v0.2.0 — the support layer becomes an installable engine

The support layer stops being something you build and becomes something you install.

templates/support/ ships the engine whole — 55 files — and scripts/install-support.sh installs or upgrades it in place. Exactly two files are team-authored (CONCEPTS.md, docs/context-source-ladder.md), which is what makes upgrades possible without re-merging your own work.

Three failures the previous model walked teams into

Each is now prevented in code and documented as a seeded docs/solutions/ learning:

• Symlink-assembled roots. Harness file viewers do not display symlinked folders' contents, so the workspace vanishes from the UI members work in — while every script still reports success.
• Tools that derive machine paths. Right on the author's machine, quietly wrong on everyone else's. Now declared-only and fail-closed.
• A synced shared folder as the session's primary folder. The harness writes personal settings there and sync distributes them to the team, repeatedly. The launch shape is the fix, not the cleanup.

Added

• Multi-root topology — several physical directories handed to the harness, declared per machine in ~/.agentic-workspace/workspace-descriptor.yaml and referenced from shared docs by binding token.
• workspace-doctor.sh — read-only session-start probe: declared roots, capability tiers, and the one step that unlocks each locked tier. Fail-closed exit codes.
• Repo digests — repository questions answered with no git installed and no checkout open.
• Digest-bound checkout sync — preview→apply, full preflight, fetch and fast-forward only, host-agnostic, auth delegated to your git credential helper.
• Deterministic artifact routing with typed, rationalized area exceptions.
• Snapshot-first record editing plus a dependency-free record lint.
• check-workspace.sh and two behavioral test suites.
• Three enabled skills, including workspace-setup, which interviews a new member from folder access to doctor-green.

Requires bash and jq; git only for checkouts. No language runtime.

Breaking changes

• bindings.env is retired in favor of the machine-local descriptor. A machine path in a shared file is now a hard validation failure.
• templates/skills/ and templates/context-fabric/ are consolidated into templates/support/.
• skill-manifest.yaml entries are now id / path / status, and a paused entry requires a review_by date.
• Records require contentLocations; repository resources require organization, repository, checkoutDirectory; accessState uses available (was accessible).

Upgrading from v0.1.0: run ./scripts/install-support.sh <workspace> --check first — it reports what would change and never overwrites a locally modified file without --force.

Full detail in CHANGELOG.md. New here? Open reference/sandbox/ and follow its five-minute tour.