Add Principal to the base HistoryEvent (#733)

<!-- Describe what has changed in this PR -->
**What changed?**
Added a `Principal` message to `temporal.api.common.v1` and a principal
field on the base `HistoryEvent` proto to support server-computed caller
identity on history events.

The change is already tested with the server PR. Here’s a sneak peek at
the history event with the principal set:
```
{
      "eventId": "5",
      "eventTime": "2026-03-18T02:09:49.481998Z",
      "eventType": "EVENT_TYPE_WORKFLOW_EXECUTION_SIGNALED",
      "taskId": "1048704",
      "principal": {
        "type": "jwt",
        "name": "signal-sender"
      },
```

<!-- Tell your future self why have you made these changes -->
**Why?**
Today, the identity field on history events is client-supplied and can
be set to any value, making it unsuitable for auditing. Principal
Attribution attaches a server-computed, immutable identifier derived
from trusted authentication context (JWT claims, mTLS certificates) to
history events, enabling reliable answers to "who did this?" for
compliance, security auditing, and root cause analysis.

<!-- Are there any breaking changes on binary or code level? -->
**Breaking changes**
None. This is a purely additive proto change.

<!-- If this breaks the Server, please provide the Server PR to merge
right after this PR was merged. -->
**Server PR**
N/A

Author: simvlad

openapi/openapiv2.json

@@ -13044,6 +13044,10 @@
           },
           "description": "Links associated with the event."
         },
+        "principal": {
+          "$ref": "#/definitions/v1Principal",
+          "description": "Server-computed authenticated caller identity associated with this event."
+        },
         "workflowExecutionStartedEventAttributes": {
           "$ref": "#/definitions/v1WorkflowExecutionStartedEventAttributes"
         },
@@ -14634,6 +14638,20 @@
       },
       "description": "PostResetOperation represents an operation to be performed on the new workflow execution after a workflow reset."
     },
+    "v1Principal": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "description": "Low-cardinality category of the principal (e.g., \"jwt\", \"users\")."
+        },
+        "name": {
+          "type": "string",
+          "description": "Identifier within that category (e.g., sub JWT claim, email address)."
+        }
+      },
+      "description": "Principal is an authenticated caller identity computed by the server from trusted\nauthentication context."
+    },
     "v1Priority": {
       "type": "object",
       "properties": {

openapi/openapiv3.yaml

@@ -10193,6 +10193,10 @@ components:
           items:
             $ref: '#/components/schemas/Link'
           description: Links associated with the event.
+        principal:
+          allOf:
+            - $ref: '#/components/schemas/Principal'
+          description: Server-computed authenticated caller identity associated with this event.
         workflowExecutionStartedEventAttributes:
           $ref: '#/components/schemas/WorkflowExecutionStartedEventAttributes'
         workflowExecutionCompletedEventAttributes:
@@ -11727,6 +11731,18 @@ components:
       description: |-
         UpdateWorkflowOptions represents updating workflow execution options after a workflow reset.
          Keep the parameters in sync with temporal.api.workflowservice.v1.UpdateWorkflowExecutionOptionsRequest.
+    Principal:
+      type: object
+      properties:
+        type:
+          type: string
+          description: Low-cardinality category of the principal (e.g., "jwt", "users").
+        name:
+          type: string
+          description: Identifier within that category (e.g., sub JWT claim, email address).
+      description: |-
+        Principal is an authenticated caller identity computed by the server from trusted
+         authentication context.
     Priority:
       type: object
       properties:

temporal/api/common/v1/message.proto

@@ -246,6 +246,15 @@ message Link {
     }
 }
 
+// Principal is an authenticated caller identity computed by the server from trusted
+// authentication context.
+message Principal {
+    // Low-cardinality category of the principal (e.g., "jwt", "users").
+    string type = 1;
+    // Identifier within that category (e.g., sub JWT claim, email address).
+    string name = 2;
+}
+
 // Priority contains metadata that controls relative ordering of task processing
 // when tasks are backed up in a queue. Initially, Priority will be used in
 // matching (workflow and activity) task queues. Later it may be used in history

temporal/api/history/v1/message.proto

@@ -1136,6 +1136,8 @@ message HistoryEvent {
     temporal.api.sdk.v1.UserMetadata user_metadata = 301;
     // Links associated with the event.
     repeated temporal.api.common.v1.Link links = 302;
+    // Server-computed authenticated caller identity associated with this event.
+    temporal.api.common.v1.Principal principal = 303;
     // The event details. The type must match that in `event_type`.
     oneof attributes {
         WorkflowExecutionStartedEventAttributes workflow_execution_started_event_attributes = 6;