Bewize Request Demo

Reference

Workspace and Company Storage Migration

Backup-first migration from legacy shared workspaces to private tenant workspaces and dedicated company storage.

Installing or upgrading Hermes Hub does not automatically move legacy workspace or company data. Run workspace migration explicitly for selected tenants:

hermes-hub workspace migrate --tenant tenant_123

Repeat --tenant to select multiple tenants. Omitting it scans all legacy workspace directories. --dry-run reports planned work without writing.

Before Migration

  1. Stop tenant activity so files cannot change while they are copied.
  2. Back up Hub configuration, SQLite, the tenant home, the legacy workspace, and relevant company/team data.
  3. Audit workspace symlinks. A symlink that resolves outside the workspace is rejected. Quarantine disposable virtual environments, dependency links, or broken developer-machine links instead of weakening this safety check.
  4. Check that the tenant home exists and that the destination is absent or is the expected legacy-workspace symlink.

Verification and Cutover

The migrator:

  • creates a staging directory inside the tenant home;
  • copies regular files, directories, and internal symlinks;
  • verifies regular-file size and SHA-256, entry kind, permissions, and symlink target;
  • ignores directory and symlink inode sizes because they vary by filesystem;
  • explicitly preserves file and directory permissions despite process umask;
  • applies tenant ownership;
  • atomically installs the staged private workspace; and
  • retains the legacy source for rollback.

The command emits a JSON report. Save it with the backup. Re-running against a matching destination returns already-migrated; a conflicting real destination is refused.

Company Data Is Separate

Migrate shared company and team content separately into the dedicated company tree. Never expose or copy the legacy agents/ workspace tree into company storage. Preserve team-relative paths and reapply the intended share-group access controls.

After both data sets are ready, reconcile tenant units and verify:

  • HERMES_WORKSPACE resolves to the private tenant workspace;
  • HERMES_COMPANY_ROOT resolves only when company/team access is granted;
  • workspace and company permissions match policy;
  • cron definitions and runtime configuration remain intact;
  • operator policy remains unchanged; and
  • Hub health and database integrity checks pass.