Summary

• add real Temporal cluster + SDK worker integration tests behind an encryption-enabled s2s-proxy
• have the starter and worker use only the proxy outbound listener, prove they receive plaintext, and complete successfully
• cover workflow/activity input and output, activity heartbeat details, local activities, SideEffect, failure details, timers, child workflows, external signals, workflow updates, Nexus operations, memo, queries, signals, and continue-as-new
• inspect initial, continued-as-new, child, and signal-receiver histories directly and require every payload to be binary/encrypted with no plaintext canaries
• inspect mutable state directly while an activity heartbeat is persisted and require its details to be encrypted
• fetch those histories through the proxy and require the expected canaries to be plaintext again
• add direct AdminService tests for DescribeMutableState, GetWorkflowExecutionRawHistory, GetWorkflowExecutionRawHistoryV2, SyncWorkflowState, and GetDLQReplicationMessages
• retain focused WorkflowService.QueryWorkflow and OperatorService.ListNexusEndpoints controls

Current result on main

Both worker integration scenarios and the WorkflowService/OperatorService controls pass. All five direct AdminService subtests fail because current main returns their payloads as plaintext. This confirms the workflow encryption path and comprehensive Temporal primitive coverage work, while isolating the remaining gap to AdminService wiring.

Tests

• PASS: go test -tags test_dep ./proxy/test -run '^TestWorkerUsesPlaintext(WhileClusterStoresSealedPayloads|ForTemporalPrimitivesWhileClusterStoresSealedPayloads)$' -count=1 -timeout 5m
• PASS: go test ./proxy -run '^TestWorkflowAndOperatorClientsReceiveSealedPayloadsFromProxy$' -count=1 -v
• PASS: go test ./interceptor -run '^TestVisitAdminPayloads(ZeroValues|ReachesEveryPayload|ReportsEveryOpaqueField|StreamHistoryEvents|MutableStateMemoAndSearchAttributes|DecodesHistoryTasks)$' -count=1
• PASS: go mod tidy -diff
• PASS: make lint
• EXPECTED FAIL: go test ./proxy -run '^TestAdminClientsReceiveSealedPayloadsFromProxy$' -count=1 -v (all five Admin APIs return plaintext on current main)