Nexus caller identity propagation [wip]

[stephanos]

What changed?

Prototype for Nexus caller-identity propagation (OSS). A signed, short-lived principal token (JWS, ES256) carries the caller identity across the Nexus HTTP hop, server-to-server:

• New common/nexus/principaltoken package: pluggable Signer / Verifier / KeyProvider / PrincipalResolver / PeerTrustFunc behind interfaces, with OSS defaults (ECDSA signer, JWS verifier, transport verifier, deny-all peer trust, noop resolver). Verifier is selected by a TrustMode config: signature (JWS) or transport (trust the cell-mTLS peer).
• Caller side mints the token from the at-rest AttributedPrincipals captured on the CHASM Nexus operation; handler side verifies and promotes the principals.
• Worker observability: PollNexusTaskQueueResponse.caller_info (NexusCallerInfo{root, service, namespace}) surfaces the verified caller chain to the handler worker.
• WorkflowExecutionInfo.root_caller_principal surfaced on Describe.
• A frontend interceptor verifies a forwarded token on StartWorkflowExecution so a workflow started in response to a Nexus operation inherits the original end-user as RootCallerPrincipal.
• Configurable via config.Global.NexusPrincipalPropagation + a registered JWKS endpoint.

Depends on the matching temporalio/api / api-go branch (stephanos/prototype-nexus-identity-propagation).

Why?

Nexus handlers today only know which namespace called, not who. This lets Temporal (and handler code) make per-caller AuthZ/audit decisions. See the blueprint: "Nexus caller identity propagation".

How did you test it?

• built
• added new unit test(s)
• added new functional test(s)

Unit tests for principaltoken (signer/verifier/transport/JWKS/fx) and nexusoperation principal capture; a two-cluster functional test (tests/nexus_propagation_test.go) exercises both trust modes, asserts the worker-observable caller_info, and the forwarded-token → RootCallerPrincipal attach via Describe.

Potential risks

Prototype / WIP — not for merge as-is. It pins unreleased api/api-go prototype branches (so check-dependencies and lint-api fail until those are released). The feature is off by default (no signer / deny-all peer trust); when enabled it only adds a server-to-server header verified by signature or trusted peer, and strips spoofed inbound principal headers/tokens at ingress.