cool-workflow 0.1.98 → 0.2.1

package/dist/{workflow-app-framework.js → core/workflow-apps/app-schema.js}

@@ -1,329 +1,191 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
+// core/workflow-apps/app-schema.ts — workflow-app manifest + workflow DSL
+// types, a pure builder API (`workflow`, `phase`, `parallel`, `loop`,
+// `agent`, `artifact`, `subWorkflow`, `input`), and full manifest
+// validation (`validateWorkflowApp`).
+//
+// MILESTONE 12 (docs/rebuild/PLAN.md build order; workflow-apps.md). Milestone 6+7
+// built the minimal real subset needed to load ONE app and drive it
+// end to end (see git history / the old header note this replaces).
+// This milestone adds, on top of that, WITHOUT changing any existing
+// exported function's signature or behavior:
+//   - `loop()` — sugar over `phase()` that sets a bounded dynamic loop
+//     spec, byte-exact to src/workflow-api.ts.
+//   - `subWorkflow()` — sugar over `agent()` that adds a `subWorkflow`
+//     field, byte-exact to src/workflow-api.ts.
+//   - `validateWorkflowApp`/`assertValidWorkflowApp`/
+//     `validateWorkflowDefinition` — the full WorkflowAppValidationIssue
+//     taxonomy `cw app validate` needs, ported byte-for-byte from
+//     src/workflow-app-framework.ts.
+//   - `WorkflowAppValidationError` — thrown by a fail-closed manifest
+//     load (see shell/workflow-app-loader.ts's discovery functions).
+//
+// Pure factory + validation functions (this file, no `fs`/`child_process`/
+// `process.env`); the actual `require()`/fs read of an app's manifest +
+// entrypoint, and `cw app list/show/validate/init/package` discovery,
+// live in shell/ (see shell/workflow-app-loader.ts), per the core/shell
+// split.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkflowAppValidationError = exports.workflow = exports.slugify = exports.phase = exports.input = exports.createWorkflowApi = exports.artifact = exports.agent = void 0;
-exports.defineWorkflowApp = defineWorkflowApp;
+exports.WorkflowAppValidationError = void 0;
+exports.slugify = slugify;
+exports.workflow = workflow;
+exports.phase = phase;
+exports.parallel = parallel;
+exports.loop = loop;
+exports.agent = agent;
+exports.subWorkflow = subWorkflow;
+exports.artifact = artifact;
+exports.input = input;
+exports.createWorkflowApi = createWorkflowApi;
+exports.validateWorkflowDefinition = validateWorkflowDefinition;
 exports.validateWorkflowApp = validateWorkflowApp;
 exports.assertValidWorkflowApp = assertValidWorkflowApp;
-exports.validateWorkflowDefinition = validateWorkflowDefinition;
-exports.loadWorkflowAppFromEntrypoint = loadWorkflowAppFromEntrypoint;
-exports.loadWorkflowAppFromManifest = loadWorkflowAppFromManifest;
-exports.summarizeWorkflowApp = summarizeWorkflowApp;
+exports.isWorkflowAppCompatible = isWorkflowAppCompatible;
+exports.validationIssuesFromError = validationIssuesFromError;
 exports.workflowAppRunMetadata = workflowAppRunMetadata;
-exports.createLegacyWorkflowApp = createLegacyWorkflowApp;
-exports.renderWorkflowAppTemplate = renderWorkflowAppTemplate;
-exports.renderWorkflowAppManifestTemplate = renderWorkflowAppManifestTemplate;
-exports.renderWorkflowAppEntrypointTemplate = renderWorkflowAppEntrypointTemplate;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const workflow_api_1 = require("./workflow-api");
-Object.defineProperty(exports, "agent", { enumerable: true, get: function () { return workflow_api_1.agent; } });
-Object.defineProperty(exports, "artifact", { enumerable: true, get: function () { return workflow_api_1.artifact; } });
-Object.defineProperty(exports, "createWorkflowApi", { enumerable: true, get: function () { return workflow_api_1.createWorkflowApi; } });
-Object.defineProperty(exports, "input", { enumerable: true, get: function () { return workflow_api_1.input; } });
-Object.defineProperty(exports, "phase", { enumerable: true, get: function () { return workflow_api_1.phase; } });
-Object.defineProperty(exports, "slugify", { enumerable: true, get: function () { return workflow_api_1.slugify; } });
-Object.defineProperty(exports, "workflow", { enumerable: true, get: function () { return workflow_api_1.workflow; } });
-const sandbox_profile_1 = require("./sandbox-profile");
-const version_1 = require("./version");
+function slugify(value) {
+    return String(value)
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "")
+        .replace(/-{2,}/g, "-");
+}
+function workflow(definition) {
+    if (!definition.id)
+        throw new Error("workflow.id is required");
+    if (!definition.title)
+        throw new Error("workflow.title is required");
+    if (!Array.isArray(definition.phases))
+        throw new Error("workflow.phases must be an array");
+    return {
+        limits: { maxAgents: 20, maxConcurrentAgents: 4, ...(definition.limits || {}) },
+        inputs: [],
+        summary: "",
+        ...definition,
+    };
+}
+function phase(name, tasks, options = {}) {
+    if (!name)
+        throw new Error("phase name is required");
+    if (!Array.isArray(tasks))
+        throw new Error(`phase ${name} tasks must be an array`);
+    return { id: slugify(name), name, status: "pending", tasks, ...options };
+}
+function parallel(name, tasks, options = {}) {
+    return phase(name, tasks, { mode: "parallel", ...options });
+}
+/** A BOUNDED DYNAMIC LOOP phase: `tasks` are a per-round template. After each
+ *  round completes, the registered `until` predicate decides whether to run
+ *  another round (a fresh appended phase with the same tasks, round-suffixed
+ *  ids) or stop; capped at `maxRounds`. Sugar over phase() that sets `loop`;
+ *  plain phases are unaffected. Byte-exact to src/workflow-api.ts's loop(). */
+function loop(name, tasks, spec, options = {}) {
+    if (!spec || typeof spec.maxRounds !== "number" || spec.maxRounds < 1) {
+        throw new Error(`loop ${name} requires a positive integer maxRounds`);
+    }
+    const until = spec.until;
+    const valid = until &&
+        ((until.kind === "predicate" && Boolean(until.ref)) ||
+            (until.kind === "budget-target" && typeof until.target === "number" && until.target > 0));
+    if (!valid) {
+        throw new Error(`loop ${name} requires until: { kind: "predicate", ref } or { kind: "budget-target", target }`);
+    }
+    return phase(name, tasks, { loop: { maxRounds: Math.floor(spec.maxRounds), until }, ...options });
+}
+function task(kind, id, prompt, options) {
+    if (!id)
+        throw new Error(`${kind} task id is required`);
+    if (!prompt)
+        throw new Error(`${kind} task ${id} prompt is required`);
+    return {
+        id,
+        kind,
+        prompt,
+        status: "pending",
+        sandboxProfileId: typeof options.sandboxProfileId === "string" ? options.sandboxProfileId : undefined,
+        ...options,
+    };
+}
+function agent(id, prompt, options = {}) {
+    return task("agent", id, prompt, options);
+}
+/** A task fulfilled by an inline SUB-WORKFLOW: instead of spawning an agent,
+ *  the drive plans + drives the child `appId` and binds its report back as
+ *  this task's result. The prompt is recorded for provenance but is not sent
+ *  to an agent. Byte-exact to src/workflow-api.ts's subWorkflow(). */
+function subWorkflow(id, appId, options = {}) {
+    if (!appId)
+        throw new Error(`subWorkflow task ${id} requires an appId`);
+    const { inputs, bindResult, prompt, ...rest } = options;
+    return task("agent", id, prompt || `Delegate to sub-workflow app: ${appId}`, {
+        ...rest,
+        subWorkflow: { appId, ...(inputs ? { inputs } : {}), ...(bindResult ? { bindResult } : {}) },
+    });
+}
+function artifact(id, prompt, options = {}) {
+    return task("artifact", id, prompt, options);
+}
+function input(name, options = {}) {
+    if (!name)
+        throw new Error("input name is required");
+    return { name, ...options };
+}
+function createWorkflowApi() {
+    return { workflow, phase, parallel, loop, agent, artifact, subWorkflow, input };
+}
 class WorkflowAppValidationError extends Error {
     issues;
     constructor(message, issues) {
-        super(`${message}: ${issues.map((issue) => issue.message).join("; ")}`);
+        super(`${message}: ${issues.map((one) => one.message).join("; ")}`);
         this.name = "WorkflowAppValidationError";
         this.issues = issues;
     }
 }
 exports.WorkflowAppValidationError = WorkflowAppValidationError;
-function defineWorkflowApp(definition) {
-    assertValidWorkflowApp(definition, { appPath: "inline" });
-    return definition;
-}
-function validateWorkflowApp(candidate, options = {}) {
-    const issues = [];
-    const appPath = options.appPath;
-    if (!isRecord(candidate)) {
-        return {
-            valid: false,
-            appPath,
-            issues: [issue("workflow-app-invalid", "Workflow app must be an object", appPath)]
-        };
-    }
-    const app = candidate;
-    if (app.schemaVersion !== version_1.WORKFLOW_APP_SCHEMA_VERSION) {
-        issues.push(issue("workflow-app-schema-version", `Workflow app schemaVersion must be ${version_1.WORKFLOW_APP_SCHEMA_VERSION}`, joinPath(appPath, "schemaVersion")));
-    }
-    validateAppId(app.id, issues, joinPath(appPath, "id"));
-    if (!isNonEmptyString(app.title)) {
-        issues.push(issue("workflow-app-title", "Workflow app title is required", joinPath(appPath, "title")));
-    }
-    if (!isSemver(app.version)) {
-        issues.push(issue("workflow-app-version", "Workflow app version must be a semver string such as 0.1.0", joinPath(appPath, "version")));
-    }
-    validateAuthor(app.author, issues, joinPath(appPath, "author"));
-    validateInputDefinitions(app.inputs, issues, joinPath(appPath, "inputs"), { optional: true });
-    validateSandboxProfileReferences(app.sandboxProfiles, issues, joinPath(appPath, "sandboxProfiles"), { optional: true });
-    validateCompatibility(app.compatibility, issues, joinPath(appPath, "compatibility"));
-    const workflowValue = options.loadedWorkflow || app.workflow;
-    if (!workflowValue) {
-        issues.push(issue("workflow-app-workflow", "Workflow app workflow is required", joinPath(appPath, "workflow")));
-    }
-    else if (isWorkflowEntrypoint(workflowValue)) {
-        validateEntrypoint(workflowValue, issues, joinPath(appPath, "workflow"));
-    }
-    else {
-        validateWorkflowDefinition(workflowValue, issues, joinPath(appPath, "workflow"), {
-            appId: isNonEmptyString(app.id) ? app.id : undefined,
-            appTitle: isNonEmptyString(app.title) ? app.title : undefined,
-            appSandboxProfiles: app.sandboxProfiles
-        });
-        if (Array.isArray(app.inputs) && isWorkflowDefinition(workflowValue)) {
-            validateMatchingInputs(app.inputs, workflowValue.inputs || [], issues, joinPath(appPath, "inputs"));
-        }
-    }
-    return {
-        valid: issues.length === 0,
-        appId: isNonEmptyString(app.id) ? app.id : undefined,
-        appPath,
-        issues
-    };
-}
-function assertValidWorkflowApp(candidate, options = {}) {
-    const result = validateWorkflowApp(candidate, options);
-    if (!result.valid) {
-        throw new WorkflowAppValidationError("Invalid workflow app", result.issues);
-    }
+function issue(code, message, pathName) {
+    return { code, message, path: pathName };
 }
-function validateWorkflowDefinition(candidate, issues = [], basePath = "workflow", options = {}) {
-    if (!isRecord(candidate)) {
-        issues.push(issue("workflow-invalid", "Workflow definition must be an object", basePath));
-        return issues;
-    }
-    const workflowDefinition = candidate;
-    validateWorkflowId(workflowDefinition.id, issues, joinPath(basePath, "id"));
-    if (!isNonEmptyString(workflowDefinition.title)) {
-        issues.push(issue("workflow-title", "Workflow title is required", joinPath(basePath, "title")));
-    }
-    if (options.appId && workflowDefinition.id !== options.appId) {
-        issues.push(issue("workflow-app-id-mismatch", `Workflow id must match app id ${options.appId}`, joinPath(basePath, "id")));
-    }
-    if (options.appTitle && workflowDefinition.title !== options.appTitle) {
-        issues.push(issue("workflow-app-title-mismatch", `Workflow title must match app title ${options.appTitle}`, joinPath(basePath, "title")));
-    }
-    validateLimits(workflowDefinition.limits, issues, joinPath(basePath, "limits"));
-    validateInputDefinitions(workflowDefinition.inputs, issues, joinPath(basePath, "inputs"), { optional: false });
-    validateSandboxProfileReferences(workflowDefinition.sandboxProfiles, issues, joinPath(basePath, "sandboxProfiles"), { optional: true });
-    validatePhases(workflowDefinition.phases, workflowDefinition.limits, issues, joinPath(basePath, "phases"), {
-        appSandboxProfiles: options.appSandboxProfiles || workflowDefinition.sandboxProfiles
-    });
-    return issues;
+function joinPath(basePath, segment) {
+    if (!basePath)
+        return segment;
+    return `${basePath}.${segment}`;
 }
-function loadWorkflowAppFromEntrypoint(file, options = {}) {
-    const entrypointPath = node_path_1.default.resolve(file);
-    const materialized = materializeModuleExport(entrypointPath, options.exportName);
-    const loaded = extractWorkflowAppExport(materialized, entrypointPath);
-    const source = {
-        kind: options.sourceKind || "workflow-file",
-        path: entrypointPath,
-        entrypointPath
-    };
-    if (loaded.app) {
-        const app = {
-            ...loaded.app,
-            workflow: loaded.workflow
-        };
-        assertValidWorkflowApp(app, { appPath: entrypointPath });
-        return { app, source, legacy: false };
-    }
-    const app = createLegacyWorkflowApp(loaded.workflow, source);
-    assertValidWorkflowApp(app, { appPath: entrypointPath });
-    return { app, source, legacy: true };
-}
-function loadWorkflowAppFromManifest(manifestPath) {
-    const absoluteManifestPath = node_path_1.default.resolve(manifestPath);
-    if (!node_fs_1.default.existsSync(absoluteManifestPath)) {
-        throw new WorkflowAppValidationError("Invalid workflow app manifest", [
-            issue("workflow-app-manifest-not-found", `Workflow app manifest does not exist: ${absoluteManifestPath}`, absoluteManifestPath)
-        ]);
-    }
-    let manifest;
-    try {
-        manifest = JSON.parse(node_fs_1.default.readFileSync(absoluteManifestPath, "utf8"));
-    }
-    catch (error) {
-        throw new WorkflowAppValidationError("Invalid workflow app manifest", [
-            issue("workflow-app-manifest-json", `Workflow app manifest is not valid JSON: ${messageOf(error)}`, absoluteManifestPath)
-        ]);
-    }
-    const manifestValidation = validateWorkflowApp(manifest, { appPath: absoluteManifestPath });
-    if (!manifestValidation.valid) {
-        throw new WorkflowAppValidationError("Invalid workflow app manifest", manifestValidation.issues);
-    }
-    if (!isWorkflowEntrypoint(manifest.workflow)) {
-        throw new WorkflowAppValidationError("Invalid workflow app manifest", [
-            issue("workflow-app-entrypoint", "Manifest workflow must be an entrypoint object", joinPath(absoluteManifestPath, "workflow"))
-        ]);
-    }
-    const entrypointPath = node_path_1.default.resolve(node_path_1.default.dirname(absoluteManifestPath), manifest.workflow.entrypoint);
-    const materialized = materializeModuleExport(entrypointPath, manifest.workflow.exportName);
-    const loaded = extractWorkflowAppExport(materialized, entrypointPath);
-    const workflowDefinition = loaded.workflow;
-    const source = {
-        kind: node_path_1.default.basename(absoluteManifestPath) === "app.json" ? "app-directory" : "app-manifest",
-        path: node_path_1.default.dirname(absoluteManifestPath),
-        manifestPath: absoluteManifestPath,
-        entrypointPath
-    };
-    if (loaded.app) {
-        validateEntrypointAppMatchesManifest(loaded.app, manifest, absoluteManifestPath);
-    }
-    const app = {
-        ...manifest,
-        workflow: workflowDefinition
-    };
-    assertValidWorkflowApp(app, {
-        appPath: absoluteManifestPath,
-        loadedWorkflow: workflowDefinition
-    });
-    return { app, source, legacy: false };
-}
-function summarizeWorkflowApp(record) {
-    const workflowDefinition = record.app.workflow;
-    const sandboxProfiles = record.app.sandboxProfiles || workflowDefinition.sandboxProfiles || [];
-    const summary = {
-        id: record.app.id,
-        title: record.app.title,
-        summary: record.app.summary || workflowDefinition.summary || "",
-        version: record.app.version,
-        author: record.app.author,
-        file: record.source.entrypointPath || record.source.manifestPath || record.source.path,
-        sourceKind: record.source.kind,
-        legacy: record.legacy,
-        compatible: isAppCompatible(record.app),
-        inputs: record.app.inputs || workflowDefinition.inputs || [],
-        sandboxProfiles,
-        phases: workflowDefinition.phases.map((phaseDefinition) => ({
-            id: phaseDefinition.id,
-            name: phaseDefinition.name,
-            taskCount: phaseDefinition.tasks.length
-        })),
-        taskCount: workflowDefinition.phases.reduce((total, phaseDefinition) => total + phaseDefinition.tasks.length, 0)
-    };
-    return summary;
+function isRecord(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function workflowAppRunMetadata(record) {
-    return {
-        schemaVersion: version_1.WORKFLOW_APP_SCHEMA_VERSION,
-        id: record.app.id,
-        title: record.app.title,
-        summary: record.app.summary || record.app.workflow.summary || "",
-        version: record.app.version,
-        author: record.app.author,
-        compatibility: record.app.compatibility,
-        sandboxProfiles: record.app.sandboxProfiles || record.app.workflow.sandboxProfiles,
-        source: record.source,
-        metadata: record.app.metadata
-    };
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
 }
-function createLegacyWorkflowApp(workflowDefinition, source) {
-    return {
-        schemaVersion: version_1.WORKFLOW_APP_SCHEMA_VERSION,
-        id: workflowDefinition.id,
-        title: workflowDefinition.title,
-        summary: workflowDefinition.summary || "",
-        version: "0.0.0",
-        workflow: workflowDefinition,
-        inputs: workflowDefinition.inputs || [],
-        sandboxProfiles: workflowDefinition.sandboxProfiles || collectWorkflowSandboxProfiles(workflowDefinition),
-        compatibility: {
-            maxVersion: version_1.CURRENT_COOL_WORKFLOW_VERSION,
-            notes: "Compatibility wrapper for legacy .workflow.js factory files."
-        },
-        metadata: {
-            legacyWorkflow: true,
-            sourcePath: source.path
-        }
-    };
+function isSemver(value) {
+    return typeof value === "string" && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(value);
 }
-function renderWorkflowAppTemplate(id, title) {
-    return `const { defineWorkflowApp, workflow, phase, agent, artifact, input } = require("../dist/workflow-app-framework");\n\nconst inputs = [\n  input("question", { required: true, description: "Question or task this workflow should answer." })\n];\n\nmodule.exports = defineWorkflowApp({\n  schemaVersion: 1,\n  id: ${JSON.stringify(id)},\n  title: ${JSON.stringify(title)},\n  summary: "Describe what this workflow app does.",\n  version: "0.1.0",\n  author: "COOLWHITE LLC",\n  inputs,\n  sandboxProfiles: ["readonly"],\n  compatibility: {\n    minVersion: "0.1.9"\n  },\n  workflow: workflow({\n    id: ${JSON.stringify(id)},\n    title: ${JSON.stringify(title)},\n    summary: "Describe what this workflow app does.",\n    limits: {\n      maxAgents: 8,\n      maxConcurrentAgents: 4\n    },\n    inputs,\n    sandboxProfiles: ["readonly"],\n    phases: [\n      phase("Map", [\n        agent("map:context", "Map the task context, constraints, and evidence needed for {{question}}.", { sandboxProfileId: "readonly" })\n      ]),\n      phase("Assess", [\n        agent("assess:risks", "Assess risks, tradeoffs, and unknowns for {{question}}.", { sandboxProfileId: "readonly" })\n      ]),\n      phase("Synthesize", [\n        artifact("synthesis:report", "Synthesize the final answer for {{question}}.", { requiresEvidence: true, sandboxProfileId: "readonly" })\n      ])\n    ]\n  })\n});\n`;
+function semverParts(value) {
+    const [major, minor, patch] = value
+        .split(/[+-]/)[0]
+        .split(".")
+        .map((part) => Number(part));
+    return [major || 0, minor || 0, patch || 0];
 }
-function renderWorkflowAppManifestTemplate(id, title) {
-    return `${JSON.stringify({
-        schemaVersion: version_1.WORKFLOW_APP_SCHEMA_VERSION,
-        id,
-        title,
-        summary: "Describe what this workflow app does.",
-        version: "0.1.0",
-        author: "COOLWHITE LLC",
-        inputs: [
-            {
-                name: "question",
-                type: "string",
-                required: true,
-                description: "Question or task this workflow should answer."
-            }
-        ],
-        sandboxProfiles: ["readonly"],
-        compatibility: {
-            minVersion: "0.1.9"
-        },
-        workflow: {
-            entrypoint: "workflow.js"
-        }
-    }, null, 2)}\n`;
-}
-function renderWorkflowAppEntrypointTemplate(id, title) {
-    return `module.exports = ({ workflow, phase, agent, artifact, input }) => {\n  const inputs = [\n    input("question", { type: "string", required: true, description: "Question or task this workflow should answer." })\n  ];\n\n  return workflow({\n    id: ${JSON.stringify(id)},\n    title: ${JSON.stringify(title)},\n    summary: "Describe what this workflow app does.",\n    limits: {\n      maxAgents: 8,\n      maxConcurrentAgents: 4\n    },\n    inputs,\n    sandboxProfiles: ["readonly"],\n    phases: [\n      phase("Map", [\n        agent("map:context", "Map the task context, constraints, and evidence needed for {{question}}.", { sandboxProfileId: "readonly" })\n      ]),\n      phase("Assess", [\n        agent("assess:risks", "Assess risks, tradeoffs, and unknowns for {{question}}.", { sandboxProfileId: "readonly" })\n      ]),\n      phase("Synthesize", [\n        artifact("synthesis:report", "Synthesize the final answer for {{question}}.", { requiresEvidence: true, sandboxProfileId: "readonly" })\n      ])\n    ]\n  });\n};\n`;
-}
-function materializeModuleExport(file, exportName) {
-    if (!node_fs_1.default.existsSync(file)) {
-        throw new WorkflowAppValidationError("Invalid workflow app entrypoint", [
-            issue("workflow-app-entrypoint-not-found", `Workflow app entrypoint does not exist: ${file}`, file)
-        ]);
-    }
-    // Workflow apps are plain runtime JavaScript, not TypeScript.
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const rawExport = require(file);
-    const selectedExport = exportName && isRecord(rawExport) ? rawExport[exportName] : rawExport;
-    if (exportName && selectedExport === undefined) {
-        throw new WorkflowAppValidationError("Invalid workflow app entrypoint", [
-            issue("workflow-app-entrypoint-export", `Workflow app entrypoint does not export ${exportName}`, file)
-        ]);
-    }
-    if (typeof selectedExport === "function") {
-        return selectedExport({
-            ...(0, workflow_api_1.createWorkflowApi)(),
-            defineWorkflowApp
-        });
+function compareSemver(left, right) {
+    const leftParts = semverParts(left);
+    const rightParts = semverParts(right);
+    for (let index = 0; index < 3; index += 1) {
+        if (leftParts[index] !== rightParts[index])
+            return leftParts[index] < rightParts[index] ? -1 : 1;
     }
-    return selectedExport;
+    return 0;
 }
-function extractWorkflowAppExport(value, file) {
-    if (isWorkflowAppDefinition(value) && isWorkflowDefinition(value.workflow)) {
-        return {
-            app: value,
-            workflow: value.workflow
-        };
-    }
-    if (isWorkflowDefinition(value)) {
-        return { workflow: value };
-    }
-    throw new WorkflowAppValidationError("Invalid workflow app entrypoint", [
-        issue("workflow-app-entrypoint-export", "Workflow app entrypoint must export a workflow definition, workflow app, or factory", file)
-    ]);
+function isWorkflowDefinition(value) {
+    return (isRecord(value) &&
+        isNonEmptyString(value.id) &&
+        isNonEmptyString(value.title) &&
+        Array.isArray(value.phases) &&
+        isRecord(value.limits) &&
+        Array.isArray(value.inputs));
 }
-function validateEntrypointAppMatchesManifest(entrypointApp, manifest, manifestPath) {
-    const issues = [];
-    for (const key of ["schemaVersion", "id", "title", "version"]) {
-        if (entrypointApp[key] !== manifest[key]) {
-            issues.push(issue("workflow-app-manifest-mismatch", `Entrypoint app ${key} must match manifest ${key}`, joinPath(manifestPath, key)));
-        }
-    }
-    if (issues.length)
-        throw new WorkflowAppValidationError("Invalid workflow app manifest", issues);
+function isWorkflowEntrypoint(value) {
+    return isRecord(value) && "entrypoint" in value && !("phases" in value);
 }
 function validateAppId(value, issues, pathName) {
     if (!isNonEmptyString(value)) {
@@ -409,7 +271,7 @@ function validateMatchingInputs(appInputs, workflowInputs, issues, pathName) {
         issues.push(issue("workflow-app-inputs-mismatch", "Workflow app inputs must match workflow.inputs when both are present", pathName));
     }
 }
-function validateSandboxProfileReferences(profiles, issues, pathName, options = { optional: false }) {
+function validateSandboxProfileReferences(profiles, issues, pathName, bundledIds, options = { optional: false }) {
     if (profiles === undefined && options.optional)
         return;
     if (!Array.isArray(profiles)) {
@@ -417,7 +279,6 @@ function validateSandboxProfileReferences(profiles, issues, pathName, options =
         return;
     }
     const seen = new Set();
-    const bundled = (0, sandbox_profile_1.bundledSandboxProfileIds)();
     for (const [index, value] of profiles.entries()) {
         const profilePath = joinPath(pathName, String(index));
         if (!isNonEmptyString(value)) {
@@ -428,20 +289,20 @@ function validateSandboxProfileReferences(profiles, issues, pathName, options =
             issues.push(issue("workflow-sandbox-profile-duplicate", `Duplicate sandbox profile reference: ${value}`, profilePath));
         }
         seen.add(value);
-        if (!(0, sandbox_profile_1.isBundledSandboxProfileId)(value)) {
-            issues.push(issue("workflow-sandbox-profile-unknown", `Unknown sandbox profile ${value}; bundled profiles: ${bundled.join(", ")}`, profilePath));
+        if (!bundledIds.includes(value)) {
+            issues.push(issue("workflow-sandbox-profile-unknown", `Unknown sandbox profile ${value}; bundled profiles: ${bundledIds.join(", ")}`, profilePath));
         }
     }
 }
-function validateCompatibility(value, issues, pathName) {
+function validateCompatibility(value, issues, pathName, currentVersion) {
     if (value === undefined)
         return;
     if (!isRecord(value)) {
         issues.push(issue("workflow-app-compatibility", "Workflow app compatibility must be an object", pathName));
         return;
     }
-    if (value.workflowSchemaVersion !== undefined && value.workflowSchemaVersion !== version_1.WORKFLOW_APP_SCHEMA_VERSION) {
-        issues.push(issue("workflow-app-compatibility", `Workflow schema version must be ${version_1.WORKFLOW_APP_SCHEMA_VERSION}`, joinPath(pathName, "workflowSchemaVersion")));
+    if (value.workflowSchemaVersion !== undefined && value.workflowSchemaVersion !== 1) {
+        issues.push(issue("workflow-app-compatibility", "Workflow schema version must be 1", joinPath(pathName, "workflowSchemaVersion")));
     }
     for (const key of ["coolWorkflow", "node", "notes"]) {
         if (value[key] !== undefined && !isNonEmptyString(value[key])) {
@@ -452,16 +313,16 @@ function validateCompatibility(value, issues, pathName) {
         if (!isSemver(value.minVersion)) {
             issues.push(issue("workflow-app-compatibility", "Compatibility minVersion must be semver", joinPath(pathName, "minVersion")));
         }
-        else if (compareSemver(version_1.CURRENT_COOL_WORKFLOW_VERSION, value.minVersion) < 0) {
-            issues.push(issue("workflow-app-incompatible", `Workflow app requires Cool Workflow >= ${value.minVersion}; current is ${version_1.CURRENT_COOL_WORKFLOW_VERSION}`, joinPath(pathName, "minVersion")));
+        else if (compareSemver(currentVersion, value.minVersion) < 0) {
+            issues.push(issue("workflow-app-incompatible", `Workflow app requires Cool Workflow >= ${value.minVersion}; current is ${currentVersion}`, joinPath(pathName, "minVersion")));
         }
     }
     if (value.maxVersion !== undefined) {
         if (!isSemver(value.maxVersion)) {
             issues.push(issue("workflow-app-compatibility", "Compatibility maxVersion must be semver", joinPath(pathName, "maxVersion")));
         }
-        else if (compareSemver(version_1.CURRENT_COOL_WORKFLOW_VERSION, value.maxVersion) > 0) {
-            issues.push(issue("workflow-app-incompatible", `Workflow app supports Cool Workflow <= ${value.maxVersion}; current is ${version_1.CURRENT_COOL_WORKFLOW_VERSION}`, joinPath(pathName, "maxVersion")));
+        else if (compareSemver(currentVersion, value.maxVersion) > 0) {
+            issues.push(issue("workflow-app-incompatible", `Workflow app supports Cool Workflow <= ${value.maxVersion}; current is ${currentVersion}`, joinPath(pathName, "maxVersion")));
         }
     }
 }
@@ -469,7 +330,7 @@ function validateEntrypoint(value, issues, pathName) {
     if (!isNonEmptyString(value.entrypoint)) {
         issues.push(issue("workflow-app-entrypoint", "Workflow app workflow.entrypoint is required", joinPath(pathName, "entrypoint")));
     }
-    if (value.entrypoint && node_path_1.default.isAbsolute(value.entrypoint)) {
+    if (value.entrypoint && /^([a-zA-Z]:)?[/\\]/.test(value.entrypoint)) {
         issues.push(issue("workflow-app-entrypoint", "Workflow app workflow.entrypoint must be relative", joinPath(pathName, "entrypoint")));
     }
     if (value.entrypoint && value.entrypoint.split(/[\\/]/).includes("..")) {
@@ -479,26 +340,41 @@ function validateEntrypoint(value, issues, pathName) {
         issues.push(issue("workflow-app-entrypoint", "Workflow app workflow.exportName must be a string", joinPath(pathName, "exportName")));
     }
 }
-function validatePhases(phases, limits, issues, pathName, options = {}) {
-    if (!Array.isArray(phases) || !phases.length) {
-        issues.push(issue("workflow-phases", "Workflow phases must be a non-empty array", pathName));
+function validateTask(taskDefinition, issues, pathName, seenTaskIds, options) {
+    if (!isRecord(taskDefinition)) {
+        issues.push(issue("workflow-task", "Workflow task must be an object", pathName));
         return;
     }
-    const seenPhaseIds = new Set();
-    const seenTaskIds = new Set();
-    let taskCount = 0;
-    for (const [phaseIndex, phaseDefinition] of phases.entries()) {
-        const phasePath = joinPath(pathName, String(phaseIndex));
-        validatePhase(phaseDefinition, issues, phasePath, seenPhaseIds);
-        if (!isRecord(phaseDefinition) || !Array.isArray(phaseDefinition.tasks))
-            continue;
-        for (const [taskIndex, taskDefinition] of phaseDefinition.tasks.entries()) {
-            taskCount += 1;
-            validateTask(taskDefinition, issues, joinPath(joinPath(phasePath, "tasks"), String(taskIndex)), seenTaskIds, options);
-        }
+    const taskValue = taskDefinition;
+    if (!isNonEmptyString(taskValue.id) || !/^[A-Za-z0-9][A-Za-z0-9_.:/-]*$/.test(taskValue.id)) {
+        issues.push(issue("workflow-task-id", `Workflow task id is malformed: ${String(taskValue.id || "")}`, joinPath(pathName, "id")));
     }
-    if (isRecord(limits) && Number.isInteger(Number(limits.maxAgents)) && taskCount > Number(limits.maxAgents)) {
-        issues.push(issue("workflow-limits", `Workflow defines ${taskCount} tasks but limits.maxAgents is ${String(limits.maxAgents)}`, joinPath(pathName, "limits.maxAgents")));
+    else if (seenTaskIds.has(taskValue.id)) {
+        issues.push(issue("workflow-task-duplicate", `Duplicate workflow task id: ${taskValue.id}`, joinPath(pathName, "id")));
+    }
+    else {
+        seenTaskIds.add(taskValue.id);
+    }
+    if (!["agent", "artifact"].includes(String(taskValue.kind))) {
+        issues.push(issue("workflow-task-kind", `Workflow task ${String(taskValue.id || "")} kind must be agent or artifact`, joinPath(pathName, "kind")));
+    }
+    if (!isNonEmptyString(taskValue.prompt)) {
+        issues.push(issue("workflow-task-prompt", `Workflow task ${String(taskValue.id || "")} prompt is required`, joinPath(pathName, "prompt")));
+    }
+    if (taskValue.requiresEvidence !== undefined && typeof taskValue.requiresEvidence !== "boolean") {
+        issues.push(issue("workflow-task-evidence", `Workflow task ${String(taskValue.id || "")} requiresEvidence must be boolean`, joinPath(pathName, "requiresEvidence")));
+    }
+    const sandboxProfileId = taskValue.sandboxProfileId;
+    if (sandboxProfileId !== undefined) {
+        if (!isNonEmptyString(sandboxProfileId)) {
+            issues.push(issue("workflow-task-sandbox-profile", `Workflow task ${String(taskValue.id || "")} sandboxProfileId must be a string`, joinPath(pathName, "sandboxProfileId")));
+        }
+        else if (!options.bundledIds.includes(sandboxProfileId)) {
+            issues.push(issue("workflow-task-sandbox-profile", `Workflow task ${String(taskValue.id || "")} references unknown sandbox profile ${sandboxProfileId}`, joinPath(pathName, "sandboxProfileId")));
+        }
+        else if (options.appSandboxProfiles && !options.appSandboxProfiles.includes(sandboxProfileId)) {
+            issues.push(issue("workflow-task-sandbox-profile", `Workflow task ${String(taskValue.id || "")} sandbox profile ${sandboxProfileId} must be listed in app sandboxProfiles`, joinPath(pathName, "sandboxProfileId")));
+        }
     }
 }
 function validatePhase(phaseDefinition, issues, pathName, seenPhaseIds) {
@@ -522,125 +398,160 @@ function validatePhase(phaseDefinition, issues, pathName, seenPhaseIds) {
     if (!Array.isArray(phaseValue.tasks) || !phaseValue.tasks.length) {
         issues.push(issue("workflow-phase-tasks", `Workflow phase ${String(phaseValue.id || phaseValue.name || "")} must have tasks`, joinPath(pathName, "tasks")));
     }
-    // Bounded dynamic loop spec (fail-closed shape check; the predicate ref need not be
-    // registered at validation time — the expander stops fail-closed if it is missing).
     if (phaseValue.loop !== undefined) {
-        const loop = phaseValue.loop;
-        if (!isRecord(loop)) {
+        const loopValue = phaseValue.loop;
+        if (!isRecord(loopValue)) {
             issues.push(issue("workflow-phase-loop", "Workflow phase loop must be an object", joinPath(pathName, "loop")));
         }
         else {
-            if (typeof loop.maxRounds !== "number" || !Number.isInteger(loop.maxRounds) || loop.maxRounds < 1) {
+            if (typeof loopValue.maxRounds !== "number" || !Number.isInteger(loopValue.maxRounds) || loopValue.maxRounds < 1) {
                 issues.push(issue("workflow-phase-loop-maxrounds", "loop.maxRounds must be a positive integer", joinPath(pathName, "loop.maxRounds")));
             }
-            const until = loop.until;
-            const validUntil = isRecord(until)
-                && ((until.kind === "predicate" && isNonEmptyString(until.ref))
-                    || (until.kind === "budget-target" && typeof until.target === "number" && until.target > 0));
+            const until = loopValue.until;
+            const validUntil = isRecord(until) &&
+                ((until.kind === "predicate" && isNonEmptyString(until.ref)) ||
+                    (until.kind === "budget-target" && typeof until.target === "number" && until.target > 0));
             if (!validUntil) {
                 issues.push(issue("workflow-phase-loop-until", 'loop.until must be { kind: "predicate", ref } or { kind: "budget-target", target }', joinPath(pathName, "loop.until")));
             }
         }
     }
 }
-function validateTask(taskDefinition, issues, pathName, seenTaskIds, options) {
-    if (!isRecord(taskDefinition)) {
-        issues.push(issue("workflow-task", "Workflow task must be an object", pathName));
+function validatePhases(phases, limits, issues, pathName, options) {
+    if (!Array.isArray(phases) || !phases.length) {
+        issues.push(issue("workflow-phases", "Workflow phases must be a non-empty array", pathName));
         return;
     }
-    const taskValue = taskDefinition;
-    if (!isNonEmptyString(taskValue.id) || !/^[A-Za-z0-9][A-Za-z0-9_.:/-]*$/.test(taskValue.id)) {
-        issues.push(issue("workflow-task-id", `Workflow task id is malformed: ${String(taskValue.id || "")}`, joinPath(pathName, "id")));
-    }
-    else if (seenTaskIds.has(taskValue.id)) {
-        issues.push(issue("workflow-task-duplicate", `Duplicate workflow task id: ${taskValue.id}`, joinPath(pathName, "id")));
+    const seenPhaseIds = new Set();
+    const seenTaskIds = new Set();
+    let taskCount = 0;
+    for (const [phaseIndex, phaseDefinition] of phases.entries()) {
+        const phasePath = joinPath(pathName, String(phaseIndex));
+        validatePhase(phaseDefinition, issues, phasePath, seenPhaseIds);
+        if (!isRecord(phaseDefinition) || !Array.isArray(phaseDefinition.tasks))
+            continue;
+        for (const [taskIndex, taskDefinition] of phaseDefinition.tasks.entries()) {
+            taskCount += 1;
+            validateTask(taskDefinition, issues, joinPath(joinPath(phasePath, "tasks"), String(taskIndex)), seenTaskIds, options);
+        }
     }
-    else {
-        seenTaskIds.add(taskValue.id);
+    if (isRecord(limits) && Number.isInteger(Number(limits.maxAgents)) && taskCount > Number(limits.maxAgents)) {
+        issues.push(issue("workflow-limits", `Workflow defines ${taskCount} tasks but limits.maxAgents is ${String(limits.maxAgents)}`, joinPath(pathName, "limits.maxAgents")));
     }
-    if (!["agent", "artifact"].includes(String(taskValue.kind))) {
-        issues.push(issue("workflow-task-kind", `Workflow task ${String(taskValue.id || "")} kind must be agent or artifact`, joinPath(pathName, "kind")));
+}
+function validateWorkflowDefinition(candidate, context, issues = [], basePath = "workflow", options = {}) {
+    if (!isRecord(candidate)) {
+        issues.push(issue("workflow-invalid", "Workflow definition must be an object", basePath));
+        return issues;
     }
-    if (!isNonEmptyString(taskValue.prompt)) {
-        issues.push(issue("workflow-task-prompt", `Workflow task ${String(taskValue.id || "")} prompt is required`, joinPath(pathName, "prompt")));
+    const workflowDefinition = candidate;
+    validateWorkflowId(workflowDefinition.id, issues, joinPath(basePath, "id"));
+    if (!isNonEmptyString(workflowDefinition.title)) {
+        issues.push(issue("workflow-title", "Workflow title is required", joinPath(basePath, "title")));
     }
-    if (taskValue.requiresEvidence !== undefined && typeof taskValue.requiresEvidence !== "boolean") {
-        issues.push(issue("workflow-task-evidence", `Workflow task ${String(taskValue.id || "")} requiresEvidence must be boolean`, joinPath(pathName, "requiresEvidence")));
+    if (options.appId && workflowDefinition.id !== options.appId) {
+        issues.push(issue("workflow-app-id-mismatch", `Workflow id must match app id ${options.appId}`, joinPath(basePath, "id")));
     }
-    const sandboxProfileId = taskValue.sandboxProfileId;
-    if (sandboxProfileId !== undefined) {
-        if (!isNonEmptyString(sandboxProfileId)) {
-            issues.push(issue("workflow-task-sandbox-profile", `Workflow task ${String(taskValue.id || "")} sandboxProfileId must be a string`, joinPath(pathName, "sandboxProfileId")));
-        }
-        else if (!(0, sandbox_profile_1.isBundledSandboxProfileId)(sandboxProfileId)) {
-            issues.push(issue("workflow-task-sandbox-profile", `Workflow task ${String(taskValue.id || "")} references unknown sandbox profile ${sandboxProfileId}`, joinPath(pathName, "sandboxProfileId")));
-        }
-        else if (options.appSandboxProfiles && !options.appSandboxProfiles.includes(sandboxProfileId)) {
-            issues.push(issue("workflow-task-sandbox-profile", `Workflow task ${String(taskValue.id || "")} sandbox profile ${sandboxProfileId} must be listed in app sandboxProfiles`, joinPath(pathName, "sandboxProfileId")));
-        }
+    if (options.appTitle && workflowDefinition.title !== options.appTitle) {
+        issues.push(issue("workflow-app-title-mismatch", `Workflow title must match app title ${options.appTitle}`, joinPath(basePath, "title")));
     }
+    validateLimits(workflowDefinition.limits, issues, joinPath(basePath, "limits"));
+    validateInputDefinitions(workflowDefinition.inputs, issues, joinPath(basePath, "inputs"), { optional: false });
+    validateSandboxProfileReferences(workflowDefinition.sandboxProfiles, issues, joinPath(basePath, "sandboxProfiles"), context.bundledSandboxProfileIds, {
+        optional: true,
+    });
+    validatePhases(workflowDefinition.phases, workflowDefinition.limits, issues, joinPath(basePath, "phases"), {
+        appSandboxProfiles: options.appSandboxProfiles || workflowDefinition.sandboxProfiles,
+        bundledIds: context.bundledSandboxProfileIds,
+    });
+    return issues;
 }
-function isWorkflowDefinition(value) {
-    return (isRecord(value) &&
-        isNonEmptyString(value.id) &&
-        isNonEmptyString(value.title) &&
-        Array.isArray(value.phases) &&
-        isRecord(value.limits) &&
-        Array.isArray(value.inputs));
-}
-function isWorkflowAppDefinition(value) {
-    return isRecord(value) && value.schemaVersion === version_1.WORKFLOW_APP_SCHEMA_VERSION && isNonEmptyString(value.id) && "workflow" in value;
-}
-function isWorkflowEntrypoint(value) {
-    return isRecord(value) && "entrypoint" in value && !("phases" in value);
-}
-function isAppCompatible(app) {
-    return !validateWorkflowApp(app).issues.some((compatIssue) => compatIssue.code === "workflow-app-incompatible");
-}
-function collectWorkflowSandboxProfiles(workflowDefinition) {
-    const profiles = new Set();
-    for (const phaseDefinition of workflowDefinition.phases) {
-        for (const taskDefinition of phaseDefinition.tasks) {
-            if (taskDefinition.sandboxProfileId)
-                profiles.add(taskDefinition.sandboxProfileId);
+/** The full `cw app validate` check: byte-exact issue codes/messages to
+ *  src/workflow-app-framework.ts's `validateWorkflowApp`. Never throws. */
+function validateWorkflowApp(candidate, context, options = {}) {
+    const issues = [];
+    const appPath = options.appPath;
+    if (!isRecord(candidate)) {
+        return { valid: false, appPath, issues: [issue("workflow-app-invalid", "Workflow app must be an object", appPath)] };
+    }
+    const app = candidate;
+    if (app.schemaVersion !== 1) {
+        issues.push(issue("workflow-app-schema-version", "Workflow app schemaVersion must be 1", joinPath(appPath, "schemaVersion")));
+    }
+    validateAppId(app.id, issues, joinPath(appPath, "id"));
+    if (!isNonEmptyString(app.title)) {
+        issues.push(issue("workflow-app-title", "Workflow app title is required", joinPath(appPath, "title")));
+    }
+    if (!isSemver(app.version)) {
+        issues.push(issue("workflow-app-version", "Workflow app version must be a semver string such as 0.1.0", joinPath(appPath, "version")));
+    }
+    validateAuthor(app.author, issues, joinPath(appPath, "author"));
+    validateInputDefinitions(app.inputs, issues, joinPath(appPath, "inputs"), { optional: true });
+    validateSandboxProfileReferences(app.sandboxProfiles, issues, joinPath(appPath, "sandboxProfiles"), context.bundledSandboxProfileIds, { optional: true });
+    validateCompatibility(app.compatibility, issues, joinPath(appPath, "compatibility"), context.currentCoolWorkflowVersion);
+    const workflowValue = options.loadedWorkflow || app.workflow;
+    if (!workflowValue) {
+        issues.push(issue("workflow-app-workflow", "Workflow app workflow is required", joinPath(appPath, "workflow")));
+    }
+    else if (isWorkflowEntrypoint(workflowValue)) {
+        validateEntrypoint(workflowValue, issues, joinPath(appPath, "workflow"));
+    }
+    else {
+        validateWorkflowDefinition(workflowValue, context, issues, joinPath(appPath, "workflow"), {
+            appId: isNonEmptyString(app.id) ? app.id : undefined,
+            appTitle: isNonEmptyString(app.title) ? app.title : undefined,
+            appSandboxProfiles: app.sandboxProfiles,
+        });
+        if (Array.isArray(app.inputs) && isWorkflowDefinition(workflowValue)) {
+            validateMatchingInputs(app.inputs, workflowValue.inputs || [], issues, joinPath(appPath, "inputs"));
         }
     }
-    return [...profiles].sort();
+    return {
+        valid: issues.length === 0,
+        appId: isNonEmptyString(app.id) ? app.id : undefined,
+        appPath,
+        issues,
+    };
 }
-function compareSemver(left, right) {
-    const leftParts = semverParts(left);
-    const rightParts = semverParts(right);
-    for (let index = 0; index < 3; index += 1) {
-        if (leftParts[index] !== rightParts[index])
-            return leftParts[index] < rightParts[index] ? -1 : 1;
+function assertValidWorkflowApp(candidate, context, options = {}) {
+    const result = validateWorkflowApp(candidate, context, options);
+    if (!result.valid) {
+        throw new WorkflowAppValidationError("Invalid workflow app", result.issues);
     }
-    return 0;
 }
-function semverParts(value) {
-    const [major, minor, patch] = value.split(/[+-]/)[0].split(".").map((part) => Number(part));
-    return [major || 0, minor || 0, patch || 0];
-}
-function isSemver(value) {
-    return typeof value === "string" && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(value);
-}
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function isRecord(value) {
-    return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function issue(code, message, pathName) {
+/** `isAppCompatible` (WorkflowAppSummary.compatible): re-validate and check
+ *  ONLY for a `workflow-app-incompatible` issue — see PLAN.md rebuild risk
+ *  #3. */
+function isWorkflowAppCompatible(app, context) {
+    return !validateWorkflowApp(app, context).issues.some((one) => one.code === "workflow-app-incompatible");
+}
+/** `validationIssuesFromError` — turns any thrown error (typically a
+ *  `WorkflowAppValidationError`) into an issues array for the
+ *  `{valid:false, issues}` catch-branch shape `cw app validate` needs on
+ *  an unresolvable target. */
+function validationIssuesFromError(error) {
+    if (error instanceof WorkflowAppValidationError)
+        return error.issues;
+    return [{ code: "workflow-app-invalid", message: error instanceof Error ? error.message : String(error) }];
+}
+/** Byte-exact render of the workflow-app run-metadata block that lands in
+ *  `run.workflow.app` (report.md's "Workflow App:" line reads
+ *  `run.workflow.app.id`/`.version`). */
+function workflowAppRunMetadata(app) {
     return {
-        code,
-        message,
-        path: pathName
+        schemaVersion: 1,
+        id: app.id,
+        title: app.title,
+        summary: app.summary,
+        version: app.version,
+        author: app.author,
+        // compatibility + metadata ride into run.workflow.app so report.md can
+        // render the domain-gated "- Source:" label (metadata.domain ===
+        // "research") and downstream tools can read the app's compatibility
+        // window. Byte-behavior port of the old build's workflowAppRunMetadata.
+        compatibility: app.compatibility,
+        sandboxProfiles: app.sandboxProfiles,
+        source: { manifestPath: app.sourcePath },
+        metadata: app.metadata,
     };
 }
-function joinPath(basePath, segment) {
-    if (!basePath)
-        return segment;
-    return `${basePath}.${segment}`;
-}
-function messageOf(error) {
-    return error instanceof Error ? error.message : String(error);
-}