868 B
Execution Approvals
M4 introduces lab_execution approval for one exact ArtifactSet. Approval is allowed only when all
required members are present, verified and non-quarantined and when static evidence reports neither
pickle/executable serialization nor required remote repository code.
The approval stores approver, reason, timestamp, optional expiry and a canonical fingerprint of the artifact/security facts. It becomes stale on expiry, revocation or evidence change. Approval of a model name, another ArtifactSet or an older revision cannot authorize execution.
LAB approval is not production approval. It authorizes only an isolated technical runtime probe.
The M4 API exposes no production-approval or activation route, and deployment candidates produced by
successful probes are hard constrained to channel=lab, status=lab_ready, production=false.