@team-agent/installer 0.5.44 → 0.5.46

package/crates/team-agent/src/cli/status_port.rs

@@ -3,6 +3,7 @@ use super::*;
 use crate::state::projection::OwnerTeamResolution;
 use crate::transport::Transport;
 use rusqlite::params;
+use std::path::PathBuf;
 
 /// `status.status(workspace, as_json, compact)`(`queries.py:33`,**有副作用**:capture→refresh→save)。
 pub fn status(workspace: &Path, compact: bool, detail: bool) -> Result<Value, CliError> {
@@ -48,7 +49,7 @@ pub fn status_scoped(
         !tmux_present,
         &freshness,
     );
-    let agents = enrich_agents(state.get("agents"), tmux_present, &freshness);
+    let agents = enrich_agents(workspace, state, tmux_present, &freshness);
     let tasks = state.get("tasks").cloned().unwrap_or_else(|| json!([]));
     let leader_receiver = state
         .get("leader_receiver")
@@ -548,18 +549,27 @@ pub(crate) fn compute_runtime_freshness(
 }
 
 fn enrich_agents(
-    agents: Option<&Value>,
+    workspace: &Path,
+    state: &Value,
     tmux_session_present: bool,
     freshness: &RuntimeFreshness,
 ) -> Value {
+    let agents = state.get("agents");
     let Some(Value::Object(input)) = agents else {
         return json!({});
     };
+    let team_dir = state
+        .get("team_dir")
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+        .map(PathBuf::from)
+        .unwrap_or_else(|| workspace.to_path_buf());
     let mut out = Map::new();
     for (agent_id, value) in input {
         match value {
             Value::Object(obj) => {
                 let mut enriched = obj.clone();
+                apply_effective_role_projection(&team_dir, agent_id, &mut enriched);
                 enriched.insert(
                     "interacted".to_string(),
                     Value::String(interacted_marker(obj.get("first_send_at"))),
@@ -640,6 +650,64 @@ fn enrich_agents(
     Value::Object(out)
 }
 
+fn apply_effective_role_projection(
+    team_dir: &Path,
+    agent_id: &str,
+    agent: &mut Map<String, Value>,
+) {
+    let role_file = agent
+        .get("dynamic_role_file")
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+        .map(PathBuf::from)
+        .unwrap_or_else(|| team_dir.join("agents").join(format!("{agent_id}.md")));
+    let Ok((meta, _)) = crate::compiler::read_front_matter(&role_file) else {
+        return;
+    };
+    let Some(meta) = yaml_map(&meta) else {
+        return;
+    };
+    if let Some(provider) = yaml_str(meta, "provider").filter(|value| !value.is_empty()) {
+        agent.insert("provider".to_string(), Value::String(provider.to_string()));
+        agent.insert(
+            "provider_source".to_string(),
+            Value::String("role".to_string()),
+        );
+    }
+    if let Some(model) = yaml_str(meta, "model").filter(|value| !value.is_empty()) {
+        if agent.get("model").and_then(Value::as_str) != Some(model) {
+            agent.insert("model_stale".to_string(), Value::Bool(true));
+        }
+        agent.insert("model".to_string(), Value::String(model.to_string()));
+        agent.insert(
+            "model_source".to_string(),
+            Value::String("role".to_string()),
+        );
+    }
+}
+
+fn yaml_map(
+    value: &crate::model::yaml::Value,
+) -> Option<&Vec<(String, crate::model::yaml::Value)>> {
+    match value {
+        crate::model::yaml::Value::Map(items) => Some(items),
+        _ => None,
+    }
+}
+
+fn yaml_str<'a>(items: &'a [(String, crate::model::yaml::Value)], key: &str) -> Option<&'a str> {
+    items.iter().find_map(|(name, value)| {
+        if name == key {
+            match value {
+                crate::model::yaml::Value::Str(value) => Some(value.as_str()),
+                _ => None,
+            }
+        } else {
+            None
+        }
+    })
+}
+
 fn downgrade_stale_agent(agent: &mut Map<String, Value>) {
     let raw = agent
         .get("status")

package/crates/team-agent/src/cli/tests/run_delegation.rs

@@ -125,12 +125,15 @@ fn run_dispatches_send_to_handler_returns_ok() {
 }
 
 #[test]
-fn run_unknown_subcommand_is_usage() {
-    // An unknown subcommand routes to argparse-style usage (exit 2), never a handler.
+fn run_unknown_subcommand_is_error_not_usage() {
+    // 0.5.45 naming-addressing (RED-6): unknown subcommand exits 1
+    // (Error), aligned with the shared refusal shape used by
+    // `send`/`--to-name` typos. Pre-0.5.45 argparse-style Usage (2)
+    // was internal drift.
     assert_eq!(
         run(&["totally-not-a-subcommand".to_string()], Path::new(".")),
-        ExitCode::Usage,
-        "an unknown subcommand must map to ExitCode::Usage"
+        ExitCode::Error,
+        "unknown subcommand must map to ExitCode::Error (aligned with send/--to-name typo family)"
     );
 }
 

package/crates/team-agent/src/coordinator/steps/abnormal.rs

@@ -101,7 +101,7 @@ pub(crate) fn detect_abnormal_exits(
         let fact = crate::provider::latest_explicit_error_fact(agent.provider, &text);
         let error_observation_key = fact
             .as_ref()
-            .map(|fact| abnormal_error_observation_key(&agent, fact, size));
+            .map(|fact| abnormal_error_observation_key(&agent, fact));
         let error_observation_cohort = fact.as_ref().map(|_| abnormal_error_cohort_key(&agent));
         let error_recency = abnormal_error_recency(
             &snapshot,
@@ -116,7 +116,6 @@ pub(crate) fn detect_abnormal_exits(
             fact.as_ref(),
             error_recency,
             error_observation_key.as_deref(),
-            size,
         );
         upsert_abnormal_watch(
             state,
@@ -155,7 +154,7 @@ pub(crate) fn detect_abnormal_exits(
         let fact = match (decision, fact) {
             (AbnormalExitDecision::Notify, Some(fact)) => fact,
             (AbnormalExitDecision::Suppress(reason), _) => {
-                let suppress_key = abnormal_suppression_key(&agent, &liveness, reason, size);
+                let suppress_key = abnormal_suppression_key(&agent, &liveness, reason);
                 if abnormal_last_suppressed_key(state, &agent.agent_id).as_deref()
                     != Some(suppress_key.as_str())
                 {
@@ -167,7 +166,7 @@ pub(crate) fn detect_abnormal_exits(
             (AbnormalExitDecision::NoSignal, _) => continue,
             (AbnormalExitDecision::Notify, None) => continue,
         };
-        let dedupe_key = abnormal_dedupe_key(&agent, &fact, size);
+        let dedupe_key = abnormal_dedupe_key(&agent, &fact);
         if abnormal_last_notified_key(state, &agent.agent_id).as_deref()
             == Some(dedupe_key.as_str())
         {
@@ -555,7 +554,7 @@ fn agent_process_liveness(
     if let Some(command) = agent.current_command.as_deref() {
         return command_process_check_with_marker(agent, transport, command);
     }
-    if let Some(pane_id) = agent.pane_id.as_deref() {
+    if agent.pane_id.is_some() {
         // Even without pane current_command / matching target, try the
         // marker probe directly — the wrapper's printf leaves the marker
         // in the pane's capture tail whether or not the transport
@@ -1135,16 +1134,13 @@ fn write_abnormal_suppressed(
     Ok(())
 }
 
-fn abnormal_dedupe_key(
-    agent: &AbnormalWatchAgent,
-    fact: &crate::provider::FaultFact,
-    size: u64,
-) -> String {
+fn abnormal_dedupe_key(agent: &AbnormalWatchAgent, fact: &crate::provider::FaultFact) -> String {
     let bucket = fact
         .turn_id
         .as_ref()
         .map(|id| id.as_str().to_string())
-        .unwrap_or_else(|| size.to_string());
+        .or_else(|| abnormal_error_fact_identity(fact))
+        .unwrap_or_else(|| "no_error_identity".to_string());
     format!(
         "worker.abnormal_exit:{}:{}:{}:{}",
         agent.agent_id,
@@ -1174,9 +1170,9 @@ fn abnormal_error_cohort_key(agent: &AbnormalWatchAgent) -> String {
 fn abnormal_error_observation_key(
     agent: &AbnormalWatchAgent,
     fact: &crate::provider::FaultFact,
-    size: u64,
 ) -> String {
-    let bucket = abnormal_error_fact_identity(fact).unwrap_or_else(|| size.to_string());
+    let bucket =
+        abnormal_error_fact_identity(fact).unwrap_or_else(|| "no_error_identity".to_string());
     format!(
         "worker.abnormal_exit.error:{}:{}:{}:{}",
         agent.agent_id,
@@ -1217,15 +1213,13 @@ fn abnormal_suppression_key(
     agent: &AbnormalWatchAgent,
     liveness: &ProcessCheck,
     reason: &str,
-    size: u64,
 ) -> String {
     format!(
-        "abnormal_exit.single_signal_suppressed:{}:{}:{}:{}:{}",
+        "abnormal_exit.single_signal_suppressed:{}:{}:{}:{}",
         agent.agent_id,
         agent.rollout_path_display,
         reason,
-        process_liveness_wire(liveness.state),
-        size
+        process_liveness_wire(liveness.state)
     )
 }
 
@@ -1235,17 +1229,15 @@ fn abnormal_check_key(
     fact: Option<&crate::provider::FaultFact>,
     error_recency: ErrorRecency,
     error_observation_key: Option<&str>,
-    size: u64,
 ) -> String {
     format!(
-        "worker.abnormal_exit.check:{}:{}:{}:{}:{}:{}:{}",
+        "worker.abnormal_exit.check:{}:{}:{}:{}:{}:{}",
         agent.agent_id,
         agent.rollout_path_display,
         process_liveness_wire(liveness.state),
         fact.map(|fact| fact.signature.as_str()).unwrap_or("-"),
         error_recency.as_str(),
-        error_observation_key.unwrap_or("-"),
-        size
+        error_observation_key.unwrap_or("-")
     )
 }
 
@@ -2526,7 +2518,7 @@ mod tests {
             "{\"method\":\"turn/completed\",\"params\":{\"turn\":{\"id\":\"t1\",\"status\":\"failed\"}}}\n",
         )
         .unwrap();
-        let observation_key = abnormal_error_observation_key(&agent, &fact, 99);
+        let observation_key = abnormal_error_observation_key(&agent, &fact);
         let state = serde_json::json!({
             "coordinator": {
                 "abnormal_exit_watch": {

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -113,6 +113,23 @@ pub(crate) fn start_agent_at_paths(
     let window = agent_window(&agent, agent_id);
     let adaptive_layout =
         open_display && crate::lifecycle::launch::state_uses_adaptive_layout(&state);
+    let fake_provider = raw_agent
+        .get("provider")
+        .and_then(serde_json::Value::as_str)
+        .is_some_and(|provider| provider.eq_ignore_ascii_case("fake"));
+    if force && !fake_provider && is_per_agent_window(&window, agent_id) {
+        let expected_pane_id = raw_agent
+            .get("pane_id")
+            .and_then(serde_json::Value::as_str)
+            .filter(|value| !value.is_empty());
+        let target =
+            SameRoleCohortTarget::new(agent_id, &window).with_expected_pane_id(expected_pane_id);
+        if let Some(error) =
+            same_role_cohort_pre_spawn_error(transport, &session_name, "start-agent", &[target])
+        {
+            return Err(LifecycleError::RequirementUnmet(error));
+        }
+    }
     let agent_live = if adaptive_layout {
         agent_pane_live(transport, &raw_agent)
     } else {
@@ -640,7 +657,7 @@ fn list_same_role_panes(
 /// caller falls back to safer behavior (refuse stop, surface
 /// RequirementUnmet/transport error) when this returns false.
 fn is_per_agent_window(window: &str, agent_id: &AgentId) -> bool {
-    window == agent_id.as_str() && !crate::lifecycle::launch::is_adaptive_layout_window_pub(window)
+    is_per_agent_cohort_window(window, agent_id)
 }
 
 fn tmux_start_mode_for_spawn(
@@ -1264,6 +1281,10 @@ fn reset_agent_at_paths(
         .filter(|p| !p.is_empty())
         .map(crate::transport::PaneId::new);
     let old_pane_pid_before = state_pane_pid(&state_before_stop, agent_id);
+    let old_pane_live_before = old_pane_id_before
+        .as_ref()
+        .map(|pane| agent_pane_live_by_id(transport, pane))
+        .unwrap_or(false);
     // CR C-2: take ONE pre-stop snapshot of the team session's panes so
     // the gate below can compute "what survived stop" by set difference,
     // not "what panes exist at all" (which would refuse legitimate
@@ -1286,7 +1307,18 @@ fn reset_agent_at_paths(
         if let Some(session) = pre_stop_session.as_ref() {
             if is_per_agent_window(&pre_stop_window, agent_id) {
                 list_same_role_panes(transport, session, &pre_stop_window)
-                    .iter()
+                    .into_iter()
+                    .filter(|pane| {
+                        if !old_pane_live_before {
+                            return true;
+                        }
+                        let same_old_pane = old_pane_id_before
+                            .as_ref()
+                            .is_some_and(|old| pane.pane_id.as_str() == old.as_str());
+                        let same_old_pid = old_pane_pid_before
+                            .is_some_and(|old_pid| pane.pane_pid == Some(old_pid));
+                        same_old_pane || same_old_pid
+                    })
                     .map(|p| p.pane_id.as_str().to_string())
                     .collect()
             } else {
@@ -1327,17 +1359,12 @@ fn reset_agent_at_paths(
     // CR C-5: gate is reset-specific; standalone stop-agent path keeps
     // existing "already absent is ok" behavior.
     //
-    // Gate scope refinement: when stop.stopped == true, the kill_pane
-    // call already succeeded (and drain_old_pane_and_pid polled for
-    // the pane to become unreachable). Treat that as the authoritative
-    // signal — running the gate again post-stop introduces a race
-    // window where tmux's has_pane lag can spuriously report Live.
-    // Only gate the dangerous case: stop reported stopped == false
-    // (state's stale pane_id pointed at nothing kill-able), which is
-    // exactly the duplicate-window bug pattern from the macmini
-    // evidence: `stop_agent.complete stopped=false` followed by an
-    // unconditional `start_agent.agent_start`.
-    if !agent_is_paused && !stop.stopped {
+    // P0 cohort proof: every non-paused reset takes a post-stop
+    // same-role snapshot. Refuse only on tmux-visible residue; a
+    // standalone old-pane liveness probe can be stale in mocks and
+    // must not mask the later spawn ownership/window-disappeared
+    // verifier.
+    if !agent_is_paused {
         let spec_for_gate = load_team_spec(spec_workspace)?;
         let gate_state = resolve_team_scoped_state_or_refuse(workspace, team)?;
         let session_name_gate = state_session_name_from_spec(&gate_state, &spec_for_gate);
@@ -1349,10 +1376,6 @@ fn reset_agent_at_paths(
             .filter(|s| !s.is_empty())
             .unwrap_or_else(|| agent_id.as_str())
             .to_string();
-        let old_pane_still_live = old_pane_id_before
-            .as_ref()
-            .map(|p| agent_pane_live_by_id(transport, p))
-            .unwrap_or(false);
         // Take a SECOND snapshot post-stop and compute the differential.
         // Only panes present in BOTH snapshots are residue (stop did not
         // remove them).
@@ -1366,16 +1389,10 @@ fn reset_agent_at_paths(
             .into_iter()
             .filter(|p| pre_stop_pane_ids.contains(p.pane_id.as_str()))
             .collect();
-        // Pid-alone aliveness is secondary evidence and noisy under fixtures
-        // (synthetic pids may by chance be live on the test machine). Block
-        // ONLY on tmux-visible residue: old pane still live OR same-role
-        // panes survived stop. The pid is still recorded in the event for
-        // diagnostics.
-        let old_pid_still_live = old_pane_pid_before
-            .filter(|_| old_pane_still_live)
-            .map(|pid| pid_is_alive(pid))
-            .unwrap_or(false);
-        if old_pane_still_live || !remaining_panes.is_empty() {
+        // Pid-alone aliveness is secondary evidence and noisy under
+        // fixtures. Block only on tmux-visible same-role residue; record
+        // the old pid in the event for diagnostics.
+        if !remaining_panes.is_empty() {
             let remaining_pane_ids: Vec<String> = remaining_panes
                 .iter()
                 .map(|p| p.pane_id.as_str().to_string())
@@ -1454,6 +1471,8 @@ fn reset_agent_at_paths(
     )?;
     let started = matches!(start, StartAgentOutcome::Running { .. });
     write_reset_complete_event(workspace, agent_id, stop.stopped, started)?;
+    let (capture_state, reset_proof, weak_reset_warning) =
+        reset_capture_proof(workspace, agent_id, discarded_session_id.as_ref());
     match start {
         StartAgentOutcome::Running {
             env,
@@ -1476,6 +1495,9 @@ fn reset_agent_at_paths(
                 discarded_session_id,
                 session_id: output_session_id,
                 new_session_id,
+                capture_state,
+                reset_proof,
+                weak_reset_warning,
             })
         }
         StartAgentOutcome::Noop { env, .. } => Ok(ResetAgentOutcome::Reset {
@@ -1484,6 +1506,9 @@ fn reset_agent_at_paths(
             discarded_session_id,
             session_id: None,
             new_session_id: None,
+            capture_state,
+            reset_proof,
+            weak_reset_warning,
         }),
         StartAgentOutcome::Paused { .. } => Ok(ResetAgentOutcome::Reset {
             env: AgentActionEnvelope {
@@ -1495,10 +1520,61 @@ fn reset_agent_at_paths(
             discarded_session_id,
             session_id: None,
             new_session_id: None,
+            capture_state,
+            reset_proof,
+            weak_reset_warning,
         }),
     }
 }
 
+fn reset_capture_proof(
+    workspace: &Path,
+    agent_id: &AgentId,
+    discarded_session_id: Option<&SessionId>,
+) -> (String, String, Option<String>) {
+    let state = crate::state::persist::load_runtime_state(workspace)
+        .unwrap_or_else(|_| serde_json::json!({}));
+    let agent = state
+        .get("agents")
+        .and_then(|agents| agents.get(agent_id.as_str()));
+    let capture_state = agent
+        .and_then(|agent| agent.get("capture_state"))
+        .and_then(serde_json::Value::as_str)
+        .filter(|value| !value.is_empty())
+        .or_else(|| {
+            agent
+                .and_then(|agent| agent.get("attribution_ambiguous"))
+                .and_then(serde_json::Value::as_bool)
+                .filter(|ambiguous| *ambiguous)
+                .map(|_| "attribution_ambiguous")
+        })
+        .or_else(|| {
+            let has_session = agent
+                .and_then(|agent| agent.get("session_id"))
+                .and_then(serde_json::Value::as_str)
+                .is_some_and(|value| !value.is_empty());
+            let has_rollout = agent
+                .and_then(|agent| agent.get("rollout_path"))
+                .and_then(serde_json::Value::as_str)
+                .is_some_and(|value| !value.is_empty());
+            (has_session && has_rollout).then_some("captured")
+        })
+        .unwrap_or("transcript_missing")
+        .to_string();
+    let weak = discarded_session_id.is_none()
+        || matches!(
+            capture_state.as_str(),
+            "transcript_missing" | "attribution_ambiguous"
+        );
+    let reset_proof = if weak { "weak" } else { "strong" }.to_string();
+    let weak_reset_warning = weak.then(|| {
+        format!(
+            "weak reset proof: capture_state={capture_state}; lifecycle restarted but attribution did not prove a fresh transcript"
+        )
+    });
+    (capture_state, reset_proof, weak_reset_warning)
+}
+
 #[allow(clippy::too_many_arguments)]
 fn write_start_agent_start_event(
     workspace: &Path,

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -14,6 +14,142 @@ pub(super) struct SpawnedAgentWindow {
     pub owner_team_id: Option<String>,
 }
 
+#[derive(Clone)]
+pub(super) struct SameRoleCohortTarget {
+    pub agent_id: String,
+    pub window: String,
+    pub expected_pane_id: Option<String>,
+}
+
+impl SameRoleCohortTarget {
+    pub(super) fn new(agent_id: &AgentId, window: &str) -> Self {
+        Self {
+            agent_id: agent_id.as_str().to_string(),
+            window: window.to_string(),
+            expected_pane_id: None,
+        }
+    }
+
+    pub(super) fn with_expected_pane_id(mut self, pane_id: Option<&str>) -> Self {
+        self.expected_pane_id = pane_id.map(ToString::to_string);
+        self
+    }
+}
+
+pub(super) fn is_per_agent_cohort_window(window: &str, agent_id: &AgentId) -> bool {
+    window == agent_id.as_str() && !crate::lifecycle::launch::is_adaptive_layout_window_pub(window)
+}
+
+pub(super) fn same_role_cohort_pre_spawn_error(
+    transport: &dyn crate::transport::Transport,
+    session_name: &SessionName,
+    operation: &str,
+    targets: &[SameRoleCohortTarget],
+) -> Option<String> {
+    same_role_cohort_error(transport, session_name, operation, targets, 0, true)
+}
+
+pub(super) fn same_role_cohort_exactly_one_error(
+    transport: &dyn crate::transport::Transport,
+    session_name: &SessionName,
+    operation: &str,
+    targets: &[SameRoleCohortTarget],
+) -> Option<String> {
+    same_role_cohort_error(transport, session_name, operation, targets, 1, false)
+}
+
+pub(super) fn retire_expected_same_role_cohorts(
+    transport: &dyn crate::transport::Transport,
+    operation: &str,
+    targets: &[SameRoleCohortTarget],
+) -> Result<(), String> {
+    for target in targets {
+        let Some(pane_id) = target.expected_pane_id.as_deref() else {
+            continue;
+        };
+        let pane = crate::transport::PaneId::new(pane_id);
+        if transport.has_pane(&pane).ok().flatten() == Some(false) {
+            continue;
+        }
+        transport.kill_pane(&pane).map_err(|error| {
+            format!(
+                "{operation} failed to retire old same-role cohort {}:window={}:pane={pane_id}: {error}",
+                target.agent_id, target.window
+            )
+        })?;
+    }
+    Ok(())
+}
+
+fn same_role_cohort_error(
+    transport: &dyn crate::transport::Transport,
+    session_name: &SessionName,
+    operation: &str,
+    targets: &[SameRoleCohortTarget],
+    expected_live: usize,
+    expected_old_only: bool,
+) -> Option<String> {
+    let panes = transport.list_targets().ok()?;
+    let mut cardinality_proofs = Vec::new();
+    let mut binding_proofs = Vec::new();
+    for target in targets {
+        let live_panes = panes
+            .iter()
+            .filter(|pane| pane.session.as_str() == session_name.as_str())
+            .filter(|pane| {
+                pane.window_name
+                    .as_ref()
+                    .is_some_and(|window| window.as_str() == target.window)
+            })
+            .filter(|pane| {
+                !expected_old_only
+                    || target
+                        .expected_pane_id
+                        .as_deref()
+                        .is_some_and(|expected| pane.pane_id.as_str() == expected)
+            })
+            .filter(|pane| {
+                transport
+                    .liveness(&pane.pane_id)
+                    .is_ok_and(|live| live == crate::transport::PaneLiveness::Live)
+            })
+            .map(|pane| pane.pane_id.as_str().to_string())
+            .collect::<Vec<_>>();
+        if live_panes.len() != expected_live {
+            cardinality_proofs.push(format!(
+                "{}:window={}:live_panes=[{}]",
+                target.agent_id,
+                target.window,
+                live_panes.join(",")
+            ));
+        } else if !expected_old_only {
+            let observed = live_panes.first().map(String::as_str);
+            if target.expected_pane_id.as_deref() != observed {
+                binding_proofs.push(format!(
+                    "{}:window={}:expected_pane={}:observed_pane={}",
+                    target.agent_id,
+                    target.window,
+                    target.expected_pane_id.as_deref().unwrap_or("<missing>"),
+                    observed.unwrap_or("<missing>")
+                ));
+            }
+        }
+    }
+    if !binding_proofs.is_empty() {
+        return Some(format!(
+            "{operation} refused: spawn identity/binding mismatch; {}",
+            binding_proofs.join("; ")
+        ));
+    }
+    if !cardinality_proofs.is_empty() {
+        return Some(format!(
+            "{operation} refused: same-role cohort duplicate proof failed; {}",
+            cardinality_proofs.join("; ")
+        ));
+    }
+    None
+}
+
 #[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_agent_window(
     workspace: &Path,