Workspace isolation inverts user/channel hierarchy — artifacts split across channels for the same user BUG?

Summary

The per-user workspace is scoped by channel first, then user. This means a user who interacts via multiple channels has their artifacts scattered across separate directories with no unified home. This is the opposite of isolation.

Observed behavior

Verified via POST /v1/chat/completions and WebSocket chat.send (tenant-scoped API key, predefined agent type):

tenants/{slug}/ws/{userID}/artifact.txt ← WebSocket session
tenants/{slug}/http/{userID}/artifact.txt ← HTTP session
tenants/{slug}/telegram/{userID}/artifact.txt ← Telegram

Same user, same agent, same tenant — three different filesystem homes.
This behavior appears to contradict multi-tenant isolation goals. Is it design-intent or bug?

Root cause

internal/store/pg/agents_context.go, GetOrCreateUserProfile:

effectiveWs = filepath.Join(effectiveWs, channel) // channel appended first
// then in loop_context.go, userID appended second via UserChatLayer

Expected behavior ?

User is the primary isolation boundary. Channel is a subdirectory under the user:

tenants/{slug}/{userID}/ws/
tenants/{slug}/{userID}/http/
tenants/{slug}/{userID}/telegram/

One-line fix:
// instead of:
effectiveWs = filepath.Join(effectiveWs, channel)
// should be:
effectiveWs = filepath.Join(effectiveWs, userID, channel)

(with corresponding removal of the UserChatLayer(userID) append downstream)

Impact

Any multi-channel deployment, a user's workspace context — files, artifacts, outputs — does not persist or accumulate across channels. Memory (DB-backed) is shared correctly; only the filesystem workspace is affected.

Read internal/store/pg/agents_context.go at GetOrCreateUserProfile and trace the downstream UserChatLayer(userID) path construction in loop_context.go. Reproduce the HTTP and WebSocket cases described in the issue, then verify that the same user's artifacts resolve under one tenant/user workspace with channel-specific subdirectories and no duplicate userID append.