The gateway can become powerful once the agent runtime has authenticated GitHub writes. Keep the first deployment conservative.

• The Python bot exposes no PR merge command and no issue close command.
• GitHub webhook payloads require HMAC verification.
• GitHub webhooks only update passive Discord mirror cards.
• Discord collaboration is mention-gated.
• PR merges are human-only through GitHub.

Prefer gh auth login in the deployment container for explicit, human-triggered agent tasks. The passive webhook publisher needs no GitHub API token.

Grant only what is needed:

• Metadata: read
• Issues: only when an explicit task needs them
• Pull requests: only when an explicit task needs them

• Rotate Discord and GitHub tokens if they are pasted into chat or logs.
• Keep .env out of commits.
• Do not expose the webhook endpoint without a secret.
• Prefer a branch protection rule so the agent runtime cannot bypass required reviews or checks.
• Do not grant bypass permissions to the authenticated CLI account.