fix(cloud): reject malformed executionOrder instead of silently running in parallel

A workspace config.yaml was yaml.load'ed and straight-cast to
IWorkspaceConfig, so a wrong-shaped executionOrder was never checked. The
intuitive bare-list form made executionOrder an Array, .flowsOrder came back
undefined, resolveSequentialFlows returned [], and every flow ran in
parallel - same cost, wrong semantics, green run. The only symptom was
depends_on being null on every result row.

Add a zod schema as the single source of truth for the config shape
(src/services/workspace-config.schema.ts) and route all three former cast
sites through one validated loader, loadWorkspaceConfig:

- A malformed executionOrder is now fatal (exit 1), with a message showing
  what was found next to the expected shape. A bare list is not valid
  Maestro either, so there is nothing to accept - and a warning in CI logs
  is exactly what got missed.
- Unrecognised top-level keys warn (and are preserved, since the config is
  forwarded to the API as fields.workspaceConfig), catching flowOrder, a
  top-level continueOnFailure, tags in place of includeTags, and flowTimeout.
- executionOrder on a single-file input warns instead of being dropped:
  planSingleFile never sequences, so it was silently ignored even when
  well-formed.
- continueOnFailure's real default (true) now lives in the schema instead of
  being re-specified at three read sites.
- WORKSPACE_CONFIG_KEYS is derived from the schema so isWorkspaceConfigFile's
  detection set can no longer drift from it.
- includeTags/excludeTags scalar coercion moves from readYamlFileAsJson into
  the schema, so the loader is a plain YAML read and the validator is pure.

Warnings go through an injected callback: cloud.ts passes logger.warn (stderr,
so it survives --json), the MCP tool passes logStderr since its stdout is the
JSON-RPC channel.

Also fixes two test fixtures that used a tags: key the CLI never read.

Verified on dev: the bare-list form now exits 1 before anything is submitted,
and a well-formed executionOrder chains depends_on null -> 36962 -> 36963
across results 36962-36964.

Fixes #110

Author: finalerock44

src/commands/cloud.ts

@@ -569,6 +569,9 @@ export const cloudCommand = defineCommand({
           excludeFlows,
           configFile,
           debug,
+          // Not warnOut: config problems are worth surfacing even under --json,
+          // and logger.warn writes to stderr so stdout stays parseable.
+          warn: (m: string) => logger.warn(m),
         });
 
         if (debug) {

src/mcp/tools/run-cloud-test.ts

@@ -151,6 +151,8 @@ export function registerRunCloudTest(server: McpServer): void {
           excludeTags: args.excludeTags ?? [],
           excludeFlows: args.excludeFlows,
           configFile: args.configFile,
+          // stdout is the JSON-RPC channel — config warnings must go to stderr.
+          warn: logStderr,
         });
 
         const commonRoot = computeCommonRoot(

src/services/execution-plan.service.ts

@@ -5,45 +5,12 @@ import {
   getFlowsToRunInSequence,
   isFlowFile,
   isWorkspaceConfigFile,
+  loadWorkspaceConfig,
   processDependencies,
   readDirectory,
   readTestYamlFileAsJson,
-  readYamlFileAsJson,
 } from './execution-plan.utils.js';
-
-/** Email notification configuration */
-interface INotificationsConfig {
-  email?: {
-    enabled?: boolean;
-    onSuccess?: boolean;
-    recipients?: string[];
-  };
-}
-
-/** Workspace configuration from config.yaml */
-interface IWorkspaceConfig {
-  excludeTags?: null | string[];
-  executionOrder?: IExecutionOrder | null;
-  flows?: null | string[];
-  includeTags?: null | string[];
-  local?: ILocal | null;
-  notifications?: INotificationsConfig;
-  platform?: {
-    android?: { disableAnimations?: boolean };
-    ios?: { disableAnimations?: boolean };
-  };
-}
-
-/** Local execution configuration */
-interface ILocal {
-  deterministicOrder: boolean | null;
-}
-
-/** Sequential execution configuration */
-interface IExecutionOrder {
-  continueOnFailure: boolean;
-  flowsOrder: string[];
-}
+import { IWorkspaceConfig } from './workspace-config.schema.js';
 
 /** Options for execution plan generation */
 export interface PlanOptions {
@@ -53,6 +20,12 @@ export interface PlanOptions {
   excludeTags?: string[];
   includeTags?: string[];
   input: string;
+  /**
+   * Sink for non-fatal config problems. Injected rather than imported so the
+   * MCP server can route warnings to stderr — its stdout is the JSON-RPC
+   * channel.
+   */
+  warn?: (message: string) => void;
 }
 
 /** Execution plan containing all flows to run with metadata and dependencies */
@@ -146,11 +119,13 @@ function filterFlowFiles(
  * Load workspace configuration from config.yaml/yml if present
  * @param input - Input directory path
  * @param unfilteredFlowFiles - List of discovered flow files
+ * @param warn - Sink for non-fatal config problems
  * @returns Workspace configuration object (empty if no config file found)
  */
 function getWorkspaceConfig(
   input: string,
   unfilteredFlowFiles: string[],
+  warn: (message: string) => void,
 ): IWorkspaceConfig {
   const possibleConfigPaths = new Set(
     [path.join(input, 'config.yaml'), path.join(input, 'config.yml')].map((p) =>
@@ -162,11 +137,7 @@ function getWorkspaceConfig(
     possibleConfigPaths.has(path.normalize(file)),
   );
 
-  const config = configFilePath
-    ? (readYamlFileAsJson(configFilePath) as IWorkspaceConfig)
-    : {};
-
-  return config;
+  return configFilePath ? loadWorkspaceConfig(configFilePath, warn) : {};
 }
 
 /**
@@ -199,11 +170,13 @@ function extractDeviceCloudOverrides(
 /**
  * Generate execution plan for a single flow file
  * @param normalizedInput - Normalized path to the flow file
+ * @param warn - Sink for non-fatal config problems
  * @param resolvedConfigFile - Optional absolute path to a custom config file
  * @returns Execution plan for the single file with dependencies
  */
 async function planSingleFile(
   normalizedInput: string,
+  warn: (message: string) => void,
   resolvedConfigFile?: string,
 ): Promise<IExecutionPlan> {
   const inputBasename = path.basename(normalizedInput);
@@ -232,9 +205,17 @@ async function planSingleFile(
       throw new Error(`Config file does not exist: ${resolvedConfigFile}`);
     }
 
-    workspaceConfig = readYamlFileAsJson(
-      resolvedConfigFile,
-    ) as IWorkspaceConfig;
+    workspaceConfig = loadWorkspaceConfig(resolvedConfigFile, warn);
+
+    // Sequencing is resolved against a workspace's discovered flows, which a
+    // single-file input doesn't have — so executionOrder is ignored here. Say so
+    // rather than accepting a config that reads as if it applied (dcd-cli#110).
+    if (workspaceConfig.executionOrder?.flowsOrder.length) {
+      warn(
+        `Warning: \`executionOrder\` in ${resolvedConfigFile} is ignored when a single flow file is passed.\n` +
+          `Pass the workspace folder instead so the named flows can be discovered and sequenced.`,
+      );
+    }
   }
 
   const checkedDependancies = await checkDependencies(normalizedInput);
@@ -386,6 +367,7 @@ export async function plan(options: PlanOptions): Promise<IExecutionPlan> {
     excludeFlows,
     configFile,
     debug = false,
+    warn = (message: string) => console.warn(message),
   } = options;
   const normalizedInput = path.normalize(input);
   const flowMetadata: Record<string, Record<string, unknown>> = {};
@@ -400,7 +382,7 @@ export async function plan(options: PlanOptions): Promise<IExecutionPlan> {
   }
 
   if (fs.lstatSync(normalizedInput).isFile()) {
-    return planSingleFile(normalizedInput, resolvedConfigFile);
+    return planSingleFile(normalizedInput, warn, resolvedConfigFile);
   }
 
   let unfilteredFlowFiles = await readDirectory(normalizedInput, isFlowFile);
@@ -420,11 +402,13 @@ export async function plan(options: PlanOptions): Promise<IExecutionPlan> {
       throw new Error(`Config file does not exist: ${resolvedConfigFile}`);
     }
 
-    workspaceConfig = readYamlFileAsJson(
-      resolvedConfigFile,
-    ) as IWorkspaceConfig;
+    workspaceConfig = loadWorkspaceConfig(resolvedConfigFile, warn);
   } else {
-    workspaceConfig = getWorkspaceConfig(normalizedInput, unfilteredFlowFiles);
+    workspaceConfig = getWorkspaceConfig(
+      normalizedInput,
+      unfilteredFlowFiles,
+      warn,
+    );
   }
 
   unfilteredFlowFiles = await applyFlowGlobs(

src/services/execution-plan.utils.ts

@@ -3,6 +3,12 @@ import * as yaml from 'js-yaml';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import {
+  IWorkspaceConfig,
+  parseWorkspaceConfig,
+  WORKSPACE_CONFIG_KEYS,
+} from './workspace-config.schema.js';
+
 const commandsThatRequireFiles = new Set(['addMedia', 'runFlow', 'runScript']);
 
 export function getFlowsToRunInSequence(
@@ -60,22 +66,6 @@ export function isFlowFile(filePath: string): boolean {
   return filePath.endsWith('.yaml') || filePath.endsWith('.yml');
 }
 
-/**
- * Top-level keys that only ever appear in a workspace config (see
- * IWorkspaceConfig in execution-plan.service.ts). Deliberately excludes keys
- * Maestro also allows in flow front matter — appId, name, tags, env,
- * onFlowStart, onFlowComplete, jsEngine.
- */
-const WORKSPACE_CONFIG_KEYS = new Set([
-  'excludeTags',
-  'executionOrder',
-  'flows',
-  'includeTags',
-  'local',
-  'notifications',
-  'platform',
-]);
-
 /**
  * True when a YAML file is a workspace config rather than a runnable flow.
  *
@@ -112,27 +102,34 @@ export const readYamlFileAsJson = (filePath: string) => {
     const normalizedPath = path.normalize(filePath);
     const yamlText = fs.readFileSync(normalizedPath, 'utf8');
 
-    const result = yaml.load(yamlText);
-
-    // Ensure includeTags and excludeTags are always arrays if present
-    if (result && typeof result === 'object') {
-      if ('includeTags' in result && !Array.isArray(result.includeTags)) {
-        result.includeTags = result.includeTags ? [result.includeTags] : [];
-      }
-
-      if ('excludeTags' in result && !Array.isArray(result.excludeTags)) {
-        result.excludeTags = result.excludeTags ? [result.excludeTags] : [];
-      }
-    }
-
-    return result;
+    return yaml.load(yamlText);
   } catch (error) {
     throw new Error(`Error parsing YAML file ${filePath}: ${error}`, {
       cause: error,
     });
   }
 };
 
+/**
+ * Load and validate a workspace config file.
+ *
+ * The single chokepoint for reading a config: every caller gets a
+ * runtime-validated object instead of an unchecked `as IWorkspaceConfig` cast.
+ * Scalar-to-array coercion for `includeTags`/`excludeTags` lives in the schema,
+ * so `readYamlFileAsJson` stays a plain YAML read.
+ *
+ * @param filePath - Path to the config file
+ * @param warn - Sink for non-fatal problems (unrecognised keys)
+ * @returns The validated workspace config
+ * @throws Error if the file is unparseable or the config is invalid
+ */
+export function loadWorkspaceConfig(
+  filePath: string,
+  warn: (message: string) => void,
+): IWorkspaceConfig {
+  return parseWorkspaceConfig(readYamlFileAsJson(filePath), { filePath, warn });
+}
+
 export const readTestYamlFileAsJson = (filePath: string) => {
   try {
     const normalizedPath = path.normalize(filePath);