slim(parent-template): extract dev tree → symlink to molecule-dev-department, delete 17 orphans (Phase 3d) #5
Loading…
Reference in New Issue
Block a user
No description provided.
Delete Branch "slim/extract-dev-into-symlink"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Phase 3d of internal#77. Final structural change of the dev-department extraction. After this PR + the dev-department-side merges (#1, #2, #3), this template contains only parent-only roles (PM + Research + Marketing) — the entire engineering org tree is composed in via a single
dev-leadsymlink to the sibling repo.Tree shape after this PR
What changed (numbers)
dev-lead → ../molecule-dev-department/dev-lead/.org.yaml workspaces:adds third root!include dev-lead/workspace.yaml.teams/pm.yaml children:removes dev/doc-spec/triage-op/triage-op-2 references (they moved to dev tree or were orphans).teams/marketing.yaml children:removes devrel-engineer reference (orphan).Repo size drops from ~567 KiB to ~150 KiB. Workspace count drops from 50+ to 11 (PM + Research × 4 + Marketing × 6). The dev tree's 28 workspaces are composed in at import time via the symlink.
Symlink contract
The
dev-leadsymlink at template root targets../molecule-dev-department/dev-lead/— a RELATIVE path that resolves correctly when both repos are cloned as siblings under the operator's/org-templates/directory. The platform's import resolver (workspace-server/internal/handlers/org_include.go:resolveYAMLIncludes) operates on path strings viafilepath.Abs/filepath.Rel(does NOT follow symlinks at the security check), sodev-lead/workspace.yamlpasses the in-root check. The actual file open usesos.ReadFilewhich DOES follow the symlink, delivering content from the sibling repo.This contract is empirically pinned by tests in molecule-core PR #102 —
TestResolveYAMLIncludes_FollowsDirectorySymlinkproves the resolver follows directory symlinks across repo boundaries while the security check stays sound.Operator-side deploy contract
For this template to import correctly, both repos must be cloned as siblings:
The operator's existing convention already uses unprefixed dir names (
molecule-dev,reno-stars, etc.). Adding the second repo means:If the operator clones with a different dir name, the symlink target needs to match. Documented for the deploy runbook.
Hostile self-review (SOP Phase 4)
POST /org/importagainst this template will fail with 'target does not exist' on the dev-lead symlink. Mitigation: deploy step needs to ensure the sibling clone exists before any/org/importcall referencing this template.git log -- core-be/will now show only the deletion commit, not the original creation/edit history. Acceptable tradeoff for the structural cleanup.POST /org/importon a staging tenant. That's Phase 4 (task #226) — happens after this merges. Local Python validator surfaces a false-positive on the symlink-resolved-outside-root path, but the actual platform Go resolver passes it (per the molecule-core PR #102 tests). The validator-vs-platform divergence is a known follow-up — filed separately.Refs
Phase 3d of internal#77 (dev-department extraction). What changed: Deletions: - 17 orphan workspace folders not reachable from any teams/*.yaml !include chain in this template (caught at extract time by validate-tree.py): backend-engineer{,-2,-3}, frontend-engineer{,-2,-3}, qa-engineer{,-2,-3}, security-auditor{,-2}, platform-engineer, devops-engineer, sre-engineer, offensive-security-engineer, devrel-engineer, triage-operator-2, uiux-designer. - 27 dev-tree workspace folders extracted to molecule-ai/molecule-dev-department (history preserved via git filter-repo): dev-lead, core-{lead,be,fe,qa, security,uiux,devops,offsec}, cp-{lead,be,qa,security}, app-{lead,fe,qa}, technical-writer, infra-{lead,sre,runtime-be}, sdk-{lead,dev}, plugin-dev, release-manager, integration-tester, fullstack-engineer, documentation-specialist, triage-operator. - 8 teams/<dev-tree>.yaml composition files (dev.yaml, core-platform.yaml, controlplane.yaml, app-docs.yaml, infra.yaml, sdk.yaml, documentation-specialist.yaml, triage-operator.yaml). Additions: - dev-lead → ../molecule-dev-department/dev-lead/ (symlink). Resolves correctly when both repos are cloned as siblings under operator's /org-templates/ (current convention: /org-templates/molecule-dev/ + /org-templates/molecule-dev-department/). Platform's resolveYAMLIncludes follows the symlink at file-read while its security check (filepath.Abs/Rel) operates on path strings, so 'dev-lead/workspace.yaml' counts as 'inside parent root' even though its content lives in the sibling repo. Contract pinned by molecule-core PR #102's tests. Edits: - org.yaml workspaces: gains '!include dev-lead/workspace.yaml' (third root after pm.yaml + marketing.yaml). The other two roots are unchanged. - teams/pm.yaml children: removed dev.yaml, documentation-specialist.yaml, triage-operator.yaml, triage-operator-2 (orphan). Comments document where each moved. - teams/marketing.yaml children: removed devrel-engineer (orphan). This template is now ~50% smaller and contains only parent-only roles: PM + Research (research-lead, market-analyst, technical-researcher, competitive-intelligence) + Marketing (marketing-lead, content-marketer, product-marketing-manager, community-manager, seo-growth-analyst, social-media-brand). Engineering org tree is composed in via the dev-lead symlink + dev-department repo. Refs: internal#77 — extraction RFC molecule-ai/molecule-dev-department PRs #1, #2, #3 (scaffold + extract + atomize) molecule-core PR #102 — symlink-resolution contract test Hongming GO 2026-05-08 ("approved, keep going" + "dont wait for me, follow the plan") SOP Phase 3d — task #225