REQ-27: executor rail repurposed as approval-request queue ONLY (P04, one-way frozen-repo change) #1

2026-10-18T21:41:12Z

coreci-sre commented

2026-10-18 21:41:12 +00:00

One-way frozen-repo change — executor approval-request queue (REQ-27, C-09)

Repurposes the executor rail (LXC 116 coreci-executor + LXC 117 coreci-broker, BOTH STAY RUNNING) as a DECISION-RECORD approval queue: park -> route -> decide -> mirror -> poll. The queue NEVER executes anything against production.

Carries (mirror-of-tree, verbatim transfer):

allowlist.yaml v5.0 (mode: approval_queue_only; ALL v4.1 auto-run grants revoked, enumerated inline)
routing.json — GENERATED from coreci/company org/systems-ownership.md v1.2 + org-chart.json (never hand-edited)
README.md — governance rewrite (frozen + one-way PR channel + NEVER-EXECUTES guarantee)
executor.env.example — executor app-account mirror config (placeholder-only)
docs/approval-queue-runbook.md — queue model, operator-gated apply/rollback, post-apply asserts

Design + mirror contract: coreci/sre scripts/p04-executor/DESIGN.md (scripts/p04-executor/).
After merge (operator-gated): git pull --ff-only on the LXC 116 config clone (hot-read: allowlist takes effect without restart) + the 0.4.0 decision-only server build per the runbook. This PR closes nothing.

# One-way frozen-repo change — executor approval-request queue (REQ-27, C-09) Repurposes the executor rail (LXC 116 coreci-executor + LXC 117 coreci-broker, BOTH STAY RUNNING) as a DECISION-RECORD approval queue: park -> route -> decide -> mirror -> poll. The queue NEVER executes anything against production. Carries (mirror-of-tree, verbatim transfer): - `allowlist.yaml` v5.0 (`mode: approval_queue_only`; ALL v4.1 auto-run grants revoked, enumerated inline) - `routing.json` — GENERATED from coreci/company org/systems-ownership.md v1.2 + org-chart.json (never hand-edited) - `README.md` — governance rewrite (frozen + one-way PR channel + NEVER-EXECUTES guarantee) - `executor.env.example` — executor app-account mirror config (placeholder-only) - `docs/approval-queue-runbook.md` — queue model, operator-gated apply/rollback, post-apply asserts Design + mirror contract: coreci/sre scripts/p04-executor/DESIGN.md (`scripts/p04-executor/`). After merge (operator-gated): `git pull --ff-only` on the LXC 116 config clone (hot-read: allowlist takes effect without restart) + the 0.4.0 decision-only server build per the runbook. This PR closes nothing.

coreci-sre added 5 commits 2026-10-18 21:41:12 +00:00

frozen-repo change (REQ-27 approval queue): README.md f28576f0a8

frozen-repo change (REQ-27 approval queue): allowlist.yaml 822eadb386

frozen-repo change (REQ-27 approval queue): executor.env.example e2ab073fdc

frozen-repo change (REQ-27 approval queue): routing.json 24e1e91ee1

frozen-repo change (REQ-27 approval queue): docs/approval-queue-runbook.md eb6009160d

coreci-sre added 1 commit 2026-10-18 21:41:12 +00:00

frozen-repo change (REQ-27 approval queue): docs/approval-queue-runbook.md eb6009160d

coreci-sre merged commit ce45e4ca4d into main

2026-10-18 23:37:40 +00:00

Sign in to join this conversation.