Struct ApprovalBroker 

pub struct ApprovalBroker { /* private fields */ }

Authorization + quorum layer over resolve_gate. Holds NO copy of the approval policy/group config - it resolves every policy and membership decision from the engine’s live [sop.approval] at use-time (single source of truth), so a config reload cannot leave the broker deciding on stale rules. It carries only the identity-resolution seam and the route adapter.

Implementations

impl ApprovalBroker

pub fn new( resolver: Arc<dyn ApprovalIdentityResolver>, route: Arc<dyn ApprovalRouteAdapter>, ) -> ApprovalBroker

Build with an explicit identity resolver and route adapter.

pub fn with_route(route: Arc<dyn ApprovalRouteAdapter>) -> ApprovalBroker

Build with the config-backed local resolver and the given route adapter. Policies/groups are read from the engine’s live config at resolve-time, so there is no per-broker config to keep in sync.

pub fn disabled() -> ApprovalBroker

A broker with the local resolver and a no-op route. With no [sop.approval] policy in the engine config resolve behaves exactly like resolve_gate (the engine default, so behavior is unchanged until a policy is configured).

pub fn escalation_route( &self, cfg: &SopApprovalConfig, policy_name: &str, ) -> Option<String>

The explicit escalation route for a named policy (Phase 10), read from live config. An empty string is treated the same as None; callers that deliver a timeout notice must use escalation_delivery_route to apply the request-route fallback promised by the config contract.

pub fn deliver_escalation(&self, route: &str, notice: &GateNotice<'_>)

Deliver an escalation notice to a route (best-effort).

pub fn request_route( &self, cfg: &SopApprovalConfig, policy_name: &str, ) -> Option<String>

The request route for a named policy: the channel the INITIAL approval request is delivered to when a run parks at a gate this policy governs. Read from live config; an empty string is treated as None (no out-of-band request notice), matching the config contract. This is a DISTINCT lifecycle event from escalation_route - the request fires on park, the escalation only if the gate later times out.

pub fn escalation_delivery_route( &self, cfg: &SopApprovalConfig, policy_name: &str, ) -> Option<String>

The route a timeout escalation actually delivers to: an explicit escalation route when present, otherwise the initial request route. None means the policy has no out-of-band route to re-surface.

pub fn reply_routes( &self, cfg: &SopApprovalConfig, policy_name: &str, ) -> Vec<String>

Every route that can receive approval reply instructions for a policy’s current gate. The request route is first; a distinct effective escalation route follows. Text fallback admission uses this exact set so it cannot drift from timeout delivery semantics.

pub fn deliver_request(&self, route: &str, notice: &GateNotice<'_>)

Deliver the initial approval-request notice to a route (best-effort). Fired when a run parks at a policied gate; a delivery failure never blocks or clears the gate (the gate is the source of truth, this is only a notice).

pub fn resolve( &self, engine: &mut SopEngine, run_id: &str, decision: ApprovalDecision, principal: ApprovalPrincipal, ) -> Result<BrokerOutcome, Error>

Resolve a gate through the broker: enforce membership + quorum, then call the chokepoint. engine is the authoritative gate owner; the broker only decides whether (and when) to reach resolve_gate.