A suspension IS an approval request: queue one record per suspended step
path (idempotently — the store's partial unique open-step index collapses
duplicates, so re-queuing an already-queued gate is a no-op). EVERY path
files: .parallel() branches can suspend together
(summary.suspended = [['a'], ['b']]), and a gate that never reaches the
queue can never be decided — its connector then denies on every resume
(fail closed) with nothing telling a reviewer why the run is stuck.
Capturing each step's (suspendedAt, resumeCount) pair binds its approval to
THAT suspension exactly (clock-free grant minting), and each suspend
payload's connectors declares what a decision should mint.
requestedBy is the principal who advanced the run to this suspension — the
initiating human or automation, or the reviewer whose decision caused a
re-suspension at the next gate. It must not be invented by reconciliation:
the library's self-decision separation-of-duties check compares it to the
deciding actor.
systemPrincipalId names only the record's creator. The bridge mints its own
automated principal from it, so a host
never performs the trust assertion for the platform's own bookkeeping.
A suspension IS an approval request: queue one record per suspended step path (idempotently — the store's partial unique open-step index collapses duplicates, so re-queuing an already-queued gate is a no-op). EVERY path files:
.parallel()branches can suspend together (summary.suspended = [['a'], ['b']]), and a gate that never reaches the queue can never be decided — its connector then denies on every resume (fail closed) with nothing telling a reviewer why the run is stuck. Capturing each step's (suspendedAt, resumeCount) pair binds its approval to THAT suspension exactly (clock-free grant minting), and each suspend payload'sconnectorsdeclares what a decision should mint.requestedByis the principal who advanced the run to this suspension — the initiating human or automation, or the reviewer whose decision caused a re-suspension at the next gate. It must not be invented by reconciliation: the library's self-decision separation-of-duties check compares it to the deciding actor.systemPrincipalIdnames only the record's creator. The bridge mints its own automated principal from it, so a host never performs the trust assertion for the platform's own bookkeeping.