Carlos Florêncio
bc218dfbbe
* feat: add workspace sources from files panel * fix: preserve worktree identity during recovery * feat: unify workspace source actions * fix: validate recovered workspace repositories * fix: harden workspace source filesystem boundaries * test: split workspace repository chip coverage * fix: restrict repository rescan recovery paths * fix: stabilize workspace source CI checks * test: canonicalize workspace source paths * test: align workspace source container paths * fix: populate direct workspace repository names * test: preserve git fixture rewrites across restarts * test: isolate backend git fixture config * fix: resume remote workspace executions before creation * fix: preserve ssh agent identity during resume * fix: preserve SSH workspace across backend restart * fix: simplify workspace actions trigger * fix: refine add workspace repositories UX * docs: narrow workspace source UX updates * fix: avoid phantom turn on session resume * test(web): normalize workspace source request headers * feat(web): streamline workspace source picker * docs: remove trailing spaces from workspace source plan * fix: prevent resume status from creating phantom turns * fix(web): stabilize workspace source attachment * refactor(web): extract workspace source store contract * fix: avoid phantom turns on idle agent resume * fix: address backend static analysis findings * fix: preserve agentctl readiness status value * fix: preserve resume messages without active turns * fix: resume agents from promoted workspace root * chore: merge origin/main into feature/add-new-repo-folder-d97 * feat(web): explain workspace source consequences * test(websocket): count session activity subscription
1.5 KiB
ADR-2026-07-23-workspace-source-root-move-boundary: Workspace Source Root Move Boundary
Status: accepted Date: 2026-07-23 Area: backend
Context
Workspace-source materialization performs filesystem mutations for sources rooted at canonical
workspace paths. Go's os.Root can safely anchor operations within one such root, but it does not
provide a portable atomic, no-replace publication operation across two roots. Treating a cross-root
move as a copy followed by deletion could race with concurrent changes, overwrite a destination, or
lose data when either phase fails.
Decision
File mutations are descriptor-rooted: each operation uses one canonical workspace/source root as its filesystem authority. Rename is allowed only when both paths resolve under that same root. Cross-root moves and renames are rejected explicitly before mutation.
Consequences
Source materializers have one clear authority boundary and do not emulate a move with an unsafe copy/delete sequence. A future cross-root transfer requires an explicit copy workflow or a cross-platform no-replace primitive; it must supersede this ADR before being introduced.
Alternatives Considered
- Copy then delete. Rejected because it is not atomic and can race, overwrite an existing destination, or lose data on partial failure.
- Platform-specific rename or publication syscalls. Rejected for now because their semantics and availability do not supply a portable cross-root, atomic no-replace contract.