Preserve workspace paths with spaces during provenance refresh #550

Defect

The provenance rewriter silently clears a workspace containing a space:

# acq.backends/common.sh:2029-2032
case "$workspace" in
  "") : ;;
  *[!A-Za-z0-9._/-]*) workspace="" ;;
esac

The rejecting pattern is at acq.backends/common.sh:2031. This disagrees with acq_workspace_record_write, which accepts an existing directory after rejecting only CR and LF at acq.backends/common.sh:2073-2084.

Impact

Creating a sandbox from an ordinary workspace path containing a space records the path successfully. A later provenance refresh reads that host-marked workspace at acq.backends/common.sh:2014-2016, rejects it, and atomically rewrites the record without workspace_source or workspace.

Subsequent name-only operations can no longer recover the sandbox's host workspace. This breaks behavior such as GitHub repository scoping and project-environment guidance for those sandboxes.

Reproduction

The probe below extracts and executes the released source directly from commit af9814d802cf798850c56c4d8715e9bb376802f9:

scratch=$(mktemp -d "${TMPDIR:-/tmp}/paseo-review-main.XXXXXX")
git archive af9814d802cf798850c56c4d8715e9bb376802f9 | tar -x -C "$scratch"
mkdir -p "$scratch/probe/work space"
SCRATCH="$scratch" bash -c '
  . "$SCRATCH/acq.backends/common.sh"
  export ACQ_PROVENANCE_DIR="$SCRATCH/probe/provenance-space"
  acq_workspace_record_write sbx spaced "$SCRATCH/probe/work space"
  write_rc=$?
  before=$(acq_workspace_record_read sbx spaced)
  acq_provenance_write sbx spaced
  refresh_rc=$?
  after=$(acq_workspace_record_read sbx spaced)
  source=$(acq_provenance_field sbx spaced workspace_source)
  printf "write_rc=%s before=<%s> refresh_rc=%s after=<%s> source=<%s>\n" \
    "$write_rc" "$before" "$refresh_rc" "$after" "$source"
'

Observed output:

write_rc=0 before=</tmp/paseo-review-main.bmYb2z/probe/work space> refresh_rc=0 after=<> source=<>

Both writes report success, but the refresh silently deletes the previously accepted workspace value and its source marker.

Severity

Major and live today for users whose workspace path contains a space. No future provider artifact or configuration change is required to trigger it.

Fix requirement

Make the provenance writer and workspace writer use the same accepted value contract. Preserve valid existing host paths containing spaces while continuing to reject record-breaking characters such as CR and LF. Add a regression test that records a real directory containing a space, refreshes provenance, and verifies the workspace and workspace_source=host survive.

This defect shipped in v4.0.0, published at 2026-10-06 00:44:00Z, with target commit af9814d802cf798850c56c4d8715e9bb376802f9.