feat: validate workflow plans without saving

web/packages/rpc/scripts/workflow-contract-generator.test.ts

@@ -436,6 +436,6 @@ describe("workflow contract generator", () => {
 
     const generatedSource = await generateWorkflowContractSource(manifestText);
     expect(generatedSource).toBe(checkedSource);
-    expect(generatedSource.match(/^  \| "workflow\./gm)).toHaveLength(71);
+    expect(generatedSource.match(/^  \| "workflow\./gm)).toHaveLength(72);
   });
 });

web/packages/rpc/src/generated/workflow-contract.test.ts

@@ -15,8 +15,8 @@ import {
 
 describe("generated workflow contract", () => {
   it("contains every operation exactly once", () => {
-    expect(workflowOperationNames).toHaveLength(71);
-    expect(new Set(workflowOperationNames)).toHaveLength(71);
+    expect(workflowOperationNames).toHaveLength(72);
+    expect(new Set(workflowOperationNames)).toHaveLength(72);
   });
 
   it("contains every authored Effect operation without broadening its boundary", () => {

web/packages/rpc/src/generated/workflow-contract.ts

@@ -22,6 +22,7 @@ export type WorkflowOperationName =
   | "workflow.artifacts.inspect"
   | "workflow.artifacts.list"
   | "workflow.artifacts.save"
+  | "workflow.artifacts.validate_plan"
   | "workflow.capabilities.call"
   | "workflow.capabilities.inspect"
   | "workflow.capabilities.list"
@@ -95,6 +96,7 @@ export const workflowOperationNames: readonly WorkflowOperationName[] = [
   "workflow.artifacts.inspect",
   "workflow.artifacts.list",
   "workflow.artifacts.save",
+  "workflow.artifacts.validate_plan",
   "workflow.capabilities.call",
   "workflow.capabilities.inspect",
   "workflow.capabilities.list",
@@ -380,6 +382,23 @@ export interface WorkflowContractMap {
     };
     result: SaveArtifactResult;
   };
+  "workflow.artifacts.validate_plan": {
+    params: {
+      plan: {
+        [k: string]: unknown;
+      };
+      outcomes: string[];
+      required_capabilities?: {
+        [k: string]: {
+          [k: string]: unknown;
+        };
+      } | null;
+      source_bindings?: {
+        [k: string]: string;
+      } | null;
+    };
+    result: ValidateArtifactPlanResult;
+  };
   "workflow.capabilities.call": {
     params: {
       qualified_name: string;
@@ -1248,6 +1267,35 @@ export interface ArtifactCatalogEntryPayload {
   version: number;
   [k: string]: unknown;
 }
+/**
+ * Non-persisting artifact-plan validation and dependency inventory.
+ *
+ * This interface was referenced by `WorkflowContractMap`'s JSON-Schema
+ * via the `definition` "ValidateArtifactPlanResult".
+ */
+export interface ValidateArtifactPlanResult {
+  diagnostics: ArtifactPlanDiagnosticPayload[];
+  required_capabilities: RequiredCapabilityPayload[];
+  status: "valid" | "invalid";
+  workflow_dependencies: {
+    [k: string]: number;
+  };
+  [k: string]: unknown;
+}
+/**
+ * Stable diagnostic projected when an artifact plan is invalid.
+ *
+ * This interface was referenced by `WorkflowContractMap`'s JSON-Schema
+ * via the `definition` "ArtifactPlanDiagnosticPayload".
+ */
+export interface ArtifactPlanDiagnosticPayload {
+  code: string;
+  message: string;
+  path: string;
+  repair_hint: string | null;
+  severity: "error" | "warning";
+  [k: string]: unknown;
+}
 /**
  * Outcome returned by a direct node-spec or wrapper capability call.
  *