@stigmer/cli 3.12.4 → 3.12.6

package/resources/task-configs.js

@@ -0,0 +1,144 @@
+// Typed decode of workflow task_config blocks — the offline twin of the
+// server's `unmarshalTaskConfig` (backend/services/stigmer-server/pkg/domain/
+// workflow/converter/unmarshal.go).
+//
+// The Workflow proto models `task_config` as an open google.protobuf.Struct
+// discriminated by `kind`, so the top-level schema decode accepts ANY config
+// payload; a real apply then decodes it into the kind's typed message and
+// rejects what does not fit. Before this module, `stigmer validate` and
+// `apply --dry-run` reported "valid" for configs a real apply refuses
+// (stigmer/stigmer#778).
+//
+// Scope is decode-truth only: field shapes, types, enum membership, unknown
+// fields. Semantic validation (cross-task references, expression namespaces,
+// model registry, protovalidate required-field rules) remains the server's
+// authority via `validateSpec`.
+import { fromJson } from "@bufbuild/protobuf";
+import { WorkflowTaskKind } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
+import { AgentCallTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/agent_call_pb";
+import { CallActivityTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/call_activity_pb";
+import { EmitEventTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/emit_event_pb";
+import { EvalTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/eval_pb";
+import { ForTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/for_pb";
+import { ForkTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/fork_pb";
+import { GrpcCallTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/grpc_call_pb";
+import { HttpCallTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/http_call_pb";
+import { HumanInputTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/human_input_pb";
+import { ListenTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/listen_pb";
+import { LlmCallTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/llm_call_pb";
+import { NotificationTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/notification_pb";
+import { RaiseTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/raise_pb";
+import { RunTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/run_pb";
+import { SetTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/set_pb";
+import { SwitchTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/switch_pb";
+import { TransformTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/transform_pb";
+import { TryTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/try_pb";
+import { ValidateTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/validate_pb";
+import { WaitTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/wait_pb";
+// Exported for the drift test (task-configs.test.ts), which holds this map and
+// the WorkflowTaskKind enum descriptor to strict bidirectional equality — the
+// stigmer/stigmer#353 drift class: a new task kind cannot ship without a CLI
+// schema binding, and a retired kind cannot linger here. The entries mirror
+// the server's `unmarshalTaskConfig` kind switch one-for-one.
+export const TASK_CONFIG_SCHEMAS = new Map([
+    [WorkflowTaskKind.set_vars, SetTaskConfigSchema],
+    [WorkflowTaskKind.http_call, HttpCallTaskConfigSchema],
+    [WorkflowTaskKind.grpc_call, GrpcCallTaskConfigSchema],
+    [WorkflowTaskKind.switch_case, SwitchTaskConfigSchema],
+    [WorkflowTaskKind.for_each, ForTaskConfigSchema],
+    [WorkflowTaskKind.fork, ForkTaskConfigSchema],
+    [WorkflowTaskKind.try_catch, TryTaskConfigSchema],
+    [WorkflowTaskKind.listen, ListenTaskConfigSchema],
+    [WorkflowTaskKind.wait, WaitTaskConfigSchema],
+    [WorkflowTaskKind.activity_call, CallActivityTaskConfigSchema],
+    [WorkflowTaskKind.raise_error, RaiseTaskConfigSchema],
+    [WorkflowTaskKind.run_workflow, RunTaskConfigSchema],
+    [WorkflowTaskKind.agent_call, AgentCallTaskConfigSchema],
+    [WorkflowTaskKind.llm_call, LlmCallTaskConfigSchema],
+    [WorkflowTaskKind.transform, TransformTaskConfigSchema],
+    [WorkflowTaskKind.human_input, HumanInputTaskConfigSchema],
+    [WorkflowTaskKind.validate, ValidateTaskConfigSchema],
+    [WorkflowTaskKind.emit_event, EmitEventTaskConfigSchema],
+    [WorkflowTaskKind.notification, NotificationTaskConfigSchema],
+    [WorkflowTaskKind.eval, EvalTaskConfigSchema],
+]);
+/**
+ * Decodes every task's `task_config` into its kind's typed proto message,
+ * throwing on the first config a real apply would reject. Runs on the decoded
+ * Workflow message (after the top-level schema decode), so snake_case and
+ * json-name spellings are already normalized.
+ *
+ * A task with no `task_config` is skipped: its absence is a protovalidate
+ * required-field violation, which is the server's layer, not decode-truth.
+ */
+export function decodeWorkflowTaskConfigs(workflow) {
+    for (const task of workflow.spec?.tasks ?? []) {
+        if (task.taskConfig === undefined)
+            continue;
+        const schema = TASK_CONFIG_SCHEMAS.get(task.kind);
+        if (schema === undefined)
+            continue; // unspecified/unknown kind — the server's layer reports it
+        // protobuf-es represents google.protobuf.Struct fields as plain JSON, so
+        // the Struct's content feeds the per-kind decode directly.
+        const config = normalizeTaskConfigShorthands(task.kind, task.taskConfig);
+        try {
+            fromJson(schema, config, { ignoreUnknownFields: false });
+        }
+        catch (err) {
+            throw new Error(`task '${task.name}' (${WorkflowTaskKind[task.kind]}): invalid task_config: ${err.message}`);
+        }
+    }
+}
+/**
+ * Rewrites user-friendly DSL forms to the shapes the proto decode expects —
+ * the twin of the server's `normalizeEnumShorthands` (unmarshal.go): agent_call
+ * harness shorthands ("cursor" → "HARNESS_CURSOR"), run_config service-tier/thinking-mode
+ * shorthands ("fast" → "SERVICE_TIER_FAST"), and the environment_refs kind
+ * default (an omitted kind means environment). Without this twin the offline
+ * decode would be STRICTER than a real apply and fail valid manifests.
+ */
+function normalizeTaskConfigShorthands(kind, config) {
+    if (kind !== WorkflowTaskKind.agent_call || !isJsonObject(config)) {
+        return config;
+    }
+    const normalized = { ...config };
+    if (typeof normalized.harness === "string") {
+        const harness = HARNESS_SHORTHANDS[normalized.harness.toLowerCase()];
+        if (harness !== undefined)
+            normalized.harness = harness;
+    }
+    if (isJsonObject(normalized.run_config)) {
+        const runConfig = { ...normalized.run_config };
+        if (typeof runConfig.service_tier === "string") {
+            const tier = SERVICE_TIER_SHORTHANDS[runConfig.service_tier.toLowerCase()];
+            if (tier !== undefined)
+                runConfig.service_tier = tier;
+        }
+        if (typeof runConfig.thinking_mode === "string") {
+            const mode = THINKING_MODE_SHORTHANDS[runConfig.thinking_mode.toLowerCase()];
+            if (mode !== undefined)
+                runConfig.thinking_mode = mode;
+        }
+        normalized.run_config = runConfig;
+    }
+    if (Array.isArray(normalized.environment_refs)) {
+        normalized.environment_refs = normalized.environment_refs.map((ref) => isJsonObject(ref) && ref.kind === undefined ? { ...ref, kind: "environment" } : ref);
+    }
+    return normalized;
+}
+const HARNESS_SHORTHANDS = {
+    native: "HARNESS_NATIVE",
+    cursor: "HARNESS_CURSOR",
+};
+const SERVICE_TIER_SHORTHANDS = {
+    standard: "SERVICE_TIER_STANDARD",
+    fast: "SERVICE_TIER_FAST",
+};
+const THINKING_MODE_SHORTHANDS = {
+    disabled: "THINKING_MODE_DISABLED",
+    enabled: "THINKING_MODE_ENABLED",
+};
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=task-configs.js.map

package/resources/task-configs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-configs.js","sourceRoot":"","sources":["../../src/resources/task-configs.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,8EAA8E;AAC9E,oCAAoC;AACpC,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,gCAAgC;AAEhC,OAAO,EAAoB,QAAQ,EAAkB,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wDAAwD,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,uEAAuE,CAAC;AACrH,OAAO,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAC7G,OAAO,EAAE,0BAA0B,EAAE,MAAM,qEAAqE,CAAC;AACjH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AACxG,OAAO,EAAE,uBAAuB,EAAE,MAAM,kEAAkE,CAAC;AAC3G,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,+DAA+D,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AACxG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mEAAmE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AAEpG,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAA+C,IAAI,GAAG,CAGpF;IACA,CAAC,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAChD,CAAC,gBAAgB,CAAC,SAAS,EAAE,wBAAwB,CAAC;IACtD,CAAC,gBAAgB,CAAC,SAAS,EAAE,wBAAwB,CAAC;IACtD,CAAC,gBAAgB,CAAC,WAAW,EAAE,sBAAsB,CAAC;IACtD,CAAC,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAChD,CAAC,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAC7C,CAAC,gBAAgB,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACjD,CAAC,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACjD,CAAC,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAC7C,CAAC,gBAAgB,CAAC,aAAa,EAAE,4BAA4B,CAAC;IAC9D,CAAC,gBAAgB,CAAC,WAAW,EAAE,qBAAqB,CAAC;IACrD,CAAC,gBAAgB,CAAC,YAAY,EAAE,mBAAmB,CAAC;IACpD,CAAC,gBAAgB,CAAC,UAAU,EAAE,yBAAyB,CAAC;IACxD,CAAC,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACpD,CAAC,gBAAgB,CAAC,SAAS,EAAE,yBAAyB,CAAC;IACvD,CAAC,gBAAgB,CAAC,WAAW,EAAE,0BAA0B,CAAC;IAC1D,CAAC,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,CAAC;IACrD,CAAC,gBAAgB,CAAC,UAAU,EAAE,yBAAyB,CAAC;IACxD,CAAC,gBAAgB,CAAC,YAAY,EAAE,4BAA4B,CAAC;IAC7D,CAAC,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,CAAC;CAC9C,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAkB;IAC1D,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS,CAAC,2DAA2D;QAE/F,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,CAAC,IAAI,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B,CAAC,IAAsB,EAAE,MAAiB;IAC9E,IAAI,IAAI,KAAK,gBAAgB,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,UAAU,GAA8B,EAAE,GAAG,MAAM,EAAE,CAAC;IAE5D,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,SAAS;YAAE,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC;IAC1D,CAAC;IAED,IAAI,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,SAAS,GAA8B,EAAE,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1E,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3E,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7E,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC;QACzD,CAAC;QACD,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,UAAU,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACpE,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,kBAAkB,GAA2B;IACjD,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;CACzB,CAAC;AAEF,MAAM,uBAAuB,GAA2B;IACtD,QAAQ,EAAE,uBAAuB;IACjC,IAAI,EAAE,mBAAmB;CAC1B,CAAC;AAEF,MAAM,wBAAwB,GAA2B;IACvD,QAAQ,EAAE,wBAAwB;IAClC,OAAO,EAAE,uBAAuB;CACjC,CAAC;AAEF,SAAS,YAAY,CAAC,KAA4B;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/resources/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/resources/validate.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,WAAW,EAAY,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAIhF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAOtH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CAKrE,CAAC;AAEH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,GAAG,SAAS,CAEhF;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,GAAG,IAAI,CAI/E"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/resources/validate.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,WAAW,EAAY,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAIhF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAQtH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CAKrE,CAAC;AAEH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,GAAG,SAAS,CAEhF;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,GAAG,IAAI,CAW/E"}

package/resources/validate.js

@@ -10,6 +10,7 @@ import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ProjectSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/api_pb";
+import { decodeWorkflowTaskConfigs } from "./task-configs.js";
 // Exported for the verb/dispatch conformance suite (registry/registry.test.ts),
 // which holds this map and the matrix's Verb.Validate promises to strict
 // bidirectional equality — the stigmer/stigmer#353 drift class. Command code
@@ -27,6 +28,12 @@ export function schemaForValidate(kind) {
 export function validateDocument(schema, document) {
     // ignoreUnknownFields mirrors the server's lenient unmarshal: forward-compat
     // fields a newer server adds should not fail a slightly older CLI.
-    fromJson(schema, document, { ignoreUnknownFields: true });
+    const message = fromJson(schema, document, { ignoreUnknownFields: true });
+    // Workflows carry per-kind typed configs inside an open Struct that the
+    // top-level decode cannot see into — decode them too, so validate stops
+    // passing configs a real apply rejects (stigmer/stigmer#778).
+    if (schema === WorkflowSchema) {
+        decodeWorkflowTaskConfigs(message);
+    }
 }
 //# sourceMappingURL=validate.js.map

package/resources/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/resources/validate.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,qDAAqD;AAErD,OAAO,EAAoB,QAAQ,EAAkB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAErF,gFAAgF;AAChF,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAA8C,IAAI,GAAG,CAA+B;IAC/G,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1C,CAAC,eAAe,CAAC,UAAU,EAAE,eAAe,CAAC;IAC7C,CAAC,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,QAAmB;IACvE,6EAA6E;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/resources/validate.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,qDAAqD;AAErD,OAAO,EAAoB,QAAQ,EAAkB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAiB,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,gFAAgF;AAChF,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAA8C,IAAI,GAAG,CAA+B;IAC/G,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1C,CAAC,eAAe,CAAC,UAAU,EAAE,eAAe,CAAC;IAC7C,CAAC,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,QAAmB;IACvE,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1E,wEAAwE;IACxE,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,yBAAyB,CAAC,OAAmB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/src/commands/agent-exec-flags.ts

@@ -3,7 +3,7 @@
 // execution flag is added here once and both surfaces pick it up.
 
 import type { Command } from "commander";
-import type { AgentExecFlags, RunMode, ServiceTierFlag } from "../resources/run/prepare.js";
+import type { AgentExecFlags, RunMode, ServiceTierFlag, ThinkingFlag } from "../resources/run/prepare.js";
 
 /** Commander collector for repeatable string options. */
 export const collect = (value: string, previous: string[]): string[] => [...previous, value];
@@ -26,6 +26,7 @@ export interface AgentExecOptions {
   autoApprove?: boolean;
   mode?: string;
   serviceTier?: string;
+  thinking?: string;
 }
 
 /**
@@ -52,7 +53,8 @@ export function addAgentExecFlags(command: Command, requireMessage = false): Com
     .option("--model <model>", "LLM model to use (e.g. claude-sonnet-4-6)")
     .option("--auto-approve", "automatically approve all tool executions")
     .option("--mode <mode>", 'interaction mode: "agent" (default) or "plan" (read-only)')
-    .option("--service-tier <tier>", 'model service tier: "standard" (default) or "fast" (requires --model naming a model with a fast tier; billed at fast rates)');
+    .option("--service-tier <tier>", 'model service tier: "standard" (default) or "fast" (requires --model naming a model with a fast tier; billed at fast rates)')
+    .option("--thinking <mode>", 'extended reasoning: "disabled" (default) or "enabled" (requires --model naming a thinking-capable model; billed at base rates, uses more output tokens)');
 }
 
 /** Map parsed commander options onto the shared {@link AgentExecFlags} shape. */
@@ -74,5 +76,6 @@ export function toAgentExecFlags(options: AgentExecOptions): AgentExecFlags {
     autoApprove: options.autoApprove === true,
     mode: (options.mode ?? "") as RunMode,
     serviceTier: (options.serviceTier ?? "") as ServiceTierFlag,
+    thinking: (options.thinking ?? "") as ThinkingFlag,
   };
 }

package/src/commands/draft.ts

@@ -8,7 +8,7 @@
 // unless detached or a local workspace is in play.
 
 import type { Command } from "commander";
-import { ensureAuthenticated, resolveOrganization } from "../config/index.js";
+import { ensureAuthenticated, isCloudMode, resolveOrganization } from "../config/index.js";
 import { UsageError } from "../errors/index.js";
 import { addAgentExecFlags, type AgentExecOptions, toAgentExecFlags } from "./agent-exec-flags.js";
 import { globalOrg } from "./shared.js";
@@ -73,7 +73,9 @@ async function runDraft(config: DraftConfig, options: DraftFlags, command: Comma
 
   const agent = await resolveDraftAgent(resolveAgentRef, client.stigmer, config);
 
-  const prepared = await prepareAgentExec(toAgentExecFlags(options), client.stigmer, org, stderrProgress());
+  const prepared = await prepareAgentExec(toAgentExecFlags(options), client.stigmer, org, stderrProgress(), {
+    cloudBackend: isCloudMode(client.config),
+  });
 
   if (prepared.attachments.length + prepared.workspaceFileRefs.length > 0) {
     process.stderr.write(`Attached ${prepared.attachments.length + prepared.workspaceFileRefs.length} file(s) as context\n`);

package/src/commands/run.ts

@@ -5,7 +5,7 @@
 // the differ) load lazily inside the action so `--help` stays fast (DD-001).
 
 import type { Command } from "commander";
-import { ensureAuthenticated, resolveOrganization } from "../config/index.js";
+import { ensureAuthenticated, isCloudMode, resolveOrganization } from "../config/index.js";
 import { UsageError } from "../errors/index.js";
 import { interactiveBrowseEnabled } from "../resources/picker/tty.js";
 import { addAgentExecFlags, type AgentExecOptions } from "./agent-exec-flags.js";
@@ -171,7 +171,9 @@ async function runResolvedAgent(
   const { executeResolvedAgent } = await import("../resources/run/agent-exec.js");
   const { toAgentExecFlags } = await import("./agent-exec-flags.js");
 
-  const prepared = await prepareAgentExec(toAgentExecFlags(options), client.stigmer, org, stderrProgress());
+  const prepared = await prepareAgentExec(toAgentExecFlags(options), client.stigmer, org, stderrProgress(), {
+    cloudBackend: isCloudMode(client.config),
+  });
   await executeResolvedAgent({
     agent,
     prepared,

package/src/commands/seedpack.ts

@@ -3,7 +3,10 @@
 // The seedpack (system agents, skills, MCP servers, workflows under the
 // "stigmer" org) is applied automatically on `stigmer up` in local mode; these
 // commands bootstrap it explicitly against whatever backend is configured
-// (local or cloud). Apply is idempotent via a content-hash marker.
+// (local or cloud). Apply is content-hash idempotent: in cloud mode the truth
+// is the stigmer.ai/seedpack-hash label on the server's seedpack Project (any
+// machine sees the same applied state — cloud#429); in local mode it is a
+// marker file in the data dir, which lives and dies with the local backend.
 //
 // Heavy modules load lazily inside the action so `--help` stays fast (DD-001).
 
@@ -50,7 +53,11 @@ async function runApply(flags: ApplyFlags): Promise<void> {
       info: (line) => process.stderr.write(`${line}\n`),
       warn: (line) => process.stderr.write(`${line}\n`),
     },
-    { markerDir: markerDir(), force: flags.force === true },
+    {
+      markerDir: markerDir(),
+      force: flags.force === true,
+      useServerHash: isCloudMode(load()),
+    },
   );
 
   const label = backendLabel();
@@ -61,11 +68,26 @@ async function runApply(flags: ApplyFlags): Promise<void> {
 }
 
 async function runStatus(flags: OutputFlags): Promise<void> {
-  const { seedpackContentHash } = await import("../local/seedpack/apply.js");
+  const { readServerSeedpackHash, resolveSeedpackOrg, seedpackContentHash } = await import("../local/seedpack/apply.js");
   const { readMarker } = await import("../local/seedpack/content.js");
 
   const hash = seedpackContentHash();
-  const stored = readMarker(markerDir());
+
+  // Cloud mode asks the server (the label on the seedpack Project) so status
+  // is truthful from ANY machine, not just the one that last ran apply.
+  let stored: string | null;
+  let storedLabel: string;
+  if (isCloudMode(load())) {
+    const { connectBackend } = await import("../backend.js");
+    const { ensureAuthenticated } = await import("../config/index.js");
+    const client = connectBackend();
+    ensureAuthenticated(client.config);
+    stored = await readServerSeedpackHash(client.stigmer, resolveSeedpackOrg());
+    storedLabel = "Applied Hash (server)";
+  } else {
+    stored = readMarker(markerDir());
+    storedLabel = "Applied Hash";
+  }
 
   const result = CommandResult.success("Seedpack status");
   const section = result.addSection("");
@@ -74,7 +96,7 @@ async function runStatus(flags: OutputFlags): Promise<void> {
   if (stored === null) {
     section.field("Status", "Not applied (run 'stigmer seedpack apply')");
   } else {
-    section.field("Applied Hash", stored);
+    section.field(storedLabel, stored);
     section.field("Status", stored === hash ? "Up to date" : "Outdated (run 'stigmer seedpack apply' to update)");
   }
   renderResult(result, resultFormat(flags));

package/src/local/seedpack/apply.test.ts

@@ -1,11 +1,19 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Message } from "@bufbuild/protobuf";
+import type { Stigmer } from "@stigmer/sdk";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { buildDeclarativeItems, scanResourceFiles } from "../../resources/apply/declarative.js";
 import type { ControllerFn } from "../../resources/apply/handlers.js";
-import { applySeedpack, resolveSeedpackOrg, seedpackContentHash } from "./apply.js";
+import {
+  applySeedpack,
+  readServerSeedpackHash,
+  resolveSeedpackOrg,
+  SEEDPACK_HASH_LABEL,
+  SEEDPACK_PROJECT_SLUG,
+  seedpackContentHash,
+} from "./apply.js";
 import type { SeedpackContent } from "./content.js";
 import { extractSeedpack, readMarker, resolveSeedpackContent } from "./content.js";
 
@@ -43,27 +51,43 @@ function makeContent(): SeedpackContent {
   return { dir, source: "repo" };
 }
 
-// Records each applied message's proto type name; every controller resolves to
-// the same stub apply (the handlers only call `.apply`).
-function recordingDeps() {
+// Records each applied message (and its proto type name); every controller
+// resolves to the same stub apply (the handlers only call `.apply`).
+function recordingDeps(stigmer?: unknown) {
   const applied: string[] = [];
+  const appliedMessages: Message[] = [];
   const controller = (() => ({
     apply: async (m: Message) => {
       applied.push((m as { $typeName: string }).$typeName);
+      appliedMessages.push(m);
       return m;
     },
   })) as unknown as ControllerFn;
   return {
     applied,
+    appliedMessages,
     deps: {
       controller,
-      stigmer: {} as never,
+      stigmer: (stigmer ?? {}) as never,
       info: () => {},
       warn: () => {},
     },
   };
 }
 
+// A Stigmer stub whose project.getByReference reports the given stored hash
+// (null → the label is absent; "absent" → the project itself does not exist).
+function stigmerWithServerHash(stored: string | null | "absent"): Stigmer {
+  return {
+    project: {
+      getByReference: async () => {
+        if (stored === "absent") throw new Error("not found");
+        return { metadata: { labels: stored === null ? {} : { [SEEDPACK_HASH_LABEL]: stored } } };
+      },
+    },
+  } as unknown as Stigmer;
+}
+
 let content: SeedpackContent;
 let markerDir: string;
 beforeEach(() => {
@@ -125,6 +149,91 @@ describe("applySeedpack", () => {
     expect(result.applied).toBe(true);
     expect(forced.applied.length).toBeGreaterThan(0);
   });
+
+  it("stamps the content hash as a reserved label on the applied Project", async () => {
+    const { appliedMessages, deps } = recordingDeps();
+    const result = await applySeedpack(deps, { markerDir, content });
+
+    const project = appliedMessages.find((m) => (m as { $typeName: string }).$typeName.endsWith("Project")) as
+      | { metadata?: { labels: Record<string, string> } }
+      | undefined;
+    expect(project).toBeDefined();
+    expect(project?.metadata?.labels[SEEDPACK_HASH_LABEL]).toBe(result.hash);
+  });
+});
+
+describe("applySeedpack — cloud mode (useServerHash)", () => {
+  it("skips when the server's recorded hash matches, without touching the marker", async () => {
+    const hash = seedpackContentHash({ content });
+    const { applied, deps } = recordingDeps(stigmerWithServerHash(hash));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
+
+    expect(result.applied).toBe(false);
+    expect(applied).toHaveLength(0);
+    expect(readMarker(markerDir)).toBeNull();
+  });
+
+  it("applies when the server records a different hash — and never writes the marker", async () => {
+    const { applied, deps } = recordingDeps(stigmerWithServerHash("sha256:0000000000000000"));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
+
+    expect(result.applied).toBe(true);
+    expect(applied.length).toBeGreaterThan(0);
+    // Cloud mode's record is the Project label; a marker here would be a
+    // second record of the same fact, free to drift.
+    expect(readMarker(markerDir)).toBeNull();
+  });
+
+  it("applies when the seedpack Project does not exist yet (first bootstrap)", async () => {
+    const { applied, deps } = recordingDeps(stigmerWithServerHash("absent"));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
+
+    expect(result.applied).toBe(true);
+    expect(applied.length).toBeGreaterThan(0);
+  });
+
+  it("ignores a stale local marker: the server is the only truth consulted", async () => {
+    const hash = seedpackContentHash({ content });
+    // A leftover marker from the pre-cloud#429 era says "up to date"…
+    const { deps: first } = recordingDeps();
+    await applySeedpack(first, { markerDir, content });
+    // …but the server has never seen this content.
+    const { applied, deps } = recordingDeps(stigmerWithServerHash(null));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
+
+    expect(result.applied).toBe(true);
+    expect(applied.length).toBeGreaterThan(0);
+    expect(hash).toBe(result.hash);
+  });
+
+  it("re-applies when forced even if the server hash matches", async () => {
+    const hash = seedpackContentHash({ content });
+    const { applied, deps } = recordingDeps(stigmerWithServerHash(hash));
+
+    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true, force: true });
+
+    expect(result.applied).toBe(true);
+    expect(applied.length).toBeGreaterThan(0);
+  });
+});
+
+describe("readServerSeedpackHash", () => {
+  it("returns the recorded label", async () => {
+    const hash = await readServerSeedpackHash(stigmerWithServerHash("sha256:abcdef0123456789"), "stigmer");
+    expect(hash).toBe("sha256:abcdef0123456789");
+  });
+
+  it("returns null when the label is absent", async () => {
+    expect(await readServerSeedpackHash(stigmerWithServerHash(null), "stigmer")).toBeNull();
+  });
+
+  it("returns null when the project cannot be read (never applied / transient failure)", async () => {
+    expect(await readServerSeedpackHash(stigmerWithServerHash("absent"), "stigmer")).toBeNull();
+  });
 });
 
 describe("seedpackContentHash", () => {
@@ -139,6 +248,18 @@ describe("seedpackContentHash", () => {
 // CI canary manifest) must live outside the content set, never beside the
 // McpServer YAMLs where `loadDocuments(strict)` would reject it for missing a
 // `kind`. The synthetic fixtures above can't catch this — only real content can.
+// The cloud-mode hash read addresses the seedpack Project by a pinned slug.
+// The server derives the slug from the manifest's metadata.name, so this pin
+// holds exactly as long as the real seedpack keeps that name — verify against
+// the real content so a rename there fails here, not silently in prod.
+describe("SEEDPACK_PROJECT_SLUG pins the real manifest name", () => {
+  it("matches seedpack/stigmer.yaml metadata.name", () => {
+    const real = resolveSeedpackContent();
+    const manifest = readFileSync(join(real.dir, "stigmer.yaml"), "utf8");
+    expect(manifest).toMatch(new RegExp(`name:\\s*${SEEDPACK_PROJECT_SLUG}\\s*$`, "m"));
+  });
+});
+
 describe("real seedpack content loads through the declarative scanner", () => {
   it("scans + builds apply items without a missing-kind error", () => {
     const real = resolveSeedpackContent();

package/src/local/seedpack/apply.ts

@@ -10,11 +10,18 @@
 //   2. the project (stigmer.yaml + agents/skills/mcp-servers/workflows) via the
 //      declarative reconciler, under the target org.
 //
-// Idempotent: a content-hash marker skips the apply when nothing changed.
+// Idempotent, with the applied-hash truth living with the backend it describes
+// (cloud#429): every apply stamps the content hash as a reserved label on the
+// seedpack Project, and cloud-mode runs skip by reading that label back — so
+// any machine (operator laptop, CI) sees the same applied state. Local mode
+// keeps the original marker file (the local data dir lives and dies with the
+// local backend, so a local file IS backend-scoped state there).
 
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import type { Stigmer } from "@stigmer/sdk";
 import { applyItem, resolveApplyItems } from "../../resources/apply/apply.js";
 import { applyDeclarative, detectTrack } from "../../resources/apply/declarative.js";
@@ -31,6 +38,23 @@ import {
 const DEFAULT_ORG = "stigmer";
 const ORG_ENV_VAR = "STIGMER_SEEDPACK_ORG";
 
+/**
+ * Reserved label on the seedpack Project recording the last applied content
+ * hash (cloud#429). Writing a NEW value requires `can_write_reserved_labels`
+ * (the seeding identity's capability); re-sending an unchanged value is an
+ * echo the cloud guard passes for any caller — so re-applies of identical
+ * content are never treated as reserved-label writes.
+ */
+export const SEEDPACK_HASH_LABEL = "stigmer.ai/seedpack-hash";
+
+/**
+ * The seedpack Project's slug. The server derives it from the manifest's
+ * `metadata.name` in `seedpack/stigmer.yaml` — "stigmer-seedpack" is already
+ * slug-shaped, so name and slug coincide. Pinned by a test against the real
+ * content so a rename there fails loudly here.
+ */
+export const SEEDPACK_PROJECT_SLUG = "stigmer-seedpack";
+
 export interface SeedpackApplyDeps {
   /** Raw command-controller accessor (full-proto apply, preserves metadata.id). */
   readonly controller: ControllerFn;
@@ -43,7 +67,7 @@ export interface SeedpackApplyDeps {
 }
 
 export interface SeedpackApplyOptions {
-  /** Directory holding the idempotency marker (data dir for local, config dir for cloud). */
+  /** Directory holding the idempotency marker (local mode only). */
   readonly markerDir: string;
   /** Target org slug. Defaults to STIGMER_SEEDPACK_ORG, then "stigmer". */
   readonly org?: string;
@@ -52,6 +76,13 @@ export interface SeedpackApplyOptions {
   /** Pre-resolved content (injectable for tests); resolved on demand otherwise. */
   readonly content?: SeedpackContent;
   readonly home?: string;
+  /**
+   * Cloud mode: the idempotency truth is the {@link SEEDPACK_HASH_LABEL} on the
+   * server's seedpack Project, read via {@link readServerSeedpackHash} — the
+   * local marker is neither read nor written, so a stateless machine (CI, a
+   * second operator laptop) still skips unchanged content correctly.
+   */
+  readonly useServerHash?: boolean;
 }
 
 export interface SeedpackApplyResult {
@@ -77,17 +108,35 @@ export function seedpackContentHash(opts: Pick<SeedpackApplyOptions, "content" |
   return hashSeedpackContent(content.dir);
 }
 
+/**
+ * Read the applied content hash recorded on the backend's seedpack Project,
+ * or null when it cannot be proven (project absent — never applied — or the
+ * read failed). Null means "apply": the apply itself is idempotent server-side,
+ * so an unprovable state costs one redundant pass, never a skipped update.
+ */
+export async function readServerSeedpackHash(stigmer: Stigmer, org: string): Promise<string | null> {
+  try {
+    const project = await stigmer.project.getByReference({ org, slug: SEEDPACK_PROJECT_SLUG });
+    return project.metadata?.labels?.[SEEDPACK_HASH_LABEL] ?? null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Apply the seedpack to the backend the deps connect to. Returns `applied:false`
- * (without touching the backend) when the marker already matches the content
- * hash and `force` is not set.
+ * (without touching the backend beyond the cloud-mode hash read) when the
+ * recorded hash already matches the content hash and `force` is not set.
  */
 export async function applySeedpack(deps: SeedpackApplyDeps, opts: SeedpackApplyOptions): Promise<SeedpackApplyResult> {
   const org = resolveSeedpackOrg(opts.org);
   const content = opts.content ?? resolveSeedpackContent({ home: opts.home });
   const hash = hashSeedpackContent(content.dir);
 
-  if (opts.force !== true && readMarker(opts.markerDir) === hash) {
+  const appliedHash = opts.useServerHash === true
+    ? await readServerSeedpackHash(deps.stigmer, org)
+    : readMarker(opts.markerDir);
+  if (opts.force !== true && appliedHash === hash) {
     return { applied: false, hash, org };
   }
 
@@ -96,8 +145,12 @@ export async function applySeedpack(deps: SeedpackApplyDeps, opts: SeedpackApply
   try {
     extractSeedpack(content.dir, stage);
     await applyOrganizations(deps, stage);
-    await applyProject(deps, stage, org);
-    writeMarker(opts.markerDir, hash);
+    await applyProject(deps, stage, org, hash);
+    // The Project label written above is the cloud-mode record; the marker
+    // stays the local-mode one. Never both — two records of one fact drift.
+    if (opts.useServerHash !== true) {
+      writeMarker(opts.markerDir, hash);
+    }
   } finally {
     rmSync(stage, { recursive: true, force: true });
   }
@@ -124,11 +177,18 @@ async function applyOrganizations(deps: SeedpackApplyDeps, stageDir: string): Pr
 
 // Phase 2: the project (agents, skills, MCP servers, workflows) via the shared
 // declarative reconciler — the same path `stigmer apply` runs for a user project.
-async function applyProject(deps: SeedpackApplyDeps, stageDir: string, org: string): Promise<void> {
+//
+// The content hash is stamped as a reserved label on the Project HERE, in the
+// seedpack path only — general `stigmer apply` never writes reserved labels.
+// The stamp rides the project apply that happens anyway, so recording the hash
+// costs no extra RPC and can never succeed while the apply failed.
+async function applyProject(deps: SeedpackApplyDeps, stageDir: string, org: string, contentHash: string): Promise<void> {
   const detect = detectTrack(stageDir);
-  if (detect.track !== "declarative") {
+  if (detect.track !== "declarative" || detect.project === undefined) {
     throw new Error(`seedpack is not a declarative project (detected '${detect.track}')`);
   }
+  detect.project.metadata ??= create(ApiResourceMetadataSchema, {});
+  detect.project.metadata.labels[SEEDPACK_HASH_LABEL] = contentHash;
   await applyDeclarative(detect, {
     controller: deps.controller,
     stigmer: deps.stigmer,