[bergundy]

What changed?

Adds core/src/main/java/io/temporal/samples/nexussecurecredentialpropagation, a sample that propagates an end-user JWT from a client, through a caller Workflow, to a Nexus Operation handler without the JWT appearing in plaintext in history, Temporal headers, or Nexus headers.

• Receiver-encrypted headers. The credential travels only in headers, encrypted with Tink HPKE to the receiving hop (caller Worker for the start hop, Nexus handler for the Nexus hop). Clients and caller Workers hold only public keys for the hops they send on.
• Bound to the exact arguments. Each header's HPKE info binds it to the hop's context and to a SHA-256 digest of that hop's transmitted argument ciphertexts, their positions, and count: the start header to the start arguments, the Nexus header to the Nexus input. The context is never transmitted: it is mixed into key derivation, and the receiver rebuilds it from the dispatched route, its Workflow info, and the ciphertexts it received. No input is canonicalized or re-serialized. The payload codec hands the digest to the interceptors through a thread local and knows nothing about credentials.
• Continue-as-new headers are bound to firstExecutionRunId (the Java SDK builds that header before encoding arguments). Child Workflows never receive the credential.
• Handler. Takes the route from the actual Nexus request, validates the JWT, authorizes the input against the principal, derives the backing Workflow ID from principal + business identity, and signs operation tokens so they can't be forged for cancellation.
• Codec. Context-bound Tink AEAD payloads; rejections are non-retryable PayloadValidationError so the handler reports BAD_REQUEST instead of retrying.
• Verifier tool. tools/VerifyCredentialBinding reads a Workflow's history and, for every WorkflowExecutionStarted and NexusOperationScheduled event with a credential header, recomputes the binding, opens the header with it, confirms a one-bit-changed context is rejected, and confirms the binding value is absent from the header bytes. It needs the receivers' private keys (only they can check the binding), prints only subject and issuer, and exits non-zero on failure.
• Adds com.google.crypto.tink:tink:1.23.0 to core.

The README documents the threat model, wire formats, key distribution, why the HPKE public keys need not be secret (and how to add sender authentication with signatures if needed), replay cases, why the args digests do not scope the credential to an action and the alternatives for that (action-scoped tokens and others), and the access-layer boundary for replayed cancels.

Why?

To show a replay-safe way to carry end-user identity across a Nexus call where neither history readers nor holders of sender-side keys can read or repurpose the credential.

Breaking changes?

None.

Testing

• SecureCredentialPropagationTest (21 end-to-end tests against the test server): start / signal-with-start / update-with-start, continue-as-new to another type plus retry, child Workflows, cancellation, argument reorder/duplicate/truncate/substitute, copied continue-as-new header, key-less attacker replaying captured Nexus input and headers (exact replay, input swap, endpoint move, missing credential), subject check, wrong audience, a misordered interceptor, and the verifier on normal, continue-as-new, and substituted-argument histories.
• CryptoComponentsTest (18 unit tests): framing, header contexts and parsing, args digest, codec context binding, JWT validation, authorization policy, resource IDs, operation tokens.
• Full :core:test passes.
• Ran the three-process demo against a local dev server and verified neither history contains the JWT, its claims, or business values. Ran the verifier against the resulting history: both headers pass.