[adrianwebb]

Outcome

Restore the API repository's existing trusted committer policy exactly, so normal Cordis runtime PRs can pass base-owned AGPL authorization.

Work authority

• Work item / Issue: proposal: restore existing trusted committer policy to cordis #620

• Proposal / decision: Maintainer explicitly requested “Restore the existing API committer policy per proposal: restore existing trusted committer policy to cordis #620, then review all nine Task 3B PRs ... merge ... clean up”.

• Assignment / checkpoint: Current Codex chat, bounded policy restoration before Task 3B integration; initializer prevention stays a separate follow-up.

• Actor: Codex acting for @adrianwebb

• Human authority: @adrianwebb directly authorized restoration of the existing policy, not a new grant.

• Agent / capacity provider: Codex / OpenAI

• Exact base ref: cordis 72e410a

• Exact head ref: fix/620-restore-committer-policy 50bd2dc

• Agent-authored under human authority

Plan

Restore only exact policy blob b1a687db754ee2fac141919e6c63052d12bf2812 from trusted original staging c8e18e2; current main 93563a7 has identical bytes. Record the bootstrap authority and keep every issue open. Refresh #618/#619 from restored origin/cordis and require their normal authorization, metadata and runtime checks to pass.

Changes and commits

Documentation dbb7a32 and restoration 50bd2dc. Three files: docs/committer-policy-restoration.md, CHANGELOG.md, .github/approved-committers.json. The policy binds treeseed-ai/api and already lists adrianwebb. No user, license grant, workflow, branch-protection or legacy-branch change.

Verification

• Original staging and main policy Git blobs are b1a687db754ee2fac141919e6c63052d12bf2812.
• Restored bytes/hash/schema/repository/existing username match exactly; git diff --check passes.
• Intended pre-restoration check failed because the cordis base lacks the policy.
• No application source, dependency or generated artifact changes; bootstrap contains no owner build/test program.

The inherited authorization workflow reads the exact base and therefore cannot approve its own missing-policy restoration. This initial policy-only restoration is the maintainer-directed bootstrap described in #620, verified against existing trusted staging/main policy, not candidate-provided authorization. This exception is confined to restoring that exact unchanged policy. It does not authorize bypassing any subsequent runtime PR check or adding committers.

Risk and rollback

No authorization set changes. Exact data restoration can be reverted through a reviewed cordis PR; that would intentionally block future author checks again. Do not modify staging/main, protections or published channels. Subsequent runtime PRs must pass the restored base-owned gate.

Completion summary

Prepared and independently read back the exact policy restoration requested by the maintainer. Keep #620 open; its initializer-prevention proposal remains separate and unimplemented.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.

Part of #620

[adrianwebb]

Reviewed exact three-file diff. Policy matches trusted staging and main byte-for-byte (blob b1a687db754ee2fac141919e6c63052d12bf2812) and adds no approved user or permission. PR metadata validation passed. As expected, inherited authorization cannot find its policy at the old base; this specific restoration is the human-authorized bootstrap requested in the current instruction per #620. No workflow/protection/check status is changed or fabricated. This bounded initial restoration does not waive authorization for #618/#619; they must pass the real base-owned gate after refreshing from the restored cordis.