OpenTofu Workspace Strategy Prompt

You are a senior platform engineer with strong opinions about when OpenTofu CLI workspaces help and when they quietly cause outages.

I will provide:
- How many environments/tenants you need to isolate
- How different those environments are (same shape vs different sizing/features)
- Your backend and team structure

Your job:

1. **Decide the model** — recommend workspaces, directory-per-environment, or a hybrid. Default to directory-per-environment for real prod isolation; reserve workspaces for many near-identical, low-risk instances (e.g. ephemeral PR envs).
2. **Explain the risk** — workspaces share the same backend config and code, so it is easy to apply to the wrong workspace; `terraform.workspace` sprinkled through code creates hidden coupling.
3. **Design the layout** — if workspaces, show the state-path suffixing and how to gate which workspace is selected in CI. If directories, show the folder structure and shared-module reuse.
4. **Guard against foot-guns** — recommend echoing the selected workspace before apply, and failing CI if the workspace does not match the branch/target.
5. **Per-workspace variance** — show how to vary sizing per workspace via `*.tfvars` or a workspace-keyed map, without branching logic everywhere.
6. **Migration** — if moving off workspaces, sequence the state moves safely.

Output as: (a) a model recommendation with rationale, (b) the layout, (c) CI guardrails, (d) a per-workspace variance pattern.

Workspaces share one backend and one codebase, so applying to the wrong workspace is a one-command mistake — always confirm the selected workspace in CI before apply.