Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,5 +1,5 @@
 {
- "current": "4089c02",
+ "current": "db43911",
  "releases": [
   {
    "version": "v53",

VERSION

@@ -1 +1 @@
-4089c02
+db43911

api/routes_customers.py

@@ -320,7 +320,8 @@ def grid_assembly(session: Session, scope: str = "customer", storage_key: str =
             _ov[_pid] = {**(_ov.get(_pid) or {}), **_cells}
         ws["overlays"] = _ov
     workspace, fields, views, lists = aios_grid.workspace_wire(
-        ws, session.uname, set(pids), defs={}, scope_key=scope, storage_key=storage_key)
+        ws, session.uname, set(pids), defs={}, scope_key=scope, storage_key=storage_key,
+        st=rt)
     # ⭐⭐ W38-T20 — AND THE COLUMN DEFINITIONS, BEFORE THE WALL. See `_merge_shared_fields`: this
     # position is load-bearing twice, once for the transitive closure and once because it is the
     # only order in which the per-field grant marker is ever presented to `hidden_keys`.

api/routes_products.py

@@ -363,7 +363,7 @@ def product_assembly(session: Session, scope: str = "product", storage_key: str
     ctx = grid_events.EventCtx(
         uname=session.uname, allowed_pids=pids, fields=[],
         hidden_keys=perm_scope.hidden_keys(session.user, MODULE, fields_base, st=session.runtime),
-        admin=session.admin, fallback_ws=None, seen_ids={},
+        admin=session.admin, fallback_ws=None, seen_ids={}, st=session.runtime,
         scope_key="product", table=pd.table_ops(session.runtime))
     ws = grid_events.table_workspace(ctx, allowed_pids=pids,
                                      consume_corrections=consume_corrections)
@@ -385,7 +385,7 @@ def product_assembly(session: Session, scope: str = "product", storage_key: str
         ws["overlays"] = _ov
     workspace, fields, views, lists = aios_grid.workspace_wire(
         ws, session.uname, set(pids), defs={}, scope_key=scope, storage_key=storage_key,
-        fields_base=fields_base)
+        fields_base=fields_base, st=session.runtime)
 
     # W43: source-backed Product choices learn values in the shared overlay schema.  Apply that
     # durable vocabulary before the payload is served, so "Add option: et" is still available
@@ -517,7 +517,7 @@ def patch_product(pid: int, body: dict = Body(default=None),
         admin=session.admin, fallback_ws=None, seen_ids={},
         hidden_keys=perm_scope.hidden_keys(
             session.user, MODULE, g["fields"], st=session.runtime),
-        scope_key="product", table=pd.table_ops(session.runtime))
+        scope_key="product", table=pd.table_ops(session.runtime), st=session.runtime)
     try:
         grid_events.handle_one(
             {"id": f"patch:product:{pid}:{time.time_ns()}", "type": "overlay_patch",

api/routes_shares.py

@@ -973,7 +973,7 @@ def _object_ref(session, kind, oid):
              "field": "A column", "cohort": "A cohort"}.get(kind, "An item"), None, "")
 
 
-def _cohort_visible(scope, username, allowed_pids=None):
+def _cohort_visible(scope, username, allowed_pids=None, st=None):
     """Adapt the Cohort module's existing list projection to the one registry predicate.
 
     ``workspace_wire`` is the live Cohort list/open path.  It intentionally receives only a
@@ -984,7 +984,7 @@ def _cohort_visible(scope, username, allowed_pids=None):
     """
     import modules.cohort as cohort_mod
 
-    records = shares.visible_cohorts(scope, username)
+    records = shares.visible_cohorts(scope, username, st=st)
     return {cid: {**record,
                   "members": cohort_mod._clean_members(record.get("members"), allowed_pids)}
             for cid, record in records.items()}
@@ -999,7 +999,8 @@ def _install_cohort_visibility():
             return _cohort_visible("customer", username, allowed_pids)
 
         def _scoped_visible(self, username, allowed_pids=None):
-            return _cohort_visible(self.scope, username, allowed_pids)
+            return _cohort_visible(self.scope, username, allowed_pids,
+                                   st=getattr(self, 'st', None))
 
         cohort_mod.visible = _customer_visible
         cohort_mod.CohortStore.visible = _scoped_visible

api/routes_tables.py

@@ -747,7 +747,7 @@ def ut_write_ctx(session: Session, table_key: str):
     ws = grid_events.table_workspace(ctx, allowed_pids=pids, consume_corrections=False)
     workspace, fields, views, lists = aios_grid.workspace_wire(
         ws, session.uname, set(pids), defs={}, scope_key=table_key, storage_key="",
-        fields_base=fields_base)
+        fields_base=fields_base, st=session.runtime)
     # ⭐⭐ W38-T16 — THE SHARED COLUMNS JOIN THE **WRITE** CTX'S CONTRACT TOO, and for the reason
     # W36-T21 gave one wall over: `grid_events` refuses a key by asking `ctx.hidden_keys`, so a
     # column missing from this list is a column the events transport does not know it must
@@ -1257,7 +1257,7 @@ def ut_assembly(session: Session, table_key: str, storage_key: str = "",
                                      consume_corrections=consume_corrections)
     workspace, fields, views, lists = aios_grid.workspace_wire(
         ws, session.uname, set(pids), defs={}, scope_key=table_key,
-        storage_key=storage_key, fields_base=fields_base)
+        storage_key=storage_key, fields_base=fields_base, st=session.runtime)
     # ⭐⭐ W38-T16 — THE TENANT-WIDE STRATUM, ON A MATERIALISED GRID. Merged HERE, between
     # `workspace_wire` and the wall, which is `routes_odoo_tables`' own position for the same two
     # lines and for the same reason: the closure must be recomputed on the MERGED contract or a

platform/aios_grid.py

@@ -2962,7 +2962,7 @@ def views_from_defs(defs, saved_views, fields, system_name="All customers", lock
 
 
 def workspace_wire(ws, uname, pool_pids, defs=None, scope_key='customer', storage_key=None,
-                   fields_base=None, with_cohorts=True):
+                   fields_base=None, with_cohorts=True, st=None):
     """The client's `GridWorkspace` WIRE SHAPE from the stored table workspace — the ONE
     projection, shared by both servers (app.py's `_table_grid` and the API's `/workspace`).
 
@@ -2994,7 +2994,7 @@ def workspace_wire(ws, uname, pool_pids, defs=None, scope_key='customer', storag
 
     cohort_lists = []
     if with_cohorts:
-        for cid, c in sorted(cohort_mod.scoped(scope_key).visible(uname, pool_pids).items(),
+        for cid, c in sorted(cohort_mod.scoped(scope_key, st=st).visible(uname, pool_pids).items(),
                              key=lambda kv: (kv[1].get('name') or '').lower()):
             members = [p for p in (c.get('members') or []) if p in pool_pids]
             entry = {'id': cid, 'name': c.get('name') or cid, 'pids': members}

platform/core/grid_events.py

@@ -344,7 +344,7 @@ def _cohorts(ctx):
     instead. `modules.cohort.scoped` returns the module itself for the customer topic, so the
     customer path is byte-unchanged.
     """
-    return cohort_mod.scoped(ctx.scope_key)
+    return cohort_mod.scoped(ctx.scope_key, st=_store_of(ctx))
 
 
 #: The keys a stored document entry may put on the wire. ⛔ `path` IS NOT ONE OF THEM — it is the

platform/modules/cohort.py

@@ -40,13 +40,10 @@ bucket per topic (`<scope>_cohorts`), reached through `scoped(scope)`.
      `modules.cohort.visible` (the gates do) keep working through the facade, and every existing
      positional call site is byte-unaffected.
 
-TENANCY, STATED NOT HIDDEN (booked as DEBT, wave 19): this module writes through the MODULE-LEVEL
-`core.store`, i.e. tenant #0's dataset repo — the same place `customer_docs` and the customer /
-product table workspaces already live. It is safe rather than correct: the outer key is the
-USERNAME, and `core/users.py`'s registry is ONE global bucket, so a username belongs to exactly
-one tenant and no cross-tenant READ is reachable. What is wrong is RESIDENCY (tenant B's lists
-sit in tenant #0's repo). Fixing it means threading the runtime handle through `EventCtx`, which
-needs `routes_grid._ctx` — another session's file this wave.
+TENANCY: the API passes its request's ``TenantRuntime`` through ``scoped(..., st=...)``. Both list
+reads and lifecycle writes then resolve through that handle; the module-level ``core.store`` is
+only for legacy callers that have no request runtime. A sandbox or another tenant therefore
+cannot reach tenant #0's Cohort bucket merely because this module was imported there first.
 
 No validate(): there is no Odoo aggregate to reconcile a hand-picked list against. Its counts
 derive from the rows it renders (rule 8b), and the metrics themselves are already validated by
@@ -104,21 +101,26 @@ def _now():
     return _dt.datetime.now().strftime('%Y-%m-%d %H:%M')
 
 
-def _all_for(key, username):
+def _store_for(st=None):
+    """The request tenant store when supplied, else the legacy module default."""
+    return st if st is not None else store
+
+
+def _all_for(key, username, st=None):
     """{cohort_id: {name, members, note, created, updated}} for one user, from ONE bucket.
 
     Returns {} when the store is unavailable rather than raising: a cohort list that cannot load
     should degrade to "no cohorts", never to a broken page.
     """
     try:
-        return dict((store.get(key) or {}).get(username, {}) or {})
+        return dict((_store_for(st).get(key) or {}).get(username, {}) or {})
     except Exception:
         return {}
 
 
-def all_for(username):
+def all_for(username, st=None):
     """{cohort_id: {...}} for one user on the CUSTOMER book — see `_all_for`."""
-    return _all_for(KEY, username)
+    return _all_for(KEY, username, st=st)
 
 
 def _clean_members(raw, allowed_pids=None):
@@ -144,15 +146,15 @@ def _clean_members(raw, allowed_pids=None):
     return out[:MAX_MEMBERS]
 
 
-def _visible(key, username, allowed_pids=None):
+def _visible(key, username, allowed_pids=None, st=None):
     """Every cohort in ONE bucket, with membership already scoped to what this user may open."""
     return {cid: {**c, 'members': _clean_members(c.get('members'), allowed_pids)}
-            for cid, c in _all_for(key, username).items()}
+            for cid, c in _all_for(key, username, st=st).items()}
 
 
-def visible(username, allowed_pids=None):
+def visible(username, allowed_pids=None, st=None):
     """Every CUSTOMER cohort, membership scoped to what this user may open."""
-    return _visible(KEY, username, allowed_pids)
+    return _visible(KEY, username, allowed_pids, st=st)
 
 
 def new_id(name):
@@ -167,7 +169,7 @@ def new_id(name):
     return f"cohort_{slug or 'list'}_{_dt.datetime.now().strftime('%H%M%S')}"
 
 
-def _create(key, username, name, members=(), note=''):
+def _create(key, username, name, members=(), note='', st=None):
     """Create a cohort in ONE bucket and return its id. Raises ValueError on a blank name or when
     the per-user cap is reached — refusing loudly beats silently dropping somebody's list.
 
@@ -177,7 +179,7 @@ def _create(key, username, name, members=(), note=''):
     name = str(name or '').strip()[:120]
     if not name:
         raise ValueError('a cohort needs a name')
-    existing = _all_for(key, username)
+    existing = _all_for(key, username, st=st)
     if len(existing) >= MAX_COHORTS:
         raise ValueError(f'you already have {MAX_COHORTS} cohorts — delete one first')
     cid = new_id(name)
@@ -187,16 +189,16 @@ def _create(key, username, name, members=(), note=''):
     def _up(data):
         data.setdefault(username, {})[cid] = record
         return data
-    store.update(key, _up)
+    _store_for(st).update(key, _up)
     return cid
 
 
-def create(username, name, members=(), note=''):
+def create(username, name, members=(), note='', st=None):
     """Create a CUSTOMER cohort and return its id — see `_create`."""
-    return _create(KEY, username, name, members=members, note=note)
+    return _create(KEY, username, name, members=members, note=note, st=st)
 
 
-def _mutate(key, username, cohort_id, change):
+def _mutate(key, username, cohort_id, change, st=None):
     def _up(data):
         book = data.setdefault(username, {})
         c = book.get(cohort_id)
@@ -205,10 +207,10 @@ def _mutate(key, username, cohort_id, change):
         change(c)
         c['updated'] = _now()
         return data
-    store.update(key, _up)
+    _store_for(st).update(key, _up)
 
 
-def _add_members(key, username, cohort_id, pids):
+def _add_members(key, username, cohort_id, pids, st=None):
     """Union new ids into a cohort, PRESERVING the existing order and appending the new ones.
 
     Additive on purpose: "add to list" from a view can be clicked twice, and the second click
@@ -216,54 +218,54 @@ def _add_members(key, username, cohort_id, pids):
     """
     def _change(c):
         c['members'] = _clean_members(list(c.get('members') or []) + list(pids or []))
-    _mutate(key, username, cohort_id, _change)
+    _mutate(key, username, cohort_id, _change, st=st)
 
 
-def add_members(username, cohort_id, pids):
+def add_members(username, cohort_id, pids, st=None):
     """Union new ids into a CUSTOMER cohort — see `_add_members`."""
-    _add_members(KEY, username, cohort_id, pids)
+    _add_members(KEY, username, cohort_id, pids, st=st)
 
 
-def _remove_members(key, username, cohort_id, pids):
+def _remove_members(key, username, cohort_id, pids, st=None):
     drop = {int(p) for p in (pids or []) if str(p).lstrip('-').isdigit()}
 
     def _change(c):
         c['members'] = [p for p in _clean_members(c.get('members')) if p not in drop]
-    _mutate(key, username, cohort_id, _change)
+    _mutate(key, username, cohort_id, _change, st=st)
 
 
-def remove_members(username, cohort_id, pids):
-    _remove_members(KEY, username, cohort_id, pids)
+def remove_members(username, cohort_id, pids, st=None):
+    _remove_members(KEY, username, cohort_id, pids, st=st)
 
 
-def _rename(key, username, cohort_id, name):
+def _rename(key, username, cohort_id, name, st=None):
     name = str(name or '').strip()[:120]
     if not name:
         raise ValueError('a cohort needs a name')
-    _mutate(key, username, cohort_id, lambda c: c.__setitem__('name', name))
+    _mutate(key, username, cohort_id, lambda c: c.__setitem__('name', name), st=st)
 
 
-def rename(username, cohort_id, name):
-    _rename(KEY, username, cohort_id, name)
+def rename(username, cohort_id, name, st=None):
+    _rename(KEY, username, cohort_id, name, st=st)
 
 
-def _set_note(key, username, cohort_id, note):
-    _mutate(key, username, cohort_id, lambda c: c.__setitem__('note', str(note or '')[:2000]))
+def _set_note(key, username, cohort_id, note, st=None):
+    _mutate(key, username, cohort_id, lambda c: c.__setitem__('note', str(note or '')[:2000]), st=st)
 
 
-def set_note(username, cohort_id, note):
-    _set_note(KEY, username, cohort_id, note)
+def set_note(username, cohort_id, note, st=None):
+    _set_note(KEY, username, cohort_id, note, st=st)
 
 
-def _delete(key, username, cohort_id):
+def _delete(key, username, cohort_id, st=None):
     def _up(data):
         (data.get(username) or {}).pop(cohort_id, None)
         return data
-    store.update(key, _up)
+    _store_for(st).update(key, _up)
 
 
-def delete(username, cohort_id):
-    _delete(KEY, username, cohort_id)
+def delete(username, cohort_id, st=None):
+    _delete(KEY, username, cohort_id, st=st)
 
 
 def rows_for(cohort, pool_rows):
@@ -290,42 +292,43 @@ class CohortStore:
     code it already was.
     """
 
-    __slots__ = ('scope', 'key', 'noun')
+    __slots__ = ('scope', 'key', 'noun', 'st')
 
-    def __init__(self, scope):
+    def __init__(self, scope, st=None):
         self.scope = str(scope or 'customer').strip().lower()
         self.key = key_for(self.scope)
         self.noun = noun_for(self.scope)
+        self.st = st
 
     def __repr__(self):
         return f'CohortStore({self.scope!r} -> {self.key!r})'
 
     def all_for(self, username):
-        return _all_for(self.key, username)
+        return _all_for(self.key, username, st=self.st)
 
     def visible(self, username, allowed_pids=None):
-        return _visible(self.key, username, allowed_pids)
+        return _visible(self.key, username, allowed_pids, st=self.st)
 
     def create(self, username, name, members=(), note=''):
-        return _create(self.key, username, name, members=members, note=note)
+        return _create(self.key, username, name, members=members, note=note, st=self.st)
 
     def add_members(self, username, cohort_id, pids):
-        _add_members(self.key, username, cohort_id, pids)
+        _add_members(self.key, username, cohort_id, pids, st=self.st)
 
     def remove_members(self, username, cohort_id, pids):
-        _remove_members(self.key, username, cohort_id, pids)
+        _remove_members(self.key, username, cohort_id, pids, st=self.st)
 
     def rename(self, username, cohort_id, name):
-        _rename(self.key, username, cohort_id, name)
+        _rename(self.key, username, cohort_id, name, st=self.st)
 
     def set_note(self, username, cohort_id, note):
-        _set_note(self.key, username, cohort_id, note)
+        _set_note(self.key, username, cohort_id, note, st=self.st)
 
     def delete(self, username, cohort_id):
-        _delete(self.key, username, cohort_id)
+        _delete(self.key, username, cohort_id, st=self.st)
 
 
-def scoped(scope=None):
+def scoped(scope=None, st=None):
     """The cohort store for ONE topic — THE resolution point (R9).
 
     ⛔ Returns THIS MODULE for the customer topic, not a `CohortStore(KEY)`. Two reasons, and both
@@ -336,9 +339,9 @@ def scoped(scope=None):
          that returned a bound object would silently ignore the patch, leaving a gate green over
          code it is no longer exercising.
     """
-    if str(scope or 'customer').strip().lower() in LEGACY_SCOPES:
+    if st is None and str(scope or 'customer').strip().lower() in LEGACY_SCOPES:
         return _sys.modules[__name__]
-    return CohortStore(scope)
+    return CohortStore(scope, st=st)
 
 
 #: What ONE row of the customer topic is called — the module facade's answer to `CohortStore.noun`,