> ## Documentation Index
> Fetch the complete documentation index at: https://veridical-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub App permissions and events

> What Veridical reads, what it writes, and why

## Repository permissions

| Permission    | Access         | Use                                                                         |
| ------------- | -------------- | --------------------------------------------------------------------------- |
| Metadata      | Read           | Identify the installation, repository, and pull request scope.              |
| Contents      | Read           | Materialize the exact base and head revisions for review.                   |
| Pull requests | Read and write | Read pull-request state and publish verified review comments and summaries. |
| Checks        | Write          | Publish the review state and exact-head result.                             |
| Issues        | Read           | Receive maintainer commands on pull requests.                               |

Veridical does not request repository administration, Actions secrets, workflow
write, deployments, members, or organization administration. It does not merge
pull requests.

## Webhook events

| Event                         | Use                                                                    |
| ----------------------------- | ---------------------------------------------------------------------- |
| `pull_request`                | Start, update, supersede, or close review work.                        |
| `issue_comment`               | Accept authenticated maintainer commands such as an additional review. |
| `pull_request_review_comment` | Track replies and whether a finding was acted on.                      |
| `pull_request_review_thread`  | Track resolved and unresolved review threads.                          |

GitHub supplies installation and repository-selection lifecycle events for the
app installation itself.

## Publication safety

* Work is bound to an immutable base and head.
* A moved head makes the earlier result stale and prevents it from becoming the current review.
* Comments are published only for findings that survive grounding and final verification.
* Duplicate webhook deliveries are idempotent.
* Maintainer commands are accepted only from GitHub-recognized repository insiders.
* Veridical never auto-merges.

Uninstalling the app or removing a repository stops new work for that scope.