Every agent framework lets a model call a tool. Most will print something before a dangerous one. Far fewer actually stop.
That gap is easy to ship without noticing, because the two states look identical in a screenshot. A card that says "this will post to Slack, approve?" and a card that says the same thing and then posts anyway render the same pixels. The difference only shows up in the executor, and the executor is the part nobody screenshots.
I spent the last three days building graph execution into Vodou: a readable recipe format, a plan you see before anything runs, real parallel tool calls, and an approval gate. Thirty commits, fifty-nine files. Two of those commits exist because my gate was a warning label for two days and my parallel executor was never parallel.
What shipped
A recipe is the readable form of a plan. It compiles down to actions.json, which is what the engines actually run.
