Repository navigation
REQ 094
Each request shall be one workflow run with one gated job whose inputs bind a request ID, an action class from a closed list, the target repository and ref, the content by full commit SHA or SHA-256 digest, the expected target precondition, and a rationale.
An approval means something only for the exact content the reviewer saw, and one request per run lets a reviewer approve or reject each request individually. Content is staged on a requests/* ref that a ruleset restricts to the requester identity (decision D8 in VITechnologies/projectbuddy#177), so the requester never writes to a target.
Rejected before the gate, so no reviewer is asked: an unknown action class; a branch, tag, or abbreviated SHA given as the content; a missing digest, precondition, or rationale; and a target outside the action class's declared target pattern. The executor recomputes the content digest from the staged ref and stops on a mismatch.
Planned, TEST-096; not yet performed live. Offline fixture tests refuse an unknown action class, a content binding that is not a full commit SHA or SHA-256 digest, a missing precondition or rationale, and a target outside the class's target pattern before dispatch; the gated job recomputes the content binding and refuses a mismatch as digest-mismatch. Live verification waits for Phase 3 of VITechnologies/projectbuddy#179.
Software-Requirements-Specification
High
scripts/tests/test_approval_gate_model.py, scripts/tests/test_approval_gate_checks.py, and scripts/tests/test_approval_gate_cli.py offline fixtures
scripts/approval_gate/model.py, scripts/approval_gate/registry.py, scripts/approval_gate/submit.py, scripts/approval_gate/checks.py, .github/workflows/approval-request.yml, .github/workflows/approval-gate.yml
Planned; offline fixture tests pass, no live proof yet