An Hitl block declares the human-participation contract of a step: when the engine must stop, how it asks, and what it does with the answer. The block is the authoring surface; the running lifecycle — pause, escalation, park, resume — is specified in HITL gates.
The block
The block declares four things. Wire-level field names are pinned in the annotated SOP; the contract is:
| Declares | Semantics |
|---|---|
| Escalation budget | Number of human signals issued before the park — 1 of N, 2 of N. |
| Escalation payload | What each signal carries: the step's diagnosis and its consumed inputs. |
| Park condition | Terminal escalation exhausted without resolution. |
| Response contract | The classes of answer the engine accepts, and their effects. |
Escalation ladder
Each tier signals a human with the step's diagnosis and the inputs already consumed. A response is consumed exactly once — by the first escalation that reads it — and never persists to influence a later gate. An unconsumed response is stripped at hard-cap termination; it cannot leak into an unrelated escalation.
Response classes
| Class | Effect |
|---|---|
| Data provision | Injected into step context; triggers a fresh planning iteration with the data in scope |
| Instruction | Treated as a directive; triggers a fresh planning iteration |
| Gap acceptance | Acknowledges that an input gap is real; the verification zero-case exemption is honored and the step completes on the acknowledged gap |
| Reject | Terminal for the step; routes to Saga compensations |
A response triggers a fresh-iteration resume: the step's execution state is cleared and planning rerun with the response in context. The failed attempt is never blindly re-executed.
Choosing the response class
| Condition | Correct class |
|---|---|
| The step failed for lack of data a human can supply | Data provision |
| The step misread the task and needs a directive | Instruction |
| The input legitimately contains nothing to select — honest scarcity | Gap acceptance |
| The step's goal is itself wrong | Reject |
A retry-class response against a data-level gap re-enters planning with unchanged context, which cannot resolve the gap — the input still contains nothing to select. Gap acceptance exists for exactly this condition; the escalation payload's diagnosis states which condition holds.