@stigmer/runner 3.15.3-dev.20260914121148 → 3.16.0

package/src/shared/channel-attachment.ts

@@ -11,13 +11,16 @@
  * model composes template sends in context without spending a tool
  * round (DD-003 D5).
  *
- * Two connection shapes, one roster (the records pattern):
+ * Two connection shapes, one roster (the records pattern), one
+ * credential — the run's own — presented on both:
  *   - Bridge endpoint configured (cloud): Streamable HTTP against the
- *     bridge's /channels route with the execution's own session-scoped
- *     credential as the Bearer token.
+ *     bridge's /channels route with the run's credential as the Bearer
+ *     token.
  *   - No bridge endpoint (OSS/local): a spawned `stigmer mcp-server`
- *     stdio child with STIGMER_MCP_ROSTER=channels. In practice OSS
- *     answers the discovery read with an empty list (DD-006 D3), so
+ *     stdio child with STIGMER_MCP_ROSTER=channels and the run's
+ *     credential as its startup credential (synthesized-attachment.ts
+ *     `stdioCredentialEnv`, the memory attachment's twin). In practice
+ *     OSS answers the discovery read with an empty list (DD-006 D3), so
  *     this shape only serves local deployments that grow a messaging
  *     runtime later — it exists for symmetry with the deployment
  *     topology, not for a live OSS path today.
@@ -42,7 +45,11 @@ import type {
 } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/message_io_pb";
 import type { StigmerClient } from "../client/stigmer-client.js";
 import type { ResolvedMcpServer } from "./mcp-resolver.js";
-import { grpcTarget, type SynthesizedAttachmentOptions } from "./synthesized-attachment.js";
+import {
+  grpcTarget,
+  stdioCredentialEnv,
+  type SynthesizedAttachmentOptions,
+} from "./synthesized-attachment.js";
 
 /**
  * The synthesized attachment's slug. Reserved: a user McpServer with
@@ -151,6 +158,7 @@ export function synthesizeChannelAttachment(
     env: {
       STIGMER_MCP_ROSTER: "channels",
       STIGMER_SERVER_ADDRESS: grpcTarget(options.backendEndpoint),
+      ...stdioCredentialEnv(options.credential),
     },
   };
 }

package/src/shared/cost-guard.ts

@@ -1,8 +1,8 @@
 /**
  * ExecutionConfig.max_cost_usd enforcement as a hard stop on a harness turn.
  *
- * Harness-agnostic: the Cursor activity is today's only caller and the turn
- * runtime takes it over in S2 M3. The rationale below is Cursor's, and it is
+ * Harness-agnostic: the Cursor activity was its only caller until the turn
+ * runtime took it over in #1070. The rationale below is Cursor's, and it is
  * why the module is shaped as a hard stop rather than a middleware.
  *
  * The native harness enforces the cap in middleware (cost-cap.ts): tools are

package/src/shared/exact-apply.ts

@@ -28,7 +28,7 @@
  *
  * SOURCE OF TRUTH — the approved whole-file bytes and target path are read from
  * the gated tool call's `args` (the authoritative proposed content the deny-gate
- * stamped from the hook input; see execute-cursor/message-translator.ts
+ * stamped from the hook input; see execute-cursor/boundary-rows.ts
  * `applyGateInput`). This is the single copy — there is no separate captured
  * `file_changes` mirror — so "what was shown == what is applied" holds by
  * construction. (Phase 5 Slice 4 removed the redundant `ToolCall.file_changes`

package/src/shared/execution-context.ts

@@ -15,8 +15,8 @@
  * `setInterceptorExecutionId`) is whichever turn set it last; this store is
  * what makes concurrent turns not overwrite each other's headers.
  *
- * Moved from `activities/execute-cursor/fetch-interceptor.ts` (S2 M3,
- * Q-M3-12) so `harness/run-turn.ts` can enter it without importing the
+ * Moved from `activities/execute-cursor/fetch-interceptor.ts` (#1070)
+ * so `harness/run-turn.ts` can enter it without importing the
  * adapter; the interceptors import it from here. No harness enters it: the
  * contract lists it among the things deliberately NOT on `TurnSink`.
  */

package/src/shared/extract-structured-output.ts

@@ -3,8 +3,8 @@
  *
  * Harness-agnostic, and called from one place: the turn runtime's epilogue
  * (`harness/run-turn.ts` `extractStructuredOutputFromText`), so both
- * harnesses have it — Cursor since S2 M3, native since S3 M2a (pinned by the
- * native hermetic `structured-output` tier-2 arm since M2b, Q-S3-7).
+ * harnesses have it — Cursor since #1070, native since #1096 (pinned by the
+ * native hermetic `structured-output` tier-2 arm).
  *
  * When tier-1 text extraction (shared/extract-json.ts) cannot find JSON in
  * the agent's free-text response, this tier asks an economy-tier LLM to

package/src/shared/filereview/__tests__/capture.test.ts

@@ -1,8 +1,12 @@
 /**
- * @regression file-hitl-phase0 — pins file-edit HITL fixes #7, #8, #9 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ * @regression file-hitl-phase0 — pins three rules of git capture mode: a
+ * no-commit tree-ref snapshot and restore with one card per changed file;
+ * edits stay applied through the WAITING-to-resume boundary and the resume
+ * reconciles to the pinned refs; a reject is a DISCARD that COMPLETES, snaps
+ * the tree back byte for byte, and partial decisions land only approved files.
  *
  * Tests the harness-agnostic capture orchestration directly, under one
- * harness id (since S3 M4 the runtime is the ONE caller for every harness,
+ * harness id (since #1096 the runtime is the ONE caller for every harness,
  * `harness/capture.ts`; until then each adapter called this seam and the
  * Cursor side had its own test, `execute-cursor/capture-flow.test.ts`, whose
  * three reconcile arms no other file carried moved here). Confirms that the
@@ -235,8 +239,8 @@ describe("capture orchestration — deep-agent harness", () => {
     // artifact mode. `ProxyArtifactStorage.exists()` reports true for ANY key
     // (the presign endpoint mints a URL regardless of object existence), so the
     // old reconcile "found" a CAS manifest that a git-only turn never wrote,
-    // downloaded it, and died on the R2 `NoSuchKey` 404 (see the ExecuteCursor
-    // crash in _cursor/error.md). The reconcile must decide "is this a CAS turn?"
+    // downloaded it, and died on the R2 `NoSuchKey` 404 (the ExecuteCursor
+    // crash `proxy-reconcile.test.ts` reproduces). The reconcile must decide "is this a CAS turn?"
     // from the change set's CANDIDATE snapshot — a git-only turn carries no cas
     // ref — so a lying `exists()` can no longer turn a git reconcile into a
     // doomed download.
@@ -335,7 +339,7 @@ function candidateCompleteness(status: AgentExecutionStatus): DiffCompleteness |
     : undefined;
 }
 
-describe("capture reconcile — the decision rules the resume enforces (moved from execute-cursor/capture-flow.test at S3 M4)", () => {
+describe("capture reconcile — the decision rules the resume enforces (moved from execute-cursor/capture-flow.test in #1096)", () => {
   async function captureTwoFileTurn(status: AgentExecutionStatus): Promise<void> {
     const baseline = await captureBaselineToLedger({ status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID, harnessId: HARNESS });
     await write("notes.md", "planton notes\n");

package/src/shared/filereview/__tests__/git-substrate.test.ts

@@ -1,5 +1,8 @@
 /**
- * @regression file-hitl-phase0 — pins file-edit HITL fixes #7, #8 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ * @regression file-hitl-phase0 — pins git capture mode: a no-commit tree-ref
+ * snapshot and restore with one card per changed file; edits stay applied
+ * through the WAITING-to-resume boundary and the resume reconciles to the
+ * pinned refs.
  *
  * Unit tests for the git snapshot/restore capture substrate (the PRIMITIVES:
  * snapshot / capture / restore / apply / recompute / drop).

package/src/shared/filereview/__tests__/proxy-reconcile.test.ts

@@ -1,8 +1,8 @@
 /**
  * @regression file-hitl-proxy-reconcile — the file-review reconcile crash in
- * cloud/desktop (proxy) artifact mode (see _cursor/error.md: an ExecuteCursor
- * turn died on `Artifact download failed (HTTP 404) ... NoSuchKey` for a CAS
- * manifest a git-only turn never wrote).
+ * cloud/desktop (proxy) artifact mode: an ExecuteCursor turn died on
+ * `Artifact download failed (HTTP 404) ... NoSuchKey` for a CAS manifest a
+ * git-only turn never wrote.
  *
  * This exercises the REAL {@link ProxyArtifactStorage} end to end against a mock
  * proxy + object store, so the whole stack — presign, the ranged-GET existence

package/src/shared/filereview/cas-touched.ts

@@ -14,9 +14,9 @@
  * capture ({@link buildCasTurnCaptures}), which composes it into the
  * {@link CasPathCapture}s the CAS substrate stores.
  *
- * Until S3 M4 each harness carried its own copy of `buildCasTurnCaptures`
+ * Until #1096 each harness carried its own copy of `buildCasTurnCaptures`
  * beside its observation source; the copies were byte-near-identical
- * (F-M4-P6) and now live here once. The AFTER bytes are always re-read from
+ * and now live here once. The AFTER bytes are always re-read from
  * disk at composition time (the authoritative net result of the turn), so
  * many edits to one path collapse to one before/after.
  */

package/src/shared/filereview/progress.ts

@@ -24,6 +24,19 @@
  * plus a `changed` flag, so the hybrid can merge both slices even when only one
  * moved (a `ProgressDelta | undefined` would drop the unchanged slice).
  *
+ * WHAT A CAPTURE MAY SEE
+ * ----------------------
+ * A capture rides a persist, and the persist that a tool's start dirtied runs
+ * while that tool may still be writing: the engine does not wait for the
+ * runtime's write to land before it runs the tool. So one snapshot can precede
+ * a tool's write (a turn behind), straddle it (the path present, the counts of
+ * a half-written file), or follow it (the next tool's file already there).
+ * That is accepted, not fixed: the strip is a latest-wins display field and the
+ * next capture converges it, while capturing only between tools would take the
+ * strip's liveness away during exactly the long-running tools it exists for.
+ * A consumer — a console, a test — reads the strip for what it converges to
+ * while the set is CAPTURING, never for what one capture happened to show.
+ *
  * SECRET SAFETY
  * -------------
  * No file bodies are ever carried. A secret-like path ({@link isSecretLikePath})

package/src/shared/heartbeat.ts

@@ -13,7 +13,7 @@
  * heartbeat subject — `@temporalio/activity/lib/index.js`
  * `Context.heartbeat`, `@temporalio/worker/lib/worker.js` the heartbeat
  * callback; the SDK's own doc: "Cancellation is not propagated from this
- * function"). Until S2 M3 this handle carried two flags for a throw that
+ * function"). Until #1070 this handle carried two flags for a throw that
  * cannot happen; a turn reads its interruption from the signal's reason
  * instead (`worker-shutdown.ts` `classifyTurnInterruption`).
  */

package/src/shared/llm-backend.ts

@@ -8,10 +8,6 @@
  * factories run `preflightLlmBackends` at startup, and `model-client.ts`
  * resolves the backend and translates model ids at construction time; see
  * `__tests__/vertex-seam.test.ts` for the pinned seam behavior.
- *
- * Design decision record: stigmer-cloud
- * `_projects/2026-08/20260809.01.multi-cloud-llm-provider-endpoints/`
- * `design-decisions/001-provider-backends.md`.
  */
 
 import type { LlmProvider } from "./llm-proxy.js";

package/src/shared/memory-attachment.ts

@@ -12,22 +12,29 @@
  * ZERO facts is a meaningful state: memory is on, nothing stored yet —
  * the tool is offered so the first fact can be proposed.
  *
- * Two connection shapes, one roster (the channels pattern):
+ * Two connection shapes, one roster (the channels pattern), one
+ * credential — the run's own — presented on both:
  *   - Bridge endpoint configured (cloud): Streamable HTTP against the
- *     bridge's /memory route with the execution's own session-scoped
- *     credential as the Bearer token, plus the capture context as
- *     per-request headers.
+ *     bridge's /memory route with the run's credential as the Bearer
+ *     token, plus the capture context as per-request headers.
  *   - No bridge endpoint (OSS/local): a spawned `stigmer mcp-server`
- *     stdio child with STIGMER_MCP_ROSTER=memory, plus the capture
- *     context as STIGMER_MEMORY_* env.
+ *     stdio child with STIGMER_MCP_ROSTER=memory, the run's credential
+ *     as its startup credential (synthesized-attachment.ts
+ *     `stdioCredentialEnv`), plus the capture context as
+ *     STIGMER_MEMORY_* env. Without the credential a server that signs
+ *     people in refuses every `remember` as nobody's (stigmer#1147);
+ *     with it the memory is the run's person's, which the server derives
+ *     from the credential and nothing the child says.
  *
  * The capture context (org + agent/session/execution ids) is
  * attribution, never authorization (the Stage 3 provenance decision,
  * owner-ratified 2026-08-22): the cloud create handler accepts it only
  * from a session-sandbox credential and overrides session/org with the
- * token's own claims; the OSS server stores it under the local
- * single-user trust model. The subject is never threaded — the server
- * derives it from the credential (DD-005 D2).
+ * token's own claims; the OSS server under sign-in admits it from the
+ * run's credential and proves the session off the run's row, and stores
+ * it as given under the local single-user trust model. The subject is
+ * never threaded — the server derives it from the credential (DD-005
+ * D2).
  *
  * Approval-free by construction (the synthesized-attachment contract):
  * the tool only ever creates a PROPOSAL the user must confirm through
@@ -44,7 +51,11 @@
 
 import type { RecalledMemories } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
 import type { ResolvedMcpServer } from "./mcp-resolver.js";
-import { grpcTarget, type SynthesizedAttachmentOptions } from "./synthesized-attachment.js";
+import {
+  grpcTarget,
+  stdioCredentialEnv,
+  type SynthesizedAttachmentOptions,
+} from "./synthesized-attachment.js";
 
 /**
  * The synthesized attachment's slug. Reserved: a user McpServer with
@@ -149,6 +160,7 @@ export function synthesizeMemoryAttachment(
     env: {
       STIGMER_MCP_ROSTER: "memory",
       STIGMER_SERVER_ADDRESS: grpcTarget(options.backendEndpoint),
+      ...stdioCredentialEnv(options.credential),
       ...nonEmptyEntries([
         [MEMORY_ORG_ENV, context.org],
         [MEMORY_AGENT_ID_ENV, context.agentId],

package/src/shared/model-error.ts

@@ -14,8 +14,7 @@
  *    errors from the PLATFORM's provider account told customers to top up
  *    consoles they don't own. The cloud proxy rewrites those to a 503
  *    carrying PLATFORM_CAPACITY_SENTINEL (the contract lives in
- *    stigmer-cloud's PlatformProviderErrorClassifier and the DD at
- *    _projects/2026-08/20260801.02.provider-error-attribution/); this module
+ *    stigmer-cloud's PlatformProviderErrorClassifier); this module
  *    is the runner-side half that recognizes the sentinel and, in direct
  *    (BYO-key) mode, attributes billing errors to the user's own account
  *    with actionable wording.

package/src/shared/persist-decision.ts

@@ -3,10 +3,17 @@
  *
  * Harness-agnostic, and both adapters' stream loops read it
  * (`execute-cursor/turn-stream.ts`, `execute-deep-agent/turn-stream.ts`; the
- * native orchestrator's own copy of the rule retired with it at S3 M2b):
- * `shouldPersist = forceFlush || scheduler.shouldSendUpdate(eventCount)`.
- * Both harnesses thus share one cadence model — discrete state changes flush
- * immediately, high-frequency token deltas ride a bounded time cadence.
+ * native orchestrator's own copy of the rule retired with it in #1096):
+ * `shouldPersist = transcriptDirty || scheduler.shouldSendUpdate(eventCount)`.
+ * Both harnesses thus share one cadence model — a discrete state change
+ * flushes immediately, high-frequency token deltas ride a bounded time
+ * cadence.
+ *
+ * One flag, the transcript builder's `dirty` (since #1097). Until then the
+ * decision took three Cursor-named flags — the delta enricher's, the todo
+ * tracker's and the accumulator's — of which two were constant `false` on
+ * both loops once the one builder folded every discrete change; a shape
+ * that named writers which no longer existed.
  *
  * Extracted as a single pure function so the stream loop and its unit tests
  * exercise the same implementation and cannot drift.
@@ -14,43 +21,27 @@
 
 import type { StreamingUpdateScheduler } from "./streaming-scheduler.js";
 
-/**
- * Force-flush signals — discrete, user-visible state changes that must reach the
- * live stream immediately, independent of the scheduler's time cadence.
- */
-export interface ForceFlushSignals {
-  /** Shell/tool output text accumulated past the delta-enricher debounce. */
-  readonly deltaEnricherDirty: boolean;
-  /** The agent's todo list changed. */
-  readonly todosDirty: boolean;
-  /**
-   * A tool call started or reached a terminal status, or a sub-agent was
-   * delegated/updated (MessageAccumulator.isDirty).
-   */
-  readonly contentDirty: boolean;
-}
-
 /**
  * Decide whether to persist the streaming status after a stream event.
  *
- * - forceFlush: any discrete signal flushes now so the live trace (tool calls,
- *   sub-agents, todos, shell output) is never starved on short turns.
+ * - `transcriptDirty`: a discrete, user-visible change landed on the
+ *   transcript since the last persist (a row started or settled, a sub-agent
+ *   delegated, a todo written, an artifact registered) and must reach the
+ *   live stream now, so short turns are never starved.
  * - scheduler: the shared StreamingUpdateScheduler carries assistant text and
  *   model thinking on a bounded time cadence (500ms floor / 5s keepalive),
  *   avoiding a per-token persist storm.
  *
- * After a persist, the caller must call scheduler.markUpdateSent(eventCount) so
- * the cadence resets — matching the native harness.
+ * After a persist, the caller calls `scheduler.markUpdateSent(eventCount)` so
+ * the cadence resets, and clears the builder's flag as it requests the write.
  *
  * @param nowMs Injectable clock forwarded to the scheduler, for tests.
  */
 export function shouldPersistStreamingStatus(
-  signals: ForceFlushSignals,
+  transcriptDirty: boolean,
   scheduler: StreamingUpdateScheduler,
   eventCount: number,
   nowMs?: number,
 ): boolean {
-  const forceFlush =
-    signals.deltaEnricherDirty || signals.todosDirty || signals.contentDirty;
-  return forceFlush || scheduler.shouldSendUpdate(eventCount, nowMs);
+  return transcriptDirty || scheduler.shouldSendUpdate(eventCount, nowMs);
 }

package/src/shared/prompt-sections.ts

@@ -7,7 +7,7 @@
  * (`sender-identity.ts`, `declared-preferences.ts`, `recalled-memories.ts`,
  * `session-context.ts`, `context-bridge.ts`, `attachment-vision.ts`,
  * `attachment-download-urls.ts`). What the two prompt builders duplicated
- * until S3 M5 (Q-S3-10, Q-M2b-8) was the glue around those bodies: the order
+ * until #1096 was the glue around those bodies: the order
  * the five standing sections read in, with the same doctrine comments written
  * twice; the input-files bullet and disclosure lines; which skills a prompt
  * highlights when there are many. This module is that glue, written once.
@@ -169,10 +169,10 @@ export interface InputFileLines {
 /**
  * The input-files lines over the runtime's own `ResolvedAttachment` — one
  * type, one truth (a structural twin once lived in each builder; native's
- * silently dropped the size, Cursor's was deleted at S3 M5, Q-M5-5).
+ * silently dropped the size, Cursor's was deleted in #1096).
  *
  * Each bullet discloses the size (so the agent can weigh a read — the field's
- * own stated purpose; Cursor's line gained it at S3 M5, Q-M5-3), the original
+ * own stated purpose; Cursor's line gained it in #1096), the original
  * name of a duplicate-renamed file (`attachment-naming.ts`; so the agent can
  * connect "the two report.pdfs" in the user's message to distinct files on
  * disk), and the download URL when one was minted
@@ -224,7 +224,7 @@ export interface SkillSelection {
  * named, so the agent can still activate one on its own judgement (the Agent
  * Skills spec's progressive disclosure: metadata up front, instructions on
  * demand). The native harness calls this on every turn; the Cursor harness
- * lists every skill today and its adoption is S4's (Q-M5-4).
+ * lists every skill today; adopting the selection there is an open item.
  */
 export function selectSkillsForPrompt(userMessage: string, skills: readonly SkillMetadata[]): SkillSelection {
   const filter = filterSkills(

package/src/shared/run-credential-store.ts

@@ -0,0 +1,45 @@
+/**
+ * The run credential of the activity that is running — an `AsyncLocalStorage`
+ * the activity boundary enters once and the control-plane transport reads
+ * per request.
+ *
+ * Why a store and not a parameter: the runner serves many executions in one
+ * process, and the `StigmerClient` a request goes out on is shared — one per
+ * worker for the turn activities (`harness/registry.ts`), one per call or a
+ * module singleton for the engine's activities. A credential baked into a
+ * client would be the wrong run's the moment two runs share it; a credential
+ * read from the async context of the request is always the run whose
+ * activity made the request, and a client cached across runs stays correct.
+ * `shared/execution-context.ts` is the same shape for the execution id, with
+ * a different owner (the turn runtime enters it INSIDE the turn) and a
+ * different reader (the Cursor proxy interceptors) — two facts, two stores.
+ *
+ * Exactly one writer — `interceptors/run-credential-activity.ts`, the
+ * activity inbound interceptor both worker roots register — and exactly one
+ * reader — the auth interceptor in `client/stigmer-client.ts`. Nothing else
+ * may read this: a user task's outbound HTTP (`activities/call-http.ts`) must
+ * never carry the run's credential, and the way that stays true is that no
+ * code path but the control-plane client asks for it.
+ */
+
+import { AsyncLocalStorage } from "node:async_hooks";
+
+const runCredential = new AsyncLocalStorage<string>();
+
+/** Run `fn` with `credential` as the run credential of everything it awaits. */
+export function withRunCredential<T>(
+  credential: string,
+  fn: () => Promise<T>,
+): Promise<T> {
+  return runCredential.run(credential, fn);
+}
+
+/**
+ * The run credential of the activity this request belongs to; `undefined`
+ * outside any activity (boot, renewal loops) and inside an activity whose
+ * dispatch carried none (an older server; the cloud, whose runner credential
+ * is provisioned, not dispatched).
+ */
+export function currentRunCredential(): string | undefined {
+  return runCredential.getStore();
+}

package/src/shared/run-credential.ts

@@ -0,0 +1,70 @@
+/**
+ * The run credential's wire vocabulary — the two places a dispatch can carry
+ * it, and the one reader of both.
+ *
+ * A run credential is the token the control plane mints for ONE execution at
+ * dispatch (`execution_context_token` on the workflow input, 2026-09-16) so
+ * that the runner — one long-lived process keyed with one operator's API key,
+ * serving every member's runs — can act as the run's own human on that run's
+ * RPCs. Under a server with sign-in on, the credential's bearer IS the run's
+ * person for as long as the run lives; on an older server no credential
+ * arrives and the runner behaves exactly as before. The runner never decodes
+ * or judges the credential: it presents, the server judges
+ * (`client/token-claims.ts`).
+ *
+ * Two hops carry it, one channel each:
+ *
+ *   - The SERVER's dispatches — the Execute* turn activities and
+ *     GenerateSessionSubject — carry it on the activity INPUT under
+ *     {@link RUN_CREDENTIAL_INPUT_KEY}, the same key the workflow inputs use
+ *     (a cross-component wire contract; the server's
+ *     temporal/agentexecution/workflows/invoke-agent-execution.ts builds it).
+ *   - The RUNNER's own dispatches — every activity the serverless-workflow
+ *     engine schedules from `workflows/execute-from-execution.ts` — carry it
+ *     as a Temporal activity HEADER, {@link RUN_CREDENTIAL_HEADER}, stamped by
+ *     the workflow interceptor in `workflows/interceptors/run-credential.ts`.
+ *     Headers, not arguments: the engine hands `execution_id` to ten local
+ *     activities positionally, and a credential threaded the same way is a
+ *     field every future activity has to remember. A header reaches all of
+ *     them, and the next one, with no signature learning the word.
+ *
+ * One reader for both: `interceptors/run-credential-activity.ts` enters the
+ * store (`run-credential-store.ts`) at the activity boundary, and
+ * `client/stigmer-client.ts` reads it per request. No activity body touches
+ * a credential.
+ *
+ * ISOLATE-SAFE BY CONTRACT: this module is imported by workflow code that
+ * runs inside Temporal's deterministic V8 sandbox. It must import nothing
+ * from Node and hold no mutable state; the store lives in its own module for
+ * exactly that reason.
+ */
+
+/**
+ * The snake_case key under which a dispatch's input object carries the run
+ * credential. Byte-pinned: the same name on both invoke workflow inputs, on
+ * `ExecuteActivityInput`, on `GenerateSessionSubjectInput` and on the connect
+ * lane's input (where it names a DIFFERENT, clocked token that this reader
+ * never sees — that lane hands its token per call).
+ */
+export const RUN_CREDENTIAL_INPUT_KEY = "execution_context_token" as const;
+
+/**
+ * The Temporal activity header the runner's own workflow stamps on every
+ * activity it schedules for a run. Byte-pinned wire vocabulary: a rename
+ * strands every in-flight run's activities on the process credential.
+ */
+export const RUN_CREDENTIAL_HEADER = "stigmer-run-credential" as const;
+
+/**
+ * The run credential an activity input carries, or `undefined` when the
+ * argument is not an object carrying a non-empty string under the key —
+ * positional string arguments, the connect lane's camelCase input, and an
+ * older server's credential-less object all answer `undefined`.
+ */
+export function readRunCredentialFromInput(arg: unknown): string | undefined {
+  if (arg === null || typeof arg !== "object") {
+    return undefined;
+  }
+  const value = (arg as Record<string, unknown>)[RUN_CREDENTIAL_INPUT_KEY];
+  return typeof value === "string" && value !== "" ? value : undefined;
+}

package/src/shared/skill-resolver.ts

@@ -12,9 +12,9 @@
  * the control plane, which only the runtime holds, and writes under the
  * platform dir the runtime owns; the harness renders the returned metadata
  * into its prompt in its own placement. Moved from
- * `activities/execute-cursor/` at S2 M3b; the native harness's twin
- * (`skill-writer.ts` `fetchSkillsByRefs` + `mountSkills`) retired at S3 M2b,
- * and the module itself at S3 M5 — the one renderer it kept is
+ * `activities/execute-cursor/` in #1070; the native harness's twin
+ * (`skill-writer.ts` `fetchSkillsByRefs` + `mountSkills`) retired in #1096,
+ * and the module itself with it — the one renderer it kept is
  * `shared/prompt-sections.ts` `alsoAvailableSkillsNote`. This is the one
  * skills path for every harness.
  *

package/src/shared/status-offload.ts

@@ -20,7 +20,7 @@
  *      Images are uploaded as their decoded bytes (so the UI can render an
  *      <img>); other large output is uploaded as text with a preview head.
  *      Idempotent and content-hash-deduped so the throttled, repeated persists
- *      (and result re-inflation by mergeToolCallEvent) upload each blob once.
+ *      (and result re-inflation by the builder's `tool_finished` upsert) upload each blob once.
  *
  *   2. offloadCandidateChangesToFit — an aggregate, storage-backed step for the
  *      file-review ledger: if the status still exceeds the soft cap after (1),
@@ -344,7 +344,7 @@ async function maybeOffloadToolCall(
   const hash = sha256(result);
 
   // Idempotent: the same content was already offloaded on a prior persist (or
-  // mergeToolCallEvent re-inflated `result` with identical bytes). Re-collapse
+  // the builder's finish upsert re-inflated `result` with identical bytes). Re-collapse
   // the inline copy without re-uploading.
   if (tc.outputRef && tc.outputRef.contentHash === hash) {
     tc.result = collapsedResultFor(tc.outputRef);

package/src/shared/streaming-scheduler.ts

@@ -19,13 +19,8 @@
  * the live stream cadence is identical across harnesses.
  */
 
-export enum UpdateReason {
-  TIME_THRESHOLD = "time_threshold",
-  BURST_PROTECTION = "burst_protection",
-  KEEPALIVE = "keepalive",
-  FIRST_UPDATE = "first_update",
-  NONE = "none",
-}
+/** Why the scheduler last said "send": the cadence rule that fired, or `none`. */
+export type UpdateReason = "time_threshold" | "burst_protection" | "keepalive" | "first_update" | "none";
 
 export interface StreamingConfig {
   /** Minimum time between updates (ms). Rate limit: max ~2 updates/second. */
@@ -95,7 +90,7 @@ export class StreamingUpdateScheduler {
 
   private lastUpdateTime: number;
   private lastUpdateEvents = 0;
-  private lastReason: UpdateReason = UpdateReason.NONE;
+  private lastReason: UpdateReason = "none";
   private firstCheck = true;
 
   /**
@@ -119,26 +114,26 @@ export class StreamingUpdateScheduler {
     const eventsSinceLast = eventsProcessed - this.lastUpdateEvents;
 
     if (this.firstCheck && eventsSinceLast >= 1) {
-      this.lastReason = UpdateReason.FIRST_UPDATE;
+      this.lastReason = "first_update";
       return true;
     }
 
     if (timeSinceLastMs >= this.config.minIntervalMs && eventsSinceLast >= 1) {
-      this.lastReason = UpdateReason.TIME_THRESHOLD;
+      this.lastReason = "time_threshold";
       return true;
     }
 
     if (eventsSinceLast >= this.config.burstThreshold) {
-      this.lastReason = UpdateReason.BURST_PROTECTION;
+      this.lastReason = "burst_protection";
       return true;
     }
 
     if (timeSinceLastMs >= this.config.maxIntervalMs) {
-      this.lastReason = UpdateReason.KEEPALIVE;
+      this.lastReason = "keepalive";
       return true;
     }
 
-    this.lastReason = UpdateReason.NONE;
+    this.lastReason = "none";
     return false;
   }
 

package/src/shared/subagent-rows.ts

@@ -7,9 +7,9 @@
  * infrastructure cancel), so the final snapshot has no permanent IN_PROGRESS
  * "zombie" delegation. Harness-agnostic (a `SubAgentExecution` is the
  * platform's row, not an engine's), read by the turn runtime's terminal
- * table and the Cursor accumulator's own finalize alike.
+ * table and the Cursor settle alike.
  *
- * Moved from `activities/execute-cursor/message-translator.ts` at S2 M3 so
+ * Moved from `activities/execute-cursor/message-translator.ts` in #1070 so
  * the runtime's catch can reach it; the body is unchanged.
  */