338 Commits

Author	SHA1	Message	Date
claude-ceo-assistant	5c0a48f0f5	fix(ci): make prod deploy wait on aggregate context	2026-05-23 22:09:50 -07:00
claude-ceo-assistant	7da843f2fa	fix(ci): move all-required to meta runner lane	2026-05-23 20:55:06 -07:00
claude-ceo-assistant	df94fd1764	fix(ci): keep production auto-deploy nonblocking	2026-05-23 15:01:39 -07:00
agent-dev-a	8346b06291	Merge pull request 'fix(ci): arm64 pilot runs-on label matches Mac mini registration' (#1744) from fix/arm64-pilot-label into main	2026-05-23 21:57:42 +00:00
agent-dev-b	b7da21063e	fix(ci): guard review-check against empty PRs (head == base) (#1743) ... Co-authored-by: agent-dev-b <agent-dev-b@agents.moleculesai.app> Co-committed-by: agent-dev-b <agent-dev-b@agents.moleculesai.app>	2026-05-23 21:56:43 +00:00
Molecule AI Dev Engineer B (MiniMax)	213ea06840	fix(ci): arm64 shellcheck pilot resilience ... - Add continue-on-error on Install shellcheck step - Add command -v check before running shellcheck (skip if binary missing, exit 0 — pilot mode) - Add continue-on-error on Run shellcheck step The arm64-darwin Mac mini pilot runner may not have shellcheck pre-installed; this makes the workflow resilient rather than failing. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-23 21:52:36 +00:00
Molecule AI Dev Engineer A (Kimi)	f07dfa7af6	ci: add internal#418 tracker for arm64 advisory continue-on-error (#1731) ... The lint-continue-on-error-tracking script requires a tracker comment within 2 lines of every advisory continue-on-error directive. This adds the missing internal#418 tracker to ci-arm64-advisory.yml. Fixes #1731	2026-05-23 21:49:44 +00:00
Molecule AI Dev Engineer A (Kimi)	e5d6e45ab1	fix(ci): arm64 pilot runs-on label matches Mac mini registration (#1679) ... Mac mini registers with labels self-hosted, macos-self-hosted-arm64, arm64-darwin — no plain 'arm64'. The workflow was perpetually CANCELLED because Gitea could not assign a runner. Fixes #1679	2026-05-23 21:40:46 +00:00
claude-ceo-assistant	a1cf56cdab	fix(ci): use writable Docker config for canvas publish	2026-05-23 14:11:53 -07:00
hongming	e05fc4daae	ci(arm64): ADVISORY Mac arm64 fast-check lane (Pilot ②, internal#418 relief) (#1442)	2026-05-23 11:08:57 +00:00
core-fe	3112f394eb	fix(ci): path-scope main push heavy checks	2026-05-21 23:51:16 -07:00
core-fe	3a82e1f1b1	fix(e2e): use stable MiniMax model default	2026-05-21 22:34:42 -07:00
hongming	adaaa2a1f8	PR_TITLE ... PR_BODY	2026-05-22 01:10:09 +00:00
infra-sre	1c76713d71	fix: align tier refire with canonical SOP gate	2026-05-21 17:47:08 -07:00
core-fe	3e28bf5943	Fail E2E teardown on leaked EC2	2026-05-21 17:13:42 -07:00
core-fe	07d3dcd988	Use literal region for AWS secrets janitor	2026-05-21 14:42:23 -07:00
core-fe	e123d07898	Make AWS secrets janitor fail loud	2026-05-21 13:50:18 -07:00
hongming	22fbf43580	Restore AWS secrets janitor schedule (#1651) ... Restore the hourly AWS Secrets Manager janitor after provisioning the dedicated staging janitor IAM key and mirroring it through Infisical/Gitea secrets.	2026-05-21 20:39:31 +00:00
core-fe	a47307969c	Restore AWS secrets janitor schedule	2026-05-21 13:35:16 -07:00
core-devops	119743d0de	test(e2e): forbid dev token path in staging peer visibility	2026-05-21 13:21:45 -07:00
core-fe	55e8c2d347	chore(ci): publish tenant image to staging ecr via ssot publisher	2026-05-21 13:00:28 -07:00
core-fe	7081a8e900	chore(ci): mirror tenant image to staging ecr	2026-05-21 12:31:54 -07:00
core-fe	f5dc55f1d1	chore(e2e): retrigger peer visibility after publish fix	2026-05-21 11:18:34 -07:00
core-fe	fc7498fef0	fix(ci): isolate publish buildx docker config	2026-05-21 10:37:48 -07:00
core-fe	8fc27f4d69	ci: compensate cancelled push status noise	2026-05-21 00:19:56 -07:00
hongming	704a8ab7de	Merge pull request #1634 ... ci: path-scope required CI lanes on PRs	2026-05-21 06:59:25 +00:00
core-fe	e358b9b92f	ci: fix PR path filter base diff	2026-05-20 23:12:27 -07:00
core-devops	7f59b7fd35	fix(watchdog): add HEAD-recheck + settling delay to suppress cancel-cascade false-positives (#1635)	2026-05-21 06:08:40 +00:00
core-fe	c37caa2ec9	ci: share path filter helper	2026-05-20 22:32:17 -07:00
core-fe	6e77083b84	ci: path-scope shellcheck on prs	2026-05-20 22:20:02 -07:00
core-fe	3a3f670662	ci: path-scope canvas on prs	2026-05-20 22:17:30 -07:00
core-fe	30a8aa10b8	ci: path-scope platform go on prs	2026-05-20 22:02:54 -07:00
hongming	a1cfd085a8	Merge pull request 'chore(runtime): delete core workspace copy' (#1620) from chore/delete-core-workspace-runtime into main	2026-05-21 04:23:33 +00:00
core-fe	16b203fff1	ci: keep browser e2e out of normal pr path	2026-05-20 21:02:33 -07:00
core-devops	e62db981e8	fix(core): keep docker mode in chat e2e	2026-05-20 20:36:36 -07:00
core-devops	679314aa8f	fix(core): keep chat e2e echo url local	2026-05-20 20:29:04 -07:00
core-fe	a9bc5e39d5	ci: reduce scheduled runner load and prep prebaked browsers	2026-05-20 17:36:09 -07:00
core-devops	f088e0ee90	fix(core): decouple local peer visibility from container boot	2026-05-20 16:56:04 -07:00
core-devops	4c290f49f2	fix(core): make e2e auth explicit after token bootstrap	2026-05-20 15:20:31 -07:00
core-devops	f13a675408	fix(core): use runtime package in e2e after workspace deletion	2026-05-20 15:03:38 -07:00
core-devops	9aa4764301	chore(runtime): delete core workspace copy	2026-05-20 14:47:55 -07:00
core-devops	7932bc4c48	chore(ssot): delete dead .github/workflows/ — Gitea is SSOT (#331 SSOT-Instance-4) ... Per CTO directive 2026-05-20 and task #347 (disabled GitHub-mirror push fleet-wide), .github/workflows/ on molecule-core is dead — Gitea Actions reads .gitea/workflows/ exclusively (memory: reference_molecule_core_actions_gitea_only), and GitHub Actions has had no real push activity since 2026-05-06 (the only post-2026-05-06 runs are dynamic CodeQL re-runs on frozen pre-suspension PRs). Empirical validation: - 24 files total in .github/workflows/. - 23 have same-name siblings in .gitea/workflows/ (port carries "Ported from .github/workflows/X on 2026-05-11 per RFC internal#219" header on most files). - 1 .github-only file: canary-staging.yml — already ported to .gitea/workflows/staging-smoke.yml on 2026-05-11 per the same RFC, Hongming directive renamed canary→smoke. Verified via header comment in staging-smoke.yml. - Last GitHub-side push event: 2026-05-06T07:06:12Z (pre-suspension). - All 24 .github/workflows/* files removed. Tooling updates needed (load-bearing): - tools/branch-protection/check_name_parity.sh: hard-coded $REPO_ROOT/.github/workflows path → switched to .gitea/workflows. Pre-existing parity findings (3x Analyze CodeQL names absent from any workflow file) are unchanged — that drift exists pre-PR and is out-of-scope (file as follow-up). - tools/branch-protection/test_check_name_parity.sh: synthetic test fixtures now create .gitea/workflows/ instead of .github/workflows/. All 6 unit tests pass after change. - .gitea/workflows/lint-required-workflows-docker-host-pinned.yml: dropped '.github/workflows/**' from path-filter triggers + dropped '.github/workflows' from the python directory-walk loop (the isdir-check would have made this a no-op cleanly, but pruning reflects current truth). Out-of-scope (NOT touched in this PR): - .github/CODEOWNERS, .github/dependabot.yml, .github/scripts/ remain (task is scoped to .github/workflows/). - COVERAGE_FLOOR.md, workspace/smoke_mode.py, workspace/main.py contain comment references to .github/workflows/* — stale docs string-references only, not behavioral. Separate follow-up. - Provenance comments inside .gitea/workflows/* of the form "Ported from .github/workflows/X on 2026-05-11" are intentionally preserved — useful history. Refs: task #331 (SSOT-Instance-4), task #347 (mirror push disabled), memory reference_molecule_core_actions_gitea_only, memory reference_per_repo_gitea_vs_github_actions_dir, RFC internal#219 §1 (the original 2026-05-11 port sweep).	2026-05-20 09:29:33 -07:00
core-devops	dd3090c894	Merge pull request 'ci: SSOT-Instance-10 — ECR registry via vars.ECR_REGISTRY (#333)' (#1611) from chore/ssot10-ecr-registry-var into main	2026-05-20 13:04:05 +00:00
core-devops	896afc5bd7	ci: SSOT-Instance-10 — ECR registry via vars.ECR_REGISTRY (#333) ... The ECR registry triplet (account.dkr.ecr.region.amazonaws.com = 153263036946.dkr.ecr.us-east-2.amazonaws.com) is currently hardcoded in every publish/verify workflow across 4+ repos. Switching AWS accounts or regions means touching every workflow. Refactor each affected workflow's env block to source the triplet from `vars.ECR_REGISTRY` with the current prod-account literal as a bootstrap fallback. Once the org-level variable is set, the fallback becomes dead code and an account/region migration is a one-line change at the org level instead of N PRs. Pattern mirrors `vars.CP_URL || 'https://api.moleculesai.app'` already in use in molecule-core/staging-verify.yml + redeploy-tenants-on-main.yml — proven to work on Gitea 1.22.6. Constraints honored: - No cross-repo `uses:` (blocked on 1.22.6 per feedback_gitea_cross_repo_uses_blocked). - No new admin-required setup (the org-level var can be set later by CTO without touching these workflows again). - Zero functional change today (fallback literal == current hardcoded value), so the in-flight cascade (publish → ECR → redeploy-fleet) is unaffected.	2026-05-20 05:27:54 -07:00
core-devops	a224b26c0f	fix(sop-checklist): stream comment pagination + RLIMIT_AS guardrail + na-gate fallback ... PRs with thousands of bot-relay comments (e.g. mc#1242-class history) pushed `get_issue_comments` past the runner's cgroup memory cap and 137'd the gate job. Sub-agent aa8fa266 verified via SHA64 1:1 mapping that the leak source is `.gitea/scripts/sop-checklist.py:463-484` — a `while True` pagination that accumulates the FULL Gitea-API comment dict (~2 KiB median, ~3 KiB p95) into one list, then iterates it twice (compute_ack_state + compute_na_state). Fix shape (task #369): 1. `get_issue_comments` now projects to a minimal `{user.login, body}` shape during pagination — drops html_url, pull_request_url, assets, created_at/updated_at, user.avatar_url, etc. Synthetic benchmark on a 5000-comment fixture: 8.2 MiB → 5.5 MiB peak heap (~33% smaller). 2. New `iter_issue_comments` generator yields one minimal-dict per comment, allowing future streaming consumers. 3. Per-comment body cap (8 KiB, env-tunable) — the directive parser only walks for ^/sop-* markers in the first few KiB; a single pasted-CI-log comment can no longer OOM the runner. 4. Script-entry `RLIMIT_AS = 2 GiB` (skipped under SOP_CHECKLIST_NO_RLIMIT=1 for the test suite) so any future regression surfaces as a catchable MemoryError instead of SIGKILL. 5. `--max-comments` cap (default 5000, env-tunable) — at the cap we post a SOFT pending status with a `[volume-skipped]` note so neither BP nor the author gets stuck. No-block. 6. Fold in `probe()` n/a-gate fallback (was issue-355-class KeyError 'security-review'): when called from `compute_na_state` with a gate name that isn't also an item slug, fall back to the gate's own `required_teams` from config instead of KeyError'ing on `items_by_slug[slug]`. Tests: 88/88 pass (87 existing + 8 new for streaming + body-cap + na-gate fallback). Live dry-run against open PR #1608 succeeds end- to-end with state=failure (expected, no acks yet) — minimal-dict shape flows cleanly through compute_ack_state + render_status. Closes #369 follow-up to #364 OOM source. RCA: sub-agent aa8fa266 (SHA64 1:1 mapping, no overlap-correlation). Supersedes mis-targeted attempts #365 (qa-review/security-review bash) and #366 (workflow yaml). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-20 05:25:05 -07:00
infra-sre	6602361bf5	ci(publish-runtime): dual-push to Gitea PyPI primary + PyPI fallback (RFC#596 Phase 2) (#1585) ... Co-authored-by: infra-sre <infra-sre@agents.moleculesai.app> Co-committed-by: infra-sre <infra-sre@agents.moleculesai.app>	2026-05-20 10:19:50 +00:00
hongming-pc2	02e305f6f5	chore(ci): retrigger publish-workspace-server-image after EACCES hotfix on PC2 WSL publish-2 (#1600) ... chore(ci): retrigger publish-workspace-server-image after EACCES hotfix on PC2 WSL publish-2 (#1600) Trigger-only � 8-line doc-comment in workflow header. Hot-patched the buildx/certs dir perms on the WSL publish runner. The push:main triggers publish-workspace-server-image.yml; the image rebuild from the unchanged main HEAD lands platform-tenant:staging-<sha> in ECR, unblocking the mc#1589 cascade (CP scoped redeploy + reno-stars 94MB PDF retry).	2026-05-20 09:40:36 +00:00
infra-sre	349d3a5ca7	fix(ci): add confirm:true to redeploy-fleet callers (cp#228 contract) (#1595) ... Closes follow-up to cp#228 (44317b0). Adds confirm:true to all 4 fleet-wide callers of /cp/admin/tenants/redeploy-fleet (publish-workspace-server-image via prod-auto-deploy.py + redeploy-tenants-on-main + redeploy-tenants-on-staging + staging-verify). Pairs with cp#228 TestRedeployFleet_ConfirmTrueProceeds. 2 APPROVES from core-devops + core-qa (both independent of cp#228 author devops-engineer and this PR author infra-sre). Co-authored-by: infra-sre <infra-sre@agents.moleculesai.app> Co-committed-by: infra-sre <infra-sre@agents.moleculesai.app>	2026-05-20 08:15:06 +00:00
devops-engineer	def11782f4	ci: add bp-exempt directive to renamed scan emission (#1593) ... The workflow-name rename in 979064f9 creates a new context emission ('Lint no tenant GITEA or GITHUB token write / Scan ...') that the lint_required_context_exists_in_bp (Tier 2g) gate flags as undeclared. The scan job is advisory (PR-review-driven, not BP-required), so the directive is bp-exempt rather than bp-required: pending. Verified locally: re-running the gate script with BASE/HEAD now exits 0 (no missing directives, no asymmetry).	2026-05-20 00:47:10 -07:00
devops-engineer	979064f90a	fix(ci): drop slash from lint-no-tenant-gitea-token name (task #307) ... The workflow's `name:` field contained `GITEA/GITHUB`, which trips `lint-workflow-yaml` Rule 3 (slash in workflow name breaks `<workflow> / <job> (<event>)` status-context tokenization). On 2026-05-20 aa375b1f this fatal lint blocked the Production auto-deploy job on `publish-workspace-server-image`, forcing a manual `redeploy-fleet` curl. Rename to "Lint no tenant GITEA or GITHUB token write" (the linter already documents `-` or space as the supported separators). Verification: - Pre-fix: `python3 .gitea/scripts/lint-workflow-yaml.py` → exit 1, Rule 3 FATAL on lint-no-tenant-gitea-token.yml. - Post-fix: same command → exit 0, 'no fatal Gitea-1.22.6-hostile shapes', and `pytest tests/test_lint_workflow_yaml.py` 27/27 pass. Surface unchanged: workflow still triggers on the same pull_request and push events; only the human-readable display name shifts.	2026-05-20 00:35:38 -07:00