Record Hermes approval packet evidence

2026-06-01 07:46:58 -04:00
parent 97a00a4fe6
commit 61b6cffa34
3 changed files with 88 additions and 2 deletions
@@ -0,0 +1,57 @@
+---
+name: CTO Hermes Approval Packet Evidence
+status: validated
+lifecycle_classification: sot
+owner: jp
+created: 2026-06-01
+last_reviewed: 2026-06-01
+core_promotion_status: not-promoted
+---
+
+# CTO Hermes Approval Packet Evidence
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## Scope
+
+This evidence closes `CTO-WORK-065`.
+
+The implementation adds a read-only JP approval packet to the Hermes WebUI CTO control panel. It prepares copy/paste approval text from Harness evidence but does not approve execution, activate Case, or mutate target repositories.
+
+## Implementation Evidence
+
+- Hermes plugin commit: `a109448 Add CTO approval packet surface`
+- API field: `approval_packet`
+- API field: `approval_command_text`
+- API field: required evidence paths
+- API field: allowed paths
+- API field: blocked actions
+- API invariant: not executable
+- UI surface: `static/cto_control_panel.js`
+- Route surface: `routes/cto_control_summary.py`
+
+## Validation Evidence
+
+- Focused validation: `python3 -m pytest tests/unit/test_cto_control_summary.py tests/unit/test_cto_control_panel_static.py -q`
+- Focused result: `5 passed`
+- Aggregate validation before commit: `python3 scripts/ast-connection-map.py --check`
+- Aggregate result before commit: `CONNECTION-MAP.md is fresh`
+- Aggregate validation before commit: `python3 -m pytest tests/ -q`
+- Aggregate result before commit: `103 passed, 4 skipped`
+- Aggregate validation after merge: `python3 scripts/ast-connection-map.py --check`
+- Aggregate result after merge: `CONNECTION-MAP.md is fresh`
+- Aggregate validation after merge: `python3 -m pytest tests/ -q`
+- Aggregate result after merge: `107 passed`
+
+## Governance Evidence
+
+- Harness-backed summary data remains the source of truth.
+- Hermes prepares approval text; JP remains the approver.
+- Case runtime default active: false
+- target repository mutation: false
+- upstream `hermes-webui` edited: false
+- upstream `hermes-agent` edited: false
+
+## Result
+
+`CTO-WORK-065` is validated because Hermes can now prepare a JP approval packet while remaining read-only and non-executable.