Controlling execution lifecycle: pause, resume, and human authority

Human-in-the-loop is not a dashboard sticker. It is a runtime contract: humans must be able to intervene while work is in flight—without always paying the cost of cancel and restart.

Cancel says: discard outcomes; clean up; treat the run as terminal.
Pause says: stop advancing, preserve position and context, allow inspection, then resume when the human is satisfied.

This distinction matters to compliance officers, incident commanders, and any operator who has watched a model confidently proceed on poisoned inputs.

State machine (mental model)

At a high level, async executions move through operational states; pause and resume are explicit transitions governed by scope human_api:executions:pause (and related invoke policies for cancel/status):

queued — work is scheduled; pause removes the job from the queue surface and marks the row paused so nothing starts until resume.
processing — an agent is running; pause is requested; the agent cooperates by polling ctx.lifecycle.checkPaused() between major steps and yielding cleanly.
paused — human holds the token; resume re-queues with original intent.

Provenance should record who paused, when, and why—not as surveillance, but as auditability: the same principle that makes delegation trustworthy.

Why agents must cooperate

Pause during processing cannot be instant magic without unsafe interruption. Cooperative polling keeps filesystem, network, and partial writes bounded: the agent finishes the current step, observes paused, and stops.

In @human/agent-sdk, ctx.lifecycle.checkPaused() returns whether execution should yield (and optional reason). Long-running loops should call it the way they check cancellation or budgets.

Operator surfaces

HTTP: POST /v1/async-executions/:id/pause and .../resume with validated bodies (reason on pause).
CLI: human execution list|pause|resume|cancel|status for terminal workflows and scripts.
Command Plane: /executions list and detail views with action buttons—visibility turns policy into muscle memory.

Narrative: compliance hold

A reviewer sees mismatched invoice totals mid-batch. She hits Pause from the console. The worker stops scheduling new steps; the agent yields after the current extraction phase. She corrects the source file, adds a note on the pause reason, and hits Resume. The run continues from a known-good boundary—no re-ingestion of unrelated files, no mystery duplicate charges.

That is human authority expressed as infrastructure.

When to pause vs escalate

Pause when the human needs time or data correction inside the same run.
Escalate (ctx.approval) when a decision or risk acceptance must be recorded before proceeding—even if the model is confident.

They compose: pause the outer run while an approval ticket clears, then resume.

Closing

If the only lifecycle knob you offer is kill, you train operators to either over-correct (nuclear cancel) or under-correct (let bad runs finish). Pause/resume is the boring superpower that keeps HUMΛN aligned with Canon Principle Five: AI proposes; humans decide—and sometimes they need the mic mid-sentence.