Function idempotency_key 

pub fn idempotency_key(run_id: &str, step_id: &str) -> String

The env view (curated, secret-free) the templates see. The idempotency key for one step of one run: stable across retries and replays BY ARITHMETIC — it is derived from identity every attempt of the same logical operation already shares — and distinct across runs because run ids are. Hashed so the remote learns nothing: a raw run.step would leak ULID timestamps and internal step names to every API that logs its keys, which is the good instinct behind wanting keys random. Deterministic derivation gets the opacity without the persistence, and without the crash-window a mint-then-store scheme has to defend forever.

Anything time-based or random here would be WRONG: specs re-render on every attempt, so a fresh value per attempt is precisely the duplicate-charge the mechanism exists to prevent.