@opengeni/worker-bundle 1.0.0-canary.0 → 1.0.0

package/src/activities/agent-turn/run.ts

@@ -1,5 +1,14 @@
+import { withClaudeConnectionCredential } from "@opengeni/config";
+import {
+  getSessionAuthorityProjection,
+  readActiveSandbox,
+  getWorkspaceCredentialProvider,
+  resolveClaudeAccountCredential,
+  ClaudeSubscriptionReconnectRequired,
+} from "@opengeni/db";
+import { routingEnabled } from "../../sandbox-routing";
+import { resolveAgentToolFamilies } from "@opengeni/contracts";
 import { createKnowledgeSourceSyncActivities } from "../knowledge-source-sync";
-import { prepareTurnKnowledgeSources } from "./knowledge-sources";
 import {
   assertModelConnectionAllowsTurn,
   freezeAgentLearningPolicy,
@@ -11,10 +20,16 @@ import {
   getMaterializedSandboxFileResources,
   markSandboxFileResourcesMaterialized,
 } from "@opengeni/db";
-import { sandboxOperationMetricObserver } from "@opengeni/observability";
+import {
+  sandboxOperationMetricObserver,
+  turnExecutionTelemetryKey,
+  withTraceContext,
+  withMcpTelemetry,
+} from "@opengeni/observability";
 import {
   REMOTE_COMPACTION_V2_BETA_FEATURE,
   REMOTE_COMPACTION_V2_IMPLEMENTATION,
+  awaitModelCallAdmission,
   materializeSandboxFileDownloads,
   sandboxFileDownloadFailureNote,
   type SandboxFileDownload,
@@ -25,11 +40,14 @@ import { buildCodexTokenResolver } from "../codex-auth";
 import {
   buildModelResolver,
   CODEX_CLIENT_VERSION,
-  CODEX_FALLBACK_MODEL_SLUGS,
   codexRequestStorage,
   withCodexRequestOverrides,
   type CodexRequestContext,
 } from "@opengeni/codex";
+import { codexUpstreamModelSlugs } from "@opengeni/config";
+import { parseModelProvidersJson } from "@opengeni/config";
+import { withClaudeUsageObserver } from "@opengeni/runtime";
+import { createClaudeUsageObserver } from "./claude-usage-observer";
 import {
   xaiSubscriptionRequestStorage,
   type XaiSubscriptionRequestContext,
@@ -48,6 +66,7 @@ import {
   recordModelRequestPhase,
   recordCompanyBrainContributions,
   recordTurnStartupPhase,
+  measureTurnStartupPhase,
   runtimeMetricsHooksForObservability,
 } from "../../observability-metrics";
 import { summarizeCompanyBrainContributions } from "../../model-context-contributions";
@@ -84,10 +103,11 @@ import {
   establishTurnSandbox,
   bindLazySandboxProvisioner,
 } from "./sandbox-establish";
-import { selectXaiTurnCapacity } from "./xai-capacity";
+import { selectXaiTurnCapacity, selectClaudeTurnCapacity } from "./xai-capacity";
 import { prepareRunCredentials } from "./run-credentials";
 import { prepareTurnToolPolicy, prepareTurnToolRuntime } from "./tool-environment";
 import { applyTurnGitHubRepositoryBindings } from "./github-repository-bindings";
+import { dropUnavailableOptionalRepositories } from "./optional-repositories";
 import { buildTurnAgent } from "./agent-build";
 
 /**
@@ -152,7 +172,11 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
   // final model checkpoint happens while the activity still owns its complete
   // turn graph and must not suppress collection after that graph is released.
   const turnCompletionMemoryCollector = createModelCheckpointMemoryCollector();
-  return async function runAgentTurn(input: RunAgentTurnInput): Promise<RunAgentTurnResult> {
+  const runAgentTurn = async (
+    input: RunAgentTurnInput,
+    resolvedServices: ActivityServices,
+    activitySpan: ReturnType<ActivityServices["observability"]["startSpan"]>,
+  ): Promise<RunAgentTurnResult> => {
     const {
       settings,
       catalogSourceSettings = settings,
@@ -160,6 +184,8 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       bus,
       runtime,
       summarizeContextForCompaction,
+      requestWorkerDrain,
+      turnFinalizationTimeoutMs,
       objectStorage,
       observability,
       wakeSessionWorkflow,
@@ -169,7 +195,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       connectionCredentials,
       personalGitHubCredentials,
       startVideoGenerationWorkflow,
-    } = await services();
+    } = resolvedServices;
     const activityContext = currentActivityContext();
     const cancellationSignal = activityContext?.cancellationSignal;
     // Temporal cancellation is not the only way an activity loses ownership:
@@ -207,11 +233,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
     });
     const dispatchId = activityContext?.info.activityId ?? randomUUID();
     const activityStarted = performance.now();
-    const activitySpan = observability.startSpan("worker.run_agent_segment", {
-      "opengeni.session_id": input.sessionId,
-      "opengeni.workflow_id": input.workflowId,
-      "opengeni.trigger_kind": input.trigger.kind,
-    });
     const acknowledgeLostAttemptOwnership = (): void => {
       // A stale terminal/recovery settlement can lose either to a benign
       // successor or to Pause/Steer closing this exact attempt. Only the
@@ -364,6 +385,14 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       getModelRunSettings: () => eventing.modelRunSettings,
       getExecutionGeneration: () => attempt.executionGeneration,
     });
+    const checkpointBeforeProviderDispatch = async () => {
+      await awaitModelCallAdmission();
+      await checkpointHistoryBeforeProviderDispatch(historySink, {
+        effectiveSandboxBackend: eventing.modelRunSettings.sandboxBackend,
+        routingEnabled: routingEnabled(settings),
+        readActiveSandbox: () => readActiveSandbox(db, input.workspaceId, input.sessionId),
+      });
+    };
 
     try {
       const claimed = await claimTurnAttempt({
@@ -423,19 +452,51 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       if (!attempt.turnId) {
         throw new Error("Turn id was not initialized");
       }
-      const learning = await freezeAgentLearningPolicy(db, {
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        actor: {
-          kind: "agent",
-          sessionId: input.sessionId,
-          turnId: attempt.turnId,
-          attemptId: input.attemptId,
-          executionGeneration: attempt.executionGeneration,
+      const learningActor = {
+        kind: "agent" as const,
+        sessionId: input.sessionId,
+        turnId: attempt.turnId,
+        attemptId: input.attemptId,
+        executionGeneration: attempt.executionGeneration,
+      };
+      const learning = await measureTurnStartupPhase(
+        observability,
+        {
+          phase: "learning_policy_freeze",
+          provider: turnExecutionPolicy.providerId,
+          backend: turn.sandboxBackend,
         },
-      });
+        () =>
+          freezeAgentLearningPolicy(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            actor: learningActor,
+          }),
+      );
+      const attachmentAuthority = await measureTurnStartupPhase(
+        observability,
+        {
+          phase: "attachment_authority_projection",
+          provider: turnExecutionPolicy.providerId,
+          backend: turn.sandboxBackend,
+        },
+        () => getSessionAuthorityProjection(db, input.workspaceId, input.sessionId),
+      );
+      if (!attachmentAuthority) throw new Error("Session attachment authority unavailable");
       return await withSessionRlsActorContext(
         {
+          sessionAttachmentReadAccess: {
+            sessionId: input.sessionId,
+            authorityEpoch: attachmentAuthority.authorityEpoch,
+            actor: {
+              kind: "agent_attempt",
+              subjectId: "service:agent-turn",
+              callerSessionId: input.sessionId,
+              turnId: attempt.turnId,
+              attemptId: input.attemptId,
+              executionGeneration: attempt.executionGeneration,
+            },
+          },
           subjectId: "service:agent-turn",
           initiatingHumanSubjectId: fileAuthoritySubjectId,
           privateFileOwnerSubjectId:
@@ -483,11 +544,42 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             if ("exit" in codexCapacity) return codexCapacity.exit;
             const xaiCapacity = await selectXaiTurnCapacity(capacityDeps);
             if ("exit" in xaiCapacity) return xaiCapacity.exit;
+            const claudeCapacity = await selectClaudeTurnCapacity(capacityDeps);
+            if ("exit" in claudeCapacity) return claudeCapacity.exit;
           }
 
+          let selectedCapabilitySettings = capabilitySettings;
+          if (billingState.isClaudeTurn) {
+            const credentialId = providerTurn.effectiveClaudeCredentialId;
+            const subjectId = leases.claude.subjectId;
+            const authoritySnapshot = providerTurn.claudeAuthoritySnapshot;
+            if (!credentialId || !subjectId || !authoritySnapshot)
+              throw new Error("Claude serving account has no accepted authority");
+            leases.claude.assertUsable();
+            const credential = await resolveClaudeAccountCredential(db, settings, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              subjectId,
+              credentialId,
+              authoritySnapshot,
+            });
+            providerTurn.effectiveClaudeCredentialVersion = credential.version;
+            if ("reconnectRequired" in credential) throw new ClaudeSubscriptionReconnectRequired();
+            selectedCapabilitySettings = withClaudeConnectionCredential(
+              capabilitySettings,
+              "claude_subscription",
+              JSON.stringify(credential.secret),
+              authoritySnapshot.scope === "organization" ? "organization" : "workspace",
+              {
+                connectionId: credentialId,
+                credentialVersion: credential.version,
+              },
+            );
+          }
           const governance = await prepareGovernanceAndModel({
             input,
             db,
+            observability,
             runtime,
             objectStorage,
             eventing,
@@ -495,7 +587,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             media,
             turn,
             session,
-            capabilitySettings,
+            capabilitySettings: selectedCapabilitySettings,
             fileAuthoritySubjectId,
             humanInputResume,
             turnExecutionPolicy,
@@ -508,14 +600,17 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             modelId: turnExecutionPolicy.productModelId,
             codexCredentialId: providerTurn.effectiveCodexCredentialId,
             xaiCredentialId: providerTurn.effectiveXaiCredentialId,
+            claudeCredentialId: providerTurn.effectiveClaudeCredentialId,
+            claudeAuthoritySnapshot: turn.claudeProviderAccountAuthoritySnapshot,
           });
           const {
             runtimePreparationStartedAt,
-            packRuntime,
             rigVersion,
             rigName,
             agentHumanInputEnabled,
+            codeSearchEnabled,
             workspaceAgentInstructions,
+            workspaceAgentIdentity,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
             workspaceMemory,
@@ -556,6 +651,12 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
                     runSettings,
                     input.workspaceId,
                     providerTurn.effectiveCodexCredentialId ?? "",
+                    undefined,
+                    {
+                      turnId: turn.id,
+                      holderId: leases.codex.holderId!,
+                      generation: leases.codex.generation!,
+                    },
                   );
                   const resolveTrackedToken = async (
                     resolve: () => ReturnType<typeof resolver.getToken>,
@@ -575,10 +676,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
                     sessionId: input.sessionId,
                     getToken: () => resolveTrackedToken(resolver.getToken),
                     refresh: () => resolveTrackedToken(resolver.refresh),
-                    resolveModel: buildModelResolver(
-                      CODEX_FALLBACK_MODEL_SLUGS,
-                      CODEX_FALLBACK_MODEL_SLUGS[0],
-                    ),
+                    resolveModel: buildModelResolver(codexUpstreamModelSlugs(runSettings)),
                     onUsageHeaders: (snapshot) => {
                       providerTurn.latestCodexUsage = snapshot;
                     }, // latest wins; flushed once in finally
@@ -665,7 +763,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
                         );
                       }
                       if (event.phase === "started") {
-                        await checkpointHistoryBeforeProviderDispatch(historySink);
+                        await checkpointBeforeProviderDispatch();
                       }
                       const shouldRecordStartedAudit =
                         event.phase === "started" && !firstModelRequestAuditRecorded;
@@ -745,8 +843,12 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
               credentialId: providerTurn.effectiveXaiCredentialId,
               authoritySnapshot: turn.xaiProviderAccountAuthoritySnapshot,
               hostedSearch: {
-                webSearch: runSettings.webSearchEnabled,
-                xSearch: runSettings.webSearchEnabled,
+                webSearch: resolveAgentToolFamilies(session.agent, {
+                  webSearch: runSettings.webSearchEnabled,
+                }).webSearch,
+                xSearch: resolveAgentToolFamilies(session.agent, {
+                  webSearch: runSettings.webSearchEnabled,
+                }).webSearch,
               },
               streamIdleTimeoutMs: runSettings.supergrokResponseStreamIdleTimeoutMs,
               nextRequestId: () => `${dispatchId}:xai:${++xaiModelRequestSequence}`,
@@ -818,7 +920,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
                   throw new Error("SuperGrok model request started before the turn event producer");
                 }
                 if (event.phase === "started") {
-                  await checkpointHistoryBeforeProviderDispatch(historySink);
+                  await checkpointBeforeProviderDispatch();
                 }
                 const shouldRecordStartedAudit =
                   event.phase === "started" && !firstModelRequestAuditRecorded;
@@ -880,12 +982,73 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             });
             providerTurn.xaiRequestContext = authorization.context;
           }
+          const claudeUsageObserver = await createClaudeUsageObserver(
+            parseModelProvidersJson(runSettings.modelProvidersJson),
+            providerTurn.latestClaudeUsage,
+            async () => null,
+          );
+          const withClaudeUsage = <T>(fn: () => Promise<T>): Promise<T> =>
+            withClaudeUsageObserver(claudeUsageObserver, fn, async (providerId, headers) => {
+              return claudeUsageObserver.prepareRequestWithObserver(
+                providerId,
+                headers,
+                async (binding) => {
+                  const credentialId = providerTurn.effectiveClaudeCredentialId;
+                  const authoritySnapshot = providerTurn.claudeAuthoritySnapshot;
+                  const subjectId = leases.claude.subjectId;
+                  if (
+                    !credentialId ||
+                    !authoritySnapshot ||
+                    !subjectId ||
+                    binding.expectedConnectionId !== credentialId ||
+                    binding.expectedCredentialVersion !==
+                      providerTurn.effectiveClaudeCredentialVersion ||
+                    binding.scope !==
+                      (authoritySnapshot.scope === "organization" ? "organization" : "workspace")
+                  )
+                    throw new Error(
+                      "Claude physical request is outside its accepted serving account",
+                    );
+                  await leases.claude.renew("runtime_event");
+                  leases.claude.assertUsable();
+                  await assertModelConnectionAllowsTurn(db, {
+                    workspaceId: input.workspaceId,
+                    subjectId,
+                    modelId: turnExecutionPolicy.productModelId,
+                    claudeCredentialId: credentialId,
+                    claudeAuthoritySnapshot: authoritySnapshot,
+                  });
+                  const credential = await resolveClaudeAccountCredential(
+                    db,
+                    settings,
+                    {
+                      accountId: input.accountId,
+                      workspaceId: input.workspaceId,
+                      subjectId,
+                      credentialId,
+                      authoritySnapshot,
+                    },
+                    { expectedCredentialVersion: binding.expectedCredentialVersion },
+                  );
+                  if ("reconnectRequired" in credential)
+                    throw new ClaudeSubscriptionReconnectRequired();
+                  leases.claude.assertUsable();
+                  return {
+                    token: credential.secret.token,
+                    connectionId: credential.id,
+                    credentialVersion: credential.version,
+                  };
+                },
+              );
+            });
           const withCodex = <T>(fn: () => Promise<T>): Promise<T> =>
             codexContext ? codexRequestStorage.run(codexContext, fn) : fn();
           const withProviderRequestContext = <T>(fn: () => Promise<T>): Promise<T> =>
-            providerTurn.xaiRequestContext
-              ? xaiSubscriptionRequestStorage.run(providerTurn.xaiRequestContext, fn)
-              : withCodex(fn);
+            withClaudeUsage(() =>
+              providerTurn.xaiRequestContext
+                ? xaiSubscriptionRequestStorage.run(providerTurn.xaiRequestContext, fn)
+                : withCodex(fn),
+            );
           let codexSessionTitleRequestSequence = 0;
           let xaiSessionTitleRequestSequence = 0;
           const codexSessionTitleContext = codexContext
@@ -901,25 +1064,29 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
               )
             : null;
           const withSessionTitleProviderRequestContext = <T>(fn: () => Promise<T>): Promise<T> =>
-            xaiSessionTitleContext
-              ? xaiSubscriptionRequestStorage.run(xaiSessionTitleContext, fn)
-              : codexSessionTitleContext
-                ? codexRequestStorage.run(codexSessionTitleContext, fn)
-                : fn();
+            withClaudeUsage(() =>
+              xaiSessionTitleContext
+                ? xaiSubscriptionRequestStorage.run(xaiSessionTitleContext, fn)
+                : codexSessionTitleContext
+                  ? codexRequestStorage.run(codexSessionTitleContext, fn)
+                  : fn(),
+            );
           const withCodexRemoteCompaction = <T>(fn: () => Promise<T>): Promise<T> =>
-            withCodex(() =>
-              withCodexRequestOverrides(
-                {
-                  betaFeatures: [REMOTE_COMPACTION_V2_BETA_FEATURE],
-                  turnMetadata: {
-                    request_kind: "compaction",
-                    compaction: {
-                      implementation: REMOTE_COMPACTION_V2_IMPLEMENTATION,
-                      strategy: "memento",
+            withClaudeUsage(() =>
+              withCodex(() =>
+                withCodexRequestOverrides(
+                  {
+                    betaFeatures: [REMOTE_COMPACTION_V2_BETA_FEATURE],
+                    turnMetadata: {
+                      request_kind: "compaction",
+                      compaction: {
+                        implementation: REMOTE_COMPACTION_V2_IMPLEMENTATION,
+                        strategy: "memento",
+                      },
                     },
                   },
-                },
-                fn,
+                  fn,
+                ),
               ),
             );
           const compactionPrep = await prepareCompaction({
@@ -945,6 +1112,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             turnExecutionPolicy,
             resolvedModel,
             workspaceAgentInstructions,
+            workspaceAgentIdentity,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
             workspaceMemory,
@@ -1030,44 +1198,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             knowledgeRecoveryNote =
               "[OpenGeni confirmation recovery unavailable] Do not assume an earlier remember confirmation was published. Inspect the current Knowledge or instruction review.";
           }
-          const attachmentPreparationNote = await prepareTurnKnowledgeSources({
-            settings: runSettings,
-            scope: {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              sessionId: input.sessionId,
-              turnId: turn.id,
-              attemptId: input.attemptId,
-              executionGeneration: attempt.executionGeneration,
-            },
-            // Only attachments on this accepted turn are new source inputs.
-            // Session-level file receipts remain historical context and must
-            // never trigger metadata reads, downloads, or re-preparation.
-            resources: turn.resources,
-            selectedTools: session.firstPartyMcpTools,
-            permissions: session.firstPartyMcpPermissions,
-            learningMode: learning.effective.knowledge,
-            signal: cancellationSignal,
-            onOutcome: async (outcome) => {
-              if (outcome.status === "disabled") return;
-              await eventing.publish!(
-                [
-                  {
-                    type:
-                      outcome.status === "failed"
-                        ? "knowledge.source.failed"
-                        : "knowledge.source.prepared",
-                    payload: outcome,
-                  },
-                ],
-                true,
-              );
-            },
-          });
-
-          const knowledgeSourcePreparationNote =
-            [knowledgeRecoveryNote, attachmentPreparationNote].filter(Boolean).join("\n\n") ||
-            undefined;
+          const knowledgeSourcePreparationNote = knowledgeRecoveryNote;
 
           const sandboxRoute = await resolveSandboxRoute({
             input,
@@ -1096,13 +1227,26 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           // set. A Connected Machine receives no platform Git credential, so its
           // resources stay exactly as stored. Resolution never fails the turn;
           // an unusable bound repository stays bare and is reported visibly.
-          const { turnResources, runtimeResources } = await waitForTurnOperation(
+          const hasCredentialProvider =
+            activeSandboxBackend !== "selfhosted" &&
+            (
+              await waitForTurnOperation(
+                getWorkspaceCredentialProvider(db, {
+                  accountId: input.accountId,
+                  workspaceId: input.workspaceId,
+                }),
+                cancellationSignal,
+                undefined,
+              )
+            )?.enabled === true;
+          const boundResources = await waitForTurnOperation(
             applyTurnGitHubRepositoryBindings({
               db,
               settings: runSettings,
               workspaceId: input.workspaceId,
               sessionId: input.sessionId,
               activeSandboxBackend,
+              hasCredentialProvider,
               claimedTurnResources,
               claimedRuntimeResources,
               publish: async (events) => {
@@ -1113,8 +1257,35 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             cancellationSignal,
             undefined,
           );
+          // An automatically attached (optional) repository that lost its
+          // allowlist entry or its GitHub App access since the session started
+          // sits this turn out with a warning, before the strict allowlist
+          // recheck and token mint below would fail the whole turn for it.
+          const {
+            turnResources,
+            runtimeResources,
+            retainsResource: retainsOptionalRepository,
+          } = await waitForTurnOperation(
+            dropUnavailableOptionalRepositories({
+              db,
+              settings: runSettings,
+              workspaceId: input.workspaceId,
+              activeSandboxBackend,
+              hostMintsGitCredentials: Boolean(connectionCredentials?.gitCredentials),
+              turnResources: boundResources.turnResources,
+              runtimeResources: boundResources.runtimeResources,
+              publish: async (events) => {
+                await eventing.publish!(events, true);
+              },
+              warn: (message, fields) => observability.warn(message, fields),
+            }),
+            cancellationSignal,
+            undefined,
+          );
 
           const runCredentials = await prepareRunCredentials({
+            turnTools,
+            localMcpServerIds: installedApiIntegrations.map((integration) => integration.serverId),
             input,
             settings,
             db,
@@ -1129,6 +1300,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             sandboxRuntime,
             turn,
             session,
+            turnExecutionPolicy,
             fileAuthoritySubjectId,
             runSettings,
             workspaceVariableSet,
@@ -1145,10 +1317,10 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           });
           const {
             runCredentialResolver,
+            runMcpCredentials,
             establishPolicy,
             initialRunCredentialMaterial,
             runCredentialsNote,
-            hostCredentialRootSessionId,
             codemodeAuthority,
             sandboxArtifactRuntime,
             sandboxEnvironment,
@@ -1268,7 +1440,8 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           ];
           const toolRuntime = await prepareTurnToolRuntime({
             fetchKnowledgeSource: sourceActivities.runKnowledgeSourceSyncBatch,
-            selectedSkillActivations: packRuntime.skillActivations,
+            runCredentialRenewals: runCredentialResolver ? renewals : undefined,
+            runMcpCredentials,
             input,
             catalogSourceSettings,
             db,
@@ -1277,7 +1450,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             objectStorage,
             observability,
             cancellationSignal,
-            connectionCredentials,
             eventing,
             attempt,
             sandboxState,
@@ -1292,10 +1464,10 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             turnExecutionPolicy,
             trigger,
             runSettings,
+            resolvedModel,
             lazyToolTransport,
             turnTools,
             connectionScope,
-            hostCredentialRootSessionId,
             sandboxArtifactRuntime,
             activeSandboxBackend,
             groupBoxBackend,
@@ -1304,6 +1476,8 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             credentialSubjectId,
             interactionInterventionResume,
             runWorkspaceMutationForSandbox,
+            codeSearchEnabled,
+            retainsOptionalRepository,
             throwIfWorkerShuttingDown,
             throwIfTurnCancelled,
           });
@@ -1317,6 +1491,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
 
           const builtAgent = await buildTurnAgent({
             skillCatalog: toolRuntime.skillCatalog,
+            mcpServers: toolRuntime.mcpServers,
             input,
             db,
             runtime,
@@ -1346,6 +1521,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             supportsImageInput,
             agentHumanInputEnabled,
             workspaceAgentInstructions,
+            workspaceAgentIdentity,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
             workspaceMemory,
@@ -1366,6 +1542,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             connectorActionPolicy,
             trigger,
             preparationIndependentToolNames,
+            codeSearchAvailable: toolRuntime.codeSearchAvailable,
             videoGenerationAcceptancesByCallId,
             activeSandboxBackend,
             groupBoxBackend,
@@ -1474,6 +1651,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             turnExecutionPolicy,
             resolvedModel,
             workspaceAgentInstructions,
+            workspaceAgentIdentity,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
             workspaceMemory,
@@ -1647,6 +1825,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             providerTurn,
             leases,
             historySink,
+            checkpointBeforeProviderDispatch,
             media,
             toolResultSpill,
             claimedResult,
@@ -1739,6 +1918,8 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       });
     } finally {
       await finalizeTurnAttempt({
+        turnFinalizationTimeoutMs,
+        requestWorkerDrain,
         input,
         settings,
         db,
@@ -1771,4 +1952,50 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       });
     }
   };
+  return async (input: RunAgentTurnInput): Promise<RunAgentTurnResult> => {
+    const servicesStartedAt = performance.now();
+    const resolvedServices = await services();
+    const servicesDurationSeconds = (performance.now() - servicesStartedAt) / 1_000;
+    const correlationId = turnExecutionTelemetryKey(
+      input.workspaceId,
+      input.sessionId,
+      input.attemptId,
+    );
+    const span = resolvedServices.observability.startSpan(
+      "worker.run_agent_segment",
+      {
+        "opengeni.trigger_kind": input.trigger.kind,
+        correlationId,
+      },
+      { parent: null },
+    );
+    try {
+      return await withMcpTelemetry(resolvedServices.observability, correlationId, () =>
+        withTraceContext(span, () => {
+          try {
+            recordTurnStartupPhase(resolvedServices.observability, {
+              phase: "services_initialization",
+              provider: "unresolved",
+              backend: "unresolved",
+              outcome: "completed",
+              durationSeconds: servicesDurationSeconds,
+            });
+          } catch {
+            // Service initialization telemetry never gates a claimed attempt.
+          }
+          try {
+            resolvedServices.observability.info("worker execution started", { correlationId });
+          } catch {
+            // Correlation diagnostics never affect execution or admission.
+          }
+          return runAgentTurn(input, resolvedServices, span);
+        }),
+      );
+    } catch (error) {
+      span.end({ error });
+      throw error;
+    } finally {
+      span.end();
+    }
+  };
 }