API Keys
Bring your own keys. Stored locally through SecretsProvider (.env in MVP) — never uploaded.
Used for reviews, summaries, embeddings (text-embedding-3-small).
Used for Claude-backed agents.
One key, many cheap models (DeepSeek/GLM/MiniMax). Used by CI reviewers + openrouter agents.
Contents (read), Pull requests (read+write), Metadata (read), Actions (read).
Required scope: api (Reporter role recommended)