diagnose-workspacelisted

# Diagnose Workspace Perform a deterministic, read-only health check. Diagnose structure and traceability; do not judge business conclusions or turn cleanup into another framework. ## Establish Scope 1. Resolve the exact Personal Workspace root, adjacent Case roots, `.local/inbox/<workspace-id>/`, and any protected production or delivery areas the user named. 2. Treat protected areas as read-only or excluded exactly as requested. Do not follow old host links into a protected tree just to make the audit “complete.” 3. Do not read Secret values. Report only the presence and location of `.env`, credentials, tokens, cookies, or other likely Secret files when they cross a boundary. ## Deterministic Checks Run the smallest checks that apply: 1. **Workspace identity** — Git root, `workspace.yaml`, v0.2 empty `spec`, current status, and unexpected nested repositories. 2. **Active closure** — each `skills/*/SKILL.md` and `workflows/*/SKILL.md + workflow.yaml` loads; names match directories; completion standards are nonempty; Workflow Skills and Artifact paths resolve. 3. **Lifecycle boundary** — Candidates are not in `skills/`; Trials are not silently adopted; Case inputs, screenshots, generated Artifacts, Run folders, caches, dependency directories, or final deliverables have not leaked into the reusable Workspace. 4. **Source identity** — externally derived Skills have `SOURCE.md` with repository or URL, source path, commit/version, license status, relation, and local changes.