feat(entrypoint): boot-install declared plugins (#32 keystone) #136

2026-06-17T15:23:56Z

core-devops commented

2026-06-17 15:23:56 +00:00

Installs the workspace's declared plugins (MOLECULE_DECLARED_PLUGINS desired-set) into /configs/plugins at container start, before serving — so skills survive the ephemeral-instance restart. Box-side gitea:// fetch via the read-only PAT; only the source list rides the provision env. Verified: sh -n + shellcheck clean; functional dry-run fetched+extracted the real seo-all skill (234KB, SKILL.md present). Pairs with core MOLECULE_DECLARED_PLUGINS producer. 🤖

core-devops added 1 commit 2026-06-17 15:23:56 +00:00

feat(entrypoint): boot-install declared plugins into /configs/plugins (#32 keystone)

CI / Template validation (static) (push) Successful in 8s

Details

CI / Adapter unit tests (push) Successful in 10s

Details

Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s

Details

CI / Template validation (static) (pull_request) Successful in 7s

Details

CI / Adapter unit tests (pull_request) Successful in 9s

Details

verify-providers-projection / Regenerate projection, fail on drift, assert registry ⊆ template (pull_request) Successful in 24s

Details

CI / T4 tier-4 conformance (live) (pull_request) Successful in 36s

Details

CI / T4 tier-4 conformance (live) (push) Successful in 2m6s

Details

CI / Template validation (runtime) (push) Successful in 2m53s

Details

CI / validate (push) Successful in 1s

Details

CI / Template validation (runtime) (pull_request) Successful in 2m23s

Details

CI / validate (pull_request) Successful in 0s

Details

6f600e0d53

agent-skills are plugins, installed dynamically — but a SaaS "restart" is a full
ephemeral re-provision (fresh instance + disk), so a plugin pushed post-online
lived only on the destroyed instance and vanished on every restart (root-caused
2026-06-17 from live box logs: install succeeds → auto-restart re-provisions a
new instance → /configs/plugins gone → reconcile skips on the stale tracking
row). /configs is re-rendered every boot; this brings plugins onto the same
every-boot model.

The entrypoint (root, before the gosu drop) reads MOLECULE_DECLARED_PLUGINS (the
DB desired-set, comma-separated gitea:// sources, stamped into the box env by the
CP) and fetches each via the Gitea archive API using the read-only PAT already
in this container's env, landing it at /configs/plugins/<name>/ BEFORE the agent
serves. Loop-free (present before serving → no online→install→restart), survives
ephemeral re-provision, and only the small source LIST rides the provision env —
never the skill content — so it never hits the user-data 16 KiB cap.

Verified: sh -n + shellcheck -S error clean; functional dry-run fetched+extracted
the real private seo-all skill (234 KB archive, SKILL.md present) via the parser.
Fail-soft: per-source error handling, never blocks boot.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

molecule-code-reviewer approved these changes 2026-06-17 15:51:37 +00:00

molecule-code-reviewer left a comment

Reviewed: entrypoint boot-install; shellcheck+functional-dryrun verified (real seo-all fetch). APPROVE.

core-security approved these changes 2026-06-17 15:51:38 +00:00

core-security left a comment

Reviewed: entrypoint boot-install; shellcheck+functional-dryrun verified (real seo-all fetch). APPROVE.

core-devops merged commit 389894b3f0 into main

2026-06-17 15:51:39 +00:00

core-devops deleted branch fix/rfc2843-32-plugin-boot-install

2026-06-17 15:51:39 +00:00

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-ai-workspace-template-claude-code#136