# Worker uncertainty handling: pause-not-timeout, severity × likelihood trigger, peer-consult deferred

When a Worker hits a mid-dispatch ambiguity whose worst-case outcome × likelihood-of-being-wrong crosses a workflow-configured threshold, the Worker emits a `pause_requested` terminal_event, exits cleanly, and the Agent re-dispatches once the operator answers via the Watchtower review queue. **There is no timeout-fallback-to-default for pause** — absence of an answer means the work waits. Pause-policy lives in a Resolver-injected envelope preamble (Workers spawn `--bare` and see neither CLAUDE.md nor hooks) with per-workflow override via `prompt_template` + `pause_threshold`. Peer-consultation (Worker asks a peer agent before escalating to operator) is the better shape — cheaper than operator pause in latency terms — but is deferred to a separate cross-agent-conversation arc (T-1804) because the substrate it depends on (persistent multi-party conversation with wakeup-of-non-running-agent, bounded round-trip, audit trail) doesn't fully exist today. v1 ships (a) post-hoc outcome eval + (b1) pause-to-operator. (b3) peer-consult unlocks when the cross-agent-conversation seam with TermLink is agreed and implemented.

The trigger is **severity × likelihood**, not "uncertainty." Uncertainty alone is too noisy — Workers are uncertain about lots of low-stakes things, and a pause-on-uncertainty model collapses into either pause-storms (operators ignore the queue) or under-pausing (the threshold gets raised until pause is effectively off). The grid-power analogy is the teaching case: when the downside is catastrophic and you got no answer to "is anyone working the lines?", the safest action is not to switch on the power — not to "assume safe." A timeout-fallback-to-default inverts the asymmetry exactly the wrong way.

## Considered Options

- **(a) Worker guesses + post-hoc outcome evaluator catches bad assumptions → re-dispatch.** Cheap and simple. Rejected as the *only* mechanism: for expensive workflows (multi-file builds, long-running multi-step work), full Worker run on the wrong path produces wrong output that must be detected and reverted — costlier than not having produced it. Outcome evaluators also catch a different class of error than pause does (they catch verification-failing output; they miss verification-passing-but-semantically-wrong output). Adopted as v1 baseline for low-stakes workflows; not sufficient by itself.

- **(b1) Worker pauses, exits cleanly, operator resolves via review queue, Agent re-dispatches.** Adopted for v1 on opt-in workflows. The exit-cleanly-and-re-dispatch shape uses existing `retry_of_dispatch_id` semantics — no new IPC, no resume-protocol complexity. The cost is operator latency on the critical path for opted-in workflows; mitigated by the severity × likelihood threshold being operator-curated per workflow.

- **(b2) Pause as a structural feature of all dispatch, default-off, uniform across workflows.** Rejected: workflows already encode asymmetry (`cost_cap_usd`, `variants`, `outcome_evaluator`) — pause-policy belongs in that same per-workflow layer. Forcing uniformity in policy where there isn't uniformity in workflow risk profile creates pressure to either over-engineer cheap workflows or under-protect expensive ones.

- **(b3) Worker consults a peer agent (reviewer / specialist / orchestrator) for a second opinion before escalating to operator.** Architecturally the best shape — cheaper than operator pause in latency terms, leverages specialist expertise where it exists, creates a tier of resolution before reaching the human, and yields a richer training signal for v2 self-improvement. Deferred to v2 because cross-agent conversation substrate has an unsolved gap: agents can't reliably notify and wake non-running peers without operator-driven polling loops. (T-1804 is the inception arc to close this gap jointly with TermLink.)

- **(c) Reclassify ambiguity-prone task_types to `inline: true`.** Considered as escape valve for workflows that can't tolerate operator-pause latency. Adopted as a structural option: workflows where pause is intolerable AND ambiguity is plausible should not dispatch — they should run inline with the Agent because Workers have no efficient operator-interaction channel. Not a fallback during dispatch; a workflow-level reclassification.

- **Timeout-fallback-to-default on no operator answer.** Rejected outright after the grid-power analogy. When the question being asked is "is this safe?" and the worst case is catastrophic, assuming "yes" on no-answer inverts the asymmetry. There is no timeout in (b1) — the work waits until the operator answers. Workflows that cannot tolerate "wait" must set `pause_threshold: high` (rare pause) or be reclassified `inline: true`.

- **Pause-policy in CLAUDE.md or hooks.** Rejected as structurally incompatible: Workers spawn with `--bare` (no CLAUDE.md auto-discovery, no PreToolUse hooks). The Resolver-injected envelope preamble is the only governance channel Workers see — the policy must live there. This makes `--bare` a feature: every Worker sees the same policy because the policy ships with the envelope, not the host filesystem.

## Consequences

- **Workflow schema gains `pause_threshold` and `allow_pause`** (both optional, defaults `allow_pause: false`, `pause_threshold: high`). Existing workflows are unaffected.
- **The Resolver gains a fifth responsibility**: prepending a baseline risk-assessment preamble to every dispatch prompt. Per-workflow `prompt_template` may extend or override it. ADR-0003's Resolver responsibility list extends from four to five (CONTEXT.md updated 2026-05-13).
- **A new terminal_event class lands**: `pause_requested`. Substrate already supports this (T-1777 persists `terminal_event` into `dispatches.jsonl`). Outcome row marks `terminal_event: paused_awaiting_resolution`.
- **Resume-via-re-dispatch is the pause-resolution mechanism.** Operator answer is captured in the review queue; Agent re-dispatches with the resolution context, linking via existing `retry_of_dispatch_id`. No new IPC.
- **Watchtower review queue gains a `[PAUSE]` prefix class.** Operator surfaces are existing; the addition is one prefix and a "live Worker awaiting resolution" property in the row.
- **Outcome evaluator (ADR-0003) remains load-bearing.** Pause catches some errors mid-flight; outcome eval catches different errors post-flight. They coexist; neither replaces the other.
- **Peer-consult (b3) becomes a dependency on the cross-agent-conversation arc** (T-1804). The pause-resolution model is built without depending on peer-consult, so the deferral does not block v1. When (b3) lands, the workflow schema will gain `allow_consult` / `consult_threshold` parallel to the pause knobs, and the Resolver preamble will be extended to instruct Workers when to consult vs pause.
- **v2-readiness:** pause events become a new signal class in `dispatches.jsonl`. Self-improvement can learn "which ambiguities were worth pausing for" — a richer signal than dispatch outcome alone. No retrofit needed; the `terminal_event` field is already in the schema.
- **The "interactive = inline; everything else dispatches" cut from ADR-0002 holds.** Pause does not turn dispatch into interactive work — pause exits cleanly and re-dispatches. The Worker never solicits operator input directly. The cut between Agent-interactive-work and Worker-dispatched-work stays structural.
