{"id":"human-review-cancellation","name":"Human review, interruption and cancellation","shortName":"Human review, interruption and cancellation","role":"Approve a concrete versioned action; stale approval invalidates on change; distinguish request, acknowledgement and committed effects.","description":"A useful review concerns a concrete proposed action: its resource, parameters, evidence and consequences. Approval for one quantity or destination cannot silently authorize another. The runtime should bind the decision to the exact payload and preserve that relationship across a pause or restart. A workflow interruption is also distinct from cancellation. A pause waits for more input; cancellation requests that execution stop. An already committed external effect may remain after cancellation is acknowledged, and a physical action may need time to stop. The incident experience reviews an exact reservation before service. Declining leaves inventory unchanged. Its cancel-after-commit case retains the reservation while preventing the work order, exposing the incomplete business state rather than pretending cancellation rolled the world back.","mechanism":["The worker persists the proposed action and enters a review state before mutating inventory.","The decision names the exact reviewed payload; editing a bound field requires a fresh decision.","Resume continues from the recorded boundary and does not reinterpret an old approval as broad permission.","Cancellation stops additional execution, while existing receipts describe effects that already committed."],"learningObjective":"Determine which exact action was approved and distinguish pause, cancellation and compensation.","engineeringExample":"An approval covers FAN-7, FILTER-A, quantity two, manual-fan-7 and reservation key K. A later request with quantity three does not match that approval. In the normal fixture, declining review leaves stock at four. If two units already committed before a lost response and cancellation follows, stock remains two and one reservation exists, but no work order is created. A compensating release would be a separate authorized action; this example does not execute one.","misconception":"Canceling a workflow does not automatically undo its completed side effects.","check":{"question":"Cancellation arrives after the reservation committed. Which statement is correct?","options":["The reservation necessarily disappears","The reservation remains unless a separate valid reversal occurs","The failed response proves no stock changed"],"answer":1,"explanation":"The receipt represents a committed external effect. Cancellation stops further work but does not erase it."},"checks":[],"prerequisites":["durable-actions-idempotency","tool-authority-identity"],"related":["tool-loop","evaluation"],"specs":[{"label":"Mechanism boundary","value":"What does approval or cancellation actually change?","context":"The executable equality check is canonical payload matching, not a cryptographic approval signature. Physical stop behavior and compensating transactions are outside the fixture."},{"label":"Evidence type","value":"Authored worked example","context":"The durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform."}],"interfaces":[{"name":"Declared input and state","direction":"in","signal":"The worker persists the proposed action and enters a review state before mutating inventory."},{"name":"Checked outcome","direction":"out","signal":"Determine which exact action was approved and distinguish pause, cancellation and compensation."}],"tradeoff":"Human review adds latency and must present enough evidence to make the decision meaningful; excessive generic prompts can obscure the one action that needs review.","whyAI":"AI assistance remains controllable when proposals, review decisions and effects have explicit boundaries.","sourceIds":["automation-langgraph-interrupts","automation-temporal-activities","automation-ros-actions"],"sources":[{"title":"LangGraph · Interrupts","url":"https://docs.langchain.com/oss/python/langgraph/interrupts"},{"title":"Temporal Activities","url":"https://docs.temporal.io/activities"},{"title":"ROS 2 Jazzy: Understanding actions","url":"https://raw.githubusercontent.com/ros2/ros2_documentation/jazzy/source/Concepts/Basic/About-Actions.rst"}],"science":[{"title":"Human review, interruption and cancellation · explicit relationship","equation":"Approval binds the exact proposed action. Pause waits for input; cancellation stops further execution; compensation is a separate action against an existing effect.","explanation":"An approval covers FAN-7, FILTER-A, quantity two, manual-fan-7 and reservation key K. A later request with quantity three does not match that approval. In the normal fixture, declining review leaves stock at four. If two units already committed before a lost response and cancellation follows, stock remains two and one reservation exists, but no work order is created. A compensating release would be a separate authorized action; this example does not execute one.","assumptions":"The executable equality check is canonical payload matching, not a cryptographic approval signature. Physical stop behavior and compensating transactions are outside the fixture."}],"evidenceNotes":"The durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform. The quantities and fixtures are authored. Source scope is recorded in the automation learning review manifest; no source benchmark or private system behavior is claimed. The executable equality check is canonical payload matching, not a cryptographic approval signature. Physical stop behavior and compensating transactions are outside the fixture.","level":"software","branch":"From request to durable action","subbranch":"Human review, interruption and cancellation","scale":"Logical state, task evidence and declared units; no physical assembly scale","kind":"system","workstream":"W11","visualFamily":"software-flow","labId":"library","labScope":"The durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform.","history":[],"workedTrace":{"declinedStock":4,"canceledAfterCommitStock":2,"canceledAfterCommitWorkOrders":0}}