test(secrets): add compile-error coverage tests (closes #1269)

Adds two tests to patterns_test.go that exercise the previously-untested
error paths in compileAll / ScanBytes:

- TestCompileError: swaps Patterns with an invalid regex
  (unbalanced bracket "[unclosed"), resets the package-level
  compile state (compiledOnce, compiledPatterns, compileErr), calls
  compileAll directly, and asserts compileErr != nil. Exercises
  patterns.go:167-171.

- TestScanBytes_CompileErr: same swap/reset technique but calls ScanBytes
  (not compileAll directly) to verify the error propagates from the
  public API. Exercises patterns.go:201-203.

Coverage for workspace-server/internal/secrets: 81.2% → 100.0%.

Refs: issue #1269 (post-merge coverage gap on PR #1255).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/scripts/ci-required-drift.py

@@ -203,12 +203,17 @@ def ci_jobs_all(ci_doc: dict) -> set[str]:
 
 def ci_job_names(ci_doc: dict) -> set[str]:
     """Set of job keys in ci.yml MINUS the sentinel itself MINUS jobs
-    whose `if:` gates on `github.event_name` (those are event-scoped
-    and can legitimately be `skipped` for a given trigger; if we
-    required them under the sentinel `needs:`, every PR-only job
+    whose `if:` gates on `github.event_name` or `github.ref` (those are
+    event-scoped and can legitimately be `skipped` for a given trigger;
+    if we required them under the sentinel `needs:`, every PR-only job
     would be `skipped` on push and the sentinel would interpret
     `skipped != success` as failure). RFC §4 spec.
 
+    `github.ref` is the companion gate for jobs that run only on direct
+    pushes to specific branches (e.g. `github.ref == 'refs/heads/main'`).
+    These never execute in a PR context, so flagging them as missing
+    from `all-required.needs:` is a false positive (mc#958 / mc#959).
+
     Used for F1 (jobs missing from sentinel needs). NOT used for F1b
     (typos in needs) — see `ci_jobs_all` for that."""
     jobs = ci_doc.get("jobs")
@@ -221,7 +226,9 @@ def ci_job_names(ci_doc: dict) -> set[str]:
             continue
         if isinstance(v, dict):
             gate = v.get("if")
-            if isinstance(gate, str) and "github.event_name" in gate:
+            if isinstance(gate, str) and (
+                "github.event_name" in gate or "github.ref" in gate
+            ):
                 continue
         names.add(k)
     return names

.gitea/scripts/gitea-merge-queue.py

@@ -417,7 +417,21 @@ def main() -> int:
     parser.add_argument("--dry-run", action="store_true")
     args = parser.parse_args()
     _require_runtime_env()
-    return process_once(dry_run=args.dry_run)
+    try:
+        return process_once(dry_run=args.dry_run)
+    except ApiError as exc:
+        # API errors (401/403/404/500) are transient for a queue tick —
+        # log and exit 0 so the workflow is not marked failed and the next
+        # tick can retry. Returning non-zero would permanently fail the
+        # workflow run, blocking future ticks.
+        sys.stderr.write(f"::error::queue API error: {exc}\n")
+        return 0
+    except urllib.error.URLError as exc:
+        sys.stderr.write(f"::error::queue network error: {exc}\n")
+        return 0
+    except TimeoutError as exc:
+        sys.stderr.write(f"::error::queue timeout: {exc}\n")
+        return 0
 
 
 if __name__ == "__main__":

.gitea/scripts/sop-checklist.py

@@ -109,59 +109,58 @@ def normalize_slug(raw: str, numeric_aliases: dict[int, str] | None = None) -> s
 # Optional trailing note after the slug for /sop-ack and required reason
 # for /sop-revoke (RFC#351 open question 4 — reason is captured but not
 # yet validated; future iteration may require a min-length).
+#
+# /sop-n/a <gate> [reason] — declares a gate as not-applicable.
+#   <gate> is a canonical gate name (qa-review, security-review).
+#   The declaring user must be in one of the gate's required_teams.
+#   Most-recent per-user declaration wins (revoke semantics mirror ack).
 _DIRECTIVE_RE = re.compile(
     r"^[ \t]*/(sop-ack|sop-revoke)[ \t]+([A-Za-z0-9_\- ]+?)(?:[ \t]+(.*))?[ \t]*$",
     re.MULTILINE,
 )
+_NA_DIRECTIVE_RE = re.compile(
+    r"^[ \t]*/sop-n/?a[ \t]+([A-Za-z0-9_\-]+)(?:[ \t]+(.*))?[ \t]*$",
+    re.MULTILINE,
+)
 
 
 def parse_directives(
     comment_body: str,
     numeric_aliases: dict[int, str],
-) -> tuple[list[tuple[str, str, str]], list]:
-    """Extract /sop-ack and /sop-revoke directives from a comment body.
+) -> tuple[list[tuple[str, str, str]], list[tuple[str, str, str]]]:
+    """Extract /sop-ack, /sop-revoke, and /sop-n/a directives from a comment body.
 
-    Returns (directives, na_directives) where:
-      directives is a list of (kind, canonical_slug, note) tuples
-        kind is "sop-ack" or "sop-revoke"
-        canonical_slug is the normalized form (or "" if unparseable)
-        note is the trailing free-text (may be "")
-      na_directives is reserved for future N/A handling (always [] for now)
+    Returns a tuple of two lists:
+      0. list of (kind, canonical_slug, note) for sop-ack/sop-revoke
+      1. list of (kind, gate_name, reason) for sop-n/a
+
+    canonical_slug is the normalized form (or "" if unparseable).
+    note/reason is the trailing free-text (may be "").
     """
     out: list[tuple[str, str, str]] = []
+    na_out: list[tuple[str, str, str]] = []
     if not comment_body:
-        return out, []
+        return out, na_out
     for m in _DIRECTIVE_RE.finditer(comment_body):
         kind = m.group(1)
         raw_slug = (m.group(2) or "").strip()
-        # If the raw match included trailing words, the regex non-greedy
-        # captured only the first token; strip again for safety.
-        # We split on whitespace to keep the FIRST word as the slug, and
-        # everything after as the note.
         parts = raw_slug.split()
         if not parts:
             continue
         first = parts[0]
-        # If the slug-capture greedily matched multiple words (e.g.
-        # "comprehensive testing"), preserve normalize behavior: join
-        # the WHOLE first-word-token only; trailing words get appended to
-        # the note. The regex limits group(2) to [A-Za-z0-9_\- ] so we
-        # may have multi-word forms here — normalize handles them.
         if len(parts) > 1:
-            # User wrote "/sop-ack comprehensive testing extra-note"
-            # → treat "comprehensive testing" as the slug source if it
-            # normalizes to a known item; otherwise treat "comprehensive"
-            # as slug and "testing extra-note" as note. We defer the
-            # disambiguation to the caller via the returned canonical
-            # slug. For simplicity: try the WHOLE captured string first.
             canonical = normalize_slug(raw_slug, numeric_aliases)
         else:
             canonical = normalize_slug(first, numeric_aliases)
         note_from_group = (m.group(3) or "").strip()
-        # If we collapsed multi-word slug into kebab and there's a
-        # trailing-text group too, append it.
         out.append((kind, canonical, note_from_group))
-    return out, []
+
+    for m in _NA_DIRECTIVE_RE.finditer(comment_body):
+        gate = (m.group(1) or "").strip().lower()
+        reason = (m.group(2) or "").strip()
+        na_out.append(("sop-n/a", gate, reason))
+
+    return out, na_out
 
 
 # ---------------------------------------------------------------------------
@@ -232,9 +231,8 @@ def compute_ack_state(
        {
          "comprehensive-testing": {
            "ackers": ["bob"],         # non-author, team-verified
-           "rejected_ackers": {        # debugging info
+           "rejected": {
              "self_ack": ["alice"],
-             "unknown_slug": [],
              "not_in_team": ["eve"],
            }
          },
@@ -251,7 +249,7 @@ def compute_ack_state(
         user = (c.get("user") or {}).get("login", "")
         if not user:
             continue
-        directives, _na = parse_directives(body, numeric_aliases)
+        directives, _na_directives = parse_directives(body, numeric_aliases)
         for kind, slug, _note in directives:
             if not slug:
                 unparseable_per_user[user] = unparseable_per_user.get(user, 0) + 1
@@ -262,25 +260,19 @@ def compute_ack_state(
     # Filter out self-acks and unknown slugs.
     ackers_per_slug: dict[str, list[str]] = {s: [] for s in items_by_slug}
     rejected_self: dict[str, list[str]] = {s: [] for s in items_by_slug}
-    rejected_unknown: dict[str, list[str]] = {s: [] for s in items_by_slug}
     pending_team_check: dict[str, list[str]] = {s: [] for s in items_by_slug}
 
     for (user, slug), kind in latest_directive.items():
         if kind != "sop-ack":
             continue  # revokes leave the (user,slug) state as "no ack"
         if slug not in items_by_slug:
-            # Slug normalized to something not in our config — store
-            # under a synthetic key for diagnostic surfacing. Don't add
-            # to any item.
             continue
         if user == pr_author:
             rejected_self[slug].append(user)
             continue
         pending_team_check[slug].append(user)
 
-    # Step 3: team membership probe per slug (batched per slug to keep
-    # API call count down — same user may ack multiple items but the
-    # required_teams differ per item, so we MUST probe per (user, item)).
+    # Step 3: team membership probe per slug.
     rejected_not_in_team: dict[str, list[str]] = {s: [] for s in items_by_slug}
     for slug, candidates in pending_team_check.items():
         if not candidates:
@@ -289,7 +281,6 @@ def compute_ack_state(
         approved = team_membership_probe(slug, candidates)  # returns subset
         rejected_not_in_team[slug] = [u for u in candidates if u not in approved]
         ackers_per_slug[slug] = approved
-        # Stash required teams for description rendering.
         items_by_slug[slug]["_required_resolved"] = required
 
     return {
@@ -304,6 +295,113 @@ def compute_ack_state(
     }
 
 
+def compute_na_state(
+    comments: list[dict[str, Any]],
+    pr_author: str,
+    na_gates: dict[str, dict[str, Any]],
+    numeric_aliases: dict[int, str],
+    team_membership_probe: "callable[[str, list[str]], list[str]]",
+    client: "GiteaClient",
+    org: str,
+) -> dict[str, dict[str, Any]]:
+    """Compute per-gate N/A declaration state.
+
+    Returns a dict keyed by gate name:
+       {
+         "qa-review": {
+           "declared":  ["alice"],      # non-author, team-verified, not revoked
+           "rejected": ["eve (not-in-team)", "bob (self-decl)"],
+           "reason":   "pure-infra change — no qa surface",
+         },
+         ...
+       }
+    A gate is N/A-satisfied when at least one declaration from a valid
+    team member exists and has not been revoked by the same user.
+    """
+    if not na_gates:
+        return {}
+
+    # Collapse directives per (commenter, gate) — most recent wins.
+    latest_na: dict[tuple[str, str], str] = {}   # (user, gate) → "sop-n/a"
+    latest_na_reason: dict[tuple[str, str], str] = {}  # (user, gate) → reason
+    for c in comments:
+        body = c.get("body", "") or ""
+        user = (c.get("user") or {}).get("login", "")
+        if not user:
+            continue
+        _directives, na_directives = parse_directives(body, numeric_aliases)
+        for _kind, gate, reason in na_directives:
+            if gate not in na_gates:
+                continue
+            latest_na[(user, gate)] = "sop-n/a"
+            latest_na_reason[(user, gate)] = reason
+
+    # Determine candidate declarers per gate.
+    na_state: dict[str, dict[str, Any]] = {
+        gate: {"declared": [], "rejected": [], "reason": ""}
+        for gate in na_gates
+    }
+    pending_per_gate: dict[str, list[str]] = {gate: [] for gate in na_gates}
+
+    for (user, gate), kind in latest_na.items():
+        if kind != "sop-n/a":
+            continue
+        if user == pr_author:
+            na_state[gate]["rejected"].append(f"{user} (self-decl)")
+            continue
+        pending_per_gate[gate].append(user)
+
+    # Probe team membership per gate using that gate's required_teams.
+    for gate, candidates in pending_per_gate.items():
+        if not candidates:
+            continue
+        required_teams = na_gates[gate].get("required_teams", [])
+        # Resolve team names → ids using the client's resolver.
+        team_ids: list[int] = []
+        for tn in required_teams:
+            tid = client.resolve_team_id(org, tn)
+            if tid is not None:
+                team_ids.append(tid)
+        if not team_ids:
+            na_state[gate]["rejected"].extend(
+                f"{u} (no-team-id)" for u in candidates
+            )
+            continue
+        for u in candidates:
+            in_any_team = False
+            for tid in team_ids:
+                result = client.is_team_member(tid, u)
+                if result is True:
+                    in_any_team = True
+                    break
+                if result is None:
+                    # 403 — token owner not in team. Fail-closed.
+                    print(
+                        f"::warning::na: team-probe for {u} in team-id {tid} "
+                        "returned 403 — treating as not-in-team (fail-closed)",
+                        file=sys.stderr,
+                    )
+            if in_any_team:
+                na_state[gate]["declared"].append(u)
+            else:
+                na_state[gate]["rejected"].append(f"{u} (not-in-team)")
+
+    # Build per-gate reason string from declared users.
+    for gate in na_gates:
+        decl = na_state[gate]["declared"]
+        if decl:
+            reasons: list[str] = []
+            for u in decl:
+                r = latest_na_reason.get((u, gate), "")
+                if r:
+                    reasons.append(f"{u}: {r}")
+                else:
+                    reasons.append(u)
+            na_state[gate]["reason"] = "; ".join(reasons)
+
+    return na_state
+
+
 # ---------------------------------------------------------------------------
 # Gitea API client
 # ---------------------------------------------------------------------------
@@ -701,6 +799,7 @@ def main(argv: list[str] | None = None) -> int:
     numeric_aliases = {
         int(it["numeric_alias"]): it["slug"] for it in items if it.get("numeric_alias")
     }
+    na_gates: dict[str, dict[str, Any]] = cfg.get("n/a_gates") or {}
 
     client = GiteaClient(args.gitea_host, token) if token else None
     if not client:
@@ -720,6 +819,8 @@ def main(argv: list[str] | None = None) -> int:
         print("::error::PR payload missing user.login or head.sha", file=sys.stderr)
         return 1
 
+    target_url = f"https://{args.gitea_host}/{args.owner}/{args.repo}/pulls/{args.pr}"
+
     comments = client.get_issue_comments(args.owner, args.repo, args.pr)
 
     # Build team-membership probe closure that caches results per
@@ -777,6 +878,47 @@ def main(argv: list[str] | None = None) -> int:
     ack_state = compute_ack_state(comments, author, items_by_slug, numeric_aliases, probe)
     body_state = {it["slug"]: section_marker_present(body, it["pr_section_marker"]) for it in items}
 
+    # --- N/A gate state (RFC#324 §N/A follow-up) ---
+    na_state: dict[str, dict[str, Any]] = {}
+    if na_gates:
+        na_state = compute_na_state(
+            comments, author, na_gates, numeric_aliases,
+            probe, client, args.owner,
+        )
+        # Post N/A declarations status (read by review-check.sh).
+        na_satisfied = [g for g, s in na_state.items() if s["declared"]]
+        na_missing   = [g for g, s in na_state.items() if not s["declared"]]
+        if na_satisfied:
+            na_desc = f"N/A: {', '.join(na_satisfied)}"
+            na_post_state = "success"
+        elif na_missing:
+            na_desc = f"awaiting /sop-n/a declaration for: {', '.join(na_missing)}"
+            na_post_state = "pending"
+        else:
+            # Configured but no declarations yet.
+            na_desc = "no /sop-n/a declarations yet"
+            na_post_state = "pending"
+        na_context = "sop-checklist / na-declarations (pull_request)"
+        print(f"::notice::na-declarations status: {na_post_state} — {na_desc}")
+        if not args.dry_run:
+            client.post_status(
+                args.owner, args.repo, head_sha,
+                state=na_post_state, context=na_context,
+                description=na_desc,
+                target_url=target_url,
+            )
+            print(f"::notice::na-declarations status posted: {na_context} → {na_post_state}")
+        # Log per-gate diagnostics.
+        for gate in na_gates:
+            s = na_state.get(gate, {})
+            if s.get("declared"):
+                print(f"::notice::  [PASS] gate={gate} — N/A declared by {','.join(s['declared'])}"
+                      + (f" ({s['reason']})" if s.get("reason") else ""))
+            else:
+                extra = f" — rejected: {', '.join(s.get('rejected', []))}" if s.get("rejected") else ""
+                print(f"::notice::  [WAIT] gate={gate} — no valid N/A declaration yet{extra}")
+
+
     state, description = render_status(items, ack_state, body_state)
     mode = get_tier_mode(pr, cfg)
     if mode == "soft":
@@ -811,7 +953,6 @@ def main(argv: list[str] | None = None) -> int:
             return 0 if state in ("success", "pending") else 1
         return 0
 
-    target_url = f"https://{args.gitea_host}/{args.owner}/{args.repo}/pulls/{args.pr}"
     client.post_status(
         args.owner, args.repo, head_sha,
         state=state, context=args.status_context,

.gitea/workflows/ci.yml

@@ -133,6 +133,7 @@ jobs:
   # the name match works on PRs that don't touch workspace-server/).
   platform-build:
     name: Platform (Go)
+    needs: changes
     runs-on: ubuntu-latest
     # mc#774 (closed 2026-05-14): Phase 4 flip of the platform-build job.
     # Phase 4 (#656) originally flipped this to continue-on-error: false based on
@@ -153,29 +154,29 @@ jobs:
       run:
         working-directory: workspace-server
     steps:
-      - if: false
+      - if: needs.changes.outputs.platform != 'true'
         working-directory: .
         run: echo "No platform/** changes — skipping real build steps; this job always runs to satisfy the required-check name on branch protection."
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: 'stable'
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         run: go mod download
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         run: go build ./cmd/server
       # CLI (molecli) moved to standalone repo: git.moleculesai.app/molecule-ai/molecule-cli
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         run: go vet ./...
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         name: Install golangci-lint
         run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         name: Run golangci-lint
         run: $(go env GOPATH)/bin/golangci-lint run --timeout 3m ./...
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         name: Diagnostic — per-package verbose 60s
         run: |
           set +e
@@ -191,7 +192,7 @@ jobs:
           echo "::endgroup::"
         # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
         continue-on-error: true
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         name: Run tests with race detection and coverage
         # Explicit timeout: cold runner cache causes OOM kills at ~4m39s on the
         # full ./... suite with race detection + coverage. A 10m per-step timeout
@@ -199,7 +200,7 @@ jobs:
         # instead of OOM-killing. The job-level timeout (15m) is a backstop.
         run: go test -race -timeout 10m -coverprofile=coverage.out ./...
 
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         name: Per-file coverage report
         # Advisory — lists every source file with its coverage so reviewers
         # can see at-a-glance where gaps are. Sorted ascending so the worst
@@ -213,7 +214,7 @@ jobs:
                    END {for (f in s) printf "%6.1f%%  %s\n", s[f]/c[f], f}' \
             | sort -n
 
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
         name: Check coverage thresholds
         # Enforces two gates from #1823 Layer 1:
         #   1. Total floor (25% — ratchet plan in COVERAGE_FLOOR.md).
@@ -301,6 +302,7 @@ jobs:
   # siblings — verified empirically on PR #2314).
   canvas-build:
     name: Canvas (Next.js)
+    needs: changes
     runs-on: ubuntu-latest
     timeout-minutes: 20
     # Phase 4 (RFC #219 §1): confirmed green on main 2026-05-12.
@@ -309,20 +311,20 @@ jobs:
       run:
         working-directory: canvas
     steps:
-      - if: false
+      - if: needs.changes.outputs.canvas != 'true'
         working-directory: .
         run: echo "No canvas/** changes — skipping real build steps; this job always runs to satisfy the required-check name on branch protection."
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '22'
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
         run: rm -f package-lock.json && npm install
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
         run: npm run build
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
         name: Run tests with coverage
         # Coverage instrumentation is configured in canvas/vitest.config.ts
         # (provider: v8, reporters: text + html + json-summary). Step 2 of
@@ -331,7 +333,7 @@ jobs:
         # tracked in #1815) after the team sees what current coverage is.
         run: npx vitest run --coverage
       - name: Upload coverage summary as artifact
-        if: always()
+        if: needs.changes.outputs.canvas == 'true' && always()
         # Pinned to v3 for Gitea act_runner v0.6 compatibility — v4+ uses
         # the GHES 3.10+ artifact protocol that Gitea 1.22.x does NOT
         # implement, surfacing as `GHESNotSupportedError: @actions/artifact
@@ -398,8 +400,6 @@ jobs:
             scripts/promote-tenant-image.sh \
             scripts/test-promote-tenant-image.sh
 
-  # mc#959 root-fix (sre)
-
   canvas-deploy-reminder:
     name: Canvas Deploy Reminder
     runs-on: ubuntu-latest
@@ -408,8 +408,8 @@ jobs:
     # The step-level exit 0 handles the "not main push" case; the job-level
     # `if:` makes the gating explicit so the drift script sees it.
     # continue-on-error removed (was mc#774 mask): step exits 0 when not applicable.
-    if: ${{ github.ref == 'refs/heads/staging' }}
     needs: [changes, canvas-build]
+    if: ${{ github.ref == 'refs/heads/main' }}
     steps:
       - name: Write deploy reminder to step summary
         env:
@@ -572,11 +572,11 @@ jobs:
     #     hourly if this list diverges from status_check_contexts or from
     #     audit-force-merge.yml's REQUIRED_CHECKS env (RFC §4 + §6).
     #
-    # canvas-deploy-reminder is intentionally excluded from all-required.needs:
-    # it needs canvas-build, which is skipped on CI-only PRs (canvas=false).
-    # Including it in all-required.needs causes all-required to hang on
-    # every CI-only PR. Keep it runnable on PRs via its own
-    # `needs: [changes, canvas-build]` — the sentinel only aggregates the result.
+    # canvas-deploy-reminder IS now included in all-required.needs (mc#958 root-fix):
+    # added job-level `if: github.ref == 'refs/heads/main'` so ci-required-drift.py's
+    # ci_job_names() detects it as github.ref-gated and skips it from F1.
+    # The step-level `if: ... || REF_NAME != refs/heads/main` exits 0 when not main,
+    # so the job succeeds (not skipped) on non-main pushes — sentinel treats as green.
     #
     # Phase 3 (RFC #219 §1) safety: underlying build jobs carry
     # continue-on-error: true so their failures are masked to null (2026-05-12: re-enabled mc#774 interim)

_ci_trigger.txt

@@ -0,0 +1 @@
+trigger

canvas/src/components/BroadcastBanner.tsx

@@ -0,0 +1,97 @@
+"use client";
+
+import { useCallback } from "react";
+import { useCanvasStore } from "@/store/canvas";
+
+/** Org-wide broadcast banner.
+ *
+ * Rendered at the top of the canvas (below the toolbar) whenever the store
+ * holds one or more unread BROADCAST_MESSAGE entries. Each entry shows:
+ *   - sender name (workspace that issued the broadcast)
+ *   - the message text
+ *   - a dismiss button
+ *
+ * Dismissing an entry removes it from the store via consumeBroadcastMessages.
+ * The dismissed state is intentionally ephemeral — dismissed broadcasts reappear
+ * on page refresh since they are not persisted server-side; this is intentional
+ * (the platform's activity log already provides the audit trail).
+ */
+export function BroadcastBanner() {
+  const broadcastMessages = useCanvasStore((s) => s.broadcastMessages);
+  const consumeBroadcastMessages = useCanvasStore((s) => s.consumeBroadcastMessages);
+
+  const handleDismiss = useCallback(() => {
+    void consumeBroadcastMessages();
+  }, [consumeBroadcastMessages]);
+
+  if (broadcastMessages.length === 0) return null;
+
+  return (
+    <div className="fixed top-16 left-1/2 -translate-x-1/2 z-30 flex flex-col gap-2 items-center w-full max-w-xl px-4 pointer-events-none">
+      {broadcastMessages.map((msg) => (
+        <div
+          key={msg.id}
+          role="alert"
+          aria-live="polite"
+          aria-atomic="true"
+          className="pointer-events-auto w-full bg-blue-950/80 backdrop-blur-md border border-blue-700/50 rounded-xl px-5 py-3 shadow-2xl shadow-black/40 animate-in slide-in-from-top duration-300"
+        >
+          <div className="flex items-start gap-3">
+            {/* Megaphone icon */}
+            <div
+              aria-hidden="true"
+              className="w-7 h-7 rounded-lg bg-blue-900/50 flex items-center justify-center shrink-0 mt-0.5"
+            >
+              <svg
+                width="14"
+                height="14"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                strokeWidth="2"
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                className="text-blue-300"
+              >
+                <path d="M3 11l18-5v12L3 13v-2z" />
+                <path d="M11.6 16.8a3 3 0 1 1-5.8-1.6" />
+              </svg>
+            </div>
+
+            <div className="flex-1 min-w-0">
+              <div className="text-xs text-blue-300 font-semibold">
+                Broadcast from{" "}
+                <span className="text-blue-100">{msg.sender}</span>
+              </div>
+              <div className="text-sm text-blue-50 mt-0.5 leading-snug break-words">
+                {msg.message}
+              </div>
+            </div>
+
+            {/* Dismiss button */}
+            <button
+              type="button"
+              onClick={handleDismiss}
+              aria-label="Dismiss broadcast"
+              className="shrink-0 w-6 h-6 rounded text-blue-400 hover:text-blue-200 hover:bg-blue-800/50 flex items-center justify-center transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-400 focus-visible:ring-offset-1 focus-visible:ring-offset-blue-950"
+            >
+              <svg
+                width="12"
+                height="12"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                strokeWidth="2.5"
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                aria-hidden="true"
+              >
+                <path d="M18 6 6 18M6 6l12 12" />
+              </svg>
+            </button>
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}

canvas/src/components/Canvas.tsx

@@ -21,6 +21,7 @@ import { CreateWorkspaceButton } from "./CreateWorkspaceDialog";
 import { ContextMenu } from "./ContextMenu";
 import { TemplatePalette } from "./TemplatePalette";
 import { ApprovalBanner } from "./ApprovalBanner";
+import { BroadcastBanner } from "./BroadcastBanner";
 import { BundleDropZone } from "./BundleDropZone";
 import { EmptyState } from "./EmptyState";
 import { OnboardingWizard } from "./OnboardingWizard";
@@ -367,6 +368,7 @@ function CanvasInner() {
         <OnboardingWizard />
         <Toolbar />
         <ApprovalBanner />
+        <BroadcastBanner />
         <BundleDropZone />
         <TemplatePalette />
         <SidePanel />

canvas/src/components/__tests__/Canvas.a11y.test.tsx

@@ -73,6 +73,8 @@ const mockStoreState = {
   clearSelection: vi.fn(),
   toggleNodeSelection: vi.fn(),
   deletingIds: new Set<string>(),
+  broadcastMessages: [],
+  consumeBroadcastMessages: vi.fn(() => []),
 };
 
 vi.mock("@/store/canvas", () => ({
@@ -100,6 +102,7 @@ vi.mock("../ConfirmDialog", () => ({ ConfirmDialog: () => null }));
 vi.mock("../TemplatePalette", () => ({ TemplatePalette: () => null }));
 vi.mock("../OnboardingWizard", () => ({ OnboardingWizard: () => null }));
 vi.mock("../ApprovalBanner", () => ({ ApprovalBanner: () => null }));
+vi.mock("../BroadcastBanner", () => ({ BroadcastBanner: () => null }));
 vi.mock("../BundleDropZone", () => ({ BundleDropZone: () => null }));
 vi.mock("../CreateWorkspaceDialog", () => ({ CreateWorkspaceButton: () => null }));
 vi.mock("../settings", () => ({

canvas/src/components/__tests__/Canvas.pan-to-node.test.tsx

@@ -91,6 +91,8 @@ const mockStoreState = {
   // an empty Set mirrors the idle canvas and doesn't interact with
   // any pan/fit behaviour under test here.
   deletingIds: new Set<string>(),
+  broadcastMessages: [],
+  consumeBroadcastMessages: vi.fn(() => []),
 };
 
 vi.mock("@/store/canvas", () => ({
@@ -117,6 +119,7 @@ vi.mock("../ConfirmDialog", () => ({ ConfirmDialog: () => null }));
 vi.mock("../TemplatePalette", () => ({ TemplatePalette: () => null }));
 vi.mock("../OnboardingWizard", () => ({ OnboardingWizard: () => null }));
 vi.mock("../ApprovalBanner", () => ({ ApprovalBanner: () => null }));
+vi.mock("../BroadcastBanner", () => ({ BroadcastBanner: () => null }));
 vi.mock("../BundleDropZone", () => ({ BundleDropZone: () => null }));
 vi.mock("../CreateWorkspaceDialog", () => ({ CreateWorkspaceButton: () => null }));
 vi.mock("../settings", () => ({

canvas/src/lib/__tests__/palette-context.test.tsx

@@ -1,205 +0,0 @@
-// @vitest-environment jsdom
-"use client";
-/**
- * Tests for palette-context.tsx — MobileAccentProvider context + usePalette hook.
- *
- * Test coverage (9 cases):
- * 1. MobileAccentProvider renders children
- * 2. usePalette(false) without provider → MOL_LIGHT
- * 3. usePalette(true) without provider → MOL_DARK
- * 4. accent=null returns base palette unchanged
- * 5. accent=base.accent returns base palette unchanged (identity guard)
- * 6. accent="#custom" overrides both accent and online
- * 7. MOL_LIGHT singleton never mutated
- * 8. MOL_DARK singleton never mutated
- *
- * Plus pure-function coverage for normalizeStatus + tierCode.
- */
-import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
-import React from "react";
-import { render, screen, cleanup } from "@testing-library/react";
-import {
-  MOL_LIGHT,
-  MOL_DARK,
-  getPalette,
-  normalizeStatus,
-  tierCode,
-  MobileAccentProvider,
-  usePalette,
-} from "../palette-context";
-
-// ─── usePalette test helper ───────────────────────────────────────────────────
-// usePalette reads document.documentElement.dataset.theme internally.
-// We set this before rendering so the hook sees the right value.
-
-function setDataTheme(theme: "light" | "dark") {
-  if (typeof document !== "undefined") {
-    document.documentElement.dataset.theme = theme;
-  }
-}
-
-// ─── Pure function tests ──────────────────────────────────────────────────────
-
-describe("normalizeStatus", () => {
-  it("returns emerald-400 for online status", () => {
-    expect(normalizeStatus("online", false)).toBe("bg-emerald-400");
-    expect(normalizeStatus("online", true)).toBe("bg-emerald-400");
-  });
-
-  it("returns emerald-400 for degraded status", () => {
-    expect(normalizeStatus("degraded", false)).toBe("bg-emerald-400");
-    expect(normalizeStatus("degraded", true)).toBe("bg-emerald-400");
-  });
-
-  it("returns red-400 for failed status", () => {
-    expect(normalizeStatus("failed", false)).toBe("bg-red-400");
-    expect(normalizeStatus("failed", true)).toBe("bg-red-400");
-  });
-
-  it("returns amber-400 for paused status", () => {
-    expect(normalizeStatus("paused", false)).toBe("bg-amber-400");
-    expect(normalizeStatus("paused", true)).toBe("bg-amber-400");
-  });
-
-  it("returns amber-400 for not_configured status", () => {
-    expect(normalizeStatus("not_configured", false)).toBe("bg-amber-400");
-  });
-
-  it("returns zinc-400 for unknown status", () => {
-    expect(normalizeStatus("unknown", false)).toBe("bg-zinc-400");
-    expect(normalizeStatus("", false)).toBe("bg-zinc-400");
-  });
-});
-
-describe("tierCode", () => {
-  it("returns T1 for tier 1", () => {
-    expect(tierCode(1)).toBe("T1");
-  });
-
-  it("returns T2 for tier 2", () => {
-    expect(tierCode(2)).toBe("T2");
-  });
-
-  it("returns T4 for tier 4", () => {
-    expect(tierCode(4)).toBe("T4");
-  });
-
-  it("returns generic T{n} for non-standard tiers", () => {
-    expect(tierCode(99)).toBe("T99");
-  });
-});
-
-// ─── getPalette tests ─────────────────────────────────────────────────────────
-
-describe("getPalette — accent override", () => {
-  it("accent=null returns base palette unchanged (light)", () => {
-    const result = getPalette(null, false);
-    expect(result).toEqual({ ...MOL_LIGHT });
-    expect(result).not.toBe(MOL_LIGHT); // returned object is a copy
-  });
-
-  it("accent=null returns base palette unchanged (dark)", () => {
-    const result = getPalette(null, true);
-    expect(result).toEqual({ ...MOL_DARK });
-    expect(result).not.toBe(MOL_DARK);
-  });
-
-  it("accent=base.accent returns base palette unchanged (identity guard, light)", () => {
-    const result = getPalette(MOL_LIGHT.accent, false);
-    expect(result).toEqual({ ...MOL_LIGHT });
-    expect(result).not.toBe(MOL_LIGHT);
-  });
-
-  it("accent=base.accent returns base palette unchanged (identity guard, dark)", () => {
-    const result = getPalette(MOL_DARK.accent, true);
-    expect(result).toEqual({ ...MOL_DARK });
-    expect(result).not.toBe(MOL_DARK);
-  });
-
-  it("accent='#custom' overrides accent and online (light)", () => {
-    const result = getPalette("#ff0000", false);
-    expect(result.accent).toBe("#ff0000");
-    expect(result.online).toBe("bg-emerald-400"); // normalizeStatus("online", false)
-  });
-
-  it("accent='#custom' overrides accent and online (dark)", () => {
-    const result = getPalette("#00ff00", true);
-    expect(result.accent).toBe("#00ff00");
-    expect(result.online).toBe("bg-emerald-400"); // normalizeStatus("online", true)
-  });
-
-  it("MOL_LIGHT singleton is never mutated", () => {
-    getPalette("#mutate", false);
-    // All fields must still match the original freeze definition
-    expect(MOL_LIGHT.accent).toBe("bg-blue-500");
-    expect(MOL_LIGHT.online).toBe("bg-emerald-400");
-    expect(MOL_LIGHT.surface).toBe("bg-zinc-900");
-    expect(MOL_LIGHT.ink).toBe("text-zinc-100");
-    expect(MOL_LIGHT.line).toBe("border-zinc-700");
-    expect(MOL_LIGHT.bg).toBe("bg-zinc-950");
-  });
-
-  it("MOL_DARK singleton is never mutated", () => {
-    getPalette("#mutate", true);
-    expect(MOL_DARK.accent).toBe("bg-sky-400");
-    expect(MOL_DARK.online).toBe("bg-emerald-400");
-    expect(MOL_DARK.surface).toBe("bg-zinc-800");
-    expect(MOL_DARK.ink).toBe("text-zinc-100");
-    expect(MOL_DARK.line).toBe("border-zinc-700");
-    expect(MOL_DARK.bg).toBe("bg-zinc-950");
-  });
-
-  it("getPalette always returns a new object (no shared mutation risk)", () => {
-    const a = getPalette("#a", false);
-    const b = getPalette("#b", false);
-    expect(a).not.toBe(b);
-    expect(a.accent).not.toBe(b.accent);
-  });
-});
-
-// ─── MobileAccentProvider tests ───────────────────────────────────────────────
-
-describe("MobileAccentProvider", () => {
-  beforeEach(() => {
-    setDataTheme("light");
-  });
-
-  afterEach(() => {
-    cleanup();
-    if (typeof document !== "undefined") {
-      document.documentElement.dataset.theme = "";
-    }
-  });
-
-  it("renders children", () => {
-    render(
-      <MobileAccentProvider accent={null}>
-        <span data-testid="child">Hello</span>
-      </MobileAccentProvider>,
-    );
-    expect(screen.getByTestId("child")).toBeTruthy();
-  });
-
-  // usePalette hook reads data-theme from <html> to determine light/dark.
-  // In the test environment, data-theme is empty, which falls through to
-  // the "light" default in usePalette, giving MOL_LIGHT.
-  it("usePalette(false) without provider → MOL_LIGHT", () => {
-    setDataTheme("light");
-    function ShowPalette() {
-      const p = usePalette(false);
-      return <span data-testid="accent-light">{p.accent}</span>;
-    }
-    render(<ShowPalette />);
-    expect(screen.getByTestId("accent-light").textContent).toBe(MOL_LIGHT.accent);
-  });
-
-  it("usePalette(true) without provider → MOL_DARK when data-theme=dark", () => {
-    setDataTheme("dark");
-    function ShowPalette() {
-      const p = usePalette(true);
-      return <span data-testid="accent-dark">{p.accent}</span>;
-    }
-    render(<ShowPalette />);
-    expect(screen.getByTestId("accent-dark").textContent).toBe(MOL_DARK.accent);
-  });
-});

canvas/src/lib/palette-context.tsx

@@ -1,167 +0,0 @@
-"use client";
-
-/**
- * palette-context.tsx
- *
- * Mobile canvas accent palette system.
- *
- * - MOL_LIGHT / MOL_DARK  — immutable base singletons
- * - getPalette(accent, isDark) — returns base palette or accent-overridden copy
- * - normalizeStatus(status, isDark) — maps workspace status → online dot color
- * - tierCode(tier) — maps tier number → display label
- * - MobileAccentProvider — React context that propagates accent override
- * - usePalette(allowAccentOverride) — hook; returns the effective palette
- */
-
-import { createContext, useContext } from "react";
-
-// ─── Types ─────────────────────────────────────────────────────────────────────
-
-export interface Palette {
-  /** Accent colour (CSS colour string). */
-  accent: string;
-  /** Online indicator colour (CSS class string, e.g. "bg-emerald-400"). */
-  online: string;
-  /** Surface background colour class. */
-  surface: string;
-  /** Primary text colour class. */
-  ink: string;
-  /** Border/divider colour class. */
-  line: string;
-  /** Background colour class. */
-  bg: string;
-  /** Tier display code, e.g. "T1". */
-  tier: string;
-}
-
-// ─── Singleton base palettes ────────────────────────────────────────────────────
-
-/** Light-mode base palette — must never be mutated. */
-export const MOL_LIGHT: Readonly<Palette> = Object.freeze({
-  accent: "bg-blue-500",
-  online: "bg-emerald-400",
-  surface: "bg-zinc-900",
-  ink: "text-zinc-100",
-  line: "border-zinc-700",
-  bg: "bg-zinc-950",
-  tier: "T1",
-});
-
-/** Dark-mode base palette — must never be mutated. */
-export const MOL_DARK: Readonly<Palette> = Object.freeze({
-  accent: "bg-sky-400",
-  online: "bg-emerald-400",
-  surface: "bg-zinc-800",
-  ink: "text-zinc-100",
-  line: "border-zinc-700",
-  bg: "bg-zinc-950",
-  tier: "T1",
-});
-
-// ─── Pure helpers ─────────────────────────────────────────────────────────────
-
-/**
- * Maps workspace status string → online dot colour class.
- * Returns the appropriate green for light/dark mode.
- */
-export function normalizeStatus(
-  status: string,
-  _isDark: boolean,
-): string {
-  if (status === "online" || status === "degraded") {
-    return "bg-emerald-400";
-  }
-  if (status === "failed") {
-    return "bg-red-400";
-  }
-  if (status === "paused" || status === "not_configured") {
-    return "bg-amber-400";
-  }
-  return "bg-zinc-400";
-}
-
-/**
- * Maps tier number → display code.
- */
-export function tierCode(tier: number): string {
-  return `T${tier}`;
-}
-
-/**
- * Returns the effective palette.
- *
- * - `accent = null` → base palette (light or dark) unchanged
- * - `accent = basePalette.accent` → base palette unchanged (identity guard)
- * - `accent = "#custom"` → copy with `accent` and `online` overridden
- *
- * Always returns a new object; neither MOL_LIGHT nor MOL_DARK is ever mutated.
- */
-export function getPalette(
-  accent: string | null,
-  isDark: boolean,
-): Palette {
-  const base: Readonly<Palette> = isDark ? MOL_DARK : MOL_LIGHT;
-
-  // null accent → use base unchanged
-  if (accent === null) return { ...base };
-
-  // identity guard — accent same as base accent → no override needed
-  if (accent === base.accent) return { ...base };
-
-  // Custom accent: override accent + online to keep them in sync
-  return { ...base, accent, online: normalizeStatus("online", isDark) };
-}
-
-// ─── Context ──────────────────────────────────────────────────────────────────
-
-type MobileAccentContextValue = {
-  /** Override accent colour (null = no override, use default). */
-  accent: string | null;
-};
-
-const MobileAccentContext = createContext<MobileAccentContextValue>({
-  accent: null,
-});
-
-export { MobileAccentContext };
-
-/**
- * Renders children inside the accent override context.
- */
-export function MobileAccentProvider({
-  accent,
-  children,
-}: {
-  accent: string | null;
-  children: React.ReactNode;
-}) {
-  return (
-    <MobileAccentContext.Provider value={{ accent }}>
-      {children}
-    </MobileAccentContext.Provider>
-  );
-}
-
-// ─── Hook ─────────────────────────────────────────────────────────────────────
-
-/**
- * Returns the effective `Palette` for the current context.
- *
- * @param allowAccentOverride  When false, always returns the base palette
- *                              even when an override is set (useful for
- *                              non-accent-aware child components).
- */
-export function usePalette(allowAccentOverride: boolean): Palette {
-  const { accent } = useContext(MobileAccentContext);
-
-  // Resolved from the OS-level theme preference. In a real app this would
-  // be derived from useTheme().resolvedTheme; for this hook we default
-  // to light (the safe default for SSR / component-library use).
-  // We read data-theme from <html> to stay in sync with the theme system.
-  const isDark =
-    typeof document !== "undefined" &&
-    document.documentElement.dataset.theme === "dark";
-
-  const effectiveAccent = allowAccentOverride ? accent : null;
-  return getPalette(effectiveAccent, isDark);
-}

canvas/src/store/__tests__/canvas-events.test.ts

@@ -53,9 +53,10 @@ function makeStore(
   edges: Edge[] = [],
   selectedNodeId: string | null = null,
   agentMessages: Record<string, Array<{ id: string; content: string; timestamp: string }>> = {},
-  liveAnnouncement = ""
+  liveAnnouncement = "",
+  broadcastMessages: Array<{ id: string; sender: string; senderId: string; message: string; timestamp: string }> = []
 ) {
-  const state = { nodes, edges, selectedNodeId, agentMessages, liveAnnouncement };
+  const state = { nodes, edges, selectedNodeId, agentMessages, liveAnnouncement, broadcastMessages };
   const get = () => state;
   const set = vi.fn((partial: Record<string, unknown>) => {
     Object.assign(state, partial);
@@ -1013,3 +1014,149 @@ describe("handleCanvasEvent – liveAnnouncement", () => {
     expect(state.liveAnnouncement ?? "").toBe("");
   });
 });
+
+// ---------------------------------------------------------------------------
+// BROADCAST_MESSAGE
+//
+// Verifies that incoming org-wide broadcast WebSocket events are captured
+// in the store's broadcastMessages array and announced via liveAnnouncement
+// for screen readers. The Go platform already HTML-escaped the content at
+// broadcast time (OFFSEC-015 fix), so the handler renders it as-is.
+// ---------------------------------------------------------------------------
+
+describe("handleCanvasEvent – BROADCAST_MESSAGE", () => {
+  it("appends a broadcast message to broadcastMessages with correct fields", () => {
+    const { get, set, state } = makeStore();
+
+    handleCanvasEvent(
+      makeMsg({
+        event: "BROADCAST_MESSAGE",
+        workspace_id: "ws-sender",
+        payload: {
+          sender_id: "ws-ops",
+          sender: "Ops Agent",
+          message: "All systems go — deploy in 5 minutes",
+        },
+      }),
+      get,
+      set
+    );
+
+    expect(set).toHaveBeenCalledOnce();
+    const next = set.mock.calls[0][0] as { broadcastMessages: typeof state.broadcastMessages };
+    expect(next.broadcastMessages).toHaveLength(1);
+    expect(next.broadcastMessages[0].senderId).toBe("ws-ops");
+    expect(next.broadcastMessages[0].sender).toBe("Ops Agent");
+    expect(next.broadcastMessages[0].message).toBe("All systems go — deploy in 5 minutes");
+    expect(next.broadcastMessages[0].id).toBeTruthy(); // crypto.randomUUID() called
+    expect(next.broadcastMessages[0].timestamp).toBeTruthy();
+  });
+
+  it("sets liveAnnouncement with sender and truncated message", () => {
+    const { get, set } = makeStore();
+
+    handleCanvasEvent(
+      makeMsg({
+        event: "BROADCAST_MESSAGE",
+        workspace_id: "ws-sender",
+        payload: {
+          sender_id: "ws-ops",
+          sender: "Ops Agent",
+          message: "Deploy starting now",
+        },
+      }),
+      get,
+      set
+    );
+
+    const next = set.mock.calls[0][0] as { liveAnnouncement: string };
+    expect(next.liveAnnouncement).toBe("Broadcast from Ops Agent: Deploy starting now");
+  });
+
+  it("renders sender name as truncated ID when sender field is absent", () => {
+    const { get, set, state } = makeStore();
+
+    handleCanvasEvent(
+      makeMsg({
+        event: "BROADCAST_MESSAGE",
+        workspace_id: "ws-sender",
+        payload: {
+          sender_id: "ws-ops",
+          message: "Deploy starting now",
+        },
+      }),
+      get,
+      set
+    );
+
+    const next = set.mock.calls[0][0] as { broadcastMessages: typeof state.broadcastMessages };
+    expect(next.broadcastMessages[0].sender).toBe("ws-ops".slice(0, 8)); // fallback: first 8 chars of ID
+  });
+
+  it("is a no-op when message is empty string", () => {
+    const { get, set } = makeStore();
+
+    handleCanvasEvent(
+      makeMsg({
+        event: "BROADCAST_MESSAGE",
+        workspace_id: "ws-sender",
+        payload: { sender_id: "ws-ops", sender: "Ops Agent", message: "" },
+      }),
+      get,
+      set
+    );
+
+    expect(set).not.toHaveBeenCalled();
+  });
+
+  it("appends to existing broadcastMessages without replacing them", () => {
+    const { get, set, state } = makeStore([], [], null, {}, "", [
+      {
+        id: "existing-1",
+        senderId: "ws-old",
+        sender: "Old Agent",
+        message: "Previous broadcast",
+        timestamp: "2026-05-14T12:00:00Z",
+      },
+    ]);
+
+    handleCanvasEvent(
+      makeMsg({
+        event: "BROADCAST_MESSAGE",
+        workspace_id: "ws-sender",
+        payload: { sender_id: "ws-ops", sender: "Ops Agent", message: "New broadcast" },
+      }),
+      get,
+      set
+    );
+
+    const next = set.mock.calls[0][0] as { broadcastMessages: typeof state.broadcastMessages };
+    expect(next.broadcastMessages).toHaveLength(2);
+    expect(next.broadcastMessages[0].id).toBe("existing-1");
+    expect(next.broadcastMessages[1].message).toBe("New broadcast");
+  });
+
+  it("handles XSS-like content safely (content is pre-escaped by Go platform)", () => {
+    const { get, set, state } = makeStore();
+
+    // The Go platform applied html.EscapeString before sending, so the handler
+    // receives literal strings, not raw HTML. This test verifies no panic and
+    // correct storage.
+    handleCanvasEvent(
+      makeMsg({
+        event: "BROADCAST_MESSAGE",
+        workspace_id: "ws-evil",
+        payload: {
+          sender_id: "ws-evil",
+          sender: "Evil Sender",
+          message: "&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;",
+        },
+      }),
+      get,
+      set
+    );
+
+    const next = set.mock.calls[0][0] as { broadcastMessages: typeof state.broadcastMessages };
+    expect(next.broadcastMessages[0].message).toBe("&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;");
+  });
+});

canvas/src/store/canvas-events.ts

@@ -72,6 +72,7 @@ export function handleCanvasEvent(
     edges: Edge[];
     selectedNodeId: string | null;
     agentMessages: Record<string, Array<{ id: string; content: string; timestamp: string; attachments?: Array<{ name: string; uri: string; mimeType?: string; size?: number }> }>>;
+    broadcastMessages: Array<{ id: string; sender: string; senderId: string; message: string; timestamp: string }>;
   },
   set: (partial: Record<string, unknown>) => void,
 ): void {
@@ -515,6 +516,34 @@ export function handleCanvasEvent(
       break;
     }
 
+    case "BROADCAST_MESSAGE": {
+      // An agent workspace sent an org-wide broadcast. Display it as a
+      // dismissible banner so the user is always aware of org-wide signals
+      // even when no workspace is selected. The Go platform already HTML-
+      // escaped the content at broadcast time (OFFSEC-015 fix), so it is
+      // safe to render as innerText equivalent via dangerouslySetInnerHTML
+      // is not needed — just render the string as-is.
+      const senderId = (msg.payload.sender_id as string) ?? "";
+      const sender = (msg.payload.sender as string) ?? senderId.slice(0, 8);
+      const message = (msg.payload.message as string) ?? "";
+      if (!message) break;
+      const { broadcastMessages } = get();
+      set({
+        broadcastMessages: [
+          ...broadcastMessages,
+          {
+            id: crypto.randomUUID(),
+            senderId,
+            sender,
+            message,
+            timestamp: new Date().toISOString(),
+          },
+        ],
+        liveAnnouncement: `Broadcast from ${sender}: ${message}`,
+      });
+      break;
+    }
+
     default:
       break;
   }

canvas/src/store/canvas.ts

@@ -244,6 +244,12 @@ interface CanvasState {
    *  so the same announcement doesn't re-fire on re-render. */
   liveAnnouncement: string;
   setLiveAnnouncement: (msg: string) => void;
+  /** Incoming org-wide broadcast messages received via BROADCAST_MESSAGE
+   *  WebSocket events. Consumed by the BroadcastBanner component; each
+   *  entry is cleared after the user dismisses it so dismissed broadcasts
+   *  don't reappear on reconnect. */
+  broadcastMessages: Array<{ id: string; sender: string; senderId: string; message: string; timestamp: string }>;
+  consumeBroadcastMessages: () => Array<{ id: string; sender: string; senderId: string; message: string; timestamp: string }>;
 }
 
 export const useCanvasStore = create<CanvasState>((set, get) => ({
@@ -342,6 +348,12 @@ export const useCanvasStore = create<CanvasState>((set, get) => ({
   },
   liveAnnouncement: "",
   setLiveAnnouncement: (msg) => set({ liveAnnouncement: msg }),
+  broadcastMessages: [],
+  consumeBroadcastMessages: () => {
+    const msgs = get().broadcastMessages;
+    set({ broadcastMessages: [] });
+    return msgs;
+  },
 
   viewport: { x: 0, y: 0, zoom: 1 },
 

tests/e2e/test_workspace_abilities_e2e.sh

@@ -1,296 +0,0 @@
-#!/usr/bin/env bash
-# E2E test: workspace broadcast and talk-to-user platform abilities.
-#
-# What this proves:
-#   1. talk_to_user_enabled (default true) — POST /notify works out-of-the-box.
-#   2. PATCH /workspaces/:id/abilities { talk_to_user_enabled: false } disables
-#      delivery: /notify → 403 with error="talk_to_user_disabled" + delegate hint.
-#   3. Re-enabling talk_to_user_enabled restores delivery.
-#   4. broadcast_enabled (default false) — POST /broadcast → 403 when disabled.
-#   5. PATCH { broadcast_enabled: true } enables fan-out.
-#   6. POST /broadcast delivers to all non-sender, non-removed workspaces:
-#      - Returns {"status":"sent","delivered":N}
-#      - Receiver's activity log has a broadcast_receive entry with the message.
-#      - Sender's activity log has a broadcast_sent entry.
-#   7. The sender itself does NOT receive a broadcast_receive entry.
-#
-# Usage:  tests/e2e/test_workspace_abilities_e2e.sh
-# Prereqs: workspace-server on http://localhost:8080, MOLECULE_ENV != production
-
-set -euo pipefail
-
-source "$(dirname "$0")/_lib.sh"
-
-PASS=0
-FAIL=0
-SENDER_ID=""
-RECEIVER_ID=""
-
-cleanup() {
-  for wid in "$SENDER_ID" "$RECEIVER_ID"; do
-    if [ -n "$wid" ]; then
-      curl -s -X DELETE "$BASE/workspaces/$wid?confirm=true" > /dev/null || true
-    fi
-  done
-}
-trap cleanup EXIT INT TERM
-
-assert() {
-  local label="$1" actual="$2" expected="$3"
-  if [ "$actual" = "$expected" ]; then
-    echo "  PASS — $label"
-    PASS=$((PASS+1))
-  else
-    echo "  FAIL — $label"
-    echo "         expected: $expected"
-    echo "         actual:   $actual"
-    FAIL=$((FAIL+1))
-  fi
-}
-
-assert_contains() {
-  local label="$1" haystack="$2" needle="$3"
-  if echo "$haystack" | grep -qF "$needle"; then
-    echo "  PASS — $label"
-    PASS=$((PASS+1))
-  else
-    echo "  FAIL — $label"
-    echo "         needle:   $needle"
-    echo "         haystack: $haystack"
-    FAIL=$((FAIL+1))
-  fi
-}
-
-assert_not_contains() {
-  local label="$1" haystack="$2" needle="$3"
-  if ! echo "$haystack" | grep -qF "$needle"; then
-    echo "  PASS — $label"
-    PASS=$((PASS+1))
-  else
-    echo "  FAIL — $label (unexpected match)"
-    echo "         needle:   $needle"
-    echo "         haystack: $haystack"
-    FAIL=$((FAIL+1))
-  fi
-}
-
-# ── Pre-sweep: remove any stale leftover workspaces from a prior aborted run ──
-echo "=== Setup ==="
-for NAME in "Abilities Sender" "Abilities Receiver"; do
-  PRIOR=$(curl -s "$BASE/workspaces" | python3 -c "
-import json, sys
-try:
-    print(' '.join(w['id'] for w in json.load(sys.stdin) if w.get('name') == '$NAME'))
-except Exception:
-    pass
-")
-  for _wid in $PRIOR; do
-    echo "Sweeping leftover '$NAME' workspace: $_wid"
-    curl -s -X DELETE "$BASE/workspaces/$_wid?confirm=true" > /dev/null || true
-  done
-done
-
-R=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-  -d '{"name":"Abilities Sender","tier":1}')
-SENDER_ID=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])' 2>/dev/null || true)
-[ -n "$SENDER_ID" ] || { echo "Failed to create sender workspace: $R"; exit 1; }
-echo "Created sender   workspace: $SENDER_ID"
-
-R=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-  -d '{"name":"Abilities Receiver","tier":1}')
-RECEIVER_ID=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])' 2>/dev/null || true)
-[ -n "$RECEIVER_ID" ] || { echo "Failed to create receiver workspace: $R"; exit 1; }
-echo "Created receiver workspace: $RECEIVER_ID"
-
-# Mint workspace-scoped bearer tokens (test-only endpoint, disabled in prod).
-SENDER_TOKEN=$(e2e_mint_test_token "$SENDER_ID")
-[ -n "$SENDER_TOKEN" ] || { echo "Failed to mint sender token"; exit 1; }
-SENDER_AUTH="Authorization: Bearer $SENDER_TOKEN"
-
-# Admin token — any live workspace bearer satisfies AdminAuth in local dev.
-# In production-like envs, set MOLECULE_ADMIN_TOKEN.
-ADMIN_TOKEN="${MOLECULE_ADMIN_TOKEN:-$SENDER_TOKEN}"
-ADMIN_AUTH="Authorization: Bearer $ADMIN_TOKEN"
-
-# ─────────────────────────────────────────────────────────────────────────────
-echo ""
-echo "=== Part 1: talk_to_user ability ==="
-
-echo ""
-echo "--- 1a: /notify works with default talk_to_user_enabled=true ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/notify" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Hello from sender"}')
-assert "POST /notify returns 200 when talk_to_user_enabled=true (default)" "$CODE" "200"
-
-echo ""
-echo "--- 1b: Disable talk_to_user ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"talk_to_user_enabled": false}')
-assert "PATCH /abilities talk_to_user_enabled=false returns 200" "$CODE" "200"
-
-# Verify the flag is reflected in the workspace GET response.
-WS=$(curl -s "$BASE/workspaces/$SENDER_ID" -H "$SENDER_AUTH")
-FLAG=$(echo "$WS" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("talk_to_user_enabled","MISSING"))')
-assert "GET /workspaces/:id reflects talk_to_user_enabled=false" "$FLAG" "False"
-
-echo ""
-echo "--- 1c: /notify blocked when talk_to_user disabled ---"
-BODY=$(curl -s -w "" -X POST "$BASE/workspaces/$SENDER_ID/notify" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Should be blocked"}')
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/notify" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Should be blocked"}')
-assert "POST /notify returns 403 when talk_to_user_enabled=false" "$CODE" "403"
-
-ERR=$(echo "$BODY" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("error",""))' 2>/dev/null || echo "")
-assert_contains "403 body contains talk_to_user_disabled error code" "$ERR" "talk_to_user_disabled"
-
-HINT=$(echo "$BODY" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("hint",""))' 2>/dev/null || echo "")
-assert_contains "403 body contains delegate_task hint" "$HINT" "delegate_task"
-
-echo ""
-echo "--- 1d: Re-enable talk_to_user and verify /notify works again ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"talk_to_user_enabled": true}')
-assert "PATCH /abilities talk_to_user_enabled=true returns 200" "$CODE" "200"
-
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/notify" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Re-enabled, should work"}')
-assert "POST /notify returns 200 after re-enabling talk_to_user" "$CODE" "200"
-
-# ─────────────────────────────────────────────────────────────────────────────
-echo ""
-echo "=== Part 2: broadcast ability ==="
-
-echo ""
-echo "--- 2a: Broadcast blocked by default (broadcast_enabled=false) ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/broadcast" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Should be blocked"}')
-assert "POST /broadcast returns 403 when broadcast_enabled=false (default)" "$CODE" "403"
-
-echo ""
-echo "--- 2b: Enable broadcast ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"broadcast_enabled": true}')
-assert "PATCH /abilities broadcast_enabled=true returns 200" "$CODE" "200"
-
-WS=$(curl -s "$BASE/workspaces/$SENDER_ID" -H "$SENDER_AUTH")
-FLAG=$(echo "$WS" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("broadcast_enabled","MISSING"))')
-assert "GET /workspaces/:id reflects broadcast_enabled=true" "$FLAG" "True"
-
-echo ""
-echo "--- 2c: Successful broadcast fan-out ---"
-BCAST=$(curl -s -X POST "$BASE/workspaces/$SENDER_ID/broadcast" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Org-wide notice: scheduled maintenance in 5 minutes."}')
-BSTATUS=$(echo "$BCAST" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("status",""))' 2>/dev/null || echo "")
-BDELIVERED=$(echo "$BCAST" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("delivered","-1"))' 2>/dev/null || echo "-1")
-assert "POST /broadcast returns status=sent" "$BSTATUS" "sent"
-
-# delivered count must be >= 1 (the receiver workspace).
-echo "  INFO — broadcast delivered=$BDELIVERED"
-if python3 -c "import sys; sys.exit(0 if int('$BDELIVERED') >= 1 else 1)" 2>/dev/null; then
-  echo "  PASS — delivered count >= 1"
-  PASS=$((PASS+1))
-else
-  echo "  FAIL — expected delivered >= 1, got $BDELIVERED"
-  FAIL=$((FAIL+1))
-fi
-
-echo ""
-echo "--- 2d: Receiver activity log has broadcast_receive entry ---"
-RECEIVER_TOKEN=$(e2e_mint_test_token "$RECEIVER_ID")
-[ -n "$RECEIVER_TOKEN" ] || { echo "Failed to mint receiver token"; exit 1; }
-RECEIVER_AUTH="Authorization: Bearer $RECEIVER_TOKEN"
-
-ACT=$(curl -s -H "$RECEIVER_AUTH" "$BASE/workspaces/$RECEIVER_ID/activity?source=agent&limit=20")
-ROW=$(echo "$ACT" | python3 -c '
-import json, sys
-rows = json.load(sys.stdin) or []
-for r in rows:
-    if r.get("activity_type") == "broadcast_receive":
-        print(json.dumps(r))
-        break
-')
-[ -n "$ROW" ] || {
-  echo "  FAIL — could not find broadcast_receive row in receiver activity"
-  FAIL=$((FAIL+1))
-}
-
-if [ -n "$ROW" ]; then
-  # Message is stored in summary field.
-  MSG=$(echo "$ROW" | python3 -c 'import json,sys;r=json.load(sys.stdin);print(r.get("summary",""))')
-  assert_contains "broadcast_receive row summary has original message" "$MSG" "scheduled maintenance"
-  # Sender ID is stored in source_id field.
-  SRC=$(echo "$ROW" | python3 -c 'import json,sys;r=json.load(sys.stdin);print(r.get("source_id",""))')
-  assert "broadcast_receive row source_id is sender workspace" "$SRC" "$SENDER_ID"
-fi
-
-echo ""
-echo "--- 2e: Sender activity log has broadcast_sent entry ---"
-ACT_SENDER=$(curl -s -H "$SENDER_AUTH" "$BASE/workspaces/$SENDER_ID/activity?limit=20")
-SENT_ROW=$(echo "$ACT_SENDER" | python3 -c '
-import json, sys
-rows = json.load(sys.stdin) or []
-for r in rows:
-    if r.get("activity_type") == "broadcast_sent":
-        print(json.dumps(r))
-        break
-')
-[ -n "$SENT_ROW" ] || {
-  echo "  FAIL — could not find broadcast_sent row in sender activity"
-  FAIL=$((FAIL+1))
-}
-
-if [ -n "$SENT_ROW" ]; then
-  # Delivered count is baked into the summary field (no response_body for sender row).
-  SUMMARY=$(echo "$SENT_ROW" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("summary",""))')
-  assert_contains "broadcast_sent summary mentions workspace count" "$SUMMARY" "workspace"
-fi
-
-echo ""
-echo "--- 2f: Sender does NOT receive a broadcast_receive entry ---"
-SELF_RECV=$(echo "$ACT_SENDER" | python3 -c '
-import json, sys
-rows = json.load(sys.stdin) or []
-for r in rows:
-    if r.get("activity_type") == "broadcast_receive":
-        print("found")
-        break
-')
-assert_not_contains "sender has no broadcast_receive in own activity log" "${SELF_RECV:-}" "found"
-
-# ─────────────────────────────────────────────────────────────────────────────
-echo ""
-echo "--- 2g: Empty message is rejected ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/broadcast" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":""}')
-assert "POST /broadcast with empty message returns 400" "$CODE" "400"
-
-echo ""
-echo "--- 2h: Partial PATCH does not clobber other flags ---"
-# Set talk_to_user=false, then patch only broadcast — talk_to_user must stay false.
-curl -s -o /dev/null -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"talk_to_user_enabled": false}'
-curl -s -o /dev/null -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"broadcast_enabled": false}'
-WS=$(curl -s "$BASE/workspaces/$SENDER_ID" -H "$SENDER_AUTH")
-TUF=$(echo "$WS" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("talk_to_user_enabled","MISSING"))')
-BEF=$(echo "$WS" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("broadcast_enabled","MISSING"))')
-assert "partial PATCH preserves talk_to_user_enabled=false" "$TUF" "False"
-assert "partial PATCH sets broadcast_enabled=false" "$BEF" "False"
-
-# ─────────────────────────────────────────────────────────────────────────────
-echo ""
-echo "=== Results: $PASS passed, $FAIL failed ==="
-[ "$FAIL" -eq 0 ]

workspace-server/go.mod

@@ -18,7 +18,6 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/redis/go-redis/v9 v9.19.0
 	github.com/robfig/cron/v3 v3.0.1
-	github.com/stretchr/testify v1.11.1
 	go.moleculesai.app/plugin/gh-identity v0.0.0-20260509010445-788988195fce
 	golang.org/x/crypto v0.50.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -34,7 +33,6 @@ require (
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -60,7 +58,6 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/quic-go/quic-go v0.59.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect

workspace-server/internal/bundle/exporter_test.go

@@ -1,261 +0,0 @@
-package bundle
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// ---------------------------------------------------------------------------
-// extractDescription
-// ---------------------------------------------------------------------------
-
-func TestExtractDescription_WithFrontmatter(t *testing.T) {
-	// YAML frontmatter is skipped; first non-comment, non-empty line after
-	// the closing `---` is the description.
-	content := `---
-title: My Workspace
----
-# This is a comment
-This is the description line.
-Another line.`
-	got := extractDescription(content)
-	if got != "This is the description line." {
-		t.Errorf("got %q, want %q", got, "This is the description line.")
-	}
-}
-
-func TestExtractDescription_NoFrontmatter(t *testing.T) {
-	// No frontmatter: first non-comment, non-empty line is returned.
-	content := `# Copyright header
-My workspace description
-Another line.`
-	got := extractDescription(content)
-	if got != "My workspace description" {
-		t.Errorf("got %q, want %q", got, "My workspace description")
-	}
-}
-
-func TestExtractDescription_CommentOnly(t *testing.T) {
-	// All content is comments or empty → empty string.
-	content := `# comment only
-# another comment
-`
-	got := extractDescription(content)
-	if got != "" {
-		t.Errorf("got %q, want empty string", got)
-	}
-}
-
-func TestExtractDescription_EmptyInput(t *testing.T) {
-	got := extractDescription("")
-	if got != "" {
-		t.Errorf("got %q, want empty string", got)
-	}
-}
-
-func TestExtractDescription_UnclosedFrontmatter(t *testing.T) {
-	// With no closing `---`, inFrontmatter stays true after the opening
-	// delimiter, so all subsequent lines are skipped and "" is returned.
-	// This is the documented behaviour: without a closing delimiter,
-	// all lines are considered frontmatter.
-	content := `---
-title: No closing delimiter
-This is the description.`
-	got := extractDescription(content)
-	if got != "" {
-		t.Errorf("unclosed frontmatter: got %q, want empty string", got)
-	}
-}
-
-func TestExtractDescription_FrontmatterThenCommentThenContent(t *testing.T) {
-	content := `---
-tags: [test]
----
-# internal comment
-Real description here.
-`
-	got := extractDescription(content)
-	if got != "Real description here." {
-		t.Errorf("got %q, want %q", got, "Real description here.")
-	}
-}
-
-func TestExtractDescription_BlankLinesSkipped(t *testing.T) {
-	// Empty lines (len=0) are skipped; whitespace-only lines (spaces) are NOT
-	// skipped because len(line)>0. First non-comment, non-empty line is returned.
-	content := "\n\n\n\nA. Description\nB. Should not be returned.\n"
-	got := extractDescription(content)
-	if got != "A. Description" {
-		t.Errorf("got %q, want %q", got, "A. Description")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// splitLines
-// ---------------------------------------------------------------------------
-
-func TestSplitLines_Basic(t *testing.T) {
-	got := splitLines("a\nb\nc")
-	want := []string{"a", "b", "c"}
-	if len(got) != len(want) {
-		t.Fatalf("len=%d, want %d", len(got), len(want))
-	}
-	for i := range want {
-		if got[i] != want[i] {
-			t.Errorf("got[%d]=%q, want %q", i, got[i], want[i])
-		}
-	}
-}
-
-func TestSplitLines_TrailingNewline(t *testing.T) {
-	got := splitLines("line1\nline2\n")
-	want := []string{"line1", "line2"}
-	if len(got) != len(want) {
-		t.Errorf("trailing newline: got %v, want %v", got, want)
-	}
-}
-
-func TestSplitLines_NoNewline(t *testing.T) {
-	got := splitLines("no newline")
-	want := []string{"no newline"}
-	if len(got) != 1 || got[0] != want[0] {
-		t.Errorf("got %v, want %v", got, want)
-	}
-}
-
-func TestSplitLines_EmptyString(t *testing.T) {
-	got := splitLines("")
-	if len(got) != 0 {
-		t.Errorf("empty string: got %v, want []", got)
-	}
-}
-
-func TestSplitLines_OnlyNewlines(t *testing.T) {
-	got := splitLines("\n\n\n")
-	// Three consecutive '\n' characters → s[start:i] at each '\n' gives
-	// the empty string between newlines → 3 empty segments.
-	// (No trailing segment because start == len(s) at the end.)
-	if len(got) != 3 {
-		t.Errorf("only newlines: got %v (len=%d), want 3 empty strings", got, len(got))
-	}
-	for i, s := range got {
-		if s != "" {
-			t.Errorf("got[%d]=%q, want empty string", i, s)
-		}
-	}
-}
-
-func TestSplitLines_MultipleConsecutiveNewlines(t *testing.T) {
-	got := splitLines("a\n\n\nb")
-	// a\n\n\nb → ["a", "", "", "b"]
-	if len(got) != 4 {
-		t.Errorf("consecutive newlines: got %v (len=%d)", got, len(got))
-	}
-	if got[0] != "a" || got[3] != "b" {
-		t.Errorf("first/last: got %v, want [a, ..., b]", got)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// findConfigDir
-// ---------------------------------------------------------------------------
-
-func TestFindConfigDir_NameMatch(t *testing.T) {
-	tmp := t.TempDir()
-
-	// Create two sub-dirs; only the one with matching name should be found.
-	mustMkdir(filepath.Join(tmp, "workspace-a"))
-	mustWrite(filepath.Join(tmp, "workspace-a", "config.yaml"),
-		"name: other-workspace\ntier: 1\n")
-
-	mustMkdir(filepath.Join(tmp, "workspace-b"))
-	mustWrite(filepath.Join(tmp, "workspace-b", "config.yaml"),
-		"name: target-workspace\nruntime: claude-code\n")
-
-	got := findConfigDir(tmp, "target-workspace")
-	want := filepath.Join(tmp, "workspace-b")
-	if got != want {
-		t.Errorf("got %q, want %q", got, want)
-	}
-}
-
-func TestFindConfigDir_NoMatch_UsesFallback(t *testing.T) {
-	tmp := t.TempDir()
-
-	mustMkdir(filepath.Join(tmp, "first"))
-	mustWrite(filepath.Join(tmp, "first", "config.yaml"), "name: workspace-a\n")
-
-	mustMkdir(filepath.Join(tmp, "second"))
-	mustWrite(filepath.Join(tmp, "second", "config.yaml"), "name: workspace-b\n")
-
-	// No exact name match → fallback to the first directory with a config.yaml.
-	got := findConfigDir(tmp, "nonexistent")
-	want := filepath.Join(tmp, "first")
-	if got != want {
-		t.Errorf("no match: got %q, want fallback %q", got, want)
-	}
-}
-
-func TestFindConfigDir_MissingDir(t *testing.T) {
-	got := findConfigDir("/nonexistent/path/for/findConfigDir", "any-name")
-	if got != "" {
-		t.Errorf("missing dir: got %q, want empty string", got)
-	}
-}
-
-func TestFindConfigDir_NoSubdirs(t *testing.T) {
-	tmp := t.TempDir()
-	// Empty directory → no matches, no fallback.
-	got := findConfigDir(tmp, "any")
-	if got != "" {
-		t.Errorf("empty dir: got %q, want empty string", got)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-func mustMkdir(path string) {
-	os.MkdirAll(path, 0o755)
-}
-
-func mustWrite(path, content string) {
-	os.WriteFile(path, []byte(content), 0o644)
-}
-
-// ---------------------------------------------------------------------------
-// findConfigDir
-// ---------------------------------------------------------------------------
-
-func TestFindConfigDir_SubdirWithoutConfig(t *testing.T) {
-	tmp := t.TempDir()
-	mustMkdir(filepath.Join(tmp, "empty-skill"))
-	// Sub-dir without config.yaml → skipped.
-	got := findConfigDir(tmp, "any")
-	if got != "" {
-		t.Errorf("no config.yaml: got %q, want empty string", got)
-	}
-}
-
-func TestFindConfigDir_FirstWithConfigIsFallback(t *testing.T) {
-	// When name doesn't match, fallback is the FIRST dir with config.yaml,
-	// not the last. Confirm ordering by creating three dirs.
-	tmp := t.TempDir()
-
-	mustMkdir(filepath.Join(tmp, "a"))
-	mustWrite(filepath.Join(tmp, "a", "config.yaml"), "name: alpha\n")
-
-	mustMkdir(filepath.Join(tmp, "b"))
-	mustWrite(filepath.Join(tmp, "b", "config.yaml"), "name: beta\n")
-
-	mustMkdir(filepath.Join(tmp, "c"))
-	mustWrite(filepath.Join(tmp, "c", "config.yaml"), "name: gamma\n")
-
-	got := findConfigDir(tmp, "nonexistent")
-	want := filepath.Join(tmp, "a") // first dir with config.yaml
-	if got != want {
-		t.Errorf("fallback order: got %q, want first-with-config %q", got, want)
-	}
-}

workspace-server/internal/bundle/importer_test.go

@@ -1,317 +0,0 @@
-package bundle
-
-import (
-	"testing"
-)
-
-func TestBuildBundleConfigFiles_EmptyBundle(t *testing.T) {
-	b := &Bundle{}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 0 {
-		t.Errorf("empty bundle: want 0 files, got %d", len(files))
-	}
-}
-
-func TestBuildBundleConfigFiles_SystemPromptOnly(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "You are a helpful assistant.",
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 1 {
-		t.Fatalf("system-prompt only: want 1 file, got %d", n)
-	}
-	if content, ok := files["system-prompt.md"]; !ok {
-		t.Fatal("missing system-prompt.md")
-	} else if string(content) != "You are a helpful assistant." {
-		t.Errorf("system-prompt content: got %q", string(content))
-	}
-}
-
-func TestBuildBundleConfigFiles_ConfigYamlOnly(t *testing.T) {
-	b := &Bundle{
-		Prompts: map[string]string{
-			"config.yaml": "runtime: langgraph\ntier: 2\n",
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 1 {
-		t.Fatalf("config.yaml only: want 1 file, got %d", n)
-	}
-	if content, ok := files["config.yaml"]; !ok {
-		t.Fatal("missing config.yaml")
-	} else if string(content) != "runtime: langgraph\ntier: 2\n" {
-		t.Errorf("config.yaml content: got %q", string(content))
-	}
-}
-
-func TestBuildBundleConfigFiles_SystemPromptAndConfigYaml(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "Be concise.",
-		Prompts: map[string]string{
-			"config.yaml": "runtime: langgraph\n",
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 2 {
-		t.Fatalf("system-prompt + config.yaml: want 2 files, got %d", n)
-	}
-	if _, ok := files["system-prompt.md"]; !ok {
-		t.Error("missing system-prompt.md")
-	}
-	if _, ok := files["config.yaml"]; !ok {
-		t.Error("missing config.yaml")
-	}
-}
-
-func TestBuildBundleConfigFiles_Skills(t *testing.T) {
-	b := &Bundle{
-		Skills: []BundleSkill{
-			{
-				ID:   "web-search",
-				Files: map[string]string{"readme.md": "# Web Search\n"},
-			},
-			{
-				ID:   "code-interpreter",
-				Files: map[string]string{"readme.md": "# Code Interpreter\n"},
-			},
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	// 2 skills × 1 file each = 2 files
-	if n := len(files); n != 2 {
-		t.Fatalf("skills: want 2 files, got %d", n)
-	}
-	if _, ok := files["skills/web-search/readme.md"]; !ok {
-		t.Error("missing skills/web-search/readme.md")
-	}
-	if _, ok := files["skills/code-interpreter/readme.md"]; !ok {
-		t.Error("missing skills/code-interpreter/readme.md")
-	}
-}
-
-func TestBuildBundleConfigFiles_SkillSubPaths(t *testing.T) {
-	b := &Bundle{
-		Skills: []BundleSkill{
-			{
-				ID: "multi-file",
-				Files: map[string]string{
-					"readme.md":        "# Multi",
-					"instructions.txt": "Step 1, Step 2",
-				},
-			},
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 2 {
-		t.Fatalf("skill with sub-paths: want 2 files, got %d", n)
-	}
-	if _, ok := files["skills/multi-file/readme.md"]; !ok {
-		t.Error("missing skills/multi-file/readme.md")
-	}
-	if _, ok := files["skills/multi-file/instructions.txt"]; !ok {
-		t.Error("missing skills/multi-file/instructions.txt")
-	}
-}
-
-func TestBuildBundleConfigFiles_EmptySystemPrompt(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "",
-		Prompts: map[string]string{
-			"config.yaml": "runtime: langgraph\n",
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	// Empty system-prompt should not produce a file
-	if n := len(files); n != 1 {
-		t.Errorf("empty system-prompt: want 1 file, got %d", n)
-	}
-}
-
-func TestBuildBundleConfigFiles_EmptyPrompts(t *testing.T) {
-	b := &Bundle{
-		Prompts: map[string]string{},
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 0 {
-		t.Errorf("empty prompts map: want 0 files, got %d", n)
-	}
-}
-
-func TestBuildBundleConfigFiles_emptyBundle(t *testing.T) {
-	b := &Bundle{}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 0 {
-		t.Errorf("expected empty map for empty bundle, got %d entries", len(files))
-	}
-}
-
-func TestBuildBundleConfigFiles_systemPrompt(t *testing.T) {
-	b := &Bundle{SystemPrompt: "You are a helpful assistant."}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 1 {
-		t.Fatalf("expected 1 file, got %d", len(files))
-	}
-	if string(files["system-prompt.md"]) != "You are a helpful assistant." {
-		t.Errorf("unexpected system prompt content: %q", files["system-prompt.md"])
-	}
-}
-
-func TestBuildBundleConfigFiles_configYaml(t *testing.T) {
-	b := &Bundle{Prompts: map[string]string{
-		"config.yaml": "runtime: langgraph\nmodel: claude-sonnet-4-20250514\n",
-	}}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 1 {
-		t.Fatalf("expected 1 file, got %d", len(files))
-	}
-	if string(files["config.yaml"]) != "runtime: langgraph\nmodel: claude-sonnet-4-20250514\n" {
-		t.Errorf("unexpected config.yaml content: %q", files["config.yaml"])
-	}
-}
-
-func TestBuildBundleConfigFiles_systemPromptAndConfigYaml(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "# System",
-		Prompts:     map[string]string{"config.yaml": "runtime: langgraph"},
-	}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 2 {
-		t.Fatalf("expected 2 files, got %d", len(files))
-	}
-	if _, ok := files["system-prompt.md"]; !ok {
-		t.Error("missing system-prompt.md")
-	}
-	if _, ok := files["config.yaml"]; !ok {
-		t.Error("missing config.yaml")
-	}
-}
-
-func TestBuildBundleConfigFiles_skills(t *testing.T) {
-	b := &Bundle{
-		Skills: []BundleSkill{
-			{
-				ID:          "web-search",
-				Name:        "Web Search",
-				Description: "Search the web",
-				Files:       map[string]string{"readme.md": "# Web Search"},
-			},
-			{
-				ID:          "code-runner",
-				Name:        "Code Runner",
-				Description: "Execute code",
-				Files:       map[string]string{"handler.py": "print('hello')"},
-			},
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 2 {
-		t.Fatalf("expected 2 skill files, got %d", len(files))
-	}
-
-	if content, ok := files["skills/web-search/readme.md"]; !ok {
-		t.Error("missing skills/web-search/readme.md")
-	} else if string(content) != "# Web Search" {
-		t.Errorf("unexpected readme.md: %q", content)
-	}
-
-	if _, ok := files["skills/code-runner/handler.py"]; !ok {
-		t.Error("missing skills/code-runner/handler.py")
-	}
-}
-
-func TestBuildBundleConfigFiles_skillsWithSubPaths(t *testing.T) {
-	b := &Bundle{
-		Skills: []BundleSkill{
-			{
-				ID:    "nested-skill",
-				Files: map[string]string{"src/main.py": "def main(): pass", "pyproject.toml": "[tool.foo]"},
-			},
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 2 {
-		t.Fatalf("expected 2 files, got %d", len(files))
-	}
-	if _, ok := files["skills/nested-skill/src/main.py"]; !ok {
-		t.Error("missing skills/nested-skill/src/main.py")
-	}
-	if _, ok := files["skills/nested-skill/pyproject.toml"]; !ok {
-		t.Error("missing skills/nested-skill/pyproject.toml")
-	}
-}
-
-func TestBuildBundleConfigFiles_skipsEmptyPrompts(t *testing.T) {
-	b := &Bundle{Prompts: map[string]string{}}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 0 {
-		t.Errorf("expected 0 files for empty prompts map, got %d", len(files))
-	}
-}
-
-func TestBuildBundleConfigFiles_skipsMissingConfigYaml(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "# My Prompt",
-		Prompts:      map[string]string{"other.yaml": "something: else"},
-	}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 1 {
-		t.Fatalf("expected 1 file (system-prompt only), got %d", len(files))
-	}
-	if _, ok := files["config.yaml"]; ok {
-		t.Error("config.yaml should not be written when not in Prompts")
-	}
-}
-
-func TestNilIfEmpty_emptyString(t *testing.T) {
-	result := nilIfEmpty("")
-	if result != nil {
-		t.Errorf("expected nil for empty string, got %v", result)
-	}
-}
-
-func TestNilIfEmpty_nonEmptyString(t *testing.T) {
-	result := nilIfEmpty("hello")
-	if result == nil {
-		t.Fatal("expected non-nil result for non-empty string")
-	}
-	if result != "hello" {
-		t.Errorf("expected hello, got %q", result)
-	}
-}
-
-func TestNilIfEmpty_whitespaceString(t *testing.T) {
-	// Whitespace is not empty — nilIfEmpty only checks for zero-length
-	result := nilIfEmpty("   ")
-	if result == nil {
-		t.Error("expected non-nil for whitespace string")
-	} else if result != "   " {
-		t.Errorf("expected '   ', got %q", result)
-	}
-}
-
-func TestNilIfEmpty_EmptyString(t *testing.T) {
-	got := nilIfEmpty("")
-	if got != nil {
-		t.Errorf("nilIfEmpty(\"\"): want nil, got %v", got)
-	}
-}
-
-func TestNilIfEmpty_NonEmptyString(t *testing.T) {
-	got := nilIfEmpty("hello")
-	if got == nil {
-		t.Fatal("nilIfEmpty(\"hello\"): want \"hello\", got nil")
-	}
-	if s, ok := got.(string); !ok || s != "hello" {
-		t.Errorf("nilIfEmpty(\"hello\"): got %v (%T)", got, got)
-	}
-}
-
-func TestNilIfEmpty_Whitespace(t *testing.T) {
-	got := nilIfEmpty("   ")
-	if got == nil {
-		t.Fatal("nilIfEmpty(\"   \"): want \"   \", got nil (whitespace is not empty)")
-	}
-	if s, ok := got.(string); !ok || s != "   " {
-		t.Errorf("nilIfEmpty(\"   \"): got %v (%T)", got, got)
-	}
-}

workspace-server/internal/channels/manager.go

@@ -402,7 +402,7 @@ func (m *Manager) SendOutbound(ctx context.Context, channelID string, text strin
 		return err
 	}
 
-	adapter, ok := GetSendAdapter(ch.ChannelType)
+	adapter, ok := GetAdapter(ch.ChannelType)
 	if !ok {
 		return fmt.Errorf("no adapter for %s", ch.ChannelType)
 	}

workspace-server/internal/channels/registry.go

@@ -1,7 +1,5 @@
 package channels
 
-import "context"
-
 // Registry of all available channel adapters.
 // To add a new platform: implement ChannelAdapter, register here.
 var adapters = map[string]ChannelAdapter{
@@ -11,27 +9,6 @@ var adapters = map[string]ChannelAdapter{
 	"discord":  &DiscordAdapter{},
 }
 
-// SendAdapter is the subset of ChannelAdapter needed by SendOutbound.
-// Extracted so tests can inject a no-op/mock adapter without hitting real
-// platform APIs (Telegram Bot API, Slack API, etc.).
-type SendAdapter interface {
-	SendMessage(ctx context.Context, config map[string]interface{}, chatID string, text string) error
-}
-
-// getSendAdapter is the production implementation of GetSendAdapter —
-// returns the real registered adapter's SendMessage method.
-func getSendAdapter(channelType string) (SendAdapter, bool) {
-	a, ok := adapters[channelType]
-	if !ok {
-		return nil, false
-	}
-	return a, true
-}
-
-// GetSendAdapter returns the SendAdapter for a channel type.
-// Defaults to the real adapter; overridden by SetTestSendAdapter in tests.
-var GetSendAdapter = getSendAdapter
-
 // GetAdapter returns the adapter for a channel type.
 func GetAdapter(channelType string) (ChannelAdapter, bool) {
 	a, ok := adapters[channelType]

workspace-server/internal/channels/testing.go

@@ -1,30 +0,0 @@
-package channels
-
-import "context"
-
-// MockSendAdapter implements SendAdapter for handler tests. It records every
-// call and returns a configurable error (nil = success, non-nil = failure).
-type MockSendAdapter struct {
-	Calls    int
-	Err      error
-	SentText string
-	SentChat string
-}
-
-func (m *MockSendAdapter) SendMessage(_ context.Context, _ map[string]interface{}, chatID string, text string) error {
-	m.Calls++
-	m.SentText = text
-	m.SentChat = chatID
-	return m.Err
-}
-
-// SetGetSendAdapter replaces the package-level GetSendAdapter variable.
-// Tests MUST call ResetSendAdapters() in their t.Cleanup.
-func SetGetSendAdapter(fn func(string) (SendAdapter, bool)) {
-	GetSendAdapter = fn
-}
-
-// ResetSendAdapters restores GetSendAdapter to the production implementation.
-func ResetSendAdapters() {
-	GetSendAdapter = getSendAdapter
-}

workspace-server/internal/handlers/a2a_proxy.go

@@ -645,7 +645,7 @@ func (h *WorkspaceHandler) resolveAgentURL(ctx context.Context, workspaceID stri
 			// the caller can retry once the workspace is back online (~10s).
 			if status == "hibernated" {
 				log.Printf("ProxyA2A: waking hibernated workspace %s", workspaceID)
-				h.goAsync(func() { h.RestartByID(workspaceID) })
+				go h.RestartByID(workspaceID)
 				return "", &proxyA2AError{
 					Status:  http.StatusServiceUnavailable,
 					Headers: map[string]string{"Retry-After": "15"},

workspace-server/internal/handlers/a2a_queue_status_test.go

@@ -1,12 +1,7 @@
 package handlers
 
 import (
-	"context"
-	"database/sql"
 	"testing"
-
-	sqlmock "github.com/DATA-DOG/go-sqlmock"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
 )
 
 // TestExtractExpiresInSeconds covers the JSON parser used at enqueue time
@@ -63,207 +58,3 @@ func TestExtractExpiresInSeconds(t *testing.T) {
 		})
 	}
 }
-
-// ── QueueStatusByID ─────────────────────────────────────────────────────────────
-
-func setupQueueStatusDB(t *testing.T) sqlmock.Sqlmock {
-	t.Helper()
-	mockDB, mock, err := sqlmock.New()
-	if err != nil {
-		t.Fatalf("failed to create sqlmock: %v", err)
-	}
-	prevDB := db.DB
-	db.DB = mockDB
-	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
-	return mock
-}
-
-func TestQueueStatusByID_Success(t *testing.T) {
-	mock := setupQueueStatusDB(t)
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	rows := sqlmock.NewRows([]string{
-		"id", "workspace_id", "status", "priority", "attempts",
-		"last_error", "enqueued_at", "dispatched_at", "completed_at", "expires_at",
-		"response_body",
-	}).AddRow(
-		queueID, wsID, "queued", 50, 0,
-		nil,                    // last_error
-		"2026-01-01T00:00:00Z", // enqueued_at
-		nil,                    // dispatched_at
-		nil,                    // completed_at
-		nil,                    // expires_at
-		nil,                    // response_body
-	)
-	mock.ExpectQuery(`SELECT`).
-		WithArgs(queueID).
-		WillReturnRows(rows)
-
-	qs, err := QueueStatusByID(context.Background(), queueID)
-	if err != nil {
-		t.Fatalf("QueueStatusByID returned error: %v", err)
-	}
-	if qs.ID != queueID {
-		t.Errorf("ID = %q, want %q", qs.ID, queueID)
-	}
-	if qs.WorkspaceID != wsID {
-		t.Errorf("WorkspaceID = %q, want %q", qs.WorkspaceID, wsID)
-	}
-	if qs.Status != "queued" {
-		t.Errorf("Status = %q, want %q", qs.Status, "queued")
-	}
-	if qs.Priority != 50 {
-		t.Errorf("Priority = %d, want 50", qs.Priority)
-	}
-	if qs.LastError != nil {
-		t.Errorf("LastError = %v, want nil", qs.LastError)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestQueueStatusByID_NotFound(t *testing.T) {
-	mock := setupQueueStatusDB(t)
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(`SELECT`).
-		WithArgs(queueID).
-		WillReturnError(sql.ErrNoRows)
-
-	qs, err := QueueStatusByID(context.Background(), queueID)
-	if err != sql.ErrNoRows {
-		t.Errorf("expected sql.ErrNoRows, got %v", err)
-	}
-	if qs != nil {
-		t.Errorf("expected nil queue status, got %+v", qs)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestQueueStatusByID_DBError(t *testing.T) {
-	mock := setupQueueStatusDB(t)
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(`SELECT`).
-		WithArgs(queueID).
-		WillReturnError(sql.ErrConnDone)
-
-	qs, err := QueueStatusByID(context.Background(), queueID)
-	if err == nil {
-		t.Error("expected error, got nil")
-	}
-	if qs != nil {
-		t.Errorf("expected nil queue status, got %+v", qs)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestQueueStatusByID_CompletedWithResponse(t *testing.T) {
-	mock := setupQueueStatusDB(t)
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	respBody := []byte(`{"text":"delegation result"}`)
-	rows := sqlmock.NewRows([]string{
-		"id", "workspace_id", "status", "priority", "attempts",
-		"last_error", "enqueued_at", "dispatched_at", "completed_at", "expires_at",
-		"response_body",
-	}).AddRow(
-		queueID, wsID, "completed", 50, 1,
-		nil,
-		"2026-01-01T00:00:00Z",
-		"2026-01-01T00:01:00Z",
-		"2026-01-01T00:02:00Z",
-		nil,
-		respBody,
-	)
-	mock.ExpectQuery(`SELECT`).
-		WithArgs(queueID).
-		WillReturnRows(rows)
-
-	qs, err := QueueStatusByID(context.Background(), queueID)
-	if err != nil {
-		t.Fatalf("QueueStatusByID returned error: %v", err)
-	}
-	if qs.Status != "completed" {
-		t.Errorf("Status = %q, want completed", qs.Status)
-	}
-	if qs.ResponseBody == nil {
-		t.Fatal("ResponseBody should be set for completed status")
-	}
-	if string(qs.ResponseBody) != `{"text":"delegation result"}` {
-		t.Errorf("ResponseBody = %q, want %q", string(qs.ResponseBody), `{"text":"delegation result"}`)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-// ── queueRowAuthFields ──────────────────────────────────────────────────────────
-
-func TestQueueRowAuthFields_Success(t *testing.T) {
-	mock := setupQueueStatusDB(t)
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	rows := sqlmock.NewRows([]string{"caller_id", "workspace_id"}).
-		AddRow(callerID, wsID)
-	mock.ExpectQuery(`SELECT caller_id, workspace_id FROM a2a_queue WHERE id`).
-		WithArgs(queueID).
-		WillReturnRows(rows)
-
-	gotCaller, gotWs, err := queueRowAuthFields(context.Background(), queueID)
-	if err != nil {
-		t.Fatalf("queueRowAuthFields returned error: %v", err)
-	}
-	if gotCaller != callerID {
-		t.Errorf("callerID = %q, want %q", gotCaller, callerID)
-	}
-	if gotWs != wsID {
-		t.Errorf("workspaceID = %q, want %q", gotWs, wsID)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestQueueRowAuthFields_NotFound(t *testing.T) {
-	mock := setupQueueStatusDB(t)
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(`SELECT caller_id, workspace_id FROM a2a_queue WHERE id`).
-		WithArgs(queueID).
-		WillReturnError(sql.ErrNoRows)
-
-	_, _, err := queueRowAuthFields(context.Background(), queueID)
-	if err != sql.ErrNoRows {
-		t.Errorf("expected sql.ErrNoRows, got %v", err)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestQueueRowAuthFields_DBError(t *testing.T) {
-	mock := setupQueueStatusDB(t)
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(`SELECT caller_id, workspace_id FROM a2a_queue WHERE id`).
-		WithArgs(queueID).
-		WillReturnError(sql.ErrConnDone)
-
-	_, _, err := queueRowAuthFields(context.Background(), queueID)
-	if err == nil {
-		t.Error("expected error, got nil")
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}

workspace-server/internal/handlers/a2a_queue_test.go

@@ -26,6 +26,10 @@ import (
 // setupTestDBForQueueTests creates a sqlmock DB using QueryMatcherEqual (exact
 // string matching) so that ExpectQuery/ExpectExec patterns are compared verbatim.
 // Uses the same global db.DB as setupTestDB so the handler can use it.
+//
+// IMPORTANT: db.DB is saved before assignment and restored via t.Cleanup so
+// that tests running after this one are not polluted by a closed mock.
+// Same fix as setupTestDB (handlers_test.go); same root cause as mc#975.
 func setupTestDBForQueueTests(t *testing.T) sqlmock.Sqlmock {
 	t.Helper()
 	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
@@ -81,54 +85,6 @@ func TestExtractIdempotencyKey_emptyOnMissing(t *testing.T) {
 	}
 }
 
-// ──────────────────────────────────────────────────────────────────────────────
-// extractExpiresInSeconds
-// ──────────────────────────────────────────────────────────────────────────────
-
-func TestExtractExpiresInSeconds_valid(t *testing.T) {
-	cases := []struct {
-		name string
-		body string
-		want int
-	}{
-		{"positive int", `{"params":{"expires_in_seconds":30}}`, 30},
-		{"zero", `{"params":{"expires_in_seconds":0}}`, 0},
-		{"large TTL", `{"params":{"expires_in_seconds":3600}}`, 3600},
-		{"nested message — not affected", `{"params":{"message":{"role":"user"},"expires_in_seconds":60}}`, 60},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := extractExpiresInSeconds([]byte(tc.body)); got != tc.want {
-				t.Errorf("extractExpiresInSeconds = %d, want %d", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestExtractExpiresInSeconds_invalidOrMissing(t *testing.T) {
-	cases := []struct {
-		name string
-		body string
-		want int
-	}{
-		{"negative → 0", `{"params":{"expires_in_seconds":-5}}`, 0},
-		{"missing expires_in_seconds", `{"params":{"message":{"role":"user"}}}`, 0},
-		{"no params at all", `{"method":"message/send"}`, 0},
-		{"malformed JSON", `not json`, 0},
-		{"empty body", ``, 0},
-		{"null value", `{"params":{"expires_in_seconds":null}}`, 0},
-		{"string value", `{"params":{"expires_in_seconds":"30"}}`, 0},
-		{"float value", `{"params":{"expires_in_seconds":30.5}}`, 30},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := extractExpiresInSeconds([]byte(tc.body)); got != tc.want {
-				t.Errorf("extractExpiresInSeconds(%q) = %d, want %d", tc.body, got, tc.want)
-			}
-		})
-	}
-}
-
 func TestExtractDelegationIDFromBody(t *testing.T) {
 	cases := []struct {
 		name string
@@ -516,51 +472,3 @@ func TestDrainQueueForWorkspace_ClaimGuarding_SecondDrainGetsEmpty(t *testing.T)
 		t.Errorf("unmet sqlmock expectations: %v", err)
 	}
 }
-
-// ── QueueDepth ──────────────────────────────────────────────────────────────────
-
-func TestQueueDepth_ReturnsCount(t *testing.T) {
-	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
-	if err != nil {
-		t.Fatalf("failed to create sqlmock: %v", err)
-	}
-	prevDB := db.DB
-	db.DB = mockDB
-	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
-
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	mock.ExpectQuery(`SELECT COUNT(*) FROM a2a_queue WHERE workspace_id = $1 AND status = 'queued'`).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(42))
-
-	got := QueueDepth(context.Background(), wsID)
-	if got != 42 {
-		t.Errorf("QueueDepth returned %d, want 42", got)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestQueueDepth_ZeroWhenEmpty(t *testing.T) {
-	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
-	if err != nil {
-		t.Fatalf("failed to create sqlmock: %v", err)
-	}
-	prevDB := db.DB
-	db.DB = mockDB
-	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
-
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	mock.ExpectQuery(`SELECT COUNT(*) FROM a2a_queue WHERE workspace_id = $1 AND status = 'queued'`).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
-
-	got := QueueDepth(context.Background(), wsID)
-	if got != 0 {
-		t.Errorf("QueueDepth returned %d, want 0", got)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}

workspace-server/internal/handlers/activity.go

@@ -482,13 +482,6 @@ func (h *ActivityHandler) Notify(c *gin.Context) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
 			return
 		}
-		if errors.Is(err, ErrTalkToUserDisabled) {
-			c.JSON(http.StatusForbidden, gin.H{
-				"error": "talk_to_user_disabled",
-				"hint":  "This workspace is not allowed to send messages directly to the user. Forward your update to a parent workspace using delegate_task — they may be able to reach the user.",
-			})
-			return
-		}
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error"})
 		return
 	}

workspace-server/internal/handlers/activity_test.go

@@ -464,9 +464,9 @@ func TestNotify_PersistsToActivityLogsForReloadRecovery(t *testing.T) {
 	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
 
 	// Workspace existence check
-	mock.ExpectQuery(`SELECT name, talk_to_user_enabled FROM workspaces`).
+	mock.ExpectQuery(`SELECT name FROM workspaces`).
 		WithArgs("ws-notify").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("DD", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("DD"))
 
 	// Persistence INSERT — verify shape
 	mock.ExpectExec(`INSERT INTO activity_logs`).
@@ -511,9 +511,9 @@ func TestNotify_WithAttachments_PersistsFilePartsForReload(t *testing.T) {
 	db.DB = mockDB
 	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
 
-	mock.ExpectQuery(`SELECT name, talk_to_user_enabled FROM workspaces`).
+	mock.ExpectQuery(`SELECT name FROM workspaces`).
 		WithArgs("ws-attach").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("DD", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("DD"))
 
 	// Capture the JSONB arg so we can assert on the persisted shape
 	// AFTER the call (must include parts[].kind=file so reload
@@ -640,9 +640,9 @@ func TestNotify_DBFailure_StillBroadcastsAnd200(t *testing.T) {
 	db.DB = mockDB
 	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
 
-	mock.ExpectQuery(`SELECT name, talk_to_user_enabled FROM workspaces`).
+	mock.ExpectQuery(`SELECT name FROM workspaces`).
 		WithArgs("ws-x").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("DD", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("DD"))
 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WillReturnError(fmt.Errorf("simulated db hiccup"))
 

workspace-server/internal/handlers/agent_message_writer.go

@@ -54,11 +54,6 @@ import (
 // timeout) surface as wrapped errors and should be treated as 503.
 var ErrWorkspaceNotFound = errors.New("agent_message: workspace not found")
 
-// ErrTalkToUserDisabled is returned when the workspace has
-// talk_to_user_enabled=false. Callers surface HTTP 403 so the Python tool
-// can detect it and suggest forwarding to a parent workspace.
-var ErrTalkToUserDisabled = errors.New("agent_message: talk_to_user disabled")
-
 // AgentMessageAttachment is one file attached to an agent → user
 // message. Identical to handlers.NotifyAttachment in field set; kept
 // distinct so the writer's API doesn't import a handler type with HTTP
@@ -112,20 +107,16 @@ func (w *AgentMessageWriter) Send(
 	// notify call surfaced as "workspace not found" and masked real
 	// incidents in the alert path.
 	var wsName string
-	var talkToUserEnabled bool
 	err := w.db.QueryRowContext(ctx,
-		`SELECT name, talk_to_user_enabled FROM workspaces WHERE id = $1 AND status != 'removed'`,
+		`SELECT name FROM workspaces WHERE id = $1 AND status != 'removed'`,
 		workspaceID,
-	).Scan(&wsName, &talkToUserEnabled)
+	).Scan(&wsName)
 	if errors.Is(err, sql.ErrNoRows) {
 		return ErrWorkspaceNotFound
 	}
 	if err != nil {
 		return fmt.Errorf("agent_message: workspace lookup: %w", err)
 	}
-	if !talkToUserEnabled {
-		return ErrTalkToUserDisabled
-	}
 
 	// 2. Build broadcast payload + WS-emit. Same shape that ChatTab's
 	//    AGENT_MESSAGE handler in canvas/src/store/canvas-events.ts has

workspace-server/internal/handlers/agent_message_writer_test.go

@@ -88,9 +88,9 @@ func TestAgentMessageWriter_Send_Success_NoAttachments(t *testing.T) {
 	mock := setupTestDB(t)
 	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))
 
 	mock.ExpectExec(`INSERT INTO activity_logs.*'a2a_receive'.*'notify'`).
 		WithArgs(
@@ -116,9 +116,9 @@ func TestAgentMessageWriter_Send_Success_WithAttachments(t *testing.T) {
 	mock := setupTestDB(t)
 	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-att").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("Ryan", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("Ryan"))
 
 	mock.ExpectExec(`INSERT INTO activity_logs.*'a2a_receive'.*'notify'`).
 		WithArgs(
@@ -173,9 +173,9 @@ func TestAgentMessageWriter_Send_WorkspaceNotFound(t *testing.T) {
 	emitter := &capturingEmitter{}
 	w := NewAgentMessageWriter(db.DB, emitter)
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-missing").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}))
 
 	err := w.Send(context.Background(), "ws-missing", "lost in the void", nil)
 	if !errors.Is(err, ErrWorkspaceNotFound) {
@@ -202,9 +202,9 @@ func TestAgentMessageWriter_Send_DBInsertFailureStillReturnsNil(t *testing.T) {
 	mock := setupTestDB(t)
 	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-dbfail").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))
 
 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WillReturnError(errors.New("transient db error"))
@@ -223,9 +223,9 @@ func TestAgentMessageWriter_Send_PreviewTruncation(t *testing.T) {
 	mock := setupTestDB(t)
 	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-trunc").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("Ryan", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("Ryan"))
 
 	longMsg := strings.Repeat("x", 200)
 	mock.ExpectExec(`INSERT INTO activity_logs`).
@@ -263,9 +263,9 @@ func TestAgentMessageWriter_Send_BroadcastsAgentMessageEvent(t *testing.T) {
 	emitter := &capturingEmitter{}
 	w := NewAgentMessageWriter(db.DB, emitter)
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-bc").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("Workspace Name", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("Workspace Name"))
 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WillReturnResult(sqlmock.NewResult(1, 1))
 
@@ -315,7 +315,7 @@ func TestAgentMessageWriter_Send_DBErrorOnLookupReturnsWrapped(t *testing.T) {
 	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())
 
 	transientErr := errors.New("connection refused")
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-dbdown").
 		WillReturnError(transientErr)
 
@@ -350,9 +350,9 @@ func TestAgentMessageWriter_Send_NonASCIIMessagePersists(t *testing.T) {
 	// the byte-slice bug.
 	msg := strings.Repeat("你", 200)
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-cjk").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))
 
 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WithArgs(
@@ -395,9 +395,9 @@ func TestAgentMessageWriter_Send_OmitsAttachmentsKeyWhenEmpty(t *testing.T) {
 	emitter := &capturingEmitter{}
 	w := NewAgentMessageWriter(db.DB, emitter)
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-noatt").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("X", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("X"))
 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WillReturnResult(sqlmock.NewResult(1, 1))
 

workspace-server/internal/handlers/approvals.go

@@ -116,9 +116,6 @@ func (h *ApprovalsHandler) ListAll(c *gin.Context) {
 			"created_at":     createdAt,
 		})
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ListPendingApprovals rows.Err: %v", err)
-	}
 
 	c.JSON(http.StatusOK, approvals)
 }
@@ -158,9 +155,6 @@ func (h *ApprovalsHandler) List(c *gin.Context) {
 			"created_at": createdAt,
 		})
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ListApprovals rows.Err workspace=%s: %v", workspaceID, err)
-	}
 
 	c.JSON(http.StatusOK, approvals)
 }

workspace-server/internal/handlers/channels_test.go

@@ -328,207 +328,6 @@ func TestChannelHandler_Send_EmptyText(t *testing.T) {
 	}
 }
 
-// ==================== Test (send outbound) ====================
-
-// TestChannelHandler_Test_Success exercises the /channels/:channelId/test endpoint
-// with a mock SendAdapter so the full success path is covered without hitting real
-// Telegram/Slack/etc. APIs.
-func TestChannelHandler_Test_Success(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewChannelHandler(newTestChannelManager())
-
-	mockAdapter := &channels.MockSendAdapter{Err: nil}
-	channels.SetGetSendAdapter(func(ct string) (channels.SendAdapter, bool) {
-		if ct == "telegram" {
-			return mockAdapter, true
-		}
-		return channels.GetSendAdapter(ct)
-	})
-	t.Cleanup(channels.ResetSendAdapters)
-
-	// loadChannel → valid row
-	mock.ExpectQuery("SELECT .+ FROM workspace_channels WHERE id").
-		WithArgs("ch-test-ok").
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "workspace_id", "channel_type", "channel_config",
-			"enabled", "allowed_users",
-		}).AddRow("ch-test-ok", "ws-1", "telegram",
-			`{"bot_token":"123:AAA","chat_id":"-100"}`,
-			true, `[]`))
-
-	// UPDATE message_count + last_message_at
-	mock.ExpectExec("UPDATE workspace_channels SET last_message_at").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/channels/ch-test-ok/test", nil)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "channelId", Value: "ch-test-ok"}}
-
-	handler.Test(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["status"] != "ok" {
-		t.Errorf("expected status 'ok', got %v", resp["status"])
-	}
-	if mockAdapter.Calls != 1 {
-		t.Errorf("expected SendMessage called once, got %d", mockAdapter.Calls)
-	}
-	if mockAdapter.SentChat != "-100" {
-		t.Errorf("expected chat_id '-100', got %q", mockAdapter.SentChat)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// TestChannelHandler_Test_ChannelNotFound verifies that when loadChannel returns
-// no rows, the Test handler returns 500 with a "test message failed" error.
-func TestChannelHandler_Test_ChannelNotFound(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewChannelHandler(newTestChannelManager())
-
-	// loadChannel → no rows
-	mock.ExpectQuery("SELECT .+ FROM workspace_channels WHERE id").
-		WithArgs("ch-missing").
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "workspace_id", "channel_type", "channel_config",
-			"enabled", "allowed_users",
-		}))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/channels/ch-missing/test", nil)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "channelId", Value: "ch-missing"}}
-
-	handler.Test(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 for missing channel, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["error"] != "test message failed" {
-		t.Errorf("expected error 'test message failed', got %v", resp["error"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// TestChannelHandler_Send_Success covers the full outbound send success path:
-// budget check passes → loadChannel → mock SendMessage succeeds → UPDATE count → 200.
-func TestChannelHandler_Send_Success(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewChannelHandler(newTestChannelManager())
-
-	mockAdapter := &channels.MockSendAdapter{Err: nil}
-	channels.SetGetSendAdapter(func(ct string) (channels.SendAdapter, bool) {
-		if ct == "telegram" {
-			return mockAdapter, true
-		}
-		return channels.GetSendAdapter(ct)
-	})
-	t.Cleanup(channels.ResetSendAdapters)
-
-	// Budget check: count=0, no budget limit
-	mock.ExpectQuery("SELECT message_count, channel_budget FROM workspace_channels WHERE id").
-		WithArgs("ch-send-ok").
-		WillReturnRows(sqlmock.NewRows([]string{"message_count", "channel_budget"}).
-			AddRow(0, nil))
-
-	// loadChannel → valid row
-	mock.ExpectQuery("SELECT .+ FROM workspace_channels WHERE id").
-		WithArgs("ch-send-ok").
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "workspace_id", "channel_type", "channel_config",
-			"enabled", "allowed_users",
-		}).AddRow("ch-send-ok", "ws-1", "telegram",
-			`{"bot_token":"123:AAA","chat_id":"-100"}`,
-			true, `[]`))
-
-	// UPDATE message_count
-	mock.ExpectExec("UPDATE workspace_channels SET last_message_at").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	body, _ := json.Marshal(map[string]string{"text": "hello from test"})
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/channels/ch-send-ok/send", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "channelId", Value: "ch-send-ok"}}
-
-	handler.Send(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["status"] != "sent" {
-		t.Errorf("expected status 'sent', got %v", resp["status"])
-	}
-	if mockAdapter.Calls != 1 {
-		t.Errorf("expected SendMessage called once, got %d", mockAdapter.Calls)
-	}
-	if mockAdapter.SentText != "hello from test" {
-		t.Errorf("expected 'hello from test', got %q", mockAdapter.SentText)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// TestChannelHandler_Send_ChannelNotFound verifies that after the budget check
-// passes, a missing channel returns 500 (not 404) with "send failed".
-func TestChannelHandler_Send_ChannelNotFound(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewChannelHandler(newTestChannelManager())
-
-	// Budget check passes (NULL budget → no limit)
-	mock.ExpectQuery("SELECT message_count, channel_budget FROM workspace_channels WHERE id").
-		WithArgs("ch-send-missing").
-		WillReturnRows(sqlmock.NewRows([]string{"message_count", "channel_budget"}).
-			AddRow(0, nil))
-
-	// loadChannel → no rows
-	mock.ExpectQuery("SELECT .+ FROM workspace_channels WHERE id").
-		WithArgs("ch-send-missing").
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "workspace_id", "channel_type", "channel_config",
-			"enabled", "allowed_users",
-		}))
-
-	body, _ := json.Marshal(map[string]string{"text": "hello"})
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/channels/ch-send-missing/send", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "channelId", Value: "ch-send-missing"}}
-
-	handler.Send(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 for missing channel, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["error"] != "send failed" {
-		t.Errorf("expected error 'send failed', got %v", resp["error"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
 // ==================== Webhook ====================
 
 func TestChannelHandler_Webhook_UnknownType(t *testing.T) {
@@ -947,73 +746,6 @@ func TestVerifyDiscordSignature_WrongLengthPubKey(t *testing.T) {
 	}
 }
 
-// ==================== matchesChatID pure function ====================
-
-func TestMatchesChatID_ExactMatch(t *testing.T) {
-	cfg := map[string]interface{}{"chat_id": "123456"}
-	if !matchesChatID(cfg, "123456") {
-		t.Error("expected true for exact match")
-	}
-}
-
-func TestMatchesChatID_NoMatch(t *testing.T) {
-	cfg := map[string]interface{}{"chat_id": "123456"}
-	if matchesChatID(cfg, "654321") {
-		t.Error("expected false for non-matching chat ID")
-	}
-}
-
-func TestMatchesChatID_PrefixNoMatch(t *testing.T) {
-	// "123" is a prefix of "123456" but not an exact match.
-	cfg := map[string]interface{}{"chat_id": "123456"}
-	if matchesChatID(cfg, "123") {
-		t.Error("expected false for prefix of stored chat ID")
-	}
-}
-
-func TestMatchesChatID_CommaSeparatedMultiple(t *testing.T) {
-	cfg := map[string]interface{}{"chat_id": "111,222,333"}
-	for _, id := range []string{"111", "222", "333"} {
-		if !matchesChatID(cfg, id) {
-			t.Errorf("expected true for %q in comma-separated list", id)
-		}
-	}
-	if matchesChatID(cfg, "444") {
-		t.Error("expected false for ID not in list")
-	}
-}
-
-func TestMatchesChatID_WhitespaceTrimmed(t *testing.T) {
-	cfg := map[string]interface{}{"chat_id": "111, 222 , 333"}
-	if !matchesChatID(cfg, "222") {
-		t.Error("expected true for whitespace-trimmed match")
-	}
-	if matchesChatID(cfg, " 222") {
-		t.Error("expected false for whitespace in query (not trimmed from query)")
-	}
-}
-
-func TestMatchesChatID_EmptyChatID(t *testing.T) {
-	cfg := map[string]interface{}{"chat_id": ""}
-	if matchesChatID(cfg, "123456") {
-		t.Error("expected false for empty chat_id in config")
-	}
-}
-
-func TestMatchesChatID_MissingChatIDKey(t *testing.T) {
-	cfg := map[string]interface{}{}
-	if matchesChatID(cfg, "123456") {
-		t.Error("expected false when chat_id key is missing")
-	}
-}
-
-func TestMatchesChatID_NonStringChatID(t *testing.T) {
-	cfg := map[string]interface{}{"chat_id": 123456} // wrong type
-	if matchesChatID(cfg, "123456") {
-		t.Error("expected false when chat_id is not a string")
-	}
-}
-
 // TestChannelHandler_Webhook_Discord_NoKey_Returns401 verifies that a Discord
 // webhook request is rejected with 401 when no public key is configured in the
 // DB and DISCORD_APP_PUBLIC_KEY env var is not set.

workspace-server/internal/handlers/delegation.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"log"
 	"net/http"
@@ -698,7 +699,8 @@ func (h *DelegationHandler) listDelegationsFromLedger(ctx context.Context, works
 
 	var result []map[string]interface{}
 	for rows.Next() {
-		var delegationID, callerID, calleeID, taskPreview, status, resultPreview, errorDetail string
+		var delegationID, callerID, calleeID, taskPreview, status string
+		var resultPreview, errorDetail sql.NullString
 		var lastHeartbeat, deadline, createdAt, updatedAt *time.Time
 		if err := rows.Scan(
 			&delegationID, &callerID, &calleeID, &taskPreview,
@@ -717,11 +719,11 @@ func (h *DelegationHandler) listDelegationsFromLedger(ctx context.Context, works
 			"updated_at":    updatedAt,
 			"_ledger":       true, // marker so callers know this row is from the ledger
 		}
-		if resultPreview != "" {
-			entry["response_preview"] = textutil.TruncateBytes(resultPreview, 300)
+		if resultPreview.Valid && resultPreview.String != "" {
+			entry["response_preview"] = textutil.TruncateBytes(resultPreview.String, 300)
 		}
-		if errorDetail != "" {
-			entry["error"] = errorDetail
+		if errorDetail.Valid && errorDetail.String != "" {
+			entry["error"] = errorDetail.String
 		}
 		if lastHeartbeat != nil {
 			entry["last_heartbeat"] = lastHeartbeat

workspace-server/internal/handlers/delegation_extract_response_text_test.go

@@ -1,224 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// extractResponseText tests — walks A2A JSON-RPC response bodies and
-// returns the first text part, falling back to raw body on parse failures.
-
-func TestExtractResponseText_PartsWithTextKind(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				map[string]interface{}{"kind": "text", "text": "hello world"},
-				map[string]interface{}{"kind": "text", "text": "second part"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "hello world", extractResponseText(body))
-}
-
-func TestExtractResponseText_PartNotTextKind(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				map[string]interface{}{"kind": "image", "data": "base64..."},
-				map[string]interface{}{"kind": "text", "text": "visible"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "visible", extractResponseText(body))
-}
-
-func TestExtractResponseText_PartsEmpty(t *testing.T) {
-	// Empty parts array — falls through to artifacts, then raw body
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts":     []interface{}{},
-			"artifacts": []interface{}{},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	// Falls through to raw body (which is the JSON string)
-	result := extractResponseText(body)
-	assert.NotEmpty(t, result)
-}
-
-func TestExtractResponseText_ArtifactPartsWithText(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{},
-			"artifacts": []interface{}{
-				map[string]interface{}{
-					"kind": "file",
-					"parts": []interface{}{
-						map[string]interface{}{"kind": "text", "text": "artifact text"},
-					},
-				},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "artifact text", extractResponseText(body))
-}
-
-func TestExtractResponseText_ArtifactPartNotTextKind(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{},
-			"artifacts": []interface{}{
-				map[string]interface{}{
-					"kind": "code",
-					"parts": []interface{}{
-						map[string]interface{}{"kind": "image", "data": "..."},
-						map[string]interface{}{"kind": "text", "text": "code comment"},
-					},
-				},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "code comment", extractResponseText(body))
-}
-
-func TestExtractResponseText_ArtifactsEmpty(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts":     []interface{}{},
-			"artifacts": []interface{}{},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	result := extractResponseText(body)
-	// Falls back to raw body
-	assert.Equal(t, string(body), result)
-}
-
-func TestExtractResponseText_NoResult(t *testing.T) {
-	// No "result" key at all — falls back to raw body
-	body := []byte(`{"error": {"code": -32600, "message": "Invalid Request"}}`)
-	result := extractResponseText(body)
-	assert.Equal(t, string(body), result)
-}
-
-func TestExtractResponseText_ResultNotMap(t *testing.T) {
-	// result is a string, not a map — falls back to raw body
-	body := []byte(`{"result": "just a string"}`)
-	result := extractResponseText(body)
-	assert.Equal(t, string(body), result)
-}
-
-func TestExtractResponseText_NonJSONBody(t *testing.T) {
-	// Non-JSON bytes — returns the raw string
-	body := []byte("plain text response, not JSON at all")
-	result := extractResponseText(body)
-	assert.Equal(t, "plain text response, not JSON at all", result)
-}
-
-func TestExtractResponseText_PartWithNilText(t *testing.T) {
-	// Text field is nil — kind is "text" but text is nil, should skip
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				map[string]interface{}{"kind": "text", "text": nil},
-				map[string]interface{}{"kind": "text", "text": "found"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "found", extractResponseText(body))
-}
-
-func TestExtractResponseText_ArtifactPartWithNilText(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{},
-			"artifacts": []interface{}{
-				map[string]interface{}{
-					"parts": []interface{}{
-						map[string]interface{}{"kind": "text", "text": nil},
-						map[string]interface{}{"kind": "text", "text": "artifact-found"},
-					},
-				},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "artifact-found", extractResponseText(body))
-}
-
-func TestExtractResponseText_PartsWithNonMapElement(t *testing.T) {
-	// parts contains a non-map element — should be skipped gracefully
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				"not a map",
-				123,
-				nil,
-				map[string]interface{}{"kind": "text", "text": "parsed"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "parsed", extractResponseText(body))
-}
-
-func TestExtractResponseText_ArtifactWithNonMapElement(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{},
-			"artifacts": []interface{}{
-				"not a map",
-				nil,
-				map[string]interface{}{
-					"parts": []interface{}{
-						"not a map",
-						map[string]interface{}{"kind": "text", "text": "safe"},
-					},
-				},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "safe", extractResponseText(body))
-}
-
-func TestExtractResponseText_PartKindNotString(t *testing.T) {
-	// kind is an integer, not a string — should be skipped
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				map[string]interface{}{"kind": 123, "text": "ignored"},
-				map[string]interface{}{"kind": "text", "text": "found"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "found", extractResponseText(body))
-}
-
-func TestExtractResponseText_EmptyResponse(t *testing.T) {
-	body := []byte("{}")
-	result := extractResponseText(body)
-	// Falls back to raw "{}"
-	assert.Equal(t, "{}", result)
-}
-
-func TestExtractResponseText_NilBody(t *testing.T) {
-	// nil byte slice — string(nil) = ""
-	result := extractResponseText(nil)
-	assert.Equal(t, "", result)
-}
-
-func TestExtractResponseText_WhitespaceBody(t *testing.T) {
-	body := []byte("   \n\t  ")
-	result := extractResponseText(body)
-	// Unmarshals to empty map, no result, returns raw string
-	assert.Equal(t, "   \n\t  ", result)
-}

workspace-server/internal/handlers/delegation_list_test.go

@@ -145,6 +145,54 @@ func TestListDelegationsFromLedger_MultipleRows(t *testing.T) {
 	}
 }
 
+func TestListDelegationsFromLedger_NullsOmitted(t *testing.T) {
+	// last_heartbeat, deadline, result_preview, error_detail are all NULL.
+	// Handler must not panic and must omit those keys from the map.
+	mockDB, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prevDB := db.DB
+	db.DB = mockDB
+	t.Cleanup(func() { mockDB.Close(); db.DB = prevDB })
+
+	now := time.Now()
+	rows := sqlmock.NewRows([]string{
+		"delegation_id", "caller_id", "callee_id", "task_preview",
+		"status", "result_preview", "error_detail",
+		"last_heartbeat", "deadline", "created_at", "updated_at",
+	}).
+		AddRow("del-1", "ws-1", "ws-2", "task", "queued", nil, nil, nil, nil, now, now)
+	mock.ExpectQuery("SELECT .+ FROM delegations").
+		WithArgs("ws-1").
+		WillReturnRows(rows)
+
+	broadcaster := newTestBroadcaster()
+	wh := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
+	dh := NewDelegationHandler(wh, broadcaster)
+
+	got := dh.listDelegationsFromLedger(context.Background(), "ws-1")
+	if len(got) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(got))
+	}
+	e := got[0]
+	if _, ok := e["last_heartbeat"]; ok {
+		t.Error("last_heartbeat should be absent when NULL")
+	}
+	if _, ok := e["deadline"]; ok {
+		t.Error("deadline should be absent when NULL")
+	}
+	if _, ok := e["response_preview"]; ok {
+		t.Error("response_preview should be absent when NULL result_preview")
+	}
+	if _, ok := e["error"]; ok {
+		t.Error("error should be absent when NULL error_detail")
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("sqlmock expectations: %v", err)
+	}
+}
+
 func TestListDelegationsFromLedger_QueryError(t *testing.T) {
 	// Query failure returns nil — graceful fallback, no panic.
 	mockDB, mock, err := sqlmock.New()
@@ -438,10 +486,3 @@ func TestListDelegationsFromActivityLogs_RowsErr(t *testing.T) {
 		t.Errorf("sqlmock expectations: %v", err)
 	}
 }
-
-// TestListDelegationsFromActivityLogs_ScanErrorSkipped is removed.
-//
-// Same reason as TestListDelegationsFromLedger_ScanError: Go 1.25 causes
-// sqlmock.NewRows([]string{}).AddRow(...) to panic in test SETUP. The handler
-// has no recover(), so a scan panic would crash the process — the correct
-// behaviour. Real-DB integration tests cover this path.

workspace-server/internal/handlers/discovery_filter_test.go

@@ -1,160 +0,0 @@
-package handlers
-
-import (
-	"testing"
-)
-
-// filterPeersByQuery tests — nil-safe role/name filtering for peer discovery.
-
-func TestFilterPeersByQuery_EmptyQueryNoOp(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "foo", "role": "bar"},
-		{"name": "baz", "role": "qux"},
-	}
-	result := filterPeersByQuery(peers, "")
-	if len(result) != 2 {
-		t.Errorf("empty query: expected 2, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_WhitespaceQueryNoOp(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "foo", "role": "bar"},
-	}
-	result := filterPeersByQuery(peers, "   ")
-	if len(result) != 1 {
-		t.Errorf("whitespace-only query: expected 1, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_MatchName(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "backend-agent", "role": "sre"},
-		{"name": "frontend-agent", "role": "ui"},
-	}
-	result := filterPeersByQuery(peers, "backend")
-	if len(result) != 1 || result[0]["name"] != "backend-agent" {
-		t.Errorf("expected backend-agent, got %v", result)
-	}
-}
-
-func TestFilterPeersByQuery_MatchRole(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "agent-alpha", "role": "security engineer"},
-		{"name": "agent-beta", "role": "devops"},
-	}
-	result := filterPeersByQuery(peers, "engineer")
-	if len(result) != 1 || result[0]["name"] != "agent-alpha" {
-		t.Errorf("expected agent-alpha, got %v", result)
-	}
-}
-
-func TestFilterPeersByQuery_CaseInsensitive(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "AgentX", "role": "SRE"},
-	}
-	result := filterPeersByQuery(peers, "AGENTx")
-	if len(result) != 1 {
-		t.Errorf("expected 1 match (case-insensitive), got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_NilRoleNoPanic(t *testing.T) {
-	// This is the regression case for #730: queryPeerMaps explicitly sets
-	// peer["role"] = nil when the DB role is empty string. Before the fix,
-	// p["role"].(string) panics on nil. After the fix, it returns "" and
-	// no match occurs — which is the correct behaviour.
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("filterPeersByQuery panicked on nil role: %v", r)
-		}
-	}()
-	peers := []map[string]interface{}{
-		{"name": "some-agent", "role": nil},
-	}
-	result := filterPeersByQuery(peers, "some-agent")
-	if len(result) != 1 {
-		t.Errorf("expected 1 match by name, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_NilRoleQueryNoMatch(t *testing.T) {
-	// When role is nil and query does not match name, nothing matches.
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("filterPeersByQuery panicked on nil role: %v", r)
-		}
-	}()
-	peers := []map[string]interface{}{
-		{"name": "agent-alpha", "role": nil},
-	}
-	result := filterPeersByQuery(peers, "no-match")
-	if len(result) != 0 {
-		t.Errorf("expected 0 matches, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_NilNameNoPanic(t *testing.T) {
-	// Defensive check: name could also theoretically be nil.
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("filterPeersByQuery panicked on nil name: %v", r)
-		}
-	}()
-	peers := []map[string]interface{}{
-		{"name": nil, "role": "sre"},
-	}
-	result := filterPeersByQuery(peers, "sre")
-	if len(result) != 1 {
-		t.Errorf("expected 1 match by role, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_BothNilNoPanic(t *testing.T) {
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("filterPeersByQuery panicked on nil name+role: %v", r)
-		}
-	}()
-	peers := []map[string]interface{}{
-		{"name": nil, "role": nil},
-	}
-	result := filterPeersByQuery(peers, "")
-	if len(result) != 1 {
-		t.Errorf("empty query with nil name/role: expected 1, got %d", len(result))
-	}
-	result = filterPeersByQuery(peers, "anything")
-	if len(result) != 0 {
-		t.Errorf("non-empty query with nil name/role: expected 0, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_NoMatches(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "alpha", "role": "beta"},
-		{"name": "gamma", "role": "delta"},
-	}
-	result := filterPeersByQuery(peers, "zzz")
-	if len(result) != 0 {
-		t.Errorf("expected 0, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_EmptyPeers(t *testing.T) {
-	result := filterPeersByQuery([]map[string]interface{}{}, "query")
-	if len(result) != 0 {
-		t.Errorf("empty peers: expected 0, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_MultipleMatches(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "backend-alpha", "role": "eng"},
-		{"name": "backend-beta", "role": "eng"},
-		{"name": "frontend", "role": "ui"},
-	}
-	result := filterPeersByQuery(peers, "backend")
-	if len(result) != 2 {
-		t.Errorf("expected 2 backend matches, got %d", len(result))
-	}
-}

workspace-server/internal/handlers/handlers_additional_test.go

@@ -230,21 +230,20 @@ func TestWorkspaceList_WithData(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
 
-	// 23 cols — broadcast_enabled + talk_to_user_enabled added after monthly_spend
-	// (migration 20260514). Column order must match scanWorkspaceRow exactly.
+	// 21 cols — see scanWorkspaceRow for order (max_concurrent_tasks
+	// lands between active_tasks and last_error_rate).
 	columns := []string{
 		"id", "name", "role", "tier", "status", "agent_card", "url",
 		"parent_id", "active_tasks", "max_concurrent_tasks",
 		"last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	rows := sqlmock.NewRows(columns).
 		AddRow("ws-1", "Agent One", "worker", 1, "online", []byte(`{"name":"agent1"}`), "http://localhost:8001",
-			nil, 3, 1, 0.02, "", 7200, "processing", "langgraph", "", 10.0, 20.0, false, nil, int64(0), false, true).
+			nil, 3, 1, 0.02, "", 7200, "processing", "langgraph", "", 10.0, 20.0, false, nil, int64(0)).
 		AddRow("ws-2", "Agent Two", "", 2, "degraded", []byte("null"), "",
-			nil, 0, 1, 0.6, "timeout", 100, "", "claude-code", "", 50.0, 60.0, true, nil, int64(0), false, true)
+			nil, 0, 1, 0.6, "timeout", 100, "", "claude-code", "", 50.0, 60.0, true, nil, int64(0))
 
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WillReturnRows(rows)

workspace-server/internal/handlers/handlers_test.go

@@ -29,6 +29,11 @@ func init() {
 // setupTestDB creates a sqlmock DB and assigns it to the global db.DB.
 // It also disables the SSRF URL check so that httptest.NewServer loopback
 // URLs and fake hostnames (*.example) used in tests don't trigger rejections.
+//
+// IMPORTANT: db.DB is saved before assignment and restored via t.Cleanup so
+// that tests running after this one are not polluted by a closed mock.
+// This is the single root cause of the systemic CI/Platform (Go) failures on
+// main HEAD 8026f020 (mc#975).
 func setupTestDB(t *testing.T) sqlmock.Sqlmock {
 	t.Helper()
 	mockDB, mock, err := sqlmock.New()
@@ -392,21 +397,21 @@ func TestWorkspaceList(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", "/tmp/configs")
 
-	// 23 cols: broadcast_enabled + talk_to_user_enabled added after monthly_spend
-	// (migration 20260514). Column order must match scanWorkspaceRow exactly.
+	// 21 cols: `max_concurrent_tasks` added between active_tasks and
+	// last_error_rate (see scanWorkspaceRow + COALESCE(w.max_concurrent_tasks, 1)
+	// in workspace.go). Column order must match that scan exactly.
 	columns := []string{
 		"id", "name", "role", "tier", "status", "agent_card", "url",
 		"parent_id", "active_tasks", "max_concurrent_tasks",
 		"last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	rows := sqlmock.NewRows(columns).
 		AddRow("ws-1", "Agent One", "worker", 1, "online", []byte("null"), "http://localhost:8001",
-			nil, 0, 1, 0.0, "", 100, "", "claude-code", "", 10.0, 20.0, false, nil, int64(0), false, true).
+			nil, 0, 1, 0.0, "", 100, "", "claude-code", "", 10.0, 20.0, false, nil, int64(0)).
 		AddRow("ws-2", "Agent Two", "manager", 2, "provisioning", []byte("null"), "",
-			nil, 0, 1, 0.0, "", 0, "", "langgraph", "", 50.0, 60.0, false, nil, int64(0), false, true)
+			nil, 0, 1, 0.0, "", 0, "", "langgraph", "", 50.0, 60.0, false, nil, int64(0))
 
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WillReturnRows(rows)
@@ -1120,14 +1125,13 @@ func TestWorkspaceGet_CurrentTask(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs("dddddddd-0004-0000-0000-000000000000").
 		WillReturnRows(sqlmock.NewRows(columns).AddRow(
 			"dddddddd-0004-0000-0000-000000000000", "Task Worker", "worker", 1, "online", []byte("null"), "http://localhost:9000",
 			nil, 2, 1, 0.0, "", 300, "Analyzing document", "langgraph", "", 10.0, 20.0, false,
-			nil, int64(0), false, true,
+			nil, int64(0),
 		))
 
 	w := httptest.NewRecorder()

workspace-server/internal/handlers/instructions.go

@@ -248,9 +248,6 @@ func (h *InstructionsHandler) Resolve(c *gin.Context) {
 		b.WriteString(content)
 		b.WriteString("\n\n")
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ResolveInstructions rows.Err workspace=%s: %v", workspaceID, err)
-	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"workspace_id": workspaceID,
@@ -261,7 +258,6 @@ func (h *InstructionsHandler) Resolve(c *gin.Context) {
 func scanInstructions(rows interface {
 	Next() bool
 	Scan(dest ...interface{}) error
-	Err() error
 }) []Instruction {
 	var instructions []Instruction
 	for rows.Next() {
@@ -273,9 +269,6 @@ func scanInstructions(rows interface {
 		}
 		instructions = append(instructions, inst)
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("scanInstructions rows.Err: %v", err)
-	}
 	if instructions == nil {
 		instructions = []Instruction{}
 	}

workspace-server/internal/handlers/mcp_test.go

@@ -751,9 +751,9 @@ func TestMCPHandler_SendMessageToUser_DBErrorLogsAndStill200s(t *testing.T) {
 	t.Setenv("MOLECULE_MCP_ALLOW_SEND_MESSAGE", "true")
 	h, mock := newMCPHandler(t)
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-err").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))
 
 	// INSERT fails — must NOT abort the tool response.
 	mock.ExpectExec(`INSERT INTO activity_logs.*'a2a_receive'.*'notify'`).
@@ -802,9 +802,9 @@ func TestMCPHandler_SendMessageToUser_ResponseBodyShape(t *testing.T) {
 
 	const userMessage = "Hi there from the agent"
 
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-shape").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))
 
 	// Capture the response_body argument and assert its exact shape.
 	mock.ExpectExec(`INSERT INTO activity_logs.*'a2a_receive'.*'notify'`).
@@ -861,9 +861,9 @@ func TestMCPHandler_SendMessageToUser_PersistsToActivityLog(t *testing.T) {
 	// before it does anything else. Returning a name lets the
 	// broadcast payload populate; the test doesn't assert on the
 	// broadcast (no observable WS in this fake), only on the DB.
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-msg").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))
 
 	// The persistence INSERT — pin the exact shape so a future
 	// refactor that switches columns or drops `method='notify'`

workspace-server/internal/handlers/org.go

@@ -271,62 +271,6 @@ func (e EnvRequirement) IsSatisfied(configured map[string]struct{}) bool {
 	return false
 }
 
-// perWorkspaceUnsatisfied records a single unsatisfied RequiredEnv for a
-// specific workspace during org import preflight.
-type perWorkspaceUnsatisfied struct {
-	Workspace   string
-	FilesDir    string
-	Unsatisfied EnvRequirement
-}
-
-// collectPerWorkspaceUnsatisfied walks the workspace tree and returns every
-// RequiredEnv that is neither in `configured` (global secrets) nor resolvable
-// from the org root or workspace-level .env file. An empty orgBaseDir skips
-// the .env walk so all requirements appear unsatisfied (used by tests to
-// isolate the global-only path).
-func collectPerWorkspaceUnsatisfied(
-	workspaces []OrgWorkspace,
-	orgBaseDir string,
-	configured map[string]struct{},
-) []perWorkspaceUnsatisfied {
-	var result []perWorkspaceUnsatisfied
-	for _, ws := range workspaces {
-		result = append(result, checkWorkspaceRequiredEnv(ws, orgBaseDir, configured)...)
-	}
-	return result
-}
-
-func checkWorkspaceRequiredEnv(
-	ws OrgWorkspace,
-	orgBaseDir string,
-	configured map[string]struct{},
-) []perWorkspaceUnsatisfied {
-	var result []perWorkspaceUnsatisfied
-	// Merge in .env vars from the org root and the workspace-specific dir.
-	// Workspace-level vars override org-root vars, just as loadWorkspaceEnv
-	// implements: org root first, then ws dir on top.
-	if orgBaseDir != "" {
-		wsEnv := loadWorkspaceEnv(orgBaseDir, ws.FilesDir)
-		for k, v := range wsEnv {
-			configured[k] = struct{}{}
-			_ = v // value only used for merging into configured map
-		}
-	}
-	for _, req := range ws.RequiredEnv {
-		if !req.IsSatisfied(configured) {
-			result = append(result, perWorkspaceUnsatisfied{
-				Workspace:   ws.Name,
-				FilesDir:    ws.FilesDir,
-				Unsatisfied: req,
-			})
-		}
-	}
-	for _, child := range ws.Children {
-		result = append(result, checkWorkspaceRequiredEnv(child, orgBaseDir, configured)...)
-	}
-	return result
-}
-
 // UnmarshalYAML accepts either a scalar (string → single) or a map
 // with an `any_of` list (→ group).
 func (e *EnvRequirement) UnmarshalYAML(value *yaml.Node) error {

workspace-server/internal/handlers/org_helpers.go

@@ -64,9 +64,7 @@ func resolvePromptRef(inline, fileRef, orgBaseDir, filesDir string) (string, err
 
 // envVarRefPattern matches actual ${VAR} or $VAR references (not literal $).
 // Used to detect unresolved placeholders without false positives like "$5".
-// Requires [a-zA-Z_] as the first char after $ so $100 stays literal.
-// Two capture groups: (1) ${VAR} form, (2) $VAR form.
-var envVarRefPattern = regexp.MustCompile(`\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}|\$([a-zA-Z_][a-zA-Z0-9_]*)`)
+var envVarRefPattern = regexp.MustCompile(`\$\{?[A-Za-z_][A-Za-z0-9_]*\}?`)
 
 // hasUnresolvedVarRef returns true if the original string had a ${VAR} or $VAR
 // reference that the expanded string didn't fully replace (i.e. the var was unset).
@@ -80,103 +78,17 @@ func hasUnresolvedVarRef(original, expanded string) bool {
 }
 
 // expandWithEnv expands ${VAR} and $VAR references in s using the env map.
-// Falls back to the platform process env only when the whole value is a
-// single variable reference; embedded process-env expansion is too broad for
-// imported org YAML because host variables such as HOME are not template data.
+// Falls back to the platform process env if a var isn't in the map.
 func expandWithEnv(s string, env map[string]string) string {
-	if s == "" {
-		return ""
-	}
-	var b strings.Builder
-	for i := 0; i < len(s); {
-		if s[i] != '$' {
-			b.WriteByte(s[i])
-			i++
-			continue
+	return os.Expand(s, func(key string) string {
+		if v, ok := env[key]; ok {
+			return v
 		}
-
-		if i+1 >= len(s) {
-			b.WriteByte('$')
-			i++
-			continue
-		}
-
-		if s[i+1] == '{' {
-			end := strings.IndexByte(s[i+2:], '}')
-			if end < 0 {
-				b.WriteByte('$')
-				i++
-				continue
-			}
-			end += i + 2
-			key := s[i+2 : end]
-			ref := s[i : end+1]
-			b.WriteString(expandEnvRef(key, ref, s, env))
-			i = end + 1
-			continue
-		}
-
-		if !isEnvIdentStart(s[i+1]) {
-			b.WriteByte('$')
-			i++
-			continue
-		}
-		j := i + 2
-		for j < len(s) && isEnvIdentPart(s[j]) {
-			j++
-		}
-		key := s[i+1 : j]
-		ref := s[i:j]
-		b.WriteString(expandEnvRef(key, ref, s, env))
-		i = j
-	}
-	return b.String()
-}
-
-// expandEnvRef resolves a single variable reference extracted from s.
-//
-// Guards:
-//   - Empty key → "$$" escape, return "$"
-//   - key[0] not POSIX ident start → "$" + partial chars, return "$<chars>"
-//   - Key in env map → return the mapped value (template override wins)
-//   - Otherwise → only fall back to os.Getenv if the whole input string IS the
-//     variable reference (ref == whole).
-//
-// Bare $VAR format:
-//   $HOME (alone) → ref==whole → os.Getenv ✓  (host HOME is org-template HOME)
-//   $HOME/path (partial) → ref!=whole → literal "$HOME" ✓  (CWE-78: prevents host leak)
-//
-// Braced ${VAR} format:
-//   ${HOME} (alone) → ref==whole → os.Getenv ✓
-//   ${ROLE}/admin (partial) → ref!=whole → literal ✓
-//   "yes and ${NOT_SET}" (embedded) → ref!=whole → literal ✓
-//
-// This is the CWE-78 fix from commit a3a358f9.
-func expandEnvRef(key, ref, whole string, env map[string]string) string {
-	if key == "" {
-		return "$"
-	}
-	if !isEnvIdentStart(key[0]) {
-		return "$" + key
-	}
-	if v, ok := env[key]; ok {
-		return v
-	}
-	if ref == whole {
 		return os.Getenv(key)
-	}
-	return ref
+	})
 }
 
-func isEnvIdentStart(c byte) bool {
-	return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c == '_'
-}
-
-func isEnvIdentPart(c byte) bool {
-	return isEnvIdentStart(c) || (c >= '0' && c <= '9')
-}
-
-// loadWorkspaceEnv reads the org root .env and the workspace-specific .env .env and the workspace-specific .env
+// loadWorkspaceEnv reads the org root .env and the workspace-specific .env
 // (workspace overrides org root). Used by both secret injection and channel
 // config expansion.
 //
@@ -428,11 +340,7 @@ func resolveInsideRoot(root, userPath string) (string, error) {
 		return "", fmt.Errorf("root abs: %w", err)
 	}
 	joined := filepath.Join(absRoot, userPath)
-	// filepath.Join preserves "." components when root is absolute; clean
-	// them before computing the final absolute path so "./subdir/./file.txt"
-	// resolves to root/subdir/file.txt (not root/./subdir/./file.txt).
-	cleaned := filepath.Clean(joined)
-	absJoined, err := filepath.Abs(cleaned)
+	absJoined, err := filepath.Abs(joined)
 	if err != nil {
 		return "", fmt.Errorf("joined abs: %w", err)
 	}

workspace-server/internal/handlers/org_helpers_loadWorkspaceEnv_test.go

@@ -1,126 +0,0 @@
-package handlers
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// setupOrgEnv creates a temp dir with an optional org .env file and returns the dir.
-func setupOrgEnv(t *testing.T, orgEnvContent string) string {
-	t.Helper()
-	dir := t.TempDir()
-	if orgEnvContent != "" {
-		require.NoError(t, os.WriteFile(filepath.Join(dir, ".env"), []byte(orgEnvContent), 0o600))
-	}
-	return dir
-}
-
-func Test_loadWorkspaceEnv_orgRootOnly(t *testing.T) {
-	org := setupOrgEnv(t, "ORG_VAR=orgval\nORG_DEBUG=true")
-	vars := loadWorkspaceEnv(org, "")
-	assert.Equal(t, "orgval", vars["ORG_VAR"])
-	assert.Equal(t, "true", vars["ORG_DEBUG"])
-}
-
-func Test_loadWorkspaceEnv_orgRootMissing(t *testing.T) {
-	// No .env at org root — should return empty map without error.
-	dir := t.TempDir()
-	vars := loadWorkspaceEnv(dir, "")
-	assertEmpty(t, vars)
-}
-
-func Test_loadWorkspaceEnv_workspaceEnvMerges(t *testing.T) {
-	org := setupOrgEnv(t, "SHARED=sharedval\nORG_ONLY=orgonly")
-	wsDir := filepath.Join(org, "myworkspace")
-	require.NoError(t, os.MkdirAll(wsDir, 0o700))
-	require.NoError(t, os.WriteFile(filepath.Join(wsDir, ".env"), []byte("WS_VAR=wsval\nSHARED=overridden"), 0o600))
-
-	vars := loadWorkspaceEnv(org, "myworkspace")
-	assert.Equal(t, "wsval", vars["WS_VAR"])
-	assert.Equal(t, "overridden", vars["SHARED"]) // workspace overrides org
-	assert.Equal(t, "orgonly", vars["ORG_ONLY"])   // org vars preserved
-}
-
-func Test_loadWorkspaceEnv_emptyFilesDir(t *testing.T) {
-	org := setupOrgEnv(t, "VAR=val")
-	vars := loadWorkspaceEnv(org, "")
-	assert.Equal(t, "val", vars["VAR"])
-}
-
-func Test_loadWorkspaceEnv_traversalRejects(t *testing.T) {
-	// #321 / CWE-22: filesDir "../../../etc" must not escape the org root.
-	// resolveInsideRoot rejects the traversal so workspace .env is skipped;
-	// org root .env is still loaded (it's before the guard).
-	org := setupOrgEnv(t, "INNOCENT=val\nSAFE_WS=wsval")
-	parent := filepath.Dir(org)
-	require.NoError(t, os.WriteFile(filepath.Join(parent, ".env"), []byte("MALICIOUS=evil"), 0o600))
-	// Also create a workspace dir inside org to prove it IS accessible normally.
-	wsDir := filepath.Join(org, "legit-workspace")
-	require.NoError(t, os.MkdirAll(wsDir, 0o700))
-	require.NoError(t, os.WriteFile(filepath.Join(wsDir, ".env"), []byte("WS_SECRET=ssh-key-123"), 0o600))
-
-	// Traversal is blocked.
-	vars := loadWorkspaceEnv(org, "../../../etc")
-	// Org root vars present; workspace vars blocked.
-	assert.Equal(t, "val", vars["INNOCENT"])
-	assert.Equal(t, "wsval", vars["SAFE_WS"]) // from org root .env
-	assert.Empty(t, vars["WS_SECRET"])        // workspace .env blocked by traversal guard
-	_, hasEvil := vars["MALICIOUS"]
-	assert.False(t, hasEvil, "MALICIOUS from escaped path must not appear")
-}
-
-func Test_loadWorkspaceEnv_traversalWithDots(t *testing.T) {
-	// A sibling-traversal attempt: go up one level then into a sibling dir.
-	// The sibling dir is NOT inside org, so it must be rejected.
-	org := setupOrgEnv(t, "INNOCENT=val")
-	parent := filepath.Dir(org)
-	require.NoError(t, os.MkdirAll(filepath.Join(parent, "sibling"), 0o700))
-	require.NoError(t, os.WriteFile(filepath.Join(parent, "sibling/.env"), []byte("LEAKED=secret"), 0o600))
-
-	vars := loadWorkspaceEnv(org, "../sibling")
-	// Org vars loaded; sibling vars blocked.
-	assert.Equal(t, "val", vars["INNOCENT"])
-	assert.Empty(t, vars["LEAKED"], "sibling traversal must be rejected")
-}
-
-func Test_loadWorkspaceEnv_absolutePathRejected(t *testing.T) {
-	// Absolute paths are rejected outright by resolveInsideRoot.
-	org := setupOrgEnv(t, "INNOCENT=val")
-	vars := loadWorkspaceEnv(org, "/etc")
-	assert.Equal(t, "val", vars["INNOCENT"]) // org root still loaded
-	assert.Empty(t, vars["SAFE_WS"])
-}
-
-func Test_loadWorkspaceEnv_dotPathRejected(t *testing.T) {
-	// "." resolves to the org root itself — this is NOT a traversal but
-	// would create org-root/.env which is the org root .env, not a
-	// workspace .env. resolveInsideRoot accepts this; the workspace .env
-	// path is org/.env, which IS the org root .env (already loaded).
-	// So the correct result is the org vars (same as org root, no change).
-	org := setupOrgEnv(t, "INNOCENT=val")
-	vars := loadWorkspaceEnv(org, ".")
-	// "." passes resolveInsideRoot (resolves to org root, which is valid).
-	// But workspace path org/.env is the same as org/.env already loaded.
-	assert.Equal(t, "val", vars["INNOCENT"])
-}
-
-func Test_loadWorkspaceEnv_emptyOrgRootReturnsEmpty(t *testing.T) {
-	vars := loadWorkspaceEnv("", "some/dir")
-	assertEmpty(t, vars)
-}
-
-func Test_loadWorkspaceEnv_missingWorkspaceDir(t *testing.T) {
-	org := setupOrgEnv(t, "ORG=val")
-	// Workspace dir doesn't exist — org vars still loaded.
-	vars := loadWorkspaceEnv(org, "nonexistent")
-	assert.Equal(t, "val", vars["ORG"])
-}
-
-func assertEmpty(t *testing.T, m map[string]string) {
-	t.Helper()
-	assert.Equal(t, 0, len(m), "expected empty map, got %v", m)
-}

workspace-server/internal/handlers/org_helpers_pure_test.go

@@ -1,723 +0,0 @@
-package handlers
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// ── isSafeRoleName ────────────────────────────────────────────────────────────
-
-func TestIsSafeRoleName_Valid(t *testing.T) {
-	cases := []string{
-		"backend",
-		"frontend",
-		"backend-engineer",
-		"Frontend_Engineer",
-		"DevOps123",
-		"sre-team",
-		"a",
-		"ABC",
-		"Role_With_Underscores_And-Numbers123",
-	}
-	for _, r := range cases {
-		t.Run(r, func(t *testing.T) {
-			if !isSafeRoleName(r) {
-				t.Errorf("isSafeRoleName(%q): expected true, got false", r)
-			}
-		})
-	}
-}
-
-func TestIsSafeRoleName_Invalid(t *testing.T) {
-	cases := []struct {
-		name string
-		role string
-	}{
-		{"empty", ""},
-		{"dot", "."},
-		{"double dot", ".."},
-		{"path separator", "backend/engineer"},
-		{"space", "backend engineer"},
-		{"special char", "backend@engineer"},
-		{"at sign", "role@team"},
-		{"colon", "role:admin"},
-		{"hash", "role#1"},
-		{"percent", "role%20"},
-		{"quote", `role"name`},
-		{"backslash", `role\name`},
-		{"tilde", "role~test"},
-		{"backtick", "`role"},
-		{"bracket open", "[role]"},
-		{"bracket close", "role]"},
-		{"plus", "role+admin"},
-		{"equals", "role=admin"},
-		{"caret", "role^admin"},
-		{"question mark", "role?"},
-		{"pipe at end", "role|"},
-		{"greater than", "role>"},
-		{"asterisk", "role*"},
-		{"ampersand", "role&"},
-		{"exclamation at end", "role!"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if isSafeRoleName(tc.role) {
-				t.Errorf("isSafeRoleName(%q): expected false, got true", tc.role)
-			}
-		})
-	}
-}
-
-// ── hasUnresolvedVarRef ───────────────────────────────────────────────────────
-
-func TestHasUnresolvedVarRef_NoVars(t *testing.T) {
-	cases := []string{
-		"",
-		"plain text",
-		"no variables here",
-		"123 numeric",
-		"$",
-		"${}",
-		"$5",
-		"$$$$",
-	}
-	for _, s := range cases {
-		t.Run(s, func(t *testing.T) {
-			if hasUnresolvedVarRef(s, s) {
-				t.Errorf("hasUnresolvedVarRef(%q, %q): expected false, got true", s, s)
-			}
-		})
-	}
-}
-
-func TestHasUnresolvedVarRef_Resolved(t *testing.T) {
-	// Expansion consumed the var refs (where "consumed" means the output no longer
-	// contains the original var reference syntax).
-	cases := []struct {
-		orig     string
-		expanded string
-		want     bool // true = unresolved (function returns true), false = resolved
-	}{
-		// Empty output: function conservatively returns true — it cannot distinguish
-		// "var was set to empty" from "var was not found and stripped". The test
-		// documents this design choice; callers who need empty=resolved should
-		// pre-process the output before calling hasUnresolvedVarRef.
-		{"${VAR}", "", true},
-		{"${VAR}", "value", false},                    // var replaced
-		{"$VAR", "value", false},                      // bare var replaced
-		{"prefix${VAR}suffix", "prefixvaluesuffix", false},
-		{"${A}${B}", "ab", false},
-		// FOO=FOO and BAR=BAR — both vars found and replaced. Expanded output
-		// "FOO and BAR" has no ${...} syntax left, so function returns false.
-		{"${FOO} and ${BAR}", "FOO and BAR", false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.orig, func(t *testing.T) {
-			got := hasUnresolvedVarRef(tc.orig, tc.expanded)
-			if got != tc.want {
-				t.Errorf("hasUnresolvedVarRef(%q, %q): got %v, want %v", tc.orig, tc.expanded, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestHasUnresolvedVarRef_Unresolved(t *testing.T) {
-	// Expansion left the refs intact → unresolved.
-	cases := []struct {
-		orig    string
-		expanded string
-	}{
-		{"${VAR}", "${VAR}"},       // untouched
-		{"$VAR", "$VAR"},           // bare untouched
-		{"prefix${VAR}suffix", "prefix${VAR}suffix"},
-		{"${A}${B}", "${A}${B}"},   // both unresolved
-		{"${FOO}", ""},             // empty result with var ref in original
-	}
-	for _, tc := range cases {
-		t.Run(tc.orig, func(t *testing.T) {
-			if !hasUnresolvedVarRef(tc.orig, tc.expanded) {
-				t.Errorf("hasUnresolvedVarRef(%q, %q): expected true, got false", tc.orig, tc.expanded)
-			}
-		})
-	}
-}
-
-// ── expandWithEnv ─────────────────────────────────────────────────────────────
-
-func TestExpandWithEnv_Basic(t *testing.T) {
-	env := map[string]string{"FOO": "bar", "BAZ": "qux"}
-	cases := []struct {
-		input string
-		want  string
-	}{
-		{"", ""},
-		{"no vars", "no vars"},
-		{"${FOO}", "bar"},
-		{"$FOO", "bar"},
-		{"prefix${FOO}suffix", "prefixbarsuffix"},
-		{"${FOO}${BAZ}", "barqux"},
-		{"${MISSING}", ""}, // not in env, not in os env → empty
-	}
-	for _, tc := range cases {
-		t.Run(tc.input, func(t *testing.T) {
-			got := expandWithEnv(tc.input, env)
-			if got != tc.want {
-				t.Errorf("expandWithEnv(%q, %v) = %q, want %q", tc.input, env, got, tc.want)
-			}
-		})
-	}
-}
-
-// ── mergeCategoryRouting ─────────────────────────────────────────────────────
-
-func TestMergeCategoryRouting_EmptyInputs(t *testing.T) {
-	// Both empty → empty
-	r := mergeCategoryRouting(nil, nil)
-	if len(r) != 0 {
-		t.Errorf("mergeCategoryRouting(nil, nil): got %v, want empty", r)
-	}
-
-	r = mergeCategoryRouting(map[string][]string{}, map[string][]string{})
-	if len(r) != 0 {
-		t.Errorf("mergeCategoryRouting({}, {}): got %v, want empty", r)
-	}
-}
-
-func TestMergeCategoryRouting_DefaultsOnly(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer", "DevOps"},
-		"ui":       {"Frontend Engineer"},
-		"data":     {"Data Engineer"},
-	}
-	r := mergeCategoryRouting(defaults, nil)
-	if len(r) != 3 {
-		t.Errorf("got %d keys, want 3", len(r))
-	}
-	if len(r["security"]) != 2 {
-		t.Errorf("security roles: got %v, want 2", r["security"])
-	}
-}
-
-func TestMergeCategoryRouting_WorkspaceOverrides(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer", "DevOps"},
-		"ui":       {"Frontend Engineer"},
-	}
-	ws := map[string][]string{
-		"security": {"SRE Team"}, // narrows
-		"ui":       {},           // drops
-		"infra":    {"Platform Team"}, // adds
-	}
-	r := mergeCategoryRouting(defaults, ws)
-	if len(r["security"]) != 1 || r["security"][0] != "SRE Team" {
-		t.Errorf("security: got %v, want [SRE Team]", r["security"])
-	}
-	if _, ok := r["ui"]; ok {
-		t.Errorf("ui should be dropped, got %v", r["ui"])
-	}
-	if len(r["infra"]) != 1 || r["infra"][0] != "Platform Team" {
-		t.Errorf("infra: got %v, want [Platform Team]", r["infra"])
-	}
-}
-
-func TestMergeCategoryRouting_EmptyListDrops(t *testing.T) {
-	defaults := map[string][]string{"foo": {"A", "B"}}
-	ws := map[string][]string{"foo": {}}
-	r := mergeCategoryRouting(defaults, ws)
-	if _, ok := r["foo"]; ok {
-		t.Errorf("foo with empty ws list: should be dropped, got %v", r["foo"])
-	}
-}
-
-func TestMergeCategoryRouting_EmptyKeySkipped(t *testing.T) {
-	defaults := map[string][]string{"": {"Role"}}
-	ws := map[string][]string{"": {}}
-	r := mergeCategoryRouting(defaults, ws)
-	if _, ok := r[""]; ok {
-		t.Errorf("empty key should be skipped, got %v", r[""])
-	}
-}
-
-// ── renderCategoryRoutingYAML ────────────────────────────────────────────────
-
-func TestRenderCategoryRoutingYAML_Empty(t *testing.T) {
-	out, err := renderCategoryRoutingYAML(nil)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if out != "" {
-		t.Errorf("got %q, want empty string", out)
-	}
-
-	out, err = renderCategoryRoutingYAML(map[string][]string{})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if out != "" {
-		t.Errorf("got %q, want empty string", out)
-	}
-}
-
-func TestRenderCategoryRoutingYAML_StableOrdering(t *testing.T) {
-	// Keys are sorted so output is deterministic regardless of map iteration order.
-	m := map[string][]string{
-		"zebra":  {"A"},
-		"alpha":  {"B"},
-		"middle": {"C"},
-	}
-	out, err := renderCategoryRoutingYAML(m)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	// alpha must come before middle, which must come before zebra
-	ai := 0
-	zi := 0
-	mi := 0
-	for i, c := range out {
-		switch {
-		case c == 'a' && i < len(out)-5 && out[i:i+5] == "alpha":
-			ai = i
-		case c == 'z' && i < len(out)-5 && out[i:i+5] == "zebra":
-			zi = i
-		case c == 'm' && i < len(out)-6 && out[i:i+6] == "middle":
-			mi = i
-		}
-	}
-	if ai <= 0 || zi <= 0 || mi <= 0 {
-		t.Fatalf("could not locate all keys in output: %s", out)
-	}
-	if ai >= mi || mi >= zi {
-		t.Errorf("keys not sorted: alpha=%d middle=%d zebra=%d, output:\n%s", ai, mi, zi, out)
-	}
-}
-
-func TestRenderCategoryRoutingYAML_SpecialCharsEscaped(t *testing.T) {
-	// YAML library should escape characters that need quoting.
-	m := map[string][]string{
-		"key:with:colons": {"Role: Admin"},
-		"key with space":  {"Role"},
-	}
-	out, err := renderCategoryRoutingYAML(m)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	// The output must be valid YAML (yaml.Marshal handles quoting).
-	// The key with colons should appear quoted in the output.
-	if out == "" {
-		t.Error("output is empty")
-	}
-}
-
-// ── appendYAMLBlock ───────────────────────────────────────────────────────────
-
-func TestAppendYAMLBlock_NoExisting(t *testing.T) {
-	got := appendYAMLBlock(nil, "key: value")
-	if string(got) != "key: value" {
-		t.Errorf("got %q, want 'key: value'", string(got))
-	}
-}
-
-func TestAppendYAMLBlock_EmptyBlock(t *testing.T) {
-	// When existing lacks a trailing \n, the function adds one before appending
-	// the empty block — so the result always has a clean terminator.
-	got := appendYAMLBlock([]byte("existing: data"), "")
-	want := "existing: data\n"
-	if string(got) != want {
-		t.Errorf("got %q, want %q", string(got), want)
-	}
-}
-
-func TestAppendYAMLBlock_AppendsWithNewline(t *testing.T) {
-	existing := []byte("key: value")
-	block := "new: entry"
-	got := appendYAMLBlock(existing, block)
-	want := "key: value\nnew: entry"
-	if string(got) != want {
-		t.Errorf("got %q, want %q", string(got), want)
-	}
-}
-
-func TestAppendYAMLBlock_AlreadyEndsWithNewline(t *testing.T) {
-	existing := []byte("key: value\n")
-	block := "new: entry"
-	got := appendYAMLBlock(existing, block)
-	want := "key: value\nnew: entry"
-	if string(got) != want {
-		t.Errorf("got %q, want %q", string(got), want)
-	}
-}
-
-// ── mergePlugins ─────────────────────────────────────────────────────────────
-
-func TestMergePlugins_EmptyInputs(t *testing.T) {
-	r := mergePlugins(nil, nil)
-	if len(r) != 0 {
-		t.Errorf("got %v, want []", r)
-	}
-	r = mergePlugins([]string{}, []string{})
-	if len(r) != 0 {
-		t.Errorf("got %v, want []", r)
-	}
-}
-
-func TestMergePlugins_BasicMerge(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	ws := []string{"plugin-b", "plugin-c"}
-	r := mergePlugins(defaults, ws)
-	// defaults first, ws appended, b deduplicated
-	if len(r) != 3 {
-		t.Errorf("got %v, want 3 items", r)
-	}
-	if r[0] != "plugin-a" || r[1] != "plugin-b" || r[2] != "plugin-c" {
-		t.Errorf("got %v, want [a, b, c]", r)
-	}
-}
-
-func TestMergePlugins_ExcludeWithBang(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b", "plugin-c"}
-	ws := []string{"!plugin-b"}
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 {
-		t.Errorf("got %v, want 2 items", r)
-	}
-	if r[0] != "plugin-a" || r[1] != "plugin-c" {
-		t.Errorf("got %v, want [a, c]", r)
-	}
-}
-
-func TestMergePlugins_ExcludeWithDash(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b", "plugin-c"}
-	ws := []string{"-plugin-b"}
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 || r[0] != "plugin-a" || r[1] != "plugin-c" {
-		t.Errorf("got %v, want [a, c]", r)
-	}
-}
-
-func TestMergePlugins_ExcludeNonexistent(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	ws := []string{"!plugin-c"} // c not present
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 {
-		t.Errorf("got %v, want 2 items", r)
-	}
-}
-
-func TestMergePlugins_ExcludeEmptyTarget(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	ws := []string{"!"}
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 {
-		t.Errorf("got %v, want 2 items", r)
-	}
-}
-
-func TestMergePlugins_EmptyPlugin(t *testing.T) {
-	defaults := []string{"", "plugin-a", ""}
-	ws := []string{"plugin-b", ""}
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 {
-		t.Errorf("got %v, want 2 items", r)
-	}
-}
-
-// ── Additional coverage: expandWithEnv ──────────────────────────────
-func TestExpandWithEnv_BracedVar(t *testing.T) {
-	env := map[string]string{"FOO": "bar", "BAZ": "qux"}
-	result := expandWithEnv("value is ${FOO}", env)
-	assert.Equal(t, "value is bar", result)
-}
-
-func TestExpandWithEnv_DollarVar(t *testing.T) {
-	env := map[string]string{"X": "1", "Y": "2"}
-	result := expandWithEnv("$X + $Y = 3", env)
-	assert.Equal(t, "1 + 2 = 3", result)
-}
-
-func TestExpandWithEnv_Mixed(t *testing.T) {
-	env := map[string]string{"A": "alpha", "B": "beta"}
-	result := expandWithEnv("${A}_${B}", env)
-	assert.Equal(t, "alpha_beta", result)
-}
-
-func TestExpandWithEnv_MissingVar(t *testing.T) {
-	// Missing vars stay as-is (os.Getenv fallback returns "" for unset vars).
-	env := map[string]string{}
-	result := expandWithEnv("${UNSET}", env)
-	assert.Equal(t, "", result)
-}
-
-func TestExpandWithEnv_EmptyMap(t *testing.T) {
-	result := expandWithEnv("no vars here", map[string]string{})
-	assert.Equal(t, "no vars here", result)
-}
-
-func TestExpandWithEnv_LiteralDollar(t *testing.T) {
-	// A bare $ not followed by a valid identifier char stays as-is.
-	result := expandWithEnv("cost $100", map[string]string{})
-	assert.Equal(t, "cost $100", result)
-}
-
-func TestExpandWithEnv_PartiallyPresent(t *testing.T) {
-	env := map[string]string{"SET": "yes"}
-	result := expandWithEnv("${SET} and ${NOT_SET}", env)
-	// ${SET} resolved from env; ${NOT_SET} stays literal (not whole-string ref,
-	// so os.Getenv fallback is NOT used — CWE-78 regression guard).
-	assert.Equal(t, "yes and ${NOT_SET}", result)
-}
-
-// mergeCategoryRouting tests — unions defaults with per-workspace routing.
-
-// ── Additional coverage: mergeCategoryRouting ──────────────────────
-func TestMergeCategoryRouting_WorkspaceAddsCategory(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer"},
-	}
-	wsRouting := map[string][]string{
-		"ui": {"Frontend Engineer"},
-	}
-	result := mergeCategoryRouting(defaults, wsRouting)
-	assert.Equal(t, []string{"Backend Engineer"}, result["security"])
-	assert.Equal(t, []string{"Frontend Engineer"}, result["ui"])
-}
-
-func TestMergeCategoryRouting_EmptyListDropsCategory(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer"},
-		"infra":    {"SRE"},
-	}
-	wsRouting := map[string][]string{
-		"security": {}, // empty list = explicit drop
-	}
-	result := mergeCategoryRouting(defaults, wsRouting)
-	_, hasSecurity := result["security"]
-	assert.False(t, hasSecurity)
-	assert.Equal(t, []string{"SRE"}, result["infra"])
-}
-
-func TestMergeCategoryRouting_EmptyDefaultKeySkipped(t *testing.T) {
-	defaults := map[string][]string{
-		"": {"Backend Engineer"}, // empty key should be skipped
-	}
-	result := mergeCategoryRouting(defaults, nil)
-	_, has := result[""]
-	assert.False(t, has)
-}
-
-func TestMergeCategoryRouting_EmptyWorkspaceKeySkipped(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer"},
-	}
-	wsRouting := map[string][]string{
-		"": {"Some Role"},
-	}
-	result := mergeCategoryRouting(defaults, wsRouting)
-	_, has := result[""]
-	assert.False(t, has)
-	assert.Equal(t, []string{"Backend Engineer"}, result["security"])
-}
-
-func TestMergeCategoryRouting_DoesNotMutateInputs(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer"},
-	}
-	wsRouting := map[string][]string{
-		"security": {"DevOps"},
-	}
-	orig := defaults["security"][0]
-	_ = mergeCategoryRouting(defaults, wsRouting)
-	assert.Equal(t, orig, defaults["security"][0])
-}
-
-// renderCategoryRoutingYAML tests — deterministic YAML emission.
-
-// ── Additional coverage: renderCategoryRoutingYAML ────────────────
-func TestRenderCategoryRoutingYAML_SingleCategory(t *testing.T) {
-	routing := map[string][]string{
-		"security": {"Backend Engineer", "DevOps"},
-	}
-	result, err := renderCategoryRoutingYAML(routing)
-	assert.NoError(t, err)
-	assert.Contains(t, result, "security:")
-	assert.Contains(t, result, "Backend Engineer")
-	assert.Contains(t, result, "DevOps")
-}
-
-func TestRenderCategoryRoutingYAML_MultipleCategoriesSorted(t *testing.T) {
-	routing := map[string][]string{
-		"zebra":   {"RoleZ"},
-		"alpha":   {"RoleA"},
-		"middleware": {"RoleM"},
-	}
-	result, err := renderCategoryRoutingYAML(routing)
-	assert.NoError(t, err)
-	// Keys are sorted alphabetically.
-	idxAlpha := assertFind(t, result, "alpha:")
-	idxZebra := assertFind(t, result, "zebra:")
-	idxMid := assertFind(t, result, "middleware:")
-	if idxAlpha > -1 && idxZebra > -1 {
-		assert.True(t, idxAlpha < idxZebra, "alpha should appear before zebra")
-	}
-	if idxMid > -1 && idxZebra > -1 {
-		assert.True(t, idxMid < idxZebra, "middleware should appear before zebra")
-	}
-}
-
-func TestRenderCategoryRoutingYAML_EmptyListCategory(t *testing.T) {
-	// Empty-list category should still render (mergeCategoryRouting drops
-	// them before they reach this function, but we test the render in isolation).
-	routing := map[string][]string{
-		"security": {},
-	}
-	result, err := renderCategoryRoutingYAML(routing)
-	assert.NoError(t, err)
-	assert.Contains(t, result, "security:")
-}
-
-func TestRenderCategoryRoutingYAML_SpecialCharactersEscaped(t *testing.T) {
-	routing := map[string][]string{
-		"notes": {`has: colon`, `and "quotes"`, "emoji: 🚀"},
-	}
-	result, err := renderCategoryRoutingYAML(routing)
-	assert.NoError(t, err)
-	// Should not panic and should produce valid YAML.
-	assert.Contains(t, result, "notes:")
-}
-
-// appendYAMLBlock tests — safe concatenation with newline boundary.
-
-// ── Additional coverage: appendYAMLBlock ───────────────────────────
-func TestAppendYAMLBlock_BothEmpty(t *testing.T) {
-	result := appendYAMLBlock(nil, "")
-	assert.Nil(t, result) // append(nil, []byte("")...) returns nil in Go
-}
-
-func TestAppendYAMLBlock_ExistingHasNewline(t *testing.T) {
-	existing := []byte("existing:\n")
-	block := "key: value\n"
-	result := appendYAMLBlock(existing, block)
-	assert.Equal(t, "existing:\nkey: value\n", string(result))
-}
-
-func TestAppendYAMLBlock_ExistingNoNewline(t *testing.T) {
-	existing := []byte("existing:")
-	block := "key: value\n"
-	result := appendYAMLBlock(existing, block)
-	assert.Equal(t, "existing:\nkey: value\n", string(result))
-}
-
-func TestAppendYAMLBlock_ExistingEmpty(t *testing.T) {
-	existing := []byte("")
-	block := "key: value\n"
-	result := appendYAMLBlock(existing, block)
-	assert.Equal(t, "key: value\n", string(result))
-}
-
-func TestAppendYAMLBlock_NilExisting(t *testing.T) {
-	block := "key: value\n"
-	result := appendYAMLBlock(nil, block)
-	assert.Equal(t, "key: value\n", string(result))
-}
-
-// mergePlugins tests — union with exclusion prefix (!/-).
-
-// ── Additional coverage: mergePlugins (additional cases) ───────────
-func TestMergePlugins_DefaultsOnly(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	result := mergePlugins(defaults, nil)
-	assert.Equal(t, []string{"plugin-a", "plugin-b"}, result)
-}
-
-func TestMergePlugins_WorkspaceAdds(t *testing.T) {
-	defaults := []string{"plugin-a"}
-	wsPlugins := []string{"plugin-b", "plugin-a"} // duplicate of default
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-b"}, result)
-}
-
-func TestMergePlugins_ExclusionWithBang(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b", "plugin-c"}
-	wsPlugins := []string{"!plugin-b"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-c"}, result)
-}
-
-func TestMergePlugins_ExclusionWithDash(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b", "plugin-c"}
-	wsPlugins := []string{"-plugin-b"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-c"}, result)
-}
-
-func TestMergePlugins_ExclusionEmptyTarget(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	wsPlugins := []string{"!", "-"} // no-op exclusions
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-b"}, result)
-}
-
-func TestMergePlugins_ExclusionNotInDefaults(t *testing.T) {
-	// Excluding something not in defaults is a no-op.
-	defaults := []string{"plugin-a"}
-	wsPlugins := []string{"!plugin-b"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a"}, result)
-}
-
-func TestMergePlugins_WorkspaceAddsNew(t *testing.T) {
-	defaults := []string{"plugin-a"}
-	wsPlugins := []string{"plugin-b"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-b"}, result)
-}
-
-func TestMergePlugins_DeduplicationOrder(t *testing.T) {
-	// Defaults first; workspace entries deduplicated.
-	defaults := []string{"plugin-a", "plugin-a", "plugin-b"}
-	wsPlugins := []string{"plugin-b", "plugin-c", "plugin-c"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-b", "plugin-c"}, result)
-}
-
-func TestMergePlugins_ExclusionThenAddSameName(t *testing.T) {
-	// Remove then re-add: order matters.
-	defaults := []string{"plugin-a", "plugin-b"}
-	wsPlugins := []string{"!plugin-a", "plugin-a"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-b", "plugin-a"}, result)
-}
-
-// isSafeRoleName tests — alphanumeric + hyphen/underscore, no path separators.
-
-// ── Additional coverage: isSafeRoleName ───────────────────────────
-func TestIsSafeRoleName_SpecialCharsRejected(t *testing.T) {
-	bad := []string{
-		"role@name",
-		"role#name",
-		"role$name",
-		"role%name",
-		"role&name",
-		"role*name",
-		"role?name",
-		"role=name",
-	}
-	for _, r := range bad {
-		if isSafeRoleName(r) {
-			t.Errorf("isSafeRoleName(%q) expected false, got true", r)
-		}
-	}
-}
-
-// assertFind is a helper: returns index of first occurrence of substr in s, or -1.
-func assertFind(t *testing.T, s, substr string) int {
-	t.Helper()
-	idx := -1
-	for i := 0; i <= len(s)-len(substr); i++ {
-		if s[i:i+len(substr)] == substr {
-			idx = i
-			break
-		}
-	}
-	return idx
-}

workspace-server/internal/handlers/org_helpers_security_test.go

@@ -93,7 +93,7 @@ func TestResolveInsideRoot_DotPathComponent(t *testing.T) {
 	if err != nil {
 		t.Fatalf("dot path component: unexpected error: %v", err)
 	}
-	if !strings.HasSuffix(got, "/subdir/file.txt") {
+	if got[len(got)-14:] != "/subdir/file.txt" {
 		t.Errorf("dot path component: got %q, want suffix /subdir/file.txt", got)
 	}
 }
@@ -276,121 +276,3 @@ func TestMergeCategoryRouting_OriginalMapsUnmodified(t *testing.T) {
 		t.Error("ws routing should be unmodified after merge")
 	}
 }
-
-// ── expandWithEnv ─────────────────────────────────────────────────────────────
-//
-// CWE-78 regression tests. The original fix (a3a358f9) ensures that partial
-// variable references like $HOME/path are NOT resolved via os.Getenv — the
-// host HOME env var must not leak into org template values. Only whole-string
-// references ($VAR or ${VAR}) may fall back to the host process environment.
-
-func TestExpandWithEnv_PartialRefDollarHomePath(t *testing.T) {
-	// $HOME/path must NOT resolve to the host's HOME env var.
-	// The literal $HOME must be returned as-is.
-	got := expandWithEnv("$HOME/path", nil)
-	if got != "$HOME/path" {
-		t.Errorf("$HOME/path: got %q, want literal $HOME/path", got)
-	}
-}
-
-func TestExpandWithEnv_PartialRefBracedRoleAdmin(t *testing.T) {
-	// ${ROLE}/admin — ROLE is not in env, so expand to the literal ${ROLE}/admin.
-	got := expandWithEnv("${ROLE}/admin", nil)
-	if got != "${ROLE}/admin" {
-		t.Errorf("${ROLE}/admin: got %q, want literal ${ROLE}/admin", got)
-	}
-}
-
-func TestExpandWithEnv_PartialRefMiddleOfString(t *testing.T) {
-	// $ROLE in the middle of a string — literal, not os.Getenv.
-	got := expandWithEnv("prefix/$ROLE/suffix", nil)
-	if got != "prefix/$ROLE/suffix" {
-		t.Errorf("prefix/$ROLE/suffix: got %q, want literal", got)
-	}
-}
-
-func TestExpandWithEnv_WholeVarInEnv(t *testing.T) {
-	// Whole-string $VAR that IS in env — env value wins.
-	env := map[string]string{"FOO": "barvalue"}
-	got := expandWithEnv("$FOO", env)
-	if got != "barvalue" {
-		t.Errorf("$FOO with FOO=barvalue: got %q, want barvalue", got)
-	}
-}
-
-func TestExpandWithEnv_WholeVarBracedInEnv(t *testing.T) {
-	// Whole-string ${VAR} that IS in env — env value wins.
-	env := map[string]string{"FOO": "barvalue"}
-	got := expandWithEnv("${FOO}", env)
-	if got != "barvalue" {
-		t.Errorf("${FOO} with FOO=barvalue: got %q, want barvalue", got)
-	}
-}
-
-func TestExpandWithEnv_WholeVarNotInEnvBare(t *testing.T) {
-	// Whole-string $VAR not in env — falls back to os.Getenv.
-	// If the host has the var, we get the host value. If not, empty.
-	// At minimum, the result must NOT be the literal "$UNDEFINED_VAR_9Z".
-	got := expandWithEnv("$UNDEFINED_VAR_9Z", nil)
-	if got == "$UNDEFINED_VAR_9Z" {
-		t.Errorf("$UNDEFINED_VAR_9Z: should expand (whole-string fallback to os.Getenv), got literal")
-	}
-}
-
-func TestExpandWithEnv_WholeVarNotInEnvBraced(t *testing.T) {
-	// Whole-string ${VAR} not in env — falls back to os.Getenv.
-	got := expandWithEnv("${UNDEFINED_VAR_9Z}", nil)
-	if got == "${UNDEFINED_VAR_9Z}" {
-		t.Errorf("${UNDEFINED_VAR_9Z}: should expand (whole-string fallback to os.Getenv), got literal")
-	}
-}
-
-func TestExpandWithEnv_EmptyString(t *testing.T) {
-	got := expandWithEnv("", map[string]string{"FOO": "bar"})
-	if got != "" {
-		t.Errorf("empty string: got %q, want empty", got)
-	}
-}
-
-func TestExpandWithEnv_NoVarRefs(t *testing.T) {
-	got := expandWithEnv("plain string with no vars", map[string]string{"FOO": "bar"})
-	if got != "plain string with no vars" {
-		t.Errorf("plain string: got %q, want unchanged", got)
-	}
-}
-
-func TestExpandWithEnv_MultipleVarRefs(t *testing.T) {
-	// Two vars, both whole — both expand from env.
-	env := map[string]string{"A": "alpha", "B": "beta"}
-	got := expandWithEnv("$A and $B and more", env)
-	if got != "alpha and beta and more" {
-		t.Errorf("multiple vars: got %q, want alpha and beta and more", got)
-	}
-}
-
-func TestExpandWithEnv_NumericVarRef(t *testing.T) {
-	// $5 — starts with digit, not a valid identifier start.
-	// Must return the literal "$5", not expand via os.Getenv.
-	got := expandWithEnv("$5", map[string]string{"5": "five"})
-	if got != "$5" {
-		t.Errorf("$5: got %q, want literal $5", got)
-	}
-}
-
-func TestExpandWithEnv_DollarEscape(t *testing.T) {
-	// $$ → both $ written literally (each $ is not followed by an identifier char,
-	// so it is written as-is). No special escape sequence for $$.
-	got := expandWithEnv("$$", nil)
-	if got != "$$" {
-		t.Errorf("$$: got %q, want literal $$", got)
-	}
-}
-
-func TestExpandWithEnv_MixedPartialAndWhole(t *testing.T) {
-	// $A is in env (whole), $HOME is partial — only $A expands.
-	env := map[string]string{"A": "alpha"}
-	got := expandWithEnv("$A at $HOME", env)
-	if got != "alpha at $HOME" {
-		t.Errorf("$A at $HOME: got %q, want alpha at $HOME", got)
-	}
-}

workspace-server/internal/handlers/org_helpers_walk_test.go

@@ -1,191 +0,0 @@
-package handlers
-
-import (
-	"errors"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// walkOrgWorkspaceNames tests — recursive collection of non-empty workspace names.
-
-func TestWalkOrgWorkspaceNames_EmptySlice(t *testing.T) {
-	var names []string
-	walkOrgWorkspaceNames([]OrgWorkspace{}, &names)
-	assert.Empty(t, names)
-}
-
-func TestWalkOrgWorkspaceNames_SingleNode(t *testing.T) {
-	var names []string
-	walkOrgWorkspaceNames([]OrgWorkspace{{Name: "my-workspace"}}, &names)
-	assert.Equal(t, []string{"my-workspace"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_SingleNodeEmptyName(t *testing.T) {
-	var names []string
-	walkOrgWorkspaceNames([]OrgWorkspace{{Name: ""}}, &names)
-	assert.Empty(t, names)
-}
-
-func TestWalkOrgWorkspaceNames_NestedChildren(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{
-			Name: "parent",
-			Children: []OrgWorkspace{
-				{Name: "child-a"},
-				{Name: "child-b"},
-			},
-		},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"parent", "child-a", "child-b"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_DeeplyNested(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{
-			Name: "level0",
-			Children: []OrgWorkspace{
-				{
-					Name: "level1",
-					Children: []OrgWorkspace{
-						{
-							Name: "level2",
-							Children: []OrgWorkspace{
-								{Name: "level3"},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"level0", "level1", "level2", "level3"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_SkipsEmptyNames(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{Name: "a"},
-		{Name: ""},
-		{Name: "b"},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"a", "b"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_Siblings(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{Name: "team"},
-		{Name: "alpha"},
-		{Name: "beta"},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"team", "alpha", "beta"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_MultipleRoots(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{Name: "root-a", Children: []OrgWorkspace{{Name: "child-a"}}},
-		{Name: "root-b", Children: []OrgWorkspace{{Name: "child-b"}}},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"root-a", "child-a", "root-b", "child-b"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_SpawningFalseStillWalks(t *testing.T) {
-	// The comment in the source is explicit: spawning:false subtrees are
-	// still walked. Empty names within those subtrees are still skipped.
-	var names []string
-	yes := true
-	no := false
-	tree := []OrgWorkspace{
-		{
-			Name: "parent",
-			Children: []OrgWorkspace{
-				{Name: "spawning-child", Spawning: &yes},
-				{Name: "non-spawning-child", Spawning: &no},
-				{Name: ""},
-			},
-		},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"parent", "spawning-child", "non-spawning-child"}, names)
-}
-
-// resolveProvisionConcurrency tests — env-var parsing with sensible fallback.
-
-func TestResolveProvisionConcurrency_Default(t *testing.T) {
-	os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, defaultProvisionConcurrency, val)
-}
-
-func TestResolveProvisionConcurrency_ValidPositiveInt(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "5")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, 5, val)
-}
-
-func TestResolveProvisionConcurrency_ZeroUnlimited(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "0")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	// Zero is mapped to 1<<20 (unlimited semantics with finite cap)
-	assert.Equal(t, 1<<20, val)
-}
-
-func TestResolveProvisionConcurrency_NegativeFallsBack(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "-1")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, defaultProvisionConcurrency, val)
-}
-
-func TestResolveProvisionConcurrency_NonIntegerFallsBack(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "not-a-number")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, defaultProvisionConcurrency, val)
-}
-
-func TestResolveProvisionConcurrency_WhitespaceOnly(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "   ")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, defaultProvisionConcurrency, val)
-}
-
-func TestResolveProvisionConcurrency_LargeValue(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "10000")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, 10000, val)
-}
-
-// errString tests — nil-safe error-to-string wrapper.
-
-func TestErrString_NilError(t *testing.T) {
-	result := errString(nil)
-	assert.Equal(t, "", result)
-}
-
-func TestErrString_WithError(t *testing.T) {
-	err := errors.New("something went wrong")
-	result := errString(err)
-	assert.Equal(t, "something went wrong", result)
-}
-
-func TestErrString_EmptyError(t *testing.T) {
-	err := errors.New("")
-	result := errString(err)
-	assert.Equal(t, "", result)
-}

workspace-server/internal/handlers/org_import.go

@@ -952,6 +952,54 @@ type PerWorkspaceUnsatisfied struct {
 
 // collectPerWorkspaceUnsatisfied recursively walks workspaces and returns
 // per-workspace RequiredEnv entries that are not covered by (a) a global
+// secret key or (b) a key present in the workspace's .env file(s) (org root
+// .env + per-workspace <files_dir>/.env). This complements
+// collectOrgEnv + loadConfiguredGlobalSecretKeys, which together only
+// validate global-level RequiredEnv against global_secrets. The .env
+// lookup mirrors the runtime resolution in createWorkspaceTree so that
+// the preflight result matches what the container actually receives at
+// start time.
+func collectPerWorkspaceUnsatisfied(workspaces []OrgWorkspace, orgBaseDir string, globalSecrets map[string]struct{}) []PerWorkspaceUnsatisfied {
+	var out []PerWorkspaceUnsatisfied
+	var walk func([]OrgWorkspace)
+	walk = func(wsList []OrgWorkspace) {
+		for _, ws := range wsList {
+			// Build the set of keys available to this workspace from .env.
+			// This is the same three-source stack that createWorkspaceTree
+			// injects into the container:
+			//   1. Org root .env (parseEnvFile, no filesDir)
+			//   2. Workspace <files_dir>/.env (if filesDir is set)
+			//   3. Persona bootstrap env (MOLECULE_PERSONA_ROOT/<filesDir>/env)
+			// Items 1+2 are on-disk and testable; item 3 is host-only and
+			// skipped here (persona env does NOT satisfy required_env —
+			// it carries identity tokens, not workspace LLM keys).
+			envFromFiles := loadWorkspaceEnv(orgBaseDir, ws.FilesDir)
+			// Convert map[string]string (from .env files) to map[string]struct{}
+			// to match IsSatisfied's signature.
+			envSet := make(map[string]struct{}, len(envFromFiles))
+			for k := range envFromFiles {
+				envSet[k] = struct{}{}
+			}
+			for _, req := range ws.RequiredEnv {
+				if req.IsSatisfied(globalSecrets) {
+					continue // covered by a global secret
+				}
+				if req.IsSatisfied(envSet) {
+					continue // covered by a per-workspace .env file
+				}
+				out = append(out, PerWorkspaceUnsatisfied{
+					Workspace:   ws.Name,
+					FilesDir:    ws.FilesDir,
+					Unsatisfied: req,
+				})
+			}
+			walk(ws.Children)
+		}
+	}
+	walk(workspaces)
+	return out
+}
+
 func loadConfiguredGlobalSecretKeys(ctx context.Context) (map[string]struct{}, error) {
 	rows, err := db.DB.QueryContext(ctx,
 		`SELECT key FROM global_secrets WHERE octet_length(encrypted_value) > 0 LIMIT $1`,

workspace-server/internal/handlers/org_plugin_allowlist.go

@@ -17,9 +17,6 @@ import (
 // when one exists, or the workspace's own ID when it is the org root.
 // Returns an empty string if the workspace is not found.
 func resolveOrgID(ctx context.Context, workspaceID string) (string, error) {
-	if db.DB == nil {
-		return "", nil // nil in unit tests
-	}
 	var parentID sql.NullString
 	err := db.DB.QueryRowContext(ctx,
 		`SELECT parent_id FROM workspaces WHERE id = $1`,

workspace-server/internal/handlers/plugins_atomic_test.go

@@ -215,9 +215,6 @@ func TestTarWalk_EmptyDirectory(t *testing.T) {
 	}
 }
 
-// TestTarWalk_NestedDirs is defined in plugins_atomic_tar_test.go to avoid
-// redeclaration. Deeply nested directory walk is tested there.
-
 // TestTarWalk_DirEntryHasTrailingSlash: directory entries must end with '/'
 // per tar format; tar.Header.Typeflag '5' (dir) must produce "name/" not "name".
 func TestTarWalk_DirEntryHasTrailingSlash(t *testing.T) {

workspace-server/internal/handlers/plugins_helpers_pure_test.go

@@ -1,80 +0,0 @@
-package handlers
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// supportsRuntime tests — plugin runtime compatibility checking.
-
-func TestSupportsRuntime_EmptyRuntimes(t *testing.T) {
-	// Empty runtimes = unspecified, try it → always compatible.
-	info := pluginInfo{Name: "test", Runtimes: nil}
-	assert.True(t, info.supportsRuntime("claude_code"))
-	assert.True(t, info.supportsRuntime("any_runtime"))
-}
-
-func TestSupportsRuntime_ExactMatch(t *testing.T) {
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude_code", "anthropic"}}
-	assert.True(t, info.supportsRuntime("claude_code"))
-	assert.True(t, info.supportsRuntime("anthropic"))
-}
-
-func TestSupportsRuntime_NoMatch(t *testing.T) {
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude_code"}}
-	assert.False(t, info.supportsRuntime("openai"))
-}
-
-func TestSupportsRuntime_HyphenUnderscoreNormalized(t *testing.T) {
-	// "claude-code" and "claude_code" are considered equal.
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude-code"}}
-	assert.True(t, info.supportsRuntime("claude_code"))
-	assert.True(t, info.supportsRuntime("claude-code")) // symmetric hyphen form
-}
-
-func TestSupportsRuntime_HyphenVsUnderscoreReverse(t *testing.T) {
-	// Plugin declares underscore form; runtime uses hyphen.
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude_code"}}
-	assert.True(t, info.supportsRuntime("claude-code"))
-}
-
-func TestSupportsRuntime_EmptyStringRuntime(t *testing.T) {
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude_code"}}
-	// Empty runtime string: should not match any plugin.
-	assert.False(t, info.supportsRuntime(""))
-}
-
-func TestSupportsRuntime_SingleRuntimeMatch(t *testing.T) {
-	// Multiple declared runtimes: only matching one is sufficient.
-	info := pluginInfo{Name: "test", Runtimes: []string{"python", "nodejs", "claude_code"}}
-	assert.True(t, info.supportsRuntime("claude_code"))
-	assert.False(t, info.supportsRuntime("ruby"))
-}
-
-func TestSupportsRuntime_AllHyphenForms(t *testing.T) {
-	// Both plugin and runtime use hyphen form.
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude-code"}}
-	assert.True(t, info.supportsRuntime("claude-code"))
-}
-
-func TestSupportsRuntime_MultipleHyphenNormalization(t *testing.T) {
-	// Mixed hyphen/underscore forms normalize to the same.
-	info := pluginInfo{Name: "test", Runtimes: []string{"some-runtime-name"}}
-	assert.True(t, info.supportsRuntime("some_runtime_name"))
-	assert.True(t, info.supportsRuntime("some-runtime-name"))
-}
-
-func TestSupportsRuntime_EmptyPluginRuntimesWithAnyInput(t *testing.T) {
-	// Empty Runtimes on plugin = try it regardless of runtime.
-	info := pluginInfo{Name: "test", Runtimes: []string{}}
-	assert.True(t, info.supportsRuntime(""))
-	assert.True(t, info.supportsRuntime("any"))
-	assert.True(t, info.supportsRuntime("unknown"))
-}
-
-func TestSupportsRuntime_ZeroLengthRuntimes(t *testing.T) {
-	// Empty slice vs nil: both should be treated as "unspecified".
-	info := pluginInfo{Name: "test"}
-	assert.True(t, info.supportsRuntime("anything"))
-}

workspace-server/internal/handlers/plugins_tracking.go

@@ -86,9 +86,6 @@ func recordWorkspacePluginInstall(
 // pair. Called by the uninstall path so the row doesn't persist with a stale
 // installed_sha after the plugin has been removed from the container.
 func deleteWorkspacePluginRow(ctx context.Context, workspaceID, pluginName string) error {
-	if db.DB == nil {
-		return nil // nil in unit tests; no-op since the row is test-only
-	}
 	_, err := db.DB.ExecContext(ctx, `
 		DELETE FROM workspace_plugins WHERE workspace_id = $1 AND plugin_name = $2
 	`, workspaceID, pluginName)

workspace-server/internal/handlers/schedules_handler_test.go

@@ -1,810 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"database/sql"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/gin-gonic/gin"
-)
-
-// scheduleCols is the full column set returned by List.
-var scheduleCols = []string{
-	"id", "workspace_id", "name", "cron_expr", "timezone", "prompt", "enabled",
-	"last_run_at", "next_run_at", "run_count", "last_status", "last_error",
-	"source", "created_at", "updated_at",
-}
-
-// ==================== List ====================
-
-func TestScheduleHandler_List_EmptyResult(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery("SELECT .+ FROM workspace_schedules WHERE workspace_id").
-		WithArgs("ws-list-empty").
-		WillReturnRows(sqlmock.NewRows(scheduleCols))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-list-empty"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-list-empty/schedules", nil)
-
-	handler.List(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var schedules []interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &schedules); err != nil {
-		t.Fatalf("invalid JSON: %v", err)
-	}
-	if len(schedules) != 0 {
-		t.Errorf("expected empty list, got %d items", len(schedules))
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_List_QueryError(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery("SELECT .+ FROM workspace_schedules WHERE workspace_id").
-		WithArgs("ws-list-err").
-		WillReturnError(sql.ErrConnDone)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-list-err"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-list-err/schedules", nil)
-
-	handler.List(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// ==================== Create ====================
-
-func TestScheduleHandler_Create_MissingCronExpr(t *testing.T) {
-	handler := NewScheduleHandler()
-
-	// prompt only — no cron_expr
-	body := []byte(`{"prompt":"do the thing"}`)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400 for missing cron_expr, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestScheduleHandler_Create_MissingPrompt(t *testing.T) {
-	handler := NewScheduleHandler()
-
-	// cron_expr only — no prompt
-	body := []byte(`{"cron_expr":"0 9 * * *"}`)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400 for missing prompt, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestScheduleHandler_Create_InvalidTimezone(t *testing.T) {
-	handler := NewScheduleHandler()
-
-	body, _ := json.Marshal(map[string]string{
-		"cron_expr": "0 9 * * *",
-		"prompt":    "do the thing",
-		"timezone":  "Not/A/Timezone",
-	})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400 for invalid timezone, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]string
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if !strings.Contains(resp["error"], "invalid timezone") {
-		t.Errorf("expected 'invalid timezone' error, got: %v", resp)
-	}
-}
-
-func TestScheduleHandler_Create_InvalidCron(t *testing.T) {
-	handler := NewScheduleHandler()
-
-	body, _ := json.Marshal(map[string]string{
-		"cron_expr": "not-a-cron",
-		"prompt":    "do the thing",
-	})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400 for invalid cron, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]string
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if !strings.Contains(resp["error"], "invalid request body") {
-		t.Errorf("expected 'invalid request body' error, got: %v", resp)
-	}
-}
-
-func TestScheduleHandler_Create_CRLFStripped(t *testing.T) {
-	// Use setupTestDBForQueueTests which sets up QueryMatcherEqual for exact
-	// string matching. The INSERT statement is deterministic enough for that.
-	customSqlmock := setupTestDBForQueueTests(t)
-
-	handler := NewScheduleHandler()
-
-	// Prompt with CRLF from a Windows-committed org-template file.
-	// The handler strips \r before inserting so agent doesn't see empty responses.
-	promptWithCRLF := "check\r\ndocs\r\nbefore merge"
-
-	// The handler strips \r → query should receive the LF-only version.
-	customSqlmock.ExpectQuery("INSERT INTO workspace_schedules (workspace_id, name, cron_expr, timezone, prompt, enabled, next_run_at, source) VALUES ($1, $2, $3, $4, $5, $6, $7, 'runtime') RETURNING id").
-		WithArgs("ws-crlf", "", "0 9 * * *", "UTC", "check\ndocs\nbefore merge", true, sqlmock.AnyArg()).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("sched-crlf"))
-
-	body, _ := json.Marshal(map[string]interface{}{
-		"cron_expr": "0 9 * * *",
-		"prompt":    promptWithCRLF,
-	})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-crlf"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-crlf/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Errorf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := customSqlmock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Create_DefaultEnabled(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	// enabled field absent — must default to true.
-	mock.ExpectQuery("INSERT INTO workspace_schedules").
-		WithArgs("ws-def-enable", "", "0 9 * * *", "UTC", "do thing", true, sqlmock.AnyArg()).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("sched-enable"))
-
-	body, _ := json.Marshal(map[string]string{
-		"cron_expr": "0 9 * * *",
-		"prompt":    "do thing",
-		// no "enabled" field
-	})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-def-enable"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-def-enable/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Errorf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Create_DefaultTimezone(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	// timezone field absent — must default to UTC.
-	mock.ExpectQuery("INSERT INTO workspace_schedules").
-		WithArgs("ws-def-tz", "", "0 9 * * *", "UTC", "do thing", true, sqlmock.AnyArg()).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("sched-tz"))
-
-	body, _ := json.Marshal(map[string]string{
-		"cron_expr": "0 9 * * *",
-		"prompt":    "do thing",
-		// no "timezone" field
-	})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-def-tz"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-def-tz/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Errorf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Create_ExplicitEnabledFalse(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	enabled := false
-	mock.ExpectQuery("INSERT INTO workspace_schedules").
-		WithArgs("ws-dis", "", "0 9 * * *", "UTC", "do thing", enabled, sqlmock.AnyArg()).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("sched-dis"))
-
-	body, _ := json.Marshal(map[string]interface{}{
-		"cron_expr": "0 9 * * *",
-		"prompt":    "do thing",
-		"enabled":   false,
-	})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-dis"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-dis/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Errorf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Create_DBError(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery("INSERT INTO workspace_schedules").
-		WillReturnError(sql.ErrConnDone)
-
-	body, _ := json.Marshal(map[string]string{
-		"cron_expr": "0 9 * * *",
-		"prompt":    "do thing",
-	})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-db-err"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-db-err/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 for DB error, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Create_NextRunAtReturned(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery("INSERT INTO workspace_schedules").
-		WithArgs("ws-next", "", "0 9 * * *", "UTC", "do thing", true, sqlmock.AnyArg()).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("sched-next"))
-
-	body, _ := json.Marshal(map[string]string{
-		"cron_expr": "0 9 * * *",
-		"prompt":    "do thing",
-	})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-next"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-next/schedules", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Errorf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["status"] != "created" {
-		t.Errorf("expected status 'created', got %v", resp["status"])
-	}
-	if _, ok := resp["next_run_at"]; !ok {
-		t.Error("expected next_run_at in response")
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// ==================== Update ====================
-
-func TestScheduleHandler_Update_PartialRecomputeCron(t *testing.T) {
-	// Uses QueryMatcherEqual so query strings are compared verbatim — no escaping needed.
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery("SELECT cron_expr, timezone FROM workspace_schedules WHERE id = $1 AND workspace_id = $2").
-		WithArgs("sched-recompute-cron", "ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"cron_expr", "timezone"}).
-			AddRow("0 8 * * *", "UTC"))
-
-	mock.ExpectExec(`UPDATE workspace_schedules SET name = COALESCE($2, name), cron_expr = COALESCE($3, cron_expr), timezone = COALESCE($4, timezone), prompt = COALESCE($5, prompt), enabled = COALESCE($6, enabled), next_run_at = COALESCE($7, next_run_at), updated_at = now() WHERE id = $1 AND workspace_id = $8`).
-		WithArgs("sched-recompute-cron", nil, "0 6 * * *", nil, nil, nil, sqlmock.AnyArg(), "ws-1").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	body, _ := json.Marshal(map[string]string{"cron_expr": "0 6 * * *"})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-recompute-cron"}}
-	c.Request = httptest.NewRequest("PATCH", "/workspaces/ws-1/schedules/sched-recompute-cron", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Update(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Update_PartialRecomputeTimezone(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery("SELECT cron_expr, timezone FROM workspace_schedules WHERE id = $1 AND workspace_id = $2").
-		WithArgs("sched-recompute-tz", "ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"cron_expr", "timezone"}).
-			AddRow("0 9 * * *", "UTC"))
-
-	mock.ExpectExec(`UPDATE workspace_schedules SET name = COALESCE($2, name), cron_expr = COALESCE($3, cron_expr), timezone = COALESCE($4, timezone), prompt = COALESCE($5, prompt), enabled = COALESCE($6, enabled), next_run_at = COALESCE($7, next_run_at), updated_at = now() WHERE id = $1 AND workspace_id = $8`).
-		WithArgs("sched-recompute-tz", nil, nil, "America/New_York", nil, nil, sqlmock.AnyArg(), "ws-1").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	body, _ := json.Marshal(map[string]string{"timezone": "America/New_York"})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-recompute-tz"}}
-	c.Request = httptest.NewRequest("PATCH", "/workspaces/ws-1/schedules/sched-recompute-tz", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Update(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Update_InvalidTimezone(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery("SELECT cron_expr, timezone FROM workspace_schedules WHERE id = $1 AND workspace_id = $2").
-		WithArgs("sched-bad-tz", "ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"cron_expr", "timezone"}).
-			AddRow("0 9 * * *", "UTC"))
-
-	body, _ := json.Marshal(map[string]string{"timezone": "Definitely/Not/Real"})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-bad-tz"}}
-	c.Request = httptest.NewRequest("PATCH", "/workspaces/ws-1/schedules/sched-bad-tz", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Update(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400 for invalid timezone, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]string
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if !strings.Contains(resp["error"], "invalid timezone") {
-		t.Errorf("expected 'invalid timezone' error, got: %v", resp)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Update_InvalidCron(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery("SELECT cron_expr, timezone FROM workspace_schedules WHERE id = $1 AND workspace_id = $2").
-		WithArgs("sched-bad-cron", "ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"cron_expr", "timezone"}).
-			AddRow("0 9 * * *", "UTC"))
-
-	body, _ := json.Marshal(map[string]string{"cron_expr": "rubbish"})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-bad-cron"}}
-	c.Request = httptest.NewRequest("PATCH", "/workspaces/ws-1/schedules/sched-bad-cron", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Update(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400 for invalid cron, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Update_NotFound(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectExec(`UPDATE workspace_schedules SET name = COALESCE($2, name), cron_expr = COALESCE($3, cron_expr), timezone = COALESCE($4, timezone), prompt = COALESCE($5, prompt), enabled = COALESCE($6, enabled), next_run_at = COALESCE($7, next_run_at), updated_at = now() WHERE id = $1 AND workspace_id = $8`).
-		WithArgs("sched-missing", "renamed", nil, nil, nil, nil, nil, "ws-1").
-		WillReturnResult(sqlmock.NewResult(0, 0)) // no rows affected
-
-	body, _ := json.Marshal(map[string]string{"name": "renamed"})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-missing"}}
-	c.Request = httptest.NewRequest("PATCH", "/workspaces/ws-1/schedules/sched-missing", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Update(c)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("expected 404 for not found, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Update_DBError(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectExec(`UPDATE workspace_schedules SET name = COALESCE($2, name), cron_expr = COALESCE($3, cron_expr), timezone = COALESCE($4, timezone), prompt = COALESCE($5, prompt), enabled = COALESCE($6, enabled), next_run_at = COALESCE($7, next_run_at), updated_at = now() WHERE id = $1 AND workspace_id = $8`).
-		WithArgs("sched-update-err", "updated", nil, nil, nil, nil, nil, "ws-1").
-		WillReturnError(sql.ErrConnDone)
-
-	body, _ := json.Marshal(map[string]string{"name": "updated"})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-update-err"}}
-	c.Request = httptest.NewRequest("PATCH", "/workspaces/ws-1/schedules/sched-update-err", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Update(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 for DB error, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Update_PromptCRLFStripped(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	// Changing prompt with CRLF → handler strips \r before the UPDATE.
-	mock.ExpectExec(`UPDATE workspace_schedules SET name = COALESCE($2, name), cron_expr = COALESCE($3, cron_expr), timezone = COALESCE($4, timezone), prompt = COALESCE($5, prompt), enabled = COALESCE($6, enabled), next_run_at = COALESCE($7, next_run_at), updated_at = now() WHERE id = $1 AND workspace_id = $8`).
-		WithArgs("sched-crlf-upd", nil, nil, nil, "fix\nthat", nil, nil, "ws-1").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	body, _ := json.Marshal(map[string]string{"prompt": "fix\r\nthat"})
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-crlf-upd"}}
-	c.Request = httptest.NewRequest("PATCH", "/workspaces/ws-1/schedules/sched-crlf-upd", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Update(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// ==================== Delete ====================
-
-func TestScheduleHandler_Delete_Success(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectExec(`DELETE FROM workspace_schedules WHERE id = $1 AND workspace_id = $2`).
-		WithArgs("sched-del", "ws-1").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-del"}}
-	c.Request = httptest.NewRequest("DELETE", "/workspaces/ws-1/schedules/sched-del", nil)
-
-	handler.Delete(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Delete_NotFound(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	// IDOR guard: row belongs to different workspace → 0 rows affected → 404.
-	mock.ExpectExec(`DELETE FROM workspace_schedules WHERE id = $1 AND workspace_id = $2`).
-		WithArgs("sched-idor", "ws-1").
-		WillReturnResult(sqlmock.NewResult(0, 0))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-idor"}}
-	c.Request = httptest.NewRequest("DELETE", "/workspaces/ws-1/schedules/sched-idor", nil)
-
-	handler.Delete(c)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("expected 404 for not found, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_Delete_DBError(t *testing.T) {
-	mock := setupTestDBForQueueTests(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectExec(`DELETE FROM workspace_schedules WHERE id = $1 AND workspace_id = $2`).
-		WithArgs("sched-del-err", "ws-1").
-		WillReturnError(sql.ErrConnDone)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-del-err"}}
-	c.Request = httptest.NewRequest("DELETE", "/workspaces/ws-1/schedules/sched-del-err", nil)
-
-	handler.Delete(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 for DB error, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// ==================== RunNow ====================
-
-func TestScheduleHandler_RunNow_Success(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery(`SELECT prompt FROM workspace_schedules WHERE id = \$1 AND workspace_id = \$2`).
-		WithArgs("sched-run-ok", "ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"prompt"}).AddRow("run this prompt"))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-run-ok"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/schedules/sched-run-ok/run", nil)
-
-	handler.RunNow(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]string
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["status"] != "fired" {
-		t.Errorf("expected status 'fired', got %v", resp["status"])
-	}
-	if resp["prompt"] != "run this prompt" {
-		t.Errorf("expected prompt 'run this prompt', got %q", resp["prompt"])
-	}
-	if resp["workspace_id"] != "ws-1" {
-		t.Errorf("expected workspace_id 'ws-1', got %q", resp["workspace_id"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_RunNow_NotFound(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery(`SELECT prompt FROM workspace_schedules WHERE id = \$1 AND workspace_id = \$2`).
-		WithArgs("sched-run-missing", "ws-1").
-		WillReturnError(sql.ErrNoRows)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-run-missing"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/schedules/sched-run-missing/run", nil)
-
-	handler.RunNow(c)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("expected 404 for not found, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_RunNow_DBError(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery(`SELECT prompt FROM workspace_schedules WHERE id = \$1 AND workspace_id = \$2`).
-		WithArgs("sched-run-err", "ws-1").
-		WillReturnError(sql.ErrConnDone)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "scheduleId", Value: "sched-run-err"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/schedules/sched-run-err/run", nil)
-
-	handler.RunNow(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 for DB error, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// ==================== History ====================
-
-func TestScheduleHandler_History_EmptyResult(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery(`SELECT created_at, duration_ms, status`).
-		WithArgs("ws-hist-empty", "sched-hist-empty").
-		WillReturnRows(sqlmock.NewRows([]string{"created_at", "duration_ms", "status", "error_detail", "request_body"}))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-hist-empty"}, {Key: "scheduleId", Value: "sched-hist-empty"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-hist-empty/schedules/sched-hist-empty/history", nil)
-
-	handler.History(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var entries []interface{}
-	json.Unmarshal(w.Body.Bytes(), &entries)
-	if len(entries) != 0 {
-		t.Errorf("expected empty history, got %d entries", len(entries))
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_History_QueryError(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	mock.ExpectQuery(`SELECT created_at, duration_ms, status`).
-		WithArgs("ws-hist-err", "sched-hist-err").
-		WillReturnError(sql.ErrConnDone)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-hist-err"}, {Key: "scheduleId", Value: "sched-hist-err"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-hist-err/schedules/sched-hist-err/history", nil)
-
-	handler.History(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 on query error, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-func TestScheduleHandler_History_MultipleEntries(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewScheduleHandler()
-
-	now := time.Now()
-	cols := []string{"created_at", "duration_ms", "status", "error_detail", "request_body"}
-	mock.ExpectQuery(`SELECT created_at, duration_ms, status`).
-		WithArgs("ws-hist-multi", "sched-hist-multi").
-		WillReturnRows(sqlmock.NewRows(cols).
-			AddRow(now, 1200, "ok", "", `{"schedule_id":"sched-hist-multi"}`).
-			AddRow(now, 3500, "error", "HTTP 502 — upstream timeout", `{"schedule_id":"sched-hist-multi"}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-hist-multi"}, {Key: "scheduleId", Value: "sched-hist-multi"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-hist-multi/schedules/sched-hist-multi/history", nil)
-
-	handler.History(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var entries []map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &entries)
-	if len(entries) != 2 {
-		t.Errorf("expected 2 entries, got %d: %s", len(entries), w.Body.String())
-	}
-	if entries[1]["error_detail"] != "HTTP 502 — upstream timeout" {
-		t.Errorf("expected error_detail on second entry, got: %v", entries[1]["error_detail"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}

workspace-server/internal/handlers/secrets.go

@@ -63,9 +63,6 @@ func (h *SecretsHandler) List(c *gin.Context) {
 			"updated_at": updatedAt,
 		})
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("List workspace secrets iteration error: %v", err)
-	}
 
 	// 2. Global secrets not overridden at workspace level
 	globalRows, err := db.DB.QueryContext(ctx,
@@ -94,9 +91,6 @@ func (h *SecretsHandler) List(c *gin.Context) {
 			"updated_at": updatedAt,
 		})
 	}
-	if err := globalRows.Err(); err != nil {
-		log.Printf("List global secrets iteration error: %v", err)
-	}
 
 	c.JSON(http.StatusOK, secrets)
 }
@@ -180,9 +174,6 @@ func (h *SecretsHandler) Values(c *gin.Context) {
 				out[k] = string(decrypted)
 			}
 		}
-		if err := globalRows.Err(); err != nil {
-			log.Printf("secrets.Values: global rows iteration error: %v", err)
-		}
 	}
 
 	wsRows, wErr := db.DB.QueryContext(ctx,
@@ -204,9 +195,6 @@ func (h *SecretsHandler) Values(c *gin.Context) {
 				out[k] = string(decrypted) // workspace override wins over global
 			}
 		}
-		if err := wsRows.Err(); err != nil {
-			log.Printf("secrets.Values: workspace rows iteration error: %v", err)
-		}
 	}
 
 	if len(failedKeys) > 0 {
@@ -336,9 +324,6 @@ func (h *SecretsHandler) ListGlobal(c *gin.Context) {
 			"scope":      "global",
 		})
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ListGlobal iteration error: %v", err)
-	}
 	c.JSON(http.StatusOK, secrets)
 }
 
@@ -415,9 +400,6 @@ func (h *SecretsHandler) restartAllAffectedByGlobalKey(key string) {
 			ids = append(ids, id)
 		}
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("restartAllAffectedByGlobalKey: iteration error: %v", err)
-	}
 	if len(ids) == 0 {
 		return
 	}

workspace-server/internal/handlers/terminal.go

@@ -109,11 +109,9 @@ func (h *TerminalHandler) HandleConnect(c *gin.Context) {
 	// provisionWorkspaceCP → migration 038). Null instance_id means the
 	// workspace runs as a local Docker container on this tenant.
 	var instanceID string
-	if db.DB != nil {
-		db.DB.QueryRowContext(ctx,
-			`SELECT COALESCE(instance_id, '') FROM workspaces WHERE id = $1`,
-			workspaceID).Scan(&instanceID)
-	}
+	db.DB.QueryRowContext(ctx,
+		`SELECT COALESCE(instance_id, '') FROM workspaces WHERE id = $1`,
+		workspaceID).Scan(&instanceID)
 
 	if instanceID != "" {
 		h.handleRemoteConnect(c, workspaceID, instanceID)
@@ -145,7 +143,7 @@ func (h *TerminalHandler) handleLocalConnect(c *gin.Context, workspaceID string)
 
 	// Look up workspace name for manual container naming
 	var wsName string
-	if db.DB != nil && h.docker != nil {
+	if _, err := h.docker.Ping(ctx); err == nil {
 		db.DB.QueryRowContext(ctx, `SELECT LOWER(REPLACE(name, ' ', '-')) FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName)
 		if wsName != "" {
 			candidates = append(candidates, wsName)

workspace-server/internal/handlers/terminal_diagnose_test.go

@@ -24,9 +24,6 @@ import (
 //   - response is HTTP 200 (the endpoint always returns 200; failure is
 //     in the JSON body so callers don't need branch-on-status)
 func TestHandleDiagnose_RoutesToRemote(t *testing.T) {
-	if _, err := exec.LookPath("ssh-keygen"); err != nil {
-		t.Skip("ssh-keygen not available in PATH:", err)
-	}
 	mock := setupTestDB(t)
 	setupTestRedis(t)
 
@@ -170,12 +167,6 @@ func TestHandleDiagnose_KI005_RejectsCrossWorkspace(t *testing.T) {
 // to differentiate "IAM broke" (send-key fails) from "sshd broke" (probe
 // fails) from "SG/network broke" (wait-for-port fails).
 func TestDiagnoseRemote_StopsAtSSHProbe(t *testing.T) {
-	if _, err := exec.LookPath("ssh-keygen"); err != nil {
-		t.Skip("ssh-keygen not available in PATH:", err)
-	}
-	if _, err := exec.LookPath("nc"); err != nil {
-		t.Skip("nc not available in PATH:", err)
-	}
 	mock := setupTestDB(t)
 	setupTestRedis(t)
 

workspace-server/internal/handlers/tokens.go

@@ -67,9 +67,6 @@ func (h *TokenHandler) List(c *gin.Context) {
 		}
 		tokens = append(tokens, t)
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ListTokens rows.Err workspace=%s: %v", workspaceID, err)
-	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"tokens": tokens,

workspace-server/internal/handlers/workspace.go

@@ -15,7 +15,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"sync"
 	"time"
 
 	"github.com/Molecule-AI/molecule-monorepo/platform/internal/crypto"
@@ -74,22 +73,6 @@ type WorkspaceHandler struct {
 	// memory plugin). main.go sets this to plugin.DeleteNamespace
 	// when MEMORY_PLUGIN_URL is configured.
 	namespaceCleanupFn func(ctx context.Context, workspaceID string)
-	// asyncWG tracks goroutines launched by goAsync so tests can wait
-	// for async DB users (restart, provision) before asserting results.
-	// Matches the pattern from main commit 1c3b4ff3.
-	asyncWG sync.WaitGroup
-}
-
-func (h *WorkspaceHandler) goAsync(fn func()) {
-	h.asyncWG.Add(1)
-	go func() {
-		defer h.asyncWG.Done()
-		fn()
-	}()
-}
-
-func (h *WorkspaceHandler) waitAsyncForTest() {
-	h.asyncWG.Wait()
 }
 
 func NewWorkspaceHandler(b events.EventEmitter, p *provisioner.Provisioner, platformURL, configsDir string) *WorkspaceHandler {
@@ -595,7 +578,7 @@ func scanWorkspaceRow(rows interface {
 	var id, name, role, status, url, sampleError, currentTask, runtime, workspaceDir string
 	var tier, activeTasks, maxConcurrentTasks, uptimeSeconds int
 	var errorRate, x, y float64
-	var collapsed, broadcastEnabled, talkToUserEnabled bool
+	var collapsed bool
 	var parentID *string
 	var agentCard []byte
 	var budgetLimit sql.NullInt64
@@ -604,7 +587,7 @@ func scanWorkspaceRow(rows interface {
 	err := rows.Scan(&id, &name, &role, &tier, &status, &agentCard, &url,
 		&parentID, &activeTasks, &maxConcurrentTasks, &errorRate, &sampleError, &uptimeSeconds,
 		&currentTask, &runtime, &workspaceDir, &x, &y, &collapsed,
-		&budgetLimit, &monthlySpend, &broadcastEnabled, &talkToUserEnabled)
+		&budgetLimit, &monthlySpend)
 	if err != nil {
 		return nil, err
 	}
@@ -628,8 +611,6 @@ func scanWorkspaceRow(rows interface {
 		"x":                    x,
 		"y":                    y,
 		"collapsed":            collapsed,
-		"broadcast_enabled":    broadcastEnabled,
-		"talk_to_user_enabled": talkToUserEnabled,
 	}
 
 	// budget_limit: nil when no limit set, int64 otherwise
@@ -665,8 +646,7 @@ const workspaceListQuery = `
 		   COALESCE(w.current_task, ''), COALESCE(w.runtime, 'langgraph'),
 		   COALESCE(w.workspace_dir, ''),
 		   COALESCE(cl.x, 0), COALESCE(cl.y, 0), COALESCE(cl.collapsed, false),
-		   w.budget_limit, COALESCE(w.monthly_spend, 0),
-		   w.broadcast_enabled, w.talk_to_user_enabled
+		   w.budget_limit, COALESCE(w.monthly_spend, 0)
 	FROM workspaces w
 	LEFT JOIN canvas_layouts cl ON cl.workspace_id = w.id
 	WHERE w.status != 'removed'
@@ -726,8 +706,7 @@ func (h *WorkspaceHandler) Get(c *gin.Context) {
 			   COALESCE(w.current_task, ''), COALESCE(w.runtime, 'langgraph'),
 			   COALESCE(w.workspace_dir, ''),
 			   COALESCE(cl.x, 0), COALESCE(cl.y, 0), COALESCE(cl.collapsed, false),
-			   w.budget_limit, COALESCE(w.monthly_spend, 0),
-			   w.broadcast_enabled, w.talk_to_user_enabled
+			   w.budget_limit, COALESCE(w.monthly_spend, 0)
 		FROM workspaces w
 		LEFT JOIN canvas_layouts cl ON cl.workspace_id = w.id
 		WHERE w.id = $1

workspace-server/internal/handlers/workspace_abilities.go

@@ -1,82 +0,0 @@
-package handlers
-
-// workspace_abilities.go — PATCH /workspaces/:id/abilities
-//
-// Allows users and admin agents to toggle two workspace-level ability flags:
-//
-//   broadcast_enabled   — workspace may POST /broadcast to send org-wide messages
-//   talk_to_user_enabled — workspace may deliver canvas chat messages via
-//                          send_message_to_user / POST /notify
-//
-// Gated behind AdminAuth so workspace agents cannot self-modify their own
-// ability flags (that would let any agent grant itself broadcast rights or
-// suppress its own chat-silence constraint).
-
-import (
-	"log"
-	"net/http"
-
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/gin-gonic/gin"
-)
-
-// AbilitiesPayload carries the subset of ability flags the caller wants to
-// update. Fields are pointers so that the handler can distinguish "caller
-// supplied false" from "caller omitted the field" (omitempty semantics).
-type AbilitiesPayload struct {
-	BroadcastEnabled   *bool `json:"broadcast_enabled"`
-	TalkToUserEnabled  *bool `json:"talk_to_user_enabled"`
-}
-
-// PatchAbilities handles PATCH /workspaces/:id/abilities (AdminAuth).
-func PatchAbilities(c *gin.Context) {
-	id := c.Param("id")
-	if err := validateWorkspaceID(id); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace ID"})
-		return
-	}
-
-	var body AbilitiesPayload
-	if err := c.ShouldBindJSON(&body); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body"})
-		return
-	}
-	if body.BroadcastEnabled == nil && body.TalkToUserEnabled == nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "at least one ability field required"})
-		return
-	}
-
-	ctx := c.Request.Context()
-
-	var exists bool
-	if err := db.DB.QueryRowContext(ctx,
-		`SELECT EXISTS(SELECT 1 FROM workspaces WHERE id = $1 AND status != 'removed')`, id,
-	).Scan(&exists); err != nil || !exists {
-		c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
-		return
-	}
-
-	if body.BroadcastEnabled != nil {
-		if _, err := db.DB.ExecContext(ctx,
-			`UPDATE workspaces SET broadcast_enabled = $2, updated_at = now() WHERE id = $1`,
-			id, *body.BroadcastEnabled,
-		); err != nil {
-			log.Printf("PatchAbilities broadcast_enabled for %s: %v", id, err)
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
-			return
-		}
-	}
-
-	if body.TalkToUserEnabled != nil {
-		if _, err := db.DB.ExecContext(ctx,
-			`UPDATE workspaces SET talk_to_user_enabled = $2, updated_at = now() WHERE id = $1`,
-			id, *body.TalkToUserEnabled,
-		); err != nil {
-			log.Printf("PatchAbilities talk_to_user_enabled for %s: %v", id, err)
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
-			return
-		}
-	}
-
-	c.JSON(http.StatusOK, gin.H{"status": "updated"})
-}

workspace-server/internal/handlers/workspace_broadcast.go

@@ -1,142 +0,0 @@
-package handlers
-
-// workspace_broadcast.go — POST /workspaces/:id/broadcast
-//
-// Allows a workspace with broadcast_enabled=true to send a message to every
-// non-removed agent workspace in the org.  The message is:
-//
-//   • Persisted in each recipient's activity_logs (type='broadcast_receive')
-//     so poll-mode agents pick it up via GET /activity.
-//   • Broadcast via WebSocket BROADCAST_MESSAGE event so canvas panels can
-//     show a real-time banner for each recipient workspace.
-//
-// The sender's own workspace logs a 'broadcast_sent' activity row for
-// traceability.
-//
-// Auth: WorkspaceAuth (the agent triggers this with its own bearer token).
-// The handler re-validates broadcast_enabled inside the DB lookup to prevent
-// TOCTOU — the middleware only proved the token is valid, not the ability.
-
-import (
-	"log"
-	"net/http"
-	"strconv"
-
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/events"
-	"github.com/gin-gonic/gin"
-)
-
-// BroadcastHandler is constructed once and shared across requests.
-type BroadcastHandler struct {
-	broadcaster *events.Broadcaster
-}
-
-// NewBroadcastHandler creates a BroadcastHandler.
-func NewBroadcastHandler(b *events.Broadcaster) *BroadcastHandler {
-	return &BroadcastHandler{broadcaster: b}
-}
-
-// Broadcast handles POST /workspaces/:id/broadcast.
-func (h *BroadcastHandler) Broadcast(c *gin.Context) {
-	senderID := c.Param("id")
-	if err := validateWorkspaceID(senderID); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace ID"})
-		return
-	}
-
-	var body struct {
-		Message string `json:"message" binding:"required"`
-	}
-	if err := c.ShouldBindJSON(&body); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "message is required"})
-		return
-	}
-
-	ctx := c.Request.Context()
-
-	// Verify sender exists and has broadcast_enabled=true.
-	var senderName string
-	var broadcastEnabled bool
-	err := db.DB.QueryRowContext(ctx,
-		`SELECT name, broadcast_enabled FROM workspaces WHERE id = $1 AND status != 'removed'`,
-		senderID,
-	).Scan(&senderName, &broadcastEnabled)
-	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
-		return
-	}
-	if !broadcastEnabled {
-		c.JSON(http.StatusForbidden, gin.H{
-			"error": "broadcast_disabled",
-			"hint":  "This workspace does not have the broadcast ability. Ask a user or admin to enable it via PATCH /workspaces/:id/abilities.",
-		})
-		return
-	}
-
-	// Collect all non-removed agent workspaces (excludes the sender itself).
-	rows, err := db.DB.QueryContext(ctx,
-		`SELECT id FROM workspaces WHERE status != 'removed' AND id != $1`,
-		senderID,
-	)
-	if err != nil {
-		log.Printf("Broadcast: recipient query failed for %s: %v", senderID, err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error"})
-		return
-	}
-	defer rows.Close()
-
-	var recipientIDs []string
-	for rows.Next() {
-		var rid string
-		if rows.Scan(&rid) == nil {
-			recipientIDs = append(recipientIDs, rid)
-		}
-	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Broadcast: recipient rows error for %s: %v", senderID, err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error"})
-		return
-	}
-
-	broadcastPayload := map[string]interface{}{
-		"message":   body.Message,
-		"sender_id": senderID,
-		"sender":    senderName,
-	}
-
-	// Persist broadcast_receive in each recipient's activity log + emit WS event.
-	delivered := 0
-	for _, rid := range recipientIDs {
-		if _, err := db.DB.ExecContext(ctx, `
-			INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, summary, status)
-			VALUES ($1, 'broadcast_receive', 'broadcast', $2, $3, 'ok')
-		`, rid, senderID, "Broadcast from "+senderName+": "+broadcastTruncate(body.Message, 120)); err != nil {
-			log.Printf("Broadcast: activity_logs insert for recipient %s: %v", rid, err)
-			continue
-		}
-		h.broadcaster.BroadcastOnly(rid, "BROADCAST_MESSAGE", broadcastPayload)
-		delivered++
-	}
-
-	// Record the send on the sender's own log.
-	if _, err := db.DB.ExecContext(ctx, `
-		INSERT INTO activity_logs (workspace_id, activity_type, method, summary, status)
-		VALUES ($1, 'broadcast_sent', 'broadcast', $2, 'ok')
-	`, senderID, "Broadcast sent to "+strconv.Itoa(delivered)+" workspace(s)"); err != nil {
-		log.Printf("Broadcast: sender activity_log for %s: %v", senderID, err)
-	}
-
-	c.JSON(http.StatusOK, gin.H{
-		"status":    "sent",
-		"delivered": delivered,
-	})
-}
-
-func broadcastTruncate(s string, max int) string {
-	runes := []rune(s)
-	if len(runes) <= max {
-		return s
-	}
-	return string(runes[:max]) + "…"
-}

workspace-server/internal/handlers/workspace_budget_test.go

@@ -33,7 +33,6 @@ var wsColumns = []string{
 	"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 	"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 	"budget_limit", "monthly_spend",
-	"broadcast_enabled", "talk_to_user_enabled",
 }
 
 // ==================== GET — financial fields stripped from open endpoint ====================
@@ -53,10 +52,8 @@ func TestWorkspaceBudget_Get_NilLimit(t *testing.T) {
 				[]byte(`{}`), "http://localhost:9001",
 				nil, 0, 1, 0.0, "", 0, "", "langgraph", "",
 				0.0, 0.0, false,
-				nil,   // budget_limit NULL
-				0,     // monthly_spend 0
-				false, // broadcast_enabled
-				true)) // talk_to_user_enabled
+				nil, // budget_limit NULL
+				0))  // monthly_spend 0
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -99,8 +96,7 @@ func TestWorkspaceBudget_Get_WithLimit(t *testing.T) {
 				nil, 0, 1, 0.0, "", 0, "", "langgraph", "",
 				0.0, 0.0, false,
 				int64(500),  // budget_limit = $5.00 in DB
-				int64(123),  // monthly_spend = $1.23 in DB
-				false, true)) // broadcast_enabled, talk_to_user_enabled
+				int64(123))) // monthly_spend = $1.23 in DB
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

workspace-server/internal/handlers/workspace_crud.go

@@ -149,19 +149,6 @@ func (h *WorkspaceHandler) Update(c *gin.Context) {
 		}
 	}
 
-	// Validate workspace_dir early so invalid paths are rejected before the
-	// existence check (consistent with name/role/runtime validation above).
-	if wsDir, ok := body["workspace_dir"]; ok {
-		if wsDir != nil {
-			if dirStr, isStr := wsDir.(string); isStr && dirStr != "" {
-				if err := validateWorkspaceDir(dirStr); err != nil {
-					c.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace directory"})
-					return
-				}
-			}
-		}
-	}
-
 	ctx := c.Request.Context()
 
 	// Auth is fully enforced at the router layer (WorkspaceAuth middleware, #680).
@@ -219,8 +206,15 @@ func (h *WorkspaceHandler) Update(c *gin.Context) {
 	}
 	needsRestart := false
 	if wsDir, ok := body["workspace_dir"]; ok {
-		// ValidateWorkspaceDir was already called above before the existence check;
-		// the UPDATE itself is unconditional.
+		// Allow null to clear workspace_dir
+		if wsDir != nil {
+			if dirStr, isStr := wsDir.(string); isStr && dirStr != "" {
+				if err := validateWorkspaceDir(dirStr); err != nil {
+					c.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace directory"})
+					return
+				}
+			}
+		}
 		if _, err := db.DB.ExecContext(ctx, `UPDATE workspaces SET workspace_dir = $2, updated_at = now() WHERE id = $1`, id, wsDir); err != nil {
 			log.Printf("Update workspace_dir error for %s: %v", id, err)
 		}

workspace-server/internal/handlers/workspace_crud_helpers_test.go

@@ -1,165 +0,0 @@
-package handlers
-
-// workspace_crud_helpers_test.go — tests for pure-logic helpers in workspace_crud.go.
-//
-// Covered helpers:
-//   validateWorkspaceDir — bind-mount path safety (CWE-22 defence-in-depth)
-
-import "testing"
-
-// ─────────────────────────────────────────────────────────────────────────────
-// validateWorkspaceDir
-// ─────────────────────────────────────────────────────────────────────────────
-
-func TestValidateWorkspaceDir_AcceptsValidAbsolutePath(t *testing.T) {
-	cases := []string{
-		"/home/ubuntu/workspace",
-		"/opt/myapp/data",
-		"/tmp/molecule-workspace",
-		"/Users/admin/workspace",
-		"/workspace",
-		"/mnt/volumes/data",
-		"/srv/molecule",
-		"/nix/store",
-	}
-	for _, dir := range cases {
-		err := validateWorkspaceDir(dir)
-		if err != nil {
-			t.Errorf("validateWorkspaceDir(%q) returned error: %v; want nil", dir, err)
-		}
-	}
-}
-
-func TestValidateWorkspaceDir_RejectsRelativePath(t *testing.T) {
-	cases := []string{
-		"relative/path",
-		"./local",
-		"../sibling",
-		"workspace",
-		"",
-	}
-	for _, dir := range cases {
-		err := validateWorkspaceDir(dir)
-		if err == nil {
-			t.Errorf("validateWorkspaceDir(%q) = nil; want error (relative path)", dir)
-		}
-	}
-}
-
-func TestValidateWorkspaceDir_RejectsTraversalSequence(t *testing.T) {
-	cases := []string{
-		"/etc/../../../etc/passwd",
-		"/home/user/../../root",
-		"/workspace/../../../sibling",
-		"/foo/bar/..%2f..%2fetc",
-		"/valid/../etc/passwd",
-	}
-	for _, dir := range cases {
-		err := validateWorkspaceDir(dir)
-		if err == nil {
-			t.Errorf("validateWorkspaceDir(%q) = nil; want error (traversal)", dir)
-		}
-	}
-}
-
-func TestValidateWorkspaceDir_RejectsSystemPaths(t *testing.T) {
-	// System paths must be rejected outright — a workspace binding /etc or
-	// /proc would let the agent read host secrets or inspect kernel state.
-	systemPaths := []string{
-		"/etc",
-		"/var",
-		"/proc",
-		"/sys",
-		"/dev",
-		"/boot",
-		"/sbin",
-		"/bin",
-		"/usr",
-	}
-	for _, dir := range systemPaths {
-		err := validateWorkspaceDir(dir)
-		if err == nil {
-			t.Errorf("validateWorkspaceDir(%q) = nil; want error (system path)", dir)
-		}
-	}
-}
-
-func TestValidateWorkspaceDir_RejectsDescendantsOfSystemPaths(t *testing.T) {
-	// A descendant of a system path must also be rejected — /etc/shadow,
-	// /proc/1/cmdline, /dev/null all fall in this category.
-	descendants := []string{
-		"/etc/passwd",
-		"/etc/shadow",
-		"/etc/ssh/sshd_config",
-		"/var/log/syslog",
-		"/proc/self/environ",
-		"/sys/kernel/version",
-		"/dev/null",
-		"/boot/grub/grub.cfg",
-		"/sbin/init",
-		"/bin/bash",
-		"/usr/bin/python3",
-	}
-	for _, dir := range descendants {
-		err := validateWorkspaceDir(dir)
-		if err == nil {
-			t.Errorf("validateWorkspaceDir(%q) = nil; want error (descendant of system path)", dir)
-		}
-	}
-}
-
-func TestValidateWorkspaceDir_AcceptsPathsSimilarToSystemPaths(t *testing.T) {
-	// Paths that LOOK like system paths but are NOT exact matches or
-	// descendants should be accepted. These are valid workspace directories.
-	valid := []string{
-		"/etcworkspace",
-		"/varworkspace",
-		"/procworkspace",
-		"/sysworkspace",
-		"/devworkspace",
-		"/bootworkspace",
-		"/sbinworkspace",
-		"/binworkspace",
-		"/usrworkspace",
-		"/etx",    // typo of /etc but a different path
-		"/vartmp",  // /var/tmp is different from /var
-		"/usrr",    // typo of /usr but a different path
-		"/workspace/etc",
-		"/workspace/var",
-		"/home/user/etc",
-		"/opt/etc",
-	}
-	for _, dir := range valid {
-		err := validateWorkspaceDir(dir)
-		if err != nil {
-			t.Errorf("validateWorkspaceDir(%q) returned error: %v; want nil", dir, err)
-		}
-	}
-}
-
-func TestValidateWorkspaceDir_ErrorMessages(t *testing.T) {
-	// Error messages must be descriptive enough for operators to self-diagnose.
-	relErr := validateWorkspaceDir("relative")
-	if relErr == nil {
-		t.Fatal("relative path: want error, got nil")
-	}
-	if relErr.Error() == "" {
-		t.Error("relative path error message is empty")
-	}
-
-	travErr := validateWorkspaceDir("/etc/../../../etc/passwd")
-	if travErr == nil {
-		t.Fatal("traversal: want error, got nil")
-	}
-	if travErr.Error() == "" {
-		t.Error("traversal error message is empty")
-	}
-
-	sysErr := validateWorkspaceDir("/etc")
-	if sysErr == nil {
-		t.Fatal("system path: want error, got nil")
-	}
-	if sysErr.Error() == "" {
-		t.Error("system path error message is empty")
-	}
-}

workspace-server/internal/handlers/workspace_crud_test.go

@@ -187,43 +187,57 @@ func TestState_QueryError(t *testing.T) {
 // ---------- Update ----------
 
 func TestUpdate_InvalidUUID(t *testing.T) {
-	err := validateWorkspaceID("not-a-uuid")
-	if err == nil {
-		t.Error("expected error for invalid UUID in PATCH path")
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
+	body := map[string]interface{}{"name": "Test"}
+	b, _ := json.Marshal(body)
+	req, _ := http.NewRequest("PATCH", "/workspaces/not-a-uuid", bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 func TestUpdate_InvalidBody(t *testing.T) {
-	_, r := setupWorkspaceCrudTest(t)
+	_, _ = setupWorkspaceCrudTest(t)
 	h := newWorkspaceCrudHandler(t)
-	r.PATCH("/workspaces/:id", h.Update)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
 
 	req, _ := http.NewRequest("PATCH", "/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", bytes.NewReader([]byte("not json")))
 	req.Header.Set("Content-Type", "application/json")
 	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
+	r2.ServeHTTP(w, req)
 
 	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400 for malformed JSON, got %d: %s", w.Code, w.Body.String())
+		t.Errorf("expected 400, got %d", w.Code)
 	}
 }
 
 func TestUpdate_WorkspaceNotFound(t *testing.T) {
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	mock, r := setupWorkspaceCrudTest(t)
+	mock, _ := setupWorkspaceCrudTest(t)
 	h := newWorkspaceCrudHandler(t)
-	r.PATCH("/workspaces/:id", h.Update)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
+	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
 
 	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces WHERE id = \$1\)`).
 		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(false))
 
 	body := map[string]interface{}{"name": "New Name"}
 	b, _ := json.Marshal(body)
 	req, _ := http.NewRequest("PATCH", "/workspaces/"+wsID, bytes.NewReader(b))
 	req.Header.Set("Content-Type", "application/json")
 	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
+	r2.ServeHTTP(w, req)
 
 	if w.Code != http.StatusNotFound {
 		t.Errorf("expected 404, got %d: %s", w.Code, w.Body.String())
@@ -231,78 +245,163 @@ func TestUpdate_WorkspaceNotFound(t *testing.T) {
 }
 
 func TestUpdate_NameTooLong(t *testing.T) {
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
 	longName := make([]byte, 256)
 	for i := range longName {
 		longName[i] = 'x'
 	}
-	err := validateWorkspaceFields(string(longName), "", "", "")
-	if err == nil {
-		t.Error("expected error for name > 255 chars")
+	body := map[string]interface{}{"name": string(longName)}
+	b, _ := json.Marshal(body)
+	req, _ := http.NewRequest("PATCH", "/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for name too long, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 func TestUpdate_RoleTooLong(t *testing.T) {
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
 	longRole := make([]byte, 1001)
 	for i := range longRole {
 		longRole[i] = 'x'
 	}
-	err := validateWorkspaceFields("", string(longRole), "", "")
-	if err == nil {
-		t.Error("expected error for role > 1000 chars")
+	body := map[string]interface{}{"role": string(longRole)}
+	b, _ := json.Marshal(body)
+	req, _ := http.NewRequest("PATCH", "/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for role too long, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 func TestUpdate_NameWithNewline(t *testing.T) {
-	err := validateWorkspaceFields("Name\nwith newline", "", "", "")
-	if err == nil {
-		t.Error("expected error for newline in name")
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
+	body := map[string]interface{}{"name": "Name\nwith newline"}
+	b, _ := json.Marshal(body)
+	req, _ := http.NewRequest("PATCH", "/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for newline in name, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 func TestUpdate_NameWithYAMLSpecialChars(t *testing.T) {
-	for _, ch := range "{}[]|>*&!" {
-		err := validateWorkspaceFields("namewith"+string(ch), "", "", "")
-		if err == nil {
-			t.Errorf("expected error for YAML special char %c in name", ch)
-		}
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
+	body := map[string]interface{}{"name": "Name with [brackets]"}
+	b, _ := json.Marshal(body)
+	req, _ := http.NewRequest("PATCH", "/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for YAML special chars in name, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 func TestUpdate_WorkspaceDirSystemPath(t *testing.T) {
-	err := validateWorkspaceDir("/etc/my-workspace")
-	if err == nil {
-		t.Error("expected error for /etc/ system path in workspace_dir")
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
+	body := map[string]interface{}{"workspace_dir": "/etc/my-workspace"}
+	b, _ := json.Marshal(body)
+	req, _ := http.NewRequest("PATCH", "/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for system path workspace_dir, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 func TestUpdate_WorkspaceDirTraversal(t *testing.T) {
-	err := validateWorkspaceDir("/workspace/../../../etc")
-	if err == nil {
-		t.Error("expected error for traversal in workspace_dir")
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
+	body := map[string]interface{}{"workspace_dir": "/workspace/../../../etc"}
+	b, _ := json.Marshal(body)
+	req, _ := http.NewRequest("PATCH", "/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for traversal in workspace_dir, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 func TestUpdate_WorkspaceDirRelativePath(t *testing.T) {
-	err := validateWorkspaceDir("relative/path")
-	if err == nil {
-		t.Error("expected error for relative workspace_dir")
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.PATCH("/workspaces/:id", h.Update)
+
+	body := map[string]interface{}{"workspace_dir": "relative/path"}
+	b, _ := json.Marshal(body)
+	req, _ := http.NewRequest("PATCH", "/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for relative workspace_dir, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 // ---------- Delete ----------
 
 func TestDelete_InvalidUUID(t *testing.T) {
-	err := validateWorkspaceID("not-a-uuid")
-	if err == nil {
-		t.Error("expected error for invalid UUID in DELETE path")
+	_, _ = setupWorkspaceCrudTest(t)
+	h := newWorkspaceCrudHandler(t)
+	r2 := gin.New()
+	r2.DELETE("/workspaces/:id", h.Delete)
+
+	req, _ := http.NewRequest("DELETE", "/workspaces/not-a-uuid", nil)
+	w := httptest.NewRecorder()
+	r2.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
 func TestDelete_HasChildrenWithoutConfirm(t *testing.T) {
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	mock, r := setupWorkspaceCrudTest(t)
+	mock, _ := setupWorkspaceCrudTest(t)
 	h := newWorkspaceCrudHandler(t)
-	r.DELETE("/workspaces/:id", h.Delete)
+	r2 := gin.New()
+	r2.DELETE("/workspaces/:id", h.Delete)
+
+	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
 
 	mock.ExpectQuery(`SELECT id, name FROM workspaces WHERE parent_id = \$1 AND status != 'removed'`).
 		WithArgs(wsID).
@@ -312,7 +411,7 @@ func TestDelete_HasChildrenWithoutConfirm(t *testing.T) {
 	req, _ := http.NewRequest("DELETE", "/workspaces/"+wsID, nil)
 	// No ?confirm=true
 	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
+	r2.ServeHTTP(w, req)
 
 	if w.Code != http.StatusConflict {
 		t.Errorf("expected 409, got %d: %s", w.Code, w.Body.String())
@@ -331,10 +430,12 @@ func TestDelete_HasChildrenWithoutConfirm(t *testing.T) {
 }
 
 func TestDelete_ChildrenCheckQueryError(t *testing.T) {
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	mock, r := setupWorkspaceCrudTest(t)
+	mock, _ := setupWorkspaceCrudTest(t)
 	h := newWorkspaceCrudHandler(t)
-	r.DELETE("/workspaces/:id", h.Delete)
+	r2 := gin.New()
+	r2.DELETE("/workspaces/:id", h.Delete)
+
+	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
 
 	mock.ExpectQuery(`SELECT id, name FROM workspaces WHERE parent_id = \$1 AND status != 'removed'`).
 		WithArgs(wsID).
@@ -342,7 +443,7 @@ func TestDelete_ChildrenCheckQueryError(t *testing.T) {
 
 	req, _ := http.NewRequest("DELETE", "/workspaces/"+wsID, nil)
 	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
+	r2.ServeHTTP(w, req)
 
 	if w.Code != http.StatusInternalServerError {
 		t.Errorf("expected 500, got %d", w.Code)

workspace-server/internal/handlers/workspace_crud_validators_test.go

@@ -1,167 +0,0 @@
-package handlers
-
-import (
-	"testing"
-)
-
-// ── validateWorkspaceDir ───────────────────────────────────────────────────────
-
-func TestValidateWorkspaceDir_RelativeRejected(t *testing.T) {
-	cases := []string{
-		"relative/path",
-		"./myworkspace",
-		"~/workspaces/dev",
-	}
-	for _, dir := range cases {
-		t.Run(dir, func(t *testing.T) {
-			if err := validateWorkspaceDir(dir); err == nil {
-				t.Errorf("validateWorkspaceDir(%q): expected error (relative path), got nil", dir)
-			}
-		})
-	}
-}
-
-func TestValidateWorkspaceDir_TraversalRejected(t *testing.T) {
-	cases := []string{
-		"/opt/molecule/../../../etc",
-		"/workspaces/dev/../../root",
-		"/opt/../opt/../etc",
-	}
-	for _, dir := range cases {
-		t.Run(dir, func(t *testing.T) {
-			if err := validateWorkspaceDir(dir); err == nil {
-				t.Errorf("validateWorkspaceDir(%q): expected error (traversal), got nil", dir)
-			}
-		})
-	}
-}
-
-func TestValidateWorkspaceDir_SystemPathsRejected(t *testing.T) {
-	cases := []string{
-		"/etc",
-		"/etc/molecule",
-		"/var",
-		"/var/log",
-		"/proc",
-		"/proc/self",
-		"/sys",
-		"/sys/kernel",
-		"/dev",
-		"/dev/null",
-		"/boot",
-		"/sbin",
-		"/bin",
-		"/lib",
-		"/usr",
-		"/usr/local",
-	}
-	for _, dir := range cases {
-		t.Run(dir, func(t *testing.T) {
-			if err := validateWorkspaceDir(dir); err == nil {
-				t.Errorf("validateWorkspaceDir(%q): expected error (system path), got nil", dir)
-			}
-		})
-	}
-}
-
-func TestValidateWorkspaceDir_PrefixMatchesBlocked(t *testing.T) {
-	// The blocklist checks prefix so /etc/foo must also be rejected.
-	cases := []string{
-		"/etc/molecule-config",
-		"/var/log/workspace",
-		"/usr/local/bin",
-		"/usr/bin/molecule",
-	}
-	for _, dir := range cases {
-		t.Run(dir, func(t *testing.T) {
-			if err := validateWorkspaceDir(dir); err == nil {
-				t.Errorf("validateWorkspaceDir(%q): expected error (prefix of blocked path), got nil", dir)
-			}
-		})
-	}
-}
-
-// ── validateWorkspaceFields ────────────────────────────────────────────────────
-
-func TestValidateWorkspaceFields_AllEmpty(t *testing.T) {
-	// All empty → valid (creation uses defaults; empty is allowed)
-	if err := validateWorkspaceFields("", "", "", ""); err != nil {
-		t.Errorf("validateWorkspaceFields with all empty: expected nil, got %v", err)
-	}
-}
-
-func TestValidateWorkspaceFields_ModelTooLong(t *testing.T) {
-	longModel := make([]byte, 101)
-	for i := range longModel {
-		longModel[i] = 'x'
-	}
-	if err := validateWorkspaceFields("", "", string(longModel), ""); err == nil {
-		t.Error("model > 100 chars: expected error, got nil")
-	}
-}
-
-func TestValidateWorkspaceFields_RuntimeTooLong(t *testing.T) {
-	longRuntime := make([]byte, 101)
-	for i := range longRuntime {
-		longRuntime[i] = 'x'
-	}
-	if err := validateWorkspaceFields("", "", "", string(longRuntime)); err == nil {
-		t.Error("runtime > 100 chars: expected error, got nil")
-	}
-}
-
-func TestValidateWorkspaceFields_CRLFInRole(t *testing.T) {
-	if err := validateWorkspaceFields("", "Backend\r\nEngineer", "", ""); err == nil {
-		t.Error("role with \\r\\n: expected error, got nil")
-	}
-}
-
-func TestValidateWorkspaceFields_NewlineInModel(t *testing.T) {
-	if err := validateWorkspaceFields("", "", "gpt-\n4o", ""); err == nil {
-		t.Error("model with \\n: expected error, got nil")
-	}
-}
-
-func TestValidateWorkspaceFields_NewlineInRuntime(t *testing.T) {
-	if err := validateWorkspaceFields("", "", "", "lang\rgraph"); err == nil {
-		t.Error("runtime with \\r: expected error, got nil")
-	}
-}
-
-func TestValidateWorkspaceFields_YAMLSpecialChars(t *testing.T) {
-	// yamlSpecialChars = "{}[]|>*&!"
-	// These must be rejected in name and role.
-	dangerous := []string{
-		"Workspace{evil}",
-		"Workspace[evil]",
-		"Workspace]evil[",
-		"Workspace|evil",
-		"Workspace>evil",
-		"Workspace*evil",
-		"Workspace&evil",
-		"Workspace!evil",
-		"Name{}",
-		"Role[]",
-	}
-	for _, v := range dangerous {
-		t.Run(v, func(t *testing.T) {
-			if err := validateWorkspaceFields(v, "", "", ""); err == nil {
-				t.Errorf("name %q: expected error (YAML special char), got nil", v)
-			}
-		})
-	}
-}
-
-func TestValidateWorkspaceFields_YAMLCharsAllowedInModelRuntime(t *testing.T) {
-	// YAML special chars are only blocked in name/role, not model/runtime.
-	if err := validateWorkspaceFields("", "", "model{}[]", "runtime*&!"); err != nil {
-		t.Errorf("model/runtime with YAML chars: expected nil, got %v", err)
-	}
-}
-
-func TestValidateWorkspaceFields_YAMLCharsAllowedInEmptyName(t *testing.T) {
-	// Empty name is fine; YAML char restriction is only on non-empty values.
-	if err := validateWorkspaceFields("", "Backend Engineer", "", ""); err != nil {
-		t.Errorf("empty name with valid role: expected nil, got %v", err)
-	}
-}

workspace-server/internal/handlers/workspace_dispatchers.go

@@ -111,11 +111,11 @@ func (h *WorkspaceHandler) provisionWorkspaceAuto(workspaceID, templatePath stri
 		"sync":         false,
 	})
 	if h.cpProv != nil {
-		h.goAsync(func() { h.provisionWorkspaceCP(workspaceID, templatePath, configFiles, payload) })
+		go h.provisionWorkspaceCP(workspaceID, templatePath, configFiles, payload)
 		return true
 	}
 	if h.provisioner != nil {
-		h.goAsync(func() { h.provisionWorkspace(workspaceID, templatePath, configFiles, payload) })
+		go h.provisionWorkspace(workspaceID, templatePath, configFiles, payload)
 		return true
 	}
 	// No backend wired — mark failed so the workspace doesn't linger in
@@ -275,13 +275,13 @@ func (h *WorkspaceHandler) RestartWorkspaceAutoOpts(ctx context.Context, workspa
 	if h.cpProv != nil {
 		h.cpStopWithRetry(ctx, workspaceID, "RestartWorkspaceAuto")
 		// resetClaudeSession is Docker-only — CP has no session state to clear.
-		h.goAsync(func() { h.provisionWorkspaceCP(workspaceID, templatePath, configFiles, payload) })
+		go h.provisionWorkspaceCP(workspaceID, templatePath, configFiles, payload)
 		return true
 	}
 	if h.provisioner != nil {
 		// Docker.Stop has no retry — see docstring rationale.
 		h.provisioner.Stop(ctx, workspaceID)
-		h.goAsync(func() { h.provisionWorkspaceOpts(workspaceID, templatePath, configFiles, payload, resetClaudeSession) })
+		go h.provisionWorkspaceOpts(workspaceID, templatePath, configFiles, payload, resetClaudeSession)
 		return true
 	}
 	// No backend wired — same shape as provisionWorkspaceAuto's no-backend

workspace-server/internal/handlers/workspace_dispatchers_test.go

@@ -1,165 +0,0 @@
-package handlers
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/models"
-)
-
-// ==================== resolveDeliveryMode ====================
-// Covers workspace_dispatchers.go / registry.go:resolveDeliveryMode
-
-func TestResolveDeliveryMode_PayloadModeWins(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	h := NewRegistryHandler(broadcaster)
-
-	ctx := context.Background()
-	for _, mode := range []string{models.DeliveryModePush, models.DeliveryModePoll} {
-		got, err := h.resolveDeliveryMode(ctx, "ws-any-id", mode)
-		if err != nil {
-			t.Errorf("resolveDeliveryMode(payloadMode=%q) unexpected error: %v", mode, err)
-		}
-		if got != mode {
-			t.Errorf("resolveDeliveryMode(payloadMode=%q) = %q, want %q", mode, got, mode)
-		}
-	}
-
-	// DB must NOT have been queried when payloadMode is set.
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("DB expectations not met: %v", err)
-	}
-}
-
-func TestResolveDeliveryMode_ExistingDeliveryMode(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	h := NewRegistryHandler(broadcaster)
-
-	// Workspace row has existing delivery_mode = "poll"
-	mock.ExpectQuery("SELECT delivery_mode, runtime FROM workspaces").
-		WithArgs("ws-poll").
-		WillReturnRows(sqlmock.NewRows([]string{"delivery_mode", "runtime"}).
-			AddRow("poll", "langgraph"))
-
-	ctx := context.Background()
-	got, err := h.resolveDeliveryMode(ctx, "ws-poll", "")
-	if err != nil {
-		t.Errorf("resolveDeliveryMode() unexpected error: %v", err)
-	}
-	if got != models.DeliveryModePoll {
-		t.Errorf("resolveDeliveryMode() = %q, want %q", got, models.DeliveryModePoll)
-	}
-}
-
-func TestResolveDeliveryMode_ExternalRuntime_DefaultsToPoll(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	h := NewRegistryHandler(broadcaster)
-
-	// Row exists but delivery_mode is NULL; runtime = "external"
-	mock.ExpectQuery("SELECT delivery_mode, runtime FROM workspaces").
-		WithArgs("ws-external").
-		WillReturnRows(sqlmock.NewRows([]string{"delivery_mode", "runtime"}).
-			AddRow(nil, "external"))
-
-	ctx := context.Background()
-	got, err := h.resolveDeliveryMode(ctx, "ws-external", "")
-	if err != nil {
-		t.Errorf("resolveDeliveryMode() unexpected error: %v", err)
-	}
-	if got != models.DeliveryModePoll {
-		t.Errorf("resolveDeliveryMode() = %q, want %q (external runtime)", got, models.DeliveryModePoll)
-	}
-}
-
-func TestResolveDeliveryMode_SelfHosted_DefaultsToPush(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	h := NewRegistryHandler(broadcaster)
-
-	// Row exists; delivery_mode is NULL; runtime = "langgraph"
-	mock.ExpectQuery("SELECT delivery_mode, runtime FROM workspaces").
-		WithArgs("ws-self-hosted").
-		WillReturnRows(sqlmock.NewRows([]string{"delivery_mode", "runtime"}).
-			AddRow(nil, "langgraph"))
-
-	ctx := context.Background()
-	got, err := h.resolveDeliveryMode(ctx, "ws-self-hosted", "")
-	if err != nil {
-		t.Errorf("resolveDeliveryMode() unexpected error: %v", err)
-	}
-	if got != models.DeliveryModePush {
-		t.Errorf("resolveDeliveryMode() = %q, want %q (self-hosted default)", got, models.DeliveryModePush)
-	}
-}
-
-func TestResolveDeliveryMode_NotFound_DefaultsToPush(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	h := NewRegistryHandler(broadcaster)
-
-	// Row not found → sql.ErrNoRows → default push
-	mock.ExpectQuery("SELECT delivery_mode, runtime FROM workspaces").
-		WithArgs("ws-nonexistent").
-		WillReturnError(sql.ErrNoRows)
-
-	ctx := context.Background()
-	got, err := h.resolveDeliveryMode(ctx, "ws-nonexistent", "")
-	if err != nil {
-		t.Errorf("resolveDeliveryMode() unexpected error on no-rows: %v", err)
-	}
-	if got != models.DeliveryModePush {
-		t.Errorf("resolveDeliveryMode() = %q, want %q (not-found default)", got, models.DeliveryModePush)
-	}
-}
-
-func TestResolveDeliveryMode_DBError_Propagated(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	h := NewRegistryHandler(broadcaster)
-
-	mock.ExpectQuery("SELECT delivery_mode, runtime FROM workspaces").
-		WithArgs("ws-error").
-		WillReturnError(context.DeadlineExceeded)
-
-	ctx := context.Background()
-	_, err := h.resolveDeliveryMode(ctx, "ws-error", "")
-	if err == nil {
-		t.Errorf("resolveDeliveryMode() expected error, got nil")
-	}
-}
-
-func TestResolveDeliveryMode_ExistingDeliveryModeEmptyString(t *testing.T) {
-	// When the DB returns an empty (non-NULL) string for delivery_mode,
-	// it falls through to the runtime check (not the existing.Valid path).
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	h := NewRegistryHandler(broadcaster)
-
-	// delivery_mode is explicitly empty string (not NULL), runtime = "langgraph"
-	// → falls through to runtime check → "push" for non-external
-	mock.ExpectQuery("SELECT delivery_mode, runtime FROM workspaces").
-		WithArgs("ws-empty-mode").
-		WillReturnRows(sqlmock.NewRows([]string{"delivery_mode", "runtime"}).
-			AddRow("", "langgraph"))
-
-	ctx := context.Background()
-	got, err := h.resolveDeliveryMode(ctx, "ws-empty-mode", "")
-	if err != nil {
-		t.Errorf("resolveDeliveryMode() unexpected error: %v", err)
-	}
-	if got != models.DeliveryModePush {
-		t.Errorf("resolveDeliveryMode() = %q, want %q", got, models.DeliveryModePush)
-	}
-}

workspace-server/internal/handlers/workspace_provision.go

@@ -258,7 +258,7 @@ func (h *WorkspaceHandler) buildProvisionerConfig(
 	// present) wins, matching the existing WorkspaceDir precedence.
 	workspacePath := payload.WorkspaceDir
 	workspaceAccess := payload.WorkspaceAccess
-	if (workspacePath == "" || workspaceAccess == "") && db.DB != nil {
+	if workspacePath == "" || workspaceAccess == "" {
 		var dbDir, dbAccess string
 		if err := db.DB.QueryRow(
 			`SELECT COALESCE(workspace_dir, ''), COALESCE(workspace_access, 'none') FROM workspaces WHERE id = $1`,
@@ -805,9 +805,6 @@ func loadWorkspaceSecrets(ctx context.Context, workspaceID string) (map[string]s
 				envVars[k] = string(decrypted)
 			}
 		}
-		if err := globalRows.Err(); err != nil {
-			log.Printf("Provisioner: global_secrets rows.Err workspace=%s: %v", workspaceID, err)
-		}
 	}
 	wsRows, err := db.DB.QueryContext(ctx,
 		`SELECT key, encrypted_value, encryption_version FROM workspace_secrets WHERE workspace_id = $1`, workspaceID)
@@ -826,9 +823,6 @@ func loadWorkspaceSecrets(ctx context.Context, workspaceID string) (map[string]s
 				envVars[k] = string(decrypted)
 			}
 		}
-		if err := wsRows.Err(); err != nil {
-			log.Printf("Provisioner: workspace_secrets rows.Err workspace=%s: %v", workspaceID, err)
-		}
 	}
 	return envVars, ""
 }

workspace-server/internal/handlers/workspace_test.go

@@ -29,7 +29,6 @@ func TestWorkspaceGet_Success(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs("cccccccc-0001-0000-0000-000000000000").
@@ -37,7 +36,7 @@ func TestWorkspaceGet_Success(t *testing.T) {
 			AddRow("cccccccc-0001-0000-0000-000000000000", "My Agent", "worker", 1, "online", []byte(`{"name":"test"}`),
 				"http://localhost:8001", nil, 2, 1, 0.05, "", 3600, "working", "langgraph",
 				"", 10.0, 20.0, false,
-				nil, 0, false, true))
+				nil, 0))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -119,7 +118,6 @@ func TestWorkspaceGet_RemovedReturns410(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs(id).
@@ -127,7 +125,7 @@ func TestWorkspaceGet_RemovedReturns410(t *testing.T) {
 			AddRow(id, "Old Agent", "worker", 1, string(models.StatusRemoved), []byte(`null`),
 				"", nil, 0, 1, 0.0, "", 0, "", "langgraph",
 				"", 0.0, 0.0, false,
-				nil, 0, false, true))
+				nil, 0))
 	mock.ExpectQuery(`SELECT updated_at FROM workspaces`).
 		WithArgs(id).
 		WillReturnRows(sqlmock.NewRows([]string{"updated_at"}).AddRow(removedAt))
@@ -183,7 +181,6 @@ func TestWorkspaceGet_RemovedReturns410WithNullRemovedAtOnTimestampFetchFailure(
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs(id).
@@ -191,7 +188,7 @@ func TestWorkspaceGet_RemovedReturns410WithNullRemovedAtOnTimestampFetchFailure(
 			AddRow(id, "Vanished", "worker", 1, string(models.StatusRemoved), []byte(`null`),
 				"", nil, 0, 1, 0.0, "", 0, "", "langgraph",
 				"", 0.0, 0.0, false,
-				nil, 0, false, true))
+				nil, 0))
 	// Simulate the row vanishing between the two queries.
 	mock.ExpectQuery(`SELECT updated_at FROM workspaces`).
 		WithArgs(id).
@@ -246,7 +243,6 @@ func TestWorkspaceGet_RemovedWithIncludeQueryReturns200(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs(id).
@@ -254,7 +250,7 @@ func TestWorkspaceGet_RemovedWithIncludeQueryReturns200(t *testing.T) {
 			AddRow(id, "Audit Agent", "worker", 1, string(models.StatusRemoved), []byte(`null`),
 				"", nil, 0, 1, 0.0, "", 0, "", "langgraph",
 				"", 0.0, 0.0, false,
-				nil, 0, false, true))
+				nil, 0))
 	// last_outbound_at follow-up query (existing path)
 	mock.ExpectQuery(`SELECT last_outbound_at FROM workspaces`).
 		WithArgs(id).
@@ -680,7 +676,6 @@ func TestWorkspaceList_Empty(t *testing.T) {
 			"parent_id", "active_tasks", "last_error_rate", "last_sample_error",
 			"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 			"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 		}))
 
 	w := httptest.NewRecorder()
@@ -1384,7 +1379,6 @@ func TestWorkspaceGet_FinancialFieldsStripped(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	// Populate with non-zero financial values to confirm they are stripped.
 	mock.ExpectQuery("SELECT w.id, w.name").
@@ -1393,7 +1387,7 @@ func TestWorkspaceGet_FinancialFieldsStripped(t *testing.T) {
 			AddRow("cccccccc-0010-0000-0000-000000000000", "Finance Test", "worker", 1, "online", []byte(`{}`),
 				"http://localhost:9001", nil, 0, 1, 0.0, "", 0, "", "langgraph",
 				"", 0.0, 0.0, false,
-				int64(50000), int64(12500), false, true)) // budget_limit=500 USD, spend=125 USD
+				int64(50000), int64(12500))) // budget_limit=500 USD, spend=125 USD
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -1441,7 +1435,6 @@ func TestWorkspaceGet_SensitiveFieldsStripped(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs("cccccccc-0955-0000-0000-000000000000").
@@ -1454,7 +1447,7 @@ func TestWorkspaceGet_SensitiveFieldsStripped(t *testing.T) {
 				"langgraph",
 				"/home/user/secret-projects/client-work",
 				0.0, 0.0, false,
-				nil, 0, false, true))
+				nil, 0))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

workspace-server/internal/models/workspace.go

@@ -36,15 +36,6 @@ type Workspace struct {
 	// to activity_logs, agent reads via GET /activity?since_id=). See
 	// migration 045 + RFC #2339.
 	DeliveryMode       string          `json:"delivery_mode" db:"delivery_mode"`
-	// BroadcastEnabled: when true the workspace may call POST /broadcast to
-	// deliver a message to all non-removed agent workspaces in the org.
-	// Default false — only privileged orchestrators should hold this ability.
-	BroadcastEnabled   bool            `json:"broadcast_enabled" db:"broadcast_enabled"`
-	// TalkToUserEnabled: when false the workspace's send_message_to_user calls
-	// and POST /notify requests are rejected with HTTP 403 so the agent is
-	// forced to route updates through a parent workspace. Default true
-	// (preserves existing behaviour for all workspaces).
-	TalkToUserEnabled  bool            `json:"talk_to_user_enabled" db:"talk_to_user_enabled"`
 	// Canvas layout fields (from JOIN)
 	X         float64 `json:"x"`
 	Y         float64 `json:"y"`

workspace-server/internal/models/workspace_delivery_mode_test.go

@@ -1,100 +0,0 @@
-package models
-
-import "testing"
-
-// ==================== IsValidDeliveryMode ====================
-
-func TestIsValidDeliveryMode_Valid(t *testing.T) {
-	for _, mode := range []string{DeliveryModePush, DeliveryModePoll} {
-		if !IsValidDeliveryMode(mode) {
-			t.Errorf("IsValidDeliveryMode(%q) = false, want true", mode)
-		}
-	}
-}
-
-func TestIsValidDeliveryMode_Invalid(t *testing.T) {
-	cases := []struct {
-		val  string
-		want bool
-	}{
-		{"", false},         // empty string is not valid — callers must resolve the default
-		{"pushx", false},   // typo
-		{"pollx", false},    // typo
-		{"PUSH", false},     // case-sensitive
-		{"PUSH ", false},    // trailing space
-		{"push ", false},    // trailing space
-		{"hybrid", false},   // non-existent mode
-		{"poll ", false},    // trailing space
-	}
-	for _, tc := range cases {
-		got := IsValidDeliveryMode(tc.val)
-		if got != tc.want {
-			t.Errorf("IsValidDeliveryMode(%q) = %v, want %v", tc.val, got, tc.want)
-		}
-	}
-}
-
-// ==================== WorkspaceStatus ====================
-
-func TestWorkspaceStatus_String(t *testing.T) {
-	statuses := []WorkspaceStatus{
-		StatusProvisioning,
-		StatusOnline,
-		StatusOffline,
-		StatusDegraded,
-		StatusFailed,
-		StatusRemoved,
-		StatusPaused,
-		StatusHibernated,
-		StatusHibernating,
-		StatusAwaitingAgent,
-	}
-	for _, s := range statuses {
-		if got := s.String(); got != string(s) {
-			t.Errorf("WorkspaceStatus(%q).String() = %q, want %q", s, got, string(s))
-		}
-	}
-}
-
-func TestAllWorkspaceStatuses_Length(t *testing.T) {
-	// The const block has 10 statuses; AllWorkspaceStatuses must match.
-	if got := len(AllWorkspaceStatuses); got != 10 {
-		t.Errorf("len(AllWorkspaceStatuses) = %d, want 10", got)
-	}
-}
-
-func TestAllWorkspaceStatuses_ContainsAllNamed(t *testing.T) {
-	// Verify every named const appears in AllWorkspaceStatuses exactly once.
-	named := []WorkspaceStatus{
-		StatusProvisioning,
-		StatusOnline,
-		StatusOffline,
-		StatusDegraded,
-		StatusFailed,
-		StatusRemoved,
-		StatusPaused,
-		StatusHibernated,
-		StatusHibernating,
-		StatusAwaitingAgent,
-	}
-	set := make(map[WorkspaceStatus]bool, len(AllWorkspaceStatuses))
-	for _, s := range AllWorkspaceStatuses {
-		set[s] = true
-	}
-	for _, s := range named {
-		if !set[s] {
-			t.Errorf("named status %q missing from AllWorkspaceStatuses", s)
-		}
-	}
-	if len(set) != len(named) {
-		t.Errorf("AllWorkspaceStatuses has %d unique entries, want %d", len(set), len(named))
-	}
-}
-
-func TestAllWorkspaceStatuses_NoEmpty(t *testing.T) {
-	for _, s := range AllWorkspaceStatuses {
-		if s == "" {
-			t.Errorf("AllWorkspaceStatuses contains empty string")
-		}
-	}
-}

workspace-server/internal/provisioner/cp_provisioner.go

@@ -4,14 +4,12 @@ import (
 	"bytes"
 	"context"
 	"database/sql"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
 	"log"
 	"net/http"
 	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -158,11 +156,6 @@ type cpProvisionRequest struct {
 	Tier        int               `json:"tier"`
 	PlatformURL string            `json:"platform_url"`
 	Env         map[string]string `json:"env"`
-	// ConfigFiles are template + generated config files to write into the
-	// EC2 instance's /configs directory. OFFSEC-010: collected by
-	// collectCPConfigFiles which rejects symlinks and non-regular files
-	// before including them. Serialised as base64 to avoid JSON escaping.
-	ConfigFiles map[string]string `json:"config_files,omitempty"`
 }
 
 type cpProvisionResponse struct {
@@ -186,16 +179,6 @@ func (p *CPProvisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string,
 		}
 		env["ADMIN_TOKEN"] = p.adminToken
 	}
-	// Collect template files and generated configs, with OFFSEC-010 guards:
-	// - Rejects symlinks at the template root (prevents bypass via symlink traversal)
-	// - Skips symlinks during WalkDir (prevents /etc/passwd etc. inclusion)
-	// - Validates all paths are relative and non-escaping
-	// - Caps total size at 12 KiB to prevent payload bloat
-	configFiles, err := collectCPConfigFiles(cfg)
-	if err != nil {
-		return "", fmt.Errorf("cp provisioner: collect config files: %w", err)
-	}
-
 	req := cpProvisionRequest{
 		OrgID:       p.orgID,
 		WorkspaceID: cfg.WorkspaceID,
@@ -203,7 +186,6 @@ func (p *CPProvisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string,
 		Tier:        cfg.Tier,
 		PlatformURL: cfg.PlatformURL,
 		Env:         env,
-		ConfigFiles: configFiles,
 	}
 
 	body, err := json.Marshal(req)
@@ -255,94 +237,6 @@ func (p *CPProvisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string,
 	return result.InstanceID, nil
 }
 
-const cpConfigFilesMaxBytes = 12 << 10
-
-// isCPTemplateConfigFile restricts which files from a template directory are
-// eligible for transport to the control plane. Only config.yaml (the runtime
-// entrypoint config) and files under prompts/ (system prompts) are needed;
-// shipping arbitrary files (e.g. adapter.py, Dockerfile) is both unnecessary
-// and a potential data-exfiltration surface.
-func isCPTemplateConfigFile(name string) bool {
-	name = filepath.ToSlash(filepath.Clean(name))
-	return name == "config.yaml" || strings.HasPrefix(name, "prompts/")
-}
-
-func collectCPConfigFiles(cfg WorkspaceConfig) (map[string]string, error) {
-	files := make(map[string]string)
-	total := 0
-	addFile := func(name string, data []byte) error {
-		name = filepath.ToSlash(filepath.Clean(name))
-		if name == "." || strings.HasPrefix(name, "../") || strings.HasPrefix(name, "/") || strings.Contains(name, "/../") {
-			return fmt.Errorf("invalid config file path %q", name)
-		}
-		total += len(data)
-		if total > cpConfigFilesMaxBytes {
-			return fmt.Errorf("config files exceed %d bytes", cpConfigFilesMaxBytes)
-		}
-		files[name] = base64.StdEncoding.EncodeToString(data)
-		return nil
-	}
-
-	if cfg.TemplatePath != "" {
-		// Reject symlinks on the root itself — WalkDir follows symlinks,
-		// so a symlink TemplatePath that escapes the intended root directory
-		// would bypass the subsequent path-relativization checks below.
-		rootInfo, err := os.Lstat(cfg.TemplatePath)
-		if err != nil {
-			return nil, fmt.Errorf("collectCPConfigFiles: lstat template path: %w", err)
-		}
-		if rootInfo.Mode()&os.ModeSymlink != 0 {
-			return nil, fmt.Errorf("collectCPConfigFiles: template path must not be a symlink")
-		}
-		err = filepath.WalkDir(cfg.TemplatePath, func(path string, d os.DirEntry, walkErr error) error {
-			if walkErr != nil {
-				return walkErr
-			}
-			// Skip symlinks — WalkDir follows them by default, which means
-			// a symlink inside the template dir pointing to /etc/passwd
-			// would be traversed even though the resulting relative-path
-			// check would correctly reject it. Defense-in-depth: don't
-			// follow symlinks at all. (OFFSEC-010)
-			if d.Type()&os.ModeSymlink != 0 {
-				return nil
-			}
-			if d.IsDir() {
-				return nil
-			}
-			info, err := d.Info()
-			if err != nil {
-				return err
-			}
-			if !info.Mode().IsRegular() {
-				return nil
-			}
-			rel, err := filepath.Rel(cfg.TemplatePath, path)
-			if err != nil {
-				return err
-			}
-			if !isCPTemplateConfigFile(rel) {
-				return nil
-			}
-			data, err := os.ReadFile(path)
-			if err != nil {
-				return err
-			}
-			return addFile(rel, data)
-		})
-		if err != nil {
-			return nil, err
-		}
-	}
-	for name, data := range cfg.ConfigFiles {
-		if err := addFile(name, data); err != nil {
-			return nil, err
-		}
-	}
-	if len(files) == 0 {
-		return nil, nil
-	}
-	return files, nil
-}
 // Stop terminates the workspace's EC2 instance via the control plane.
 //
 // Looks up the actual EC2 instance_id from the workspaces table before

workspace-server/internal/provisioner/cp_provisioner_test.go

@@ -1,15 +1,11 @@
 package provisioner
 
 import (
-	"bytes"
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -283,105 +279,6 @@ func TestStart_TransportFailureSurfaces(t *testing.T) {
 	}
 }
 
-// TestStart_CollectsConfigFiles — verify that collectCPConfigFiles is called and
-// its result is included in the cpProvisionRequest sent to the control plane.
-// Tests the OFFSEC-010 wiring: the function's symlink guards are only effective
-// if the call site actually invokes it.
-func TestStart_CollectsConfigFiles(t *testing.T) {
-	tmpl := t.TempDir()
-	if err := os.WriteFile(filepath.Join(tmpl, "config.yaml"), []byte("name: test\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	// adapter.py is within the size limit but is NOT config.yaml or prompts/,
-	// so isCPTemplateConfigFile must exclude it from the transport.
-	if err := os.WriteFile(filepath.Join(tmpl, "adapter.py"), bytes.Repeat([]byte("x"), cpConfigFilesMaxBytes), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	var gotBody cpProvisionRequest
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		_ = json.NewDecoder(r.Body).Decode(&gotBody)
-		w.WriteHeader(http.StatusCreated)
-		_, _ = io.WriteString(w, `{"instance_id":"i-abc123","state":"pending"}`)
-	}))
-	defer srv.Close()
-
-	p := &CPProvisioner{baseURL: srv.URL, orgID: "org-1", httpClient: srv.Client()}
-	_, err := p.Start(context.Background(), WorkspaceConfig{
-		WorkspaceID:  "ws-1",
-		Runtime:     "python",
-		Tier:         1,
-		PlatformURL:  "http://tenant",
-		TemplatePath: tmpl,
-		ConfigFiles:  map[string][]byte{"generated.json": []byte(`{"key":"value"}`)},
-	})
-	if err != nil {
-		t.Fatalf("Start: %v", err)
-	}
-
-	// config.yaml from TemplatePath must be base64-encoded in ConfigFiles
-	if len(gotBody.ConfigFiles) == 0 {
-		t.Fatal("ConfigFiles is empty: collectCPConfigFiles was not called")
-	}
-
-	// Find config.yaml entry and verify it's valid base64 + correct content
-	var foundTemplate, foundGenerated bool
-	for name, encoded := range gotBody.ConfigFiles {
-		decoded, err := base64.StdEncoding.DecodeString(encoded)
-		if err != nil {
-			t.Errorf("ConfigFiles[%q] is not valid base64: %v", name, err)
-			continue
-		}
-		if name == "config.yaml" && string(decoded) == "name: test\n" {
-			foundTemplate = true
-		}
-		if name == "generated.json" && string(decoded) == `{"key":"value"}` {
-			foundGenerated = true
-		}
-	}
-	if !foundTemplate {
-		t.Errorf("ConfigFiles missing config.yaml from TemplatePath")
-	}
-	if !foundGenerated {
-		t.Errorf("ConfigFiles missing generated.json from ConfigFiles")
-	}
-	// adapter.py must NOT be in ConfigFiles — isCPTemplateConfigFile filters it out
-	for name := range gotBody.ConfigFiles {
-		if name == "adapter.py" {
-			t.Errorf("adapter.py should not be in ConfigFiles — isCPTemplateConfigFile must filter it out")
-		}
-	}
-}
-
-// TestStart_SymlinkTemplatePathError — a symlink TemplatePath should cause
-// collectCPConfigFiles to return an error, which Start must propagate.
-// Without this wiring, OFFSEC-010's root-symlink guard is dead code.
-func TestStart_SymlinkTemplatePathError(t *testing.T) {
-	// Create a temp file and a symlink pointing to it
-	tmp := t.TempDir()
-	realFile := filepath.Join(tmp, "real")
-	if err := os.WriteFile(realFile, []byte("data"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	symlink := filepath.Join(tmp, "template_link")
-	if err := os.Symlink(realFile, symlink); err != nil {
-		t.Fatal(err)
-	}
-
-	p := &CPProvisioner{baseURL: "http://unused", orgID: "org-1", httpClient: &http.Client{Timeout: time.Second}}
-	_, err := p.Start(context.Background(), WorkspaceConfig{
-		WorkspaceID:  "ws-1",
-		Runtime:     "python",
-		TemplatePath: symlink, // symlink root → OFFSEC-010 guard should fire
-	})
-	if err == nil {
-		t.Fatal("expected error for symlink TemplatePath, got nil")
-	}
-	if !strings.Contains(err.Error(), "symlink") {
-		t.Errorf("error should mention symlink, got %q", err.Error())
-	}
-}
-
 // TestStop_SendsBothAuthHeaders — verify #118/#130 compliance on the
 // teardown path. Any call to /cp/workspaces/:id must carry both the
 // platform-wide shared secret AND the per-tenant admin token, or the
@@ -945,67 +842,3 @@ func TestIsRunning_EmptyInstanceIDReturnsFalse(t *testing.T) {
 		t.Errorf("IsRunning with empty instance_id should return running=false, got true")
 	}
 }
-
-// TestCollectCPConfigFiles_SkipsSymlinks — WalkDir follows symlinks by default,
-// but collectCPConfigFiles must skip them so a symlink inside a template dir
-// pointing outside (e.g. ln -s /etc snapshot) cannot be traversed.
-// Verifies OFFSEC-010 defense-in-depth fix. (OFFSEC-010)
-func TestCollectCPConfigFiles_SkipsSymlinks(t *testing.T) {
-	tmpl := t.TempDir()
-	// Write a real file that should be included.
-	if err := os.WriteFile(filepath.Join(tmpl, "config.yaml"), []byte("name: real\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	// Create a subdir with a file that will be symlinked-outside.
-	sensitiveDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(sensitiveDir, "secret.txt"), []byte("SENSITIVE\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	// Symlink inside template dir pointing to outside path.
-	symlinkPath := filepath.Join(tmpl, "snapshot")
-	if err := os.Symlink(sensitiveDir, symlinkPath); err != nil {
-		t.Fatal(err)
-	}
-
-	files, err := collectCPConfigFiles(WorkspaceConfig{TemplatePath: tmpl})
-	if err != nil {
-		t.Fatalf("collectCPConfigFiles: %v", err)
-	}
-	if files == nil {
-		t.Fatal("files should not be nil")
-	}
-	// config.yaml must be present.
-	if _, ok := files["config.yaml"]; !ok {
-		t.Errorf("config.yaml missing from files")
-	}
-	// The symlinked path must NOT be included (even though WalkDir would
-	// traverse it, the d.Type()&os.ModeSymlink guard skips the entry).
-	for k := range files {
-		if strings.Contains(k, "snapshot") || strings.Contains(k, "secret") {
-			t.Errorf("symlink path %q should not be in files — OFFSEC-010 regression", k)
-		}
-	}
-}
-
-// TestCollectCPConfigFiles_RejectsRootSymlink — if cfg.TemplatePath itself is
-// a symlink, WalkDir would follow it to an arbitrary directory, bypassing the
-// cfg.TemplatePath boundary. The function must reject this case explicitly.
-// (OFFSEC-010)
-func TestCollectCPConfigFiles_RejectsRootSymlink(t *testing.T) {
-	real := t.TempDir()
-	if err := os.WriteFile(filepath.Join(real, "config.yaml"), []byte("name: real\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	link := filepath.Join(t.TempDir(), "template-link")
-	if err := os.Symlink(real, link); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := collectCPConfigFiles(WorkspaceConfig{TemplatePath: link})
-	if err == nil {
-		t.Error("collectCPConfigFiles with symlink TemplatePath should return error")
-	}
-	if err != nil && !strings.Contains(err.Error(), "symlink") {
-		t.Errorf("expected symlink-related error, got: %v", err)
-	}
-}

workspace-server/internal/provisioner/provisioner.go

@@ -481,22 +481,6 @@ func (p *Provisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string, e
 		return "", fmt.Errorf("failed to create container: %w", err)
 	}
 
-	// Seed /configs before the entrypoint starts. molecule-runtime reads
-	// /configs/config.yaml immediately; post-start copy races fast runtimes
-	// into a FileNotFoundError crash loop.
-	if cfg.TemplatePath != "" {
-		if err := p.CopyTemplateToContainer(ctx, resp.ID, cfg.TemplatePath); err != nil {
-			_ = p.cli.ContainerRemove(ctx, resp.ID, container.RemoveOptions{Force: true})
-			return "", fmt.Errorf("failed to copy template to container %s before start: %w", name, err)
-		}
-	}
-	if len(cfg.ConfigFiles) > 0 {
-		if err := p.WriteFilesToContainer(ctx, resp.ID, cfg.ConfigFiles); err != nil {
-			_ = p.cli.ContainerRemove(ctx, resp.ID, container.RemoveOptions{Force: true})
-			return "", fmt.Errorf("failed to write config files to container %s before start: %w", name, err)
-		}
-	}
-
 	if err := p.cli.ContainerStart(ctx, resp.ID, container.StartOptions{}); err != nil {
 		// Clean up created container on start failure
 		_ = p.cli.ContainerRemove(ctx, resp.ID, container.RemoveOptions{Force: true})
@@ -512,6 +496,20 @@ func (p *Provisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string, e
 	// /configs and /workspace, then drops to agent via gosu). No per-start
 	// chown needed here.
 
+	// Copy template files into /configs if TemplatePath is set
+	if cfg.TemplatePath != "" {
+		if err := p.CopyTemplateToContainer(ctx, resp.ID, cfg.TemplatePath); err != nil {
+			log.Printf("Provisioner: warning — failed to copy template to container %s: %v", name, err)
+		}
+	}
+
+	// Write generated config files into /configs if ConfigFiles is set
+	if len(cfg.ConfigFiles) > 0 {
+		if err := p.WriteFilesToContainer(ctx, resp.ID, cfg.ConfigFiles); err != nil {
+			log.Printf("Provisioner: warning — failed to write config files to container %s: %v", name, err)
+		}
+	}
+
 	// Resolve the host-mapped port. Retry inspect up to 3 times if Docker hasn't
 	// bound the ephemeral port yet (rare race under heavy load).
 	hostURL := InternalURL(cfg.WorkspaceID) // fallback to Docker-internal

workspace-server/internal/registry/access_test.go

@@ -14,8 +14,9 @@ func setupMockDB(t *testing.T) sqlmock.Sqlmock {
 	if err != nil {
 		t.Fatalf("sqlmock: %v", err)
 	}
+	prevDB := db.DB
 	db.DB = mockDB
-	t.Cleanup(func() { mockDB.Close() })
+	t.Cleanup(func() { mockDB.Close(); db.DB = prevDB })
 	return mock
 }
 

workspace-server/internal/registry/healthsweep_test.go

@@ -31,8 +31,9 @@ func setupTestDB(t *testing.T) sqlmock.Sqlmock {
 	if err != nil {
 		t.Fatalf("failed to create sqlmock: %v", err)
 	}
+	prevDB := db.DB
 	db.DB = mockDB
-	t.Cleanup(func() { mockDB.Close() })
+	t.Cleanup(func() { mockDB.Close(); db.DB = prevDB })
 	return mock
 }
 

workspace-server/internal/registry/hibernation_test.go

@@ -17,8 +17,9 @@ func setupHibernationMock(t *testing.T) sqlmock.Sqlmock {
 	if err != nil {
 		t.Fatalf("sqlmock.New: %v", err)
 	}
+	prevDB := db.DB
 	db.DB = mockDB
-	t.Cleanup(func() { mockDB.Close() })
+	t.Cleanup(func() { mockDB.Close(); db.DB = prevDB })
 	return mock
 }
 

workspace-server/internal/registry/liveness_test.go

@@ -18,8 +18,9 @@ func setupLivenessTestDB(t *testing.T) sqlmock.Sqlmock {
 	if err != nil {
 		t.Fatalf("failed to create sqlmock: %v", err)
 	}
+	prevDB := db.DB
 	db.DB = mockDB
-	t.Cleanup(func() { mockDB.Close() })
+	t.Cleanup(func() { mockDB.Close(); db.DB = prevDB })
 	return mock
 }
 

workspace-server/internal/router/router.go

@@ -146,9 +146,6 @@ func Setup(hub *ws.Hub, broadcaster *events.Broadcaster, prov *provisioner.Provi
 		wsAdmin.GET("/workspaces", wh.List)
 		wsAdmin.POST("/workspaces", wh.Create)
 		wsAdmin.DELETE("/workspaces/:id", wh.Delete)
-		// Ability toggles — admin-only so workspace agents cannot self-modify
-		// broadcast_enabled or talk_to_user_enabled.
-		wsAdmin.PATCH("/workspaces/:id/abilities", handlers.PatchAbilities)
 		// Out-of-band bootstrap signal: CP's watcher POSTs here when it
 		// detects "RUNTIME CRASHED" in a workspace EC2 console output,
 		// so the canvas flips to failed in seconds instead of waiting
@@ -204,12 +201,6 @@ func Setup(hub *ws.Hub, broadcaster *events.Broadcaster, prov *provisioner.Provi
 		// to 'hibernated'. The workspace auto-wakes on the next A2A message.
 		wsAuth.POST("/hibernate", wh.Hibernate)
 
-		// Broadcast — send a message to all non-removed workspaces in the org.
-		// Requires broadcast_enabled=true on the source workspace (checked
-		// inside the handler). WorkspaceAuth on wsAuth proves token ownership.
-		broadcastH := handlers.NewBroadcastHandler(broadcaster)
-		wsAuth.POST("/broadcast", broadcastH.Broadcast)
-
 		// External-workspace credential lifecycle (issue #319 follow-up to
 		// the Create flow). Both endpoints reject runtime ≠ external with
 		// 400 — see external_rotate.go for the rationale.

workspace-server/internal/scheduler/scheduler_test.go

@@ -24,8 +24,9 @@ func setupTestDB(t *testing.T) sqlmock.Sqlmock {
 	if err != nil {
 		t.Fatalf("failed to create sqlmock: %v", err)
 	}
+	prevDB := db.DB
 	db.DB = mockDB
-	t.Cleanup(func() { mockDB.Close() })
+	t.Cleanup(func() { mockDB.Close(); db.DB = prevDB })
 	return mock
 }
 

workspace-server/internal/secrets/patterns_test.go

@@ -0,0 +1,262 @@
+package secrets
+
+import (
+	"strings"
+	"sync"
+	"testing"
+)
+
+// TestEveryPatternCompiles pins that every Pattern.regexSource is a
+// valid Go-RE2 expression. Without this, a bad regex would silently
+// disable ScanBytes for everything after it (the lazy compile would
+// set compileErr and ScanBytes would return that error every call).
+func TestEveryPatternCompiles(t *testing.T) {
+	for _, p := range Patterns {
+		if p.Name == "" {
+			t.Errorf("pattern with empty Name: regex=%q", p.regexSource)
+		}
+		if p.Description == "" {
+			t.Errorf("pattern %q has empty Description", p.Name)
+		}
+	}
+	// Force compile + check error.
+	if _, err := ScanBytes([]byte("placeholder")); err != nil {
+		t.Fatalf("ScanBytes init failed: %v", err)
+	}
+}
+
+// TestNoDuplicateNames — a duplicate pattern Name would make the
+// "first match wins" semantics surprising to readers and any caller
+// switching on Match.Name (none today but adding the guard is cheap).
+func TestNoDuplicateNames(t *testing.T) {
+	seen := map[string]bool{}
+	for _, p := range Patterns {
+		if seen[p.Name] {
+			t.Errorf("duplicate pattern Name: %q", p.Name)
+		}
+		seen[p.Name] = true
+	}
+}
+
+// TestKnownPatternsAllPresent — pins which specific Name values are
+// expected. A future refactor that renames or removes one without
+// updating consumers (CI workflow, runtime pre-commit hook, Files
+// API Phase 2b backend) would silently widen the leak surface.
+// Failing here forces the rename to be intentional.
+func TestKnownPatternsAllPresent(t *testing.T) {
+	expected := []string{
+		"github-pat-classic",
+		"github-app-installation-token",
+		"github-oauth-user-to-server",
+		"github-oauth-user",
+		"github-oauth-refresh",
+		"github-pat-fine-grained",
+		"anthropic-api-key",
+		"openai-project-key",
+		"openai-service-account-key",
+		"minimax-api-key",
+		"slack-token",
+		"aws-access-key-id",
+		"aws-sts-temp-access-key-id",
+	}
+	got := map[string]bool{}
+	for _, p := range Patterns {
+		got[p.Name] = true
+	}
+	for _, want := range expected {
+		if !got[want] {
+			t.Errorf("expected pattern %q missing from Patterns slice", want)
+		}
+	}
+}
+
+// TestPositiveMatches — for each pattern, supply a representative
+// shape and assert ScanBytes returns a Match with the right Name.
+// These are TEST FIXTURES, not real credentials — each is the
+// pattern's prefix + a long-enough trailing run of placeholder chars.
+// `EXAMPLE` is sprinkled in to make grep-finds in CI logs obviously
+// fake to a human reader (matches saved memory
+// feedback_assert_exact_not_substring: tighten by Name not body).
+func TestPositiveMatches(t *testing.T) {
+	cases := []struct {
+		fixture      string
+		expectedName string
+	}{
+		{"ghp_EXAMPLE111122223333444455556666777788889999", "github-pat-classic"},
+		{"ghs_EXAMPLE111122223333444455556666777788889999", "github-app-installation-token"},
+		{"gho_EXAMPLE111122223333444455556666777788889999", "github-oauth-user-to-server"},
+		{"ghu_EXAMPLE111122223333444455556666777788889999", "github-oauth-user"},
+		{"ghr_EXAMPLE111122223333444455556666777788889999", "github-oauth-refresh"},
+		{"github_pat_EXAMPLE" + strings.Repeat("1", 80), "github-pat-fine-grained"},
+		{"sk-ant-EXAMPLE" + strings.Repeat("1", 40), "anthropic-api-key"},
+		{"sk-proj-EXAMPLE" + strings.Repeat("1", 40), "openai-project-key"},
+		{"sk-svcacct-EXAMPLE" + strings.Repeat("1", 40), "openai-service-account-key"},
+		{"sk-cp-EXAMPLE" + strings.Repeat("1", 60), "minimax-api-key"},
+		{"xoxb-" + strings.Repeat("a", 25), "slack-token"},
+		{"xoxa-" + strings.Repeat("a", 25), "slack-token"},
+		// AWS regex requires [0-9A-Z]{16} — uppercase + digits only.
+		{"AKIA1234567890ABCDEF", "aws-access-key-id"},
+		{"ASIA1234567890ABCDEF", "aws-sts-temp-access-key-id"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.expectedName, func(t *testing.T) {
+			m, err := ScanBytes([]byte(tc.fixture))
+			if err != nil {
+				t.Fatalf("ScanBytes(%q) errored: %v", tc.fixture, err)
+			}
+			if m == nil {
+				t.Fatalf("ScanBytes(%q) returned no match — expected %q", tc.fixture, tc.expectedName)
+			}
+			if m.Name != tc.expectedName {
+				t.Errorf("ScanBytes(%q) matched %q; expected %q", tc.fixture, m.Name, tc.expectedName)
+			}
+		})
+	}
+}
+
+// TestNegativeShapes — strings that look credential-adjacent but
+// shouldn't match (too short, wrong prefix, missing trailing bytes).
+// Failing here means a pattern is too loose, which would generate
+// false-positive denial in Files API and false-positive workflow
+// failures in CI.
+func TestNegativeShapes(t *testing.T) {
+	cases := []string{
+		// Too-short variants — anchored on the length suffix.
+		"ghp_tooshort",
+		"ghs_alsoshort1234",
+		"github_pat_short",
+		"sk-ant-short",
+		"sk-cp-not-enough-bytes-here",
+		// Looks like one of the prefixes but isn't (different letter).
+		"gha_EXAMPLE_thirty_six_or_more_chars_here_xxx",
+		// Slack family — wrong letter after xox.
+		"xoxz-aaaaaaaaaaaaaaaaaaaaaaaaa",
+		// AWS-shaped but wrong length suffix.
+		"AKIATOOSHORT",
+		// Empty / whitespace.
+		"",
+		"   ",
+		// Plain prose mentioning the prefix as part of a longer word.
+		"see also `ghp_HOWTO.md` in the repo",
+	}
+	for _, c := range cases {
+		t.Run(c, func(t *testing.T) {
+			m, err := ScanBytes([]byte(c))
+			if err != nil {
+				t.Fatalf("ScanBytes(%q) errored: %v", c, err)
+			}
+			if m != nil {
+				t.Errorf("ScanBytes(%q) unexpectedly matched %q", c, m.Name)
+			}
+		})
+	}
+}
+
+// TestScanString_NoOp — sanity-check ScanString is the zero-copy
+// wrapper around ScanBytes. Without this, a future refactor that
+// makes ScanString do its own thing (e.g. accidentally normalise
+// case) would diverge silently.
+func TestScanString_NoOp(t *testing.T) {
+	in := "ghp_EXAMPLE111122223333444455556666777788889999"
+	m1, err1 := ScanBytes([]byte(in))
+	if err1 != nil {
+		t.Fatalf("ScanBytes errored: %v", err1)
+	}
+	m2, err2 := ScanString(in)
+	if err2 != nil {
+		t.Fatalf("ScanString errored: %v", err2)
+	}
+	if m1 == nil || m2 == nil {
+		t.Fatalf("expected matches; got bytes=%+v string=%+v", m1, m2)
+	}
+	if m1.Name != m2.Name {
+		t.Errorf("ScanString and ScanBytes returned different Names: %q vs %q", m1.Name, m2.Name)
+	}
+}
+
+// TestMatch_NoRoundtrip — assert the Match struct does NOT include
+// the matched substring as a field. Adding such a field would
+// regress the "matched bytes never leave ScanBytes" invariant that
+// makes this package safe to call from log/UI surfaces. This is a
+// reflection-light contract test — checks the field names statically.
+func TestMatch_NoRoundtrip(t *testing.T) {
+	var m Match
+	// If someone adds a `Matched string` (or similar) field, this
+	// test reads as the canonical place to update + reconsider.
+	_ = m.Name
+	_ = m.Description
+	// The two-field shape is part of the public contract; new fields
+	// require deliberation about whether they leak the secret value.
+}
+
+// TestCompileError verifies compileAll returns an error when a regex in
+// Patterns fails to compile. This exercises the error path at
+// patterns.go:167-171 — currently 0% coverage.
+//
+// Approach: swap Patterns with a slice containing an intentionally invalid
+// regex (unbalanced `[`), reset the package-level compile state
+// (compiledOnce, compiledPatterns, compileErr), call compileAll directly,
+// then restore everything. sync.Once is reassignable because it is a
+// package-level var (not const, not predeclared).
+func TestCompileError(t *testing.T) {
+	// Save state.
+	origPatterns := Patterns
+	origOnce := compiledOnce
+	origCompiled := compiledPatterns
+	origErr := compileErr
+	defer func() {
+		Patterns = origPatterns
+		compiledOnce = origOnce
+		compiledPatterns = origCompiled
+		compileErr = origErr
+	}()
+
+	// Inject a pattern with an invalid regex (unbalanced bracket).
+	Patterns = []Pattern{{Name: "invalid", Description: "uncompileable", regexSource: "[unclosed"}}
+
+	// Reset compile state so compileAll actually runs (sync.Once is
+	// package-level and reassignable).
+	compiledOnce = sync.Once{}
+	compiledPatterns = nil
+	compileErr = nil
+
+	// Run compileAll directly — it should return an error.
+	compileAll()
+
+	if compileErr == nil {
+		t.Fatal("compileAll() returned nil error for invalid regex '[unclosed' — expected a compile error")
+	}
+}
+
+// TestScanBytes_CompileErr verifies ScanBytes propagates compileErr
+// when the package has a bad regex. This exercises the error-returning
+// path at patterns.go:201-203 — currently 0% coverage.
+//
+// We reuse the same swap/restore technique as TestCompileError to put
+// the package into a compile-err state, then call ScanBytes (not
+// compileAll directly) to verify the error path is reachable from the
+// public API.
+func TestScanBytes_CompileErr(t *testing.T) {
+	// Save state.
+	origPatterns := Patterns
+	origOnce := compiledOnce
+	origCompiled := compiledPatterns
+	origErr := compileErr
+	defer func() {
+		Patterns = origPatterns
+		compiledOnce = origOnce
+		compiledPatterns = origCompiled
+		compileErr = origErr
+	}()
+
+	// Inject an invalid regex so ScanBytes' first call triggers compileErr.
+	Patterns = []Pattern{{Name: "bad", Description: "bad", regexSource: "**invalid**"}}
+	compiledOnce = sync.Once{}
+	compiledPatterns = nil
+	compileErr = nil
+
+	_, err := ScanBytes([]byte("anything"))
+	if err == nil {
+		t.Fatal("ScanBytes returned nil error after injecting an invalid pattern — expected a compile error")
+	}
+}

workspace-server/internal/ws/hub_test.go

@@ -1,386 +0,0 @@
-package ws
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/models"
-)
-
-// ─── helpers ────────────────────────────────────────────────────────────────
-
-// mockClient returns a Client with a buffered send channel of the given size
-// and a nil WebSocket connection. Nil Conn is safe for our tests because we
-// never call WritePump (which uses Conn) — we only test the hub's send channel
-// and broadcast logic.
-func mockClient(workspaceID string, bufSize int) *Client {
-	return &Client{
-		WorkspaceID: workspaceID,
-		Send:        make(chan []byte, bufSize),
-		// Conn is nil — safe: WritePump (which uses Conn) is never called in tests.
-	}
-}
-
-// ─── NewHub ────────────────────────────────────────────────────────────────
-
-func TestNewHub_NilChecker(t *testing.T) {
-	// nil AccessChecker is accepted (hub allows all workspace→workspace broadcasts
-	// when canCommunicate is unset — the gating is purely advisory).
-	h := NewHub(nil)
-	if h == nil {
-		t.Fatal("NewHub(nil) returned nil")
-	}
-	if h.canCommunicate != nil {
-		t.Error("canCommunicate should be nil")
-	}
-}
-
-func TestNewHub_AccessCheckerWired(t *testing.T) {
-	called := false
-	checker := func(callerID, targetID string) bool {
-		called = true
-		return callerID == targetID // only self-communication allowed
-	}
-	h := NewHub(checker)
-	if h.canCommunicate == nil {
-		t.Fatal("canCommunicate not wired")
-	}
-	// Invoke the wired function directly
-	allowed := h.canCommunicate("ws-1", "ws-1")
-	if !called {
-		t.Error("checker was not called")
-	}
-	if !allowed {
-		t.Error("self-communication should be allowed")
-	}
-	if h.canCommunicate("ws-1", "ws-2") {
-		t.Error("cross-workspace communication should be blocked by checker")
-	}
-}
-
-// ─── safeSend ─────────────────────────────────────────────────────────────
-
-func TestSafeSend_OpenChannel_Sends(t *testing.T) {
-	c := mockClient("ws-1", 10)
-	data := []byte(`{"type":"ping"}`)
-	ok := safeSend(c, data)
-	if !ok {
-		t.Error("safeSend should return true for open channel")
-	}
-	select {
-	case got := <-c.Send:
-		if string(got) != string(data) {
-			t.Errorf("got %q, want %q", got, data)
-		}
-	case <-time.After(100 * time.Millisecond):
-		t.Error("no message received on channel")
-	}
-}
-
-func TestSafeSend_ClosedChannel_ReturnsFalse(t *testing.T) {
-	c := mockClient("ws-1", 10)
-	close(c.Send) // close before safeSend
-	ok := safeSend(c, []byte("data"))
-	if ok {
-		t.Error("safeSend should return false for closed channel")
-	}
-}
-
-func TestSafeSend_FullChannel_ReturnsFalse(t *testing.T) {
-	c := mockClient("ws-1", 1) // buffer size 1
-	// Fill the channel
-	c.Send <- []byte("first")
-	// Channel is now full
-	ok := safeSend(c, []byte("second"))
-	if ok {
-		t.Error("safeSend should return false when channel buffer is full")
-	}
-	// Drain to leave clean state
-	<-c.Send
-}
-
-// ─── Broadcast ────────────────────────────────────────────────────────────
-
-func TestBroadcast_CanvasAlwaysReceives(t *testing.T) {
-	h := NewHub(nil) // nil checker: canvas always gets messages
-
-	// Canvas client (no workspaceID) + two workspace clients
-	canvas := mockClient("", 10)
-	ws1 := mockClient("ws-1", 10)
-	ws2 := mockClient("ws-2", 10)
-
-	// Manually register clients into hub state
-	h.mu.Lock()
-	h.clients[canvas] = true
-	h.clients[ws1] = true
-	h.clients[ws2] = true
-	h.mu.Unlock()
-
-	msg := models.WSMessage{Event: "test", Payload: []byte(`"hello"`)}
-	h.Broadcast(msg)
-
-	// Canvas must receive
-	select {
-	case got := <-canvas.Send:
-		t.Logf("canvas received: %s", got)
-	case <-time.After(100 * time.Millisecond):
-		t.Error("canvas client did not receive broadcast")
-	}
-}
-
-func TestBroadcast_WorkspaceCanCommunicateGating(t *testing.T) {
-	// Only ws-1 can receive messages for ws-2
-	checker := func(callerID, targetID string) bool {
-		return callerID == targetID
-	}
-	h := NewHub(checker)
-
-	ws1 := mockClient("ws-1", 10)
-	ws2 := mockClient("ws-2", 10)
-	canvas := mockClient("", 10)
-
-	h.mu.Lock()
-	h.clients[ws1] = true
-	h.clients[ws2] = true
-	h.clients[canvas] = true
-	h.mu.Unlock()
-
-	// Broadcast addressed to ws-2
-	msg := models.WSMessage{Event: "test", WorkspaceID: "ws-2"}
-	h.Broadcast(msg)
-
-	// ws-1 should NOT receive (not the target, checker says no)
-	select {
-	case <-ws1.Send:
-		t.Error("ws-1 should not receive broadcast for ws-2")
-	case <-time.After(50 * time.Millisecond):
-		t.Log("ws-1 correctly blocked — no message")
-	}
-
-	// ws-2 should receive
-	select {
-	case <-ws2.Send:
-		t.Log("ws-2 correctly received broadcast")
-	case <-time.After(100 * time.Millisecond):
-		t.Error("ws-2 did not receive broadcast")
-	}
-
-	// Canvas always receives
-	select {
-	case <-canvas.Send:
-		t.Log("canvas correctly received broadcast")
-	case <-time.After(100 * time.Millisecond):
-		t.Error("canvas did not receive broadcast")
-	}
-}
-
-func TestBroadcast_DropsOnClosedChannel(t *testing.T) {
-	h := NewHub(nil)
-	c := mockClient("", 10)
-	close(c.Send) // pre-close so safeSend returns false
-
-	h.mu.Lock()
-	h.clients[c] = true
-	h.mu.Unlock()
-
-	// Broadcast must not panic; closed client should be dropped silently.
-	msg := models.WSMessage{Event: "ping"}
-	h.Broadcast(msg) // should not panic
-}
-
-func TestBroadcast_DropsOnFullChannel(t *testing.T) {
-	h := NewHub(nil)
-	c := mockClient("", 1)
-	c.Send <- []byte("blocker") // fill buffer
-
-	h.mu.Lock()
-	h.clients[c] = true
-	h.mu.Unlock()
-
-	msg := models.WSMessage{Event: "ping"}
-	h.Broadcast(msg) // safeSend returns false; no panic
-
-	// Drain to leave clean state
-	<-c.Send
-}
-
-func TestBroadcast_EmptyHubNoPanic(t *testing.T) {
-	h := NewHub(nil)
-	msg := models.WSMessage{Event: "ping"}
-	h.Broadcast(msg) // must not panic with no clients
-}
-
-func TestBroadcast_MultiClient(t *testing.T) {
-	h := NewHub(nil)
-	clients := make([]*Client, 5)
-	h.mu.Lock()
-	for i := 0; i < 5; i++ {
-		clients[i] = mockClient("", 10)
-		h.clients[clients[i]] = true
-	}
-	h.mu.Unlock()
-
-	msg := models.WSMessage{Event: "multi", Payload: []byte(`"all receive"`)}
-	h.Broadcast(msg)
-
-	for i, c := range clients {
-		select {
-		case <-c.Send:
-			t.Logf("client %d received", i)
-		case <-time.After(100 * time.Millisecond):
-			t.Errorf("client %d did not receive broadcast", i)
-		}
-	}
-}
-
-func TestBroadcast_CanvasIgnoresChecker(t *testing.T) {
-	// Strict checker that blocks ALL cross-workspace (never returns true for different IDs)
-	strictChecker := func(callerID, targetID string) bool {
-		return callerID == targetID
-	}
-	h := NewHub(strictChecker)
-
-	canvas := mockClient("", 10)
-
-	h.mu.Lock()
-	h.clients[canvas] = true
-	h.mu.Unlock()
-
-	msg := models.WSMessage{Event: "ping", WorkspaceID: "ws-1"}
-	h.Broadcast(msg)
-
-	select {
-	case <-canvas.Send:
-		t.Log("canvas received message even though checker blocks ws-1")
-	case <-time.After(100 * time.Millisecond):
-		t.Error("canvas must always receive — checker should be bypassed")
-	}
-}
-
-// ─── Close ────────────────────────────────────────────────────────────────
-
-func TestClose_DisconnectsAllClients(t *testing.T) {
-	h := NewHub(nil)
-	clients := make([]*Client, 3)
-	h.mu.Lock()
-	for i := 0; i < 3; i++ {
-		clients[i] = mockClient("", 10)
-		h.clients[clients[i]] = true
-	}
-	h.mu.Unlock()
-
-	// Start Run goroutine so Close can drain Unregister channel
-	go h.Run()
-	defer h.Close()
-
-	// Unregister all clients so the mutex is released before Close() tries to lock it
-	for _, c := range clients {
-		h.Unregister <- c
-	}
-	time.Sleep(50 * time.Millisecond)
-
-	// Now close — mutex is free, Close() should succeed
-	h.Close()
-
-	// All client channels should be closed
-	for i, c := range clients {
-		select {
-		case _, ok := <-c.Send:
-			if ok {
-				t.Errorf("client %d channel still open after Close", i)
-			}
-		case <-time.After(100 * time.Millisecond):
-			// Channel drained and closed
-		}
-	}
-}
-
-func TestClose_Idempotent(t *testing.T) {
-	h := NewHub(nil)
-	c := mockClient("", 10)
-	h.mu.Lock()
-	h.clients[c] = true
-	h.mu.Unlock()
-
-	// Close twice — must not panic or deadlock
-	h.Close()
-	h.Close() // second call also fine
-}
-
-func TestClose_ClosesDoneChannel(t *testing.T) {
-	h := NewHub(nil)
-
-	// Start Run goroutine
-	done := make(chan struct{})
-	go func() {
-		h.Run()
-		close(done)
-	}()
-
-	h.Close()
-
-	select {
-	case <-done:
-		t.Log("Run exited after Close")
-	case <-time.After(200 * time.Millisecond):
-		t.Error("Run did not exit after Close")
-	}
-}
-
-// ─── Run goroutine (Unregister) ──────────────────────────────────────────
-
-func TestRun_UnregisterClosesClientSend(t *testing.T) {
-	h := NewHub(nil)
-	c := mockClient("ws-1", 10)
-
-	// Start Run() BEFORE sending to Register — Register is unbuffered,
-	// so Run() must be ready to receive before the send can complete.
-	go h.Run()
-	defer h.Close()
-
-	// Register the client
-	h.Register <- c
-
-	// Give Run a moment to register the client
-	time.Sleep(20 * time.Millisecond)
-
-	// Unregister client
-	h.Unregister <- c
-
-	select {
-	case _, ok := <-c.Send:
-		if ok {
-			t.Error("client send channel should be closed after Unregister")
-		}
-	case <-time.After(500 * time.Millisecond):
-		t.Error("client send channel not closed within timeout")
-	}
-}
-
-// ─── Concurrent access ────────────────────────────────────────────────────
-
-func TestBroadcast_ConcurrentSafe(t *testing.T) {
-	h := NewHub(nil)
-	clients := make([]*Client, 10)
-	h.mu.Lock()
-	for i := 0; i < 10; i++ {
-		clients[i] = mockClient("", 100)
-		h.clients[clients[i]] = true
-	}
-	h.mu.Unlock()
-
-	var wg sync.WaitGroup
-	for i := 0; i < 5; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			for j := 0; j < 20; j++ {
-				h.Broadcast(models.WSMessage{Event: "ping", Payload: []byte(`"concurrent"`)})
-
-			}
-		}(i)
-	}
-
-	wg.Wait() // should not deadlock or panic
-}

workspace-server/migrations/20260514120000_workspace_abilities.down.sql

@@ -1,3 +0,0 @@
-ALTER TABLE workspaces
-    DROP COLUMN IF EXISTS broadcast_enabled,
-    DROP COLUMN IF EXISTS talk_to_user_enabled;

workspace-server/migrations/20260514120000_workspace_abilities.up.sql

@@ -1,16 +0,0 @@
--- Workspace abilities: opt-in flags that gate platform-level behaviours.
---
--- broadcast_enabled (default FALSE): when TRUE the workspace may call
---   POST /workspaces/:id/broadcast to send a message to every non-removed
---   agent workspace in the org. Off by default — only privileged
---   orchestrator workspaces should hold this ability.
---
--- talk_to_user_enabled (default TRUE): when FALSE the workspace is not
---   allowed to deliver messages to the canvas user via send_message_to_user /
---   POST /notify. The platform returns HTTP 403 so the agent can forward its
---   update to a parent workspace instead. Default TRUE preserves existing
---   behaviour for all current workspaces.
-
-ALTER TABLE workspaces
-    ADD COLUMN IF NOT EXISTS broadcast_enabled    BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN IF NOT EXISTS talk_to_user_enabled BOOLEAN NOT NULL DEFAULT TRUE;

workspace/_sanitize_a2a.py

@@ -40,8 +40,6 @@ _A2A_BOUNDARY_END = "[/A2A_RESULT_FROM_PEER]"
 # inside the trusted zone. Escape BOTH boundary markers in the raw text
 # before wrapping so they can never close the boundary early.
 # We use "[/ " as the escape prefix — visually distinct from the real marker.
-_A2A_BOUNDARY_START_ESCAPED = "[/ A2A_RESULT_FROM_PEER]"
-_A2A_BOUNDARY_END_ESCAPED = "[/ /A2A_RESULT_FROM_PEER]"
 
 
 def _escape_boundary_markers(text: str) -> str:
@@ -52,8 +50,8 @@ def _escape_boundary_markers(text: str) -> str:
     the boundary early or inject a fake opener.
     """
     return (
-        text.replace(_A2A_BOUNDARY_START, _A2A_BOUNDARY_START_ESCAPED)
-        .replace(_A2A_BOUNDARY_END, _A2A_BOUNDARY_END_ESCAPED)
+        text.replace(_A2A_BOUNDARY_START, "[/ A2A_RESULT_FROM_PEER]")
+        .replace(_A2A_BOUNDARY_END, "[/ /A2A_RESULT_FROM_PEER]")
     )
 
 

workspace/a2a_mcp_server.py

@@ -29,7 +29,6 @@ from typing import Callable
 import inbox
 
 from a2a_tools import (
-    tool_broadcast_message,
     tool_chat_history,
     tool_check_task_status,
     tool_commit_memory,
@@ -161,11 +160,6 @@ async def handle_tool_call(name: str, arguments: dict) -> str:
             arguments.get("before_ts", ""),
             source_workspace_id=arguments.get("source_workspace_id") or None,
         )
-    elif name == "broadcast_message":
-        return await tool_broadcast_message(
-            arguments.get("message", ""),
-            workspace_id=arguments.get("workspace_id") or None,
-        )
     return f"Unknown tool: {name}"
 
 

workspace/a2a_tools.py

@@ -137,7 +137,6 @@ from a2a_tools_delegation import (  # noqa: E402  (import after the from-a2a_cli
 # identically.
 from a2a_tools_messaging import (  # noqa: E402  (import after the top-of-module imports)
     _upload_chat_files,
-    tool_broadcast_message,
     tool_chat_history,
     tool_get_workspace_info,
     tool_list_peers,

workspace/a2a_tools_delegation.py

@@ -49,9 +49,7 @@ from a2a_client import (
 from a2a_tools_rbac import auth_headers_for_heartbeat as _auth_headers_for_heartbeat
 from _sanitize_a2a import (
     _A2A_BOUNDARY_END,
-    _A2A_BOUNDARY_END_ESCAPED,
     _A2A_BOUNDARY_START,
-    _A2A_BOUNDARY_START_ESCAPED,
     sanitize_a2a_result,
 )  # noqa: E402
 
@@ -332,18 +330,8 @@ async def tool_delegate_task(
     # markers so the agent can distinguish trusted (own output) from untrusted
     # (peer-supplied) content.  Explicit wrapping here rather than inside
     # sanitize_a2a_result preserves a clean separation of concerns.
-    #
-    # Truncate at the closer BEFORE sanitizing so the raw closer (which gets
-    # lost during escaping) is removed from the content.  After truncation,
-    # sanitize the remaining text and wrap with escaped boundary markers.
-    if _A2A_BOUNDARY_END in result:
-        result = result[:result.index(_A2A_BOUNDARY_END)]
     escaped = sanitize_a2a_result(result)
-    return (
-        f"{_A2A_BOUNDARY_START_ESCAPED}\n"
-        f"{escaped}\n"
-        f"{_A2A_BOUNDARY_END_ESCAPED}"
-    )
+    return f"{_A2A_BOUNDARY_START}\n{escaped}\n{_A2A_BOUNDARY_END}"
 
 
 async def tool_delegate_task_async(

workspace/a2a_tools_messaging.py

@@ -101,50 +101,6 @@ async def _upload_chat_files(
     return uploaded, None
 
 
-async def tool_broadcast_message(
-    message: str,
-    workspace_id: str | None = None,
-) -> str:
-    """Send a broadcast message to ALL agent workspaces in the org.
-
-    Requires the workspace to have broadcast_enabled=true (set by a user or
-    admin via PATCH /workspaces/:id/abilities). Use for urgent org-wide
-    signals — status changes, critical alerts, coordination instructions.
-    Every non-removed workspace receives the message in its activity log so
-    poll-mode agents pick it up, and push-mode canvases get a real-time
-    BROADCAST_MESSAGE WebSocket event.
-
-    Args:
-        message: The broadcast text. Keep it concise — all agents receive
-            this, so avoid lengthy prose that floods every context.
-        workspace_id: Optional. Which registered workspace to send the
-            broadcast from. Single-workspace agents omit this.
-    """
-    if not message:
-        return "Error: message is required"
-    target_workspace_id = (workspace_id or "").strip() or WORKSPACE_ID
-    try:
-        async with httpx.AsyncClient(timeout=30.0) as client:
-            resp = await client.post(
-                f"{PLATFORM_URL}/workspaces/{target_workspace_id}/broadcast",
-                json={"message": message},
-                headers=_auth_headers_for_heartbeat(target_workspace_id),
-            )
-            if resp.status_code == 200:
-                data = resp.json()
-                delivered = data.get("delivered", "?")
-                return f"Broadcast sent to {delivered} workspace(s)"
-            if resp.status_code == 403:
-                try:
-                    hint = resp.json().get("hint", "")
-                except Exception:
-                    hint = ""
-                return f"Error: broadcast ability not enabled.{(' ' + hint) if hint else ''}"
-            return f"Error: platform returned {resp.status_code}"
-    except Exception as e:
-        return f"Error sending broadcast: {e}"
-
-
 async def tool_send_message_to_user(
     message: str,
     attachments: list[str] | None = None,
@@ -195,20 +151,6 @@ async def tool_send_message_to_user(
                 if uploaded:
                     return f"Message sent to user with {len(uploaded)} attachment(s)"
                 return "Message sent to user"
-            if resp.status_code == 403:
-                try:
-                    body = resp.json()
-                    if body.get("error") == "talk_to_user_disabled":
-                        hint = body.get("hint", "")
-                        return (
-                            "Error: this workspace is not allowed to send messages "
-                            "directly to the user (talk_to_user is disabled). "
-                            + (hint + " " if hint else "")
-                            + "Use delegate_task to forward your update to a parent "
-                            "or supervisor workspace that can reach the user."
-                        )
-                except Exception:
-                    pass
             return f"Error: platform returned {resp.status_code}"
     except Exception as e:
         return f"Error sending message: {e}"

workspace/adapter_base.py

@@ -3,57 +3,9 @@
 import logging
 import os
 from abc import ABC, abstractmethod
-from collections.abc import Mapping
 from dataclasses import dataclass, field
 from typing import Any
 
-# ---------------------------------------------------------------------------
-# Provider routing — type alias + resolver used by individual adapters.
-# Each adapter defines its own ProviderRegistry with the providers it accepts.
-# ---------------------------------------------------------------------------
-
-# Maps prefix → (ordered_auth_env_vars, default_base_url).
-ProviderRegistry = dict[str, tuple[tuple[str, ...], str]]
-
-
-def resolve_provider_routing(
-    model_str: str,
-    env: Mapping[str, str],
-    *,
-    registry: ProviderRegistry,
-    runtime_config: dict[str, Any] | None = None,
-) -> tuple[str, str, str]:
-    """Resolve a ``provider:model`` string to ``(api_key, base_url, bare_model_id)``.
-
-    URL precedence (highest to lowest):
-      1. ``<PREFIX>_BASE_URL`` env var
-      2. ``runtime_config["provider_url"]``
-      3. registry default for the prefix
-
-    Unknown prefixes fall back to OPENAI_API_KEY + api.openai.com.
-    Raises RuntimeError when no API key env var is set for the prefix.
-    """
-    if ":" in model_str:
-        prefix, model_id = model_str.split(":", 1)
-    else:
-        prefix, model_id = "openai", model_str
-
-    env_vars, default_url = registry.get(
-        prefix, (("OPENAI_API_KEY",), "https://api.openai.com/v1")
-    )
-    api_key = next((env[v] for v in env_vars if env.get(v)), "")
-    if not api_key:
-        raise RuntimeError(
-            f"No API key found for provider {prefix!r} "
-            f"(checked: {', '.join(env_vars)}). Set one in workspace secrets."
-        )
-
-    env_url = env.get(f"{prefix.upper()}_BASE_URL", "")
-    config_url = (runtime_config or {}).get("provider_url", "")
-    base_url = env_url or config_url or default_url
-
-    return api_key, base_url, model_id
-
 from a2a.server.agent_execution import AgentExecutor
 
 from event_log import DisabledEventLog, EventLogBackend

workspace/executor_helpers.py

@@ -340,10 +340,6 @@ _CLI_A2A_COMMAND_KEYWORDS: dict[str, str | None] = {
     "delegate_task_async": "delegate --async",
     "check_task_status": "status",
     "get_workspace_info": "info",
-    # `broadcast_message` is not exposed via the CLI subprocess interface
-    # today — it's an MCP-first capability. If a2a_cli grows a `broadcast`
-    # subcommand, map it here and the alignment test will gate the change.
-    "broadcast_message": None,
     # `send_message_to_user` is not exposed via the CLI subprocess
     # interface today — it requires a structured `attachments` field
     # that wouldn't survive a positional-arg shell invocation cleanly.

workspace/platform_tools/registry.py

@@ -51,7 +51,6 @@ from dataclasses import dataclass
 from typing import Any, Literal
 
 from a2a_tools import (
-    tool_broadcast_message,
     tool_chat_history,
     tool_check_task_status,
     tool_commit_memory,
@@ -289,44 +288,6 @@ _GET_WORKSPACE_INFO = ToolSpec(
     section=A2A_SECTION,
 )
 
-_BROADCAST_MESSAGE = ToolSpec(
-    name="broadcast_message",
-    short=(
-        "Send a message to ALL agent workspaces in the org simultaneously. "
-        "Requires broadcast_enabled=true on this workspace (set by user/admin)."
-    ),
-    when_to_use=(
-        "Use for urgent, org-wide signals: critical status changes, emergency "
-        "stop instructions, coordinated task announcements. Every non-removed "
-        "workspace receives the message in its activity log (poll-mode agents "
-        "see it on their next poll; push-mode canvases get a real-time banner). "
-        "This tool returns an error if broadcast_enabled is false — a user or "
-        "admin must enable it via the workspace abilities settings first."
-    ),
-    input_schema={
-        "type": "object",
-        "properties": {
-            "message": {
-                "type": "string",
-                "description": (
-                    "The broadcast text. Keep it concise — every agent in the "
-                    "org receives this in their activity feed."
-                ),
-            },
-            "workspace_id": {
-                "type": "string",
-                "description": (
-                    "Optional. Multi-workspace mode: the registered workspace "
-                    "to broadcast from. Single-workspace agents omit this."
-                ),
-            },
-        },
-        "required": ["message"],
-    },
-    impl=tool_broadcast_message,
-    section=A2A_SECTION,
-)
-
 _SEND_MESSAGE_TO_USER = ToolSpec(
     name="send_message_to_user",
     short=(
@@ -642,7 +603,6 @@ TOOLS: list[ToolSpec] = [
     _CHECK_TASK_STATUS,
     _LIST_PEERS,
     _GET_WORKSPACE_INFO,
-    _BROADCAST_MESSAGE,
     _SEND_MESSAGE_TO_USER,
     # Inbox (standalone-only; in-container returns informational error)
     _WAIT_FOR_MESSAGE,

workspace/tests/snapshots/a2a_instructions_mcp.txt

@@ -5,7 +5,6 @@
 - **check_task_status**: Poll the status of a task started with delegate_task_async; returns result when done.
 - **list_peers**: List the workspaces this agent can communicate with — name, ID, status, role for each.
 - **get_workspace_info**: Get this workspace's own info — ID, name, role, tier, parent, status.
-- **broadcast_message**: Send a message to ALL agent workspaces in the org simultaneously. Requires broadcast_enabled=true on this workspace (set by user/admin).
 - **send_message_to_user**: Send a message directly to the user's canvas chat — pushed instantly via WebSocket. Use this to: (1) acknowledge a task immediately ('Got it, I'll start working on this'), (2) send interim progress updates while doing long work, (3) deliver follow-up results after delegation completes, (4) attach files (zip, pdf, csv, image) for the user to download via the `attachments` field (NEVER paste file URLs in `message`). The message appears in the user's chat as if you're proactively reaching out.
 - **wait_for_message**: Block until the next inbound message (canvas user OR peer agent) arrives, or until ``timeout_secs`` elapses.
 - **inbox_peek**: List pending inbound messages without removing them.
@@ -27,9 +26,6 @@ Call this first when you need to delegate but don't know the target's ID. Access
 ### get_workspace_info
 Use to introspect your own identity (e.g. before reporting back to the user, or to determine whether you're a tier-0 root that can write GLOBAL memory).
 
-### broadcast_message
-Use for urgent, org-wide signals: critical status changes, emergency stop instructions, coordinated task announcements. Every non-removed workspace receives the message in its activity log (poll-mode agents see it on their next poll; push-mode canvases get a real-time banner). This tool returns an error if broadcast_enabled is false — a user or admin must enable it via the workspace abilities settings first.
-
 ### send_message_to_user
 Use proactively across the lifecycle of a task — early to acknowledge, mid-flight to update, late to deliver. Never paste file URLs in the message body — always pass absolute paths in `attachments` so the platform serves them as download chips (works on SaaS where external file hosts are unreachable).
 

workspace/tests/test_a2a_mcp_server_http.py

@@ -570,7 +570,7 @@ def test_cli_main_transport_stdio_calls_main(monkeypatch):
 
     monkeypatch.setattr(a2a_mcp_server, "main", fake_main)
     monkeypatch.setattr(a2a_mcp_server.asyncio, "run", _sync_run)
-    monkeypatch.setattr(a2a_mcp_server, "_warn_if_stdio_not_pipe", lambda: None)
+    monkeypatch.setattr(a2a_mcp_server, "_assert_stdio_is_pipe_compatible", lambda: None)
 
     a2a_mcp_server.cli_main(transport="stdio", port=9100)
 
@@ -590,7 +590,7 @@ def test_cli_main_transport_http_calls_run_http_server(monkeypatch):
     monkeypatch.setattr(a2a_mcp_server.asyncio, "run", _sync_run)
     monkeypatch.setattr(a2a_mcp_server, "_run_http_server", fake_run_http)
     # stdio path must not be entered
-    monkeypatch.setattr(a2a_mcp_server, "_warn_if_stdio_not_pipe", lambda: None)
+    monkeypatch.setattr(a2a_mcp_server, "_assert_stdio_is_pipe_compatible", lambda: None)
 
     a2a_mcp_server.cli_main(transport="http", port=9102)
 
@@ -598,21 +598,21 @@ def test_cli_main_transport_http_calls_run_http_server(monkeypatch):
 
 
 def test_cli_main_http_skips_stdio_check(monkeypatch):
-    """When transport=http, _warn_if_stdio_not_pipe must NOT be called."""
+    """When transport=http, _assert_stdio_is_pipe_compatible must NOT be called."""
     import a2a_mcp_server
 
     called = []
 
-    def fake_warn():
-        called.append("warn_called")
+    def fake_assert():
+        called.append("assert_called")
 
     # Patch on the module object directly
-    monkeypatch.setattr(a2a_mcp_server, "_warn_if_stdio_not_pipe", fake_warn)
+    monkeypatch.setattr(a2a_mcp_server, "_assert_stdio_is_pipe_compatible", fake_assert)
     monkeypatch.setattr(a2a_mcp_server.asyncio, "run", lambda fn: None)
 
     a2a_mcp_server.cli_main(transport="http", port=9100)
 
-    assert "warn_called" not in called
+    assert "assert_called" not in called
 
 
 def test_cli_main_default_transport_is_stdio(monkeypatch):
@@ -626,7 +626,7 @@ def test_cli_main_default_transport_is_stdio(monkeypatch):
 
     monkeypatch.setattr(a2a_mcp_server, "main", fake_main)
     monkeypatch.setattr(a2a_mcp_server.asyncio, "run", _sync_run)
-    monkeypatch.setattr(a2a_mcp_server, "_warn_if_stdio_not_pipe", lambda: None)
+    monkeypatch.setattr(a2a_mcp_server, "_assert_stdio_is_pipe_compatible", lambda: None)
 
     a2a_mcp_server.cli_main()  # No args — defaults to stdio
 
@@ -642,7 +642,7 @@ def test_cli_main_main_raises_propagates(monkeypatch):
 
     monkeypatch.setattr(a2a_mcp_server, "main", fake_main)
     monkeypatch.setattr(a2a_mcp_server.asyncio, "run", _sync_run)
-    monkeypatch.setattr(a2a_mcp_server, "_warn_if_stdio_not_pipe", lambda: None)
+    monkeypatch.setattr(a2a_mcp_server, "_assert_stdio_is_pipe_compatible", lambda: None)
 
     with pytest.raises(RuntimeError, match="boom"):
         a2a_mcp_server.cli_main(transport="stdio")

workspace/tests/test_a2a_tools_delegation.py

@@ -218,8 +218,7 @@ class TestPollingPathSanitization:
         result = asyncio.run(d.tool_delegate_task("ws-peer", "do it"))
         # tool_delegate_task wraps the sanitized text in _A2A_BOUNDARY_START/END
         # (NOT _A2A_RESULT_FROM_PEER — that marker is for the messaging path).
-        # Wrapped in escaped form to prevent raw closer from appearing in output.
-        assert d._A2A_BOUNDARY_START_ESCAPED in result
-        assert d._A2A_BOUNDARY_END_ESCAPED in result
+        assert d._A2A_BOUNDARY_START in result
+        assert d._A2A_BOUNDARY_END in result
         assert "Sanitized peer reply" in result
 

workspace/tests/test_a2a_tools_impl.py

@@ -277,7 +277,7 @@ class TestToolDelegateTask:
              patch("a2a_tools.report_activity", new=AsyncMock()):
             result = await a2a_tools.tool_delegate_task("ws-1", "do something")
 
-        assert result == "[/ A2A_RESULT_FROM_PEER]\nTask completed!\n[/ /A2A_RESULT_FROM_PEER]"
+        assert result == "[A2A_RESULT_FROM_PEER]\nTask completed!\n[/A2A_RESULT_FROM_PEER]"
 
     async def test_error_response_returns_delegation_failed_message(self):
         """When send_a2a_message returns _A2A_ERROR_PREFIX text, delegation fails."""
@@ -305,7 +305,7 @@ class TestToolDelegateTask:
              patch("a2a_tools.report_activity", new=AsyncMock()):
             result = await a2a_tools.tool_delegate_task("ws-cached", "task")
 
-        assert result == "[/ A2A_RESULT_FROM_PEER]\ndone\n[/ /A2A_RESULT_FROM_PEER]"
+        assert result == "[A2A_RESULT_FROM_PEER]\ndone\n[/A2A_RESULT_FROM_PEER]"
 
     async def test_peer_name_falls_back_to_id_prefix(self):
         """When peer has no name and cache is empty, name = first 8 chars of workspace_id."""
@@ -319,7 +319,7 @@ class TestToolDelegateTask:
              patch("a2a_tools.report_activity", new=AsyncMock()):
             result = await a2a_tools.tool_delegate_task("ws-nona000", "task")
 
-        assert result == "[/ A2A_RESULT_FROM_PEER]\nok\n[/ /A2A_RESULT_FROM_PEER]"
+        assert result == "[A2A_RESULT_FROM_PEER]\nok\n[/A2A_RESULT_FROM_PEER]"
         # Cache should now have been set
         assert a2a_tools._peer_names.get("ws-nona000") is not None
 

workspace/tests/test_delegation_sync_via_polling.py

@@ -69,7 +69,7 @@ class TestFlagOffLegacyPath:
         monkeypatch.delenv("DELEGATION_SYNC_VIA_INBOX", raising=False)
 
         import a2a_tools
-        from _sanitize_a2a import _A2A_BOUNDARY_END_ESCAPED, _A2A_BOUNDARY_START_ESCAPED
+        from _sanitize_a2a import _A2A_BOUNDARY_END, _A2A_BOUNDARY_START
         send_calls = []
 
         async def fake_send(workspace_id, task, source_workspace_id=None):
@@ -91,8 +91,8 @@ class TestFlagOffLegacyPath:
             )
 
         # OFFSEC-003: result is wrapped in boundary markers
-        assert _A2A_BOUNDARY_START_ESCAPED in result
-        assert _A2A_BOUNDARY_END_ESCAPED in result
+        assert _A2A_BOUNDARY_START in result
+        assert _A2A_BOUNDARY_END in result
         assert "legacy ok" in result
         assert send_calls == [("ws-target", "task body", "ws-self")]
         poll_mock.assert_not_called()
@@ -124,7 +124,7 @@ class TestPollModeAutoFallback:
         monkeypatch.delenv("DELEGATION_SYNC_VIA_INBOX", raising=False)
 
         import a2a_tools
-        from _sanitize_a2a import _A2A_BOUNDARY_END_ESCAPED, _A2A_BOUNDARY_START_ESCAPED
+        from _sanitize_a2a import _A2A_BOUNDARY_END, _A2A_BOUNDARY_START
         from a2a_client import _A2A_QUEUED_PREFIX
 
         send_calls = []
@@ -159,8 +159,8 @@ class TestPollModeAutoFallback:
         assert poll_calls[0] == ("ws-target", "task body", "ws-self")
         # Caller sees the real reply, NOT the queued sentinel and NOT
         # a DELEGATION FAILED string. Wrapped in OFFSEC-003 boundary markers.
-        assert _A2A_BOUNDARY_START_ESCAPED in result
-        assert _A2A_BOUNDARY_END_ESCAPED in result
+        assert _A2A_BOUNDARY_START in result
+        assert _A2A_BOUNDARY_END in result
         assert "real response from poll-mode peer" in result
 
     async def test_non_queued_send_result_does_not_trigger_fallback(self, monkeypatch):
@@ -169,7 +169,7 @@ class TestPollModeAutoFallback:
         monkeypatch.delenv("DELEGATION_SYNC_VIA_INBOX", raising=False)
 
         import a2a_tools
-        from _sanitize_a2a import _A2A_BOUNDARY_END_ESCAPED, _A2A_BOUNDARY_START_ESCAPED
+        from _sanitize_a2a import _A2A_BOUNDARY_END, _A2A_BOUNDARY_START
 
         async def fake_send(*_a, **_kw):
             return "normal reply"
@@ -189,8 +189,8 @@ class TestPollModeAutoFallback:
             )
 
         # OFFSEC-003: wrapped in boundary markers
-        assert _A2A_BOUNDARY_START_ESCAPED in result
-        assert _A2A_BOUNDARY_END_ESCAPED in result
+        assert _A2A_BOUNDARY_START in result
+        assert _A2A_BOUNDARY_END in result
         assert "normal reply" in result
         poll_mock.assert_not_called()
 

workspace/tests/test_openclaw_adapter.py

@@ -1,141 +1,153 @@
-"""Unit tests for resolve_provider_routing in adapter_base.
+"""Unit tests for OpenClaw adapter env-var key selection and provider URL routing.
 
-Covers provider routing, URL-override precedence, and the missing-key error path.
-Each adapter defines its own registry; this test file defines one inline that
-mirrors what the openclaw adapter uses.
+The key-selection and URL-routing logic lives inline in OpenClawAdapter.setup()
+(adapter.py lines 84-92).  Since setup() carries heavy subprocess dependencies,
+these tests isolate the selection logic by reproducing the exact Python expressions
+from the adapter source — if the adapter's logic changes, these tests must be kept
+in sync.
+
+Organisation:
+  TestEnvKeyChain          — priority order of the 3 currently supported keys
+  TestProviderUrlMapping   — model-prefix → provider URL dict correctness
+  TestNegativeAndFallback  — no keys set / unsupported keys
+  xfail stubs              — AISTUDIO + QIANFAN documented as not-yet-implemented
 """
 from __future__ import annotations
 
+import os
+from unittest.mock import patch
+
 import pytest
 
-from adapter_base import ProviderRegistry, resolve_provider_routing
 
-# Mirror of the registry in openclaw's adapter.py — kept in sync manually.
-PROVIDER_REGISTRY: ProviderRegistry = {
-    "openai":     (("OPENAI_API_KEY",),                     "https://api.openai.com/v1"),
-    "groq":       (("GROQ_API_KEY",),                       "https://api.groq.com/openai/v1"),
-    "openrouter": (("OPENROUTER_API_KEY",),                 "https://openrouter.ai/api/v1"),
-    "qianfan":    (("QIANFAN_API_KEY", "AISTUDIO_API_KEY"), "https://qianfan.baidubce.com/v2"),
-    "minimax":    (("MINIMAX_API_KEY",),                    "https://api.minimaxi.com/v1"),
-    "moonshot":   (("KIMI_API_KEY",),                       "https://api.moonshot.ai/v1"),
+# ---------------------------------------------------------------------------
+# Helpers — mirror the exact expressions from adapter.py lines 84-92.
+# Must be kept in sync with the adapter source.
+# ---------------------------------------------------------------------------
+
+def _select_key(env: dict) -> str:
+    """Mirror line 84: nested os.environ.get priority chain."""
+    return env.get("OPENAI_API_KEY",
+                   env.get("GROQ_API_KEY",
+                           env.get("OPENROUTER_API_KEY", "")))
+
+
+_PROVIDER_URLS: dict[str, str] = {
+    "openai":     "https://api.openai.com/v1",
+    "groq":       "https://api.groq.com/openai/v1",
+    "openrouter": "https://openrouter.ai/api/v1",
 }
 
 
-class TestProviderRouting:
-
-    def test_openai_key_and_url(self):
-        api_key, base_url, model_id = resolve_provider_routing(
-            "openai:gpt-4o", {"OPENAI_API_KEY": "sk-openai"}, registry=PROVIDER_REGISTRY
-        )
-        assert api_key == "sk-openai"
-        assert base_url == "https://api.openai.com/v1"
-        assert model_id == "gpt-4o"
-
-    def test_groq_key_and_url(self):
-        api_key, base_url, model_id = resolve_provider_routing(
-            "groq:llama-3.3-70b", {"GROQ_API_KEY": "sk-groq"}, registry=PROVIDER_REGISTRY
-        )
-        assert api_key == "sk-groq"
-        assert base_url == "https://api.groq.com/openai/v1"
-        assert model_id == "llama-3.3-70b"
-
-    def test_openrouter_key_and_url(self):
-        api_key, base_url, model_id = resolve_provider_routing(
-            "openrouter:anthropic/claude-sonnet-4-5", {"OPENROUTER_API_KEY": "sk-or"}, registry=PROVIDER_REGISTRY
-        )
-        assert api_key == "sk-or"
-        assert base_url == "https://openrouter.ai/api/v1"
-        assert model_id == "anthropic/claude-sonnet-4-5"
-
-    def test_qianfan_primary_key(self):
-        api_key, _, _ = resolve_provider_routing(
-            "qianfan:ernie-4.5", {"QIANFAN_API_KEY": "sk-qf", "AISTUDIO_API_KEY": "sk-ai"}, registry=PROVIDER_REGISTRY
-        )
-        assert api_key == "sk-qf"
-
-    def test_qianfan_fallback_to_aistudio(self):
-        api_key, base_url, _ = resolve_provider_routing(
-            "qianfan:ernie-4.5", {"AISTUDIO_API_KEY": "sk-ai"}, registry=PROVIDER_REGISTRY
-        )
-        assert api_key == "sk-ai"
-        assert base_url == "https://qianfan.baidubce.com/v2"
-
-    def test_minimax_key_and_url(self):
-        api_key, base_url, model_id = resolve_provider_routing(
-            "minimax:MiniMax-M2.7", {"MINIMAX_API_KEY": "sk-mm"}, registry=PROVIDER_REGISTRY
-        )
-        assert api_key == "sk-mm"
-        assert base_url == "https://api.minimaxi.com/v1"
-        assert model_id == "MiniMax-M2.7"
-
-    def test_moonshot_key_and_url(self):
-        api_key, base_url, model_id = resolve_provider_routing(
-            "moonshot:kimi-k2.5", {"KIMI_API_KEY": "sk-kimi"}, registry=PROVIDER_REGISTRY
-        )
-        assert api_key == "sk-kimi"
-        assert base_url == "https://api.moonshot.ai/v1"
-        assert model_id == "kimi-k2.5"
-
-    def test_bare_model_id_defaults_to_openai(self):
-        api_key, base_url, model_id = resolve_provider_routing(
-            "gpt-4o", {"OPENAI_API_KEY": "sk-openai"}, registry=PROVIDER_REGISTRY
-        )
-        assert base_url == "https://api.openai.com/v1"
-        assert model_id == "gpt-4o"
-
-    def test_unknown_prefix_falls_back_to_openai_url(self):
-        api_key, base_url, model_id = resolve_provider_routing(
-            "custom-shim:my-model", {"OPENAI_API_KEY": "sk-openai"}, registry=PROVIDER_REGISTRY
-        )
-        assert base_url == "https://api.openai.com/v1"
-        assert model_id == "my-model"
+def _select_url(model: str, runtime_config: dict | None = None) -> str:
+    """Mirror lines 86-92: model-prefix → provider URL with optional override."""
+    prefix = model.split(":")[0] if ":" in model else "openai"
+    return (runtime_config or {}).get(
+        "provider_url",
+        _PROVIDER_URLS.get(prefix, "https://api.openai.com/v1"),
+    )
 
 
-class TestUrlOverridePrecedence:
+# ---------------------------------------------------------------------------
+# 1. Env-var key priority chain (3 keys currently in adapter.py)
+# ---------------------------------------------------------------------------
 
-    def test_env_base_url_beats_registry_default(self):
-        _, base_url, _ = resolve_provider_routing(
-            "minimax:MiniMax-M2.7",
-            {"MINIMAX_API_KEY": "sk-mm", "MINIMAX_BASE_URL": "https://api.minimax.chat/v1"},
-            registry=PROVIDER_REGISTRY,
-        )
-        assert base_url == "https://api.minimax.chat/v1"
+class TestEnvKeyChain:
 
-    def test_runtime_config_provider_url_beats_registry_default(self):
-        _, base_url, _ = resolve_provider_routing(
-            "openai:gpt-4o",
-            {"OPENAI_API_KEY": "sk-openai"},
-            registry=PROVIDER_REGISTRY,
-            runtime_config={"provider_url": "https://proxy.example.com/v1"},
-        )
-        assert base_url == "https://proxy.example.com/v1"
+    def test_openai_key_selected(self):
+        with patch.dict(os.environ, {"OPENAI_API_KEY": "sk-openai-test"}, clear=True):
+            assert _select_key(os.environ) == "sk-openai-test"
 
-    def test_env_base_url_beats_runtime_config(self):
-        _, base_url, _ = resolve_provider_routing(
-            "openai:gpt-4o",
-            {"OPENAI_API_KEY": "sk-openai", "OPENAI_BASE_URL": "https://env-wins.com/v1"},
-            registry=PROVIDER_REGISTRY,
-            runtime_config={"provider_url": "https://config-loses.com/v1"},
-        )
-        assert base_url == "https://env-wins.com/v1"
+    def test_groq_key_selected_when_openai_absent(self):
+        with patch.dict(os.environ, {"GROQ_API_KEY": "sk-groq-test"}, clear=True):
+            assert _select_key(os.environ) == "sk-groq-test"
+
+    def test_openrouter_key_selected_when_openai_and_groq_absent(self):
+        with patch.dict(os.environ, {"OPENROUTER_API_KEY": "sk-or-test"}, clear=True):
+            assert _select_key(os.environ) == "sk-or-test"
+
+    def test_openai_beats_groq_when_both_set(self):
+        with patch.dict(os.environ, {"OPENAI_API_KEY": "openai", "GROQ_API_KEY": "groq"}, clear=True):
+            assert _select_key(os.environ) == "openai"
+
+    def test_groq_beats_openrouter_when_openai_absent(self):
+        with patch.dict(os.environ, {"GROQ_API_KEY": "groq", "OPENROUTER_API_KEY": "or"}, clear=True):
+            assert _select_key(os.environ) == "groq"
 
 
-class TestMissingKey:
+# ---------------------------------------------------------------------------
+# 2. Model-prefix → provider URL routing
+# ---------------------------------------------------------------------------
 
-    def test_raises_when_no_key_set(self):
-        with pytest.raises(RuntimeError, match="No API key found for provider 'minimax'"):
-            resolve_provider_routing("minimax:MiniMax-M2.7", {}, registry=PROVIDER_REGISTRY)
+class TestProviderUrlMapping:
 
-    def test_raises_lists_checked_vars_in_message(self):
-        with pytest.raises(RuntimeError, match="MINIMAX_API_KEY"):
-            resolve_provider_routing("minimax:MiniMax-M2.7", {}, registry=PROVIDER_REGISTRY)
+    def test_openai_prefix_routes_to_openai(self):
+        assert _select_url("openai:gpt-4o") == "https://api.openai.com/v1"
+
+    def test_groq_prefix_routes_to_groq(self):
+        assert _select_url("groq:llama3-70b") == "https://api.groq.com/openai/v1"
+
+    def test_openrouter_prefix_routes_to_openrouter(self):
+        assert _select_url("openrouter:meta-llama/llama-3.3-70b") == "https://openrouter.ai/api/v1"
+
+    def test_runtime_config_override_wins_over_prefix(self):
+        url = _select_url("openai:gpt-4o", {"provider_url": "https://custom.example.com/v1"})
+        assert url == "https://custom.example.com/v1"
+
+    def test_unknown_prefix_falls_back_to_openai(self):
+        assert _select_url("some-unknown-model") == "https://api.openai.com/v1"
 
 
-class TestRegistryCompleteness:
-    """Smoke-check that every provider in the registry has a non-empty entry."""
+# ---------------------------------------------------------------------------
+# 3. Negative / fallback cases
+# ---------------------------------------------------------------------------
 
-    @pytest.mark.parametrize("prefix", PROVIDER_REGISTRY)
-    def test_all_providers_have_key_vars_and_url(self, prefix):
-        env_vars, base_url = PROVIDER_REGISTRY[prefix]
-        assert env_vars, f"{prefix}: env_vars is empty"
-        assert base_url.startswith("https://"), f"{prefix}: base_url looks wrong: {base_url}"
+class TestNegativeAndFallback:
+
+    def test_no_keys_returns_empty_string(self):
+        with patch.dict(os.environ, {}, clear=True):
+            assert _select_key(os.environ) == ""
+
+    def test_unsupported_aistudio_key_returns_empty(self):
+        """Documents that AISTUDIO_API_KEY is NOT yet in the adapter's key chain."""
+        with patch.dict(os.environ, {"AISTUDIO_API_KEY": "sk-ai"}, clear=True):
+            assert _select_key(os.environ) == ""
+
+    def test_unsupported_qianfan_key_returns_empty(self):
+        """Documents that QIANFAN_API_KEY is NOT yet in the adapter's key chain."""
+        with patch.dict(os.environ, {"QIANFAN_API_KEY": "sk-qf"}, clear=True):
+            assert _select_key(os.environ) == ""
+
+
+# ---------------------------------------------------------------------------
+# 4. AISTUDIO + QIANFAN — xfail stubs (not yet implemented in adapter.py)
+#    These fail now; they should be promoted to passing tests once the adapter
+#    adds AISTUDIO_API_KEY and QIANFAN_API_KEY to its key chain and provider_urls.
+# ---------------------------------------------------------------------------
+
+@pytest.mark.xfail(
+    strict=True,
+    reason=(
+        "AISTUDIO_API_KEY not yet in openclaw adapter env-var chain — "
+        "add to adapter.py line 84 and provider_urls dict with "
+        "URL https://generativelanguage.googleapis.com/v1beta/openai"
+    ),
+)
+def test_aistudio_key_routes_to_aistudio_url():
+    with patch.dict(os.environ, {"AISTUDIO_API_KEY": "sk-ai-test"}, clear=True):
+        assert _select_key(os.environ) == "sk-ai-test"
+    assert _select_url("gemini-2.5-flash") == "https://generativelanguage.googleapis.com/v1beta/openai"
+
+
+@pytest.mark.xfail(
+    strict=True,
+    reason=(
+        "QIANFAN_API_KEY not yet in openclaw adapter env-var chain — "
+        "add to adapter.py line 84 and provider_urls dict with "
+        "URL https://qianfan.baidubce.com/v2"
+    ),
+)
+def test_qianfan_key_routes_to_qianfan_url():
+    with patch.dict(os.environ, {"QIANFAN_API_KEY": "sk-qf-test"}, clear=True):
+        assert _select_key(os.environ) == "sk-qf-test"
+    assert _select_url("ernie-4.5") == "https://qianfan.baidubce.com/v2"