diff --git a/src/open-api/__tests__/TaskRuntimeMetadata.test.ts b/src/open-api/__tests__/TaskRuntimeMetadata.test.ts
new file mode 100644
index 00000000..b01faaff
--- /dev/null
+++ b/src/open-api/__tests__/TaskRuntimeMetadata.test.ts
@@ -0,0 +1,31 @@
+import { Task } from "../generated/types.gen";
+
+// Compile-time guarantee: the generated Task type carries runtimeMetadata as an optional
+// string->string map. If the OpenAPI spec (and thus the regenerated type) drops the field, this
+// assignment fails `tsc` — the type is the real deliverable for the dynamic TS client.
+const _runtimeMetadataTypeGuard: Record<string, string> | undefined = ({} as Task).runtimeMetadata;
+void _runtimeMetadataTypeGuard;
+
+/**
+ * The server delivers host-resolved secret values on Task.runtimeMetadata (wire-only, never
+ * persisted) when a worker's TaskDef.runtimeMetadata declares secret names (conductor-oss PR #1255).
+ * Verify the generated client type carries the field as a string->string map and round-trips it.
+ */
+describe("Task.runtimeMetadata", () => {
+  it("round-trips host-resolved secret values", () => {
+    const task: Task = {
+      taskId: "t1",
+      runtimeMetadata: { GITHUB_TOKEN: "ghp_secret", GH_APP_ID: "42" },
+    };
+
+    const back = JSON.parse(JSON.stringify(task)) as Task;
+
+    expect(back.runtimeMetadata).toEqual({ GITHUB_TOKEN: "ghp_secret", GH_APP_ID: "42" });
+    expect(back.runtimeMetadata?.["GITHUB_TOKEN"]).toBe("ghp_secret");
+  });
+
+  it("is optional and omitted from the wire when absent", () => {
+    const task: Task = { taskId: "t1" };
+    expect(JSON.stringify(task)).not.toContain("runtimeMetadata");
+  });
+});
diff --git a/src/open-api/generated/types.gen.ts b/src/open-api/generated/types.gen.ts
index 44005b9c..99f65da6 100644
--- a/src/open-api/generated/types.gen.ts
+++ b/src/open-api/generated/types.gen.ts
@@ -2188,6 +2188,12 @@ export type Task = {
     outputData?: {
         [key: string]: unknown;
     };
+    /**
+     * Secret values the server resolved for this task at poll time and delivered on the wire only (never persisted). Populated when the task's TaskDef.runtimeMetadata declares secret names the host resolves from its secret store (conductor-oss PR #1255).
+     */
+    runtimeMetadata?: {
+        [key: string]: string;
+    };
     parentTaskId?: string;
     pollCount?: number;
     queueWaitTime?: number;
diff --git a/src/open-api/spec/spec.json b/src/open-api/spec/spec.json
index bb429f80..9373efae 100644
--- a/src/open-api/spec/spec.json
+++ b/src/open-api/spec/spec.json
@@ -16847,6 +16847,13 @@
               "type": "object",
               "additionalProperties": {}
             },
+            "runtimeMetadata": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Secret values the server resolved for this task at poll time and delivered on the wire only (never persisted). Populated when the task's TaskDef.runtimeMetadata declares secret names the host resolves from its secret store (conductor-oss PR #1255)."
+            },
             "parentTaskId": {
               "type": "string"
             },