Module broker 

Approval broker (EPIC G, Phase 5).

A thin authorization layer that WRAPS the single gate-clearing chokepoint (SopEngine::resolve_gate) - it never opens a second gate-clearing path. It adds, on top of approval_mode:

• required-group membership (via ApprovalIdentityResolver),
• quorum (N distinct approvers, counted from the append-only gate_vote ledger rows so a partial quorum survives a restart),
• a route-adapter seam (ApprovalRouteAdapter) for delivering approval notices to a route (and, on timeout, a distinct second route).

When a step names no policy (or the config has none) the broker is a pass-through to resolve_gate - unchanged behavior. The chokepoint keeps its audit-first, fail-closed contract; the broker only gates who may reach it and how many times.

Structs

ApprovalBroker

Authorization + quorum layer over resolve_gate. Holds NO copy of the approval policy/group config - it resolves every policy and membership decision from the engine’s live [sop.approval] at use-time (single source of truth), so a config reload cannot leave the broker deciding on stale rules. It carries only the identity-resolution seam and the route adapter.

GateNotice

Everything a route adapter needs to render a MEANINGFUL gate notice — not just “run X waits at step N” but WHAT is being approved.

NoopRouteAdapter

A no-op route adapter: logs the delivery intent but sends nowhere. The default until real channel delivery is wired (a follow-up); keeps the broker and escalation functional without a channel dependency.

Enums

ApprovalNoticeKind

Why an approval notice is being delivered. Route adapters render this so an on-call escalation cannot be mistaken for the initial request.

BrokerOutcome

The outcome of a broker-mediated gate resolution.

Traits

ApprovalRouteAdapter

Deliver an approval notice to a named route (channel). The seam that lets approvals reach approvers beyond the originating channel (the cross-channel HITL gap) and that escalation uses to reach a distinct SECOND route on timeout. Delivery is best-effort: a route error must never clear or block a gate (the gate state is the source of truth; the route is only a notice).