> ## Documentation Index
> Fetch the complete documentation index at: https://veridical-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub App permissions and events

> What Veridical reads, what it writes, and why

## Repository permissions

| Permission | Access | Use |
| - | - | - |
| Metadata | Read | Identify the installation, repository, and pull request scope. |
| Contents | Read | Materialize the exact base and head revisions for review. |
| Pull requests | Read and write | Read pull-request state and publish verified review comments and summaries. |
| Checks | Write | Publish the review state and exact-head result. |
| Issues | Read | Receive maintainer commands on pull requests. |

Veridical does not request repository administration, Actions secrets, workflow
write, deployments, members, or organization administration. It does not merge
pull requests.

## Webhook events

| Event | Use |
| - | - |
| `pull_request` | Start, update, supersede, or close review work. |
| `issue_comment` | Accept authenticated maintainer commands such as an additional review. |
| `pull_request_review_comment` | Track replies and whether a finding was acted on. |
| `pull_request_review_thread` | Track resolved and unresolved review threads. |

GitHub supplies installation and repository-selection lifecycle events for the
app installation itself.

## Publication safety

* Work is bound to an immutable base and head.
* A moved head makes the earlier result stale and prevents it from becoming the current review.
* Comments are published only for findings that survive grounding and final verification.
* Duplicate webhook deliveries are idempotent.
* Maintainer commands are accepted only from GitHub-recognized repository insiders.
* Veridical never auto-merges.

Uninstalling the app or removing a repository stops new work for that scope.