fix(evidence): isolate vectors by workspace

harness/tests/l0/test_pgvector_corpus_lifecycle.py

@@ -241,7 +241,8 @@ def test_real_pgvector_corpus_job_lifecycle(tmp_path, persistent_pgvector):
         record=VectorRecord(
             id="chunk:exact-vector-orphan", kind="evidence", ref="doc:orphan",
             title="orphan", content="orphan",
-            metadata={"document_id": "doc:orphan", "vector_generation": orphan},
+                metadata={"document_id": "doc:orphan", "vector_generation": orphan,
+                          "workspace_id": "pgvector-lifecycle"},
         ),
         embedding=query, content_hash="sha256:" + "f" * 64,
     )])
@@ -251,5 +252,7 @@ def test_real_pgvector_corpus_job_lifecycle(tmp_path, persistent_pgvector):
     expected_fs = set(generations[-2:])
     assert set(CorpusStore(tmp_path / "corpus").list_generations()) == expected_fs
     expected_vectors = expected_fs | {generations[0]}
-    assert set(recreated.list_evidence_generations("evidence")) == expected_vectors
+    assert set(recreated.list_evidence_generations(
+        "evidence", "pgvector-lifecycle"
+    )) == expected_vectors
     assert final_pipeline.gc(workspace_root=tmp_path)["evicted"] == []

harness/tests/l0/test_pgvector_store.py

@@ -130,14 +130,29 @@ def test_pgvector_lists_and_deletes_exact_evidence_generation(store):
     value = VectorWriteRecord(
         record=VectorRecord(
             id="evidence-generation-a", kind="evidence", ref="doc:a", title="a",
-            content="content", metadata={"vector_generation": generation},
+            content="content", metadata={"vector_generation": generation, "workspace_id": "default"},
         ),
         embedding=[1.0, 0.0], content_hash="sha256:" + "a" * 64,
     )
     store.upsert("evidence", [value])
-    assert generation in store.list_evidence_generations("evidence")
-    assert store.delete_generation("evidence", generation) == 1
-    assert generation not in store.list_evidence_generations("evidence")
+    assert generation in store.list_evidence_generations("evidence", "default")
+    assert store.delete_generation("evidence", generation, "default") == 1
+    assert generation not in store.list_evidence_generations("evidence", "default")
+
+
+def test_pgvector_generation_cleanup_isolated_between_workspaces(store):
+    generation = "gen:" + "b" * 32
+    records = [VectorWriteRecord(
+        record=VectorRecord(
+            id=f"evidence-{workspace}", kind="evidence", ref=f"doc:{workspace}",
+            title=workspace, content=workspace,
+            metadata={"vector_generation": generation, "workspace_id": workspace},
+        ), embedding=[1.0, 0.0], content_hash="sha256:" + key * 64,
+    ) for workspace, key in (("workspace-a", "b"), ("workspace-b", "c"))]
+    store.upsert("evidence", records)
+    assert store.delete_generation("evidence", generation, "workspace-a") == 1
+    assert generation not in store.list_evidence_generations("evidence", "workspace-a")
+    assert generation in store.list_evidence_generations("evidence", "workspace-b")
 
 
 def test_pgvector_search_filters_kinds_before_limit(store):

harness/tests/l0/test_vector_adapter_parity.py

@@ -235,9 +235,10 @@ def test_http_delete_generation_uses_exact_allowlisted_rpc_payload(monkeypatch):
         lambda url, json, **kwargs: calls.append((url, json)) or Response({"deleted": 2}),
     )
     client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
-    assert client.delete_generation("evidence", "gen:" + "a" * 32) == 2
+    assert client.delete_generation("evidence", "gen:" + "a" * 32, "default") == 2
     assert calls == [("https://vectors.test/rpc/delete_vector_generation", {
         "table_name": "evidence", "kind": "evidence", "generation": "gen:" + "a" * 32,
+        "workspace_id": "default",
     })]
 
 
@@ -248,7 +249,7 @@ def test_http_delete_generation_legacy_404_fails_closed_without_body_leak(monkey
     )
     client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
     with pytest.raises(VectorRestError, match="delete_vector_generation RPC is unavailable") as error:
-        client.delete_generation("evidence", "gen:" + "a" * 32)
+        client.delete_generation("evidence", "gen:" + "a" * 32, "default")
     assert "secret" not in str(error.value)
 
 
@@ -261,9 +262,9 @@ def test_http_list_evidence_generations_exact_rpc_and_legacy_fail_closed(monkeyp
         ]),
     )
     client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
-    assert client.list_evidence_generations("evidence") == ["gen:" + "a" * 32]
+    assert client.list_evidence_generations("evidence", "default") == ["gen:" + "a" * 32]
     assert calls[0][0].endswith("/rpc/list_evidence_generations")
-    assert calls[0][1] == {"table_name": "evidence", "kind": "evidence"}
+    assert calls[0][1] == {"table_name": "evidence", "kind": "evidence", "workspace_id": "default"}
 
 
 @pytest.mark.parametrize("generation", ["gen:a", "gen:" + "A" * 32, "gen:" + "a" * 33])
@@ -274,7 +275,7 @@ def test_http_generation_operations_reject_noncanonical_values(monkeypatch, gene
     )
     client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
     with pytest.raises(ValueError, match="canonical"):
-        client.delete_generation("evidence", generation)
+            client.delete_generation("evidence", generation, "default")
 
 
 def test_http_inventory_rejects_malformed_rpc_output(monkeypatch):
@@ -284,4 +285,4 @@ def test_http_inventory_rejects_malformed_rpc_output(monkeypatch):
     )
     client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
     with pytest.raises(VectorRestError, match="malformed"):
-        client.list_evidence_generations("evidence")
+        client.list_evidence_generations("evidence", "default")