Inspect committed workspace files

docs/consumers/check.md

@@ -41,6 +41,12 @@ formatter built into ReleaseKit. It includes vendor and nested-module source,
 ignores symlink blobs and worktree changes, and reports unformatted paths as
 `go-format` without rewriting files. Its zero value disables the check; it runs
 after tests, selected vet, and package compilation, before `AdditionalChecks`.
+
+Set `Validation.ModuleDistribution.WorkspaceFiles` to reject committed
+`go.work` and `go.work.sum` blobs, including nested and symlink entries. It
+examines the captured candidate even when `GOWORK=off`, ignores uncommitted
+files, and does not change Go test workspace selection or vendor behavior. The
+zero value disables the check; failures use `workspace-files`.
 ReleaseKit calls `AdditionalChecks` once after shared validation when supplied.
 It does not download a different toolchain automatically. If race prerequisites
 are unavailable, the `go-test` check fails rather than being skipped; a selected

docs/consumers/publish.md

@@ -55,6 +55,13 @@ worktree changes and symlink blobs, and reports unformatted paths as
 tests, selected vet, and package compilation, and a failure stops publication
 before product checks or tag creation.
 
+Set `Validation.ModuleDistribution.WorkspaceFiles` to reject committed
+`go.work` and `go.work.sum` blobs, including nested paths and symlink entries.
+The rule reads the captured candidate regardless of `GOWORK`; uncommitted files
+are ignored, and Go workspace selection and vendor behavior are unchanged. Its
+zero value disables the check. Findings use `workspace-files` and stop
+publication before product checks or tag creation.
+
 If `Build` selects targets, ReleaseKit verifies them after the standard suite
 and additional checks, before creating the tag. The operation then rechecks the
 candidate and remote guards, creates an annotated tag for the captured commit,