fix(apps): send workflowId not path from CLI; wire sandboxRoot and systemPromptPath in server; update prompts and fixtures

apps/cli/src/main/kotlin/com/correx/apps/cli/commands/RunCommand.kt

@@ -97,6 +97,9 @@ class RunCommand : CliktCommand(name = "run") {
         }
     }
 
+    private fun resolveWorkflowId(path: String): String =
+        java.nio.file.Path.of(path).fileName.toString().removeSuffix(".toml")
+
     private suspend fun startSession(
         client: HttpClient,
         host: String,
@@ -105,7 +108,7 @@ class RunCommand : CliktCommand(name = "run") {
     ): String? = runCatching {
         val resp = client.post("http://$host:$portInt/sessions") {
             contentType(ContentType.Application.Json)
-            setBody(StartSessionRequest(workflowId = workflow, sessionId = sessionId))
+            setBody(StartSessionRequest(workflowId = resolveWorkflowId(workflow), sessionId = sessionId))
         }
         resp.body<StartSessionResponse>().sessionId
     }.getOrElse { e ->

apps/server/build.gradle

@@ -21,6 +21,7 @@ dependencies {
     implementation project(':core:artifacts')
     implementation project(':core:artifacts-store')
     implementation project(':infrastructure')
+    implementation project(':infrastructure:artifacts-cas')
     implementation project(':infrastructure:workflow')
     implementation project(':infrastructure:persistence')
     implementation project(':infrastructure:inference')

apps/server/src/main/kotlin/com/correx/apps/server/Main.kt

@@ -22,6 +22,7 @@ import com.correx.core.sessions.SessionProjector
 import com.correx.core.sessions.projections.replay.DefaultEventReplayer
 import com.correx.core.transitions.evaluation.PromptResolver
 import com.correx.core.transitions.resolution.DefaultTransitionResolver
+import com.correx.core.validation.artifact.ArtifactPayloadValidator
 import com.correx.core.validation.pipeline.ValidationPipeline
 import com.correx.apps.server.logging.LoggingEventStore
 import com.correx.infrastructure.InfrastructureModule
@@ -70,7 +71,7 @@ fun main() {
         transitionResolver = DefaultTransitionResolver { condition, ctx -> condition.evaluate(ctx) },
         contextPackBuilder = DefaultContextPackBuilder(DefaultContextCompressor()),
         inferenceRouter = inferenceRouter,
-        validationPipeline = ValidationPipeline(validators = emptyList()),
+        validationPipeline = ValidationPipeline(validators = listOf(ArtifactPayloadValidator(artifactStore))),
         approvalEngine = DefaultApprovalEngine(),
         riskAssessor = DefaultRiskAssessor(),
         promptResolver = promptResolver,

apps/server/src/main/kotlin/com/correx/apps/server/routes/SessionRoutes.kt

@@ -67,8 +67,11 @@ private fun Route.startSessionRoute(module: ServerModule) {
         val graph = module.workflowRegistry.find(body.workflowId)
             ?: return@post call.respond(HttpStatusCode.BadRequest, "Unknown workflowId: ${body.workflowId}")
         val sessionId: SessionId = TypeId(UUID.randomUUID().toString())
+        val config = OrchestrationConfig(
+            defaultSystemPromptPath = "~/.config/correx/prompts/default_system.md",
+        )
         call.application.launch {
-            runCatching { module.orchestrator.run(sessionId, graph, OrchestrationConfig()) }
+            runCatching { module.orchestrator.run(sessionId, graph, config) }
                 .onFailure { ex ->
                     log.error("run failed for session={}: {}", sessionId.value, ex.message, ex)
                     module.eventStore.append(

apps/server/src/main/kotlin/com/correx/apps/server/ws/GlobalStreamHandler.kt

@@ -103,7 +103,10 @@ class GlobalStreamHandler(private val module: ServerModule) {
                 val sessionId: SessionId = TypeId(UUID.randomUUID().toString())
                 log.info("starting session={} workflow={}", sessionId.value, msg.workflowId)
                 session.launch {
-                    runCatching { module.orchestrator.run(sessionId, graph, OrchestrationConfig()) }
+                    val config = OrchestrationConfig(
+                        defaultSystemPromptPath = "~/.config/correx/prompts/default_system.md",
+                    )
+                    runCatching { module.orchestrator.run(sessionId, graph, config) }
                         .onFailure { ex ->
                             log.error("run failed for session={}: {}", sessionId.value, ex.message, ex)
                             module.eventStore.append(