@stigmer/server 3.15.3-dev.20260916211208 → 3.16.0

package/src/temporal/agentexecution/workflows/invoke-agent-execution.ts

@@ -157,28 +157,77 @@ const approvalGateResolvedSignal = defineSignal(SIGNAL_APPROVAL_GATE_RESOLVED);
 
 // ─── Activity proxies (options are contract; see the census table) ──────
 
+/**
+ * The typed input of ExecuteDeepAgent and ExecuteCursor — the runner's
+ * ExecuteActivityInput (shared/activity-input.ts), snake_case keys, a
+ * cross-component wire contract. `execution_context_token` is the run
+ * credential the workflow input carries (workflow-input.ts), handed on
+ * so the activity can present it on the run's own RPCs; omitted when the
+ * dispatch carried none (the omitempty convention). Adding the key needed
+ * no patch marker: an in-flight history's input has no token, so the
+ * commands its replay generates are byte-for-byte what they were.
+ */
+interface ExecuteActivityInput {
+  readonly execution_id: string;
+  readonly thread_id: string;
+  readonly invoker_identity_account_id: string;
+  readonly turn_seq: number;
+  readonly execution_context_token?: string;
+}
+
+/**
+ * The typed input of GenerateSessionSubject — the runner's
+ * GenerateSessionSubjectInput (activities/generate-session-subject.ts),
+ * snake_case keys. Sent ONLY when the dispatch carries a run credential;
+ * otherwise the activity is called with the positional execution id it has
+ * always received, byte for byte, because a server whose dispatches carry
+ * no credential (the cloud's: its runner credential is provisioned, not
+ * dispatched) talks to desktop runners in the field that predate the object
+ * shape, and a session title is not worth breaking for them. A runner that
+ * knows the object accepts both.
+ */
+interface GenerateSessionSubjectInput {
+  readonly execution_id: string;
+  readonly execution_context_token: string;
+}
+
 interface RunnerActivities {
   [ENSURE_THREAD_ACTIVITY_NAME]: (
     sessionId: string,
     agentId: string,
   ) => Promise<string>;
-  [EXECUTE_DEEP_AGENT_ACTIVITY_NAME]: (input: {
-    execution_id: string;
-    thread_id: string;
-    invoker_identity_account_id: string;
-    turn_seq: number;
-  }) => Promise<RunnerActivityResult | null>;
-  [EXECUTE_CURSOR_ACTIVITY_NAME]: (input: {
-    execution_id: string;
-    thread_id: string;
-    invoker_identity_account_id: string;
-    turn_seq: number;
-  }) => Promise<RunnerActivityResult | null>;
+  [EXECUTE_DEEP_AGENT_ACTIVITY_NAME]: (
+    input: ExecuteActivityInput,
+  ) => Promise<RunnerActivityResult | null>;
+  [EXECUTE_CURSOR_ACTIVITY_NAME]: (
+    input: ExecuteActivityInput,
+  ) => Promise<RunnerActivityResult | null>;
   [GENERATE_SESSION_SUBJECT_ACTIVITY_NAME]: (
-    executionId: string,
+    input: GenerateSessionSubjectInput | string,
   ) => Promise<void>;
 }
 
+/**
+ * The ONE builder of an Execute* input for both harness flows and both
+ * invocations (first turn and every HITL re-invocation): the run's
+ * coordinates from the workflow input, the harness thread and the turn
+ * from the caller.
+ */
+function executeActivityInput(
+  input: InvokeAgentExecutionWorkflowInput,
+  threadId: string,
+  turnSeq: number,
+): ExecuteActivityInput {
+  const runCredential = input.execution_context_token ?? "";
+  return {
+    execution_id: input.execution_id,
+    thread_id: threadId,
+    invoker_identity_account_id: input.invoker_identity_account_id ?? "",
+    turn_seq: turnSeq,
+    ...(runCredential !== "" ? { execution_context_token: runCredential } : {}),
+  };
+}
+
 function newEnsureThreadProxy(taskQueue: string) {
   return proxyActivities<Pick<RunnerActivities, typeof ENSURE_THREAD_ACTIVITY_NAME>>({
     taskQueue,
@@ -516,7 +565,6 @@ async function executeDeepAgentFlow(
 ): Promise<RunnerActivityResult> {
   const executionId = input.execution_id;
   const sessionId = input.session_id;
-  const invoker = input.invoker_identity_account_id ?? "";
 
   log.info("Step 1: Ensuring thread", { sessionId, agentId: input.agent_id });
   const ensureThread = newEnsureThreadProxy(activityTaskQueue);
@@ -531,7 +579,7 @@ async function executeDeepAgentFlow(
   }
   log.info("Thread ensured", { threadId });
 
-  fireGenerateSessionSubject(activityTaskQueue, executionId);
+  fireGenerateSessionSubject(activityTaskQueue, input);
 
   log.info("Step 2: Executing deep agent", { executionId, threadId });
   const agentProxy = newExecuteAgentProxy(activityTaskQueue);
@@ -547,20 +595,14 @@ async function executeDeepAgentFlow(
         signals,
         parentWorkflowId: input.parent_workflow_id ?? "",
         firstInvoke: () =>
-          agentProxy[EXECUTE_DEEP_AGENT_ACTIVITY_NAME]({
-            execution_id: executionId,
-            thread_id: threadId,
-            invoker_identity_account_id: invoker,
-            turn_seq: 0,
-          }),
+          agentProxy[EXECUTE_DEEP_AGENT_ACTIVITY_NAME](
+            executeActivityInput(input, threadId, 0),
+          ),
         // The LangGraph thread id is stable — re-invocations reuse it.
         reinvoke: (turnSeq) =>
-          agentProxy[EXECUTE_DEEP_AGENT_ACTIVITY_NAME]({
-            execution_id: executionId,
-            thread_id: threadId,
-            invoker_identity_account_id: invoker,
-            turn_seq: turnSeq,
-          }),
+          agentProxy[EXECUTE_DEEP_AGENT_ACTIVITY_NAME](
+            executeActivityInput(input, threadId, turnSeq),
+          ),
         nullResultMessage: "activity returned null status - this should never happen",
         nullResultAfterApprovalMessage:
           "activity returned null status after approval - this should never happen",
@@ -584,9 +626,8 @@ async function executeCursorFlow(
 ): Promise<RunnerActivityResult> {
   const executionId = input.execution_id;
   const sessionId = input.session_id;
-  const invoker = input.invoker_identity_account_id ?? "";
 
-  fireGenerateSessionSubject(activityTaskQueue, executionId);
+  fireGenerateSessionSubject(activityTaskQueue, input);
 
   log.info("Executing Cursor agent", { executionId, sessionId });
   const agentProxy = newExecuteAgentProxy(activityTaskQueue);
@@ -612,12 +653,9 @@ async function executeCursorFlow(
             );
             harnessStateId = "";
           }
-          return agentProxy[EXECUTE_CURSOR_ACTIVITY_NAME]({
-            execution_id: executionId,
-            thread_id: harnessStateId,
-            invoker_identity_account_id: invoker,
-            turn_seq: 0,
-          });
+          return agentProxy[EXECUTE_CURSOR_ACTIVITY_NAME](
+            executeActivityInput(input, harnessStateId, 0),
+          );
         },
         reinvoke: async (turnSeq) => {
           let harnessStateId: string;
@@ -634,12 +672,9 @@ async function executeCursorFlow(
             cycle: turnSeq,
             harnessStateId,
           });
-          return agentProxy[EXECUTE_CURSOR_ACTIVITY_NAME]({
-            execution_id: executionId,
-            thread_id: harnessStateId,
-            invoker_identity_account_id: invoker,
-            turn_seq: turnSeq,
-          });
+          return agentProxy[EXECUTE_CURSOR_ACTIVITY_NAME](
+            executeActivityInput(input, harnessStateId, turnSeq),
+          );
         },
         nullResultMessage:
           "cursor activity returned null status - this should never happen",
@@ -649,15 +684,26 @@ async function executeCursorFlow(
   });
 }
 
-/** GenerateSessionSubject: fire-and-forget, non-blocking (issue #665). */
+/**
+ * GenerateSessionSubject: fire-and-forget, non-blocking (issue #665). The
+ * argument shape follows the run credential's presence — see
+ * GenerateSessionSubjectInput for why the credential-less dispatch keeps
+ * the positional string.
+ */
 function fireGenerateSessionSubject(
   activityTaskQueue: string,
-  executionId: string,
+  input: InvokeAgentExecutionWorkflowInput,
 ): void {
+  const executionId = input.execution_id;
+  const runCredential = input.execution_context_token ?? "";
+  const argument: GenerateSessionSubjectInput | string =
+    runCredential !== ""
+      ? { execution_id: executionId, execution_context_token: runCredential }
+      : executionId;
   const subjectProxy = newSubjectProxy(activityTaskQueue);
   void (async () => {
     try {
-      await subjectProxy[GENERATE_SESSION_SUBJECT_ACTIVITY_NAME](executionId);
+      await subjectProxy[GENERATE_SESSION_SUBJECT_ACTIVITY_NAME](argument);
     } catch (error) {
       log.warn("Session subject generation failed (non-critical)", {
         executionId,

package/src/temporal/workflowexecution/__tests__/engine-client.test.ts

@@ -6,9 +6,18 @@
  * raw-signal convention, the WorkflowNotFoundError → seam-sentinel
  * mapping, and the provider's memoization/disconnected semantics.
  *
+ * And the run credential on the input (2026-09-16): minted through the
+ * composed provider's capability on BOTH dispatch lanes (start and
+ * signalWithStart), bound to the execution with no clock; the key is
+ * ABSENT when the provider lacks the capability (an edition credentialed
+ * another way), when it is keyless, and when the mint throws — a dispatch
+ * never fails on a mint.
+ *
  * The Temporal Client is a recording double — the real dial path is
  * proven by local-execution.
  */
+import { randomBytes } from "node:crypto";
+
 import { describe, expect, it } from "vitest";
 
 import type { Client } from "@temporalio/client";
@@ -27,11 +36,18 @@ import {
   WORKFLOW_ROUTING_GLOBAL,
   WorkflowExecutionTemporalConfig,
 } from "../../../domain/workflowexecution/temporal/config.js";
+import type { RunCredentialMint } from "../../../runnerauth/dispatch-credential.js";
+import { newExecutionScopedRunnerCredentialProvider } from "../../../runnerauth/runner-credential-provider.js";
+import {
+  isClockedToken,
+  RunnerAuthService,
+} from "../../../runnerauth/runnerauth.js";
 import type { TemporalManager } from "../../manager.js";
 import {
   newWorkflowExecutionEngineStateProvider,
   TemporalWorkflowExecutionEngine,
 } from "../engine-client.js";
+import type { TemporalWorkflowExecutionEngineDeps } from "../engine-client.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -46,6 +62,27 @@ const config = new WorkflowExecutionTemporalConfig(
   WORKFLOW_DEFAULT_EXECUTION_TARGET_LOCAL,
 );
 
+/** The keyed OSS default — what a real open-source boot composes. */
+const runnerAuth = RunnerAuthService.create(randomBytes(32));
+const keyedCredentials = newExecutionScopedRunnerCredentialProvider(runnerAuth);
+
+/**
+ * One construction site for every arm: the realistic deps by default,
+ * any of them overridable, so the next dependency costs one line here.
+ */
+function newEngine(
+  client: Client,
+  overrides: Partial<Omit<TemporalWorkflowExecutionEngineDeps, "client">> = {},
+): TemporalWorkflowExecutionEngine {
+  return new TemporalWorkflowExecutionEngine({
+    client,
+    config,
+    runnerCredentials: keyedCredentials,
+    logger: silentLogger,
+    ...overrides,
+  });
+}
+
 interface RecordedStart {
   readonly workflowType: string;
   readonly options: Record<string, unknown>;
@@ -93,6 +130,15 @@ function newClientDouble(handleError?: Error) {
   return { client, starts, signalWithStarts, handleCalls };
 }
 
+/** The one workflow input a recorded start (or signalWithStart) carried. */
+function inputOf(recorded: RecordedStart[]): Record<string, unknown> {
+  expect(recorded).toHaveLength(1);
+  return (recorded[0]!.options["args"] as unknown[])[0] as Record<
+    string,
+    unknown
+  >;
+}
+
 function startInput(
   overrides: Partial<StartWorkflowExecutionInput> = {},
 ): StartWorkflowExecutionInput {
@@ -110,11 +156,7 @@ function startInput(
 describe("TemporalWorkflowExecutionEngine", () => {
   it("starts the orchestrator with the pinned ID, queue, memo, and omitempty input", async () => {
     const double = newClientDouble();
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await engine.startInvokeWorkflow(startInput());
 
@@ -125,7 +167,9 @@ describe("TemporalWorkflowExecutionEngine", () => {
       "stigmer/workflow-execution/invoke/wfe-1",
     );
     expect(start.options["taskQueue"]).toBe("workflow_execution_stigmer");
-    expect(start.options["memo"]).toEqual({ runnerTaskQueue: "stigmer_runner" });
+    expect(start.options["memo"]).toEqual({
+      runnerTaskQueue: "stigmer_runner",
+    });
     // Go's omitempty shape: recovery_mode false is OMITTED, not false.
     expect(start.options["args"]).toEqual([
       {
@@ -133,6 +177,8 @@ describe("TemporalWorkflowExecutionEngine", () => {
         workflow_instance_id: "wfi-1",
         workflow_id: "wf-1",
         org_id: "org-1",
+        // The run credential, minted per dispatch (its own arms below).
+        execution_context_token: expect.any(String),
       },
     ]);
     // No workflowRunTimeout — durable execution (module header).
@@ -141,11 +187,7 @@ describe("TemporalWorkflowExecutionEngine", () => {
 
   it("omits every zero-valued optional field and carries recovery_mode when set", async () => {
     const double = newClientDouble();
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await engine.startInvokeWorkflow(
       startInput({
@@ -157,18 +199,89 @@ describe("TemporalWorkflowExecutionEngine", () => {
     );
 
     expect(double.starts[0]!.options["args"]).toEqual([
-      { execution_id: "wfe-1", recovery_mode: true },
+      {
+        execution_id: "wfe-1",
+        recovery_mode: true,
+        execution_context_token: expect.any(String),
+      },
     ]);
   });
 
-  it("signalWithStart carries the signal, its payload, and the same start options", async () => {
+  it("carries the run credential minted through the provider: bound to the execution, no clock", async () => {
     const double = newClientDouble();
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
+    const engine = newEngine(double.client);
+
+    await engine.startInvokeWorkflow(startInput({ executionId: "wex_cred" }));
+
+    const token = inputOf(double.starts)["execution_context_token"];
+    expect(typeof token).toBe("string");
+    expect(runnerAuth.verify(token as string)).toBe("wex_cred");
+    expect(isClockedToken(token as string)).toBe(false);
+  });
+
+  it("signalWithStart mints the same credential — the lane that may be the start", async () => {
+    const double = newClientDouble();
+    const engine = newEngine(double.client);
+
+    await engine.signalWithStart(
+      startInput({ executionId: "wex_sws" }),
+      "relaySignal",
+      {
+        signalName: "human_input_step1",
+        payload: { answer: 42 },
+      },
+    );
+
+    const token = inputOf(double.signalWithStarts)["execution_context_token"];
+    expect(runnerAuth.verify(token as string)).toBe("wex_sws");
+  });
+
+  it("omits the credential when the provider lacks the capability — an edition credentialed another way", async () => {
+    const double = newClientDouble();
+    const withoutCapability: RunCredentialMint = {};
+    const engine = newEngine(double.client, {
+      runnerCredentials: withoutCapability,
     });
 
+    await engine.startInvokeWorkflow(startInput());
+    await engine.signalWithStart(startInput(), "relaySignal", null);
+
+    expect("execution_context_token" in inputOf(double.starts)).toBe(false);
+    expect("execution_context_token" in inputOf(double.signalWithStarts)).toBe(
+      false,
+    );
+  });
+
+  it("omits the credential when the provider is keyless", async () => {
+    const double = newClientDouble();
+    const keyless = newExecutionScopedRunnerCredentialProvider(
+      RunnerAuthService.create(undefined),
+    );
+    const engine = newEngine(double.client, { runnerCredentials: keyless });
+
+    await engine.startInvokeWorkflow(startInput());
+
+    expect("execution_context_token" in inputOf(double.starts)).toBe(false);
+  });
+
+  it("a mint that throws degrades to a dispatch without the credential — the start still happens", async () => {
+    const double = newClientDouble();
+    const throwing: RunCredentialMint = {
+      mintRunCredential(): string {
+        throw new Error("signing failed");
+      },
+    };
+    const engine = newEngine(double.client, { runnerCredentials: throwing });
+
+    await engine.startInvokeWorkflow(startInput());
+
+    expect("execution_context_token" in inputOf(double.starts)).toBe(false);
+  });
+
+  it("signalWithStart carries the signal, its payload, and the same start options", async () => {
+    const double = newClientDouble();
+    const engine = newEngine(double.client);
+
     await engine.signalWithStart(startInput(), "relaySignal", {
       signalName: "human_input_step1",
       payload: { answer: 42 },
@@ -189,17 +302,17 @@ describe("TemporalWorkflowExecutionEngine", () => {
 
   it("raw signal sends exactly one argument, null when the payload is absent", async () => {
     const double = newClientDouble();
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await engine.signalWorkflow("wf-id-1", "pause", "user requested");
     await engine.signalWorkflow("wf-id-1", "resume", undefined);
 
     expect(double.handleCalls).toEqual([
-      { workflowId: "wf-id-1", method: "signal", args: ["pause", "user requested"] },
+      {
+        workflowId: "wf-id-1",
+        method: "signal",
+        args: ["pause", "user requested"],
+      },
       // Go SignalWorkflow(nil) — one nil argument, not zero arguments.
       { workflowId: "wf-id-1", method: "signal", args: ["resume", null] },
     ]);
@@ -208,11 +321,7 @@ describe("TemporalWorkflowExecutionEngine", () => {
   it("maps WorkflowNotFoundError onto the seam's sentinel for signal/cancel/terminate", async () => {
     const notFound = new WorkflowNotFoundError("gone", "wf-id-x", undefined);
     const double = newClientDouble(notFound);
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await expect(
       engine.signalWorkflow("wf-id-x", "pause", "r"),
@@ -228,11 +337,7 @@ describe("TemporalWorkflowExecutionEngine", () => {
   it("passes non-not-found errors through unchanged", async () => {
     const boom = new Error("connection refused");
     const double = newClientDouble(boom);
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await expect(engine.cancelWorkflow("wf-id-x")).rejects.toBe(boom);
   });
@@ -248,6 +353,7 @@ describe("newWorkflowExecutionEngineStateProvider", () => {
     const provider = newWorkflowExecutionEngineStateProvider({
       manager,
       config,
+      runnerCredentials: keyedCredentials,
       logger: silentLogger,
     });
 

package/src/temporal/workflowexecution/engine-client.ts

@@ -26,6 +26,18 @@
  * signal/cancel/terminate operations take a workflowId verbatim. That
  * asymmetry is the seam's documented contract.
  *
+ * The run credential rides the input (2026-09-16): every dispatch — a
+ * fresh start, a recovery, and both signalWithStart lanes (sendSignal,
+ * submitWorkflowTaskApproval), which may be the start when they race the
+ * create — asks the composed credential provider for the run's credential
+ * (runnerauth/dispatch-credential.ts) and carries it as
+ * `execution_context_token`, the connect lane's shape. signalWithStart
+ * mints even when the workflow already exists and Temporal discards the
+ * input: the mint is a local HMAC with no read, and one input builder
+ * serving every lane is worth more than the spared signature. A provider
+ * without the capability (an edition credentialed another way) leaves the
+ * key off.
+ *
  * Proven by the workflowexecution suites on local-execution.
  */
 import type { JsonValue } from "@bufbuild/protobuf";
@@ -42,6 +54,8 @@ import {
   type WorkflowExecutionEngineStateProvider,
 } from "../../domain/workflowexecution/engine.js";
 import type { WorkflowExecutionTemporalConfig } from "../../domain/workflowexecution/temporal/config.js";
+import { runCredentialForDispatch } from "../../runnerauth/dispatch-credential.js";
+import type { RunCredentialMint } from "../../runnerauth/dispatch-credential.js";
 import type { TemporalManager } from "../manager.js";
 import { resolveWorkflowTaskQueue } from "./dispatch.js";
 import {
@@ -54,6 +68,8 @@ import type { InvokeWorkflowExecutionWorkflowInput } from "./workflow-input.js";
 export interface TemporalWorkflowExecutionEngineDeps {
   readonly client: Client;
   readonly config: WorkflowExecutionTemporalConfig;
+  /** The composed credential provider — the dispatch reads its run-credential capability (module header). */
+  readonly runnerCredentials: RunCredentialMint;
   readonly logger: Logger;
 }
 
@@ -82,7 +98,7 @@ export class TemporalWorkflowExecutionEngine
       workflowId,
       taskQueue: config.stigmerQueue,
       memo: { [MEMO_RUNNER_TASK_QUEUE]: dispatch.taskQueue },
-      args: [buildWorkflowInput(input)],
+      args: [this.buildWorkflowInput(input)],
     });
 
     logger.info("Started InvokeWorkflowExecutionWorkflow", {
@@ -117,7 +133,7 @@ export class TemporalWorkflowExecutionEngine
         workflowId,
         taskQueue: config.stigmerQueue,
         memo: { [MEMO_RUNNER_TASK_QUEUE]: dispatch.taskQueue },
-        args: [buildWorkflowInput(input)],
+        args: [this.buildWorkflowInput(input)],
         signal: signalName,
         signalArgs: [payload],
       },
@@ -164,26 +180,35 @@ export class TemporalWorkflowExecutionEngine
       throw mapNotFound(error, workflowId);
     }
   }
-}
 
-/**
- * The slim input with Go's omitempty shape (workflow-input.ts): zero
- * values are omitted so TS-authored histories carry the same keys a
- * Go-authored one would. The cloud-only fields are unmodeled (the seam's
- * ratified boundary).
- */
-function buildWorkflowInput(
-  input: StartWorkflowExecutionInput,
-): InvokeWorkflowExecutionWorkflowInput {
-  return {
-    execution_id: input.executionId,
-    ...(input.workflowInstanceId !== ""
-      ? { workflow_instance_id: input.workflowInstanceId }
-      : {}),
-    ...(input.workflowId !== "" ? { workflow_id: input.workflowId } : {}),
-    ...(input.orgId !== "" ? { org_id: input.orgId } : {}),
-    ...(input.recoveryMode ? { recovery_mode: true } : {}),
-  };
+  /**
+   * The slim input with Go's omitempty shape (workflow-input.ts): zero
+   * values are omitted so TS-authored histories carry the same keys a
+   * Go-authored one would. The cloud-only fields are unmodeled (the
+   * seam's ratified boundary). The run credential is the one key minted
+   * here rather than copied from the caller (module header).
+   */
+  private buildWorkflowInput(
+    input: StartWorkflowExecutionInput,
+  ): InvokeWorkflowExecutionWorkflowInput {
+    const runCredential = runCredentialForDispatch(
+      this.deps.runnerCredentials,
+      input.executionId,
+      this.deps.logger,
+    );
+    return {
+      execution_id: input.executionId,
+      ...(input.workflowInstanceId !== ""
+        ? { workflow_instance_id: input.workflowInstanceId }
+        : {}),
+      ...(input.workflowId !== "" ? { workflow_id: input.workflowId } : {}),
+      ...(input.orgId !== "" ? { org_id: input.orgId } : {}),
+      ...(input.recoveryMode ? { recovery_mode: true } : {}),
+      ...(runCredential !== ""
+        ? { execution_context_token: runCredential }
+        : {}),
+    };
+  }
 }
 
 /**
@@ -200,6 +225,7 @@ function mapNotFound(error: unknown, workflowId: string): unknown {
 export interface WorkflowExecutionEngineStateProviderDeps {
   readonly manager: TemporalManager;
   readonly config: WorkflowExecutionTemporalConfig;
+  readonly runnerCredentials: RunCredentialMint;
   readonly logger: Logger;
 }
 
@@ -232,6 +258,7 @@ export function newWorkflowExecutionEngineStateProvider(
           engine: new TemporalWorkflowExecutionEngine({
             client,
             config: deps.config,
+            runnerCredentials: deps.runnerCredentials,
             logger: deps.logger,
           }),
         },

package/src/temporal/workflowexecution/workflow-input.ts

@@ -28,6 +28,20 @@ export interface InvokeWorkflowExecutionWorkflowInput {
    * recover pipeline; normal executions omit it (Go omitempty).
    */
   readonly recovery_mode?: boolean;
+  /**
+   * The run credential (runnerauth: a clockless execution-scoped token
+   * bound to this execution), minted by the engine client at dispatch
+   * when the composed credential provider defines `mintRunCredential`
+   * and omitted otherwise. The connect lane's key for the same token
+   * type (domain/mcpserver/engine.ts). The orchestrator passes this
+   * object whole to the runner's child workflow, so the runner reads it
+   * from here and presents it on the run's own RPCs: under the built-in
+   * authorization posture it admits the runner as the human whose run
+   * this is, for as long as the run lives. In Temporal history in the
+   * clear, like the connect lane's — history is operator-only, and the
+   * operator holds the signing key already.
+   */
+  readonly execution_context_token?: string;
 }
 
 /**