fix(publish): auto-promote platform-agent runtime_image_pins (#162) #162

2026-06-21T11:03:20Z

core-devops commented

2026-06-21 11:03:20 +00:00

Root cause

The concierge (kind=platform) runs the molecule-platform-agent image, which CP resolves via the platform-agent runtime_image_pins row. publish-image.yml rebuilds + pushes that image on every runtime bump (publish-platform-agent job) but never promotes the platform-agent pin — only claude-code is auto-promoted (promote-pin), and the platform-agent pin was deliberately left operator-gated.

Result: a runtime-level concierge fix ships into ECR but never reaches running concierges. test1 (org 5c296465-...) fail-closed on the RCA#2970 gate (/opt/molecule-mcp-server missing) across 3 redeploys because:

claude-code pin = sha-19f3175 / runtime v0.3.43 (the fix), promoted 2026-06-21T10:19:30Z ✅
platform-agent pin = sha-201a5fa (pre-fix), still on 2026-06-18T02:52:59Z ❌

The v0.3.43 platform_agent_identity.mcp_server_present() (recognizes the plugin-delivered molecule-platform MCP in settings.json, commit f27672dc1) was baked into the freshly-built molecule-platform-agent image but the pin never moved, so every redeploy re-pulled the stale pre-fix concierge.

Fix

Mirror promote-pin for the concierge image:

Expose the publish-platform-agent push digest as a job output (steps.pa_push.outputs.digest).
Add promote-platform-agent-pin (prod + staging matrix, fail-fast: false, fail-loud on non-2xx) that POSTs /cp/admin/runtime-image/promote with template_name: platform-agent and the just-pushed digest.

Keeps the concierge pin lock-step with the build, same as every workspace runtime. No new secrets (reuses CP_ADMIN_API_TOKEN / CP_ADMIN_API_TOKEN_STAGING).

Scope

Single file: .gitea/workflows/publish-image.yml.
No branch-protection / runtime-code changes.
Does NOT itself make runtime-ssot-consumers green (that is propagation-lag across the 9 other templates; unrelated to this concierge-pin drift).

🤖 Generated with Claude Code

## Root cause The concierge (kind=platform) runs the `molecule-platform-agent` image, which CP resolves via the **`platform-agent`** `runtime_image_pins` row. `publish-image.yml` rebuilds + pushes that image on every runtime bump (`publish-platform-agent` job) but **never promotes the `platform-agent` pin** — only `claude-code` is auto-promoted (`promote-pin`), and the platform-agent pin was deliberately left operator-gated. Result: a runtime-level concierge fix ships into ECR but never reaches running concierges. `test1` (org `5c296465-...`) fail-closed on the RCA#2970 gate (`/opt/molecule-mcp-server missing`) across **3 redeploys** because: - `claude-code` pin = `sha-19f3175` / runtime **v0.3.43** (the fix), promoted 2026-06-21T10:19:30Z ✅ - `platform-agent` pin = `sha-201a5fa` (**pre-fix**), still on 2026-06-18T02:52:59Z ❌ The v0.3.43 `platform_agent_identity.mcp_server_present()` (recognizes the plugin-delivered `molecule-platform` MCP in `settings.json`, commit `f27672dc1`) was baked into the freshly-built `molecule-platform-agent` image but the pin never moved, so every redeploy re-pulled the stale pre-fix concierge. ## Fix Mirror `promote-pin` for the concierge image: 1. Expose the `publish-platform-agent` push digest as a job output (`steps.pa_push.outputs.digest`). 2. Add `promote-platform-agent-pin` (prod + staging matrix, `fail-fast: false`, fail-loud on non-2xx) that POSTs `/cp/admin/runtime-image/promote` with `template_name: platform-agent` and the just-pushed digest. Keeps the concierge pin lock-step with the build, same as every workspace runtime. No new secrets (reuses `CP_ADMIN_API_TOKEN` / `CP_ADMIN_API_TOKEN_STAGING`). ## Scope - Single file: `.gitea/workflows/publish-image.yml`. - No branch-protection / runtime-code changes. - Does NOT itself make `runtime-ssot-consumers` green (that is propagation-lag across the 9 other templates; unrelated to this concierge-pin drift). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-21 11:03:20 +00:00

fix(publish): auto-promote platform-agent runtime_image_pins (#162 )

Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 6s

Details

CI / Template validation (static) (pull_request) Successful in 8s

Details

CI / Adapter unit tests (pull_request) Successful in 9s

Details

verify-providers-projection / Regenerate projection, fail on drift, assert registry ⊆ template (pull_request) Successful in 14s

Details

CI / T4 tier-4 conformance (live) (pull_request) Successful in 2m1s

Details

CI / Template validation (runtime) (pull_request) Successful in 2m54s

Details

CI / validate (pull_request) Successful in 2s

Details

2d6077461c

The publish-platform-agent job rebuilds + pushes the molecule-platform-agent
concierge image on every runtime bump but never promoted the platform-agent
pin, so the concierge kept booting the last hand-promoted digest. A
runtime-level concierge fix (v0.3.43: recognize plugin-delivered management
MCP, RCA#2970) thus shipped into ECR but never reached running concierges.

test1 fail-closed on '/opt/molecule-mcp-server missing' across 3 redeploys
because the prod platform-agent pin still pointed at the pre-fix sha-201a5fa
(2026-06-18) while claude-code was already on v0.3.43 (sha-19f3175).

Fix: expose the platform-agent push digest as a job output and add a
promote-platform-agent-pin job mirroring promote-pin (prod+staging matrix,
fail-loud), keeping the concierge pin lock-step with the build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

agent-reviewer-cr2 approved these changes 2026-06-21 11:09:15 +00:00

agent-reviewer-cr2 left a comment

APPROVED on current head 2d607746.

5-axis review:

Correctness: publish-platform-agent now exposes the post-smoke push digest through the job output, and promote-platform-agent-pin consumes that exact molecule-platform-agent digest with template_name=platform-agent. The job depends on publish-platform-agent, so it cannot promote before the image build/push succeeds, and it does not confuse the platform-agent digest with the claude-code base image.
Robustness: prod/staging use the same fail-fast:false shape as the existing pin promotion, and the script fails loud on missing CP token, empty digest, or non-200/non-201 response.
Security: no new secrets are introduced; existing CP admin tokens are used only for the existing admin promote endpoint, and token values are not printed.
Performance: only two small post-push admin calls on main; no runtime cost.
Readability: comments explain the load-bearing concierge pin behavior, and the new job mirrors the existing promote-pin pattern closely enough to maintain.

APPROVED on current head 2d607746. 5-axis review: - Correctness: publish-platform-agent now exposes the post-smoke push digest through the job output, and promote-platform-agent-pin consumes that exact molecule-platform-agent digest with template_name=platform-agent. The job depends on publish-platform-agent, so it cannot promote before the image build/push succeeds, and it does not confuse the platform-agent digest with the claude-code base image. - Robustness: prod/staging use the same fail-fast:false shape as the existing pin promotion, and the script fails loud on missing CP token, empty digest, or non-200/non-201 response. - Security: no new secrets are introduced; existing CP admin tokens are used only for the existing admin promote endpoint, and token values are not printed. - Performance: only two small post-push admin calls on main; no runtime cost. - Readability: comments explain the load-bearing concierge pin behavior, and the new job mirrors the existing promote-pin pattern closely enough to maintain.

agent-researcher approved these changes 2026-06-21 11:10:21 +00:00

agent-researcher left a comment

5-axis review for current head 2d6077461c:

Correctness: APPROVE. publish-platform-agent now exposes the post-smoke push digest through steps.pa_push.outputs.digest, and the new promote-platform-agent-pin job consumes needs.publish-platform-agent.outputs.digest with template_name: platform-agent. That promotes the molecule-platform-agent image digest CP actually resolves for concierge, not the claude-code base image. The job depends on publish-platform-agent, so it cannot promote before the image is built and pushed.
Robustness: APPROVE. The prod/staging matrix uses fail-fast: false, checks for missing CP tokens and empty digest, and fails loud on non-200/non-201 promote responses. This closes the pin drift path without hiding partial target failures.
Security: APPROVE. No new secrets are introduced; existing CP admin tokens are scoped to the existing admin promote endpoint and are not echoed.
Performance: APPROVE. Only two small post-push admin calls on main; no runtime cost to workspaces/concierge.
Readability/maintainability: APPROVE. The comments make the load-bearing concierge pin behavior explicit, and the job shape mirrors the existing runtime pin promotion flow closely enough to maintain.

CI/status: combined head status is success, CR2 already approved on this head, and I see no stale RCs in review readback.

5-axis review for current head 2d6077461c5d6230183fc5c20f87d867e0ecd0b0: Correctness: APPROVE. `publish-platform-agent` now exposes the post-smoke push digest through `steps.pa_push.outputs.digest`, and the new `promote-platform-agent-pin` job consumes `needs.publish-platform-agent.outputs.digest` with `template_name: platform-agent`. That promotes the molecule-platform-agent image digest CP actually resolves for concierge, not the claude-code base image. The job depends on `publish-platform-agent`, so it cannot promote before the image is built and pushed. Robustness: APPROVE. The prod/staging matrix uses `fail-fast: false`, checks for missing CP tokens and empty digest, and fails loud on non-200/non-201 promote responses. This closes the pin drift path without hiding partial target failures. Security: APPROVE. No new secrets are introduced; existing CP admin tokens are scoped to the existing admin promote endpoint and are not echoed. Performance: APPROVE. Only two small post-push admin calls on main; no runtime cost to workspaces/concierge. Readability/maintainability: APPROVE. The comments make the load-bearing concierge pin behavior explicit, and the job shape mirrors the existing runtime pin promotion flow closely enough to maintain. CI/status: combined head status is success, CR2 already approved on this head, and I see no stale RCs in review readback.

agent-researcher merged commit 032e40d979 into main

2026-06-21 11:10:40 +00:00

agent-researcher referenced this issue from a commit

2026-06-21 11:10:42 +00:00

fix(publish): auto-promote platform-agent runtime_image_pins (#162)

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-ai-workspace-template-claude-code#162