Module hitl 

Risk-tiered HITL vocabulary shared across the executor, runtime, and surfaces.

Structs

HitlRequest

EventKind::HitlRequest payload: the durable, pinned approval request.

HitlResponse

EventKind::HitlResponse payload: the human’s decision, echoing the pin.

Enums

HitlMode

What the gate does for a tier.

RiskTier

How risky an action is. Ord is severity order: Read < … < Privileged. Tier is resolved most-restrictive-wins and is NEVER LLM-asserted.

Unanswered

What an Ask-tier gate does when nobody has answered yet.

Functions

default_mode

Default gate mode for a tier. Read runs unattended; everything mutating asks. A channel policy floor (future) may tighten Ask→Deny but never loosen.

tier_may_be_granted

May a run’s owner take standing responsibility for this tier in config — i.e. pre-approve it once instead of being asked every time?