# JK-Git accounts and machine access

| Identity | What it records | Where it is used |
| --- | --- | --- |
| One SSH deploy key per machine | Which machine pushed; write access only to its assigned repos | Created and kept on the machine. jr-run adds only its public half to the repos it needs; dev machines get every repo. It cannot push a protected branch. |
| Commit name and email | Who worked: `claude-agent`, `codex-agent`, or `westtexasfish` | Claude and Codex settings set their own commit names. A commit name is a label, not proof. |
| West Texas Fish's own device key | His own pushes and protected-branch bypass | Only his PCs, registered on the `westtexasfish` Gitea account. Never on servers. |
| `jr-team_agent` / `jr-team-review_agent` | JR-Team coding and PR review | Only on jr-team (CT 107), through Paperclip's own access. |
| `jr-run` | Repository, machine-key and PR standard jobs | Site-admin automation on jr-run (CT 210). |
| `claude-agent` / `codex-agent` Gitea accounts | JK-Git MCP review comments and Claude cloud sessions | These accounts do not push from lab machines. |

Your Git setup comes from the machine you are on. Push your branch when it is
ready: jr-run opens a PR automatically, requests and assigns
`jr-team-review_agent`, and enables auto-merge after approval. Name a branch
`wip/...` to save unfinished work without opening a PR. Do not change Git
identity, keys or remotes, do not run setup scripts, and never ask anyone to
make a key.

On the jr-team server, JR-Team agents push as `jr-team_agent` and open their
own PRs. Request review from `jr-team-review_agent` and turn on auto-merge.
The PR Reviewer reviews; it does not push or merge. The source branch is
removed after merge.