@stigmer/runner 3.9.0 → 3.11.0

package/src/shared/model-error.ts

@@ -26,6 +26,14 @@
  */
 
 import type { LlmProvider } from "./llm-proxy.js";
+import {
+  parseAnthropicBackend,
+  BACKEND_DOC_URL,
+  BEDROCK_INFERENCE_PREFIX_ENV,
+  FOUNDRY_DEPLOYMENT_MAP_ENV,
+  FOUNDRY_RESOURCE_ENV,
+  type AnthropicBackend,
+} from "./llm-backend.js";
 
 /**
  * Machine-readable code the cloud proxy embeds in rewritten platform-fault
@@ -96,6 +104,7 @@ export function classifyModelCallError(
 ): ClassifiedModelError | undefined {
   const root = unwrapModelError(err);
   const message = root instanceof Error ? root.message : String(root);
+  const backend = resolveDirectBackend(ctx);
 
   // 1. Platform sentinel — before status mapping (see module doc).
   if (message.includes(PLATFORM_CAPACITY_SENTINEL)) {
@@ -106,6 +115,69 @@ export function classifyModelCallError(
     };
   }
 
+  // 1b. Backend credential acquisition — also before status mapping: these
+  //     failures come from the auth library (thrown while adapting the
+  //     request, usually with no HTTP status) and won't self-heal on retry.
+  //     Raw, they read like library internals ("Could not load the default
+  //     credentials"); the operator needs to hear "fix your cloud
+  //     credentials".
+  if (backend === "vertex" && isGoogleCredentialMessage(message)) {
+    return {
+      code: "LLM_BACKEND_CREDENTIALS",
+      retryable: false,
+      message:
+        `The vertex backend could not acquire Google credentials for ${modelLabel(ctx)}. ` +
+        `Set GOOGLE_APPLICATION_CREDENTIALS to a service-account key, or run on a GCP ` +
+        `identity (workload identity / metadata server). ANTHROPIC_VERTEX_PROJECT_ID is ` +
+        `only needed when the credentials don't carry a project. See ${BACKEND_DOC_URL}. ` +
+        `Underlying error: ${message}`,
+    };
+  }
+  if (backend === "bedrock" && isAwsCredentialMessage(message)) {
+    return {
+      code: "LLM_BACKEND_CREDENTIALS",
+      retryable: false,
+      message:
+        `The bedrock backend could not acquire AWS credentials for ${modelLabel(ctx)}. ` +
+        `Provide credentials through the standard AWS chain (environment keys, an IAM ` +
+        `role / IRSA, config files) or set AWS_BEARER_TOKEN_BEDROCK. See ${BACKEND_DOC_URL}. ` +
+        `Underlying error: ${message}`,
+    };
+  }
+  if (backend === "foundry" && isFoundryCredentialMessage(message)) {
+    // Only the keyless Entra path can land here: API-key failures arrive
+    // as HTTP 401s (status arm below), while a failing token provider
+    // throws statusless from inside the Foundry SDK's authHeaders.
+    return {
+      code: "LLM_BACKEND_CREDENTIALS",
+      retryable: false,
+      message:
+        `The foundry backend could not acquire a Microsoft Entra ID token for ${modelLabel(ctx)}. ` +
+        `Give the runner an Azure identity the credential chain can resolve (workload ` +
+        `identity / managed identity, service-principal env vars, or az login), or set ` +
+        `ANTHROPIC_FOUNDRY_API_KEY to use API-key auth instead. See ${BACKEND_DOC_URL}. ` +
+        `Underlying error: ${message}`,
+    };
+  }
+
+  // 1c. Bedrock's inference-profile rejection — a config condition, not a
+  //     bad request: newer Claude models cannot be invoked by bare model id
+  //     (AWS lists their in-region endpoint as N/A). The operator remedy is
+  //     one env var, so say exactly that instead of relaying AWS prose that
+  //     talks about ARNs and provisioned throughput.
+  if (backend === "bedrock" && isBedrockInferenceProfileMessage(message)) {
+    return {
+      code: "LLM_BACKEND_MODEL_ROUTING",
+      retryable: false,
+      message:
+        `Bedrock requires an inference profile for ${modelLabel(ctx)} — the bare model ` +
+        `id cannot be invoked on-demand. Set ${BEDROCK_INFERENCE_PREFIX_ENV} to your ` +
+        `deployment's geography (e.g. "us", "eu", or "global"), or map this model ` +
+        `explicitly in STIGMER_BEDROCK_MODEL_MAP. See ${BACKEND_DOC_URL}. ` +
+        `Underlying error: ${message}`,
+    };
+  }
+
   // 2. Provider billing prose. In direct mode this is the user's own
   //    account and the fix is theirs. In proxy mode these patterns should
   //    never appear (the proxy rewrites them), but a version-skewed proxy
@@ -135,7 +207,7 @@ export function classifyModelCallError(
     ? (root as { status: number }).status
     : undefined;
   if (status !== undefined) {
-    return classifyByStatus(status, message, ctx);
+    return classifyByStatus(status, message, ctx, backend);
   }
 
   // 4. Connection/timeout heuristics on the root error's class name. Strict
@@ -175,6 +247,7 @@ function classifyByStatus(
   status: number,
   rawMessage: string,
   ctx: ModelErrorContext,
+  backend: AnthropicBackend,
 ): ClassifiedModelError {
   const context = modelLabel(ctx);
 
@@ -186,7 +259,23 @@ function classifyByStatus(
         message: ctx.proxyMode
           ? `The Stigmer platform rejected this model call (authentication, HTTP 401) for ${context}. ` +
             `Your session token may have expired — retry the execution, and contact support if it persists.`
-          : `Authentication failed for ${context}. Check that your API key is valid and not expired.`,
+          // On a cloud backend the credential is a cloud identity — "check
+          // your API key" would send the operator hunting for a key that
+          // isn't in play.
+          : backend === "vertex"
+            ? `Google rejected this Vertex AI call (authentication, HTTP 401) for ${context}. ` +
+              `The credentials are expired or not valid for this project — check ` +
+              `GOOGLE_APPLICATION_CREDENTIALS or the runner's GCP identity. See ${BACKEND_DOC_URL}.`
+          : backend === "bedrock"
+            ? `AWS rejected this Bedrock call (authentication, HTTP 401) for ${context}. ` +
+              `The credentials are expired or invalid — check the runner's AWS identity ` +
+              `(environment keys, IAM role / IRSA) or AWS_BEARER_TOKEN_BEDROCK. See ${BACKEND_DOC_URL}.`
+          : backend === "foundry"
+            ? `Azure rejected this Microsoft Foundry call (authentication, HTTP 401) for ${context}. ` +
+              `The credential is expired or not valid for this Foundry resource — check ` +
+              `ANTHROPIC_FOUNDRY_API_KEY (find it on the deployment's Details tab) or the ` +
+              `runner's Azure identity. See ${BACKEND_DOC_URL}.`
+            : `Authentication failed for ${context}. Check that your API key is valid and not expired.`,
       };
     case 403:
       return {
@@ -195,13 +284,50 @@ function classifyByStatus(
         message: ctx.proxyMode
           ? `The Stigmer platform denied this model call (authorization, HTTP 403) for ${context}. ` +
             `Verify this execution is permitted to use the model, and contact support if it persists.`
-          : `Access denied for ${context}. Verify that your API key has permission to use this model.`,
+          : backend === "vertex"
+            ? `Vertex AI denied this call (HTTP 403) for ${context}. Grant the runner's ` +
+              `service account the "Vertex AI User" role (aiplatform.endpoints.predict) ` +
+              `in the target project. See ${BACKEND_DOC_URL}.`
+          : backend === "bedrock"
+            // The most common Bedrock setup mistake: Anthropic models must
+            // be enabled per account ("Model access" in the Bedrock console,
+            // including the use-case submission), on top of IAM.
+            ? `Bedrock denied this call (HTTP 403) for ${context}. Enable this Claude model ` +
+              `under "Model access" in the Bedrock console (Anthropic models require a ` +
+              `use-case submission), and grant the runner's identity bedrock:InvokeModel ` +
+              `for the model and its inference profile. See ${BACKEND_DOC_URL}.`
+          : backend === "foundry"
+            ? `Microsoft Foundry denied this call (HTTP 403) for ${context}. Grant the ` +
+              `runner's Azure identity the "Foundry User" (or "Cognitive Services User") ` +
+              `RBAC role on the Foundry resource. See ${BACKEND_DOC_URL}.`
+            : `Access denied for ${context}. Verify that your API key has permission to use this model.`,
       };
     case 404:
       return {
         code: "LLM_MODEL_NOT_FOUND",
         retryable: false,
-        message: `Model not found: ${context}. Verify the model name is correct and available in your account.`,
+        // The most common Vertex setup mistake: Claude models must be enabled
+        // per project in Model Garden, and availability varies by region.
+        message: backend === "vertex"
+          ? `Model not found on Vertex AI: ${context}. Enable this Claude model for your ` +
+            `project in the Vertex AI Model Garden, and confirm it is available in ` +
+            `${describeVertexRegion()} — availability varies by region. See ${BACKEND_DOC_URL}.`
+          : backend === "bedrock"
+            ? `Model not found on Bedrock: ${context}. Confirm the model is available in ` +
+              `${describeBedrockRegion()} — availability varies by region — and that the ` +
+              `resolved Bedrock id is right for your deployment (STIGMER_BEDROCK_MODEL_MAP ` +
+              `overrides, ${BEDROCK_INFERENCE_PREFIX_ENV} for inference profiles). See ${BACKEND_DOC_URL}.`
+          : backend === "foundry"
+            // The most common Foundry setup mistake: Foundry routes by
+            // DEPLOYMENT NAME, and deployments are created one by one in
+            // the portal — a model with no deployment (or a custom name)
+            // 404s even though the model itself exists on Foundry.
+            ? `Model deployment not found on Microsoft Foundry: ${context}. Foundry routes ` +
+              `by deployment name — confirm a deployment for this model exists in ` +
+              `${describeFoundryResource()} (default deployment names are the dateless ` +
+              `model ids), or map it to your custom deployment name in ` +
+              `${FOUNDRY_DEPLOYMENT_MAP_ENV}. See ${BACKEND_DOC_URL}.`
+            : `Model not found: ${context}. Verify the model name is correct and available in your account.`,
       };
     case 400:
       return {
@@ -260,6 +386,98 @@ export function describeExecutionError(
   };
 }
 
+/**
+ * The backend serving this direct-mode Anthropic call — the only condition
+ * under which a backend's specific arms may speak. Proxied calls and other
+ * providers read as "public" (no backend wording applies). The backend is
+ * resolved from env here (deployment-static, like the API keys
+ * model-client reads) rather than threaded through every activity's
+ * ModelErrorContext; an invalid var value also reads as public, since
+ * classification must never throw and invalid values are already fatal at
+ * the factories' preflight and at model construction.
+ */
+function resolveDirectBackend(ctx: ModelErrorContext): AnthropicBackend {
+  if (ctx.proxyMode || ctx.provider !== "anthropic") return "public";
+  const parsed = parseAnthropicBackend();
+  return parsed.ok ? parsed.backend : "public";
+}
+
+/**
+ * Google credential-acquisition prose, matched against the raw message.
+ * Narrow by design (mirrors isProviderBillingMessage): pinned to
+ * google-auth-library's ADC failure, its project-detection failure, the
+ * Vertex SDK's own projectId error, and OAuth's invalid_grant (expired or
+ * revoked service-account key). A miss falls through to status
+ * classification — never worse than the raw error.
+ */
+function isGoogleCredentialMessage(message: string): boolean {
+  const lower = message.toLowerCase();
+  return (
+    lower.includes("could not load the default credentials")
+    || lower.includes("unable to detect a project id")
+    || lower.includes("no projectid was given")
+    || lower.includes("invalid_grant")
+  );
+}
+
+/**
+ * AWS credential-acquisition prose, matched against the raw message.
+ * Narrow by design (mirrors isGoogleCredentialMessage): pinned to the AWS
+ * credential provider chain's terminal failure
+ * (@aws-sdk/credential-providers' CredentialsProviderError wordings) and
+ * the SigV4 signer's invalid-shape error. A miss falls through to status
+ * classification — never worse than the raw error.
+ */
+function isAwsCredentialMessage(message: string): boolean {
+  const lower = message.toLowerCase();
+  return (
+    lower.includes("could not load credentials from any providers")
+    || lower.includes("credential is missing")
+    || lower.includes("resolved credential object is not valid")
+  );
+}
+
+/**
+ * Bedrock's bare-model-id rejection prose (HTTP 400 ValidationException):
+ * "Invocation of model ID … with on-demand throughput isn't supported.
+ * Retry your request with the ID or ARN of an inference profile …".
+ * Matched narrowly on the phrase that only this condition carries.
+ */
+function isBedrockInferenceProfileMessage(message: string): boolean {
+  return message.toLowerCase().includes("on-demand throughput isn't supported");
+}
+
+/**
+ * Entra ID token-acquisition prose, matched against the raw message.
+ * Narrow by design (mirrors the Google/AWS matchers), and narrower than it
+ * looks: the Foundry SDK wraps EVERY token-provider failure — whatever
+ * @azure/identity's credential chain threw — in this one prefix before
+ * rethrowing (pinned by foundry-seam.test.ts), so a single phrase covers
+ * the whole family. A miss falls through to status classification — never
+ * worse than the raw error.
+ */
+function isFoundryCredentialMessage(message: string): boolean {
+  return message.toLowerCase().includes("failed to get token from azureadtokenprovider");
+}
+
+/** "region {value}" when CLOUD_ML_REGION is set, else a pointer to the var. */
+function describeVertexRegion(): string {
+  const region = process.env.CLOUD_ML_REGION?.trim();
+  return region ? `region "${region}"` : "your CLOUD_ML_REGION";
+}
+
+/** "region {value}" when AWS_REGION is set, else a pointer to the var. */
+function describeBedrockRegion(): string {
+  const region = process.env.AWS_REGION?.trim();
+  return region ? `region "${region}"` : "your AWS_REGION";
+}
+
+/** `resource "{value}"` when the resource var is set, else a generic label. */
+function describeFoundryResource(): string {
+  const resource = process.env[FOUNDRY_RESOURCE_ENV]?.trim();
+  return resource ? `resource "${resource}"` : "your Foundry resource";
+}
+
 /**
  * Provider billing-exhaustion prose, matched against the raw message. Narrow
  * by design: these phrases are pinned to real provider wordings (Anthropic's

package/src/shared/model-registry.ts

@@ -1,10 +1,13 @@
 /**
- * Model registry — provider lookup and economy-tier model derivation.
+ * Model registry — provider lookup, economy-tier model derivation, and
+ * model capability resolution.
  *
  * Fetches the model registry from the runner's control plane (see
  * registry-endpoint.ts for endpoint resolution — same endpoint as
  * model-pricing-data.ts) and uses `costTier` + `harness` fields to
- * dynamically resolve economy-tier models for extraction/summarization.
+ * dynamically resolve economy-tier models for extraction/summarization,
+ * plus `capabilities` catalog metadata for per-model capability lookups
+ * (getModelVisionCapability).
  */
 
 import { resolveModelRegistryUrl, buildRegistryHeaders } from "./registry-endpoint.js";
@@ -22,6 +25,14 @@ interface RegistryModel {
   costTier: string;
   harness: string;
   featured: boolean;
+  /**
+   * Tri-state vision capability from the registry's `capabilities` block.
+   * The registry serializes `capabilities` only for models whose capabilities
+   * have actually been assessed, so `undefined` means "never assessed" —
+   * deliberately distinct from an explicit `false` ("assessed as blind").
+   * Consumers gate only on the explicit `false` (see attachment-vision.ts).
+   */
+  visionCapability?: boolean;
 }
 
 let cache: { models: readonly RegistryModel[]; expiresAt: number } | null = null;
@@ -41,9 +52,20 @@ function parseRegistry(json: unknown): RegistryModel[] {
       costTier: (m.costTier as string) ?? "standard",
       harness: (m.harness as string) ?? "native",
       featured: !!m.featured,
+      visionCapability: parseVisionCapability(m.capabilities),
     }));
 }
 
+/**
+ * Extract `capabilities.vision` preserving the tri-state: a missing or
+ * malformed `capabilities` block stays `undefined` (never coerced to false).
+ */
+function parseVisionCapability(capabilities: unknown): boolean | undefined {
+  if (!capabilities || typeof capabilities !== "object") return undefined;
+  const vision = (capabilities as Record<string, unknown>).vision;
+  return typeof vision === "boolean" ? vision : undefined;
+}
+
 async function fetchRegistry(): Promise<readonly RegistryModel[]> {
   const url = resolveModelRegistryUrl();
   const res = await fetch(url, { headers: buildRegistryHeaders() });
@@ -211,6 +233,32 @@ export async function resolveToApiModelId(registryId: string): Promise<string> {
   return entry.apiModelId ?? registryId;
 }
 
+/**
+ * Look up a model's vision capability from the registry's `capabilities`
+ * catalog metadata. Returns the tri-state the vision policy expects
+ * (attachment-vision.ts): `false` only when the registry explicitly says the
+ * model cannot see images; `undefined` whenever the answer is unknown —
+ * capability never assessed, model not in the registry, registry
+ * unreachable, or no concrete model name (the Cursor harness's ""/"default"
+ * Auto pool). Callers gate on the explicit `false` only, so every unknown
+ * degrades to today's behavior instead of blocking images.
+ *
+ * Matches by registry `id` OR `apiModelId`: getDefaultModel() hands the
+ * deep-agent harness the provider API id, while executionConfig.modelName
+ * carries the registry id, so both forms arrive here.
+ */
+export async function getModelVisionCapability(
+  modelName: string,
+): Promise<boolean | undefined> {
+  if (!modelName || modelName === "default") return undefined;
+
+  const registry = await getRegistry();
+  const entry = registry.find(
+    (m) => m.id === modelName || m.apiModelId === modelName,
+  );
+  return entry?.visionCapability;
+}
+
 /** Exposed for testing — resets the in-memory cache. */
 export function _resetRegistryCache(): void {
   cache = null;

package/src/shared/plan-mode-permissions.ts

@@ -0,0 +1,30 @@
+/**
+ * The Plan-mode filesystem permission rules — the enforcement twin of
+ * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
+ *
+ * Plan mode is read-only BY CONSTRUCTION on the native harness: these rules
+ * deny every filesystem write operation at the tool level so
+ * write_file/edit_file cannot mutate the workspace regardless of what the
+ * model was told. Rules are first-match-wins with a permissive default, so a
+ * single deny-all-writes rule is sufficient. (The Cursor harness has no
+ * tool-level lever and enforces plan mode via its prompt prefix instead.)
+ *
+ * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
+ * into every compiled sub-agent graph: deepagents' parent-permission
+ * inheritance covers only spec-style sub-agents, and ours are pre-built
+ * CompiledSubAgents, so each sub-agent graph must carry the rules itself
+ * (issue #255). Kept as its own side-effect-free module so tests can pin the
+ * production rules without dragging in setup.ts's import graph.
+ *
+ * Invariant: never combine these rules with a shell-capable (sandbox)
+ * backend — deepagents rejects that pairing at graph construction (see the
+ * cas-capture-backend.ts header). Plan mode guarantees it by construction:
+ * it is the mode that clears `shellEnv`, and `shellEnv` is the single switch
+ * for shell capability on both the parent and sub-agent backends.
+ */
+
+import type { FilesystemPermission } from "deepagents";
+
+export const PLAN_MODE_PERMISSIONS: FilesystemPermission[] = [
+  { operations: ["write"], paths: ["/**"], mode: "deny" },
+];

package/src/worker.ts

@@ -27,11 +27,12 @@ export interface WorkerActivities {
 export interface StartWorkerOptions {
   config: Config;
   activities: WorkerActivities;
-  payloadCodec?: PayloadCodec;
+  /** Ordered codec chain from createPayloadCodecs (order is load-bearing). */
+  payloadCodecs?: PayloadCodec[];
 }
 
 export async function startWorker(opts: StartWorkerOptions): Promise<Worker> {
-  const { config, activities, payloadCodec } = opts;
+  const { config, activities, payloadCodecs } = opts;
 
   const connection = await NativeConnection.connect({
     address: config.temporalAddress,
@@ -89,9 +90,7 @@ export async function startWorker(opts: StartWorkerOptions): Promise<Worker> {
       ? { workflowBundle: { codePath: workflowSource.codePath } }
       : { workflowsPath: workflowSource.workflowsPath }),
     maxConcurrentActivityTaskExecutions: config.maxConcurrentActivities,
-    dataConverter: payloadCodec
-      ? { payloadCodecs: [payloadCodec] }
-      : undefined,
+    dataConverter: payloadCodecs?.length ? { payloadCodecs } : undefined,
     sinks,
     interceptors: {
       ...(activityInterceptors.length > 0 ? { activity: activityInterceptors } : {}),

package/src/workflow-engine/types.ts

@@ -800,6 +800,24 @@ export type WorkflowEventDescriptor =
 interface EventBase {
   readonly taskName?: string;
   readonly occurredAt: string;
+  /**
+   * Workflow-assigned event sequence number, stamped at the emit funnels
+   * (engine-core's emitEvents and the agent-call orchestrator's
+   * emitProgress) from the workflow-owned monotonic counter. Assigning
+   * inside the deterministic sandbox makes the number stable across
+   * activity retries and worker restarts, so persistence is idempotent
+   * (the store skips already-persisted sequences).
+   *
+   * A plain `number`, not `bigint`: descriptors cross the
+   * workflow→activity boundary through Temporal's JSON payload converter,
+   * which cannot serialize BigInt. The emit activity converts to the
+   * proto's uint64.
+   *
+   * Absent only when replaying histories recorded before the
+   * "workflow-assigned-event-sequences" patch — the emit activity then
+   * falls back to its legacy process-global counter.
+   */
+  readonly sequenceNumber?: number;
 }
 
 export interface ExecutionStartedEvent extends EventBase {

package/src/workflows/__tests__/execute-serverless-workflow.test.ts

@@ -4,6 +4,8 @@ import type { WorkflowModel } from "../../workflow-engine/types.js";
 import type { ExecuteServerlessWorkflowInput } from "../execute-serverless-workflow.js";
 
 const mockEvaluateExpressions = vi.fn();
+const mockResetEventSequence = vi.fn();
+const mockEmitWorkflowEvents = vi.fn();
 
 vi.mock("@temporalio/workflow", () => ({
   proxyLocalActivities: vi.fn(() => ({
@@ -12,8 +14,9 @@ vi.mock("@temporalio/workflow", () => ({
       input: unknown,
       stateVars: Record<string, unknown>,
     ) => mockEvaluateExpressions(exprs, input, stateVars),
-    ResetEventSequence: vi.fn(),
-    EmitWorkflowEvents: vi.fn(),
+    ResetEventSequence: (executionId: string) => mockResetEventSequence(executionId),
+    EmitWorkflowEvents: (executionId: string, events: unknown[], taskStatuses: unknown[]) =>
+      mockEmitWorkflowEvents(executionId, events, taskStatuses),
   })),
   proxyActivities: vi.fn(() => ({
     CallHttp: vi.fn(),
@@ -246,6 +249,69 @@ describe("executeServerlessWorkflow", () => {
     });
   });
 
+  describe("workflow-assigned event sequences", () => {
+    interface StampedEvent {
+      type: string;
+      sequenceNumber?: number;
+    }
+
+    function emittedEvents(): StampedEvent[] {
+      return mockEmitWorkflowEvents.mock.calls.flatMap(call => call[1] as StampedEvent[]);
+    }
+
+    const model: WorkflowModel = {
+      document: { dsl: "1.0.0", name: "test-sequences" },
+      do: [
+        { key: "step1", task: { kind: "set", set: { a: 1 } } },
+        { key: "step2", task: { kind: "set", set: { b: 2 } } },
+      ],
+    };
+
+    it("stamps a strictly monotonic sequence continuing from the high-water mark", async () => {
+      mockResetEventSequence.mockResolvedValue(10);
+
+      await runWorkflow({
+        model,
+        workflow_input: null,
+        env: {},
+        metadata: { execution_id: "wfx-seq-1" },
+      });
+
+      const events = emittedEvents();
+      expect(events.length).toBeGreaterThan(0);
+      // execution_started, task events, execution_completed — all from one
+      // counter, gapless, continuing after the persisted high-water mark.
+      const sequences = events.map(e => e.sequenceNumber);
+      const expected = Array.from({ length: events.length }, (_, i) => 11 + i);
+      expect(sequences).toEqual(expected);
+    });
+
+    it("starts at 1 for a fresh execution (high-water mark 0)", async () => {
+      mockResetEventSequence.mockResolvedValue(0);
+
+      await runWorkflow({
+        model,
+        workflow_input: null,
+        env: {},
+        metadata: { execution_id: "wfx-seq-2" },
+      });
+
+      expect(emittedEvents()[0]?.sequenceNumber).toBe(1);
+    });
+
+    it("emits no events without an execution_id (direct invocation, child workflows)", async () => {
+      mockResetEventSequence.mockResolvedValue(0);
+
+      await runWorkflow({
+        model,
+        workflow_input: null,
+        env: {},
+      });
+
+      expect(mockEmitWorkflowEvents).not.toHaveBeenCalled();
+    });
+  });
+
   describe("switch with flow directives", () => {
     it("handles switch-driven branching through the workflow", async () => {
       const model: WorkflowModel = {

package/src/workflows/call-agent-orchestrator.ts

@@ -94,6 +94,15 @@ export interface AgentCallOrchestrationInput {
   parentWorkflowId: string;
   taskName: string;
   workflowExecutionId: string;
+  /**
+   * Allocator for the workflow-owned event sequence counter, shared with
+   * engine-core's emit funnel so progress events and task events draw
+   * from one monotonic series. Safe to pass as a closure — the
+   * orchestrator is a plain function call inside the same workflow run,
+   * not a child workflow. Undefined when replaying pre-patch histories
+   * (the emit activity then assigns from its legacy counter).
+   */
+  nextEventSequence?: () => number;
 }
 
 /**
@@ -318,6 +327,7 @@ async function emitProgress(
       type: "agent_call_progress",
       taskName: input.taskName,
       occurredAt: new Date().toISOString(),
+      sequenceNumber: input.nextEventSequence?.(),
       childExecutionId: childExecId,
       agentSlug: input.config.agent ?? "",
       agentPhase: progress?.agentPhase ?? 0,

package/src/workflows/connect-mcp-server.ts

@@ -41,6 +41,13 @@ import type {
 type DiscoverActivities = ReturnType<typeof createDiscoverMcpServerActivities>;
 type ClassifyActivities = ReturnType<typeof createClassifyToolApprovalsActivities>;
 
+// Discovery's bounds ladder (issue #239): the activity heartbeats every 15s,
+// so heartbeatTimeout is pure LIVENESS (dead worker/pod detection) — it no
+// longer kills slow-but-alive discoveries. The activity bounds its own WORK
+// with a transport-aware init timeout (30s HTTP / 270s stdio) that fails with
+// an actionable, endpoint-naming error; startToCloseTimeout is the hard cap
+// above both. Keep the ordering: work bound < hard cap, heartbeat interval
+// (15s) < heartbeatTimeout.
 const discover = proxyActivities<DiscoverActivities>({
   startToCloseTimeout: "600s",
   heartbeatTimeout: "60s",

package/src/workflows/engine-core.ts

@@ -145,7 +145,21 @@ export async function runWorkflowEngine(
 
   recordExecutionStartMetric(model.document.name);
 
-  await eventProxy.ResetEventSequence(executionId);
+  // Event sequence numbers are workflow state: assigned here in the
+  // deterministic sandbox (seeded from the persisted high-water mark) so
+  // they are stable across activity retries, worker restarts, and
+  // concurrent executions — the store can then treat re-sent sequences as
+  // idempotent duplicates. Pre-patch histories recorded the activity
+  // result as void and assigned sequences inside the emit activity from a
+  // process-global counter; they must keep doing so on replay, hence the
+  // gate. Remove the gate (and the activity's legacy counter) once
+  // pre-patch executions have drained.
+  const workflowAssignedSequences = patched("workflow-assigned-event-sequences");
+  const eventLogHighWaterMark = await eventProxy.ResetEventSequence(executionId);
+  let eventSequence = workflowAssignedSequences ? Number(eventLogHighWaterMark ?? 0) : 0;
+  const nextEventSequence = workflowAssignedSequences
+    ? () => ++eventSequence
+    : undefined;
 
   let recoveryContext: RecoveryContext | undefined;
   if (options?.recoveryMode && executionId) {
@@ -170,9 +184,15 @@ export async function runWorkflowEngine(
 
   const emitEvents = async (events: WorkflowEventDescriptor[]): Promise<void> => {
     if (!executionId || events.length === 0) return;
+    const stamped = nextEventSequence
+      ? events.map(e => ({ ...e, sequenceNumber: nextEventSequence() }))
+      : events;
     try {
-      await eventProxy.EmitWorkflowEvents(executionId, events, taskStatusAccumulator.toArray());
+      await eventProxy.EmitWorkflowEvents(executionId, stamped, taskStatusAccumulator.toArray());
     } catch (err) {
+      // Final guard after the activity's retries are exhausted: a run must
+      // not die because its timeline write failed. With workflow-assigned
+      // sequences the result is a gap in the log, never a poisoned log.
       log.warn("Failed to emit workflow events (non-fatal)", {
         executionId,
         eventCount: events.length,
@@ -246,6 +266,7 @@ export async function runWorkflowEngine(
         parentWorkflowId: agentMeta.parentWorkflowId || workflowInfo().workflowId,
         taskName: agentMeta.taskName,
         workflowExecutionId: agentMeta.workflowExecutionId || executionId,
+        nextEventSequence,
       }),
     promoteTaskOutput: (taskOutput: unknown, wexId: string, taskName: string, displayName?: string) =>
       promoteProxy.PromoteTaskOutput(taskOutput, wexId || executionId, taskName, displayName),

package/src/workflows/execute-from-execution.ts

@@ -63,7 +63,7 @@ export interface ExecuteFromExecutionInput {
 
 export async function executeFromExecution(
   input: ExecuteFromExecutionInput,
-): Promise<unknown> {
+): Promise<void> {
   const { checkPause } = setupPauseResumeHandlers();
 
   log.info("Hydrating workflow execution from slim IDs", {
@@ -86,7 +86,17 @@ export async function executeFromExecution(
   });
 
   try {
-    return await runWorkflowEngine(materialized, {
+    // The engine's output is deliberately NOT returned. Both orchestrator
+    // parents discard this workflow's result (Java awaits it as Void, Go
+    // passes nil to Get), and the output already reaches users through
+    // PromoteTaskOutput and the event log. Returning it would (a) persist
+    // the full workflow output — which may embed secrets — as a plaintext
+    // payload in the cross-language parent's history, and (b) hand the Java
+    // parent a payload it must decode: once the payload-encryption codec is
+    // active, an encrypted result would fail Java's converter lookup
+    // (fromPayloads has no Void special-case). A void return produces a
+    // data-less binary/null payload that every SDK handles natively.
+    await runWorkflowEngine(materialized, {
       checkPause,
       recoveryMode: input.recovery_mode ?? false,
     });