@opengeni/worker-bundle 1.0.0-canary.0 → 1.0.1-canary.0

package/dist/index.js

@@ -784,7 +784,7 @@ function temporalWorkflowExecutionNotFound(error) {
   return isGrpcServiceError(error) && error.code === 5;
 }
 async function createDefaultWorkerActivities(role, dependencies = {}) {
-  return role === "control" ? (await import("./activities-control-HMFGSKC5.js")).createControlActivities(dependencies) : (await import("./activities-turn-AP67JADS.js")).createTurnActivities(dependencies);
+  return role === "control" ? (await import("./activities-control-O5U6OLT2.js")).createControlActivities(dependencies) : (await import("./activities-turn-OAPNO2IH.js")).createTurnActivities(dependencies);
 }
 function resolveOpenGeniWorkflowDefinition(moduleUrl = import.meta.url) {
   const modulePath = fileURLToPath(moduleUrl).replaceAll("\\", "/");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "1.0.0-canary.0",
+  "version": "1.0.1-canary.0",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,24 +54,24 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "^0.6.0-canary.3",
-    "@opengeni/capabilities": "^0.3.3-canary.15",
-    "@opengeni/codemode": "^0.5.8-canary.0",
-    "@opengeni/codex": "^0.2.23-canary.0",
-    "@opengeni/config": "^1.2.1-canary.0",
-    "@opengeni/contracts": "^4.0.0-canary.0",
-    "@opengeni/core": "^3.0.0-canary.0",
-    "@opengeni/db": "^5.0.0-canary.0",
-    "@opengeni/documents": "^0.8.29-canary.0",
-    "@opengeni/events": "^0.4.27-canary.0",
-    "@opengeni/github": "^0.7.12-canary.0",
-    "@opengeni/network": "^0.3.1-canary.15",
-    "@opengeni/observability": "^0.8.28-canary.0",
-    "@opengeni/runtime": "^3.0.0-canary.0",
-    "@opengeni/sdk": "^6.0.0-canary.0",
-    "@opengeni/storage": "^0.2.129-canary.0",
-    "@opengeni/tool-gateway": "^0.1.9-canary.0",
-    "@opengeni/xai-subscription": "^0.1.4-canary.15",
+    "@opengeni/agent-proto": "^0.6.0-canary.5",
+    "@opengeni/capabilities": "^0.3.4-canary.0",
+    "@opengeni/codemode": "^0.5.9-canary.0",
+    "@opengeni/codex": "^0.2.23-canary.2",
+    "@opengeni/config": "^1.2.2-canary.0",
+    "@opengeni/contracts": "^4.1.0-canary.0",
+    "@opengeni/core": "^3.0.1-canary.0",
+    "@opengeni/db": "^5.0.1-canary.0",
+    "@opengeni/documents": "^0.8.30-canary.0",
+    "@opengeni/events": "^0.4.28-canary.0",
+    "@opengeni/github": "^0.7.13-canary.0",
+    "@opengeni/network": "^0.3.1-canary.17",
+    "@opengeni/observability": "^0.8.29-canary.0",
+    "@opengeni/runtime": "^3.0.1-canary.0",
+    "@opengeni/sdk": "^6.1.0-canary.0",
+    "@opengeni/storage": "^0.2.130-canary.0",
+    "@opengeni/tool-gateway": "^0.1.10-canary.0",
+    "@opengeni/xai-subscription": "^0.1.4-canary.17",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/claim.ts

@@ -387,6 +387,7 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
     turnId: attempt.turnId,
     opAcks: {},
   };
+  eventing.heartbeatDetails = heartbeatDetails;
   const opJournal = makeTurnOpJournal(activityContext, heartbeatDetails);
   eventing.heartbeatTimer = startActivityHeartbeat(activityContext, heartbeatDetails);
   let producerSeq = 0;

package/src/activities/agent-turn/errors.ts

@@ -15,6 +15,9 @@ import {
   isMcpTransportConnectivityError,
   isModalTaskExecStartDnsResolutionError,
   RoutingWorkspaceRootChangedError,
+  SandboxMaterializationVerificationError,
+  materializationVerificationDiagnostic,
+  type MaterializationVerificationDiagnostic,
   SelfhostedWorkspaceRootChangedError,
   UNKNOWN_MODEL_FINISH_REASON_CODE,
 } from "@opengeni/runtime";
@@ -851,6 +854,15 @@ function findPostgresDriverError(error: unknown): Record<string, unknown> | null
 export function agentRunFailurePayload(
   error: unknown,
   options: { isCodexTurn?: boolean } = {},
+): ReturnType<typeof baseAgentRunFailurePayload> {
+  const failure = baseAgentRunFailurePayload(error, options);
+  const diagnostic = materializationVerificationDiagnostic(error);
+  return diagnostic ? { ...failure, materializationDiagnostic: diagnostic } : failure;
+}
+
+function baseAgentRunFailurePayload(
+  error: unknown,
+  options: { isCodexTurn?: boolean } = {},
 ): {
   error: string;
   code?: string;
@@ -870,7 +882,16 @@ export function agentRunFailurePayload(
   database?: Record<string, string>;
   historyPersistenceStage?: MandatoryHistoryPersistenceStage;
   mcpTransportDiagnostic?: McpTransportRequestFailureDiagnostic;
+  materializationDiagnostic?: MaterializationVerificationDiagnostic;
 } {
+  if (error instanceof SandboxMaterializationVerificationError) {
+    return {
+      error: error.message,
+      code: error.code,
+      retryable: false,
+      materializationDiagnostic: error.diagnostic,
+    };
+  }
   if (error instanceof RetainedAttachmentTransportLimitError) {
     return { error: error.message, code: "retained_attachment_transport_limit", retryable: false };
   }

package/src/activities/agent-turn/finalization-monitor.ts

@@ -0,0 +1,121 @@
+import type { Observability } from "@opengeni/observability";
+import type { TurnHeartbeatDetails } from "../../op-journal";
+import { armTurnQuiescenceWatchdog } from "./quiescence";
+
+export const TURN_FINALIZATION_STAGES = [
+  "tool_writers",
+  "credential_renewals",
+  "credential_cleanup",
+  "quiescence_receipt",
+  "event_flush",
+  "provider_leases",
+  "workspace_capture",
+  "tool_close",
+  "sandbox_provisioning",
+  "sandbox_rotation",
+  "workspace_snapshot",
+  "sandbox_release",
+] as const;
+export type TurnFinalizationStage = (typeof TURN_FINALIZATION_STAGES)[number];
+
+const INFLIGHT = {
+  name: "opengeni_turn_finalization_inflight",
+  help: "Physical turn finalizers currently waiting in each cleanup stage.",
+};
+const SLOW_STAGES = {
+  name: "opengeni_turn_finalization_slow_total",
+  help: "Turn cleanup stages observed to exceed thirty seconds.",
+};
+const initialized = new WeakSet<Observability>();
+function diagnose(operation: () => void): void {
+  try {
+    operation();
+  } catch {
+    // Diagnostics cannot own physical cleanup or containment.
+  }
+}
+
+/** Starts only after agent execution ends. A cleanup-stage deadline never caps
+ * agent work and never detaches a physical writer to manufacture quiescence. */
+export function startTurnFinalizationMonitor(input: {
+  observability: Observability;
+  details: TurnHeartbeatDetails;
+  heartbeat: (details: TurnHeartbeatDetails) => void;
+  terminateWorker: () => void;
+  timeoutMs?: number;
+  slowAfterMs?: number;
+}) {
+  const { observability, details } = input;
+  if (!initialized.has(observability)) {
+    for (const stage of TURN_FINALIZATION_STAGES) {
+      diagnose(() => observability.incrementGauge({ ...INFLIGHT, labels: { stage }, amount: 0 }));
+      diagnose(() =>
+        observability.incrementCounter({ ...SLOW_STAGES, labels: { stage }, amount: 0 }),
+      );
+    }
+    initialized.add(observability);
+  }
+  let stage: TurnFinalizationStage | null = null;
+  let disarm = () => {};
+  let stopped = false;
+  let slowTimer: ReturnType<typeof setTimeout> | undefined;
+  const leave = () => {
+    disarm();
+    clearTimeout(slowTimer);
+    if (stage) {
+      const previous = stage;
+      diagnose(() =>
+        observability.incrementGauge({ ...INFLIGHT, labels: { stage: previous }, amount: -1 }),
+      );
+    }
+    stage = null;
+  };
+  return {
+    enter(next: TurnFinalizationStage) {
+      if (stopped || stage === next) return;
+      leave();
+      stage = next;
+      details.phase = "finalizing";
+      details.finalizationStage = next;
+      details.finalizationStageStartedAt = new Date().toISOString();
+      diagnose(() => observability.incrementGauge({ ...INFLIGHT, labels: { stage: next } }));
+      disarm = armTurnQuiescenceWatchdog({
+        enabled: true,
+        ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),
+        onTimeout: () => {
+          try {
+            observability.error("turn finalization stalled; containing worker", {
+              surface: "turn_finalization",
+              outcome: "containment",
+              reason: next,
+            });
+          } catch {
+            // Diagnostic failure must never disable physical containment.
+          }
+        },
+        terminateWorker: input.terminateWorker,
+      });
+      // Record the precursor while the process remains scrapeable. A counter
+      // increment immediately before process.exit can never reach Prometheus.
+      slowTimer = setTimeout(
+        () =>
+          diagnose(() => {
+            observability.incrementCounter({ ...SLOW_STAGES, labels: { stage: next } });
+            observability.warn("turn finalization is taking longer than expected", {
+              surface: "turn_finalization",
+              outcome: "slow",
+              reason: next,
+            });
+          }),
+        input.slowAfterMs ?? 30_000,
+      );
+      slowTimer.unref?.();
+      diagnose(() => input.heartbeat(details));
+    },
+    stop() {
+      if (stopped) return;
+      stopped = true;
+      leave();
+    },
+  };
+}

package/src/activities/agent-turn/finalization.ts

@@ -13,7 +13,8 @@ import { clearRunCredentialsForAttempt } from "@opengeni/runtime";
 import { fetchXaiSubscriptionQuota } from "@opengeni/xai-subscription";
 import type { Settings } from "@opengeni/config";
 import { signalCodexCapacityWakeTargets } from "../codex-capacity";
-import type { currentActivityContext } from "../streaming";
+import { startActivityHeartbeat, type currentActivityContext } from "../streaming";
+import { startTurnFinalizationMonitor } from "./finalization-monitor";
 import type { CodemodeTokenRenewalController } from "../codemode-token-renewal";
 import type { RunCredentialRenewalController } from "../run-credential-renewal";
 import type {
@@ -43,7 +44,6 @@ import { safeErrorDiagnostic, safeErrorForTelemetry } from "./errors";
 import {
   assertPhysicalToolQuiescenceForCancellation,
   assertSessionAttemptQuiescenceRecoveryDurable,
-  armTurnQuiescenceWatchdog,
   clearAttemptCredentialsWithSettledFence,
   drainAttemptOwnedSandboxWriters,
   persistOrSignalSessionAttemptQuiescence,
@@ -99,6 +99,42 @@ export type TurnFinalizationDeps = {
 };
 
 export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<void> {
+  const details = deps.eventing.heartbeatDetails ?? {
+    sessionId: deps.input.sessionId,
+    turnId: deps.attempt.turnId,
+    opAcks: {},
+  };
+  deps.eventing.heartbeatDetails = details;
+  // Keep one heartbeat owner through all physical cleanup, with the same op
+  // acknowledgements used during execution. It must no longer say "running".
+  if (deps.eventing.heartbeatTimer) clearInterval(deps.eventing.heartbeatTimer);
+  deps.eventing.heartbeatTimer = startActivityHeartbeat(deps.activityContext, details);
+  const monitor = startTurnFinalizationMonitor({
+    observability: deps.observability,
+    details,
+    heartbeat: (value) => {
+      try {
+        deps.activityContext?.heartbeat({ ...value, at: new Date().toISOString() });
+      } catch {
+        // A closed Temporal transport is not proof of physical quiescence.
+      }
+    },
+    terminateWorker: () => process.exit(1),
+  });
+  try {
+    monitor.enter("tool_writers");
+    await finalizeTurnAttemptSteps(deps, monitor);
+  } finally {
+    monitor.stop();
+    if (deps.eventing.heartbeatTimer) clearInterval(deps.eventing.heartbeatTimer);
+    deps.eventing.heartbeatTimer = undefined;
+  }
+}
+
+async function finalizeTurnAttemptSteps(
+  deps: TurnFinalizationDeps,
+  monitor: ReturnType<typeof startTurnFinalizationMonitor>,
+): Promise<void> {
   const {
     input,
     settings,
@@ -142,17 +178,6 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
   let finalizationError: unknown;
   let physicalToolQuiescenceConfirmed = !control.acknowledgeQuiescence;
   let quiescenceReceiptOrProofDurable = !control.acknowledgeQuiescence;
-  const disarmQuiescenceWatchdog = armTurnQuiescenceWatchdog({
-    enabled: control.acknowledgeQuiescence,
-    onTimeout: () => {
-      observability.error("turn quiescence drain exceeded hard containment deadline", {
-        "opengeni.session_id": input.sessionId,
-        "opengeni.turn_id": attempt.turnId ?? "",
-        "opengeni.attempt_id": input.attemptId,
-      });
-    },
-    terminateWorker: () => process.exit(1),
-  });
   const finalizerSignal = turnFinalizerCancellationSignal(
     cancellationSignal,
     control.activityStatus,
@@ -200,6 +225,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
       // and durably settled before workspace capture. Only receipt
       // publication remains conditional on acknowledgeQuiescence.
       toolCancellationFence,
+      onStage: monitor.enter,
       cancellationReason: cancellationSignal?.reason ?? new Error("TURN_ATTEMPT_FINALIZED"),
       gitCredentialRenewals: gitRenewalsToStop,
       codemodeTokenRenewal: codemodeRenewalToStop,
@@ -211,6 +237,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
     // attempt's generation before publishing physical quiescence. A failure
     // deliberately keeps the receipt closed.
     if (credentialSessionToClear) {
+      monitor.enter("credential_cleanup");
       const clearAttemptCredentials = async (): Promise<void> =>
         await clearRunCredentialsForAttempt(credentialSessionToClear, {
           sessionId: input.sessionId,
@@ -258,6 +285,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
       // and before lease, cache, recording, or provider cleanup. Its
       // transaction also enqueues the exact workflow wake that will admit
       // the replacement; Temporal activity terminalization does neither.
+      monitor.enter("quiescence_receipt");
       const proof: SessionAttemptQuiescenceProof = {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -304,6 +332,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
         signalProof: signalSessionAttemptQuiesced,
         heartbeat: (deliveryAttempt, retryMs) => {
           activityContext?.heartbeat({
+            ...eventing.heartbeatDetails,
             phase: "quiescence-proof-delivery",
             sessionId: input.sessionId,
             attemptId: input.attemptId,
@@ -336,7 +365,6 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
         },
       });
       quiescenceReceiptOrProofDurable = true;
-      disarmQuiescenceWatchdog();
       if (recoveryMode === "signal") {
         observability.info("agent turn quiescence proof handed to workflow recovery", {
           "opengeni.session_id": input.sessionId,
@@ -351,6 +379,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
     // the turn. Sync observer → buffer → single awaited append here (no unawaited
     // DB write inside the activity). Scoped to this turn; skipped if no turnId
     // (the op ran under a turn, so on the normal path turnId is set).
+    monitor.enter("event_flush");
     const machineOpEvents = machineOpObserver.drainEvents();
     if (machineOpEvents.length > 0 && attempt.turnId && attempt.executionGeneration > 0) {
       await waitForTurnFinalizerStep(
@@ -377,6 +406,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
     // Multi-account P4: flush the serving account's free per-turn caches ONCE,
     // best-effort (same discipline as today's usage write). Both writers skip
     // version/updatedAt, so neither can race the token-refresh CAS.
+    monitor.enter("provider_leases");
     if (providerTurn.effectiveCodexCredentialId) {
       // Part A: the latest scraped usage-header snapshot → the P2 usage cache. A
       // full both-windows snapshot (parseCodexUsageHeaders gates on both), so this
@@ -502,6 +532,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
     ) {
       // Review reads yield to queued work. Recovery snapshots have their own
       // physical-settlement requirement and are drained later in finalization.
+      monitor.enter("workspace_capture");
       sandboxState.turnEndCaptureInProgress = true;
       const captureSandbox = sandboxState.resolvedSandbox;
       const captureSession = sandboxState.setupBoxSession as ChannelASession;
@@ -549,6 +580,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
         },
       });
     }
+    monitor.enter("tool_close");
     eventing.toolPreparationClosing = true;
     if (eventing.toolPreparationReady) {
       await waitForTurnFinalizerStep(
@@ -569,9 +601,7 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
         finalizerSignal,
       );
     }
-    if (eventing.heartbeatTimer) {
-      clearInterval(eventing.heartbeatTimer);
-    }
+    monitor.enter("sandbox_provisioning");
     if (sandboxState.turnSandboxProvisioner?.hasStarted()) {
       await waitForTurnFinalizerStep(
         sandboxState.turnSandboxProvisioner.waitForSettled(30_000),
@@ -599,12 +629,14 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
     if (sandboxState.leaseHeartbeatTimer) {
       stopLeaseHeartbeat();
     }
+    monitor.enter("sandbox_rotation");
     if (sandboxState.rotationPreemptionInFlight) {
       await sandboxState.rotationPreemptionInFlight.catch(() => undefined);
     }
     // No heartbeat can register another capture after this point. Join the
     // actual provider continuation before either starting a turn-end capture
     // or entering the proof-bearing holder release.
+    monitor.enter("workspace_snapshot");
     await drainInFlightWarmSnapshot();
     if (sandboxState.resolvedSandbox) {
       // TURN-END mid-session snapshot (sandbox-file-persistence): fold the
@@ -667,10 +699,13 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
     // Temporal cancellation: the eager listener may already have dropped
     // the holder, and this idempotent proof-bearing pass still must run.
     stopLeaseHeartbeat();
+    monitor.enter("sandbox_rotation");
     if (sandboxState.rotationPreemptionInFlight) {
       await sandboxState.rotationPreemptionInFlight.catch(() => undefined);
     }
+    monitor.enter("workspace_snapshot");
     await drainInFlightWarmSnapshot();
+    monitor.enter("sandbox_release");
     const sandboxReleaseTargets = new Set(sandboxState.lateSandboxesAwaitingWriterDrain);
     sandboxState.lateSandboxesAwaitingWriterDrain.clear();
     if (sandboxState.resolvedSandbox) {

package/src/activities/agent-turn/quiescence.ts

@@ -198,13 +198,16 @@ export async function drainAttemptOwnedSandboxWriters(input: {
   gitCredentialRenewals: readonly Pick<GitCredentialRenewalController, "stop">[];
   codemodeTokenRenewal: Pick<CodemodeTokenRenewalController, "stop"> | null;
   runCredentialRenewal: Pick<RunCredentialRenewalController, "stop"> | null;
+  onStage?: (stage: "tool_writers" | "credential_renewals") => void;
 }): Promise<void> {
+  input.onStage?.("tool_writers");
   if (input.toolCancellationFence) {
     input.toolCancellationFence.cancel(
       input.cancellationReason ?? new Error("TURN_ATTEMPT_FENCED"),
     );
     await input.toolCancellationFence.waitForQuiescence();
   }
+  input.onStage?.("credential_renewals");
   await Promise.all(input.gitCredentialRenewals.map(async (renewal) => await renewal.stop()));
   await input.codemodeTokenRenewal?.stop();
   await input.runCredentialRenewal?.stop();

package/src/activities/agent-turn/run.ts

@@ -1,5 +1,4 @@
 import { createKnowledgeSourceSyncActivities } from "../knowledge-source-sync";
-import { prepareTurnKnowledgeSources } from "./knowledge-sources";
 import {
   assertModelConnectionAllowsTurn,
   freezeAgentLearningPolicy,
@@ -1030,44 +1029,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             knowledgeRecoveryNote =
               "[OpenGeni confirmation recovery unavailable] Do not assume an earlier remember confirmation was published. Inspect the current Knowledge or instruction review.";
           }
-          const attachmentPreparationNote = await prepareTurnKnowledgeSources({
-            settings: runSettings,
-            scope: {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              sessionId: input.sessionId,
-              turnId: turn.id,
-              attemptId: input.attemptId,
-              executionGeneration: attempt.executionGeneration,
-            },
-            // Only attachments on this accepted turn are new source inputs.
-            // Session-level file receipts remain historical context and must
-            // never trigger metadata reads, downloads, or re-preparation.
-            resources: turn.resources,
-            selectedTools: session.firstPartyMcpTools,
-            permissions: session.firstPartyMcpPermissions,
-            learningMode: learning.effective.knowledge,
-            signal: cancellationSignal,
-            onOutcome: async (outcome) => {
-              if (outcome.status === "disabled") return;
-              await eventing.publish!(
-                [
-                  {
-                    type:
-                      outcome.status === "failed"
-                        ? "knowledge.source.failed"
-                        : "knowledge.source.prepared",
-                    payload: outcome,
-                  },
-                ],
-                true,
-              );
-            },
-          });
-
-          const knowledgeSourcePreparationNote =
-            [knowledgeRecoveryNote, attachmentPreparationNote].filter(Boolean).join("\n\n") ||
-            undefined;
+          const knowledgeSourcePreparationNote = knowledgeRecoveryNote;
 
           const sandboxRoute = await resolveSandboxRoute({
             input,

package/src/activities/agent-turn/skill-selection.ts

@@ -14,6 +14,7 @@ export function configuredBundledSkillNames(context: BundledSkillConfiguration):
   const tools = new Set(context.firstPartyTools);
   const artifacts = () => tools.has("editable_artifact_list") && tools.has("editable_artifact_get");
   const definitions = [
+    { name: "opengeni-help", include: () => true },
     { name: "opengeni-visualize", include: () => true },
     { name: "document-parsing", include: () => true },
     { name: "opengeni-skills", include: () => true },

package/src/activities/agent-turn/tool-environment.ts

@@ -51,7 +51,7 @@ import { buildCodexTokenResolver } from "../codex-auth";
 import { CODEX_CLIENT_VERSION } from "@opengeni/codex";
 import { mergeResourceRefs } from "../common";
 import {
-  defaultSessionMcpServerIds,
+  workspaceSessionToolPolicyDefaultServerIds,
   loadRigDefaultVariableSetEnvironment,
   mergeRigDefaultVariableSetEnvironment,
   buildApiIntegrationMcpServers,
@@ -212,7 +212,15 @@ export async function prepareTurnToolPolicy(deps: PrepareTurnToolPolicyDeps) {
       ? scheduledEffectiveMcpServerIds.filter((id) => currentMcpServerIds.has(id))
       : [...currentMcpServerIds],
     defaultMcpServerIds:
-      scheduledEffectiveMcpServerIds ?? defaultSessionMcpServerIds(capabilitySettings.mcpServers),
+      scheduledEffectiveMcpServerIds ??
+      (session.toolPolicy.mode === "workspace_default"
+        ? await workspaceSessionToolPolicyDefaultServerIds(
+            db,
+            input.workspaceId,
+            capabilitySettings,
+            fileAuthoritySubjectId ?? undefined,
+          )
+        : []),
   });
   const mcpAvailabilityNote = unavailableMcpOperationalContext({
     droppedIds: resolvedToolPolicy.effectivePolicy.droppedIds,

package/src/activities/agent-turn/turn-context.ts

@@ -1,3 +1,4 @@
+import type { TurnHeartbeatDetails } from "../../op-journal";
 import type { Settings } from "@opengeni/config";
 import type { CodexUsageHeaderSnapshot } from "@opengeni/codex";
 import type { AppendEventInput, ApplySessionTurnSettlementInput } from "@opengeni/db";
@@ -123,6 +124,7 @@ export type RenewalState = {
 };
 
 export type EventingState = {
+  heartbeatDetails: TurnHeartbeatDetails | null;
   heartbeatTimer: ReturnType<typeof startActivityHeartbeat> | undefined;
   batcher: ReturnType<typeof createRuntimeBatcher> | null;
   preparedTools: Awaited<ReturnType<OpenGeniRuntime["prepareTools"]>> | null;
@@ -254,6 +256,7 @@ export function createTurnContext(input: {
       publishedRunCredentialNotices: new Set(),
     },
     eventing: {
+      heartbeatDetails: null,
       heartbeatTimer: undefined,
       batcher: null,
       preparedTools: null,

package/src/activities/workflow-wake.ts

@@ -6,6 +6,7 @@ import {
   type Database,
 } from "@opengeni/db";
 import { publishDurableWorkspaceControlEvent } from "@opengeni/events";
+import { recordWorkflowWakeReconciliation } from "@opengeni/observability";
 import type { ControlActivityServices } from "./types";
 import {
   reconcileAutomaticSessionTitleFanout,
@@ -115,23 +116,7 @@ export function createWorkflowWakeActivities(services: () => Promise<ControlActi
         pendingAdmissionBlockers,
         exhaustedBatchLimit,
       };
-      if (claimed > 0) {
-        service.observability.info("session workflow wake delivery reconciled", {
-          claimed,
-          signaled,
-          delivered,
-          pendingAdmission,
-          unconfirmed,
-          failed,
-          exhaustedBatchLimit,
-          ...Object.fromEntries(
-            Object.entries(pendingAdmissionBlockers).map(([blocker, count]) => [
-              `pendingAdmissionBlockers.${blocker}`,
-              count,
-            ]),
-          ),
-        });
-      }
+      recordWorkflowWakeReconciliation(service.observability, result);
       return result;
     },
   };

package/dist/activities/agent-turn/knowledge-sources.d.ts

@@ -1,20 +0,0 @@
-import { type FirstPartyMcpToolName, type Permission, type ResourceRef, type KnowledgeFilePreparationResult } from "@opengeni/contracts";
-import { type Settings } from "@opengeni/config";
-import { createFirstPartyAttemptClient } from "@opengeni/runtime";
-export type KnowledgeSourcePreparationOutcome = KnowledgeFilePreparationResult | {
-    status: "failed";
-    fileId: string;
-    message: string;
-};
-/** Accepted chat/schedule resources use ordinary agent authority and policy. */
-export declare function prepareTurnKnowledgeSources(input: {
-    settings: Settings;
-    scope: Parameters<typeof createFirstPartyAttemptClient>[0]["scope"];
-    resources: readonly ResourceRef[];
-    selectedTools?: readonly FirstPartyMcpToolName[] | undefined;
-    permissions?: readonly Permission[] | null | undefined;
-    learningMode: "automatic" | "review_first" | "off";
-    signal?: AbortSignal | undefined;
-    onOutcome: (outcome: KnowledgeSourcePreparationOutcome) => Promise<void>;
-    prepare?: (fileId: string) => Promise<KnowledgeFilePreparationResult>;
-}): Promise<string | undefined>;