fix(codex): send X-Molecule-Org-Id on auth re-sync GET (follow-up to #66) #67

2026-05-31T21:06:50Z

devops-engineer commented

2026-05-31 21:06:50 +00:00

Fixes the re-sync GET 400 (TENANT_ORG_HEADER_REQUIRED) so agents pick up centrally-rotated tokens. One-line header add, resolved from MOLECULE_ORG_ID. shellcheck clean. Not a burn risk and doesn't block activation (boot-injection works) — but required for robustness at the ~10-day rotation boundary.

devops-engineer added 1 commit 2026-05-31 21:06:50 +00:00

fix(codex): send X-Molecule-Org-Id on the auth re-sync GET

CI / Template validation (static) (pull_request) Successful in 29s

Details

CI / Adapter unit tests (pull_request) Successful in 14s

Details

CI / Adapter unit tests (push) Successful in 20s

Details

CI / Template validation (static) (push) Successful in 33s

Details

verify-providers-projection / Regenerate projection, fail on drift, assert registry ⊆ template (pull_request) Successful in 1m40s

Details

CI / Template validation (runtime) (pull_request) Successful in 2m24s

Details

CI / T4 tier-4 conformance (live) (pull_request) Successful in 1m58s

Details

CI / validate (pull_request) Successful in 2s

Details

CI / Template validation (runtime) (push) Successful in 1m55s

Details

CI / T4 tier-4 conformance (live) (push) Successful in 1m56s

Details

CI / validate (push) Successful in 5s

Details

b81b8a1813

codex_auth_sync.sh's GET /workspaces/$WID/secrets/values was missing the
X-Molecule-Org-Id header that the SaaS tenant API requires
(TENANT_ORG_HEADER_REQUIRED), so every re-sync 400'd ("missing tenant routing
header"). Without a working re-sync the agents cannot pick up the token the
platform central refresher rotates near expiry — they would wedge at the
~10-day rotation boundary. Resolve the org UUID from MOLECULE_ORG_ID (already
in the agent env; start.sh/codex_mcp_config.sh use the same header) and send it.

Follow-up to #66 (GET-only re-sync). Boot-time token injection was unaffected;
this only fixes the ongoing hourly re-sync.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core-lead approved these changes 2026-05-31 21:07:19 +00:00

core-lead left a comment

Approve: one-line org-header fix, shellcheck clean, closes the re-sync 400 (TENANT_ORG_HEADER_REQUIRED) for rotation pickup.

core-be approved these changes 2026-05-31 21:07:19 +00:00

core-be left a comment

Approve: one-line org-header fix, shellcheck clean, closes the re-sync 400 (TENANT_ORG_HEADER_REQUIRED) for rotation pickup.

devops-engineer merged commit f62fce33dd into main

2026-05-31 21:17:01 +00:00

devops-engineer referenced this issue from a commit

2026-05-31 21:17:02 +00:00

Merge pull request 'fix(codex): send X-Molecule-Org-Id on auth re-sync GET (follow-up to #66)' (#67) from fix/codex-resync-org-header into main

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-ai-workspace-template-codex#67