Module proposal 

Runtime workflow proposal cross-validation, authorization, quotas, and sequential execution (spec 109-runtime-workflow-proposals, P1).

Builds on the portable proposal types and structural validation in traverse_contracts::proposal. This module owns everything that needs live host state: cross-checking a proposal against a loaded application manifest and capability registry, deciding whether it is automatic-eligible or requires a verified approval token, tracking per-principal/app/workspace quotas, and executing the bounded sequential DAG one node at a time.

Structs

ApprovalTokenClaims

An approval token’s verified claims (spec 109 FR-006a). Only produced by verify_approval_token after signature, time, and binding checks pass.

ApprovalTokenError

ApprovalTokenStore

Tracks approval-token use-count and revocation across calls (spec 109 FR-006a: max use count, revocation, replay prevention). In-memory only — tokens do not survive a process restart, which is safe since they are short-lived and bound to a specific pinned snapshot.

ApprovalTokenVerificationContext

The context an approval token is verified against: expected issuer, audience, the exact proposal/snapshot digests it must be bound to, and the key registry it may be signed with (spec 109 FR-006a).

AuthorizationSummary

ProposalCrossValidationError

ProposalCrossValidationFailure

ProposalNodeOutcome

ProposalTrace

A bounded, redacted, immutable projection of one proposal execution (spec 109 FR-009). Carries mapping paths, never mapped values; a token id, never the raw token; and no raw node input/output payloads.

QuotaDenial

QuotaLimits

QuotaReservation

A live concurrency reservation. Releases automatically on drop so a caller can never forget to release it, even on an early error return.

QuotaTracker

In-memory concurrency quota ledger keyed by principal, app, and workspace (spec 109 FR-007b). Each dimension is tracked and enforced independently.

ResolvedProposalNode

A proposal node resolved to its exact, pinned capability contract.

Enums

ApprovalTokenErrorCode

AuthorizationDecision

ProposalCrossValidationErrorCode

ProposalNodeStatus

ProposalTerminalState

Constants

DEFAULT_MAX_CONCURRENT_PER_APP

DEFAULT_MAX_CONCURRENT_PER_PRINCIPAL

DEFAULT_MAX_CONCURRENT_PER_WORKSPACE

Functions

execute_proposal

Executes a structurally and cross-validated proposal one node at a time in its deterministic execution order, threading data between nodes solely through the proposal’s explicit mappings. Stops at the first failed node with no retry, compensation, or graph mutation (spec 109 FR-008).

proposal_is_automatic_eligible

Whether every resolved node’s declared risk classes permit automatic execution (spec 109 FR-006). A proposal requires an approval token the moment any single node does not.

validate_proposal_against_host_state

Cross-checks a structurally valid proposal against the loaded application manifest and capability registry (spec 109 FR-004, FR-011):

verify_approval_token

Verifies an approval token’s Ed25519 signature, algorithm, key identity, issuer, audience, expiry, and exact binding to the proposal/snapshot digest and workspace (spec 109 FR-006a). Does not check use-count or revocation — see ApprovalTokenStore.