ADK 2.0 graph workflow runtime — pause/resume, retry and durable HITL become native primitives

ADK 2.0 (GA 2026-06-30) replaces the hierarchical agent executor with a graph execution engine — agents, tools and functions become nodes, edges carry routing conditions — and in doing so turns pause/resume, durable human-in-the-loop and per-node retry into runtime primitives instead of hand-built guards sitting on top of the framework.

The signal that gives it away

You're looking at the 2.0 graph runtime, not 1.x with patches on top, when:

- Nodes are wired by typed routes — StringRoute, IntRoute, BoolRoute, MultiRoute, and a Default that fires when nothing else matches — rather than by an LLM deciding "what agent handles this next." - The graph supports fan-out/fan-in through `Join` nodes as barriers, nested sub-graphs, and loops as first-class: a node that already completed can be re-triggered, not just re-run from scratch. - A single LlmAgent runs on the exact same node-runtime as a full multi-step workflow — no special-casing between "just an agent" and "a workflow," which is the tell that you're on the unified 2.0 runner. - Migrating code trips on a specific, verifiable set of breaking changes: the first parameter of nodes/functions moves from agent.InvocationContext to agent.Context; ToolContext and CallbackContext are gone (tools, callbacks and nodes all take agent.Context); session.Event grows IsolationScope, Output, Routes, RequestedInput, NodeInfo fields, which breaks any test asserting exact event equality; session.NewEvent now requires a context (NewEvent(ctx, invocationID)); and a custom context type must implement two new methods, IsolationScope() and ResumedInput(id string). (The runtime-primitive claims above — graph structure, routing, HITL semantics, retry defaults, agent modes — are corroborated near-verbatim by the primary Google announcement. The specific Go API rename details in this paragraph come from our field notes plus one migration write-up and were not independently re-confirmed by a second public source at time of writing — treat them as accurate-per-source, not yet doubly cross-referenced.)

How it's exploited (what you now get for free)

- Human-in-the-loop as a primitive. Any node can pause the graph and ask a human a question, and the workflow durably waits for the answer — no external polling loop to build. Two resume shapes: *handoff* (the answer routes to the next node) and *re-entry* (the paused node reruns itself, reading the answer via ctx.ResumedInput(id)). - Durable resume across a process restart. ADK reconstructs a paused workflow by scanning session history, so a workflow can resume after the process that started it has died — state reconstruction is now the framework's job, not something you engineer externally with TTL'd artifacts or side-channel flags. - Retry per node with a real default policy. Out of the box: 5 attempts, 1s initial delay, 60s cap, 2x backoff, full jitter. Add a per-node timeout and a graph-wide concurrency cap via WithMaxConcurrency(n), and most of what used to be hand-rolled retry/backoff/timeout code around a fragile call disappears. - Agent modes — `Chat`, `Task`, `SingleTurn` — auto-install the matching tools (finish_task, single_turn, task) for the role an agent plays, instead of you wiring "how do I answer a gate" by hand with an ad hoc mix of text and function-response. - If you roll your own context type instead of using the framework's, the contract is exactly two methods: IsolationScope() and ResumedInput(id string).

What does NOT work (or doesn't carry over automatically)

- Native retry is not an idempotency guarantee. The runtime will retry a failed node for you — but if that node has an external side effect (a dispatch, a write, a charge), the runtime's retry re-triggers the effect exactly as readily as a hand-rolled retry loop would have. The fire-once guard on the *effect* itself is still entirely your job; the framework retrying the *node* changes nothing about that. See Idempotency guard with Redis SET NX — fire the dispatch once, never on retry-count alone. - A shim that keeps `InvocationContext`-shaped code alive tends to hide the real migration work. The new session.Event fields (IsolationScope, Output, Routes, RequestedInput, NodeInfo) only surface as a problem when a test asserting exact event equality breaks — treat that break as the signal to actually adopt the new event surface, not as something to patch around by loosening the assertion. - Agent Modes don't retroactively fix every caller's resume message shape. Modes standardize which tools a node installs; they don't guarantee that whatever is calling in still sends a resume message the new path expects. A caller mixing free text and a function-response in the same reply to a gate still breaks resume the same way it did before — see Answering a gate with text + functionResponse together silently breaks Workflow resume. - "Durable resume after restart" is not the same guarantee as "everything you read on resume is fresh." Two problems it does *not* erase: a resumed session reading a persisted-but-stale credential instead of a fresh one (401 on a resumed session: a helper preferred the expired token snapshotted in state over the fresh one in Redis), and an idempotency artifact whose TTL is shorter than a plausible resume gap, so an old resumed session silently redoes work it already did (A resumed old session redoes expensive work from scratch — the idempotency guard was reading a short-TTL artifact). Reconstructing *that a workflow was paused here* is a different guarantee from *every artifact it depends on is still valid*. - Assuming the native failure handling covers a human rejection or exhausted-retry design decision. The runtime retries and durably waits; it does not decide for you what should happen when a human says no, or when retries run out. That contract is still yours to design — see the next section.

What this changes about the rest of this wiki's adk/ cluster

Several pages here describe hand-built guards for problems the graph runtime now solves natively — this page names the shift, it doesn't replace the detail in those pages:

- No long-running agent framework handles failure for you — you need an explicit error contract — "no long-running framework handles failure natively" no longer holds unqualified against ADK 2.0: durable HITL pause/resume plus per-node retry with real defaults is now built in. What's still missing: an explicit contract for what happens when a human rejects, or retries exhaust — that design decision remains entirely on you. - Seven verified gotchas in a pause/resume-native workflow framework's primitives (checkpoint, resume_inputs, compaction, disconnect) — its seven verified gotchas (rerun-on-resume flags, compaction eating an open interrupt's event, disconnect during a synchronous run, interrupt-id reuse across loop rounds, and more) are about the edges of a specific pause/resume-native runtime once you're already on it. This page names the shift to that kind of runtime; that page is the field guide to its rough edges. - Idempotency guard with Redis SET NX — fire the dispatch once, never on retry-count alone and A resumed old session redoes expensive work from scratch — the idempotency guard was reading a short-TTL artifact — native per-node retry does not retire the external fire-once guard on side effects; it just means the retry loop calling into that guard is now the framework's, not yours. - 401 on a resumed session: a helper preferred the expired token snapshotted in state over the fresh one in Redis — durable resume from session history and "the credential is fresh" are two different guarantees; they compose, one doesn't subsume the other. - Answering a gate with text + functionResponse together silently breaks Workflow resume — agent Modes reframe how a gate answer is supposed to arrive; they don't retroactively fix a caller still sending the old ad hoc shape.