The family's repos service. The hub calls it for repositories, pull requests, issues, CI, files and commits, and for subscriptions that end with a signed signal when CI settles, a pull request merges, a review lands or a job finishes. It holds no GitHub credential of its own: each request carries a keyring token and names a profile, and the service resolves that person's credential from keyring for the call. Everything it answers is a fixed, narrow projection; no raw GitHub payload ever leaves it.
What stands out
- No credential of its own: resolved per request from keyring
- Fixed, narrow projections instead of raw GitHub payloads
- Subscriptions that end with a signed signal when CI settles or a pull request merges