Enable pull-request delivery

Repository discovery is read-only. Delivering a tested change needs a second, separately validated bot credential with an exact allowlist of repositories it may write to. AI runners never receive this credential.

Configure

On the source’s card, choose Configure.
Keep or edit the Connection name, and paste the bot’s Access token: a token belonging to a bot or machine account with push permission on every repository you will allowlist (for GitHub, a personal access token for that account; the App used for discovery is not reused). It is validated with the provider, encrypted, and never displayed again.
Under Repositories allowed for pull requests, tick each repository. Only repositories the read-only source can see and read are offered, and at least one is required.
Choose Enable PR delivery.

Validation checks the bot’s login and confirms push, maintain, or admin permission on every allowlisted repository. A bot that lacks write access to any entry is refused.

Operate

The card shows PR delivery enabled, the bot login, the credential validation state, and the allowlist. Check credential re-verifies it at any time.
Edit settings changes the name and allowlist. Rotate token replaces the credential after revalidation, and is blocked while unsaved settings changes exist.
Disable removes the bot credential. Existing branches and pull requests are unaffected.

How delivery uses it

At delivery the broker requires an exact, case-sensitive match between the plan’s owner/name and the allowlist, the same source connection and provider, and the provider’s canonical origin. It fetches the exact base commit (a moved base fails the run with a request for a fresh plan), applies the bounded patch, refuses any file outside the plan’s affected paths, and opens one deterministic pull request. If that pull request already exists and is open it is reused; if it was closed the run fails rather than opening a duplicate.