A suspension is an approval request unless its step is in
summary.suspensionTimers, which the run's Durable Object resumes itself.
Queue one record per other suspended step path (idempotently — the store's
partial unique open-step index collapses duplicates, so re-queuing an
already-queued gate is a no-op). EVERY such path files: .parallel()
branches can suspend together (summary.suspended = [['a'], ['b']]), and a
gate that never reaches the queue can never be decided — its connector then
denies on every resume (fail closed) with nothing telling a reviewer why the
run is stuck.
Capturing each step's (suspendedAt, resumeCount) pair binds its approval to
THAT suspension exactly (clock-free grant minting), and each suspend
payload's connectors declares what a decision should mint.
requestedBy is the principal who advanced the run to this suspension — the
initiating human or automation, or the reviewer whose decision caused a
re-suspension at the next gate. It must not be invented by reconciliation:
the library's self-decision separation-of-duties check compares it to the
deciding actor.
systemPrincipalId names only the record's creator. The bridge mints its own
automated principal from it, so a host
never performs the trust assertion for the platform's own bookkeeping.
A suspension is an approval request unless its step is in
summary.suspensionTimers, which the run's Durable Object resumes itself. Queue one record per other suspended step path (idempotently — the store's partial unique open-step index collapses duplicates, so re-queuing an already-queued gate is a no-op). EVERY such path files:.parallel()branches can suspend together (summary.suspended = [['a'], ['b']]), and a gate that never reaches the queue can never be decided — its connector then denies on every resume (fail closed) with nothing telling a reviewer why the run is stuck. Capturing each step's (suspendedAt, resumeCount) pair binds its approval to THAT suspension exactly (clock-free grant minting), and each suspend payload'sconnectorsdeclares what a decision should mint.requestedByis the principal who advanced the run to this suspension — the initiating human or automation, or the reviewer whose decision caused a re-suspension at the next gate. It must not be invented by reconciliation: the library's self-decision separation-of-duties check compares it to the deciding actor.systemPrincipalIdnames only the record's creator. The bridge mints its own automated principal from it, so a host never performs the trust assertion for the platform's own bookkeeping.