Tracks: #2797

Server returns input_required, accepts inputResponses + requestState on retry, validates them; the client-loop helper for the high-level Client to consume.

What's in it

• Server: return input_required, accept inputResponses/requestState on retry, validate them.
• requestState integrity — treat as untrusted input; verify integrity and reject on failure (spec MUST). Mechanism (HMAC, signature, etc.) is implementer's choice.
• Client-loop helper (call → input_required → fulfil via callbacks → retry; bounded; opt-out) — wired in by New Client (all-versions, low-level + high-level) #2894.

Conformance

• The 12 input-required-result-* server scenarios
• input-required-result-result-type
• Together with New Client (all-versions, low-level + high-level) #2894: sep-2322-client-request-state

Dependencies

• Depends on: Backwards compatibility & version negotiation #2892
• Depends on: Context object (layered, per-request) #2895

References

• MRTR pattern
• SEP-2322
• sep-2322.yaml