From e2ab073fdcea647b7fabcfafde6c87edd4a242d9 Mon Sep 17 00:00:00 2001 From: coreci-sre Date: Sun, 18 Oct 2026 21:41:10 +0000 Subject: [PATCH] frozen-repo change (REQ-27 approval queue): executor.env.example --- executor.env.example | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/executor.env.example b/executor.env.example index 40d64fa..34073f4 100644 --- a/executor.env.example +++ b/executor.env.example @@ -1,8 +1,19 @@ -EXECUTOR_API_KEY=change-me-long-random # tool-endpoint auth (Open WebUI) -EXECUTOR_PASSCODE=change-me-web-ui-passcode # approval UI +EXECUTOR_MODE=approval_queue_only # REQ-27: the rail is an approval-queue ONLY +EXECUTOR_ROUTING_TABLE=/config/routing.json # GENERATED routing table (do not hand-edit) +EXECUTOR_MIRROR_REPO=coreci/meetings # Gitea issue mirror lane (see mirror contract) +EXECUTOR_MIRROR_LABELS=approval-request # + approval:L2|L3 + dept: per request + +# --- executor app account (Gitea) — mirror/audit writer identity ONLY ----- GITEA_URL=https://git.coreci.dev -GITEA_USER=coreci-executor -GITEA_TOKEN=paste-token-from-pack-output-here # write:repository ONLY +GITEA_USER=coreci-executor # non-admin; write:repository scope ONLY +GITEA_TOKEN=paste-token-from-pack-output-here # executor's own PAT; NEVER a seat's personal token +# Scope contract for the PAT (enforced by review, audited monthly): +# read: executor-config (queue config), meetings (issue mirror lane) +# write: meetings (issues for the approval lane + label ensure) — NOTHING else +# Rotation: docs/runbook.md (legacy "Token rotation" section applies unchanged). + +EXECUTOR_API_KEY=change-me-long-random # requestor pipelines poll auth (Bearer or X-Executor-Key) +EXECUTOR_PASSCODE=change-me-web-ui-passcode # approver UI passcode (decision surface) DISCORD_WEBHOOK_URL= # optional: approvals + outcomes -MAX_OUTPUT_TAIL=4000 -REQUEST_TIMEOUT_S=900 +MAX_OUTPUT_TAIL=4000 # legacy: kept for schema compat (no run tail exists) +REQUEST_TIMEOUT_S=900 # legacy: kept for schema compat \ No newline at end of file