frozen-repo change (REQ-27 approval queue): executor.env.example

executor.env.example

@@ -1,8 +1,19 @@
-EXECUTOR_API_KEY=change-me-long-random        # tool-endpoint auth (Open WebUI)
-EXECUTOR_PASSCODE=change-me-web-ui-passcode   # approval UI
+EXECUTOR_MODE=approval_queue_only             # REQ-27: the rail is an approval-queue ONLY
+EXECUTOR_ROUTING_TABLE=/config/routing.json   # GENERATED routing table (do not hand-edit)
+EXECUTOR_MIRROR_REPO=coreci/meetings          # Gitea issue mirror lane (see mirror contract)
+EXECUTOR_MIRROR_LABELS=approval-request       # + approval:L2|L3 + dept:<dept> per request
+
+# --- executor app account (Gitea) — mirror/audit writer identity ONLY -----
 GITEA_URL=https://git.coreci.dev
-GITEA_USER=coreci-executor
-GITEA_TOKEN=paste-token-from-pack-output-here # write:repository ONLY
+GITEA_USER=coreci-executor                    # non-admin; write:repository scope ONLY
+GITEA_TOKEN=paste-token-from-pack-output-here # executor's own PAT; NEVER a seat's personal token
+# Scope contract for the PAT (enforced by review, audited monthly):
+#   read:  executor-config (queue config), meetings (issue mirror lane)
+#   write: meetings (issues for the approval lane + label ensure) — NOTHING else
+# Rotation: docs/runbook.md (legacy "Token rotation" section applies unchanged).
+
+EXECUTOR_API_KEY=change-me-long-random        # requestor pipelines poll auth (Bearer or X-Executor-Key)
+EXECUTOR_PASSCODE=change-me-web-ui-passcode   # approver UI passcode (decision surface)
 DISCORD_WEBHOOK_URL=                          # optional: approvals + outcomes
-MAX_OUTPUT_TAIL=4000
-REQUEST_TIMEOUT_S=900
+MAX_OUTPUT_TAIL=4000                          # legacy: kept for schema compat (no run tail exists)
+REQUEST_TIMEOUT_S=900                         # legacy: kept for schema compat