An HITL gate is where the engine parks a workflow and waits for an explicit human signal before proceeding. The authoring contract is specified in HITL blocks; this document is the running lifecycle: what the operator sees, what the engine does with each answer, and why the resume path is built the way it is.
The lifecycle
running ──▶ escalation 1 of N ──▶ ... ──▶ escalation N of N
│ │
│ response │ no response
▼ ▼
fresh iteration park ──▶ resolution
(state cleared, (data · instruction ·
answer in context) gap acceptance · reject)| Stage | Semantics |
|---|---|
| Pause | The step halts before the action that requires a human |
| Escalation | Tiered signals, each carrying the step's diagnosis and consumed inputs |
| Park | Terminal escalation state; the workflow consumes no compute |
| Resolution | A response class — data provision, instruction, gap acceptance, reject |
| Resume | Fresh-iteration resume: execution state cleared, planning rerun with the answer in context |
Response classes in practice
| Signal | Effect | Ledger evidence |
|---|---|---|
| Data provision | Missing input injected; fresh planning iteration | Response event, new step_start with enriched context |
| Instruction | Directive applied; fresh planning iteration | Response event, new step_start under the correction |
| Gap acceptance | Zero-case exemption honored; step completes on the acknowledged gap | Response event, step_complete on the empty result |
| Reject | Terminal for the step; routes to compensation | Response event, compensation sequence |
One-shot consumption
A response is consumed exactly once — by the first escalation that reads it. An unconsumed response is stripped at hard-cap termination and cannot leak into a later, unrelated gate. Both rules exist for the same reason: a human answer is context for one decision, not a standing instruction for the run.
Why fresh-iteration resume
The resume path clears the failed attempt's execution state before re-planning. The alternative — replaying the failed attempt with the answer appended — is the defect this construction closes: a stale planner output that never reflected the human's answer would survive the resume, and the verifier back-edge would route around the very response that was supposed to fix the run. The answer takes effect by construction: planning runs again, with the response in context.
Park diagnosis
The park carries the step's diagnosis: the failure signature and the consumed-inputs digest. The operator resolves against evidence — what actually failed, against what input — not against a generic retry prompt.
| Diagnosis | Correct resolution class |
|---|---|
| Input gap — data missing that a human can supply | Data provision |
| Directive error — the step misread the task | Instruction |
| Honest scarcity — the input legitimately contains nothing to select | Gap acceptance |
| The step's goal is itself wrong | Reject |
NOTE — The one-shot consumption rule and the fresh-iteration resume are specified from incident post-mortems on the running system: a stale execution state that survived a human response, and a residual response that a later escalation consumed out of context. Both are defects of the same class — human context that does not bind cleanly to exactly one resume — and both are closed in the current baseline.