fix(human-decision): give operator disagreement a closed wire channel

[abrichr]

Why

The attended decision vocabulary is closed at continue / skip / teach / escalate. When the engine is correct to halt — the record genuinely says Ineligible — the operator's only one-tap options are to assert they fixed something (verify_and_resume) or to hand it to a colleague (escalate). There is no way to say "you were right, stop."

Consequences:

• Disagreement has no channel, so the answer distribution can never report how often halts are correct — data needed before tuning halt rates.
• The absence of a visible reject option communicates that disagreement is not an expected outcome.
• The only one-tap resolution is the agreeable one, which is the shape that produces rubber-stamping.

What

• HumanDecisionAction.REJECT = "reject".
• HumanDecisionReceiptState.REJECTED + HumanDecisionReceiptReason.REJECTED_BY_OPERATOR, pinned as a pair in HUMAN_DECISION_RECEIPT_REASONS.
• allowed_actions max_length 4 → 5.
• Regenerated human-decision-task-v1.json / human-decision-receipt-v1.json.

Design notes

reject is not a relabelled escalate. escalate parks the run — the durable pause stays intact and a colleague can continue it. reject terminates it. Collapsing them destroys the signal the action exists to obtain.

reject is scoped to one run. It asserts that this run must not proceed, not that the saved workflow is wrong. The latter changes future runs and belongs to teach, which carries the demonstration and requalification gate that authority requires.

No free text anywhere. The cause is a closed enum with exactly one member today. A reason taxonomy would make the distribution far more informative, but there is no evidence yet for its members — the reject rate is the data that would design them — and a wrong taxonomy is worse than none. Adding members later is additive; a free-text reason could never be closed again.

max_length 4 → 5 is the load-bearing part of the additive change. The bound is the size of the vocabulary, not a policy. A pause that is skippable, re-verifiable, rejectable, teachable and escalatable is legitimate, and a stale bound would have refused to issue that task at all — a refusal in exactly the case where the operator has the most choice. Covered by a new test.

Release

fix: on purpose, not feat:. major_on_zero = false means feat: would cut 0.7.0 and fall outside openadapt-flow's openadapt-types>=0.6.2,<0.7.0 pin. This lands as 0.6.3, inside the pin. Flow's floor is raised to >=0.6.3 in its own PR, because a floor that predates a new symbol fails at import, not at resolve.

Precedent: #13 (fix: close the attended terminal-outcome contract gap with HumanDecisionReceiptV1) added the entire receipt model under fix:.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM