[moetemp]

This PR splits one step of a session turn into three activities instead of one, behind OPENCODE_TEMPORAL_STEPPED=1. Off by default.

Until now the smallest durable unit was a step: one model call plus every tool it asked for, in a single activity. Nothing could sit between the model asking for a tool and the tool running, so per-tool retry policies, per-tool timeouts, approval gates and budgets had nowhere to live.

runModelCall  ->  runToolCall (one per call, concurrent)  ->  sealStep

SessionRunner.runModelCall performs the attempt, records each call as Tool.Called, and hands the calls back instead of running them. runToolCall settles one call. sealStep takes the end snapshot, diffs it against the start, and publishes Step.Ended. The loop between them is workflow code (stepped-turn.ts). The supervisor is untouched: it only ever called one runTurnStep, so the stepped mode supplies a different one.

What has to hold, and has a test for it:

• One owner token per step, not per activity. The event log fences a publish behind the current owner. Only runModelCall claims; the tool and seal activities publish under the token it returns. Claiming is a compare-and-set, because two attempts of one activity can be alive at once and a paused attempt 1 resuming after attempt 2 must not take the log back.
• A call that already started is not silently repeated. runToolCall publishes Tool.Called before it runs the tool, so a call the log shows as running is one a dispatch was already inside. Only a tool declaring idempotent runs again; anything else reaches the model as an unknown outcome. One admission event, with an id derived from the call, admits one dispatch under overlapping attempts.
• The tool arguments come off the log, not the hand-off. The record holds the provider's raw JSON, which the dispatcher parses; a provider that delivers a call whole has its arguments seeded into the record.
• A stop closes the calls it cut short, and a hand-off does not. A declined permission crosses the boundary as its own failure type, the step is sealed on the way out with no continuation, and a cancellation that means this attempt is being handed on leaves the call as it was found.
• Each tool ships the tree from the host that ran it, because the seal can land on any worker. Where two hosts could run one step's tools, they run one at a time (OPENCODE_TEMPORAL_SERIAL_TOOLS, on by default only with a shared store).

Verified live against a Temporal dev server and gpt-5-mini: a one-tool turn recorded five activities and the tool ran once; four concurrent read calls ran as four overlapping runToolCall activities with no fenced write; a serve killed mid-tool came back on a fresh worker with the interrupted call reported unknown and the model recovering; an interrupt closed the in-flight call by itself. The SessionExecution conformance suite passes in both Temporal modes and in the local coordinator, and gained the two scenarios the split changes: a tool round trip, and an interrupt with a tool in flight.

Worker affinity, the live event tick, the worktree freshness rule and the fork CI workflow, which used to ride in this PR, are their own PRs in the stack now.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

Hey! Your PR title Split a step into model-call, per-tool, and seal activities. doesn't follow conventional commit format.

Please update it to start with one of:

• feat: or feat(scope): new feature
• fix: or fix(scope): bug fix
• docs: or docs(scope): documentation changes
• chore: or chore(scope): maintenance tasks
• refactor: or refactor(scope): code refactoring
• test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.