--- id: CAP-PFM-CSH-011 title: Continue in another workspace without reusing a record feature: FEAT-PFM-CSH-03 product_area: platform module: console-shell revision: 2 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - >- react-console:docs/url-architecture.md#6. Tenant from the URL (decided by Andrew 2026-10-14; final acceptance 2026-10-15) purpose: >- The switcher moves staff to corresponding work in another workspace without carrying a record reference across. outcomes: - Workspace choices come from the current reach list. - The destination list belongs to the newly entered workspace. concepts: - CON-PFM-CSH-003 actors: - ACT-PFM-001 - ACT-PFM-002 - ACT-PFM-004 - ACT-PFM-005 surfaces: - console preconditions: [] postconditions: [] permissions: - key: platform.security-self.read where_checked: api scope: tenant rules: - id: BR-CAP-PFM-CSH-011-01 proved_by: [ATS-PFM-CSH-011-03, ATS-PFM-CSH-011-05] statement: The switcher uses only the reachable workspaces listed by the security context. kind: permission enforced_at: - console must_prove: true provenance: observed source: 'react-console:components/console/tenant-switcher.tsx:TenantSwitcher' origin: >- react-console:docs/url-architecture.md#6. Tenant from the URL (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-011-02 proved_by: [ATS-PFM-CSH-011-01, ATS-PFM-CSH-011-02, ATS-PFM-CSH-011-06, TST-PFM-CSH-014, TST-PFM-CSH-029] statement: >- A workspace switch keeps the corresponding area and list, strips record identities and queries, and retains a planned page’s path. kind: calculation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/routes/__tests__/routes.test.ts#keeps the workspace and resource list and drops record ids and queries origin: >- react-console:docs/url-architecture.md#6. Tenant from the URL (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-011-03 proved_by: [ATS-PFM-CSH-011-04] statement: Choosing the already selected workspace initiates no navigation. kind: validation enforced_at: - console must_prove: true provenance: observed source: 'react-console:components/console/tenant-switcher.tsx:TenantSwitcher' origin: none - id: BR-CAP-PFM-CSH-011-04 proved_by: [] statement: >- The switcher presents the current workspace and customer with copy controls for their identifiers. kind: policy enforced_at: - console must_prove: false provenance: observed source: 'react-console:components/console/tenant-switcher.tsx:DetailRow' origin: none - id: BR-CAP-PFM-CSH-011-05 proved_by: [ATS-PFM-CSH-011-05] statement: >- Alternative workspace choices appear when more than one is reachable, and name-or-identifier search appears above six choices with an empty-result message. kind: calculation enforced_at: - console must_prove: true provenance: observed source: 'react-console:components/console/tenant-switcher.tsx:TenantSwitcher' origin: none - id: BR-CAP-PFM-CSH-011-06 proved_by: [] statement: >- Entry in progress disables choices and shows progress, but the switcher reports the chosen workspace immediately before its entry is confirmed. kind: lifecycle enforced_at: - console must_prove: false provenance: observed source: 'react-console:components/console/tenant-switcher.tsx:TenantSwitcher' origin: none - id: BR-CAP-PFM-CSH-011-07 proved_by: [ATS-PFM-CSH-010-09, ATS-PFM-CSH-011-02] statement: >- URL entry reads the destination context, clears cached data after a successful answer but before installing it, remounts workspace stores and keeps destination content gated while pending. kind: invariant enforced_at: - console must_prove: true provenance: observed source: >- react-console:lib/security-context/provider.tsx:openTenantId; components/console/tenant-id-gate.tsx:TenantIdGate origin: none - id: BR-CAP-PFM-CSH-011-08 proved_by: [] statement: >- Successful workspace entry is remembered per person for customer landing and legacy links, while bare-address staff landing still targets HQ. kind: lifecycle enforced_at: - console must_prove: true provenance: observed source: >- react-console:lib/security-context/provider.tsx:openTenantId; lib/auth/session.ts:rememberTenantFor origin: none scenarios: - id: SC-CAP-PFM-CSH-011-01 given: The person is viewing a contact in the first workspace. when: They choose another workspace. then: Navigation targets the contacts list in the chosen workspace without the contact identifier. provenance: test source: >- react-console:e2e/mock/url-architecture.mock.spec.ts#switching tenant opens the same list under the other tenant's id, record ids dropped - id: SC-CAP-PFM-CSH-011-02 given: The chosen destination cannot be reached anymore. when: Its gate refuses entry. then: The person receives a refusal with a route back to a reachable workspace. provenance: observed source: 'react-console:components/console/tenant-id-gate.tsx:TenantIdGate, deniedReturnTenant' edge_cases: [] constraints: [] depends_on: - CAP-PFM-CSH-010 related: - CAP-PFM-CSH-009 journeys: - JNY-PFM-CSH-004 open_questions: [] evidence: - >- react-console at baf6dae: components/console/tenant-switcher.tsx, lib/routes/match.ts (switchTenantPath), lib/routes/__tests__/routes.test.ts, docs/url-architecture.md §6 and §11 item 11, e2e/mock/url-architecture.mock.spec.ts. - >- services-platform at ad3f6a6: modules/security/aws/api/access.routes.ts (getMySecurityContext with tenant_id and preferred_tenant_id, getMySecurityContextInTenant; MOD-PFM-SEC). controls: [TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-IAM-003, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-003, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-CSH-03-03] suites: [TST-PFM-CSH-014, TST-PFM-CSH-029] --- # Continue in another workspace without reusing a record ## Purpose The switcher moves staff to corresponding work in another workspace without carrying a record reference across. ## How It Works The person opens the workspace switcher from the header. They review the current context and choose another reachable workspace. Navigation constructs a corresponding destination without the previous record. The workspace gate then establishes access to that destination. A confirmation currently precedes that result and can describe a switch that later fails. The product should align confirmation with successful entry and test cache replacement under delayed responses. ## Relationships - Workspace entry supplies the destination context and refusal handling. - Address matching selects the retained list path.