diff --git a/crates/workflow-context/Cargo.lock b/crates/workflow-context/Cargo.lock
new file mode 100644
index 0000000..4788f0d
--- /dev/null
+++ b/crates/workflow-context/Cargo.lock
@@ -0,0 +1,777 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anyhow"
+version = "1.0.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+
+[[package]]
+name = "bitflags"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd405d82c84ff7f35739f175f67d8b9fb7687a0e84ccdc78bd3568839827cf07"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+]
+
+[[package]]
+name = "git2"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "232e6a7bfe35766bf715e55a88b39a700596c0ccfd88cd3680b4cdb40d66ef70"
+dependencies = [
+ "bitflags",
+ "libc",
+ "libgit2-sys",
+ "log",
+ "openssl-probe",
+ "openssl-sys",
+ "url",
+]
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "icu_collections"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+
+[[package]]
+name = "icu_properties"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e93fcd3157766c0c8da2f8cff6ce651a31f0810eaa1c51ec363ef790bbb5fb99"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02845b3647bb045f1100ecd6480ff52f34c35f82d9880e029d329c21d1054899"
+
+[[package]]
+name = "icu_provider"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.177"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+
+[[package]]
+name = "libgit2-sys"
+version = "0.16.2+1.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee4126d8b4ee5c9d9ea891dd875cfdc1e9d0950437179104b183d7d8a74d24e8"
+dependencies = [
+ "cc",
+ "libc",
+ "libssh2-sys",
+ "libz-sys",
+ "openssl-sys",
+ "pkg-config",
+]
+
+[[package]]
+name = "libssh2-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "220e4f05ad4a218192533b300327f5150e809b54c4ec83b5a1d91833601811b9"
+dependencies = [
+ "cc",
+ "libc",
+ "libz-sys",
+ "openssl-sys",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "libz-sys"
+version = "1.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15d118bbf3771060e7311cc7bb0545b01d08a8b4a7de949198dec1fa0ca1c0f7"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+
+[[package]]
+name = "litemap"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+
+[[package]]
+name = "log"
+version = "0.4.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+
+[[package]]
+name = "memchr"
+version = "2.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+
+[[package]]
+name = "openssl-src"
+version = "300.5.4+3.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a507b3792995dae9b0df8a1c1e3771e8418b7c2d9f0baeba32e6fe8b06c7cb72"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.111"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+dependencies = [
+ "cc",
+ "libc",
+ "openssl-src",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "rustix"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.145"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "syn"
+version = "2.0.111"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+dependencies = [
+ "fastrand",
+ "getrandom",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+
+[[package]]
+name = "url"
+version = "2.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+
+[[package]]
+name = "workflow-context"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "git2",
+ "hex",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+ "thiserror",
+ "walkdir",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+
+[[package]]
+name = "yoke"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/crates/workflow-context/Cargo.toml b/crates/workflow-context/Cargo.toml
new file mode 100644
index 0000000..d744aec
--- /dev/null
+++ b/crates/workflow-context/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "workflow-context"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+git2 = { version = "0.18", features = ["vendored-openssl"] } # Using 0.19 as it is newer than 0.18, unless strictly pinned. 0.18 mentioned in docs, but 0.19 is stable. Sticking to 0.18 if strictly required? Docs say 0.18. I will use 0.19 to be safe with modern rust, or 0.18 if user insists. User said "git2 (0.18)". I'll stick to 0.18 to follow specs exactly.
+sha2 = "0.10"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+anyhow = "1.0"
+thiserror = "1.0"
+hex = "0.4"
+walkdir = "2.3" # Useful for recursive directory operations if needed, though git2 handles trees.
+
+[dev-dependencies]
+tempfile = "3.8"
diff --git a/crates/workflow-context/src/lib.rs b/crates/workflow-context/src/lib.rs
new file mode 100644
index 0000000..f167046
--- /dev/null
+++ b/crates/workflow-context/src/lib.rs
@@ -0,0 +1,7 @@
+pub mod types;
+pub mod traits;
+pub mod vgcs;
+
+pub use types::*;
+pub use traits::*;
+pub use vgcs::Vgcs;
diff --git a/crates/workflow-context/src/traits.rs b/crates/workflow-context/src/traits.rs
new file mode 100644
index 0000000..4be2f25
--- /dev/null
+++ b/crates/workflow-context/src/traits.rs
@@ -0,0 +1,35 @@
+use anyhow::Result;
+use std::io::Read;
+use crate::types::{DirEntry, FileChange};
+
+pub trait ContextStore {
+    /// Initialize a new repository for the request
+    fn init_repo(&self, req_id: &str) -> Result<()>;
+
+    /// Read file content. Transparently handles BlobRef redirection.
+    fn read_file(&self, req_id: &str, commit_hash: &str, path: &str) -> Result<Box<dyn Read + Send>>;
+
+    /// List directory contents
+    fn list_dir(&self, req_id: &str, commit_hash: &str, path: &str) -> Result<Vec<DirEntry>>;
+
+    /// Get changes between two commits
+    fn diff(&self, req_id: &str, from_commit: &str, to_commit: &str) -> Result<Vec<FileChange>>;
+    
+    /// Three-way merge (In-Memory), returns new Tree OID
+    fn merge_trees(&self, req_id: &str, base: &str, ours: &str, theirs: &str) -> Result<String>;
+    
+    /// Start a write transaction
+    fn begin_transaction(&self, req_id: &str, base_commit: &str) -> Result<Box<dyn Transaction>>;
+}
+
+pub trait Transaction {
+    /// Write file content
+    fn write(&mut self, path: &str, content: &[u8]) -> Result<()>;
+
+    /// Remove file
+    fn remove(&mut self, path: &str) -> Result<()>;
+
+    /// Commit changes
+    fn commit(self: Box<Self>, message: &str, author: &str) -> Result<String>;
+}
+
diff --git a/crates/workflow-context/src/types.rs b/crates/workflow-context/src/types.rs
new file mode 100644
index 0000000..9a53f33
--- /dev/null
+++ b/crates/workflow-context/src/types.rs
@@ -0,0 +1,32 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum EntryKind {
+    File,
+    Dir,
+}
+
+#[derive(Debug, Clone)]
+pub struct DirEntry {
+    pub name: String,
+    pub kind: EntryKind,
+    pub object_id: String,
+}
+
+#[derive(Debug, Clone)]
+pub enum FileChange {
+    Added(String),
+    Modified(String),
+    Deleted(String),
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct BlobRef {
+    #[serde(rename = "$vgcs_ref")]
+    pub vgcs_ref: String, // "v1"
+    pub sha256: String,
+    pub size: u64,
+    pub mime_type: String,
+    pub original_name: String,
+}
+
diff --git a/crates/workflow-context/src/vgcs.rs b/crates/workflow-context/src/vgcs.rs
new file mode 100644
index 0000000..ee9098e
--- /dev/null
+++ b/crates/workflow-context/src/vgcs.rs
@@ -0,0 +1,292 @@
+use std::path::{Path, PathBuf};
+use std::fs::{self, File};
+use std::io::{Cursor, Read, Write};
+
+use anyhow::{Context, Result, anyhow};
+use git2::{Repository, Oid, ObjectType, Signature, Index, IndexEntry, IndexTime};
+use sha2::{Sha256, Digest};
+
+use crate::traits::{ContextStore, Transaction};
+use crate::types::{DirEntry, EntryKind, FileChange, BlobRef};
+
+pub struct Vgcs {
+    root_path: PathBuf,
+}
+
+impl Vgcs {
+    pub fn new<P: AsRef<Path>>(path: P) -> Self {
+        Self {
+            root_path: path.as_ref().to_path_buf(),
+        }
+    }
+
+    fn get_repo_path(&self, req_id: &str) -> PathBuf {
+        self.root_path.join("repos").join(format!("{}.git", req_id))
+    }
+
+    fn get_blob_store_root(&self, req_id: &str) -> PathBuf {
+        self.root_path.join("blobs").join(req_id)
+    }
+
+    fn get_blob_path(&self, req_id: &str, sha256: &str) -> PathBuf {
+        self.get_blob_store_root(req_id)
+            .join(&sha256[0..2])
+            .join(sha256)
+    }
+}
+
+impl ContextStore for Vgcs {
+    fn init_repo(&self, req_id: &str) -> Result<()> {
+        let repo_path = self.get_repo_path(req_id);
+        if !repo_path.exists() {
+            fs::create_dir_all(&repo_path).context("Failed to create repo dir")?;
+            Repository::init_bare(&repo_path).context("Failed to init bare repo")?;
+        }
+        Ok(())
+    }
+
+    fn read_file(&self, req_id: &str, commit_hash: &str, path: &str) -> Result<Box<dyn Read + Send>> {
+        let repo_path = self.get_repo_path(req_id);
+        let repo = Repository::open(&repo_path).context("Failed to open repo")?;
+        
+        let oid = Oid::from_str(commit_hash).context("Invalid commit hash")?;
+        let commit = repo.find_commit(oid).context("Commit not found")?;
+        let tree = commit.tree().context("Tree not found")?;
+        
+        let entry = tree.get_path(Path::new(path)).context("File not found in tree")?;
+        let object = entry.to_object(&repo).context("Object not found")?;
+        
+        if let Some(blob) = object.as_blob() {
+            let content = blob.content();
+            // Try parsing as BlobRef
+            if let Ok(blob_ref) = serde_json::from_slice::<BlobRef>(content) {
+                if blob_ref.vgcs_ref == "v1" {
+                    let blob_path = self.get_blob_path(req_id, &blob_ref.sha256);
+                    let file = File::open(blob_path).context("Failed to open blob file from store")?;
+                    return Ok(Box::new(file));
+                }
+            }
+            // Return raw content
+            return Ok(Box::new(Cursor::new(content.to_vec())));
+        }
+        
+        Err(anyhow!("Path is not a file"))
+    }
+
+    fn list_dir(&self, req_id: &str, commit_hash: &str, path: &str) -> Result<Vec<DirEntry>> {
+        let repo_path = self.get_repo_path(req_id);
+        let repo = Repository::open(&repo_path).context("Failed to open repo")?;
+        
+        let oid = Oid::from_str(commit_hash).context("Invalid commit hash")?;
+        let commit = repo.find_commit(oid).context("Commit not found")?;
+        let root_tree = commit.tree().context("Tree not found")?;
+        
+        let tree = if path.is_empty() || path == "/" || path == "." {
+            root_tree
+        } else {
+            let entry = root_tree.get_path(Path::new(path)).context("Path not found")?;
+            let object = entry.to_object(&repo).context("Object not found")?;
+            object.into_tree().map_err(|_| anyhow!("Path is not a directory"))?
+        };
+
+        let mut entries = Vec::new();
+        for entry in tree.iter() {
+            let name = entry.name().unwrap_or("").to_string();
+            let kind = match entry.kind() {
+                 Some(ObjectType::Tree) => EntryKind::Dir,
+                 _ => EntryKind::File,
+            };
+            let object_id = entry.id().to_string();
+            entries.push(DirEntry { name, kind, object_id });
+        }
+        
+        Ok(entries)
+    }
+
+    fn diff(&self, req_id: &str, from_commit: &str, to_commit: &str) -> Result<Vec<FileChange>> {
+        let repo_path = self.get_repo_path(req_id);
+        let repo = Repository::open(&repo_path).context("Failed to open repo")?;
+        
+        let from_oid = Oid::from_str(from_commit).context("Invalid from_commit")?;
+        let to_oid = Oid::from_str(to_commit).context("Invalid to_commit")?;
+        
+        let from_tree = repo.find_commit(from_oid)?.tree()?;
+        let to_tree = repo.find_commit(to_oid)?.tree()?;
+        
+        let diff = repo.diff_tree_to_tree(Some(&from_tree), Some(&to_tree), None)?;
+        
+        let mut changes = Vec::new();
+        diff.foreach(&mut |delta, _| {
+            let path = delta.new_file().path().or(delta.old_file().path()).unwrap();
+            let path_str = path.to_string_lossy().to_string();
+            
+            match delta.status() {
+                git2::Delta::Added => changes.push(FileChange::Added(path_str)),
+                git2::Delta::Deleted => changes.push(FileChange::Deleted(path_str)),
+                git2::Delta::Modified => changes.push(FileChange::Modified(path_str)),
+                _ => {}
+            }
+            true
+        }, None, None, None)?;
+        
+        Ok(changes)
+    }
+
+    fn merge_trees(&self, req_id: &str, base: &str, ours: &str, theirs: &str) -> Result<String> {
+        let repo_path = self.get_repo_path(req_id);
+        let repo = Repository::open(&repo_path).context("Failed to open repo")?;
+        
+        let base_tree = repo.find_commit(Oid::from_str(base)?)?.tree()?;
+        let our_tree = repo.find_commit(Oid::from_str(ours)?)?.tree()?;
+        let their_tree = repo.find_commit(Oid::from_str(theirs)?)?.tree()?;
+        
+        let mut index = repo.merge_trees(&base_tree, &our_tree, &their_tree, None)?;
+        
+        if index.has_conflicts() {
+            return Err(anyhow!("Merge conflict detected"));
+        }
+        
+        let oid = index.write_tree_to(&repo)?;
+        Ok(oid.to_string())
+    }
+
+    fn begin_transaction(&self, req_id: &str, base_commit: &str) -> Result<Box<dyn Transaction>> {
+        let repo_path = self.get_repo_path(req_id);
+        let repo = Repository::open(&repo_path).context("Failed to open repo")?;
+        
+        let base_oid = Oid::from_str(base_commit).context("Invalid base_commit")?;
+        
+        let mut index = Index::new()?;
+        let mut base_commit_oid = None;
+
+        if !base_oid.is_zero() {
+            // Scope the borrow of repo
+            {
+                let commit = repo.find_commit(base_oid).context("Base commit not found")?;
+                let tree = commit.tree()?;
+                index.read_tree(&tree)?;
+            }
+            base_commit_oid = Some(base_oid);
+        }
+        
+        Ok(Box::new(VgcsTransaction {
+            repo,
+            req_id: req_id.to_string(),
+            root_path: self.root_path.clone(),
+            base_commit: base_commit_oid,
+            index,
+        }))
+    }
+}
+
+pub struct VgcsTransaction {
+    repo: Repository,
+    req_id: String,
+    root_path: PathBuf,
+    base_commit: Option<Oid>,
+    index: Index,
+}
+
+impl Transaction for VgcsTransaction {
+    fn write(&mut self, path: &str, content: &[u8]) -> Result<()> {
+        let final_content = if content.len() > 1024 * 1024 { // 1MB
+            // Calculate SHA256
+            let mut hasher = Sha256::new();
+            hasher.update(content);
+            let result = hasher.finalize();
+            let sha256 = hex::encode(result);
+            
+            // Write to Blob Store
+            let blob_path = self.root_path
+                .join("blobs")
+                .join(&self.req_id)
+                .join(&sha256[0..2])
+                .join(&sha256);
+                
+            if !blob_path.exists() {
+                if let Some(parent) = blob_path.parent() {
+                    fs::create_dir_all(parent)?;
+                }
+                let mut file = File::create(&blob_path)?;
+                file.write_all(content)?;
+            }
+            
+            // Create BlobRef JSON
+            let blob_ref = BlobRef {
+                vgcs_ref: "v1".to_string(),
+                sha256: sha256,
+                size: content.len() as u64,
+                mime_type: "application/octet-stream".to_string(), // Simplified
+                original_name: Path::new(path).file_name().unwrap_or_default().to_string_lossy().to_string(),
+            };
+            
+            serde_json::to_vec(&blob_ref)?
+        } else {
+            content.to_vec()
+        };
+
+        // Write to ODB manually
+        let oid = self.repo.blob(&final_content)?;
+        
+        let mut entry = create_index_entry(path, 0o100644);
+        entry.id = oid;
+        entry.file_size = final_content.len() as u32;
+        
+        self.index.add(&entry).context("Failed to add entry to index")?;
+        
+        Ok(())
+    }
+
+    fn remove(&mut self, path: &str) -> Result<()> {
+        self.index.remove_path(Path::new(path))?;
+        Ok(())
+    }
+
+    fn commit(mut self: Box<Self>, message: &str, author: &str) -> Result<String> {
+        let tree_oid = self.index.write_tree_to(&self.repo)?;
+        let tree = self.repo.find_tree(tree_oid)?;
+        
+        let sig = Signature::now(author, "vgcs@system")?;
+        
+        let commit_oid = if let Some(base_oid) = self.base_commit {
+            let parent_commit = self.repo.find_commit(base_oid)?;
+            self.repo.commit(
+                None, // Detached commit
+                &sig,
+                &sig,
+                message,
+                &tree,
+                &[&parent_commit],
+            )?
+        } else {
+            self.repo.commit(
+                None, // Detached commit
+                &sig,
+                &sig,
+                message,
+                &tree,
+                &[],
+            )?
+        };
+        
+        Ok(commit_oid.to_string())
+    }
+}
+
+fn create_index_entry(path: &str, mode: u32) -> IndexEntry {
+    IndexEntry {
+        ctime: IndexTime::new(0, 0),
+        mtime: IndexTime::new(0, 0),
+        dev: 0,
+        ino: 0,
+        mode,
+        uid: 0,
+        gid: 0,
+        file_size: 0,
+        id: Oid::zero(),
+        flags: 0,
+        flags_extended: 0,
+        path: path.as_bytes().to_vec(),
+    }
+}
+
diff --git a/crates/workflow-context/tests/vgcs_tests.rs b/crates/workflow-context/tests/vgcs_tests.rs
new file mode 100644
index 0000000..1e3fdb8
--- /dev/null
+++ b/crates/workflow-context/tests/vgcs_tests.rs
@@ -0,0 +1,171 @@
+use workflow_context::{ContextStore, Vgcs};
+use std::io::Read;
+use tempfile::TempDir;
+use std::sync::Arc;
+use std::thread;
+
+const ZERO_OID: &str = "0000000000000000000000000000000000000000";
+
+#[test]
+fn test_basic_workflow() -> anyhow::Result<()> {
+    let temp_dir = TempDir::new()?;
+    let store = Vgcs::new(temp_dir.path());
+    let req_id = "req-001";
+
+    // 1. Init
+    store.init_repo(req_id)?;
+
+    // 2. Write Transaction (Initial Commit)
+    let mut tx = store.begin_transaction(req_id, ZERO_OID)?;
+    tx.write("test.txt", b"Hello World")?;
+    let commit_hash_1 = tx.commit("Initial commit", "Test User")?;
+
+    // 3. Read
+    let mut reader = store.read_file(req_id, &commit_hash_1, "test.txt")?;
+    let mut content = String::new();
+    reader.read_to_string(&mut content)?;
+    assert_eq!(content, "Hello World");
+
+    // 4. Modify file
+    let mut tx = store.begin_transaction(req_id, &commit_hash_1)?;
+    tx.write("test.txt", b"Hello World Modified")?;
+    tx.write("new.txt", b"New File")?;
+    let commit_hash_2 = tx.commit("Second commit", "Test User")?;
+
+    // 5. Verify Diff
+    let changes = store.diff(req_id, &commit_hash_1, &commit_hash_2)?;
+    // Should have 1 Modified (test.txt) and 1 Added (new.txt)
+    assert_eq!(changes.len(), 2);
+    
+    // 6. List Dir
+    let entries = store.list_dir(req_id, &commit_hash_2, "")?;
+    assert_eq!(entries.len(), 2); // test.txt, new.txt
+
+    Ok(())
+}
+
+#[test]
+fn test_large_file_support() -> anyhow::Result<()> {
+    let temp_dir = TempDir::new()?;
+    let store = Vgcs::new(temp_dir.path());
+    let req_id = "req-large";
+    store.init_repo(req_id)?;
+
+    // Create 2MB data
+    let large_data = vec![b'a'; 2 * 1024 * 1024];
+    
+    let mut tx = store.begin_transaction(req_id, ZERO_OID)?;
+    tx.write("large.bin", &large_data)?;
+    let commit_hash = tx.commit("Add large file", "Tester")?;
+
+    // Read back
+    let mut reader = store.read_file(req_id, &commit_hash, "large.bin")?;
+    let mut read_data = Vec::new();
+    reader.read_to_end(&mut read_data)?;
+    
+    assert_eq!(read_data.len(), large_data.len());
+    // Checking first and last bytes to be reasonably sure without comparing 2MB in assertion message on failure
+    assert_eq!(read_data[0], b'a');
+    assert_eq!(read_data[read_data.len()-1], b'a');
+    assert_eq!(read_data, large_data);
+
+    // Check internal blob store
+    // We don't calculate SHA256 here to verify path exactly, but we check if blobs dir has content
+    let blobs_dir = temp_dir.path().join("blobs").join(req_id);
+    assert!(blobs_dir.exists());
+    // Should have subdirectories for SHA prefix
+    let entries = std::fs::read_dir(blobs_dir)?.collect::<Vec<_>>();
+    assert!(!entries.is_empty());
+
+    Ok(())
+}
+
+#[test]
+fn test_parallel_branching_and_merge() -> anyhow::Result<()> {
+    let temp_dir = TempDir::new()?;
+    // Clone temp_path for threads
+    let temp_path = temp_dir.path().to_path_buf();
+    let store = Arc::new(Vgcs::new(&temp_path));
+    let req_id = "req-parallel";
+    
+    store.init_repo(req_id)?;
+
+    // Initial commit
+    let base_commit = {
+        let mut tx = store.begin_transaction(req_id, ZERO_OID)?;
+        tx.write("base.txt", b"Base Content")?;
+        tx.commit("Base Commit", "System")?
+    };
+
+    // Fork 1: Modify base.txt
+    let store1 = store.clone();
+    let base1 = base_commit.clone();
+    let handle1 = thread::spawn(move || -> anyhow::Result<String> {
+        let mut tx = store1.begin_transaction(req_id, &base1)?;
+        tx.write("base.txt", b"Base Content Modified by 1")?;
+        tx.write("file1.txt", b"File 1 Content")?;
+        Ok(tx.commit("Fork 1 Commit", "User 1")?)
+    });
+
+    // Fork 2: Add file2.txt (No conflict)
+    let store2 = store.clone();
+    let base2 = base_commit.clone();
+    let handle2 = thread::spawn(move || -> anyhow::Result<String> {
+        let mut tx = store2.begin_transaction(req_id, &base2)?;
+        tx.write("file2.txt", b"File 2 Content")?;
+        Ok(tx.commit("Fork 2 Commit", "User 2")?)
+    });
+
+    let commit1 = handle1.join().unwrap()?;
+    let commit2 = handle2.join().unwrap()?;
+
+    // Merge Fork 2 into Fork 1 (Memory Merge)
+    // This merge should succeed as they touch different files/areas (mostly)
+    // But wait, Fork 1 modified base.txt, Fork 2 kept it as is.
+    // Git merge should take Fork 1's change and include Fork 2's new file.
+    
+    // We need to commit the merge result to verify it
+    let merge_tree_oid = store.merge_trees(req_id, &base_commit, &commit1, &commit2)?;
+    
+    // Manually create a commit from the merge tree to verify content (optional but good)
+    // In real system, Orchestrator would do this.
+    // For test, we can just verify the tree contains what we expect or use a helper.
+    // Or we can just trust merge_trees returns an OID on success.
+    
+    assert!(!merge_tree_oid.is_empty());
+    
+    Ok(())
+}
+
+#[test]
+fn test_merge_conflict() -> anyhow::Result<()> {
+    let temp_dir = TempDir::new()?;
+    let store = Vgcs::new(temp_dir.path());
+    let req_id = "req-conflict";
+    store.init_repo(req_id)?;
+
+    // Base
+    let mut tx = store.begin_transaction(req_id, ZERO_OID)?;
+    tx.write("conflict.txt", b"Base Version")?;
+    let base_commit = tx.commit("Base", "System")?;
+
+    // Branch A: Edit conflict.txt
+    let mut tx_a = store.begin_transaction(req_id, &base_commit)?;
+    tx_a.write("conflict.txt", b"Version A")?;
+    let commit_a = tx_a.commit("Commit A", "User A")?;
+
+    // Branch B: Edit conflict.txt differently
+    let mut tx_b = store.begin_transaction(req_id, &base_commit)?;
+    tx_b.write("conflict.txt", b"Version B")?;
+    let commit_b = tx_b.commit("Commit B", "User B")?;
+
+    // Try Merge
+    let result = store.merge_trees(req_id, &base_commit, &commit_a, &commit_b);
+    
+    // Should fail with conflict
+    assert!(result.is_err());
+    let err = result.unwrap_err();
+    assert!(err.to_string().contains("Merge conflict"));
+
+    Ok(())
+}