Summary
Represent explicit maintainer approval for a focused CI change through a trusted, content-bound review record.
Actual behavior
Approved workflow edits cannot pass the unconditional workflow-path restriction.
Expected behavior
Only workflow content matching an explicit trusted review can pass normal verification and submit gates.
Steps to reproduce
Approve a workflow change, then adopt a commit modifying .github/workflows; current policy still rejects it.
Environment
RepoSteward main; existing configured reviewer and separate submit workflow.
Acceptance criteria
Additional context
A maintainer can explicitly approve a focused workflow change, but RepoSteward currently cannot represent that approval: workflow paths remain unconditionally denied in the default configuration. This blocks approved platform CI work such as CoWiki Windows support (#153 / PR #154).
Add an opt-in review record read only from trusted per-user configuration, bound to repository, Issue, exact base commit, configured reviewer, and SHA256 content for an exact set of workflow YAML files. Default behavior remains unchanged. Project config cannot grant or alter this authority. Reject wildcard paths, changed content, a different base/Issue/reviewer, symlinks, missing files, and non-workflow path requests. Check the grant again before publication so removal takes effect after verification. Preserve separate submit, environment gate, identity, contribution checks, isolated verification and publication audit.
Record the matched review in the verified run/review packet, document the trusted configuration, and cover default rejection, grant mismatch/revocation, project isolation, and successful reviewed submission with regression tests.
Summary
Represent explicit maintainer approval for a focused CI change through a trusted, content-bound review record.
Actual behavior
Approved workflow edits cannot pass the unconditional workflow-path restriction.
Expected behavior
Only workflow content matching an explicit trusted review can pass normal verification and submit gates.
Steps to reproduce
Approve a workflow change, then adopt a commit modifying .github/workflows; current policy still rejects it.
Environment
RepoSteward main; existing configured reviewer and separate submit workflow.
Acceptance criteria
Additional context
A maintainer can explicitly approve a focused workflow change, but RepoSteward currently cannot represent that approval: workflow paths remain unconditionally denied in the default configuration. This blocks approved platform CI work such as CoWiki Windows support (#153 / PR #154).
Add an opt-in review record read only from trusted per-user configuration, bound to repository, Issue, exact base commit, configured reviewer, and SHA256 content for an exact set of workflow YAML files. Default behavior remains unchanged. Project config cannot grant or alter this authority. Reject wildcard paths, changed content, a different base/Issue/reviewer, symlinks, missing files, and non-workflow path requests. Check the grant again before publication so removal takes effect after verification. Preserve separate submit, environment gate, identity, contribution checks, isolated verification and publication audit.
Record the matched review in the verified run/review packet, document the trusted configuration, and cover default rejection, grant mismatch/revocation, project isolation, and successful reviewed submission with regression tests.