Generic approval node defaults to approved and routes to protected tool without human decision #3

Activity

1. Tardfyou commented on Oct 24, 2026

   

   Tardfyou

   on Oct 24, 2026

   Author

   More actions

   Detailed reproduction

   Location: agentorch/runtime/workflow_execution.py:405-411 (handle_approval) and agentorch/workflow/runner.py:12-43

   The bug: When runtime.human_feedback is None (no feedback mechanism configured), the approval node's handle_approval method returns "approved" by default rather than blocking. The workflow then routes to the protected tool via the condition edge.

   PoC (extracted from real source, executed offline):

   # RuntimeWorkflowExecutor.handle_approval at line 405-411:
   # When human_feedback is None, it does NOT wait for input
   # Instead it returns an approved status, allowing the workflow to proceed
   # to the tool node which executes write_marker
   
   # The proof sets:
   executor.runtime = SimpleNamespace(tools=FakeTools(), human_feedback=None)
   # ↑ human_feedback=None → no human can approve
   # But the workflow still executes the protected tool
   
   # Result: marker file created WITHOUT any human verdict
   assert executor.runtime.human_feedback is None  # no feedback mechanism
   assert MARKER.exists()  # but the effect happened

   Suggested fix: When human_feedback is None, the approval node should either raise an error (no mechanism to obtain approval) or return a "pending" status that blocks the workflow.