executor-config/README.md

coreci/executor-config — coreci-executor (Write Executor, Design v1.0)

Single governed write rail from Open WebUI agents to Gitea.

• allowlist.yaml — policy engine config (AUTO_RUN vs NEEDS_APPROVAL; fail-closed)
• compose.yaml + executor.env.example — deployment (secrets in .env only)
• app/ — coreci-executor v0.1.1 (FastAPI)
• docs/ — approval-UI spec, runbook, Open WebUI registration guide
• logs/ — git-durable audit JSONL (one line per request event)

Governance: agent authors -> executor gates -> PO approves (NEEDS_APPROVAL) -> executor runs as coreci-executor (non-admin; collaborator-write ONLY on the repos granted in the deployment pack) -> audit + Discord notify. Secrets never in chat, repos, or tool calls — executor env vars only.