Yuliia Pominchuk ce73861ba8 fix(core): Run a catalog workflow with the caller's own credentials ... The catalog's run endpoint never attached a credential context. `execution- context.ts` only picks one up when `encryptedRunnerIdentity` is set, and nothing set it, so a dynamic credential had no end user to resolve to and the workflow quietly ran on whatever it stores itself — the opposite of the point. It affected every run from the catalog, not any particular trigger. The scheduled path had identity from the day it was written, because that one mints a token; the attended path, where the identity was sitting right there in the request, had none. The design note claiming manual runs take identity from the session described an intention, not the code. Now the controller reads the session token off the request and the run service encrypts it, the same way the editor's manual execution has always done. A minted identity still wins when one is supplied, so the unattended path is unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>		2026-08-05 15:25:54 +02:00
..
generated	feat(core): Store catalog consent and personal schedules	2026-08-05 12:14:48 +02:00
db.md	feat(core): Add auto-generated database schema documentation (no-changelog) (#32069)	2026-06-12 07:44:01 +00:00
workflow-catalog-handoff.md	fix(core): Run a catalog workflow with the caller's own credentials	2026-08-05 15:25:54 +02:00