Workspace versioning
An audit row recorded on every workspace apply, plus a hash stamped on every run, so any agent output traces back to the exact files that produced it.
Last verified
Workspace versioning is the practice of recording, on every change to an agent's configuration and on every run that configuration produces, exactly which version was in effect — so an output can be traced back to the prompts, skills, and rules that generated it.
What gets recorded
Every workspace:apply writes a row to workspace_version with the git SHA,
the timestamp, which files changed, per-resource counts, and who applied it.
Every tool_call — the record of a single agent action — is stamped with a
workspace_sha at the moment it ran.
Why it matters in production
"Why did the agent draft the email like that" is a question every team running agents eventually has to answer, usually after the fact and usually under pressure. Without a version stamped on the run itself, the answer depends on remembering what the prompts looked like at the time — which nobody does reliably six months later.
How Vocion implements it
Documented in docs/workspace.md's
"Audit trail" section: a workspace_sha is either a clean git SHA, a
<sha>-dirty-<hash> if the apply ran with uncommitted changes, local-<hash>
outside a git repo, or any of those with a +core@<version> suffix when a
base pack is pinned. Looking up a tool_call row by id gives the SHA, and
git show <workspace_sha> in the workspace's own repo reproduces the exact
files active when the call ran.