Which key did that repository trust?

A client says a server can still push, or says the key was removed when the person left. Tonight, three proofs, in a repository the agency or the client can open. Name the key that repository trusted: the key id, the title, and whether it can write. If the list is empty, write that, and do not invent a title to fill the hole. Show a different key whose id or read-only flag is not this one. Show another client's repository that does not list this key. If any of the three needs a dashboard you cannot open, you have not named the key. You have a slide and a guess.

This is the deploy key on one repository. It is not the ruleset. Which ruleset did that push hit? is the ruleset id, the name, and the enforcement. A ruleset can be active while this key was never added. It is not the role. Which role did that invite grant? is an invitation role. A role on a person is not a key on a repository, and removing the person does not remove the key. It is not the branch. Which branch did that pull target? is a base ref. A ref is not a public key. It is not the meter an event named, and it is not the image a prompt returned. Those are different objects, and they are not this key id.

None of what follows is a permission grant for this client, and none of it is legal advice. The fields below are one host's current description of a deploy key, and the list, the create response, and the get response print the same object. The counts below that are a paper about other accounts' user keys, not about this repository. A title on an example is not a census of your servers. A paper that counted public keys on user accounts cannot name the key on the repository you opened tonight. They do tell you which numbers people mix up when they try to sound precise about a key they have not opened.

GitHub's list, create, and get samples print one deploy key, three times. id is 1. key is ssh-rsa AAA... 14 characters, and the ellipsis means the sample is not a key you can match. url is https://api.github.com/repos/octocat/Hello-World/keys/1. 55 characters. title is octocat@octomac. 15 characters. verified is true. created_at is 2014-12-10T15:53:42Z. 20 characters. read_only is true. added_by is octocat. 7 characters. last_used is 2022-01-10T15:53:42Z. 20 characters, the same length as created_at, and not the same string. enabled is true. The clock time is 15:53:42 on both stamps. The dates are not the same day. From 2014-12-10 to 2022-01-10 is 2588 days. 2588 times 86400 is 223603200 seconds exactly. 7 times 365 is 2555. The two leap days in that span, 2016 and 2020, make 2557 days from 10 December 2014 to 10 December 2021. December 10 to January 10 is 31 days. 2557 plus 31 is 2588. That addition matches. Hello-World is 11 characters. octocat is 7. The title's octomac is not octocat. 15 is not 7, and 15 is not 11. id 1 is the same integer on the list, the create response, and the get. Three copies of one object are not three keys (GitHub, REST API endpoints for deploy keys).

The same pages name limits the sample does not sit on. per_page default is 30. The maximum is 100. page default is 1. The list sample contains 1 key. 1 is not 30, and 30 is not 100. 100 divided by 30 is 3.333, which is not an integer, and the page does not print 3.333. The create request sends title octocat@octomac, key ssh-rsa AAA..., and read_only true. It sends the flag. You cannot read the default off a request that set the flag. The note on the page says most endpoints use X-GitHub-Api-Version 2026-03-10. 10 characters. 2026 is not 2014, and 2026 is not 2022. Deploy keys are immutable. The delete response is 204 with no body. 204 is not 201, and 204 is not id 1. A deleted key is not a key you can edit in place.

The page lists activities that delete a key and activities that do not, and one of them is said twice. Deleting a personal access token deletes the key. Regenerating that token does not. Revoking an OAuth app token deletes the key. Revoking a GitHub App user access token does not. Uninstalling or deleting the app does not. Regenerating the personal access token is then said again in the list of activities that do not delete the key. That is six sentences and five distinct activities. 6 is not 5. Two of the five delete the key. Three do not. 2 plus 3 is 5. A sentence repeated is not a second activity. Write access is a different fact from deletion. The create page says a deploy key with write access can perform the same actions as an organization member with admin access, or a collaborator on a personal repository. read_only true on the sample is the opposite of that sentence. true is not a write grant. Admin is not a title of 15 characters.

The managing-deploy-keys page agrees on the shape and adds limits the sample does not store. A deploy key grants access to a single repository. The private part stays on the server. You cannot reuse one key for a second repository. The page says deploy keys are read-only by default, are usually not protected by a passphrase, do not have an expiry date, and are not removed when the user who created them is removed from the repository. That is four cons. 4 is not 5, and a cons list is not the sample's id. The sample has no expiry field at all. A missing field is not a date, and it is not last_used. last_used being 2588 days after created_at is a use stamp, not an expiry. The page also says a key with write access can push. The sample's read_only is true, so this sample is not that key (GitHub, Managing deploy keys).

The study people reach for when they want a key count is a different registry. Abubakar Sadiq Shittu, John Sadik, Farzin Gholamrezae, and Scott Ruoti report 2,737,649 GitHub accounts, 71,694 active contributors, 16,112,439 commits, and 874,198 repositories. The key-only dataset is 208,546 unique public keys across 122,050 users, evaluated at a snapshot of 31 December 2025. 208,546 divided by 122,050 is 1.7087. The page does not print 1.7087. 2,737,649 minus 71,694 is 2,665,955. The page does not print 2,665,955. The page header prints a conference line dated June 2018, an ISBN containing 2018, and a copyright line of 2018, on a paper whose key section uses 31 December 2025. 2025 minus 2018 is 7. The page does not print 7. 2018 is not 2025, and a user-account key is not a deploy key id of 1 (Shittu, Sadik, Gholamrezae, and Ruoti, Analysis of Commit Signing on Github).

The same paper's percentages do not all sit on the integer they look like, and one subtraction is not the fraction it sits near. The 2% cohort is 87.9% complete, 71,694 of 81,540 users. 71,694 divided by 81,540, times 100, is 87.92, which rounds to the 87.9 they print. 89% of users authored at least one signed commit, and the sentence gives 63,961 out of 71,694. 63,961 divided by 71,694, times 100, is 89.21. Table 3 prints 89.21. The prose sentence prints 89. 89.21 is not 89. It also says 59%, 37,557, sign their first commit. 37,557 divided by 63,961, times 100, is 58.719. 58.719 is not 59. Only 2.81% of keys, 5,858 of 208,546, have an expiry. 5,858 divided by 208,546, times 100, is 2.809, which rounds to the 2.81 they print. Of those, 3,096 had expired, 52.85%. 3,096 divided by 5,858, times 100, is 52.851, which rounds to 52.85. 5,858 minus 3,096 is 2,762. The page does not print 2,762. It says 99.81% of expired keys remain unrevoked. 0.9981 times 3,096 is 3090.1176, which is not an integer count of keys. The page does not print 3090.1176. Median lifetime is 730 days, the upper quartile 1,460, the 95th percentile 3,650 days, which the sentence calls 10 years. 365 times 2 is 730. 365 times 4 is 1,460. 365 times 10 is 3,650. 365.25 times 10 is 3,652.5. 3,652.5 is not 3,650. E2E commits by users who signed at least once are 2,607,634, of which 669,477 are signed, 25.67%. 669,477 divided by 2,607,634, times 100, is 25.674, which rounds to 25.67. The sentence then says roughly one in four. One in four is 25, and 25 is not 25.67. Table 3's UI commit fraction is 20.63% on the 2% cohort. 16,112,439 minus 12,754,615 is 3,357,824. 3,357,824 divided by 16,112,439, times 100, is 20.84. 20.84 is not 20.63, and the two rows do not even share a user count: 71,694 against 61,364. A subtraction of those two commit totals is not the fraction the table prints. 5,858 is not id 1, and 208,546 is not a key on Hello-World.

Do the three proofs on one real key, in the repository that actually holds it. First, the binding. Copy the key id, the title, and read_only. If the list is empty, write empty. Do not infer id 1 because a sample prints it, and do not infer a write grant because a sentence on the page describes admin. If the only fact you have is that someone on the team once had access, write that, and write that a deploy key is not removed when that person is removed. Second, the other key. A different key, with a different id or a different read_only value, is not this one. A table of 208,546 user keys is not that second key. If you cannot show a key that is not this one, you have a counter, not a record. Third, the other repository. A list that belongs to another client does not contain this key id. If the only list mixes every client's servers, write that. A tenant you cannot name is the finding. It is not a reason to tell the client the key was removed.

Three moves feel like the proof and are a second problem. Deleting the key before you have copied the id, because the title looked old. The delete returns 204 and no body. You will not have the title if you did not copy it. Regenerating a personal access token and telling the client the key is gone. The page says regenerating does not delete the key, and it says that twice. Quoting 2.81% or 89% because one of them looks precise, while the key you were asked about is one id, and the accounts that produced those figures had not opened this repository. Asking a model which key the repository trusted. The model will pick a plausible title. It will not open the key list. A ruleset you have not kept, while the client is arguing about a push, is which ruleset did that push hit?. Opening that screen does not name the key id.

The path is ordinary when an operator can open one client's repository without opening the next client's repository as the way to prove it. Gigbase is one agency workspace: projects, teams, and clients. The shape that matters here is one client's repository you can point at, distinct from the next client's repository. That case is not a deploy-key ledger. Nothing in that sentence is a headcount, a duration, or a result figure. If the only control on the screen shows every client at once and will not name a key id, you do not have this proof. You have a directory.

There is a version of this afternoon where the agency should not take the work. The work is not sold under the agency's name. The client asked to meet the builders. The room only has a slide. The buyer only wants a template. Or the buyer wants a legal opinion about what a key promises. A white label software development partner is the page for capacity sold under the agency's name. It does not rank anyone, including us. 2.81% is not this repository, and id 1 is not this repository, and 2588 days on a sample is not this repository.

When the repository is real and the key is not on a screen you can open, the missing object is specific. The id, the title, and the read-only flag, a different key that is not that one, and another client's repository that does not list it. A white-label engagement that expects this will put the repository in the client's organization, or in yours, before the first deploy, because a key that lives only on a vendor laptop is not an id you can hand the client. One that can only paste a screenshot is telling you who holds the private half. Where the next slice is one capability and the acceptance sentence names the key id, an AI integration sprint is the shape that can require the three proofs as the definition of done. Where you are not sure which repository the current engagement can still reach, a two-week AI readiness assessment maps the systems. The findings are yours. They are not a promise that 2.81% of this tree has an expiry, and they are not id 1. The control that decides who may add the key is an AI security and compliance services question only after the key itself has an id.

The meter an event named, and the image a prompt returned, are different objects: which meter did that event name? and which image did that prompt return?. Do not record either on this page. An event name is not a key id. A model name is not a title.

Before you tell the client which key the server used, write the three lines. The key id, the title, and whether it can write, or a written line that the list was empty. A different key that is not that one. Another repository that does not hold it. Do not regenerate a token and call that a deletion, and do not ask a model which of the sample titles it was. A paper can tell you how other accounts' user keys were left unrevoked, including the 99.81% that is not a whole number of the 3,096. The binding is the key you can defend.