From dbb7a326ae6a73d6fd12750acdae337c412c400f Mon Sep 17 00:00:00 2001
From: Adrian Webb <adrian@webb.sh>
Date: Sat, 24 Oct 2026 20:04:35 -0400
Subject: [PATCH 1/2] docs: record exact API policy restoration authority
 (#620)

---
 CHANGELOG.md                         | 7 +++++++
 docs/committer-policy-restoration.md | 7 +++++++
 2 files changed, 14 insertions(+)
 create mode 100644 CHANGELOG.md
 create mode 100644 docs/committer-policy-restoration.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..c2adb1c3
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,7 @@
+# Changelog
+
+## [Unreleased]
+
+### Fixed
+
+- Restore the existing API committer policy to Cordis (#620).
diff --git a/docs/committer-policy-restoration.md b/docs/committer-policy-restoration.md
new file mode 100644
index 00000000..8f196763
--- /dev/null
+++ b/docs/committer-policy-restoration.md
@@ -0,0 +1,7 @@
+# Restore the existing API committer policy
+
+Issue #620 restores `.github/approved-committers.json` exactly from trusted original API staging commit `c8e18e22f322f33550726bfe65aa79c889307f2b`, Git blob `b1a687db754ee2fac141919e6c63052d12bf2812`. It binds `treeseed-ai/api` and already lists `adrianwebb`; no committer or license permission changes.
+
+The maintainer explicitly authorized this restoration and Task 3B integration in the current review request. The existing authorization workflow reads the exact PR base, which currently lacks the policy. This separately reviewed, exact-byte bootstrap restoration uses that human direction and existing trusted policy, not self-authorization from a candidate's declarations. No branch protections, workflow checks, legacy branches or production channels change. Runtime PRs must refresh from the restored `origin/cordis` and pass normal base-owned authorization before merge.
+
+Verification compares original staging and main policy blobs and bytes, parses repository/schema/user binding, and confirms the diff contains only the declared restoration/docs/changelog. Keep #620 and all migration issues open until release. Initializer prevention remains a separately reviewed follow-up.

From 50bd2dc9a55ba37f7e75cb573ec751fbfcba7629 Mon Sep 17 00:00:00 2001
From: Adrian Webb <adrian@webb.sh>
Date: Sat, 24 Oct 2026 20:04:46 -0400
Subject: [PATCH 2/2] fix: restore unchanged trusted API committer policy
 (#620)

---
 .github/approved-committers.json | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 .github/approved-committers.json

diff --git a/.github/approved-committers.json b/.github/approved-committers.json
new file mode 100644
index 00000000..b1a687db
--- /dev/null
+++ b/.github/approved-committers.json
@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "repository": "treeseed-ai/api",
+  "approvedGitHubUsernames": [
+    "adrianwebb"
+  ]
+}