frozen-repo change (REQ-27 approval queue): README.md

README.md

@@ -1,13 +1,75 @@
-# coreci/executor-config — coreci-executor (Write Executor, Design v1.0)
+# coreci/executor-config — approval-request queue (repurposed, REQ-27)
 
-Single governed write rail from Open WebUI agents to Gitea.
-- `allowlist.yaml` — policy engine config (AUTO_RUN vs NEEDS_APPROVAL; fail-closed)
-- `compose.yaml` + `executor.env.example` — deployment (secrets in .env only)
-- `app/` — coreci-executor v0.1.1 (FastAPI)
-- `docs/` — approval-UI spec, runbook, Open WebUI registration guide
-- `logs/` — git-durable audit JSONL (one line per request event)
+Governance lane for CoreCI's executor rail (LXC 116 coreci-executor +
+LXC 117 coreci-broker — BOTH STAY RUNNING). The rail is REPURPOSED as an
+approval-request queue ONLY: operational requests from acting employees'
+pipelines are parked here, routed across the chain of command, decided by
+the resolved approver at the executor UI, mirrored to a Gitea issue lane,
+and POLLED by the requesting pipeline. The queue NEVER executes anything
+against production. This repo is FROZEN: the one-way config change below
+(a PR) is the only change channel — direct pushes are denied, no apply
+pipeline lives here, and there is no CI: the deploy step is the on-host,
+operator-gated reconcile in `docs/approval-queue-runbook.md`.
 
-Governance: agent authors -> executor gates -> PO approves (NEEDS_APPROVAL) ->
-executor runs as `coreci-executor` (non-admin; collaborator-write ONLY on the
-repos granted in the deployment pack) -> audit + Discord notify.
-Secrets never in chat, repos, or tool calls — executor env vars only.
+## What this repo carries (post-repurpose)
+
+- `allowlist.yaml` — policy engine config, v5.0 (`mode: approval_queue_only`)
+  — every legacy AUTO_RUN grant is REVOKED; failure mode is NEEDS_APPROVAL
+  for everything (fail-closed). The revoked grants are enumerated inline.
+- `routing.json` — GENERATED approval-routing table (manager edges,
+  system owners, C-09 chairman-direct seat set; source:
+  coreci/company `org/systems-ownership.md` v1.2 + org-chart.json;
+  generator: coreci/sre `scripts/p04-executor/gen-routing-table.py`).
+  Do not hand-edit — regenerate.
+- `compose.yaml` + `executor.env.example` — deployment; secrets in `.env`
+  only (never committed).
+- `app/` — legacy classifier module (v0.1.1 history kept for the audit
+  trail). Stale vs the live rail (0.3.0 server, built on-host): do NOT
+  "restore" it — the 0.4.0 decision-only server is built from the live
+  source, per the runbook.
+- `docs/` — approval-queue runbook (this repurpose), legacy approval-ui
+  spec (kept for history), Open WebUI registration, legacy runbook.
+- `logs/` — git-durable audit JSONL (one line per queue event; see the
+  event vocabulary in the mirror contract).
+
+## The NEVER-EXECUTES guarantee (REQ-27)
+
+The queue path contains no execution of any kind:
+- the legacy job runner (pack execution on approve) is DISABLED in
+  approval-queue mode; approve/deny are decision-RECORD operations;
+- no script execution, no host execution, no work-runner container —
+  `WORK_ROOT` remains only as legacy-compat storage, never a run surface;
+- the executor's own credentials (below) are scoped to the queue's WRITE
+  surface: meeting-lane issues + audit logs, nothing else;
+- the v4.1 mailbox-path AUTO_RUN exemption was app-code-level; in
+  approval-queue mode it can no longer reach an execution path (nothing
+  executes). v5.0 records its revocation inline.
+
+Routing semantics: manager-first (one chain-of-command hop) + system owner
+when an owned system is touched (both when both). Chairman-direct lane
+per C-09 (acting C-suite, CEO, coreci-sre → Chairman decides directly).
+Unresolvable chain → CEO → Chairman queue (sanctioned skip-path 2).
+Full audit: every request event is append-only JSONL under `logs/` and
+mirrored to `coreci/meetings` (labels `approval-request`,
+`approval:L2|L3`, `dept:<dept>`).
+
+## Decision surface
+
+Approvers decide at the executor UI (passcode-gated `/ui/*`) and/or read
+the mirror issue in coreci/meetings; the requesting pipeline polls
+`GET /request_status?request_id=…` (Bearer EXECUTOR_API_KEY). Requests are
+CREDENTIAL-FREE envelopes; the executor injects nothing anywhere — the
+requestor keeps its own credentials, the queue only carries their
+REQUEST for approval.
+
+## Freeze discipline
+
+- `allowlist.yaml`, `routing.json`, `executor.env.example`, `README.md`,
+  `docs/` change ONLY via PRs into this repo's `main` (one-way channel).
+- `coreci/broker` (LXC 117) is frozen on the same one-way-PR discipline.
+- No redeploy pipeline reads this repo; deployment is operator-gated
+  (runbook §"Apply the change").
+
+Executor identity: `coreci-executor` (non-admin Gitea account; its PAT
+carries only what the mirror + audit need — see
+`docs/approval-queue-runbook.md`).