@stigmer/runner 3.12.7 → 3.12.9

package/src/activities/execute-cursor/fetch-interceptor.ts

@@ -19,15 +19,34 @@ import { AsyncLocalStorage } from "node:async_hooks";
 
 import { TimingRecorder, emitTimingLog } from "../../shared/cold-start-timing.js";
 
+/** One REST path's timing identity: the emitted timeline event and its
+ * single segment name. */
+interface TimedRestPath {
+  readonly event: string;
+  readonly segment: string;
+}
+
 /**
- * The one REST path worth timing individually: the Cursor SDK calls
- * GET /v1/models inside Agent.create/Agent.resume purely to validate the
- * model id, and in proxy mode that is a runner → Stigmer → Cursor double
- * hop sitting inside the resolve_agent setup segment (issue #209). The
- * emitted `cursor_models_fetch` timeline splits that network cost out of
- * the segment total without touching the SDK.
+ * REST paths worth timing individually — both sit inside Agent.create/
+ * Agent.resume on the user-visible resolve_agent setup path, and in proxy
+ * mode each is a runner → Stigmer → Cursor double hop. The emitted
+ * timelines split that network cost out of the segment total without
+ * touching the SDK:
+ *
+ * - GET /v1/models (`cursor_models_fetch`): the SDK's model-id validation
+ *   read, ~0.95s of the pre-cache resolve_agent segment (issue #209).
+ * - POST /auth/exchange_user_api_key (`cursor_token_exchange`): the SDK's
+ *   API-key → access-token exchange, the strongest suspect for the
+ *   remaining unexplained 0.6–1.3s inside Agent.create
+ *   (stigmer-cloud#484 — this timeline is that issue's Step 1, measure).
  */
-const MODELS_PATH = "/v1/models";
+const TIMED_REST_PATHS: ReadonlyMap<string, TimedRestPath> = new Map([
+  ["/v1/models", { event: "cursor_models_fetch", segment: "models_fetch" }],
+  [
+    "/auth/exchange_user_api_key",
+    { event: "cursor_token_exchange", segment: "token_exchange" },
+  ],
+]);
 
 const CURSOR_DOMAINS = [
   "api2.cursor.sh",
@@ -258,13 +277,14 @@ async function fetchWithUrlRewrite(
   const rewrittenUrl = rewriteUrl(url, config.proxyEndpoint);
   const rewrittenInit = replaceAuth(init, config);
   const path = extractPath(url);
-  const modelsTiming = path === MODELS_PATH ? new TimingRecorder() : undefined;
+  const timedPath = TIMED_REST_PATHS.get(path);
+  const timing = timedPath ? new TimingRecorder() : undefined;
 
   try {
     const response = await originalFetch(rewrittenUrl, rewrittenInit);
 
-    if (modelsTiming) {
-      emitModelsFetchTiming(modelsTiming, config, response.status);
+    if (timedPath && timing) {
+      emitRestTiming(timedPath, timing, config, response.status);
     }
 
     if (!response.ok) {
@@ -290,22 +310,23 @@ async function fetchWithUrlRewrite(
 }
 
 /**
- * Emit the `cursor_models_fetch` timeline for one proxied GET /v1/models.
+ * Emit the timeline for one proxied REST call on a timed path.
  *
  * `execution_id` comes from the AsyncLocalStorage execution context — the
  * whole ExecuteCursor activity runs inside runWithExecutionContext, so the
  * value is correct even with concurrent activities on one runner process.
- * `recordTimingMetric` deliberately ignores this event (no mapped OTel
- * instrument): it is a forensic stdout line only, joined to the
+ * `recordTimingMetric` deliberately ignores these events (no mapped OTel
+ * instruments): they are forensic stdout lines only, joined to the
  * execution_setup timeline by execution_id in cold-start-baseline analysis.
  */
-function emitModelsFetchTiming(
+function emitRestTiming(
+  timedPath: TimedRestPath,
   timing: TimingRecorder,
   config: ProxyConfig,
   httpStatus: number,
 ): void {
-  timing.mark("models_fetch");
-  emitTimingLog("cursor_models_fetch", {
+  timing.mark(timedPath.segment);
+  emitTimingLog(timedPath.event, {
     execution_id: executionContext.getStore()?.executionId ?? config.executionId,
     http_status: httpStatus,
   }, timing);

package/src/activities/execute-cursor/index.ts

@@ -57,7 +57,8 @@ import {
 } from "../../shared/caller-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
 import { readDeclaredPreferences } from "../../shared/declared-preferences.js";
-import { readRecalledMemories } from "../../shared/recalled-memories.js";
+import type { RecalledMemoriesContent } from "../../shared/recalled-memories.js";
+import { selectRecalledFacts } from "../../shared/memory-retrieval.js";
 import { withholdSecretContentFromMessages } from "../../shared/tool-row.js";
 import { StallTimeoutError, formatStallFailure } from "../../shared/stall-watchdog.js";
 import { resolveUsableArtifactStorage, loadArtifactStorageConfig, type ArtifactStorage } from "../../shared/artifact-storage.js";
@@ -84,6 +85,7 @@ import {
   readChannelConversationId,
   synthesizeConversationAttachment,
 } from "../../shared/conversation-attachment.js";
+import { synthesizeMemoryAttachment } from "../../shared/memory-attachment.js";
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { mergeApprovalPolicies } from "./approval-policy.js";
 import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
@@ -717,6 +719,33 @@ async function executeCursorInner(
         resolvedMcpServers, conversationAttachment, "conversation participation",
       );
     }
+
+    // Phase 4a5: Synthesize the memory capture attachment (DD-005 D1) —
+    // the fourth sibling. The recall snapshot's enabled bit IS the
+    // attachment decision (server-stamped at execution create; a free
+    // local read, like the conversation attachment's session label). The
+    // capture context is attribution the server verifies or trusts per
+    // edition (Stage 3 provenance decision); the subject is never
+    // threaded — it derives from the credential.
+    const memoryAttachment = synthesizeMemoryAttachment(
+      execution.spec?.recalledMemories,
+      {
+        org: session.metadata?.org ?? "",
+        agentId: blueprint.agent.metadata?.id ?? "",
+        sessionId,
+        agentExecutionId: executionId,
+      },
+      {
+        bridgeEndpoint: config.mcpBridgeEndpoint,
+        credential: attachmentCredential,
+        backendEndpoint: config.stigmerBackendEndpoint,
+      },
+    );
+    if (memoryAttachment) {
+      resolvedMcpServers = injectSynthesizedAttachment(
+        resolvedMcpServers, memoryAttachment, "memory capture",
+      );
+    }
     // The one projection point: every mutation above is now visible in the
     // Cursor SDK config by construction (no per-mutation rebuild to forget).
     const mcpConfig = toCursorMcpConfig(resolvedMcpServers);
@@ -1154,6 +1183,38 @@ async function executeCursorInner(
     const structuredOutputSchema = spec.executionConfig?.structuredOutputSchema as
       Record<string, unknown> | undefined;
 
+    // Phase 9c: Semantic memory selection (DD-008), memoized to at most one
+    // run per invocation. Deliberately NOT decided by the Phase-10
+    // resolution alone: a resumed-agent primary send carries no memories,
+    // but a mid-send poisoned-handle failure rebuilds on a FRESH agent
+    // whose recovery prompt does — the buildFromPlan drop-hazard class —
+    // so every memory-carrying build site awaits this lazily instead.
+    // Selection runs against the frozen first message's semantics: above
+    // the activation threshold it picks top-k for spec.message, otherwise
+    // (and on any failure) it injects the full candidate set — Phase 2
+    // behavior. The outcome report is stamped on the turn's status ONCE,
+    // picked up by the next persist; a re-invocation replays the report
+    // already persisted on the execution rather than re-selecting (the
+    // written-once rule).
+    let memorySelection: Promise<RecalledMemoriesContent | undefined> | undefined;
+    const selectMemoriesOnce = (): Promise<RecalledMemoriesContent | undefined> => {
+      memorySelection ??= selectRecalledFacts(spec.recalledMemories, spec.message, {
+        proxyEndpoint: config.proxyEndpoint,
+        stigmerToken: config.stigmerToken,
+        executionId,
+        priorReport: execution.status?.recalledMemoriesReport,
+      }).then((selection) => {
+        if (selection.report !== undefined) {
+          status.recalledMemoriesReport = selection.report;
+        }
+        return selection.content;
+      });
+      return memorySelection;
+    };
+    const recalledMemories = promptCarriesStandingContext(resolution.reason)
+      ? await selectMemoriesOnce()
+      : undefined;
+
     // Phase 10: Build the prompt
     const interactionMode = spec.executionConfig?.interactionMode
       ?? InteractionMode.UNSPECIFIED;
@@ -1180,7 +1241,7 @@ async function executeCursorInner(
       senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
       sessionContext: readSessionContext(blueprint.sessionSpec.metadata),
       declaredPreferences: readDeclaredPreferences(spec.declaredPreferences),
-      recalledMemories: readRecalledMemories(spec.recalledMemories),
+      recalledMemories,
       conversationCatchup: readConversationCatchup(spec.conversationCatchup),
       // The turn's recorded transcript, seeded from the persisted execution
       // on a reinvocation (Phase 3). Consumed only by the HITL-recovery
@@ -1888,7 +1949,10 @@ async function executeCursorInner(
             senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
             sessionContext: readSessionContext(blueprint.sessionSpec.metadata),
             declaredPreferences: readDeclaredPreferences(spec.declaredPreferences),
-            recalledMemories: readRecalledMemories(spec.recalledMemories),
+            // Lazily selected: the primary send may have been a resumed-agent
+            // shape that carried no memories, but this fresh agent's prompt
+            // must (see the Phase 9c memoized selection).
+            recalledMemories: await selectMemoriesOnce(),
             conversationCatchup: readConversationCatchup(spec.conversationCatchup),
             // Composed fresh (not reused from Phase 10): the failed primary
             // stream may have appended partial work onto status.messages,
@@ -2578,6 +2642,23 @@ export function primarySendCarriesImages(
   return !(isHitlReinvocation(approvalDecisions) && reason === "resumed_successfully");
 }
 
+/**
+ * Whether a prompt built for this resolution carries the STANDING context —
+ * instructions, skills, declared preferences, recalled memories, session
+ * context. Exactly one resolution shape does not: a successfully RESUMED
+ * agent, whose native conversation already holds the first message's
+ * context (both its prompt shapes — the raw follow-up and the
+ * decisions-only HITL reinvocation — send no standing sections).
+ *
+ * The named authority for that routing property (the
+ * primarySendCarriesImages idiom): buildPrompt's internal routing and the
+ * activity's standing-context preparation (e.g. the memory selection gate)
+ * both consult THIS predicate, so the two can never drift.
+ */
+export function promptCarriesStandingContext(reason: AgentResolutionReason): boolean {
+  return reason !== "resumed_successfully";
+}
+
 /**
  * Append the structured-output contract to a prompt when the execution
  * requests one. A per-turn directive (the buildFromPlan rule): it must ride
@@ -2619,7 +2700,7 @@ export function buildPrompt(input: BuildPromptInput): string {
   // an empty conversation strand the agent with instructions and no story,
   // and the session inherits that amnesia permanently (issue #366).
   if (isHitlReinvocation(approvalDecisions)) {
-    if (resolution.reason !== "resumed_successfully") {
+    if (promptCarriesStandingContext(resolution.reason)) {
       return buildHitlRecoveryPrompt(
         {
           instructions,
@@ -2670,7 +2751,7 @@ export function buildPrompt(input: BuildPromptInput): string {
   // cloud DD-006). Catchup last: it is context, and context sits closest to
   // the task (the enhanced prompt's own ordering doctrine); the input files
   // precede it because they are this turn's payload, not background.
-  if (resolution.reason === "resumed_successfully") {
+  if (!promptCarriesStandingContext(resolution.reason)) {
     const prefixes = [
       formatInteractionModePrefix(interactionMode),
       formatImplementPlanSection(buildFromPlan, attachments),

package/src/activities/execute-cursor/message-translator.ts

@@ -501,15 +501,21 @@ function blockText(b: Record<string, unknown>): string | undefined {
  *
  * The Cursor SDK returns sub-agent work as a blob in the task tool's
  * completed event (not as streaming events with a distinct agent_id).
- * Re-verified 2026-07-02 with live recordings on both the pinned SDK (1.0.13)
- * and the latest (1.0.22): zero events reach the parent's run.stream() between
- * the task tool's "running" and "completed" events, every event carries the
- * parent's agent_id, and the child agentId visible in the task args at spawn
- * is NOT queryable mid-run through any public read surface (Agent.listRuns /
- * Agent.messages.list / Agent.getRun all return not-found for it; the SDK's
- * on-disk sub-agent transcript is written only at completion). Live nested
- * visibility is therefore an upstream SDK limitation — do not try to fake it
- * here; the UI shows an elapsed-time affordance instead (SubAgentSection).
+ * Re-verified 2026-08-23 on the pinned SDK (1.0.13) AND the latest (1.0.28),
+ * this time including the write side (stigmer/stigmer#839): an injected
+ * platform.eventStore/eventNotifier receives parent events only on 1.0.13 and
+ * is bypassed entirely on 1.0.28 (persistence moved into the executor daemon's
+ * own state dir); zero events reach the parent's run.stream() mid-task; the
+ * agentId in the task args is not a platform-store agent id at all, so it can
+ * never be addressable via Agent.listRuns / Agent.getRun (this is WHY the
+ * 2026-07-02 read-side polls all returned not-found). On 1.0.28 the child
+ * transcript lands at a deterministic path knowable at spawn
+ * (~/.cursor/projects/<slug>/agent-transcripts/<parentId>/subagents/<argsAgentId>.jsonl)
+ * but is flushed only at completion — verified with 200ms sampling across a
+ * full sub-agent run. Live nested visibility is therefore still an upstream
+ * SDK limitation — do not try to fake it here; the UI shows an elapsed-time
+ * affordance instead (SubAgentSection). Probe scripts and recordings:
+ * stigmer-cloud _projects/2026-08/20260823.03.cursor-subagent-live-progress.
  * The result shape is:
  *
  *   { status: "success", value: { conversationSteps: ConversationStep[] } }

package/src/activities/execute-deep-agent/__tests__/mcp-gate.test.ts

@@ -14,6 +14,7 @@ const nothing = {
   mcpServerUsageCount: 0,
   channelMessagingCount: 0,
   conversationChannelId: undefined,
+  memoryCaptureEnabled: false,
 };
 
 describe("shouldConnectMcp", () => {
@@ -34,4 +35,10 @@ describe("shouldConnectMcp", () => {
     // channel — the escalation tool is the ONLY source.
     expect(shouldConnectMcp({ ...nothing, conversationChannelId: "agch_1" })).toBe(true);
   });
+
+  it("enters on memory capture alone (the memory attachment)", () => {
+    // A tool-less agent whose user has memory on: the remember tool is
+    // the ONLY source, and skipping the block would silently drop it.
+    expect(shouldConnectMcp({ ...nothing, memoryCaptureEnabled: true })).toBe(true);
+  });
 });

package/src/activities/execute-deep-agent/index.ts

@@ -180,6 +180,16 @@ export function createDeepAgentActivities(config: Config) {
           ? seedStatusFromExecution(setup.execution)
           : create(AgentExecutionStatusSchema, {});
 
+        // The semantic retriever's injection outcome (DD-008 D5), computed at
+        // prompt build in setup Step 8. Stamped here — before the first
+        // persist — because setup predates this status object; the server's
+        // presence-guarded merge preserves it across report-less writes. On a
+        // re-invocation the seeded status already carries the (replayed)
+        // report, so this stamp is idempotent by construction.
+        if (setup.recalledMemoriesReport !== undefined) {
+          initialStatus.recalledMemoriesReport = setup.recalledMemoriesReport;
+        }
+
         const statusBuilder = new StatusBuilder(executionId, initialStatus);
 
         statusBuilder.setApprovalProvider({

package/src/activities/execute-deep-agent/mcp-gate.ts

@@ -22,6 +22,8 @@ export interface McpToolSources {
   /** The serving channel id when this session IS a live channel
    *  conversation (the conversation attachment, DD-008). */
   readonly conversationChannelId: string | undefined;
+  /** The recall snapshot's enabled bit (the memory attachment, DD-005 D1). */
+  readonly memoryCaptureEnabled: boolean;
 }
 
 /** True when any tool source demands MCP resolution and connect. */
@@ -29,6 +31,7 @@ export function shouldConnectMcp(sources: McpToolSources): boolean {
   return (
     sources.mcpServerUsageCount > 0 ||
     sources.channelMessagingCount > 0 ||
-    sources.conversationChannelId !== undefined
+    sources.conversationChannelId !== undefined ||
+    sources.memoryCaptureEnabled
   );
 }

package/src/activities/execute-deep-agent/setup.ts

@@ -15,7 +15,7 @@ import { z } from "zod";
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 type AgentGraph = any;
 
-import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { AgentExecution, RecalledMemoriesReport } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import type { DynamicStructuredTool } from "@langchain/core/tools";
@@ -33,7 +33,7 @@ import {
 } from "../../shared/caller-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
 import { readDeclaredPreferences } from "../../shared/declared-preferences.js";
-import { readRecalledMemories } from "../../shared/recalled-memories.js";
+import { selectRecalledFacts } from "../../shared/memory-retrieval.js";
 import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-manager.js";
 import { mergeMcpServerUsages, resolveMcpServers } from "../../shared/mcp-resolver.js";
 import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
@@ -47,6 +47,10 @@ import {
   readChannelConversationId,
   synthesizeConversationAttachment,
 } from "../../shared/conversation-attachment.js";
+import {
+  memoryCaptureEnabled,
+  synthesizeMemoryAttachment,
+} from "../../shared/memory-attachment.js";
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { shouldConnectMcp } from "./mcp-gate.js";
 import { WorkspaceProvisioner } from "../../shared/workspace/provisioner.js";
@@ -197,6 +201,15 @@ export interface SetupResult {
    * baseline/candidate/reconcile seam (`capture.ts`) and the CAS capture-class.
    */
   readonly gitWorkspace: boolean;
+  /**
+   * The semantic retriever's injection outcome (DD-008 D5), produced at
+   * prompt build (Step 8) — the one place selection runs. The activity
+   * stamps it onto the turn's status proto before the first persist; the
+   * server's presence-guarded merge preserves it across report-less
+   * writes. Undefined when nothing was injected (recall absent, disabled,
+   * or empty) — absent report = wholesale, true by construction.
+   */
+  readonly recalledMemoriesReport: RecalledMemoriesReport | undefined;
 }
 
 export interface SetupDependencies {
@@ -390,11 +403,17 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     // free, synchronous read, so no hoisted discovery needed.
     const conversationChannelId = readChannelConversationId(session.metadata?.labels);
 
+    // The memory-attachment decision (DD-005 D1): the recall snapshot's
+    // enabled bit, stamped server-side at execution create — like the
+    // conversation attachment, a free, synchronous spec read.
+    const captureMemories = memoryCaptureEnabled(execution.spec?.recalledMemories);
+
     let resolvedMcpServers: Awaited<ReturnType<typeof resolveMcpServers>> | null = null;
     if (shouldConnectMcp({
       mcpServerUsageCount: mcpServerUsages.length,
       channelMessagingCount: channelMessaging.length,
       conversationChannelId,
+      memoryCaptureEnabled: captureMemories,
     })) {
       await reportSetupProgress(client, executionId, "Connecting tools…");
       const transportPosture = resolveMcpTransportPosture(config.mode);
@@ -456,6 +475,32 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
           backfilledServers, conversationAttachment, "conversation participation",
         );
       }
+
+      // The memory capture attachment (DD-005 D1) — same after-backfill
+      // rule. The capture context is attribution the server verifies or
+      // trusts per edition (Stage 3 provenance decision); the subject is
+      // never threaded — it derives from the credential.
+      if (captureMemories) {
+        const memoryAttachment = synthesizeMemoryAttachment(
+          execution.spec?.recalledMemories,
+          {
+            org: session.metadata?.org ?? "",
+            agentId: agent.metadata?.id ?? "",
+            sessionId,
+            agentExecutionId: executionId,
+          },
+          {
+            bridgeEndpoint: config.mcpBridgeEndpoint,
+            credential: attachmentCredential,
+            backendEndpoint: config.stigmerBackendEndpoint,
+          },
+        );
+        if (memoryAttachment) {
+          backfilledServers = injectSynthesizedAttachment(
+            backfilledServers, memoryAttachment, "memory capture",
+          );
+        }
+      }
       resolvedMcpServers = { resolvedServers: backfilledServers };
       timing.mark("backfill_mcp");
 
@@ -554,7 +599,27 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     }
     timing.mark("inject_attachments");
 
-    // Step 8: Build enhanced system prompt
+    // Step 8: Build enhanced system prompt.
+    //
+    // Recalled memories go through the semantic retriever (DD-008), not the
+    // raw snapshot read: above the activation threshold it selects the
+    // top-k facts for THIS turn's message (one batched embeddings call);
+    // otherwise — and on any failure — it injects the full candidate set,
+    // exactly the Phase 2 behavior. A re-invocation of this execution
+    // (approval resume) replays the outcome recorded on the execution's
+    // status instead of re-selecting, so the prompt never shifts
+    // mid-execution. The report returned here is stamped onto the turn's
+    // status by the activity (index.ts) — setup has no status object yet.
+    const memorySelection = await selectRecalledFacts(
+      execution.spec!.recalledMemories,
+      execution.spec!.message,
+      {
+        proxyEndpoint: config.proxyEndpoint,
+        stigmerToken: config.stigmerToken,
+        executionId,
+        priorReport: execution.status?.recalledMemoriesReport,
+      },
+    );
     const systemPrompt = buildEnhancedSystemPrompt({
       instructions,
       provisionResults,
@@ -578,9 +643,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       declaredPreferences: readDeclaredPreferences(
         execution.spec!.declaredPreferences,
       ),
-      recalledMemories: readRecalledMemories(
-        execution.spec!.recalledMemories,
-      ),
+      recalledMemories: memorySelection.content,
     });
 
     // Step 9: Construct the LLM model. Resolution to the provider API id
@@ -928,6 +991,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       casObserver,
       captureMode,
       gitWorkspace,
+      recalledMemoriesReport: memorySelection.report,
     };
   } catch (err) {
     if (mcpConnection) {

package/src/payload-codecs.ts

@@ -12,9 +12,9 @@
  *   decode: claim-check → decrypt   (restore the blob, then decrypt)
  */
 
+import type { BootstrapKeyMaterial } from "@stigmer/temporal-codecs";
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
-import type { BootstrapKeyMaterial } from "./encryption/config.js";
 import { getRunnerSecret } from "./shared/runner-credential-store.js";
 
 export async function createPayloadCodecs(
@@ -23,12 +23,18 @@ export async function createPayloadCodecs(
 ): Promise<PayloadCodec[] | undefined> {
   const codecs: PayloadCodec[] = [];
 
-  const { loadPayloadEncryptionConfig, EncryptionPayloadCodec } = await import(
-    "./encryption/index.js"
-  );
+  const {
+    loadPayloadEncryptionConfig,
+    EncryptionPayloadCodec,
+    loadClaimcheckConfig,
+    ClaimcheckPayloadCodec,
+  } = await import("@stigmer/temporal-codecs");
   // Env-configured keys win outright; server-managed (bootstrap) keys apply
-  // only when the env is silent — see encryption/config.ts for the rationale.
-  const encryptionConfig = loadPayloadEncryptionConfig(bootstrapKeys);
+  // only when the env is silent — see the lib's encryption/config.ts for the
+  // rationale. Key VALUES resolve through getRunnerSecret (the #508 boot
+  // capture moves them out of process.env — agent shells must not read
+  // them), which is why the loader takes the reader as an argument.
+  const encryptionConfig = loadPayloadEncryptionConfig(getRunnerSecret, bootstrapKeys);
   if (encryptionConfig) {
     codecs.push(new EncryptionPayloadCodec(encryptionConfig));
     const source = getRunnerSecret("STIGMER_PAYLOAD_ENCRYPTION_KEY") ? "env" : "bootstrap";
@@ -41,9 +47,6 @@ export async function createPayloadCodecs(
     );
   }
 
-  const { loadClaimcheckConfig, ClaimcheckPayloadCodec } = await import(
-    "./claimcheck/index.js"
-  );
   const claimcheckConfig = loadClaimcheckConfig();
   if (claimcheckConfig.enabled) {
     const { loadArtifactStorageConfig, createArtifactStorage } = await import(