`download?style=ga` emits unversioned `tool_id`s, producing workflows that save but cannot be invoked

[scottcain]

Posted by an AI assistant on scottcain's behalf.

Summary

GET /api/workflows/{id}/download?style=ga emits each Tool Shed step's tool_id as the
unversioned repository path (toolshed.g2.bx.psu.edu/repos/iuc/kmindex/kmindex_query), with the
version carried separately in tool_version.

Re-importing that exact document — the download/edit/upload round trip any external deploy script
performs — produces a workflow that saves successfully, shows errors: null on every step via
GET /api/workflows/{id}?legacy=false, and lints clean, but cannot be invoked:
POST /api/workflows/{id}/invocations returns HTTP 400 "the following required tools are not
installed", naming tools that are installed at exactly that id and version.

Setting tool_id to the full versioned path, with no other change, makes the same workflow invoke
immediately. The round trip is lossy in a way that is invisible until invocation: the format the
server hands you back is not a format the server will accept for execution.

Evidence

Isolated on a purpose-built one-step probe workflow (a single tp_cat step, plain
POST /api/workflows body {"workflow": …} with no exact_tools/allow_missing_tools keys, so those
flags are excluded as a cause):

• tool_id: …/text_processing/tp_cat + tool_version: 9.11+galaxy0 → invocation 400, "required tools
  are not installed: …/tp_cat (version 9.11+galaxy0)".
• Changing only tool_id to …/text_processing/tp_cat/9.11+galaxy0 → invocation scheduled, jobs
  ran to ok.

Corroborated on the run's real workflow: the version built from a download?style=ga round trip
saved fine with 0 steps in error, every tool independently confirmed present via
GET /api/tools/{versioned-id} — yet invocation returned 400 listing collapse_dataset 5.1.0,
kmindex_query 0.6.1+galaxy4, lexicmap_search 0.9.0+galaxy1 and collection_column_join 0.0.3 as
not installed. The next version, identical apart from versioned tool_ids, invoked successfully.

Expected

1. POST /api/workflows/{id}/invocations should resolve an unversioned tool_id together with the
   step's own tool_version, exactly as the save path and the editor already do. Failing that, the
   error should say the id is unversioned rather than claiming an installed tool is not installed —
   which routes debugging toward tool installation instead of toward id formatting.
2. download?style=ga should round-trip losslessly: either emit the versioned id, or have the
   invocation check accept what the download emits. As it stands, the documented way to fetch a
   workflow produces a document that silently loses executability.

Distinct from

The stale-toolbox-read issue also filed from this run. That one has a reload-timing signature under
planemo; this is deterministic, has no timing component, and reproduces on demand against a long-warm
production toolbox.