60 lines
2.9 KiB
YAML
60 lines
2.9 KiB
YAML
version: 5.0
|
|
mode: approval_queue_only
|
|
# allowlist v5.0 — approval-request queue repurpose (REQ-27, P04-04).
|
|
#
|
|
# CHANGE SHAPE (one-way PR into the FROZEN executor-config repo):
|
|
# v4.x classified packs and auto-ran granted targets. The rail is now an
|
|
# approval-request queue ONLY — it routes, records, mirrors, and reports;
|
|
# it NEVER executes against production.
|
|
#
|
|
# REVOKED in v5.0 (the complete v4.1 grant set — nothing else ever existed):
|
|
# - coreci-coo: bash_pack auto_run coreci-coo/home (revoked)
|
|
# - coreci-cairo: bash_pack auto_run coreci-cairo/home (revoked)
|
|
# - coreci-cpo: bash_pack auto_run coreci-cpo/home (revoked)
|
|
# - coreci-executor: bash_pack auto_run coreci/executor-config (revoked)
|
|
# - defaults read_targets (coreci/company) kept UNCHANGED: the queue still
|
|
# allows the org records as a READ surface for request context only.
|
|
#
|
|
# SEMANTICS under mode: approval_queue_only:
|
|
# - defaults.decision stays NEEDS_APPROVAL (fail-closed) and there are no
|
|
# agent rows: the v4.1 classifier can never return AUTO_RUN again.
|
|
# - The v4.1 mailbox-path exemption is APP-CODE-level (not config) and
|
|
# cannot reach an execution path here — approval-queue mode has none
|
|
# (see README.md "The NEVER-EXECUTES guarantee").
|
|
# - approval_queue.* below is consumed by the 0.4.0 decision-only server
|
|
# build; the legacy 0.3.0 server ignores unknown top-level keys (its
|
|
# loader picks only defaults/agents), so this file is backward-safe.
|
|
#
|
|
# Routing for approvals comes from routing.json (GENERATED from
|
|
# coreci/company org/systems-ownership.md v1.2 + org-chart.json — do not
|
|
# hand-edit either side of that chain; regenerate instead).
|
|
defaults:
|
|
decision: NEEDS_APPROVAL
|
|
timeout_s: 900 # legacy field, retained for schema compat only
|
|
read_targets:
|
|
- coreci/company
|
|
|
|
agents: {} # v5.0: NO auto-run grants remain (see REVOKED above)
|
|
|
|
approval_queue:
|
|
enabled: true
|
|
never_execute: true # the queue is a decision-record surface, full stop
|
|
routing_table: /config/routing.json
|
|
request_id_prefix: ar # queue ids: ar-<yyyymmdd-hhmmss>-<role>
|
|
decision_surface: executor_ui # + Gitea issue mirror (coreci/meetings)
|
|
mirror:
|
|
repo: coreci/meetings
|
|
actor: coreci-executor # executor app account; PAT scoped to writes below
|
|
labels:
|
|
- approval-request
|
|
- approval:L2 # emitted alongside approval:L3 per request class
|
|
- dept:<dept> # resolved from the requestor's org-chart ancestor
|
|
lanes:
|
|
- chairman_direct # C-09: acting C-suite, CEO, coreci-sre requests
|
|
- manager_owner # manager one hop + system owner (both when both)
|
|
- skip_path # unresolvable -> CEO -> Chairman
|
|
statuses:
|
|
- open
|
|
- routed
|
|
- decided # decided (approved|rejected, decided_by, decided_at)
|
|
- withdrawn # requestor abort before decision |