@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/temporal/agentexecution/__tests__/engine-client.test.ts

@@ -14,8 +14,14 @@
  *     map the SDK's workflow-not-found onto EngineWorkflowNotFoundError
  *     (Go serviceerror.NotFound → ErrWorkflowNotFound);
  *   - the engine-state provider: DISCONNECTED until the first connect,
- *     memoized per client instance, re-built on client swap (reconnect).
+ *     memoized per client instance, re-built on client swap (reconnect);
+ *   - the run credential on the input (2026-09-16): minted through the
+ *     composed provider's capability and bound to the execution with no
+ *     clock; the key is ABSENT when the provider lacks the capability
+ *     (an edition credentialed another way), when it is keyless, and
+ *     when the mint throws — a dispatch never fails on a mint.
  */
+import { randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
@@ -41,6 +47,12 @@ import {
   DEFAULT_EXECUTION_TARGET_LOCAL,
   ROUTING_GLOBAL,
 } from "../../../domain/agentexecution/temporal/config.js";
+import type { RunCredentialMint } from "../../../runnerauth/dispatch-credential.js";
+import { newExecutionScopedRunnerCredentialProvider } from "../../../runnerauth/runner-credential-provider.js";
+import {
+  isClockedToken,
+  RunnerAuthService,
+} from "../../../runnerauth/runnerauth.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
 import type { Store } from "../../../store/interface.js";
 import type { TemporalManager } from "../../manager.js";
@@ -48,6 +60,7 @@ import {
   newExecutionEngineStateProvider,
   TemporalExecutionEngine,
 } from "../engine-client.js";
+import type { TemporalExecutionEngineDeps } from "../engine-client.js";
 import { DEFAULT_ACTIVITY_TASK_QUEUE } from "../names.js";
 
 const silentLogger = createLogger({
@@ -56,6 +69,28 @@ const silentLogger = createLogger({
   write: () => {},
 });
 
+/** The keyed OSS default — what a real open-source boot composes. */
+const runnerAuth = RunnerAuthService.create(randomBytes(32));
+const keyedCredentials = newExecutionScopedRunnerCredentialProvider(runnerAuth);
+
+/**
+ * One construction site for every arm: the realistic deps by default,
+ * any of them overridable, so the next dependency costs one line here.
+ */
+function newEngine(
+  client: Client,
+  overrides: Partial<Omit<TemporalExecutionEngineDeps, "client">> = {},
+): TemporalExecutionEngine {
+  return new TemporalExecutionEngine({
+    client,
+    config: config(),
+    store: overrides.store ?? newStore(),
+    runnerCredentials: keyedCredentials,
+    logger: silentLogger,
+    ...overrides,
+  });
+}
+
 const cleanups: Array<() => Promise<void> | void> = [];
 afterEach(async () => {
   for (const cleanup of cleanups.splice(0)) {
@@ -123,6 +158,12 @@ function stubClient(behavior?: { handleError?: Error }) {
   return { client, startCalls, handleCalls };
 }
 
+/** The one workflow input the stub recorded. */
+function dispatchedInput(startCalls: StartCall[]): Record<string, unknown> {
+  expect(startCalls).toHaveLength(1);
+  return (startCalls[0]!.options["args"] as unknown[])[0] as Record<string, unknown>;
+}
+
 function startInput(overrides: Partial<Parameters<TemporalExecutionEngine["startInvokeWorkflow"]>[0]> = {}) {
   return {
     executionId: "aex_1",
@@ -139,12 +180,7 @@ function startInput(overrides: Partial<Parameters<TemporalExecutionEngine["start
 describe("TemporalExecutionEngine.startInvokeWorkflow", () => {
   it("starts the byte-pinned workflow type with the memo, queue, and slim input", async () => {
     const { client, startCalls } = stubClient();
-    const engine = new TemporalExecutionEngine({
-      client,
-      config: config(),
-      store: newStore(),
-      logger: silentLogger,
-    });
+    const engine = newEngine(client);
 
     await engine.startInvokeWorkflow(
       startInput({ callbackToken: Buffer.from("tok"), parentWorkflowId: "parent-wf" }),
@@ -171,10 +207,67 @@ describe("TemporalExecutionEngine.startInvokeWorkflow", () => {
         // keeps it, so the wire carries it) and target resolved LOCAL.
         harness: Harness.NATIVE,
         execution_target: ExecutionTarget.LOCAL,
+        // The run credential, minted per dispatch (its own arms below).
+        execution_context_token: expect.any(String),
       },
     ]);
   });
 
+  it("carries the run credential minted through the provider: bound to the execution, no clock", async () => {
+    const { client, startCalls } = stubClient();
+    const engine = newEngine(client);
+
+    await engine.startInvokeWorkflow(startInput({ executionId: "aex_cred" }));
+
+    const token = dispatchedInput(startCalls)["execution_context_token"];
+    expect(typeof token).toBe("string");
+    expect(runnerAuth.verify(token as string)).toBe("aex_cred");
+    expect(isClockedToken(token as string)).toBe(false);
+  });
+
+  it("omits the credential when the provider lacks the capability — an edition credentialed another way", async () => {
+    const { client, startCalls } = stubClient();
+    const withoutCapability: RunCredentialMint = {};
+    const engine = newEngine(client, { runnerCredentials: withoutCapability });
+
+    await engine.startInvokeWorkflow(startInput());
+
+    expect("execution_context_token" in dispatchedInput(startCalls)).toBe(
+      false,
+    );
+  });
+
+  it("omits the credential when the provider is keyless", async () => {
+    const { client, startCalls } = stubClient();
+    const keyless = newExecutionScopedRunnerCredentialProvider(
+      RunnerAuthService.create(undefined),
+    );
+    const engine = newEngine(client, { runnerCredentials: keyless });
+
+    await engine.startInvokeWorkflow(startInput());
+
+    expect("execution_context_token" in dispatchedInput(startCalls)).toBe(
+      false,
+    );
+  });
+
+  it("a mint that throws degrades to a dispatch without the credential — the start still happens", async () => {
+    const { client, startCalls } = stubClient();
+    const throwing: RunCredentialMint = {
+      mintRunCredential(): string {
+        throw new Error("signing failed");
+      },
+    };
+    const engine = newEngine(client, { runnerCredentials: throwing });
+
+    await engine.startInvokeWorkflow(startInput());
+
+    expect(startCalls).toHaveLength(1);
+    expect("execution_context_token" in dispatchedInput(startCalls)).toBe(
+      false,
+    );
+  });
+
   it("resolves session routing through dispatch (harness + target in the input)", async () => {
     const { client, startCalls } = stubClient();
     const store = newStore();
@@ -193,16 +286,11 @@ describe("TemporalExecutionEngine.startInvokeWorkflow", () => {
         },
       }),
     );
-    const engine = new TemporalExecutionEngine({
-      client,
-      config: config(),
-      store,
-      logger: silentLogger,
-    });
+    const engine = newEngine(client, { store });
 
     await engine.startInvokeWorkflow(startInput({ sessionId: "ses_1" }));
 
-    const input = (startCalls[0]!.options["args"] as unknown[])[0] as Record<string, unknown>;
+    const input = dispatchedInput(startCalls);
     expect(input["harness"]).toBe(Harness.CURSOR);
     expect(input["execution_target"]).toBe(ExecutionTarget.CLOUD);
     // Omitempty shape: empty callback token and parent id carry NO keys.
@@ -214,12 +302,7 @@ describe("TemporalExecutionEngine.startInvokeWorkflow", () => {
     const { client } = stubClient();
     const store = newStore();
     await store.close(); // Forces a non-NotFound store failure in dispatch.
-    const engine = new TemporalExecutionEngine({
-      client,
-      config: config(),
-      store,
-      logger: silentLogger,
-    });
+    const engine = newEngine(client, { store });
 
     await expect(
       engine.startInvokeWorkflow(startInput({ sessionId: "ses_any" })),
@@ -234,12 +317,7 @@ describe("TemporalExecutionEngine.startInvokeWorkflow", () => {
 describe("TemporalExecutionEngine lifecycle operations", () => {
   it("targets the pinned workflow ID for signal/cancel/terminate", async () => {
     const { client, handleCalls } = stubClient();
-    const engine = new TemporalExecutionEngine({
-      client,
-      config: config(),
-      store: newStore(),
-      logger: silentLogger,
-    });
+    const engine = newEngine(client);
 
     await engine.signalApprovalGateResolved("aex_2");
     await engine.signalPause("aex_2", "Paused by user");
@@ -260,12 +338,7 @@ describe("TemporalExecutionEngine lifecycle operations", () => {
     const { client } = stubClient({
       handleError: new WorkflowNotFoundError("nope", "wf", undefined),
     });
-    const engine = new TemporalExecutionEngine({
-      client,
-      config: config(),
-      store: newStore(),
-      logger: silentLogger,
-    });
+    const engine = newEngine(client);
 
     for (const op of [
       () => engine.signalApprovalGateResolved("aex_3"),
@@ -280,12 +353,7 @@ describe("TemporalExecutionEngine lifecycle operations", () => {
 
   it("passes through other errors unmapped", async () => {
     const { client } = stubClient({ handleError: new Error("connection reset") });
-    const engine = new TemporalExecutionEngine({
-      client,
-      config: config(),
-      store: newStore(),
-      logger: silentLogger,
-    });
+    const engine = newEngine(client);
     await expect(engine.signalResume("aex_4")).rejects.toThrow("connection reset");
   });
 });
@@ -298,6 +366,7 @@ describe("newExecutionEngineStateProvider", () => {
       manager,
       config: config(),
       store: newStore(),
+      runnerCredentials: keyedCredentials,
       logger: silentLogger,
     });
 

package/src/temporal/agentexecution/__tests__/invoke-workflow.test.ts

@@ -20,7 +20,11 @@
  *     stigmer#282 — and the EC deleted);
  *   - callback-token completion on success AND failure (the DD-001 lane,
  *     oss#861: the TS error completion WORKS);
- *   - the cursor flow's harness_state_id re-read discipline.
+ *   - the cursor flow's harness_state_id re-read discipline;
+ *   - the run credential handed on (2026-09-16): the workflow input's
+ *     `execution_context_token` reaches EVERY Execute* invocation, first
+ *     turn and re-invocation, both harnesses, and the key is absent when
+ *     the dispatch carried none.
  *
  * Recorder discipline (oss#892): Temporal activities are at-least-once —
  * a workflow task whose completion fails to commit re-executes its local
@@ -102,6 +106,18 @@ interface ActivityScript {
     }) => Promise<Record<string, unknown>>
   >;
   executeCalls: Array<{ thread_id: string; turn_seq: number }>;
+  /**
+   * The `execution_context_token` each Execute* invocation carried, in
+   * order — `undefined` when the key was absent. Recorded beside
+   * executeCalls so the arms that pin thread/turn shape stay exact.
+   */
+  executeCredentials: Array<string | undefined>;
+  /**
+   * The argument each GenerateSessionSubject invocation received, verbatim:
+   * the positional execution id when the dispatch carried no credential,
+   * the typed object when it did (the runner accepts both).
+   */
+  subjectArguments: unknown[];
   /** Consumed per LoadAgentExecution call, in order; last one sticks. */
   loadResults: JsonValue[];
   /** Consumed per ReadHarnessStateId call, in order; last one sticks. */
@@ -137,6 +153,8 @@ function resetScript(): void {
   script = {
     executeBehaviors: [],
     executeCalls: [],
+    executeCredentials: [],
+    subjectArguments: [],
     loadResults: [],
     harnessStateIds: [],
     persistedStatuses: [],
@@ -210,11 +228,17 @@ function scriptedActivities(): Record<string, (...args: never[]) => Promise<unkn
     execution_id: string;
     thread_id: string;
     turn_seq: number;
+    execution_context_token?: string;
   }) => {
     script.executeCalls.push({
       thread_id: input.thread_id,
       turn_seq: input.turn_seq,
     });
+    script.executeCredentials.push(
+      "execution_context_token" in input
+        ? input.execution_context_token
+        : undefined,
+    );
     const behavior = script.executeBehaviors.shift();
     if (behavior === undefined) {
       throw new Error("test script exhausted: unexpected agent invocation");
@@ -224,7 +248,9 @@ function scriptedActivities(): Record<string, (...args: never[]) => Promise<unkn
 
   return {
     EnsureThread: async (): Promise<string> => script.ensureThreadResult,
-    GenerateSessionSubject: async (): Promise<void> => {},
+    GenerateSessionSubject: async (argument: unknown): Promise<void> => {
+      script.subjectArguments.push(argument);
+    },
     ExecuteDeepAgent: takeExecuteBehavior as never,
     ExecuteCursor: takeExecuteBehavior as never,
     UpdateExecutionStatus: async (
@@ -721,6 +747,83 @@ describe("invoke-agent-execution workflow (TestWorkflowEnvironment)", () => {
     ]);
   }, 30_000);
 
+  it("hands the run credential to every deep-agent invocation — the first turn and the re-invocation alike", async (testCtx) => {    if (!envReady) return testCtx.skip();
+    script.executeBehaviors = [
+      async () => slimResult(ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL),
+      async () => slimResult(ExecutionPhase.EXECUTION_COMPLETED),
+    ];
+    script.loadResults = [executionJson(statusWithPendingApproval())];
+
+    const handle = await startWorkflow(
+      workflowInput({ execution_context_token: "run-credential-1" }),
+    );
+    await waitForPersistedPhase(ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL);
+    await handle.signal(SIGNAL_APPROVAL_GATE_RESOLVED);
+    await handle.result();
+
+    expect(script.executeCredentials).toEqual([
+      "run-credential-1",
+      "run-credential-1",
+    ]);
+  }, 30_000);
+
+  it("hands the run credential to the cursor invocation too", async (testCtx) => {    if (!envReady) return testCtx.skip();
+    script.executeBehaviors = [
+      async () => slimResult(ExecutionPhase.EXECUTION_COMPLETED),
+    ];
+    script.harnessStateIds = [""];
+
+    const handle = await startWorkflow(
+      workflowInput({
+        harness: Harness.CURSOR,
+        execution_context_token: "run-credential-2",
+      }),
+    );
+    await handle.result();
+
+    expect(script.executeCredentials).toEqual(["run-credential-2"]);
+  }, 30_000);
+
+  it("omits the credential key when the dispatch carried none — the omitempty shape an in-flight history has", async (testCtx) => {    if (!envReady) return testCtx.skip();
+    script.executeBehaviors = [
+      async () => slimResult(ExecutionPhase.EXECUTION_COMPLETED),
+    ];
+
+    const handle = await startWorkflow(workflowInput());
+    await handle.result();
+
+    expect(script.executeCredentials).toEqual([undefined]);
+  }, 30_000);
+
+  it("calls GenerateSessionSubject with the typed object carrying the run credential when the dispatch has one", async (testCtx) => {    if (!envReady) return testCtx.skip();
+    script.executeBehaviors = [
+      async () => slimResult(ExecutionPhase.EXECUTION_COMPLETED),
+    ];
+
+    const handle = await startWorkflow(
+      workflowInput({ execution_context_token: "run-credential-3" }),
+    );
+    await handle.result();
+
+    expect(script.subjectArguments).toEqual([
+      {
+        execution_id: currentExecutionId,
+        execution_context_token: "run-credential-3",
+      },
+    ]);
+  }, 30_000);
+
+  it("calls GenerateSessionSubject with the positional execution id when the dispatch carried no credential — the shape every earlier runner accepts", async (testCtx) => {    if (!envReady) return testCtx.skip();
+    script.executeBehaviors = [
+      async () => slimResult(ExecutionPhase.EXECUTION_COMPLETED),
+    ];
+
+    const handle = await startWorkflow(workflowInput());
+    await handle.result();
+
+    expect(script.subjectArguments).toEqual([currentExecutionId]);
+  }, 30_000);
+
   it("survives a missing parent workflow for child_execution_started (non-fatal)", async (testCtx) => {    if (!envReady) return testCtx.skip();
     script.executeBehaviors = [
       async () => slimResult(ExecutionPhase.EXECUTION_COMPLETED),

package/src/temporal/agentexecution/engine-client.ts

@@ -19,6 +19,15 @@
  * engine per client instance — a new engine object per RPC would be
  * garbage for no behavior.
  *
+ * The run credential rides the input (2026-09-16): every dispatch — a
+ * fresh start and a recovery alike, both through startInvokeWorkflow —
+ * asks the composed credential provider for the run's credential
+ * (runnerauth/dispatch-credential.ts) and carries it as
+ * `execution_context_token`, the connect lane's shape. Minting here, in
+ * the one place that builds the input, is what keeps the create step and
+ * the recover path ignorant of credentials; a provider without the
+ * capability (an edition credentialed another way) leaves the key off.
+ *
  * Proven by the agentexecution suites on local-execution.
  */
 import type { Client } from "@temporalio/client";
@@ -35,6 +44,8 @@ import {
   type StartInvokeWorkflowInput,
 } from "../../domain/agentexecution/engine.js";
 import type { AgentExecutionTemporalConfig } from "../../domain/agentexecution/temporal/config.js";
+import { runCredentialForDispatch } from "../../runnerauth/dispatch-credential.js";
+import type { RunCredentialMint } from "../../runnerauth/dispatch-credential.js";
 import type { Store } from "../../store/interface.js";
 import type { TemporalManager } from "../manager.js";
 import { resolveActivityTaskQueue } from "./dispatch.js";
@@ -52,6 +63,8 @@ export interface TemporalExecutionEngineDeps {
   readonly client: Client;
   readonly config: AgentExecutionTemporalConfig;
   readonly store: Store;
+  /** The composed credential provider — the dispatch reads its run-credential capability (module header). */
+  readonly runnerCredentials: RunCredentialMint;
   readonly logger: Logger;
 }
 
@@ -59,7 +72,7 @@ export class TemporalExecutionEngine implements ConnectedExecutionEngine {
   constructor(private readonly deps: TemporalExecutionEngineDeps) {}
 
   async startInvokeWorkflow(input: StartInvokeWorkflowInput): Promise<void> {
-    const { client, config, store, logger } = this.deps;
+    const { client, config, store, runnerCredentials, logger } = this.deps;
 
     let dispatch;
     try {
@@ -79,6 +92,11 @@ export class TemporalExecutionEngine implements ConnectedExecutionEngine {
     }
 
     const workflowId = invokeWorkflowIdFor(input.executionId);
+    const runCredential = runCredentialForDispatch(
+      runnerCredentials,
+      input.executionId,
+      logger,
+    );
 
     // Slim input with Go's omitempty shape (workflow-input.ts): zero-value
     // fields are omitted so TS- and Go-authored histories carry the same
@@ -88,7 +106,9 @@ export class TemporalExecutionEngine implements ConnectedExecutionEngine {
       session_id: input.sessionId,
       agent_id: input.agentId,
       ...(input.callbackToken.length > 0
-        ? { callback_token: Buffer.from(input.callbackToken).toString("base64") }
+        ? {
+            callback_token: Buffer.from(input.callbackToken).toString("base64"),
+          }
         : {}),
       ...(input.autoApproveAll ? { auto_approve_all: true } : {}),
       ...(input.parentWorkflowId !== ""
@@ -98,6 +118,9 @@ export class TemporalExecutionEngine implements ConnectedExecutionEngine {
       ...(dispatch.executionTarget !== 0
         ? { execution_target: dispatch.executionTarget }
         : {}),
+      ...(runCredential !== ""
+        ? { execution_context_token: runCredential }
+        : {}),
     };
 
     // NOTE deliberately NO workflowRunTimeout: HITL approval can block for
@@ -190,6 +213,7 @@ export interface EngineStateProviderDeps {
   readonly manager: TemporalManager;
   readonly config: AgentExecutionTemporalConfig;
   readonly store: Store;
+  readonly runnerCredentials: RunCredentialMint;
   readonly logger: Logger;
 }
 
@@ -220,6 +244,7 @@ export function newExecutionEngineStateProvider(
             client,
             config: deps.config,
             store: deps.store,
+            runnerCredentials: deps.runnerCredentials,
             logger: deps.logger,
           }),
         },

package/src/temporal/agentexecution/workflow-input.ts

@@ -25,6 +25,19 @@ export interface InvokeAgentExecutionWorkflowInput {
   readonly auto_approve_all?: boolean;
   readonly parent_workflow_id?: string;
   readonly invoker_identity_account_id?: string;
+  /**
+   * The run credential (runnerauth: a clockless execution-scoped token
+   * bound to this execution), minted by the engine client at dispatch
+   * when the composed credential provider defines `mintRunCredential`
+   * and omitted otherwise. The connect lane's key for the same token
+   * type (domain/mcpserver/engine.ts). The workflow hands it to the
+   * runner's activities, which present it on the run's own RPCs: under
+   * the built-in authorization posture it admits the runner as the
+   * human whose run this is, for as long as the run lives. Like the
+   * connect lane's, it sits in Temporal history in the clear — history
+   * is operator-only, and the operator holds the signing key already.
+   */
+  readonly execution_context_token?: string;
   /**
    * Session harness as the proto enum numeric value (0=UNSPECIFIED treated
    * as NATIVE, 1=NATIVE, 2=CURSOR) — selects ExecuteDeepAgent vs