fix(plugins): log silently ignored execAsRoot errors during uninstall

Plugin uninstall had two sites where execAsRoot errors were discarded:
- Skill directory removal (plugins_install.go:125) — orphaned skill dirs
  if rm -rf failed silently
- CLAUDE.md marker stripping (plugins_install_pipeline.go:326) — stale
  plugin content left in CLAUDE.md if awk script failed

Both now log the error without failing the overall uninstall (best-effort
 cleanup), giving operators visibility into incomplete uninstalls.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -51,7 +51,7 @@ MOLECULE_ENV=development                       # Environment label (development/
 # MOLECULE_IN_DOCKER=                    # Set when running the platform inside Docker (accepts 1/0, true/false). Triggers A2A proxy to rewrite 127.0.0.1:<port> agent URLs to Docker bridge hostnames. Auto-detected via /.dockerenv; only set if detection fails or to force off.
 
 # GitHub
-# GITHUB_REPO=owner/repo                 # Target repo for agent initial_prompt clone (e.g. Molecule-AI/molecule-monorepo). Read inside workspace containers.
+# GITHUB_REPO=owner/repo                 # Target repo for agent initial_prompt clone (e.g. Molecule-AI/molecule-core). Read inside workspace containers.
 # GITHUB_TOKEN=                          # Personal access token / installation token used by agents that clone private repos. Register as a global secret via POST /admin/secrets for propagation to workspace env. Token is used in-URL during clone and then scrubbed from .git/config via `git remote set-url`.
 
 # Webhooks

.gitea/scripts/audit-force-merge.sh

@@ -18,15 +18,24 @@
 # per §SOP-6 security model). No-op when merged=false.
 #
 # Required env (set by the workflow):
-#   GITEA_TOKEN, GITEA_HOST, REPO, PR_NUMBER, REQUIRED_CHECKS
+#   GITEA_TOKEN, GITEA_HOST, REPO, PR_NUMBER
+#   plus one of REQUIRED_CHECKS_JSON (preferred) or REQUIRED_CHECKS (legacy)
 #
-# REQUIRED_CHECKS is a newline-separated list of status-check context
-# names that branch protection requires. Declared in the workflow YAML
-# rather than fetched from /branch_protections (which needs admin
-# scope — sop-tier-bot has read-only). Trade dynamism for simplicity:
-# when the required-check set changes, update both branch protection
-# AND this env. Keeping them in sync is less complexity than granting
-# the audit bot admin perms on every repo.
+# REQUIRED_CHECKS_JSON is a JSON object keyed by branch name. Each value
+# is an array of status-check context names that branch protection
+# requires for that branch. The script looks up the PR's base branch and
+# evaluates only the checks declared for that branch.
+#
+#   {"main": ["CI / all-required (pull_request)", ...],
+#    "staging": ["CI / all-required (pull_request)", ...]}
+#
+# REQUIRED_CHECKS (legacy) is a newline-separated list used when the
+# JSON variable is not set. Declared in the workflow YAML rather than
+# fetched from /branch_protections (which needs admin scope — sop-tier-bot
+# has read-only). Trade dynamism for simplicity: when the required-check
+# set changes, update both branch protection AND this env. Keeping them
+# in sync is less complexity than granting the audit bot admin perms on
+# every repo.
 
 set -euo pipefail
 
@@ -34,7 +43,10 @@ set -euo pipefail
 : "${GITEA_HOST:?required}"
 : "${REPO:?required}"
 : "${PR_NUMBER:?required}"
-: "${REQUIRED_CHECKS:?required (newline-separated context names)}"
+if [ -z "${REQUIRED_CHECKS_JSON:-}" ] && [ -z "${REQUIRED_CHECKS:-}" ]; then
+  echo "::error::Either REQUIRED_CHECKS_JSON or REQUIRED_CHECKS must be set"
+  exit 1
+fi
 
 OWNER="${REPO%%/*}"
 NAME="${REPO##*/}"
@@ -65,10 +77,14 @@ if [ -z "$MERGE_SHA" ]; then
   exit 0
 fi
 
-# 2. Required status checks declared in the workflow env.
-REQUIRED="$REQUIRED_CHECKS"
+# 2. Required status checks — branch-aware JSON dict takes precedence.
+if [ -n "${REQUIRED_CHECKS_JSON:-}" ]; then
+  REQUIRED=$(echo "$REQUIRED_CHECKS_JSON" | jq -r --arg branch "$BASE_BRANCH" '.[$branch] // [] | .[]')
+else
+  REQUIRED="$REQUIRED_CHECKS"
+fi
 if [ -z "${REQUIRED//[[:space:]]/}" ]; then
-  echo "::notice::REQUIRED_CHECKS empty — force-merge not applicable."
+  echo "::notice::REQUIRED_CHECKS empty for branch '$BASE_BRANCH' — force-merge not applicable."
   exit 0
 fi
 

.gitea/scripts/review-check.sh

@@ -296,7 +296,15 @@ fi
 #   403     → token owner is not in this team (Gitea 1.22.6 'Must be a team
 #             member' constraint — see follow-up issue for token-provisioning)
 #   404     → not a member
+# Track whether every candidate returned 403 (token owner not in team).
+# When this happens the root cause is a token-provisioning issue, not a
+# reviewer-eligibility issue — surface it clearly so ops don't waste time
+# verifying team roster (Bug C / RFC#324 follow-up).
+_ALL_CANDIDATES_403="yes"
+_CANDIDATE_COUNT=0
+
 for U in $CANDIDATES; do
+  _CANDIDATE_COUNT=$((_CANDIDATE_COUNT + 1))
   CODE=$(curl -sS -o "$TEAM_PROBE_TMP" -w '%{http_code}' \
     -K "$CURL_AUTH_FILE" "${API}/teams/${TEAM_ID}/members/${U}")
   debug "probe ${U} in team ${TEAM} (id=${TEAM_ID}) → HTTP ${CODE}"
@@ -317,14 +325,20 @@ for U in $CANDIDATES; do
       continue
       ;;
     404)
+      _ALL_CANDIDATES_403="no"
       debug "${U} not a member of ${TEAM}"
       ;;
     *)
+      _ALL_CANDIDATES_403="no"
       echo "::warning::team-probe for ${U} in ${TEAM} returned unexpected HTTP ${CODE}"
       cat "$TEAM_PROBE_TMP" >&2
       ;;
   esac
 done
 
-echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (candidates: $(echo "$CANDIDATES" | tr '\n' ',' | sed 's/,$//') — none are in team)"
+if [ "$_ALL_CANDIDATES_403" = "yes" ] && [ "$_CANDIDATE_COUNT" -gt 0 ]; then
+  echo "::error::${TEAM}-review FAILED — every candidate returned 403 (token owner is not a member of the ${TEAM} team). This is a TOKEN PROVISIONING issue, not a reviewer-eligibility issue. Add the token owner to the '${TEAM}' Gitea team (id=${TEAM_ID}) or use a token whose owner is already in that team."
+else
+  echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (candidates: $(echo "$CANDIDATES" | tr '\n' ',' | sed 's/,$//') — none are in team)"
+fi
 exit 1

.gitea/scripts/sop-checklist.py

@@ -6,8 +6,8 @@
 # RFC#351 Step 2 of 6 (implementation MVP).
 #
 # Invoked by .gitea/workflows/sop-checklist.yml on:
-#   - pull_request_target: [opened, edited, synchronize, reopened]
-#   - issue_comment:       [created, edited, deleted]
+#   - pull_request_target: [opened, edited, synchronize, reopened, labeled, unlabeled]
+#   - issue_comment:       [created]  # edited/deleted omitted (Gitea 1.22.6 job-parsing quirk)
 #
 # Flow:
 #   1. Load .gitea/sop-checklist-config.yaml (from BASE ref — trusted).
@@ -639,9 +639,7 @@ def load_config(path: str) -> dict[str, Any]:
         # yaml is an optional dep; the canonical loader is used when available,
         # but the SOP runs on runners that may not have PyYAML installed. The
         # fallback _load_config_minimal covers the same config shape without
-        # requiring the dep, so the ignore is safe: if yaml loads, we use it;
-        # otherwise we fall back silently.
-        import yaml  # type: ignore[import-not-found]
+        import yaml  # type: ignore[import-not-found]  # optional dep; fall back silently if absent
         with open(path, encoding="utf-8") as f:
             return yaml.safe_load(f)
     except ImportError:
@@ -1033,7 +1031,7 @@ def main(argv: list[str] | None = None) -> int:
                     for t in data:
                         if t.get("name") == tn:
                             tid = t.get("id")
-                            client._team_id_cache[(args.owner, tn)] = tid  # noqa: SLF001  # internal write-through cache
+                            client._team_id_cache[(args.owner, tn)] = tid  # noqa: SLF001  # write-through cache; intentional side-effect for reuse across calls
                             break
             if tid is not None:
                 team_ids.append(tid)

.gitea/scripts/tests/test_ci_workflow_bookkeeping.py

@@ -11,21 +11,100 @@ def load_workflow(name: str) -> dict:
         return yaml.safe_load(f)
 
 
+def _all_required(workflow: dict) -> dict:
+    return workflow["jobs"]["all-required"]
+
+
 def test_all_required_uses_dedicated_meta_runner_lane():
     workflow = load_workflow("ci.yml")
-    all_required = workflow["jobs"]["all-required"]
+    all_required = _all_required(workflow)
 
+    # Stays on the dedicated `ci-meta` lane (the sentinel does no docker
+    # work, so it must NOT occupy the general docker-host pool).
     assert all_required["runs-on"] == "ci-meta"
-    assert "needs" not in all_required
 
 
-def test_all_required_reuses_path_filter_before_polling():
+def test_all_required_is_needs_aggregator_not_a_polling_gate():
+    """fix/ci-scheduler-fanout (2026-06-01): the sentinel was converted
+    from a status-polling loop (which squatted a ci-meta executor slot for
+    up to 40 min per PR) into a plain `needs:` aggregator that frees the
+    slot immediately. Pin the new shape so a regression to the poller is
+    caught.
+    """
     workflow = load_workflow("ci.yml")
-    all_required = workflow["jobs"]["all-required"]
+    all_required = _all_required(workflow)
     rendered = str(all_required)
 
-    assert "--profile ci" in rendered
-    assert ".gitea/scripts/detect-changes.py" in rendered
-    assert "REQUIRE_PLATFORM" in rendered
-    assert "REQUIRE_CANVAS" in rendered
-    assert "REQUIRE_SCRIPTS" in rendered
+    # The job MUST aggregate via `needs:` (the slot-freeing design).
+    assert "needs" in all_required, "all-required must be a needs: aggregator"
+
+    # It MUST NOT reintroduce the polling loop / per-SHA status fetch that
+    # was the throughput sink.
+    assert "detect-changes.py" not in rendered, (
+        "all-required must not run the detect-changes poller path"
+    )
+    assert "commits/" not in rendered and "statuses" not in rendered, (
+        "all-required must not poll commit statuses (the slot-squat path)"
+    )
+
+
+def test_all_required_does_not_use_if_always():
+    """Plain `needs:` works on Gitea 1.22.6 / act_runner v0.6.1; `needs:` +
+    `if: always()` is BROKEN (feedback_gitea_needs_works_only_ifalways_broken)
+    and would let a non-success need pass the gate. The sentinel must use
+    plain `needs:` WITHOUT a job-level `if: always()`.
+    """
+    workflow = load_workflow("ci.yml")
+    all_required = _all_required(workflow)
+
+    job_if = all_required.get("if")
+    assert not (isinstance(job_if, str) and "always()" in job_if), (
+        "all-required must not combine needs: with if: always()"
+    )
+
+
+def test_all_required_needs_matches_ci_required_drift_f1_set():
+    """The sentinel `needs:` list MUST equal ci-required-drift.py's
+    `ci_job_names()` set: every job MINUS the sentinel itself MINUS jobs
+    whose `if:` gates on github.event_name/github.ref (event-gated jobs
+    skip on PRs and a `needs:` on a skipped job would never let the
+    sentinel run). If they diverge, ci-required-drift F1 fires.
+    """
+    workflow = load_workflow("ci.yml")
+    jobs = workflow["jobs"]
+    sentinel = "all-required"
+
+    expected = set()
+    for key, body in jobs.items():
+        if key == sentinel:
+            continue
+        gate = body.get("if") if isinstance(body, dict) else None
+        if isinstance(gate, str) and (
+            "github.event_name" in gate or "github.ref" in gate
+        ):
+            # event-gated → legitimately skips on some triggers; excluded
+            # from both `needs:` and the F1 set.
+            continue
+        expected.add(key)
+
+    needs = jobs[sentinel].get("needs", [])
+    if isinstance(needs, str):
+        needs = [needs]
+    actual = set(needs)
+
+    assert actual == expected, (
+        f"all-required needs: {sorted(actual)} != ci_job_names() "
+        f"{sorted(expected)} — ci-required-drift F1 would fire"
+    )
+
+
+def test_all_required_needs_reference_real_jobs():
+    """F1b guard: every entry in `needs:` must name an existing job."""
+    workflow = load_workflow("ci.yml")
+    jobs = workflow["jobs"]
+    needs = jobs["all-required"].get("needs", [])
+    if isinstance(needs, str):
+        needs = [needs]
+    job_keys = set(jobs)
+    for dep in needs:
+        assert dep in job_keys, f"all-required needs unknown job {dep!r}"

.gitea/workflows/audit-force-merge.yml

@@ -47,13 +47,25 @@ jobs:
           REPO: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           # Required-status-check contexts to evaluate at merge time.
-          # Newline-separated. Mirror this against branch protection
-          # (settings → branches → protected branch → required checks).
+          # Branch-aware JSON dict: keys are protected branch names,
+          # values are arrays of context names that branch protection
+          # requires for that branch. Mirror this against branch
+          # protection (settings → branches → protected branch →
+          # required checks) for each branch listed here.
+          #
           # Declared here rather than fetched from /branch_protections
           # because that endpoint requires admin write — sop-tier-bot is
           # read-only by design (least-privilege).
-          REQUIRED_CHECKS: |
-            CI / all-required (pull_request)
-            E2E API Smoke Test / E2E API Smoke Test (pull_request)
-            Handlers Postgres Integration / Handlers Postgres Integration (pull_request)
+          REQUIRED_CHECKS_JSON: |
+            {
+              "main": [
+                "CI / all-required (pull_request)",
+                "E2E API Smoke Test / E2E API Smoke Test (pull_request)",
+                "Handlers Postgres Integration / Handlers Postgres Integration (pull_request)"
+              ],
+              "staging": [
+                "CI / all-required (pull_request)",
+                "sop-checklist / all-items-acked (pull_request)"
+              ]
+            }
         run: bash .gitea/scripts/audit-force-merge.sh

.gitea/workflows/block-internal-paths.yml

@@ -37,7 +37,7 @@ jobs:
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking
     # the PR. Follow-up PR flips this off after surfaced defects are
     # triaged.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.gitea/workflows/check-migration-collisions.yml

@@ -45,7 +45,7 @@ jobs:
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking
     # the PR. Follow-up PR flips this off after surfaced defects are
     # triaged.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 5
     steps:

.gitea/workflows/ci-arm64-advisory.yml

@@ -101,7 +101,7 @@ jobs:
     # AND-set: only the Mac arm64 runner advertises macos-self-hosted.
     # See "RUNNER TARGETING" header note for why bare self-hosted is unsafe.
     runs-on: [self-hosted, macos-self-hosted]
-    # ADVISORY: never blocks. See safety contract point 3. mc#774
+    # ADVISORY: never blocks. See safety contract point 3. mc#1982
     # internal#418 — tracked: arm64 advisory pilot, non-gating by design.
     continue-on-error: true
     # event_name gate: functional (only meaningful on push/PR) AND keeps

.gitea/workflows/ci.yml

@@ -106,7 +106,7 @@ jobs:
     name: Platform (Go)
     needs: changes
     runs-on: ubuntu-latest
-    # mc#774 (closed 2026-05-14): Phase 4 flip of the platform-build job.
+    # mc#1982 (closed 2026-05-14): Phase 4 flip of the platform-build job.
     # Phase 4 (#656) originally flipped this to continue-on-error: false based on
     # Phase-3-masked "green on main 2026-05-12". Two failure classes then surfaced:
     #   (1) 4x delegation_test.go sqlmock gaps (PR #669 / #634 fix-forward, closed).
@@ -161,7 +161,7 @@ jobs:
           echo "::group::pendinguploads exit=$pu_exit (last 100 lines)"
           tail -100 /tmp/test-pu.log
           echo "::endgroup::"
-        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+        # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
         continue-on-error: true
       - if: ${{ needs.changes.outputs.platform == 'true' }}
         name: Run tests with coverage (blocking gate)
@@ -392,7 +392,7 @@ jobs:
   canvas-deploy-reminder:
     name: Canvas Deploy Reminder
     runs-on: docker-host
-    # mc#774 root-fix: added job-level `if:` so ci-required-drift.py's
+    # mc#1982 root-fix: added job-level `if:` so ci-required-drift.py's
     # ci_job_names() detects this as github.ref-gated and skips it from F1.
     # The step-level exit 0 handles the "not main push" case; the job-level
     # `if:` makes the gating explicit so the drift script sees it.
@@ -475,10 +475,10 @@ jobs:
     #
     # Emits `CI / all-required (<event>)` where <event> is the workflow trigger
     # (e.g. `CI / all-required (pull_request)`, `CI / all-required (push)`).
-    # Branch protection MUST be updated to require the event-suffixed name —
+    # Branch protection requires the event-suffixed name —
     # requiring `CI / all-required` (bare, no suffix) silently blocks all merges
     # because Gitea treats absent status contexts as pending (not skipped), and
-    # no workflow emits the bare name. Fixed: BP now requires
+    # no workflow emits the bare name. BP requires
     # `CI / all-required (pull_request)` per issue #1473.
     #
     # Closes the failure mode where status_check_contexts on molecule-core/main
@@ -487,129 +487,91 @@ jobs:
     # red silently merged through. See internal#286 for the three concrete
     # tonight-of-2026-05-11 incidents that prompted the emergency bump.
     #
-    # This job deliberately has no `needs:`. Gitea 1.22/act_runner can mark a
-    # job-level `if: always()` + `needs:` sentinel as skipped before upstream
-    # jobs settle, leaving branch protection with a permanent pending
-    # `CI / all-required` context. Instead, this independent sentinel polls the
-    # required commit-status contexts for this SHA and fails if any fail, skip,
-    # or never emit. It runs the same path detector as `changes` and only waits
-    # for path-relevant jobs; Gitea can otherwise leave needs/output-skipped
-    # jobs permanently pending with "Blocked by required conditions". It runs on
-    # the dedicated `ci-meta` lane so the poller does not occupy the same
-    # general runner pool as the jobs it is waiting for.
+    # ── 2026-06-01 CI-scheduler-overload fix (fix/ci-scheduler-fanout) ──
+    # PREVIOUS shape: a poll-gate that ran detect-changes then LOOPED on
+    # `GET /commits/{sha}/statuses` every 15s for up to 40 min, occupying a
+    # `ci-meta` executor slot the entire time it waited for upstream jobs.
+    # With only 2 ci-meta runners, that poll-loop squatted half the lane on
+    # every PR — a confirmed throughput sink in the live RCA (two concurrent
+    # `JOB-all-required` containers observed pinning the lane). The polling
+    # design existed only to dodge the Gitea `needs:` + `if: always()` bug,
+    # where an always()-guarded sentinel could be marked skipped before
+    # upstream jobs settled (leaving BP pending forever).
     #
-    # canvas-deploy-reminder is intentionally NOT included in all-required.needs.
-    # It is an informational main-push reminder, not a PR quality gate. Keeping
-    # it in this dependency list lets a skipped reminder skip the required
-    # sentinel before the `always()` guard can emit a branch-protection status.
+    # NEW shape: a plain `needs:` aggregator with NO polling loop. This is
+    # safe here — and was NOT safe at the time the poller was written —
+    # because every aggregated CI job now gates its real work PER-STEP
+    # (`if: needs.changes.outputs.* != 'true'`) rather than at the JOB level.
+    # A per-step-gated job always reaches a terminal SUCCESS (it no-ops its
+    # expensive steps but the job itself still completes), so it is never
+    # `skipped`. Plain `needs:` (WITHOUT `if: always()`) works correctly on
+    # Gitea 1.22.6 / act_runner v0.6.1 — only `needs:` + `if: always()` is
+    # broken (feedback_gitea_needs_works_only_ifalways_broken). We therefore
+    # use plain `needs:` + an explicit per-need result check (NOT
+    # `if: always()`); if any need fails/errors, Gitea never starts this job
+    # and BP sees `CI / all-required` go red via the failed dependency
+    # propagation — exactly the gate we want, with zero runner-squat.
     #
+    # The `needs:` list MUST stay in lockstep with ci-required-drift.py's
+    # F1 check (`ci_job_names()` = every job MINUS the sentinel MINUS jobs
+    # whose `if:` gates on github.event_name/github.ref). canvas-deploy-
+    # reminder is event-gated (`if: github.ref == refs/heads/{main,staging}`)
+    # so it is intentionally EXCLUDED — it skips on PRs and a `needs:` on a
+    # skipped job would never let the sentinel run. If a new always-running
+    # CI job is added, add it here too or ci-required-drift F1 will flag it.
+    #
+    # Stays on the dedicated `ci-meta` lane (no docker work, so the
+    # docker-host-pin lint does not apply), but now the job is sub-second:
+    # it only inspects already-settled `needs.*.result` values, so it frees
+    # the slot immediately instead of holding it for the whole CI duration.
+    #
+    needs:
+      - changes
+      - platform-build
+      - canvas-build
+      - shellcheck
+      - python-lint
     continue-on-error: false
     runs-on: ci-meta
-    timeout-minutes: 45
+    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-      - id: check
+      - name: Verify all aggregated CI jobs succeeded
+        # NO polling, NO API call, NO checkout. Because this job lists the
+        # aggregated jobs under `needs:` (without `if: always()`), Gitea only
+        # starts it once every need has reached SUCCESS — a failed/errored
+        # need short-circuits the job and propagates red to the
+        # `CI / all-required` context. This explicit check is a
+        # belt-and-suspenders assertion + a readable run summary; the real
+        # gating is the `needs:` edge itself.
         env:
-          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          PUSH_BEFORE: ${{ github.event.before }}
-        run: |
-          python3 .gitea/scripts/detect-changes.py \
-            --profile ci \
-            --event-name "${{ github.event_name }}" \
-            --pr-base-sha "$PR_BASE_SHA" \
-            --base-ref "$PR_BASE_REF" \
-            --push-before "${GITHUB_EVENT_BEFORE:-$PUSH_BEFORE}"
-      - name: Wait for required CI contexts
-        env:
-          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          API_ROOT: ${{ github.server_url }}/api/v1
-          REPOSITORY: ${{ github.repository }}
-          COMMIT_SHA: ${{ github.sha }}
-          EVENT_NAME: ${{ github.event_name }}
-          REQUIRE_PLATFORM: ${{ steps.check.outputs.platform }}
-          REQUIRE_CANVAS: ${{ steps.check.outputs.canvas }}
-          REQUIRE_SCRIPTS: ${{ steps.check.outputs.scripts }}
+          CHANGES_RESULT: ${{ needs.changes.result }}
+          PLATFORM_RESULT: ${{ needs.platform-build.result }}
+          CANVAS_RESULT: ${{ needs.canvas-build.result }}
+          SHELLCHECK_RESULT: ${{ needs.shellcheck.result }}
+          PYTHON_LINT_RESULT: ${{ needs.python-lint.result }}
         run: |
           set -euo pipefail
-          python3 - <<'PY'
-          import json
-          import os
-          import sys
-          import time
-          import urllib.error
-          import urllib.request
-
-          token = os.environ["GITEA_TOKEN"]
-          api_root = os.environ["API_ROOT"].rstrip("/")
-          repo = os.environ["REPOSITORY"]
-          sha = os.environ["COMMIT_SHA"]
-          event = os.environ["EVENT_NAME"]
-          required = [
-              f"CI / Detect changes ({event})",
-              f"CI / Python Lint & Test ({event})",
-          ]
-          if os.environ.get("REQUIRE_PLATFORM") == "true":
-              required.append(f"CI / Platform (Go) ({event})")
-          if os.environ.get("REQUIRE_CANVAS") == "true":
-              required.append(f"CI / Canvas (Next.js) ({event})")
-          if os.environ.get("REQUIRE_SCRIPTS") == "true":
-              required.append(f"CI / Shellcheck (E2E scripts) ({event})")
-          terminal_bad = {"failure", "error"}
-          deadline = time.time() + 40 * 60
-          last_summary = None
-
-          def fetch_statuses():
-              statuses = []
-              for page in range(1, 6):
-                  url = f"{api_root}/repos/{repo}/commits/{sha}/statuses?page={page}&limit=100"
-                  req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
-                  with urllib.request.urlopen(req, timeout=10) as resp:
-                      chunk = json.load(resp)
-                  if not chunk:
-                      break
-                  statuses.extend(chunk)
-              latest = {}
-              for item in statuses:
-                  ctx = item.get("context")
-                  if not ctx:
-                      continue
-                  prev = latest.get(ctx)
-                  if prev is None or (item.get("updated_at") or item.get("created_at") or "") >= (prev.get("updated_at") or prev.get("created_at") or ""):
-                      latest[ctx] = item
-              return latest
-
-          while True:
-              try:
-                  latest = fetch_statuses()
-              except (TimeoutError, OSError, urllib.error.URLError) as exc:
-                  if time.time() >= deadline:
-                      print(f"FAIL: status polling did not recover before deadline: {exc}", file=sys.stderr)
-                      sys.exit(1)
-                  print(f"WARN: status poll failed, retrying: {exc}", flush=True)
-                  time.sleep(15)
-                  continue
-              states = {ctx: (latest.get(ctx) or {}).get("status") or (latest.get(ctx) or {}).get("state") or "missing" for ctx in required}
-              summary = ", ".join(f"{ctx}={state}" for ctx, state in states.items())
-              if summary != last_summary:
-                  print(summary, flush=True)
-                  last_summary = summary
-              bad = {ctx: state for ctx, state in states.items() if state in terminal_bad}
-              if bad:
-                  print("FAIL: required CI context failed:", file=sys.stderr)
-                  for ctx, state in bad.items():
-                      desc = (latest.get(ctx) or {}).get("description") or ""
-                      print(f"  - {ctx}: {state} {desc}", file=sys.stderr)
-                  sys.exit(1)
-              if all(state == "success" for state in states.values()):
-                  print(f"OK: all {len(required)} required CI contexts succeeded")
-                  sys.exit(0)
-              if time.time() >= deadline:
-                  print("FAIL: timed out waiting for required CI contexts:", file=sys.stderr)
-                  for ctx, state in states.items():
-                      print(f"  - {ctx}: {state}", file=sys.stderr)
-                  sys.exit(1)
-              time.sleep(15)
-          PY
+          fail=0
+          check() {
+            name="$1"; result="$2"
+            printf 'CI / %s = %s\n' "$name" "$result"
+            # `success` is the only green terminal state we accept. A plain
+            # `needs:` job is only started when all needs succeed, so reaching
+            # this step already implies success — but assert explicitly so a
+            # future `if: always()` reintroduction (which WOULD let non-success
+            # through) fails loudly instead of silently passing the gate.
+            if [ "$result" != "success" ]; then
+              echo "::error::aggregated CI job '${name}' did not succeed (result=${result})"
+              fail=1
+            fi
+          }
+          check "Detect changes"        "$CHANGES_RESULT"
+          check "Platform (Go)"         "$PLATFORM_RESULT"
+          check "Canvas (Next.js)"      "$CANVAS_RESULT"
+          check "Shellcheck (E2E scripts)" "$SHELLCHECK_RESULT"
+          check "Python Lint & Test"    "$PYTHON_LINT_RESULT"
+          if [ "$fail" -ne 0 ]; then
+            echo "::error::all-required: one or more aggregated CI jobs did not succeed"
+            exit 1
+          fi
+          echo "OK: all aggregated CI jobs succeeded — CI / all-required green."

.gitea/workflows/continuous-synth-e2e.yml

@@ -102,7 +102,7 @@ jobs:
     name: Synthetic E2E against staging
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     # Bumped from 12 → 20 (2026-05-04). Tenant user-data install phase
     # (apt-get update + install docker.io/jq/awscli/caddy + snap install

.gitea/workflows/e2e-api.yml

@@ -123,7 +123,7 @@ jobs:
     # integration). See internal#512 for the class defect.
     runs-on: docker-host
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     outputs:
       api: ${{ steps.decide.outputs.api }}
@@ -160,7 +160,7 @@ jobs:
     # detect-changes for the full rationale.
     runs-on: docker-host
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 15
     env:

.gitea/workflows/e2e-chat.yml

@@ -48,7 +48,7 @@ jobs:
     # defect.
     runs-on: docker-host
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     outputs:
       chat: ${{ steps.decide.outputs.chat }}
@@ -112,7 +112,7 @@ jobs:
     # Must land on operator-host Linux (docker-host).
     runs-on: docker-host
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 15
     env:

.gitea/workflows/e2e-staging-canvas.yml

@@ -71,7 +71,7 @@ jobs:
   detect-changes:
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     outputs:
       canvas: ${{ steps.decide.outputs.canvas }}
@@ -140,7 +140,7 @@ jobs:
     name: Canvas tabs E2E
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 40
 

.gitea/workflows/e2e-staging-external.yml

@@ -84,7 +84,7 @@ jobs:
     name: E2E Staging External Runtime
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 25
 

.gitea/workflows/e2e-staging-saas.yml

@@ -94,20 +94,20 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
-        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+        # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
         continue-on-error: true
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
-        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+        # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
         continue-on-error: true
 
       - name: YAML validation (best-effort)
         run: |
           echo "e2e-staging-saas.yml — PR validation: workflow YAML is valid."
           echo "E2E step runs only when provisioning-critical files change."
-        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+        # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
         continue-on-error: true
 
   # Actual E2E: runs on trunk pushes and PRs that touch provisioning-critical
@@ -118,7 +118,7 @@ jobs:
     name: E2E Staging SaaS
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 45
     permissions:

.gitea/workflows/e2e-staging-sanity.yml

@@ -37,7 +37,7 @@ jobs:
     name: Intentional-failure teardown sanity
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 20
 

.gitea/workflows/gate-check-v3.yml

@@ -66,7 +66,7 @@ jobs:
   # bp-exempt: PR advisory bot; merge blocking is enforced by CI status and branch protection.
   gate-check:
     runs-on: ubuntu-latest
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true  # Never block on our own detector failing
     steps:
       - name: Check out BASE ref (never PR-head under pull_request_target)

.gitea/workflows/handlers-postgres-integration.yml

@@ -87,8 +87,8 @@ jobs:
     # both jobs on the same label avoids workspace-volume cross-host
     # surprises and keeps the routing rule discoverable in one place.
     runs-on: docker-host
-    # mc#774 Phase 3 (RFC §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982 Phase 3 (RFC §1): surface broken workflows without blocking.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     outputs:
       handlers: ${{ steps.filter.outputs.handlers }}
@@ -118,8 +118,8 @@ jobs:
     # mc#1529 §1: must run on operator-host (where `molecule-core-net`
     # exists). See detect-changes for the full routing rationale.
     runs-on: docker-host
-    # mc#774 Phase 3 (RFC §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982 Phase 3 (RFC §1): surface broken workflows without blocking.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     env:
       # Unique name per run so concurrent jobs don't collide on the

.gitea/workflows/harness-replays.yml

@@ -70,7 +70,7 @@ jobs:
     # of mc#1543; see internal#512 for class defect.
     runs-on: docker-host
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     outputs:
       run: ${{ steps.decide.outputs.run }}
@@ -172,7 +172,7 @@ jobs:
     # beta containers. Must run on operator-host Linux (docker-host).
     runs-on: docker-host
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 30
     steps:

.gitea/workflows/lint-bp-context-emit-match.yml

@@ -1,6 +1,6 @@
 name: lint-bp-context-emit-match
 
-# Tier 2f scheduled lint (per mc#774) — detects drift between
+# Tier 2f scheduled lint (per mc#1982) — detects drift between
 # `branch_protections/<branch>.status_check_contexts` and the set of
 # contexts emitted by `.gitea/workflows/*.yml`.
 #
@@ -60,7 +60,7 @@ name: lint-bp-context-emit-match
 #
 # Cross-links
 # -----------
-# - mc#774 (the RFC that specs this lint)
+# - mc#1982 (the RFC that specs this lint)
 # - internal#349 (cross-repo BP sweep)
 # - feedback_phantom_required_check_after_gitea_migration
 # - feedback_tier_label_ids_are_per_repo
@@ -94,7 +94,7 @@ jobs:
     # Phase 3 (RFC #219 §1): surface drift without blocking. After 7
     # clean scheduled runs on main, flip to false so a scheduled
     # failure is a hard CI signal.
-    continue-on-error: true  # mc#774 Phase 3 — flip to false after 7 clean main runs
+    continue-on-error: true  # mc#1982 Phase 3 — flip to false after 7 clean main runs
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0

.gitea/workflows/lint-continue-on-error-tracking.yml

@@ -1,6 +1,6 @@
 name: lint-continue-on-error-tracking
 
-# Tier 2e hard-gate lint (per mc#774) — every
+# Tier 2e hard-gate lint (per mc#1982) — every
 # `continue-on-error: true` in `.gitea/workflows/*.yml` must carry a
 # `# mc#NNNN` or `# internal#NNNN` tracker comment within 2 lines,
 # the referenced issue must be OPEN, and ≤14 days old.
@@ -8,7 +8,7 @@ name: lint-continue-on-error-tracking
 # Why this exists
 # ---------------
 # `continue-on-error: true` on `platform-build` had been hiding
-# mc#774-class regressions for ~3 weeks before #656 surfaced them on
+# mc#1982-class regressions for ~3 weeks before #656 surfaced them on
 # 2026-05-12. A 14-day cap on tracker age forces a review cycle and
 # surfaces mask-drift within at most 14 days of the original defect.
 # Each `continue-on-error: true` gets a paper trail — close or renew.
@@ -45,12 +45,12 @@ name: lint-continue-on-error-tracking
 # close-and-flip, or document the deliberate keep-mask in a fresh
 # 14-day-renewable tracker. After main is clean for 3 days,
 # follow-up PR flips this workflow's continue-on-error to false.
-# Tracking: mc#774.
+# Tracking: mc#1982.
 #
 # Cross-links
 # -----------
-# - mc#774 (the RFC that specs this lint)
-# - mc#774 (the empirical masked-3-weeks case)
+# - mc#1982 (the RFC that specs this lint)
+# - mc#1982 (the empirical masked-3-weeks case)
 # - feedback_chained_defects_in_never_tested_workflows
 # - feedback_behavior_based_ast_gates
 # - feedback_strict_root_only_after_class_a
@@ -97,9 +97,9 @@ jobs:
     # Phase 3 (RFC #219 §1): surface masked defects without blocking
     # PRs. Pre-existing continue-on-error: true directives on main
     # all violate this lint at first — intentional. Flip to false
-    # follow-up after main is clean for 3 days. mc#774.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
-    continue-on-error: true  # mc#774 Phase 3 mask — 14d forced-renewal cadence
+    # follow-up after main is clean for 3 days. mc#1982.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    continue-on-error: true  # mc#1982 Phase 3 mask — 14d forced-renewal cadence
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0

.gitea/workflows/lint-curl-status-capture.yml

@@ -51,7 +51,7 @@ jobs:
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking
     # the PR. Follow-up PR flips this off after surfaced defects are
     # triaged.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.gitea/workflows/lint-forbidden-env-keys.yml

@@ -25,6 +25,21 @@ name: Lint forbidden tenant-env keys
 #   feedback_path_filtered_workflow_cant_be_required). The scan itself
 #   targets workspace_secrets-writer paths via grep -r; it's fast
 #   (sub-second) so unconditional run is fine.
+#
+# ── 2026-06-01 CI-scheduler-fanout consolidation (fix/ci-scheduler-fanout) ──
+# The RFC#523 sibling lint formerly in its own file
+# `lint-no-tenant-gitea-token.yml` (the broader "no repo-host token into
+# any tenant-writer surface" scan) is now a SECOND job in THIS workflow
+# (`scan-tenant-token-write`). Both are sub-second Go-source greps that
+# fired as two separate workflow runs on every PR — pure scheduler
+# fan-out. Folding the sibling in here drops one workflow run + one
+# checkout per PR while keeping BOTH scans firing unconditionally on
+# every PR (the no-paths discipline above is preserved — neither job is
+# paths-filtered). The moved job keeps its exact `name:` so its emitted
+# status context is unchanged in substance; its `# bp-exempt:` directive
+# moves with it (Tier 2g). The old `Lint no tenant GITEA or GITHUB token
+# write / …` context is retired (a disappearing context needs no
+# directive; only NEW emitters do).
 
 on:
   pull_request:
@@ -166,3 +181,126 @@ jobs:
           fi
 
           echo "OK No forbidden operator-scope env key names hardcoded in writer paths."
+
+  # bp-exempt: advisory RFC#523 lint; PR review gate is review-driven, not BP-driven.
+  # (Carried with the workflow-name rename in PR mc#1593 so the renamed
+  # context emission satisfies lint_required_context_exists_in_bp Tier 2g.)
+  scan-tenant-token-write:
+    name: Scan for repo-host token write into tenant workspace surface
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: Find Go files referencing a tenant-writer surface AND a repo-host token
+        run: |
+          set -euo pipefail
+
+          # Repo-host token NAMES — the threat-model subset. Operator-fleet
+          # tokens (CP_ADMIN_API_TOKEN, RAILWAY_TOKEN, INFISICAL_*) are
+          # caught by lint-forbidden-env-keys.yml's broader deny set; this
+          # lint focuses on the git-host class so a single co-occurrence
+          # match has a low false-positive rate.
+          FORBIDDEN_KEYS=(
+            "GITEA_TOKEN"
+            "GITEA_PAT"
+            "GITHUB_TOKEN"
+            "GITHUB_PAT"
+            "GH_TOKEN"
+          )
+
+          # Tenant-writer surface markers. A file matches the surface set
+          # if it references ANY of these strings. This is the "is this
+          # code path writing into a tenant workspace?" heuristic.
+          # Curated to catch the actual code shapes used in this repo
+          # (verified by grep against current main 2026-05-19):
+          #   - "workspace_secrets" / "global_secrets"  → DB table writes
+          #   - "seedAllowList"                          → CP-side seed table
+          #   - "/settings/secrets"                      → tenant HTTP API write
+          #   - "envVars["                               → in-memory env map write
+          #   - "containerEnv"                           → docker-run env-set
+          #   - "userData"                               → EC2 user-data script
+          #   - "provisionPayload" / "provisionContext"  → provision-request shape
+          SURFACE_PATTERN='workspace_secrets|global_secrets|seedAllowList|/settings/secrets|envVars\[|containerEnv|userData|provisionPayload|provisionContext'
+
+          # Files that legitimately reference these names AND a surface
+          # marker, but do so for guard / strip / test / doc-comment
+          # reasons. New entries require reviewer signoff and a one-line
+          # justification in the diff.
+          EXEMPT_FILES=(
+            # RFC#523 L1 deny-set source-of-truth + tests
+            "workspace-server/internal/handlers/workspace_provision_forbidden_env.go"
+            "workspace-server/internal/handlers/workspace_provision_forbidden_env_test.go"
+            # Forensic-#145 silent-strip denylist (defense-in-depth, by design lists the names)
+            "workspace-server/internal/provisioner/provisioner.go"
+            "workspace-server/internal/provisioner/provisioner_test.go"
+            # Pre-RFC#523 persona-fallback / org-helper paths. The L1
+            # fail-closed runs BEFORE these writers; downstream silent-strip
+            # also covers them. See applyAgentGitHTTPCreds doc-comment.
+            "workspace-server/internal/handlers/agent_git_identity.go"
+            "workspace-server/internal/handlers/org_helpers.go"
+            "workspace-server/internal/handlers/org.go"
+            # CP→platform admin auth (NOT a tenant env write).
+            "workspace-server/internal/provisioner/cp_provisioner.go"
+          )
+
+          # Build an extended-regex alternation of forbidden keys.
+          KEY_ALT="$(IFS='|'; echo "${FORBIDDEN_KEYS[*]}")"
+
+          # Find candidate files: Go non-test sources that contain a
+          # tenant-writer surface marker.
+          mapfile -t CANDIDATES < <(
+            grep -rlE --include='*.go' --exclude='*_test.go' \
+              "${SURFACE_PATTERN}" . 2>/dev/null \
+            | sed 's|^\./||' \
+            | sort -u
+          )
+
+          if [ "${#CANDIDATES[@]}" -eq 0 ]; then
+            echo "OK No tenant-writer-surface files found in tree (unexpected, but not a lint failure)."
+            exit 0
+          fi
+
+          HITS=""
+          for f in "${CANDIDATES[@]}"; do
+            # Skip exempt files.
+            skip=0
+            for ex in "${EXEMPT_FILES[@]}"; do
+              if [ "$f" = "$ex" ]; then skip=1; break; fi
+            done
+            [ "$skip" = "1" ] && continue
+
+            # File contains a surface marker; now grep for a forbidden
+            # key NAME. We require a QUOTED-literal match to avoid
+            # firing on a comment like "// also handle GITEA_TOKEN".
+            #
+            # The literal form catches:
+            #   - os.Getenv("GITEA_TOKEN")
+            #   - envVars["GITEA_TOKEN"] = ...
+            #   - {envKey: "GITEA_TOKEN", tenantKey: "GITEA_TOKEN"}
+            # but not:
+            #   - // see GITEA_TOKEN below   (no quotes)
+            found=$(grep -nE "\"(${KEY_ALT})\"" "$f" 2>/dev/null || true)
+            if [ -n "$found" ]; then
+              HITS="${HITS}--- ${f} ---\n${found}\n"
+            fi
+          done
+
+          if [ -n "$HITS" ]; then
+            echo "::error::Task #146 lint: repo-host token name(s) quoted in a tenant-writer-surface file:"
+            printf "$HITS"
+            echo ""
+            echo "These files reference a tenant-writer surface (workspace_secrets,"
+            echo "seedAllowList, /settings/secrets, containerEnv, userData, etc.)"
+            echo "AND quote a repo-host token name (GITEA_TOKEN/GITHUB_TOKEN/…)."
+            echo "Per RFC#523 threat model, tenant workspaces MUST NOT receive"
+            echo "operator-scope repo-host tokens. If your code legitimately needs"
+            echo "to reference one of these names in a tenant-writer file (e.g."
+            echo "a deny-set definition or silent-strip list), add the file to"
+            echo "EXEMPT_FILES with a one-line justification — reviewer signoff"
+            echo "required."
+            exit 1
+          fi
+
+          echo "OK No tenant-writer-surface file co-mentions a repo-host token literal."

.gitea/workflows/lint-mask-pr-atomicity.yml

@@ -1,6 +1,6 @@
 name: lint-mask-pr-atomicity
 
-# Tier 2d hard-gate lint (per mc#774) — blocks PRs that touch
+# Tier 2d hard-gate lint (per mc#1982) — blocks PRs that touch
 # `.gitea/workflows/ci.yml` and modify ONLY ONE of {continue-on-error,
 # all-required.sentinel.needs} without a `Paired: #NNN` reference in
 # the PR body or in a commit message.
@@ -37,13 +37,13 @@ name: lint-mask-pr-atomicity
 # This workflow lands at `continue-on-error: true` (Phase 3 — surface
 # regressions without blocking PRs while the rule beds in).
 # Follow-up PR flips to `false` once we have ≥3 days of clean runs on
-# `main` and no false-positives. Tracking issue: mc#774.
+# `main` and no false-positives. Tracking issue: mc#1982.
 #
 # Cross-links
 # -----------
-# - mc#774 (the RFC that specs this lint)
+# - mc#1982 (the RFC that specs this lint)
 # - PR#665 / PR#668 (the empirical split-pair)
-# - mc#774 (the main-red incident the split caused)
+# - mc#1982 (the main-red incident the split caused)
 # - feedback_strict_root_only_after_class_a
 # - feedback_behavior_based_ast_gates
 #
@@ -92,8 +92,8 @@ jobs:
     # Phase 3 (RFC #219 §1): surface broken shapes without blocking
     # PRs. Follow-up PR flips this to `false` once recent runs on main
     # are confirmed clean (eat-our-own-dogfood discipline mirrors
-    # PR#673's same-shape comment). Tracking: mc#774.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # PR#673's same-shape comment). Tracking: mc#1982.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     steps:
       - name: Check out PR head with full history (need base SHA blobs)

.gitea/workflows/lint-no-tenant-gitea-token.yml

@@ -1,182 +0,0 @@
-name: Lint no tenant GITEA or GITHUB token write
-
-# Task #146 — CI guardrail companion to RFC#523's `lint-forbidden-env-keys.yml`.
-#
-# `lint-forbidden-env-keys.yml` (Layer 3) catches code that hardcodes a
-# forbidden env-var key NAME as a quoted literal in workspace_secrets
-# writer paths under workspace-server/internal/.
-#
-# This workflow catches a BROADER class: any code path that reads a
-# repo-host token (GITEA_TOKEN / GITHUB_TOKEN / GH_TOKEN) and then writes
-# it into a TENANT WORKSPACE's env, secret store, user-data, or
-# provision payload. This is the actual RFC#523 threat-model statement —
-# the goal is "no tenant workspace ever receives an operator-scope repo
-# token," not just "no _quoted_ literal `GITEA_TOKEN`." A future writer
-# could route the value via a variable, a struct field, or a config key
-# and slip past the existing literal scan; this lint catches those
-# routing patterns at PR review time.
-#
-# Scope
-#   Scans the WHOLE repo's Go sources (not just workspace-server/) for
-#   co-occurrences of:
-#     - a repo-host token NAME (GITEA_TOKEN / GITHUB_TOKEN / GH_TOKEN /
-#       GITEA_PAT / GITHUB_PAT) used as os.Getenv argument or string
-#       literal
-#     - within a file that ALSO references a tenant-writer surface
-#       (`tenant`, `workspace_secrets`, `global_secrets`, `seedAllowList`,
-#       `/settings/secrets`, `userData`, `provisionPayload`,
-#       `envVars[`, `containerEnv`).
-#
-#   Co-occurrence (not single-line) is the false-positive control: a
-#   file that just LOGS the variable name (e.g. "missing GITEA_TOKEN")
-#   without touching any tenant surface won't fire.
-#
-# Drift contract with lint-forbidden-env-keys.yml
-#   Both lints share the same FORBIDDEN_KEYS list (a subset — only the
-#   repo-host tokens, since this lint's threat model is "tenant gets
-#   write access to operator's git host"). If RFC#523's deny set grows,
-#   update BOTH this file AND lint-forbidden-env-keys.yml AND the Go
-#   source-of-truth in
-#   workspace-server/internal/handlers/workspace_provision_forbidden_env.go.
-#
-# Open-source-template-friendly
-#   The patterns scanned are generic (no MOLECULE_-prefix literals).
-#   A fork can copy this workflow as-is and adjust FORBIDDEN_KEYS.
-#
-# Path-filter discipline
-#   No `paths:` filter — required-status workflows must run on every PR
-#   per `feedback_path_filtered_workflow_cant_be_required`. Scan is
-#   sub-second.
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-  push:
-    branches: [main, staging]
-
-env:
-  GITHUB_SERVER_URL: https://git.moleculesai.app
-
-jobs:
-  # bp-exempt: advisory RFC#523 lint; PR review gate is review-driven, not BP-driven.
-  # (Carried with the workflow-name rename in PR mc#1593 so the renamed
-  # context emission satisfies lint_required_context_exists_in_bp Tier 2g.)
-  scan:
-    name: Scan for repo-host token write into tenant workspace surface
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 1
-
-      - name: Find Go files referencing a tenant-writer surface AND a repo-host token
-        run: |
-          set -euo pipefail
-
-          # Repo-host token NAMES — the threat-model subset. Operator-fleet
-          # tokens (CP_ADMIN_API_TOKEN, RAILWAY_TOKEN, INFISICAL_*) are
-          # caught by lint-forbidden-env-keys.yml's broader deny set; this
-          # lint focuses on the git-host class so a single co-occurrence
-          # match has a low false-positive rate.
-          FORBIDDEN_KEYS=(
-            "GITEA_TOKEN"
-            "GITEA_PAT"
-            "GITHUB_TOKEN"
-            "GITHUB_PAT"
-            "GH_TOKEN"
-          )
-
-          # Tenant-writer surface markers. A file matches the surface set
-          # if it references ANY of these strings. This is the "is this
-          # code path writing into a tenant workspace?" heuristic.
-          # Curated to catch the actual code shapes used in this repo
-          # (verified by grep against current main 2026-05-19):
-          #   - "workspace_secrets" / "global_secrets"  → DB table writes
-          #   - "seedAllowList"                          → CP-side seed table
-          #   - "/settings/secrets"                      → tenant HTTP API write
-          #   - "envVars["                               → in-memory env map write
-          #   - "containerEnv"                           → docker-run env-set
-          #   - "userData"                               → EC2 user-data script
-          #   - "provisionPayload" / "provisionContext"  → provision-request shape
-          SURFACE_PATTERN='workspace_secrets|global_secrets|seedAllowList|/settings/secrets|envVars\[|containerEnv|userData|provisionPayload|provisionContext'
-
-          # Files that legitimately reference these names AND a surface
-          # marker, but do so for guard / strip / test / doc-comment
-          # reasons. New entries require reviewer signoff and a one-line
-          # justification in the diff.
-          EXEMPT_FILES=(
-            # RFC#523 L1 deny-set source-of-truth + tests
-            "workspace-server/internal/handlers/workspace_provision_forbidden_env.go"
-            "workspace-server/internal/handlers/workspace_provision_forbidden_env_test.go"
-            # Forensic-#145 silent-strip denylist (defense-in-depth, by design lists the names)
-            "workspace-server/internal/provisioner/provisioner.go"
-            "workspace-server/internal/provisioner/provisioner_test.go"
-            # Pre-RFC#523 persona-fallback / org-helper paths. The L1
-            # fail-closed runs BEFORE these writers; downstream silent-strip
-            # also covers them. See applyAgentGitHTTPCreds doc-comment.
-            "workspace-server/internal/handlers/agent_git_identity.go"
-            "workspace-server/internal/handlers/org_helpers.go"
-            "workspace-server/internal/handlers/org.go"
-            # CP→platform admin auth (NOT a tenant env write).
-            "workspace-server/internal/provisioner/cp_provisioner.go"
-          )
-
-          # Build an extended-regex alternation of forbidden keys.
-          KEY_ALT="$(IFS='|'; echo "${FORBIDDEN_KEYS[*]}")"
-
-          # Find candidate files: Go non-test sources that contain a
-          # tenant-writer surface marker.
-          mapfile -t CANDIDATES < <(
-            grep -rlE --include='*.go' --exclude='*_test.go' \
-              "${SURFACE_PATTERN}" . 2>/dev/null \
-            | sed 's|^\./||' \
-            | sort -u
-          )
-
-          if [ "${#CANDIDATES[@]}" -eq 0 ]; then
-            echo "OK No tenant-writer-surface files found in tree (unexpected, but not a lint failure)."
-            exit 0
-          fi
-
-          HITS=""
-          for f in "${CANDIDATES[@]}"; do
-            # Skip exempt files.
-            skip=0
-            for ex in "${EXEMPT_FILES[@]}"; do
-              if [ "$f" = "$ex" ]; then skip=1; break; fi
-            done
-            [ "$skip" = "1" ] && continue
-
-            # File contains a surface marker; now grep for a forbidden
-            # key NAME. We require a QUOTED-literal match to avoid
-            # firing on a comment like "// also handle GITEA_TOKEN".
-            #
-            # The literal form catches:
-            #   - os.Getenv("GITEA_TOKEN")
-            #   - envVars["GITEA_TOKEN"] = ...
-            #   - {envKey: "GITEA_TOKEN", tenantKey: "GITEA_TOKEN"}
-            # but not:
-            #   - // see GITEA_TOKEN below   (no quotes)
-            found=$(grep -nE "\"(${KEY_ALT})\"" "$f" 2>/dev/null || true)
-            if [ -n "$found" ]; then
-              HITS="${HITS}--- ${f} ---\n${found}\n"
-            fi
-          done
-
-          if [ -n "$HITS" ]; then
-            echo "::error::Task #146 lint: repo-host token name(s) quoted in a tenant-writer-surface file:"
-            printf "$HITS"
-            echo ""
-            echo "These files reference a tenant-writer surface (workspace_secrets,"
-            echo "seedAllowList, /settings/secrets, containerEnv, userData, etc.)"
-            echo "AND quote a repo-host token name (GITEA_TOKEN/GITHUB_TOKEN/…)."
-            echo "Per RFC#523 threat model, tenant workspaces MUST NOT receive"
-            echo "operator-scope repo-host tokens. If your code legitimately needs"
-            echo "to reference one of these names in a tenant-writer file (e.g."
-            echo "a deny-set definition or silent-strip list), add the file to"
-            echo "EXEMPT_FILES with a one-line justification — reviewer signoff"
-            echo "required."
-            exit 1
-          fi
-
-          echo "OK No tenant-writer-surface file co-mentions a repo-host token literal."

.gitea/workflows/lint-pre-flip-continue-on-error.yml

@@ -4,7 +4,7 @@ name: Lint pre-flip continue-on-error
 # on any job in `.gitea/workflows/*.yml` WITHOUT proof that the affected
 # job's recent runs on the target branch (PR base) are actually green.
 #
-# Empirical class: PR #656 / mc#774. PR #656 (RFC internal#219 Phase 4)
+# Empirical class: PR #656 / mc#1982. PR #656 (RFC internal#219 Phase 4)
 # flipped 5 platform-build-class jobs `continue-on-error: true → false`
 # on the basis of a "verified green on main via combined-status check".
 # But that "green" was the LIE the prior `continue-on-error: true`
@@ -13,7 +13,7 @@ name: Lint pre-flip continue-on-error
 # job-level status. The precondition the PR claimed to verify was
 # structurally fooled by the bug being flipped.
 #
-# mc#774 captured the surfaced defects (2 mutually-masked regressions):
+# mc#1982 captured the surfaced defects (2 mutually-masked regressions):
 #   - Class 1: sqlmock helper drift since 2f36bb9a (24 days old)
 #   - Class 2: OFFSEC-001 contract collision since 7d1a189f (1 day old)
 #
@@ -55,7 +55,7 @@ name: Lint pre-flip continue-on-error
 #   - YAML parse error in one of the workflow files: warn-only,
 #     don't block — the YAML lint workflows catch this separately.
 #
-# Cross-links: PR#656, mc#774, PR#665 (interim re-mask),
+# Cross-links: PR#656, mc#1982, PR#665 (interim re-mask),
 # Quirk #10 (internal#342 + dup #287), hongming-pc2 charter
 # §SOP-N rule (e), feedback_strict_root_only_after_class_a,
 # feedback_no_shared_persona_token_use.
@@ -99,8 +99,8 @@ jobs:
     timeout-minutes: 8
     # Phase 3 (RFC internal#219 §1): surface broken flips without blocking
     # the PR yet. Follow-up flips this to `false` once the workflow itself
-    # has clean recent runs on main. mc#774 interim — remove when CoE→false.
-    continue-on-error: true  # mc#774
+    # has clean recent runs on main. mc#1982 interim — remove when CoE→false.
+    continue-on-error: true  # mc#1982
     steps:
       - name: Check out PR head (full history for base-SHA access)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

.gitea/workflows/lint-required-context-exists-in-bp.yml

@@ -1,6 +1,6 @@
 name: lint-required-context-exists-in-bp
 
-# Tier 2g hard-gate lint (per mc#774) — diff-based PR-time
+# Tier 2g hard-gate lint (per mc#1982) — diff-based PR-time
 # check. When a PR adds a NEW commit-status emission (workflow YAML
 # `name:` + job `name:`-or-key + on:-event), the workflow file must
 # carry one of three directives adjacent to the new job:
@@ -16,7 +16,7 @@ name: lint-required-context-exists-in-bp
 # PR#656 added `CI / all-required (pull_request)` as a sentinel
 # context that workflows emit, but BP did NOT list it. When
 # platform-build failed, all-required failed, but BP let the PR
-# merge anyway → cascade to mc#774. With this lint, PR#656 would
+# merge anyway → cascade to mc#1982. With this lint, PR#656 would
 # have been blocked until either the BP PATCH ran alongside OR
 # the author added a `bp-required: pending` directive.
 #
@@ -27,7 +27,7 @@ name: lint-required-context-exists-in-bp
 # share the workflow-context enumeration helpers
 # (`_event_map`, `workflow_contexts`, `_job_display`) but the
 # semantics are intentionally distinct so they're separate scripts.
-# Co-design is documented in mc#774.
+# Co-design is documented in mc#1982.
 #
 # Directive comment lives in the workflow file (NOT PR body)
 # ----------------------------------------------------------
@@ -42,13 +42,13 @@ name: lint-required-context-exists-in-bp
 # Lands at `continue-on-error: true` (Phase 3 — surface the
 # pattern without blocking PRs while the directive convention
 # beds in). After 7 days of clean runs on `main` with no false
-# positives, follow-up flips to `false`. Tracking: mc#774.
+# positives, follow-up flips to `false`. Tracking: mc#1982.
 #
 # Cross-links
 # -----------
-# - mc#774 (the RFC that specs this lint)
+# - mc#1982 (the RFC that specs this lint)
 # - PR#656 (the empirical case)
-# - mc#774 (the surfaced cascade)
+# - mc#1982 (the surfaced cascade)
 # - feedback_phantom_required_check_after_gitea_migration (Tier 2f cousin)
 # - feedback_behavior_based_ast_gates
 #
@@ -83,8 +83,8 @@ jobs:
     timeout-minutes: 5
     # Phase 3 (RFC #219 §1): surface the pattern without blocking PRs
     # while the directive convention beds in. Follow-up flip to false
-    # after 7 clean days on main. mc#774.
-    continue-on-error: true  # mc#774 Phase 3 — flip to false after 7 clean main runs
+    # after 7 clean days on main. mc#1982.
+    continue-on-error: true  # mc#1982 Phase 3 — flip to false after 7 clean main runs
     steps:
       - name: Check out PR head with full history (need base SHA blobs)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

.gitea/workflows/lint-workflow-yaml.yml

@@ -55,7 +55,7 @@ jobs:
     # Phase 3 (RFC #219 §1): surface broken shapes without blocking PRs.
     # Follow-up PR flips this off after the 4 existing-on-main rule-2
     # (workflow_run) violations are migrated to a supported trigger.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

.gitea/workflows/publish-canvas-image.yml

@@ -67,7 +67,7 @@ jobs:
     # in this rollout (internal#462) so the precondition holds.
     runs-on: publish
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     steps:
       - name: Checkout

.gitea/workflows/publish-workspace-server-image.yml

@@ -234,7 +234,7 @@ jobs:
     name: Production auto-deploy
     needs: build-and-push
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-    # Side-effect deploy only; image publish success is the durable artifact. mc#774
+    # Side-effect deploy only; image publish success is the durable artifact. mc#1982
     continue-on-error: true
     # Publish/release lane (internal#462) — production deploy of a merged
     # fix; reserved capacity, never queued behind PR-CI.

.gitea/workflows/railway-pin-audit.yml

@@ -51,7 +51,7 @@ jobs:
     name: Audit Railway env vars for drift-prone pins
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 10
 

.gitea/workflows/redeploy-tenants-on-main.yml

@@ -73,7 +73,7 @@ jobs:
     # it never queues behind PR-CI. `publish` -> molecule-runner-publish-*.
     runs-on: publish
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 25
     env:

.gitea/workflows/redeploy-tenants-on-staging.yml

@@ -80,7 +80,7 @@ jobs:
     # `publish` -> molecule-runner-publish-* sub-pool.
     runs-on: publish
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 25
     steps:

.gitea/workflows/review-check-tests.yml

@@ -54,7 +54,7 @@ jobs:
         # runners with internet access to package mirrors). Falls back to GitHub
         # binary download. GitHub releases may be blocked on some runner networks
         # (infra#241 follow-up).
-        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+        # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
         continue-on-error: true
         run: |
           if apt-get update -qq && apt-get install -y -qq jq; then

.gitea/workflows/secret-pattern-drift.yml

@@ -57,7 +57,7 @@ jobs:
     name: Detect SECRET_PATTERNS drift
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     timeout-minutes: 5
     steps:

.gitea/workflows/sop-tier-check.yml

@@ -36,7 +36,7 @@
 # window closed. continue-on-error: true has been removed from the
 # tier-check job; AND-composition is now fully enforced. If you need
 # to temporarily re-introduce a mask, file a tracker and follow the
-# mc#774 protocol (Tier 2e lint requires a current tracker within
+# mc#1982 protocol (Tier 2e lint requires a current tracker within
 # 2 lines of any continue-on-error: true).
 
 name: sop-tier-check
@@ -92,7 +92,7 @@ jobs:
         # runners). The sop-tier-check script has its own fallback as a
         # third line of defense. continue-on-error: true ensures this step
         # failing does not block the job.
-        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+        # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
         continue-on-error: true
         run: |
           # apt-get is the primary method — Ubuntu package mirrors are reliably
@@ -113,7 +113,7 @@ jobs:
         # continue-on-error: true at step level — job-level is ignored by Gitea
         # Actions (quirk #10, internal runbooks). Belt-and-suspenders with
         # SOP_FAIL_OPEN=1 + || true below.
-        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+        # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
         continue-on-error: true
         env:
           GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}

.gitea/workflows/staging-verify.yml

@@ -90,7 +90,7 @@ jobs:
   staging-smoke:
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     outputs:
       sha: ${{ steps.compute.outputs.sha }}
@@ -212,7 +212,7 @@ jobs:
     if: ${{ needs.staging-smoke.result == 'success' && needs.staging-smoke.outputs.smoke_ran == 'true' }}
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     env:
       SHA: ${{ needs.staging-smoke.outputs.sha }}

.gitea/workflows/sweep-cf-orphans.yml

@@ -71,7 +71,7 @@ jobs:
     name: Sweep CF orphans
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     # 3 min surfaces hangs (CF API stall, AWS describe-instances stuck)
     # within one cron interval instead of burning a full tick. Realistic

.gitea/workflows/sweep-cf-tunnels.yml

@@ -55,7 +55,7 @@ jobs:
     name: Sweep CF tunnels
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     # 30 min cap. Was 5 min on the theory that the only thing that
     # could take >5min is a CF-API hang — but on 2026-05-02 a backlog

.gitea/workflows/test-ops-scripts.yml

@@ -49,7 +49,7 @@ jobs:
     name: Ops scripts (unittest)
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.gitea/workflows/verify-providers-gen.yml

@@ -35,8 +35,26 @@ name: verify-providers-gen
 on:
   pull_request:
     types: [opened, synchronize, reopened]
+    # CI-scheduler-overload fix (fix/ci-scheduler-fanout, 2026-06-01):
+    # this gate only verifies that the generated providers artifact is in
+    # sync with the schema SSOT. Its verdict can ONLY change when one of
+    # the codegen inputs/outputs changes, so firing the Go toolchain on
+    # every unrelated PR (docs, canvas, scripts) is pure fan-out cost.
+    # Scoped to the codegen surface. SAFE because this workflow is NOT a
+    # branch-protection status_check_context (see header §ENFORCEMENT
+    # GATING) — lint-required-no-paths only forbids paths filters on
+    # REQUIRED workflows; this is advisory, so a paths filter is allowed.
+    # Mirrors the sibling sync-providers-yaml.yml scoping convention.
+    paths:
+      - 'workspace-server/internal/providers/**'
+      - 'workspace-server/cmd/gen-providers/**'
+      - '.gitea/workflows/verify-providers-gen.yml'
   push:
     branches: [main, staging]
+    paths:
+      - 'workspace-server/internal/providers/**'
+      - 'workspace-server/cmd/gen-providers/**'
+      - '.gitea/workflows/verify-providers-gen.yml'
 
 env:
   GITHUB_SERVER_URL: https://git.moleculesai.app

.gitea/workflows/weekly-platform-go.yml

@@ -31,7 +31,7 @@ jobs:
     name: Weekly Platform-Go Surface
     runs-on: ubuntu-latest
     # continue-on-error: surface only, never block
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    # mc#1982: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
     continue-on-error: true
     defaults:
       run:

README.md

@@ -49,8 +49,8 @@
 ## Quick Start
 
 ```bash
-git clone https://git.moleculesai.app/molecule-ai/molecule-monorepo.git
-cd molecule-monorepo
+git clone https://git.moleculesai.app/molecule-ai/molecule-core.git
+cd molecule-core
 ./scripts/dev-start.sh
 ```
 

canvas/src/app/pricing/page.tsx

@@ -41,7 +41,7 @@ export default function PricingPage() {
         <p className="mt-2 text-ink-mid">
           We publish the{" "}
           <a
-            href="https://git.moleculesai.app/molecule-ai/molecule-monorepo"
+            href="https://git.moleculesai.app/molecule-ai/molecule-core"
             className="text-accent underline hover:text-accent"
           >
             full source on GitHub

canvas/src/components/tabs/ConfigTab.tsx

@@ -377,11 +377,18 @@ export function billingModeForSelectedProvider(
 // config.yaml` on the container is a separate runtime-internal file,
 // not this one.
 const RUNTIMES_WITH_OWN_CONFIG = new Set<string>(["external", "kimi", "kimi-cli", "openclaw"]);
-const SUPPORTED_RUNTIME_VALUES = new Set(["claude-code", "codex", "openclaw", "hermes"]);
+// The runtime picker is SSOT-driven: options come from GET /templates,
+// which workspace-server already gates to the manifest.json maintained set
+// (loadRuntimesFromManifest). A hand-maintained frontend allowlist silently
+// dropped runtimes the backend added (google-adk shipped in manifest but was
+// filtered out, so its workspaces rendered the wrong default option). A
+// template may still opt OUT of the picker via `displayable: false` on its
+// /templates row. See project_canvas_runtime_dropdown_ssot_fix.
 
 const FALLBACK_RUNTIME_OPTIONS: RuntimeOption[] = [
   { value: "claude-code", label: "Claude Code", models: [], providers: [], registryBacked: false, registryProviders: [], registryModels: [] },
   { value: "codex", label: "Codex", models: [], providers: [], registryBacked: false, registryProviders: [], registryModels: [] },
+  { value: "google-adk", label: "Google ADK", models: [], providers: [], registryBacked: false, registryProviders: [], registryModels: [] },
   { value: "openclaw", label: "OpenClaw", models: [], providers: [], registryBacked: false, registryProviders: [], registryModels: [] },
   { value: "hermes", label: "Hermes", models: [], providers: [], registryBacked: false, registryProviders: [], registryModels: [] },
 ];
@@ -585,13 +592,16 @@ export function ConfigTab({ workspaceId }: Props) {
       registry_backed?: boolean;
       registry_providers?: RegistryProvider[];
       registry_models?: RegistryModel[];
+      displayable?: boolean;
     }>>("/templates")
       .then((rows) => {
         if (cancelled || !Array.isArray(rows)) return;
         const byRuntime = new Map<string, RuntimeOption>();
         for (const r of rows) {
           const v = (r.runtime || "").trim();
-          if (!SUPPORTED_RUNTIME_VALUES.has(v)) continue;
+          if (!v) continue;
+          // Honor an explicit opt-out; absent/true means show it.
+          if (r.displayable === false) continue;
           // Last template wins if two templates share a runtime — rare, and the
           // one with the richer models list is probably newer.
           const existing = byRuntime.get(v);

canvas/src/components/tabs/__tests__/ConfigTab.googleAdk.test.tsx

@@ -0,0 +1,87 @@
+// @vitest-environment jsdom
+//
+// Regression: project_canvas_runtime_dropdown_ssot_fix — a google-adk
+// workspace's Config tab showed the wrong runtime ("LangGraph (default)"
+// / first option) because a hardcoded frontend allowlist
+// (SUPPORTED_RUNTIME_VALUES) dropped google-adk from the /templates-derived
+// options even though the backend served it. A Save from that state would
+// PATCH runtime to the wrong value and break the ADK agent.
+//
+// The fix: the dropdown is SSOT-driven — it trusts GET /templates (which the
+// backend already gates to the manifest maintained set) and hides a runtime
+// only when its row carries `displayable: false`. This pins: a google-adk
+// workspace shows "google-adk" selected, and a displayable:false template is
+// not offered.
+import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
+import { render, screen, cleanup, waitFor } from "@testing-library/react";
+import React from "react";
+
+afterEach(cleanup);
+
+const apiGet = vi.fn();
+const apiPatch = vi.fn();
+const apiPut = vi.fn();
+vi.mock("@/lib/api", () => ({
+  api: {
+    get: (path: string) => apiGet(path),
+    patch: (path: string, body: unknown) => apiPatch(path, body),
+    put: (path: string, body: unknown) => apiPut(path, body),
+    post: vi.fn(),
+    del: vi.fn(),
+  },
+}));
+
+vi.mock("@/store/canvas", () => ({
+  useCanvasStore: Object.assign(
+    (selector: (s: unknown) => unknown) => selector({ restartWorkspace: vi.fn(), updateNodeData: vi.fn() }),
+    { getState: () => ({ restartWorkspace: vi.fn(), updateNodeData: vi.fn() }) },
+  ),
+}));
+
+vi.mock("../AgentCardSection", () => ({
+  AgentCardSection: () => <div data-testid="agent-card-stub" />,
+}));
+
+import { ConfigTab } from "../ConfigTab";
+
+function wireApi(templates: Array<{ id: string; name?: string; runtime?: string; models?: unknown[]; displayable?: boolean }>) {
+  apiGet.mockImplementation((path: string) => {
+    if (path === "/workspaces/ws-adk") return Promise.resolve({ runtime: "google-adk" });
+    if (path === "/workspaces/ws-adk/model") return Promise.resolve({ model: "vertex:gemini-2.5-pro" });
+    if (path === "/workspaces/ws-adk/files/config.yaml") return Promise.resolve({ content: "name: adk\nruntime: google-adk\n" });
+    if (path === "/templates") return Promise.resolve(templates);
+    return Promise.reject(new Error(`unmocked api.get: ${path}`));
+  });
+}
+
+beforeEach(() => {
+  apiGet.mockReset();
+  apiPatch.mockReset();
+  apiPut.mockReset();
+});
+
+describe("ConfigTab — google-adk runtime (SSOT dropdown)", () => {
+  it("shows google-adk selected in the runtime dropdown (#ssot-fix)", async () => {
+    wireApi([
+      { id: "claude-code", name: "Claude Code", runtime: "claude-code", models: [] },
+      { id: "google-adk", name: "Google ADK", runtime: "google-adk", models: [] },
+    ]);
+    render(<ConfigTab workspaceId="ws-adk" />);
+    const select = await waitFor(() => screen.getByRole("combobox", { name: /runtime/i }));
+    expect((select as HTMLSelectElement).value).toBe("google-adk");
+    const opts = Array.from((select as HTMLSelectElement).options).map((o) => o.value);
+    expect(opts).toContain("google-adk");
+  });
+
+  it("hides a template flagged displayable:false", async () => {
+    wireApi([
+      { id: "google-adk", name: "Google ADK", runtime: "google-adk", models: [] },
+      { id: "legacy", name: "Legacy", runtime: "legacy", models: [], displayable: false },
+    ]);
+    render(<ConfigTab workspaceId="ws-adk" />);
+    const select = await waitFor(() => screen.getByRole("combobox", { name: /runtime/i }));
+    const opts = Array.from((select as HTMLSelectElement).options).map((o) => o.value);
+    expect(opts).toContain("google-adk");
+    expect(opts).not.toContain("legacy");
+  });
+});

docs/architecture/molecule-technical-doc.md

@@ -1,7 +1,7 @@
 # Molecule AI — Comprehensive Technical Documentation
 
 > Definitive technical reference for the Molecule AI Agent Team platform.
-> Based on a full non-invasive scan of the [molecule-monorepo](https://git.moleculesai.app/molecule-ai/molecule-monorepo) repository.
+> Based on a full non-invasive scan of the [molecule-core](https://git.moleculesai.app/molecule-ai/molecule-core) repository.
 
 ---
 
@@ -1131,11 +1131,11 @@ Molecule AI's workspace abstraction is **runtime-agnostic by design**. A workspa
 
 ## Links
 
-- **GitHub**: https://git.moleculesai.app/molecule-ai/molecule-monorepo
-- **Architecture Docs**: https://git.moleculesai.app/molecule-ai/molecule-monorepo/src/branch/main/docs/architecture
-- **API Protocol**: https://git.moleculesai.app/molecule-ai/molecule-monorepo/src/branch/main/docs/api-protocol
-- **Agent Runtime**: https://git.moleculesai.app/molecule-ai/molecule-monorepo/src/branch/main/docs/agent-runtime
-- **Product Docs**: https://git.moleculesai.app/molecule-ai/molecule-monorepo/src/branch/main/docs/product
+- **GitHub**: https://git.moleculesai.app/molecule-ai/molecule-core
+- **Architecture Docs**: https://git.moleculesai.app/molecule-ai/molecule-core/src/branch/main/docs/architecture
+- **API Protocol**: https://git.moleculesai.app/molecule-ai/molecule-core/src/branch/main/docs/api-protocol
+- **Agent Runtime**: https://git.moleculesai.app/molecule-ai/molecule-core/src/branch/main/docs/agent-runtime
+- **Product Docs**: https://git.moleculesai.app/molecule-ai/molecule-core/src/branch/main/docs/product
 
 ---
 

docs/development/local-development.md

@@ -82,7 +82,7 @@ DATABASE_URL=postgres://dev:dev@postgres:5432/molecule?sslmode=prefer
 REDIS_URL=redis://redis:6379
 PORT=8080
 SECRETS_ENCRYPTION_KEY=dev-key-change-in-production
-WORKSPACE_DIR=/path/to/molecule-monorepo   # Optional global fallback; prefer per-workspace workspace_dir in org.yaml or API
+WORKSPACE_DIR=/path/to/molecule-core   # Optional global fallback; prefer per-workspace workspace_dir in org.yaml or API
 ```
 
 ### Canvas (Next.js)

docs/infra/workspace-terminal.md

@@ -16,11 +16,9 @@ workspace container running on it) over an [EC2 Instance Connect
 Endpoint](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-setup-ec2-instance-connect-endpoint.html).
 End users see a terminal; no direct public SSH ingress is required.
 
-Tracking: originally `molecule-core#1528` (resolved 2026-04-22). The
-`molecule-core` repo has since been renamed to `molecule-monorepo` and no
-longer accepts new issues under the old name; future terminal work is
-tracked in `molecule-monorepo` issues (workspace-server scope) and in
-`molecule-controlplane` issues for the EIC / per-tenant SG path.
+Tracking: originally `molecule-core#1528` (resolved 2026-04-22). Future
+terminal work is tracked in `molecule-core` issues (workspace-server scope)
+and in `molecule-controlplane` issues for the EIC / per-tenant SG path.
 
 ## Where things are
 

docs/integrations/opencode.md

@@ -64,7 +64,7 @@ When opencode connects to the Molecule MCP endpoint, the agent gains access to:
   "tool": "delegate_task",
   "arguments": {
     "target": "research-lead",
-    "task": "Summarise the last 7 days of commits in Molecule-AI/molecule-monorepo"
+    "task": "Summarise the last 7 days of commits in Molecule-AI/molecule-core"
   }
 }
 ```

docs/internal-content-policy.md

@@ -1,6 +1,6 @@
 # Internal content policy
 
-The `Molecule-AI/molecule-monorepo` repo is **public**. Anything internal
+The `Molecule-AI/molecule-core` repo is **public**. Anything internal
 (positioning, competitive briefs, sales playbooks, PMM/press drip, draft
 campaigns, raw research notes, ops runbooks, retrospectives) lives in
 **`Molecule-AI/internal`**.
@@ -18,14 +18,14 @@ This page is the canonical decision tree.
 | Draft campaign asset (still iterating, not yet customer-visible) | `Molecule-AI/internal/marketing/campaigns/` |
 | Roadmap discussion, planning doc, retrospective | `Molecule-AI/internal/PLAN.md` or `Molecule-AI/internal/retrospectives/` |
 | Runbook, ops procedure, incident postmortem | `Molecule-AI/internal/runbooks/` |
-| **Public-ready** blog post (final draft, ready to ship to docs site) | `Molecule-AI/molecule-monorepo/docs/blog/` |
-| **Public-ready** tutorial / quickstart | `Molecule-AI/molecule-monorepo/docs/tutorials/` |
-| Public DevRel content (code samples, demos for users) | `Molecule-AI/molecule-monorepo/docs/devrel/` |
-| API reference, architecture docs for external developers | `Molecule-AI/molecule-monorepo/docs/api/` |
+| **Public-ready** blog post (final draft, ready to ship to docs site) | `Molecule-AI/molecule-core/docs/blog/` |
+| **Public-ready** tutorial / quickstart | `Molecule-AI/molecule-core/docs/tutorials/` |
+| Public DevRel content (code samples, demos for users) | `Molecule-AI/molecule-core/docs/devrel/` |
+| API reference, architecture docs for external developers | `Molecule-AI/molecule-core/docs/api/` |
 | Code, tests, infrastructure | wherever is appropriate inside this repo |
 
 **Rule of thumb:** *"Would I be comfortable if a competitor / journalist / customer
-read this verbatim today?"* — yes → `monorepo/docs/`. No / not yet → `internal/`.
+read this verbatim today?"* — yes → `molecule-core/docs/`. No / not yet → `internal/`.
 
 ## Why
 
@@ -82,7 +82,7 @@ git push -u origin HEAD
 gh pr create --base main --fill
 ```
 
-Yes, this is more steps than `cd molecule-monorepo && git add research/foo.md`.
+Yes, this is more steps than `cd molecule-core && git add research/foo.md`.
 That cost is intentional: the friction is the point. Public space and
 internal space are different products with different audiences and
 different durability guarantees.

docs/quickstart.md

@@ -17,8 +17,8 @@ This path is aligned to the current repository and current UI. It gets you from
 ## The one-command path
 
 ```bash
-git clone https://git.moleculesai.app/molecule-ai/molecule-monorepo.git
-cd molecule-monorepo
+git clone https://git.moleculesai.app/molecule-ai/molecule-core.git
+cd molecule-core
 ./scripts/dev-start.sh
 ```
 
@@ -42,8 +42,8 @@ If you'd rather run each component yourself — useful when you're iterating on
 ### Step 1: Clone the repository
 
 ```bash
-git clone https://git.moleculesai.app/molecule-ai/molecule-monorepo.git
-cd molecule-monorepo
+git clone https://git.moleculesai.app/molecule-ai/molecule-core.git
+cd molecule-core
 ```
 
 ### Step 2: Start the shared infrastructure

docs/runbooks/engineer-agent-gitea-token-scope.md

@@ -0,0 +1,124 @@
+# Engineer-Agent Gitea Token Scope Runbook
+
+## Symptom
+
+Engineer-class agents (e.g. `agent-dev-a`, `agent-dev-b`) fail swarm-pull issue discovery or receive HTTP 403 when calling Gitea issue-list APIs, while PR review and repository API operations continue to work.
+
+Typical failing call:
+```bash
+GET /api/v1/repos/molecule-ai/molecule-core/issues?state=open&labels=approved&limit=50
+# => 403 Forbidden
+```
+
+Typical working calls (same token):
+```bash
+GET /api/v1/repos/molecule-ai/molecule-core/pulls?state=open&limit=50
+POST /api/v1/repos/molecule-ai/molecule-core/pulls/1666/comments
+# => 200 OK
+```
+
+## Root Cause
+
+Gitea v1.22.6 routes issue-list under the `Issue` scope category (`routers/api/v1/api.go:1379-1491`), while PR routes live under repository/pull routing (`api.go:1278-1305`). The scope gate derives required read/write level from HTTP method (`api.go:309-313`), so `GET /issues?...` requires `read:issue`.
+
+Engineer-class agent PATs were provisioned with repository and PR scopes but without `read:issue`, causing the asymmetric 403.
+
+## Detection
+
+1. **Agent-side**: swarm-pull workflow logs show `403 Forbidden` on issue enumeration but not on PR list/review.
+2. **Platform-side**: Gitea access logs show `GET /repos/{owner}/{repo}/issues` returning 403 for the affected token.
+3. **Reproduction** (from any workspace with a suspected token):
+   ```bash
+   TOKEN=$(cat /configs/secrets.d/GITEA_TOKEN)
+   PLATFORM="https://git.moleculesai.app"
+
+   # Should succeed — confirms token is live
+   curl -s -o /dev/null -w "%{http_code}" \
+     -H "Authorization: token $TOKEN" \
+     "$PLATFORM/api/v1/user"
+
+   # Will 403 if the token lacks read:issue
+   curl -s -o /dev/null -w "%{http_code}" \
+     -H "Authorization: token $TOKEN" \
+     "$PLATFORM/api/v1/repos/molecule-ai/molecule-core/issues?state=open&limit=1"
+   ```
+
+## Immediate Fix
+
+### Step 1: Issue fresh PATs with correct scopes
+
+From a Gitea site-admin account (or via the Gitea web UI → Settings → Applications):
+
+1. Navigate to the affected user's profile (e.g. `agent-dev-a`).
+2. Go to **Settings → Applications → Generate New Token**.
+3. Select scopes:
+   - `read:repository` (existing)
+   - `write:repository` (existing, if push is required)
+   - `read:issue` (**add this**)
+   - `write:issue` (add only if agents must comment/edit issues)
+   - `read:pull-request` / `write:pull-request` (existing)
+   - `read:comment` / `write:comment` (existing, if PR review is required)
+4. Copy the plaintext token immediately — it is shown only once.
+
+### Step 2: Update workspace secrets
+
+For each affected engineer workspace, update the Gitea token secret:
+
+```bash
+# Via the platform API (admin auth required)
+PLATFORM="https://agents-team.moleculesai.app"
+ADMIN_TOKEN="<your-admin-token>"
+WORKSPACE_ID="<affected-workspace-id>"
+NEW_GITEA_TOKEN="<fresh-token-from-step-1>"
+
+curl -X POST "$PLATFORM/workspaces/$WORKSPACE_ID/secrets" \
+  -H "Authorization: Bearer $ADMIN_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{
+    \"GITEA_TOKEN\": \"$NEW_GITEA_TOKEN\"
+  }"
+```
+
+Restart the workspace so the runtime re-reads secrets:
+```bash
+curl -X POST "$PLATFORM/workspaces/$WORKSPACE_ID/restart" \
+  -H "Authorization: Bearer $ADMIN_TOKEN"
+```
+
+### Step 3: Smoke-test
+
+From the restarted workspace, verify all three paths:
+
+```bash
+# 1. Issue list (the previously failing path)
+curl -s -H "Authorization: token $GITEA_TOKEN" \
+  "https://git.moleculesai.app/api/v1/repos/molecule-ai/molecule-core/issues?state=open&labels=approved&limit=1" | jq '.[0].number'
+
+# 2. PR list (should still work)
+curl -s -H "Authorization: token $GITEA_TOKEN" \
+  "https://git.moleculesai.app/api/v1/repos/molecule-ai/molecule-core/pulls?state=open&limit=1" | jq '.[0].number'
+
+# 3. Swarm-pull discovery (end-to-end)
+# Trigger the agent's autonomous tick or delegate a task that enumerates open issues.
+```
+
+## Long-Term Fix
+
+Update the **workspace secret injection path** that writes `/configs/secrets.d/GITEA_TOKEN` for engineer-class agents. The provisioning template or secret-distribution job should request `read:issue` (and optionally `write:issue`) at token-creation time.
+
+File locations to audit:
+- `.gitea/scripts/` — any token-provisioning automation
+- `infra/terraform/` or equivalent — IAM/secret-manager templates
+- `workspace-configs-templates/` — engineer-class workspace templates that declare required secrets
+
+## Prevention
+
+1. **Token scope checklist**: when provisioning new engineer-class agent tokens, verify the scope set includes `read:issue` before distributing the secret.
+2. **Monitoring**: add an agent health-check that probes `GET /repos/molecule-ai/molecule-core/issues?limit=1` and surfaces a non-fatal warning if it returns 403.
+3. **Documentation**: update the onboarding runbook for new engineer agents to include the full required scope list.
+
+## References
+
+- Gitea issue #1750: [RCA: engineer-token read:issue scope gap blocks swarm-pull workflow](https://git.moleculesai.app/molecule-ai/molecule-core/issues/1750)
+- Gitea source: `routers/api/v1/api.go:309-313` (scope gate), `api.go:1278-1305` (PR routing), `api.go:1379-1491` (issue routing)
+- Related: PR #1542 (provisioner git-creds injection), PR #1669 (auth_token inline mint)

scripts/ops/check_migration_collisions.py

@@ -93,9 +93,7 @@ def _gitea_get(path: str, params: dict[str, str] | None = None) -> bytes | None:
     try:
         # S310 (信任boundary): this function IS the outbound HTTP client for
         # Gitea API calls. The call is intentional and controlled — we build
-        # the request ourselves and handle errors explicitly. Timeout=20s
-        # prevents indefinite hangs.
-        with urllib.request.urlopen(req, timeout=20) as resp:  # noqa: S310
+        with urllib.request.urlopen(req, timeout=20) as resp:  # noqa: S310  # explicit timeout + error handling; bandit false positive
             return resp.read()
     except urllib.error.HTTPError as e:
         sys.stderr.write(f"Gitea API HTTP {e.code} on {path}: {e.reason}\n")

scripts/wheel_smoke.py

@@ -27,9 +27,9 @@ def smoke_imports_and_invariants() -> None:
     import-rewrite mistakes (the 0.1.16 incident, where main.py loaded but
     main_sync was missing because the build script dropped a re-export).
     """
-    from molecule_runtime.main import main_sync  # noqa: F401
-    from molecule_runtime import a2a_client, a2a_tools  # noqa: F401
-    from molecule_runtime.builtin_tools import memory  # noqa: F401
+    from molecule_runtime.main import main_sync  # noqa: F401  # smoke-test re-export regression (mc#1769)
+    from molecule_runtime import a2a_client, a2a_tools  # noqa: F401  # smoke-test re-export regression (mc#1769)
+    from molecule_runtime.builtin_tools import memory  # noqa: F401  # smoke-test re-export regression (mc#1769)
     from molecule_runtime.adapters import get_adapter, BaseAdapter, AdapterConfig
 
     # cli_main + mcp_cli.main are the molecule-mcp console-script entry
@@ -38,8 +38,8 @@ def smoke_imports_and_invariants() -> None:
     # rewrite here would break every external operator's MCP install on
     # the next wheel publish. Pin both names because pyproject points
     # at mcp_cli.main, which then imports a2a_mcp_server.cli_main.
-    from molecule_runtime.a2a_mcp_server import cli_main  # noqa: F401
-    from molecule_runtime.mcp_cli import main as mcp_cli_main  # noqa: F401
+    from molecule_runtime.a2a_mcp_server import cli_main  # noqa: F401  # smoke-test re-export regression (mc#1769)
+    from molecule_runtime.mcp_cli import main as mcp_cli_main  # noqa: F401  # smoke-test re-export regression (mc#1769)
     assert callable(cli_main), "a2a_mcp_server.cli_main must be callable"
     assert callable(mcp_cli_main), "mcp_cli.main must be callable"
 
@@ -48,7 +48,7 @@ def smoke_imports_and_invariants() -> None:
     # imports + activates these at startup; if a wheel ships without
     # them, the standalone agent silently loses the wait_for_message /
     # inbox_peek / inbox_pop tools and reverts to outbound-only.
-    from molecule_runtime.inbox import (  # noqa: F401
+    from molecule_runtime.inbox import (  # noqa: F401  # smoke-test re-export regression (mc#1769)
         InboxState,
         activate as inbox_activate,
         get_state as inbox_get_state,

tools/check-template-parity.sh

@@ -13,7 +13,7 @@
 #
 # Invocation (from template-hermes repo's CI):
 #
-#     bash /path/to/molecule-monorepo/tools/check-template-parity.sh \
+#     bash /path/to/molecule-core/tools/check-template-parity.sh \
 #          install.sh start.sh
 #
 # Or inline via curl:

workspace-server/cmd/server/main.go

@@ -36,6 +36,7 @@ import (
 	"time"
 
 	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/channels"
+	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/codexauth"
 	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/crypto"
 	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/db"
 	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/events"
@@ -334,6 +335,20 @@ func main() {
 		pendinguploads.StartSweeper(c, pendinguploads.NewPostgres(db.DB), 0)
 	})
 
+	// Codex shared-OAuth central refresher — the SINGLE owner of the rotating
+	// refresh_token for the global codex (ChatGPT/Codex subscription) credential
+	// (global_secrets key CODEX_AUTH_JSON). Multiple codex workspaces share ONE
+	// ChatGPT-Pro OAuth token; OpenAI's refresh_token is single-use, so letting
+	// each per-agent app-server refresh on its own 401 burned the seed within
+	// seconds (a refresh storm). This goroutine is structurally single-flight
+	// (one goroutine + a package mutex), refreshes only within a safety margin
+	// of expiry, POSTs the refresh_token at most once per due cycle, and writes
+	// the rotated blob back — workspaces now only GET the current token (see the
+	// codex template's codex_auth_sync.sh). INERT when no CODEX_AUTH_JSON exists.
+	go supervised.RunWithRecover(ctx, "codex-auth-refresher", func(c context.Context) {
+		codexauth.StartCodexAuthRefresher(c, db.DB)
+	})
+
 	// Provision-timeout sweep — flips workspaces that have been stuck in
 	// status='provisioning' past the timeout window to 'failed' and emits
 	// WORKSPACE_PROVISION_TIMEOUT. Without this the UI banner is cosmetic

workspace-server/docs/openapi/README.md

@@ -0,0 +1,114 @@
+# Molecule Platform OpenAPI specs
+
+This directory holds the machine-readable API contracts for the Molecule
+platform.
+
+| File | Spec | Scope | Status |
+|------|------|-------|--------|
+| `management.yaml` | OpenAPI **3.1** | The **management surface** across both services (orgs, billing, admin, provisioning, workspaces, secrets, templates, org-tokens, bundles). | **SSOT** — hand-authored. |
+| `swagger.yaml` / `swagger.json` | OpenAPI 2.0 | swaggo-generated stub, `/schedules` only (the per-workspace **runtime** surface). | Legacy stub; superseded for management by `management.yaml`. |
+
+`management.yaml` is the **single source of truth** the management tooling
+derives from — the management MCP server, the management CLI (`molecule-cli`),
+and the human-facing API docs (RFC #1706, the gap closed by
+`PLATFORM-MANAGEMENT-API.md` §5c). Do not hand-edit those clients' route maps;
+change them here and regenerate/derive.
+
+## The two-service split
+
+One structural fact drives the whole spec: there are **two services with two
+auth stacks**, and the management surface spans both.
+
+```
+                         ┌─────────────────────────────────────────┐
+   browser / CLI / MCP   │  Control plane (CP)                      │
+        │                │  molecule-controlplane @ api.moleculesai │
+        │  session       │  /api/v1/* (stable) [+ /cp/* sunset]      │
+        ├───────────────▶│  orgs · members · billing · provisioning │
+        │  admin bearer  │  · fleet/admin ops · pins                 │
+        │  provision sec │                                          │
+        └────────────────┴──────────────┬───────────────────────────┘
+                                         │ edge reverse-proxy
+                                         │ (subdomain / X-Molecule-Org-Slug)
+                                         ▼
+                         ┌─────────────────────────────────────────┐
+   Org API Key / ws tok  │  Tenant workspace-server                 │
+        │                │  molecule-core/workspace-server          │
+        └───────────────▶│  ONE EC2 per org @ <slug>.moleculesai.app│
+                         │  workspaces · secrets · templates ·      │
+                         │  org-tokens · bundles                    │
+                         └─────────────────────────────────────────┘
+```
+
+- **Control plane (CP)** — `api.moleculesai.app`, routes modelled under
+  `/api/v1/*` (the `/cp/*` mirror is identical but sunset-headed per RFC #61 and
+  is not duplicated in the spec). Owns **orgs, members, billing, provisioning,
+  fleet/admin ops**.
+- **Tenant workspace-server** — one EC2 per org at `<slug>.moleculesai.app`.
+  Owns **workspaces, agents, secrets, templates, org-tokens, bundles**. Requests
+  may also be sent to the CP host with an `X-Molecule-Org-Slug` header; the CP
+  edge reverse-proxies them to the tenant host (the `Authorization`,
+  `X-Molecule-Org-*`, and cookie headers pass through unchanged and the tenant's
+  own middleware validates them).
+
+The key consequence, called out in `PLATFORM-MANAGEMENT-API.md`: **the Org API
+Key is a TENANT credential, not a CP one.** It is full tenant-admin over its own
+org's workspace-server surface and reaches **nothing** on the CP (org
+create/delete, billing, members, provisioning all 401/403 it). That is why
+member/billing tools belong in a separate CP-admin MCP, not the org-key-authed
+management MCP.
+
+## Security scheme → surface map (the tier matrix)
+
+`management.yaml` defines these `securitySchemes`; each operation declares the
+one(s) it accepts. Mirror of `PLATFORM-MANAGEMENT-API.md` §1:
+
+| Scheme | What it is | Where it applies |
+|--------|-----------|------------------|
+| `workosSession` | WorkOS AuthKit session cookie `mcp_session` (+ org membership/ownership checks) | CP `/api/v1/orgs/*`, `/api/v1/billing/*`. Also accepted on the tenant surface via the CP-session path. |
+| `cpAdminBearer` | CP `CP_ADMIN_API_TOKEN` operator bearer (AdminGate, constant-time) | CP `/api/v1/admin/*` — admin-create-org, tenant teardown, workspace env, ListOrgWorkspaces, redeploy, pins. |
+| `provisionSecret` | CP `PROVISION_SHARED_SECRET` bearer | CP `/api/v1/workspaces/provision`, `…/status`. Routes unmounted when the secret is unset. |
+| `tenantAdminToken` | Per-tenant admin_token (+ `X-Molecule-Org-Id`) | CP `DELETE /api/v1/workspaces/:id` (deprovision) — **in addition to** `provisionSecret` (issue #118). |
+| `orgApiKey` | Tenant Org API Key — `Authorization: Bearer <key>` + routing header; full tenant-admin, self-minting | **All** tenant routes: `/workspaces[/:id]`, `/workspaces/:id/secrets`, budget, billing-mode, `/settings/secrets`, `/org/import`, `/org/templates`, `/org/tokens`, `/templates`, `/bundles`. |
+| `workspaceToken` | Per-workspace bearer, bound to one workspace id (+ routing header) | Read/lifecycle/secrets on a single `/workspaces/:id/*`. **Rejected** on admin list/create/delete when ADMIN_TOKEN is set — use `orgApiKey`. |
+| `orgRoutingHeaderId` / `orgRoutingHeaderSlug` | `X-Molecule-Org-Id` / `X-Molecule-Org-Slug` | Required on every tenant-host request so the edge / TenantGuard route + authorize against the correct org. Send one of them alongside the bearer. |
+
+### Guards worth knowing (modelled per-operation)
+
+- **Dry-run:** `POST /api/v1/admin/orgs?dry_run=true` — validate + echo, no org
+  created. (The only dry-run on the whole management API.)
+- **Confirm token:** `DELETE /api/v1/admin/tenants/:slug` and
+  `…/scrub-artifacts` — body `confirm` MUST equal the URL slug, else `400`
+  before any teardown.
+- **Force flag:** `POST /api/v1/admin/workspaces/:id/env` — keys matching the
+  secret-keyword guard (`TOKEN`/`SECRET`/`KEY`/`PASSWORD`) require `force=true`.
+- **Runtime-pin gate:** `POST /api/v1/workspaces/provision` returns `422
+  RUNTIME_PIN_MISSING` when no runtime image pin exists.
+- **Auto-restart side-effects:** writing a workspace or global secret
+  auto-restarts the affected workspace(s).
+
+## Security note (carried from the synthesis spec)
+
+The Org API Key is **full tenant-admin and self-minting** — a management MCP
+holding one holds tenant root. There is no scope-down today (TODO in
+`orgtoken`). Per-role / per-workspace scoping should ship alongside the
+management MCP.
+
+## Validate
+
+```bash
+cd workspace-server/docs/openapi
+npx @redocly/cli lint management.yaml   # must be clean (0 errors, 0 warnings)
+```
+
+## Scope notes / best-effort flags
+
+- The per-workspace **runtime** surface (schedules, agent, registry, a2a,
+  memory, approvals, channels, terminal, files) is intentionally **out of
+  scope** here — that's the runtime contract, not management.
+- A handful of bodies are **best-effort** from the handlers (org-import inline
+  template, bundle import, list responses with open shapes) and are marked with
+  `additionalProperties: true` in the schema. Tighten as the handler structs
+  stabilise.
+- `/cp/*` deprecated mirrors are omitted (identical shapes; RFC #61
+  Deprecation/Sunset). Build against `/api/v1/*`.

workspace-server/internal/codexauth/refresher.go

@@ -0,0 +1,463 @@
+// Package codexauth owns the SINGLE, platform-side refresh of the global
+// codex (ChatGPT/Codex subscription) OAuth credential stored in the
+// global_secrets table under key CODEX_AUTH_JSON.
+//
+// THE PROBLEM IT FIXES (agents-team prod, 2026-05-31)
+//
+// Multiple codex workspaces share ONE ChatGPT-Pro OAuth token (the global
+// secret CODEX_AUTH_JSON). OpenAI's refresh_token is SINGLE-USE: every refresh
+// rotates it and invalidates the prior one. When each per-agent codex
+// app-server refreshed independently on a 401, the siblings' in-flight tokens
+// were invalidated within seconds — a refresh storm that burned the seed and
+// wedged every codex agent.
+//
+// THE FIX (two halves; this is the core half)
+//
+//  1. The per-workspace codex app-server NO LONGER refreshes (the template's
+//     OAuth POST is gated off by default — see the codex template's
+//     codex_auth_sync.sh / CODEX_AUTH_REFRESH_OWNER gate). Workspaces only ever
+//     GET the current token and write it to auth.json.
+//  2. ONE owner refreshes the rotating refresh_token: this background goroutine
+//     in the platform. It is structurally single-flight (one goroutine + a
+//     package mutex), refreshes ONLY when the access_token is within a safety
+//     margin of expiry, POSTs the refresh_token at most ONCE per due cycle, and
+//     writes the rotated blob back to global_secrets. On a permanent failure
+//     (the seed was already burned by an out-of-band login) it logs ONCE and
+//     backs off — it never hot-loops a dead refresh_token.
+//
+// Billing-mode resolution and the byok strip are UNTOUCHED by this package.
+package codexauth
+
+import (
+	"context"
+	"database/sql"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/crypto"
+)
+
+const (
+	// CodexAuthSecretKey is the global_secrets key holding the shared codex
+	// ChatGPT/Codex subscription OAuth blob (auth.json contents).
+	CodexAuthSecretKey = "CODEX_AUTH_JSON"
+
+	// oauthTokenURL is OpenAI's OAuth token endpoint. The ONLY endpoint this
+	// package ever POSTs to, and only for a due refresh.
+	oauthTokenURL = "https://auth.openai.com/oauth/token"
+
+	// codexOAuthClientID is the public Codex CLI OAuth client id (the same id
+	// the codex CLI sends). Not a secret.
+	codexOAuthClientID = "app_EMoamEEZ73f0CkXaXp7hrann"
+
+	// refreshSafetyMargin is how far ahead of access_token expiry a refresh is
+	// considered DUE. A token expiring within this window is refreshed now; one
+	// expiring later is left untouched (skip-when-fresh). Generous so a slow
+	// tick can never let the shared token lapse for the fleet.
+	refreshSafetyMargin = 15 * time.Minute
+
+	// defaultInterval is how often the loop wakes to check due-ness. The check
+	// is cheap (decrypt + JWT exp parse) and only POSTs when actually due.
+	defaultInterval = 5 * time.Minute
+
+	// permanentFailureBackoff is how long the loop waits after a PERMANENT
+	// refresh failure (invalid_grant / "refresh token already used"). The seed
+	// is burned until a human re-seeds a fresh login; there is nothing to retry,
+	// so we back off hard rather than hammer the dead token.
+	permanentFailureBackoff = 1 * time.Hour
+)
+
+// SecretStore is the minimal global_secrets surface the refresher needs. The
+// production implementation (postgresStore) is backed by *sql.DB; tests inject
+// a fake. It is deliberately tiny — read one key, write one key — so the test
+// double is trivial and the refresher never reaches for the package-global DB.
+type SecretStore interface {
+	// Get returns the decrypted secret value and true, or ("", false) when the
+	// key is absent. A non-nil error is a real read failure (not absence).
+	Get(ctx context.Context, key string) (value string, found bool, err error)
+	// Put encrypts and upserts value under key, bumping the row's updated_at
+	// (the "last_refresh" timestamp). It is the rotated-blob write-back.
+	Put(ctx context.Context, key, value string) error
+}
+
+// httpDoer is the http client seam (real *http.Client in prod, fake transport
+// in tests). Tests NEVER hit the network.
+type httpDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// refresher is the single-owner refresh engine. The package-level mutex makes
+// the refresh structurally single-flight: even if two refreshOnce calls raced
+// (they cannot in prod — one goroutine drives it — but a test or a future
+// caller might), only one POSTs at a time, and the access-token freshness
+// re-check inside the lock means the second sees a freshly-rotated token and
+// skips. One goroutine + this mutex = single-flight by construction.
+type refresher struct {
+	store  SecretStore
+	client httpDoer
+	now    func() time.Time
+
+	// permanentlyFailed records that the current seed's refresh_token was
+	// rejected as already-used/invalid. While set, refreshOnce is INERT (it
+	// will not re-POST the dead token) until the secret value CHANGES (a human
+	// re-seed), detected by comparing the stored blob. This is the anti-storm
+	// latch — it lives on the struct, not globally, so it resets if the seed is
+	// replaced out of band.
+	failedSeed string // the auth-json blob that failed; "" = no known failure
+}
+
+// mu serializes refreshOnce across the process. Package-level so the
+// single-flight guarantee holds regardless of how many refresher values exist
+// (in prod there is exactly one).
+var mu sync.Mutex
+
+// oauthTokens is the token trio inside auth.json (and the OAuth response).
+type oauthTokens struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+	IDToken      string `json:"id_token,omitempty"`
+}
+
+// StartCodexAuthRefresher launches the single background refresher goroutine.
+// It returns immediately; the loop runs until ctx is cancelled. Wire it under
+// supervised.RunWithRecover in main.go like the other Start* sweeps.
+//
+// db may be nil only in tests that drive refreshOnce directly; in prod it is
+// the server's *sql.DB. The loop is INERT (logs once, keeps ticking) whenever
+// CODEX_AUTH_JSON is absent — a deployment with no shared codex seed pays only
+// a cheap periodic read.
+func StartCodexAuthRefresher(ctx context.Context, db *sql.DB) {
+	r := &refresher{
+		store:  &postgresStore{db: db},
+		client: &http.Client{Timeout: 30 * time.Second},
+		now:    time.Now,
+	}
+	r.run(ctx, defaultInterval)
+}
+
+// run is the tick loop. It checks due-ness every interval and on a permanent
+// failure waits permanentFailureBackoff before the next check (never a tight
+// retry of a burned token).
+func (r *refresher) run(ctx context.Context, interval time.Duration) {
+	// Check once promptly on boot, then on the interval.
+	for {
+		wait := interval
+		if perm := r.refreshOnce(ctx); perm {
+			// Permanent failure this cycle — the seed is burned. Back off hard;
+			// a human must re-seed. We keep ticking (a re-seed CHANGES the blob,
+			// which clears the latch) but slowly.
+			wait = permanentFailureBackoff
+		}
+
+		timer := time.NewTimer(wait)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			log.Printf("codexauth: context done; stopping refresher")
+			return
+		case <-timer.C:
+		}
+	}
+}
+
+// refreshOnce performs ONE due-check + at most one refresh POST. It returns
+// permanentFailure=true iff the refresh_token was permanently rejected this
+// cycle (the caller backs off). All other outcomes (inert/skip/rotated/transient
+// error) return false.
+//
+// It is single-flight: the package mutex is held for the whole read→decide→
+// POST→write-back so two callers cannot both POST the (single-use) refresh_token.
+func (r *refresher) refreshOnce(ctx context.Context) (permanentFailure bool) {
+	mu.Lock()
+	defer mu.Unlock()
+
+	blob, found, err := r.store.Get(ctx, CodexAuthSecretKey)
+	if err != nil {
+		log.Printf("codexauth: read CODEX_AUTH_JSON failed: %v (skipping this cycle)", err)
+		return false
+	}
+	if !found || strings.TrimSpace(blob) == "" {
+		// INERT: no shared codex seed in this deployment. Cheap no-op.
+		log.Printf("codexauth: no CODEX_AUTH_JSON in global_secrets — refresher inert")
+		// A previously-failed seed that has since been DELETED clears the latch.
+		r.failedSeed = ""
+		return false
+	}
+
+	// Anti-storm latch: if THIS exact blob already failed permanently, do not
+	// re-POST its dead refresh_token. A re-seed changes the blob and clears it.
+	if r.failedSeed != "" && r.failedSeed == blob {
+		return false
+	}
+	if r.failedSeed != "" && r.failedSeed != blob {
+		// The seed changed out of band (human re-login) — give it a fresh chance.
+		r.failedSeed = ""
+	}
+
+	tokens, err := parseTokens(blob)
+	if err != nil {
+		log.Printf("codexauth: CODEX_AUTH_JSON is not parseable codex auth json: %v (skipping)", err)
+		return false
+	}
+	if tokens.RefreshToken == "" {
+		log.Printf("codexauth: CODEX_AUTH_JSON carries no refresh_token (skipping)")
+		return false
+	}
+
+	// Skip-when-fresh: only refresh within the safety margin of expiry. A blob
+	// with an unparseable/absent access_token exp is treated as DUE (better to
+	// refresh a token we cannot date than let the fleet lapse).
+	exp, haveExp := jwtExp(tokens.AccessToken)
+	if haveExp {
+		remaining := exp.Sub(r.now())
+		if remaining > refreshSafetyMargin {
+			// Fresh — nothing to do. No POST.
+			return false
+		}
+	}
+
+	// DUE: POST the refresh_token ONCE.
+	newTokens, perm, err := r.doRefresh(ctx, tokens.RefreshToken)
+	if err != nil {
+		if perm {
+			// Permanent: the seed is burned. Latch it so we don't re-POST, log
+			// ONCE, and DO NOT write anything back.
+			log.Printf("codexauth: PERMANENT refresh failure (refresh_token rejected): %v — "+
+				"NOT writing back; the shared CODEX_AUTH_JSON seed is burned and must be re-seeded "+
+				"via a fresh codex login. Backing off.", err)
+			r.failedSeed = blob
+			return true
+		}
+		// Transient (network/5xx): no write-back, retry next cycle (no backoff).
+		log.Printf("codexauth: transient refresh error: %v (will retry next cycle)", err)
+		return false
+	}
+
+	// Success: merge the rotated trio into the blob (preserving every other
+	// field) and write it back encrypted, bumping updated_at (last_refresh).
+	rotated, err := mergeTokens(blob, newTokens)
+	if err != nil {
+		log.Printf("codexauth: failed to merge rotated tokens into auth json: %v (NOT writing back)", err)
+		return false
+	}
+	if err := r.store.Put(ctx, CodexAuthSecretKey, rotated); err != nil {
+		log.Printf("codexauth: write-back of rotated CODEX_AUTH_JSON failed: %v", err)
+		return false
+	}
+	r.failedSeed = "" // success clears any stale latch
+	log.Printf("codexauth: rotated shared CODEX_AUTH_JSON (single-owner refresh)")
+	return false
+}
+
+// doRefresh POSTs the refresh_token to OpenAI's OAuth endpoint exactly once and
+// returns the rotated trio. permanent=true marks an unrecoverable rejection
+// (HTTP 400 invalid_grant / "refresh token already used") so the caller latches
+// and backs off instead of retrying.
+func (r *refresher) doRefresh(ctx context.Context, refreshToken string) (tokens oauthTokens, permanent bool, err error) {
+	body, _ := json.Marshal(map[string]string{
+		"grant_type":    "refresh_token",
+		"client_id":     codexOAuthClientID,
+		"refresh_token": refreshToken,
+	})
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, oauthTokenURL, strings.NewReader(string(body)))
+	if err != nil {
+		return oauthTokens{}, false, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := r.client.Do(req)
+	if err != nil {
+		return oauthTokens{}, false, err // transient: network
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+
+	if resp.StatusCode == http.StatusOK {
+		var t oauthTokens
+		if err := json.Unmarshal(respBody, &t); err != nil {
+			return oauthTokens{}, false, fmt.Errorf("decode token response: %w", err)
+		}
+		if t.AccessToken == "" {
+			return oauthTokens{}, false, fmt.Errorf("token response missing access_token")
+		}
+		return t, false, nil
+	}
+
+	// Non-200. A 400 (and any body naming invalid_grant / already-used) is a
+	// PERMANENT rejection of the refresh_token. 401/403 likewise mean the seed
+	// is no good. Everything else (429/5xx/network-shaped) is transient.
+	lowerBody := strings.ToLower(string(respBody))
+	isInvalidGrant := strings.Contains(lowerBody, "invalid_grant") ||
+		strings.Contains(lowerBody, "refresh token already used") ||
+		strings.Contains(lowerBody, "already been used") ||
+		strings.Contains(lowerBody, "token has been revoked")
+	switch {
+	case resp.StatusCode == http.StatusBadRequest && isInvalidGrant:
+		return oauthTokens{}, true, fmt.Errorf("oauth %d: %s", resp.StatusCode, strings.TrimSpace(string(respBody)))
+	case resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden:
+		return oauthTokens{}, true, fmt.Errorf("oauth %d: %s", resp.StatusCode, strings.TrimSpace(string(respBody)))
+	default:
+		return oauthTokens{}, false, fmt.Errorf("oauth %d: %s", resp.StatusCode, strings.TrimSpace(string(respBody)))
+	}
+}
+
+// parseTokens extracts the OAuth trio from an auth.json blob, accepting both
+// the nested `{"tokens":{...}}` shape the codex CLI writes and a flat top-level
+// shape some seeds use.
+func parseTokens(blob string) (oauthTokens, error) {
+	var top map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(blob), &top); err != nil {
+		return oauthTokens{}, err
+	}
+	if nested, ok := top["tokens"]; ok {
+		var t oauthTokens
+		if err := json.Unmarshal(nested, &t); err != nil {
+			return oauthTokens{}, fmt.Errorf("decode nested tokens: %w", err)
+		}
+		return t, nil
+	}
+	var t oauthTokens
+	if err := json.Unmarshal([]byte(blob), &t); err != nil {
+		return oauthTokens{}, err
+	}
+	return t, nil
+}
+
+// mergeTokens writes the rotated trio back into the original blob in-place,
+// preserving the blob's shape (nested-vs-flat) and every other field. A field
+// in the OAuth response that is empty (e.g. id_token omitted) does NOT clobber
+// the existing value.
+func mergeTokens(blob string, rotated oauthTokens) (string, error) {
+	var top map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(blob), &top); err != nil {
+		return "", err
+	}
+
+	applyTo := func(m map[string]json.RawMessage) error {
+		setStr := func(key, val string) error {
+			if val == "" {
+				return nil // don't clobber an existing value with an empty one
+			}
+			b, err := json.Marshal(val)
+			if err != nil {
+				return err
+			}
+			m[key] = b
+			return nil
+		}
+		if err := setStr("access_token", rotated.AccessToken); err != nil {
+			return err
+		}
+		if err := setStr("refresh_token", rotated.RefreshToken); err != nil {
+			return err
+		}
+		if err := setStr("id_token", rotated.IDToken); err != nil {
+			return err
+		}
+		return nil
+	}
+
+	if nestedRaw, ok := top["tokens"]; ok {
+		var nested map[string]json.RawMessage
+		if err := json.Unmarshal(nestedRaw, &nested); err != nil {
+			return "", fmt.Errorf("decode nested tokens for merge: %w", err)
+		}
+		if err := applyTo(nested); err != nil {
+			return "", err
+		}
+		nb, err := json.Marshal(nested)
+		if err != nil {
+			return "", err
+		}
+		top["tokens"] = nb
+	} else {
+		if err := applyTo(top); err != nil {
+			return "", err
+		}
+	}
+
+	out, err := json.Marshal(top)
+	if err != nil {
+		return "", err
+	}
+	return string(out), nil
+}
+
+// jwtExp decodes the `exp` claim (Unix seconds) from a JWT access token WITHOUT
+// verifying the signature (we only need the expiry to decide due-ness; the
+// token's validity is OpenAI's to enforce). Returns ok=false when the token is
+// not a parseable 3-part JWT or carries no numeric exp.
+func jwtExp(token string) (time.Time, bool) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return time.Time{}, false
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		// Some encoders pad; tolerate standard base64url with padding too.
+		payload, err = base64.URLEncoding.DecodeString(parts[1])
+		if err != nil {
+			return time.Time{}, false
+		}
+	}
+	var claims struct {
+		Exp json.Number `json:"exp"`
+	}
+	if err := json.Unmarshal(payload, &claims); err != nil {
+		return time.Time{}, false
+	}
+	secs, err := claims.Exp.Int64()
+	if err != nil || secs <= 0 {
+		return time.Time{}, false
+	}
+	return time.Unix(secs, 0), true
+}
+
+// postgresStore is the production SecretStore backed by global_secrets, using
+// the SAME crypto path the secrets handler uses (DecryptVersioned on read,
+// Encrypt + CurrentEncryptionVersion on write).
+type postgresStore struct {
+	db *sql.DB
+}
+
+func (s *postgresStore) Get(ctx context.Context, key string) (string, bool, error) {
+	var enc []byte
+	var ver int
+	err := s.db.QueryRowContext(ctx,
+		`SELECT encrypted_value, encryption_version FROM global_secrets WHERE key = $1`, key).
+		Scan(&enc, &ver)
+	if err == sql.ErrNoRows {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, err
+	}
+	plain, err := crypto.DecryptVersioned(enc, ver)
+	if err != nil {
+		return "", false, err
+	}
+	return string(plain), true, nil
+}
+
+func (s *postgresStore) Put(ctx context.Context, key, value string) error {
+	enc, err := crypto.Encrypt([]byte(value))
+	if err != nil {
+		return err
+	}
+	ver := crypto.CurrentEncryptionVersion()
+	_, err = s.db.ExecContext(ctx, `
+		INSERT INTO global_secrets (key, encrypted_value, encryption_version)
+		VALUES ($1, $2, $3)
+		ON CONFLICT (key) DO UPDATE
+			SET encrypted_value = $2, encryption_version = $3, updated_at = now()
+	`, key, enc, ver)
+	return err
+}

workspace-server/internal/codexauth/refresher_test.go

@@ -0,0 +1,425 @@
+package codexauth
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// --- test doubles -----------------------------------------------------------
+
+// fakeStore is an in-memory SecretStore. nil entry = absent key.
+type fakeStore struct {
+	mu     sync.Mutex
+	values map[string]string
+	getErr error
+	putErr error
+	puts   int32 // count of successful Put calls
+}
+
+func newFakeStore() *fakeStore { return &fakeStore{values: map[string]string{}} }
+
+func (f *fakeStore) Get(_ context.Context, key string) (string, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.getErr != nil {
+		return "", false, f.getErr
+	}
+	v, ok := f.values[key]
+	return v, ok, nil
+}
+
+func (f *fakeStore) Put(_ context.Context, key, value string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.putErr != nil {
+		return f.putErr
+	}
+	f.values[key] = value
+	atomic.AddInt32(&f.puts, 1)
+	return nil
+}
+
+func (f *fakeStore) get(key string) string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.values[key]
+}
+
+// fakeTransport records every request and returns a scripted response. It is
+// the network seam — tests NEVER make a real request.
+type fakeTransport struct {
+	mu        sync.Mutex
+	calls     int32
+	urls      []string
+	methods   []string
+	bodies    []string
+	status    int
+	respBody  string
+	transport func(*http.Request) (*http.Response, error) // optional override
+}
+
+func (t *fakeTransport) Do(req *http.Request) (*http.Response, error) {
+	atomic.AddInt32(&t.calls, 1)
+	t.mu.Lock()
+	t.urls = append(t.urls, req.URL.String())
+	t.methods = append(t.methods, req.Method)
+	if req.Body != nil {
+		b, _ := io.ReadAll(req.Body)
+		t.bodies = append(t.bodies, string(b))
+	} else {
+		t.bodies = append(t.bodies, "")
+	}
+	t.mu.Unlock()
+
+	if t.transport != nil {
+		return t.transport(req)
+	}
+	status := t.status
+	if status == 0 {
+		status = http.StatusOK
+	}
+	return &http.Response{
+		StatusCode: status,
+		Body:       io.NopCloser(strings.NewReader(t.respBody)),
+		Header:     make(http.Header),
+	}, nil
+}
+
+func (t *fakeTransport) callCount() int { return int(atomic.LoadInt32(&t.calls)) }
+
+// --- helpers ----------------------------------------------------------------
+
+// makeJWT builds an unsigned-but-parseable JWT whose payload carries exp.
+func makeJWT(exp time.Time) string {
+	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none","typ":"JWT"}`))
+	payload := base64.RawURLEncoding.EncodeToString([]byte(
+		fmt.Sprintf(`{"exp":%d,"sub":"codex"}`, exp.Unix())))
+	sig := base64.RawURLEncoding.EncodeToString([]byte("sig"))
+	return header + "." + payload + "." + sig
+}
+
+// authBlob builds a nested codex auth.json blob with the given tokens.
+func authBlob(access, refresh string) string {
+	b, _ := json.Marshal(map[string]any{
+		"tokens": map[string]any{
+			"access_token":  access,
+			"refresh_token": refresh,
+			"id_token":      "id-original",
+		},
+		"OPENAI_API_KEY": nil,
+		"last_refresh":   "2026-01-01T00:00:00Z",
+	})
+	return string(b)
+}
+
+func newTestRefresher(store SecretStore, client httpDoer, now time.Time) *refresher {
+	return &refresher{
+		store:  store,
+		client: client,
+		now:    func() time.Time { return now },
+	}
+}
+
+func okRefreshResponse(access, refresh string) string {
+	b, _ := json.Marshal(oauthTokens{AccessToken: access, RefreshToken: refresh, IDToken: "id-new"})
+	return string(b)
+}
+
+// --- tests ------------------------------------------------------------------
+
+// TestJWTExpParse covers the exp decode (valid, malformed, missing).
+func TestJWTExpParse(t *testing.T) {
+	want := time.Now().Add(2 * time.Hour).Truncate(time.Second)
+	got, ok := jwtExp(makeJWT(want))
+	if !ok {
+		t.Fatalf("jwtExp(valid) ok=false, want true")
+	}
+	if !got.Equal(want) {
+		t.Errorf("jwtExp = %v, want %v", got, want)
+	}
+
+	if _, ok := jwtExp("not-a-jwt"); ok {
+		t.Errorf("jwtExp(non-jwt) ok=true, want false")
+	}
+	if _, ok := jwtExp("a.b.c"); ok {
+		t.Errorf("jwtExp(garbage parts) ok=true, want false")
+	}
+	// 3 parts but payload has no exp.
+	noExp := base64.RawURLEncoding.EncodeToString([]byte("{}"))
+	if _, ok := jwtExp("h." + noExp + ".s"); ok {
+		t.Errorf("jwtExp(no exp claim) ok=true, want false")
+	}
+}
+
+// TestRefreshOnce_SkipWhenFresh: a token well outside the safety margin is NOT
+// refreshed — no POST, no write-back.
+func TestRefreshOnce_SkipWhenFresh(t *testing.T) {
+	now := time.Now()
+	store := newFakeStore()
+	store.values[CodexAuthSecretKey] = authBlob(makeJWT(now.Add(2*time.Hour)), "rt-1")
+	tr := &fakeTransport{status: http.StatusOK, respBody: okRefreshResponse("new-at", "rt-2")}
+	r := newTestRefresher(store, tr, now)
+
+	if perm := r.refreshOnce(context.Background()); perm {
+		t.Fatalf("fresh token: permanentFailure=true, want false")
+	}
+	if tr.callCount() != 0 {
+		t.Errorf("fresh token: %d OAuth POSTs, want 0", tr.callCount())
+	}
+	if atomic.LoadInt32(&store.puts) != 0 {
+		t.Errorf("fresh token: %d write-backs, want 0", store.puts)
+	}
+}
+
+// TestRefreshOnce_RotateThenReskip: a token inside the margin is refreshed once
+// (POST + write-back of the rotated blob); a subsequent call on the now-fresh
+// rotated token skips (no second POST). Proves rotate→write-back→re-skip.
+func TestRefreshOnce_RotateThenReskip(t *testing.T) {
+	now := time.Now()
+	store := newFakeStore()
+	// Expires in 5m — inside the 15m safety margin → DUE.
+	store.values[CodexAuthSecretKey] = authBlob(makeJWT(now.Add(5*time.Minute)), "rt-1")
+	// Rotated access token is fresh (2h out); rotated refresh is rt-2.
+	tr := &fakeTransport{status: http.StatusOK, respBody: okRefreshResponse(makeJWT(now.Add(2*time.Hour)), "rt-2")}
+	r := newTestRefresher(store, tr, now)
+
+	if perm := r.refreshOnce(context.Background()); perm {
+		t.Fatalf("due token: permanentFailure=true, want false")
+	}
+	if tr.callCount() != 1 {
+		t.Fatalf("due token: %d OAuth POSTs, want exactly 1", tr.callCount())
+	}
+	if atomic.LoadInt32(&store.puts) != 1 {
+		t.Fatalf("due token: %d write-backs, want exactly 1", store.puts)
+	}
+
+	// The written blob must carry the rotated refresh_token and preserve the
+	// non-token field.
+	rotated := store.get(CodexAuthSecretKey)
+	tokens, err := parseTokens(rotated)
+	if err != nil {
+		t.Fatalf("parse rotated blob: %v", err)
+	}
+	if tokens.RefreshToken != "rt-2" {
+		t.Errorf("rotated refresh_token = %q, want rt-2", tokens.RefreshToken)
+	}
+	if !strings.Contains(rotated, "last_refresh") {
+		t.Errorf("rotated blob dropped the preserved last_refresh field: %s", rotated)
+	}
+
+	// Second call: the rotated access token is fresh → skip, no new POST.
+	if perm := r.refreshOnce(context.Background()); perm {
+		t.Fatalf("re-skip: permanentFailure=true, want false")
+	}
+	if tr.callCount() != 1 {
+		t.Errorf("re-skip: %d total OAuth POSTs, want still 1", tr.callCount())
+	}
+	if atomic.LoadInt32(&store.puts) != 1 {
+		t.Errorf("re-skip: %d total write-backs, want still 1", store.puts)
+	}
+}
+
+// TestRefreshOnce_NoSecretInert: absent CODEX_AUTH_JSON → inert (no POST, no
+// write-back, no error/permanent).
+func TestRefreshOnce_NoSecretInert(t *testing.T) {
+	store := newFakeStore() // empty
+	tr := &fakeTransport{}
+	r := newTestRefresher(store, tr, time.Now())
+
+	if perm := r.refreshOnce(context.Background()); perm {
+		t.Fatalf("no secret: permanentFailure=true, want false")
+	}
+	if tr.callCount() != 0 {
+		t.Errorf("no secret: %d POSTs, want 0", tr.callCount())
+	}
+	if atomic.LoadInt32(&store.puts) != 0 {
+		t.Errorf("no secret: %d write-backs, want 0", store.puts)
+	}
+}
+
+// TestRefreshOnce_PermanentFailNoWriteNoStorm: a 400 invalid_grant must (a) not
+// write back, (b) return permanentFailure=true, and (c) NOT re-POST on the next
+// cycle for the same (burned) seed — the anti-storm latch.
+func TestRefreshOnce_PermanentFailNoWriteNoStorm(t *testing.T) {
+	now := time.Now()
+	store := newFakeStore()
+	store.values[CodexAuthSecretKey] = authBlob(makeJWT(now.Add(1*time.Minute)), "rt-burned")
+	tr := &fakeTransport{
+		status:   http.StatusBadRequest,
+		respBody: `{"error":"invalid_grant","error_description":"refresh token already used"}`,
+	}
+	r := newTestRefresher(store, tr, now)
+
+	perm := r.refreshOnce(context.Background())
+	if !perm {
+		t.Fatalf("invalid_grant: permanentFailure=false, want true")
+	}
+	if tr.callCount() != 1 {
+		t.Fatalf("invalid_grant: %d POSTs, want exactly 1", tr.callCount())
+	}
+	if atomic.LoadInt32(&store.puts) != 0 {
+		t.Fatalf("invalid_grant: %d write-backs, want 0 (must NOT persist a failed refresh)", store.puts)
+	}
+
+	// Next cycle, SAME burned seed: must NOT re-POST (anti-storm latch).
+	perm2 := r.refreshOnce(context.Background())
+	if tr.callCount() != 1 {
+		t.Errorf("anti-storm: re-POSTed a burned refresh_token (%d total POSTs, want still 1)", tr.callCount())
+	}
+	_ = perm2 // latched cycle returns false (already-known failure, nothing new)
+
+	// A RE-SEED (blob changes) clears the latch and allows a fresh attempt.
+	store.mu.Lock()
+	store.values[CodexAuthSecretKey] = authBlob(makeJWT(now.Add(1*time.Minute)), "rt-freshly-seeded")
+	store.mu.Unlock()
+	tr.status = http.StatusOK
+	tr.respBody = okRefreshResponse(makeJWT(now.Add(2*time.Hour)), "rt-rotated")
+	if perm := r.refreshOnce(context.Background()); perm {
+		t.Fatalf("post-reseed: permanentFailure=true, want false")
+	}
+	if tr.callCount() != 2 {
+		t.Errorf("post-reseed: %d total POSTs, want 2 (latch should clear on re-seed)", tr.callCount())
+	}
+}
+
+// TestRefreshOnce_TransientNoWriteNoLatch: a 5xx is transient — no write-back,
+// returns false (no hard backoff latch), and a later cycle retries.
+func TestRefreshOnce_TransientNoWriteNoLatch(t *testing.T) {
+	now := time.Now()
+	store := newFakeStore()
+	store.values[CodexAuthSecretKey] = authBlob(makeJWT(now.Add(1*time.Minute)), "rt-1")
+	tr := &fakeTransport{status: http.StatusServiceUnavailable, respBody: "upstream down"}
+	r := newTestRefresher(store, tr, now)
+
+	if perm := r.refreshOnce(context.Background()); perm {
+		t.Fatalf("503: permanentFailure=true, want false (transient)")
+	}
+	if atomic.LoadInt32(&store.puts) != 0 {
+		t.Errorf("503: %d write-backs, want 0", store.puts)
+	}
+	// Retry next cycle succeeds (no latch on transient).
+	tr.status = http.StatusOK
+	tr.respBody = okRefreshResponse(makeJWT(now.Add(2*time.Hour)), "rt-2")
+	if perm := r.refreshOnce(context.Background()); perm {
+		t.Fatalf("retry after 503: permanentFailure=true, want false")
+	}
+	if tr.callCount() != 2 {
+		t.Errorf("transient retry: %d total POSTs, want 2", tr.callCount())
+	}
+	if atomic.LoadInt32(&store.puts) != 1 {
+		t.Errorf("transient retry: %d write-backs, want 1", store.puts)
+	}
+}
+
+// TestRefreshOnce_SingleFlight: concurrent refreshOnce calls on a DUE token must
+// POST exactly once total — the package mutex serializes them and the second
+// sees the freshly-rotated (now-fresh) token and skips. Structural single-flight.
+func TestRefreshOnce_SingleFlight(t *testing.T) {
+	now := time.Now()
+	store := newFakeStore()
+	store.values[CodexAuthSecretKey] = authBlob(makeJWT(now.Add(1*time.Minute)), "rt-1")
+	// Every successful rotation yields a FRESH (2h) access token, so once one
+	// caller rotates, the other sees fresh and skips.
+	tr := &fakeTransport{status: http.StatusOK, respBody: okRefreshResponse(makeJWT(now.Add(2*time.Hour)), "rt-2")}
+	r := newTestRefresher(store, tr, now)
+
+	const n = 16
+	var wg sync.WaitGroup
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			r.refreshOnce(context.Background())
+		}()
+	}
+	wg.Wait()
+
+	if tr.callCount() != 1 {
+		t.Errorf("single-flight: %d OAuth POSTs across %d concurrent calls, want exactly 1", tr.callCount(), n)
+	}
+	if atomic.LoadInt32(&store.puts) != 1 {
+		t.Errorf("single-flight: %d write-backs, want exactly 1", store.puts)
+	}
+}
+
+// TestRefreshOnce_PostsExactlyOnceToOAuthEndpoint: when it DOES refresh, the
+// single POST goes to the OAuth token URL with the refresh_token grant body.
+func TestRefreshOnce_PostsExactlyOnceToOAuthEndpoint(t *testing.T) {
+	now := time.Now()
+	store := newFakeStore()
+	store.values[CodexAuthSecretKey] = authBlob(makeJWT(now.Add(1*time.Minute)), "rt-secret")
+	tr := &fakeTransport{status: http.StatusOK, respBody: okRefreshResponse(makeJWT(now.Add(2*time.Hour)), "rt-2")}
+	r := newTestRefresher(store, tr, now)
+
+	r.refreshOnce(context.Background())
+
+	if tr.callCount() != 1 {
+		t.Fatalf("%d POSTs, want exactly 1", tr.callCount())
+	}
+	if tr.urls[0] != oauthTokenURL {
+		t.Errorf("POST URL = %q, want %q", tr.urls[0], oauthTokenURL)
+	}
+	if tr.methods[0] != http.MethodPost {
+		t.Errorf("method = %q, want POST", tr.methods[0])
+	}
+	var body map[string]string
+	if err := json.Unmarshal([]byte(tr.bodies[0]), &body); err != nil {
+		t.Fatalf("request body not json: %v (%s)", err, tr.bodies[0])
+	}
+	if body["grant_type"] != "refresh_token" {
+		t.Errorf("grant_type = %q, want refresh_token", body["grant_type"])
+	}
+	if body["refresh_token"] != "rt-secret" {
+		t.Errorf("refresh_token = %q, want rt-secret", body["refresh_token"])
+	}
+	if body["client_id"] != codexOAuthClientID {
+		t.Errorf("client_id = %q, want %q", body["client_id"], codexOAuthClientID)
+	}
+}
+
+// TestRefreshOnce_ReadErrorSkips: a store read error is a transient skip (no
+// POST, no permanent latch).
+func TestRefreshOnce_ReadErrorSkips(t *testing.T) {
+	store := newFakeStore()
+	store.getErr = fmt.Errorf("db down")
+	tr := &fakeTransport{}
+	r := newTestRefresher(store, tr, time.Now())
+	if perm := r.refreshOnce(context.Background()); perm {
+		t.Errorf("read error: permanentFailure=true, want false")
+	}
+	if tr.callCount() != 0 {
+		t.Errorf("read error: %d POSTs, want 0", tr.callCount())
+	}
+}
+
+// TestMergeTokens_PreservesOtherFields proves the rotated write-back keeps every
+// non-token field and does not clobber id_token with an empty rotated value.
+func TestMergeTokens_PreservesOtherFields(t *testing.T) {
+	blob := authBlob("old-at", "old-rt")
+	out, err := mergeTokens(blob, oauthTokens{AccessToken: "new-at", RefreshToken: "new-rt"}) // no id_token
+	if err != nil {
+		t.Fatalf("mergeTokens: %v", err)
+	}
+	tokens, err := parseTokens(out)
+	if err != nil {
+		t.Fatalf("parse merged: %v", err)
+	}
+	if tokens.AccessToken != "new-at" || tokens.RefreshToken != "new-rt" {
+		t.Errorf("merged tokens = %+v, want new-at/new-rt", tokens)
+	}
+	if tokens.IDToken != "id-original" {
+		t.Errorf("empty rotated id_token clobbered the original: got %q, want id-original", tokens.IDToken)
+	}
+	if !strings.Contains(out, "last_refresh") {
+		t.Errorf("merge dropped preserved field: %s", out)
+	}
+}

workspace-server/internal/handlers/admin_schedules_health.go

@@ -243,7 +243,12 @@ func (h *AdminSchedulesHealthHandler) ReapOrphans(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "re-point failed"})
 		return
 	}
-	repointedN, _ := repointed.RowsAffected()
+	repointedN, err := repointed.RowsAffected()
+	if err != nil {
+		log.Printf("ReapOrphans: repointed rows affected: %v", err)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "re-point failed"})
+		return
+	}
 
 	// 2. Disable any remaining schedules still bound to a removed/missing
 	//    workspace (no live successor, or template schedules on a dead row).
@@ -261,7 +266,12 @@ func (h *AdminSchedulesHealthHandler) ReapOrphans(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "disable failed"})
 		return
 	}
-	disabledN, _ := disabled.RowsAffected()
+	disabledN, err := disabled.RowsAffected()
+	if err != nil {
+		log.Printf("ReapOrphans: disabled rows affected: %v", err)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "disable failed"})
+		return
+	}
 
 	log.Printf("ReapOrphans: re-pointed %d, disabled %d orphaned schedule(s)", repointedN, disabledN)
 	c.JSON(http.StatusOK, gin.H{"repointed": repointedN, "disabled": disabledN})

workspace-server/internal/handlers/audit.go

@@ -252,6 +252,9 @@ func scanAuditRows(rows *sql.Rows) ([]auditEventRow, error) {
 		}
 		result = append(result, ev)
 	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
 	return result, nil
 }
 

workspace-server/internal/handlers/cross_tenant_isolation_test.go

@@ -294,8 +294,9 @@ func TestProxyA2A_CrossTenant_RoutingDenied(t *testing.T) {
 	// A URL exists for the target; the guard must deny BEFORE it is used.
 	mr.Set(fmt.Sprintf("ws:%s:url", target), "http://localhost:1")
 
-	// CanCommunicate: both root-level (parent_id NULL) → its weak "root-level
-	// siblings" rule ALLOWS this. The org guard must catch it afterward.
+	// Post-#1955: CanCommunicate no longer has the root-sibling bypass.
+	// Both root-level (parent_id NULL) but unrelated org roots → hierarchy
+	// check DENIES with 403 BEFORE the org-scope guard or resolveAgentURL.
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id = ").
 		WithArgs(caller).
 		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow(caller, nil))
@@ -303,15 +304,6 @@ func TestProxyA2A_CrossTenant_RoutingDenied(t *testing.T) {
 		WithArgs(target).
 		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow(target, nil))
 
-	// #1953 org-scope guard: caller resolves to org-a-root, target to org-b-root
-	// → different orgs → 403. (Each org root resolves to itself.)
-	mock.ExpectQuery("WITH RECURSIVE org_chain AS").
-		WithArgs(caller).
-		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow(caller))
-	mock.ExpectQuery("WITH RECURSIVE org_chain AS").
-		WithArgs(target).
-		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow(target))
-
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Params = gin.Params{{Key: "id", Value: target}}
@@ -329,8 +321,8 @@ func TestProxyA2A_CrossTenant_RoutingDenied(t *testing.T) {
 	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
 		t.Fatalf("body not JSON: %v", err)
 	}
-	if msg, _ := resp["error"].(string); !strings.Contains(msg, "different org") {
-		t.Errorf("expected cross-org denial message, got %v", resp["error"])
+	if msg, _ := resp["error"].(string); !strings.Contains(msg, "cannot communicate") {
+		t.Errorf("expected hierarchy denial message, got %v", resp["error"])
 	}
 	if err := mock.ExpectationsWereMet(); err != nil {
 		t.Errorf("unmet sqlmock expectations: %v", err)

workspace-server/internal/handlers/delegation_executor_integration_test.go

@@ -55,6 +55,7 @@ import (
 const integrationTestDelegationID = "del-159-test-integration"
 const integrationTestSourceID = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
 const integrationTestTargetID = "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
+const integrationTestParentID = "cccccccc-cccc-cccc-cccc-cccccccccccc"
 
 // rawHTTPServer starts a TCP listener, serves one HTTP response, and closes.
 // It runs in a background goroutine so the test can proceed immediately after

workspace-server/internal/handlers/handlers_additional_test.go

@@ -43,6 +43,8 @@ func TestWorkspaceCreate_WithParentID(t *testing.T) {
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -79,6 +81,8 @@ func TestWorkspaceCreate_ExplicitClaudeCodeRuntime(t *testing.T) {
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -300,6 +304,8 @@ func TestWorkspaceCreate_MaxConcurrentTasksOverride(t *testing.T) {
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -576,13 +582,14 @@ func TestDiscover_TargetOffline(t *testing.T) {
 	setupTestRedis(t)
 	handler := NewDiscoveryHandler()
 
-	// Both root-level, access allowed
+	// Share a parent so communication is allowed under post-#1955 rules
+	sharedParent := "ws-parent"
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id =").
 		WithArgs("ws-caller").
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-caller", nil))
+		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-caller", sharedParent))
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id =").
 		WithArgs("ws-off").
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-off", nil))
+		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-off", sharedParent))
 
 	// Name + runtime lookup (discovery now queries both)
 	mock.ExpectQuery("SELECT COALESCE").
@@ -622,13 +629,14 @@ func TestCheckAccess_SiblingsAllowed(t *testing.T) {
 	setupTestRedis(t)
 	handler := NewDiscoveryHandler()
 
-	// Both root-level siblings → allowed
+	// Share a parent so communication is allowed under post-#1955 rules
+	sharedParent := "ws-parent"
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id =").
 		WithArgs("ws-a").
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-a", nil))
+		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-a", sharedParent))
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id =").
 		WithArgs("ws-b").
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-b", nil))
+		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-b", sharedParent))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

workspace-server/internal/handlers/handlers_extended_test.go

@@ -374,14 +374,14 @@ func TestExtended_DiscoverWithCallerID(t *testing.T) {
 	handler := NewDiscoveryHandler()
 
 	// CanCommunicate needs to look up both workspaces
-	// Caller: root-level (no parent)
+	// Share a parent so communication is allowed under post-#1955 rules
+	sharedParent := "ws-parent"
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id =").
 		WithArgs("ws-caller").
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-caller", nil))
-	// Target: also root-level (no parent) — root-level siblings are allowed
+		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-caller", sharedParent))
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id =").
 		WithArgs("ws-target").
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-target", nil))
+		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-target", sharedParent))
 
 	// Discover handler looks up workspace name + runtime
 	mock.ExpectQuery("SELECT COALESCE").
@@ -515,13 +515,14 @@ func TestExtended_CheckAccess(t *testing.T) {
 	handler := NewDiscoveryHandler()
 
 	// CanCommunicate will look up both workspaces
-	// Both root-level — should be allowed
+	// Share a parent so communication is allowed under post-#1955 rules
+	sharedParent := "ws-parent"
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id =").
 		WithArgs("ws-a").
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-a", nil))
+		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-a", sharedParent))
 	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id =").
 		WithArgs("ws-b").
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-b", nil))
+		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow("ws-b", sharedParent))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

workspace-server/internal/handlers/handlers_test.go

@@ -386,6 +386,8 @@ func TestWorkspaceCreate(t *testing.T) {
 	// Expect RecordAndBroadcast INSERT for WORKSPACE_PROVISIONING
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -422,6 +424,76 @@ func TestWorkspaceCreate(t *testing.T) {
 	}
 }
 
+// TestWorkspaceCreate_ReturnsAuthToken_201 pins the inline-auth_token
+// behaviour added for #1644. Pre-fix, the 201 response was
+// {id, status, awareness_namespace, workspace_access} — callers had to
+// make a separate POST to /admin/workspaces/:id/tokens (AdminAuth-gated,
+// path-prefix differs in CP-admin deploys) OR fall back to the dev-only
+// GET /admin/workspaces/:id/test-token (deliberately 404s on
+// MOLECULE_ENV=production per feedback_no_dev_only_routes_in_e2e).
+//
+// Post-fix: every Create response includes an `auth_token` field with
+// the freshly-minted plaintext bearer (returned once, never recoverable).
+// This is the SSOT path — production E2E + canvas + org_import all
+// get the bearer they need in the same round trip.
+//
+// Failure path is non-fatal: if the IssueToken DB call fails, the 201
+// still goes out without auth_token + a fallback log line. That branch
+// is exercised by sqlmock returning a non-INSERT-INTO-workspace_auth_tokens
+// path here — the test asserts presence on the happy path.
+func TestWorkspaceCreate_ReturnsAuthToken_201(t *testing.T) {
+	mock := setupTestDB(t)
+	setupTestRedis(t)
+	broadcaster := newTestBroadcaster()
+	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", "/tmp/configs")
+
+	mock.ExpectBegin()
+	mock.ExpectExec("INSERT INTO workspaces").
+		WithArgs(sqlmock.AnyArg(), "Token Holder", nil, 3, "claude-code", (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectCommit()
+	mock.ExpectExec("INSERT INTO canvas_layouts").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO structure_events").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	// The inline mint added in #1644 Part B — wsauth.IssueToken issues
+	// a new bearer via INSERT INTO workspace_auth_tokens (workspace_id,
+	// token_hash, prefix). This is the assertion that the new code path
+	// reaches the DB.
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WithArgs(sqlmock.AnyArg(), sqlmock.AnyArg(), sqlmock.AnyArg()).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	body := `{"name":"Token Holder","model":"anthropic:claude-opus-4-7"}`
+	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	handler.Create(c)
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String())
+	}
+	var resp map[string]interface{}
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("parse response: %v", err)
+	}
+	tok, ok := resp["auth_token"].(string)
+	if !ok || tok == "" {
+		t.Fatalf("expected non-empty auth_token in 201 response (the #1644 SSOT inline mint), got: %s", w.Body.String())
+	}
+	// Sanity: tokens are base64-RawURL encoded 32-byte payloads (per
+	// wsauth/tokens.go::tokenPayloadBytes), so a meaningful lower bound
+	// is ~40 chars. If this fails, IssueToken's contract drifted.
+	if len(tok) < 40 {
+		t.Errorf("auth_token suspiciously short (%d chars) — wsauth.IssueToken contract drift?", len(tok))
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations — inline mint path may have skipped IssueToken: %v", err)
+	}
+}
+
 func TestBuildProvisionerConfig_WorkspacePathFromPayload(t *testing.T) {
 	setupTestDB(t)
 	broadcaster := newTestBroadcaster()

workspace-server/internal/handlers/llm_billing_mode.go

@@ -377,6 +377,9 @@ func readWorkspaceDeriveInputs(ctx context.Context, workspaceID string) (runtime
 			availableAuthEnv = append(availableAuthEnv, k)
 		}
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("llm_billing_mode: read secrets rows error for %s: %v (deriving with partial model/auth-env)", workspaceID, err)
+	}
 	return runtime, model, availableAuthEnv
 }
 
@@ -453,7 +456,10 @@ func SetWorkspaceLLMBillingMode(ctx context.Context, workspaceID, mode string) e
 		if err != nil {
 			return fmt.Errorf("clear workspace llm_billing_mode for %s: %w", workspaceID, err)
 		}
-		n, _ := res.RowsAffected()
+		n, err := res.RowsAffected()
+		if err != nil {
+			return fmt.Errorf("clear workspace llm_billing_mode rows affected %s: %w", workspaceID, err)
+		}
 		if n == 0 {
 			return sql.ErrNoRows
 		}
@@ -470,7 +476,10 @@ func SetWorkspaceLLMBillingMode(ctx context.Context, workspaceID, mode string) e
 	if err != nil {
 		return fmt.Errorf("set workspace llm_billing_mode for %s: %w", workspaceID, err)
 	}
-	n, _ := res.RowsAffected()
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("set workspace llm_billing_mode rows affected %s: %w", workspaceID, err)
+	}
 	if n == 0 {
 		return sql.ErrNoRows
 	}

workspace-server/internal/handlers/org_import.go

@@ -750,7 +750,12 @@ func (h *OrgHandler) migrateRuntimeSchedulesFromRemovedPredecessor(ctx context.C
 		log.Printf("Org import: schedule migration %s -> %s (%q) failed: %v", predID, newID, name, err)
 		return
 	}
-	if n, _ := res.RowsAffected(); n > 0 {
+	n, err := res.RowsAffected()
+	if err != nil {
+		log.Printf("Org import: schedule migration rows affected %s -> %s: %v", predID, newID, err)
+		return
+	}
+	if n > 0 {
 		log.Printf("Org import: migrated %d runtime schedule(s) from removed predecessor %s to new workspace %s (%q)", n, predID, newID, name)
 	}
 }

workspace-server/internal/handlers/org_plugin_allowlist.go

@@ -141,7 +141,7 @@ func requireCallerOwnsOrg(c *gin.Context) (string, error) {
 	orgID, err := orgtoken.OrgIDByTokenID(c.Request.Context(), db.DB, tokID)
 	if err != nil {
 		// DB error — deny by default rather than risk cross-org access.
-		return "", fmt.Errorf("allowlist: requireCallerOwnsOrg: %v", err)
+		return "", fmt.Errorf("allowlist: requireCallerOwnsOrg: %w", err)
 	}
 	return orgID, nil
 }

workspace-server/internal/handlers/org_scope_test.go

@@ -0,0 +1,191 @@
+package handlers
+
+// Sqlmock-backed coverage for org_scope.go (orgRootID + sameOrg).
+// Security-critical path — cross-tenant isolation (#1953).
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/db"
+)
+
+// ---------- orgRootID ----------
+
+func TestOrgRootID_HappyPath_NonRoot(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	// CTE walks: ws-child → ws-parent → org-root (parent_id IS NULL)
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow(wsUUID3))
+
+	root, err := orgRootID(context.Background(), db.DB, wsUUID1)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if root != wsUUID3 {
+		t.Errorf("root=%q, want %q", root, wsUUID3)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet: %v", err)
+	}
+}
+
+func TestOrgRootID_WorkspaceIsRoot(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	// One-row chain: the workspace itself is the org root.
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow(wsUUID1))
+
+	root, err := orgRootID(context.Background(), db.DB, wsUUID1)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if root != wsUUID1 {
+		t.Errorf("root=%q, want %q", root, wsUUID1)
+	}
+}
+
+func TestOrgRootID_NoRows(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}))
+
+	_, err := orgRootID(context.Background(), db.DB, wsUUID1)
+	if !errors.Is(err, errNoOrgRoot) {
+		t.Fatalf("expected errNoOrgRoot, got %v", err)
+	}
+}
+
+func TestOrgRootID_DBError(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnError(errors.New("conn lost"))
+
+	_, err := orgRootID(context.Background(), db.DB, wsUUID1)
+	if err == nil || errors.Is(err, errNoOrgRoot) {
+		t.Fatalf("expected DB error, got %v", err)
+	}
+}
+
+func TestOrgRootID_EmptyRoot(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	// Row present but root is empty string → treated as not-found.
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow(""))
+
+	_, err := orgRootID(context.Background(), db.DB, wsUUID1)
+	if !errors.Is(err, errNoOrgRoot) {
+		t.Fatalf("expected errNoOrgRoot for empty root, got %v", err)
+	}
+}
+
+// ---------- sameOrg ----------
+
+func TestSameOrg_SameWorkspace(t *testing.T) {
+	// Fast path: identical IDs are same-org without touching DB.
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	ok, err := sameOrg(context.Background(), db.DB, wsUUID1, wsUUID1)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !ok {
+		t.Error("same workspace must be same-org")
+	}
+	// No DB expectations → proves short-circuit.
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("DB was touched despite short-circuit: %v", err)
+	}
+}
+
+func TestSameOrg_SameOrg(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow(wsUUID3))
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID2).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow(wsUUID3))
+
+	ok, err := sameOrg(context.Background(), db.DB, wsUUID1, wsUUID2)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !ok {
+		t.Error("expected same-org")
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet: %v", err)
+	}
+}
+
+func TestSameOrg_DifferentOrg(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow(wsUUID3))
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID2).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}).AddRow("org-b"))
+
+	ok, err := sameOrg(context.Background(), db.DB, wsUUID1, wsUUID2)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ok {
+		t.Error("expected different-org")
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet: %v", err)
+	}
+}
+
+func TestSameOrg_OrgRootFails(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnError(errors.New("conn lost"))
+
+	_, err := sameOrg(context.Background(), db.DB, wsUUID1, wsUUID2)
+	if err == nil {
+		t.Fatal("expected error when orgRootID fails")
+	}
+}
+
+func TestSameOrg_OrgRootNotFound(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`WITH RECURSIVE org_chain`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"root_id"}))
+
+	_, err := sameOrg(context.Background(), db.DB, wsUUID1, wsUUID2)
+	if !errors.Is(err, errNoOrgRoot) {
+		t.Fatalf("expected errNoOrgRoot, got %v", err)
+	}
+}

workspace-server/internal/handlers/plugins_install.go

@@ -171,9 +171,11 @@ func (h *PluginsHandler) uninstallViaDocker(ctx context.Context, c *gin.Context,
 			log.Printf("Plugin uninstall: skipping invalid skill name %q in %s: %v", skill, pluginName, err)
 			continue
 		}
-		_, _ = h.execAsRoot(ctx, containerName, []string{
+		if _, rmErr := h.execAsRoot(ctx, containerName, []string{
 			"rm", "-rf", "/configs/skills/" + skill,
-		})
+		}); rmErr != nil {
+			log.Printf("Plugin uninstall: failed to remove skill %s from %s: %v", skill, workspaceID, rmErr)
+		}
 	}
 
 	// 3. Delete the plugin directory itself (as root to handle file ownership).

workspace-server/internal/handlers/plugins_install_pipeline.go

@@ -417,7 +417,9 @@ func (h *PluginsHandler) stripPluginMarkersFromMemory(ctx context.Context, conta
 		`awk 'BEGIN{skip=0; blanks=0} /^%s/{skip=1; blanks=0; next} skip==1 && /^[[:space:]]*$/{blanks++; if(blanks>=2){skip=0; print; next} next} /^# Plugin: /{if(skip==1)skip=0} skip==1{next} {print}' /configs/CLAUDE.md > /tmp/claude.new && mv /tmp/claude.new /configs/CLAUDE.md`,
 		regexpEscapeForAwk(marker),
 	)
-	_, _ = h.execAsRoot(ctx, containerName, []string{"bash", "-c", script})
+	if _, awkErr := h.execAsRoot(ctx, containerName, []string{"bash", "-c", script}); awkErr != nil {
+		log.Printf("Plugin uninstall: failed to strip markers from CLAUDE.md for %s in %s: %v", pluginName, workspaceID, awkErr)
+	}
 }
 
 // regexpEscapeForAwk escapes characters that have special meaning inside an

workspace-server/internal/handlers/secrets.go

@@ -24,6 +24,7 @@ var platformManagedDirectLLMBypassKeys = map[string]struct{}{
 	"ANTHROPIC_AUTH_TOKEN":    {},
 	"ARCEEAI_API_KEY":         {},
 	"CLAUDE_CODE_OAUTH_TOKEN": {},
+	"CODEX_AUTH_JSON":         {},
 	"DASHSCOPE_API_KEY":       {},
 	"DEEPSEEK_API_KEY":        {},
 	"GEMINI_API_KEY":          {},

workspace-server/internal/handlers/ssrf.go

@@ -79,7 +79,7 @@ func isSafeURL(rawURL string) error {
 	}
 	addrs, err := net.LookupHost(host)
 	if err != nil {
-		return fmt.Errorf("DNS resolution blocked for hostname: %s (%v)", host, err)
+		return fmt.Errorf("DNS resolution blocked for hostname: %s (%w)", host, err)
 	}
 	if len(addrs) == 0 {
 		return fmt.Errorf("DNS returned no addresses for: %s", host)

workspace-server/internal/handlers/templates.go

@@ -224,6 +224,15 @@ type templateSummary struct {
 	// 0 = template hasn't declared one, falls through to canvas's
 	// runtime-profile default.
 	ProvisionTimeoutSeconds int `json:"provision_timeout_seconds,omitempty"`
+	// Displayable lets a template opt OUT of the canvas runtime picker
+	// declaratively (config.yaml `displayable: false`) while still being a
+	// provisionable runtime. nil/absent or true → shown; only an explicit
+	// false hides it. The canvas runtime dropdown is SSOT-driven off this
+	// list (no hardcoded frontend allowlist), so this is the single place a
+	// runtime is hidden from the picker. Pointer so "unset" is distinct from
+	// "false" and omitempty keeps the payload unchanged for existing
+	// templates that never declare it.
+	Displayable *bool `json:"displayable,omitempty"`
 }
 
 // resolveTemplateDir finds the template directory for a workspace on the host.
@@ -270,6 +279,7 @@ func (h *TemplatesHandler) List(c *gin.Context) {
 				Runtime     string   `yaml:"runtime"`
 				Model       string   `yaml:"model"`
 				Skills      []string `yaml:"skills"`
+				Displayable *bool    `yaml:"displayable"`
 				// Top-level `providers:` block — structured registry. Distinct
 				// from runtime_config.providers (slug list) below. Both shapes
 				// coexist in production: claude-code ships the structured
@@ -334,6 +344,7 @@ func (h *TemplatesHandler) List(c *gin.Context) {
 				Skills:                  raw.Skills,
 				SkillCount:              len(raw.Skills),
 				ProvisionTimeoutSeconds: raw.RuntimeConfig.ProvisionTimeoutSeconds,
+				Displayable:             raw.Displayable,
 			}
 
 			// internal#718 P3: serve the SELECTABLE provider/model list from

workspace-server/internal/handlers/templates_test.go

@@ -1554,3 +1554,86 @@ skills: []
 		t.Errorf("template Providers unchanged: got %v", got.Providers)
 	}
 }
+
+// TestTemplatesList_DisplayableFlag verifies the SSOT-driven runtime-picker
+// opt-out: a template's config.yaml `displayable: false` surfaces as a
+// non-nil false on the /templates row (canvas hides it), while an absent
+// flag stays nil (canvas shows it) and an explicit true surfaces as true.
+// This is the backend half of removing the hardcoded frontend allowlist —
+// the picker trusts this list, so hiding a runtime must be declarative here.
+func TestTemplatesList_DisplayableFlag(t *testing.T) {
+	setupTestDB(t)
+	setupTestRedis(t)
+
+	tmpDir := t.TempDir()
+
+	mk := func(dir, yaml string) {
+		d := filepath.Join(tmpDir, dir)
+		if err := os.MkdirAll(d, 0755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(d, "config.yaml"), []byte(yaml), 0644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// absent → nil
+	mk("adk-shown", "name: ADK Shown\nruntime: claude-code\n")
+	// explicit false → hidden marker
+	mk("adk-hidden", "name: ADK Hidden\nruntime: claude-code\ndisplayable: false\n")
+	// explicit true → shown marker
+	mk("adk-explicit", "name: ADK Explicit\nruntime: claude-code\ndisplayable: true\n")
+
+	handler := NewTemplatesHandler(tmpDir, nil, nil)
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("GET", "/templates", nil)
+	handler.List(c)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+	var resp []templateSummary
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	byID := map[string]templateSummary{}
+	for _, s := range resp {
+		byID[s.ID] = s
+	}
+
+	if s, ok := byID["adk-shown"]; !ok {
+		t.Fatal("adk-shown missing")
+	} else if s.Displayable != nil {
+		t.Errorf("adk-shown: expected nil Displayable (absent), got %v", *s.Displayable)
+	}
+
+	if s, ok := byID["adk-hidden"]; !ok {
+		t.Fatal("adk-hidden missing")
+	} else if s.Displayable == nil || *s.Displayable != false {
+		t.Errorf("adk-hidden: expected non-nil false Displayable, got %v", s.Displayable)
+	}
+
+	if s, ok := byID["adk-explicit"]; !ok {
+		t.Fatal("adk-explicit missing")
+	} else if s.Displayable == nil || *s.Displayable != true {
+		t.Errorf("adk-explicit: expected non-nil true Displayable, got %v", s.Displayable)
+	}
+
+	// JSON contract: omitempty drops the field entirely when nil so existing
+	// templates' payloads are byte-unchanged; present when set.
+	var rawRows []map[string]json.RawMessage
+	if err := json.Unmarshal(w.Body.Bytes(), &rawRows); err != nil {
+		t.Fatalf("raw parse: %v", err)
+	}
+	for _, row := range rawRows {
+		id := ""
+		_ = json.Unmarshal(row["id"], &id)
+		_, present := row["displayable"]
+		if id == "adk-shown" && present {
+			t.Error("adk-shown: displayable key should be omitted when nil")
+		}
+		if (id == "adk-hidden" || id == "adk-explicit") && !present {
+			t.Errorf("%s: displayable key should be present when set", id)
+		}
+	}
+}

workspace-server/internal/handlers/workspace.go

@@ -856,11 +856,38 @@ func (h *WorkspaceHandler) Create(c *gin.Context) {
 		}
 	}
 
-	c.JSON(http.StatusCreated, gin.H{
+	// Mint the workspace's first bearer token and return it inline
+	// (#1644). Pre-fix, callers had to make a separate POST to
+	// /admin/workspaces/:id/tokens (production path, AdminAuth-gated,
+	// but the path-prefix differs in CP-admin deploys so staging E2E
+	// got HTML 404) OR fall back to GET /admin/workspaces/:id/test-token
+	// (dev-only — deliberately 404s on MOLECULE_ENV=production per
+	// admin_test_token.go::TestTokensEnabled, which violates
+	// feedback_no_dev_only_routes_in_e2e). Inlining the first token here
+	// makes the create response the SSOT — every caller (canvas Save,
+	// org_import, E2E, third-party API) gets the bearer they need to
+	// authenticate /activity, /a2a, /memory etc. without an extra
+	// round trip to a separate mint endpoint.
+	//
+	// Failure is non-fatal: the workspace row already committed; the
+	// operator can recover via POST /admin/workspaces/:id/tokens
+	// (canonical admin mint) or POST /workspaces/:id/external/rotate
+	// (already-used for the external pre-register path above). We log
+	// the failure and return 201 without the field — callers that need
+	// the token will get a clear-shaped fallback (auth_token absent
+	// from response = use the admin mint path).
+	resp := gin.H{
 		"id":               id,
 		"status":           "provisioning",
 		"workspace_access": workspaceAccess,
-	})
+	}
+	if authToken, tokErr := wsauth.IssueToken(ctx, db.DB, id); tokErr != nil {
+		log.Printf("Create workspace %s: inline auth_token mint failed (non-fatal — caller can use POST /admin/workspaces/:id/tokens): %v", id, tokErr)
+	} else {
+		resp["auth_token"] = authToken
+	}
+
+	c.JSON(http.StatusCreated, resp)
 }
 
 // addProvisionTimeoutMs decorates a workspace response map with the

workspace-server/internal/handlers/workspace_abilities_test.go

@@ -0,0 +1,200 @@
+package handlers
+
+// Sqlmock-backed coverage for workspace_abilities.go (PatchAbilities).
+// Closes #1312 — handler was at 0% coverage.
+
+import (
+	"bytes"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/gin-gonic/gin"
+)
+
+func patchAbilitiesReq(t *testing.T, wsID string, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: wsID}}
+	c.Request = httptest.NewRequest("PATCH", "/workspaces/"+wsID+"/abilities", bytes.NewBufferString(body))
+	c.Request.Header.Set("Content-Type", "application/json")
+	PatchAbilities(c)
+	return w
+}
+
+// ---------- Validation errors ----------
+
+func TestPatchAbilities_InvalidWorkspaceID(t *testing.T) {
+	w := patchAbilitiesReq(t, "not-a-uuid", `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_InvalidJSON(t *testing.T) {
+	w := patchAbilitiesReq(t, wsUUID1, `not json`)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_EmptyBody(t *testing.T) {
+	w := patchAbilitiesReq(t, wsUUID1, `{}`)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+// ---------- Not found ----------
+
+func TestPatchAbilities_WorkspaceNotFound(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1 AND status != 'removed'\)`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(false))
+
+	w := patchAbilitiesReq(t, wsUUID1, `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet: %v", err)
+	}
+}
+
+func TestPatchAbilities_ExistsQueryError(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1 AND status != 'removed'\)`).
+		WithArgs(wsUUID1).
+		WillReturnError(errors.New("conn refused"))
+
+	w := patchAbilitiesReq(t, wsUUID1, `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("expected 404 on exists query error, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+// ---------- Happy paths ----------
+
+func TestPatchAbilities_BroadcastOnly(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1 AND status != 'removed'\)`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled = \$2, updated_at = now\(\) WHERE id = \$1`).
+		WithArgs(wsUUID1, true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := patchAbilitiesReq(t, wsUUID1, `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet: %v", err)
+	}
+}
+
+func TestPatchAbilities_TalkToUserOnly(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1 AND status != 'removed'\)`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET talk_to_user_enabled = \$2, updated_at = now\(\) WHERE id = \$1`).
+		WithArgs(wsUUID1, false).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := patchAbilitiesReq(t, wsUUID1, `{"talk_to_user_enabled":false}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet: %v", err)
+	}
+}
+
+func TestPatchAbilities_BothFields(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1 AND status != 'removed'\)`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled = \$2, updated_at = now\(\) WHERE id = \$1`).
+		WithArgs(wsUUID1, true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec(`UPDATE workspaces SET talk_to_user_enabled = \$2, updated_at = now\(\) WHERE id = \$1`).
+		WithArgs(wsUUID1, true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := patchAbilitiesReq(t, wsUUID1, `{"broadcast_enabled":true,"talk_to_user_enabled":true}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet: %v", err)
+	}
+}
+
+// ---------- DB errors on update ----------
+
+func TestPatchAbilities_BroadcastUpdateError(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1 AND status != 'removed'\)`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled = \$2, updated_at = now\(\) WHERE id = \$1`).
+		WithArgs(wsUUID1, true).
+		WillReturnError(errors.New("disk full"))
+
+	w := patchAbilitiesReq(t, wsUUID1, `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected 500, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_TalkToUserUpdateError(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1 AND status != 'removed'\)`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET talk_to_user_enabled = \$2, updated_at = now\(\) WHERE id = \$1`).
+		WithArgs(wsUUID1, false).
+		WillReturnError(errors.New("disk full"))
+
+	w := patchAbilitiesReq(t, wsUUID1, `{"talk_to_user_enabled":false}`)
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected 500, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_BothFields_BroadcastFails(t *testing.T) {
+	mock, cleanup := withMockDB(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1 AND status != 'removed'\)`).
+		WithArgs(wsUUID1).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled = \$2, updated_at = now\(\) WHERE id = \$1`).
+		WithArgs(wsUUID1, true).
+		WillReturnError(errors.New("disk full"))
+
+	w := patchAbilitiesReq(t, wsUUID1, `{"broadcast_enabled":true,"talk_to_user_enabled":true}`)
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected 500, got %d: %s", w.Code, w.Body.String())
+	}
+}

workspace-server/internal/handlers/workspace_broadcast.go

@@ -85,15 +85,15 @@ func (h *BroadcastHandler) Broadcast(c *gin.Context) {
 	var orgRootID string
 	err = db.DB.QueryRowContext(ctx, `
 		WITH RECURSIVE org_chain AS (
-			SELECT id, parent_id, id AS root_id
+			SELECT id, parent_id
 			FROM workspaces
 			WHERE id = $1
 			UNION ALL
-			SELECT w.id, w.parent_id, c.root_id
+			SELECT w.id, w.parent_id
 			FROM workspaces w
 			JOIN org_chain c ON w.id = c.parent_id
 		)
-		SELECT root_id FROM org_chain WHERE parent_id IS NULL LIMIT 1
+		SELECT id AS root_id FROM org_chain WHERE parent_id IS NULL LIMIT 1
 	`, senderID).Scan(&orgRootID)
 	if err != nil {
 		log.Printf("Broadcast: org root lookup for %s: %v", senderID, err)

workspace-server/internal/handlers/workspace_broadcast_org_root_integration_test.go

@@ -0,0 +1,144 @@
+//go:build integration
+// +build integration
+
+// workspace_broadcast_org_root_integration_test.go — REAL Postgres
+// regression test for #1959: the Broadcast org-root recursive CTE.
+//
+// Run with:
+//
+//   INTEGRATION_DB_URL="postgres://postgres:test@localhost:55432/molecule?sslmode=disable" \
+//     go test -tags=integration ./internal/handlers/ -run Integration_BroadcastOrgRoot -v
+//
+// CI: piggybacks on .github/workflows/handlers-postgres-integration.yml
+// (path-filter includes workspace-server/internal/handlers/**).
+//
+// Why this is NOT a sqlmock test
+// ------------------------------
+// The unit tests in workspace_broadcast_test.go use sqlmock, which
+// returns whatever rows the test stubs — it CANNOT execute the
+// recursive CTE, so it cannot catch the #1959 bug where the anchor
+// pinned `id AS root_id` to the SENDER's own id and carried it
+// unchanged up the chain. With that bug a non-root sender resolved
+// ITSELF as the org root (wrong broadcast scoping). Only a real
+// Postgres can prove the corrected CTE resolves UP to the true
+// null-parent ancestor.
+//
+// The query under test is copied verbatim from Broadcast() in
+// workspace_broadcast.go; if that query changes, this test must be
+// updated in lockstep (it is the real-artifact gate for the fix).
+
+package handlers
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/google/uuid"
+	_ "github.com/lib/pq"
+)
+
+// orgRootCTE is the exact org-root resolution query from Broadcast().
+// Kept here verbatim so the test fails loudly if the handler regresses
+// to the #1959 sender-id-pinned form.
+const orgRootCTE = `
+	WITH RECURSIVE org_chain AS (
+		SELECT id, parent_id
+		FROM workspaces
+		WHERE id = $1
+		UNION ALL
+		SELECT w.id, w.parent_id
+		FROM workspaces w
+		JOIN org_chain c ON w.id = c.parent_id
+	)
+	SELECT id AS root_id FROM org_chain WHERE parent_id IS NULL LIMIT 1
+`
+
+func integrationDB_BroadcastOrgRoot(t *testing.T) *sql.DB {
+	t.Helper()
+	url := os.Getenv("INTEGRATION_DB_URL")
+	if url == "" {
+		t.Skip("INTEGRATION_DB_URL not set; skipping (see file header)")
+	}
+	conn, err := sql.Open("postgres", url)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	if err := conn.Ping(); err != nil {
+		t.Fatalf("ping: %v", err)
+	}
+	t.Cleanup(func() { conn.Close() })
+	return conn
+}
+
+// TestIntegration_BroadcastOrgRoot_NonRootSenderResolvesToRoot builds a
+// real three-level org chain in Postgres:
+//
+//	root  (parent_id = NULL)
+//	└── mid   (parent_id = root)
+//	    └── leaf  (parent_id = mid)   ← non-root sender
+//
+// and runs the handler's org-root CTE for each node. Every node — root,
+// mid, and leaf — MUST resolve to `root`. Under the #1959 bug the leaf
+// (and mid) resolved to themselves; this test pins the fix.
+func TestIntegration_BroadcastOrgRoot_NonRootSenderResolvesToRoot(t *testing.T) {
+	conn := integrationDB_BroadcastOrgRoot(t)
+	ctx := context.Background()
+
+	prefix := fmt.Sprintf("itest-bcastroot-%s", uuid.New().String()[:8])
+	t.Cleanup(func() {
+		if _, err := conn.ExecContext(ctx,
+			`DELETE FROM workspaces WHERE name LIKE $1`, prefix+"%"); err != nil {
+			t.Logf("cleanup (non-fatal): %v", err)
+		}
+	})
+
+	rootID := uuid.New().String()
+	midID := uuid.New().String()
+	leafID := uuid.New().String()
+
+	// root — parent_id NULL.
+	if _, err := conn.ExecContext(ctx, `
+		INSERT INTO workspaces (id, name, tier, runtime, status, parent_id)
+		VALUES ($1, $2, 2, 'claude-code', 'online', NULL)
+	`, rootID, prefix+"-root"); err != nil {
+		t.Fatalf("seed root: %v", err)
+	}
+	// mid — child of root.
+	if _, err := conn.ExecContext(ctx, `
+		INSERT INTO workspaces (id, name, tier, runtime, status, parent_id)
+		VALUES ($1, $2, 2, 'claude-code', 'online', $3)
+	`, midID, prefix+"-mid", rootID); err != nil {
+		t.Fatalf("seed mid: %v", err)
+	}
+	// leaf — child of mid (a non-root, non-direct-child sender).
+	if _, err := conn.ExecContext(ctx, `
+		INSERT INTO workspaces (id, name, tier, runtime, status, parent_id)
+		VALUES ($1, $2, 2, 'claude-code', 'online', $3)
+	`, leafID, prefix+"-leaf", midID); err != nil {
+		t.Fatalf("seed leaf: %v", err)
+	}
+
+	cases := []struct {
+		name     string
+		senderID string
+	}{
+		{"root sender resolves to itself", rootID},
+		{"mid sender resolves to root", midID},
+		{"leaf (deep non-root) sender resolves to root", leafID},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var got string
+			if err := conn.QueryRowContext(ctx, orgRootCTE, tc.senderID).Scan(&got); err != nil {
+				t.Fatalf("org-root CTE for %s: %v", tc.senderID, err)
+			}
+			if got != rootID {
+				t.Errorf("org root for sender %s = %s; want %s (the true null-parent ancestor) — #1959 regression: a non-root sender resolved to the wrong root",
+					tc.senderID, got, rootID)
+			}
+		})
+	}
+}

workspace-server/internal/handlers/workspace_budget_test.go

@@ -168,6 +168,8 @@ func TestWorkspaceBudget_Create_WithLimit(t *testing.T) {
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

workspace-server/internal/handlers/workspace_compute_test.go

@@ -108,6 +108,8 @@ func TestWorkspaceCreate_WithCompute_PersistsComputeJSON(t *testing.T) {
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

workspace-server/internal/handlers/workspace_provision_runtime_seed_test.go

@@ -0,0 +1,110 @@
+package handlers
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestParseTopLevelRuntime(t *testing.T) {
+	cases := []struct {
+		name string
+		yaml string
+		want string
+	}{
+		{"top-level claude-code", "name: x\nruntime: claude-code\ntier: 2\n", "claude-code"},
+		{"top-level google-adk", "runtime: google-adk\n", "google-adk"},
+		{"quoted value", `runtime: "google-adk"` + "\n", "google-adk"},
+		{"single-quoted value", "runtime: 'codex'\n", "codex"},
+		{"ignores runtime_config nested model", "runtime: google-adk\nruntime_config:\n  model: vertex:gemini-2.5-pro\n", "google-adk"},
+		{"runtime_config only, no top-level runtime", "name: y\nruntime_config:\n  model: x\n", ""},
+		{"indented runtime is not top-level", "wrapper:\n  runtime: claude-code\n", ""},
+		{"empty", "", ""},
+		{"no runtime key", "name: z\ntier: 4\n", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := parseTopLevelRuntime([]byte(tc.yaml)); got != tc.want {
+				t.Fatalf("parseTopLevelRuntime(%q) = %q, want %q", tc.yaml, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestSeededConfigRuntime(t *testing.T) {
+	// in-memory configFiles wins over template dir.
+	t.Run("from configFiles", func(t *testing.T) {
+		cf := map[string][]byte{"config.yaml": []byte("runtime: google-adk\n")}
+		if got := seededConfigRuntime("/nonexistent", cf); got != "google-adk" {
+			t.Fatalf("got %q, want google-adk", got)
+		}
+	})
+
+	// falls back to template dir's config.yaml.
+	t.Run("from template dir", func(t *testing.T) {
+		dir := t.TempDir()
+		if err := os.WriteFile(filepath.Join(dir, "config.yaml"), []byte("name: a\nruntime: claude-code\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if got := seededConfigRuntime(dir, nil); got != "claude-code" {
+			t.Fatalf("got %q, want claude-code", got)
+		}
+	})
+
+	// nothing available → "".
+	t.Run("indeterminate", func(t *testing.T) {
+		if got := seededConfigRuntime("", nil); got != "" {
+			t.Fatalf("got %q, want empty", got)
+		}
+		if got := seededConfigRuntime("/does/not/exist", map[string][]byte{}); got != "" {
+			t.Fatalf("got %q, want empty", got)
+		}
+	})
+}
+
+func TestRuntimeSeedMismatchAbort(t *testing.T) {
+	adkCfg := map[string][]byte{"config.yaml": []byte("runtime: google-adk\n")}
+	ccCfg := map[string][]byte{"config.yaml": []byte("name: Claude Code Agent\nruntime: claude-code\n")}
+
+	t.Run("mismatch fails loud (the #2027 demo bug)", func(t *testing.T) {
+		// requested google-adk, but seeding the claude-code-default config.
+		abort := runtimeSeedMismatchAbort("google-adk", "", ccCfg)
+		if abort == nil {
+			t.Fatal("expected abort for google-adk requested but claude-code seeded, got nil")
+		}
+		if abort.Extra["requested_runtime"] != "google-adk" || abort.Extra["seeded_runtime"] != "claude-code" {
+			t.Fatalf("abort.Extra mismatch: %+v", abort.Extra)
+		}
+		if abort.Extra["issue"] != "2027" {
+			t.Fatalf("expected issue 2027 tag, got %v", abort.Extra["issue"])
+		}
+	})
+
+	t.Run("match is allowed", func(t *testing.T) {
+		if abort := runtimeSeedMismatchAbort("google-adk", "", adkCfg); abort != nil {
+			t.Fatalf("expected no abort when seeded runtime matches, got %q", abort.Msg)
+		}
+	})
+
+	t.Run("empty requested runtime is allowed (org-template default path)", func(t *testing.T) {
+		if abort := runtimeSeedMismatchAbort("", "", ccCfg); abort != nil {
+			t.Fatalf("expected no abort for unspecified runtime, got %q", abort.Msg)
+		}
+	})
+
+	t.Run("indeterminate seed is allowed (CP mode, no local config bytes)", func(t *testing.T) {
+		if abort := runtimeSeedMismatchAbort("google-adk", "", nil); abort != nil {
+			t.Fatalf("expected no abort when seeded runtime is indeterminate, got %q", abort.Msg)
+		}
+	})
+
+	t.Run("mismatch via template dir also fails loud", func(t *testing.T) {
+		dir := t.TempDir()
+		if err := os.WriteFile(filepath.Join(dir, "config.yaml"), []byte("runtime: claude-code\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if abort := runtimeSeedMismatchAbort("hermes", dir, nil); abort == nil {
+			t.Fatal("expected abort for hermes requested but claude-code template seeded")
+		}
+	})
+}

workspace-server/internal/handlers/workspace_provision_shared.go

@@ -37,8 +37,11 @@ package handlers
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log"
+	"os"
 	"path/filepath"
+	"strings"
 
 	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/db"
 	"git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/events"
@@ -263,6 +266,22 @@ func (h *WorkspaceHandler) prepareProvisionContext(
 		}
 	}
 
+	// Preflight: runtime-seed match (issue #2027). Fail LOUD when a workspace
+	// NAMED a runtime but the config.yaml we're about to seed declares a
+	// different top-level runtime — the symmetric counterpart to selectImage's
+	// ErrUnresolvableRuntime guard, on the config/template side. Pre-fix, when a
+	// runtime's workspace template wasn't in the tenant cache at provision time
+	// (or sanitizeRuntime coerced an unknown runtime), seeding silently fell
+	// back to the claude-code-default template: the image+env said e.g.
+	// google-adk but the seeded config said claude-code, so the agent booted
+	// mislabeled and personaless yet looked 'online' and returned canned
+	// non-answers. Refusing loudly turns that silent wrong-agent into a visible
+	// WORKSPACE_PROVISION_FAILED the operator can act on.
+	if abort := runtimeSeedMismatchAbort(payload.Runtime, templatePath, configFiles); abort != nil {
+		log.Printf("Provisioner: ABORT workspace=%s — %s", workspaceID, abort.Msg)
+		return nil, abort
+	}
+
 	cfg := h.buildProvisionerConfig(ctx, workspaceID, templatePath, configFiles, payload, envVars, pluginsPath)
 	cfg.ResetClaudeSession = resetClaudeSession
 
@@ -273,6 +292,76 @@ func (h *WorkspaceHandler) prepareProvisionContext(
 	}, nil
 }
 
+// runtimeSeedMismatchAbort returns a non-nil abort when a workspace NAMED a
+// runtime but the config.yaml about to be seeded declares a *different*
+// top-level runtime — the fail-loud counterpart to selectImage's
+// ErrUnresolvableRuntime (issue #2027). It catches the silent
+// claude-code-default substitution that occurs when a runtime's workspace
+// template isn't cached at provision time (or sanitizeRuntime coerced an
+// unknown runtime to claude-code): both surface as a seeded config whose
+// runtime contradicts the requested one.
+//
+// Pure (modulo reading the template dir's config.yaml). An empty
+// requestedRuntime (unspecified / org-template default path) or an
+// indeterminate seeded runtime (e.g. CP mode with no local config bytes) is
+// allowed — we only fail on a concrete, contradictory signal, never on
+// absence of one.
+func runtimeSeedMismatchAbort(requestedRuntime, templatePath string, configFiles map[string][]byte) *provisionAbort {
+	if requestedRuntime == "" {
+		return nil
+	}
+	seeded := seededConfigRuntime(templatePath, configFiles)
+	if seeded == "" || seeded == requestedRuntime {
+		return nil
+	}
+	msg := fmt.Sprintf(
+		"runtime seed mismatch: workspace requested runtime %q but the seeded config.yaml declares %q — the %q workspace template was not available at provision time (silent %q fallback). Refusing to launch a mislabeled agent; refresh the template cache (POST /admin/templates/refresh) and re-provision.",
+		requestedRuntime, seeded, requestedRuntime, seeded,
+	)
+	return &provisionAbort{
+		Msg: msg,
+		Extra: map[string]interface{}{
+			"error":             msg,
+			"requested_runtime": requestedRuntime,
+			"seeded_runtime":    seeded,
+			"issue":             "2027",
+		},
+	}
+}
+
+// seededConfigRuntime extracts the top-level `runtime:` from the config.yaml
+// that will be seeded into the workspace — preferring the in-memory
+// configFiles, falling back to the template directory on disk. Returns ""
+// when no config.yaml is available or it declares no top-level runtime.
+func seededConfigRuntime(templatePath string, configFiles map[string][]byte) string {
+	if data, ok := configFiles["config.yaml"]; ok {
+		return parseTopLevelRuntime(data)
+	}
+	if templatePath != "" {
+		if data, err := os.ReadFile(filepath.Join(templatePath, "config.yaml")); err == nil {
+			return parseTopLevelRuntime(data)
+		}
+	}
+	return ""
+}
+
+// parseTopLevelRuntime returns the value of the top-level `runtime:` key in a
+// config.yaml, ignoring the nested `runtime_config:` block. A small dedicated
+// line scanner (mirrors the one the Create handler uses to read a template's
+// runtime) so the provision-time guard needs no YAML dependency.
+func parseTopLevelRuntime(data []byte) string {
+	for _, raw := range strings.Split(string(data), "\n") {
+		trimmed := strings.TrimLeft(raw, " \t")
+		if len(raw) > len(trimmed) {
+			continue // indented — inside a nested block (e.g. runtime_config:)
+		}
+		if strings.HasPrefix(trimmed, "runtime:") && !strings.HasPrefix(trimmed, "runtime_config") {
+			return strings.Trim(strings.TrimSpace(strings.TrimPrefix(trimmed, "runtime:")), `"'`)
+		}
+	}
+	return ""
+}
+
 // mintWorkspaceSecrets issues + persists the workspace auth token
 // AND the platform→workspace inbound secret (#2312). Both modes MUST
 // call this — Docker mints + writes to local config volume; SaaS

workspace-server/internal/handlers/workspace_test.go

@@ -390,6 +390,8 @@ func TestWorkspaceCreate_DefaultsApplied(t *testing.T) {
 	// Expect RecordAndBroadcast INSERT
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -438,6 +440,9 @@ func TestWorkspaceCreate_SaaSHardForcesTier4(t *testing.T) {
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	// External workspaces return early with connectionToken in the
+	// connection payload; they do NOT reach the inline auth_token mint
+	// at the bottom of Create (non-external path only).
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -478,6 +483,8 @@ func TestWorkspaceCreate_WithSecrets_Persists(t *testing.T) {
 	// canvas_layouts (non-fatal, outside tx)
 	mock.ExpectExec("INSERT INTO canvas_layouts").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -558,6 +565,8 @@ func TestWorkspaceCreate_EmptySecrets_OK(t *testing.T) {
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -597,6 +606,7 @@ func TestWorkspaceCreate_ExternalURL_SSRFSafe(t *testing.T) {
 	mock.ExpectExec("UPDATE workspaces SET url").
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	// CacheURL is non-fatal — uses Redis (db.RDB, set by setupTestRedis), not the DB.
+	// External workspaces return early before the inline auth_token mint.
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -1808,6 +1818,8 @@ runtime_config:
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -1867,6 +1879,8 @@ model: moonshot/kimi-k2.5
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -1920,6 +1934,8 @@ runtime_config:
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -2215,6 +2231,8 @@ func TestWorkspaceCreate_188_ExplicitRuntimeNoTemplate_OK(t *testing.T) {
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectExec("INSERT INTO structure_events").
 		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

workspace-server/internal/providers/derive_provider.go

@@ -54,7 +54,17 @@ func (p Provider) IsPlatform() bool {
 //     native provider ref's Models list, that provider wins outright — this
 //     resolves the kimi namespace split (moonshot/kimi-k2.6 -> platform vs
 //     bare kimi-for-coding -> kimi-coding) deterministically and overrides
-//     any broader prefix match.
+//     any broader prefix match. If the SAME id is exact-listed by MORE THAN
+//     ONE native arm — the legitimate "one model id, two auth arms" shape (the
+//     codex gpt-* family is offered on BOTH the openai-subscription OAuth arm
+//     and the openai-api direct-key arm, mirroring claude-code's anthropic
+//     oauth+api split) — disambiguate by available auth env exactly as the
+//     prefix step (5) does: keep the arms whose auth_env intersects
+//     availableAuthEnv; if exactly one survives it wins. With no auth context
+//     (or an unresolved tie), the FIRST-declared native arm wins — the
+//     deterministic default (codex lists openai-subscription first, so a
+//     gpt-* id with no auth context defaults to the subscription, matching the
+//     codex adapter's resolve-provider precedence #1).
 //  4. Otherwise, fall back to model_prefix_match among the native providers.
 //  5. If >1 native provider still matches, disambiguate by auth env: keep
 //     only the providers whose auth_env intersects availableAuthEnv. If
@@ -85,11 +95,14 @@ func (m *Manifest) DeriveProvider(runtime, model string, availableAuthEnv []stri
 	}
 
 	// Step 3: exact model-id match against each native provider ref's Models.
-	// Authoritative — a verbatim id beats any prefix. If two native refs both
-	// list the same id, that is a manifest ambiguity we surface rather than
-	// silently pick (LoadManifest already forbids a provider ref appearing
-	// twice in one runtime, but two DIFFERENT providers listing the same id
-	// is not load-rejected, so guard it here).
+	// Authoritative — a verbatim id beats any prefix. `exact` is collected in
+	// native-declaration order. When ONE native arm lists the id, it wins
+	// outright. When MORE THAN ONE lists it (the codex oauth-vs-key "one id,
+	// two auth arms" shape), it is disambiguated by available auth env, with
+	// the first-declared arm as the deterministic default (handled below) —
+	// NOT a load error, since a model legitimately offered on two auth arms is
+	// a feature, not a typo. (LoadManifest still forbids the SAME provider ref
+	// appearing twice in one runtime.)
 	var exact []Provider
 	for _, ref := range native.Providers {
 		for _, mid := range ref.Models {
@@ -105,9 +118,19 @@ func (m *Manifest) DeriveProvider(runtime, model string, availableAuthEnv []stri
 		return exact[0], nil
 	}
 	if len(exact) > 1 {
-		return Provider{}, fmt.Errorf(
-			"providers: model %q for runtime %q is exact-listed by %d native providers (%s) — manifest ambiguity",
-			model, runtime, len(exact), strings.Join(providerNames(exact), ", "))
+		// The same id is exact-listed by >1 native arm — the legitimate
+		// "one model id, two auth arms" shape (codex gpt-* on both the
+		// openai-subscription OAuth arm and the openai-api direct-key arm,
+		// mirroring claude-code's anthropic oauth+api split). Disambiguate by
+		// available auth env exactly as the prefix step does. `exact` is in
+		// native-declaration order, so the first-declared arm is the
+		// deterministic default when auth env does not resolve it.
+		if p, ok := disambiguateByAuthEnv(exact, availableAuthEnv); ok {
+			return p, nil
+		}
+		// No auth context (or an unresolved tie): the first-declared native
+		// arm is the default (codex declares openai-subscription first).
+		return exact[0], nil
 	}
 
 	// Step 4: prefix match among native providers only.
@@ -132,26 +155,11 @@ func (m *Manifest) DeriveProvider(runtime, model string, availableAuthEnv []stri
 	}
 
 	// Step 5: >1 prefix match — disambiguate by available auth env.
-	if len(availableAuthEnv) > 0 {
-		avail := make(map[string]struct{}, len(availableAuthEnv))
-		for _, e := range availableAuthEnv {
-			avail[e] = struct{}{}
-		}
-		var byAuth []Provider
-		for _, p := range matched {
-			for _, want := range p.AuthEnv {
-				if _, ok := avail[want]; ok {
-					byAuth = append(byAuth, p)
-					break
-				}
-			}
-		}
-		if len(byAuth) == 1 {
-			return byAuth[0], nil
-		}
-		if len(byAuth) > 1 {
-			matched = byAuth // narrowed but still ambiguous; report the narrowed set
-		}
+	if p, ok := disambiguateByAuthEnv(matched, availableAuthEnv); ok {
+		return p, nil
+	}
+	if narrowed := authEnvMatches(matched, availableAuthEnv); len(narrowed) > 1 {
+		matched = narrowed // narrowed but still ambiguous; report the narrowed set
 	}
 
 	// Step 6: still ambiguous -> error (never silently pick).
@@ -247,6 +255,41 @@ func (m *Manifest) ResolveUpstream(model string) (Upstream, error) {
 		"providers: %q is not an upstream-namespaced model id (vendor/model); bare ids are vestigial at the proxy and resolve via the legacy fallback", model)
 }
 
+// authEnvMatches returns the subset of candidates whose AuthEnv intersects
+// availableAuthEnv, preserving the input order. A nil/empty availableAuthEnv
+// yields nil (the tie-break cannot fire).
+func authEnvMatches(candidates []Provider, availableAuthEnv []string) []Provider {
+	if len(availableAuthEnv) == 0 {
+		return nil
+	}
+	avail := make(map[string]struct{}, len(availableAuthEnv))
+	for _, e := range availableAuthEnv {
+		avail[e] = struct{}{}
+	}
+	var out []Provider
+	for _, p := range candidates {
+		for _, want := range p.AuthEnv {
+			if _, ok := avail[want]; ok {
+				out = append(out, p)
+				break
+			}
+		}
+	}
+	return out
+}
+
+// disambiguateByAuthEnv returns the single candidate whose AuthEnv intersects
+// availableAuthEnv when EXACTLY one does, else ok=false. Used by both the
+// exact-id step (codex oauth-vs-key arms exact-listing the same gpt-* id) and
+// the prefix step to split an auth-distinguished provider overlap.
+func disambiguateByAuthEnv(candidates []Provider, availableAuthEnv []string) (Provider, bool) {
+	byAuth := authEnvMatches(candidates, availableAuthEnv)
+	if len(byAuth) == 1 {
+		return byAuth[0], true
+	}
+	return Provider{}, false
+}
+
 // providerNames returns the sorted names of a provider slice for stable,
 // deterministic error messages (test assertions + operator readability).
 func providerNames(ps []Provider) []string {

workspace-server/internal/providers/derive_provider_test.go

@@ -58,7 +58,18 @@ func TestDeriveProvider_RealManifest(t *testing.T) {
 		{"claude-code api sonnet versioned", "claude-code", "claude-sonnet-4-6", []string{"ANTHROPIC_API_KEY"}, "anthropic-api"},
 
 		// --- other runtimes' native sets --------------------------------
-		{"codex byok gpt-5.5", "codex", "gpt-5.5", []string{"OPENAI_API_KEY"}, "openai"},
+		// codex OpenAI is split across openai-subscription (OAuth — the
+		// DEFAULT) + openai-api (direct key), mirroring the anthropic
+		// oauth+api split. The codex template/adapter registry uses these
+		// SPLIT names, never bare `openai` (the prod "picks provider='openai'
+		// but it is not in the providers registry" wedge this fixes). The
+		// shared gpt-* ids are exact-listed under BOTH arms and disambiguated
+		// by available auth env, defaulting to the first-declared arm
+		// (openai-subscription) when no auth context resolves it.
+		{"codex byok gpt-5.5 with OPENAI_API_KEY -> api", "codex", "gpt-5.5", []string{"OPENAI_API_KEY"}, "openai-api"},
+		{"codex byok gpt-5.5 with CODEX_AUTH_JSON -> subscription", "codex", "gpt-5.5", []string{"CODEX_AUTH_JSON"}, "openai-subscription"},
+		{"codex byok gpt-5.5 no auth -> subscription (default)", "codex", "gpt-5.5", nil, "openai-subscription"},
+		{"codex byok gpt-5.4-mini no auth -> subscription (default)", "codex", "gpt-5.4-mini", nil, "openai-subscription"},
 		{"claude-code minimax", "claude-code", "MiniMax-M2.7", []string{"MINIMAX_API_KEY"}, "minimax"},
 		{"openclaw byok colon", "openclaw", "moonshot:kimi-k2.6", []string{"KIMI_API_KEY"}, "kimi-coding"},
 	}
@@ -334,9 +345,13 @@ func TestResolveUpstream_RealManifest(t *testing.T) {
 		{"platform moonshot colon (openclaw)", "moonshot:kimi-k2.6", "moonshot", "kimi-k2.6", "moonshot", false},
 		// anthropic namespace resolves to the anthropic-api ENTRY (name != vendor).
 		{"platform anthropic ns", "anthropic/claude-opus-4-7", "anthropic", "claude-opus-4-7", "anthropic-api", false},
-		{"platform openai ns", "openai/gpt-5.4", "openai", "gpt-5.4", "openai", false},
+		// openai namespace resolves to the openai-api ENTRY (name != vendor),
+		// mirroring anthropic/ -> anthropic-api: the OAuth subscription arm
+		// carries NO upstream_vendor (OAuth never traverses the proxy), so the
+		// `openai/` namespace + Responses surface route through openai-api.
+		{"platform openai ns", "openai/gpt-5.4", "openai", "gpt-5.4", "openai-api", false},
 		{"platform minimax ns", "minimax/MiniMax-M2.7", "minimax", "MiniMax-M2.7", "minimax", false},
-		{"openai ns gpt-4o", "openai/gpt-4o", "openai", "gpt-4o", "openai", false},
+		{"openai ns gpt-4o", "openai/gpt-4o", "openai", "gpt-4o", "openai-api", false},
 		// --- bare ids are VESTIGIAL at the proxy: ResolveUpstream errors (the
 		//     proxy falls back to its legacy switch for these). No live bare traffic.
 		{"bare kimi -> err (vestigial, legacy fallback)", "kimi-k2.6", "", "", "", true},
@@ -417,7 +432,7 @@ func TestResolveUpstream_ResolvesToProviderEntry(t *testing.T) {
 		{"moonshot/kimi-k2.6", "moonshot", "https://api.moonshot.ai/v1", "https://api.moonshot.ai/anthropic/v1", "MOONSHOT_API_KEY"},
 		{"anthropic/claude-opus-4-7", "anthropic-api", "https://api.anthropic.com/v1", "https://api.anthropic.com/v1", "ANTHROPIC_API_KEY"},
 		{"minimax/MiniMax-M2.7", "minimax", "https://api.minimax.io/v1", "https://api.minimax.io/anthropic/v1", "MINIMAX_API_KEY"},
-		{"openai/gpt-5.4", "openai", "https://api.openai.com/v1", "", "OPENAI_API_KEY"},
+		{"openai/gpt-5.4", "openai-api", "https://api.openai.com/v1", "", "OPENAI_API_KEY"},
 	}
 	for _, tc := range cases {
 		up, err := m.ResolveUpstream(tc.model)
@@ -505,9 +520,12 @@ func TestResolveUpstream_OnlyRoutingEntriesCarryVendor(t *testing.T) {
 	}
 	want := map[string]string{
 		"anthropic": "anthropic-api",
-		"openai":    "openai",
-		"moonshot":  "moonshot",
-		"minimax":   "minimax",
+		// openai's upstream_vendor lives on the openai-api entry (the proxy
+		// arm); the openai-subscription OAuth arm carries none — OAuth never
+		// traverses the proxy (mirror of anthropic-oauth).
+		"openai":   "openai-api",
+		"moonshot": "moonshot",
+		"minimax":  "minimax",
 	}
 	if len(got) != len(want) {
 		t.Fatalf("upstream_vendor entries = %v, want exactly %v", got, want)
@@ -518,3 +536,85 @@ func TestResolveUpstream_OnlyRoutingEntriesCarryVendor(t *testing.T) {
 		}
 	}
 }
+
+// codexTemplateProviderRegistry is the set of provider names the DEPLOYED codex
+// workspace template/adapter accepts in its `providers:` registry
+// (git.moleculesai.app/molecule-ai/molecule-ai-workspace-template-codex
+// config.yaml — the source of truth for the codex adapter's vocabulary). The
+// adapter REJECTS any provider name not in this set with the prod error:
+//
+//	ValueError: codex adapter: workspace config picks provider='openai' but it
+//	is not in the providers registry. Known providers: openai-subscription,
+//	openai-api
+//
+// `minimax-token-plan` + `platform` are also in the template but are NOT in the
+// codex NATIVE matrix (token-plan is pruned — the vendor's /v1/responses leg
+// 404s; platform is core-only billing), so the BYOK arms the SSOT derives must
+// be a SUBSET of {openai-subscription, openai-api}. `platform` is the legitimate
+// platform-managed exception (it is in both the template and the native set).
+var codexTemplateProviderRegistry = map[string]struct{}{
+	"openai-subscription": {},
+	"openai-api":          {},
+	"minimax-token-plan":  {},
+	"platform":            {},
+}
+
+// TestCodexDerivesOnlyTemplateRegistryProviders is the DRIFT GATE that the
+// pre-fix gate MISSED: it caught the claude-code/kimi SSOT↔template divergence
+// but NOT codex's (the SSOT derived bare `openai`, which the codex adapter
+// rejects). It asserts that for EVERY model the codex runtime natively exposes,
+// DeriveProvider resolves to a provider name the deployed codex template's
+// `providers:` registry actually accepts — so a future SSOT edit that derives a
+// codex-adapter-unknown provider (a bare `openai` regression, a typo'd arm)
+// fails RED here instead of wedging codex agents as NOT CONFIGURED in prod.
+func TestCodexDerivesOnlyTemplateRegistryProviders(t *testing.T) {
+	m, err := LoadManifest()
+	if err != nil {
+		t.Fatalf("LoadManifest() error = %v", err)
+	}
+	models, err := m.ModelsForRuntime("codex")
+	if err != nil {
+		t.Fatalf("ModelsForRuntime(codex) error = %v", err)
+	}
+	if len(models) == 0 {
+		t.Fatal("codex native model set is empty — nothing to gate")
+	}
+	// Exercise both auth contexts the codex adapter resolves: the OAuth
+	// subscription (CODEX_AUTH_JSON) and the direct key (OPENAI_API_KEY), plus
+	// the no-auth default. Every resulting provider name MUST be one the codex
+	// template registry accepts (never bare `openai`).
+	authContexts := [][]string{
+		nil,                          // no auth -> default (subscription)
+		{"CODEX_AUTH_JSON"},          // ChatGPT/Codex subscription
+		{"OPENAI_API_KEY"},           // direct OpenAI key
+		{"MOLECULE_LLM_USAGE_TOKEN"}, // platform-managed
+	}
+	for _, model := range models {
+		for _, authEnv := range authContexts {
+			p, derr := m.DeriveProvider("codex", model, authEnv)
+			if derr != nil {
+				// A platform/-namespaced id requires the platform auth env to
+				// disambiguate; an unrelated auth context legitimately can't
+				// resolve it. Only a CLEAN derivation must be in-registry.
+				continue
+			}
+			if _, ok := codexTemplateProviderRegistry[p.Name]; !ok {
+				t.Errorf("codex model %q (authEnv=%v) derived provider %q, which the codex template registry REJECTS (known: openai-subscription, openai-api, minimax-token-plan, platform) — SSOT↔template drift, the exact prod wedge",
+					model, authEnv, p.Name)
+			}
+		}
+	}
+	// And pin the load-bearing default explicitly: the bare gpt-* family with
+	// no auth context defaults to the OAuth subscription (the codex adapter's
+	// resolve-provider precedence #1), never bare `openai`.
+	for _, model := range []string{"gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex", "gpt-5.3-codex-spark", "gpt-5.2"} {
+		p, derr := m.DeriveProvider("codex", model, nil)
+		if derr != nil {
+			t.Errorf("codex default derivation for %q errored: %v", model, derr)
+			continue
+		}
+		if p.Name != "openai-subscription" {
+			t.Errorf("codex default for %q = %q, want openai-subscription (the OAuth subscription default)", model, p.Name)
+		}
+	}
+}

workspace-server/internal/providers/gen/registry_gen.go

@@ -16,7 +16,7 @@ const SchemaVersion = 1
 // Fingerprint is a stable content hash of the generated projection (schema
 // version + provider catalog + runtime native sets). It changes iff the
 // registry DATA changes (comment-only YAML edits do not churn it).
-const Fingerprint = "cbd39dfe934302e0"
+const Fingerprint = "8f733b112695b926"
 
 // GenProvider is the generated projection of one provider catalog entry —
 // the subset a downstream consumer needs to derive + display a provider.
@@ -46,7 +46,8 @@ type GenRuntimeRef struct {
 var Providers = []GenProvider{
 	{Name: "anthropic-api", DisplayName: "Anthropic API", Protocol: "anthropic", AuthMode: "anthropic_api", AuthEnv: []string{"ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"}, ModelPrefixMatch: "^claude", IsPlatform: false, UpstreamVendor: "anthropic"},
 	{Name: "anthropic-oauth", DisplayName: "Claude Code subscription", Protocol: "anthropic", AuthMode: "oauth", AuthEnv: []string{"CLAUDE_CODE_OAUTH_TOKEN"}, ModelPrefixMatch: "^(sonnet|opus|haiku)$", IsPlatform: false},
-	{Name: "openai", DisplayName: "OpenAI", Protocol: "openai", AuthMode: "anthropic_api", AuthEnv: []string{"OPENAI_API_KEY"}, ModelPrefixMatch: "^gpt-", IsPlatform: false, UpstreamVendor: "openai"},
+	{Name: "openai-subscription", DisplayName: "OpenAI Codex subscription", Protocol: "openai", AuthMode: "oauth", AuthEnv: []string{"CODEX_AUTH_JSON", "CODEX_CHATGPT_AUTH_JSON"}, ModelPrefixMatch: "^gpt-", IsPlatform: false},
+	{Name: "openai-api", DisplayName: "OpenAI API", Protocol: "openai", AuthMode: "anthropic_api", AuthEnv: []string{"OPENAI_API_KEY"}, ModelPrefixMatch: "^openai-api[:/]", IsPlatform: false, UpstreamVendor: "openai"},
 	{Name: "moonshot", DisplayName: "Moonshot (Kimi)", Protocol: "openai", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"MOONSHOT_API_KEY", "KIMI_API_KEY"}, ModelPrefixMatch: "^moonshot[:/-]", IsPlatform: false, UpstreamVendor: "moonshot"},
 	{Name: "minimax", DisplayName: "MiniMax", Protocol: "openai", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"MINIMAX_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_API_KEY"}, ModelPrefixMatch: "(?i)^minimax-m", IsPlatform: false, UpstreamVendor: "minimax"},
 	{Name: "platform", DisplayName: "Platform", Protocol: "anthropic", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"ANTHROPIC_API_KEY", "MOLECULE_LLM_USAGE_TOKEN"}, ModelPrefixMatch: "^platform/", IsPlatform: true},
@@ -55,6 +56,7 @@ var Providers = []GenProvider{
 	{Name: "kimi-coding", DisplayName: "Moonshot Kimi (coding-tuned)", Protocol: "anthropic", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"KIMI_API_KEY", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"}, ModelPrefixMatch: "^kimi-", IsPlatform: false},
 	{Name: "deepseek", DisplayName: "DeepSeek", Protocol: "anthropic", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"DEEPSEEK_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_API_KEY"}, ModelPrefixMatch: "^deepseek-", IsPlatform: false},
 	{Name: "google", DisplayName: "Google Gemini", Protocol: "openai", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"GEMINI_API_KEY", "GOOGLE_API_KEY"}, ModelPrefixMatch: "^gemini-", IsPlatform: false},
+	{Name: "vertex", DisplayName: "Google Vertex AI (keyless ADC)", Protocol: "openai", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"GOOGLE_APPLICATION_CREDENTIALS"}, ModelPrefixMatch: "^vertex:", IsPlatform: false},
 	{Name: "alibaba", DisplayName: "Alibaba Qwen (DashScope)", Protocol: "openai", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"DASHSCOPE_API_KEY", "ALIBABA_API_KEY"}, ModelPrefixMatch: "^qwen-", IsPlatform: false},
 	{Name: "nousresearch", DisplayName: "Nous Research (Hermes)", Protocol: "openai", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"NOUSRESEARCH_API_KEY"}, ModelPrefixMatch: "^nousresearch/", IsPlatform: false},
 	{Name: "openrouter", DisplayName: "OpenRouter (any model)", Protocol: "openai", AuthMode: "third_party_anthropic_compat", AuthEnv: []string{"OPENROUTER_API_KEY"}, ModelPrefixMatch: "^openrouter/", IsPlatform: false},
@@ -78,13 +80,18 @@ var Runtimes = map[string][]GenRuntimeRef{
 		{Name: "anthropic-oauth", Models: []string{"sonnet", "opus", "haiku", "anthropic:sonnet", "anthropic:opus", "anthropic:haiku"}},
 		{Name: "anthropic-api", Models: []string{"claude-sonnet-4-6", "claude-opus-4-7", "claude-haiku-4-5", "claude-sonnet-4-5", "anthropic:claude-sonnet-4-6", "anthropic:claude-opus-4-7", "anthropic:claude-haiku-4-5", "anthropic:claude-sonnet-4-5"}},
 		{Name: "kimi-coding", Models: []string{"kimi-for-coding", "kimi-k2.5", "kimi-k2", "moonshot:kimi-k2.6", "moonshot:kimi-k2.5"}},
-		{Name: "minimax", Models: []string{"MiniMax-M2", "MiniMax-M2.7", "MiniMax-M2.7-highspeed", "minimax:MiniMax-M2", "minimax:MiniMax-M2.7", "minimax:MiniMax-M2.7-highspeed"}},
-		{Name: "platform", Models: []string{"anthropic/claude-opus-4-7", "anthropic/claude-sonnet-4-6", "moonshot/kimi-k2.6", "moonshot/kimi-k2.5", "minimax/MiniMax-M2.7", "minimax/MiniMax-M2.7-highspeed"}},
+		{Name: "minimax", Models: []string{"MiniMax-M2", "MiniMax-M2.7", "MiniMax-M2.7-highspeed", "MiniMax-M3", "minimax:MiniMax-M2", "minimax:MiniMax-M2.7", "minimax:MiniMax-M2.7-highspeed", "minimax:MiniMax-M3"}},
+		{Name: "platform", Models: []string{"anthropic/claude-opus-4-7", "anthropic/claude-sonnet-4-6", "moonshot/kimi-k2.6", "moonshot/kimi-k2.5", "minimax/MiniMax-M2.7", "minimax/MiniMax-M2.7-highspeed", "minimax/MiniMax-M3"}},
 	},
 	"codex": {
-		{Name: "openai", Models: []string{"gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex", "gpt-5.3-codex-spark", "gpt-5.2"}},
+		{Name: "openai-subscription", Models: []string{"gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex", "gpt-5.3-codex-spark", "gpt-5.2"}},
+		{Name: "openai-api", Models: []string{"gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex", "gpt-5.3-codex-spark", "gpt-5.2"}},
 		{Name: "platform", Models: []string{"openai/gpt-5.4", "openai/gpt-5.4-mini"}},
 	},
+	"google-adk": {
+		{Name: "vertex", Models: []string{"vertex:gemini-2.5-pro"}},
+		{Name: "google", Models: []string{"gemini-2.5-pro"}},
+	},
 	"hermes": {
 		{Name: "kimi-coding", Models: []string{"kimi-coding/kimi-k2"}},
 		{Name: "platform", Models: []string{"moonshot/kimi-k2.6", "moonshot/kimi-k2.5"}},

workspace-server/internal/providers/providers.go

@@ -1,27 +1,18 @@
-// Package providers is the molecule-core SIDE of the LLM provider registry
-// SSOT (internal#718 P2-A, CTO 2026-05-27 "Distribution = SDK via codegen +
-// verify-CI"). It is a load-time mirror of the canonical loader that lives in
-// molecule-controlplane internal/providers — same parse, same validation, same
-// DeriveProvider/IsPlatform/ResolveUpstream API.
+// Package providers is the SSOT baseline for the LLM provider registry.
 //
-// CANONICAL SSOT = molecule-controlplane internal/providers/providers.yaml.
-// This package embeds a SYNCED COPY of that file (providers.yaml here is a
-// byte-for-byte mirror of the canonical, NOT a second authoring surface). The
-// CTO-decided distribution model for a multi-repo registry is
-// "codegen-checked-into-each-repo + verify-CI": every consumer repo carries the
-// generated projection and a drift gate, so a registry change in CP must be
-// re-synced here (the sync-providers-yaml verify gate goes RED if this copy
-// drifts from the canonical). molecule-core has no Go module dependency on
-// controlplane, so a synced+gated copy is the blessed path (a shared Go module
-// is not viable across the two repos today).
+// RFC: molecule-ai/molecule-controlplane#340 "Canonical Providers
+// Manifest". This package is PR-1: it embeds and parses providers.yaml
+// (the git-tracked baseline that transcribes the union of the proxy
+// switch, the canvas VENDOR_LABELS, the adapter config.yaml `providers:`
+// block, and the DB llm_price_catalog). NOTHING imports it yet — the
+// consumers (internal/handlers/llm_proxy.go, the canvas dropdown, and
+// the workspace-template adapters) are migrated in later PRs. Reverting
+// PR-1 = delete this package; zero runtime behavior change.
 //
-// P2-A is ADDITIVE, ZERO behavior change (the P0 shape mirrored): the loader +
-// DeriveProvider land here, plus the generated artifact (cmd/gen-providers) and
-// the verify-providers-gen drift gate, but NO production code path imports this
-// package yet. P2-B wires the billing/credential decision onto DeriveProvider.
-//
-// Distribution model mirrors molecule-controlplane internal/providers: go:embed
-// the YAML into the binary so a boot-time Load never touches the network.
+// Distribution model mirrors internal/envs (RFC internal#213 §6.5.4
+// Option C): go:embed the YAML into the binary so a boot-time Load never
+// touches the network. A future DB override layer (RFC §3 (c)) can merge
+// on top of the embedded baseline without breaking this package's API.
 package providers
 
 import (
@@ -311,9 +302,24 @@ func (m *Manifest) ModelsForRuntime(rt string) ([]string, error) {
 	if !ok {
 		return nil, fmt.Errorf("providers: unknown runtime %q", rt)
 	}
+	// De-duplicate while preserving first-seen order. A single model id may be
+	// exact-listed under MORE THAN ONE native arm — the legitimate "one model
+	// id, two auth arms" shape (codex's gpt-* family is offered on both the
+	// openai-subscription OAuth arm and the openai-api direct-key arm, mirroring
+	// claude-code's anthropic oauth+api split). The canvas surfaces each id
+	// once (the auth path is chosen at runtime by which key is present), so the
+	// flattened native model set must not repeat it. A no-op for every runtime
+	// whose arms list disjoint ids.
 	var out []string
+	seen := make(map[string]struct{})
 	for _, ref := range native.Providers {
-		out = append(out, ref.Models...)
+		for _, mid := range ref.Models {
+			if _, dup := seen[mid]; dup {
+				continue
+			}
+			seen[mid] = struct{}{}
+			out = append(out, mid)
+		}
 	}
 	return out, nil
 }

workspace-server/internal/providers/providers.yaml

@@ -110,30 +110,85 @@ providers:
     model_aliases: [sonnet, opus, haiku]
 
   # ===========================================================================
-  # OpenAI — proxy default arm + DB catalog + canvas. NOT in the adapter
-  # template (claude-code template is Anthropic-protocol only).
+  # OpenAI / Codex — SPLIT into two providers, mirroring the anthropic-api /
+  # anthropic-oauth pair above. The codex runtime authenticates via EITHER a
+  # ChatGPT/Codex subscription (OAuth-style auth.json blob — the CLI talks to
+  # OpenAI directly, never the proxy) OR a direct OpenAI API key. The codex
+  # template/adapter registry
+  # (git.moleculesai.app/molecule-ai/molecule-ai-workspace-template-codex
+  # config.yaml `providers:`) uses the SPLIT names `openai-subscription`
+  # (auth_mode chatgpt_subscription) + `openai-api` (auth_mode openai_api); it
+  # does NOT accept a bare `openai`. The previous single `openai` SSOT entry
+  # derived bare `openai` for (codex, gpt-*), which the adapter rejected with
+  # "picks provider='openai' but it is not in the providers registry. Known
+  # providers: openai-subscription, openai-api" — leaving codex agents NOT
+  # CONFIGURED. The split below converges the SSOT onto the adapter's vocabulary.
+  #
+  # openai-subscription is the OAuth arm (mirror of anthropic-oauth): auth_mode
+  # oauth, NO upstream_vendor (OAuth never traverses the proxy — the CLI dials
+  # OpenAI directly), base_url null, the ChatGPT-OAuth auth.json env. It is the
+  # codex DEFAULT (the template adapter's resolve-provider precedence #1 picks
+  # the subscription when CODEX_AUTH_JSON is present), so it owns the bare gpt-*
+  # family by prefix + exact-list and DeriveProvider(codex, gpt-5.5) -> here.
   # ===========================================================================
-  - name: openai
-    display_name: "OpenAI"
+  - name: openai-subscription
+    display_name: "OpenAI Codex subscription"
     vendor_logo: "openai"
     protocol: openai
-    auth_mode: anthropic_api  # OpenAI is openai-protocol; auth is a bearer API key.
+    auth_mode: oauth  # ChatGPT/Codex subscription — auth.json blob, not a bearer key.
+    base_url_template: null  # OAuth: the codex CLI talks to OpenAI directly (no proxy).
+    base_url_anthropic: null  # OpenAI exposes only the OpenAI protocol surface.
+    # The codex template's chatgpt_subscription auth_env, verbatim from the
+    # deployed config.yaml: CODEX_AUTH_JSON wins over the older
+    # CODEX_CHATGPT_AUTH_JSON alias when both are set.
+    auth_env: [CODEX_AUTH_JSON, CODEX_CHATGPT_AUTH_JSON]
+    auth_token_env: CODEX_AUTH_JSON
+    # Canvas matches /^gpt-/i. This is the codex DEFAULT arm, so it owns the
+    # bare gpt-* prefix (the codex runtime exact-lists the gpt-* ids under it).
+    model_prefix_match: "^gpt-"
+    model_aliases: []
+    # NO upstream_vendor — OAuth never traverses the proxy (mirror of
+    # anthropic-oauth). The proxy's `openai/` namespace token + Responses
+    # surface resolve to openai-api below (which carries upstream_vendor:
+    # openai), keeping proxy routing + billing byte-identical.
+
+  # ===========================================================================
+  # OpenAI API key — the BYOK direct-key arm AND the proxy arm (mirror of
+  # anthropic-api). Carries upstream_vendor: openai so ResolveUpstream still
+  # maps the `openai/` namespace token to THIS entry and the proxy's OpenAI
+  # Responses surface (codex platform-managed) routes upstream vendor "openai"
+  # exactly as before — proxy + billing are byte-identical to the pre-split
+  # `openai` entry. Its catalog model_prefix_match is a DISJOINT sentinel
+  # (`^openai-api[:/]`) so the bare gpt-* family stays owned by
+  # openai-subscription and the catalog overlap guard (no slug may match two
+  # providers) stays green — exactly as anthropic-oauth's `^(sonnet|opus|
+  # haiku)$` is disjoint from anthropic-api's `^claude`.
+  # ===========================================================================
+  - name: openai-api
+    display_name: "OpenAI API"
+    vendor_logo: "openai"
+    protocol: openai
+    auth_mode: anthropic_api  # openai-protocol; auth is a bearer API key (mirror of anthropic-api).
     base_url_template: "https://api.openai.com/v1"
     base_url_anthropic: null  # OpenAI exposes only the OpenAI protocol surface.
     auth_env: [OPENAI_API_KEY]
     auth_token_env: OPENAI_API_KEY
-    # Proxy treats openai as the DEFAULT (catch-all) arm of inferLLMProvider;
-    # there is no explicit prefix today. Canvas matches /^gpt-/i. Encode the
-    # canvas prefix so the explicit slugs route; the proxy's catch-all
-    # behavior is a routing decision for PR-3, not the manifest.
-    model_prefix_match: "^gpt-"
+    # DISJOINT sentinel prefix: openai-api is selected explicitly (the
+    # provisioner's LLM_PROVIDER=openai-api) or via the `openai/` proxy
+    # namespace (ResolveUpstream uses upstream_vendor, NOT this prefix). The
+    # bare gpt-* family is owned by openai-subscription (the codex default), so
+    # this prefix must NOT also claim `^gpt-` or the catalog overlap guard
+    # (TestNoAmbiguousModelMatch) would flag gpt-5.5 as matching two providers.
+    model_prefix_match: "^openai-api[:/]"
     model_aliases: []
     # internal#718 P1 (CONVERGED): the proxy's upstream-vendor key. ResolveUpstream
-    # maps the `openai/` namespace token to THIS entry. openai is ALSO the proxy's
-    # historical catch-all (the switch's `default:` arm) for bare/unknown ids —
-    # but the catch-all is a VESTIGIAL bare-id behavior (no live bare traffic), so
-    # it lives in the retained legacy fallback (inferLLMProviderLegacy), NOT as a
-    # registry data flag. Live `openai/<m>` ids resolve here by namespace.
+    # maps the `openai/` namespace token to THIS entry, then dials its
+    # base_url_template + auth (the SINGLE source). openai is ALSO the proxy's
+    # historical catch-all (the legacy switch's `default:` arm) for bare/unknown
+    # ids — a VESTIGIAL bare-id behavior (no live bare traffic) retained in
+    # inferLLMProviderLegacy, NOT a registry flag. Live `openai/<m>` ids resolve
+    # here by namespace. The openai-subscription OAuth arm carries NO
+    # upstream_vendor (OAuth never traverses the proxy).
     upstream_vendor: openai
 
   # ===========================================================================
@@ -293,8 +348,8 @@ providers:
     vendor_logo: "moonshot"
     protocol: anthropic
     auth_mode: third_party_anthropic_compat
-    base_url_template: "https://api.kimi.com/coding/"
-    base_url_anthropic: "https://api.kimi.com/coding/"
+    base_url_template: "https://api.kimi.com/coding/v1"
+    base_url_anthropic: "https://api.kimi.com/coding/v1"
     auth_env: [KIMI_API_KEY, ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN]
     # x-api-key header (NOT bearer) per kimi.com's Claude Code integration doc.
     auth_token_env: ANTHROPIC_API_KEY
@@ -348,7 +403,7 @@ providers:
     vendor_logo: "google"
     protocol: openai
     auth_mode: third_party_anthropic_compat
-    base_url_template: null
+    base_url_template: "https://generativelanguage.googleapis.com/v1beta/openai"
     base_url_anthropic: null
     auth_env: [GEMINI_API_KEY, GOOGLE_API_KEY]
     auth_token_env: ANTHROPIC_AUTH_TOKEN
@@ -357,6 +412,26 @@ providers:
     model_prefix_match: "^gemini-"
     model_aliases: []
 
+  # Google Vertex AI — KEYLESS arm (mirrors the anthropic-oauth / anthropic-api
+  # and openai-subscription / openai-api split: same vendor, distinct auth).
+  # google-adk serves Gemini via Vertex using Application Default Credentials
+  # over Workload Identity Federation (AWS EC2 role -> GCP STS -> SA), injected
+  # by the provisioner (cp#416 + envs.yaml vertex block) as a NON-SECRET
+  # external_account cred-config at GOOGLE_APPLICATION_CREDENTIALS. No API key.
+  # Distinct `vertex:` model namespace keeps it unambiguous vs the API-key
+  # `google` vendor's ^gemini- (TestNoAmbiguousModelMatch).
+  - name: vertex
+    display_name: "Google Vertex AI (keyless ADC)"
+    vendor_logo: "google"
+    protocol: openai
+    auth_mode: third_party_anthropic_compat
+    base_url_template: null
+    base_url_anthropic: null
+    auth_env: [GOOGLE_APPLICATION_CREDENTIALS]
+    auth_token_env: ANTHROPIC_AUTH_TOKEN
+    model_prefix_match: "^vertex:"
+    model_aliases: []
+
   - name: alibaba
     display_name: "Alibaba Qwen (DashScope)"
     vendor_logo: "alibaba"
@@ -561,7 +636,8 @@ providers:
 # AUTHORITATIVE MATRIX (provider level), encoded EXACTLY below:
 #   claude-code -> anthropic (oauth + api), kimi (kimi-coding), minimax
 #   hermes      -> kimi (kimi-coding)
-#   codex       -> openai
+#   codex       -> openai (subscription + api — the split openai-subscription /
+#                  openai-api pair, mirroring anthropic oauth+api)
 #   openclaw    -> kimi (kimi-coding)
 #
 # Each runtime entry lists native provider NAMES (referencing `providers:`
@@ -657,9 +733,11 @@ runtimes:
           - MiniMax-M2
           - MiniMax-M2.7
           - MiniMax-M2.7-highspeed
+          - MiniMax-M3
           - minimax:MiniMax-M2
           - minimax:MiniMax-M2.7
           - minimax:MiniMax-M2.7-highspeed
+          - minimax:MiniMax-M3
       # Platform-managed (no tenant key; Molecule owns billing). The
       # vendor/model-namespaced ids the proxy resolves to the upstream vendor.
       # Canonical for the template's `provider: platform` model entries — the
@@ -673,6 +751,7 @@ runtimes:
           - moonshot/kimi-k2.5
           - minimax/MiniMax-M2.7
           - minimax/MiniMax-M2.7-highspeed
+          - minimax/MiniMax-M3
 
   # hermes: native Kimi only (kimi-coding gateway). hermes-agent owns its own
   # broad provider matrix, but the CTO native matrix for the Molecule
@@ -689,12 +768,39 @@ runtimes:
           - moonshot/kimi-k2.6
           - moonshot/kimi-k2.5
 
-  # codex: OpenAI — BYOK (subscription + API key, both map to the `openai`
-  # manifest provider) + platform-managed (the `platform` ref below, served
-  # via the proxy Responses surface).
+  # codex: OpenAI — BYOK split across TWO native providers
+  # (openai-subscription + openai-api), mirroring claude-code's anthropic
+  # oauth+api split, PLUS platform-managed (the `platform` ref below, served via
+  # the proxy Responses surface).
+  #
+  # The split fixes the prod "picks provider='openai' but it is not in the
+  # providers registry. Known providers: openai-subscription, openai-api" wedge:
+  # the codex template/adapter registry uses the SPLIT names, never bare
+  # `openai`, so the SSOT must derive one of them. openai-subscription is the
+  # DEFAULT (the adapter's resolve-provider precedence #1 picks the ChatGPT/Codex
+  # subscription when CODEX_AUTH_JSON is present), so it is listed FIRST and owns
+  # the bare gpt-* family — DeriveProvider(codex, gpt-5.5) -> openai-subscription.
+  # openai-api is referenced too (the direct-OPENAI_API_KEY BYOK arm); the same
+  # gpt-* ids are exact-listed under both arms and DeriveProvider disambiguates
+  # by available auth env (OPENAI_API_KEY -> openai-api; the subscription
+  # auth.json env or no auth context -> the first-declared default,
+  # openai-subscription) — the identical oauth-vs-key disambiguation
+  # claude-code's anthropic pair uses.
   codex:
     providers:
-      - name: openai
+      # DEFAULT arm (listed first): ChatGPT/Codex subscription via OAuth.
+      - name: openai-subscription
+        models:
+          - gpt-5.5
+          - gpt-5.4
+          - gpt-5.4-mini
+          - gpt-5.3-codex
+          - gpt-5.3-codex-spark
+          - gpt-5.2
+      # Direct OpenAI API-key BYOK arm. Same gpt-* family; selected over the
+      # subscription default when OPENAI_API_KEY is the available auth env (or
+      # via the explicit provisioner LLM_PROVIDER=openai-api).
+      - name: openai-api
         models:
           - gpt-5.5
           - gpt-5.4
@@ -730,3 +836,19 @@ runtimes:
         models:
           - moonshot/kimi-k2.6
           - moonshot/kimi-k2.5
+
+
+  # google-adk: Gemini via Vertex AI, keyless ADC (Workload Identity
+  # Federation; provisioner cp#416 + envs.yaml). The google vendor entry
+  # in the top-level providers: list supplies auth/model-prefix metadata;
+  # this runtimes entry declares the selectable model set.
+  google-adk:
+    providers:
+      # Keyless Vertex (org-compliant default): Gemini via Vertex AI + ADC/WIF.
+      - name: vertex
+        models:
+          - vertex:gemini-2.5-pro
+      # API-key BYOK arm: AI Studio GEMINI_API_KEY/GOOGLE_API_KEY.
+      - name: google
+        models:
+          - gemini-2.5-pro

workspace-server/internal/providers/providers_test.go

@@ -113,9 +113,13 @@ func TestMatchesModel(t *testing.T) {
 		{"MiniMax-M2.7", "minimax"},
 		{"MiniMax-M2", "minimax"},
 		{"minimax-m2.5", "minimax"},
-		// OpenAI — DB gpt-5.x + canvas /^gpt-/.
-		{"gpt-5.5", "openai"},
-		{"gpt-5.4-mini", "openai"},
+		// OpenAI — the bare gpt-* family is owned by the codex DEFAULT arm
+		// openai-subscription (the OAuth subscription); openai-api uses a
+		// disjoint sentinel prefix so the catalog overlap guard stays green
+		// (mirror of anthropic-oauth's alias-only regex vs anthropic-api's
+		// ^claude). canvas /^gpt-/.
+		{"gpt-5.5", "openai-subscription"},
+		{"gpt-5.4-mini", "openai-subscription"},
 		// Xiaomi MiMo — adapter mimo- + canvas /^mimo-/.
 		{"mimo-v2.5-pro", "xiaomi-mimo"},
 		// Z.ai GLM — adapter glm- + canvas /^GLM-/ (mixed case).
@@ -205,3 +209,109 @@ func TestMatchesModelZeroValue(t *testing.T) {
 		t.Error("Provider with an empty regex must never match")
 	}
 }
+
+// TestGoogleADKRuntimeRegistered locks the providers.yaml SSOT entry for the
+// google-adk runtime (Gemini via Vertex AI, keyless ADC). The runtime picker
+// + GET /templates enrichment read this matrix as SSOT; a missing entry
+// silently degrades the ADK runtime's model/provider surface. See
+// project_canvas_runtime_dropdown_ssot_fix.
+func TestGoogleADKRuntimeRegistered(t *testing.T) {
+	m, err := LoadManifest()
+	if err != nil {
+		t.Fatalf("LoadManifest() error = %v", err)
+	}
+	models, err := m.ModelsForRuntime("google-adk")
+	if err != nil {
+		t.Fatalf("ModelsForRuntime(google-adk) error = %v", err)
+	}
+	hasModel := false
+	for _, id := range models {
+		if id == "gemini-2.5-pro" {
+			hasModel = true
+		}
+	}
+	if !hasModel {
+		t.Errorf("google-adk models missing gemini-2.5-pro; got %v", models)
+	}
+	provs, err := m.ProvidersForRuntime("google-adk")
+	if err != nil {
+		t.Fatalf("ProvidersForRuntime(google-adk) error = %v", err)
+	}
+	hasProv := false
+	for _, p := range provs {
+		if p.Name == "google" {
+			hasProv = true
+		}
+	}
+	if !hasProv {
+		t.Errorf("google-adk providers missing google vendor; got %d providers", len(provs))
+	}
+}
+
+// TestVertexProviderRegistered locks the keyless Vertex provider variant in the
+// providers.yaml SSOT. google-adk serves Gemini via Vertex AI with ADC/WIF
+// (no API key); the registry must model that as a first-class "vertex" provider
+// (auth_env GOOGLE_APPLICATION_CREDENTIALS, ^vertex: namespace) distinct from
+// the API-key "google" vendor, and the google-adk runtime must offer both arms.
+// See project_canvas_runtime_dropdown_ssot_fix.
+func TestVertexProviderRegistered(t *testing.T) {
+	ps, err := Load()
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	var vertex *Provider
+	for i := range ps {
+		if ps[i].Name == "vertex" {
+			vertex = &ps[i]
+		}
+	}
+	if vertex == nil {
+		t.Fatal("vertex provider not registered in providers.yaml")
+	}
+	// Keyless: ADC env, not an API key.
+	hasADC := false
+	for _, e := range vertex.AuthEnv {
+		if e == "GOOGLE_APPLICATION_CREDENTIALS" {
+			hasADC = true
+		}
+	}
+	if !hasADC {
+		t.Errorf("vertex auth_env should be keyless GOOGLE_APPLICATION_CREDENTIALS; got %v", vertex.AuthEnv)
+	}
+	// Owns the vertex: namespace, NOT ^gemini- (which the API-key google vendor owns).
+	if !vertex.MatchesModel("vertex:gemini-2.5-pro") {
+		t.Errorf("vertex provider should match vertex:gemini-2.5-pro")
+	}
+	if vertex.MatchesModel("gemini-2.5-pro") {
+		t.Errorf("vertex provider must NOT claim the bare gemini- namespace (owned by google vendor)")
+	}
+
+	m, err := LoadManifest()
+	if err != nil {
+		t.Fatalf("LoadManifest() error = %v", err)
+	}
+	provs, err := m.ProvidersForRuntime("google-adk")
+	if err != nil {
+		t.Fatalf("ProvidersForRuntime(google-adk) error = %v", err)
+	}
+	names := map[string]bool{}
+	for _, p := range provs {
+		names[p.Name] = true
+	}
+	if !names["vertex"] {
+		t.Errorf("google-adk runtime should offer the keyless vertex arm; got %v", names)
+	}
+	if !names["google"] {
+		t.Errorf("google-adk runtime should keep the API-key google arm; got %v", names)
+	}
+	models, _ := m.ModelsForRuntime("google-adk")
+	hasVertexModel := false
+	for _, id := range models {
+		if id == "vertex:gemini-2.5-pro" {
+			hasVertexModel = true
+		}
+	}
+	if !hasVertexModel {
+		t.Errorf("google-adk models should include vertex:gemini-2.5-pro; got %v", models)
+	}
+}

workspace-server/internal/providers/runtimes_test.go

@@ -19,13 +19,17 @@ import (
 //
 //	claude-code -> anthropic (oauth+api), kimi (kimi-coding), minimax, platform
 //	hermes      -> kimi (kimi-coding), platform
-//	codex       -> openai, platform
+//	codex       -> openai (subscription + api), platform
 //	openclaw    -> kimi (kimi-coding), platform
 var runtimeNativeProviders = map[string][]string{
 	"claude-code": {"anthropic-api", "anthropic-oauth", "kimi-coding", "minimax", "platform"},
 	"hermes":      {"kimi-coding", "platform"},
-	"codex":       {"openai", "platform"}, // platform openai via the proxy Responses surface
-	"openclaw":    {"kimi-coding", "platform"},
+	// codex's OpenAI BYOK is split across the OAuth subscription arm
+	// (openai-subscription) and the direct-key arm (openai-api), mirroring
+	// claude-code's anthropic oauth+api split; platform openai via the proxy
+	// Responses surface.
+	"codex":    {"openai-subscription", "openai-api", "platform"},
+	"openclaw": {"kimi-coding", "platform"},
 }
 
 func sortedCopy(in []string) []string {
@@ -99,10 +103,10 @@ func TestModelsForRuntime_ExactModelIDs(t *testing.T) {
 			// kimi via platform proxy
 			"moonshot/kimi-k2.6", "moonshot/kimi-k2.5",
 			// minimax BYOK (bare + legacy colon-namespaced)
-			"MiniMax-M2", "MiniMax-M2.7", "MiniMax-M2.7-highspeed",
-			"minimax:MiniMax-M2", "minimax:MiniMax-M2.7", "minimax:MiniMax-M2.7-highspeed",
+			"MiniMax-M2", "MiniMax-M2.7", "MiniMax-M2.7-highspeed", "MiniMax-M3",
+			"minimax:MiniMax-M2", "minimax:MiniMax-M2.7", "minimax:MiniMax-M2.7-highspeed", "minimax:MiniMax-M3",
 			// minimax via platform proxy
-			"minimax/MiniMax-M2.7", "minimax/MiniMax-M2.7-highspeed",
+			"minimax/MiniMax-M2.7", "minimax/MiniMax-M2.7-highspeed", "minimax/MiniMax-M3",
 		},
 		// hermes: kimi (BYOK gateway) + platform-managed kimi.
 		"hermes": {

workspace-server/internal/providers/sync_canonical_test.go

@@ -29,7 +29,7 @@ import (
 // canonicalProvidersYAMLSHA256 is the sha256 of the canonical providers.yaml as
 // synced from molecule-controlplane. Bumped deliberately on each re-sync (see
 // file doc). Cross-checked live by the sync-providers-yaml CI workflow.
-const canonicalProvidersYAMLSHA256 = "73e8003062edaa4ce75bfb324be615b6e2b380f07487e3af4dc16cb644dc12bc"
+const canonicalProvidersYAMLSHA256 = "dec73199e26cee2d395a0acece99771618d3879dc5ca724ba57cb5b38079c6ce"
 
 func TestSyncedYAMLMatchesCanonicalSHA(t *testing.T) {
 	sum := sha256.Sum256(embeddedYAML)

workspace-server/internal/registry/access.go

@@ -99,11 +99,6 @@ func CanCommunicate(callerID, targetID string) bool {
 		*caller.ParentID == *target.ParentID {
 		return true
 	}
-	// Root-level siblings — both have no parent
-	if caller.ParentID == nil && target.ParentID == nil {
-		return true
-	}
-
 	// Direct parent → child (fast path; avoids the ancestor walk)
 	if target.ParentID != nil && caller.ID == *target.ParentID {
 		return true

workspace-server/internal/registry/access_test.go

@@ -63,14 +63,16 @@ func TestCanCommunicate_Siblings(t *testing.T) {
 	}
 }
 
-func TestCanCommunicate_RootSiblings(t *testing.T) {
+func TestCanCommunicate_Denied_RootSiblings(t *testing.T) {
 	mock := setupMockDB(t)
-	// Both at root level (no parent)
+	// Two unrelated org roots (both parent_id = NULL) must NOT communicate.
+	// This is the regression test for #1955: without an org_id column, two
+	// root workspaces have no shared ancestor, so they must be denied.
 	expectLookup(mock, "ws-a", nil)
 	expectLookup(mock, "ws-b", nil)
 
-	if !CanCommunicate("ws-a", "ws-b") {
-		t.Error("root-level siblings should communicate")
+	if CanCommunicate("ws-a", "ws-b") {
+		t.Error("unrelated root-level workspaces should NOT communicate")
 	}
 }