Governance lane for CoreCI's executor rail (LXC 116 coreci-executor + LXC 117 coreci-broker — BOTH STAY RUNNING). The rail is REPURPOSED as an approval-request queue ONLY: operational requests from acting employees' pipelines are parked here, routed across the chain of command, decided by the resolved approver at the executor UI, mirrored to a Gitea issue lane, and POLLED by the requesting pipeline. The queue NEVER executes anything against production. This repo is FROZEN: the one-way config change below (a PR) is the only change channel — direct pushes are denied, no apply pipeline lives here, and there is no CI: the deploy step is the on-host, operator-gated reconcile in docs/approval-queue-runbook.md.

What this repo carries (post-repurpose)

allowlist.yaml — policy engine config, v5.0 (mode: approval_queue_only) — every legacy AUTO_RUN grant is REVOKED; failure mode is NEEDS_APPROVAL for everything (fail-closed). The revoked grants are enumerated inline.
routing.json — GENERATED approval-routing table (manager edges, system owners, C-09 chairman-direct seat set; source: coreci/company org/systems-ownership.md v1.2 + org-chart.json; generator: coreci/sre scripts/p04-executor/gen-routing-table.py). Do not hand-edit — regenerate.
compose.yaml + executor.env.example — deployment; secrets in .env only (never committed).
app/ — legacy classifier module (v0.1.1 history kept for the audit trail). Stale vs the live rail (0.3.0 server, built on-host): do NOT "restore" it — the 0.4.0 decision-only server is built from the live source, per the runbook.
docs/ — approval-queue runbook (this repurpose), legacy approval-ui spec (kept for history), Open WebUI registration, legacy runbook.
logs/ — git-durable audit JSONL (one line per queue event; see the event vocabulary in the mirror contract).

The NEVER-EXECUTES guarantee (REQ-27)

The queue path contains no execution of any kind:

the legacy job runner (pack execution on approve) is DISABLED in approval-queue mode; approve/deny are decision-RECORD operations;
no script execution, no host execution, no work-runner container — WORK_ROOT remains only as legacy-compat storage, never a run surface;
the executor's own credentials (below) are scoped to the queue's WRITE surface: meeting-lane issues + audit logs, nothing else;
the v4.1 mailbox-path AUTO_RUN exemption was app-code-level; in approval-queue mode it can no longer reach an execution path (nothing executes). v5.0 records its revocation inline.

Routing semantics: manager-first (one chain-of-command hop) + system owner when an owned system is touched (both when both). Chairman-direct lane per C-09 (acting C-suite, CEO, coreci-sre → Chairman decides directly). Unresolvable chain → CEO → Chairman queue (sanctioned skip-path 2). Full audit: every request event is append-only JSONL under logs/ and mirrored to coreci/meetings (labels approval-request, approval:L2|L3, dept:<dept>).

Decision surface

Approvers decide at the executor UI (passcode-gated /ui/*) and/or read the mirror issue in coreci/meetings; the requesting pipeline polls GET /request_status?request_id=… (Bearer EXECUTOR_API_KEY). Requests are CREDENTIAL-FREE envelopes; the executor injects nothing anywhere — the requestor keeps its own credentials, the queue only carries their REQUEST for approval.

Freeze discipline

allowlist.yaml, routing.json, executor.env.example, README.md, docs/ change ONLY via PRs into this repo's main (one-way channel).
coreci/broker (LXC 117) is frozen on the same one-way-PR discipline.
No redeploy pipeline reads this repo; deployment is operator-gated (runbook §"Apply the change").

Executor identity: coreci-executor (non-admin Gitea account; its PAT carries only what the mirror + audit need — see docs/approval-queue-runbook.md).