78 lines
4.1 KiB
Markdown
78 lines
4.1 KiB
Markdown
# coreci/executor-config — approval-request queue (repurposed, REQ-27)
|
|
|
|
**TL;DR** — this repository. This file explains how to stand it up and who to contact; the machinery detail stays lower under Details.
|
|
|
|
|
|
Governance lane for CoreCI's executor rail (LXC 116 coreci-executor +
|
|
LXC 117 coreci-broker — BOTH STAY RUNNING). The rail is REPURPOSED as an
|
|
approval-request queue ONLY: operational requests from acting employees'
|
|
pipelines are parked here, routed across the chain of command, decided by
|
|
the resolved approver at the executor UI, mirrored to a Gitea issue lane,
|
|
and POLLED by the requesting pipeline. The queue NEVER executes anything
|
|
against production. This repo is FROZEN: the one-way config change below
|
|
(a PR) is the only change channel — direct pushes are denied, no apply
|
|
pipeline lives here, and there is no CI: the deploy step is the on-host,
|
|
operator-gated reconcile in `docs/approval-queue-runbook.md`.
|
|
|
|
## What this repo carries (post-repurpose)
|
|
|
|
- `allowlist.yaml` — policy engine config, v5.0 (`mode: approval_queue_only`)
|
|
— every legacy AUTO_RUN grant is REVOKED; failure mode is NEEDS_APPROVAL
|
|
for everything (fail-closed). The revoked grants are enumerated inline.
|
|
- `routing.json` — GENERATED approval-routing table (manager edges,
|
|
system owners, C-09 chairman-direct seat set; source:
|
|
coreci/company `org/systems-ownership.md` v1.2 + org-chart.json;
|
|
generator: coreci/sre `scripts/p04-executor/gen-routing-table.py`).
|
|
Do not hand-edit — regenerate.
|
|
- `compose.yaml` + `executor.env.example` — deployment; secrets in `.env`
|
|
only (never committed).
|
|
- `app/` — legacy classifier module (v0.1.1 history kept for the audit
|
|
trail). Stale vs the live rail (0.3.0 server, built on-host): do NOT
|
|
"restore" it — the 0.4.0 decision-only server is built from the live
|
|
source, per the runbook.
|
|
- `docs/` — approval-queue runbook (this repurpose), legacy approval-ui
|
|
spec (kept for history), Open WebUI registration, legacy runbook.
|
|
- `logs/` — git-durable audit JSONL (one line per queue event; see the
|
|
event vocabulary in the mirror contract).
|
|
|
|
## The NEVER-EXECUTES guarantee (REQ-27)
|
|
|
|
The queue path contains no execution of any kind:
|
|
- the legacy job runner (pack execution on approve) is DISABLED in
|
|
approval-queue mode; approve/deny are decision-RECORD operations;
|
|
- no script execution, no host execution, no work-runner container —
|
|
`WORK_ROOT` remains only as legacy-compat storage, never a run surface;
|
|
- the executor's own credentials (below) are scoped to the queue's WRITE
|
|
surface: meeting-lane issues + audit logs, nothing else;
|
|
- the v4.1 mailbox-path AUTO_RUN exemption was app-code-level; in
|
|
approval-queue mode it can no longer reach an execution path (nothing
|
|
executes). v5.0 records its revocation inline.
|
|
|
|
Routing semantics: manager-first (one chain-of-command hop) + system owner
|
|
when an owned system is touched (both when both). Chairman-direct lane
|
|
per C-09 (acting C-suite, CEO, coreci-sre → Chairman decides directly).
|
|
Unresolvable chain → CEO → Chairman queue (sanctioned skip-path 2).
|
|
Full audit: every request event is append-only JSONL under `logs/` and
|
|
mirrored to `coreci/meetings` (labels `approval-request`,
|
|
`approval:L2|L3`, `dept:<dept>`).
|
|
|
|
## Decision surface
|
|
|
|
Approvers decide at the executor UI (passcode-gated `/ui/*`) and/or read
|
|
the mirror issue in coreci/meetings; the requesting pipeline polls
|
|
`GET /request_status?request_id=…` (Bearer EXECUTOR_API_KEY). Requests are
|
|
CREDENTIAL-FREE envelopes; the executor injects nothing anywhere — the
|
|
requestor keeps its own credentials, the queue only carries their
|
|
REQUEST for approval.
|
|
|
|
## Freeze discipline
|
|
|
|
- `allowlist.yaml`, `routing.json`, `executor.env.example`, `README.md`,
|
|
`docs/` change ONLY via PRs into this repo's `main` (one-way channel).
|
|
- `coreci/broker` (LXC 117) is frozen on the same one-way-PR discipline.
|
|
- No redeploy pipeline reads this repo; deployment is operator-gated
|
|
(runbook §"Apply the change").
|
|
|
|
Executor identity: `coreci-executor` (non-admin Gitea account; its PAT
|
|
carries only what the mirror + audit need — see
|
|
`docs/approval-queue-runbook.md`). |