fix: enforce lifecycle response identities

src/wf_client/deployments.py

@@ -120,6 +120,18 @@ class Deployment:
                     f"match requested {self.deployment_id!r}"
                 ),
             )
+        if (
+            decoded.artifact_id != self.artifact_id
+            or decoded.artifact_version != self.artifact_version
+        ):
+            raise InvalidResponse(
+                operation="workflow.runs.start",
+                details=(
+                    f"start result for {self.deployment_id!r} targets artifact "
+                    f"{decoded.artifact_id!r} version {decoded.artifact_version}, "
+                    f"expected {self.artifact_id!r} version {self.artifact_version}"
+                ),
+            )
         if decoded.run_id is None or decoded.status in {"unrunnable", "rejected"}:
             raise DeploymentNotRunnable(
                 deployment_id=self.deployment_id,
@@ -127,7 +139,11 @@ class Deployment:
                 outcome=decoded.outcome,
                 error=decoded.error,
             )
-        return _run_from_decoded(self._port, decoded)
+        return _run_from_decoded(
+            self._port,
+            decoded,
+            operation="workflow.runs.start",
+        )
 
 
 def _decode_summaries(payload: object) -> list[dict[str, Any]]:
@@ -222,4 +238,15 @@ async def run_artifact(
                 f"match requested {matches[0]['id']!r}"
             ),
         )
+    if (
+        deployment.artifact_id != artifact.artifact.id
+        or deployment.artifact_version != artifact.artifact.version
+    ):
+        raise InvalidResponse(
+            operation="workflow.deployments.inspect",
+            details=(
+                f"deployment {matches[0]['id']!r} does not target artifact "
+                f"{artifact.artifact.id!r} version {artifact.artifact.version}"
+            ),
+        )
     return await deployment.run(workflow_input)

src/wf_client/runs.py

@@ -81,6 +81,7 @@ def _run_from_decoded(
             deployment_id=decoded.deployment_id,
             diagnostics=decoded.diagnostics,
             outcome=decoded.outcome,
+            error=decoded.error,
         )
     return Run(
         _port=port,

src/wf_client/workflows.py

@@ -128,7 +128,7 @@ class WorkflowArtifact:
         """Save, inspect, and validate a deployment for this artifact version."""
         from .deployments import Deployment
 
-        await self._port.save_deployment(
+        saved = await self._port.save_deployment(
             {
                 "id": deployment_id,
                 "artifact_id": self.artifact.id,
@@ -137,10 +137,27 @@ class WorkflowArtifact:
                 "drift_policy": drift_policy,
             }
         )
+        if not isinstance(saved, Mapping) or saved.get("deployment_id") != deployment_id:
+            saved_id = saved.get("deployment_id") if isinstance(saved, Mapping) else None
+            raise InvalidResponse(
+                operation="workflow.deployments.save",
+                details=(
+                    f"saved deployment id {saved_id!r} does not match requested "
+                    f"{deployment_id!r}"
+                ),
+            )
         deployment = Deployment.from_payload(
             self._port,
             await self._port.inspect_deployment(deployment_id=deployment_id),
         )
+        if deployment.deployment_id != deployment_id:
+            raise InvalidResponse(
+                operation="workflow.deployments.inspect",
+                details=(
+                    f"inspected deployment {deployment.deployment_id!r} does not "
+                    f"match requested {deployment_id!r}"
+                ),
+            )
         if (
             deployment.artifact_id != self.artifact.id
             or deployment.artifact_version != self.artifact.version