A suspension IS an approval request: queue one record per suspended step
path (idempotently — the store's partial unique open-step index collapses
duplicates, so re-queuing an already-queued gate is a no-op). EVERY path
files: .parallel() branches can suspend together
(summary.suspended = [['a'], ['b']]), and a gate that never reaches the
queue can never be decided — its connector then denies on every resume
(fail closed) with nothing telling a reviewer why the run is stuck.
Capturing each step's (suspendedAt, resumeCount) pair binds its approval to
THAT suspension exactly (clock-free grant minting), and each suspend
payload's connectors declares what a decision should mint.
requestedBy is the HUMAN who advanced the run to this suspension — the actor
who started it, or the reviewer whose decision caused a re-suspension at the
next gate. It must NOT be the system actor: the library's self-decision
separation-of-duties check compares requestedBy to the deciding actor, so
attributing every request to the system actor would make that check unfireable.
systemActorId names only the record's creator. The bridge mints its own
automated principal from it against the service's tenant binding, so a host
never performs the trust assertion for the platform's own bookkeeping.
A suspension IS an approval request: queue one record per suspended step path (idempotently — the store's partial unique open-step index collapses duplicates, so re-queuing an already-queued gate is a no-op). EVERY path files:
.parallel()branches can suspend together (summary.suspended = [['a'], ['b']]), and a gate that never reaches the queue can never be decided — its connector then denies on every resume (fail closed) with nothing telling a reviewer why the run is stuck. Capturing each step's (suspendedAt, resumeCount) pair binds its approval to THAT suspension exactly (clock-free grant minting), and each suspend payload'sconnectorsdeclares what a decision should mint.requestedByis the HUMAN who advanced the run to this suspension — the actor who started it, or the reviewer whose decision caused a re-suspension at the next gate. It must NOT be the system actor: the library's self-decision separation-of-duties check comparesrequestedByto the deciding actor, so attributing every request to the system actor would make that check unfireable.systemActorIdnames only the record's creator. The bridge mints its own automated principal from it against the service's tenant binding, so a host never performs the trust assertion for the platform's own bookkeeping.