Use one-time AGPL committer authorization

[adrianwebb]

Outcome

Replace per-PR grants and signed agent attestations with one trusted-base allowlist of provider-authenticated GitHub usernames for this AGPL/commercial repository.

Work authority

• Work item / Issue: Closes Replace per-PR contribution grants with a trusted GitHub username allowlist #7
• Proposal / decision: maintainer-approved one-time committer authorization
• Assignment / checkpoint: SDK-first cutover contributor-policy correction
• Actor: agent:engineer
• Human authority: GitHub user adrianwebb
• Agent / capacity provider: agent:engineer / local TreeSeed provider
• Exact base ref: staging at 3d341ad65419bcf8de36fd3960acbf086bc7dda8
• Exact head ref: codex/committer-policy at 7fa97c9b648596affd7512c8d8f60ef70652378f

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Remove API-signed contribution authorization routes/services and definition requirements. Add a base-SHA-bound workflow, committed username allowlist seeded with adrianwebb, one-time approval guide/form, and regression coverage. Never use email or untrusted PR/commit identity.

Changes and commits

• 7fa97c9b648596affd7512c8d8f60ef70652378f — implements the one-time AGPL committer policy and removes per-PR/signed-attestation machinery.

Verification

• Licensing and executable committer-workflow tests: 6/6 passed.

• Workflow and issue-form YAML parse passed.

• npm ci --dry-run: passed.

• npm run build:dist and npm run check:file-architecture: passed.

• git diff --check: passed.

• Eight API agent definitions no longer declare contribution_attestation.

• I ran the narrowest relevant package verification and documented any checks that could not be run.

Risk and rollback

The first merge is a deliberate bootstrap exception because the base branch still owns the obsolete checkbox workflow. After this policy reaches staging, PRs authored by allowlisted GitHub accounts pass automatically. Revert the commit to roll back, then restore a reviewed alternative before accepting external contributions.

Completion summary

API contributor authorization is account-level and username-only. adrianwebb is initially approved; unlisted users are directed to a one-time request. Both exact-head hosted Verify runs pass. Trusted-base canary remains pending until this workflow is merged.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.