Allow local bound workspace artifact fallback

[SoundBlaster]

Summary

• Use trusted workspace-scoped file artifacts for a ready binding when no static artifact base is configured.
• Scope candidate approval intent workflow refs to the durable workspace binding.
• Related task: dedicated hosted canary workspace preparation.

Motivation

• A newly initialized local product workspace has a durable binding before its first static bundle exists.
• Approval intent state previously compared bound repaired artifacts with legacy root runs/repaired_* refs, making the lifecycle appear stale in SpecSpace.

Goals

• Keep local initialized workspace UI available through binding-scoped file runs.
• Make approval intent/readiness projections use the same bound run directory as provider and managed operations.
• Preserve legacy root-run behavior for unbound workspaces.
• Out of scope: production routing changes, binding contract changes, or managed execution authority.

Changes

• Select the binding URL only when static artifact routing was explicitly configured.
• Keep local bound runs when the configured root artifact base is an unrelated bootstrap URL; a root base suppresses local fallback only when it matches the binding's sanitized root URL.
• Preserve the sanitized binding root URL in the public routing projection so provider selection can verify that match.
• Bind approval intent session/gate refs in workflow status and wire the binding into approval intent API handlers.
• Add regression coverage for bound approval refs and unrelated bootstrap-base fallback.

Validation

• Tests added/updated for changed behavior
• Local checks passed

Commands run:

.venv/bin/python -m pytest tests/test_specspace_api_v1.py -q
.venv/bin/python -m pytest tests/test_product_workspace_binding.py -q
.venv/bin/python -m unittest \
  tests.test_specspace_api_v1.SpecSpaceApiV1Tests.test_candidate_approval_workflow_status_scopes_refs_to_workspace_binding \
  tests.test_specspace_api_v1.SpecSpaceApiV1Tests.test_idea_to_spec_candidate_approval_intents_v1_posts_repaired_intent -v
.venv/bin/python -m py_compile viewer/specspace_v1_api.py viewer/idea_to_spec_candidate_approval_intents.py
git diff --check

Results:

• Binding/provider suite: 9 passed.
• API suite: 322 passed, 18 subtests passed.
• Browser verification: the dedicated workspace no longer reports repair_session_ref_mismatch; repair is complete and the approval intent is fresh.

Risks / Notes

• Backward compatibility impact: legacy unbound workspaces retain root runs/* refs.
• Migration/config changes required: none.
• Known limitations: static publication remains required for production artifact serving; Git dry-run remains a separate lifecycle blocker.

Checklist

• PR title clearly describes the change
• Scope is focused and minimal
• Documentation updated (or N/A)
• API/artifact/UI-state changes distinguish presence from readiness/status
• Temporary and intermediate paths are scoped to the current run/task where relevant
• No secrets or sensitive data added

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ccd340d62b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".