feat(workflows): Phase 1 backend — WorkflowDefinition model, persistence, IPC, sidecar execution

Introduce WorkflowDefinition as a first-class entity alongside PatternDefinition.

Shared domain:
- src/shared/domain/workflow.ts: new WorkflowDefinition, WorkflowGraph,
  WorkflowNode/Edge/Config types, normalization, TS-side validation, and
  buildWorkflowExecutionPattern (synthetic pattern bridge for session plumbing)
- workspace.ts: add workflows[] and selectedWorkflowId
- session.ts: add optional workflowId to SessionRecord
- runTimeline.ts: add optional workflowId/workflowName to run records
- sessionLibrary.ts: workflow-aware session search

IPC / main process:
- contracts/channels.ts, contracts/ipc.ts: workflow CRUD channels
- preload/index.ts: expose saveWorkflow, deleteWorkflow, createWorkflowSession
- ipc/registerIpcHandlers.ts: register workflow handlers
- persistence/workspaceRepository.ts: load/save/normalize workflows
- AryxAppService.ts: saveWorkflow, deleteWorkflow, createWorkflowSession,
  resolveSessionExecutionDefinition, workflow-aware turn/run plumbing

Sidecar protocol:
- contracts/sidecar.ts: ValidateWorkflowCommand, WorkflowValidationEvent,
  optional workflow on RunTurnCommand
- sidecarProcess.ts: validate-workflow command dispatch and event handling
- Contracts/ProtocolModels.cs: workflow DTOs and validate-workflow DTOs
- Services/SidecarProtocolHost.cs: validate-workflow command handler
- Services/CopilotWorkflowRunner.cs: workflow-aware build and checkpoint path
- Services/WorkflowValidator.cs: graph validation (connectivity, start/end,
  fan-out/in arity, path reachability)
- Services/WorkflowRunner.cs: WorkflowDefinitionDto -> Agent Framework Workflow
  builder (direct, fan-out, fan-in edges; agent executor binding)

Project: bump both csproj from net9.0 to net10.0

Tests:
- tests/shared/workflow.test.ts: TS workflow validation and pattern synthesis
- tests/main/appServiceWorkflow.test.ts: saveWorkflow / createWorkflowSession
- tests/Aryx.AgentHost.Tests/SidecarProtocolHostTests.cs: ValidateWorkflowCommand
- Fix two stale workspace fixtures missing workflows field

Validation: tsc clean, bun test 367/367 pass, dotnet test 244/244 pass, bun run build succeeds.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sidecar/src/Aryx.AgentHost/Aryx.AgentHost.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net9.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <SatelliteResourceLanguages>en</SatelliteResourceLanguages>

sidecar/src/Aryx.AgentHost/Contracts/ProtocolModels.cs

@@ -1,3 +1,4 @@
+using System.Text.Json;
 using System.Text.Json.Serialization;
 
 namespace Aryx.AgentHost.Contracts;
@@ -66,6 +67,125 @@ public sealed class PatternDefinitionDto
     public string UpdatedAt { get; init; } = string.Empty;
 }
 
+public sealed class WorkflowPositionDto
+{
+    public double X { get; init; }
+    public double Y { get; init; }
+}
+
+public sealed class WorkflowNodeConfigDto
+{
+    public string Kind { get; init; } = string.Empty;
+    public string? InputType { get; init; }
+    public string? OutputType { get; init; }
+    public string Id { get; init; } = string.Empty;
+    public string Name { get; init; } = string.Empty;
+    public string Description { get; init; } = string.Empty;
+    public string Instructions { get; init; } = string.Empty;
+    public string Model { get; init; } = string.Empty;
+    public string? ReasoningEffort { get; init; }
+    public PatternAgentCopilotConfigDto? Copilot { get; init; }
+    public string? WorkspaceAgentId { get; init; }
+    public string? Implementation { get; init; }
+    public string? FunctionRef { get; init; }
+    public IReadOnlyDictionary<string, JsonElement>? Parameters { get; init; }
+    public string? WorkflowId { get; init; }
+    public WorkflowDefinitionDto? InlineWorkflow { get; init; }
+    public string? PortId { get; init; }
+    public string? RequestType { get; init; }
+    public string? ResponseType { get; init; }
+    public string? Prompt { get; init; }
+}
+
+public sealed class WorkflowNodeDto
+{
+    public string Id { get; init; } = string.Empty;
+    public string Kind { get; init; } = string.Empty;
+    public string Label { get; init; } = string.Empty;
+    public WorkflowPositionDto Position { get; init; } = new();
+    public int? Order { get; init; }
+    public WorkflowNodeConfigDto Config { get; init; } = new();
+}
+
+public sealed class WorkflowConditionRuleDto
+{
+    public string PropertyPath { get; init; } = string.Empty;
+    public string Operator { get; init; } = string.Empty;
+    public string Value { get; init; } = string.Empty;
+}
+
+public sealed class EdgeConditionDto
+{
+    public string Type { get; init; } = string.Empty;
+    public string? TypeName { get; init; }
+    public string? Expression { get; init; }
+    public string? Combinator { get; init; }
+    public IReadOnlyList<WorkflowConditionRuleDto> Rules { get; init; } = [];
+}
+
+public sealed class FanOutConfigDto
+{
+    public string Strategy { get; init; } = "broadcast";
+    public string? PartitionExpression { get; init; }
+}
+
+public sealed class WorkflowEdgeDto
+{
+    public string Id { get; init; } = string.Empty;
+    public string Source { get; init; } = string.Empty;
+    public string Target { get; init; } = string.Empty;
+    public string Kind { get; init; } = "direct";
+    public EdgeConditionDto? Condition { get; init; }
+    public string? Label { get; init; }
+    public FanOutConfigDto? FanOutConfig { get; init; }
+}
+
+public sealed class WorkflowGraphDto
+{
+    public IReadOnlyList<WorkflowNodeDto> Nodes { get; init; } = [];
+    public IReadOnlyList<WorkflowEdgeDto> Edges { get; init; } = [];
+}
+
+public sealed class WorkflowCheckpointSettingsDto
+{
+    public bool Enabled { get; init; }
+}
+
+public sealed class WorkflowTelemetrySettingsDto
+{
+    public bool? OpenTelemetry { get; init; }
+    public bool? SensitiveData { get; init; }
+}
+
+public sealed class WorkflowStateScopeDto
+{
+    public string Name { get; init; } = string.Empty;
+    public string? Description { get; init; }
+    public IReadOnlyDictionary<string, JsonElement>? InitialValues { get; init; }
+}
+
+public sealed class WorkflowSettingsDto
+{
+    public WorkflowCheckpointSettingsDto Checkpointing { get; init; } = new();
+    public string ExecutionMode { get; init; } = "off-thread";
+    public int? MaxIterations { get; init; }
+    public ApprovalPolicyDto? ApprovalPolicy { get; init; }
+    public IReadOnlyList<WorkflowStateScopeDto> StateScopes { get; init; } = [];
+    public WorkflowTelemetrySettingsDto? Telemetry { get; init; }
+}
+
+public sealed class WorkflowDefinitionDto
+{
+    public string Id { get; init; } = string.Empty;
+    public string Name { get; init; } = string.Empty;
+    public string Description { get; init; } = string.Empty;
+    public bool? IsFavorite { get; init; }
+    public WorkflowGraphDto Graph { get; init; } = new();
+    public WorkflowSettingsDto Settings { get; init; } = new();
+    public string CreatedAt { get; init; } = string.Empty;
+    public string UpdatedAt { get; init; } = string.Empty;
+}
+
 public sealed class ApprovalPolicyDto
 {
     public IReadOnlyList<ApprovalCheckpointRuleDto> Rules { get; init; } = [];
@@ -105,6 +225,15 @@ public sealed class PatternValidationIssueDto
     public string Message { get; init; } = string.Empty;
 }
 
+public sealed class WorkflowValidationIssueDto
+{
+    public string Level { get; init; } = "error";
+    public string? Field { get; init; }
+    public string Message { get; init; } = string.Empty;
+    public string? NodeId { get; init; }
+    public string? EdgeId { get; init; }
+}
+
 public sealed class SidecarModeCapabilityDto
 {
     public bool Available { get; init; }
@@ -177,6 +306,11 @@ public sealed class ValidatePatternCommandDto : SidecarCommandEnvelope
     public PatternDefinitionDto Pattern { get; init; } = new();
 }
 
+public sealed class ValidateWorkflowCommandDto : SidecarCommandEnvelope
+{
+    public WorkflowDefinitionDto Workflow { get; init; } = new();
+}
+
 public sealed class RunTurnCommandDto : SidecarCommandEnvelope
 {
     public string SessionId { get; init; } = string.Empty;
@@ -186,6 +320,7 @@ public sealed class RunTurnCommandDto : SidecarCommandEnvelope
     public string MessageMode { get; init; } = "enqueue";
     public string? ProjectInstructions { get; init; }
     public PatternDefinitionDto Pattern { get; init; } = new();
+    public WorkflowDefinitionDto? Workflow { get; init; }
     public IReadOnlyList<ChatMessageDto> Messages { get; init; } = [];
     public RunTurnPromptInvocationDto? PromptInvocation { get; init; }
     public RunTurnToolingConfigDto? Tooling { get; init; }
@@ -330,6 +465,11 @@ public sealed class PatternValidationEventDto : SidecarEventDto
     public IReadOnlyList<PatternValidationIssueDto> Issues { get; init; } = [];
 }
 
+public sealed class WorkflowValidationEventDto : SidecarEventDto
+{
+    public IReadOnlyList<WorkflowValidationIssueDto> Issues { get; init; } = [];
+}
+
 public sealed class TurnDeltaEventDto : SidecarEventDto
 {
     public string SessionId { get; init; } = string.Empty;

sidecar/src/Aryx.AgentHost/Services/CopilotWorkflowRunner.cs

@@ -12,14 +12,17 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
 {
     private const string HandoffFunctionPrefix = "handoff_to_";
     private readonly PatternValidator _patternValidator;
+    private readonly WorkflowValidator _workflowValidator;
+    private readonly WorkflowRunner _workflowRunner = new();
     private readonly CopilotApprovalCoordinator _approvalCoordinator = new();
     private readonly CopilotUserInputCoordinator _userInputCoordinator = new();
     private readonly CopilotMcpOAuthCoordinator _mcpOAuthCoordinator = new();
     private readonly CopilotExitPlanModeCoordinator _exitPlanModeCoordinator = new();
 
-    public CopilotWorkflowRunner(PatternValidator patternValidator)
+    public CopilotWorkflowRunner(PatternValidator patternValidator, WorkflowValidator? workflowValidator = null)
     {
         _patternValidator = patternValidator;
+        _workflowValidator = workflowValidator ?? new WorkflowValidator();
     }
 
     public async Task<IReadOnlyList<ChatMessageDto>> RunTurnAsync(
@@ -32,10 +35,12 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
         Func<ExitPlanModeRequestedEventDto, Task> onExitPlanMode,
         CancellationToken cancellationToken)
     {
-        PatternValidationIssueDto? validationError = _patternValidator.Validate(command.Pattern).FirstOrDefault();
+        string? validationError = command.Workflow is null
+            ? _patternValidator.Validate(command.Pattern).FirstOrDefault()?.Message
+            : _workflowValidator.Validate(command.Workflow).FirstOrDefault()?.Message;
         if (validationError is not null)
         {
-            throw new InvalidOperationException(validationError.Message);
+            throw new InvalidOperationException(validationError);
         }
 
         CopilotTurnExecutionState state = new(command);
@@ -79,7 +84,9 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
                 },
                 runCancellation.Token);
             ConfigureHookLifecycleEventSuppression(state, bundle);
-            Workflow workflow = bundle.BuildWorkflow(command.Pattern);
+            Workflow workflow = command.Workflow is null
+                ? bundle.BuildWorkflow(command.Pattern)
+                : _workflowRunner.BuildWorkflow(command.Workflow, command.Pattern, bundle.Agents);
             List<ChatMessage> inputMessages = command.Messages.Select(WorkflowTranscriptProjector.ToChatMessage).ToList();
             WorkflowTranscriptProjector.AttachMessageMode(inputMessages, command.MessageMode);
 
@@ -145,6 +152,11 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
     internal static bool ShouldEnableWorkflowCheckpointing(RunTurnCommandDto command)
     {
         ArgumentNullException.ThrowIfNull(command);
+        if (command.Workflow is not null)
+        {
+            return command.Workflow.Settings.Checkpointing.Enabled;
+        }
+
         return string.Equals(command.Pattern.Mode, "handoff", StringComparison.OrdinalIgnoreCase);
     }
 

sidecar/src/Aryx.AgentHost/Services/SidecarProtocolHost.cs

@@ -11,6 +11,7 @@ public sealed class SidecarProtocolHost
 {
     private const string DescribeCapabilitiesCommandType = "describe-capabilities";
     private const string ValidatePatternCommandType = "validate-pattern";
+    private const string ValidateWorkflowCommandType = "validate-workflow";
     private const string RunTurnCommandType = "run-turn";
     private const string CancelTurnCommandType = "cancel-turn";
     private const string ResolveApprovalCommandType = "resolve-approval";
@@ -42,6 +43,7 @@ public sealed class SidecarProtocolHost
 
     private readonly Func<CancellationToken, Task<SidecarCapabilitiesDto>> _capabilitiesProvider;
     private readonly PatternValidator _patternValidator;
+    private readonly WorkflowValidator _workflowValidator;
     private readonly ITurnWorkflowRunner _workflowRunner;
     private readonly ICopilotSessionManager _sessionManager;
     private readonly JsonSerializerOptions _jsonOptions;
@@ -53,7 +55,7 @@ public sealed class SidecarProtocolHost
         new(StringComparer.Ordinal);
 
     public SidecarProtocolHost()
-        : this(new PatternValidator())
+        : this(new PatternValidator(), new WorkflowValidator())
     {
     }
 
@@ -62,9 +64,20 @@ public sealed class SidecarProtocolHost
         ITurnWorkflowRunner? workflowRunner = null,
         Func<CancellationToken, Task<SidecarCapabilitiesDto>>? capabilitiesProvider = null,
         ICopilotSessionManager? sessionManager = null)
+        : this(patternValidator, new WorkflowValidator(), workflowRunner, capabilitiesProvider, sessionManager)
+    {
+    }
+
+    public SidecarProtocolHost(
+        PatternValidator patternValidator,
+        WorkflowValidator workflowValidator,
+        ITurnWorkflowRunner? workflowRunner = null,
+        Func<CancellationToken, Task<SidecarCapabilitiesDto>>? capabilitiesProvider = null,
+        ICopilotSessionManager? sessionManager = null)
     {
         _patternValidator = patternValidator;
-        _workflowRunner = workflowRunner ?? new CopilotWorkflowRunner(_patternValidator);
+        _workflowValidator = workflowValidator;
+        _workflowRunner = workflowRunner ?? new CopilotWorkflowRunner(_patternValidator, _workflowValidator);
         _capabilitiesProvider = capabilitiesProvider ?? BuildCapabilitiesAsync;
         _sessionManager = sessionManager ?? new CopilotSessionManager();
         _jsonOptions = JsonSerialization.CreateWebOptions();
@@ -74,6 +87,7 @@ public sealed class SidecarProtocolHost
         {
             [DescribeCapabilitiesCommandType] = HandleDescribeCapabilitiesAsync,
             [ValidatePatternCommandType] = HandleValidatePatternAsync,
+            [ValidateWorkflowCommandType] = HandleValidateWorkflowAsync,
             [RunTurnCommandType] = HandleRunTurnAsync,
             [CancelTurnCommandType] = HandleCancelTurnAsync,
             [ResolveApprovalCommandType] = HandleResolveApprovalAsync,
@@ -180,6 +194,18 @@ public sealed class SidecarProtocolHost
         }, context.CancellationToken).ConfigureAwait(false);
     }
 
+    private async Task HandleValidateWorkflowAsync(CommandContext context)
+    {
+        ValidateWorkflowCommandDto command = DeserializeCommand<ValidateWorkflowCommandDto>(context);
+
+        await WriteAsync(context.Output, new WorkflowValidationEventDto
+        {
+            Type = "workflow-validation",
+            RequestId = context.Envelope.RequestId,
+            Issues = _workflowValidator.Validate(command.Workflow),
+        }, context.CancellationToken).ConfigureAwait(false);
+    }
+
     private async Task HandleRunTurnAsync(CommandContext context)
     {
         RunTurnCommandDto command = DeserializeCommand<RunTurnCommandDto>(context);

sidecar/src/Aryx.AgentHost/Services/WorkflowRunner.cs

@@ -0,0 +1,95 @@
+using Aryx.AgentHost.Contracts;
+using Microsoft.Agents.AI;
+using Microsoft.Agents.AI.Workflows;
+using Microsoft.Agents.AI.Workflows.Specialized;
+
+namespace Aryx.AgentHost.Services;
+
+internal sealed class WorkflowRunner
+{
+    public Workflow BuildWorkflow(
+        WorkflowDefinitionDto workflowDefinition,
+        PatternDefinitionDto patternDefinition,
+        IReadOnlyList<AIAgent> agents)
+    {
+        ArgumentNullException.ThrowIfNull(workflowDefinition);
+        ArgumentNullException.ThrowIfNull(patternDefinition);
+        ArgumentNullException.ThrowIfNull(agents);
+
+        WorkflowNodeDto startNode = workflowDefinition.Graph.Nodes.Single(node =>
+            string.Equals(node.Kind, "start", StringComparison.OrdinalIgnoreCase));
+        WorkflowNodeDto endNode = workflowDefinition.Graph.Nodes.Single(node =>
+            string.Equals(node.Kind, "end", StringComparison.OrdinalIgnoreCase));
+
+        Dictionary<string, AIAgent> agentMap = patternDefinition.Agents
+            .Zip(agents, (definition, agent) => (definition.Id, agent))
+            .ToDictionary(pair => pair.Id, pair => pair.agent, StringComparer.Ordinal);
+
+        Dictionary<string, ExecutorBinding> bindings = new(StringComparer.Ordinal);
+        foreach (WorkflowNodeDto node in workflowDefinition.Graph.Nodes)
+        {
+            bindings[node.Id] = CreateExecutorBinding(node, agentMap);
+        }
+
+        WorkflowBuilder builder = new(bindings[startNode.Id]);
+
+        foreach (WorkflowEdgeDto edge in workflowDefinition.Graph.Edges.Where(edge =>
+                     string.Equals(edge.Kind, "direct", StringComparison.OrdinalIgnoreCase)))
+        {
+            builder.AddEdge(bindings[edge.Source], bindings[edge.Target]);
+        }
+
+        foreach (IGrouping<string, WorkflowEdgeDto> fanOutGroup in workflowDefinition.Graph.Edges
+                     .Where(edge => string.Equals(edge.Kind, "fan-out", StringComparison.OrdinalIgnoreCase))
+                     .GroupBy(edge => edge.Source, StringComparer.Ordinal))
+        {
+            builder.AddFanOutEdge(
+                bindings[fanOutGroup.Key],
+                fanOutGroup.Select(edge => bindings[edge.Target]).ToArray());
+        }
+
+        foreach (IGrouping<string, WorkflowEdgeDto> fanInGroup in workflowDefinition.Graph.Edges
+                     .Where(edge => string.Equals(edge.Kind, "fan-in", StringComparison.OrdinalIgnoreCase))
+                     .GroupBy(edge => edge.Target, StringComparer.Ordinal))
+        {
+            builder.AddFanInBarrierEdge(
+                fanInGroup.Select(edge => bindings[edge.Source]).ToArray(),
+                bindings[fanInGroup.Key]);
+        }
+
+        if (!string.IsNullOrWhiteSpace(workflowDefinition.Name))
+        {
+            builder = builder.WithName(workflowDefinition.Name);
+        }
+
+        return builder.WithOutputFrom(bindings[endNode.Id]).Build();
+    }
+
+    private static ExecutorBinding CreateExecutorBinding(
+        WorkflowNodeDto node,
+        IReadOnlyDictionary<string, AIAgent> agentMap)
+    {
+        if (string.Equals(node.Kind, "start", StringComparison.OrdinalIgnoreCase))
+        {
+            return new ChatForwardingExecutor(node.Id);
+        }
+
+        if (string.Equals(node.Kind, "end", StringComparison.OrdinalIgnoreCase))
+        {
+            return new WorkflowOutputMessagesExecutor();
+        }
+
+        if (string.Equals(node.Kind, "agent", StringComparison.OrdinalIgnoreCase))
+        {
+            string agentId = !string.IsNullOrWhiteSpace(node.Config.Id) ? node.Config.Id : node.Id;
+            if (!agentMap.TryGetValue(agentId, out AIAgent? agent))
+            {
+                throw new InvalidOperationException($"Workflow node \"{node.Id}\" references unknown agent \"{agentId}\".");
+            }
+
+            return agent.BindAsExecutor(CopilotAgentBundle.CreateAgentHostOptions());
+        }
+
+        throw new NotSupportedException($"Workflow node kind \"{node.Kind}\" is not executable yet.");
+    }
+}

sidecar/src/Aryx.AgentHost/Services/WorkflowValidator.cs

@@ -0,0 +1,292 @@
+using Aryx.AgentHost.Contracts;
+
+namespace Aryx.AgentHost.Services;
+
+public sealed class WorkflowValidator
+{
+    private static readonly HashSet<string> ExecutableNodeKinds = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "start",
+        "end",
+        "agent",
+    };
+
+    public IReadOnlyList<WorkflowValidationIssueDto> Validate(WorkflowDefinitionDto workflow)
+    {
+        List<WorkflowValidationIssueDto> issues = [];
+
+        if (string.IsNullOrWhiteSpace(workflow.Name))
+        {
+            issues.Add(new WorkflowValidationIssueDto
+            {
+                Field = "name",
+                Message = "Workflow name is required.",
+            });
+        }
+
+        if (workflow.Graph.Nodes.Count == 0)
+        {
+            issues.Add(new WorkflowValidationIssueDto
+            {
+                Field = "graph",
+                Message = "Workflow graph must include nodes.",
+            });
+            return issues;
+        }
+
+        Dictionary<string, WorkflowNodeDto> nodesById = new(StringComparer.Ordinal);
+        HashSet<string> edgeIds = new(StringComparer.Ordinal);
+        Dictionary<string, int> incomingCounts = new(StringComparer.Ordinal);
+        Dictionary<string, int> outgoingCounts = new(StringComparer.Ordinal);
+
+        foreach (WorkflowNodeDto node in workflow.Graph.Nodes)
+        {
+            if (string.IsNullOrWhiteSpace(node.Id))
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.nodes.id",
+                    Message = "Workflow nodes must have an ID.",
+                });
+                continue;
+            }
+
+            if (!nodesById.TryAdd(node.Id, node))
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.nodes.id",
+                    NodeId = node.Id,
+                    Message = $"Workflow graph contains duplicate node \"{node.Id}\".",
+                });
+                continue;
+            }
+
+            if (!ExecutableNodeKinds.Contains(node.Kind))
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.nodes.kind",
+                    NodeId = node.Id,
+                    Message = $"Workflow node kind \"{node.Kind}\" is not executable yet.",
+                });
+            }
+
+            if (string.Equals(node.Kind, "agent", StringComparison.OrdinalIgnoreCase))
+            {
+                if (string.IsNullOrWhiteSpace(node.Config.Name))
+                {
+                    issues.Add(new WorkflowValidationIssueDto
+                    {
+                        Field = "graph.nodes.config.name",
+                        NodeId = node.Id,
+                        Message = "Agent nodes require a name.",
+                    });
+                }
+
+                if (string.IsNullOrWhiteSpace(node.Config.Model))
+                {
+                    issues.Add(new WorkflowValidationIssueDto
+                    {
+                        Field = "graph.nodes.config.model",
+                        NodeId = node.Id,
+                        Message = $"Agent node \"{node.Label}\" requires a model.",
+                    });
+                }
+            }
+        }
+
+        foreach (WorkflowEdgeDto edge in workflow.Graph.Edges)
+        {
+            if (string.IsNullOrWhiteSpace(edge.Id))
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.edges.id",
+                    Message = "Workflow edges must have an ID.",
+                });
+                continue;
+            }
+
+            if (!edgeIds.Add(edge.Id))
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.edges.id",
+                    EdgeId = edge.Id,
+                    Message = $"Workflow graph contains duplicate edge \"{edge.Id}\".",
+                });
+            }
+
+            if (!nodesById.ContainsKey(edge.Source) || !nodesById.ContainsKey(edge.Target))
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.edges",
+                    EdgeId = edge.Id,
+                    Message = $"Workflow edge \"{edge.Id}\" must connect known nodes.",
+                });
+                continue;
+            }
+
+            outgoingCounts[edge.Source] = outgoingCounts.TryGetValue(edge.Source, out int outgoing)
+                ? outgoing + 1
+                : 1;
+            incomingCounts[edge.Target] = incomingCounts.TryGetValue(edge.Target, out int incoming)
+                ? incoming + 1
+                : 1;
+        }
+
+        List<WorkflowNodeDto> startNodes = workflow.Graph.Nodes
+            .Where(node => string.Equals(node.Kind, "start", StringComparison.OrdinalIgnoreCase))
+            .ToList();
+        List<WorkflowNodeDto> endNodes = workflow.Graph.Nodes
+            .Where(node => string.Equals(node.Kind, "end", StringComparison.OrdinalIgnoreCase))
+            .ToList();
+        List<WorkflowNodeDto> agentNodes = workflow.Graph.Nodes
+            .Where(node => string.Equals(node.Kind, "agent", StringComparison.OrdinalIgnoreCase))
+            .ToList();
+
+        if (startNodes.Count != 1)
+        {
+            issues.Add(new WorkflowValidationIssueDto
+            {
+                Field = "graph.nodes",
+                Message = "Workflow graphs must contain exactly one start node.",
+            });
+        }
+
+        if (endNodes.Count != 1)
+        {
+            issues.Add(new WorkflowValidationIssueDto
+            {
+                Field = "graph.nodes",
+                Message = "Workflow graphs must contain exactly one end node.",
+            });
+        }
+
+        if (agentNodes.Count == 0)
+        {
+            issues.Add(new WorkflowValidationIssueDto
+            {
+                Field = "graph.nodes",
+                Message = "Workflow graphs must contain at least one agent node.",
+            });
+        }
+
+        foreach (WorkflowNodeDto startNode in startNodes)
+        {
+            if (incomingCounts.GetValueOrDefault(startNode.Id) != 0)
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.edges",
+                    NodeId = startNode.Id,
+                    Message = "Start nodes cannot have incoming edges.",
+                });
+            }
+
+            if (outgoingCounts.GetValueOrDefault(startNode.Id) == 0)
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.edges",
+                    NodeId = startNode.Id,
+                    Message = "Start nodes must connect to at least one downstream node.",
+                });
+            }
+        }
+
+        foreach (WorkflowNodeDto endNode in endNodes)
+        {
+            if (outgoingCounts.GetValueOrDefault(endNode.Id) != 0)
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.edges",
+                    NodeId = endNode.Id,
+                    Message = "End nodes cannot have outgoing edges.",
+                });
+            }
+        }
+
+        foreach (IGrouping<string, WorkflowEdgeDto> fanOutGroup in workflow.Graph.Edges
+                     .Where(edge => string.Equals(edge.Kind, "fan-out", StringComparison.OrdinalIgnoreCase))
+                     .GroupBy(edge => edge.Source, StringComparer.Ordinal))
+        {
+            if (fanOutGroup.Count() < 2)
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.edges.kind",
+                    NodeId = fanOutGroup.Key,
+                    Message = "Fan-out edges require at least two outgoing fan-out connections from the same source.",
+                });
+            }
+        }
+
+        foreach (IGrouping<string, WorkflowEdgeDto> fanInGroup in workflow.Graph.Edges
+                     .Where(edge => string.Equals(edge.Kind, "fan-in", StringComparison.OrdinalIgnoreCase))
+                     .GroupBy(edge => edge.Target, StringComparer.Ordinal))
+        {
+            if (fanInGroup.Count() < 2)
+            {
+                issues.Add(new WorkflowValidationIssueDto
+                {
+                    Field = "graph.edges.kind",
+                    NodeId = fanInGroup.Key,
+                    Message = "Fan-in edges require at least two incoming fan-in connections to the same target.",
+                });
+            }
+        }
+
+        WorkflowNodeDto? start = startNodes.FirstOrDefault();
+        if (start is not null && endNodes.Count > 0 && !HasPathToAnyEnd(start.Id, workflow.Graph, endNodes.Select(node => node.Id)))
+        {
+            issues.Add(new WorkflowValidationIssueDto
+            {
+                Field = "graph.edges",
+                Message = "Workflow graph must include a path from the start node to at least one end node.",
+            });
+        }
+
+        return issues;
+    }
+
+    private static bool HasPathToAnyEnd(
+        string startNodeId,
+        WorkflowGraphDto graph,
+        IEnumerable<string> endNodeIds)
+    {
+        HashSet<string> endSet = endNodeIds.ToHashSet(StringComparer.Ordinal);
+        Dictionary<string, List<string>> outgoing = graph.Edges
+            .GroupBy(edge => edge.Source, StringComparer.Ordinal)
+            .ToDictionary(
+                group => group.Key,
+                group => group.Select(edge => edge.Target).ToList(),
+                StringComparer.Ordinal);
+
+        Queue<string> queue = new([startNodeId]);
+        HashSet<string> visited = new(StringComparer.Ordinal);
+        while (queue.Count > 0)
+        {
+            string current = queue.Dequeue();
+            if (!visited.Add(current))
+            {
+                continue;
+            }
+
+            if (endSet.Contains(current))
+            {
+                return true;
+            }
+
+            foreach (string target in outgoing.GetValueOrDefault(current, []))
+            {
+                queue.Enqueue(target);
+            }
+        }
+
+        return false;
+    }
+}

sidecar/tests/Aryx.AgentHost.Tests/Aryx.AgentHost.Tests.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net9.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <IsPackable>false</IsPackable>

sidecar/tests/Aryx.AgentHost.Tests/SidecarProtocolHostTests.cs

@@ -108,6 +108,76 @@ public sealed class SidecarProtocolHostTests
             });
     }
 
+    [Fact]
+    public async Task ValidateWorkflowCommand_ReturnsIssuesAndCompletion()
+    {
+        IReadOnlyList<JsonElement> events = await RunHostAsync(new ValidateWorkflowCommandDto
+        {
+            Type = "validate-workflow",
+            RequestId = "validate-workflow-1",
+            Workflow = new WorkflowDefinitionDto
+            {
+                Id = "workflow-1",
+                Name = "",
+                Graph = new WorkflowGraphDto
+                {
+                    Nodes =
+                    [
+                        new WorkflowNodeDto
+                        {
+                            Id = "start",
+                            Kind = "start",
+                            Label = "Start",
+                            Config = new WorkflowNodeConfigDto { Kind = "start" },
+                        },
+                        new WorkflowNodeDto
+                        {
+                            Id = "end",
+                            Kind = "end",
+                            Label = "End",
+                            Config = new WorkflowNodeConfigDto { Kind = "end" },
+                        },
+                    ],
+                    Edges =
+                    [
+                        new WorkflowEdgeDto
+                        {
+                            Id = "edge-start-end",
+                            Source = "start",
+                            Target = "end",
+                            Kind = "direct",
+                        },
+                    ],
+                },
+                Settings = new WorkflowSettingsDto
+                {
+                    Checkpointing = new WorkflowCheckpointSettingsDto(),
+                },
+            },
+        });
+
+        Assert.Collection(
+            events,
+            validationEvent =>
+            {
+                Assert.Equal("workflow-validation", validationEvent.GetProperty("type").GetString());
+                Assert.Equal("validate-workflow-1", validationEvent.GetProperty("requestId").GetString());
+
+                JsonElement[] issues = validationEvent.GetProperty("issues").EnumerateArray().ToArray();
+                Assert.Contains(issues, issue =>
+                    issue.GetProperty("field").GetString() == "name"
+                    && issue.GetProperty("message").GetString() == "Workflow name is required.");
+                Assert.Contains(issues, issue =>
+                    issue.GetProperty("field").GetString() == "graph.nodes"
+                    && issue.GetProperty("message").GetString() == "Workflow graphs must contain at least one agent node.");
+            },
+            completionEvent =>
+            {
+                Assert.Equal("command-complete", completionEvent.GetProperty("type").GetString());
+                Assert.Equal("validate-workflow-1", completionEvent.GetProperty("requestId").GetString());
+            });
+    }
+
     [Fact]
     public async Task RunTurnCommand_ReturnsActivityEventsAndCompletion()
     {