boost-backend — HITL approval flow and SonataFlow integration (issue 8 of 15)

[gabemontero]

Labels: ready-to-code
Depends on: Issue 6

Implement the human-in-the-loop approval service for tool calls, including built-in approval and SonataFlow-managed external workflow with X-Boost-Workflow-Callback header.

Tasks

From openspec/changes/platform-operations-deployment/tasks.md:

• 1.10 HITL approval state: request-scoped cacheService

Specifications

• openspec/changes/ai-chat-interaction-experience/specs/hitl-approval/spec.md
• openspec/changes/security-safety-governance/specs/access-control/spec.md — SonataFlow trust boundary scenarios

[fullsend-ai-triage]

Triage: Blocked

This issue is blocked by #3302 (boost-backend — Streaming chat and normalized event pipeline, issue 6 of 15), which is still open. The issue body explicitly declares this dependency.

Additionally, the specification files referenced in the issue description — under the openspec/ directory — do not currently exist in the repository. These specs would be needed to define the HITL approval service contract and SonataFlow integration details before implementation can begin.

Next steps

• Resolve boost-backend — Streaming chat and normalized event pipeline (issue 6 of 15) #3302 (streaming chat and event pipeline) first.
• Ensure the referenced spec files are committed to the repository so that the implementation requirements are available to developers.

Once the dependency is resolved and specs are in place, this issue can be re-triaged for implementation.

---

Labels: This is a boost-backend feature issue related to AI integrations; the ai-integrations label matches the workspace area.