fix: harden workflow config rpc target routing

docs/current_roadmap.md

@@ -93,9 +93,10 @@ implementation state.
     - Completed: the first JSON-RPC-over-HTTP transport can expose the local/static
       `WorkflowServer` through fixed dotted methods. Remote CLI targeting remains
       the next transport-facing slice.
-    - Completed: workflow config now distinguishes client targets from server
-      hosting config, and selected `wf` commands can target JSON-RPC HTTP with
-      explicit CLI overrides.
+   - Completed: workflow config now distinguishes client targets from server
+      hosting config, selected `wf cap`/`wf run` commands can target JSON-RPC
+      HTTP with explicit CLI overrides, and local-only draft/artifact/deploy
+      commands fail fast for remote targets until they are wired.
 
 5. **CLI/API alignment**
    - Let the CLI target either local process-backed stores/runtime or the future

docs/superpowers/specs/2026-06-03-workflow-config-targets-and-sources.md

@@ -305,7 +305,7 @@ Recommended Pydantic shape:
 ```python
 class StdlibSourceConfig(BaseModel):
     kind: Literal["stdlib"]
-    id: str
+    id: Literal["wf.std", "wf.recipes"]
 
 
 class McpStdioTransportConfig(BaseModel):
@@ -458,16 +458,20 @@ First slice implemented:
 
 - neutral `wf_config` models and loader
 - filesystem server store config
-- stdlib source bootstrap config
+- stdlib source bootstrap config is parsed and fail-fast limited to currently
+  wired source ids (`wf.std`, `wf.recipes`)
 - local and JSON-RPC client targets
 - `wf` root overrides for `--local`, `--url`, and `--timeout`
 - remote JSON-RPC client support for capability and run CLI commands
-- `wf-rpc-server --config` support for server store and RPC HTTP transport
+- local-only CLI commands fail fast for `rpc_http` targets until they are wired
+- `wf-rpc-server --config` support for server store and RPC HTTP transport,
+  including configured RPC path
 
 Still future:
 
 - store-backed mutable source registry
 - MCP/OpenAPI source config
+- arbitrary stdlib source aliases
 - `/mcp` hosting from neutral server config
 - remote draft/artifact/deployment CLI commands
 - auth and SQL stores