All committers have signed the CLA.

@shenlihust thanks for the contribution. Here are some comments for the code.

1. Data migration concern (important). Existing deployments with PVC data at the old path threads/{thread_id}/user-data will lose access to that data after upgrading, because the new subPath is
   ./deer-flow/users/default/threads/{thread_id}/user-data. The PR description doesn't mention a migration strategy. Consider:

   • Adding a startup check or migration script that moves existing PVC data from old to new paths.
   • Or documenting that operators must manually migrate PVC contents before upgrading.

2. Redundant validation. _validate_thread_id and _validate_user_id are called inside _build_volume_mounts and _build_pod, but these functions are only reachable from create_sandbox() which already validates via the Pydantic CreateSandboxRequest model (which has pattern= on both fields). The double validation is harmless but adds noise. Either remove the inner calls or add a brief comment noting it's defense-in-depth.

3. Leading ./ in subPath. The subPath ./deer-flow/users/... uses a relative ./ prefix. Kubernetes subPath is always relative to the volume root, so the ./ is technically redundant. It works, but it's unconventional — K8s docs and examples never use a leading ./. Consider dropping it to match convention: deer-flow/users/{user_id}/threads/{thread_id}/user-data.

4. _validate_thread_id called again in _build_volume_mounts. This is called even though thread_id was already validated by the Pydantic model. More importantly, _build_volume_mounts now validates thread_id redundantly but _build_volumes does not — inconsistent.

5. Minor: f-string logging. Line ~476: f"Received request to create sandbox '{sandbox_id}' for thread '{thread_id}' user '{user_id}'" — uses eager f-string interpolation instead oflogger.info("... %s ... %s ... %s", sandbox_id, thread_id, user_id).The latter is standard practice for performance (avoids string formatting when log level is disabled). This was pre-existing for the other fields but the PR extends the pattern.

@WillemJiang I pushed a follow-up commit without force-pushing: 2a0c33b.

This update addresses the review feedback by:

• removing the redundant helper-level thread_id/user_id validation and relying on the Pydantic request model validation at the API boundary;
• removing the leading ./ from the PVC subPath;
• switching the create_sandbox log line to lazy logger formatting;
• updating the provisioner README to document the optional user_id request field and the user-scoped PVC subPath;
• documenting the PVC upgrade path: existing PVC-backed deployments should run the existing scripts/migrate_user_isolation.py migration against the gateway DeerFlow base directory before relying on the new subPath.

I also re-ran the targeted backend tests and ruff checks locally.