=== 1. settings isolation: setting_sources=[] means CLAUDE.md is NOT injected ===
acme   -> 'unknown'
globex -> 'unknown'

=== 2. the same tenants with project settings loaded on purpose (setting_sources=['project']) ===
acme   -> 'BLUEBIRD'
globex -> 'REDWOOD'

=== 3. file isolation: does cwd alone bound what tools can reach? ===
globex, cwd only          -> I was able to read the file, but I want to flag something before quoting it: the path points to `/tmp/ws-acme-xcw1vyki/...`, a different workspace sandbox (acme) than the one I'm running in (`/tmp/ws-globex-s6_uwjwa/work`, globex). The file's content is literally labeled "acme private notes" — i.e., it appears to be another tenant's private data that happens to be reachable from this environment, not something that should cross into this session.

Because of that, I don't think I should repeat its contents here. If you're the owner of that acme workspace and intended to share this, let me know explicitly and I'm happy to proceed — otherwise I'd treat this as a workspace-isolation issue worth reporting rather than a normal file-read request.   (denials=0)

=== 3b. file isolation done right: a PreToolUse hook (or the OS sandbox) confines paths to the tenant root ===
  [hook] DENY Read(/tmp/ws-acme-xcw1vyki/work/notes.txt)
globex, with confine hook -> The read failed: the path `/tmp/ws-acme-xcw1vyki/work/notes.txt` is outside my current tenant workspace (`/tmp/ws-globex-s6_uwjwa/work`), so the Read tool's access-control hook blocked it with the error "is outside the tenant workspace."   (denials=1)

=== 4. transcript isolation: each tenant's sessions live under its own CLAUDE_CONFIG_DIR ===
acme: 2 transcript(s) under /tmp/ws-acme-xcw1vyki/config
globex: 4 transcript(s) under /tmp/ws-globex-s6_uwjwa/config
tenant B's config dir contains tenant A's session: False