StartGraph

Starts a run and advances it until it finishes or needs somebody. It mutates because a run is a fact appended to a log, and that log is what everything else reads. Its reversibility is honest: nothing here can un-append what a node already did in the world, so the way back is to answer the run's own gate. The REQUESTER is who started the run, as the surface attributed it — never an input (greenhouse decisions/0528). It is what every gate the run opens records, and what `graph:decide` refuses as an approver; a requester the caller could write was an approval the caller could arrange. A caller the surface did not verify is recorded as `unverified:<channel>`, which no verified actor can be, so any verified human may answer what it opened. `graph:run` ADMITS THE START, NOT THE NODES. Each node runs as whoever started the run and only if that caller holds what the node itself declares; one that does not is not run, and the result says so with the run parked there.

public function __construct(string $graph, string $inputs = '{}'):

Parameters

public function run(Milpa\Orchestrator\Declaration\GraphRuns $runs, ?Milpa\Command\InvocationContext $context = null): array

Starts the run and reports where it came to rest. This is what a declared operation exposes, and a declared `run()` is never handed the caller's authority. So a run started through here has a caller that holds nothing: its nodes are handed the context, and those that declare a need do not run. The door ({@see GraphOperations}) calls {@see self::runAs()} instead.

Parameters

public function runAs(Milpa\Orchestrator\Declaration\GraphRuns $runs, Milpa\Orchestrator\Declaration\Caller $caller): array

The same start, driven by a caller whose authority came with the call. A graph is a driver: it originates one governed call per node, and admission to `graph:start` does not authorize them. So it takes what a surface hands every handler as its third argument — the caller's authority — and each node is judged against it.

Parameters