[mashkovd]

Summary

Sets MCTL_AGENTS_APPROVE_LEGACY_APPROVER: "false" on mctl-api (platform-gitops/bootstrap/templates/mctl-platform/mctl-api.yaml). This closes the free-text approver relay that mctl-api#571 kept while mctl-agents moved to grant-based DevLoop approval (mctl-agents#636, released in 1.76.0).

With the flag off (per cmd/api/main.go parseLegacyApprover, internal/api/handlers_write.go, internal/api/handlers_dev_loop.go on mctl-api main):

• a service call to mctl-agents-approve naming a different approver gets 400 legacy_approver_disabled instead of an approver.legacy_relay audit row;
• a DevLoop approve with no aar_ grant gets 409 approval_grant_missing;
• grant-authorized approvals are unaffected.

Evidence that it is safe now

• Canonical path proven live on the first post-deploy DevLoop, dev-loop-mctlhq-mctl-agents-655, approved 2026-10-16 16:35Z. mctl-api audit chain:
  • wi_9bf97cb9-acd6-42d5-9cdd-d6f9bc612831 has exactly one execution, we_43fa7987-0cda-4281-bdac-7b8cae280603.
  • aar_95e18f44c2824b9f88cd2df091383b41: action_approval.create (13:25Z) → decision approved by github:mashkovd (16:35:54Z) → consume (16:35:56Z).
  • agent_run_token.mint art_a5ea06f4-f85a-45f0-8fa2-9b2eeb30a091 for the same we_.
  • Exactly one mctl-agents-approve (16:35:56Z, grant_ref = the aar_, agent_run_id = the art_), status succeeded, then mctl-agents-implement submitted.
  • No approver.legacy_relay row in the window.
• Legacy loops drained. The five DevLoops started before 1.76.0 and still parked at approval were abandoned via mctl_abandon_dev_loop (all Completed, result abandoned: ...): mctl-api-489, mctl-claude-remote-79, mctl-agents-600, mctl-agents-428, mctl-agents-413. Their proposals stay proposed and can be restarted with a new loop. The only other running loop, .github-161, was approved before this change and is already implemented.

Verification

• helm template of platform-gitops/bootstrap renders the Application, and the flag lands in spec.sources[0].helm.values.env as the string 'false'. Any other value would refuse mctl-api startup.
• The env change is in the pod spec, so ArgoCD rolls the mctl-api pod; no ROLLOUT_MARKER bump is needed.

Rollback

Remove the line (empty means on).

Refs mctlhq/mctl-agents#636, mctlhq/mctl-api#571

🤖 Generated with Claude Code

https://claude.ai/code/session_01BKnkncXtavYRiryZ2k33nM

[claude]

Claude finished @mashkovd's task in 1m 12s —— View job

---

Review complete ✅

• Gather context (diff, CLAUDE.md conventions)
• Analyze the diff for correctness/security/operational safety
• Post findings / verdict

Diff: single env var addition (MCTL_AGENTS_APPROVE_LEGACY_APPROVER: "false") in platform-gitops/bootstrap/templates/mctl-platform/mctl-api.yaml, following the exact comment/rollback convention already used for the adjacent TENANT_AUTHZ_MODE / ADMIN_PRINCIPALS lines (explains why, cites the issue refs, documents rollback). Quoting style matches sibling boolean-valued vars (AUTH_REQUIRED: "true"). This is a config-only values change with no template logic, RBAC, or secret changes — falls under the trivial-diff category.

Approved via gh api .../pulls/1913/reviews with event="APPROVE" bound to commit 653572fcf2aa5cc29d51cd3876b4d92927dbdf4f.

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.8-flash-high · commit 653572f.

No significant issues found.

[claude]

Trivial: single env var addition in values YAML, follows existing comment/rollback convention for sibling flags.