Sub-SOP Orchestration — Escepine Docs

A SUB_SOP step invokes another SOP as a nested workflow. Composition is how large procedures stay declarative: the parent states that a sub-procedure must complete; the child is a full workflow with its own state machine, gates, and evidence trail. The mechanics below are what keep nesting from becoming the failure mode.

Child isolation

Dimension	Semantics
Identity	Own workflow identity; generations carry the `_rN` suffix
Checkpoints	Own checkpoint trail, independent of the parent's
Budgets	Own budget envelope — the child cannot consume the parent's headroom
Ledger	Full child event trail is part of the parent's evidence

The parent consumes only the child's terminal artifacts. Downstream steps never see child internals — no partial state, no mid-flight outputs.

Artifact propagation

Child terminal artifacts enter the parent's artifact space at the join, and downstream hydration references them like any other artifact. The parent's dispatch loop resumes exactly as it does for a native step: dependencies satisfied, steps released. Nothing downstream knows whether an upstream value came from a REASONING step or a completed sub-procedure.

Regeneration

Property	Semantics
Mechanism	A failed child is re-instantiated as a new generation — new identity, new checkpoint trail
Never in place	The failed generation is never re-run: its checkpoints are not rewound
Bound	Hard regeneration cap per sub-SOP step
Counter persistence	Escalation counters carry across generations — a new generation does not reset the human budget

parent step (SUB_SOP)
  │ dispatch
  ▼
child _r1 ── terminal failure ──▶ regenerate (bounded cap)
  │
  ▼
child _r2 ── same failure signature ──▶ circuit breaker trips
                                          │
                                          ▼
                                     park: signature + diagnosis

The circuit breaker

Regeneration exists for transient failure. A deterministic failure — identical error, identical inputs, no state change between attempts — is not transient, and regenerating against it produces a storm, not a recovery. The breaker enforces the distinction.

Trip condition	Effect
Consecutive generations fail with the same deterministic signature	Regeneration halts immediately
Signature with no state change between failures	The workflow parks with the signature and diagnosis attached
Transient failure (state changed, or signature differs)	Regeneration proceeds within the cap

The park carries the diagnosis, so the human resolves against evidence — the actual failing signature — not against a wall of retries.

Honest scarcity in children

A child whose input legitimately contains nothing to select completes under the zero-case rule: the self-attesting empty result is a valid terminal artifact, and the parent proceeds on it. An empty child result is not a child failure — conflating the two is what makes workflows unfinishable, and the engine does not conflate them.

Parent-side failure path

Child fails terminally or the breaker trips → regeneration up to the cap → parent-side escalation ladder → park. Each stage is a ledger event; the parent's evidence trail contains the child's full history, every generation included.