Make workspace status CI-actionable

DEVELOPER_GUIDE.md

@@ -225,7 +225,9 @@ ownership boundaries so behavior changes remain reviewable and testable.
 
 ### Workspaces
 
-`cdidx.workspace.json` and `.cdidx-workspace.json` declare monorepo members without adding a YAML dependency. Workspace manifests are capped at 64 KiB, 16 JSON nesting levels, 1024 members, 4096 characters per member path, and 255 characters for `default_db_name`. The supported schema is additive: `members` is an array of member paths that must be relative to and resolve under the manifest directory, `index_strategy` is `per_member` or `single` with unknown values rejected, `default_db_name` is a plain file name that overrides `codeindex.db`, and `shared_ignores` is reserved for shared ignore policy. Invalid `members` entries are rejected with bounded diagnostics, and valid entries are normalized and deduplicated with the workspace path casing policy before DB paths are materialized. `cdidx workspace list` and `cdidx workspace status` report member DB paths. `workspace status` also reports each member's database existence, probe status and reason, schema compatibility, exact workspace freshness, timestamps, index completeness, and graph readiness. It probes at most 64 distinct existing member databases per invocation, reuses a probe when members share a database under the `single` strategy, and marks later members as `not_checked` with a top-level truncation summary. In JSON mode, invalid manifest schema or safety failures are returned as a structured `workspace_manifest_invalid` error instead of falling through to the top-level crash handler.
+`cdidx.workspace.json` and `.cdidx-workspace.json` declare monorepo members without adding a YAML dependency. Workspace manifests are capped at 64 KiB, 16 JSON nesting levels, 1024 members, 4096 characters per member path, and 255 characters for `default_db_name`. The supported schema is additive: `members` is an array of member paths that must be relative to and resolve under the manifest directory, `index_strategy` is `per_member` or `single` with unknown values rejected, `default_db_name` is a plain file name that overrides `codeindex.db`, and `shared_ignores` is reserved for shared ignore policy. Invalid `members` entries are rejected with bounded diagnostics, and valid entries are normalized and deduplicated with the workspace path casing policy before DB paths are materialized. `cdidx workspace list` and `cdidx workspace status` report member DB paths. `workspace status` also reports each member's project-directory and database existence as the unambiguous sibling fields `project_exists` and `db_exists`; the older `exists` field remains a compatibility alias for `project_exists`. Per-member `index_health` reports probe status and stable reason, a structured `repair_action`, schema compatibility, exact workspace freshness, timestamps, index completeness, and graph readiness. It probes at most 64 distinct existing member databases per invocation, reuses a probe when members share a database under the `single` strategy, and marks later members as `not_checked` with a top-level truncation summary.
+
+`member_health_summary` aggregates healthy, degraded, and missing members, reports the exit code that enforcement would use, and deduplicates recommended action codes. `cdidx workspace status --check` returns success `0` only when every required member is `ready`; it returns not-found `2` when the manifest is missing, the manifest has no members, or any required project/database is missing, and stale-index `5` for every other degraded aggregate (including stale, incomplete, incompatible, invalid, unavailable, or probe-limit-skipped members). Missing takes precedence over degraded in a mixed workspace. Without `--check`, `workspace status` remains informational and returns `0` after a successful report. Invalid manifest schema or safety failures remain usage exit `1` and, in JSON mode, are returned as a structured `workspace_manifest_invalid` error instead of falling through to the top-level crash handler. Repair commands are emitted as `name` plus `args[]`, not shell-quoted strings, so paths remain portable across Windows and POSIX shells.
 
 `cdidx workspace use <name-or-relative-path>` writes an existing manifest member or `default` workspace to the per-user config directory and rejects missing manifest members. A directory name remains a shorthand when it identifies exactly one member; repeated directory names remain ambiguous. A manifest-relative path selects the exact normalized member, accepts either slash spelling, and stores the canonical forward-slash relative path in active workspace state. Manifest-member selections also persist `manifest_member: true`, so members named `default` or `env` remain distinguishable from the reserved non-manifest states. Active workspace names share the manifest member path's 4096-character bound. `cdidx workspace clear` (also available as `workspace deactivate`) removes that persisted selection instead of rebinding `default` to the current directory. When `CDIDX_ACTIVE_WORKSPACE` is set, clear reports that the environment override must be unset because it takes precedence over persisted state. Query DB resolution keeps existing precedence: explicit `--db`, then explicit `--data-dir` / `CDIDX_DATA_DIR`, then active workspace state, then ancestor/CWD discovery.
 
@@ -3572,11 +3574,23 @@ invalid な `members` entries は件数を制限した diagnostics で拒否さ
 `cdidx workspace list` と `cdidx workspace status` は member DB path を報告します。
 `workspace status` はさらに、member ごとの database 存在有無、probe status / reason、
 schema compatibility、workspace との厳密な freshness、timestamp、index completeness、
-graph readiness を報告します。1 回の実行で probe する既存の異なる member database は最大 64 個で、
+graph readiness を報告します。project directory と database の存在有無は sibling field の
+`project_exists` / `db_exists` で明示し、従来の `exists` は `project_exists` の互換 alias として
+維持します。member ごとの `index_health` は安定した reason と構造化 `repair_action` も返します。
+1 回の実行で probe する既存の異なる member database は最大 64 個で、
 `single` strategy で database が共有される場合は probe 結果を再利用し、それ以降の member は
 `not_checked` として top-level の truncation summary に反映します。
-JSON mode では、manifest schema または safety validation の失敗は top-level crash handler へ
-落とさず、構造化された `workspace_manifest_invalid` error として返します。
+`member_health_summary` は healthy / degraded / missing member を集約し、enforcement 時の exit code と
+重複排除した recommended action code を返します。`cdidx workspace status --check` はすべての
+required member が `ready` の場合だけ success `0`、manifest 不在、member 0件、required project /
+database が1件でも missing の場合は not-found `2`、それ以外の degraded aggregate（stale、
+incomplete、incompatible、invalid、unavailable、probe limit による未確認を含む）では
+stale-index `5` を返します。mixed workspace では missing が degraded より優先されます。
+`--check` なしの `workspace status` は informational なままで、report 成功時は `0` です。
+不正な manifest schema / safety validation は従来どおり usage exit `1` で、JSON mode では
+top-level crash handler へ落とさず構造化 `workspace_manifest_invalid` error を返します。
+repair command は shell quoting 済み文字列ではなく `name` と `args[]` で返すため、
+Windows / POSIX shell 間でも path を安全に扱えます。
 
 `cdidx workspace use <name-or-relative-path>` は既存の manifest member または `default` を
 active workspace として per-user config directory に保存し、存在しない member は拒否します。

README.md

@@ -255,6 +255,17 @@ Check-mode JSON includes `query_context.check_mode` (`explicit` or
 `implied_by_stale_after`) and the effective `query_context.stale_after_seconds`;
 ordinary status JSON omits `query_context`.
 
+`cdidx workspace status --json` reports sibling `project_exists` and `db_exists`
+fields for each member; the older `exists` field remains as a compatibility
+alias for `project_exists`. Each `index_health` includes a stable reason and a
+structured `repair_action` (`action` plus optional `command.name` /
+`command.args`), while `member_health_summary` aggregates healthy, degraded,
+and missing counts. `workspace status --check` returns `0` only when every
+required member is ready, `2` for a missing manifest, an empty workspace, or
+any missing required member/database, and `5` for other degraded health.
+Malformed manifests retain usage exit `1`. Ordinary `workspace status` remains
+informational and returns `0` after a successful status report.
+
 Index-generation readiness is derived from persisted evidence and is shared by
 the index command result, immediate `status` / workspace status, and MCP
 responses. `index_complete=false` identifies omitted input or extraction work,
@@ -694,6 +705,17 @@ check mode の JSON は `query_context.check_mode`（`explicit` または
 `implied_by_stale_after`）と有効な `query_context.stale_after_seconds` を含み、
 通常の status JSON では `query_context` を省略します。
 
+`cdidx workspace status --json` は member ごとに sibling field の
+`project_exists` と `db_exists` を返します。従来の `exists` は
+`project_exists` の互換 alias として維持します。各 `index_health` は安定した reason と、
+`action` および任意の `command.name` / `command.args` からなる構造化
+`repair_action` を含み、`member_health_summary` は healthy / degraded / missing
+件数を集約します。`workspace status --check` はすべての required member が ready の
+場合だけ `0`、manifest 不在、空 workspace、required member / database が1件でも
+missing の場合は `2`、その他の degraded health では `5` を返します。
+不正な manifest は従来どおり usage exit `1` です。通常の `workspace status` は
+informational なままで、status report が成功すれば `0` を返します。
+
 index generation の readiness は永続化済みの証拠から導出し、index command の結果、
 直後の `status` / workspace status、MCP response で同じ snapshot を共有します。
 symbols-only run、file size / symbol count / reference count の上限、extractor failure、

TESTING_GUIDE.md

@@ -77,6 +77,8 @@ Use `docs/test-doc-maintenance-plan.md` before moving oversized suites or adding
   Search snippet origin-priority coverage keeps PascalCase, snake_case, and phrase queries in coordinated mixed comment/string/code fixtures so identifier focus, same-line code-column clamping, over-1-MiB valid chunks, final-window dropped counts, filtered-origin refocusing, and the phrase control share one contract.
   Recovery-command coverage keeps resolved execution arguments separate from support-safe display arguments. Assert structured argv, current `dotnet`/apphost prefix preservation, replay of option-like paths under CLI `--show-paths`, default CLI/MCP redaction metadata, and correct quoting for both POSIX sh and PowerShell. Include paths with spaces, quotes, dollar signs, shell metacharacters, POSIX home/temp roots, Windows drives, UNC roots, option-like source names such as `--db`, and file-URI database query parameters containing raw/encoded paths, percent-encoded sensitive keys, or path values with embedded sensitive assignments. Default-output assertions must reject the fixture's full absolute paths and secrets while preserving safe URI controls. Pair this with `status --config` coverage for default DB/data/log path and URI-query redaction, always-redacted secrets, and explicit `--show-paths`.
   Console writer synchronization coverage yields between character writes instead of sleeping per character; use enough whole-line iterations to expose interleaving without adding wall-clock delay.
+- `WorkspaceCommandRunnerTests.cs`
+  Workspace status coverage keeps missing manifests, empty and malformed manifests, missing project directories, all-missing databases, mixed healthy/degraded members, and shared-database layouts independently observable. Assert the compatibility `exists` alias beside unambiguous `project_exists` and `db_exists` fields, structured repair command names and argv (including paths with spaces), human labels, aggregate reasons/actions, and the stable `--check` exit policy: ready `0`, missing `2`, degraded `5`, and invalid input `1`.
 - `SymbolExtractor*Tests.cs` and `ReferenceExtractor*Tests.cs`
   Extractor coverage is split by language or feature area with partial test classes, while shared helpers remain on the root `SymbolExtractorTests` / `ReferenceExtractorTests` parts.
   YAML sequence-hierarchy fixtures must keep sequence items path-only, count empty/scalar/alias items in stable indexes, preserve anchor and block-scalar boundaries, assert logical qualified paths separately from nearest emitted symbol parents, and prove a normal full scan refreshes unchanged YAML rows stamped with the prior extractor contract.
@@ -1009,6 +1011,8 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests"
   search snippet の origin 優先順位 coverage は PascalCase、snake_case、phrase query を連携した comment / string / code 混在 fixture にまとめ、identifier focus、同一行の code 列への clamping、1 MiB を超える有効 chunk、最終 window の dropped count、filter 後 origin への再 focus、phrase の control を一つの contract として検証します。
   recovery command の coverage では、解決済みの実行引数とサポート共有向けの表示引数を分離して検証します。構造化 argv、現在の `dotnet` / apphost prefix の維持、CLI `--show-paths` による option と紛らわしい path の再実行、既定の CLI/MCP redaction metadata、POSIX sh と PowerShell 双方の正しい quoting を確認してください。空白、quote、dollar sign、shell metacharacter、POSIX の home/temp root、Windows drive、UNC root、`--db` のように option と紛らわしい source 名、raw / encoded path、percent-encoded な機密 key、機密 assignment を内包する path 値を持つ file-URI database query parameter を含めます。既定出力に fixture の完全な絶対パスや secret が残らず、安全な URI control は維持されることを assertion にします。`status --config` の DB/data/log path と URI query の既定 redaction、mode に関係なく維持される secret redaction、明示的 `--show-paths` も対で検証してください。
   console writer synchronization coverageは文字writeごとのsleepではなくyieldを使い、wall-clock delayを追加せずinterleavingを露出できる十分なwhole-line iterationを維持してください。
+- `WorkspaceCommandRunnerTests.cs`
+  workspace status の coverage では、manifest 不在、空 / malformed manifest、project directory 不在、全 database 不在、healthy / degraded member の混在、shared-database layout をそれぞれ独立して観測可能にします。曖昧さのない `project_exists` / `db_exists` と互換用 `exists` alias、構造化された修復 command 名と argv（空白を含む path を含む）、human-readable label、集約 reason / action、ならびに ready `0`、missing `2`、degraded `5`、invalid input `1` の安定した `--check` exit policy を検証してください。
 - `SymbolExtractor*Tests.cs` と `ReferenceExtractor*Tests.cs`
   extractor のカバレッジは言語または機能領域ごとの partial test class に分割し、共有 helper は root 側の `SymbolExtractorTests` / `ReferenceExtractorTests` に残します。
   YAML sequence hierarchy の fixture では、sequence item を path 専用のまま保ち、empty / scalar / alias item を安定した index に数え、anchor と block scalar の境界を維持し、論理 qualified path と最寄りの出力済み symbol parent を分けて検証し、旧 extractor contract が stamp された未変更 YAML row を通常の full scan が更新することも確認してください。

changelog.d/unreleased/4885.changed.md

@@ -0,0 +1,21 @@
+---
+category: changed
+issues:
+  - 4885
+affected:
+  - src/CodeIndex/Cli/WorkspaceCommandRunner.cs
+  - src/CodeIndex/Cli/WorkspaceManifest.cs
+  - src/CodeIndex/Cli/ConsoleUi.cs
+  - tests/CodeIndex.Tests/WorkspaceCommandRunnerTests.cs
+  - README.md
+  - DEVELOPER_GUIDE.md
+  - TESTING_GUIDE.md
+---
+
+## English
+
+- **Workspace status is now unambiguous and CI-actionable (#4885)** — member JSON adds sibling `project_exists` / `db_exists` fields while retaining `exists` as a compatibility alias, publishes per-member structured repair actions and an aggregate health summary, and supports `workspace status --check` with stable healthy (`0`), missing (`2`), and degraded (`5`) exit policies.
+
+## 日本語
+
+- **workspace status の存在判定を明確化し、CI で判定可能にしました (#4885)** — member JSON に sibling field の `project_exists` / `db_exists` を追加しつつ `exists` を互換 alias として維持し、member ごとの構造化 repair action と aggregate health summary を公開しました。また、healthy (`0`)、missing (`2`)、degraded (`5`) の安定した終了ポリシーを持つ `workspace status --check` を追加しました。