Set up, scan, review, and defend

Orient each role and route readers to the shortest successful path.

Cover first GitHub sign-in, account state, and where settings live.

Document the owning-account restriction, repository selection, permissions, and installation verification.

Explain OAuth versus a fine-grained token, required scopes, storage, rotation, and revocation.

Take a user from authenticated GitHub access to a selected repository and ref.

Explain how environment synthesis is triggered, what it builds, and how readiness is verified.

Cover the first hunt/scan trigger, options, expected stages, and completion signals.

Cover adding repositories, branches/refs, repeated scans, and repository inventory behavior.

Map job and environment states to the pages where users inspect progress, logs, and failures.

Cover cadence selection, pause/resume, last-run state, and schedule failures.

Explain finding groups, evidence, severity, confidence, status, occurrences, and deduplication.

Document that acknowledgement confirms a true positive and immediately starts Defend patch generation; rejection marks a false positive.

Cover acknowledgement-triggered and bundled patch generation, eligibility, progress, generated patches, and revalidation.

Explain the two-step PR request/approval flow, GitHub review, and merge handoff.

Document knowledge cards, appropriate content, lifecycle, and their effect on later scans.

Explain reversible archive controls, filters, and the boundary with deletion.

Cover mapped owners and delegated org-admins across installation, authentication, repositories, seats, and delegation.

Cover pending versus active members, reserved seats, resend/expiry, and initial repository scope and roles applied on acceptance.

Explain scope-first repository access and the named roles that refine permitted actions.

Cover seat counts, disabling, re-enabling, removing, offboarding, and limit escalation.

Cover the owning-account restriction, adding/removing repositories, permission changes, suspension, uninstall, and recovery.

Explain estate totals, action queue, top risks, repository posture, and threat registry.

Define site roles, mapped ownership, delegated org-admin, membership, repo access, named roles, and capability boundaries.

Provide one canonical state map from repository connection through environment, scan, review, defend, PR, and archive.

List GitHub App/OAuth/token permissions, why each exists, and least-privilege alternatives.

Route common install, auth, clone, environment, scan, review, defend, PR, and seat failures.