fix: use sudo/root to create /workspace symlink in manifest entrypoint

The previous commit moved the pi-agent repo mount from /workspace to
/home/user/{repo_name}. This exposed a permission bug: the Dockerfile
creates /workspace as a root-owned symlink in the image, and the
non-root entrypoint could not replace it because / is owned by root.

- Update compile_entrypoint to recreate /workspace via sudo when running
  as the container user, or directly when running as root
- Add unit test covering sudo/root symlink creation
- Update OpenSpec change docs with the additional root cause

Quality gates:
- pytest tests/unit: 208 passed
- ruff: clean on changed files
- mypy: clean on changed files
- alembic heads: single head
This commit is contained in:
Developer
2026-06-14 20:29:03 +00:00
parent fe82a248ec
commit bd94cc9bbf
16 changed files with 53 additions and 26 deletions
+1 -1
View File
@@ -7,7 +7,7 @@ index: apps/.pi-map.index.md
Contains the main application entry points and executable modules for the project.
## files
## arch
Modular application structure with separate deployable units, typically following framework-specific patterns (e.g., MVC, MVVM, or component-based architecture depending on the stack).
Modular application architecture with separate deployable units, likely following microservices or layered architecture patterns with domain-driven organization.
## tags
-
## symbols