Isolation by default

A space is a sealed unit. It cannot see, query or touch another space — not because a rule forbids it, but because there is no mechanism by which it could. On most multi-tenant platforms isolation is something you add: a tenant column, a WHERE clause, a permission check on every query, each of which someone has to remember to write. CTXR turns that around. Isolation is the default shape of the system, and crossing it would be the thing you’d have to deliberately build.

The boundary is the folder

This follows directly from being file-based. A space is a directory on disk, and everything that belongs to it lives inside that directory. The boundary between two spaces is therefore physical — two different folders — not a condition in a shared query that could be forgotten or bypassed. There is no shared database, no global user table, no index that spans tenants. An editor or key from one space is simply unknown in another, the way one folder knows nothing of the contents of another.

Decided before any code runs

Isolation holds at the very front door. When a request arrives, the platform resolves which space it belongs to from the subdomain, before any other logic executes. There is no moment in which a request exists without a space attached — and so there is no “what if a crafted request crosses tenants”, because the question has already been answered before the request handler does anything. Every read and write downstream is scoped to that one tenant by construction, not by a check that has to fire correctly each time.

Default, not opt-in

The phrase “by default” is the whole point. You don’t switch isolation on, and you can’t accidentally switch it off. Safety here is a property of the structure, not a reward for vigilance — the common multi-tenant failure (one tenant quietly reading another’s data) isn’t guarded against, it’s impossible to express. The full account of how this is enforced, alongside the other layers built on top of it, lives in the security model; the space-level view is in What is a space.

Why this is a foundation

Isolation is the premise the next idea answers. If nothing crosses between spaces, then how does a space ever get content that originated elsewhere — a starter site, a shared folder, a snapshot from a partner? Not by reaching in, because reaching in does not exist. It gets a copy, taken at a moment and autonomous ever after. That move — the only way anything travels between sealed units — is the adoption model, and it only makes sense once you accept that isolation comes first.