Inspect committed workspace files

docs/cli.md

@@ -39,8 +39,11 @@ show the selected target. When `validation.go_format` is true, `check` examines
 regular committed Go files with the Go formatter after tests, vet, and package
 compilation. It includes vendor and nested-module source, ignores the worktree
 and symlink blobs, and reports unformatted paths as `go-format` without
-modifying files. Any artifact build selected by the separate `build`
-setting runs after shared validation and configured checks.
+modifying files. When `validation.module_distribution.workspace_files` is true,
+`check` reports committed `go.work` and `go.work.sum` blobs, including nested
+and symlink entries, as `workspace-files`. This inspection is independent of
+`GOWORK` and ignores uncommitted files. Any artifact build selected by the
+separate `build` setting runs after shared validation and configured checks.
 
 `check` writes errors and diagnostics to standard error. It returns status 0
 after local validation, 1 after a candidate validation failure, and 2 for usage,
@@ -60,8 +63,9 @@ settings as `check`. It checks the authoritative remote and validates the
 candidate: the single standard offline Go test suite runs first, with `-race`
 when `validation.go.race` is true. When `validation.go.full_vet` is true,
 test-time vet is disabled and `go vet -mod=readonly ./...` runs after successful
-tests. Selected package compilation and committed Go formatting follow, then
-configured checks run in profile order. It then creates an annotated local tag
+tests. Selected package compilation and committed Go formatting follow. The
+selected workspace-file check then runs, followed by configured checks in
+profile order. It then creates an annotated local tag
 and pushes only its exact tag object. It prints the confirmed version,
 candidate commit, and tag object
 on success. Validation
@@ -77,8 +81,9 @@ after tests and full vet and before configured checks. Each failure is reported
 as `package-compile` with its selected target; this does not create build
 artifacts or execute target binaries. When `validation.go_format` is true,
 committed Go formatting runs after package compilation and before configured
-checks. A failure is reported as `go-format` with affected repository paths;
-parser and source-inspection causes are retained.
+checks. The selected workspace-file check then reports committed go.work and
+go.work.sum paths as `workspace-files`. Formatting failures are reported as
+`go-format` with affected paths and preserve parser or source-inspection causes.
 
 The optional profile field `expected_push_url` applies only to `publish`. A
 nonempty value must exactly match the effective push URL resolved by Git;

docs/config.md

@@ -45,6 +45,12 @@ symlink blobs and the worktree, and reports every selected path whose bytes
 change under formatting. It never writes formatted bytes back. Omitted or false
 disables the check. It runs after tests, selected full vet, and selected package
 compilation, before configured product checks.
+
+When `validation.module_distribution.workspace_files` is true, it reports
+committed blob entries whose basename is `go.work` or `go.work.sum`, including
+nested paths and symlinks. It checks candidate distribution contents regardless
+of `GOWORK`; it does not select or change the workspace used by Go commands,
+and it does not alter existing vendor behavior. Omitted or false disables it.
 For example:
 
 ```json
@@ -56,7 +62,10 @@ For example:
       "full_vet": true,
       "compile_targets": ["linux/amd64", "linux/arm64"]
     },
-    "go_format": true
+    "go_format": true,
+    "module_distribution": {
+      "workspace_files": true
+    }
   }
 }
 ```
@@ -84,10 +93,14 @@ run native `go vet -mod=readonly ./...` after successful tests. They then run
 `validation.go.compile_targets` entry, in profile order. Compile failures use
 the `package-compile` identity and include the selected target. When selected,
 `validation.go_format` checks regular committed Go source with go/format after
-package compilation; unformatted paths use the `go-format` identity. Configured
-`checks` commands run afterward, once each in order, as additional product
-checks. Artifact builds selected by the separate `build` setting run after
-shared validation and product checks.
+package compilation; unformatted paths use the `go-format` identity. When
+`validation.module_distribution.workspace_files` is true, shared validation
+also reports committed go.work and go.work.sum blobs after Go formatting, using
+the workspace-files identity. Uncommitted workspace files are not inspected.
+Configured `checks` commands run afterward, once each in order, as additional
+product checks. Artifact builds selected by the separate `build` setting run
+after shared validation and product checks.
+
 Do not repeat the standard suite or vet in `checks`; doing so repeats work. The
 `build` command uses the selected build settings and writes binaries to `dist` unless
 `--output` selects another path.

docs/consumers/check.md

@@ -41,6 +41,12 @@ formatter built into ReleaseKit. It includes vendor and nested-module source,
 ignores symlink blobs and worktree changes, and reports unformatted paths as
 `go-format` without rewriting files. Its zero value disables the check; it runs
 after tests, selected vet, and package compilation, before `AdditionalChecks`.
+
+Set `Validation.ModuleDistribution.WorkspaceFiles` to reject committed
+`go.work` and `go.work.sum` blobs, including nested and symlink entries. It
+examines the captured candidate even when `GOWORK=off`, ignores uncommitted
+files, and does not change Go test workspace selection or vendor behavior. The
+zero value disables the check; failures use `workspace-files`.
 ReleaseKit calls `AdditionalChecks` once after shared validation when supplied.
 It does not download a different toolchain automatically. If race prerequisites
 are unavailable, the `go-test` check fails rather than being skipped; a selected

docs/consumers/publish.md

@@ -55,6 +55,13 @@ worktree changes and symlink blobs, and reports unformatted paths as
 tests, selected vet, and package compilation, and a failure stops publication
 before product checks or tag creation.
 
+Set `Validation.ModuleDistribution.WorkspaceFiles` to reject committed
+`go.work` and `go.work.sum` blobs, including nested paths and symlink entries.
+The rule reads the captured candidate regardless of `GOWORK`; uncommitted files
+are ignored, and Go workspace selection and vendor behavior are unchanged. Its
+zero value disables the check. Findings use `workspace-files` and stop
+publication before product checks or tag creation.
+
 If `Build` selects targets, ReleaseKit verifies them after the standard suite
 and additional checks, before creating the tag. The operation then rechecks the
 candidate and remote guards, creates an annotated tag for the captured commit,

docs/internal/validation.md

@@ -25,6 +25,11 @@ symlink blobs, reports all unformatted paths, and stops with a contextual cause
 on parse or inspection errors. It runs before product checks and build callbacks.
 `Request.ReadCandidateTree` lets selected file checks request candidate
 contents; the Go-only path does not enumerate the tree.
+
+The workspace-file check uses that same candidate inventory and reports blob
+entries named go.work or go.work.sum, including nested paths and symlink blobs.
+It does not read workspace contents or depend on the workspace selected for Go
+commands.
 `CandidateTree` gets metadata and bytes from Git objects, reads blob bytes
 lazily, and resolves destinations without consulting the worktree or
 neighboring files.

docs/roadmap/implementation.md

@@ -337,6 +337,12 @@ behavior, API/profile parity, and failure before later product/build work.
 
 ## Stage 6: Select committed workspace-file inspection
 
+**Completion:** Complete. `Validation.ModuleDistribution.WorkspaceFiles` and
+`validation.module_distribution.workspace_files` report committed blob entries
+named `go.work` or `go.work.sum`, including nested paths and symlinks. The rule
+inspects the captured candidate independently of `GOWORK` and leaves the Go
+workspace environment and vendor behavior unchanged.
+
 **Outcome:** One distribution rule works independently of the Go environment.
 
 1. Add `ModuleDistributionValidationSpec.WorkspaceFiles` and the matching JSON