@hotmeshio/long-tail 0.1.13 → 0.1.15

package/docs/compiler.md

@@ -0,0 +1,311 @@
+# The Workflow Compiler
+
+You wrote a durable workflow. It works. `proxyActivities`, `sleep`, `condition` — the Temporal-like API is productive and familiar. But under the hood, the durable engine replays the entire workflow function on every wake-up. Sleep three times in a ten-step workflow? Steps 1–3 replay on wake one. Steps 1–6 replay on wake two. Steps 1–9 replay on wake three. The replay is deterministic — it skips completed activities — but the function still executes from the top every time.
+
+The compiled YAML DAG does the same work without replay. Each step fires exactly once. State flows explicitly between activities through input mappings. No function re-execution, no replay loop, no wasted cycles.
+
+`ltc` is the compiler. It reads your TypeScript source and produces an equivalent YAML DAG. Write procedural because it's productive. Run the DAG because it's fast.
+
+---
+
+## The Analogy
+
+`tsc` compiles TypeScript to JavaScript. You write in the language that's expressive. You run the artifact that's efficient. The source is authoritative — you edit it, test it, review it. The compiled output is what actually executes.
+
+`ltc` does the same for workflows:
+
+```
+  TypeScript source       ltc compile        YAML DAG
+  (developer-friendly) ──────────────────→ (execution-optimized)
+
+  assembly-line.ts     →   assembly-line.compiled.yaml
+```
+
+The `.ts` file is the spec. The `.compiled.yaml` is the optimized execution. Both live in the repo. A reviewer reads both side-by-side and traces every line of orchestration logic to its DAG equivalent.
+
+---
+
+## Quick Start
+
+```bash
+npm install -g @hotmeshio/long-tail
+export ANTHROPIC_API_KEY=sk-ant-...
+
+ltc compile workflows/basic-echo/index.ts
+```
+
+Output:
+
+```
+  ✓ index.ts → workflows/basic-echo/index.compiled.yaml
+    1 activities · 2 inputs (message, sleepSeconds) · topic: basic.echo
+
+  Compiled 1 workflow in 18.1s
+```
+
+The compiled YAML appears adjacent to the source file.
+
+---
+
+## Before and After
+
+### The source (procedural)
+
+```typescript
+import { Durable } from '@hotmeshio/hotmesh';
+import * as activities from './activities';
+
+const { echo } = Durable.workflow.proxyActivities<typeof activities>({
+  activities,
+});
+
+export async function basicEcho(envelope: LTEnvelope): Promise<any> {
+  const { message = 'Hello, Long Tail!', sleepSeconds = 1 } = envelope.data;
+
+  // 1. Durable sleep — the engine replays to this point on wake-up
+  await Durable.workflow.sleep(`${sleepSeconds} seconds`);
+
+  // 2. Activity call — replayed as a no-op if already completed
+  const echoResult = await echo({ message });
+
+  return {
+    type: 'return' as const,
+    data: { ...echoResult, sleepSeconds, userId: envelope.lt?.userId },
+  };
+}
+```
+
+This function executes three times: once on initial invocation, once when the sleep timer fires, and once when the echo activity completes. Each time, the engine replays from the top, skipping completed steps. For a two-step workflow this is fine. For a twenty-step workflow with multiple sleeps, the replay cost compounds.
+
+### The compiled output (DAG)
+
+```yaml
+app:
+  id: longtail
+  version: '1'
+  graphs:
+    - subscribes: basic.echo
+      expire: 300
+      input:
+        schema:
+          type: object
+          properties:
+            message:
+              type: string
+              default: 'Hello, Long Tail!'
+            sleepSeconds:
+              type: number
+              default: 1
+      activities:
+        trigger_m7qz:
+          type: trigger
+          output:
+            schema:
+              type: object
+              properties:
+                message: { type: string }
+                sleepSeconds: { type: number }
+
+        delay_m7qz:
+          type: hook
+          sleep: '{trigger_m7qz.output.data.sleepSeconds}'
+
+        echo_m7qz:
+          type: worker
+          topic: basic.echo
+          input:
+            maps:
+              message: '{trigger_m7qz.output.data.message}'
+              workflowName: echo
+
+      transitions:
+        trigger_m7qz:
+          - to: delay_m7qz
+        delay_m7qz:
+          - to: echo_m7qz
+```
+
+### The mapping
+
+| TypeScript | YAML | What happens |
+|---|---|---|
+| `envelope.data` destructuring | `trigger` activity with input schema | Inputs declared as typed schema with defaults |
+| `Durable.workflow.sleep(N)` | `hook` activity with `sleep` field | Engine sets a timer; no replay on wake |
+| `await echo({ message })` | `worker` activity with input `maps` | Worker fires once; result stored in job hash |
+| `return { data: ... }` | `job.maps` on the final activity | Output fields plucked from activity results |
+
+Each step executes exactly once. The `sleep` hook pauses the DAG. When the timer fires, execution resumes at `echo_m7qz` — not from the top of the function.
+
+---
+
+## Discovery
+
+Point `ltc` at a directory and it finds workflow files automatically:
+
+```bash
+ltc compile examples/workflows/ --dry-run
+```
+
+```
+  Found 10 workflows:
+
+  ● assembly-line/index.ts
+    Function: assemblyLine  ·  HotMesh Durable
+    Control flow: startChild, condition
+
+  ● basic-echo/index.ts
+    Function: basicEcho  ·  HotMesh Durable
+    Activities: echo
+    Control flow: sleep
+
+  ● basic-signal/index.ts
+    Function: basicSignal  ·  HotMesh Durable
+    Activities: ltCreateEscalation, processApproval
+    Control flow: conditionLT
+
+  ● kitchen-sink/index.ts
+    Function: kitchenSink  ·  HotMesh Durable
+    Activities: greet, fetchData, transformData, notifyComplete
+    Control flow: sleep, executeLT
+```
+
+### What the scanner looks for
+
+| Pattern | Classification |
+|---|---|
+| `proxyActivities` / `Durable.workflow.proxyActivities` | HotMesh Durable workflow |
+| `@temporalio/workflow` import | Temporal workflow |
+| `sleep`, `condition`, `signal` | Control flow primitives |
+| `startChild`, `executeChild`, `executeLT` | Composition (parent workflow) |
+| Exported async function | Workflow entry point |
+
+Files in `node_modules/`, `build/`, `dist/`, and test files (`*.test.ts`, `*.spec.ts`) are excluded.
+
+---
+
+## How Compilation Works
+
+The compiler is not an AST parser. It uses the LLM to translate orchestration logic, grounded by structural metadata extracted from the source.
+
+1. **Read source** — file or inline string
+2. **Extract metadata** — lightweight regex extraction: activity names, durable primitives, envelope fields, import paths, control flow markers (loops, Promise.all, conditionals, escalation)
+3. **Resolve activities** — if the source imports activity modules, the compiler reads them too and includes them in the LLM context
+4. **LLM translation** — the source code, extracted metadata, and the full HotMesh YAML specification are sent to the LLM. Temperature 0. Up to 3 retry attempts on parse failure.
+5. **Fix patterns** — known LLM anti-patterns in YAML pipe expressions are corrected deterministically
+
+The metadata extraction is intentionally lightweight — regex, not a TypeScript AST. It gives the LLM structural hints (which functions are activities, which primitives are used) without requiring `ts-morph` or the TypeScript compiler API as a dependency.
+
+---
+
+## Composition
+
+When a workflow uses `startChild` or `executeChild`, the compiler resolves the child workflow source through imports and compiles children first (leaf-first ordering). The parent's compiled YAML references each child by topic using the `await` activity type — the same mechanism used by the Pipeline Designer's Plan Build mode.
+
+```
+parent.ts  ──→  parent.compiled.yaml
+  └─ startChild(worker)
+       └─ worker.ts  ──→  worker.compiled.yaml
+```
+
+All compiled workflows in the same composition share the same `app.id` namespace, enabling cross-graph invocation.
+
+---
+
+## Three Surfaces
+
+The compiler is the same function regardless of how you invoke it.
+
+### CLI
+
+```bash
+ltc compile workflows/assembly-line.ts
+ltc compile src/workflows/ --dry-run
+ltc compile --model claude-sonnet-4-6
+```
+
+### HTTP API
+
+```bash
+curl -X POST http://localhost:3000/api/yaml-workflows/from-durable \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "source": "export async function basicEcho(envelope) { ... }",
+    "workflow_name": "basicEcho",
+    "name": "basic_echo"
+  }'
+```
+
+### SDK
+
+```typescript
+import { createClient } from '@hotmeshio/long-tail/sdk';
+
+const lt = createClient({ auth: { userId: 'system' } });
+
+const result = await lt.yamlWorkflows.compileDurable({
+  source: fs.readFileSync('workflows/assembly-line.ts', 'utf-8'),
+  workflow_name: 'assemblyLine',
+  name: 'assembly_line',
+});
+```
+
+The CLI writes `.compiled.yaml` files to disk. The HTTP and SDK surfaces store the compiled workflow in the database and return the record. All three use the same underlying `compileDurableToYaml()` function.
+
+---
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `ANTHROPIC_API_KEY` | — | Required for Claude models |
+| `OPENAI_API_KEY` | — | Required for OpenAI models |
+| `LT_LLM_MODEL_PRIMARY` | `claude-sonnet-4-6` | Model used for compilation |
+| `LT_LLM_BASE_URL` | — | Custom endpoint for OpenAI-compatible models |
+
+The CLI loads `.env` automatically if present in the current directory.
+
+---
+
+## CLI Reference
+
+```
+Usage: ltc compile [options] [target]
+
+Compile durable TypeScript workflows to YAML DAGs
+
+Arguments:
+  target                  File or directory to compile (default: current directory)
+
+Options:
+  --dry-run               Show discovered workflows without compiling
+  -o, --output <dir>      Output directory (default: adjacent to source file)
+  --model <model>         LLM model to use (default: claude-sonnet-4-6)
+  --function <name>       Workflow function name (auto-detected if omitted)
+  -h, --help              Display help
+```
+
+### Examples
+
+```bash
+# Compile a single file
+ltc compile workflows/basic-echo/index.ts
+
+# Scan and compile all workflows in a directory
+ltc compile src/workflows/
+
+# Compile everything in the current directory
+ltc compile
+
+# Preview what would be compiled
+ltc compile examples/workflows/ --dry-run
+
+# Use a specific model
+ltc compile workflows/complex.ts --model claude-opus-4-6
+
+# Write output to a separate directory
+ltc compile workflows/ -o compiled/
+
+# Compile a specific function from a multi-export file
+ltc compile workflows/multi.ts --function assemblyLine
+```

package/docs/events.md

@@ -26,6 +26,25 @@ await start({
 
 `start()` handles adapter connection and graceful disconnection on shutdown automatically.
 
+## Dashboard Transport Selection
+
+The dashboard auto-detects its event transport via `GET /api/settings`. By default, Socket.IO is reported — it works in-process with no additional infrastructure.
+
+For multi-container deployments where the API and workers run as separate processes, set `EVENT_TRANSPORT=nats` to tell the dashboard to connect via NATS WebSocket instead of Socket.IO:
+
+```yaml
+# docker-compose.yml
+services:
+  app:
+    environment:
+      - EVENT_TRANSPORT=nats
+      - NATS_URL=nats://nats:4222
+      - NATS_WS_URL=ws://localhost:9222
+      - NATS_TOKEN=your-token
+```
+
+Both adapters still publish events regardless of `EVENT_TRANSPORT` — the setting only controls what the dashboard listens on. This means server-side event consumers (callbacks, NATS subscribers) work independently of the dashboard transport.
+
 ## LTEvent
 
 Every published event conforms to the `LTEvent` interface:

package/docs/schema-exchange.md

@@ -0,0 +1,173 @@
+# Surfacing Any API
+
+## The Gap Between Plumbing and Domain
+
+Long Tail ships with built-in MCP servers. Browser automation for navigating web interfaces. File storage for persisting artifacts. Vision for analyzing images. Knowledge for accumulating structured state. An admin server for the platform to look inward — list its own workflows, manage its own configuration, query its own execution history.
+
+These are plumbing. They solve cross-cutting problems that every deployment shares. But they don't know anything about your domain. They don't know what Epic's FHIR API returns for a `ServiceRequest` resource. They don't know the shape of Stripe's charge response. They don't know that your internal inventory service returns `{ items: [...], cursor: string }` and paginates with cursor-based tokens.
+
+Traditionally, closing this gap meant writing an MCP server. Define the tools. Map each one to an API call. Handle serialization, error cases, pagination. Register the server. Tag it. Write compile hints so the builder knows how to wire it. A week of engineering per external service.
+
+The schema-exchange primitive eliminates that week.
+
+---
+
+## The Principle: Endpoint + Schema
+
+The `exchange` tool doesn't know HTTP from Playwright. It knows three things: where to send data, what the data should look like going out, and what it should look like coming back.
+
+```
+endpoint:        where
+request_schema:  what leaves
+response_schema: what returns
+```
+
+Transport is an implementation detail. Today it's Node.js `fetch`. Tomorrow it could be a browser automation step that fills a form, submits, and scrapes the result. Or a gRPC call. Or a SOAP envelope. The consumer doesn't know and doesn't care.
+
+What the consumer gets is a contract. The request is validated before it leaves the system. The response is validated when it arrives. If either validation fails, the failure is structural and specific — "the response is missing the `resourceType` field" — not a vague 500 error three layers deep.
+
+This is the difference between a fetch call and a schema-driven exchange. A fetch call succeeds or fails. An exchange succeeds, fails, or *detects drift* — the call succeeded but the shape changed. That third state is what makes API integrations maintainable over time.
+
+---
+
+## From Spec to Toolset
+
+Open the Pipeline Designer. Choose Build mode. Paste:
+
+```
+Stripe Charges API (base: https://api.stripe.com/v1)
+
+POST /charges
+  Headers: Authorization: Bearer {api_key}
+  Request: { amount: number, currency: string, source: string, description?: string }
+  Response: { id: string, amount: number, currency: string, status: string, created: number }
+
+GET /charges/{id}
+  Headers: Authorization: Bearer {api_key}
+  Response: { id: string, amount: number, currency: string, status: string, created: number }
+```
+
+The planner decomposes this into two leaf tools. The builder discovers the `exchange` tool in its inventory, reads the compile hints, and constructs each workflow:
+
+- **`create_charge`** — trigger accepts `api_key`, `amount`, `currency`, `source`. Worker calls `exchange` with the request schema embedded as a static value. Response schema validates the charge object. If Stripe changes the response shape, `validated` flips to `false` and the error names the exact field that changed.
+
+- **`get_charge`** — trigger accepts `api_key`, `charge_id`. Worker calls `exchange` with the charge ID interpolated into the URL. Response schema validates the same shape.
+
+Both deploy under a server namespace: `stripe`. They're compiled, versioned, invocable. They have typed inputs and outputs. They compose into larger workflows — a refund pipeline, an invoicing process, a reconciliation job.
+
+The engineer didn't write an MCP server. They didn't write any code. They pasted two endpoint descriptions and got two schema-validated tools that will catch API drift the moment Stripe changes a field.
+
+---
+
+## Schema Drift: The Silent Killer
+
+APIs change. Fields get renamed. Required properties appear. Types shift from strings to objects. These changes are rarely announced in time, rarely caught by tests that don't run against live endpoints, and rarely surfaced until a downstream consumer produces wrong results.
+
+The response schema embedded in each compiled tool is a contract. It doesn't enforce — it detects. When the contract breaks, the tool reports exactly what changed:
+
+```
+response: (root): must have required property 'source' ({"missingProperty":"source"})
+```
+
+Not "API error." Not "unexpected response." The structural diff, in human-readable text, identifying the exact field.
+
+Schedule the tool on cron against a staging or dev endpoint. Every midnight, it calls the API and validates the response. If the schema matches, nothing happens. If it doesn't, the system knows before production does. The team fixes the tool, updates the schema, redeploys. No customer impact.
+
+This is what makes compiled API tools self-maintaining. The schema is both the integration logic and the regression test. They're the same artifact.
+
+---
+
+## The Request Gate
+
+Schema enforcement works in both directions. The request schema validates outbound data before it leaves the system. If a caller passes `{ amount: "fifty" }` to `create_charge`, the exchange tool rejects it immediately:
+
+```
+request: /amount: must be number ({"type":"number"})
+```
+
+The request never hits Stripe. The error is instant, specific, and local. No network round-trip. No API rate limit consumed. No partial state created on the remote service.
+
+This matters in compiled workflows where one tool's output feeds another's input. A data-mapping error in step 3 of a 7-step pipeline is caught at step 3, not when Stripe returns a 400 in step 5. The failure is close to the cause.
+
+---
+
+## Growing a Toolset
+
+The Pipeline Designer organizes tools into sets — collections of related tools that share a namespace and evolve together. You start with two Stripe endpoints. Next week you add `list_charges` and `create_refund`. The following month, `get_balance` and `list_payouts`.
+
+Each addition goes through the same flow: paste the spec, the planner builds the tool, it deploys into the existing namespace. The server version increments. All tools in the namespace are redeployed together. Active workflows don't stop — the new version activates atomically.
+
+The set is the workbench. It preserves the full specification history — every endpoint description that was pasted, in order. It's the source of truth for what the toolset covers and how it evolved.
+
+Over time, the set becomes a complete API surface. Not hand-written bindings. Not auto-generated client code that drifts from the spec. Compiled tools with embedded schemas that validate on every call.
+
+---
+
+## Composition: Tools Built From Tools
+
+Individual API tools are building blocks. A compiled tool that calls `create_charge` can be composed with one that calls `get_customer` and one that calls `send_receipt`. The composition is itself a compiled tool — a pipeline that executes the three steps in sequence, wiring the charge ID from step 1 to the receipt in step 3.
+
+The schema exchange is invisible at the composition level. The composer sees tools with typed inputs and outputs. It doesn't know — or need to know — that these tools validate their data against schemas before every call. The validation is infrastructure, not application logic.
+
+This is where the Epic story begins. The FHIR endpoints are individual tools — `get_patient`, `search_coverage`, `create_task`. Each validates its request and response. Linda's intake process composes them into a pipeline that encodes her institutional knowledge: which checks to run, in what order, with what branching logic. The individual tools handle the API contract. The composition handles the business process. Neither knows about the other's concerns.
+
+---
+
+## What This Replaces
+
+Without schema-driven exchange, wrapping an external API requires:
+
+1. Writing an MCP server (TypeScript, tool definitions, error handling)
+2. Registering it with the platform
+3. Writing compile hints so the builder knows how to use it
+4. Maintaining it when the API changes
+5. Repeating for every external service
+
+With schema-driven exchange, wrapping an external API requires:
+
+1. Pasting the endpoint specs into the Pipeline Designer
+
+The MCP server is the `exchange` tool. The compile hints are on the `exchange` tool. The schema validation is in the `exchange` tool. The only thing that changes per API is the spec the engineer pastes — the endpoints, the schemas, the auth pattern.
+
+This is what makes the Epic story practical. The engineering team doesn't spend a week writing a FHIR MCP server. They paste the endpoint descriptions and get compiled tools that speak FHIR with schema enforcement. The week they would have spent on plumbing is spent with Linda instead, capturing the institutional knowledge that makes the tools valuable.
+
+---
+
+## The Reflexive Case
+
+Long Tail wraps its own API using the same primitive. The platform's REST endpoints — login, list servers, list workflows — are compiled tools in the `longtailapi` namespace. They validate their own response shapes. They detect drift in their own API surface.
+
+This isn't a special case. It's a proof point. The same `exchange` tool that wraps Epic's FHIR server wraps Long Tail's own REST API. The same schema enforcement that catches Stripe's field changes catches Long Tail's own field changes. The platform doesn't have a privileged self-knowledge path. It discovers its own capabilities the same way it discovers any external service — through endpoints and schemas.
+
+The admin server (`long-tail-admin`) still exists for operations that require internal access — managing workflows, modifying configuration, operations that go beyond data exchange. But for anything that's "call an endpoint, validate the response, return the data" — the schema exchange primitive is the universal answer. Internal or external. FHIR or REST. Stripe or self.
+
+---
+
+## Identity: The Third Pillar
+
+Endpoint and schema handle the data contract. The third pillar — identity — handles who's calling.
+
+The `exchange` tool accepts an optional `credential_provider` field. When set, the tool resolves authentication from the platform's connection store using the calling principal's identity. No token input. No manual header wiring. No `get_access_token` step in the workflow.
+
+```
+credential_provider: "stripe"
+```
+
+That single field means: look up the calling user's Stripe credentials from the encrypted connection store, auto-refresh if expired, inject into the request headers. The credential never appears in the workflow state, the execution trace, or the YAML. It's resolved at the last mile — inside the tool execution, after the HotMesh event log has already been written.
+
+This is how the Epic story works in practice. The engineering team registers their SMART on FHIR credentials as a connection. Every compiled FHIR tool specifies `credential_provider: "epic"`. When the tool runs for Customer A, it gets Customer A's token. When it runs for Customer B, it gets Customer B's. Same compiled tool. Different identities. The routing is invisible.
+
+Three auth patterns, one tool:
+- **credential_provider** — resolve from the connection store. Fresh token, auto-refresh, per-principal. The default for production.
+- **Ephemeral references** — opaque `eph:v1:*` strings in headers, exchanged at the last mile. For workflows that need human-provided credentials with TTL.
+- **Raw headers** — pass `Authorization: Bearer {token}` directly. For testing, one-off calls, or systems where the caller manages tokens externally.
+
+---
+
+## What Remains
+
+The schema-exchange tool is plumbing. It doesn't know about healthcare or payments or logistics. It knows about endpoints, schemas, identity, and whether the data matched.
+
+Everything above it — the domain knowledge, the business logic, the institutional expertise — comes from the people who use it. Linda's referral intake rules. Maria's document requirements. The Stripe integration team's charge flow. The ops team's self-monitoring pipeline.
+
+The platform's job is to make that knowledge executable, composable, and self-testing. The schema exchange is the foundation layer — endpoint, schema, identity. The three pillars that make "paste an API spec, get a validated tool with automatic auth" possible. Everything else builds on top of it. The tools are the building. The exchange is the foundation.

package/docs/self-test.md

@@ -0,0 +1,106 @@
+# The Self-Test: Long Tail Wraps Its Own API
+
+## The Tool That Wanted to Extend Itself
+
+Long Tail ships with a schema-exchange tool — a baseline capability for exchanging data with any external service under schema enforcement. The tool validates requests before sending and responses after receiving. It doesn't know HTTP from Playwright. It knows endpoints, schemas, and whether the data matched.
+
+This is the story of what happened when someone pointed that tool at Long Tail's own API.
+
+---
+
+## The Starting Point
+
+Long Tail has a REST API. It has endpoints for authentication, for listing registered MCP servers, for querying compiled workflows. Every deployment uses these endpoints — the dashboard calls them, integrations call them, crons call them.
+
+But nobody had ever formalized what those endpoints return. The shapes were implicit — TypeScript interfaces in the codebase, but nothing the runtime could assert against. If a deployment changed a response shape, you found out when the dashboard broke. Or when a customer's integration broke. Or, worst case, you didn't find out at all because the consumer silently swallowed the new shape and produced wrong results downstream.
+
+The schema-exchange tool exists precisely for this problem. It doesn't care whether the endpoint is Epic's FHIR server or Long Tail's own API. The principle is the same: endpoint + schema + validated exchange.
+
+---
+
+## Wrapping the API
+
+An engineer opens Plan Mode in the dashboard and pastes three endpoint specifications:
+
+```
+Long Tail API (base: http://localhost:3000/api)
+
+POST /auth/login
+  Request: { username: string, password: string }
+  Response: { token: string, user: { id: string, external_id: string, display_name: string, roles: [{ role: string, type: string }] } }
+
+GET /mcp/servers (requires Bearer token)
+  Response: { servers: [{ id: string, name: string, description: string, tags: string[], status: string, tool_manifest: [{ name: string, description: string }] }] }
+
+GET /yaml-workflows (requires Bearer token)
+  Response: { workflows: [{ id: string, name: string, app_id: string, status: string, graph_topic: string, tags: string[] }], total: number }
+```
+
+The planner decomposes this into three leaf workflows. The builder discovers the `exchange` tool in the inventory, reads the compile hints, and constructs each workflow as a trigger → exchange → output DAG with embedded schemas.
+
+All three deploy under a server namespace: `longtailapi`.
+
+---
+
+## What the Compiled Tools Do
+
+**`login`** — Takes a username and password. Validates the request body (both strings, both required) against the request schema before sending. Calls POST /auth/login. Validates the response (must have `token` string and `user` object with required fields). Returns the token and user profile.
+
+If someone changes the login response — adds a field, removes `display_name`, changes `roles` from an array to a string — the schema validation catches it. `validated: false`, with a human-readable error explaining exactly what changed.
+
+**`list_servers`** — Takes a bearer token. Calls GET /mcp/servers. Validates the response (must be an object with a `servers` array, each server must have `id`, `name`, `tags`). Returns the server list.
+
+This tool can answer the question: "does the schema-exchange server exist?" If `long-tail-schema-exchange` isn't in the returned list, the tool that's asking the question knows its own infrastructure is broken. The snake eating its own tail.
+
+**`list_workflows`** — Takes a bearer token. Calls GET /yaml-workflows. Validates the response (must be an object with `workflows` array and `total` number). Returns the compiled tool inventory.
+
+This tool can check whether the `longtailapi` tools themselves are deployed and active. It can verify that the very workflows it belongs to are in the list. Self-referential validation — the compiled tool confirms its own existence.
+
+---
+
+## The Composition: Self-Health-Check
+
+The three leaf tools compose into a single workflow: `self_health_check`.
+
+1. **Login** — authenticate with a service account
+2. **List servers** — verify all expected MCP servers are registered
+3. **List workflows** — verify all expected compiled tools are deployed
+
+Each step validates its response schema. If any step fails validation, the workflow knows exactly what changed — not "the API is down" but "the `servers` response is missing the `tags` field on server objects."
+
+Schedule it on cron. Every midnight, the platform checks its own API surface against the schemas it captured when the tools were compiled. Schema drift is caught within 24 hours, automatically, without a human looking at anything.
+
+---
+
+## Why This Matters
+
+This isn't a testing framework. It's the same schema-exchange primitive that wraps Epic's FHIR endpoints or Stripe's payment API or any other external service. The fact that it can wrap Long Tail's own API is a proof point, not a special case.
+
+The proof point is:
+
+1. **Any API surface can be formalized as compiled tools.** Paste the endpoint specs. Get schema-validated, cron-testable tools. No MCP server to hand-write. No integration code. The schema is the integration.
+
+2. **Schema drift detection is automatic.** The response_schema embedded in each compiled tool is the contract. When the contract breaks, the tool reports exactly what changed. Not "500 error" — the actual structural diff.
+
+3. **The tools compose.** Login → use token → check servers → check workflows. Each step is independently testable, independently schedulable, independently versionable. But together they form a health check that validates the entire platform surface.
+
+4. **The platform can extend itself.** The schema-exchange tool is a baseline capability. The compiled API tools are built from it. The health check composes them. Every layer uses the same machinery. New endpoints are absorbed the same way — paste, compile, deploy, schedule.
+
+This is the starting point the Epic story describes: "The engineering team registers a custom MCP server that wraps the FHIR endpoints their referral workflows need." Except here, the engineering team is us, the FHIR endpoints are our own API, and the custom MCP server assembled itself from pasted specs and a schema-exchange primitive.
+
+The SOPs come next. But the plumbing works.
+
+---
+
+## The Integration Test
+
+The file `tests/integration/schema-exchange.test.ts` proves this end-to-end:
+
+1. Calls `exchange` to login (POST /auth/login with request + response schema)
+2. Calls `exchange` to list servers (GET /mcp/servers with response schema)
+3. Asserts the schema-exchange server exists in the response
+4. Calls `exchange` to list workflows (GET /yaml-workflows with response schema)
+5. Deliberately uses a wrong schema to prove drift detection
+6. Deliberately sends a malformed request to prove pre-send rejection
+
+If any assertion fails, the schema-exchange tool isn't doing its job. If they all pass, the platform can wrap any API — including its own.

package/docs/workflows.md

@@ -693,3 +693,22 @@ OPENAI_API_KEY=sk-... npm run test:vision
 # Full backend suite
 npm test
 ```
+
+---
+
+## From Durable to DAG
+
+Every durable workflow you write is a candidate for compilation. The `ltc` CLI reads your workflow source and produces an equivalent YAML DAG that runs without replay overhead.
+
+```bash
+ltc compile workflows/my-workflow.ts
+```
+
+The durable code is the spec — developer-friendly, familiar, testable with standard tools. The compiled YAML is the optimized execution path — each step fires exactly once, state is plucked explicitly from upstream activities, no replay loop.
+
+```
+  my-workflow.ts              →  my-workflow.compiled.yaml
+  (write and test here)           (deploy and run this)
+```
+
+Write procedural because it's productive. Compile because it's fast. See the [Compiler Guide](compiler.md) for details.