Workspaces and Validators

API callers choose a workspace name, never an arbitrary root. Configure one-off roots with repeatable -workspace name=directory, or use the strict versioned catalog described in Workspace Catalog.

Built-in Go formatting and JSON syntax validation cannot be disabled. Optional profiles are go-vet, go-test, and yamllint. Global profiles apply to all workspaces; a workspace can append to or replace the global optional list.

Go commands run offline with a sanitized environment, but go-test can execute arbitrary repository code. Use a container or VM security boundary for executable validators near sensitive systems.