@stigmer/cli 3.12.3 → 3.12.5

package/src/commands/seedpack.ts

@@ -3,7 +3,10 @@
 // The seedpack (system agents, skills, MCP servers, workflows under the
 // "stigmer" org) is applied automatically on `stigmer up` in local mode; these
 // commands bootstrap it explicitly against whatever backend is configured
-// (local or cloud). Apply is idempotent via a content-hash marker.
+// (local or cloud). Apply is content-hash idempotent: in cloud mode the truth
+// is the stigmer.ai/seedpack-hash label on the server's seedpack Project (any
+// machine sees the same applied state — cloud#429); in local mode it is a
+// marker file in the data dir, which lives and dies with the local backend.
 //
 // Heavy modules load lazily inside the action so `--help` stays fast (DD-001).
 
@@ -50,7 +53,11 @@ async function runApply(flags: ApplyFlags): Promise<void> {
       info: (line) => process.stderr.write(`${line}\n`),
       warn: (line) => process.stderr.write(`${line}\n`),
     },
-    { markerDir: markerDir(), force: flags.force === true },
+    {
+      markerDir: markerDir(),
+      force: flags.force === true,
+      useServerHash: isCloudMode(load()),
+    },
   );
 
   const label = backendLabel();
@@ -61,11 +68,26 @@ async function runApply(flags: ApplyFlags): Promise<void> {
 }
 
 async function runStatus(flags: OutputFlags): Promise<void> {
-  const { seedpackContentHash } = await import("../local/seedpack/apply.js");
+  const { readServerSeedpackHash, resolveSeedpackOrg, seedpackContentHash } = await import("../local/seedpack/apply.js");
   const { readMarker } = await import("../local/seedpack/content.js");
 
   const hash = seedpackContentHash();
-  const stored = readMarker(markerDir());
+
+  // Cloud mode asks the server (the label on the seedpack Project) so status
+  // is truthful from ANY machine, not just the one that last ran apply.
+  let stored: string | null;
+  let storedLabel: string;
+  if (isCloudMode(load())) {
+    const { connectBackend } = await import("../backend.js");
+    const { ensureAuthenticated } = await import("../config/index.js");
+    const client = connectBackend();
+    ensureAuthenticated(client.config);
+    stored = await readServerSeedpackHash(client.stigmer, resolveSeedpackOrg());
+    storedLabel = "Applied Hash (server)";
+  } else {
+    stored = readMarker(markerDir());
+    storedLabel = "Applied Hash";
+  }
 
   const result = CommandResult.success("Seedpack status");
   const section = result.addSection("");
@@ -74,7 +96,7 @@ async function runStatus(flags: OutputFlags): Promise<void> {
   if (stored === null) {
     section.field("Status", "Not applied (run 'stigmer seedpack apply')");
   } else {
-    section.field("Applied Hash", stored);
+    section.field(storedLabel, stored);
     section.field("Status", stored === hash ? "Up to date" : "Outdated (run 'stigmer seedpack apply' to update)");
   }
   renderResult(result, resultFormat(flags));

package/src/local/seedpack/apply.test.ts

@@ -1,11 +1,19 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Message } from "@bufbuild/protobuf";
+import type { Stigmer } from "@stigmer/sdk";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { buildDeclarativeItems, scanResourceFiles } from "../../resources/apply/declarative.js";
 import type { ControllerFn } from "../../resources/apply/handlers.js";
-import { applySeedpack, resolveSeedpackOrg, seedpackContentHash } from "./apply.js";
+import {
+  applySeedpack,
+  readServerSeedpackHash,
+  resolveSeedpackOrg,
+  SEEDPACK_HASH_LABEL,
+  SEEDPACK_PROJECT_SLUG,
+  seedpackContentHash,
+} from "./apply.js";
 import type { SeedpackContent } from "./content.js";
 import { extractSeedpack, readMarker, resolveSeedpackContent } from "./content.js";
 
@@ -43,27 +51,43 @@ function makeContent(): SeedpackContent {
   return { dir, source: "repo" };
 }
 
-// Records each applied message's proto type name; every controller resolves to
-// the same stub apply (the handlers only call `.apply`).
-function recordingDeps() {
+// Records each applied message (and its proto type name); every controller
+// resolves to the same stub apply (the handlers only call `.apply`).
+function recordingDeps(stigmer?: unknown) {
   const applied: string[] = [];
+  const appliedMessages: Message[] = [];
   const controller = (() => ({
     apply: async (m: Message) => {
       applied.push((m as { $typeName: string }).$typeName);
+      appliedMessages.push(m);
       return m;
     },
   })) as unknown as ControllerFn;
   return {
     applied,
+    appliedMessages,
     deps: {
       controller,
-      stigmer: {} as never,
+      stigmer: (stigmer ?? {}) as never,
       info: () => {},
       warn: () => {},
     },
   };
 }
 
+// A Stigmer stub whose project.getByReference reports the given stored hash
+// (null → the label is absent; "absent" → the project itself does not exist).
+function stigmerWithServerHash(stored: string | null | "absent"): Stigmer {
+  return {
+    project: {
+      getByReference: async () => {
+        if (stored === "absent") throw new Error("not found");
+        return { metadata: { labels: stored === null ? {} : { [SEEDPACK_HASH_LABEL]: stored } } };
+      },
+    },
+  } as unknown as Stigmer;
+}
+
 let content: SeedpackContent;
 let markerDir: string;
 beforeEach(() => {
@@ -125,6 +149,91 @@ describe("applySeedpack", () => {
     expect(result.applied).toBe(true);
     expect(forced.applied.length).toBeGreaterThan(0);
   });
+
+  it("stamps the content hash as a reserved label on the applied Project", async () => {
+    const { appliedMessages, deps } = recordingDeps();
+    const result = await applySeedpack(deps, { markerDir, content });
+
+    const project = appliedMessages.find((m) => (m as { $typeName: string }).$typeName.endsWith("Project")) as
+      | { metadata?: { labels: Record<string, string> } }
+      | undefined;
+    expect(project).toBeDefined();
+    expect(project?.metadata?.labels[SEEDPACK_HASH_LABEL]).toBe(result.hash);
+  });
+});
+
+describe("applySeedpack — cloud mode (useServerHash)", () => {
+  it("skips when the server's recorded hash matches, without touching the marker", async () => {
+    const hash = seedpackContentHash({ content });
+    const { applied, deps } = recordingDeps(stigmerWithServerHash(hash));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
+
+    expect(result.applied).toBe(false);
+    expect(applied).toHaveLength(0);
+    expect(readMarker(markerDir)).toBeNull();
+  });
+
+  it("applies when the server records a different hash — and never writes the marker", async () => {
+    const { applied, deps } = recordingDeps(stigmerWithServerHash("sha256:0000000000000000"));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
+
+    expect(result.applied).toBe(true);
+    expect(applied.length).toBeGreaterThan(0);
+    // Cloud mode's record is the Project label; a marker here would be a
+    // second record of the same fact, free to drift.
+    expect(readMarker(markerDir)).toBeNull();
+  });
+
+  it("applies when the seedpack Project does not exist yet (first bootstrap)", async () => {
+    const { applied, deps } = recordingDeps(stigmerWithServerHash("absent"));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
+
+    expect(result.applied).toBe(true);
+    expect(applied.length).toBeGreaterThan(0);
+  });
+
+  it("ignores a stale local marker: the server is the only truth consulted", async () => {
+    const hash = seedpackContentHash({ content });
+    // A leftover marker from the pre-cloud#429 era says "up to date"…
+    const { deps: first } = recordingDeps();
+    await applySeedpack(first, { markerDir, content });
+    // …but the server has never seen this content.
+    const { applied, deps } = recordingDeps(stigmerWithServerHash(null));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
+
+    expect(result.applied).toBe(true);
+    expect(applied.length).toBeGreaterThan(0);
+    expect(hash).toBe(result.hash);
+  });
+
+  it("re-applies when forced even if the server hash matches", async () => {
+    const hash = seedpackContentHash({ content });
+    const { applied, deps } = recordingDeps(stigmerWithServerHash(hash));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true, force: true });
+
+    expect(result.applied).toBe(true);
+    expect(applied.length).toBeGreaterThan(0);
+  });
+});
+
+describe("readServerSeedpackHash", () => {
+  it("returns the recorded label", async () => {
+    const hash = await readServerSeedpackHash(stigmerWithServerHash("sha256:abcdef0123456789"), "stigmer");
+    expect(hash).toBe("sha256:abcdef0123456789");
+  });
+
+  it("returns null when the label is absent", async () => {
+    expect(await readServerSeedpackHash(stigmerWithServerHash(null), "stigmer")).toBeNull();
+  });
+
+  it("returns null when the project cannot be read (never applied / transient failure)", async () => {
+    expect(await readServerSeedpackHash(stigmerWithServerHash("absent"), "stigmer")).toBeNull();
+  });
 });
 
 describe("seedpackContentHash", () => {
@@ -139,6 +248,18 @@ describe("seedpackContentHash", () => {
 // CI canary manifest) must live outside the content set, never beside the
 // McpServer YAMLs where `loadDocuments(strict)` would reject it for missing a
 // `kind`. The synthetic fixtures above can't catch this — only real content can.
+// The cloud-mode hash read addresses the seedpack Project by a pinned slug.
+// The server derives the slug from the manifest's metadata.name, so this pin
+// holds exactly as long as the real seedpack keeps that name — verify against
+// the real content so a rename there fails here, not silently in prod.
+describe("SEEDPACK_PROJECT_SLUG pins the real manifest name", () => {
+  it("matches seedpack/stigmer.yaml metadata.name", () => {
+    const real = resolveSeedpackContent();
+    const manifest = readFileSync(join(real.dir, "stigmer.yaml"), "utf8");
+    expect(manifest).toMatch(new RegExp(`name:\\s*${SEEDPACK_PROJECT_SLUG}\\s*$`, "m"));
+  });
+});
+
 describe("real seedpack content loads through the declarative scanner", () => {
   it("scans + builds apply items without a missing-kind error", () => {
     const real = resolveSeedpackContent();

package/src/local/seedpack/apply.ts

@@ -10,11 +10,18 @@
 //   2. the project (stigmer.yaml + agents/skills/mcp-servers/workflows) via the
 //      declarative reconciler, under the target org.
 //
-// Idempotent: a content-hash marker skips the apply when nothing changed.
+// Idempotent, with the applied-hash truth living with the backend it describes
+// (cloud#429): every apply stamps the content hash as a reserved label on the
+// seedpack Project, and cloud-mode runs skip by reading that label back — so
+// any machine (operator laptop, CI) sees the same applied state. Local mode
+// keeps the original marker file (the local data dir lives and dies with the
+// local backend, so a local file IS backend-scoped state there).
 
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import type { Stigmer } from "@stigmer/sdk";
 import { applyItem, resolveApplyItems } from "../../resources/apply/apply.js";
 import { applyDeclarative, detectTrack } from "../../resources/apply/declarative.js";
@@ -31,6 +38,23 @@ import {
 const DEFAULT_ORG = "stigmer";
 const ORG_ENV_VAR = "STIGMER_SEEDPACK_ORG";
 
+/**
+ * Reserved label on the seedpack Project recording the last applied content
+ * hash (cloud#429). Writing a NEW value requires `can_write_reserved_labels`
+ * (the seeding identity's capability); re-sending an unchanged value is an
+ * echo the cloud guard passes for any caller — so re-applies of identical
+ * content are never treated as reserved-label writes.
+ */
+export const SEEDPACK_HASH_LABEL = "stigmer.ai/seedpack-hash";
+
+/**
+ * The seedpack Project's slug. The server derives it from the manifest's
+ * `metadata.name` in `seedpack/stigmer.yaml` — "stigmer-seedpack" is already
+ * slug-shaped, so name and slug coincide. Pinned by a test against the real
+ * content so a rename there fails loudly here.
+ */
+export const SEEDPACK_PROJECT_SLUG = "stigmer-seedpack";
+
 export interface SeedpackApplyDeps {
   /** Raw command-controller accessor (full-proto apply, preserves metadata.id). */
   readonly controller: ControllerFn;
@@ -43,7 +67,7 @@ export interface SeedpackApplyDeps {
 }
 
 export interface SeedpackApplyOptions {
-  /** Directory holding the idempotency marker (data dir for local, config dir for cloud). */
+  /** Directory holding the idempotency marker (local mode only). */
   readonly markerDir: string;
   /** Target org slug. Defaults to STIGMER_SEEDPACK_ORG, then "stigmer". */
   readonly org?: string;
@@ -52,6 +76,13 @@ export interface SeedpackApplyOptions {
   /** Pre-resolved content (injectable for tests); resolved on demand otherwise. */
   readonly content?: SeedpackContent;
   readonly home?: string;
+  /**
+   * Cloud mode: the idempotency truth is the {@link SEEDPACK_HASH_LABEL} on the
+   * server's seedpack Project, read via {@link readServerSeedpackHash} — the
+   * local marker is neither read nor written, so a stateless machine (CI, a
+   * second operator laptop) still skips unchanged content correctly.
+   */
+  readonly useServerHash?: boolean;
 }
 
 export interface SeedpackApplyResult {
@@ -77,17 +108,35 @@ export function seedpackContentHash(opts: Pick<SeedpackApplyOptions, "content" |
   return hashSeedpackContent(content.dir);
 }
 
+/**
+ * Read the applied content hash recorded on the backend's seedpack Project,
+ * or null when it cannot be proven (project absent — never applied — or the
+ * read failed). Null means "apply": the apply itself is idempotent server-side,
+ * so an unprovable state costs one redundant pass, never a skipped update.
+ */
+export async function readServerSeedpackHash(stigmer: Stigmer, org: string): Promise<string | null> {
+  try {
+    const project = await stigmer.project.getByReference({ org, slug: SEEDPACK_PROJECT_SLUG });
+    return project.metadata?.labels?.[SEEDPACK_HASH_LABEL] ?? null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Apply the seedpack to the backend the deps connect to. Returns `applied:false`
- * (without touching the backend) when the marker already matches the content
- * hash and `force` is not set.
+ * (without touching the backend beyond the cloud-mode hash read) when the
+ * recorded hash already matches the content hash and `force` is not set.
  */
 export async function applySeedpack(deps: SeedpackApplyDeps, opts: SeedpackApplyOptions): Promise<SeedpackApplyResult> {
   const org = resolveSeedpackOrg(opts.org);
   const content = opts.content ?? resolveSeedpackContent({ home: opts.home });
   const hash = hashSeedpackContent(content.dir);
 
-  if (opts.force !== true && readMarker(opts.markerDir) === hash) {
+  const appliedHash = opts.useServerHash === true
+    ? await readServerSeedpackHash(deps.stigmer, org)
+    : readMarker(opts.markerDir);
+  if (opts.force !== true && appliedHash === hash) {
     return { applied: false, hash, org };
   }
 
@@ -96,8 +145,12 @@ export async function applySeedpack(deps: SeedpackApplyDeps, opts: SeedpackApply
   try {
     extractSeedpack(content.dir, stage);
     await applyOrganizations(deps, stage);
-    await applyProject(deps, stage, org);
-    writeMarker(opts.markerDir, hash);
+    await applyProject(deps, stage, org, hash);
+    // The Project label written above is the cloud-mode record; the marker
+    // stays the local-mode one. Never both — two records of one fact drift.
+    if (opts.useServerHash !== true) {
+      writeMarker(opts.markerDir, hash);
+    }
   } finally {
     rmSync(stage, { recursive: true, force: true });
   }
@@ -124,11 +177,18 @@ async function applyOrganizations(deps: SeedpackApplyDeps, stageDir: string): Pr
 
 // Phase 2: the project (agents, skills, MCP servers, workflows) via the shared
 // declarative reconciler — the same path `stigmer apply` runs for a user project.
-async function applyProject(deps: SeedpackApplyDeps, stageDir: string, org: string): Promise<void> {
+//
+// The content hash is stamped as a reserved label on the Project HERE, in the
+// seedpack path only — general `stigmer apply` never writes reserved labels.
+// The stamp rides the project apply that happens anyway, so recording the hash
+// costs no extra RPC and can never succeed while the apply failed.
+async function applyProject(deps: SeedpackApplyDeps, stageDir: string, org: string, contentHash: string): Promise<void> {
   const detect = detectTrack(stageDir);
-  if (detect.track !== "declarative") {
+  if (detect.track !== "declarative" || detect.project === undefined) {
     throw new Error(`seedpack is not a declarative project (detected '${detect.track}')`);
   }
+  detect.project.metadata ??= create(ApiResourceMetadataSchema, {});
+  detect.project.metadata.labels[SEEDPACK_HASH_LABEL] = contentHash;
   await applyDeclarative(detect, {
     controller: deps.controller,
     stigmer: deps.stigmer,

package/src/registry/registry.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, it } from "vitest";
 import { APPLY_HANDLERS } from "../resources/apply/handlers.js";
 import { DELETE_HANDLERS } from "../resources/delete.js";
 import { GET_BINDINGS } from "../resources/get-bindings.js";
+import { isExecutionAlias } from "../resources/execution.js";
 import { LIST_HANDLERS, SEARCH_KINDS } from "../resources/list.js";
 import { VALIDATE_SCHEMAS } from "../resources/validate.js";
 import { normalizeAlias } from "./aliases.js";
@@ -55,8 +56,14 @@ describe("registry — alias resolution", () => {
     expect(registry.getByAlias("nope")).toBeUndefined();
   });
 
-  it("does not register agent_execution as an addressable type", () => {
-    expect(registry.getByKind(ApiResourceKind.agent_execution)).toBeUndefined();
+  // The runtime execution kinds are served by the pre-gate `list executions`
+  // route and their dedicated controllers; registering either would put a
+  // row in `list types` that the pre-gate route then shadows — the
+  // stigmer/stigmer#469 class (see the alias-shadowing suite below).
+  it("does not register the runtime execution kinds as addressable types", () => {
+    for (const kind of [ApiResourceKind.agent_execution, ApiResourceKind.workflow_execution]) {
+      expect(registry.getByKind(kind)).toBeUndefined();
+    }
   });
 });
 
@@ -102,12 +109,18 @@ describe("registry — verb support matrix", () => {
     expect(registry.supportsVerb(ApiResourceKind.schedule, Verb.Run)).toBe(false);
   });
 
-  it("session and agent_share promise only apply (narrowed — stigmer/stigmer#354)", () => {
-    for (const kind of [ApiResourceKind.session, ApiResourceKind.agent_share]) {
-      expect(registry.supportsVerb(kind, Verb.Apply)).toBe(true);
-      for (const v of [Verb.Get, Verb.List, Verb.Delete]) {
-        expect(registry.supportsVerb(kind, v)).toBe(false);
-      }
+  it("agent_share promises only apply (narrowed — stigmer/stigmer#354)", () => {
+    expect(registry.supportsVerb(ApiResourceKind.agent_share, Verb.Apply)).toBe(true);
+    for (const v of [Verb.Get, Verb.List, Verb.Delete]) {
+      expect(registry.supportsVerb(ApiResourceKind.agent_share, v)).toBe(false);
+    }
+  });
+
+  it("session promises apply + list; get/delete stay narrowed (stigmer/stigmer#354, #469)", () => {
+    expect(registry.supportsVerb(ApiResourceKind.session, Verb.Apply)).toBe(true);
+    expect(registry.supportsVerb(ApiResourceKind.session, Verb.List)).toBe(true);
+    for (const v of [Verb.Get, Verb.Delete]) {
+      expect(registry.supportsVerb(ApiResourceKind.session, v)).toBe(false);
     }
   });
 
@@ -268,3 +281,32 @@ describe("registry — verb/dispatch conformance", () => {
     }
   });
 });
+
+// `stigmer list` resolves a handful of aliases BEFORE consulting the
+// registry (commands/list.ts): `types` (a command word, not a kind) and the
+// execution family. A pre-gate alias that intercepts a REGISTERED kind hides
+// that kind's registry dispatch behind bespoke behavior the verb matrix
+// cannot describe — sessions shipped working-but-unadvertised for two months
+// exactly this way (stigmer/stigmer#469). Every pre-gate predicate must be
+// listed here; the pin holds each one away from every registered kind's
+// alias set, so a future bypass for an addressable kind is a red test, not
+// a silently lying `list types` row.
+describe("registry — pre-gate list aliases cannot shadow registered kinds", () => {
+  const PRE_GATE_PREDICATES: ReadonlyArray<{ name: string; matches: (type: string) => boolean }> = [
+    { name: "executions (resources/execution.ts isExecutionAlias)", matches: isExecutionAlias },
+  ];
+
+  it("no registered kind's alias is intercepted by a pre-gate predicate", () => {
+    for (const { name, matches } of PRE_GATE_PREDICATES) {
+      for (const info of registry.all()) {
+        for (const alias of info.aliases) {
+          expect(
+            matches(alias),
+            `registry alias '${alias}' (${info.name}) is intercepted by the pre-gate route ${name} — ` +
+              "it shadows the kind's registry dispatch (the stigmer/stigmer#469 works-but-unadvertised class)",
+          ).toBe(false);
+        }
+      }
+    }
+  });
+});

package/src/registry/verb-support.ts

@@ -57,9 +57,12 @@ export const VERB_SUPPORT: ReadonlyMap<ApiResourceKind, ReadonlySet<Verb>> = new
   [ApiResourceKind.agent_instance, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
   // No list: proto exposes getByWorkflow (requires workflow_id), not a generic list.
   [ApiResourceKind.workflow_instance, new Set<Verb>([Verb.Apply, Verb.Get, Verb.Delete])],
-  // Sessions are runtime conversation state with no CLI read/ops story yet;
-  // get/list/delete are deliberately not promised (stigmer/stigmer#354).
-  [ApiResourceKind.session, new Set<Verb>([Verb.Apply])],
+  // Session list is served by its dedicated query RPC (a LIST_HANDLERS
+  // entry); stigmer/stigmer#469 promoted it into the matrix after it shipped
+  // working-but-unadvertised through a pre-gate bypass. get/delete remain
+  // deliberately unpromised until a real read/ops story exists
+  // (stigmer/stigmer#354) — resume-style flows go through `stigmer session`.
+  [ApiResourceKind.session, new Set<Verb>([Verb.Apply, Verb.List])],
 ]);
 
 export function verbsForKind(kind: ApiResourceKind): ReadonlySet<Verb> {

package/src/resources/apply/apply.ts

@@ -8,6 +8,7 @@
 
 import { create, fromJson, type JsonValue, type Message } from "@bufbuild/protobuf";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
@@ -19,6 +20,7 @@ import { UsageError } from "../../errors/index.js";
 import { CommandResult } from "../../output/index.js";
 import { defaultRegistry, Verb } from "../../registry/index.js";
 import { loadDocuments, resolveYamlFiles } from "../documents.js";
+import { decodeWorkflowTaskConfigs } from "../task-configs.js";
 import { type ApplyHandler, APPLY_HANDLERS, type ControllerFn } from "./handlers.js";
 
 export interface ApplyItem {
@@ -112,7 +114,15 @@ export async function applyItem(
  */
 export function marshalItem(item: ApplyItem): Message {
   try {
-    return fromJson(item.handler.schema, item.document, { ignoreUnknownFields: false });
+    const message = fromJson(item.handler.schema, item.document, { ignoreUnknownFields: false });
+    // Workflow task_config blocks live inside an open Struct the top-level
+    // decode cannot see into; decode them per kind so a dry-run (and the
+    // reconciler's marshal) rejects exactly what a real apply rejects
+    // (stigmer/stigmer#778).
+    if (item.handler.kind === ApiResourceKind.workflow) {
+      decodeWorkflowTaskConfigs(message as Workflow);
+    }
+    return message;
   } catch (err) {
     throw new UsageError(`invalid ${item.handler.displayName} in ${item.filePath}: ${(err as Error).message}`);
   }