feat: validate step inputs against method/workflow required arguments (#1151)

## Summary

- `swamp workflow validate` now checks that each step's `inputs:` block
provides all required arguments for the target method or workflow
- For `model_method` tasks: resolves model type, looks up method's Zod
argument schema, reports missing required fields
- For `workflow` tasks: looks up nested workflow's JSON Schema inputs,
reports missing required inputs
- Dynamic CEL references (`${{ }}`) in model/workflow names are
gracefully skipped
- Models/workflows not found produce pass-with-skip (not hard failure)
- Updates swamp-workflow skill docs with new validation checks
- Fixes vary integration test to provide required `run` input

Closes #40

## Test Plan

- 27 unit tests for `DefaultWorkflowValidationService` (13 new for step
input validation covering both task types)
- 4 libswamp validate integration tests (updated for async)
- Full test suite passes (4249 tests)
- Manual verification with compiled binary against a scratch repo:

### Missing required input (`run` omitted from `command/shell` model)

```
$ swamp workflow validate bad-workflow --repo-dir /tmp/swamp-repro-issue-40
Validating: bad-workflow
  ✓ Schema validation
  ✓ Unique job names
  ✓ Unique step names in job 'deploy'
  ✓ Valid job dependency references
  ✓ Valid step dependency references in job 'deploy'
  ✓ No cyclic job dependencies
  ✓ No cyclic step dependencies in job 'deploy'
  ✗ Step inputs for 'deploy-step' in job 'deploy' (my-deployer.execute)
    → Missing required inputs: run
Summary: 7/8 validations passed
Result: FAILED
```

### All required inputs present

```
$ swamp workflow validate good-workflow --repo-dir /tmp/swamp-repro-issue-40
Validating: good-workflow
  ✓ Schema validation
  ✓ Unique job names
  ✓ Unique step names in job 'deploy'
  ✓ Valid job dependency references
  ✓ Valid step dependency references in job 'deploy'
  ✓ No cyclic job dependencies
  ✓ No cyclic step dependencies in job 'deploy'
  ✓ Step inputs for 'deploy-step' in job 'deploy' (my-deployer.execute)
Summary: 8/8 validations passed
Result: PASSED
```

### Nonexistent method on model

```
$ swamp workflow validate bad-method-workflow --repo-dir /tmp/swamp-repro-issue-40
Validating: bad-method-workflow
  ✓ Schema validation
  ✓ Unique job names
  ✓ Unique step names in job 'job1'
  ✓ Valid job dependency references
  ✓ Valid step dependency references in job 'job1'
  ✓ No cyclic job dependencies
  ✓ No cyclic step dependencies in job 'job1'
  ✗ Step inputs for 'step1' in job 'job1' (my-deployer.nonexistent_method)
    → Method 'nonexistent_method' not found on model type 'command/shell'
Summary: 7/8 validations passed
Result: FAILED
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stack72

.claude/skills/swamp-workflow/SKILL.md

@@ -207,7 +207,22 @@ swamp workflow delete my-workflow --json
 
 ## Validate Workflows
 
-Validate against schema and check for errors.
+Validate against schema, check for structural errors, and verify that step
+inputs match required method/workflow arguments.
+
+**Checks performed:**
+
+1. Schema validation (Zod)
+2. Unique job names
+3. Unique step names within each job
+4. Valid job dependency references
+5. Valid step dependency references
+6. No cyclic job dependencies
+7. No cyclic step dependencies within jobs
+8. Step inputs match required arguments — for `model_method` tasks, checks that
+   all required method arguments are provided in the step's `inputs:` block. For
+   `workflow` tasks, checks that all required workflow inputs are provided.
+   Dynamic CEL references (`${{ ... }}`) in model/workflow names are skipped.
 
 ```bash
 swamp workflow validate my-workflow --json
@@ -224,7 +239,11 @@ swamp workflow validate --json  # Validate all
     { "name": "Schema validation", "passed": true },
     { "name": "Unique job names", "passed": true },
     { "name": "Valid job dependency references", "passed": true },
-    { "name": "No cyclic job dependencies", "passed": true }
+    { "name": "No cyclic job dependencies", "passed": true },
+    {
+      "name": "Step inputs for 'deploy' in job 'release' (my-app.deploy)",
+      "passed": true
+    }
   ],
   "passed": true
 }

integration/vary_test.ts

@@ -582,6 +582,7 @@ Deno.test("CLI: vary schema validates in workflow YAML", async () => {
                 modelIdOrName: "test-model",
                 methodName: "execute",
                 inputs: {
+                  run: "echo hello",
                   region: "us-east-1",
                 },
               },

src/cli/commands/workflow_validate.ts

@@ -49,7 +49,10 @@ export const workflowValidateCommand = new Command()
     });
 
     const ctx = createLibSwampContext({ logger: cliCtx.logger });
-    const deps = createWorkflowValidateDeps(repoContext.workflowRepo);
+    const deps = createWorkflowValidateDeps(
+      repoContext.workflowRepo,
+      repoContext.definitionRepo,
+    );
 
     const renderer = createWorkflowValidateRenderer(cliCtx.outputMode);
     await consumeStream(

src/domain/workflows/validation_service.ts

@@ -19,12 +19,15 @@
 
 import type { Workflow } from "./workflow.ts";
 import { WorkflowSchema } from "./workflow.ts";
+import type { WorkflowRepository } from "./repositories.ts";
+import { createWorkflowId } from "./workflow_id.ts";
 import {
   CyclicDependencyError,
   DuplicateNodeNameError,
   type GraphNode,
   TopologicalSortService,
 } from "./topological_sort_service.ts";
+
 /**
  * Value object representing the result of a single validation.
  */
@@ -61,6 +64,28 @@ export class WorkflowValidationResult {
   }
 }
 
+/**
+ * Result of resolving a method's required arguments.
+ */
+export type MethodResolution =
+  | { status: "resolved"; requiredArgs: string[] }
+  | { status: "model_not_found" }
+  | { status: "method_not_found"; modelType: string }
+  | { status: "type_unresolvable"; modelType: string };
+
+/**
+ * Port interface for resolving method argument schemas.
+ *
+ * Abstracts model type resolution so the validation service can look up
+ * method argument schemas without depending on infrastructure.
+ */
+export interface ModelMethodResolver {
+  resolve(
+    modelIdOrName: string,
+    methodName: string,
+  ): Promise<MethodResolution>;
+}
+
 /**
  * Domain service for workflow validation.
  *
@@ -72,6 +97,7 @@ export class WorkflowValidationResult {
  * 5. Valid step dependency references
  * 6. No cyclic dependencies between jobs
  * 7. No cyclic dependencies between steps within jobs
+ * 8. Step inputs match method/workflow required arguments
  */
 export interface WorkflowValidationService {
   /**
@@ -80,7 +106,7 @@ export interface WorkflowValidationService {
    * @param workflow The workflow to validate
    * @returns Array of validation results
    */
-  validate(workflow: Workflow): WorkflowValidationResult[];
+  validate(workflow: Workflow): Promise<WorkflowValidationResult[]>;
 }
 
 /**
@@ -90,7 +116,12 @@ export class DefaultWorkflowValidationService
   implements WorkflowValidationService {
   private readonly sortService = new TopologicalSortService();
 
-  validate(workflow: Workflow): WorkflowValidationResult[] {
+  constructor(
+    private readonly methodResolver?: ModelMethodResolver,
+    private readonly workflowRepo?: WorkflowRepository,
+  ) {}
+
+  async validate(workflow: Workflow): Promise<WorkflowValidationResult[]> {
     const results: WorkflowValidationResult[] = [];
 
     // 1. Schema validation
@@ -114,6 +145,11 @@ export class DefaultWorkflowValidationService
     // 7. No cyclic step dependencies within jobs
     results.push(...this.validateNoStepCycles(workflow));
 
+    // 8. Step inputs match required arguments
+    if (this.methodResolver || this.workflowRepo) {
+      results.push(...await this.validateStepInputs(workflow));
+    }
+
     return results;
   }
 
@@ -319,4 +355,154 @@ export class DefaultWorkflowValidationService
 
     return results;
   }
+
+  private async validateStepInputs(
+    workflow: Workflow,
+  ): Promise<WorkflowValidationResult[]> {
+    const results: WorkflowValidationResult[] = [];
+
+    for (const job of workflow.jobs) {
+      for (const step of job.steps) {
+        const task = step.task;
+        if (!task) continue;
+
+        const taskData = task.data;
+        if (taskData.type === "model_method" && this.methodResolver) {
+          results.push(
+            ...await this.validateModelMethodInputs(
+              job.name,
+              step.name,
+              taskData.modelIdOrName,
+              taskData.methodName,
+              taskData.inputs,
+            ),
+          );
+        } else if (taskData.type === "workflow" && this.workflowRepo) {
+          results.push(
+            ...await this.validateWorkflowTaskInputs(
+              job.name,
+              step.name,
+              taskData.workflowIdOrName,
+              taskData.inputs,
+            ),
+          );
+        }
+      }
+    }
+
+    return results;
+  }
+
+  private async validateModelMethodInputs(
+    jobName: string,
+    stepName: string,
+    modelIdOrName: string,
+    methodName: string,
+    inputs: Record<string, unknown> | undefined,
+  ): Promise<WorkflowValidationResult[]> {
+    const checkName =
+      `Step inputs for '${stepName}' in job '${jobName}' (${modelIdOrName}.${methodName})`;
+
+    // Skip dynamic CEL references — cannot resolve statically
+    if (modelIdOrName.includes("${{")) {
+      return [WorkflowValidationResult.pass(checkName)];
+    }
+
+    const resolution = await this.methodResolver!.resolve(
+      modelIdOrName,
+      methodName,
+    );
+
+    switch (resolution.status) {
+      case "model_not_found":
+        return [
+          WorkflowValidationResult.pass(
+            checkName +
+              " (model not found, skipped)",
+          ),
+        ];
+      case "type_unresolvable":
+        return [
+          WorkflowValidationResult.pass(
+            checkName +
+              " (model type not resolved, skipped)",
+          ),
+        ];
+      case "method_not_found":
+        return [
+          WorkflowValidationResult.fail(
+            checkName,
+            `Method '${methodName}' not found on model type '${resolution.modelType}'`,
+          ),
+        ];
+      case "resolved": {
+        const inputKeys = new Set(Object.keys(inputs ?? {}));
+        const missing = resolution.requiredArgs.filter((arg) =>
+          !inputKeys.has(arg)
+        );
+        if (missing.length > 0) {
+          return [
+            WorkflowValidationResult.fail(
+              checkName,
+              `Missing required inputs: ${missing.join(", ")}`,
+            ),
+          ];
+        }
+        return [WorkflowValidationResult.pass(checkName)];
+      }
+    }
+  }
+
+  private async validateWorkflowTaskInputs(
+    jobName: string,
+    stepName: string,
+    workflowIdOrName: string,
+    inputs: Record<string, unknown> | undefined,
+  ): Promise<WorkflowValidationResult[]> {
+    const checkName =
+      `Step inputs for '${stepName}' in job '${jobName}' (workflow: ${workflowIdOrName})`;
+
+    // Skip dynamic CEL references
+    if (workflowIdOrName.includes("${{")) {
+      return [WorkflowValidationResult.pass(checkName)];
+    }
+
+    // Try to find the nested workflow
+    let nested: Workflow | null = null;
+    try {
+      nested = await this.workflowRepo!.findByName(workflowIdOrName) ??
+        await this.workflowRepo!.findById(
+          createWorkflowId(workflowIdOrName),
+        );
+    } catch {
+      // ID may not be a valid UUID — that's fine, just not found
+    }
+
+    if (!nested) {
+      return [
+        WorkflowValidationResult.pass(
+          checkName +
+            " (workflow not found, skipped)",
+        ),
+      ];
+    }
+
+    const requiredInputs = nested.inputs?.required ?? [];
+    if (requiredInputs.length === 0) {
+      return [WorkflowValidationResult.pass(checkName)];
+    }
+
+    const inputKeys = new Set(Object.keys(inputs ?? {}));
+    const missing = requiredInputs.filter((arg) => !inputKeys.has(arg));
+    if (missing.length > 0) {
+      return [
+        WorkflowValidationResult.fail(
+          checkName,
+          `Missing required workflow inputs: ${missing.join(", ")}`,
+        ),
+      ];
+    }
+
+    return [WorkflowValidationResult.pass(checkName)];
+  }
 }