elastic
diff --git a/‎package.json‎
Lines changed: 3 additions & 0 deletions b/‎package.json‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎src/platform/packages/shared/kbn-workflows-ui/src/api/types.ts‎
Lines changed: 1 addition & 0 deletions b/‎src/platform/packages/shared/kbn-workflows-ui/src/api/types.ts‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎src/platform/packages/shared/kbn-workflows-ui/src/api/workflows_api.test.ts‎
Lines changed: 19 additions & 0 deletions b/‎src/platform/packages/shared/kbn-workflows-ui/src/api/workflows_api.test.ts‎
Lines changed: 19 additions & 0 deletions
diff --git a/‎src/platform/packages/shared/kbn-workflows-ui/src/api/workflows_api.ts‎
Lines changed: 9 additions & 2 deletions b/‎src/platform/packages/shared/kbn-workflows-ui/src/api/workflows_api.ts‎
Lines changed: 9 additions & 2 deletions
diff --git a/‎src/platform/packages/shared/kbn-workflows/common/errors/index.ts‎
Lines changed: 1 addition & 0 deletions b/‎src/platform/packages/shared/kbn-workflows/common/errors/index.ts‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎src/platform/packages/shared/kbn-workflows/common/errors/workflow_execution_stale_resume_error.ts‎
Lines changed: 32 additions & 0 deletions b/‎src/platform/packages/shared/kbn-workflows/common/errors/workflow_execution_stale_resume_error.ts‎
Lines changed: 32 additions & 0 deletions
diff --git a/‎src/platform/packages/shared/kbn-workflows/types/v1.ts‎
Lines changed: 15 additions & 0 deletions b/‎src/platform/packages/shared/kbn-workflows/types/v1.ts‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎src/platform/plugins/shared/workflows_execution_engine/README.md‎
Lines changed: 4 additions & 0 deletions b/‎src/platform/plugins/shared/workflows_execution_engine/README.md‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎src/platform/plugins/shared/workflows_execution_engine/common/mappings.ts‎
Lines changed: 3 additions & 0 deletions b/‎src/platform/plugins/shared/workflows_execution_engine/common/mappings.ts‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎src/platform/plugins/shared/workflows_execution_engine/integration_tests/mocks/workflow_execution_repository.mock.ts‎
Lines changed: 27 additions & 0 deletions b/‎src/platform/plugins/shared/workflows_execution_engine/integration_tests/mocks/workflow_execution_repository.mock.ts‎
Lines changed: 27 additions & 0 deletions
@@ -1285,6 +1285,9 @@
     "@kbn/workflows-execution-engine": "link:src/platform/plugins/shared/workflows_execution_engine",
     "@kbn/workflows-extensions": "link:src/platform/plugins/shared/workflows_extensions",
     "@kbn/workflows-extensions-example": "link:examples/workflows_extensions_example",
+    "@kbn/workflows-hitl-common": "link:x-pack/platform/packages/shared/workflows/hitl-common",
+    "@kbn/workflows-hitl-form": "link:x-pack/platform/packages/shared/workflows/hitl-form",
+    "@kbn/workflows-hitl-telemetry": "link:x-pack/platform/packages/shared/workflows/hitl-telemetry",
     "@kbn/workflows-management-plugin": "link:src/platform/plugins/shared/workflows_management",
     "@kbn/workflows-ui": "link:src/platform/packages/shared/kbn-workflows-ui",
     "@kbn/workflows-yaml": "link:src/platform/packages/shared/kbn-workflows-yaml",
 
@@ -135,6 +135,7 @@ export interface WorkflowExecutionLogsResponse {
 }
 
 export interface ResumeExecutionParams {
+  expectedResumeSeq?: number;
   input: Record<string, unknown>;
 }
 
 
@@ -385,6 +385,25 @@ describe('WorkflowApi', () => {
         version: VERSION,
       });
     });
+
+    it('should include expected_resume_seq in body when expectedResumeSeq is provided', async () => {
+      const input = { answer: 'yes' };
+      await api.resumeExecution('exec-1', { expectedResumeSeq: 3, input });
+
+      expect(http.post).toHaveBeenCalledWith('/api/workflows/executions/exec-1/resume', {
+        body: JSON.stringify({ expected_resume_seq: 3, input }),
+        version: VERSION,
+      });
+    });
+
+    it('should omit expected_resume_seq from body when expectedResumeSeq is not provided', async () => {
+      const input = { answer: 'yes' };
+      await api.resumeExecution('exec-1', { input });
+
+      const callArgs = (http.post as jest.Mock).mock.calls[0][1];
+      const parsed = JSON.parse(callArgs.body);
+      expect(parsed).not.toHaveProperty('expected_resume_seq');
+    });
   });
 
   describe('getExecutionLogs', () => {
 
@@ -262,9 +262,16 @@ export class WorkflowApi {
     );
   }
 
-  async resumeExecution(executionId: string, { input }: ResumeExecutionParams): Promise<void> {
+  async resumeExecution(
+    executionId: string,
+    { expectedResumeSeq, input }: ResumeExecutionParams
+  ): Promise<void> {
     return this.http.post(`${BASE}/executions/${encodeURIComponent(executionId)}/resume`, {
-      body: JSON.stringify({ input }),
+      body: JSON.stringify(
+        expectedResumeSeq !== undefined
+          ? { expected_resume_seq: expectedResumeSeq, input }
+          : { input }
+      ),
       version: API_VERSION,
     });
   }
 
@@ -9,5 +9,6 @@
 
 export { WorkflowExecutionNotFoundError } from './workflow_execution_not_found_error';
 export { WorkflowExecutionInvalidStatusError } from './workflow_execution_invalid_status_error';
+export { WorkflowExecutionStaleResumeError } from './workflow_execution_stale_resume_error';
 export { WorkflowDisabledError } from './workflow_disabled_error';
 export { WorkflowNotFoundError } from './workflow_not_found_error';
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+/**
+ * Thrown by `resumeWorkflowExecution` when the caller's `expectedResumeSeq` does
+ * not match the workflow execution's current `resume_seq + 1`. Indicates that
+ * another resume already advanced the execution and this submission is stale.
+ *
+ * Callers should treat this as an idempotent rejection — no retry; refetch
+ * canonical state and surface a stale acknowledgement to the user.
+ */
+export class WorkflowExecutionStaleResumeError extends Error {
+  public readonly executionId: string;
+  public readonly expectedResumeSeq: number;
+  public readonly currentResumeSeq: number;
+
+  constructor(executionId: string, expectedResumeSeq: number, currentResumeSeq: number) {
+    super(
+      `Workflow execution "${executionId}" stale resume: expected resume_seq=${expectedResumeSeq}, current=${currentResumeSeq}.`
+    );
+    this.name = 'WorkflowExecutionStaleResumeError';
+    this.executionId = executionId;
+    this.expectedResumeSeq = expectedResumeSeq;
+    this.currentResumeSeq = currentResumeSeq;
+  }
+}
@@ -154,6 +154,14 @@ export interface EsWorkflowExecution {
   eventChainVisitedWorkflowIds?: string[];
   /** Trigger dispatch id from event-driven scheduling (`context.metadata.eventId`), when set */
   dispatchEventId?: string;
+  /**
+   * Monotonic counter incremented on every HITL (waitForInput) resume. Used by the
+   * resumeWorkflowExecution CAS path to reject stale resume calls atomically without
+   * relying on ES `_seq_no`/`_primary_term` retries.
+   *
+   * Missing on documents created before this field was added; treat as 0.
+   */
+  resume_seq?: number;
 }
 
 export interface ProviderInput {
@@ -245,6 +253,13 @@ export interface WorkflowExecutionDto {
   traceId?: string; // APM trace ID for observability
   entryTransactionId?: string; // APM root transaction ID for trace embeddable
   concurrencyGroupKey?: string; // Evaluated concurrency group key for grouping executions
+  /**
+   * Monotonic counter incremented on every HITL (waitForInput) resume. Mirrors
+   * {@link EsWorkflowExecution.resume_seq}; present in the DTO so callers can
+   * compute the next `expectedResumeSeq` for CAS-protected resume calls.
+   * Missing on documents created before this field was added; treat as 0.
+   */
+  resume_seq?: number;
 }
 
 export type WorkflowExecutionListItemDto = Omit<
 
@@ -115,6 +115,10 @@ Integrates with Kibana's Task Manager to schedule and execute workflows.
 - `workflow:run` - Execute a workflow immediately or on schedule
 - `workflow:resume` - Resume a paused or failed workflow execution
 
+**HITL concurrency safety:** When a `waitForInput` step is used in conjunction with Agent Builder, the Inbox, or the Workflows execution view, resume calls are CAS-protected. `resumeWorkflowExecution` accepts an optional `expectedResumeSeq` and delegates to `casIncrementResumeSeq` — an Elasticsearch Painless update script that atomically increments `resume_seq` or returns a no-op if the sequence number has already been advanced. A losing CAS raises `WorkflowExecutionStaleResumeError`, which each surface converts to a user-facing stale UX without corrupting execution state.
+
+- For the full HITL architecture, race-condition analysis, and debug traces, see the [HITL deep-dive — Sequence Numbers & CAS](/x-pack/platform/packages/shared/workflows/hitl-common/README.md#sequence-numbers--cas).
+
 ---
 
 ### 2. Workflow Execution Loop
 
@@ -85,6 +85,9 @@ export const WORKFLOWS_EXECUTIONS_INDEX_MAPPINGS: MappingTypeMapping = {
     concurrencyGroupKey: {
       type: 'keyword',
     },
+    resume_seq: {
+      type: 'long',
+    },
   },
 };
 
 
@@ -244,6 +244,33 @@ export class WorkflowExecutionRepositoryMock implements Required<WorkflowExecuti
     return results;
   }
 
+  public async casIncrementResumeSeq({
+    id,
+    spaceId,
+    expectedSeq,
+  }: {
+    id: string;
+    spaceId: string;
+    expectedSeq: number;
+  }): Promise<{ won: boolean; currentSeq: number }> {
+    const execution = this.workflowExecutions.get(id);
+    if (!execution || execution.spaceId !== spaceId) {
+      return { won: false, currentSeq: -1 };
+    }
+    const current =
+      typeof (execution as unknown as { resume_seq?: number }).resume_seq === 'number'
+        ? (execution as unknown as { resume_seq: number }).resume_seq
+        : 0;
+    if (current === expectedSeq - 1) {
+      this.workflowExecutions.set(id, {
+        ...execution,
+        ...({ resume_seq: expectedSeq } as unknown as Partial<typeof execution>),
+      } as typeof execution);
+      return { won: true, currentSeq: expectedSeq };
+    }
+    return { won: false, currentSeq: current };
+  }
+
   public async bulkUpdateWorkflowExecutions(
     updates: Array<Partial<EsWorkflowExecution>>
   ): Promise<void> {
Original file line number	Diff line number	Diff line change
`@@ -135,6 +135,7 @@ export interface WorkflowExecutionLogsResponse {`
`135`	`135`	`}`
`136`	`136`
`137`	`137`	`export interface ResumeExecutionParams {`
	`138`	`+ expectedResumeSeq?: number;`
`138`	`139`	`input: Record<string, unknown>;`
`139`	`140`	`}`
`140`	`141`