I started an FAQ list with answers to these questions.

That is correct. My general assumption has been that you would allow CI machines to write AC entries and those would then also be able to populate the remote repo contents. Devs could then consume those just fine. Are you really referring to a setup in which Bazel itself never writes AC entries but remote executors do so directly?

Are you really referring to a setup in which Bazel itself never writes AC entries but remote executors do so directly?

Yes that's precisely correct. I believe BuildBuddy and BuildBarn support this configuration.

I think the feature is still great and I'll enable it in most environments, but I think it's important to point out what it entails.

This would be difficult to support since it's completely unclear how to remotely execute (even a reproducible) repo rule - this would essentially require turning Bazel into a standalone Starlark interpreter of sorts. I guess at that point it would be easier to set up a trusted "repo rule evaluation" machine running regular Bazel?

Yes, sorry. I think we are talking about different things.
I was merely saying that it's a common setup to prevent writes to the AC from Bazel.
I agree that it's extremely hard to work around that limitation.