@stigmer/cli 3.5.3 → 3.7.0

package/resources/schedule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.js","sourceRoot":"","sources":["../../src/resources/schedule.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,+BAA+B;AAC/B,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,2EAA2E;AAC3E,uEAAuE;AACvE,wCAAwC;AACxC,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,2CAA2C;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sDAAsD,CAAC;AAE1F,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAW,EAAE,GAAW;IAC7E,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,aAAa,GAAG,6BAA6B,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,IAAI,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAElD,OAAO,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,GAAW,EAAE,GAAW;IACpE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAClB,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAW,EAAE,GAAW;IAC9E,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,aAAa,GAAG,8BAA8B,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;IAE7C,IAAI,SAAS,CAAC,OAAO,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,8BAA8B,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,qDAAqD;IACrD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,KAAK,kBAAkB,CAAC,cAAc;QAClE,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,+BAA+B,CAAC;IACpC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,IAAI,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,QAAkB,EAAE,eAAuB,EAAE,WAAmB;IACvF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;IAC7C,MAAM,SAAS,GAAG,eAAe,KAAK,EAAE,IAAI,WAAW,GAAG,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAClC,SAAS,CAAC,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,aAAa,IAAI,qCAAqC,CAClG,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,eAAe,KAAK,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC3E,IAAI,WAAW,GAAG,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;QAClG,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;IACzF,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/src/commands/agent-exec-flags.ts

@@ -3,7 +3,7 @@
 // execution flag is added here once and both surfaces pick it up.
 
 import type { Command } from "commander";
-import type { AgentExecFlags, RunMode } from "../resources/run/prepare.js";
+import type { AgentExecFlags, RunMode, ServiceTierFlag } from "../resources/run/prepare.js";
 
 /** Commander collector for repeatable string options. */
 export const collect = (value: string, previous: string[]): string[] => [...previous, value];
@@ -25,6 +25,7 @@ export interface AgentExecOptions {
   model?: string;
   autoApprove?: boolean;
   mode?: string;
+  serviceTier?: string;
 }
 
 /**
@@ -50,7 +51,8 @@ export function addAgentExecFlags(command: Command, requireMessage = false): Com
     .option("--secret-file <path>", "load secrets from file (repeatable, encrypted)", collect, [])
     .option("--model <model>", "LLM model to use (e.g. claude-sonnet-4-6)")
     .option("--auto-approve", "automatically approve all tool executions")
-    .option("--mode <mode>", 'interaction mode: "agent" (default) or "plan" (read-only)');
+    .option("--mode <mode>", 'interaction mode: "agent" (default) or "plan" (read-only)')
+    .option("--service-tier <tier>", 'model service tier: "standard" (default) or "fast" (requires --model naming a model with a fast tier; billed at fast rates)');
 }
 
 /** Map parsed commander options onto the shared {@link AgentExecFlags} shape. */
@@ -71,5 +73,6 @@ export function toAgentExecFlags(options: AgentExecOptions): AgentExecFlags {
     model: options.model ?? "",
     autoApprove: options.autoApprove === true,
     mode: (options.mode ?? "") as RunMode,
+    serviceTier: (options.serviceTier ?? "") as ServiceTierFlag,
   };
 }

package/src/commands/list.ts

@@ -38,7 +38,7 @@ async function runList(type: string, options: ListFlags, command: Command): Prom
   const { isExecutionAlias } = await import("../resources/execution.js");
   const { isSessionAlias } = await import("../resources/session.js");
   if (isExecutionAlias(type)) {
-    await runListExecutions(options);
+    await runListExecutions(options, command);
     return;
   }
   if (isSessionAlias(type)) {
@@ -67,8 +67,10 @@ async function runList(type: string, options: ListFlags, command: Command): Prom
 }
 
 // Executions bypass the registry: they're listed by their own controllers and
-// optionally filtered to agent (default) or workflow by `--type`.
-async function runListExecutions(options: ListFlags): Promise<void> {
+// optionally filtered to agent (default) or workflow by `--type`. Results are
+// scoped to the resolved org context (--org flag, env, or configured context);
+// an unset cloud context resolves to "" = permission-bounded across orgs.
+async function runListExecutions(options: ListFlags, command: Command): Promise<void> {
   const [{ connectBackend }, execution] = await Promise.all([
     import("../backend.js"),
     import("../resources/execution.js"),
@@ -76,19 +78,20 @@ async function runListExecutions(options: ListFlags): Promise<void> {
 
   const client = connectBackend();
   ensureAuthenticated(client.config);
+  const org = resolveOrganization(client.config, globalOrg(command));
   const limit = parseLimit(options.limit);
   const format = readFormat(options);
 
   const filter = (options.type ?? "").trim().toLowerCase();
   if (filter === "workflow" || filter === "wf") {
-    const result = await execution.listWorkflowExecutions(client.stigmer, limit);
+    const result = await execution.listWorkflowExecutions(client.stigmer, limit, org);
     process.stdout.write(execution.renderExecutionList(result, format, "workflow"));
     return;
   }
   if (filter !== "" && filter !== "agent") {
     throw new UsageError(`unknown execution type filter: ${options.type}\n\nValid values: agent, workflow`);
   }
-  const result = await execution.listAgentExecutions(client.stigmer, limit);
+  const result = await execution.listAgentExecutions(client.stigmer, limit, org);
   process.stdout.write(execution.renderExecutionList(result, format, "agent"));
 }
 

package/src/commands/mcp-server.ts

@@ -35,7 +35,7 @@ Environment variables:
   STIGMER_SERVER_ADDRESS         gRPC address (default: CLI config, else localhost:7234)
   STIGMER_API_KEY                API key (auto-resolved from CLI config for cloud)
   STIGMER_MCP_TRANSPORT          stdio | http | both (default: stdio)
-  STIGMER_MCP_ROSTER             full | records (default: full; records = the five record tools only)
+  STIGMER_MCP_ROSTER             full | records | channels (default: full; records = the five record tools only, channels = send_channel_message only)
   STIGMER_MCP_HTTP_PORT          HTTP listen port (default: 8080)
   STIGMER_MCP_LOG_FORMAT         text | json (default: text)
   STIGMER_MCP_LOG_LEVEL          debug | info | warn | error (default: info)

package/src/commands/resume.ts

@@ -55,7 +55,7 @@ async function runResume(reference: string | undefined, options: ResumeFlags, co
     throw browseUnavailableError();
   }
 
-  const { isSessionId, isAgentId, isWorkflowId, hasResourceIdPrefix, validateResourceId } = await import(
+  const { isSessionId, isAgentId, isWorkflowId, isScheduleId, hasResourceIdPrefix, validateResourceId } = await import(
     "../resources/reference.js"
   );
 
@@ -64,6 +64,13 @@ async function runResume(reference: string | undefined, options: ResumeFlags, co
     throw new UsageError(`Resource IDs like "${reference}" are not sessions\n\nTo run a resource:\n  stigmer run ${reference}`);
   }
 
+  // Schedule IDs belong to `schedule resume` (clearing a platform pause).
+  if (isScheduleId(reference)) {
+    throw new UsageError(
+      `Resource IDs like "${reference}" are not sessions\n\nTo resume a paused schedule:\n  stigmer schedule resume ${reference}`,
+    );
+  }
+
   if (isSessionId(reference)) {
     if (validateResourceId(reference) !== null) {
       throw new UsageError(

package/src/commands/schedule.ts

@@ -0,0 +1,70 @@
+// `stigmer schedule resume <ref>` — clear a platform auto-pause from a
+// schedule. `stigmer schedule trigger <ref>` — fire it once, immediately.
+//
+// The platform pauses a schedule after repeated failed runs and records
+// why in status.paused_reason; resume is the owner's explicit act that
+// clears it (the owner's enabled switch is a different lever — see
+// docs/vocabulary.md, "Disabled vs. paused"). Trigger fires the schedule
+// through its own clock (DD-014), so everything a cron fire does applies
+// — including feeding the failure streak. Declarative verbs stay in the
+// generic matrix (apply/get/list/delete); this group exists for the
+// kind-specific operational actions, the `stigmer share` shape.
+//
+// Thin handler: resolve credentials/org, delegate to resources/schedule,
+// render the result. Heavy modules are lazy-imported so `--help` stays
+// fast (DD-001).
+
+import type { Command } from "commander";
+import { ensureAuthenticated, resolveOrganization } from "../config/index.js";
+import type { OutputFlags } from "../output/index.js";
+import { addResultFlags, globalOrg, resultFormat } from "./shared.js";
+
+export function registerSchedule(program: Command): void {
+  const schedule = program.command("schedule").description("operate on schedules");
+
+  const resume = schedule
+    .command("resume <ref>")
+    .description("clear a platform pause so a schedule fires again (id, org/slug, or slug)")
+    .action((ref: string, options: OutputFlags, command: Command) => runScheduleResume(ref, options, command));
+  addResultFlags(resume);
+
+  const trigger = schedule
+    .command("trigger <ref>")
+    .description("fire a schedule once, immediately (id, org/slug, or slug)")
+    .action((ref: string, options: OutputFlags, command: Command) => runScheduleTrigger(ref, options, command));
+  addResultFlags(trigger);
+}
+
+async function runScheduleTrigger(ref: string, options: OutputFlags, command: Command): Promise<void> {
+  const format = resultFormat(options);
+
+  const [{ connectBackend }, { triggerSchedule }, { renderResult }] = await Promise.all([
+    import("../backend.js"),
+    import("../resources/schedule.js"),
+    import("../output/command-result.js"),
+  ]);
+
+  const client = connectBackend();
+  ensureAuthenticated(client.config);
+  const org = resolveOrganization(client.config, globalOrg(command));
+
+  const result = await triggerSchedule(client.stigmer, ref, org);
+  renderResult(result, format);
+}
+
+async function runScheduleResume(ref: string, options: OutputFlags, command: Command): Promise<void> {
+  const format = resultFormat(options);
+
+  const [{ connectBackend }, { resumeSchedule }, { renderResult }] = await Promise.all([
+    import("../backend.js"),
+    import("../resources/schedule.js"),
+    import("../output/command-result.js"),
+  ]);
+
+  const client = connectBackend();
+  ensureAuthenticated(client.config);
+  const org = resolveOrganization(client.config, globalOrg(command));
+
+  const result = await resumeSchedule(client.stigmer, ref, org);
+  renderResult(result, format);
+}

package/src/program.ts

@@ -28,6 +28,7 @@ import { registerPush } from "./commands/push.js";
 import { registerReset } from "./commands/reset.js";
 import { registerResume } from "./commands/resume.js";
 import { registerRun } from "./commands/run.js";
+import { registerSchedule } from "./commands/schedule.js";
 import { registerSearch } from "./commands/search.js";
 import { registerSeedpack } from "./commands/seedpack.js";
 import { registerSetup } from "./commands/setup.js";
@@ -78,6 +79,7 @@ export function buildProgram(): Command {
   registerDelete(program);
   registerTag(program);
   registerShare(program);
+  registerSchedule(program);
   registerDiff(program);
   registerUsage(program);
   registerPush(program);

package/src/registry/metadata.ts

@@ -36,6 +36,7 @@ export const KIND_META: ReadonlyMap<ApiResourceKind, KindMeta> = new Map([
   [ApiResourceKind.agent_channel, { name: "AgentChannel", displayName: "Agent Channel", idPrefix: "ach" }],
   [ApiResourceKind.channel_app, { name: "ChannelApp", displayName: "Channel App", idPrefix: "chapp" }],
   [ApiResourceKind.datastore, { name: "Datastore", displayName: "Datastore", idPrefix: "dst" }],
+  [ApiResourceKind.schedule, { name: "Schedule", displayName: "Schedule", idPrefix: "sch" }],
   [ApiResourceKind.agent_instance, { name: "AgentInstance", displayName: "Agent Instance", idPrefix: "ain" }],
   [ApiResourceKind.workflow_instance, { name: "WorkflowInstance", displayName: "Workflow Instance", idPrefix: "win" }],
   [ApiResourceKind.session, { name: "Session", displayName: "Session", idPrefix: "ses" }],
@@ -62,6 +63,7 @@ export const CLI_RELEVANT_KINDS: readonly ApiResourceKind[] = [
   ApiResourceKind.agent_channel,
   ApiResourceKind.channel_app,
   ApiResourceKind.datastore,
+  ApiResourceKind.schedule,
   ApiResourceKind.agent_instance,
   ApiResourceKind.workflow_instance,
   ApiResourceKind.session,

package/src/registry/registry.test.ts

@@ -1,6 +1,9 @@
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { describe, expect, it } from "vitest";
 import { APPLY_HANDLERS } from "../resources/apply/handlers.js";
+import { DELETE_HANDLERS } from "../resources/delete.js";
+import { GET_BINDINGS } from "../resources/get-bindings.js";
+import { LIST_HANDLERS, SEARCH_KINDS } from "../resources/list.js";
 import { defaultRegistry } from "./registry.js";
 import { Verb } from "./verbs.js";
 
@@ -72,7 +75,7 @@ describe("registry — verb support matrix", () => {
     expect(registry.supportsVerb(ApiResourceKind.workflow_instance, Verb.List)).toBe(false);
   });
 
-  it("agent_channel supports the declarative verbs, matching agent_share", () => {
+  it("agent_channel supports the full declarative verb set", () => {
     for (const v of [Verb.Apply, Verb.Get, Verb.List, Verb.Delete]) {
       expect(registry.supportsVerb(ApiResourceKind.agent_channel, v)).toBe(true);
     }
@@ -81,6 +84,23 @@ describe("registry — verb support matrix", () => {
     expect(registry.supportsVerb(ApiResourceKind.agent_channel, Verb.Search)).toBe(false);
   });
 
+  it("schedule supports the full declarative verb set", () => {
+    for (const v of [Verb.Apply, Verb.Get, Verb.List, Verb.Delete]) {
+      expect(registry.supportsVerb(ApiResourceKind.schedule, v)).toBe(true);
+    }
+    // Firing rides `stigmer schedule trigger`, never the generic run verb.
+    expect(registry.supportsVerb(ApiResourceKind.schedule, Verb.Run)).toBe(false);
+  });
+
+  it("session and agent_share promise only apply (narrowed — stigmer/stigmer#354)", () => {
+    for (const kind of [ApiResourceKind.session, ApiResourceKind.agent_share]) {
+      expect(registry.supportsVerb(kind, Verb.Apply)).toBe(true);
+      for (const v of [Verb.Get, Verb.List, Verb.Delete]) {
+        expect(registry.supportsVerb(kind, v)).toBe(false);
+      }
+    }
+  });
+
   it("typesForVerb(get) includes the core read kinds", () => {
     const kinds = new Set(registry.typesForVerb(Verb.Get).map((t) => t.kind));
     expect(kinds).toContain(ApiResourceKind.agent);
@@ -98,13 +118,98 @@ describe("registry — completeness", () => {
     }
   });
 
-  // The apply verb dispatches through an explicit handler registry, not
-  // the kind registry — a kind can advertise Apply in the verb matrix yet
-  // fail at dispatch if its handler entry is missing. Pin the wiring for
-  // the kinds whose apply path the declarative flow depends on.
-  it("every declarative kind with an Apply verb intent has an apply handler", () => {
-    for (const kind of [ApiResourceKind.agent_share, ApiResourceKind.agent_channel]) {
-      expect(APPLY_HANDLERS.get(kind), `apply handler missing for kind ${kind}`).toBeDefined();
+});
+
+// The verb matrix is a PROMISE (`list types` prints it; the command layer
+// gates on it), but each verb actually runs through its own dispatch
+// registry. A pair present in the matrix but absent from its registry fails
+// at the point of use with "not implemented" — the stigmer/stigmer#353 bug
+// class. This suite holds the two to strict bidirectional equality so the
+// drift is a red test instead of a runtime surprise. Verbs deliberately
+// withheld are narrowed out of the matrix (recorded in stigmer/stigmer#354),
+// never exempted here — an exemption category would legitimize exactly the
+// state this suite exists to reject.
+describe("registry — verb/dispatch conformance", () => {
+  // Special cases are kind/verb pairs that genuinely work through bespoke
+  // code instead of a registry entry; each names its dispatch site.
+  const DISPATCH: ReadonlyArray<{
+    label: string;
+    verb: Verb;
+    wired: ReadonlySet<ApiResourceKind>;
+    specialCases: ReadonlyMap<ApiResourceKind, string>;
+  }> = [
+    {
+      label: "apply",
+      verb: Verb.Apply,
+      wired: new Set(APPLY_HANDLERS.keys()),
+      specialCases: new Map([
+        [
+          ApiResourceKind.project,
+          "the stigmer.yaml declarative/synthesis track (resources/apply/declarative.ts); " +
+            "file mode refuses with a pointer there (resolveHandlerForKind)",
+        ],
+      ]),
+    },
+    {
+      label: "get",
+      verb: Verb.Get,
+      wired: new Set(GET_BINDINGS.keys()),
+      specialCases: new Map([
+        [
+          ApiResourceKind.organization,
+          "fetchOrganization in resources/get.ts (not org-scoped; a slug resolves via findMyOrganizations)",
+        ],
+      ]),
+    },
+    {
+      label: "list",
+      verb: Verb.List,
+      wired: new Set([...LIST_HANDLERS.keys(), ...SEARCH_KINDS]),
+      specialCases: new Map(),
+    },
+    {
+      label: "delete",
+      verb: Verb.Delete,
+      wired: new Set(DELETE_HANDLERS.keys()),
+      specialCases: new Map([
+        [
+          ApiResourceKind.organization,
+          "planOrganizationDelete in resources/delete.ts (not org-scoped; resolved via memberships)",
+        ],
+      ]),
+    },
+  ];
+
+  it.each(DISPATCH)("every kind promising '$label' has a dispatch entry", ({ verb, wired, specialCases }) => {
+    for (const info of registry.all()) {
+      if (!info.supportedVerbs.has(verb)) continue;
+      if (specialCases.has(info.kind)) continue;
+      expect(
+        wired.has(info.kind),
+        `${info.name} promises '${verb}' in the verb matrix but has no dispatch entry — ` +
+          "wire it or narrow the matrix (stigmer/stigmer#353, #354)",
+      ).toBe(true);
+    }
+  });
+
+  it.each(DISPATCH)("every '$label' dispatch entry is promised in the matrix", ({ verb, wired }) => {
+    for (const kind of wired) {
+      expect(
+        registry.supportsVerb(kind, verb),
+        `${ApiResourceKind[kind]} is wired for '${verb}' but the verb matrix does not promise it — ` +
+          "dead dispatch the command-layer gate blocks",
+      ).toBe(true);
+    }
+  });
+
+  it("special cases do not shadow a real dispatch entry", () => {
+    for (const { label, wired, specialCases } of DISPATCH) {
+      for (const kind of specialCases.keys()) {
+        expect(
+          wired.has(kind),
+          `${ApiResourceKind[kind]} '${label}' is documented as a special case yet also has a registry entry — drop one`,
+        ).toBe(false);
+      }
     }
   });
 });

package/src/registry/verb-support.ts

@@ -1,20 +1,14 @@
 // Verb-support matrix — which verbs each resource kind supports.
 //
-// This is CLI-specific policy (not stored in proto), ported verbatim from Go's
-// types.verbSupport so both CLIs expose the same surface. Keep in lockstep.
-//
-//   | Kind         | apply | validate | get | list | delete | run | push | search | download |
-//   |--------------|-------|----------|-----|------|--------|-----|------|--------|----------|
-//   | Organization | Y     | -        | Y   | Y    | Y      | -   | -    | -      | -        |
-//   | Agent        | Y     | Y        | Y   | Y    | Y      | Y   | -    | Y      | -        |
-//   | Workflow     | Y     | Y        | Y   | Y    | Y      | Y   | -    | Y      | -        |
-//   | Skill        | -     | -        | Y   | Y    | Y      | -   | Y    | -      | -        |
-//   | McpServer    | Y     | Y        | Y   | Y    | Y      | -   | -    | -      | -        |
-//   | Project      | Y*    | Y        | Y   | Y    | Y      | -   | -    | -      | -        |
-//   | Execution    | -     | -        | Y   | Y    | Y**    | -   | -    | -      | Y        |
-//
-//   *  Project "apply" triggers SDK synthesis mode.
-//   ** Execution "delete" maps to a cancel operation.
+// This is CLI-specific policy (not stored in proto), and it is a PROMISE:
+// `stigmer list types` prints it, the docs type tables are written from it,
+// and the command layer gates on it before dispatch. The conformance test in
+// registry.test.ts holds every promised apply/get/list/delete verb to an
+// actual dispatch entry — and every dispatch entry back to a promise — so a
+// verb listed here either works or fails CI. "Advertised but not
+// implemented" (stigmer/stigmer#353) is a rejected state, not a backlog;
+// verbs deliberately withheld pending a real ops story are recorded in
+// stigmer/stigmer#354, not here.
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { Verb } from "./verbs.js";
@@ -31,17 +25,24 @@ export const VERB_SUPPORT: ReadonlyMap<ApiResourceKind, ReadonlySet<Verb>> = new
   ],
   [ApiResourceKind.skill, new Set<Verb>([Verb.Get, Verb.List, Verb.Delete, Verb.Push])],
   [ApiResourceKind.mcp_server, new Set<Verb>([Verb.Apply, Verb.Validate, Verb.Get, Verb.List, Verb.Delete])],
+  // Project apply is the stigmer.yaml declarative/synthesis track, not
+  // `apply -f project.yaml` — resolveHandlerForKind carries the teaching
+  // refusal, and the conformance test documents it as a special case.
   [ApiResourceKind.project, new Set<Verb>([Verb.Apply, Verb.Validate, Verb.Get, Verb.List, Verb.Delete])],
   [ApiResourceKind.api_key, new Set<Verb>([Verb.Get, Verb.List, Verb.Delete])],
   // agent_execution is special — uses dedicated AgentExecutionQueryController
   // RPCs, not the unified SearchService. delete maps to cancel.
   [ApiResourceKind.agent_execution, new Set<Verb>([Verb.Get, Verb.List, Verb.Delete, Verb.Download])],
-  [ApiResourceKind.identity_provider, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
-  [ApiResourceKind.oauth_app, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
+  // IAM apps are configured declaratively; read/ops verbs are deliberately
+  // not promised (never wired, no demand — stigmer/stigmer#354). To add one:
+  // dispatch entry + this line, in the same change.
+  [ApiResourceKind.identity_provider, new Set<Verb>([Verb.Apply])],
+  [ApiResourceKind.oauth_app, new Set<Verb>([Verb.Apply])],
   [ApiResourceKind.environment, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
-  // Enable/disable flows through `stigmer share agent`; the generic verbs
-  // cover the declarative path (apply a manifest, inspect, tear down).
-  [ApiResourceKind.agent_share, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
+  // Enable/disable flows through `stigmer share agent`, which is the whole
+  // read/ops surface today; only the declarative apply path is promised
+  // (stigmer/stigmer#354 records the narrowing).
+  [ApiResourceKind.agent_share, new Set<Verb>([Verb.Apply])],
   // The provider install flow is console-driven and cloud-only; the generic
   // verbs cover the declarative path (apply a manifest, inspect, tear down).
   [ApiResourceKind.agent_channel, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
@@ -52,10 +53,17 @@ export const VERB_SUPPORT: ReadonlyMap<ApiResourceKind, ReadonlySet<Verb>> = new
   // generic verbs cover the declarative path (apply a manifest, inspect,
   // tear down — delete is guarded server-side for non-empty datastores).
   [ApiResourceKind.datastore, new Set<Verb>([Verb.Apply, Verb.Validate, Verb.Get, Verb.List, Verb.Delete])],
+  // Firing is the platform's job (Temporal Schedules); the generic verbs
+  // cover the declarative path, and get/list surface the state the dedicated
+  // `stigmer schedule` commands act on — spec.enabled (the owner's switch)
+  // versus status.paused_reason (the platform's failure latch).
+  [ApiResourceKind.schedule, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
   [ApiResourceKind.agent_instance, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
   // No list: proto exposes getByWorkflow (requires workflow_id), not a generic list.
   [ApiResourceKind.workflow_instance, new Set<Verb>([Verb.Apply, Verb.Get, Verb.Delete])],
-  [ApiResourceKind.session, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
+  // Sessions are runtime conversation state with no CLI read/ops story yet;
+  // get/list/delete are deliberately not promised (stigmer/stigmer#354).
+  [ApiResourceKind.session, new Set<Verb>([Verb.Apply])],
 ]);
 
 export function verbsForKind(kind: ApiResourceKind): ReadonlySet<Verb> {

package/src/registry/verbs.ts

@@ -1,5 +1,4 @@
 // CLI verbs — operations that can be performed on a resource.
-// Mirrors the Go types.Verb set so the two CLIs stay behaviorally identical.
 
 export const Verb = {
   Apply: "apply",

package/src/resources/apply/apply.integration.test.ts

@@ -17,6 +17,8 @@ import { type ConnectRouter, createClient } from "@connectrpc/connect";
 import { connectNodeAdapter } from "@connectrpc/connect-node";
 import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
+import type { ChannelApp } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
+import { ChannelAppCommandController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/command_pb";
 import type { Datastore } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
 import { DatastoreCommandController } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/command_pb";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
@@ -33,11 +35,13 @@ const openSessions = new Set<ServerHttp2Session>();
 let appliedAgents: Agent[] = [];
 let appliedMcps: McpServer[] = [];
 let appliedDatastores: Datastore[] = [];
+let appliedChannelApps: ChannelApp[] = [];
 
 beforeEach(() => {
   appliedAgents = [];
   appliedMcps = [];
   appliedDatastores = [];
+  appliedChannelApps = [];
 });
 
 function writeYaml(dir: string, name: string, body: string): string {
@@ -66,6 +70,12 @@ beforeAll(async () => {
         return req;
       },
     });
+    router.service(ChannelAppCommandController, {
+      apply: (req) => {
+        appliedChannelApps.push(req);
+        return req;
+      },
+    });
   };
 
   backend = createHttp2Server(connectNodeAdapter({ routes }));
@@ -215,6 +225,128 @@ describe("file-mode apply — datastore", () => {
   });
 });
 
+// The stigmer/stigmer#353 regression block: ChannelApp apply used to fail
+// with "apply not implemented for Channel App" because the CLI's handler
+// table was a drifted copy of the SDK manifest registry. The handlers now
+// COME FROM that registry, so this suite pins the whole class: the kind
+// applies, secrets round-trip verbatim, and the ordering the registry
+// encodes (app before the channel that references it) is honored.
+const CHANNEL_APP_YAML = [
+  "apiVersion: agentic.stigmer.ai/v1",
+  "kind: ChannelApp",
+  "metadata:",
+  "  name: demo-whatsapp",
+  "  slug: demo-whatsapp",
+  "spec:",
+  "  whatsapp:",
+  "    app_id: '108954'",
+  "    app_secret: '***REDACTED***'",
+  "    access_token: '***REDACTED***'",
+  "    verify_token: '***REDACTED***'",
+  "",
+].join("\n");
+
+const AGENT_CHANNEL_YAML = [
+  "apiVersion: agentic.stigmer.ai/v1",
+  "kind: AgentChannel",
+  "metadata:",
+  "  name: isc-whatsapp",
+  "  slug: isc-whatsapp",
+  "spec:",
+  "  enabled: true",
+  "  agent_ref: { kind: 40, org: acme, slug: clinic-assistant }",
+  "  whatsapp: { phone_number_id: '106540352242922' }",
+  "",
+].join("\n");
+
+const SCHEDULE_YAML = [
+  "apiVersion: agentic.stigmer.ai/v1",
+  "kind: Schedule",
+  "metadata:",
+  "  name: daily-fee-reminders",
+  "  slug: daily-fee-reminders",
+  "spec:",
+  "  cron: '0 9 * * *'",
+  "  time_zone: Asia/Kolkata",
+  "  enabled: false",
+  "  agent:",
+  "    agent_ref: { kind: 40, org: acme, slug: clinic-assistant }",
+  "    message: run the reminders",
+  "",
+].join("\n");
+
+describe("file-mode apply — channel app (#353)", () => {
+  it("applies a ChannelApp through the raw controller with the redaction markers intact", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
+    try {
+      writeYaml(dir, "chapp.yaml", CHANNEL_APP_YAML);
+      const items = resolveApplyItems(dir);
+      expect(items).toHaveLength(1);
+
+      const outcome = await applyItem(controllerFn, items[0], "acme", false);
+      expect(outcome.result.message).toBe("Channel App created successfully");
+
+      expect(appliedChannelApps).toHaveLength(1);
+      const spec = appliedChannelApps[0].spec;
+      expect(spec?.providerConfig.case).toBe("whatsapp");
+      if (spec?.providerConfig.case !== "whatsapp") throw new Error("unreachable");
+      expect(spec.providerConfig.value.appId).toBe("108954");
+      // The redaction markers must reach the server verbatim — that is the
+      // convention by which applying a fetched manifest preserves stored
+      // secrets (verb-support's OAuthApp marker note).
+      expect(spec.providerConfig.value.appSecret).toBe("***REDACTED***");
+      expect(spec.providerConfig.value.accessToken).toBe("***REDACTED***");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("treats a ChannelApp carrying metadata.id as an update", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
+    try {
+      writeYaml(
+        dir,
+        "chapp.yaml",
+        CHANNEL_APP_YAML.replace("metadata:", "metadata:\n  id: chapp_existing"),
+      );
+      const items = resolveApplyItems(dir);
+      const outcome = await applyItem(controllerFn, items[0], "acme", false);
+      expect(outcome.result.message).toBe("Channel App updated successfully");
+      expect(appliedChannelApps[0].metadata?.id).toBe("chapp_existing");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("orders one bundle app → channel → schedule regardless of file order", () => {
+    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
+    try {
+      // File names chosen so lexical file order is exactly WRONG — before
+      // the registry unification all three kinds fell to a shared default
+      // priority and applied in this (broken) file order.
+      writeYaml(dir, "a-schedule.yaml", SCHEDULE_YAML);
+      writeYaml(dir, "b-channel.yaml", AGENT_CHANNEL_YAML);
+      writeYaml(dir, "c-chapp.yaml", CHANNEL_APP_YAML);
+      const items = resolveApplyItems(dir);
+      expect(items.map((i) => i.handler.displayName)).toEqual(["Channel App", "Agent Channel", "Schedule"]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("file-mode apply — project special case", () => {
+  it("refuses a Project manifest with a pointer to the stigmer.yaml flow", () => {
+    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
+    try {
+      writeYaml(dir, "project.yaml", ["kind: Project", "metadata:", "  name: Demo", "  slug: demo", ""].join("\n"));
+      expect(() => resolveApplyItems(dir)).toThrow(/stigmer\.yaml/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
 describe("file-mode apply — orchestration", () => {
   it("sorts items into dependency order (mcp_server before agent)", () => {
     const dir = mkdtempSync(join(tmpdir(), "apply-it-"));