The crontab can't accept a schedule the policy hasn't read

The freeze window is in the wiki. The crontab is on the server. Nothing connects them, which is how a 0 3 * * * deploy job appeared on the last night of the quarter.

Put the policy in the request path. A hook on the cron service matches its writes: POST and PUT on the entries and crontab routes: and dispatches them to a script in your hoody-exec. The script parses the proposed entry from req.rawBody: does the schedule fall inside a freeze window, does the command touch prod, is the requester on the list. Pass, and metadata.hook.forward() sends it on to hoody-cron unchanged. Fail, and a 422 comes back naming the rule that refused it. Reads match nothing and pass straight through.

The scheduler itself didn't change. Its front door did.

Change policy stopped being a document about the crontab and became its gatekeeper.