Human-in-the-Loop Approval Routing

Actions above a defined authority threshold pause until the right qualified human approves, with the request, context, and decision all recorded.

L4 · Orchestration — its place in the stack (left, click any layer) and its internal components (right). Telemetry rises; control descends.

When a human must decide

Not every action can or should be autonomous. Layer 4 classifies each proposed action by an authority level and routes those above a threshold to a qualified human before execution. Examples: a first shot at a new breeder operating point, a change to the burner plug-field target, or any action the copilot flags as low-confidence. The procedure blocks at a gate step until approval or rejection arrives.

Routing by role and qualification

python

def route(action):
    lvl = authority_level(action)          # L0 auto ... L3 dual-approval
    if lvl == L0: return AUTO
    approvers = qualified_for(action.domain, lvl)   # e.g. session_leader, magnet_engineer
    req = ApprovalRequest(action, context=lineage(action), deadline=action.gate_deadline)
    return await_quorum(req, approvers, policy=quorum_policy(lvl))

What the approver sees

The proposed command and its origin (which twin or copilot version proposed it).
The safety-envelope verdict and remaining margin.
The relevant machine state and the predicted effect.
A single, unambiguous approve / reject, never a free-form command entry.

Approvers approve, they do not command

A human gate is a veto-and-consent point, not a back door to inject arbitrary actions. The approver can only accept or reject the specific, already-bounded proposal in front of them. This keeps the same safety checks in force regardless of who is at the console and prevents an approval from bypassing the envelope checker.

Timeouts and defaults

Every gate has a deadline. If no decision arrives in time the default is the safe outcome, which for a pending energizing action is REJECT and for a pending abort is PROCEED. Quorum rules for high-authority actions are covered in approval policy and quorum. Every request, the context shown, the decider identity, and the decision are written to the lineage bus.