GitHub App permissions and events

What Veridical reads, what it writes, and why

Repository permissions

Permission	Access	Use
Metadata	Read	Identify the installation, repository, and pull request scope.
Contents	Read	Materialize the exact base and head revisions for review.
Pull requests	Read and write	Read pull-request state and publish verified review comments and summaries.
Checks	Write	Publish the review state and exact-head result.
Issues	Read	Receive maintainer commands on pull requests.

Veridical does not request repository administration, Actions secrets, workflow write, deployments, members, or organization administration. It does not merge pull requests.

Webhook events

Event	Use
pull_request	Start, update, supersede, or close review work.
issue_comment	Accept authenticated maintainer commands such as an additional review.
pull_request_review_comment	Track replies and whether a finding was acted on.
pull_request_review_thread	Track resolved and unresolved review threads.

GitHub supplies installation and repository-selection lifecycle events for the app installation itself.

Publication safety

• Work is bound to an immutable base and head.
• A moved head makes the earlier result stale and prevents it from becoming the current review.
• Comments are published only for findings that survive grounding and final verification.
• Duplicate webhook deliveries are idempotent.
• Maintainer commands are accepted only from GitHub-recognized repository insiders.
• Veridical never auto-merges.

Uninstalling the app or removing a repository stops new work for that scope.