fix: stabilize runtime workspace identity

harness/tests/test_config_resources.py

@@ -95,6 +95,7 @@ def test_runtime_handoff_preserves_canonical_identity_and_durable_roots(monkeypa
 runtime_identity:
   workspace_id: psd-clinical
   workspace_revision: {'a' * 40}
+  source_identity: workspace://psd-clinical
 dwh:
   type: postgres_direct
   connection: {{database: analytics, schema: mart, user: reader, password: secret}}
@@ -113,6 +114,7 @@ embeddings: {{base_url: http://embedding.invalid, model: embed, dim: 768}}
 
     assert cfg._workspace_id == "psd-clinical"
     assert cfg._workspace_revision == "a" * 40
+    assert cfg._config_source == "workspace://psd-clinical"
     assert cfg.paths.sessions == runtime_root / "sessions"
     assert cfg.paths.artifacts == runtime_root / "artifacts"
     assert cfg.paths.indexes == runtime_root / "indexes"
@@ -135,6 +137,23 @@ roots: {{sessions: sessions, artifacts: artifacts, indexes: indexes}}
     assert workspace_id_for_config(cfg, workspace) == "psd-clinical"
 
 
+def test_runtime_identity_rejects_a_source_for_another_workspace(tmp_path):
+    workspace = tmp_path / "runtime-random-uuid.yaml"
+    workspace.write_text(f"""
+runtime_identity:
+  workspace_id: psd-clinical
+  workspace_revision: {'a' * 40}
+  source_identity: workspace://another-workspace
+dwh:
+  type: postgres_direct
+  connection: {{database: analytics, schema: mart, user: reader, password: secret}}
+roots: {{sessions: sessions, artifacts: artifacts, indexes: indexes}}
+""")
+
+    with pytest.raises(ConfigError, match="source_identity"):
+        load_config(workspace)
+
+
 def test_load_config_rejects_executable_yaml_tags_without_running_them(tmp_path):
     marker = tmp_path / "must-not-exist"
     workspace = tmp_path / "workspace.yaml"