DecideGraph

Answers one waiting decision, and lets the run continue from there. WHO ANSWERS IS WHO THE SURFACE AUTHENTICATED, never a name the caller writes (greenhouse decisions/0528). This engine refuses a decision from the principal that opened the gate, so the agent that produced the work cannot be the one that approves it — and that only holds if the approver is not an argument. An earlier version took a `principal` input and judged the rule against it: an agent over MCP, an actor over HTTP and a signed terminal each approved a gate they had opened by naming somebody else (evidence/1062). Now the approver is the verified actor of the invocation — the passkey session behind the panel's door, the key behind a terminal's signature — and a caller the surface did not verify (MCP stdio, an unsigned terminal) cannot answer a gate at all. WHAT RUNS AFTER THE ANSWER RUNS AS WHOEVER ANSWERED. `graph:decide` admits the answer, not the nodes it leads to: those are judged against what the approver holds, never against what the starter held when the run parked. An answer that leads straight to a node the approver may not run is not recorded, and the gate keeps waiting.

public function __construct(string $graph, string $instance, string $decision):

Parameters

public function run(Milpa\Orchestrator\Declaration\GraphRuns $runs, ?Milpa\Command\InvocationContext $context = null): array

Records the answer on behalf of the verified caller and advances the run from there. A refusal is a result, not an exception: the person who pressed the button reads the sentence, and an HTTP surface would hide an exception's message behind a 500.

Parameters

public function runAs(Milpa\Orchestrator\Declaration\GraphRuns $runs, Milpa\Orchestrator\Declaration\Caller $caller): array

The same answer, given by a caller whose authority came with the call — what the door ({@see GraphOperations}) calls. Through {@see self::run()} the approver holds nothing, so only answers leading to nodes that declare no need are taken.

Parameters