[codeforester]

Summary

Extend the advisory Base v1.10 workspace scenario with disposable Git fixtures for the new workspace update safety contract. The scenario now proves that dry-run JSON rejects dirty checkouts, manifest paths nested inside an ancestor checkout, and clean default branches tracking the wrong upstream branch, without changing the checkout. Update the scenario guide and capability matrix to describe the coverage.

Issue

Fixes #327

Validation

• python3 tests/scenarios/workspace.py --base /private/tmp/base-candidate-06715 --base-commit 06715fed19aceff27844aba546ba2a0b4c594ac7 --base-cli /private/tmp/base-cli-8a93 --bash-libs /private/tmp/base-bash-libs-36fec --python /opt/homebrew/bin/python3 --candidate (all scenario groups passed)
• python3 tests/scenario_harness_test.py (2 passed)
• python3 tests/validate_capability_matrix.py (11 rows; passed)
• git diff --check
• Hosted scenarios workflow is required on the stacked train.

Notes

This PR is stacked on documentation PR #336, which is stacked on candidate-pin PR #335. The fixtures are temporary and local; no learner checkout, trust store, or host workspace is modified.

[codeforester]

Reviewed head 1e79b5a against #327 (stacked on #336). No blocking findings. The new workspace update --dry-run --format json fixtures are well built: disposable bare remotes and checkouts, with assertions that HEAD and the dirty file are unchanged. The three preflight cases (dirty, checkout_root_mismatch for a directory inside an ancestor checkout, upstream_mismatch for main tracking origin/feature) match Base's update safety contract. The block sits after the if not args.candidate early exit, so it runs only in the advisory lane, and that lane passed. CI fails only on the undici audit (#334/#338).

Nits: the stable-lane BOUNDARY: message (scenario line ~104) could add workspace-update preflight to its list of candidate-only capabilities. git init --initial-branch and git switch need Git ≥ 2.28, which is fine on hosted runners but worth a line in the scenario guide for local runs.

[codeforester]

Re-verified at 0633a34: both nits addressed ✅. The stable-lane BOUNDARY: line now lists workspace-update preflight safety among candidate-only capabilities, and the scenario guide documents the Git ≥ 2.28 requirement (--initial-branch, git switch). The rebase picked up #338's audit fix. One CI job was still running when I checked. Ready once it's green, after #335 and #336.