Workspace tenancy WT4: stop boot-cloning CommonPlace - #200
Merged
Conversation
Board SPEC-COMMONPLACE-WORKSPACE-TENANCY-1.0, record Verify-first, accept single-instance isolation, refuse WORKSPACE_REPO at entrypoint, and add the first gate:multitenant cut plus workspace path types.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
|
ECC bundle files are already tracked in this repository. Skipping generation of another bundle PR. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (17)
📝 WalkthroughWalkthroughThe PR defines workspace-tenancy requirements and records execution status. It adds workspace identity and path utilities, removes boot-time repository cloning, requires explicit IDE workspace roots, defers substrate provisioning, and adds a multitenancy validation script. ChangesWorkspace Tenancy
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
Implements WT4 of the workspace-tenancy spec by removing boot-time repo cloning from the workspace container and shifting the default IDE root to an empty /workspace/welcome, while scaffolding an initial WT8 “gate:multitenant” check and introducing a small @commonplace/workspace-tenancy types/helpers package to support per-workspace paths.
Changes:
- Remove boot clone behavior and explicitly refuse
WORKSPACE_REPO/WORKSPACE_REPO_URLin the workspace entrypoint; default to/workspace/welcome. - Update workspace container packaging/docs (Dockerfile + Railway notes) to eliminate single-tenant defaults.
- Add an initial multitenancy gate script and a new
@commonplace/workspace-tenancypackage withworkspacePath()+ tests, plus accompanying WT0/WT9 docs.
Reviewed changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| scripts/check-multitenant.mjs | Adds a first-cut gate to detect reintroduced boot clone, repo envs, and /workspace/repo defaults. |
| packaging/workspace/railway.toml | Updates deployment documentation to reflect WT4 retirement of repo-clone env vars. |
| packaging/workspace/entrypoint.sh | Removes boot cloning, introduces /workspace/welcome, refuses WORKSPACE_REPO*, and defers substrate bootstrap. |
| packaging/workspace/Dockerfile | Defaults the image to /workspace/welcome and removes baked-in tenant allowlist/env defaults. |
| packages/workspace-tenancy/vitest.config.ts | Adds Vitest config for the new workspace-tenancy package. |
| packages/workspace-tenancy/tsconfig.json | Adds TS config for the new workspace-tenancy package. |
| packages/workspace-tenancy/src/workspace.ts | Introduces workspace object types and workspacePath() helper. |
| packages/workspace-tenancy/src/workspace.test.ts | Adds tests for workspacePath() validation and output. |
| packages/workspace-tenancy/src/index.ts | Adds a barrel export for the package. |
| packages/workspace-tenancy/package.json | Defines the new internal package, scripts, and exports. |
| docs/plans/workspace-tenancy/VERIFY-FIRST.md | Records verify-first findings that drive WT4/WT9 decisions. |
| docs/plans/workspace-tenancy/SPEC-COMMONPLACE-WORKSPACE-TENANCY-1.0.md | Lands the workspace tenancy spec (WT1–WT9) and acceptance criteria. |
| docs/plans/workspace-tenancy/PLAN.md | Adds the execution plan/checklist for the workspace-tenancy workstream. |
| docs/plans/workspace-tenancy/EXECUTE-REPORT.md | Documents what was done vs. not done and the current deployment risk items. |
| docs/plans/workspace-tenancy/DECISION-ISOLATION.md | Records the near-term isolation decision (WT9) and revisit triggers. |
| apps/theorem-vscode/src/agent/session-opener.ts | Removes /workspace/repo fallback and requires an explicit workspace root. |
| .harness/checklists/workspace-tenancy--plan-local-20260806a.json | Adds a harness checklist artifact for the plan’s deliverables and status. |
Suppressed comments (1)
packaging/workspace/entrypoint.sh:125
- The
${COMMONPLACE_SERVICE_ALLOWED_TENANTS:+...}expansion injects literal quotes into theenvassignment (because the quotes are part of the expanded text), so the child process can receive a value like"Travis-Gilbert"or other unintended content. SinceCOMMONPLACE_SERVICE_ALLOWED_TENANTSis already exported/unset above, it doesn’t need to be conditionally re-specified here.
COMMONPLACE_API_KEY="${COMMONPLACE_API_KEY}" \
COMMONPLACE_DATA_DIR="${COMMONPLACE_DATA_DIR}" \
COMMONPLACE_INSTANCE_ID="${COMMONPLACE_INSTANCE_ID}" \
${COMMONPLACE_SERVICE_ALLOWED_TENANTS:+COMMONPLACE_SERVICE_ALLOWED_TENANTS="${COMMONPLACE_SERVICE_ALLOWED_TENANTS}"} \
setsid commonplace-api &
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| fi | ||
| return 1 | ||
| } | ||
| mkdir -p "${WORKSPACE_ROOT}" "${WELCOME_DIR}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
WORKSPACE_REPO/WORKSPACE_REPO_URL; Studio opens/workspace/welcome.node scripts/check-multitenant.mjs.@commonplace/workspace-tenancypath helpers.WORKSPACE_DIR=/workspace/welcome(WORKSPACE_REPO already absent).Not done (honest)
Test plan
node scripts/check-multitenant.mjspnpm --filter @commonplace/workspace-tenancy testpnpm --filter theorem-vscode test/IDEshows welcome README, not CommonPlace monorepoWORKSPACE_REPOon service (exits 78 if set)Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Validation