@@ -49,17 +49,17 @@ A repository/pipeline administrator must complete these separately:
 2. Authorize the GitHub connection to read this repository and report build
    results. Authorize each variable group and Azure service connection only for
    the intended pipelines.
-3. Disable fork PR builds for these credentialed pipelines in Azure DevOps.
-   Keep fork secrets and full-access tokens disabled. Use resource approvals and
-   checks to enforce the intended trust boundary before granting cloud access.
+3. Require maintainer approval before fork PR builds run. Keep fork secrets and
+   full-access tokens disabled. Use resource approvals and checks to enforce the
+   intended trust boundary before granting cloud access.
 4. Supply the test-resource configuration below. Use separate disposable test
    resources with permissions for deployment, invocation, evidence retrieval and
    cleanup; never production resources.
 
-The YAML also gates PR runs on `System.PullRequest.IsFork` being explicitly
-`False`. Missing or true values skip the cloud path. This is defense in depth,
-not a substitute for Azure DevOps authorization: a PR can change its YAML.
-Skipped cloud runs are not evidence of a successful live test.
+Repository settings gate fork PR builds on maintainer approval. The YAML does
+not independently reject fork PRs, so resource approvals and checks must
+protect credentials and cloud access: a PR can change its YAML. Fork PRs that
+are not approved do not produce evidence of a successful live test.
 
 Service-connection, variable-group and required-status settings are external to
 this repository. These files do not alter GitHub merge rules or activate a
 
@@ -8,8 +8,9 @@
 #
 # Discovery, deploy, invoke and assertion behavior uses repository-local
 # helpers; authentication, matrices, artifacts and annotations are ADO-native.
-# Operators must disable fork builds and restrict/approve the service
-# connection outside YAML before enabling this credentialed pipeline.
+# Repository settings require maintainer approval before fork PR builds run.
+# Restrict/approve the service connection outside YAML before enabling this
+# credentialed pipeline.
 #
 # Infrastructure modes:
 #   - SKIP_PROVISION=true (default): uses an existing Foundry project. Requires
@@ -98,18 +99,11 @@ stages:
   # Runs unless the kill-switch is explicitly set to 'false'. It is deliberately
   # not gated on `eq(..., 'true')`: an unset variable would then skip every
   # stage and report a false pass. Missing configuration fails in the guard
-  # step below instead. PRs also require an explicitly non-fork source; missing
-  # fork metadata fails closed. This guard is not a service-connection approval.
+  # step below instead. Fork PR execution is controlled by the repository's
+  # maintainer-approval setting, not by this stage condition.
   - stage: Discover
     displayName: Discover Samples
-    condition: |
-      and(
-        ne(variables['CLOUD_E2E_ENABLED'], 'false'),
-        or(
-          ne(variables['Build.Reason'], 'PullRequest'),
-          eq(variables['System.PullRequest.IsFork'], 'False')
-        )
-      )
+    condition: ne(variables['CLOUD_E2E_ENABLED'], 'false')
     jobs:
       - job: DiscoverSamples
         displayName: Build sample matrix
 
@@ -186,17 +186,16 @@ def test_discovery_uses_shared_exact_skiplist_matching(self):
         self.assertNotIn('/.ci-skip', discovery)
         self.assertNotIn('/.code-ci-skip', discovery)
 
-    def test_discovery_requires_explicit_nonfork_pr(self):
+    def test_discovery_allows_approved_fork_pr(self):
         discover = next(
             stage for stage in PIPELINE["stages"] if stage.get("stage") == "Discover"
         )
         condition = re.sub(r"\s+", "", discover["condition"])
         self.assertEqual(
             condition,
-            "and(ne(variables['CLOUD_E2E_ENABLED'],'false'),"
-            "or(ne(variables['Build.Reason'],'PullRequest'),"
-            "eq(variables['System.PullRequest.IsFork'],'False')))",
+            "ne(variables['CLOUD_E2E_ENABLED'],'false')",
         )
+        self.assertNotIn("System.PullRequest.IsFork", condition)
         cloud_stage = next(iter(SHARDS.values()))[0]
         self.assertIn("Discover", cloud_stage["dependsOn"])
         self.assertIn("succeeded('Discover')", cloud_stage["condition"])