Module approval 

Out-of-band SOP approval plane (EPIC C; EPIC G broker).

The resolution layer on top of EPIC A (the engine singleton) and EPIC B (the durable run store + append-only event log). resolve_gate (resolve) is the ONE gate-clearing entry point, reachable from four principals - the agent tool, the loopback CLI, the gateway, and the timeout tick - each recorded into B’s append-only ledger with a transport-derived principal that a client body can never forge. ApprovalBroker (broker) wraps that chokepoint with an authorization + quorum layer (EPIC G): required-group membership and N-distinct-approver quorum, resolved from the engine’s live [sop.approval] config. With no policy configured the broker is a pass-through to resolve_gate - unchanged behavior.

Re-exports

pub use broker::ApprovalBroker;

pub use broker::ApprovalNoticeKind;

pub use broker::ApprovalRouteAdapter;

pub use broker::BrokerOutcome;

pub use broker::GateNotice;

pub use broker::NoopRouteAdapter;

pub use channel_route::ApprovalRouteIssue;

pub use channel_route::ChannelRouteAdapter;

pub use channel_route::unresolvable_approval_routes;

pub use decision::ApprovalDecision;

pub use decision::ResolveOutcome;

pub use identity::ApprovalIdentityResolver;

pub use identity::LocalConfigApprovalIdentityResolver;

pub use ledger::GateEventKind;

pub use ledger::GateLedgerEntry;

pub use principal::ApprovalPrincipal;

pub use principal::ApprovalSource;

Modules

broker

Approval broker (EPIC G, Phase 5).

channel_route

Real channel delivery for the approval route adapter (EPIC G follow-up).

decision

The decision a principal makes on a SOP gate, and the outcome of resolving it.

identity

Approval identity resolution seam.

ledger

The append-only approval ledger entry, mapped onto EPIC B’s SopEventRecord.

principal

WHO resolved a SOP approval gate, and from WHERE (EPIC C).

resolve

The single gate-clearing chokepoint (EPIC C, C3).

timeout

Fail-closed SOP approval-timeout behavior (EPIC C, C2). [SEC-FLIP]

Enums

ApprovalMode

WHO may clear a SOP approval gate. Layered with execution_mode / priority / requires_confirmation (all of which still apply). Closed set => serde enum.

ApprovalTimeoutAction

What happens to a SOP approval gate when it times out. Default is fail-closed: the gate never self-approves. Closed set => serde enum.