version: 5.0
mode: approval_queue_only
# allowlist v5.0 — approval-request queue repurpose (REQ-27, P04-04).
#
# CHANGE SHAPE (one-way PR into the FROZEN executor-config repo):
#   v4.x classified packs and auto-ran granted targets. The rail is now an
#   approval-request queue ONLY — it routes, records, mirrors, and reports;
#   it NEVER executes against production.
#
# REVOKED in v5.0 (the complete v4.1 grant set — nothing else ever existed):
#   - coreci-coo:       bash_pack auto_run coreci-coo/home        (revoked)
#   - coreci-cairo:     bash_pack auto_run coreci-cairo/home      (revoked)
#   - coreci-cpo:       bash_pack auto_run coreci-cpo/home        (revoked)
#   - coreci-executor:  bash_pack auto_run coreci/executor-config (revoked)
#   - defaults read_targets (coreci/company) kept UNCHANGED: the queue still
#     allows the org records as a READ surface for request context only.
#
# SEMANTICS under mode: approval_queue_only:
#   - defaults.decision stays NEEDS_APPROVAL (fail-closed) and there are no
#     agent rows: the v4.1 classifier can never return AUTO_RUN again.
#   - The v4.1 mailbox-path exemption is APP-CODE-level (not config) and
#     cannot reach an execution path here — approval-queue mode has none
#     (see README.md "The NEVER-EXECUTES guarantee").
#   - approval_queue.* below is consumed by the 0.4.0 decision-only server
#     build; the legacy 0.3.0 server ignores unknown top-level keys (its
#     loader picks only defaults/agents), so this file is backward-safe.
#
# Routing for approvals comes from routing.json (GENERATED from
# coreci/company org/systems-ownership.md v1.2 + org-chart.json — do not
# hand-edit either side of that chain; regenerate instead).
defaults:
  decision: NEEDS_APPROVAL
  timeout_s: 900            # legacy field, retained for schema compat only
  read_targets:
  - coreci/company

agents: {}                  # v5.0: NO auto-run grants remain (see REVOKED above)

approval_queue:
  enabled: true
  never_execute: true       # the queue is a decision-record surface, full stop
  routing_table: /config/routing.json
  request_id_prefix: ar     # queue ids: ar-<yyyymmdd-hhmmss>-<role>
  decision_surface: executor_ui   # + Gitea issue mirror (coreci/meetings)
  mirror:
    repo: coreci/meetings
    actor: coreci-executor  # executor app account; PAT scoped to writes below
    labels:
    - approval-request
    - approval:L2           # emitted alongside approval:L3 per request class
    - dept:<dept>           # resolved from the requestor's org-chart ancestor
  lanes:
  - chairman_direct         # C-09: acting C-suite, CEO, coreci-sre requests
  - manager_owner           # manager one hop + system owner (both when both)
  - skip_path               # unresolvable -> CEO -> Chairman
  statuses:
  - open
  - routed
  - decided                 # decided (approved|rejected, decided_by, decided_at)
  - withdrawn               # requestor abort before decision