Describe the header context as HPKE info

Tink's HybridEncrypt passes contextInfo to HPKE as the info parameter,
which is mixed into key derivation, and seals with empty associated
data. The docs called the context authenticated associated data, which
is inaccurate. Describe it as HPKE info and state that it is never
transmitted, only rebuilt by the receiver.

Author: bergundy

core/src/main/java/io/temporal/samples/nexussecurecredentialpropagation/README.MD

@@ -95,7 +95,10 @@ Nexus header "x-temporal-end-user-credential":
 plaintext = frame("credential-envelope", v1, compactJwt, intent)
 ```
 
-`frame` is a length-prefixed encoding. The context is visible to anyone who can read history; only the plaintext is
+`frame` is a length-prefixed encoding. The context is passed to Tink as HPKE `info`, which is mixed into the key
+derivation (Tink's HPKE uses empty AEAD associated data). It is never transmitted: the receiver rebuilds it from the
+dispatched route, its Workflow info, and the argument ciphertexts it received, and a different context derives a
+different key, so decryption fails. Its components are visible to anyone who can read history; only the plaintext is
 secret.
 
 The Java SDK builds the continue-as-new header before encoding the new run's arguments, so continue-as-new headers
@@ -226,8 +229,8 @@ Nexus header contain only ciphertext.
 
 ### Verify the binding
 
-The args digest is not a field in the header; it is authenticated associated data that the receiver recomputes. To
-check the binding in a real history, run the verifier against the caller namespace:
+The args digest is not a field in the header; it is part of the HPKE `info` that the receiver recomputes. To check
+the binding in a real history, run the verifier against the caller namespace:
 
 ```
 ./gradlew -q :core:execute -PmainClass=io.temporal.samples.nexussecurecredentialpropagation.tools.VerifyCredentialBinding \

core/src/main/java/io/temporal/samples/nexussecurecredentialpropagation/common/Frame.java

@@ -6,7 +6,8 @@
 import java.security.GeneralSecurityException;
 
 /**
- * Unambiguous length-prefixed encoding used for associated data, digests, and envelopes.
+ * Unambiguous length-prefixed encoding used for associated data, HPKE context info, digests, and
+ * envelopes.
  *
  * <p>Every field is written as a 4-byte big-endian length followed by its bytes, so no two
  * different field sequences produce the same encoding.

core/src/main/java/io/temporal/samples/nexussecurecredentialpropagation/common/SecureCredentialHeaders.java

@@ -10,7 +10,7 @@
 import java.util.Base64;
 
 /**
- * Wire formats and associated data for the credential headers.
+ * Wire formats and HPKE context info for the credential headers.
  *
  * <p>Every header carries an HPKE ciphertext of a {@link CredentialEnvelope} encrypted to the
  * receiving hop. The HPKE context info binds it to the hop's context and, where available, to the

core/src/main/java/io/temporal/samples/nexussecurecredentialpropagation/tools/VerifyCredentialBinding.java

@@ -29,7 +29,7 @@
  * digest from the event's input ciphertexts, or using {@code firstExecutionRunId} for
  * continue-as-new headers), opens the header with it, and confirms that the same context with one
  * bit changed is rejected. It also confirms the digest never appears in the header bytes: the
- * digest is authenticated associated data, not a transmitted field.
+ * digest is part of the HPKE {@code info} mixed into key derivation, not a transmitted field.
  *
  * <p>Opening a header requires the receivers' private keys, so this is an operator debugging tool.
  * It prints only the subject and issuer of each credential, never the token.