Approvals v2: the six product-proven ladder rules

[omercelikdev]

What

Implements the accepted goldpath-approvals-v2 RFC: the six rules the api-portal product's approval engine proved live that the ladder engine lacked. All additive; the whole surface is still unshipped, so no shipped-API changes.

• Withdraw — WithdrawAsync(id, requestedBy): requester-only (NotRequester), pending-only, trailed; Withdrawn status is terminal.
• Quorum rungs — GoldpathApprovalRung.RequiredApprovals (default 1): each grant is a signature toward the rung; completion at quorum; the trail reads signed (n/m) then granted.
• Distinct-eyes across the chain — one identity signs at most once per request, held across escalation even into a higher role (AlreadySigned). Quorum counts per rung; the bar spans the whole chain.
• Mandatory rejection reason — a blank reason is refused (ReasonRequired); rejection stays terminal at any point, mid-quorum included.
• Reject → resubmit chain — ResubmitAsync(rejectedId, requestedBy): fresh request linked by SupersedesId, both trails cross-referenced (resubmitted/superseded).
• Store seam — AddSignatureAsync/GetSignaturesAsync on IGoldpathApprovalStore, in-memory and EF (GoldpathApprovalSignatures table, indexed by request).

Contract note: decision verbs keep refusal-as-value; ResubmitAsync throws on misuse like the other creation verbs (RequestAsync, DelegateAsync).

Proof

• 70 deterministic tests (20 existing + 50 new): the portal's seven multi-stage facts translated to rungs, withdraw/resubmit lifecycles, EF restart + round-trip, model-shape contract (table/column/index/conversion), composition seam (both AddGoldpathApprovals overloads + config binding), and the trail/refusal wording an auditor reads.
• The package joins the mutation gate: stryker/Goldpath.Approvals.json, score 79.13% against break 70.
• scripts/docs-freshness.sh green; dotnet format --verify-no-changes clean on the touched projects.

Ledgers (same PR as reality)

• RFC flipped to accepted (owner, 2026-08-26) with a §6 implementation record; the CorPay approval story stays with T21's adopter proof (the sample doesn't compose approvals yet — wiring it would be a demo invented for the test).
• RFC index row and the T21 open-threads addendum updated; package README documents the new verbs.

🤖 Generated with Claude Code