Repositories

1. In the console, choose Connect for your host. Certus mints a short-lived, single-use token bound to your workspace and sends you to the host's install page.
2. Install the app and choose which repositories it can see — all of them, or a list you pick.
3. The host returns you to Certus with the installation. The token you left with is what binds that installation to your workspace; nothing the callback asserts is trusted for that.
4. Certus starts the first index. Until it finishes, runs on that repository report as blocked with a reason rather than being served a partial model.

The token expires in ten minutes and can be used once. If you take longer, or the page is reloaded, press Connect again — it costs one retry and nothing else.

You never type a host credential into Certus. The connection is an app installation you grant and can revoke at the host, which is a different and better thing than handing over a token.

metadata: read

To see the repositories the installation covers.

contents: write

To read the code, and to open a branch under certus/ when a refined environment recipe is proposed. Certus never pushes to your branches.

pull_requests: write

To post the verdict as a comment and keep it updated in place.

checks: write

To publish the check that reports the verdict.

issues: write

To link proof debt to the issue that owns the feature.

Refused on principle, and not requested: administration, secrets, actions, workflows, members, commit statuses, and anything scoped to the organization rather than to the repositories you chose.

Certus subscribes to pull request activity and to re-run requests on its own check. It does not listen to pushes.

One check, named Certus, and one comment that is edited in place rather than reposted. The comment carries the verdict line, a table of claims with their frontier, the proof that ran and the grade, the evidence root with a link to replay, and the gate reasons if any.

The check's conclusion maps from the verdict and never lies about which of the five happened.

VERIFIED

Success.

VERIFIED_WITH_DEBT

Success. The debt is in the comment.

FAILED

Failure.

INCONCLUSIVE

Neutral. The proof established nothing; that is not a failure of your change.

BLOCKED

Neutral. Nothing was attempted, so nothing is being reported about your code.

Where a host limits comment length, the digest continues into a second comment rather than dropping a proved row. It is never a second topic.

Not configured

The deployment is missing credentials for that host. The row lists the missing variable names — names only, never values.

Ready to attach

Configured, and nothing connected yet. Press Connect.

Connected

An installation is bound to your workspace, with the repository count.

Needs attention

Connected, but something did not complete: repository discovery failed, a webhook did not register, or a public address or webhook secret is not declared.

Not connected

Configured and unbound. If the app is visibly installed at the host, see below.

Where Certus could not reach the engine to answer at all, the row states that rather than showing you a confident “not connected”.

The app is installed at the host but Certus says not connected

The install never returned an installation and a workspace token together, so Certus never learned whose it was. Press Connect from the console rather than installing from the host's own page.

“Not configured” with an empty list of missing names

A credential is present and was rejected. Nearly always a private key that lost its line breaks when the environment file was written.

Runs report as blocked on indexing

The first index has not finished. It runs once per repository at connection time, never inside a pull request.

No check appears on a pull request

Check deliveries at the host. A rejected signature means the webhook secret does not match; a rejected credential means the app's own key does not — two different rotations, and Certus keeps them distinct so you fix the right one.

You disconnected and the webhook is still there

Disconnecting forgets the grant on the Certus side. Removing the installation is done at the host, which is where you granted it.