feat: Implement approvals workflow and notifications integration

- Added approvals orchestration with persistence and workflow scaffolding.
- Integrated notifications insights and staged resume hooks.
- Introduced approval coordinator and policy notification bridge with unit tests.
- Added approval decision API with resume requeue and persisted plan snapshots.
- Documented the Excitor consensus API beta and provided JSON sample payload.
- Created analyzers to flag usage of deprecated merge service APIs.
- Implemented logging for artifact uploads and approval decision service.
- Added tests for PackRunApprovalDecisionService and related components.

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Core/Execution/IPackRunArtifactUploader.cs

@@ -0,0 +1,12 @@
+using StellaOps.TaskRunner.Core.Planning;
+
+namespace StellaOps.TaskRunner.Core.Execution;
+
+public interface IPackRunArtifactUploader
+{
+    Task UploadAsync(
+        PackRunExecutionContext context,
+        PackRunState state,
+        IReadOnlyList<TaskPackPlanOutput> outputs,
+        CancellationToken cancellationToken);
+}

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Core/Execution/IPackRunJobScheduler.cs

@@ -0,0 +1,6 @@
+namespace StellaOps.TaskRunner.Core.Execution;
+
+public interface IPackRunJobScheduler
+{
+    Task ScheduleAsync(PackRunExecutionContext context, CancellationToken cancellationToken);
+}

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Core/Execution/PackRunState.cs

@@ -3,27 +3,33 @@ using StellaOps.TaskRunner.Core.Planning;
 
 namespace StellaOps.TaskRunner.Core.Execution;
 
-public sealed record PackRunState(
-    string RunId,
-    string PlanHash,
-    TaskPackPlanFailurePolicy FailurePolicy,
-    DateTimeOffset CreatedAt,
-    DateTimeOffset UpdatedAt,
-    IReadOnlyDictionary<string, PackRunStepStateRecord> Steps)
+public sealed record PackRunState(
+    string RunId,
+    string PlanHash,
+    TaskPackPlan Plan,
+    TaskPackPlanFailurePolicy FailurePolicy,
+    DateTimeOffset RequestedAt,
+    DateTimeOffset CreatedAt,
+    DateTimeOffset UpdatedAt,
+    IReadOnlyDictionary<string, PackRunStepStateRecord> Steps)
 {
     public static PackRunState Create(
         string runId,
-        string planHash,
-        TaskPackPlanFailurePolicy failurePolicy,
-        IReadOnlyDictionary<string, PackRunStepStateRecord> steps,
-        DateTimeOffset timestamp)
-        => new(
-            runId,
-            planHash,
-            failurePolicy,
-            timestamp,
-            timestamp,
-            new ReadOnlyDictionary<string, PackRunStepStateRecord>(new Dictionary<string, PackRunStepStateRecord>(steps, StringComparer.Ordinal)));
+        string planHash,
+        TaskPackPlan plan,
+        TaskPackPlanFailurePolicy failurePolicy,
+        DateTimeOffset requestedAt,
+        IReadOnlyDictionary<string, PackRunStepStateRecord> steps,
+        DateTimeOffset timestamp)
+        => new(
+            runId,
+            planHash,
+            plan,
+            failurePolicy,
+            requestedAt,
+            timestamp,
+            timestamp,
+            new ReadOnlyDictionary<string, PackRunStepStateRecord>(new Dictionary<string, PackRunStepStateRecord>(steps, StringComparer.Ordinal)));
 }
 
 public sealed record PackRunStepStateRecord(

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Infrastructure/Execution/FilePackRunStateStore.cs

@@ -110,18 +110,20 @@ public sealed class FilePackRunStateStore : IPackRunStateStore
         return result;
     }
 
-    private sealed record StateDocument(
-        string RunId,
-        string PlanHash,
-        TaskPackPlanFailurePolicy FailurePolicy,
-        DateTimeOffset CreatedAt,
-        DateTimeOffset UpdatedAt,
-        IReadOnlyList<StepDocument> Steps)
-    {
-        public static StateDocument FromDomain(PackRunState state)
-        {
-            var steps = state.Steps.Values
-                .OrderBy(step => step.StepId, StringComparer.Ordinal)
+    private sealed record StateDocument(
+        string RunId,
+        string PlanHash,
+        TaskPackPlan Plan,
+        TaskPackPlanFailurePolicy FailurePolicy,
+        DateTimeOffset RequestedAt,
+        DateTimeOffset CreatedAt,
+        DateTimeOffset UpdatedAt,
+        IReadOnlyList<StepDocument> Steps)
+    {
+        public static StateDocument FromDomain(PackRunState state)
+        {
+            var steps = state.Steps.Values
+                .OrderBy(step => step.StepId, StringComparer.Ordinal)
                 .Select(step => new StepDocument(
                     step.StepId,
                     step.Kind,
@@ -137,15 +139,17 @@ public sealed class FilePackRunStateStore : IPackRunStateStore
                     step.StatusReason))
                 .ToList();
 
-            return new StateDocument(
-                state.RunId,
-                state.PlanHash,
-                state.FailurePolicy,
-                state.CreatedAt,
-                state.UpdatedAt,
-                steps);
-        }
-
+            return new StateDocument(
+                state.RunId,
+                state.PlanHash,
+                state.Plan,
+                state.FailurePolicy,
+                state.RequestedAt,
+                state.CreatedAt,
+                state.UpdatedAt,
+                steps);
+        }
+
         public PackRunState ToDomain()
         {
             var steps = Steps.ToDictionary(
@@ -165,14 +169,16 @@ public sealed class FilePackRunStateStore : IPackRunStateStore
                     step.StatusReason),
                 StringComparer.Ordinal);
 
-            return new PackRunState(
-                RunId,
-                PlanHash,
-                FailurePolicy,
-                CreatedAt,
-                UpdatedAt,
-                steps);
-        }
+            return new PackRunState(
+                RunId,
+                PlanHash,
+                Plan,
+                FailurePolicy,
+                RequestedAt,
+                CreatedAt,
+                UpdatedAt,
+                steps);
+        }
     }
 
     private sealed record StepDocument(

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Infrastructure/Execution/FilesystemPackRunDispatcher.cs

@@ -4,13 +4,13 @@ using StellaOps.AirGap.Policy;
 using StellaOps.TaskRunner.Core.Execution;
 using StellaOps.TaskRunner.Core.Planning;
 using StellaOps.TaskRunner.Core.TaskPacks;
-
-namespace StellaOps.TaskRunner.Infrastructure.Execution;
-
-public sealed class FilesystemPackRunDispatcher : IPackRunJobDispatcher
-{
-    private readonly string queuePath;
-    private readonly string archivePath;
+
+namespace StellaOps.TaskRunner.Infrastructure.Execution;
+
+public sealed class FilesystemPackRunDispatcher : IPackRunJobDispatcher, IPackRunJobScheduler
+{
+    private readonly string queuePath;
+    private readonly string archivePath;
     private readonly TaskPackManifestLoader manifestLoader = new();
     private readonly TaskPackPlanner planner;
     private readonly JsonSerializerOptions serializerOptions = new(JsonSerializerDefaults.Web);
@@ -30,11 +30,11 @@ public sealed class FilesystemPackRunDispatcher : IPackRunJobDispatcher
             .OrderBy(path => path, StringComparer.Ordinal)
             .ToArray();
 
-        foreach (var file in files)
-        {
-            cancellationToken.ThrowIfCancellationRequested();
-
-            try
+        foreach (var file in files)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+
+            try
             {
                 var jobJson = await File.ReadAllTextAsync(file, cancellationToken).ConfigureAwait(false);
                 var job = JsonSerializer.Deserialize<JobEnvelope>(jobJson, serializerOptions);
@@ -43,38 +43,69 @@ public sealed class FilesystemPackRunDispatcher : IPackRunJobDispatcher
                     continue;
                 }
 
-                var manifestPath = ResolvePath(queuePath, job.ManifestPath);
-                var inputsPath = job.InputsPath is null ? null : ResolvePath(queuePath, job.InputsPath);
-
-                var manifest = manifestLoader.Load(manifestPath);
-                var inputs = await LoadInputsAsync(inputsPath, cancellationToken).ConfigureAwait(false);
-                var planResult = planner.Plan(manifest, inputs);
-                if (!planResult.Success || planResult.Plan is null)
-                {
-                    throw new InvalidOperationException($"Failed to plan pack for run {job.RunId}: {string.Join(';', planResult.Errors.Select(e => e.Message))}");
-                }
-
-                var archiveFile = Path.Combine(archivePath, Path.GetFileName(file));
-                File.Move(file, archiveFile, overwrite: true);
-
-                var requestedAt = job.RequestedAt ?? DateTimeOffset.UtcNow;
-                return new PackRunExecutionContext(job.RunId ?? Guid.NewGuid().ToString("n"), planResult.Plan, requestedAt);
-            }
-            catch (Exception ex)
-            {
+                TaskPackPlan? plan = job.Plan;
+                if (plan is null)
+                {
+                    if (string.IsNullOrWhiteSpace(job.ManifestPath))
+                    {
+                        continue;
+                    }
+
+                    var manifestPath = ResolvePath(queuePath, job.ManifestPath);
+                    var inputsPath = job.InputsPath is null ? null : ResolvePath(queuePath, job.InputsPath);
+
+                    var manifest = manifestLoader.Load(manifestPath);
+                    var inputs = await LoadInputsAsync(inputsPath, cancellationToken).ConfigureAwait(false);
+                    var planResult = planner.Plan(manifest, inputs);
+                    if (!planResult.Success || planResult.Plan is null)
+                    {
+                        throw new InvalidOperationException($"Failed to plan pack for run {job.RunId}: {string.Join(';', planResult.Errors.Select(e => e.Message))}");
+                    }
+
+                    plan = planResult.Plan;
+                }
+
+                var archiveFile = Path.Combine(archivePath, Path.GetFileName(file));
+                File.Move(file, archiveFile, overwrite: true);
+
+                var requestedAt = job.RequestedAt ?? DateTimeOffset.UtcNow;
+                var runId = string.IsNullOrWhiteSpace(job.RunId) ? Guid.NewGuid().ToString("n") : job.RunId;
+                return new PackRunExecutionContext(runId, plan, requestedAt);
+            }
+            catch (Exception ex)
+            {
                 var failedPath = file + ".failed";
                 File.Move(file, failedPath, overwrite: true);
                 Console.Error.WriteLine($"Failed to dequeue job '{file}': {ex.Message}");
             }
         }
 
-        return null;
-    }
-
-    private static string ResolvePath(string root, string relative)
-        => Path.IsPathRooted(relative) ? relative : Path.Combine(root, relative);
-
-    private static async Task<IDictionary<string, JsonNode?>> LoadInputsAsync(string? path, CancellationToken cancellationToken)
+        return null;
+    }
+
+    public async Task ScheduleAsync(PackRunExecutionContext context, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(context);
+
+        var envelope = new JobEnvelope(
+            context.RunId,
+            ManifestPath: null,
+            InputsPath: null,
+            context.RequestedAt,
+            context.Plan);
+
+        Directory.CreateDirectory(queuePath);
+        var safeRunId = string.IsNullOrWhiteSpace(context.RunId) ? Guid.NewGuid().ToString("n") : SanitizeFileName(context.RunId);
+        var fileName = $"{safeRunId}-{DateTimeOffset.UtcNow:yyyyMMddHHmmssfff}.json";
+        var path = Path.Combine(queuePath, fileName);
+        var json = JsonSerializer.Serialize(envelope, serializerOptions);
+        await File.WriteAllTextAsync(path, json, cancellationToken).ConfigureAwait(false);
+    }
+
+    private static string ResolvePath(string root, string relative)
+        => Path.IsPathRooted(relative) ? relative : Path.Combine(root, relative);
+
+    private static async Task<IDictionary<string, JsonNode?>> LoadInputsAsync(string? path, CancellationToken cancellationToken)
     {
         if (string.IsNullOrWhiteSpace(path) || !File.Exists(path))
         {
@@ -92,7 +123,23 @@ public sealed class FilesystemPackRunDispatcher : IPackRunJobDispatcher
             pair => pair.Key,
             pair => pair.Value,
             StringComparer.Ordinal);
-    }
-
-    private sealed record JobEnvelope(string? RunId, string ManifestPath, string? InputsPath, DateTimeOffset? RequestedAt);
-}
+    }
+
+    private sealed record JobEnvelope(
+        string? RunId,
+        string? ManifestPath,
+        string? InputsPath,
+        DateTimeOffset? RequestedAt,
+        TaskPackPlan? Plan);
+
+    private static string SanitizeFileName(string value)
+    {
+        var safe = value.Trim();
+        foreach (var invalid in Path.GetInvalidFileNameChars())
+        {
+            safe = safe.Replace(invalid, '_');
+        }
+
+        return safe;
+    }
+}

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Infrastructure/Execution/LoggingPackRunArtifactUploader.cs

@@ -0,0 +1,40 @@
+using Microsoft.Extensions.Logging;
+using StellaOps.TaskRunner.Core.Execution;
+using StellaOps.TaskRunner.Core.Planning;
+
+namespace StellaOps.TaskRunner.Infrastructure.Execution;
+
+public sealed class LoggingPackRunArtifactUploader : IPackRunArtifactUploader
+{
+    private readonly ILogger<LoggingPackRunArtifactUploader> _logger;
+
+    public LoggingPackRunArtifactUploader(ILogger<LoggingPackRunArtifactUploader> logger)
+    {
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
+
+    public Task UploadAsync(
+        PackRunExecutionContext context,
+        PackRunState state,
+        IReadOnlyList<TaskPackPlanOutput> outputs,
+        CancellationToken cancellationToken)
+    {
+        if (outputs.Count == 0)
+        {
+            return Task.CompletedTask;
+        }
+
+        foreach (var output in outputs)
+        {
+            var path = output.Path?.Value?.ToString() ?? "(dynamic)";
+            _logger.LogInformation(
+                "Pack run {RunId} scheduled artifact upload for output {Output} (type={Type}, path={Path}).",
+                context.RunId,
+                output.Name,
+                output.Type,
+                path);
+        }
+
+        return Task.CompletedTask;
+    }
+}

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Infrastructure/Execution/PackRunApprovalDecisionService.cs

@@ -0,0 +1,117 @@
+using Microsoft.Extensions.Logging;
+using StellaOps.TaskRunner.Core.Execution;
+using StellaOps.TaskRunner.Core.Planning;
+
+namespace StellaOps.TaskRunner.Infrastructure.Execution;
+
+public sealed class PackRunApprovalDecisionService
+{
+    private readonly IPackRunApprovalStore _approvalStore;
+    private readonly IPackRunStateStore _stateStore;
+    private readonly IPackRunJobScheduler _scheduler;
+    private readonly ILogger<PackRunApprovalDecisionService> _logger;
+
+    public PackRunApprovalDecisionService(
+        IPackRunApprovalStore approvalStore,
+        IPackRunStateStore stateStore,
+        IPackRunJobScheduler scheduler,
+        ILogger<PackRunApprovalDecisionService> logger)
+    {
+        _approvalStore = approvalStore ?? throw new ArgumentNullException(nameof(approvalStore));
+        _stateStore = stateStore ?? throw new ArgumentNullException(nameof(stateStore));
+        _scheduler = scheduler ?? throw new ArgumentNullException(nameof(scheduler));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
+
+    public async Task<PackRunApprovalDecisionResult> ApplyAsync(
+        PackRunApprovalDecisionRequest request,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+        ArgumentException.ThrowIfNullOrWhiteSpace(request.RunId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(request.ApprovalId);
+
+        var runId = request.RunId.Trim();
+        var approvalId = request.ApprovalId.Trim();
+
+        var state = await _stateStore.GetAsync(runId, cancellationToken).ConfigureAwait(false);
+        if (state is null)
+        {
+            _logger.LogWarning("Approval decision for run {RunId} rejected – run state not found.", runId);
+            return PackRunApprovalDecisionResult.NotFound;
+        }
+
+        var approvals = await _approvalStore.GetAsync(runId, cancellationToken).ConfigureAwait(false);
+        if (approvals.Count == 0)
+        {
+            _logger.LogWarning("Approval decision for run {RunId} rejected – approval state not found.", runId);
+            return PackRunApprovalDecisionResult.NotFound;
+        }
+
+        var requestedAt = state.RequestedAt != default ? state.RequestedAt : state.CreatedAt;
+        var coordinator = PackRunApprovalCoordinator.Restore(state.Plan, approvals, requestedAt);
+
+        ApprovalActionResult actionResult;
+        var now = DateTimeOffset.UtcNow;
+
+        switch (request.Decision)
+        {
+            case PackRunApprovalDecisionType.Approved:
+                actionResult = coordinator.Approve(approvalId, request.ActorId ?? "system", now, request.Summary);
+                break;
+
+            case PackRunApprovalDecisionType.Rejected:
+                actionResult = coordinator.Reject(approvalId, request.ActorId ?? "system", now, request.Summary);
+                break;
+
+            case PackRunApprovalDecisionType.Expired:
+                actionResult = coordinator.Expire(approvalId, now, request.Summary);
+                break;
+
+            default:
+                throw new ArgumentOutOfRangeException(nameof(request.Decision), request.Decision, "Unsupported approval decision.");
+        }
+
+        await _approvalStore.UpdateAsync(runId, actionResult.State, cancellationToken).ConfigureAwait(false);
+
+        _logger.LogInformation(
+            "Applied approval decision {Decision} for run {RunId} (approval {ApprovalId}, actor={ActorId}).",
+            request.Decision,
+            runId,
+            approvalId,
+            request.ActorId ?? "(system)");
+
+        if (actionResult.ShouldResumeRun && request.Decision == PackRunApprovalDecisionType.Approved)
+        {
+            var context = new PackRunExecutionContext(runId, state.Plan, requestedAt);
+            await _scheduler.ScheduleAsync(context, cancellationToken).ConfigureAwait(false);
+            _logger.LogInformation("Scheduled run {RunId} for resume after approvals completed.", runId);
+            return PackRunApprovalDecisionResult.Resumed;
+        }
+
+        return PackRunApprovalDecisionResult.Applied;
+    }
+}
+
+public sealed record PackRunApprovalDecisionRequest(
+    string RunId,
+    string ApprovalId,
+    PackRunApprovalDecisionType Decision,
+    string? ActorId,
+    string? Summary);
+
+public enum PackRunApprovalDecisionType
+{
+    Approved,
+    Rejected,
+    Expired
+}
+
+public sealed record PackRunApprovalDecisionResult(string Status)
+{
+    public static PackRunApprovalDecisionResult NotFound { get; } = new("not_found");
+    public static PackRunApprovalDecisionResult Applied { get; } = new("applied");
+    public static PackRunApprovalDecisionResult Resumed { get; } = new("resumed");
+
+    public bool ShouldResume => ReferenceEquals(this, Resumed);
+}

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Tests/FilePackRunStateStoreTests.cs

@@ -1,4 +1,5 @@
-using StellaOps.TaskRunner.Core.Execution;
+using System.Text.Json.Nodes;
+using StellaOps.TaskRunner.Core.Execution;
 using StellaOps.TaskRunner.Core.Planning;
 using StellaOps.TaskRunner.Infrastructure.Execution;
 
@@ -60,12 +61,34 @@ public sealed class FilePackRunStateStoreTests
 
     private static PackRunState CreateState(string runId)
     {
-        var failurePolicy = new TaskPackPlanFailurePolicy(MaxAttempts: 3, BackoffSeconds: 30, ContinueOnError: false);
-        var steps = new Dictionary<string, PackRunStepStateRecord>(StringComparer.Ordinal)
-        {
-            ["step-a"] = new PackRunStepStateRecord(
-                StepId: "step-a",
-                Kind: PackRunStepKind.Run,
+        var failurePolicy = new TaskPackPlanFailurePolicy(MaxAttempts: 3, BackoffSeconds: 30, ContinueOnError: false);
+        var metadata = new TaskPackPlanMetadata("sample", "1.0.0", null, Array.Empty<string>());
+        var parameters = new Dictionary<string, TaskPackPlanParameterValue>(StringComparer.Ordinal);
+        var stepPlan = new TaskPackPlanStep(
+            Id: "step-a",
+            TemplateId: "run/image",
+            Name: "Run step",
+            Type: "run",
+            Enabled: true,
+            Uses: "builtin/run",
+            Parameters: parameters,
+            ApprovalId: null,
+            GateMessage: null,
+            Children: Array.Empty<TaskPackPlanStep>());
+        var plan = new TaskPackPlan(
+            metadata,
+            new Dictionary<string, JsonNode?>(StringComparer.Ordinal),
+            new[] { stepPlan },
+            "hash-123",
+            Array.Empty<TaskPackPlanApproval>(),
+            Array.Empty<TaskPackPlanSecret>(),
+            Array.Empty<TaskPackPlanOutput>(),
+            failurePolicy);
+        var steps = new Dictionary<string, PackRunStepStateRecord>(StringComparer.Ordinal)
+        {
+            ["step-a"] = new PackRunStepStateRecord(
+                StepId: "step-a",
+                Kind: PackRunStepKind.Run,
                 Enabled: true,
                 ContinueOnError: false,
                 MaxParallel: null,
@@ -75,10 +98,11 @@ public sealed class FilePackRunStateStoreTests
                 Attempts: 1,
                 LastTransitionAt: DateTimeOffset.UtcNow,
                 NextAttemptAt: null,
-                StatusReason: null)
-        };
-
-        return PackRunState.Create(runId, "hash-123", failurePolicy, steps, DateTimeOffset.UtcNow);
+                StatusReason: null)
+        };
+
+        var timestamp = DateTimeOffset.UtcNow;
+        return PackRunState.Create(runId, "hash-123", plan, failurePolicy, timestamp, steps, timestamp);
     }
 
     private static string CreateTempDirectory()

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Tests/PackRunApprovalDecisionServiceTests.cs

@@ -0,0 +1,211 @@
+using System.Text.Json.Nodes;
+using Microsoft.Extensions.Logging.Abstractions;
+using StellaOps.TaskRunner.Core.Execution;
+using StellaOps.TaskRunner.Core.Planning;
+using StellaOps.TaskRunner.Infrastructure.Execution;
+
+namespace StellaOps.TaskRunner.Tests;
+
+public sealed class PackRunApprovalDecisionServiceTests
+{
+    [Fact]
+    public async Task ApplyAsync_ApprovingLastGateSchedulesResume()
+    {
+        var plan = TestPlanFactory.CreatePlan();
+        var state = TestPlanFactory.CreateState("run-1", plan);
+        var approval = new PackRunApprovalState(
+            "security-review",
+            new[] { "Packs.Approve" },
+            new[] { "step-a" },
+            Array.Empty<string>(),
+            null,
+            DateTimeOffset.UtcNow.AddMinutes(-5),
+            PackRunApprovalStatus.Pending);
+
+        var approvalStore = new InMemoryApprovalStore(new Dictionary<string, IReadOnlyList<PackRunApprovalState>>
+        {
+            ["run-1"] = new List<PackRunApprovalState> { approval }
+        });
+        var stateStore = new InMemoryStateStore(new Dictionary<string, PackRunState>
+        {
+            ["run-1"] = state
+        });
+        var scheduler = new RecordingScheduler();
+
+        var service = new PackRunApprovalDecisionService(
+            approvalStore,
+            stateStore,
+            scheduler,
+            NullLogger<PackRunApprovalDecisionService>.Instance);
+
+        var result = await service.ApplyAsync(
+            new PackRunApprovalDecisionRequest("run-1", "security-review", PackRunApprovalDecisionType.Approved, "approver@example.com", "LGTM"),
+            CancellationToken.None);
+
+        Assert.Equal("resumed", result.Status);
+        Assert.True(scheduler.ScheduledContexts.TryGetValue("run-1", out var context));
+        Assert.Equal(plan.Hash, context!.Plan.Hash);
+        Assert.Equal(PackRunApprovalStatus.Approved, approvalStore.LastUpdated?.Status);
+    }
+
+    [Fact]
+    public async Task ApplyAsync_ReturnsNotFoundWhenStateMissing()
+    {
+        var approvalStore = new InMemoryApprovalStore(new Dictionary<string, IReadOnlyList<PackRunApprovalState>>());
+        var stateStore = new InMemoryStateStore(new Dictionary<string, PackRunState>());
+        var scheduler = new RecordingScheduler();
+
+        var service = new PackRunApprovalDecisionService(
+            approvalStore,
+            stateStore,
+            scheduler,
+            NullLogger<PackRunApprovalDecisionService>.Instance);
+
+        var result = await service.ApplyAsync(
+            new PackRunApprovalDecisionRequest("missing", "approval", PackRunApprovalDecisionType.Approved, "actor", null),
+            CancellationToken.None);
+
+        Assert.Equal("not_found", result.Status);
+        Assert.False(scheduler.ScheduledContexts.Any());
+    }
+
+    private sealed class InMemoryApprovalStore : IPackRunApprovalStore
+    {
+        private readonly Dictionary<string, List<PackRunApprovalState>> _approvals;
+        public PackRunApprovalState? LastUpdated { get; private set; }
+
+        public InMemoryApprovalStore(IDictionary<string, IReadOnlyList<PackRunApprovalState>> seed)
+        {
+            _approvals = seed.ToDictionary(
+                pair => pair.Key,
+                pair => pair.Value.ToList(),
+                StringComparer.Ordinal);
+        }
+
+        public Task SaveAsync(string runId, IReadOnlyList<PackRunApprovalState> approvals, CancellationToken cancellationToken)
+        {
+            _approvals[runId] = approvals.ToList();
+            return Task.CompletedTask;
+        }
+
+        public Task<IReadOnlyList<PackRunApprovalState>> GetAsync(string runId, CancellationToken cancellationToken)
+        {
+            if (_approvals.TryGetValue(runId, out var existing))
+            {
+                return Task.FromResult<IReadOnlyList<PackRunApprovalState>>(existing);
+            }
+
+            return Task.FromResult<IReadOnlyList<PackRunApprovalState>>(Array.Empty<PackRunApprovalState>());
+        }
+
+        public Task UpdateAsync(string runId, PackRunApprovalState approval, CancellationToken cancellationToken)
+        {
+            if (_approvals.TryGetValue(runId, out var list))
+            {
+                for (var i = 0; i < list.Count; i++)
+                {
+                    if (string.Equals(list[i].ApprovalId, approval.ApprovalId, StringComparison.Ordinal))
+                    {
+                        list[i] = approval;
+                        LastUpdated = approval;
+                        break;
+                    }
+                }
+            }
+
+            return Task.CompletedTask;
+        }
+    }
+
+    private sealed class InMemoryStateStore : IPackRunStateStore
+    {
+        private readonly Dictionary<string, PackRunState> _states;
+
+        public InMemoryStateStore(IDictionary<string, PackRunState> states)
+        {
+            _states = new Dictionary<string, PackRunState>(states, StringComparer.Ordinal);
+        }
+
+        public Task<PackRunState?> GetAsync(string runId, CancellationToken cancellationToken)
+        {
+            _states.TryGetValue(runId, out var state);
+            return Task.FromResult(state);
+        }
+
+        public Task SaveAsync(PackRunState state, CancellationToken cancellationToken)
+        {
+            _states[state.RunId] = state;
+            return Task.CompletedTask;
+        }
+
+        public Task<IReadOnlyList<PackRunState>> ListAsync(CancellationToken cancellationToken)
+            => Task.FromResult<IReadOnlyList<PackRunState>>(_states.Values.ToList());
+    }
+
+    private sealed class RecordingScheduler : IPackRunJobScheduler
+    {
+        public Dictionary<string, PackRunExecutionContext> ScheduledContexts { get; } = new(StringComparer.Ordinal);
+
+        public Task ScheduleAsync(PackRunExecutionContext context, CancellationToken cancellationToken)
+        {
+            ScheduledContexts[context.RunId] = context;
+            return Task.CompletedTask;
+        }
+    }
+}
+
+internal static class TestPlanFactory
+{
+    public static TaskPackPlan CreatePlan()
+    {
+        var metadata = new TaskPackPlanMetadata("sample", "1.0.0", null, Array.Empty<string>());
+        var parameters = new Dictionary<string, TaskPackPlanParameterValue>(StringComparer.Ordinal);
+        var step = new TaskPackPlanStep(
+            Id: "step-a",
+            TemplateId: "run/image",
+            Name: "Run step",
+            Type: "run",
+            Enabled: true,
+            Uses: "builtin/run",
+            Parameters: parameters,
+            ApprovalId: "security-review",
+            GateMessage: null,
+            Children: Array.Empty<TaskPackPlanStep>());
+
+        return new TaskPackPlan(
+            metadata,
+            new Dictionary<string, JsonNode?>(StringComparer.Ordinal),
+            new[] { step },
+            "hash-123",
+            new[]
+            {
+                new TaskPackPlanApproval("security-review", new[] { "Packs.Approve" }, null, null)
+            },
+            Array.Empty<TaskPackPlanSecret>(),
+            Array.Empty<TaskPackPlanOutput>(),
+            new TaskPackPlanFailurePolicy(3, 30, false));
+    }
+
+    public static PackRunState CreateState(string runId, TaskPackPlan plan)
+    {
+        var timestamp = DateTimeOffset.UtcNow;
+        var steps = new Dictionary<string, PackRunStepStateRecord>(StringComparer.Ordinal)
+        {
+            ["step-a"] = new PackRunStepStateRecord(
+                "step-a",
+                PackRunStepKind.GateApproval,
+                true,
+                false,
+                null,
+                "security-review",
+                null,
+                PackRunStepExecutionStatus.Pending,
+                0,
+                null,
+                null,
+                null)
+        };
+
+        return PackRunState.Create(runId, plan.Hash, plan, plan.FailurePolicy ?? PackRunExecutionGraph.DefaultFailurePolicy, timestamp, steps, timestamp);
+    }
+}

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Tests/PackRunGateStateUpdaterTests.cs

@@ -129,7 +129,7 @@ public sealed class PackRunGateStateUpdaterTests
                 StatusReason: reason);
         }
 
-        return PackRunState.Create("run-1", plan.Hash, graph.FailurePolicy, steps, RequestedAt);
+        return PackRunState.Create("run-1", plan.Hash, plan, graph.FailurePolicy, RequestedAt, steps, RequestedAt);
     }
 
     private static IEnumerable<PackRunExecutionStep> EnumerateSteps(IReadOnlyList<PackRunExecutionStep> steps)

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.WebService/Program.cs

@@ -12,15 +12,27 @@ var builder = WebApplication.CreateBuilder(args);
 
 builder.Services.Configure<TaskRunnerServiceOptions>(builder.Configuration.GetSection("TaskRunner"));
 builder.Services.AddSingleton<TaskPackManifestLoader>();
-builder.Services.AddSingleton<TaskPackPlanner>();
-builder.Services.AddSingleton<PackRunSimulationEngine>();
-builder.Services.AddSingleton<PackRunExecutionGraphBuilder>();
-builder.Services.AddSingleton<IPackRunStateStore>(sp =>
-{
-    var options = sp.GetRequiredService<IOptions<TaskRunnerServiceOptions>>().Value;
-    return new FilePackRunStateStore(options.RunStatePath);
-});
-builder.Services.AddOpenApi();
+builder.Services.AddSingleton<TaskPackPlanner>();
+builder.Services.AddSingleton<PackRunSimulationEngine>();
+builder.Services.AddSingleton<PackRunExecutionGraphBuilder>();
+builder.Services.AddSingleton<IPackRunApprovalStore>(sp =>
+{
+    var options = sp.GetRequiredService<IOptions<TaskRunnerServiceOptions>>().Value;
+    return new FilePackRunApprovalStore(options.ApprovalStorePath);
+});
+builder.Services.AddSingleton<IPackRunStateStore>(sp =>
+{
+    var options = sp.GetRequiredService<IOptions<TaskRunnerServiceOptions>>().Value;
+    return new FilePackRunStateStore(options.RunStatePath);
+});
+builder.Services.AddSingleton(sp =>
+{
+    var options = sp.GetRequiredService<IOptions<TaskRunnerServiceOptions>>().Value;
+    return new FilesystemPackRunDispatcher(options.QueuePath, options.ArchivePath);
+});
+builder.Services.AddSingleton<IPackRunJobScheduler>(sp => sp.GetRequiredService<FilesystemPackRunDispatcher>());
+builder.Services.AddSingleton<PackRunApprovalDecisionService>();
+builder.Services.AddOpenApi();
 
 var app = builder.Build();
 
@@ -67,11 +79,11 @@ app.MapPost("/v1/task-runner/simulations", async (
     return Results.Ok(response);
 }).WithName("SimulateTaskPack");
 
-app.MapGet("/v1/task-runner/runs/{runId}", async (
-    string runId,
-    IPackRunStateStore stateStore,
-    CancellationToken cancellationToken) =>
-{
+app.MapGet("/v1/task-runner/runs/{runId}", async (
+    string runId,
+    IPackRunStateStore stateStore,
+    CancellationToken cancellationToken) =>
+{
     if (string.IsNullOrWhiteSpace(runId))
     {
         return Results.BadRequest(new { error = "runId is required." });
@@ -83,10 +95,43 @@ app.MapGet("/v1/task-runner/runs/{runId}", async (
         return Results.NotFound();
     }
 
-    return Results.Ok(RunStateMapper.ToResponse(state));
-}).WithName("GetRunState");
-
-app.MapGet("/", () => Results.Redirect("/openapi"));
+    return Results.Ok(RunStateMapper.ToResponse(state));
+}).WithName("GetRunState");
+
+app.MapPost("/v1/task-runner/runs/{runId}/approvals/{approvalId}", async (
+    string runId,
+    string approvalId,
+    [FromBody] ApprovalDecisionDto request,
+    PackRunApprovalDecisionService decisionService,
+    CancellationToken cancellationToken) =>
+{
+    if (request is null)
+    {
+        return Results.BadRequest(new { error = "Request body is required." });
+    }
+
+    if (!Enum.TryParse<PackRunApprovalDecisionType>(request.Decision, ignoreCase: true, out var decisionType))
+    {
+        return Results.BadRequest(new { error = "Invalid decision. Expected approved, rejected, or expired." });
+    }
+
+    var result = await decisionService.ApplyAsync(
+        new PackRunApprovalDecisionRequest(runId, approvalId, decisionType, request.ActorId, request.Summary),
+        cancellationToken).ConfigureAwait(false);
+
+    if (ReferenceEquals(result, PackRunApprovalDecisionResult.NotFound))
+    {
+        return Results.NotFound();
+    }
+
+    return Results.Ok(new
+    {
+        status = result.Status,
+        resumed = result.ShouldResume
+    });
+}).WithName("ApplyApprovalDecision");
+
+app.MapGet("/", () => Results.Redirect("/openapi"));
 
 app.Run();
 
@@ -146,19 +191,21 @@ internal sealed record RunStateResponse(
     DateTimeOffset UpdatedAt,
     IReadOnlyList<RunStateStepResponse> Steps);
 
-internal sealed record RunStateStepResponse(
-    string StepId,
-    string Kind,
-    bool Enabled,
-    bool ContinueOnError,
-    int? MaxParallel,
-    string? ApprovalId,
-    string? GateMessage,
-    string Status,
-    int Attempts,
-    DateTimeOffset? LastTransitionAt,
-    DateTimeOffset? NextAttemptAt,
-    string? StatusReason);
+internal sealed record RunStateStepResponse(
+    string StepId,
+    string Kind,
+    bool Enabled,
+    bool ContinueOnError,
+    int? MaxParallel,
+    string? ApprovalId,
+    string? GateMessage,
+    string Status,
+    int Attempts,
+    DateTimeOffset? LastTransitionAt,
+    DateTimeOffset? NextAttemptAt,
+    string? StatusReason);
+
+internal sealed record ApprovalDecisionDto(string Decision, string? ActorId, string? Summary);
 
 internal static class SimulationMapper
 {

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.WebService/TaskRunnerServiceOptions.cs

@@ -1,6 +1,9 @@
 namespace StellaOps.TaskRunner.WebService;
 
-public sealed class TaskRunnerServiceOptions
-{
-    public string RunStatePath { get; set; } = Path.Combine(AppContext.BaseDirectory, "state", "runs");
-}
+public sealed class TaskRunnerServiceOptions
+{
+    public string RunStatePath { get; set; } = Path.Combine(AppContext.BaseDirectory, "state", "runs");
+    public string ApprovalStorePath { get; set; } = Path.Combine(AppContext.BaseDirectory, "approvals");
+    public string QueuePath { get; set; } = Path.Combine(AppContext.BaseDirectory, "queue");
+    public string ArchivePath { get; set; } = Path.Combine(AppContext.BaseDirectory, "queue", "archive");
+}

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Worker/Program.cs

@@ -18,12 +18,14 @@ builder.Services.AddSingleton<IPackRunApprovalStore>(sp =>
     return new FilePackRunApprovalStore(options.Value.ApprovalStorePath);
 });
 
-builder.Services.AddSingleton<IPackRunJobDispatcher>(sp =>
+builder.Services.AddSingleton(sp =>
 {
     var options = sp.GetRequiredService<IOptions<PackRunWorkerOptions>>();
     var egressPolicy = sp.GetRequiredService<IEgressPolicy>();
     return new FilesystemPackRunDispatcher(options.Value.QueuePath, options.Value.ArchivePath, egressPolicy);
 });
+builder.Services.AddSingleton<IPackRunJobDispatcher>(sp => sp.GetRequiredService<FilesystemPackRunDispatcher>());
+builder.Services.AddSingleton<IPackRunJobScheduler>(sp => sp.GetRequiredService<FilesystemPackRunDispatcher>());
 
 builder.Services.AddSingleton<IPackRunNotificationPublisher>(sp =>
 {
@@ -49,6 +51,7 @@ builder.Services.AddSingleton<IPackRunStepExecutor, NoopPackRunStepExecutor>();
 builder.Services.AddSingleton<PackRunExecutionGraphBuilder>();
 builder.Services.AddSingleton<PackRunSimulationEngine>();
 builder.Services.AddSingleton<PackRunProcessor>();
+builder.Services.AddSingleton<IPackRunArtifactUploader, LoggingPackRunArtifactUploader>();
 builder.Services.AddHostedService<PackRunWorkerService>();
 
 var host = builder.Build();

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Worker/Services/PackRunWorkerService.cs

@@ -15,31 +15,34 @@ public sealed class PackRunWorkerService : BackgroundService
 
     private readonly IPackRunJobDispatcher dispatcher;
     private readonly PackRunProcessor processor;
-    private readonly PackRunWorkerOptions options;
-    private readonly IPackRunStateStore stateStore;
-    private readonly PackRunExecutionGraphBuilder graphBuilder;
-    private readonly PackRunSimulationEngine simulationEngine;
-    private readonly IPackRunStepExecutor executor;
-    private readonly ILogger<PackRunWorkerService> logger;
-
-    public PackRunWorkerService(
-        IPackRunJobDispatcher dispatcher,
-        PackRunProcessor processor,
-        IPackRunStateStore stateStore,
-        PackRunExecutionGraphBuilder graphBuilder,
-        PackRunSimulationEngine simulationEngine,
-        IPackRunStepExecutor executor,
-        IOptions<PackRunWorkerOptions> options,
-        ILogger<PackRunWorkerService> logger)
-    {
-        this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
-        this.processor = processor ?? throw new ArgumentNullException(nameof(processor));
+    private readonly PackRunWorkerOptions options;
+    private readonly IPackRunStateStore stateStore;
+    private readonly PackRunExecutionGraphBuilder graphBuilder;
+    private readonly PackRunSimulationEngine simulationEngine;
+    private readonly IPackRunStepExecutor executor;
+    private readonly IPackRunArtifactUploader artifactUploader;
+    private readonly ILogger<PackRunWorkerService> logger;
+
+    public PackRunWorkerService(
+        IPackRunJobDispatcher dispatcher,
+        PackRunProcessor processor,
+        IPackRunStateStore stateStore,
+        PackRunExecutionGraphBuilder graphBuilder,
+        PackRunSimulationEngine simulationEngine,
+        IPackRunStepExecutor executor,
+        IPackRunArtifactUploader artifactUploader,
+        IOptions<PackRunWorkerOptions> options,
+        ILogger<PackRunWorkerService> logger)
+    {
+        this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+        this.processor = processor ?? throw new ArgumentNullException(nameof(processor));
         this.stateStore = stateStore ?? throw new ArgumentNullException(nameof(stateStore));
-        this.graphBuilder = graphBuilder ?? throw new ArgumentNullException(nameof(graphBuilder));
-        this.simulationEngine = simulationEngine ?? throw new ArgumentNullException(nameof(simulationEngine));
-        this.executor = executor ?? throw new ArgumentNullException(nameof(executor));
-        this.options = options?.Value ?? throw new ArgumentNullException(nameof(options));
-        this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        this.graphBuilder = graphBuilder ?? throw new ArgumentNullException(nameof(graphBuilder));
+        this.simulationEngine = simulationEngine ?? throw new ArgumentNullException(nameof(simulationEngine));
+        this.executor = executor ?? throw new ArgumentNullException(nameof(executor));
+        this.artifactUploader = artifactUploader ?? throw new ArgumentNullException(nameof(artifactUploader));
+        this.options = options?.Value ?? throw new ArgumentNullException(nameof(options));
+        this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
     }
 
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
@@ -100,14 +103,15 @@ public sealed class PackRunWorkerService : BackgroundService
         var updatedState = await ExecuteGraphAsync(context, graph, state, cancellationToken).ConfigureAwait(false);
         await stateStore.SaveAsync(updatedState, cancellationToken).ConfigureAwait(false);
 
-        if (updatedState.Steps.Values.All(step => step.Status is PackRunStepExecutionStatus.Succeeded or PackRunStepExecutionStatus.Skipped))
-        {
-            logger.LogInformation("Run {RunId} finished successfully.", context.RunId);
-        }
-        else
-        {
-            logger.LogInformation("Run {RunId} paused with pending work.", context.RunId);
-        }
+        if (updatedState.Steps.Values.All(step => step.Status is PackRunStepExecutionStatus.Succeeded or PackRunStepExecutionStatus.Skipped))
+        {
+            logger.LogInformation("Run {RunId} finished successfully.", context.RunId);
+            await artifactUploader.UploadAsync(context, updatedState, context.Plan.Outputs, cancellationToken).ConfigureAwait(false);
+        }
+        else
+        {
+            logger.LogInformation("Run {RunId} paused with pending work.", context.RunId);
+        }
     }
 
     private async Task<PackRunState> CreateInitialStateAsync(
@@ -164,7 +168,14 @@ public sealed class PackRunWorkerService : BackgroundService
         }
 
         var failurePolicy = graph.FailurePolicy ?? PackRunExecutionGraph.DefaultFailurePolicy;
-        var state = PackRunState.Create(context.RunId, context.Plan.Hash, failurePolicy, stepRecords, timestamp);
+        var state = PackRunState.Create(
+            context.RunId,
+            context.Plan.Hash,
+            context.Plan,
+            failurePolicy,
+            context.RequestedAt,
+            stepRecords,
+            timestamp);
         await stateStore.SaveAsync(state, cancellationToken).ConfigureAwait(false);
         return state;
     }

src/TaskRunner/StellaOps.TaskRunner/TASKS.md

@@ -18,10 +18,11 @@
 
 ## Sprint 43 – Approvals, Notifications, Hardening
 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
-|----|--------|----------|------------|-------------|---------------|
-| TASKRUN-43-001 | DOING (2025-10-29) | Task Runner Guild | TASKRUN-42-001, NOTIFY-SVC-40-001 | Implement approvals workflow (resume after approval), notifications integration, remote artifact uploads, chaos resilience, secret injection, and audit logs. | Approvals/resume flow validated; notifications emitted; chaos tests documented; secrets redacted in logs; audit logs complete. |
-> 2025-10-29: Starting approvals orchestration — defining persistence/workflow scaffolding, integrating plan insights for notifications, and staging resume hooks.
-> 2025-10-29: Added approval coordinator + policy notification bridge with unit tests; ready to wire into worker execution/resume path.
+|----|--------|----------|------------|-------------|---------------|
+| TASKRUN-43-001 | DOING (2025-10-29) | Task Runner Guild | TASKRUN-42-001, NOTIFY-SVC-40-001 | Implement approvals workflow (resume after approval), notifications integration, remote artifact uploads, chaos resilience, secret injection, and audit logs. | Approvals/resume flow validated; notifications emitted; chaos tests documented; secrets redacted in logs; audit logs complete. |
+> 2025-10-29: Starting approvals orchestration — defining persistence/workflow scaffolding, integrating plan insights for notifications, and staging resume hooks.
+> 2025-10-29: Added approval coordinator + policy notification bridge with unit tests; ready to wire into worker execution/resume path.
+> 2025-11-06: Added approval decision API with resume requeue, persisted plan snapshots, and artifact uploader hook (logging backend pending).
 
 ## Authority-Backed Scopes & Tenancy (Epic 14)
 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |