CMU inbox — personal API access

1. Sign in at https://bugs.cmu14.com with your own staff Discord account.
2. Click API key, then Create key. Copy it into your tool's private credential setting.
3. Send it as: Authorization: Bearer YOUR_KEY

The key can read this inbox's reports and replies and submit Fixed proposals.
It cannot approve proposals, notify Discord, mark duplicates, reopen reports,
or manage other keys. Your current staff access is checked on every request.
Submissions use the account that created the key; MasterCaution's submissions
are attributed to MasterCaution. The reviewer who approves is credited on Discord.

READ REPORTS
GET https://bugs.cmu14.com/api/agent/reports
Response: { "reports": [...] }

READ ONE REPORT
GET https://bugs.cmu14.com/api/agent/reports/REPORT_ID
Response: { "report": { "id": ..., "revision": ..., "description": ..., ... } }

READ REPLIES AND EVIDENCE
GET https://bugs.cmu14.com/api/agent/reports/REPORT_ID/discussion
Use ?before=MESSAGE_ID for earlier replies when nextBefore is returned.

SUBMIT A FIX FOR APPROVAL
PATCH https://bugs.cmu14.com/api/agent/reports/REPORT_ID
Content-Type: application/json
Authorization: Bearer YOUR_KEY

{
  "revision": 7,
  "requestId": "64 lowercase hexadecimal characters",
  "commit": "the full 40-character lowercase Git commit SHA",
  "summary": "What the fix changes and how it was checked",
  "action": { "type": "status", "status": "fixed" }
}

Read the report first and use its current revision. Generate a requestId once
(for example, 32 random bytes encoded as hex) and reuse it with the same payload
when retrying. The summary must contain 1–1,500 characters.

A successful HTTP 200 response contains report.activity[].agent.review.state
of "pending" for a new proposal. The report is not yet marked fixed, and no
message is sent to Discord. A reviewer approves it in the website.

401: missing, invalid, or revoked key.
403: no current staff access, wrong guild, or an operation outside this key's scope.
409: stale revision or reused requestId with a different owner/payload. Read the
latest report and review changes before making a new submission.

Keys are shown only when created and remain active until revoked or staff access
is removed. To replace a key: open API key, Revoke key, then Create key. Revocation
does not delete your submitted proposals or change another person's access.
Keep the key out of URLs, shared chats, and source control.