From first signalto first governed fix

Sign in with the account that owns the repositories you want Aegis to observe. You approve the OAuth connection on your provider's own screen and can revoke it there.

Aegis reads coverage, duplication, dependency, and static-analysis reports from your existing CI. Use the repository-scoped upload token so report ingestion never needs account credentials.

curl -X POST https://app.aegis.dev/api/coverage/upload \
  -H "Content-Type: application/json" \
  -d '{
    "repository": "your-org/your-repo",
    "token": "$AEGIS_TOKEN",
    "commit": "$CI_COMMIT_SHA",
    "branch": "$CI_COMMIT_BRANCH",
    "buildId": "$CI_JOB_ID",
    "coverage": "'"$(base64 -w0 coverage/lcov.info)"'"
  }'

Choose a failing build, low-coverage file, duplicate block, static finding, or AI-triage suggestion. Aegis queues only the action and writable scope needed for that target.

A Truemark-operated per-client runner claims the work, uses its local source checkout and client-provided credentials, then submits proposed files, a summary, and any evidence. It cannot write to the repository.

See the proposed diff, evidence origin and completeness, and run cost together. Reject the result or explicitly approve write-back. Current evidence is labeled self-attested, not Aegis-verified.

After approval, Aegis writes the approved files to the intended branch or opens a PR/MR. Normal provider review still decides the merge; Aegis records the merge and any later revert.