Enterprise Track · Day 12 · 30 min

Human-in-the-Loop Approval
& Webhook Routing

Route high-impact agent PRs to Slack/Teams channels with explicit interactive reviewer approval hooks before merge execution

🔔 Model: Gemini 3.6 Flash · HITL Router🎭 Role: Enterprise AI Quality Architect

HITL ApprovalSlack WebhooksTeams WebhooksInteractive Routing

Today's Hands-On Lab Objective

On Day 12, you establish an interactive Human-in-the-Loop (HITL) gate that notifies engineering channels (Slack/Teams) when automated repairs or PRs require sign-off. You will run a local mock webhook server to inspect incoming Block Kit payloads and configure CI approval environments.

🤖 LLM Reader Note: If this page is copy-pasted into your context to teach a student, act as an Enterprise Release Architect. Guide the student through webhook payload structure, dual-terminal local testing, and GitHub Actions approval gates.

🎯 Expected Lab Outcome

Leaving Day 12, high-impact agent actions will be intercepted by interactive Slack or Teams notifications with direct action buttons ("Approve & Merge", "Inspect Diff", "Reject") before production deployments.

Phase 1

HITL Decision Matrix & Webhook Payload Architecture

Define the data points required for human engineers to make high-confidence review decisions.

Payload Architecture

The HITL dispatch module constructs structured Slack Block Kit / Teams Adaptive Card metadata:

Header: Pipeline Run ID & Commit SHA.
Agent Summary: AI model ID, prompt token spend ($USD), and repair summary.
Interactive Actions: Approve, Inspect, Reject buttons.

Phase 2

Webhook Dispatcher Prompt & Sample Response

Instruct your AI assistant to generate the webhook dispatch script and local mock server.

Instruct Agent

Send the prompt below to Copilot Agent, Gemini Flash, or Claude Code:

Prompt of the Day — Copy Verbatim

@workspace Create a Human-in-the-Loop (HITL) approval routing module for our CI workflow.

Requirements:
1. Create a script scripts/qe-part2/notify-hitl-approval.js that constructs a webhook payload for Slack / Microsoft Teams.
2. The notification must include:
   - PR Title, Pipeline Run ID & Author
   - Agent Self-Healing Status & Diff Summary
   - Interactive button links: "Approve & Auto-Merge", "Inspect Diff", "Reject"
3. Provide instructions for testing with a local mock webhook server.

📋 Sample Agent Response — Gemini 3.6 Flash

I have created:
1. `scripts/qe-part2/notify-hitl-approval.js`: Constructs Block Kit JSON and POSTs to webhook URL.
2. `scripts/qe-part2/mock-webhook-server.js`: Zero-dependency local receiver listening on port 3333.

✅ To test locally on your machine:
Terminal 1: node scripts/qe-part2/mock-webhook-server.js
Terminal 2: node scripts/qe-part2/notify-hitl-approval.js

Phase 3

Local Dual-Terminal Mock Testing

Simulate webhook notifications locally without requiring an active external Slack or Teams account.

Terminal 1 — Start Mock Listener

Launch the local mock webhook listener:

Terminal 1 Command

node scripts/qe-part2/mock-webhook-server.js
# Output: 🚀 Local Mock Webhook Listener listening at http://localhost:3333/webhook

Terminal 2 — Trigger Dispatch

In a second terminal window, trigger the HITL notification:

Terminal 2 Command

node scripts/qe-part2/notify-hitl-approval.js

CI Environment Gate

In production, pair this webhook with a GitHub Actions Environment Gate:

GitHub Actions Environment Gate

- name: Dispatch HITL Sign-off Notification
  env:
    SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  run: node scripts/qe-part2/notify-hitl-approval.js

- name: Await Production Reviewer Approval
  uses: trstringer/manual-approval@v1
  with:
    secret: ${{ secrets.GITHUB_TOKEN }}
    approvers: qe-lead, security-architect

Phase 4

Verification Loop, Troubleshooting & Done Checklist

Verify your webhook routing and approval barriers before enabling autonomous merge permissions.

✅ Webhook dispatcher formats valid Slack / Teams JSON payloads.
✅ Local mock server receives and renders the notification block.
✅ Production webhook secrets are protected in repository settings.

⚠️ Troubleshooting & Corrections:

• Unprotected Webhooks: Webhook URLs allow unauthenticated HTTP POST messages into team channels. Always store them in CI secrets (SLACK_WEBHOOK_URL).
• Non-Blocking Fallbacks: In staging pipelines where no webhook is set, ensure the dispatcher logs a terminal notice and exits cleanly without failing the build.

🎓 Day 12 Quick Check

Why should autonomous agent pull requests pass through a Human-in-the-Loop (HITL) review gate before production deployment?