Architecture: integrate LangGraph interrupt/resume with the approval ledger

[falltwo]

Architecture: integrate LangGraph interrupt/resume with the approval ledger

Context

This is a future hardening item that depends on A′ atomic approval and idempotent execution being merged first. It does not represent an implemented capability and does not overlap Issue #1, which tracks L1/L2/L3 interface screens.

Scope

• Pause an Agent workflow at a human approval boundary and resume it with a stable workflow/thread identifier.
• Keep the A′ SQLite approval ledger and execution receipt as the only source of business truth.
• Treat LangGraph checkpoints as workflow state only; every resumed protected write must still pass A′ CAS, authorization, digest, version, and idempotency checks.

Prerequisites

• A′ protected purchase-order approval route is merged and fault-tested.
• Replaying an approved operation returns its stored receipt without another PO effect.
• The protected PO primitive cannot be called without a valid approval context.

Acceptance criteria

• Process restart can resume an interrupted approval workflow.
• Duplicate resume of the same thread cannot duplicate the PO effect.
• A checkpoint failure before/after the business commit reconciles against the domain receipt.
• Graph state and approval-ledger divergence is detectable and tested.

Non-goals / claim boundary

• LangGraph does not provide database exactly-once semantics.
• This issue does not imply all ERP writes are governed or production-ready.
• It does not add a background ERP worker or transactional outbox.