Workspace endpoint

This endpoint binds one workspace at startup using EPM_PG_WORKSPACE_ID. The optional packaged workspace profile serves /api/workspace/mcp through the proxy to internal port 5192. An operator configures the listener after provisioning the workspace.

Confirm the bound scope

1. With the workspace Administrator grant, call list_v2_workspace_functions with {}. Match listener.workspaceId to the intended workspace before writing. The server supplies this scope.
2. Use execute_v2_workspace_program with program and idempotency_key to create an application. The blank application example checks for an Active result in the same workspace, then verifies the application by ID on the router.
3. Where workspace security is configured, inspect group grants with read_v2_workspace_access. Use the separately governed set_v2_workspace_access for a reviewed grant or revoke.

If the listener reports the wrong workspace, reconnect to the correct listener before submitting a program. Reset assessment and transition have a separate operator check. Reset apply uses the dedicated maintenance listener.