diff --git a/src/VolcanicCore.Core/IConnectionProvider.cs b/src/VolcanicCore.Core/IConnectionProvider.cs
index f38e587..2e939a8 100644
--- a/src/VolcanicCore.Core/IConnectionProvider.cs
+++ b/src/VolcanicCore.Core/IConnectionProvider.cs
@@ -6,7 +6,12 @@ public interface IConnectionProvider
 {
     string Id { get; }                                    // e.g. "nats"
     string DisplayName { get; }
-    JsonSchema ConfigSchema { get; }                      // fields; mark secrets via schema convention
+    JsonSchema ConfigSchema { get; }
+
+    // Names of top-level config fields whose values must NEVER be returned to
+    // clients. SchemaSecretPolicy reads this to strip fields before serializing
+    // a connection row on GET. Match names case-insensitively.
+    IReadOnlySet<string> SecretFields { get; }
 
     Task<object> OpenAsync(JsonElement config, CancellationToken ct);
     Task CloseAsync(object handle);
diff --git a/src/VolcanicCore.Core/NodeContext.cs b/src/VolcanicCore.Core/NodeContext.cs
index 4c9ac36..1e7c2f5 100644
--- a/src/VolcanicCore.Core/NodeContext.cs
+++ b/src/VolcanicCore.Core/NodeContext.cs
@@ -8,6 +8,7 @@ namespace VolcanicCore.Core;
 public interface INodeContext
 {
     string ExecutionId { get; }
+    string WorkflowId { get; }
     string NodeId { get; }
     JsonElement Config { get; }                 // deserialize into your own DTO
     Guid? AnswerChannelId { get; }              // set when a Webhook trigger is in scope
diff --git a/src/VolcanicCore.Core/TriggerSink.cs b/src/VolcanicCore.Core/TriggerSink.cs
index 2893e5c..9153cc8 100644
--- a/src/VolcanicCore.Core/TriggerSink.cs
+++ b/src/VolcanicCore.Core/TriggerSink.cs
@@ -3,8 +3,13 @@ using System.Text.Json;
 namespace VolcanicCore.Core;
 
 // Passed to a trigger node's StartAsync. Calling EmitAsync starts one execution.
+// answerChannelId is set by webhook triggers so the executor can thread it
+// through NodeContext to the WebResponseNode. Other triggers pass null.
 public interface ITriggerSink
 {
-    Task EmitAsync(IReadOnlyList<Item> items, JsonElement? triggerData = null,
+    Task EmitAsync(
+        IReadOnlyList<Item> items,
+        JsonElement? triggerData = null,
+        Guid? answerChannelId = null,
         CancellationToken ct = default);
 }
diff --git a/tests/VolcanicCore.Tests/ConnectionProviderRegistryTests.cs b/tests/VolcanicCore.Tests/ConnectionProviderRegistryTests.cs
index 8343a9e..179a47b 100644
--- a/tests/VolcanicCore.Tests/ConnectionProviderRegistryTests.cs
+++ b/tests/VolcanicCore.Tests/ConnectionProviderRegistryTests.cs
@@ -11,6 +11,7 @@ public class ConnectionProviderRegistryTests
         public string Id => "test.provider";
         public string DisplayName => "Fake";
         public JsonSchema ConfigSchema => new(JsonDocument.Parse("{}").RootElement);
+        public IReadOnlySet<string> SecretFields => new HashSet<string>();
         public Task<object> OpenAsync(JsonElement config, CancellationToken ct) => Task.FromResult<object>(new());
         public Task CloseAsync(object handle) => Task.CompletedTask;
     }