Enable the Temporal engine by default (DRAFT — blocked on the e2e run)

[DavidNic11]

Final PR in the sequence from #194 (ADR 0036), following #196, #197 and #198. Flips the default so every turn runs on the Temporal engine.

⚠️ Draft: do not merge until the e2e suite has run under AGENT_ENGINE=temporal

ADR 0036 names that suite as the acceptance test, and it has not been run. This is a draft so the shape of the change is reviewable while that evidence is gathered — not because the diff is unfinished.

Everything merged so far was provably safe: #196–#198 each changed no behaviour, and the four of them together left the flag at langgraph. This is the first PR where anything actually moves.

What's still missing, stated plainly: 581 orchestrator unit tests and 12 Go packages pass, and that is precisely the evidence ADR 0030 says isn't sufficient — "none of the defects above were visible to unit tests; every one required the assembled system to be running." Nothing here proves parity.

What the e2e run needs

• a cluster with the CRDs applied and Temporal reachable
• temporal-engine.enabled=true + agentEngine: temporal in values-e2e.yaml
• the three engine images — these now exist on the registry (published on Import the Temporal agent engine (engines/temporal), no behaviour change #196's merge), so they can be pulled rather than built

How to judge the result

Two outcomes, judged differently:

• Everything must pass unchanged. A failure is a real parity gap.
• resilience and rollout-recovery should change for the better. They encode losses that stop occurring — ADR 0033's "the interrupted turn itself is still lost" among them — so they need re-baselining rather than passing as written. That re-baselining is the evidence, not a workaround.

AGENT_ENGINE had no chart path — fixed here

Worth calling out as a gap I left: #197 added the config value and the engine client, but never gave the chart a way to set the env var. The flip literally could not be expressed in values until this PR.

agent-orchestrator's deployment now renders AGENT_ENGINE and AGENT_TEMPORAL_ENGINE_URL, both omitted entirely when unset. Verified in both states — an unset chart renders byte-identically to before, so this half is safe on its own.

Both halves, because neither does anything alone

temporal-engine:
  enabled: true                    # deploys worker + gateway
agent-orchestrator:
  config:
    agentEngine: temporal          # routes turns to it

That separation is the rollback story, and it's recorded in values.yaml where an operator will actually find it rather than only in an ADR:

To roll back: clear agent-orchestrator.config.agentEngine. That alone returns every turn to the in-process LangGraph loop; leaving the subchart enabled costs two idle pods and nothing else. Rolling back the subchart too is the slower, optional second step.

Known rough edge, flagged rather than hidden

The gateway Service is <release>-temporal-engine-gateway, so the URL here is coupled to the release being named agent-controller. agent-orchestrator uses fullnameOverride to avoid exactly this — its values file says so explicitly — and temporal-engine should get the same treatment. Left as a follow-up rather than restructuring a just-merged chart inside a draft.

Two unrelated things this sequence surfaced

Both stand on their own merits whether or not this ever merges:

1. The identity gate is skipped for sub-agent tool calls. dispatch-tool.ts:35 has no identityProviders check at all — its jobTemplate branch launches with no secretEnv, while runTool's equivalent branch gates on exactly that (ADR 0032 §5). So a sub-agent calling the github tool via its toolRefs runs with whatever static token the Tool template carries instead of the caller's linked identity. Confirmed against current main.

2. deploy doesn't require publish-images to have run. On AGENT_ENGINE selects which agent loop runs a turn (default: langgraph) #197's merge, changes was cancelled (a GitHub-hosted runner outage), so publish-images was skipped — but deploy ran anyway and succeeded, deploying stale images. The cluster's agent-orchestrator currently does not contain the AGENT_ENGINE switch. Harmless while the default is langgraph, but it happened silently, and it would not be harmless the day this PR merges.

(2) is a prerequisite for this PR, not just a note — merging this while that pipeline can silently skip a publish means flipping the default against an image that may not have the switch in it.

🤖 Generated with Claude Code

https://claude.ai/code/session_018Uj1SJ41DJJ8woZM7fd3DQ

[imaustink]

🚢