Human-in-the-loop approval

Every tool call passes permission → policy → schema → confirmation → execute → audit. Approval is demanded by any of: the tool's sensitive flag, a policy rule (confirm / consent effects), a skill's confirmation: "always" rule, or middleware.

1. 1

   The run parks, you get an approval id

   const out = await lybo.submitInput(session, "export my report");
   // { state: "awaiting_approval", approval_id: "apr_…", reason: "…" }

2. 2

   Show the redacted preview

   The tool.awaitingApproval event carries the tool name and argument preview with PII already redacted.

3. 3

   Resolve — the workflow resumes exactly where it paused

   await lybo.resolveApproval(approvalId, true /* or false */);