--- id: CAP-PFM-CSH-013 title: Keep staff work and workspace work in distinct contexts feature: FEAT-PFM-CSH-03 product_area: platform module: console-shell revision: 2 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - >- react-console:docs/url-architecture.md#6. Tenant from the URL (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - >- react-console:docs/url-architecture.md#11. Decisions made during the build, item 24 (Andrew, 2026-10-15) (decided by Andrew 2026-10-14; final acceptance 2026-10-15) purpose: Rhythm staff distinguish platform administration in HQ from customer work in a workspace. outcomes: - HQ and customer navigation are selected independently. - Cleared staff links enter their requested workspace directly. concepts: - CON-PFM-CSH-001 - CON-PFM-CSH-002 - CON-PFM-CSH-003 actors: - ACT-PFM-004 - ACT-PFM-005 - ACT-PFM-002 surfaces: - console preconditions: [] postconditions: [] permissions: - key: console.system where_checked: console scope: tenant - key: hq.* where_checked: api scope: global rules: - id: BR-CAP-PFM-CSH-013-01 proved_by: [ATS-PFM-CSH-013-04, TST-PFM-CSH-005] statement: >- For staff, HQ addresses select HQ mode and console addresses select workspace mode, with other addresses following whether a workspace is selected; non-staff always use workspace mode. kind: calculation enforced_at: - console must_prove: true provenance: observed source: 'react-console:components/console/use-shell-mode.ts:useShellMode' origin: >- react-console:docs/url-architecture.md#6. Tenant from the URL (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-013-02 proved_by: [ATS-PFM-CSH-013-03] statement: >- Main navigation selects HQ links in HQ mode and workspace links in workspace mode without combining them. kind: invariant enforced_at: - console must_prove: true provenance: observed source: 'react-console:components/console/app-sidebar.tsx:MainNavigation' origin: none - id: BR-CAP-PFM-CSH-013-03 proved_by: [] statement: >- The HQ menu contains Home, Customers, Staff, Workspaces, Jobs, Notifications, AI Usage and Custom Query Tables. kind: policy enforced_at: - console must_prove: false provenance: observed source: 'react-console:components/console/nav-config.ts:hqLinks' origin: none - id: BR-CAP-PFM-CSH-013-04 proved_by: [] statement: HQ mode replaces the header workspace switcher with the Rhythm HQ label. kind: policy enforced_at: - console must_prove: false provenance: observed source: 'react-console:components/console/site-header.tsx:SiteHeader' origin: none - id: BR-CAP-PFM-CSH-013-05 proved_by: [ATS-PFM-CSH-005-05, ATS-PFM-CSH-013-03] statement: >- Inside a workspace the staff account menu offers HQ, and only workspace mode offers settings and My Responsibilities. kind: permission enforced_at: - console must_prove: true provenance: observed source: 'react-console:components/console/app-sidebar.tsx:AppSidebar' origin: none - id: BR-CAP-PFM-CSH-013-06 proved_by: [ATS-PFM-CSH-012-05, ATS-PFM-CSH-013-01, TST-PFM-CSH-013, TST-PFM-CSH-014] statement: >- A bare-address staff landing opens HQ without selecting the remembered workspace, while retaining that memory for later older links. kind: lifecycle enforced_at: - console must_prove: true provenance: test source: >- react-console:e2e/mock/staff-landing.mock.spec.ts#a staff member with a remembered tenant and a standing grant lands on /hq in HQ context origin: >- react-console:docs/url-architecture.md#11. Decisions made during the build, item 24 (Andrew, 2026-10-15) (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-013-07 proved_by: [ATS-PFM-CSH-013-02, TST-PFM-CSH-009, TST-PFM-CSH-014] statement: >- A bookmark for a workspace covered by a staff grant opens its page and query directly after sign-in or from HQ. kind: policy enforced_at: - console must_prove: true provenance: test source: >- react-console:e2e/mock/url-architecture.mock.spec.ts#a staff member's bookmark into a standing-grant tenant opens that page and query, from Rhythm HQ too origin: >- react-console:docs/url-architecture.md#11. Decisions made during the build, item 24 (Andrew, 2026-10-15) (decided by Andrew 2026-10-14; final acceptance 2026-10-15) scenarios: - id: SC-CAP-PFM-CSH-013-01 given: A staff user has a remembered workspace but opens the bare address. when: The console completes its landing. then: HQ opens while the remembered workspace remains available for older links. provenance: test source: >- react-console:e2e/mock/staff-landing.mock.spec.ts#a staff member with a remembered tenant and a standing grant lands on /hq in HQ context - id: SC-CAP-PFM-CSH-013-02 given: A standing staff grant covers the bookmarked workspace. when: The staff user follows the bookmark from HQ. then: The requested workspace page and query open directly. provenance: test source: >- react-console:e2e/dev/url-architecture.dev.spec.ts#signed in on Rhythm HQ: opening it goes straight into the tenant edge_cases: [] constraints: [] depends_on: [] related: - CAP-PFM-CSH-010 - CAP-PFM-CSH-012 - CAP-PFM-CSH-005 - CAP-PFM-CSH-006 journeys: - JNY-PFM-CSH-001 open_questions: [] evidence: - >- react-console at baf6dae: components/console/{use-shell-mode.ts,app-sidebar.tsx,site-header.tsx,nav-config.ts}, components/console/hq/{staff-landing-gate,staff-context-gate}.tsx, lib/security-context/boot.ts, docs/url-architecture.md §6, §11 item 24, e2e/mock/{staff-landing,url-architecture}.mock.spec.ts, e2e/dev/url-architecture.dev.spec.ts, e2e/controlled/staff-deep-link.controlled.spec.ts. - >- services-platform at ad3f6a6: modules/security/aws/api/access.routes.ts (getMySecurityContext with tenant_id and preferred_tenant_id, getMySecurityContextInTenant; MOD-PFM-SEC). controls: [TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-CSH-03-04, FAS-PFM-CSH-03-05] suites: [TST-PFM-CSH-005, TST-PFM-CSH-009, TST-PFM-CSH-013, TST-PFM-CSH-014] --- # Keep staff work and workspace work in distinct contexts ## Purpose Rhythm staff distinguish platform administration in HQ from customer work in a workspace. ## How It Works Staff choose between their own operational work and customer work. The address supplies the primary context signal. Workspace entry can establish a customer context without changing the purpose of HQ. Entering HQ clears the selected workspace while retaining useful bookmark memory. A refused staff workspace link returns to HQ with an explanation. The product should verify both contexts as one complete browser journey. ## Relationships - Security owns staff authority and workspace grants. - Workspace entry handles bookmarks and staff refusals.