# @garuda/runtime — workflow-derived runtime resolution

After login, the operator/manager experience is **resolved from the published Workflow** (PRD §7): role →
scope, navigation and permitted operations. No per-customer code.

- `resolveRuntime(cfg, roleKey)` → `{ role, scope, navigation[], canOperate, canApprove, readOnly, permissions }`. Navigation menus are gated by the permissions the role holds (from `customerSolution.roles`).
- `validateSelection(cfg, {po,asn,hu})` → referential check for AC-RT-02.
- `session-lock.js` `HuLock` → per-HU concurrency lock (AC-RT-16 / NFR-003); in-memory proves the semantic, Redis is the production impl (swappable seam).

Drives AC-RT-01/02/16/18/19/20/21/22 in `platform/acceptance`.