test(handlers): add ExpectationsWereMet check to makeTokenHandler cleanup (PR #1460 )

Per agent-reviewer REQUEST_CHANGES #7034: the new sqlmock expectations were never verified with ExpectationsWereMet, so missing SELECT/INSERT calls could pass silently. Adding the check to the makeTokenHandler cleanup covers all 4 tests that use sqlmock via the shared helper (TestGetTestToken_AdminTokenRequired_CorrectToken, TestGetTestToken_WorkspaceNotFound, TestGetTestToken_IssueTokenDBError, TestGetTestToken_ResponseContainsToken). The 3 tests that don't use sqlmock (DisabledByDefault, AdminTokenRequired_WrongToken, AdminTokenRequired_MissingBearer) get the helper but the check is a no-op for them — they early-exit on status code without hitting the DB. Closes PR #1460 review blocker.
test(handlers): add sqlmock suite for AdminTestTokenHandler
2026-06-03 22:18:12 +00:00 · 2026-05-18 00:39:25 +00:00
169 changed files with 1950 additions and 10131 deletions
@@ -1 +0,0 @@
-refire:1778784369
@@ -203,17 +203,12 @@ def ci_jobs_all(ci_doc: dict) -> set[str]:

 def ci_job_names(ci_doc: dict) -> set[str]:
    """Set of job keys in ci.yml MINUS the sentinel itself MINUS jobs
-    whose `if:` gates on `github.event_name` or `github.ref` (those are
-    event-scoped and can legitimately be `skipped` for a given trigger;
-    if we required them under the sentinel `needs:`, every PR-only job
+    whose `if:` gates on `github.event_name` (those are event-scoped
+    and can legitimately be `skipped` for a given trigger; if we
+    required them under the sentinel `needs:`, every PR-only job
    would be `skipped` on push and the sentinel would interpret
    `skipped != success` as failure). RFC §4 spec.

-    `github.ref` is the companion gate for jobs that run only on direct
-    pushes to specific branches (e.g. `github.ref == 'refs/heads/main'`).
-    These never execute in a PR context, so flagging them as missing
-    from `all-required.needs:` is a false positive (mc#958 / mc#959).
-
    Used for F1 (jobs missing from sentinel needs). NOT used for F1b
    (typos in needs) — see `ci_jobs_all` for that."""
    jobs = ci_doc.get("jobs")
@@ -226,9 +221,7 @@ def ci_job_names(ci_doc: dict) -> set[str]:
            continue
        if isinstance(v, dict):
            gate = v.get("if")
-            if isinstance(gate, str) and (
-                "github.event_name" in gate or "github.ref" in gate
-            ):
+            if isinstance(gate, str) and "github.event_name" in gate:
                continue
        names.add(k)
    return names
@@ -65,11 +65,6 @@ class ApiError(RuntimeError):
    pass


-class MergePermissionError(ApiError):
-    """Merge failed with a permanent permission error (403/404/405).
-    The queue should skip this PR and move to the next one."""
-
-
@dataclasses.dataclass(frozen=True)
 class MergeDecision:
    ready: bool
@@ -153,38 +148,15 @@ def latest_statuses_by_context(statuses: list[dict]) -> dict[str, dict]:
    return latest


-def _is_tier_low_pending_ok(
-    latest_statuses: dict[str, dict],
-    context: str,
-    pr_labels: set[str],
-) -> bool:
-    """Return True if tier:low PR can tolerate sop-checklist pending state.
-
-    Per sop-checklist-config.yaml tier_failure_mode, tier:low uses soft-fail:
-    sop-checklist posts state=pending when acks are satisfied (missing
-    manager/ceo acks are informational only). The queue should accept
-    pending instead of waiting for success.
-    """
-    if "tier:low" not in pr_labels:
-        return False
-    if "sop-checklist" not in context:
-        return False
-    status = latest_statuses.get(context) or {}
-    return status_state(status) == "pending"
-
-
 def required_contexts_green(
    latest_statuses: dict[str, dict],
    contexts: list[str],
-    pr_labels: set[str] | None = None,
 ) -> tuple[bool, list[str]]:
    missing_or_bad: list[str] = []
    for context in contexts:
        status = latest_statuses.get(context)
        state = status_state(status or {})
        if state != "success":
-            if pr_labels and _is_tier_low_pending_ok(latest_statuses, context, pr_labels):
-                continue  # tier:low soft-fail: accept pending sop-checklist
            missing_or_bad.append(f"{context}={state or 'missing'}")
    return not missing_or_bad, missing_or_bad

@@ -237,7 +209,6 @@ def evaluate_merge_readiness(
    pr_status: dict,
    required_contexts: list[str],
    pr_has_current_base: bool,
-    pr_labels: set[str] | None = None,
 ) -> MergeDecision:
    # Check push-required contexts explicitly instead of combined state.
    # Combined state can be "failure" due to non-blocking jobs
@@ -257,7 +228,7 @@ def evaluate_merge_readiness(
    # The required_contexts list is the authoritative gate — it includes only
    # the checks that actually block merges.
    latest = latest_statuses_by_context(pr_status.get("statuses") or [])
-    ok, missing_or_bad = required_contexts_green(latest, required_contexts, pr_labels)
+    ok, missing_or_bad = required_contexts_green(latest, required_contexts)
    if not ok:
        return MergeDecision(False, "wait", "required contexts not green: " + ", ".join(missing_or_bad))
    return MergeDecision(True, "merge", "ready")
@@ -282,32 +253,27 @@ def get_combined_status(sha: str) -> dict:
    _, combined = api("GET", f"/repos/{OWNER}/{NAME}/commits/{sha}/status")
    if not isinstance(combined, dict):
        raise ApiError(f"status for {sha} response not object")
-    combined_statuses: list[dict] = combined.get("statuses") or []
+    # Fetch full statuses list; 200 covers >99% of real-world runs.
+    # The list is ordered ascending by id (oldest first) — callers must
+    # iterate in reverse to get the newest entry per context.
+    # Best-effort: large repos (main with 550+ statuses) may time out.
+    # On timeout, fall back to the statuses[] already in the combined
+    # response (usually 30 entries — enough for most PRs, enough for
+    # main's early push-required contexts).
    try:
-        _, all_statuses_raw = api(
+        _, all_statuses = api(
            "GET",
            f"/repos/{OWNER}/{NAME}/commits/{sha}/statuses",
            query={"limit": "50"},
        )
-        if isinstance(all_statuses_raw, list):
-            all_statuses: list[dict] = list(all_statuses_raw)
-        else:
-            all_statuses = []
+        if isinstance(all_statuses, list):
+            combined["statuses"] = all_statuses
    except (ApiError, urllib.error.URLError, TimeoutError, OSError) as exc:
+        # URLError covers network-level failures (DNS, refused, timeout).
+        # TimeoutError and OSError cover socket-level timeouts.
        sys.stderr.write(f"::warning::could not fetch full statuses list for {sha[:8]}: {exc}\n")
-        all_statuses = []
-    # Build latest per context: process combined (ascending→reverse=newest
-    # first), then fill gaps from all_statuses (already newest-first).
-    latest: dict[str, dict] = {}
-    for status in reversed(sorted(combined_statuses, key=lambda s: s.get("id") or 0)):
-        ctx = status.get("context")
-        if isinstance(ctx, str) and ctx not in latest:
-            latest[ctx] = status
-    for status in all_statuses:
-        ctx = status.get("context")
-        if isinstance(ctx, str) and ctx not in latest:
-            latest[ctx] = status
-    combined["statuses"] = list(latest.values())
+        # Fall back to the statuses[] already in the combined response.
+        pass
    return combined


@@ -372,16 +338,7 @@ def merge_pull(pr_number: int, *, dry_run: bool) -> None:
    print(f"::notice::merging PR #{pr_number}")
    if dry_run:
        return
-    try:
-        api("POST", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/merge", body=payload, expect_json=False)
-    except ApiError as exc:
-        # Re-raise permission-like errors so process_once can skip this PR.
-        # 403 = no push access, 404 = repo/pr not found, 405 = not allowed.
-        msg = str(exc)
-        for code in ("403", "404", "405"):
-            if code in msg:
-                raise MergePermissionError(msg) from exc
-        raise  # re-raise other ApiErrors unchanged
+    api("POST", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/merge", body=payload, expect_json=False)


 def process_once(*, dry_run: bool = False) -> int:
@@ -423,13 +380,11 @@ def process_once(*, dry_run: bool = False) -> int:
    commits = get_pull_commits(pr_number)
    current_base = pr_has_current_base(pr, commits, main_sha)
    pr_status = get_combined_status(head_sha)
-    pr_labels = label_names(pr)
    decision = evaluate_merge_readiness(
        main_status=main_status,
        pr_status=pr_status,
        required_contexts=contexts,
        pr_has_current_base=current_base,
-        pr_labels=pr_labels,
    )

    print(f"::notice::PR #{pr_number} decision={decision.action}: {decision.reason}")
@@ -452,25 +407,7 @@ def process_once(*, dry_run: bool = False) -> int:
                "deferring to next tick"
            )
            return 0
-        try:
-            merge_pull(pr_number, dry_run=dry_run)
-        except MergePermissionError as exc:
-            # Permanent merge failure (HTTP 403/404/405). Post a comment so
-            # maintainers know why, then return 0 so this tick is done.
-            # The PR stays in the queue; future ticks can retry after the
-            # permission issue is resolved.
-            sys.stderr.write(f"::error::merge permission error for PR #{pr_number}: {exc}\n")
-            post_comment(
-                pr_number,
-                (
-                    "merge-queue: merge failed with HTTP 405 'User not allowed to merge PR'. "
-                    "No available token has Can-merge permission on this repo. "
-                    "Fix: grant Can-merge to a token, or add a maintain/admin collaborator. "
-                    "Skipping to next queued PR on next tick."
-                ),
-                dry_run=dry_run,
-            )
-            return 0
+        merge_pull(pr_number, dry_run=dry_run)
        return 0
    return 0

@@ -480,21 +417,7 @@ def main() -> int:
    parser.add_argument("--dry-run", action="store_true")
    args = parser.parse_args()
    _require_runtime_env()
-    try:
-        return process_once(dry_run=args.dry_run)
-    except ApiError as exc:
-        # API errors (401/403/404/500) are transient for a queue tick —
-        # log and exit 0 so the workflow is not marked failed and the next
-        # tick can retry. Returning non-zero would permanently fail the
-        # workflow run, blocking future ticks.
-        sys.stderr.write(f"::error::queue API error: {exc}\n")
-        return 0
-    except urllib.error.URLError as exc:
-        sys.stderr.write(f"::error::queue network error: {exc}\n")
-        return 0
-    except TimeoutError as exc:
-        sys.stderr.write(f"::error::queue timeout: {exc}\n")
-        return 0
+    return process_once(dry_run=args.dry_run)


 if __name__ == "__main__":
@@ -100,12 +100,11 @@ printf 'header = "Authorization: token %s"\n' "$GITEA_TOKEN" > "$CURL_AUTH_FILE"
 # (bash trap 'function' EXIT expands variables at trap-fire time, not def time).
 PR_JSON=$(mktemp)
 REVIEWS_JSON=$(mktemp)
-COMMENTS_JSON=$(mktemp)
 TEAM_PROBE_TMP=$(mktemp)
 NA_STATUSES_TMP=""  # declared here so cleanup() always has the var

 cleanup() {
-  rm -f "$CURL_AUTH_FILE" "$PR_JSON" "$REVIEWS_JSON" "$COMMENTS_JSON" "$TEAM_PROBE_TMP" "${NA_STATUSES_TMP-}"
+  rm -f "$CURL_AUTH_FILE" "$PR_JSON" "$REVIEWS_JSON" "$TEAM_PROBE_TMP" "${NA_STATUSES_TMP-}"
 }
 trap cleanup EXIT

@@ -207,81 +206,7 @@ CANDIDATES=$(jq -r --arg author "$PR_AUTHOR" --arg head "$PR_HEAD_SHA" "$JQ_FILT
 debug "candidate non-author approvers: $(echo "$CANDIDATES" | tr '\n' ' ')"

 if [ -z "$CANDIDATES" ]; then
-  # --- Guardrail (internal#503): explain the most common false
-  # "no candidates" red. Gitea's review event enum is EXACTLY
-  # APPROVED/REQUEST_CHANGES/COMMENT/PENDING. A wrong value ("APPROVE",
-  # lowercase, ...) is silently accepted (HTTP 200) and stored as
-  # state=PENDING. A correctly-started draft review has an EMPTY body;
-  # a NON-empty body + state==PENDING by a non-author == an intended
-  # verdict mis-filed by a wrong event string. Surface it actionably.
-  # This does NOT change the gate result (still fail-closed below) — it
-  # only converts a mystery red into a named, self-fixing error.
-  MISFILED_FILTER='.[]
-    | select(.state == "PENDING")
-    | select(.dismissed != true)
-    | select(.user.login != $author)
-    | select(((.body // "") | gsub("^\\s+|\\s+$";"") | length) > 0)
-    | "\(.id)\t\(.user.login)"'
-  MISFILED=$(jq -r --arg author "$PR_AUTHOR" "$MISFILED_FILTER" "$REVIEWS_JSON" 2>/dev/null || true)
-  if [ -n "$MISFILED" ]; then
-    echo "::error::${TEAM}-review: non-author review(s) were SUBMITTED but stored as PENDING — almost certainly the wrong Gitea review event string (internal#503)."
-    echo "::error::Gitea accepts ONLY the exact enum APPROVED / REQUEST_CHANGES / COMMENT. 'APPROVE' or lowercase is silently (HTTP 200) filed as PENDING and is invisible to this gate."
-    printf '%s\n' "$MISFILED" | while IFS="$(printf '\t')" read -r _rid _rl; do
-      [ -n "${_rid:-}" ] && echo "::error::  review id=${_rid} by '${_rl}': RE-SUBMIT via POST ${API}/repos/${OWNER}/${NAME}/pulls/${PR_NUMBER}/reviews with {\"event\":\"APPROVED\"} (correct enum) — do NOT edit the DB."
-    done
-  fi
-
-  # --- Fallback (internal#348): check issue comments for agent-approval ---
-  # core-qa-agent and core-security-agent approve via issue comments, NOT
-  # the reviews API. The reviews API returns zero entries for comment-only
-  # approvals. This fallback reads PR issue comments and extracts logins that:
-  #   1. Posted a comment matching the agent-prefix pattern for this gate:
-  #        qa      → "[core-qa-agent] APPROVED"
-  #        security → "[core-security-agent] APPROVED"
-  #      OR posted a generic approval keyword (word-anchored, case-insensitive):
-  #        APPROVED / LGTM / ACCEPTED
-  #   2. Are not the PR author
-  #   3. The team-membership probe below is the authoritative filter.
-  AGENT_PATTERN=""
-  case "$TEAM" in
-    qa)       AGENT_PATTERN="\\[core-qa-agent\\]" ;;
-    security) AGENT_PATTERN="\\[core-security-agent\\]" ;;
-  esac
-  HTTP_CODE=$(curl -sS -o "$COMMENTS_JSON" -w '%{http_code}' \
-    -K "$CURL_AUTH_FILE" "${API}/repos/${OWNER}/${NAME}/issues/${PR_NUMBER}/comments")
-  debug "GET /issues/${PR_NUMBER}/comments → HTTP ${HTTP_CODE}"
-  if [ "$HTTP_CODE" = "200" ]; then
-    # JQ expression: select non-author comments that match either the
-    # agent-prefix pattern (case-insensitive) OR a generic approval keyword.
-    JQ_APPROVALS='
-      .[] |
-      select(.user.login != $author) |
-      . as $cmt |
-      if ($agent_pattern | length) > 0 and ($cmt.body // "" | test($agent_pattern; "i")) then
-        $cmt.user.login
-      elif ($cmt.body // "" | test("\\b(APPROVED|LGTM|ACCEPTED)\\b"; "i")) then
-        $cmt.user.login
-      else
-        empty
-      end
-    '
-    CANDIDATES=$(jq -r \
-      --arg author "$PR_AUTHOR" \
-      --arg agent_pattern "$AGENT_PATTERN" \
-      "$JQ_APPROVALS" \
-      "$COMMENTS_JSON" 2>/dev/null | sort -u)
-    debug "comment-based approval candidates: $(echo "$CANDIDATES" | tr '\n' ' ')"
-
-    if [ -n "$CANDIDATES" ]; then
-      echo "::notice::${TEAM}-review: reviews API found no APPROVED reviews; found $(echo "$CANDIDATES" | wc -w | xargs) comment-based approval candidate(s) — verifying team membership..."
-    fi
-  else
-    debug "could not fetch issue comments (HTTP ${HTTP_CODE})"
-  fi
-fi
-
-if [ -z "${CANDIDATES:-}" ]; then
-  echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (no candidates from reviews API or issue comments)"
+  echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (no candidates yet)"
  exit 1
 fi

@@ -68,7 +68,7 @@ import sys
 import urllib.error
 import urllib.parse
 import urllib.request
-from typing import Any, Callable
+from typing import Any


 # ---------------------------------------------------------------------------
@@ -110,7 +110,7 @@ def normalize_slug(raw: str, numeric_aliases: dict[int, str] | None = None) -> s
 # for /sop-revoke (RFC#351 open question 4 — reason is captured but not
 # yet validated; future iteration may require a min-length).
 _DIRECTIVE_RE = re.compile(
-    r"^[ \t]*/(sop-ack|sop-revoke|sop-n/a)[ \t]+([A-Za-z0-9_\- ]+?)(?:[ \t]+(.*))?[ \t]*$",
+    r"^[ \t]*/(sop-ack|sop-revoke)[ \t]+([A-Za-z0-9_\- ]+?)(?:[ \t]+(.*))?[ \t]*$",
    re.MULTILINE,
 )

@@ -118,21 +118,19 @@ _DIRECTIVE_RE = re.compile(
 def parse_directives(
    comment_body: str,
    numeric_aliases: dict[int, str],
-) -> tuple[list[tuple[str, str, str]], list[tuple[str, str, str]]]:
-    """Extract /sop-ack, /sop-revoke, and /sop-n/a directives from a comment body.
+) -> tuple[list[tuple[str, str, str]], list]:
+    """Extract /sop-ack and /sop-revoke directives from a comment body.

-    Returns (directives, na_directives) where each is a list of
-    (kind, canonical_slug, note) tuples:
-      kind is "sop-ack", "sop-revoke", or "sop-n/a"
-      canonical_slug is the normalized form (or "" if unparseable)
-      note is the trailing free-text (may be "")
-    The two lists are kept separate so call sites can unpack them
-    directly (e.g. directives, na_directives = parse_directives(...)).
+    Returns (directives, na_directives) where:
+      directives is a list of (kind, canonical_slug, note) tuples
+        kind is "sop-ack" or "sop-revoke"
+        canonical_slug is the normalized form (or "" if unparseable)
+        note is the trailing free-text (may be "")
+      na_directives is reserved for future N/A handling (always [] for now)
    """
-    directives: list[tuple[str, str, str]] = []
-    na_directives: list[tuple[str, str, str]] = []
+    out: list[tuple[str, str, str]] = []
    if not comment_body:
-        return directives, na_directives
+        return out, []
    for m in _DIRECTIVE_RE.finditer(comment_body):
        kind = m.group(1)
        raw_slug = (m.group(2) or "").strip()
@@ -162,12 +160,8 @@ def parse_directives(
        note_from_group = (m.group(3) or "").strip()
        # If we collapsed multi-word slug into kebab and there's a
        # trailing-text group too, append it.
-        entry = (kind, canonical, note_from_group)
-        if kind == "sop-n/a":
-            na_directives.append(entry)
-        else:
-            directives.append(entry)
-    return directives, na_directives
+        out.append((kind, canonical, note_from_group))
+    return out, []


 # ---------------------------------------------------------------------------
@@ -180,8 +174,8 @@ def section_marker_present(body: str, marker: str) -> bool:
    on a non-empty line (i.e. the author actually filled it in).

    We require the marker substring AND non-whitespace content on the
-    same line OR within the next non-blank line — this prevents
-    trivially-empty checklists like:
+    same line OR within the next line — this prevents trivially-empty
+    checklists like:

        ## SOP-Checklist
        - [ ] **Comprehensive testing performed**:
@@ -190,18 +184,9 @@ def section_marker_present(body: str, marker: str) -> bool:
    from auto-passing the section-present check. The peer-ack is still
    required, but answering with empty content is captured as a soft
    finding via the section-present test alone.
-
-    NOTE: we scan forward through blank lines (the markdown-header pattern
-    is ## Header\\n\\ncontent) so that a header + blank-line + content
-    structure still satisfies the check. The backward checkbox fallback
-    catches inline markers without a preceding checkbox (mc#1099).
    """
    if not body or not marker:
        return False
-    # Strip trailing whitespace so the blank-line scan below can find
-    # content that appears on the very last line of the body (without
-    # being misled by a trailing \n or spaces).
-    body = body.rstrip()
    body_lower = body.lower()
    marker_lower = marker.lower()
    idx = body_lower.find(marker_lower)
@@ -217,44 +202,13 @@ def section_marker_present(body: str, marker: str) -> bool:
    stripped = re.sub(r"[\s\*:\-\[\]]+", "", line)
    if stripped:
        return True
-    # Fall through: scan forward, skipping blank-only lines, until we find
-    # non-empty content or run out of body.  Handles:
-    #   ## Header          ← marker line (empty after marker)
-    #                      ← blank line (skipped)
-    #   - actual content   ← found
-    pos = line_end
-    while True:
-        # Skip the current newline and any additional newlines (blank lines).
-        while pos < len(body) and body[pos] == "\n":
-            pos += 1
-        if pos >= len(body):
-            break
-        line_end = body.find("\n", pos)
-        if line_end < 0:
-            line_end = len(body)
-        line = body[pos:line_end]
-        stripped = re.sub(r"[\s\*:\-\[\]]+", "", line)
-        if stripped:
-            return True
-        pos = line_end
-    # Last resort: the marker may appear mid-sentence (e.g.
-    # **Memory/saved-feedback consulted**: No applicable...).
-    # Search backward within the CURRENT LINE only (not preceding lines)
-    # to find a checkbox on the same line before the marker text.
-    # mc#1099 follow-up: memory-consulted detection was failing because
-    # the checkbox was on the same line before the inline marker.
-    _CHECKBOX_RE = re.compile(r"- \[[ x\]]|<input", re.IGNORECASE)
-    line_start = body.rfind("\n", 0, idx) + 1  # 0 if no newline before idx
-    before = body[line_start:idx]
-    m = _CHECKBOX_RE.search(before)
-    if not m:
-        return False
-    # Require meaningful content between the checkbox and the marker text
-    # (markdown formatting like ** or * must also be stripped).
-    # If only whitespace/markdown chars remain, the checkbox line is empty.
-    between = before[m.end() :]
-    stripped_between = re.sub(r"[\s\*:#\[\]_\-]+", "", between)
-    return bool(stripped_between)
+    # Fall through: check the NEXT line (multi-line answers).
+    next_line_end = body.find("\n", line_end + 1)
+    if next_line_end < 0:
+        next_line_end = len(body)
+    next_line = body[line_end + 1:next_line_end]
+    stripped_next = re.sub(r"[\s\*:\-\[\]]+", "", next_line)
+    return bool(stripped_next)


 # ---------------------------------------------------------------------------
@@ -268,7 +222,6 @@ def compute_ack_state(
    items_by_slug: dict[str, dict[str, Any]],
    numeric_aliases: dict[int, str],
    team_membership_probe: "callable[[str, list[str]], list[str]]",
-    high_risk: bool = False,
 ) -> dict[str, dict[str, Any]]:
    """Compute per-item ack state.

@@ -298,7 +251,8 @@ def compute_ack_state(
        user = (c.get("user") or {}).get("login", "")
        if not user:
            continue
-        for kind, slug, _note in parse_directives(body, numeric_aliases)[0]:
+        directives, _na = parse_directives(body, numeric_aliases)
+        for kind, slug, _note in directives:
            if not slug:
                unparseable_per_user[user] = unparseable_per_user.get(user, 0) + 1
                continue
@@ -331,16 +285,11 @@ def compute_ack_state(
    for slug, candidates in pending_team_check.items():
        if not candidates:
            continue
-        # Risk-class-aware required-teams resolution (RFC#450 Option C):
-        # high-risk PRs use `required_teams_high_risk` (when set on the
-        # item); default class uses `required_teams`. The probe closure
-        # is built with the same high_risk flag so the two reads are
-        # always consistent (both sites share `resolve_required_teams`).
-        required = resolve_required_teams(items_by_slug[slug], high_risk)
+        required = items_by_slug[slug]["required_teams"]
        approved = team_membership_probe(slug, candidates)  # returns subset
        rejected_not_in_team[slug] = [u for u in candidates if u not in approved]
        ackers_per_slug[slug] = approved
-        # Stash resolved teams for description rendering.
+        # Stash required teams for description rendering.
        items_by_slug[slug]["_required_resolved"] = required

    return {
@@ -355,63 +304,6 @@ def compute_ack_state(
    }


-# ---------------------------------------------------------------------------
-# N/A-gate evaluation
-# ---------------------------------------------------------------------------
-
-
-def compute_na_state(
-    comments: list[dict[str, Any]],
-    author: str,
-    na_gates: dict[str, Any],
-    probe: Callable[[str, list[str]], list[str]],
-) -> dict[str, dict[str, Any]]:
-    """Evaluate which N/A gates have a valid declaration from a team member.
-
-    Returns dict[gate_name, dict] where each dict has:
-      declared: bool — at least one valid non-author team-member declared N/A
-      decl_ackers: list[str] — usernames who declared this gate N/A
-      rejected: dict with keys:
-        not_in_team: list[str] — users who tried but aren't in required teams
-    """
-    # Build per-user latest N/A directive (most-recent wins per RFC#324).
-    latest_na: dict[str, tuple[str, str]] = {}  # user → (gate, note)
-    for c in comments:
-        body = c.get("body", "") or ""
-        user = (c.get("user") or {}).get("login", "")
-        if not user:
-            continue
-        for kind, gate, note in parse_directives(body, {})[1]:
-            # [1] = na_directives only
-            if gate in na_gates:
-                latest_na[user] = (gate, note)
-
-    result: dict[str, dict[str, Any]] = {}
-    for gate, gate_cfg in na_gates.items():
-        result[gate] = {
-            "declared": False,
-            "decl_ackers": [],
-            "rejected": {"not_in_team": []},
-        }
-        decl_ackers: list[str] = []
-        not_in_team: list[str] = []
-        for user, (g, _note) in latest_na.items():
-            if g != gate:
-                continue
-            if user == author:
-                continue  # authors cannot self-declare N/A
-            approved = probe(gate, [user])
-            if approved:
-                decl_ackers.append(user)
-            else:
-                not_in_team.append(user)
-        result[gate]["declared"] = bool(decl_ackers)
-        result[gate]["decl_ackers"] = decl_ackers
-        result[gate]["rejected"]["not_in_team"] = not_in_team
-
-    return result
-
-
 # ---------------------------------------------------------------------------
 # Gitea API client
 # ---------------------------------------------------------------------------
@@ -771,42 +663,6 @@ def get_tier_mode(pr: dict[str, Any], cfg: dict[str, Any]) -> str:
    return default_mode


-def is_high_risk(pr: dict[str, Any], cfg: dict[str, Any]) -> bool:
-    """Return True when the PR is high-risk per RFC#450 Option C.
-
-    A PR is high-risk when ANY of:
-      - it carries the `tier:high` label (mechanically strictest tier), or
-      - it carries any label listed in cfg.high_risk_labels.
-
-    High-risk PRs use `required_teams_high_risk` (when set on an item)
-    instead of the default `required_teams`. Items without
-    `required_teams_high_risk` are unaffected (the default applies).
-
-    Governance fix for internal#442 — closes the inconsistency between
-    sop-tier-check (tier-aware) and sop-checklist (was tier-blind).
-    """
-    label_set = {(l.get("name") or "") for l in (pr.get("labels") or [])}
-    if "tier:high" in label_set:
-        return True
-    high_risk_labels = set(cfg.get("high_risk_labels") or [])
-    return bool(label_set & high_risk_labels)
-
-
-def resolve_required_teams(item: dict[str, Any], high_risk: bool) -> list[str]:
-    """Pick the active required_teams list for an item.
-
-    When high_risk is True AND the item declares a non-empty
-    `required_teams_high_risk`, return that. Else fall back to
-    `required_teams`. Keeping this in one helper means the gate's
-    decision shape stays single-sited even as items grow.
-    """
-    if high_risk:
-        elevated = item.get("required_teams_high_risk") or []
-        if elevated:
-            return list(elevated)
-    return list(item.get("required_teams") or [])
-
-
 def main(argv: list[str] | None = None) -> int:
    p = argparse.ArgumentParser()
    p.add_argument("--owner", required=True)
@@ -842,7 +698,6 @@ def main(argv: list[str] | None = None) -> int:
    cfg = load_config(args.config)
    items: list[dict[str, Any]] = cfg["items"]
    items_by_slug = {it["slug"]: it for it in items}
-    na_gates: dict[str, Any] = cfg.get("n/a_gates", {})
    numeric_aliases = {
        int(it["numeric_alias"]): it["slug"] for it in items if it.get("numeric_alias")
    }
@@ -867,12 +722,6 @@ def main(argv: list[str] | None = None) -> int:

    comments = client.get_issue_comments(args.owner, args.repo, args.pr)

-    # High-risk classification (RFC#450 Option C, governance fix for
-    # internal#442). Computed ONCE per PR — used by both the probe
-    # closure and compute_ack_state so the elevation decision is
-    # single-sited.
-    high_risk = is_high_risk(pr, cfg)
-
    # Build team-membership probe closure that caches results per
    # (user, team-id) so a user acking multiple items only triggers
    # one membership lookup per team.
@@ -880,7 +729,7 @@ def main(argv: list[str] | None = None) -> int:

    def probe(slug: str, users: list[str]) -> list[str]:
        item = items_by_slug[slug]
-        team_names: list[str] = resolve_required_teams(item, high_risk)
+        team_names: list[str] = item["required_teams"]
        # Resolve names → ids. NOTE: orgs/{org}/teams/search may not be
        # available — fall back to the list endpoint.
        team_ids: list[int] = []
@@ -925,9 +774,7 @@ def main(argv: list[str] | None = None) -> int:
                    # may still find membership in another team.
        return approved

-    ack_state = compute_ack_state(
-        comments, author, items_by_slug, numeric_aliases, probe, high_risk=high_risk
-    )
+    ack_state = compute_ack_state(comments, author, items_by_slug, numeric_aliases, probe)
    body_state = {it["slug"]: section_marker_present(body, it["pr_section_marker"]) for it in items}

    state, description = render_status(items, ack_state, body_state)
@@ -940,10 +787,7 @@ def main(argv: list[str] | None = None) -> int:
        description = f"[info tier:low] {description}"

    # Diagnostics to job log.
-    print(
-        f"::notice::PR #{args.pr} author={author} head={head_sha[:7]} "
-        f"mode={mode} risk_class={'high' if high_risk else 'default'}"
-    )
+    print(f"::notice::PR #{args.pr} author={author} head={head_sha[:7]} mode={mode}")
    for it in items:
        slug = it["slug"]
        ackers = ack_state[slug]["ackers"]
@@ -974,46 +818,6 @@ def main(argv: list[str] | None = None) -> int:
        description=description, target_url=target_url,
    )
    print(f"::notice::status posted: {args.status_context} → {state}")
-
-    # --- N/A gate status (RFC#324 §N/A follow-up) ---
-    # Post a separate status so review-check.sh can discover N/A declarations
-    # and waive the Gitea-approve requirement for that gate.
-    na_state: dict[str, dict[str, Any]] = {}
-    if na_gates:
-        na_state = compute_na_state(comments, author, na_gates, probe)
-
-        na_descs: list[str] = []
-        for gate, s in na_state.items():
-            if s["declared"]:
-                na_descs.append(gate)
-            decl = s["decl_ackers"]
-            rej = s["rejected"]["not_in_team"]
-            if decl:
-                print(f"::notice::  [N/A OK] {gate} — declared by {','.join(decl)}")
-            if rej:
-                print(
-                    f"::notice::  [N/A REJ] {gate} — not-in-team: {','.join(rej)}",
-                    file=sys.stderr,
-                )
-
-        na_desc = ", ".join(sorted(na_descs)) if na_descs else "(none)"
-        na_status_state = "success" if na_descs else "pending"
-        # review-check.sh reads the description to discover which gates are N/A.
-        # Include the gate names so it can grep for them.
-        na_description = f"N/A: {na_desc}" if na_descs else "N/A: (none)"
-
-        if not args.dry_run:
-            client.post_status(
-                args.owner, args.repo, head_sha,
-                state=na_status_state,
-                context="sop-checklist / na-declarations (pull_request)",
-                description=na_description,
-                target_url=target_url,
-            )
-            print(
-                f"::notice::na-declarations status → {na_status_state}: {na_description}"
-            )
-
    # By default exit 0 — the POSTed status IS the gate, NOT the job
    # conclusion. If the job exits 1 BP will see TWO failure signals
    # (one from the job's auto-status, one from our POST), making the
@@ -17,9 +17,6 @@ Scenarios:
  T8_team_not_member          — team membership → 404 (not a member) → exit 1
  T9_team_403                — team membership → 403 (token not in team) → exit 1
  T14_non_default_base        — open PR targeting staging → script exits 0 (no-op)
-  T15_comments_agent_approval — reviews empty; comments have "[core-qa-agent] APPROVED" → exit 0
-  T16_comments_generic_approval — reviews empty; comments have "APPROVED" by team member → exit 0
-  T17_comments_no_approval   — reviews empty; comments have no approval keywords → exit 1

 Usage:
  FIXTURE_STATE_DIR=/tmp/x python3 _review_check_fixture.py 8080
@@ -100,9 +97,7 @@ class Handler(http.server.BaseHTTPRequestHandler):
        # GET /repos/{owner}/{name}/pulls/{pr_number}/reviews
        m = re.match(r"^/api/v1/repos/([^/]+)/([^/]+)/pulls/(\d+)/reviews$", path)
        if m:
-            if sc in ("T4_reviews_empty", "T5_reviews_only_author",
-                      "T15_comments_agent_approval", "T16_comments_generic_approval",
-                      "T17_comments_no_approval"):
+            if sc in ("T4_reviews_empty", "T5_reviews_only_author"):
                return self._json(200, [])
            if sc == "T6_reviews_dismissed":
                return self._json(200, [{
@@ -121,28 +116,6 @@ class Handler(http.server.BaseHTTPRequestHandler):
                {"state": "APPROVED", "dismissed": False, "user": {"login": "core-devops"}, "commit_id": "abc1234"},
            ])

-        # GET /repos/{owner}/{name}/issues/{pr_number}/comments
-        m = re.match(r"^/api/v1/repos/([^/]+)/([^/]+)/issues/(\d+)/comments$", path)
-        if m:
-            if sc == "T15_comments_agent_approval":
-                return self._json(200, [
-                    {"user": {"login": "core-qa-agent"}, "body": "[core-qa-agent] APPROVED this PR. Good changes.", "id": 1},
-                    {"user": {"login": "alice"}, "body": "I authored this PR", "id": 2},
-                    {"user": {"login": "random-user"}, "body": "Looks okay to me", "id": 3},
-                ])
-            if sc == "T16_comments_generic_approval":
-                return self._json(200, [
-                    {"user": {"login": "core-qa-agent"}, "body": "APPROVED — all acceptance criteria met", "id": 1},
-                    {"user": {"login": "alice"}, "body": "-authored", "id": 2},
-                ])
-            if sc == "T17_comments_no_approval":
-                return self._json(200, [
-                    {"user": {"login": "alice"}, "body": "I authored this PR", "id": 1},
-                    {"user": {"login": "random-user"}, "body": "Looks okay to me", "id": 2},
-                ])
-            # Default scenarios (T1–T9, T14): no comments
-            return self._json(200, [])
-
        # GET /teams/{team_id}/members/{username}
        m = re.match(r"^/api/v1/teams/(\d+)/members/([^/]+)$", path)
        if m:
@@ -154,12 +127,6 @@ class Handler(http.server.BaseHTTPRequestHandler):
            # T7_team_member: member
            return self._empty(204)

-        # GET /repos/{owner}/{name}/statuses/{sha} — for N/A declaration check
-        m = re.match(r"^/api/v1/repos/([^/]+)/([^/]+)/statuses/([a-f0-9]+)$", path)
-        if m:
-            # All comment-based scenarios have no N/A declarations
-            return self._json(200, [])
-
        return self._json(404, {"path": path, "msg": "fixture: no route"})

    def do_POST(self):
@@ -118,13 +118,3 @@ def test_merge_decision_updates_stale_pr_before_merge():

    assert decision.ready is False
    assert decision.action == "update"
-
-
-def test_MergePermissionError_inherits_from_ApiError():
-    assert issubclass(mq.MergePermissionError, mq.ApiError)
-
-
-def test_MergePermissionError_message_preserved():
-    exc = mq.MergePermissionError("POST /merge -> HTTP 405: User not allowed")
-    assert "405" in str(exc)
-    assert "User not allowed" in str(exc)
@@ -334,31 +334,6 @@ assert_contains "T12 jq: core-devops (non-author APPROVED) in candidates" "core-
 assert_eq "T12 jq: alice (author) NOT in candidates" "" "$(echo "$T12_CANDIDATES" | grep '^alice$' || true)"
 assert_eq "T12 jq: carol (dismissed) NOT in candidates" "" "$(echo "$T12_CANDIDATES" | grep '^carol$' || true)"

-# T15 — comment-based approval via agent prefix pattern → exit 0
-echo
-echo "== T15 comment agent-prefix approval =="
-T15_OUT=$(run_review_check "T15_comments_agent_approval")
-T15_RC=$(cat "$FIX_STATE_DIR/last_rc")
-assert_eq "T15 exit code 0 (agent-comment approval + team member)" "0" "$T15_RC"
-assert_contains "T15 comment fallback notice" "comment-based approval" "$T15_OUT"
-assert_contains "T15 core-qa-agent APPROVED" "APPROVED by core-qa-agent" "$T15_OUT"
-
-# T16 — comment-based approval via generic APPROVED keyword → exit 0
-echo
-echo "== T16 comment generic keyword approval =="
-T16_OUT=$(run_review_check "T16_comments_generic_approval")
-T16_RC=$(cat "$FIX_STATE_DIR/last_rc")
-assert_eq "T16 exit code 0 (generic-approval comment + team member)" "0" "$T16_RC"
-assert_contains "T16 comment fallback notice" "comment-based approval" "$T16_OUT"
-
-# T17 — no approval keywords in comments → exit 1
-echo
-echo "== T17 comments with no approval keywords =="
-T17_OUT=$(run_review_check "T17_comments_no_approval")
-T17_RC=$(cat "$FIX_STATE_DIR/last_rc")
-assert_eq "T17 exit code 1 (no candidates from comments)" "1" "$T17_RC"
-assert_contains "T17 no candidates error" "no candidates from reviews API or issue comments" "$T17_OUT"
-
 echo
 echo "------"
 echo "PASS=$PASS FAIL=$FAIL"
@@ -551,267 +551,3 @@ class TestEndToEndAckFlow(unittest.TestCase):

 if __name__ == "__main__":
    unittest.main(verbosity=2)
-
-
-# ---------------------------------------------------------------------------
-# compute_na_state
-# ---------------------------------------------------------------------------
-
-
-class TestComputeNaState(unittest.TestCase):
-    """Tests for /sop-n/a directive evaluation."""
-
-    def test_no_na_declarations(self):
-        cfg = sop.load_config(CONFIG_PATH)
-        na_gates = cfg.get("n/a_gates", {})
-        comments = []
-        na_state = sop.compute_na_state(comments, "alice", na_gates, lambda *_: [])
-        self.assertFalse(na_state["qa-review"]["declared"])
-        self.assertFalse(na_state["security-review"]["declared"])
-
-    def test_na_declared_by_authorized_user(self):
-        cfg = sop.load_config(CONFIG_PATH)
-        na_gates = cfg.get("n/a_gates", {})
-        comments = [_comment("bob", "/sop-n/a qa-review N/A: pure tooling change")]
-        na_state = sop.compute_na_state(comments, "alice", na_gates, lambda g, u: u)
-        self.assertTrue(na_state["qa-review"]["declared"])
-        self.assertEqual(na_state["qa-review"]["decl_ackers"], ["bob"])
-
-    def test_na_declared_by_unauthorized_user_rejected(self):
-        cfg = sop.load_config(CONFIG_PATH)
-        na_gates = cfg.get("n/a_gates", {})
-        comments = [_comment("mallory", "/sop-n/a qa-review N/A: not real team")]
-        na_state = sop.compute_na_state(comments, "alice", na_gates, lambda g, u: [])
-        self.assertFalse(na_state["qa-review"]["declared"])
-        self.assertEqual(na_state["qa-review"]["rejected"]["not_in_team"], ["mallory"])
-
-    def test_author_cannot_self_declare_na(self):
-        cfg = sop.load_config(CONFIG_PATH)
-        na_gates = cfg.get("n/a_gates", {})
-        comments = [_comment("alice", "/sop-n/a qa-review N/A: I am the author")]
-        na_state = sop.compute_na_state(comments, "alice", na_gates, lambda g, u: u)
-        self.assertFalse(na_state["qa-review"]["declared"])
-
-    def test_parse_directives_separates_na_from_ack(self):
-        directives, na_directives = sop.parse_directives(
-            "/sop-ack comprehensive-testing\n/sop-n/a qa-review N/A: no surface",
-            {},
-        )
-        self.assertEqual(len(directives), 1)
-        self.assertEqual(directives[0][0], "sop-ack")
-        self.assertEqual(len(na_directives), 1)
-        self.assertEqual(na_directives[0][0], "sop-n/a")
-        self.assertEqual(na_directives[0][1], "qa-review")
-
-
-# ---------------------------------------------------------------------------
-# RFC#450 Option C — risk-classed two-eyes (governance fix for internal#442)
-# ---------------------------------------------------------------------------
-
-
-class TestIsHighRisk(unittest.TestCase):
-    """The high-risk predicate decides which required_teams list applies.
-
-    Predicate: tier:high label OR any label in cfg.high_risk_labels.
-    """
-
-    def setUp(self):
-        self.cfg = sop.load_config(CONFIG_PATH)
-
-    def test_no_labels_is_default_class(self):
-        pr = {"labels": []}
-        self.assertFalse(sop.is_high_risk(pr, self.cfg))
-
-    def test_tier_high_is_high_risk(self):
-        pr = {"labels": [{"name": "tier:high"}]}
-        self.assertTrue(sop.is_high_risk(pr, self.cfg))
-
-    def test_tier_low_is_default_class(self):
-        pr = {"labels": [{"name": "tier:low"}]}
-        self.assertFalse(sop.is_high_risk(pr, self.cfg))
-
-    def test_tier_medium_is_default_class(self):
-        # tier:medium alone is NOT high-risk (Option C — medium routes
-        # to the wider engineers OR-set).
-        pr = {"labels": [{"name": "tier:medium"}]}
-        self.assertFalse(sop.is_high_risk(pr, self.cfg))
-
-    def test_area_security_label_is_high_risk(self):
-        pr = {"labels": [{"name": "tier:medium"}, {"name": "area:security"}]}
-        self.assertTrue(sop.is_high_risk(pr, self.cfg))
-
-    def test_area_schema_label_is_high_risk(self):
-        pr = {"labels": [{"name": "area:schema"}]}
-        self.assertTrue(sop.is_high_risk(pr, self.cfg))
-
-    def test_area_identity_label_is_high_risk(self):
-        pr = {"labels": [{"name": "area:identity"}]}
-        self.assertTrue(sop.is_high_risk(pr, self.cfg))
-
-    def test_area_fleet_image_label_is_high_risk(self):
-        pr = {"labels": [{"name": "area:fleet-image"}]}
-        self.assertTrue(sop.is_high_risk(pr, self.cfg))
-
-    def test_area_gate_meta_label_is_high_risk(self):
-        # Gate-meta = changes to sop-checklist/sop-tier-check itself.
-        pr = {"labels": [{"name": "area:gate-meta"}]}
-        self.assertTrue(sop.is_high_risk(pr, self.cfg))
-
-    def test_unknown_area_label_is_default_class(self):
-        pr = {"labels": [{"name": "area:docs"}]}
-        self.assertFalse(sop.is_high_risk(pr, self.cfg))
-
-
-class TestResolveRequiredTeams(unittest.TestCase):
-    """The team resolver picks the elevated list only for high-risk PRs
-    AND only when the item declares one — items without an elevated
-    list always use the default required_teams."""
-
-    def test_default_class_uses_default_teams(self):
-        item = {"required_teams": ["engineers", "managers", "ceo"], "required_teams_high_risk": ["ceo"]}
-        self.assertEqual(
-            sop.resolve_required_teams(item, high_risk=False),
-            ["engineers", "managers", "ceo"],
-        )
-
-    def test_high_risk_uses_elevated_teams(self):
-        item = {"required_teams": ["engineers", "managers", "ceo"], "required_teams_high_risk": ["ceo"]}
-        self.assertEqual(
-            sop.resolve_required_teams(item, high_risk=True),
-            ["ceo"],
-        )
-
-    def test_high_risk_without_elevated_falls_back_to_default(self):
-        # Items that don't declare required_teams_high_risk (e.g.
-        # comprehensive-testing, staging-smoke) are unaffected by risk-class.
-        item = {"required_teams": ["engineers"]}
-        self.assertEqual(
-            sop.resolve_required_teams(item, high_risk=True),
-            ["engineers"],
-        )
-
-    def test_empty_elevated_list_falls_back_to_default(self):
-        # A defensive case: required_teams_high_risk: [] should not
-        # silently lock out all approvers — fall back to the default
-        # so the gate stays satisfiable. (Tightening should remove the
-        # key, not set it to empty.)
-        item = {"required_teams": ["engineers"], "required_teams_high_risk": []}
-        self.assertEqual(
-            sop.resolve_required_teams(item, high_risk=True),
-            ["engineers"],
-        )
-
-
-class TestRootCauseAckEligibilityWidened(unittest.TestCase):
-    """Closes internal#442: a non-author engineers-team ack now satisfies
-    root-cause / no-backwards-compat for the default class.
-
-    The dead-managers/ceo-persona-token gridlock is the symptom; the
-    root cause is that sop-checklist ignored tier-class. These tests
-    pin the new wider-default behavior so it can't regress silently.
-    """
-
-    def setUp(self):
-        self.items = _items_by_slug()
-        self.aliases = _numeric_aliases()
-
-    @staticmethod
-    def _approve_only(allowed):
-        return lambda slug, users: [u for u in users if u in allowed]
-
-    def test_engineers_ack_satisfies_root_cause_default_class(self):
-        # Bob is in engineers only (not managers, not ceo). Default class.
-        comments = [_comment("bob", "/sop-ack root-cause")]
-        # Probe: bob is approved because root-cause now lists engineers.
-        probe = self._approve_only({"bob"})
-        state = sop.compute_ack_state(
-            comments, "alice", self.items, self.aliases, probe, high_risk=False
-        )
-        self.assertEqual(state["root-cause"]["ackers"], ["bob"])
-
-    def test_engineers_ack_satisfies_no_backwards_compat_default_class(self):
-        comments = [_comment("bob", "/sop-ack no-backwards-compat")]
-        probe = self._approve_only({"bob"})
-        state = sop.compute_ack_state(
-            comments, "alice", self.items, self.aliases, probe, high_risk=False
-        )
-        self.assertEqual(state["no-backwards-compat"]["ackers"], ["bob"])
-
-    def test_engineers_ack_alone_fails_root_cause_when_high_risk(self):
-        # High-risk PR: only ceo can ack. Engineers-only ack must fail.
-        comments = [_comment("bob", "/sop-ack root-cause")]
-        # Probe: bob is in engineers, not ceo. Under high_risk,
-        # required_teams_high_risk=[ceo] → bob is NOT approved.
-        # Probe receives the items + flag indirectly via main(); for
-        # the unit-test path we inject a probe that rejects bob.
-        probe = self._approve_only(set())  # nobody is in ceo
-        state = sop.compute_ack_state(
-            comments, "alice", self.items, self.aliases, probe, high_risk=True
-        )
-        self.assertEqual(state["root-cause"]["ackers"], [])
-        self.assertIn("bob", state["root-cause"]["rejected"]["not_in_team"])
-
-    def test_ceo_ack_satisfies_root_cause_when_high_risk(self):
-        # High-risk PR + ceo-team approver → passes (the senior path).
-        comments = [_comment("hongming", "/sop-ack root-cause")]
-        probe = self._approve_only({"hongming"})
-        state = sop.compute_ack_state(
-            comments, "alice", self.items, self.aliases, probe, high_risk=True
-        )
-        self.assertEqual(state["root-cause"]["ackers"], ["hongming"])
-
-    def test_self_ack_still_forbidden_even_with_widened_eligibility(self):
-        # Author cannot self-ack — widening teams must NOT weaken
-        # the non-author rule.
-        comments = [_comment("alice", "/sop-ack root-cause")]
-        probe = self._approve_only({"alice"})
-        state = sop.compute_ack_state(
-            comments, "alice", self.items, self.aliases, probe, high_risk=False
-        )
-        self.assertEqual(state["root-cause"]["ackers"], [])
-        self.assertIn("alice", state["root-cause"]["rejected"]["self_ack"])
-
-
-class TestHighRiskClassUsesElevatedListInConfig(unittest.TestCase):
-    """End-to-end: the shipped config + RFC#450 predicate must keep
-    root-cause / no-backwards-compat gated on ceo for high-risk PRs."""
-
-    def test_root_cause_high_risk_elevated_to_ceo_only(self):
-        items = _items_by_slug()
-        # tier:high alone makes the PR high-risk → root-cause needs ceo.
-        self.assertEqual(
-            sop.resolve_required_teams(items["root-cause"], high_risk=True),
-            ["ceo"],
-        )
-        # Default class accepts engineers/managers/ceo.
-        self.assertEqual(
-            sorted(sop.resolve_required_teams(items["root-cause"], high_risk=False)),
-            sorted(["engineers", "managers", "ceo"]),
-        )
-
-    def test_no_backwards_compat_high_risk_elevated_to_ceo_only(self):
-        items = _items_by_slug()
-        self.assertEqual(
-            sop.resolve_required_teams(items["no-backwards-compat"], high_risk=True),
-            ["ceo"],
-        )
-        self.assertEqual(
-            sorted(sop.resolve_required_teams(items["no-backwards-compat"], high_risk=False)),
-            sorted(["engineers", "managers", "ceo"]),
-        )
-
-    def test_other_items_unchanged_by_risk_class(self):
-        # Items without required_teams_high_risk are unaffected.
-        items = _items_by_slug()
-        for slug in (
-            "comprehensive-testing",
-            "local-postgres-e2e",
-            "staging-smoke",
-            "five-axis-review",
-            "memory-consulted",
-        ):
-            self.assertEqual(
-                sop.resolve_required_teams(items[slug], high_risk=False),
-                sop.resolve_required_teams(items[slug], high_risk=True),
-                f"item {slug} should not be affected by risk-class",
-            )
@@ -50,34 +50,6 @@ tier_failure_mode:
  "tier:low": soft
 default_mode: hard  # used when no tier:* label is present

-# High-risk class (RFC#450 Option C, governance-fix for internal#442).
-#
-# A PR is "high-risk" when ANY of the listed labels are applied OR when
-# the PR has `tier:high` (mechanically the strictest existing tier).
-# High-risk items use `required_teams_high_risk` (when present on the
-# item); non-high-risk items use the default `required_teams`.
-#
-# This closes the inconsistency that the SOP charter already mandates
-# `tier:high → ceo only` for the sibling `sop-tier-check` gate; the
-# sop-checklist's `root-cause` and `no-backwards-compat` items now
-# follow the same risk-classed two-eyes shape:
-#   - Default class (tier:low/medium, not high-risk): a non-author
-#     engineers/managers/ceo ack satisfies the item — 25+ live
-#     identities, no dependency on a dead/inactive senior persona
-#     token.
-#   - High-risk class (tier:high OR any high_risk_label): still
-#     requires a non-author ceo ack (durable human team).
-#
-# Tightening: add labels to high_risk_labels.
-# Loosening: remove labels.
-high_risk_labels:
-  - "risk:high"
-  - "area:security"
-  - "area:schema"
-  - "area:fleet-image"
-  - "area:identity"
-  - "area:gate-meta"
-
 items:
  - slug: comprehensive-testing
    numeric_alias: 1
@@ -106,15 +78,11 @@ items:
  - slug: root-cause
    numeric_alias: 4
    pr_section_marker: "Root-cause not symptom"
-    required_teams: [engineers, managers, ceo]
-    required_teams_high_risk: [ceo]
+    required_teams: [managers, ceo]
    description: >-
-      One-sentence root-cause statement. Default class: non-author
-      engineers/managers/ceo ack suffices (engineers can attest
-      root-cause-vs-symptom for routine fixes). High-risk class
-      (see `high_risk_labels`): non-author ceo ack required —
-      senior judgment for irreversible/security/identity/gate
-      changes. Closes internal#442 + tracks RFC#450.
+      One-sentence root-cause statement. Ack from managers tier
+      (team-leads) or ceo. Senior judgment required to attest
+      root-cause-versus-symptom.

  - slug: five-axis-review
    numeric_alias: 5
@@ -127,14 +95,10 @@ items:
  - slug: no-backwards-compat
    numeric_alias: 6
    pr_section_marker: "No backwards-compat shim / dead code added"
-    required_teams: [engineers, managers, ceo]
-    required_teams_high_risk: [ceo]
+    required_teams: [managers, ceo]
    description: >-
-      Yes/no + justification if no. Default class: non-author
-      engineers/managers/ceo ack suffices. High-risk class
-      (see `high_risk_labels`): non-author ceo ack required —
-      senior judgment for shim-versus-real-fix on irreversible
-      surfaces. Closes internal#442 + tracks RFC#450.
+      Yes/no + justification if no. Senior ack required because
+      backward-compat shims are how dead-code accretes.

  - slug: memory-consulted
    numeric_alias: 7
@@ -158,68 +158,8 @@ jobs:
            echo "NOTE: No warning in output (may be suppressed by log level)"
          fi

-      - name: Reproduce openclaw failure — pipe held OPEN, no EOF
-        run: |
-          set -euo pipefail
-          echo "=== keep-stdin-open pipe (the real openclaw / Claude Code case) ==="
-          echo ""
-          echo "Before the readline() fix this HANGS: main() did"
-          echo "  stdin.read(65536)  -> on a pipe, blocks until 64KB OR EOF."
-          echo "An MCP client sends one ~150B initialize and keeps stdin"
-          echo "open waiting for the response, so the server never parsed"
-          echo "the request and the client timed out (openclaw: 'MCP error"
-          echo "-32000: Connection closed'). The earlier regular-file /"
-          echo "heredoc-pipe steps PASSED through this bug because a file"
-          echo "(or a closing heredoc) yields EOF immediately."
-          echo ""
-
-          # Drive the server through a real pipe that stays OPEN: write
-          # one initialize, do NOT close stdin, and require a response
-          # within a hard timeout. read(65536) -> no output -> timeout
-          # kills it -> FAIL. readline() -> immediate response -> PASS.
-          python - <<'PYEOF'
-          import json, subprocess, sys, time, select
-
-          proc = subprocess.Popen(
-              [sys.executable, "a2a_mcp_server.py"],
-              stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-              stderr=subprocess.STDOUT,
-              env={**__import__("os").environ},
-          )
-          req = json.dumps({
-              "jsonrpc": "2.0", "id": 1, "method": "initialize",
-              "params": {"protocolVersion": "2024-11-05",
-                         "capabilities": {},
-                         "clientInfo": {"name": "keepopen", "version": "1"}},
-          }) + "\n"
-          proc.stdin.write(req.encode())
-          proc.stdin.flush()
-          # Deliberately DO NOT close proc.stdin — mirror a live MCP client.
-
-          deadline = time.time() + 15
-          line = b""
-          while time.time() < deadline:
-              r, _, _ = select.select([proc.stdout], [], [], 1)
-              if r:
-                  line = proc.stdout.readline()
-                  if line:
-                      break
-          proc.kill()
-
-          if not line:
-              print("FAIL: no response within 15s on an open pipe — "
-                    "stdin.read(65536) regression is back")
-              sys.exit(1)
-          resp = json.loads(line.decode())
-          assert resp.get("id") == 1 and "result" in resp, \
-              f"unexpected response: {line[:200]!r}"
-          assert resp["result"]["serverInfo"]["name"] == "molecule", \
-              f"wrong serverInfo: {line[:200]!r}"
-          print("PASS: server answered initialize on a still-open pipe")
-          PYEOF
-
      - name: Run unit tests for stdio transport
        run: |
          set -euo pipefail
          echo "=== Running stdio transport unit tests ==="
-          python -m pytest tests/test_a2a_mcp_server.py::TestStdioPipeAssertion tests/test_a2a_mcp_server.py::TestStdioKeepOpenPipe -v --no-cov
+          python -m pytest tests/test_a2a_mcp_server.py::TestStdioPipeAssertion -v --no-cov
@@ -348,15 +348,16 @@ jobs:
  # Shellcheck (E2E scripts) — required check, always runs.
  shellcheck:
    name: Shellcheck (E2E scripts)
+    needs: changes
    runs-on: ubuntu-latest
    # Phase 4 (RFC #219 §1): confirmed green on main 2026-05-12.
    continue-on-error: false
    steps:
-      - if: false
+      - if: needs.changes.outputs.scripts != 'true'
        run: echo "No tests/e2e/ or infra/scripts/ changes — skipping real shellcheck; this job always runs to satisfy the required-check name on branch protection."
-      - if: always()
+      - if: needs.changes.outputs.scripts == 'true'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - if: always()
+      - if: needs.changes.outputs.scripts == 'true'
        name: Run shellcheck on tests/e2e/*.sh and infra/scripts/*.sh
        # shellcheck is pre-installed on ubuntu-latest runners (via apt).
        # infra/scripts/ is included because setup.sh + nuke.sh gate the
@@ -367,16 +368,16 @@ jobs:
          find tests/e2e infra/scripts -type f -name '*.sh' -print0 \
            | xargs -0 shellcheck --severity=warning

-      - if: always()
+      - if: needs.changes.outputs.scripts == 'true'
        name: Lint cleanup-trap hygiene (RFC #2873)
        run: bash tests/e2e/lint_cleanup_traps.sh

-      - if: always()
+      - if: needs.changes.outputs.scripts == 'true'
        name: Run E2E bash unit tests (no live infra)
        run: |
          bash tests/e2e/test_model_slug.sh

-      - if: always()
+      - if: needs.changes.outputs.scripts == 'true'
        name: Test ECR promote-tenant-image script (mock-driven, no live infra)
        # Covers scripts/promote-tenant-image.sh — the codified
        # :staging-latest → :latest ECR promote + tenant fleet redeploy
@@ -386,7 +387,7 @@ jobs:
        run: |
          bash scripts/test-promote-tenant-image.sh

-      - if: always()
+      - if: needs.changes.outputs.scripts == 'true'
        name: Shellcheck promote-tenant-image script
        # scripts/ is excluded from the bulk shellcheck pass above (legacy
        # SC3040/SC3043 cleanup pending). Run shellcheck explicitly on
@@ -406,8 +407,8 @@ jobs:
    # ci_job_names() detects this as github.ref-gated and skips it from F1.
    # The step-level exit 0 handles the "not main push" case; the job-level
    # `if:` makes the gating explicit so the drift script sees it.
-    # Runs on both main and staging pushes; step exits 0 when not applicable.
-    if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' }}
+    # continue-on-error removed (was mc#774 mask): step exits 0 when not applicable.
+    if: ${{ github.ref == 'refs/heads/staging' }}
    needs: [changes, canvas-build]
    steps:
      - name: Write deploy reminder to step summary
@@ -458,6 +459,7 @@ jobs:
  # Python Lint & Test — required check, always runs.
  python-lint:
    name: Python Lint & Test
+    needs: changes
    runs-on: ubuntu-latest
    # Phase 4 (RFC #219 §1): confirmed green on main 2026-05-12.
    continue-on-error: false
@@ -467,25 +469,25 @@ jobs:
      run:
        working-directory: workspace
    steps:
-      - if: false
+      - if: needs.changes.outputs.python != 'true'
        working-directory: .
        run: echo "No workspace/** changes — skipping real lint+test; this job always runs to satisfy the required-check name on branch protection."
-      - if: always()
+      - if: needs.changes.outputs.python == 'true'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - if: always()
+      - if: needs.changes.outputs.python == 'true'
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.11'
          cache: pip
          cache-dependency-path: workspace/requirements.txt
-      - if: always()
+      - if: needs.changes.outputs.python == 'true'
        run: pip install -r requirements.txt pytest pytest-asyncio pytest-cov sqlalchemy>=2.0.0
      # Coverage flags + fail-under floor moved into workspace/pytest.ini
      # (issue #1817) so local `pytest` and CI use identical config.
-      - if: always()
+      - if: needs.changes.outputs.python == 'true'
        run: python -m pytest --tb=short

-      - if: always()
+      - if: needs.changes.outputs.python == 'true'
        name: Per-file critical-path coverage (MCP / inbox / auth)
        # MCP-critical Python files have a per-file floor on top of the
        # 86% total floor in pytest.ini. See issue #2790 for full rationale.
@@ -538,13 +540,11 @@ jobs:
  all-required:
    # Aggregator sentinel — RFC internal#219 §2 (Phase 4 — closes internal#286).
    #
-    # Emits `CI / all-required (<event>)` where <event> is the workflow trigger
-    # (e.g. `CI / all-required (pull_request)`, `CI / all-required (push)`).
-    # Branch protection MUST be updated to require the event-suffixed name —
-    # requiring `CI / all-required` (bare, no suffix) silently blocks all merges
-    # because Gitea treats absent status contexts as pending (not skipped), and
-    # no workflow emits the bare name. Fixed: BP now requires
-    # `CI / all-required (pull_request)` per issue #1473.
+    # Single stable required-status name that branch protection points at;
+    # CI churns underneath in `needs:` without any protection edits. Mirrors
+    # the molecule-controlplane Phase 2a impl shipped in CP PR#112 and
+    # referenced by `internal#286` ("Phase 4 is a single small PR... mirrors
+    # CP's existing one").
    #
    # Closes the failure mode where status_check_contexts on molecule-core/main
    # only listed `Secret scan` + `sop-tier-check` (the 2 meta-gates), so real
@@ -552,104 +552,86 @@ jobs:
    # red silently merged through. See internal#286 for the three concrete
    # tonight-of-2026-05-11 incidents that prompted the emergency bump.
    #
-    # This job deliberately has no `needs:`. Gitea 1.22/act_runner can mark a
-    # job-level `if: always()` + `needs:` sentinel as skipped before upstream
-    # jobs settle, leaving branch protection with a permanent pending
-    # `CI / all-required` context. Instead, this independent sentinel polls the
-    # required commit-status contexts for this SHA and fails if any fail, skip,
-    # or never emit.
+    # Three properties of this job each close a failure mode:
    #
-    # canvas-deploy-reminder is intentionally NOT included in all-required.needs.
-    # It is an informational main-push reminder, not a PR quality gate. Keeping
-    # it in this dependency list lets a skipped reminder skip the required
-    # sentinel before the `always()` guard can emit a branch-protection status.
+    #  1. `if: always()` — runs even when an upstream fails. Without it the
+    #     sentinel is `skipped` and protection treats that as missing → merge
+    #     ungated.
    #
+    #  2. Assertion is `result == "success"` per dep, NOT `!= "failure"`.
+    #     A `skipped` upstream (job gated by `if:` evaluating false, matrix
+    #     entry that couldn't run) must NOT silently pass through.
+    #     `skipped`-as-green is exactly the failure mode this gate closes.
+    #
+    #  3. `needs:` is the canonical list of "what counts as required."
+    #     status_check_contexts will reference only `ci/all-required` (Step 5
+    #     follow-up — branch-protection PATCH is Owners-tier per
+    #     `feedback_never_admin_merge_bypass`, separate PR); a new job is
+    #     added simply by listing it in `needs:` here.
+    #     `.gitea/workflows/ci-required-drift.yml` files a [ci-drift] issue
+    #     hourly if this list diverges from status_check_contexts or from
+    #     audit-force-merge.yml's REQUIRED_CHECKS env (RFC §4 + §6).
+    #
+    # canvas-deploy-reminder is intentionally excluded from all-required.needs:
+    # it needs canvas-build, which is skipped on CI-only PRs (canvas=false).
+    # Including it in all-required.needs causes all-required to hang on
+    # every CI-only PR. Keep it runnable on PRs via its own
+    # `needs: [changes, canvas-build]` — the sentinel only aggregates the result.
+    #
+    # Phase 3 (RFC #219 §1) safety: underlying build jobs carry
+    # continue-on-error: true so their failures are masked to null (2026-05-12: re-enabled mc#774 interim)
+    # (Gitea suppresses status reporting for CoE jobs). This sentinel
+    # runs with continue-on-error: false so it always reports its
+    # result to the API — without this, the required-status entry
+    # (CI / all-required (pull_request)) is never created, which
+    # blocks PR merges. When Phase 3 ends, flip underlying jobs to
+    # continue-on-error: false; this sentinel can then be flipped to
+    # continue-on-error: true if a Phase-4 regression requires it.
    continue-on-error: false
    runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 1
+    needs:
+      - changes
+      - platform-build
+      - canvas-build
+      - shellcheck
+      - python-lint
+      - canvas-deploy-reminder
+    if: ${{ always() }}
    steps:
-      - name: Wait for required CI contexts
-        env:
-          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          API_ROOT: ${{ github.server_url }}/api/v1
-          REPOSITORY: ${{ github.repository }}
-          COMMIT_SHA: ${{ github.sha }}
-          EVENT_NAME: ${{ github.event_name }}
+      - name: Assert every required dependency succeeded
        run: |
          set -euo pipefail
-          python3 - <<'PY'
-          import json
-          import os
-          import sys
-          import time
-          import urllib.error
-          import urllib.request
-
-          token = os.environ["GITEA_TOKEN"]
-          api_root = os.environ["API_ROOT"].rstrip("/")
-          repo = os.environ["REPOSITORY"]
-          sha = os.environ["COMMIT_SHA"]
-          event = os.environ["EVENT_NAME"]
-          required = [
-              f"CI / Detect changes ({event})",
-              f"CI / Platform (Go) ({event})",
-              f"CI / Canvas (Next.js) ({event})",
-              f"CI / Shellcheck (E2E scripts) ({event})",
-              f"CI / Python Lint & Test ({event})",
-          ]
-          terminal_bad = {"failure", "error"}
-          deadline = time.time() + 40 * 60
-          last_summary = None
-
-          def fetch_statuses():
-              statuses = []
-              for page in range(1, 6):
-                  url = f"{api_root}/repos/{repo}/commits/{sha}/statuses?page={page}&limit=100"
-                  req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
-                  with urllib.request.urlopen(req, timeout=10) as resp:
-                      chunk = json.load(resp)
-                  if not chunk:
-                      break
-                  statuses.extend(chunk)
-              latest = {}
-              for item in statuses:
-                  ctx = item.get("context")
-                  if not ctx:
-                      continue
-                  prev = latest.get(ctx)
-                  if prev is None or (item.get("updated_at") or item.get("created_at") or "") >= (prev.get("updated_at") or prev.get("created_at") or ""):
-                      latest[ctx] = item
-              return latest
-
-          while True:
-              try:
-                  latest = fetch_statuses()
-              except (TimeoutError, OSError, urllib.error.URLError) as exc:
-                  if time.time() >= deadline:
-                      print(f"FAIL: status polling did not recover before deadline: {exc}", file=sys.stderr)
-                      sys.exit(1)
-                  print(f"WARN: status poll failed, retrying: {exc}", flush=True)
-                  time.sleep(15)
-                  continue
-              states = {ctx: (latest.get(ctx) or {}).get("status") or (latest.get(ctx) or {}).get("state") or "missing" for ctx in required}
-              summary = ", ".join(f"{ctx}={state}" for ctx, state in states.items())
-              if summary != last_summary:
-                  print(summary, flush=True)
-                  last_summary = summary
-              bad = {ctx: state for ctx, state in states.items() if state in terminal_bad}
-              if bad:
-                  print("FAIL: required CI context failed:", file=sys.stderr)
-                  for ctx, state in bad.items():
-                      desc = (latest.get(ctx) or {}).get("description") or ""
-                      print(f"  - {ctx}: {state} {desc}", file=sys.stderr)
-                  sys.exit(1)
-              if all(state == "success" for state in states.values()):
-                  print(f"OK: all {len(required)} required CI contexts succeeded")
-                  sys.exit(0)
-              if time.time() >= deadline:
-                  print("FAIL: timed out waiting for required CI contexts:", file=sys.stderr)
-                  for ctx, state in states.items():
-                      print(f"  - {ctx}: {state}", file=sys.stderr)
-                  sys.exit(1)
-              time.sleep(15)
-          PY
+          # `needs.*.result` is one of: success | failure | cancelled | skipped | null.
+          # We assert success per dep (not != failure) — see RFC §2 reasoning above.
+          # Null results are skipped: they come from Phase 3 (continue-on-error: true
+          # suppresses status) or from jobs still in-flight. The sentinel succeeds
+          # rather than blocking PRs on Phase 3 noise.
+          results='${{ toJSON(needs) }}'
+          echo "$results"
+          echo "$results" | python3 -c '
+          import json, sys
+          ns = json.load(sys.stdin)
+          # Phase 3 masked: jobs with continue-on-error: true may report "failure"
+          # Remove when mc#774 handler test failures are resolved.
+          PHASE3_MASKED = {"platform-build"}
+          # Exclude null (Phase 3 suppressed / in-flight) from the bad list.
+          bad = [(k, v.get("result")) for k, v in ns.items()
+                 if v.get("result") not in ("success", None, "cancelled", "skipped") and k not in PHASE3_MASKED]
+          if bad:
+              print(f"FAIL: jobs not green:", file=sys.stderr)
+              for k, r in bad:
+                  print(f"  - {k}: {r}", file=sys.stderr)
+              sys.exit(1)
+          pending = [(k, v.get("result")) for k, v in ns.items()
+                     if v.get("result") is None]
+          cancelled = [(k, v.get("result")) for k, v in ns.items()
+                       if v.get("result") == "cancelled"]
+          if pending:
+              print(f"WARN: {len(pending)} job(s) still in-flight (result=null): " +
+                    ", ".join(k for k, _ in pending), file=sys.stderr)
+          if cancelled:
+              print(f"INFO: {len(cancelled)} job(s) masked by continue-on-error: " +
+                    ", ".join(k for k, _ in cancelled), file=sys.stderr)
+          print(f"OK: all {len(ns)} required jobs succeeded (or Phase-3 suppressed)")
+          '
@@ -69,13 +69,6 @@ name: E2E API Smoke Test
 # 2318) shows Postgres ready in 3s, Redis in 1s, Platform in 1s when
 # they DO come up. Timeouts are not the bottleneck; not bumped.
 #
-# Item #1046 (fixed 2026-05-14): Stale platform-server from cancelled runs
-#   lingers on :8080 after "Stop platform" step is skipped (workflow cancelled
-#   before reaching line 335). Added a pre-start "Kill stale platform-server"
-#   step (line 286) that scans /proc for zombie platform-server processes
-#   and kills them before the port probe or bind. Makes the ephemeral port
-#   probe + start sequence deterministic.
-#
 # Item explicitly NOT fixed here: failing test `Status back online`
 # fails because the platform's langgraph workspace template image
 # (ghcr.io/molecule-ai/workspace-template-langgraph:latest) returns
@@ -290,35 +283,6 @@ jobs:
          echo "PORT=${PLATFORM_PORT}" >> "$GITHUB_ENV"
          echo "BASE=http://127.0.0.1:${PLATFORM_PORT}" >> "$GITHUB_ENV"
          echo "Platform host port: ${PLATFORM_PORT}"
-      - name: Kill stale platform-server before start (issue #1046)
-        if: needs.detect-changes.outputs.api == 'true'
-        run: |
-          # Concurrent runs on the same host-network act_runner can leave a
-          # zombie platform-server from a cancelled/timeout run. Cancelled
-          # runs never reach the "Stop platform" step (line 335), so the
-          # old process lingers. Kill it before the ephemeral port probe
-          # or start so the port is definitively free.
-          #
-          # /proc scan — works on any Linux without pkill/lsof/ss.
-          # comm field is truncated to 15 chars: "platform-serve" matches
-          # "platform-server". Verify with cmdline to avoid false positives.
-          killed=0
-          for pid in $(grep -l "platform-serve" /proc/[0-9]*/comm 2>/dev/null); do
-            kpid="${pid%/comm}"
-            kpid="${kpid##*/}"
-            cmdline=$(cat "/proc/${kpid}/cmdline" 2>/dev/null | tr '\0' ' ')
-            if echo "$cmdline" | grep -q "platform-server"; then
-              echo "Killing stale platform-server pid ${kpid}: ${cmdline}"
-              kill "$kpid" 2>/dev/null || true
-              killed=$((killed + 1))
-            fi
-          done
-          if [ "$killed" -gt 0 ]; then
-            sleep 2
-            echo "Killed $killed stale process(es); port(s) released."
-          else
-            echo "No stale platform-server found."
-          fi
      - name: Start platform (background)
        if: needs.detect-changes.outputs.api == 'true'
        working-directory: workspace-server
@@ -382,4 +346,3 @@ jobs:
        run: |
          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
-
@@ -97,7 +97,7 @@ jobs:
          cache-dependency-path: workspace-server/go.sum

      - if: needs.detect-changes.outputs.chat == 'true'
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d6f5 # v4
        with:
          node-version: '22'
          cache: 'npm'
@@ -175,19 +175,6 @@ jobs:
          echo "E2E_PLATFORM_URL=http://127.0.0.1:${PLATFORM_PORT}" >> "$GITHUB_ENV"
          echo "Platform host port: ${PLATFORM_PORT}"

-      - name: Pick canvas port
-        if: needs.detect-changes.outputs.chat == 'true'
-        run: |
-          CANVAS_PORT=$(python3 - <<'PY'
-          import socket
-          with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-              s.bind(("127.0.0.1", 0))
-              print(s.getsockname()[1])
-          PY
-          )
-          echo "CANVAS_PORT=${CANVAS_PORT}" >> "$GITHUB_ENV"
-          echo "Canvas host port: ${CANVAS_PORT}"
-
      - name: Start platform (background)
        if: needs.detect-changes.outputs.chat == 'true'
        working-directory: workspace-server
@@ -196,7 +183,6 @@ jobs:
          export DATABASE_URL="${DATABASE_URL}"
          export REDIS_URL="${REDIS_URL}"
          export PORT="${PLATFORM_PORT}"
-          export CORS_ORIGINS="http://localhost:3000,http://localhost:3001,http://localhost:${CANVAS_PORT},http://127.0.0.1:${CANVAS_PORT}"
          ./platform-server > platform.log 2>&1 &
          echo $! > platform.pid

@@ -230,10 +216,10 @@ jobs:
        run: |
          export NEXT_PUBLIC_PLATFORM_URL="http://127.0.0.1:${PLATFORM_PORT}"
          export NEXT_PUBLIC_WS_URL="ws://127.0.0.1:${PLATFORM_PORT}/ws"
-          npx next dev --turbopack -p "${CANVAS_PORT}" > canvas.log 2>&1 &
+          npm run dev > canvas.log 2>&1 &
          echo $! > canvas.pid
          for i in $(seq 1 30); do
-            if curl -sf "http://localhost:${CANVAS_PORT}" > /dev/null 2>&1; then
+            if curl -sf http://localhost:3000 > /dev/null 2>&1; then
              echo "Canvas up after ${i}s"
              exit 0
            fi
@@ -249,7 +235,6 @@ jobs:
        run: |
          export E2E_PLATFORM_URL="http://127.0.0.1:${PLATFORM_PORT}"
          export E2E_DATABASE_URL="${DATABASE_URL}"
-          export PLAYWRIGHT_BASE_URL="http://localhost:${CANVAS_PORT}"
          npx playwright test e2e/chat-desktop.spec.ts e2e/chat-mobile.spec.ts

      - name: Dump platform log on failure
@@ -1,397 +0,0 @@
-name: E2E Peer Visibility (literal MCP list_peers)
-
-# WHY A DEDICATED WORKFLOW (not folded into e2e-staging-saas.yml)
-# --------------------------------------------------------------
-# This is the systemic fix for a real trust failure. Hermes and OpenClaw
-# were reported "fleet-verified / cascade-complete" because the *proxy*
-# signals were green (registry registration + heartbeat for Hermes; model
-# round-trip 200 for OpenClaw). A freshly-provisioned workspace asked on
-# canvas "can you see your peers" actually FAILS:
-#   - Hermes: 401 on the molecule MCP `list_peers` call
-#   - OpenClaw: native `sessions_list` fallback, sees no platform peers
-# Tasks #142/#159 were even marked "completed" under this proxy flaw.
-#
-# A dedicated workflow (vs extending e2e-staging-saas.yml) because:
-#   - It must provision MULTIPLE distinct runtimes (hermes, openclaw,
-#     claude-code) in ONE org and assert each sees the others. The
-#     full-saas script is single-runtime-per-run (E2E_RUNTIME) and folding
-#     a multi-runtime matrix into it would conflate concerns and bloat its
-#     already-45-min run.
-#   - It needs its own concurrency group so it doesn't fight full-saas /
-#     canvas for the staging org-creation quota.
-#   - It needs an independent, non-required status-context name so it can
-#     be RED today (the in-flight Hermes-401 / OpenClaw-MCP-wiring fixes
-#     have not landed) WITHOUT wedging unrelated merges — and flipped to
-#     REQUIRED in one branch-protection edit once it goes green
-#     (flip-to-required checklist: molecule-core#1296).
-#
-# THE ASSERTION IS NOT A PROXY. The driving script
-# tests/e2e/test_peer_visibility_mcp_staging.sh issues the byte-for-byte
-# JSON-RPC `tools/call name=list_peers` envelope to `POST
-# /workspaces/:id/mcp` using each workspace's OWN bearer token, through
-# the real WorkspaceAuth + MCPRateLimiter middleware chain — the exact
-# call mcp_molecule_list_peers makes from a canvas agent. It does NOT
-# read a registry row, /health, the heartbeat table, or
-# GET /registry/:id/peers.
-#
-# HONEST GATE — NO continue-on-error. Per feedback_fix_root_not_symptom a
-# fake-green mask would defeat the entire purpose. This workflow goes red
-# on today's broken behavior and green only when the root-cause fixes
-# actually land. It is intentionally NOT in branch_protections — see PR
-# body for the required-vs-not decision + flip tracking issue.
-#
-# Gitea 1.22.6 / act_runner notes honored:
-#   - No cross-repo `uses:` (feedback_gitea_cross_repo_uses_blocked). The
-#     actions/checkout SHA is the one e2e-staging-canvas.yml already uses
-#     successfully (a mirrored SHA — see #1277/PR#1292 root-cause).
-#   - Per-SHA concurrency, not global (feedback_concurrency_group_per_sha).
-#   - Workflow-level GITHUB_SERVER_URL pinned
-#     (feedback_act_runner_github_server_url).
-#   - pr-validate posts a status under the same check name so a
-#     workflow-only PR is not silently statusless and the context is
-#     flip-to-required-ready (mirrors e2e-staging-saas.yml's proven shape;
-#     real EC2-provisioning E2E is push/dispatch/cron only — it is 30+ min
-#     and cannot run per-PR-update).
-#
-# LOCAL BACKEND (added 2026-05-15 — feedback_local_must_mimic_production,
-# feedback_mandatory_local_e2e_before_ship, feedback_local_test_before_
-# staging_e2e)
-# --------------------------------------------------------------------
-# The standing rule is that the local prod-mimic stack runs a MANDATORY
-# local-Postgres E2E BEFORE staging E2E. A staging-only peer-visibility
-# gate caught regressions late + expensively (cold EC2). The
-# `peer-visibility-local` job below runs the SAME byte-identical
-# assertion (tests/e2e/lib/peer_visibility_assert.sh) against the local
-# docker-compose stack — built + booted exactly like e2e-api.yml's
-# proven E2E API Smoke Test job (ephemeral pg/redis ports, go build,
-# background platform-server). It runs on PR + push (local boot is
-# minutes, not the 30+ min cold-EC2 path), so peer-visibility is part of
-# the local gate that fires before the staging E2E.
-#
-# It is its OWN non-required status context `E2E Peer Visibility (local)`
-# — same non-required-by-design decision as the staging job (red until
-# Hermes-401 #162 / OpenClaw-never-online #165 land; flip-to-required
-# tracked at molecule-core#1296). It is an HONEST gate: NO
-# continue-on-error mask (feedback_fix_root_not_symptom). It is kept a
-# distinct context (not folded into e2e-api.yml's required `E2E API
-# Smoke Test`) precisely so a deliberately-RED-today gate cannot wedge
-# the required local-E2E job or any unrelated merge.
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'workspace-server/internal/handlers/mcp.go'
-      - 'workspace-server/internal/handlers/mcp_tools.go'
-      - 'workspace-server/internal/middleware/**'
-      - 'workspace-server/internal/handlers/registry.go'
-      - 'workspace-server/internal/handlers/workspace.go'
-      - 'workspace/a2a_mcp_server.py'
-      - 'workspace/platform_tools/registry.py'
-      - 'tests/e2e/test_peer_visibility_mcp_staging.sh'
-      - 'tests/e2e/test_peer_visibility_mcp_local.sh'
-      - 'tests/e2e/lib/peer_visibility_assert.sh'
-      - '.gitea/workflows/e2e-peer-visibility.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'workspace-server/internal/handlers/mcp.go'
-      - 'workspace-server/internal/handlers/mcp_tools.go'
-      - 'workspace-server/internal/middleware/**'
-      - 'workspace-server/internal/handlers/registry.go'
-      - 'workspace-server/internal/handlers/workspace.go'
-      - 'workspace/a2a_mcp_server.py'
-      - 'workspace/platform_tools/registry.py'
-      - 'tests/e2e/test_peer_visibility_mcp_staging.sh'
-      - 'tests/e2e/test_peer_visibility_mcp_local.sh'
-      - 'tests/e2e/lib/peer_visibility_assert.sh'
-      - '.gitea/workflows/e2e-peer-visibility.yml'
-  workflow_dispatch:
-  schedule:
-    # 07:30 UTC daily — catches AMI / template-hermes / template-openclaw
-    # drift even on quiet days. Offset 30m from e2e-staging-saas (07:00)
-    # so the two don't collide on the staging org-creation quota.
-    - cron: '30 7 * * *'
-
-concurrency:
-  # Per-SHA (feedback_concurrency_group_per_sha). A single global group
-  # would let a queued staging/main push behind a PR run get cancelled,
-  # leaving any gate that reads "completed run at SHA" stuck.
-  group: e2e-peer-visibility-${{ github.event.pull_request.head.sha || github.sha }}
-  cancel-in-progress: false
-
-env:
-  GITHUB_SERVER_URL: https://git.moleculesai.app
-
-jobs:
-  # PR path: post a real status under the required-ready check name so a
-  # workflow-only PR is never silently statusless. The actual EC2 E2E is
-  # push/dispatch/cron only (30+ min). This is NOT a fake-green mask of
-  # the real assertion — it validates the driving script's bash syntax
-  # and inline-python so a broken test script fails at PR time.
-  pr-validate:
-    name: E2E Peer Visibility
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Validate driving scripts + shared assertion lib
-        run: |
-          bash -n tests/e2e/lib/peer_visibility_assert.sh
-          echo "lib/peer_visibility_assert.sh — bash syntax OK"
-          bash -n tests/e2e/test_peer_visibility_mcp_staging.sh
-          echo "test_peer_visibility_mcp_staging.sh — bash syntax OK"
-          bash -n tests/e2e/test_peer_visibility_mcp_local.sh
-          echo "test_peer_visibility_mcp_local.sh — bash syntax OK"
-          echo "Staging fresh-provision MCP list_peers E2E runs on push to"
-          echo "main / workflow_dispatch / daily cron (30+ min EC2 boot)."
-          echo "The LOCAL backend runs in the peer-visibility-local job"
-          echo "below on this same PR (local docker-compose stack)."
-
-  # LOCAL gate: same byte-identical assertion against the local prod-mimic
-  # docker-compose stack — the MANDATORY local-E2E that must run BEFORE
-  # the staging E2E (feedback_mandatory_local_e2e_before_ship,
-  # feedback_local_test_before_staging_e2e). Bootstrap mirrors
-  # e2e-api.yml's proven E2E API Smoke Test job (per-run container names +
-  # ephemeral host ports so concurrent host-network act_runner runs don't
-  # collide; go build; background platform-server). Its OWN non-required
-  # status context `E2E Peer Visibility (local)` — non-required-by-design
-  # exactly like the staging job (red until #162/#165 land;
-  # flip-to-required tracked at molecule-core#1296). HONEST gate, NO
-  # continue-on-error mask (feedback_fix_root_not_symptom). Runs on PR +
-  # push (local boot is minutes, not the 30+ min cold-EC2 path).
-  # bp-required: pending #1296
-  peer-visibility-local:
-    name: E2E Peer Visibility (local)
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      # Per-run names + ephemeral ports — same collision-avoidance as
-      # e2e-api.yml (host-network act_runner; feedback_act_runner_*).
-      PG_CONTAINER: pg-e2e-pv-${{ github.run_id }}-${{ github.run_attempt }}
-      REDIS_CONTAINER: redis-e2e-pv-${{ github.run_id }}-${{ github.run_attempt }}
-      # LLM keys so hermes/openclaw can actually boot. The local script
-      # SKIPs (not fails) any runtime whose key is absent, so a partially
-      # keyed CI env still exercises whatever it can.
-      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.E2E_CLAUDE_CODE_OAUTH_TOKEN }}
-      E2E_MINIMAX_API_KEY: ${{ secrets.MOLECULE_STAGING_MINIMAX_API_KEY }}
-      E2E_ANTHROPIC_API_KEY: ${{ secrets.MOLECULE_STAGING_ANTHROPIC_API_KEY }}
-      E2E_OPENAI_API_KEY: ${{ secrets.MOLECULE_STAGING_OPENAI_API_KEY }}
-      PV_RUNTIMES: "hermes openclaw claude-code"
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
-        with:
-          go-version: 'stable'
-          cache: true
-          cache-dependency-path: workspace-server/go.sum
-      - name: Pre-pull alpine + ensure provisioner network
-        run: |
-          docker pull alpine:latest >/dev/null
-          docker network create molecule-core-net >/dev/null 2>&1 || true
-          echo "alpine:latest pre-pulled; molecule-core-net ensured."
-      - name: Start Postgres (docker, ephemeral port)
-        run: |
-          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-          docker run -d --name "$PG_CONTAINER" \
-            -e POSTGRES_USER=dev -e POSTGRES_PASSWORD=dev -e POSTGRES_DB=molecule \
-            -p 0:5432 postgres:16 >/dev/null
-          PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | awk -F: '/^0\.0\.0\.0:/ {print $2; exit}')
-          [ -n "$PG_PORT" ] || PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | head -1 | awk -F: '{print $NF}')
-          if [ -z "$PG_PORT" ]; then
-            echo "::error::Could not resolve host port for $PG_CONTAINER"
-            docker logs "$PG_CONTAINER" || true; exit 1
-          fi
-          echo "DATABASE_URL=postgres://dev:dev@127.0.0.1:${PG_PORT}/molecule?sslmode=disable" >> "$GITHUB_ENV"
-          for i in $(seq 1 30); do
-            docker exec "$PG_CONTAINER" pg_isready -U dev >/dev/null 2>&1 && { echo "Postgres ready after ${i}s"; exit 0; }
-            sleep 1
-          done
-          echo "::error::Postgres did not become ready in 30s"; docker logs "$PG_CONTAINER" || true; exit 1
-      - name: Start Redis (docker, ephemeral port)
-        run: |
-          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
-          docker run -d --name "$REDIS_CONTAINER" -p 0:6379 redis:7 >/dev/null
-          REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | awk -F: '/^0\.0\.0\.0:/ {print $2; exit}')
-          [ -n "$REDIS_PORT" ] || REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | head -1 | awk -F: '{print $NF}')
-          if [ -z "$REDIS_PORT" ]; then
-            echo "::error::Could not resolve host port for $REDIS_CONTAINER"
-            docker logs "$REDIS_CONTAINER" || true; exit 1
-          fi
-          echo "REDIS_URL=redis://127.0.0.1:${REDIS_PORT}" >> "$GITHUB_ENV"
-          for i in $(seq 1 15); do
-            docker exec "$REDIS_CONTAINER" redis-cli ping 2>/dev/null | grep -q PONG && { echo "Redis ready after ${i}s"; exit 0; }
-            sleep 1
-          done
-          echo "::error::Redis did not become ready in 15s"; docker logs "$REDIS_CONTAINER" || true; exit 1
-      - name: Build platform
-        working-directory: workspace-server
-        run: go build -o platform-server ./cmd/server
-      - name: Pick platform port
-        run: |
-          PLATFORM_PORT=$(python3 - <<'PY'
-          import socket
-          with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-              s.bind(("127.0.0.1", 0))
-              print(s.getsockname()[1])
-          PY
-          )
-          echo "PORT=${PLATFORM_PORT}" >> "$GITHUB_ENV"
-          echo "BASE=http://127.0.0.1:${PLATFORM_PORT}" >> "$GITHUB_ENV"
-          echo "Platform host port: ${PLATFORM_PORT}"
-      - name: Kill stale platform-server before start
-        run: |
-          killed=0
-          for pid in $(grep -l "platform-serve" /proc/[0-9]*/comm 2>/dev/null); do
-            kpid="${pid%/comm}"; kpid="${kpid##*/}"
-            cmdline=$(cat "/proc/${kpid}/cmdline" 2>/dev/null | tr '\0' ' ')
-            if echo "$cmdline" | grep -q "platform-server"; then
-              echo "Killing stale platform-server pid ${kpid}"
-              kill "$kpid" 2>/dev/null || true; killed=$((killed + 1))
-            fi
-          done
-          [ "$killed" -gt 0 ] && sleep 2 || true
-          echo "stale-kill done ($killed killed)"
-      - name: Start platform (background)
-        working-directory: workspace-server
-        run: |
-          ./platform-server > platform.log 2>&1 &
-          echo $! > platform.pid
-      - name: Wait for /health
-        run: |
-          for i in $(seq 1 30); do
-            curl -sf "$BASE/health" > /dev/null && { echo "Platform up after ${i}s"; exit 0; }
-            sleep 1
-          done
-          echo "::error::Platform did not become healthy in 30s"
-          cat workspace-server/platform.log || true; exit 1
-      - name: Run LOCAL fresh-provision peer-visibility E2E (literal MCP list_peers)
-        # HONEST gate — NO continue-on-error. Red today (Hermes-401 #162 /
-        # OpenClaw-never-online #165 not yet fixed); green when they land.
-        # Non-required-by-design via its distinct status context until the
-        # molecule-core#1296 flip-to-required.
-        run: bash tests/e2e/test_peer_visibility_mcp_local.sh
-      - name: Dump platform log on failure
-        if: failure()
-        run: cat workspace-server/platform.log || true
-      - name: Stop platform
-        if: always()
-        run: |
-          if [ -f workspace-server/platform.pid ]; then
-            kill "$(cat workspace-server/platform.pid)" 2>/dev/null || true
-          fi
-      - name: Stop service containers
-        if: always()
-        run: |
-          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
-
-  # Real STAGING gate: provisions a throwaway org + sibling-per-runtime,
-  # drives the LITERAL list_peers MCP call per runtime, asserts 200 +
-  # expected peer set, then scoped teardown. push(main)/dispatch/cron only.
-  peer-visibility:
-    name: E2E Peer Visibility
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request'
-    timeout-minutes: 60
-
-    env:
-      MOLECULE_CP_URL: https://staging-api.moleculesai.app
-      MOLECULE_ADMIN_TOKEN: ${{ secrets.CP_STAGING_ADMIN_API_TOKEN }}
-      # LLM provider key so each runtime can authenticate at boot.
-      # Priority MiniMax → direct-Anthropic → OpenAI matches
-      # test_staging_full_saas.sh's secrets-injection chain.
-      E2E_MINIMAX_API_KEY: ${{ secrets.MOLECULE_STAGING_MINIMAX_API_KEY }}
-      E2E_ANTHROPIC_API_KEY: ${{ secrets.MOLECULE_STAGING_ANTHROPIC_API_KEY }}
-      E2E_OPENAI_API_KEY: ${{ secrets.MOLECULE_STAGING_OPENAI_API_KEY }}
-      E2E_RUN_ID: "${{ github.run_id }}-${{ github.run_attempt }}"
-      PV_RUNTIMES: "hermes openclaw claude-code"
-
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Verify admin token present
-        run: |
-          if [ -z "$MOLECULE_ADMIN_TOKEN" ]; then
-            echo "::error::CP_STAGING_ADMIN_API_TOKEN secret not set (Railway staging CP_ADMIN_API_TOKEN)"
-            exit 2
-          fi
-          echo "Admin token present"
-
-      - name: Verify an LLM key present
-        run: |
-          if [ -z "${E2E_MINIMAX_API_KEY:-}" ] && [ -z "${E2E_ANTHROPIC_API_KEY:-}" ] && [ -z "${E2E_OPENAI_API_KEY:-}" ]; then
-            echo "::error::No LLM provider key set — workspaces fail at boot with 'No provider API key found'. Set MOLECULE_STAGING_MINIMAX_API_KEY (or ANTHROPIC / OPENAI)."
-            exit 2
-          fi
-          echo "LLM key present"
-
-      - name: CP staging health preflight
-        run: |
-          code=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 10 "$MOLECULE_CP_URL/health")
-          if [ "$code" != "200" ]; then
-            echo "::error::Staging CP unhealthy (HTTP $code) — infra, not a workspace bug. Failing loud per feedback_fix_root_not_symptom."
-            exit 1
-          fi
-          echo "Staging CP healthy"
-
-      - name: Run fresh-provision peer-visibility E2E (literal MCP list_peers)
-        run: bash tests/e2e/test_peer_visibility_mcp_staging.sh
-
-      # Belt-and-braces scoped teardown: the script installs an EXIT/INT/
-      # TERM trap, but if the runner itself is cancelled the trap may not
-      # fire. This always() step deletes ONLY the e2e-pv-<run_id> org this
-      # run created — never a cluster-wide sweep
-      # (feedback_never_run_cluster_cleanup_tests_on_live_platform). The
-      # admin DELETE is idempotent so double-invoking is safe;
-      # sweep-stale-e2e-orgs is the final net (slug starts with 'e2e-').
-      - name: Teardown safety net (runs on cancel/failure)
-        if: always()
-        env:
-          ADMIN_TOKEN: ${{ secrets.CP_STAGING_ADMIN_API_TOKEN }}
-        run: |
-          set +e
-          orgs=$(curl -sS "$MOLECULE_CP_URL/cp/admin/orgs?limit=500" \
-            -H "Authorization: Bearer $ADMIN_TOKEN" 2>/dev/null \
-            | python3 -c "
-          import json, sys, os, datetime
-          run_id = os.environ.get('GITHUB_RUN_ID', '')
-          try:
-              d = json.load(sys.stdin)
-          except Exception:
-              print(''); sys.exit(0)
-          # ONLY sweep slugs from THIS run. e2e-pv-<YYYYMMDD>-<run_id>-...
-          # Sweep today AND yesterday's UTC date so a midnight-crossing run
-          # still matches its own slug (same bug class as the saas/canvas
-          # safety nets).
-          today = datetime.date.today()
-          yest = today - datetime.timedelta(days=1)
-          dates = (today.strftime('%Y%m%d'), yest.strftime('%Y%m%d'))
-          if run_id:
-              prefixes = tuple(f'e2e-pv-{dt}-{run_id}-' for dt in dates)
-          else:
-              prefixes = tuple(f'e2e-pv-{dt}-' for dt in dates)
-          orgs = d if isinstance(d, list) else d.get('orgs', [])
-          cands = [o['slug'] for o in orgs
-                   if any(o.get('slug','').startswith(p) for p in prefixes)
-                   and o.get('instance_status') not in ('purged',)]
-          print('\n'.join(cands))
-          " 2>/dev/null)
-          for slug in $orgs; do
-            echo "Safety-net teardown: $slug"
-            set +e
-            curl -sS -o /tmp/pv-cleanup.out -w "%{http_code}" \
-              -X DELETE "$MOLECULE_CP_URL/cp/admin/tenants/$slug" \
-              -H "Authorization: Bearer $ADMIN_TOKEN" \
-              -H "Content-Type: application/json" \
-              -d "{\"confirm\":\"$slug\"}" >/tmp/pv-cleanup.code
-            set -e
-            code=$(cat /tmp/pv-cleanup.code 2>/dev/null || echo "000")
-            if [ "$code" = "200" ] || [ "$code" = "204" ]; then
-              echo "[teardown] deleted $slug (HTTP $code)"
-            else
-              echo "::warning::pv teardown for $slug returned HTTP $code — sweep-stale-e2e-orgs will catch it within MAX_AGE_MINUTES. Body: $(head -c 300 /tmp/pv-cleanup.out 2>/dev/null)"
-            fi
-          done
-          exit 0
@@ -83,41 +83,25 @@ jobs:
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
-          # Fetch all open PRs and run gate-check on each. This scheduled
-          # refresher is advisory; a transient Gitea list timeout must not turn
-          # main red. PR-specific gate-check runs still use normal failure
-          # semantics.
+          # Fetch all open PRs and run gate-check on each
+          # socket.setdefaulttimeout(15): defence-in-depth for missing SOP_TIER_CHECK_TOKEN.
+          # gate_check.py uses timeout=15 on every urlopen call; this catches the
+          # inline Python polling loop too (issue #603).
          pr_numbers=$(python3 <<'PY'
          import json
          import os
          import socket
-          import sys
-          import time
-          import urllib.error
          import urllib.request

-          socket.setdefaulttimeout(30)
+          socket.setdefaulttimeout(15)
          token = os.environ["GITEA_TOKEN"]
          repo = os.environ["REPO"]
-          url = f"https://git.moleculesai.app/api/v1/repos/{repo}/pulls?state=open&limit=100"
-          last_error = None
-          for attempt in range(1, 4):
-              req = urllib.request.Request(
-                  url,
-                  headers={"Authorization": f"token {token}", "Accept": "application/json"},
-              )
-              try:
-                  with urllib.request.urlopen(req, timeout=30) as r:
-                      prs = json.loads(r.read())
-                  break
-              except (TimeoutError, OSError, urllib.error.URLError, urllib.error.HTTPError) as exc:
-                  last_error = exc
-                  print(f"warning: PR list fetch attempt {attempt}/3 failed: {exc}", file=sys.stderr)
-                  if attempt < 3:
-                      time.sleep(2 * attempt)
-          else:
-              print(f"warning: skipped scheduled gate-check refresh; failed to list open PRs after 3 attempts: {last_error}", file=sys.stderr)
-              raise SystemExit(0)
+          req = urllib.request.Request(
+              f"https://git.moleculesai.app/api/v1/repos/{repo}/pulls?state=open&limit=100",
+              headers={"Authorization": f"token {token}", "Accept": "application/json"},
+          )
+          with urllib.request.urlopen(req) as r:
+              prs = json.loads(r.read())
          for pr in prs:
              print(pr["number"])
          PY
@@ -52,9 +52,5 @@ jobs:
          # explicitly instead of the combined state avoids false-pause when
          # non-blocking jobs (continue-on-error: true) have failed — those
          # failures pollute combined state but do not gate merges.
-          # NOTE: the event-suffixed context name is intentional — branch protection
-          # MUST require `CI / all-required (pull_request)` (with suffix), NOT the
-          # bare `CI / all-required`. Gitea treats absent contexts as pending, not
-          # skipped; requiring the bare name silently blocks all merges (issue #1473).
          PUSH_REQUIRED_CONTEXTS: CI / all-required (push)
        run: python3 .gitea/scripts/gitea-merge-queue.py
@@ -86,11 +86,7 @@ jobs:
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          # A full-history checkout can exceed the runner's quiet/startup
-          # window before the path filter emits logs. Fetch the common push
-          # case cheaply; the script below fetches the exact BASE SHA if it is
-          # not present in the shallow checkout.
-          fetch-depth: 2
+          fetch-depth: 0
      - id: filter
        # Inline replacement for dorny/paths-filter — see e2e-api.yml.
        run: |
@@ -93,7 +93,7 @@ jobs:
  lint:
    name: lint-continue-on-error-tracking
    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
    # Phase 3 (RFC #219 §1): surface masked defects without blocking
    # PRs. Pre-existing continue-on-error: true directives on main
    # all violate this lint at first — intentional. Flip to false
@@ -1,168 +0,0 @@
-name: Lint forbidden tenant-env keys
-
-# RFC#523 Layer 3 (task #146): scan workspace_secrets-writer Go code
-# under workspace-server/ for new code that hardcodes a forbidden
-# operator-scope env var NAME (GITEA_TOKEN, CP_ADMIN_API_TOKEN,
-# RAILWAY_TOKEN, INFISICAL_OPERATOR_TOKEN, MOLECULE_OPERATOR_*, …).
-#
-# Catches the class "a new writer accidentally widens the propagation
-# set" — e.g. a future env-mutator plugin that sets envVars["GITEA_TOKEN"]
-# directly. Today the L1 runtime guard would abort the provision, but
-# this lint surfaces the offending code at PR review time instead of
-# at first provision attempt.
-#
-# Companion layers:
-#   - L1: workspace-server/internal/handlers/workspace_provision_forbidden_env.go
-#         (fail-closed abort at provision time)
-#   - L2: workspace/entrypoint.sh top-of-file env-grep + exit 1
-#
-# Open-source-template-friendly: the deny pattern is generic. A fork
-# can copy this workflow and replace OPERATOR_KEY_PATTERN with its
-# own operator-scope key names.
-#
-# Path-filter discipline:
-#   This workflow runs on every PR (no paths: filter — see
-#   feedback_path_filtered_workflow_cant_be_required). The scan itself
-#   targets workspace_secrets-writer paths via grep -r; it's fast
-#   (sub-second) so unconditional run is fine.
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-  push:
-    branches: [main, staging]
-
-env:
-  GITHUB_SERVER_URL: https://git.moleculesai.app
-
-jobs:
-  scan:
-    name: Scan workspace_secrets writers for forbidden env keys
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 1
-
-      - name: Scan for forbidden operator-scope env key NAMES in writer paths
-        run: |
-          set -euo pipefail
-
-          # Forbidden EXACT-MATCH env var names. Kept in lockstep with
-          # workspace-server/internal/handlers/workspace_provision_forbidden_env.go
-          # forbiddenTenantEnvKeys. The Go-side test
-          # TestIsForbiddenTenantEnvKey_ExactMatches is the source of
-          # truth — if Go-side adds a key, also add it here (and
-          # vice-versa). Drift between the two is the failure mode this
-          # entire 3-layer guardrail is designed to catch.
-          FORBIDDEN_KEYS=(
-            "GITEA_TOKEN" "GITEA_PAT"
-            "GITHUB_TOKEN" "GITHUB_PAT" "GH_TOKEN"
-            "GITLAB_TOKEN" "GL_TOKEN"
-            "BITBUCKET_TOKEN"
-            "CP_ADMIN_API_TOKEN" "CP_ADMIN_TOKEN"
-            "INFISICAL_OPERATOR_TOKEN" "INFISICAL_BOOTSTRAP_TOKEN"
-            "RAILWAY_TOKEN" "RAILWAY_PERSONAL_API_TOKEN"
-            "HETZNER_TOKEN" "HETZNER_API_TOKEN"
-          )
-
-          # Forbidden PREFIX patterns — operator-scope families.
-          FORBIDDEN_PREFIXES=(
-            "MOLECULE_OPERATOR_"
-          )
-
-          # Writer paths: Go source under workspace-server/ that
-          # writes to the env-vars map or to workspace_secrets DB rows.
-          # Tests, the forbidden-env source itself, and the silent-
-          # strip denylist are exempt (they LIST the keys by design).
-          SCAN_ROOT="workspace-server/internal"
-          # Exempt paths fall in two classes:
-          #   1. The deny-set definitions + the silent-strip denylist:
-          #      they LIST the forbidden names by design.
-          #   2. Pre-RFC#523 persona-merge / config-read paths that
-          #      already handle these names correctly (the silent-
-          #      strip downstream + the new L1 fail-closed cover the
-          #      runtime risk; these reads are unchanged).
-          # New code MUST NOT be added to this list without reviewer
-          # signoff and a one-line justification in this diff.
-          EXEMPT_PATHS=(
-            # Class 1 — deny-set definitions
-            "workspace-server/internal/handlers/workspace_provision_forbidden_env.go"
-            "workspace-server/internal/handlers/workspace_provision_forbidden_env_test.go"
-            "workspace-server/internal/provisioner/provisioner.go"
-            "workspace-server/internal/provisioner/provisioner_test.go"
-            # Class 2 — pre-existing persona-fallback / org-helper paths
-            # that set the GITEA_TOKEN fallback lane (stripped downstream
-            # by provisioner.buildContainerEnv per forensic #145). The
-            # new L1 fail-closed runs BEFORE these writers, so any
-            # operator-scope leak via global/workspace_secrets is
-            # already caught. See applyAgentGitHTTPCreds doc-comment.
-            "workspace-server/internal/handlers/agent_git_identity.go"
-            "workspace-server/internal/handlers/org_helpers.go"
-            "workspace-server/internal/handlers/org.go"
-            # Class 2 — CP→platform admin auth (NOT a tenant env write;
-            # this is the control-plane HTTP auth header source).
-            "workspace-server/internal/provisioner/cp_provisioner.go"
-          )
-
-          # Build a single grep -F pattern: every forbidden key wrapped
-          # in quotes (Go string-literal form, which is how env-map
-          # writes appear). e.g. envVars["GITEA_TOKEN"] = ... or
-          # `"GITEA_TOKEN":` in a literal-map declaration.
-          #
-          # We deliberately match the quoted form so a comment that
-          # happens to spell the name without quotes (e.g. "see
-          # GITEA_TOKEN below") doesn't trip the lint.
-          PATTERN=""
-          for k in "${FORBIDDEN_KEYS[@]}"; do
-            PATTERN="${PATTERN}\"${k}\"\n"
-          done
-          for p in "${FORBIDDEN_PREFIXES[@]}"; do
-            # Prefix match needs a regex; switch to grep -E below for
-            # this slice. Kept conceptually here so the deny set lives
-            # in one place; scan is run twice (literal + prefix).
-            true
-          done
-
-          # Build exempt-paths grep filter — `grep -v -f` style.
-          EXEMPT_FILTER=$(mktemp)
-          trap 'rm -f "$EXEMPT_FILTER"' EXIT
-          for p in "${EXEMPT_PATHS[@]}"; do
-            echo "$p" >> "$EXEMPT_FILTER"
-          done
-
-          # --- Exact-match scan ---
-          HITS=""
-          for k in "${FORBIDDEN_KEYS[@]}"; do
-            # Only .go files; skip _test.go for the writer-path scan
-            # since tests legitimately reference the names. The
-            # writer-path lint targets PRODUCTION code only.
-            found=$(grep -rn --include='*.go' --exclude='*_test.go' "\"${k}\"" "$SCAN_ROOT" 2>/dev/null \
-                    | grep -v -F -f "$EXEMPT_FILTER" || true)
-            if [ -n "$found" ]; then
-              HITS="${HITS}${found}\n"
-            fi
-          done
-
-          # --- Prefix scan ---
-          for prefix in "${FORBIDDEN_PREFIXES[@]}"; do
-            found=$(grep -rnE --include='*.go' --exclude='*_test.go' "\"${prefix}[A-Z0-9_]+\"" "$SCAN_ROOT" 2>/dev/null \
-                    | grep -v -F -f "$EXEMPT_FILTER" || true)
-            if [ -n "$found" ]; then
-              HITS="${HITS}${found}\n"
-            fi
-          done
-
-          if [ -n "$HITS" ]; then
-            echo "::error::RFC#523 Layer 3: forbidden operator-scope env var name(s) hardcoded in tenant-workspace writer paths:"
-            printf "$HITS"
-            echo ""
-            echo "These env-var NAMES are on the operator-scope deny list (see"
-            echo "workspace-server/internal/handlers/workspace_provision_forbidden_env.go)."
-            echo "If your code legitimately needs to inject one of these for a"
-            echo "non-tenant code path, add the file to EXEMPT_PATHS in this"
-            echo "workflow with a one-line justification — reviewer signoff required."
-            exit 1
-          fi
-
-          echo "OK No forbidden operator-scope env key names hardcoded in writer paths."
@@ -1,88 +0,0 @@
-name: Lint shellcheck (arm64 pilot)
-
-# Mac-CI dual-track pilot (#233). ADDITIVE / NOT REQUIRED.
-#
-# Validates the arm64 self-hosted lane (no docker.sock, no privileged
-# ops) before any required gate moves onto it. Until a Mac arm64 runner
-# is registered with the `arm64` label, this workflow sits PENDING —
-# that is FINE: `arm64` is NOT in branch_protections required contexts.
-#
-# Pairs with internal#543 (RFC: Mac arm64 multi-arch runner-base).
-# No paths: filter on purpose (feedback_path_filtered_workflow_cant_be_required).
-
-on:
-  pull_request:
-    branches:
-      - main
-      - staging
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-jobs:
-  shellcheck-arm64:
-    name: shellcheck-arm64 (pilot)
-    runs-on: [self-hosted, arm64]
-    # NOT a required check; safe to sit pending until Mac runner is up.
-    # If the Mac runner has trouble pulling actions/checkout we fall
-    # back to a plain git clone (see step 'fallback clone').
-    timeout-minutes: 10
-    env:
-      GITHUB_SERVER_URL: https://git.moleculesai.app
-    steps:
-      - name: Identify runner
-        run: |
-          set -eu
-          echo "arch=$(uname -m)"
-          echo "kernel=$(uname -sr)"
-          echo "shell=$BASH_VERSION"
-          # Sanity: must actually be arm64. If amd64 sneaks in here,
-          # fail fast — that means the label routing is wrong.
-          case "$(uname -m)" in
-            aarch64|arm64) echo "arm64 confirmed" ;;
-            *) echo "ERROR: expected arm64, got $(uname -m)"; exit 1 ;;
-          esac
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Install shellcheck (arm64)
-        run: |
-          set -eu
-          if command -v shellcheck >/dev/null 2>&1; then
-            echo "shellcheck already present: $(shellcheck --version | head -1)"
-          else
-            # Prefer apt if the runner base ships it; else download arm64 binary.
-            if command -v apt-get >/dev/null 2>&1; then
-              sudo apt-get update -qq
-              sudo apt-get install -y --no-install-recommends shellcheck
-            else
-              SC_VER=v0.10.0
-              curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/${SC_VER}/shellcheck-${SC_VER}.linux.aarch64.tar.xz" \
-                | tar -xJf - --strip-components=1
-              sudo mv shellcheck /usr/local/bin/
-            fi
-          fi
-          shellcheck --version | head -2
-
-      - name: Run shellcheck on .gitea/scripts/*.sh
-        run: |
-          set -eu
-          # Only the scripts we control under .gitea/scripts. Pilot
-          # scope is intentionally narrow — broaden in a follow-up
-          # once the lane is proven.
-          mapfile -t TARGETS < <(find .gitea/scripts -maxdepth 2 -type f -name '*.sh' | sort)
-          if [ "${#TARGETS[@]}" -eq 0 ]; then
-            echo "No .sh files found under .gitea/scripts — nothing to check"
-            exit 0
-          fi
-          echo "Checking ${#TARGETS[@]} file(s):"
-          printf '  %s\n' "${TARGETS[@]}"
-          # SC1091 = couldn't follow non-constant source; expected for
-          # CI-time analysis without the full runtime layout.
-          shellcheck --severity=error --exclude=SC1091 "${TARGETS[@]}"
@@ -49,17 +49,13 @@ jobs:
  # bp-exempt: post-merge image publication side effect; CI / all-required gates source changes.
  build-and-push:
    name: Build & push canvas image
-    # Dedicated publish/release lane (internal#462 / #394 / #399). Ship
-    # path (on: push:main, canvas/**) — reserved capacity so a merged
-    # canvas fix's image build never FIFO-queues behind PR required-CI.
-    # The `publish` label resolves ONLY to the molecule-runner-publish-*
-    # sub-pool (config.publish.yaml). HARD DEPENDENCY: this MUST land
-    # AFTER the publish-lane runners are registered/advertising `publish`
-    # — the earlier #599 `docker` label attempt queued indefinitely with
-    # zero eligible runners precisely because the label was targeted
-    # before any runner advertised it (see #576). The lane is registered
-    # in this rollout (internal#462) so the precondition holds.
-    runs-on: publish
+    # REVERTED (infra/revert-docker-runner-label): `runs-on: ubuntu-latest` restored.
+    # The `docker` label is not registered on any act_runner. `runs-on: [ubuntu-latest, docker]`
+    # causes jobs to queue indefinitely with zero eligible runners — strictly worse than the
+    # pre-#599 coin-flip (50% success rate). Once the `docker` label is registered on
+    # ≥2 runners, re-apply the fix from #599 (infra/docker-runner-label).
+    # See issue #576 + infra-lead pulse ~00:30Z.
+    runs-on: ubuntu-latest
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -104,7 +104,7 @@ jobs:
        with:
          python-version: "3.11"

-      - name: Compute next version from PyPI latest and existing tags
+      - name: Compute next version from PyPI latest
        id: bump
        run: |
          set -eu
@@ -112,24 +112,9 @@ jobs:
            | python -c "import sys,json; print(json.load(sys.stdin)['info']['version'])")
          MAJOR=$(echo "$LATEST" | cut -d. -f1)
          MINOR=$(echo "$LATEST" | cut -d. -f2)
-          TAG_LATEST=$(git tag --list "runtime-v${MAJOR}.${MINOR}.*" \
-            | sed -E 's/^runtime-v//' \
-            | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
-            | sort -V \
-            | tail -1 || true)
-          VERSION=$(PYPI_LATEST="$LATEST" TAG_LATEST="$TAG_LATEST" python - <<'PY'
-          import os
-
-          def parse(v):
-              return tuple(int(part) for part in v.split("."))
-
-          pypi = os.environ["PYPI_LATEST"]
-          tag = os.environ.get("TAG_LATEST") or pypi
-          base = max(parse(pypi), parse(tag))
-          print(f"{base[0]}.{base[1]}.{base[2] + 1}")
-          PY
-          )
-          echo "PyPI latest=$LATEST, latest runtime tag=${TAG_LATEST:-none} -> next=$VERSION"
+          PATCH=$(echo "$LATEST" | cut -d. -f3)
+          VERSION="${MAJOR}.${MINOR}.$((PATCH+1))"
+          echo "PyPI latest=$LATEST -> next=$VERSION"
          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::computed version $VERSION does not match PEP 440 X.Y.Z"
            exit 1
@@ -66,10 +66,7 @@ concurrency:

 jobs:
  publish:
-    # Dedicated publish/release lane (internal#462 / #394 / #399). Ship
-    # path (on: push tag runtime-v*) — reserved capacity, never FIFO
-    # behind PR-CI. `publish` resolves only to molecule-runner-publish-*.
-    runs-on: publish
+    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      wheel_sha256: ${{ steps.wheel_hash.outputs.wheel_sha256 }}
@@ -162,7 +159,6 @@ jobs:
            exit 1
          fi
          python -m twine upload \
-            --verbose \
            --repository pypi \
            --username __token__ \
            --password "$PYPI_TOKEN" \
@@ -170,9 +166,7 @@ jobs:

  cascade:
    needs: publish
-    # Publish/release lane (internal#462) — downstream of the runtime
-    # publish ship job; keep it on the reserved lane too.
-    runs-on: publish
+    runs-on: ubuntu-latest
    steps:
      - name: Wait for PyPI to propagate the new version
        env:
@@ -54,14 +54,7 @@ env:

 jobs:
  build-and-push:
-    # Dedicated publish/release lane (internal#462 / #394 / #399). This
-    # is a post-merge ship job (on: push:main) — it must NOT FIFO-compete
-    # with PR required-CI on the shared pool (PR#1350's prod image build
-    # was delayed ~25min this way). The `publish` label resolves ONLY to
-    # the reserved molecule-runner-publish-* sub-pool (config.publish.yaml,
-    # OUTSIDE the managed 1..20 range) so a merged fix's image build
-    # starts immediately while PR-CI keeps the general pool.
-    runs-on: publish
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -188,9 +181,7 @@ jobs:
    name: Production auto-deploy
    needs: build-and-push
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-    # Publish/release lane (internal#462) — production deploy of a merged
-    # fix; reserved capacity, never queued behind PR-CI.
-    runs-on: publish
+    runs-on: ubuntu-latest
    timeout-minutes: 75
    env:
      CP_URL: ${{ vars.PROD_CP_URL || 'https://api.moleculesai.app' }}
@@ -89,7 +89,6 @@ on:
 permissions:
  contents: read
  pull-requests: read
-  secrets: read

 jobs:
  # bp-exempt: PR review bot signal; required merge state is enforced by CI / all-required.
@@ -68,10 +68,7 @@ jobs:
  # bp-exempt: production redeploy is a side-effect workflow, not a merge gate.
  redeploy:
    if: ${{ github.event_name == 'workflow_dispatch' }}
-    # Dedicated publish/release lane (internal#462 / #394 / #399).
-    # Production tenant redeploy — a deploy action, reserved capacity so
-    # it never queues behind PR-CI. `publish` -> molecule-runner-publish-*.
-    runs-on: publish
+    runs-on: ubuntu-latest
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -75,10 +75,7 @@ env:
 jobs:
  # bp-exempt: post-merge staging redeploy side effect; CI / all-required gates source changes.
  redeploy:
-    # Dedicated publish/release lane (internal#462 / #394 / #399).
-    # Post-merge staging redeploy — a deploy action, reserved capacity.
-    # `publish` -> molecule-runner-publish-* sub-pool.
-    runs-on: publish
+    runs-on: ubuntu-latest
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -18,10 +18,6 @@ permissions:
  pull-requests: read
  statuses: write

-concurrency:
-  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.event.issue.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
  dispatch:
    runs-on: ubuntu-latest
@@ -30,11 +30,6 @@ jobs:
  scan:
    name: Scan diff for credential-shaped strings
    runs-on: ubuntu-latest
-    # Hard CI gate — must complete or the PR is unmergable. 10-minute ceiling
-    # is generous for a diff-scan against a single SHA. If this times out, the
-    # runner is frozen and holding a slot — the step timeout triggers clean
-    # failure, releasing the runner for the next job.
-    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
@@ -138,14 +133,6 @@ jobs:
            [ -z "$f" ] && continue
            [ "$f" = "$SELF_GITHUB" ] && continue
            [ "$f" = "$SELF_GITEA" ] && continue
-            # Test-fixture exclude (internal#425): the secrets-detector's OWN
-            # unit-test corpus deliberately embeds credential-SHAPED example
-            # strings to exercise the detector. Verified 2026-05-18 synthetic
-            # (fabricated ghp_* fixtures, not real). Without this the scanner
-            # self-trips on its own fixtures and fail-closes every deploy.
-            # Same rationale as the SELF_* excludes above; gate NOT weakened
-            # (all other paths still fully scanned).
-            [ "$f" = "workspace-server/internal/secrets/patterns_test.go" ] && continue
            if [ -n "$DIFF_RANGE" ]; then
              ADDED=$(git diff --no-color --unified=0 "$BASE" "$HEAD" -- "$f" 2>/dev/null | grep -E '^\+[^+]' || true)
            else
@@ -16,7 +16,6 @@ on:
 permissions:
  contents: read
  pull-requests: read
-  secrets: read

 jobs:
  # bp-exempt: PR security review bot signal; required merge state is enforced by CI / all-required.
@@ -70,7 +70,7 @@ name: sop-checklist
 # Cancel any in-progress runs for the same PR to prevent
 # stale runs from overwriting newer status contexts.
 concurrency:
-  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
+  group: ${{ github.repository }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

 # bp-required: yes  ← emits sop-checklist / all-items-acked (pull_request)
@@ -84,8 +84,11 @@ on:
 permissions:
  contents: read
  pull-requests: read
+  # NOTE: `statuses: write` is the GitHub-Actions name for POST /statuses.
+  # Gitea 1.22.6 may not gate on this permission key (it just checks the
+  # token), but listing it explicitly documents intent for the next
+  # platform-version upgrade.
  statuses: write
-  secrets: read

 jobs:
  all-items-acked:
@@ -61,17 +61,12 @@ on:
  pull_request_review:
    types: [submitted, dismissed, edited]

-concurrency:
-  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
  tier-check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
-      secrets: read
    steps:
      - name: Check out base branch (for the script)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -0,0 +1,255 @@
+name: canary-verify
+
+# Runs the canary smoke suite against the staging canary tenant fleet
+# after a new :staging-<sha> image lands in ECR. On green, calls the
+# CP redeploy-fleet endpoint to promote :staging-<sha> → :latest so
+# the prod tenant fleet's 5-minute auto-updater picks up the verified
+# digest. On red, :latest stays on the prior known-good digest and
+# prod is untouched.
+#
+# Registry note (2026-05-10): This workflow previously used GHCR
+# (ghcr.io/molecule-ai/platform-tenant) — that registry was retired
+# during the 2026-05-06 Gitea suspension migration when publish-
+# workspace-server-image.yml switched to the operator's ECR org
+# (153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/
+# platform-tenant). The GHCR → ECR migration was never applied to
+# this file, so canary-verify was silently smoke-testing the stale
+# GHCR image while the actual staging/prod tenants ran the ECR image.
+# Result: smoke tests could not catch a broken ECR build. Fix:
+#   - Wait step: reads SHA from running canary /health (tenant-
+#     agnostic, works regardless of registry).
+#   - Promote step: calls CP redeploy-fleet endpoint with target_tag=
+#     staging-<sha>, same mechanism as redeploy-tenants-on-main.yml.
+#     No longer attempts GHCR crane ops.
+#
+# Dependencies:
+#   - publish-workspace-server-image.yml publishes :staging-<sha>
+#     to ECR on staging and main merges.
+#   - Canary tenants are configured to pull :staging-<sha> from ECR
+#     (TENANT_IMAGE env set to the ECR :staging-<sha> tag).
+#   - Repo secrets CANARY_TENANT_URLS / CANARY_ADMIN_TOKENS /
+#     CANARY_CP_SHARED_SECRET are populated.
+
+on:
+  workflow_run:
+    workflows: ["publish-workspace-server-image"]
+    types: [completed]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  actions: read
+
+env:
+  # ECR registry (post-2026-05-06 SSOT for tenant images).
+  # publish-workspace-server-image.yml pushes here.
+  IMAGE_NAME: 153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/platform
+  TENANT_IMAGE_NAME: 153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/platform-tenant
+  # CP endpoint for redeploy-fleet (used in promote step below).
+  CP_URL: ${{ vars.CP_URL || 'https://staging-api.moleculesai.app' }}
+
+jobs:
+  canary-smoke:
+    # Skip when the upstream workflow failed — no image to test against.
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.compute.outputs.sha }}
+      smoke_ran: ${{ steps.smoke.outputs.ran }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Compute sha
+        id: compute
+        run: echo "sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for canary tenants to pick up :staging-<sha>
+        # Poll canary health endpoints every 30s for up to 7 min instead
+        # of a fixed 6-min sleep. Exits as soon as ALL canaries report
+        # the new SHA (~2-3 min typical vs 6 min fixed). Falls back to
+        # proceeding after 7 min even if not all canaries responded —
+        # the smoke suite will catch any that didn't update.
+        #
+        # NOTE: The SHA is read from the running tenant's /health response,
+        # NOT from a registry lookup. This is registry-agnostic and works
+        # regardless of whether the tenant pulls from ECR, GHCR, or any
+        # other registry — the canary is telling us what it's actually
+        # running, which is the ground truth for smoke testing.
+        env:
+          CANARY_TENANT_URLS: ${{ secrets.CANARY_TENANT_URLS }}
+          EXPECTED_SHA: ${{ steps.compute.outputs.sha }}
+        run: |
+          if [ -z "$CANARY_TENANT_URLS" ]; then
+            echo "No canary URLs configured — falling back to 60s wait"
+            sleep 60
+            exit 0
+          fi
+          IFS=',' read -ra URLS <<< "$CANARY_TENANT_URLS"
+          MAX_WAIT=420  # 7 minutes
+          INTERVAL=30
+          ELAPSED=0
+          while [ $ELAPSED -lt $MAX_WAIT ]; do
+            ALL_READY=true
+            for url in "${URLS[@]}"; do
+              HEALTH=$(curl -s --max-time 5 "${url}/health" 2>/dev/null || echo "{}")
+              SHA=$(echo "$HEALTH" | grep -o "\"sha\":\"[^\"]*\"" | head -1 | cut -d'"' -f4)
+              if [ "$SHA" != "$EXPECTED_SHA" ]; then
+                ALL_READY=false
+                break
+              fi
+            done
+            if $ALL_READY; then
+              echo "All canaries running staging-${EXPECTED_SHA} after ${ELAPSED}s"
+              exit 0
+            fi
+            echo "Waiting for canaries... (${ELAPSED}s / ${MAX_WAIT}s)"
+            sleep $INTERVAL
+            ELAPSED=$((ELAPSED + INTERVAL))
+          done
+          echo "Timeout after ${MAX_WAIT}s — proceeding anyway (smoke suite will validate)"
+
+      - name: Run canary smoke suite
+        id: smoke
+        # Graceful-skip when no canary fleet is configured (Phase 2 not yet
+        # stood up — see molecule-controlplane/docs/canary-tenants.md).
+        # Sets `ran=false` on skip so promote-to-latest stays off (we don't
+        # want every main merge auto-promoting without gating). Manual
+        # promote-latest.yml is the release gate while canary is absent.
+        # Once the fleet is real: delete the early-exit branch.
+        env:
+          CANARY_TENANT_URLS: ${{ secrets.CANARY_TENANT_URLS }}
+          CANARY_ADMIN_TOKENS: ${{ secrets.CANARY_ADMIN_TOKENS }}
+          CANARY_CP_BASE_URL: https://staging-api.moleculesai.app
+          CANARY_CP_SHARED_SECRET: ${{ secrets.CANARY_CP_SHARED_SECRET }}
+        run: |
+          set -euo pipefail
+          if [ -z "${CANARY_TENANT_URLS:-}" ] \
+            || [ -z "${CANARY_ADMIN_TOKENS:-}" ] \
+            || [ -z "${CANARY_CP_SHARED_SECRET:-}" ]; then
+            {
+              echo "## ⚠️ canary-verify skipped"
+              echo
+              echo "One or more canary secrets are unset (\`CANARY_TENANT_URLS\`, \`CANARY_ADMIN_TOKENS\`, \`CANARY_CP_SHARED_SECRET\`)."
+              echo "Phase 2 canary fleet has not been stood up yet —"
+              echo "see [canary-tenants.md](https://git.moleculesai.app/molecule-ai/molecule-controlplane/blob/main/docs/canary-tenants.md)."
+              echo
+              echo "**Skipped — promote-to-latest will NOT auto-fire.** Dispatch \`promote-latest.yml\` manually when ready."
+            } >> "$GITHUB_STEP_SUMMARY"
+            echo "ran=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::canary-verify: skipped — no canary fleet configured"
+            exit 0
+          fi
+          bash scripts/canary-smoke.sh
+          echo "ran=true" >> "$GITHUB_OUTPUT"
+
+      - name: Summary on failure
+        if: ${{ failure() }}
+        run: |
+          {
+            echo "## Canary smoke FAILED"
+            echo
+            echo "Canary tenants rejected image \`staging-${{ steps.compute.outputs.sha }}\`."
+            echo ":latest stays pinned to the prior good digest — prod is untouched."
+            echo
+            echo "Fix forward and merge again, or investigate the specific failed"
+            echo "assertions in the canary-smoke step log above."
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  promote-to-latest:
+    # On green, calls the CP redeploy-fleet endpoint with target_tag=
+    # staging-<sha> to promote the verified ECR image. This is the same
+    # mechanism as redeploy-tenants-on-main.yml — no GHCR crane ops.
+    #
+    # Pre-fix history: the old GHCR promote step used `crane tag` against
+    # ghcr.io/molecule-ai/platform-tenant, but publish-workspace-server-
+    # image.yml had already migrated to ECR on 2026-05-07 (commit
+    # 10e510f5). The GHCR tags were never updated, so this step was
+    # silently promoting a stale GHCR image while actual prod tenants
+    # pulled from ECR. Canary smoke tests were GHCR-targeted and could
+    # not catch a broken ECR build.
+    needs: canary-smoke
+    if: ${{ needs.canary-smoke.result == 'success' && needs.canary-smoke.outputs.smoke_ran == 'true' }}
+    runs-on: ubuntu-latest
+    env:
+      SHA: ${{ needs.canary-smoke.outputs.sha }}
+      CP_URL: ${{ vars.CP_URL || 'https://staging-api.moleculesai.app' }}
+      # CP_ADMIN_API_TOKEN gates write access to the redeploy endpoint.
+      # Stored at the repo level so all workflows pick it up automatically.
+      CP_ADMIN_API_TOKEN: ${{ secrets.CP_ADMIN_API_TOKEN }}
+      # canary_slug pin: deploy the verified :staging-<sha> to the canary
+      # first (soak 120s), then fan out to the rest of the fleet.
+      CANARY_SLUG: ${{ vars.CANARY_PROMOTE_SLUG || '' }}
+      SOAK_SECONDS: ${{ vars.CANARY_PROMOTE_SOAK || '120' }}
+      BATCH_SIZE: ${{ vars.CANARY_PROMOTE_BATCH || '3' }}
+    steps:
+      - name: Check CP credentials
+        run: |
+          if [ -z "${CP_ADMIN_API_TOKEN:-}" ]; then
+            echo "::error::CP_ADMIN_API_TOKEN secret is not set — promote step cannot call redeploy-fleet."
+            echo "::error::Set it at: repo Settings → Actions → Variables and Secrets → New Secret."
+            exit 1
+          fi
+
+      - name: Promote verified ECR image to :latest
+        run: |
+          set -euo pipefail
+
+          TARGET_TAG="staging-${SHA}"
+          BODY=$(jq -nc \
+            --arg tag "$TARGET_TAG" \
+            --argjson soak "${SOAK_SECONDS:-120}" \
+            --argjson batch "${BATCH_SIZE:-3}" \
+            --argjson dry false \
+            '{
+              target_tag: $tag,
+              soak_seconds: $soak,
+              batch_size: $batch,
+              dry_run: $dry
+            }')
+
+          if [ -n "${CANARY_SLUG:-}" ]; then
+            BODY=$(jq '. * {canary_slug: $slug}' --arg slug "$CANARY_SLUG" <<<"$BODY")
+          fi
+
+          echo "Calling: POST $CP_URL/cp/admin/tenants/redeploy-fleet"
+          echo "  target_tag: $TARGET_TAG"
+          echo "  body: $BODY"
+
+          HTTP_RESPONSE=$(mktemp)
+          HTTP_CODE_FILE=$(mktemp)
+          set +e
+          curl -sS -o "$HTTP_RESPONSE" -w '%{http_code}' \
+            -m 1200 \
+            -H "Authorization: Bearer $CP_ADMIN_API_TOKEN" \
+            -H "Content-Type: application/json" \
+            -X POST "$CP_URL/cp/admin/tenants/redeploy-fleet" \
+            -d "$BODY" >"$HTTP_CODE_FILE"
+          CURL_EXIT=$?
+          set -e
+
+          HTTP_CODE=$(cat "$HTTP_CODE_FILE" 2>/dev/null || echo "000")
+          [ -z "$HTTP_CODE" ] && HTTP_CODE="000"
+
+          echo "HTTP $HTTP_CODE (curl exit $CURL_EXIT)"
+          cat "$HTTP_RESPONSE" | jq . || cat "$HTTP_RESPONSE"
+
+          if [ "$HTTP_CODE" -ge 400 ]; then
+            echo "::error::CP redeploy-fleet returned HTTP $HTTP_CODE — refusing to proceed."
+            exit 1
+          fi
+
+      - name: Summary
+        run: |
+          {
+            echo "## Canary verified — :latest promoted via CP redeploy-fleet"
+            echo ""
+            echo "- **Target tag:** \`staging-${{ needs.canary-smoke.outputs.sha }}\`"
+            echo "- **Registry:** ECR (\`${TENANT_IMAGE_NAME}\`)"
+            echo "- **Canary slug:** \`${CANARY_SLUG:-<none>}\` (soak ${SOAK_SECONDS}s)"
+            echo "- **Batch size:** ${BATCH_SIZE:-3}"
+            echo ""
+            echo "CP redeploy-fleet is rolling out the verified image across the prod fleet."
+            echo "The fleet's 5-minute health-check loop will pick up the update automatically."
+          } >> "$GITHUB_STEP_SUMMARY"
@@ -0,0 +1,400 @@
+name: redeploy-tenants-on-main
+
+# Auto-refresh prod tenant EC2s after every main merge.
+#
+# Why this workflow exists: publish-workspace-server-image builds and
+# pushes a new platform-tenant :<sha> to ECR on every merge to main,
+# but running tenants pulled their image once at boot and never re-pull.
+# Users see stale code indefinitely.
+#
+# This workflow closes the gap by calling the control-plane admin
+# endpoint that performs a canary-first, batched, health-gated rolling
+# redeploy across every live tenant. Implemented in molecule-ai/
+# molecule-controlplane as POST /cp/admin/tenants/redeploy-fleet
+# (feat/tenant-auto-redeploy, landing alongside this workflow).
+#
+# Registry: ECR (153263036946.dkr.ecr.us-east-2.amazonaws.com/
+# molecule-ai/platform-tenant). GHCR was retired 2026-05-07 during the
+# Gitea suspension migration. The canary-verify.yml promote step now
+# uses the same redeploy-fleet endpoint (fixes the silent-GHCR gap).
+#
+# Runtime ordering:
+#   1. publish-workspace-server-image completes → new :staging-<sha> in ECR.
+#   2. This workflow fires via workflow_run, calls redeploy-fleet with
+#      target_tag=staging-<sha>. No CDN propagation wait needed —
+#      ECR image manifest is consistent immediately after push.
+#   3. Calls redeploy-fleet with canary_slug (if set) and a soak
+#      period. Canary proves the image boots; batches follow.
+#   4. Any failure aborts the rollout and leaves older tenants on the
+#      prior image — safer default than half-and-half state.
+#
+# Rollback path: re-run this workflow with a specific SHA pinned via
+# the workflow_dispatch input. That calls redeploy-fleet with
+# target_tag=<sha>, re-pulling the older image on every tenant.
+
+on:
+  workflow_run:
+    workflows: ['publish-workspace-server-image']
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      target_tag:
+        # Empty default → auto-trigger and dispatch-without-input both
+        # resolve to `staging-<short_head_sha>` (the digest publish-image
+        # just pushed). Pre-fix this defaulted to 'latest', which only
+        # gets retagged by canary-verify's promote-to-latest job — and
+        # that job soft-skips when CANARY_TENANT_URLS is unset (the
+        # current state, until Phase 2 canary fleet is live). Result:
+        # `:latest` had been pinned to a 4-day-old digest (2026-04-28)
+        # while every main push pushed fresh `staging-<sha>` images;
+        # every prod redeploy pulled the stale `:latest` and the verify
+        # step correctly flagged 3/3 tenants STALE. Pulling the
+        # just-published `staging-<sha>` directly skips the dead retag
+        # path. When canary fleet is real, this workflow should chain
+        # on canary-verify completion (workflow_run from canary-verify),
+        # not publish-image — separate, smaller PR.
+        description: 'Tenant image tag to deploy (e.g. "latest", "staging-a59f1a6c"). Empty = auto staging-<head_sha>.'
+        required: false
+        type: string
+        default: ''
+      canary_slug:
+        description: 'Tenant slug to deploy first + soak (empty = skip canary, fan out immediately).'
+        required: false
+        type: string
+        # Must be an actual prod tenant slug (current: hongming,
+        # chloe-dong, reno-stars). The previous default 'hongmingwang'
+        # didn't match any tenant — CP soft-skipped the missing canary
+        # and the fleet rolled out without the soak gate, defeating the
+        # whole point of canary-first.
+        default: 'hongming'
+      soak_seconds:
+        description: 'Seconds to wait after canary before fanning out.'
+        required: false
+        type: string
+        default: '60'
+      batch_size:
+        description: 'How many tenants SSM redeploys in parallel per batch.'
+        required: false
+        type: string
+        default: '3'
+      dry_run:
+        description: 'Plan only — do not actually redeploy.'
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  # No write scopes needed — the workflow hits an external CP endpoint,
+  # not the GitHub API.
+
+# Serialize redeploys so two rapid main pushes' redeploys don't overlap
+# and cause confusing per-tenant SSM state. Without this, GitHub's
+# implicit workflow_run queueing would *probably* serialize them, but
+# the explicit block makes the invariant defensible. Mirrors the
+# concurrency block on redeploy-tenants-on-staging.yml for shape parity.
+#
+# cancel-in-progress: false → aborting a half-rolled-out fleet would
+# leave tenants stuck on whatever image they happened to be on when
+# cancelled. Better to finish the in-flight rollout before starting
+# the next one.
+concurrency:
+  group: redeploy-tenants-on-main
+  cancel-in-progress: false
+
+jobs:
+  redeploy:
+    # Skip the auto-trigger if publish-workspace-server-image didn't
+    # actually succeed. workflow_run fires on any completion state; we
+    # don't want to redeploy against a half-built image.
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Note on ECR propagation
+        # ECR image manifests are consistent immediately after push — no
+        # CDN cache to wait for. The old GHCR-based workflow had a 30s
+        # sleep to avoid race conditions; ECR makes that unnecessary.
+        run: echo "ECR image available immediately after push — proceeding."
+
+      - name: Compute target tag
+        id: tag
+        # Resolution order:
+        #   1. Operator-supplied input (workflow_dispatch with explicit
+        #      tag) → used verbatim. Lets ops pin `latest` for emergency
+        #      rollback to last canary-verified digest, or pin a specific
+        #      `staging-<sha>` to roll back to a known-good build.
+        #   2. Default → `staging-<short_head_sha>`. The just-published
+        #      digest. Bypasses the `:latest` retag path that's currently
+        #      dead (canary-verify soft-skips without canary fleet, so
+        #      the only thing retagging `:latest` today is the manual
+        #      promote-latest.yml — last run 2026-04-28). Auto-trigger
+        #      from workflow_run uses workflow_run.head_sha; manual
+        #      dispatch with no input falls through to github.sha.
+        env:
+          INPUT_TAG: ${{ inputs.target_tag }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+        run: |
+          set -euo pipefail
+          if [ -n "${INPUT_TAG:-}" ]; then
+            echo "target_tag=$INPUT_TAG" >> "$GITHUB_OUTPUT"
+            echo "Using operator-pinned tag: $INPUT_TAG"
+          else
+            SHORT="${HEAD_SHA:0:7}"
+            echo "target_tag=staging-$SHORT" >> "$GITHUB_OUTPUT"
+            echo "Using auto tag: staging-$SHORT (head_sha=$HEAD_SHA)"
+          fi
+
+      - name: Call CP redeploy-fleet
+        # CP_ADMIN_API_TOKEN must be set as a repo/org secret on
+        # molecule-ai/molecule-core, matching the staging/prod CP's
+        # CP_ADMIN_API_TOKEN env. Stored in Railway, mirrored to this
+        # repo's secrets for CI.
+        env:
+          CP_URL: ${{ vars.CP_URL || 'https://api.moleculesai.app' }}
+          CP_ADMIN_API_TOKEN: ${{ secrets.CP_ADMIN_API_TOKEN }}
+          TARGET_TAG: ${{ steps.tag.outputs.target_tag }}
+          CANARY_SLUG: ${{ inputs.canary_slug || 'hongming' }}
+          SOAK_SECONDS: ${{ inputs.soak_seconds || '60' }}
+          BATCH_SIZE: ${{ inputs.batch_size || '3' }}
+          DRY_RUN: ${{ inputs.dry_run || false }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${CP_ADMIN_API_TOKEN:-}" ]; then
+            echo "::error::CP_ADMIN_API_TOKEN secret not set — skipping redeploy"
+            echo "::notice::Set CP_ADMIN_API_TOKEN in repo secrets to enable auto-redeploy."
+            exit 1
+          fi
+
+          BODY=$(jq -nc \
+            --arg tag "$TARGET_TAG" \
+            --arg canary "$CANARY_SLUG" \
+            --argjson soak "$SOAK_SECONDS" \
+            --argjson batch "$BATCH_SIZE" \
+            --argjson dry "$DRY_RUN" \
+            '{
+              target_tag: $tag,
+              canary_slug: $canary,
+              soak_seconds: $soak,
+              batch_size: $batch,
+              dry_run: $dry
+            }')
+
+          echo "POST $CP_URL/cp/admin/tenants/redeploy-fleet"
+          echo "  body: $BODY"
+
+          HTTP_RESPONSE=$(mktemp)
+          HTTP_CODE_FILE=$(mktemp)
+          # Route -w into its own tempfile so curl's exit code (e.g. 56
+          # on connection-reset, 22 on --fail-with-body 4xx/5xx) can't
+          # pollute the captured stdout. The previous inline-substitution
+          # shape produced "000000" on connection reset (curl wrote
+          # "000" via -w, then the inline echo-fallback appended another
+          # "000") — caught on the 2026-05-04 redeploy of sha 2b862f6.
+          # set +e/-e keeps the non-zero curl exit from tripping the
+          # outer pipeline. See lint-curl-status-capture.yml for the
+          # CI gate that pins this fix shape.
+          set +e
+          curl -sS -o "$HTTP_RESPONSE" -w '%{http_code}' \
+            -m 1200 \
+            -H "Authorization: Bearer $CP_ADMIN_API_TOKEN" \
+            -H "Content-Type: application/json" \
+            -X POST "$CP_URL/cp/admin/tenants/redeploy-fleet" \
+            -d "$BODY" >"$HTTP_CODE_FILE"
+          set -e
+          # Stderr from curl (e.g. dial errors with -sS) goes to the runner
+          # log so operators can see WHY a connection failed. Stdout is
+          # captured to $HTTP_CODE_FILE because that's where -w writes.
+          HTTP_CODE=$(cat "$HTTP_CODE_FILE" 2>/dev/null || echo "000")
+          [ -z "$HTTP_CODE" ] && HTTP_CODE="000"
+
+          echo "HTTP $HTTP_CODE"
+          cat "$HTTP_RESPONSE" | jq . || cat "$HTTP_RESPONSE"
+
+          # Pretty-print per-tenant results in the job summary so
+          # ops can see which tenants were redeployed without drilling
+          # into the raw response.
+          {
+            echo "## Tenant redeploy fleet"
+            echo ""
+            echo "**Target tag:** \`$TARGET_TAG\`"
+            echo "**Canary:** \`$CANARY_SLUG\` (soak ${SOAK_SECONDS}s)"
+            echo "**Batch size:** $BATCH_SIZE"
+            echo "**Dry run:** $DRY_RUN"
+            echo "**HTTP:** $HTTP_CODE"
+            echo ""
+            echo "### Per-tenant result"
+            echo ""
+            echo '| Slug | Phase | SSM Status | Exit | Healthz | Error |'
+            echo '|------|-------|------------|------|---------|-------|'
+            jq -r '.results[]? | "| \(.slug) | \(.phase) | \(.ssm_status // "-") | \(.ssm_exit_code) | \(.healthz_ok) | \(.error // "-") |"' "$HTTP_RESPONSE" || true
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if [ "$HTTP_CODE" != "200" ]; then
+            echo "::error::redeploy-fleet returned HTTP $HTTP_CODE"
+            exit 1
+          fi
+          OK=$(jq -r '.ok' "$HTTP_RESPONSE")
+          if [ "$OK" != "true" ]; then
+            echo "::error::redeploy-fleet reported ok=false (see summary for which tenant halted the rollout)"
+            exit 1
+          fi
+          echo "::notice::Tenant fleet redeploy reported ssm_status=Success — verifying actual image roll on each tenant..."
+
+          # Stash the response for the verify step. $RUNNER_TEMP outlasts
+          # the step boundary; $HTTP_RESPONSE doesn't.
+          cp "$HTTP_RESPONSE" "$RUNNER_TEMP/redeploy-response.json"
+
+      - name: Verify each tenant /buildinfo matches published SHA
+        # ROOT FIX FOR #2395.
+        #
+        # `redeploy-fleet`'s `ssm_status=Success` means "the SSM RPC
+        # didn't error" — NOT "the new image is running on the tenant."
+        # `:latest` lives in the local Docker daemon's image cache; if
+        # the SSM document does `docker compose up -d` without an
+        # explicit `docker pull`, the daemon serves the previously-
+        # cached digest and the container restarts on stale code.
+        # 2026-04-30 incident: hongmingwang's tenant reported
+        # ssm_status=Success at 17:00:53Z but kept serving pre-501a42d7
+        # chat_files for 30+ min — the lazy-heal fix never reached the
+        # user despite green deploy + green redeploy.
+        #
+        # This step closes the gap by curling each tenant's /buildinfo
+        # endpoint (added in workspace-server/internal/buildinfo +
+        # /Dockerfile* GIT_SHA build-arg, this PR) and comparing the
+        # returned git_sha to the SHA the workflow expects. Mismatches
+        # fail the workflow, which is what `ok=true` should have
+        # guaranteed all along.
+        #
+        # When the redeploy was triggered by workflow_dispatch with a
+        # specific tag (target_tag != "latest"), the expected SHA may
+        # not equal ${{ github.sha }} — in that case we resolve via
+        # GHCR's manifest. For workflow_run (default :latest) the
+        # workflow_run.head_sha is the SHA that just published.
+        env:
+          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          TARGET_TAG: ${{ steps.tag.outputs.target_tag }}
+          # Tenant subdomain template — slugs from the response are
+          # appended. Production CP issues `<slug>.moleculesai.app`;
+          # staging CP issues `<slug>.staging.moleculesai.app`. This
+          # workflow runs on main → prod CP → no `staging.` infix.
+          TENANT_DOMAIN: 'moleculesai.app'
+        run: |
+          set -euo pipefail
+
+          EXPECTED_SHORT="${EXPECTED_SHA:0:7}"
+          if [ "$TARGET_TAG" != "latest" ] \
+             && [ "$TARGET_TAG" != "$EXPECTED_SHA" ] \
+             && [ "$TARGET_TAG" != "staging-$EXPECTED_SHORT" ]; then
+            # workflow_dispatch with a pinned tag that isn't the head
+            # SHA — operator is rolling back / pinning. Skip the
+            # verification because we don't have the expected SHA in
+            # this context (would need to crane-inspect the GHCR
+            # manifest, which is a follow-up). Failing-open here is
+            # safe: the operator chose the tag deliberately.
+            #
+            # `staging-<short_head_sha>` IS verified — it's the new
+            # auto-trigger default (see Compute target tag step) and
+            # the digest under that tag SHOULD match EXPECTED_SHA.
+            echo "::notice::target_tag=$TARGET_TAG (operator-pinned) — skipping per-tenant SHA verification."
+            exit 0
+          fi
+
+          RESP="$RUNNER_TEMP/redeploy-response.json"
+          if [ ! -s "$RESP" ]; then
+            echo "::error::redeploy-response.json missing or empty — verify step ran without a response to read"
+            exit 1
+          fi
+
+          # Pull only successfully-redeployed tenants. Any tenant that
+          # halted the rollout already failed the previous step, so we
+          # don't double-count them here.
+          mapfile -t SLUGS < <(jq -r '.results[]? | select(.healthz_ok == true) | .slug' "$RESP")
+          if [ ${#SLUGS[@]} -eq 0 ]; then
+            echo "::warning::No tenants reported healthz_ok — nothing to verify"
+            exit 0
+          fi
+
+          echo "Verifying ${#SLUGS[@]} tenant(s) against EXPECTED_SHA=${EXPECTED_SHA:0:7}..."
+
+          # Two distinct failure modes — STALE (the #2395 bug class, hard-fail)
+          # vs UNREACHABLE (teardown race, soft-warn). See the staging variant's
+          # comment for the full rationale; same logic applies on prod even
+          # though prod has fewer ephemeral tenants — the asymmetry would be a
+          # gratuitous fork.
+          STALE_COUNT=0
+          UNREACHABLE_COUNT=0
+          STALE_LINES=()
+          UNREACHABLE_LINES=()
+          for slug in "${SLUGS[@]}"; do
+            URL="https://${slug}.${TENANT_DOMAIN}/buildinfo"
+            # 30s total: tenant just SSM-restarted, may still be coming
+            # up. Retry-on-empty rather than retry-on-status — we want
+            # to fail fast on "responded with wrong SHA", not "still
+            # warming up".
+            BODY=$(curl -sS --max-time 30 --retry 3 --retry-delay 5 --retry-connrefused "$URL" || true)
+            ACTUAL_SHA=$(echo "$BODY" | jq -r '.git_sha // ""' 2>/dev/null || echo "")
+            if [ -z "$ACTUAL_SHA" ]; then
+              UNREACHABLE_COUNT=$((UNREACHABLE_COUNT + 1))
+              UNREACHABLE_LINES+=("| $slug | (no /buildinfo response) | ${EXPECTED_SHA:0:7} | ⚠ unreachable (likely teardown race) |")
+              continue
+            fi
+            if [ "$ACTUAL_SHA" = "$EXPECTED_SHA" ]; then
+              echo "  $slug: ${ACTUAL_SHA:0:7} ✓"
+            else
+              STALE_COUNT=$((STALE_COUNT + 1))
+              STALE_LINES+=("| $slug | ${ACTUAL_SHA:0:7} | ${EXPECTED_SHA:0:7} | ❌ stale |")
+            fi
+          done
+
+          {
+            echo ""
+            echo "### Per-tenant /buildinfo verification"
+            echo ""
+            echo "Expected SHA: \`${EXPECTED_SHA:0:7}\`"
+            echo ""
+            if [ $STALE_COUNT -gt 0 ]; then
+              echo "**${STALE_COUNT} STALE tenant(s) — these did NOT pick up the new image despite ssm_status=Success:**"
+              echo ""
+              echo "| Slug | Actual /buildinfo SHA | Expected | Status |"
+              echo "|------|----------------------|----------|--------|"
+              for line in "${STALE_LINES[@]}"; do echo "$line"; done
+              echo ""
+            fi
+            if [ $UNREACHABLE_COUNT -gt 0 ]; then
+              echo "**${UNREACHABLE_COUNT} unreachable tenant(s) — likely teardown race (soft-warn, not failing):**"
+              echo ""
+              echo "| Slug | Actual /buildinfo SHA | Expected | Status |"
+              echo "|------|----------------------|----------|--------|"
+              for line in "${UNREACHABLE_LINES[@]}"; do echo "$line"; done
+              echo ""
+            fi
+            if [ $STALE_COUNT -eq 0 ] && [ $UNREACHABLE_COUNT -eq 0 ]; then
+              echo "All ${#SLUGS[@]} tenants returned matching SHA. ✓"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if [ $UNREACHABLE_COUNT -gt 0 ]; then
+            echo "::warning::$UNREACHABLE_COUNT tenant(s) unreachable post-redeploy. Likely benign teardown race — CP healthz monitor catches real outages."
+          fi
+
+          # Belt-and-suspenders sanity floor: same logic as the staging
+          # variant — see that file's comment for the full rationale.
+          # Floor only applies when fleet >= 4; below that, canary-verify
+          # is the actual gate.
+          TOTAL_VERIFIED=${#SLUGS[@]}
+          if [ $TOTAL_VERIFIED -ge 4 ] && [ $UNREACHABLE_COUNT -gt $((TOTAL_VERIFIED / 2)) ]; then
+            echo "::error::$UNREACHABLE_COUNT of $TOTAL_VERIFIED tenant(s) unreachable — exceeds 50% threshold on a fleet large enough that this signals a real outage, not teardown race."
+            exit 1
+          fi
+
+          if [ $STALE_COUNT -gt 0 ]; then
+            echo "::error::$STALE_COUNT tenant(s) returned a stale SHA. ssm_status=Success was misleading — see job summary."
+            exit 1
+          fi
+
+          echo "::notice::Tenant fleet redeploy complete — all reachable tenants on ${EXPECTED_SHA:0:7} (${UNREACHABLE_COUNT} unreachable, soft-warned)."
@@ -0,0 +1,362 @@
+name: redeploy-tenants-on-staging
+
+# Auto-refresh staging tenant EC2s after every staging-branch merge.
+#
+# Mirror of redeploy-tenants-on-main.yml, with the staging-CP host and
+# the :staging-latest tag. Sister workflow exists for prod (rolls
+# :latest after canary-verify). Both share the same shape — just
+# different CP_URL + target_tag + admin token secret.
+#
+# Why this workflow exists: publish-workspace-server-image now builds
+# on every staging-branch push (PR #2335), pushing
+# platform-tenant:staging-latest to GHCR. Existing tenants pulled
+# their image once at boot and never re-pull, so the new image just
+# sits unused until the tenant is reprovisioned.
+#
+# This workflow closes the gap by calling staging-CP's
+# /cp/admin/tenants/redeploy-fleet, which performs a canary-first,
+# batched, health-gated SSM redeploy across every live staging tenant.
+# Same endpoint shape as prod CP — only the host differs.
+#
+# Runtime ordering:
+#   1. publish-workspace-server-image completes on staging branch →
+#      new :staging-latest in GHCR.
+#   2. This workflow fires via workflow_run, waits 30s for GHCR's CDN
+#      to propagate the new tag.
+#   3. Calls redeploy-fleet with no canary (staging IS canary; we don't
+#      need a sub-canary inside it). Soak still applies to the first
+#      tenant in case of bad-deploy detection.
+#   4. Any failure aborts the rollout and leaves older tenants on the
+#      prior image — safer default than half-and-half state.
+#
+# Rollback path: re-run with workflow_dispatch + target_tag=staging-<sha>
+# of a known-good build.
+
+on:
+  workflow_run:
+    workflows: ['publish-workspace-server-image']
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      target_tag:
+        description: 'Tenant image tag to deploy (e.g. "staging-latest" or "staging-a59f1a6c"). Defaults to staging-latest when empty.'
+        required: false
+        type: string
+        default: 'staging-latest'
+      canary_slug:
+        description: 'Tenant slug to deploy first + soak (empty = skip canary, fan out immediately). Default empty for staging since staging itself is the canary.'
+        required: false
+        type: string
+        default: ''
+      soak_seconds:
+        description: 'Seconds to wait after canary before fanning out. Only meaningful if canary_slug is set.'
+        required: false
+        type: string
+        default: '60'
+      batch_size:
+        description: 'How many tenants SSM redeploys in parallel per batch.'
+        required: false
+        type: string
+        default: '3'
+      dry_run:
+        description: 'Plan only — do not actually redeploy.'
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  # No write scopes needed — the workflow hits an external CP endpoint,
+  # not the GitHub API.
+
+# Serialize per-branch so two rapid staging pushes' redeploys don't
+# overlap and cause confusing per-tenant SSM state. cancel-in-progress
+# is false because aborting a half-rolled-out fleet leaves tenants
+# stuck on whatever image they happened to be on when cancelled.
+concurrency:
+  group: redeploy-tenants-on-staging
+  cancel-in-progress: false
+
+jobs:
+  redeploy:
+    # Skip the auto-trigger if publish-workspace-server-image didn't
+    # actually succeed. workflow_run fires on any completion state; we
+    # don't want to redeploy against a half-built image.
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Wait for GHCR tag propagation
+        # GHCR's edge cache takes ~15-30s to consistently serve the new
+        # :staging-latest manifest after the registry accepts the push.
+        # Same rationale as redeploy-tenants-on-main.yml.
+        run: sleep 30
+
+      - name: Call staging-CP redeploy-fleet
+        # CP_STAGING_ADMIN_API_TOKEN must be set as a repo/org secret
+        # on molecule-ai/molecule-core, matching staging-CP's
+        # CP_ADMIN_API_TOKEN env var (visible in Railway controlplane
+        # / staging environment). Stored separately from the prod
+        # CP_ADMIN_API_TOKEN so a leak of one doesn't auth the other.
+        env:
+          CP_URL: ${{ vars.STAGING_CP_URL || 'https://staging-api.moleculesai.app' }}
+          CP_STAGING_ADMIN_API_TOKEN: ${{ secrets.CP_STAGING_ADMIN_API_TOKEN }}
+          TARGET_TAG: ${{ inputs.target_tag || 'staging-latest' }}
+          CANARY_SLUG: ${{ inputs.canary_slug || '' }}
+          SOAK_SECONDS: ${{ inputs.soak_seconds || '60' }}
+          BATCH_SIZE: ${{ inputs.batch_size || '3' }}
+          DRY_RUN: ${{ inputs.dry_run || false }}
+        run: |
+          set -euo pipefail
+
+          # Schedule-vs-dispatch hardening (mirrors sweep-cf-orphans
+          # and sweep-cf-tunnels): hard-fail on auto-trigger when the
+          # secret is missing so a misconfigured-repo doesn't silently
+          # serve stale staging tenants. Soft-skip on operator dispatch.
+          if [ -z "${CP_STAGING_ADMIN_API_TOKEN:-}" ]; then
+            if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+              echo "::warning::CP_STAGING_ADMIN_API_TOKEN secret not set — skipping redeploy"
+              echo "::warning::Set CP_STAGING_ADMIN_API_TOKEN in repo secrets to enable auto-redeploy."
+              echo "::notice::Pull the value from staging-CP's CP_ADMIN_API_TOKEN env in Railway."
+              exit 0
+            fi
+            echo "::error::staging redeploy cannot run — CP_STAGING_ADMIN_API_TOKEN secret missing"
+            echo "::error::set it at Settings → Secrets and Variables → Actions; pull from staging-CP's CP_ADMIN_API_TOKEN env in Railway."
+            exit 1
+          fi
+
+          BODY=$(jq -nc \
+            --arg tag "$TARGET_TAG" \
+            --arg canary "$CANARY_SLUG" \
+            --argjson soak "$SOAK_SECONDS" \
+            --argjson batch "$BATCH_SIZE" \
+            --argjson dry "$DRY_RUN" \
+            '{
+              target_tag: $tag,
+              canary_slug: $canary,
+              soak_seconds: $soak,
+              batch_size: $batch,
+              dry_run: $dry
+            }')
+
+          echo "POST $CP_URL/cp/admin/tenants/redeploy-fleet"
+          echo "  body: $BODY"
+
+          HTTP_RESPONSE=$(mktemp)
+          HTTP_CODE_FILE=$(mktemp)
+          # Route -w into its own tempfile so curl's exit code (e.g. 56
+          # on connection-reset) can't pollute the captured stdout. The
+          # previous inline-substitution shape produced "000000" on
+          # connection reset — caught on main variant 2026-05-04
+          # redeploying sha 2b862f6. Same fix shape as the synth-E2E
+          # §9c gate (PR #2797). See lint-curl-status-capture.yml for
+          # the CI gate that pins this fix shape.
+          set +e
+          curl -sS -o "$HTTP_RESPONSE" -w '%{http_code}' \
+            -m 1200 \
+            -H "Authorization: Bearer $CP_STAGING_ADMIN_API_TOKEN" \
+            -H "Content-Type: application/json" \
+            -X POST "$CP_URL/cp/admin/tenants/redeploy-fleet" \
+            -d "$BODY" >"$HTTP_CODE_FILE"
+          set -e
+          # Stderr from curl (-sS shows dial errors etc.) goes to the
+          # runner log so operators can see WHY a connection failed.
+          HTTP_CODE=$(cat "$HTTP_CODE_FILE" 2>/dev/null || echo "000")
+          [ -z "$HTTP_CODE" ] && HTTP_CODE="000"
+
+          echo "HTTP $HTTP_CODE"
+          cat "$HTTP_RESPONSE" | jq . || cat "$HTTP_RESPONSE"
+
+          {
+            echo "## Staging tenant redeploy fleet"
+            echo ""
+            echo "**Target tag:** \`$TARGET_TAG\`"
+            echo "**Canary:** \`${CANARY_SLUG:-(none — staging is itself the canary)}\` (soak ${SOAK_SECONDS}s)"
+            echo "**Batch size:** $BATCH_SIZE"
+            echo "**Dry run:** $DRY_RUN"
+            echo "**HTTP:** $HTTP_CODE"
+            echo ""
+            echo "### Per-tenant result"
+            echo ""
+            echo '| Slug | Phase | SSM Status | Exit | Healthz | Error |'
+            echo '|------|-------|------------|------|---------|-------|'
+            jq -r '.results[]? | "| \(.slug) | \(.phase) | \(.ssm_status // "-") | \(.ssm_exit_code) | \(.healthz_ok) | \(.error // "-") |"' "$HTTP_RESPONSE" || true
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          # Distinguish "real fleet failure" from "E2E teardown race".
+          #
+          # CP returns HTTP 500 + ok=false whenever ANY tenant in the
+          # fleet failed SSM or healthz. In practice the recurring source
+          # of these is ephemeral test tenants being torn down by their
+          # parent E2E run mid-redeploy: the EC2 dies → SSM exit=2 or
+          # healthz timeout → CP marks the fleet failed → this workflow
+          # goes red even though every operator-facing tenant rolled fine.
+          #
+          # Ephemeral slug prefixes (kept in sync with sweep-stale-e2e-orgs.yml
+          # — see that file for the source-of-truth list and rationale):
+          #   - e2e-*       — canvas/saas/ext E2E suites
+          #   - rt-e2e-*    — runtime-test harness fixtures (RFC #2251)
+          # Long-lived prefixes that are NOT ephemeral and MUST hard-fail:
+          # demo-prep, dryrun-*, dryrun2-*, plus all human tenant slugs.
+          #
+          # Filter: if HTTP=500/ok=false AND every failed slug matches an
+          # ephemeral prefix, treat as soft-warn and let the verify step
+          # downstream handle unreachable-vs-stale (#2402). Any non-ephemeral
+          # failure or a non-500 HTTP response remains a hard failure.
+          OK=$(jq -r '.ok // "false"' "$HTTP_RESPONSE")
+          FAILED_SLUGS=$(jq -r '
+            .results[]?
+            | select((.healthz_ok != true) or (.ssm_status != "Success"))
+            | .slug' "$HTTP_RESPONSE" 2>/dev/null || true)
+          EPHEMERAL_PREFIX_RE='^(e2e-|rt-e2e-)'
+          NON_EPHEMERAL_FAILED=$(printf '%s\n' "$FAILED_SLUGS" | grep -v '^$' | grep -Ev "$EPHEMERAL_PREFIX_RE" || true)
+
+          if [ "$HTTP_CODE" = "200" ] && [ "$OK" = "true" ]; then
+            : # happy path — fall through to verification
+          elif [ "$HTTP_CODE" = "500" ] && [ -z "$NON_EPHEMERAL_FAILED" ] && [ -n "$FAILED_SLUGS" ]; then
+            COUNT=$(printf '%s\n' "$FAILED_SLUGS" | grep -Ec "$EPHEMERAL_PREFIX_RE" || true)
+            echo "::warning::redeploy-fleet returned HTTP 500 but every failed tenant ($COUNT) is ephemeral (e2e-*/rt-e2e-*) — treating as teardown race, soft-warning."
+            printf '%s\n' "$FAILED_SLUGS" | sed 's/^/::warning::  failed: /'
+          elif [ "$HTTP_CODE" != "200" ]; then
+            echo "::error::redeploy-fleet returned HTTP $HTTP_CODE"
+            if [ -n "$NON_EPHEMERAL_FAILED" ]; then
+              echo "::error::non-ephemeral tenant(s) failed:"
+              printf '%s\n' "$NON_EPHEMERAL_FAILED" | sed 's/^/::error::  /'
+            fi
+            exit 1
+          else
+            # HTTP=200 but ok=false (shouldn't happen with current CP
+            # but keep the gate for completeness).
+            echo "::error::redeploy-fleet reported ok=false (see summary for which tenant halted the rollout)"
+            exit 1
+          fi
+          echo "::notice::Staging tenant fleet redeploy reported ssm_status=Success — verifying actual image roll on each tenant..."
+
+          cp "$HTTP_RESPONSE" "$RUNNER_TEMP/redeploy-response.json"
+
+      - name: Verify each staging tenant /buildinfo matches published SHA
+        # Mirror of the verify step in redeploy-tenants-on-main.yml — see
+        # there for the rationale (#2395 root fix). Staging has the same
+        # ssm_status-success-but-stale-image hazard and benefits from the
+        # same gate. Diff: TENANT_DOMAIN includes the `staging.` infix.
+        env:
+          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          TARGET_TAG: ${{ inputs.target_tag || 'staging-latest' }}
+          TENANT_DOMAIN: 'staging.moleculesai.app'
+        run: |
+          set -euo pipefail
+
+          # staging-latest is the staging-side moving tag; treat it the
+          # same way main treats `latest`. Operator-pinned SHAs skip
+          # verification (see main variant for why).
+          if [ "$TARGET_TAG" != "staging-latest" ] && [ "$TARGET_TAG" != "latest" ] && [ "$TARGET_TAG" != "$EXPECTED_SHA" ]; then
+            echo "::notice::target_tag=$TARGET_TAG (operator-pinned) — skipping per-tenant SHA verification."
+            exit 0
+          fi
+
+          RESP="$RUNNER_TEMP/redeploy-response.json"
+          if [ ! -s "$RESP" ]; then
+            echo "::error::redeploy-response.json missing or empty"
+            exit 1
+          fi
+
+          mapfile -t SLUGS < <(jq -r '.results[]? | select(.healthz_ok == true) | .slug' "$RESP")
+          if [ ${#SLUGS[@]} -eq 0 ]; then
+            echo "::warning::No staging tenants reported healthz_ok — nothing to verify"
+            exit 0
+          fi
+
+          echo "Verifying ${#SLUGS[@]} staging tenant(s) against EXPECTED_SHA=${EXPECTED_SHA:0:7}..."
+
+          # Two distinct failure modes here:
+          #   STALE_COUNT      — tenant returned a SHA that doesn't match. THIS is
+          #                      the #2395 bug class: tenant up + serving old code.
+          #                      Always hard-fail the workflow.
+          #   UNREACHABLE_COUNT — tenant didn't respond. Almost always a benign
+          #                      teardown race: redeploy-fleet snapshot says
+          #                      healthz_ok=true, then the E2E suite tears the
+          #                      ephemeral tenant down before this step runs (the
+          #                      e2e-* fixtures churn 5-10/hour on staging). Soft-
+          #                      warn so we don't block staging→main on cleanup.
+          #                      Real "tenant up but unreachable" is caught by CP's
+          #                      own healthz monitor + the post-redeploy alert; we
+          #                      don't need to double-count it here.
+          STALE_COUNT=0
+          UNREACHABLE_COUNT=0
+          STALE_LINES=()
+          UNREACHABLE_LINES=()
+          for slug in "${SLUGS[@]}"; do
+            URL="https://${slug}.${TENANT_DOMAIN}/buildinfo"
+            BODY=$(curl -sS --max-time 30 --retry 3 --retry-delay 5 --retry-connrefused "$URL" || true)
+            ACTUAL_SHA=$(echo "$BODY" | jq -r '.git_sha // ""' 2>/dev/null || echo "")
+            if [ -z "$ACTUAL_SHA" ]; then
+              UNREACHABLE_COUNT=$((UNREACHABLE_COUNT + 1))
+              UNREACHABLE_LINES+=("| $slug | (no /buildinfo response) | ${EXPECTED_SHA:0:7} | ⚠ unreachable (likely teardown race) |")
+              continue
+            fi
+            if [ "$ACTUAL_SHA" = "$EXPECTED_SHA" ]; then
+              echo "  $slug: ${ACTUAL_SHA:0:7} ✓"
+            else
+              STALE_COUNT=$((STALE_COUNT + 1))
+              STALE_LINES+=("| $slug | ${ACTUAL_SHA:0:7} | ${EXPECTED_SHA:0:7} | ❌ stale |")
+            fi
+          done
+
+          {
+            echo ""
+            echo "### Per-tenant /buildinfo verification (staging)"
+            echo ""
+            echo "Expected SHA: \`${EXPECTED_SHA:0:7}\`"
+            echo ""
+            if [ $STALE_COUNT -gt 0 ]; then
+              echo "**${STALE_COUNT} STALE tenant(s) — these did NOT pick up the new image despite ssm_status=Success:**"
+              echo ""
+              echo "| Slug | Actual /buildinfo SHA | Expected | Status |"
+              echo "|------|----------------------|----------|--------|"
+              for line in "${STALE_LINES[@]}"; do echo "$line"; done
+              echo ""
+            fi
+            if [ $UNREACHABLE_COUNT -gt 0 ]; then
+              echo "**${UNREACHABLE_COUNT} unreachable tenant(s) — likely E2E teardown race (soft-warn, not failing):**"
+              echo ""
+              echo "| Slug | Actual /buildinfo SHA | Expected | Status |"
+              echo "|------|----------------------|----------|--------|"
+              for line in "${UNREACHABLE_LINES[@]}"; do echo "$line"; done
+              echo ""
+            fi
+            if [ $STALE_COUNT -eq 0 ] && [ $UNREACHABLE_COUNT -eq 0 ]; then
+              echo "All ${#SLUGS[@]} staging tenants returned matching SHA. ✓"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if [ $UNREACHABLE_COUNT -gt 0 ]; then
+            echo "::warning::$UNREACHABLE_COUNT staging tenant(s) unreachable post-redeploy. Likely benign teardown race — CP healthz monitor catches real outages."
+          fi
+
+          # Belt-and-suspenders sanity floor: if MORE than half the fleet is
+          # unreachable AND the fleet is large enough that "half down" is
+          # statistically meaningful, this is a real outage (e.g. new image
+          # crashes on startup), not a teardown race. Hard-fail.
+          #
+          # Floor only applies when TOTAL_VERIFIED >= 4 — below that, the
+          # canary-verify step is the actual gate for "all tenants down"
+          # detection (it runs against the canary first and aborts the
+          # rollout if the canary fails to come up). Without the >=4 gate,
+          # a 1-tenant fleet (e.g. a single ephemeral e2e-* tenant on a
+          # quiet staging push) would re-flake on the exact teardown-race
+          # condition #2402 fixed: 1 of 1 unreachable = 100% > 50% → fail.
+          TOTAL_VERIFIED=${#SLUGS[@]}
+          if [ $TOTAL_VERIFIED -ge 4 ] && [ $UNREACHABLE_COUNT -gt $((TOTAL_VERIFIED / 2)) ]; then
+            echo "::error::$UNREACHABLE_COUNT of $TOTAL_VERIFIED staging tenant(s) unreachable — exceeds 50% threshold on a fleet large enough that this signals a real outage, not teardown race."
+            exit 1
+          fi
+
+          if [ $STALE_COUNT -gt 0 ]; then
+            echo "::error::$STALE_COUNT staging tenant(s) returned a stale SHA. ssm_status=Success was misleading — see job summary."
+            exit 1
+          fi
+
+          echo "::notice::Staging tenant fleet redeploy complete — all reachable tenants on ${EXPECTED_SHA:0:7} (${UNREACHABLE_COUNT} unreachable, soft-warned)."
@@ -1 +1 @@
-staging trigger 2026-05-14T17:35:02Z
+staging trigger
@@ -57,24 +57,24 @@ See `CLAUDE.md` for a full list of environment variables and their purposes.

 This repo is scoped to **code** (canvas, workspace, workspace-server, related
 infra). Public content (blog posts, marketing copy, OG images, SEO briefs,
-DevRel demos) lives in [`molecule-ai/docs`](https://git.moleculesai.app/molecule-ai/docs).
+DevRel demos) lives in [`Molecule-AI/docs`](https://git.moleculesai.app/molecule-ai/docs).
 The `Block forbidden paths` CI gate fails any PR that writes to `marketing/`
-or other removed paths — open against `molecule-ai/docs` instead.
+or other removed paths — open against `Molecule-AI/docs` instead.

 | Content type | Target |
 |---|---|
-| Blog posts | `molecule-ai/docs` → `content/blog/<YYYY-MM-DD-slug>/` |
-| Doc pages | `molecule-ai/docs` → `content/docs/` |
-| Marketing copy / PMM positioning | `molecule-ai/docs` → `marketing/` |
-| OG images, visual assets | `molecule-ai/docs` → `app/` or `marketing/` |
-| SEO briefs | `molecule-ai/docs` → `marketing/` |
-| DevRel demos (runnable code) | Standalone repo under `molecule-ai/`, OR embedded in `molecule-ai/docs` |
+| Blog posts | `Molecule-AI/docs` → `content/blog/<YYYY-MM-DD-slug>/` |
+| Doc pages | `Molecule-AI/docs` → `content/docs/` |
+| Marketing copy / PMM positioning | `Molecule-AI/docs` → `marketing/` |
+| OG images, visual assets | `Molecule-AI/docs` → `app/` or `marketing/` |
+| SEO briefs | `Molecule-AI/docs` → `marketing/` |
+| DevRel demos (runnable code) | Standalone repo under `Molecule-AI/`, OR embedded in `Molecule-AI/docs` |
 | Launch checklists, internal tracking | GitHub Issues — **not** committed files |
 | Engineering docs (`docs/adr/`, `docs/architecture/`, `docs/incidents/`) | This repo (internal, not published) |
 | Live product pages (e.g. `canvas/src/app/pricing/page.tsx`) | This repo (these are app code, not marketing copy) |

 If a PR fails the `Block forbidden paths` check, the contents belong in
-`molecule-ai/docs`. No CI drag, no Canvas E2E, content lands in minutes.
+`Molecule-AI/docs`. No CI drag, no Canvas E2E, content lands in minutes.

 ## Development Workflow

@@ -190,9 +190,9 @@ Runs the full regression suite against a fixture HTTP server. No network access
 Code in this repo lands in molecule-core. Some related runtime artifacts
 live in their own repos:

- [`molecule-ai/molecule-ai-workspace-runtime`](https://git.moleculesai.app/molecule-ai/molecule-ai-workspace-runtime) — Python adapter SDK (`molecule_runtime`) that runs inside containerized Molecule workspaces. Bridges Claude Code SDK / hermes / langgraph / etc. → A2A queue.
- [`molecule-ai/molecule-sdk-python`](https://git.moleculesai.app/molecule-ai/molecule-sdk-python) — `A2AServer` + `RemoteAgentClient` for external agents that register over the public `/registry/register` flow.
- [`molecule-ai/molecule-mcp-claude-channel`](https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel) — Claude Code channel plugin. Bridges A2A traffic into a running Claude Code session via MCP `notifications/claude/channel`. Polling-based (no tunnel required); install inside Claude Code via `/plugin marketplace add https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel.git` → `/plugin install molecule@molecule-channel`, then launch with `claude --dangerously-load-development-channels --channels plugin:molecule@molecule-channel`.
+- [`Molecule-AI/molecule-ai-workspace-runtime`](https://git.moleculesai.app/molecule-ai/molecule-ai-workspace-runtime) — Python adapter SDK (`molecule_runtime`) that runs inside containerized Molecule workspaces. Bridges Claude Code SDK / hermes / langgraph / etc. → A2A queue.
+- [`Molecule-AI/molecule-sdk-python`](https://git.moleculesai.app/molecule-ai/molecule-sdk-python) — `A2AServer` + `RemoteAgentClient` for external agents that register over the public `/registry/register` flow.
+- [`Molecule-AI/molecule-mcp-claude-channel`](https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel) — Claude Code channel plugin. Bridges A2A traffic into a running Claude Code session via MCP `notifications/claude/channel`. Polling-based (no tunnel required); install with `claude --channels plugin:molecule@Molecule-AI/molecule-mcp-claude-channel`.

 When extending the **A2A surface** in molecule-core (`workspace-server/internal/handlers/a2a_proxy.go` etc.), consider whether the change has a downstream impact on the runtime SDK or the channel plugin — they're versioned independently but share the wire shape.

@@ -4,10 +4,10 @@
 # use this Makefile; CI calls docker compose / go test directly so the
 # Makefile can evolve without breaking the build.

-.PHONY: help dev up down logs build test e2e-peer-visibility
+.PHONY: help dev up down logs build test

 help: ## Show this help.
-	@grep -E '^[a-zA-Z0-9_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-22s\033[0m %s\n", $$1, $$2}'
+	@grep -E '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-12s\033[0m %s\n", $$1, $$2}'

 dev: ## Start the full stack with air hot-reload for the platform service.
 	docker compose -f docker-compose.yml -f docker-compose.dev.yml up
@@ -26,13 +26,3 @@ build: ## Force a fresh build of the platform image (no cache).

 test: ## Run Go unit tests in workspace-server/.
 	cd workspace-server && go test -race ./...
-
-# ─── Local prod-mimic E2E gates ────────────────────────────────────────
-# Run the LITERAL peer-visibility MCP list_peers gate against the
-# already-running local stack (`make up` or `make dev`). Same byte-
-# identical assertion as the staging gate — only provisioning differs.
-# Skips any runtime whose provider key is absent (partially-keyed env
-# is fine). See tests/e2e/test_peer_visibility_mcp_local.sh for the
-# env contract (CLAUDE_CODE_OAUTH_TOKEN / E2E_MINIMAX_API_KEY / etc).
-e2e-peer-visibility: ## Run the LOCAL peer-visibility MCP gate vs the running stack (needs `make up` first).
-	bash tests/e2e/test_peer_visibility_mcp_local.sh
@@ -238,7 +238,7 @@ The result is not just “an agent that learns.” It is **an organization that
 - subscribe to one or more workspaces; peer messages surface as conversation turns; replies route back through Molecule's A2A
 - no tunnel, no public endpoint — the plugin self-registers each watched workspace as `delivery_mode=poll` and long-polls `/activity?since_id=…`
 - multi-tenant friendly: one plugin install can watch workspaces across multiple Molecule tenants (`MOLECULE_PLATFORM_URLS` per-workspace)
- install via the standard marketplace flow: `/plugin marketplace add https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel.git` → `/plugin install molecule@molecule-channel`, then launch with `claude --dangerously-load-development-channels --channels plugin:molecule@molecule-channel`
+- install via the standard marketplace flow: `/plugin marketplace add Molecule-AI/molecule-mcp-claude-channel` → `/plugin install molecule-channel@molecule-mcp-claude-channel`

 ## Built For Teams That Need More Than A Demo

@@ -237,7 +237,7 @@ Molecule AI 并不是要替代下面这些 framework，而是把它们纳入更
 - 订阅一个或多个 workspace；peer 的消息会以 user-turn 出现，回复会经 Molecule A2A 路由出去
 - 无需公网隧道、无需公开端点 —— 插件启动时自动把每个 watched workspace 注册成 `delivery_mode=poll`，长轮询 `/activity?since_id=…`
 - 多租户友好：单次安装即可同时 watch 跨多个 Molecule 租户的 workspace（`MOLECULE_PLATFORM_URLS` 按 workspace 配置）
- 通过标准 marketplace 流程安装：`/plugin marketplace add https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel.git` → `/plugin install molecule@molecule-channel`，然后用 `claude --dangerously-load-development-channels --channels plugin:molecule@molecule-channel` 启动
+- 通过标准 marketplace 流程安装：`/plugin marketplace add Molecule-AI/molecule-mcp-claude-channel` → `/plugin install molecule-channel@molecule-mcp-claude-channel`

 ## 适合什么团队

@@ -1 +0,0 @@
-trigger
@@ -8,7 +8,7 @@ export default defineConfig({
  workers: 1,
  retries: 0,
  use: {
-    baseURL: process.env.PLAYWRIGHT_BASE_URL || "http://localhost:3000",
+    baseURL: "http://localhost:3000",
    headless: true,
    screenshot: "only-on-failure",
  },
@@ -1,113 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-
-// Marketing-launch SEO (mc#1486). These tests pin the public crawler
-// contract: anything that flips public marketing routes to disallow,
-// drops the sitemap from robots.txt, or removes the OG image
-// reference from root metadata should fail loudly here.
-
-// next/font and the rest of the layout's runtime tree are not
-// vitest-compatible (next/font expects the Next.js compiler swc
-// transform). We import layout.tsx only for its exported `metadata`
-// constant — mock the font module to a constructor-returning stub.
-vi.mock("next/font/google", () => ({
-  Inter: () => ({ variable: "--font-inter" }),
-  JetBrains_Mono: () => ({ variable: "--font-jetbrains" }),
-}));
-
-import robots from "../robots";
-import sitemap from "../sitemap";
-import { metadata } from "../layout";
-
-describe("robots.ts", () => {
-  it("allows public marketing routes and blocks authed/app routes", () => {
-    const r = robots();
-    expect(r.rules).toBeDefined();
-    const rule = Array.isArray(r.rules) ? r.rules[0] : r.rules!;
-    expect(rule.userAgent).toBe("*");
-    const allow = Array.isArray(rule.allow) ? rule.allow : [rule.allow];
-    expect(allow).toEqual(expect.arrayContaining(["/", "/pricing", "/blog"]));
-    const disallow = Array.isArray(rule.disallow)
-      ? rule.disallow
-      : [rule.disallow];
-    expect(disallow).toEqual(
-      expect.arrayContaining(["/api/", "/orgs", "/cp/"]),
-    );
-  });
-
-  it("declares the sitemap URL", () => {
-    const r = robots();
-    expect(r.sitemap).toMatch(/\/sitemap\.xml$/);
-  });
-
-  it("declares a canonical host", () => {
-    const r = robots();
-    expect(r.host).toMatch(/^https:\/\//);
-  });
-});
-
-describe("sitemap.ts", () => {
-  it("includes apex, pricing, and the live blog post", () => {
-    const entries = sitemap();
-    const urls = entries.map((e) => e.url);
-    expect(urls.some((u) => u.endsWith("/"))).toBe(true);
-    expect(urls.some((u) => u.endsWith("/pricing"))).toBe(true);
-    expect(
-      urls.some((u) => u.includes("/blog/2026-04-20-chrome-devtools-mcp")),
-    ).toBe(true);
-  });
-
-  it("does NOT include authed/app routes", () => {
-    const entries = sitemap();
-    const urls = entries.map((e) => e.url);
-    expect(urls.some((u) => u.includes("/orgs"))).toBe(false);
-    expect(urls.some((u) => u.includes("/api/"))).toBe(false);
-  });
-
-  it("sets a non-zero priority and a valid changeFrequency on every entry", () => {
-    const valid = new Set([
-      "always",
-      "hourly",
-      "daily",
-      "weekly",
-      "monthly",
-      "yearly",
-      "never",
-    ]);
-    for (const e of sitemap()) {
-      expect(e.priority).toBeGreaterThan(0);
-      expect(valid.has(String(e.changeFrequency))).toBe(true);
-    }
-  });
-});
-
-describe("root layout metadata", () => {
-  it("sets a templated title + non-empty description", () => {
-    const t = metadata.title as { default: string; template: string };
-    expect(t.default).toMatch(/Molecule AI/);
-    expect(t.template).toMatch(/%s/);
-    expect((metadata.description ?? "").length).toBeGreaterThan(50);
-  });
-
-  it("declares OG + Twitter text fields (image comes from opengraph-image.tsx)", () => {
-    const og = metadata.openGraph;
-    expect(og).toBeDefined();
-    expect((og as { title: string }).title).toMatch(/Molecule AI/);
-    expect((og as { description: string }).description.length).toBeGreaterThan(
-      50,
-    );
-    const tw = metadata.twitter;
-    expect(tw).toBeDefined();
-    // Next.js typings narrow twitter.card to a union — assert via cast.
-    expect((tw as { card: string }).card).toBe("summary_large_image");
-  });
-
-  it("sets a canonical alternate", () => {
-    expect(metadata.alternates?.canonical).toBe("/");
-  });
-
-  it("enables indexing at the metadata level (robots.ts owns per-route)", () => {
-    const r = metadata.robots as { index: boolean; follow: boolean };
-    expect(r.index).toBe(true);
-    expect(r.follow).toBe(true);
-  });
-});
@@ -27,78 +27,9 @@ import {
  themeBootScript,
 } from "@/lib/theme-cookie";

-// Marketing-launch SEO (mc#1486). Canonical apex is app.moleculesai.app —
-// tenant subdomains (<slug>.moleculesai.app) reuse the same Next.js build
-// but are gated behind auth (AuthGate redirects anonymous → /cp/auth/login)
-// and are de-indexed in robots.ts. The metadata here applies to the
-// public marketing surface served from the apex host.
-//
-// Override per-route by exporting a page-level `metadata`/`generateMetadata`
-// — Next.js merges page metadata over layout metadata using
-// `title.template` for "<page> | Molecule AI" composition.
-const SITE_URL =
-  process.env.NEXT_PUBLIC_SITE_URL ?? "https://app.moleculesai.app";
-
 export const metadata: Metadata = {
-  metadataBase: new URL(SITE_URL),
-  title: {
-    default: "Molecule AI — the AI org chart canvas",
-    template: "%s | Molecule AI",
-  },
-  description:
-    "Molecule AI is an org-chart canvas for AI agent teams. Wire Claude Code, Codex, Hermes, and OpenClaw agents into a governed multi-agent workspace with credit metering, audit, and one-click runtime provisioning.",
-  applicationName: "Molecule AI",
-  keywords: [
-    "AI agents",
-    "multi-agent",
-    "agent orchestration",
-    "AI org chart",
-    "Claude Code",
-    "Codex",
-    "MCP",
-    "agent governance",
-    "A2A",
-    "agent runtime",
-  ],
-  authors: [{ name: "Molecule AI" }],
-  creator: "Molecule AI",
-  publisher: "Molecule AI",
-  alternates: { canonical: "/" },
-  // OG + Twitter images come from the file-convention sibling
-  // `opengraph-image.tsx` — Next.js auto-attaches them to og:image
-  // and twitter:image when present at the segment root. We keep the
-  // text fields here so they win over per-page metadata when a page
-  // doesn't override them. `images: []` as the structural fallback
-  // for hosts that won't follow the file convention; the real URL
-  // is injected by Next.js at build time from opengraph-image.tsx.
-  openGraph: {
-    type: "website",
-    siteName: "Molecule AI",
-    url: SITE_URL,
-    title: "Molecule AI — the AI org chart canvas",
-    description:
-      "Wire Claude Code, Codex, Hermes, and OpenClaw agents into a governed multi-agent workspace. Credit metering, audit, and one-click runtime provisioning.",
-    locale: "en_US",
-  },
-  twitter: {
-    card: "summary_large_image",
-    title: "Molecule AI — the AI org chart canvas",
-    description:
-      "Wire Claude Code, Codex, Hermes, and OpenClaw agents into a governed multi-agent workspace.",
-  },
-  icons: {
-    icon: "/molecule-icon.png",
-    apple: "/molecule-icon.png",
-  },
-  // robots.ts owns the per-route allow/disallow contract; this is the
-  // header-level fallback for routes the crawler reaches before
-  // robots.txt resolves. Default = index public marketing routes;
-  // app/auth/api/orgs are noindex'd by robots.ts.
-  robots: {
-    index: true,
-    follow: true,
-    googleBot: { index: true, follow: true, "max-image-preview": "large" },
-  },
+  title: "Molecule AI",
+  description: "AI Org Chart Canvas",
 };

 export default async function RootLayout({
@@ -163,75 +94,6 @@ export default async function RootLayout({
          nonce={nonce}
          dangerouslySetInnerHTML={{ __html: themeBootScript }}
        />
-        {/*
-         * JSON-LD structured data (mc#1486). Two graph nodes:
-         *
-         *   - Organization: surfaces the brand to Google Knowledge
-         *     Graph + Bing entity index. URL+logo+sameAs are the
-         *     minimum recommended set for new brands without a
-         *     Wikipedia page.
-         *
-         *   - WebSite: enables the sitelinks search box and tells
-         *     crawlers the canonical site URL when the same content
-         *     is reachable via multiple subdomains (apex + tenant).
-         *
-         * Type-application/ld+json runs synchronously without
-         * executing JS, so 'strict-dynamic' isn't required — we still
-         * carry the nonce because production CSP's default-src 'self'
-         * applies to any <script> element. The "type" attribute is
-         * what keeps the browser from running the body as JS, but
-         * CSP nonces are gated on the element not the type, so we
-         * include the nonce too.
-         */}
-        <script
-          type="application/ld+json"
-          nonce={nonce}
-          dangerouslySetInnerHTML={{
-            __html: JSON.stringify({
-              "@context": "https://schema.org",
-              "@graph": [
-                {
-                  "@type": "Organization",
-                  "@id": `${SITE_URL}#organization`,
-                  name: "Molecule AI",
-                  url: SITE_URL,
-                  logo: `${SITE_URL}/molecule-icon.png`,
-                  sameAs: [
-                    "https://github.com/molecule-ai",
-                    "https://x.com/moleculeai",
-                  ],
-                },
-                {
-                  "@type": "WebSite",
-                  "@id": `${SITE_URL}#website`,
-                  url: SITE_URL,
-                  name: "Molecule AI",
-                  publisher: { "@id": `${SITE_URL}#organization` },
-                  inLanguage: "en-US",
-                },
-                {
-                  "@type": "SoftwareApplication",
-                  "@id": `${SITE_URL}#software`,
-                  name: "Molecule AI",
-                  applicationCategory: "DeveloperApplication",
-                  operatingSystem: "Web",
-                  description:
-                    "Org-chart canvas for AI agent teams with credit metering, audit, and one-click runtime provisioning.",
-                  url: SITE_URL,
-                  offers: {
-                    "@type": "AggregateOffer",
-                    priceCurrency: "USD",
-                    lowPrice: "0",
-                    highPrice: "99",
-                    offerCount: "3",
-                    url: `${SITE_URL}/pricing`,
-                  },
-                  publisher: { "@id": `${SITE_URL}#organization` },
-                },
-              ],
-            }),
-          }}
-        />
      </head>
      <body className={`bg-surface text-ink ${interFont.variable} ${monoFont.variable}`}>
        <ThemeProvider initialTheme={theme}>
@@ -1,82 +0,0 @@
-import { ImageResponse } from "next/og";
-
-// Marketing-launch SEO (mc#1486). Next.js App-Router file-system OG
-// convention: served as `/opengraph-image` and auto-attached as
-// `og:image` + `twitter:image`. Dynamic (not a static PNG in /public)
-// so we can iterate the brand mark + tagline pre-launch without
-// churning a binary blob in git history.
-export const runtime = "edge";
-
-export const alt = "Molecule AI — the AI org chart canvas";
-export const size = { width: 1200, height: 630 };
-export const contentType = "image/png";
-
-export default function OG() {
-  return new ImageResponse(
-    (
-      <div
-        style={{
-          width: "100%",
-          height: "100%",
-          display: "flex",
-          flexDirection: "column",
-          alignItems: "flex-start",
-          justifyContent: "center",
-          padding: "80px",
-          background:
-            "linear-gradient(135deg, #0a0a0a 0%, #1a1a2e 60%, #16213e 100%)",
-          color: "#ffffff",
-          fontFamily: "system-ui, -apple-system, sans-serif",
-        }}
-      >
-        <div
-          style={{
-            fontSize: 28,
-            color: "#a3a3c2",
-            letterSpacing: "0.18em",
-            textTransform: "uppercase",
-            marginBottom: 24,
-          }}
-        >
-          Molecule AI
-        </div>
-        <div
-          style={{
-            fontSize: 76,
-            fontWeight: 700,
-            lineHeight: 1.05,
-            letterSpacing: "-0.02em",
-            maxWidth: 980,
-          }}
-        >
-          The AI org chart canvas
-        </div>
-        <div
-          style={{
-            fontSize: 32,
-            color: "#c8c8d8",
-            marginTop: 32,
-            lineHeight: 1.3,
-            maxWidth: 980,
-          }}
-        >
-          Wire Claude Code, Codex, Hermes, and OpenClaw agents into a governed
-          multi-agent workspace.
-        </div>
-        <div
-          style={{
-            position: "absolute",
-            right: 80,
-            bottom: 80,
-            fontSize: 22,
-            color: "#7a7a96",
-            display: "flex",
-          }}
-        >
-          moleculesai.app
-        </div>
-      </div>
-    ),
-    { ...size },
-  );
-}
@@ -103,7 +103,7 @@ export default function Home() {
                setHydrationError(null);
                window.location.reload();
              }}
-              className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+              className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm"
            >
              Retry
            </button>
@@ -115,9 +115,7 @@ export default function Home() {

  return (
    <>
-      <main aria-label="Agent canvas">
-        <Canvas />
-      </main>
+      <Canvas />
      <Legend />
      <CommunicationOverlay />
      {hydrationError && (
@@ -136,7 +134,7 @@ export default function Home() {
              setHydrationError(null);
              window.location.reload();
            }}
-            className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm"
          >
            Retry
          </button>
@@ -178,7 +176,7 @@ brew services start redis`}</pre>
      </p>
      <button
        onClick={() => window.location.reload()}
-        className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm mt-2 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+        className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm mt-2"
      >
        Reload
      </button>
@@ -1,45 +0,0 @@
-import type { MetadataRoute } from "next";
-
-// Marketing-launch SEO (mc#1486). Next.js App-Router robots convention:
-// this file is served as `/robots.txt` at build time and is the single
-// source of truth for crawler allow/disallow.
-//
-// Contract:
-//   - Public marketing routes (/, /pricing, /blog/*) are crawlable.
-//   - Authed/app routes (/orgs, /api/*) are noindex'd. They render
-//     useful content only after a session round-trip, so a crawler hit
-//     just wastes our crawl budget and exposes endpoint shapes.
-//   - Tenant subdomains (<slug>.moleculesai.app) share this build but
-//     are blocked at the host level by the canvas middleware sending
-//     an `X-Robots-Tag: noindex` header — robots.txt is per-host and
-//     this file's `host` field claims the apex as canonical.
-//
-// Note: `sitemap` is published via the sibling `sitemap.ts` route; we
-// reference it explicitly here so crawlers don't have to guess.
-const SITE_URL =
-  process.env.NEXT_PUBLIC_SITE_URL ?? "https://app.moleculesai.app";
-
-export default function robots(): MetadataRoute.Robots {
-  return {
-    rules: [
-      {
-        userAgent: "*",
-        allow: ["/", "/pricing", "/blog"],
-        // Authed app surface + API + transient checkout returns. The
-        // /orgs route boots the org-selector behind AuthGate; even
-        // though SSR returns markup, that markup is a login wall when
-        // hit by an unauthenticated crawler, so indexing it dilutes
-        // brand searches with a "Please sign in" snippet.
-        disallow: [
-          "/orgs",
-          "/orgs/",
-          "/api/",
-          "/cp/",
-          "/checkout/",
-        ],
-      },
-    ],
-    sitemap: `${SITE_URL}/sitemap.xml`,
-    host: SITE_URL,
-  };
-}
@@ -1,42 +0,0 @@
-import type { MetadataRoute } from "next";
-
-// Marketing-launch SEO (mc#1486). App-Router sitemap convention: this
-// file is served as `/sitemap.xml` and enumerates the public marketing
-// surface for search crawlers + AI training pipelines.
-//
-// Scope deliberately narrow:
-//   - Apex landing, pricing, and the (currently single) blog post.
-//   - Authed app routes are excluded — they're disallowed in robots.ts
-//     and would appear as "Please sign in" wall to a crawler.
-//
-// `lastModified` uses a build-time timestamp rather than per-route
-// fs.stat so the same value applies regardless of where the build
-// runs (Vercel/Railway/local). When we add CMS-backed blog content,
-// swap to a per-entry timestamp from the source-of-truth metadata.
-const SITE_URL =
-  process.env.NEXT_PUBLIC_SITE_URL ?? "https://app.moleculesai.app";
-
-const BUILD_DATE = new Date();
-
-export default function sitemap(): MetadataRoute.Sitemap {
-  return [
-    {
-      url: `${SITE_URL}/`,
-      lastModified: BUILD_DATE,
-      changeFrequency: "weekly",
-      priority: 1.0,
-    },
-    {
-      url: `${SITE_URL}/pricing`,
-      lastModified: BUILD_DATE,
-      changeFrequency: "weekly",
-      priority: 0.9,
-    },
-    {
-      url: `${SITE_URL}/blog/2026-04-20-chrome-devtools-mcp`,
-      lastModified: new Date("2026-04-20"),
-      changeFrequency: "monthly",
-      priority: 0.6,
-    },
-  ];
-}
@@ -132,7 +132,7 @@ export function AuditTrailPanel({ workspaceId }: Props) {

  if (loading) {
    return (
-      <div role="status" aria-live="polite" className="flex items-center justify-center h-32">
+      <div className="flex items-center justify-center h-32">
        <span className="text-xs text-ink-mid">Loading audit trail…</span>
      </div>
    );
@@ -133,13 +133,13 @@ export function ConversationTraceModal({ open, workspaceId: _workspaceId, onClos
            {/* Timeline */}
            <div className="flex-1 overflow-y-auto px-5 py-4">
              {loading && (
-                <div role="status" aria-live="polite" className="text-xs text-ink-mid text-center py-8">
+                <div className="text-xs text-ink-mid text-center py-8">
                  Loading trace from all workspaces...
                </div>
              )}

              {!loading && entries.length === 0 && (
-                <div role="status" aria-live="polite" className="text-xs text-ink-mid text-center py-8">
+                <div className="text-xs text-ink-mid text-center py-8">
                  No activity found
                </div>
              )}
@@ -105,7 +105,7 @@ export function EmptyState() {

        {/* Template grid */}
        {loading ? (
-          <div role="status" aria-live="polite" className="flex items-center justify-center gap-2 text-xs text-ink-mid py-4">
+          <div className="flex items-center justify-center gap-2 text-xs text-ink-mid py-4">
            <Spinner />
            Loading templates...
          </div>
@@ -15,7 +15,7 @@
 //     ($AGENT_URL). They ARE NOT filled in server-side because the
 //     server doesn't know where the operator's agent will live.

-import { useCallback, useRef, useState } from "react";
+import { useCallback, useState } from "react";
 import * as Dialog from "@radix-ui/react-dialog";

 type Tab = "python" | "curl" | "claude" | "mcp" | "hermes" | "codex" | "openclaw" | "kimi" | "fields";
@@ -84,33 +84,6 @@ export function ExternalConnectModal({ info, onClose }: Props) {
    : "python";
  const [tab, setTab] = useState<Tab>(initialTab);
  const [copiedKey, setCopiedKey] = useState<string | null>(null);
-  const tabRefs = useRef<Map<Tab, HTMLButtonElement | null>>(new Map());
-
-  const handleTabKeyDown = useCallback(
-    (e: React.KeyboardEvent<HTMLButtonElement>, current: Tab, tabs: Tab[]) => {
-      const idx = tabs.indexOf(current);
-      if (e.key === "ArrowRight" || e.key === "ArrowDown") {
-        e.preventDefault();
-        const next = tabs[(idx + 1) % tabs.length];
-        setTab(next);
-        tabRefs.current.get(next)?.focus();
-      } else if (e.key === "ArrowLeft" || e.key === "ArrowUp") {
-        e.preventDefault();
-        const prev = tabs[(idx - 1 + tabs.length) % tabs.length];
-        setTab(prev);
-        tabRefs.current.get(prev)?.focus();
-      } else if (e.key === "Home") {
-        e.preventDefault();
-        setTab(tabs[0]);
-        tabRefs.current.get(tabs[0])?.focus();
-      } else if (e.key === "End") {
-        e.preventDefault();
-        setTab(tabs[tabs.length - 1]);
-        tabRefs.current.get(tabs[tabs.length - 1])?.focus();
-      }
-    },
-    [],
-  );

  const copy = useCallback(async (value: string, key: string) => {
    try {
@@ -187,19 +160,6 @@ export function ExternalConnectModal({ info, onClose }: Props) {
    `MOLECULE_WORKSPACE_TOKEN=${info.auth_token}`,
  );

-  // Build the tab list once so both the tab bar and keyboard handler
-  // share the same ordered array. Computed here (after all filled* vars)
-  // so TypeScript's block-scoping analysis can reach them.
-  const tabList: Tab[] = [];
-  if (filledUniversalMcp) tabList.push("mcp");
-  tabList.push("python");
-  if (filledChannel) tabList.push("claude");
-  if (filledHermes) tabList.push("hermes");
-  if (filledCodex) tabList.push("codex");
-  if (filledOpenClaw) tabList.push("openclaw");
-  if (filledKimi) tabList.push("kimi");
-  tabList.push("curl", "fields");
-
  return (
    <Dialog.Root open onOpenChange={(o) => !o && onClose()}>
      <Dialog.Portal>
@@ -220,18 +180,34 @@ export function ExternalConnectModal({ info, onClose }: Props) {
            aria-label="Connection snippet format"
            className="mt-4 flex gap-1 border-b border-line"
          >
-            {tabList.map((t) => (
+            {(() => {
+              // Build the tab order dynamically. Claude Code first
+              // (when offered) since it's the simplest setup; Python
+              // SDK second (full register+heartbeat+inbound); Universal
+              // MCP third (any MCP-aware runtime, outbound-only); curl
+              // for one-shot register; Fields for raw values.
+              // Tab order: Universal MCP first (default, runtime-
+              // agnostic primitives), then runtime-specific channel/
+              // SDK tabs, then curl + Fields. Each runtime tab only
+              // appears when the platform supplies the snippet — no
+              // dead "tab missing snippet" UX.
+              const tabs: Tab[] = [];
+              if (filledUniversalMcp) tabs.push("mcp");
+              tabs.push("python");
+              if (filledChannel) tabs.push("claude");
+              if (filledHermes) tabs.push("hermes");
+              if (filledCodex) tabs.push("codex");
+              if (filledOpenClaw) tabs.push("openclaw");
+              if (filledKimi) tabs.push("kimi");
+              tabs.push("curl", "fields");
+              return tabs;
+            })().map((t) => (
              <button
                key={t}
                type="button"
                role="tab"
-                id={`tab-${t}`}
                aria-selected={tab === t}
-                aria-controls={`panel-${t}`}
-                tabIndex={tab === t ? 0 : -1}
-                ref={(el) => { tabRefs.current.set(t, el); }}
                onClick={() => setTab(t)}
-                onKeyDown={(e) => handleTabKeyDown(e, t, tabList)}
                className={`px-3 py-2 text-sm border-b-2 -mb-px transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-surface ${
                  tab === t
                    ? "border-accent text-ink"
@@ -259,39 +235,18 @@ export function ExternalConnectModal({ info, onClose }: Props) {
            ))}
          </div>

-          {/* Snippet area — all panels always in the DOM so aria-controls
-              targets are stable. Hidden panels use aria-hidden so screen
-              readers skip them; active panel uses role=tabpanel with
-              aria-labelledby pointing to the tab button. */}
-          <div className="mt-3" data-testid="snippet-panels">
-            {/* Claude Code tab */}
-            <div
-              id="panel-claude"
-              data-testid="panel-claude"
-              role="tabpanel"
-              aria-labelledby="tab-claude"
-              hidden={tab !== "claude" || !filledChannel}
-              className={tab === "claude" && filledChannel ? "" : "hidden"}
-            >
-              {filledChannel && (
-                <SnippetBlock
-                  value={filledChannel}
-                  label="Claude Code channel — polls workspace's A2A; no tunnel needed"
-                  copyKey="claude"
-                  copied={copiedKey === "claude"}
-                  onCopy={() => copy(filledChannel, "claude")}
-                />
-              )}
-            </div>
-            {/* Python SDK tab */}
-            <div
-              id="panel-python"
-              data-testid="panel-python"
-              role="tabpanel"
-              aria-labelledby="tab-python"
-              hidden={tab !== "python"}
-              className={tab === "python" ? "" : "hidden"}
-            >
+          {/* Snippet area */}
+          <div className="mt-3">
+            {tab === "claude" && filledChannel && (
+              <SnippetBlock
+                value={filledChannel}
+                label="Claude Code channel — polls workspace's A2A; no tunnel needed"
+                copyKey="claude"
+                copied={copiedKey === "claude"}
+                onCopy={() => copy(filledChannel, "claude")}
+              />
+            )}
+            {tab === "python" && (
              <SnippetBlock
                value={filledPython}
                label="Python SDK — includes heartbeat loop (push-mode, needs public URL)"
@@ -299,16 +254,8 @@ export function ExternalConnectModal({ info, onClose }: Props) {
                copied={copiedKey === "python"}
                onCopy={() => copy(filledPython, "python")}
              />
-            </div>
-            {/* curl tab */}
-            <div
-              id="panel-curl"
-              data-testid="panel-curl"
-              role="tabpanel"
-              aria-labelledby="tab-curl"
-              hidden={tab !== "curl"}
-              className={tab === "curl" ? "" : "hidden"}
-            >
+            )}
+            {tab === "curl" && (
              <SnippetBlock
                value={filledCurl}
                label="curl — one-shot register only (no heartbeat)"
@@ -316,111 +263,53 @@ export function ExternalConnectModal({ info, onClose }: Props) {
                copied={copiedKey === "curl"}
                onCopy={() => copy(filledCurl, "curl")}
              />
-            </div>
-            {/* Universal MCP tab */}
-            <div
-              id="panel-mcp"
-              data-testid="panel-mcp"
-              role="tabpanel"
-              aria-labelledby="tab-mcp"
-              hidden={tab !== "mcp" || !filledUniversalMcp}
-              className={tab === "mcp" && filledUniversalMcp ? "" : "hidden"}
-            >
-              {filledUniversalMcp && (
-                <SnippetBlock
-                  value={filledUniversalMcp}
-                  label="Universal MCP — standalone register + heartbeat + tools for any MCP-aware runtime (Claude Code, hermes, codex). Pair with Python or Claude Code tab if you need inbound A2A delivery."
-                  copyKey="mcp"
-                  copied={copiedKey === "mcp"}
-                  onCopy={() => copy(filledUniversalMcp, "mcp")}
-                />
-              )}
-            </div>
-            {/* Hermes tab */}
-            <div
-              id="panel-hermes"
-              data-testid="panel-hermes"
-              role="tabpanel"
-              aria-labelledby="tab-hermes"
-              hidden={tab !== "hermes" || !filledHermes}
-              className={tab === "hermes" && filledHermes ? "" : "hidden"}
-            >
-              {filledHermes && (
-                <SnippetBlock
-                  value={filledHermes}
-                  label="Hermes channel — bridges this workspace's A2A traffic into your hermes-agent session as platform messages (push parity with Claude Code). Long-poll based; no tunnel needed."
-                  copyKey="hermes"
-                  copied={copiedKey === "hermes"}
-                  onCopy={() => copy(filledHermes, "hermes")}
-                />
-              )}
-            </div>
-            {/* Codex tab */}
-            <div
-              id="panel-codex"
-              data-testid="panel-codex"
-              role="tabpanel"
-              aria-labelledby="tab-codex"
-              hidden={tab !== "codex" || !filledCodex}
-              className={tab === "codex" && filledCodex ? "" : "hidden"}
-            >
-              {filledCodex && (
-                <SnippetBlock
-                  value={filledCodex}
-                  label="Codex MCP config — wires the molecule MCP server into ~/.codex/config.toml. Outbound tools today; inbound A2A push needs the Python SDK tab paired in (codex's MCP runtime doesn't route arbitrary notifications/* yet)."
-                  copyKey="codex"
-                  copied={copiedKey === "codex"}
-                  onCopy={() => copy(filledCodex, "codex")}
-                />
-              )}
-            </div>
-            {/* OpenClaw tab */}
-            <div
-              id="panel-openclaw"
-              data-testid="panel-openclaw"
-              role="tabpanel"
-              aria-labelledby="tab-openclaw"
-              hidden={tab !== "openclaw" || !filledOpenClaw}
-              className={tab === "openclaw" && filledOpenClaw ? "" : "hidden"}
-            >
-              {filledOpenClaw && (
-                <SnippetBlock
-                  value={filledOpenClaw}
-                  label="OpenClaw MCP config — wires the molecule MCP server via openclaw mcp set + starts the gateway on loopback. Outbound tools today; inbound A2A push on an external openclaw needs the Python SDK tab paired in (a sessions.steer bridge daemon is future work)."
-                  copyKey="openclaw"
-                  copied={copiedKey === "openclaw"}
-                  onCopy={() => copy(filledOpenClaw, "openclaw")}
-                />
-              )}
-            </div>
-            {/* Kimi tab */}
-            <div
-              id="panel-kimi"
-              data-testid="panel-kimi"
-              role="tabpanel"
-              aria-labelledby="tab-kimi"
-              hidden={tab !== "kimi" || !filledKimi}
-              className={tab === "kimi" && filledKimi ? "" : "hidden"}
-            >
-              {filledKimi && (
-                <SnippetBlock
-                  value={filledKimi}
-                  label="Kimi CLI — self-contained Python bridge. Registers, heartbeats, polls for canvas messages, and echoes replies back. NAT-safe (no public URL). Run in a background terminal or via launchd."
-                  copyKey="kimi"
-                  copied={copiedKey === "kimi"}
-                  onCopy={() => copy(filledKimi, "kimi")}
-                />
-              )}
-            </div>
-            {/* Fields tab */}
-            <div
-              id="panel-fields"
-              data-testid="panel-fields"
-              role="tabpanel"
-              aria-labelledby="tab-fields"
-              hidden={tab !== "fields"}
-              className={tab === "fields" ? "" : "hidden"}
-            >
+            )}
+            {tab === "mcp" && filledUniversalMcp && (
+              <SnippetBlock
+                value={filledUniversalMcp}
+                label="Universal MCP — standalone register + heartbeat + tools for any MCP-aware runtime (Claude Code, hermes, codex). Pair with Python or Claude Code tab if you need inbound A2A delivery."
+                copyKey="mcp"
+                copied={copiedKey === "mcp"}
+                onCopy={() => copy(filledUniversalMcp, "mcp")}
+              />
+            )}
+            {tab === "hermes" && filledHermes && (
+              <SnippetBlock
+                value={filledHermes}
+                label="Hermes channel — bridges this workspace's A2A traffic into your hermes-agent session as platform messages (push parity with Claude Code). Long-poll based; no tunnel needed."
+                copyKey="hermes"
+                copied={copiedKey === "hermes"}
+                onCopy={() => copy(filledHermes, "hermes")}
+              />
+            )}
+            {tab === "codex" && filledCodex && (
+              <SnippetBlock
+                value={filledCodex}
+                label="Codex MCP config — wires the molecule MCP server into ~/.codex/config.toml. Outbound tools today; inbound A2A push needs the Python SDK tab paired in (codex's MCP runtime doesn't route arbitrary notifications/* yet)."
+                copyKey="codex"
+                copied={copiedKey === "codex"}
+                onCopy={() => copy(filledCodex, "codex")}
+              />
+            )}
+            {tab === "openclaw" && filledOpenClaw && (
+              <SnippetBlock
+                value={filledOpenClaw}
+                label="OpenClaw MCP config — wires the molecule MCP server via openclaw mcp set + starts the gateway on loopback. Outbound tools today; inbound A2A push on an external openclaw needs the Python SDK tab paired in (a sessions.steer bridge daemon is future work)."
+                copyKey="openclaw"
+                copied={copiedKey === "openclaw"}
+                onCopy={() => copy(filledOpenClaw, "openclaw")}
+              />
+            )}
+            {tab === "kimi" && filledKimi && (
+              <SnippetBlock
+                value={filledKimi}
+                label="Kimi CLI — self-contained Python bridge. Registers, heartbeats, polls for canvas messages, and echoes replies back. NAT-safe (no public URL). Run in a background terminal or via launchd."
+                copyKey="kimi"
+                copied={copiedKey === "kimi"}
+                onCopy={() => copy(filledKimi, "kimi")}
+              />
+            )}
+            {tab === "fields" && (
              <div className="space-y-2">
                <Field label="workspace_id" value={info.workspace_id} onCopy={() => copy(info.workspace_id, "wsid")} copied={copiedKey === "wsid"} />
                <Field label="platform_url" value={info.platform_url} onCopy={() => copy(info.platform_url, "url")} copied={copiedKey === "url"} />
@@ -434,7 +323,7 @@ export function ExternalConnectModal({ info, onClose }: Props) {
                <Field label="registry_endpoint" value={info.registry_endpoint} onCopy={() => copy(info.registry_endpoint, "reg")} copied={copiedKey === "reg"} />
                <Field label="heartbeat_endpoint" value={info.heartbeat_endpoint} onCopy={() => copy(info.heartbeat_endpoint, "hb")} copied={copiedKey === "hb"} />
              </div>
-            </div>
+            )}
          </div>

          <div className="mt-5 flex justify-end gap-2">
@@ -440,7 +440,6 @@ function ProviderPickerModal({
                      onChange={(e) => updateEntry(index, { value: e.target.value.trimStart() })}
                      placeholder={entry.key.includes("API_KEY") ? "sk-..." : "Enter value"}
                      type="password"
-                      aria-label={`Value for ${entry.key}`}
                      ref={index === 0 ? firstInputRef : undefined}
                      onKeyDown={(e) => {
                        if (e.key === "Enter" && entry.value.trim()) {
@@ -460,7 +459,7 @@ function ProviderPickerModal({
                )}

                {entry.error && (
-                  <div role="alert" aria-live="assertive" className="mt-1.5 text-[10px] text-bad">{entry.error}</div>
+                  <div className="mt-1.5 text-[10px] text-bad">{entry.error}</div>
                )}
              </div>
            ))}
@@ -695,7 +694,6 @@ function AllKeysModal({
                    onChange={(e) => updateEntry(index, { value: e.target.value.trimStart() })}
                    placeholder={entry.key.includes("API_KEY") ? "sk-..." : "Enter value"}
                    type="password"
-                    aria-label={`Value for ${entry.key}`}
                    autoFocus={index === 0}
                    onKeyDown={(e) => {
                      if (e.key === "Enter" && entry.value.trim()) {
@@ -720,7 +718,7 @@ function AllKeysModal({
          ))}

          {globalError && (
-            <div role="alert" aria-live="assertive" className="px-3 py-2 bg-red-950/40 border border-red-800/50 rounded-lg text-[11px] text-bad">
+            <div className="px-3 py-2 bg-red-950/40 border border-red-800/50 rounded-lg text-[11px] text-bad">
              {globalError}
            </div>
          )}
@@ -71,7 +71,7 @@ export function WorkspaceUsage({ workspaceId }: WorkspaceUsageProps) {
            <SkeletonRow />
          </>
        ) : error ? (
-          <p role="alert" aria-live="assertive" className="text-xs text-bad" data-testid="usage-error">
+          <p className="text-xs text-bad" data-testid="usage-error">
            {error}
          </p>
        ) : metrics ? (
@@ -131,9 +131,7 @@ describe("ExternalConnectModal — tab switching", () => {
  it("switches to the Python SDK tab and shows the snippet with stamped token", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /python sdk/i }));
-    // Query within the python panel so we get the right pre (not the first in DOM).
-    const pythonPanel = document.querySelector("[data-testid='panel-python']");
-    const preEl = pythonPanel?.querySelector("pre");
+    const preEl = document.querySelector("pre");
    expect(preEl?.textContent).toContain("AUTH_TOKEN");
    // The placeholder is replaced with the real auth token
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
@@ -142,9 +140,7 @@ describe("ExternalConnectModal — tab switching", () => {
  it("switches to the curl tab and shows the snippet with stamped token", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /curl/i }));
-    // Query within the curl panel so we get the right pre (not the first in DOM).
-    const curlPanel = document.querySelector("[data-testid='panel-curl']");
-    const preEl = curlPanel?.querySelector("pre");
+    const preEl = document.querySelector("pre");
    expect(preEl?.textContent).toContain("curl");
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
  });
@@ -152,11 +148,9 @@ describe("ExternalConnectModal — tab switching", () => {
  it("switches to the Fields tab and shows raw values", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /fields/i }));
-    // Query within the fields panel for specific values.
-    const fieldsPanel = document.querySelector("[data-testid='panel-fields']");
-    expect(fieldsPanel?.textContent).toContain("ws-123");
-    expect(fieldsPanel?.textContent).toContain("https://app.example.com");
-    expect(fieldsPanel?.textContent).toContain("secret-auth-token-abc");
+    expect(screen.getByText("ws-123")).toBeTruthy();
+    expect(screen.getByText("https://app.example.com")).toBeTruthy();
+    expect(screen.getByText("secret-auth-token-abc")).toBeTruthy();
  });

  it("hides the Hermes tab when hermes_channel_snippet is absent", () => {
@@ -174,8 +168,7 @@ describe("ExternalConnectModal — snippet token stamping", () => {
  it("stamps the real auth_token into the Python snippet instead of the placeholder", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /python sdk/i }));
-    const pythonPanel = document.querySelector("[data-testid='panel-python']");
-    const preEl = pythonPanel?.querySelector("pre");
+    const preEl = document.querySelector("pre");
    expect(preEl?.textContent).not.toContain("<paste from create response>");
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
  });
@@ -183,8 +176,7 @@ describe("ExternalConnectModal — snippet token stamping", () => {
  it("stamps the real auth_token into the curl snippet", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /curl/i }));
-    const curlPanel = document.querySelector("[data-testid='panel-curl']");
-    const preEl = curlPanel?.querySelector("pre");
+    const preEl = document.querySelector("pre");
    // curl template uses WORKSPACE_AUTH_TOKEN placeholder, not the generic one
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
  });
@@ -192,8 +184,7 @@ describe("ExternalConnectModal — snippet token stamping", () => {
  it("stamps the real auth_token into the Universal MCP snippet", () => {
    renderAndFlush(defaultInfo);
    // Default tab is Universal MCP
-    const mcpPanel = document.querySelector("[data-testid='panel-mcp']");
-    const preEl = mcpPanel?.querySelector("pre");
+    const preEl = document.querySelector("pre");
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
    expect(preEl?.textContent).not.toContain("<paste from create response>");
  });
@@ -202,10 +193,8 @@ describe("ExternalConnectModal — snippet token stamping", () => {
 describe("ExternalConnectModal — copy functionality", () => {
  it("calls navigator.clipboard.writeText with the snippet text", () => {
    renderAndFlush(defaultInfo);
-    // Default tab is Universal MCP — query the copy button within the mcp panel.
-    const mcpPanel = document.querySelector("[data-testid='panel-mcp']");
-    const copyBtn = mcpPanel?.querySelector("button");
-    if (copyBtn) fireEvent.click(copyBtn);
+    // Default tab is Universal MCP
+    fireEvent.click(screen.getByRole("button", { name: /^copy$/i }));
    expect(clipboardWriteText).toHaveBeenCalledWith(
      expect.stringContaining("secret-auth-token-abc"),
    );
@@ -238,8 +227,7 @@ describe("ExternalConnectModal — missing optional fields", () => {
    };
    renderAndFlush(minimalInfo);
    fireEvent.click(screen.getByRole("tab", { name: /fields/i }));
-    const fieldsPanel = document.querySelector("[data-testid='panel-fields']");
-    expect(fieldsPanel?.textContent).toContain("(missing)");
+    expect(screen.getByText("(missing)")).toBeTruthy();
  });

  it("hides the Hermes tab when hermes_channel_snippet is absent", () => {
@@ -24,12 +24,8 @@ vi.mock("@/lib/theme-provider", () => ({
  })),
 }));

-// Wrap cleanup in act() so any pending React state updates (e.g. from
-// keyDown handlers that call setTheme) flush before DOM unmount. Without
-// this, cleanup() can race against pending renders and cause INDEX_SIZE_ERR
-// when the handleKeyDown callback tries to query the DOM mid-teardown.
 afterEach(() => {
-  act(() => { cleanup(); });
+  cleanup();
  vi.clearAllMocks();
 });

@@ -150,7 +146,7 @@ describe("ThemeToggle — keyboard navigation (WCAG 2.1.1 / ARIA radiogroup)", (
    const radios = screen.getAllByRole("radio");
    // dark (index 2) is current; ArrowRight should wrap to light (index 0)
    act(() => { radios[2].focus(); });
-    act(() => { fireEvent.keyDown(radios[2], { key: "ArrowRight" }); });
+    fireEvent.keyDown(radios[2], { key: "ArrowRight" });
    expect(mockSetTheme).toHaveBeenCalledWith("light");
  });

@@ -164,7 +160,7 @@ describe("ThemeToggle — keyboard navigation (WCAG 2.1.1 / ARIA radiogroup)", (
    const radios = screen.getAllByRole("radio");
    // light (index 0) is current; ArrowLeft should go to dark (index 2)
    act(() => { radios[0].focus(); });
-    act(() => { fireEvent.keyDown(radios[0], { key: "ArrowLeft" }); });
+    fireEvent.keyDown(radios[0], { key: "ArrowLeft" });
    expect(mockSetTheme).toHaveBeenCalledWith("dark");
  });

@@ -178,7 +174,7 @@ describe("ThemeToggle — keyboard navigation (WCAG 2.1.1 / ARIA radiogroup)", (
    const radios = screen.getAllByRole("radio");
    // light (index 0) is current; ArrowDown should go to system (index 1)
    act(() => { radios[0].focus(); });
-    act(() => { fireEvent.keyDown(radios[0], { key: "ArrowDown" }); });
+    fireEvent.keyDown(radios[0], { key: "ArrowDown" });
    expect(mockSetTheme).toHaveBeenCalledWith("system");
  });

@@ -191,7 +187,7 @@ describe("ThemeToggle — keyboard navigation (WCAG 2.1.1 / ARIA radiogroup)", (
    render(<ThemeToggle />);
    const radios = screen.getAllByRole("radio");
    act(() => { radios[2].focus(); });
-    act(() => { fireEvent.keyDown(radios[2], { key: "Home" }); });
+    fireEvent.keyDown(radios[2], { key: "Home" });
    expect(mockSetTheme).toHaveBeenCalledWith("light");
  });

@@ -204,14 +200,14 @@ describe("ThemeToggle — keyboard navigation (WCAG 2.1.1 / ARIA radiogroup)", (
    render(<ThemeToggle />);
    const radios = screen.getAllByRole("radio");
    act(() => { radios[0].focus(); });
-    act(() => { fireEvent.keyDown(radios[0], { key: "End" }); });
+    fireEvent.keyDown(radios[0], { key: "End" });
    expect(mockSetTheme).toHaveBeenCalledWith("dark");
  });

  it("does nothing on unrelated keys", () => {
    render(<ThemeToggle />);
    const radios = screen.getAllByRole("radio");
-    act(() => { fireEvent.keyDown(radios[0], { key: "Enter" }); });
+    fireEvent.keyDown(radios[0], { key: "Enter" });
    expect(mockSetTheme).not.toHaveBeenCalled();
  });
 });
@@ -223,7 +223,6 @@ export function MobileCanvas({
            textTransform: "uppercase",
            fontWeight: 600,
          }}
-          className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
        >
          Reset
        </button>
@@ -2,11 +2,8 @@

 // 04 · Chat — message thread + composer + sub-tabs.
 // Wired to the same /workspaces/:id/a2a (method message/send) endpoint
-// that the desktop ChatTab uses. Render parity with desktop ChatTab is
-// achieved by reusing its renderers rather than forking a reduced
-// mobile path: the Agent Comms sub-tab mounts the same AgentCommsPanel,
-// and message attachments route through the same AttachmentPreview
-// dispatch the desktop My-Chat bubble uses (#231/#232).
+// that the desktop ChatTab uses, but with a slimmer surface: no
+// attachments, no A2A topology overlay, no conversation tracing.

 import { useEffect, useMemo, useRef, useState } from "react";
 import ReactMarkdown from "react-markdown";
@@ -19,9 +16,6 @@ import {
  useChatSend,
  useChatSocket,
 } from "@/components/tabs/chat/hooks";
-import { AgentCommsPanel } from "@/components/tabs/chat/AgentCommsPanel";
-import { AttachmentPreview } from "@/components/tabs/chat/AttachmentPreview";
-import { downloadChatFile } from "@/components/tabs/chat/uploads";

 import { toMobileAgent } from "./components";
 import { MOBILE_FONT_MONO, MOBILE_FONT_SANS, usePalette } from "./palette";
@@ -310,17 +304,6 @@ export function MobileChat({
  const removePendingFile = (index: number) =>
    setPendingFiles((prev) => prev.filter((_, i) => i !== index));

-  // Route attachment downloads through the same authenticated helper
-  // the desktop ChatTab uses (downloadChatFile) so platform-scheme
-  // URIs get a real Blob with auth headers instead of about:blank.
-  const downloadAttachment = (att: ChatAttachment) => {
-    downloadChatFile(agentId, att).catch(() => {
-      // AttachmentPreview's own error affordance covers the in-bubble
-      // failure state; matches ChatTab's behaviour of not double-
-      // reporting a download failure.
-    });
-  };
-
  const send = async () => {
    const text = draft.trim();
    if ((!text && pendingFiles.length === 0) || sending || !reachable) return;
@@ -356,7 +339,6 @@ export function MobileChat({
            type="button"
            onClick={onBack}
            aria-label="Back"
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 36,
              height: 36,
@@ -403,7 +385,6 @@ export function MobileChat({
          <button
            type="button"
            aria-label="More"
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 36,
              height: 36,
@@ -434,7 +415,6 @@ export function MobileChat({
                key={t.id}
                type="button"
                onClick={() => setTab(t.id)}
-                className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                style={{
                  padding: "4px 0 8px",
                  border: "none",
@@ -453,19 +433,7 @@ export function MobileChat({
        </div>
      </div>

-      {/* Agent Comms — reuse the desktop AgentCommsPanel verbatim so
-          mobile renders the identical peer/A2A + delegation feed
-          (history GET + live socket events) instead of a placeholder
-          (#231). The panel owns its own scroll/load/error/empty
-          states, matching ChatTab's agent-comms tabpanel. */}
-      {tab === "a2a" && (
-        <div style={{ flex: 1, minHeight: 0, overflow: "hidden" }}>
-          <AgentCommsPanel workspaceId={agentId} />
-        </div>
-      )}
-
      {/* Messages */}
-      {tab === "my" && (
      <div
        ref={scrollRef}
        style={{
@@ -477,8 +445,20 @@ export function MobileChat({
          gap: 8,
        }}
      >
+        {tab === "a2a" && (
+          <div
+            style={{
+              padding: "20px 4px",
+              textAlign: "center",
+              color: p.text3,
+              fontSize: 13,
+            }}
+          >
+            Agent Comms — peer-to-peer A2A traffic surfaces in the Comms tab.
+          </div>
+        )}
        {tab === "my" && historyLoading && (
-          <div role="status" aria-live="polite" style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
+          <div style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            Loading chat history…
          </div>
        )}
@@ -498,8 +478,6 @@ export function MobileChat({
              onClick={() => {
                loadInitial();
              }}
-              aria-label="Retry loading chat history"
-              className="focus:outline-none focus-visible:ring-2 focus-visible:ring-red-400"
              style={{
                padding: "6px 14px",
                borderRadius: 14,
@@ -515,7 +493,7 @@ export function MobileChat({
          </div>
        )}
        {tab === "my" && !historyLoading && !historyError && messages.length === 0 && (
-          <div role="status" aria-live="polite" style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
+          <div style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            Send a message to start chatting.
          </div>
        )}
@@ -543,31 +521,9 @@ export function MobileChat({
                    overflowWrap: "anywhere",
                  }}
                >
-                  {m.content && (
-                    <MarkdownBubble dark={dark} accent={p.accent}>
-                      {m.content}
-                    </MarkdownBubble>
-                  )}
-                  {m.attachments && m.attachments.length > 0 && (
-                    <div
-                      style={{
-                        display: "flex",
-                        flexWrap: "wrap",
-                        gap: 4,
-                        marginTop: m.content ? 6 : 0,
-                      }}
-                    >
-                      {m.attachments.map((att, i) => (
-                        <AttachmentPreview
-                          key={`${m.id}-${i}`}
-                          workspaceId={agentId}
-                          attachment={att}
-                          onDownload={downloadAttachment}
-                          tone={mine ? "user" : "agent"}
-                        />
-                      ))}
-                    </div>
-                  )}
+                  <MarkdownBubble dark={dark} accent={p.accent}>
+                    {m.content}
+                  </MarkdownBubble>
                  <div
                    style={{
                      fontSize: 10,
@@ -598,13 +554,7 @@ export function MobileChat({
          </div>
        )}
      </div>
-      )}

-      {/* Footer ID + composer belong to My Chat only. The Agent Comms
-          tab is a read-only peer/A2A feed (parity with desktop
-          ChatTab, where the agent-comms tabpanel has no composer). */}
-      {tab === "my" && (
-      <>
      {/* Footer ID */}
      <div
        style={{
@@ -669,7 +619,6 @@ export function MobileChat({
                  type="button"
                  onClick={() => removePendingFile(i)}
                  aria-label={`Remove ${f.name}`}
-                  className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                  style={{
                    border: "none",
                    background: "transparent",
@@ -710,7 +659,6 @@ export function MobileChat({
            onClick={() => fileInputRef.current?.click()}
            disabled={!reachable || sending || uploading}
            aria-label="Attach"
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 32,
              height: 32,
@@ -732,7 +680,6 @@ export function MobileChat({
            ref={composerRef}
            value={draft}
            onChange={(e) => setDraft(e.target.value)}
-            aria-label="Message"
            onKeyDown={(e) => {
              // Enter sends; Shift+Enter inserts a newline. Skip when the
              // IME is composing — pressing Enter to commit a Chinese/
@@ -756,12 +703,7 @@ export function MobileChat({
              border: "none",
              outline: "none",
              background: "transparent",
-              // iOS Safari/PWA zooms the viewport when a focused textarea
-              // has a computed font-size below 16px. 14.5 triggers that
-              // focus-zoom; the page looks broken until the user pinches
-              // back (#224, same class as desktop #1434 / sibling #225).
-              // 16px is the minimum that keeps focus from zooming.
-              fontSize: 16,
+              fontSize: 14.5,
              lineHeight: 1.4,
              color: p.text,
              padding: "6px 0",
@@ -777,13 +719,12 @@ export function MobileChat({
            onClick={send}
            disabled={(!draft.trim() && pendingFiles.length === 0) || !reachable || sending || uploading}
            aria-label="Send"
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 36,
              height: 36,
              borderRadius: 999,
              border: "none",
-              cursor: (draft.trim() || pendingFiles.length === 0) && !sending && !uploading ? "pointer" : "not-allowed",
+              cursor: (draft.trim() || pendingFiles.length > 0) && !sending && !uploading ? "pointer" : "not-allowed",
              flexShrink: 0,
              background:
                (draft.trim() || pendingFiles.length > 0) && reachable && !sending && !uploading
@@ -805,8 +746,6 @@ export function MobileChat({
          </button>
        </div>
      </div>
-      </>
-      )}
    </div>
  );
 }
@@ -231,7 +231,6 @@ export function MobileComms({ dark }: { dark: boolean }) {
                fontSize: 13,
                fontWeight: 500,
              }}
-              className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            >
              {o.label}
              <span
@@ -252,11 +251,11 @@ export function MobileComms({ dark }: { dark: boolean }) {

      <div style={{ padding: "0 14px", display: "flex", flexDirection: "column", gap: 8 }}>
        {loading && items.length === 0 ? (
-          <div role="status" aria-live="polite" style={{ padding: "30px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
+          <div style={{ padding: "30px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            Loading recent comms…
          </div>
        ) : filtered.length === 0 ? (
-          <div role="status" aria-live="polite" style={{ padding: "30px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
+          <div style={{ padding: "30px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            No A2A traffic yet.
          </div>
        ) : (
@@ -83,12 +83,11 @@ export function MobileDetail({
            type="button"
            onClick={onBack}
            aria-label="Back"
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={iconButtonStyle(p, dark)}
          >
            {Icons.back({ size: 18 })}
          </button>
-          <button type="button" aria-label="More" className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900" style={iconButtonStyle(p, dark)}>
+          <button type="button" aria-label="More" style={iconButtonStyle(p, dark)}>
            {Icons.more({ size: 18 })}
          </button>
        </div>
@@ -184,7 +183,6 @@ export function MobileDetail({
              key={t.id}
              type="button"
              onClick={() => setTab(t.id)}
-              className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
              style={{
                padding: "8px 14px",
                borderRadius: 999,
@@ -217,7 +215,6 @@ export function MobileDetail({
          type="button"
          onClick={onChat}
          data-testid="mobile-chat-cta"
-          className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
          style={{
            width: "100%",
            height: 52,
@@ -419,8 +416,6 @@ function DetailActivity({ workspaceId, dark }: { workspaceId: string; dark: bool
  if (items === null) {
    return (
      <div
-        role="status"
-        aria-live="polite"
        style={{
          background: p.surface,
          borderRadius: 16,
@@ -200,7 +200,6 @@ export function MobileHome({
          justifyContent: "center",
          boxShadow: "0 8px 24px rgba(40,30,20,0.25), 0 2px 6px rgba(40,30,20,0.15)",
        }}
-        className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
      >
        {Icons.plus({ size: 22 })}
      </button>
@@ -92,7 +92,6 @@ export function MobileMe({
                    border: on ? `2px solid ${p.text}` : "2px solid transparent",
                    boxShadow: on ? `0 0 0 2px ${p.bg} inset` : "none",
                  }}
-                  className="focus:outline-none focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                />
              );
            })}
@@ -185,7 +184,6 @@ function SegmentedRow({
              fontSize: 13,
              fontWeight: 600,
            }}
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
          >
            {o.label}
          </button>
@@ -12,7 +12,6 @@ import { useEffect, useState } from "react";

 import { api } from "@/lib/api";
 import { type Template } from "@/lib/deploy-preflight";
-import { isSaaSTenant } from "@/lib/tenant";

 import { tierCode } from "./palette";
 import { MOBILE_FONT_MONO, MOBILE_FONT_SANS, type MobilePalette, usePalette } from "./palette";
@@ -27,7 +26,6 @@ const TIER_LABEL: Record<"T1" | "T2" | "T3" | "T4", string> = {

 export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => void }) {
  const p = usePalette(dark);
-  const isSaaS = isSaaSTenant();
  const [templates, setTemplates] = useState<Template[]>([]);
  const [loadingTemplates, setLoadingTemplates] = useState(true);
  const [tplId, setTplId] = useState<string | null>(null);
@@ -45,7 +43,7 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
        setTemplates(list);
        if (list.length > 0) {
          setTplId(list[0].id);
-          setTier(isSaaS ? "T4" : tierCode(list[0].tier));
+          setTier(tierCode(list[0].tier));
        }
      })
      .catch(() => {
@@ -57,7 +55,7 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
    return () => {
      cancelled = true;
    };
-  }, [isSaaS]);
+  }, []);

  const handleSpawn = async () => {
    if (busy || !tplId) return;
@@ -69,7 +67,7 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
      await api.post<{ id: string }>("/workspaces", {
        name: (name.trim() || chosen.name),
        template: chosen.id,
-        tier: isSaaS ? 4 : Number(tier.slice(1)),
+        tier: Number(tier.slice(1)),
        canvas: {
          x: Math.random() * 400 + 100,
          y: Math.random() * 300 + 100,
@@ -148,7 +146,6 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
            type="button"
            onClick={onClose}
            aria-label="Close"
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 32,
              height: 32,
@@ -171,8 +168,6 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
        <div style={{ padding: "0 14px" }}>
          {loadingTemplates ? (
            <div
-              role="status"
-              aria-live="polite"
              style={{
                padding: "24px 8px",
                textAlign: "center",
@@ -208,7 +203,7 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
            >
              {templates.map((t) => {
                const on = tplId === t.id;
-                const tCode = isSaaS ? "T4" : tierCode(t.tier);
+                const tCode = tierCode(t.tier);
                return (
                  <button
                    key={t.id}
@@ -217,8 +212,6 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
                      setTplId(t.id);
                      setTier(tCode);
                    }}
-                    aria-label={`Select template: ${t.name} (tier ${t.tier})`}
-                    className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                    style={{
                      background: on
                        ? dark
@@ -307,7 +300,6 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
          <input
            value={name}
            onChange={(e) => setName(e.target.value)}
-            aria-label="Agent name"
            placeholder={tplId
              ? (templates.find((t) => t.id === tplId)?.name ?? "agent-name")
              : "agent-name"}
@@ -318,12 +310,7 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
              border: `0.5px solid ${p.border}`,
              borderRadius: 12,
              fontFamily: MOBILE_FONT_MONO,
-              // iOS Safari/PWA zooms the viewport when a focused input has
-              // a computed font-size below 16px; the layout jumps and the
-              // page looks broken until the user pinches back (#224 / #225,
-              // same class as desktop #1434). 16px is the minimum that
-              // suppresses that focus-zoom.
-              fontSize: 16,
+              fontSize: 13.5,
              color: p.text,
              outline: "none",
              boxSizing: "border-box",
@@ -341,8 +328,6 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
                key={t}
                type="button"
                onClick={() => setTier(t)}
-                aria-label={`Select tier ${t}: ${TIER_LABEL[t]}`}
-                className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                style={{
                  flex: 1,
                  padding: "10px 8px",
@@ -390,8 +375,6 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
            type="button"
            onClick={handleSpawn}
            disabled={busy || !tplId || templates.length === 0}
-            aria-label="Spawn agent"
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: "100%",
              height: 52,
@@ -21,14 +21,6 @@ import { MobileChat } from "../MobileChat";
 vi.mock("@/lib/api");
 import { api } from "@/lib/api";

-// AgentCommsPanel (mounted by the Agent Comms sub-tab, #231) subscribes
-// to the global socket via useSocketEvent. Stub it to a no-op so the
-// panel mounts without the real ReconnectingSocket — the parity tests
-// only assert the panel renders (vs the old static placeholder).
-vi.mock("@/hooks/useSocketEvent", () => ({
-  useSocketEvent: vi.fn(),
-}));
-
 // ─── Mock store ───────────────────────────────────────────────────────────────

 const mockAgentId = "ws-chat-test";
@@ -163,12 +155,6 @@ beforeEach(() => {
  mockOnBack.mockClear();
  mockStoreState.nodes = [];
  mockStoreState.agentMessages = {};
-  // jsdom doesn't implement scrollIntoView. The Agent Comms tab now
-  // mounts AgentCommsPanel (#231), which scrolls its feed to bottom on
-  // arrival; a no-op stub keeps the panel from throwing under jsdom
-  // (same stub AgentCommsPanel's own render test installs).
-  Element.prototype.scrollIntoView =
-    vi.fn() as unknown as Element["scrollIntoView"];
  // Set up spies on the real api methods. Tests override these per-call.
  const getSpy = vi.spyOn(api, "get");
  const postSpy = vi.spyOn(api, "post");
@@ -263,20 +249,6 @@ describe("MobileChat — composer", () => {
    const sendBtn = container.querySelector('[aria-label="Send"]') as HTMLButtonElement;
    expect(sendBtn.disabled).toBe(true);
  });
-
-  // Regression #224: the composer textarea must render with font-size
-  // ≥ 16px. iOS Safari and PWAs auto-zoom the viewport when a focused
-  // input has a computed font-size below 16px — the layout jumps and
-  // the page looks broken until the user pinches back. Same class as
-  // desktop #1434 / sibling MobileSpawn #225.
-  it("composer textarea renders at font-size 16px or greater (iOS focus-zoom regression #224)", () => {
-    const { container } = renderChat(mockAgentId);
-    const textarea = container.querySelector("textarea") as HTMLTextAreaElement;
-    expect(textarea).toBeTruthy();
-    const fs = Number.parseFloat(textarea.style.fontSize);
-    expect(Number.isFinite(fs)).toBe(true);
-    expect(fs).toBeGreaterThanOrEqual(16);
-  });
 });

 // ─── Tabs ─────────────────────────────────────────────────────────────────────
@@ -502,146 +474,3 @@ describe("MobileChat — chat history", () => {
    expect(getSpy).toHaveBeenCalledTimes(2);
  });
 });
-
-// ─── #232 · Attachment render parity with desktop ChatTab ────────────────────
-//
-// Regression for the CTO-reported mobile bug: MobileChat used to render
-// only m.content (no attachment surface), so files sent/received in a
-// conversation were invisible on mobile while desktop showed them. The
-// fix routes m.attachments through the same AttachmentPreview the
-// desktop ChatTab bubble uses.
-
-describe("MobileChat — attachment render parity (#232)", () => {
-  beforeEach(() => {
-    mockStoreState.nodes = [onlineNode];
-  });
-
-  it("renders an attachment from a history message via AttachmentPreview", async () => {
-    const getSpy = vi.spyOn(api, "get");
-    // useChatHistory reads { messages, reached_end }.
-    getSpy.mockResolvedValueOnce({
-      messages: [
-        {
-          id: "m-att-1",
-          role: "agent",
-          content: "Here is the report",
-          attachments: [
-            {
-              name: "report.csv",
-              uri: "workspace://out/report.csv",
-              mimeType: "text/csv",
-              size: 2048,
-            },
-          ],
-          timestamp: new Date().toISOString(),
-        },
-      ],
-      reached_end: true,
-    });
-
-    let rr: ReturnType<typeof renderChat>;
-    await act(async () => {
-      rr = renderChat(mockAgentId);
-    });
-    const { container } = rr!;
-
-    // A non-image attachment renders the AttachmentChip download button
-    // with title="Download <name>" — same component the desktop bubble
-    // dispatches through AttachmentPreview.
-    await waitFor(() => {
-      const chip = container.querySelector('[title="Download report.csv"]');
-      expect(chip).toBeTruthy();
-    });
-    expect(container.textContent ?? "").toContain("report.csv");
-  });
-});
-
-// ─── #231 · Agent Comms (A2A/peer) render parity with desktop ChatTab ────────
-//
-// Regression for the CTO-reported mobile bug: the Agent Comms sub-tab
-// rendered a static placeholder string ("peer-to-peer A2A traffic
-// surfaces in the Comms tab") instead of the real feed. The fix mounts
-// the same AgentCommsPanel the desktop ChatTab agent-comms tabpanel
-// uses, so peer/A2A + delegation activity is visible on mobile.
-
-describe("MobileChat — Agent Comms render parity (#231)", () => {
-  beforeEach(() => {
-    mockStoreState.nodes = [onlineNode];
-  });
-
-  it("mounts AgentCommsPanel on the Agent Comms tab (not the old placeholder)", async () => {
-    const getSpy = vi.spyOn(api, "get");
-    // 1st GET: useChatHistory (My Chat) on mount.
-    getSpy.mockResolvedValueOnce({ messages: [], reached_end: true });
-    // 2nd GET: AgentCommsPanel's activity load when the tab is shown.
-    // Empty list → panel renders its own empty state, which still
-    // proves AgentCommsPanel mounted (vs. the removed placeholder).
-    getSpy.mockResolvedValueOnce([]);
-
-    let rr: ReturnType<typeof renderChat>;
-    await act(async () => {
-      rr = renderChat(mockAgentId);
-    });
-    const { container } = rr!;
-
-    const commsTab = Array.from(container.querySelectorAll("button")).find(
-      (b) => b.textContent?.trim() === "Agent Comms",
-    );
-    expect(commsTab).toBeTruthy();
-    await act(async () => {
-      commsTab!.click();
-    });
-
-    await waitFor(() => {
-      const text = container.textContent ?? "";
-      // The panel's empty state — proves AgentCommsPanel mounted.
-      expect(text).toContain("No agent-to-agent communications yet.");
-    });
-    // The old hard-coded placeholder must be gone.
-    expect(container.textContent ?? "").not.toContain(
-      "peer-to-peer A2A traffic surfaces in the Comms tab",
-    );
-    // The panel hit its activity endpoint.
-    expect(getSpy).toHaveBeenCalledWith(
-      expect.stringContaining(`/workspaces/${mockAgentId}/activity`),
-    );
-  });
-
-  it("renders a peer message on the Agent Comms tab", async () => {
-    const getSpy = vi.spyOn(api, "get");
-    getSpy.mockResolvedValueOnce({ messages: [], reached_end: true });
-    // a2a_receive from a peer → AgentCommsPanel.toCommMessage maps it
-    // to an inbound bubble with the request text.
-    getSpy.mockResolvedValueOnce([
-      {
-        id: "act-1",
-        activity_type: "a2a_receive",
-        source_id: "peer-ws-uuid",
-        target_id: mockAgentId,
-        method: "message/send",
-        summary: "peer asked something",
-        request_body: { task: "Please review PR 42" },
-        response_body: null,
-        status: "ok",
-        created_at: new Date().toISOString(),
-      },
-    ]);
-
-    let rr: ReturnType<typeof renderChat>;
-    await act(async () => {
-      rr = renderChat(mockAgentId);
-    });
-    const { container } = rr!;
-
-    const commsTab = Array.from(container.querySelectorAll("button")).find(
-      (b) => b.textContent?.trim() === "Agent Comms",
-    );
-    await act(async () => {
-      commsTab!.click();
-    });
-
-    await waitFor(() => {
-      expect(container.textContent ?? "").toContain("Please review PR 42");
-    });
-  });
-});
@@ -93,24 +93,6 @@ describe("MobileSpawn — render", () => {
    expect(input).toBeTruthy();
  });

-  // Regression #224 / #225: the agent-name input must render with a
-  // font-size ≥ 16px. iOS Safari and PWAs auto-zoom the viewport when a
-  // focused input has a computed font-size below 16px — the layout
-  // jumps and the page looks broken until the user pinches back.
-  it("renders the name input at font-size 16px or greater (iOS focus-zoom regression)", () => {
-    apiGetSpy.mockResolvedValue(mockTemplates);
-    render(<MobileSpawn dark={true} onClose={vi.fn()} />);
-    const input = document.querySelector(
-      'input[aria-label="Agent name"]',
-    ) as HTMLInputElement | null;
-    expect(input).toBeTruthy();
-    // Parse the inline style font-size — jsdom doesn't run a layout
-    // engine, so getComputedStyle reports the inline value verbatim.
-    const fs = Number.parseFloat(input!.style.fontSize);
-    expect(Number.isFinite(fs)).toBe(true);
-    expect(fs).toBeGreaterThanOrEqual(16);
-  });
-
  it("renders all 4 tier buttons", () => {
    apiGetSpy.mockResolvedValue(mockTemplates);
    render(<MobileSpawn dark={true} onClose={vi.fn()} />);
@@ -133,7 +133,6 @@ export function TabBar({
            aria-label={t.label}
            onClick={() => onChange(t.id)}
            onKeyDown={(e) => handleKeyDown(e, idx)}
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              background: "none",
              border: "none",
@@ -292,7 +291,6 @@ export function AgentCard({
      data-testid="workspace-card"
      aria-label={`${agent.name}, status: ${agent.status}, tier ${agent.tier}${agent.remote ? ", remote" : ""}`}
      onClick={onClick}
-      className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
      style={{
        display: "block",
        width: "100%",
@@ -446,7 +444,6 @@ export function FilterChips({
            type="button"
            aria-checked={on}
            onClick={() => onChange(o.id)}
-            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              display: "inline-flex",
              alignItems: "center",
@@ -160,14 +160,14 @@ export function OrgTokensTab() {
            </code>
            <button
              onClick={handleCopy}
-              className="shrink-0 px-2 py-1.5 bg-emerald-800/40 hover:bg-emerald-700/50 border border-emerald-700/40 rounded text-[10px] text-good transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+              className="shrink-0 px-2 py-1.5 bg-emerald-800/40 hover:bg-emerald-700/50 border border-emerald-700/40 rounded text-[10px] text-good transition-colors"
            >
              {copied ? 'Copied' : 'Copy'}
            </button>
          </div>
          <button
            onClick={() => setNewToken(null)}
-            className="text-[9px] text-good/60 hover:text-good transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            className="text-[9px] text-good/60 hover:text-good transition-colors"
          >
            Dismiss
          </button>
@@ -219,7 +219,7 @@ export function OrgTokensTab() {
              </div>
              <button
                onClick={() => setRevokeTarget(t)}
-                className="text-[10px] text-bad/70 hover:text-bad transition-colors px-2 py-1 shrink-0 focus:outline-none focus-visible:ring-2 focus-visible:ring-red-400 focus-visible:ring-offset-1"
+                className="text-[10px] text-bad/70 hover:text-bad transition-colors px-2 py-1 shrink-0"
              >
                Revoke
              </button>
@@ -140,14 +140,14 @@ function WorkspaceTokensTab({ workspaceId }: TokensTabProps) {
            </code>
            <button
              onClick={handleCopy}
-              className="shrink-0 px-2 py-1.5 bg-emerald-800/40 hover:bg-emerald-700/50 border border-emerald-700/40 rounded text-[10px] text-good transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+              className="shrink-0 px-2 py-1.5 bg-emerald-800/40 hover:bg-emerald-700/50 border border-emerald-700/40 rounded text-[10px] text-good transition-colors"
            >
              {copied ? 'Copied' : 'Copy'}
            </button>
          </div>
          <button
            onClick={() => setNewToken(null)}
-            className="text-[9px] text-good/60 hover:text-good transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            className="text-[9px] text-good/60 hover:text-good transition-colors"
          >
            Dismiss
          </button>
@@ -192,7 +192,7 @@ function WorkspaceTokensTab({ workspaceId }: TokensTabProps) {
              </div>
              <button
                onClick={() => setRevokeTarget(t)}
-                className="text-[10px] text-bad/70 hover:text-bad transition-colors px-2 py-1 focus:outline-none focus-visible:ring-2 focus-visible:ring-red-400 focus-visible:ring-offset-1"
+                className="text-[10px] text-bad/70 hover:text-bad transition-colors px-2 py-1"
              >
                Revoke
              </button>
@@ -185,7 +185,7 @@ export function ActivityTab({ workspaceId }: Props) {
      {/* Activity list */}
      <div className="flex-1 overflow-y-auto p-3 space-y-1.5">
        {loading && activities.length === 0 && (
-          <div role="status" aria-live="polite" className="text-xs text-ink-mid text-center py-8">Loading activity...</div>
+          <div className="text-xs text-ink-mid text-center py-8">Loading activity...</div>
        )}

        {error && (
@@ -262,7 +262,7 @@ export function ChannelsTab({ workspaceId }: Props) {
      </div>

      {error && (
-        <div role="alert" aria-live="assertive" className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+        <div className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
          {error}
        </div>
      )}
@@ -10,7 +10,6 @@ import { downloadChatFile, isPlatformAttachment } from "./chat/uploads";
 import { PendingAttachmentPill } from "./chat/AttachmentViews";
 import { AttachmentPreview } from "./chat/AttachmentPreview";
 import { AgentCommsPanel } from "./chat/AgentCommsPanel";
-import { ChatErrorBanner } from "./chat/ChatErrorBanner";
 import { appendActivityLine } from "./chat/activityLog";
 import { runtimeDisplayName } from "@/lib/runtime-names";
 import { ConfirmDialog } from "@/components/ConfirmDialog";
@@ -593,19 +592,22 @@ function MyChatPanel({ workspaceId, data }: Props) {
        <div ref={bottomRef} />
      </div>

-      {/* Error banner — internal#212: surfaces the secret-safe
-          actionable failure reason that ws-server places on
-          ACTIVITY_LOGGED.error_detail (propagated via
-          useChatSocket → onSendError → setError) and offers a
-          "View activity log" affordance that navigates the user to
-          the Activity tab where the full row lives. The previous
-          inline JSX hardcoded "see workspace logs for details" with
-          no link — there is no separate Logs tab. */}
-      <ChatErrorBanner
-        message={displayError}
-        isOnline={isOnline}
-        onRestart={() => setConfirmRestart(true)}
-      />
+      {/* Error banner */}
+      {displayError && (
+        <div className="px-3 py-2 bg-red-900/20 border-t border-red-800/30">
+          <div className="flex items-center justify-between">
+            <span className="text-[10px] text-red-300">{displayError}</span>
+            {!isOnline && (
+              <button
+                onClick={() => setConfirmRestart(true)}
+                className="text-[11px] px-2 py-0.5 bg-red-800 text-red-200 rounded hover:bg-red-700"
+              >
+                Restart
+              </button>
+            )}
+          </div>
+        </div>
+      )}

      {/* Input */}
      <div className="p-3 border-t border-line">
@@ -81,7 +81,7 @@ function AgentCardSection({ workspaceId }: { workspaceId: string }) {
            spellCheck={false} rows={12}
            className="w-full bg-surface-card border border-line rounded p-2 text-[10px] font-mono text-ink focus:outline-none focus:border-accent resize-none"
          />
-          {error && <div role="alert" aria-live="assertive" className="px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">{error}</div>}
+          {error && <div className="px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">{error}</div>}
          <div className="flex gap-2">
            <button type="button" onClick={handleSave} disabled={saving}
              className="px-2 py-1 bg-accent hover:bg-accent-strong text-[10px] rounded text-white disabled:opacity-50 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-surface">
@@ -109,130 +109,6 @@ function AgentCardSection({ workspaceId }: { workspaceId: string }) {
  );
 }

-// --- Agent Abilities Section ---
-//
-// Always-visible on/off controls for the two workspace-level ability flags
-// (broadcast_enabled, talk_to_user_enabled). Both are mutated through the
-// same admin endpoint the ChatTab recovery banner already uses
-// (PATCH /workspaces/:id/abilities) and reflected into the canvas store node
-// data (broadcastEnabled / talkToUserEnabled) so every surface that reads
-// useCanvasStore.nodes stays consistent without a full re-hydrate.
-//
-// Before this section there was NO canvas control for either flag: the
-// backend was fully wired (workspace_abilities.go / workspace_broadcast.go /
-// agent_message_writer.go, see commit 29b4bffb + internal#510/#511) but the
-// only frontend affordance was the ChatTab recovery banner, which renders
-// solely when talk_to_user_enabled===false and so is invisible under the
-// TRUE default and never existed at all for broadcast.
-function AgentAbilitiesSection({ workspaceId }: { workspaceId: string }) {
-  // Read the live ability flags off the canvas store node — the platform
-  // event stream hydrates these (canvas-topology.ts maps the workspace row's
-  // broadcast_enabled/talk_to_user_enabled onto node data), so this stays in
-  // sync with the recovery banner and avoids a duplicate GET. Mirrors the
-  // store-read pattern used by AgentCardSection above.
-  const node = useCanvasStore((s) =>
-    s.nodes?.find?.((n) => n.id === workspaceId),
-  );
-  // Defaults match the backend column defaults + canvas-topology mapping:
-  // broadcast_enabled defaults FALSE, talk_to_user_enabled defaults TRUE.
-  const broadcastEnabled = node?.data.broadcastEnabled ?? false;
-  const talkToUserEnabled = node?.data.talkToUserEnabled ?? true;
-
-  // Track an in-flight PATCH per field so a double-click can't fire two
-  // racing writes, and surface a one-line error if the server rejects.
-  const [pending, setPending] = useState<null | "broadcast" | "talk">(null);
-  const [error, setError] = useState<string | null>(null);
-
-  const patchAbility = async (
-    which: "broadcast" | "talk",
-    body: { broadcast_enabled: boolean } | { talk_to_user_enabled: boolean },
-    optimistic: Partial<{ broadcastEnabled: boolean; talkToUserEnabled: boolean }>,
-  ) => {
-    setError(null);
-    setPending(which);
-    // Optimistic store update — the toggle flips immediately; on failure we
-    // roll back to the server-truth value the store last held.
-    const prev = {
-      broadcastEnabled,
-      talkToUserEnabled,
-    };
-    useCanvasStore.getState().updateNodeData(workspaceId, optimistic);
-    try {
-      await api.patch(`/workspaces/${workspaceId}/abilities`, body);
-    } catch (e) {
-      // Roll back the optimistic change to last-known server truth.
-      useCanvasStore.getState().updateNodeData(workspaceId, {
-        broadcastEnabled: prev.broadcastEnabled,
-        talkToUserEnabled: prev.talkToUserEnabled,
-      });
-      setError(
-        e instanceof Error ? e.message : "Failed to update ability — try again",
-      );
-    } finally {
-      setPending(null);
-    }
-  };
-
-  return (
-    <Section title="Agent Abilities">
-      <p className="text-[10px] text-ink-mid px-1 pb-1">
-        Workspace-level permissions for this agent. Changes apply immediately
-        (no restart required).
-      </p>
-      <div className="space-y-2">
-        <div>
-          <Toggle
-            label="Talk to user"
-            checked={talkToUserEnabled}
-            onChange={(v) =>
-              pending
-                ? undefined
-                : patchAbility(
-                    "talk",
-                    { talk_to_user_enabled: v },
-                    { talkToUserEnabled: v },
-                  )
-            }
-          />
-          <p className="text-[10px] text-ink-mid mt-0.5 ml-6">
-            When off, the agent&apos;s <code className="font-mono">send_message_to_user</code>{" "}
-            and <code className="font-mono">POST /notify</code> calls are
-            rejected (403) — it must route updates through a parent workspace.
-          </p>
-        </div>
-        <div>
-          <Toggle
-            label="Broadcast to peers"
-            checked={broadcastEnabled}
-            onChange={(v) =>
-              pending
-                ? undefined
-                : patchAbility(
-                    "broadcast",
-                    { broadcast_enabled: v },
-                    { broadcastEnabled: v },
-                  )
-            }
-          />
-          <p className="text-[10px] text-ink-mid mt-0.5 ml-6">
-            When on, the agent may <code className="font-mono">POST /broadcast</code>{" "}
-            to message all non-removed agent workspaces in the org. Off by
-            default — only privileged orchestrators should hold this.
-          </p>
-        </div>
-      </div>
-      {pending && (
-        <div className="mt-2 text-[10px] text-ink-mid">Saving…</div>
-      )}
-      {error && (
-        <div role="alert" aria-live="assertive" className="mt-2 px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">
-          {error}
-        </div>
-      )}
-    </Section>
-  );
-}
-
 // --- Main ConfigTab ---

 interface ModelSpec {
@@ -919,7 +795,6 @@ export function ConfigTab({ workspaceId }: Props) {
                  <label className="text-[10px] text-ink-mid block mb-1">Model</label>
                  <input
                    type="text"
-                    aria-label="Model"
                    value={currentModelId}
                    onChange={(e) => {
                      const v = e.target.value;
@@ -1010,8 +885,6 @@ export function ConfigTab({ workspaceId }: Props) {
            )}
          </Section>

-          <AgentAbilitiesSection workspaceId={workspaceId} />
-
          {/* Claude Settings — shown for claude-code runtime or claude/anthropic model names */}
          {(config.runtime === "claude-code" ||
            (config.runtime_config?.model || config.model || "").toLowerCase().includes("claude") ||
@@ -1122,7 +995,7 @@ export function ConfigTab({ workspaceId }: Props) {
      )}

      {error && (
-        <div role="alert" aria-live="assertive" className="mx-3 mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">{error}</div>
+        <div className="mx-3 mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">{error}</div>
      )}
      {!error && RUNTIMES_WITH_OWN_CONFIG.has(config.runtime || "") && (
        <div className="mx-3 mb-2 px-3 py-1.5 bg-surface-sunken/50 border border-line rounded text-xs text-ink-mid">
@@ -157,7 +157,7 @@ export function DetailsTab({ workspaceId, data }: Props) {
              </select>
            </Field>
            {saveError && (
-              <div role="alert" aria-live="assertive" className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+              <div className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
                {saveError}
              </div>
            )}
@@ -203,7 +203,7 @@ export function DetailsTab({ workspaceId, data }: Props) {
            {isRestartable && (
              <div className="pt-2">
                {restartError && (
-                  <div role="alert" aria-live="assertive" className="mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+                  <div className="mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
                    {restartError}
                  </div>
                )}
@@ -307,7 +307,7 @@ export function DetailsTab({ workspaceId, data }: Props) {
      {/* Delete */}
      <Section title="Danger Zone">
        {deleteError && (
-          <div role="alert" aria-live="assertive" className="mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+          <div className="mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
            {deleteError}
          </div>
        )}
@@ -82,7 +82,7 @@ export function EventsTab({ workspaceId }: Props) {
      </div>

      {error && (
-        <div role="alert" aria-live="assertive" className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+        <div className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
          {error}
        </div>
      )}
@@ -102,7 +102,7 @@ export function ExternalConnectionSection({ workspaceId }: Props) {
      </div>

      {error && (
-        <div role="alert" aria-live="assertive" className="mt-2 px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">
+        <div className="mt-2 px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">
          {error}
        </div>
      )}
@@ -266,7 +266,7 @@ function PlatformOwnedFilesTab({
        // immediately. Delete-All hovers DARKER (bg-red-700) — same AA
        // contrast trap that bit ConfirmDialog/ApprovalBanner. Cancel
        // lifts to surface-elevated instead of the prior no-op hover.
-        <div role="alertdialog" aria-modal="false" aria-labelledby="files-delete-all-msg" className="mx-3 mt-2 px-3 py-2 bg-red-950/30 border border-red-800/40 rounded space-y-1.5">
+        <div role="alertdialog" aria-labelledby="files-delete-all-msg" className="mx-3 mt-2 px-3 py-2 bg-red-950/30 border border-red-800/40 rounded space-y-1.5">
          <p id="files-delete-all-msg" className="text-xs text-bad">Delete all {files.filter((f) => !f.dir).length} files? This cannot be undone.</p>
          <div className="flex gap-2">
            <button type="button" onClick={() => { handleDeleteAll(); setShowDeleteAll(false); }} className="px-2 py-0.5 bg-red-700 hover:bg-red-600 text-[10px] rounded text-white transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-red-500/60 focus-visible:ring-offset-1 focus-visible:ring-offset-surface">Delete All</button>
@@ -280,7 +280,7 @@ function PlatformOwnedFilesTab({
      )}

      {confirmDelete && (
-        <div role="alertdialog" aria-modal="false" aria-labelledby="files-delete-one-msg" className="mx-3 mt-2 px-3 py-2 bg-amber-950/30 border border-amber-800/40 rounded space-y-1.5">
+        <div role="alertdialog" aria-labelledby="files-delete-one-msg" className="mx-3 mt-2 px-3 py-2 bg-amber-950/30 border border-amber-800/40 rounded space-y-1.5">
          <p id="files-delete-one-msg" className="text-xs text-warm">Delete <span className="font-mono">{confirmDelete}</span>{files.find((f) => f.path === confirmDelete && f.dir) ? " and all its contents" : ""}?</p>
          <div className="flex gap-2">
            <button type="button" onClick={confirmDeleteFile} className="px-2 py-0.5 bg-red-700 hover:bg-red-600 text-[10px] rounded text-white transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-red-500/60 focus-visible:ring-offset-1 focus-visible:ring-offset-surface">Delete</button>
@@ -275,7 +275,7 @@ export function ScheduleTab({ workspaceId }: Props) {
              Enabled
            </label>
          </div>
-          {error && <div role="alert" aria-live="assertive" className="text-[10px] text-bad">{error}</div>}
+          {error && <div className="text-[10px] text-bad">{error}</div>}
          <div className="flex gap-2">
            <button
              type="button"
@@ -67,7 +67,7 @@ export function TracesTab({ workspaceId }: Props) {
      </div>

      {error && (
-        <div role="alert" aria-live="assertive" className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+        <div className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
          {error}
        </div>
      )}
@@ -1,99 +0,0 @@
-// @vitest-environment jsdom
-//
-// Pins internal#212 — the chat error banner must:
-//
-//   1. Render the secret-safe failure reason (e.g. the provider's own
-//      "403 oauth_org_not_allowed: ..." string), NOT the opaque
-//      hardcoded "Agent error (Exception) — see workspace logs for
-//      details." that points at a workspace-logs tab that doesn't
-//      exist.
-//
-//   2. Offer a working "View activity log" affordance that navigates
-//      the user to the Activity tab where the full row lives.
-//
-// Tested at the banner-component seam (ChatErrorBanner). The
-// hook-level path is pinned separately by
-// chat/hooks/__tests__/useChatSocket.test.tsx — together they cover
-// wire-payload → callback → render without each test needing to drive
-// the full ChatTab send-state machinery.
-
-import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
-import { render, screen, cleanup, fireEvent } from "@testing-library/react";
-
-afterEach(cleanup);
-
-const mocks = vi.hoisted(() => ({
-  setPanelTabMock: vi.fn(),
-}));
-
-vi.mock("@/store/canvas", () => {
-  const state = {
-    setPanelTab: mocks.setPanelTabMock,
-    panelTab: "chat",
-  };
-  const hook = (selector?: (s: typeof state) => unknown) =>
-    selector ? selector(state) : state;
-  hook.getState = () => state;
-  return { useCanvasStore: hook };
-});
-
-beforeEach(() => {
-  mocks.setPanelTabMock.mockClear();
-});
-
-import { ChatErrorBanner } from "../chat/ChatErrorBanner";
-
-describe("ChatErrorBanner — surfaces actionable reason (internal#212)", () => {
-  it("renders the secret-safe failure reason verbatim, not a hardcoded opaque message", () => {
-    const reason =
-      "Anthropic 403 oauth_org_not_allowed: Your organization has disabled Claude subscription access for Claude Code — use an Anthropic API key or ask your admin to enable access.";
-    render(<ChatErrorBanner message={reason} isOnline={true} onRestart={() => {}} />);
-    expect(screen.getByText(/oauth_org_not_allowed/i)).toBeDefined();
-    expect(screen.getByText(/disabled Claude subscription access/i)).toBeDefined();
-    // The legacy boilerplate must NOT leak through when a real reason
-    // is provided.
-    expect(screen.queryByText(/see workspace logs for details/i)).toBeNull();
-  });
-
-  it("falls back to the message when it IS the legacy boilerplate (older ws-server)", () => {
-    // Graceful degradation: an older ws-server passes through the
-    // hardcoded text; the banner still renders SOMETHING — never
-    // silently swallow.
-    render(
-      <ChatErrorBanner
-        message="Agent error (Exception) — see workspace logs for details."
-        isOnline={true}
-        onRestart={() => {}}
-      />,
-    );
-    expect(
-      screen.getByText(/Agent error \(Exception\) — see workspace logs for details\./),
-    ).toBeDefined();
-  });
-
-  it("offers a 'View activity log' button that calls setPanelTab('activity')", () => {
-    render(
-      <ChatErrorBanner message="kimi 401 invalid_api_key" isOnline={true} onRestart={() => {}} />,
-    );
-    const btn = screen.getByRole("button", { name: /view activity log/i });
-    fireEvent.click(btn);
-    expect(mocks.setPanelTabMock).toHaveBeenCalledWith("activity");
-  });
-
-  it("still shows the Restart button when offline (existing behavior preserved)", () => {
-    const onRestart = vi.fn();
-    render(
-      <ChatErrorBanner message="Agent is offline" isOnline={false} onRestart={onRestart} />,
-    );
-    const btn = screen.getByRole("button", { name: /^restart$/i });
-    fireEvent.click(btn);
-    expect(onRestart).toHaveBeenCalledTimes(1);
-  });
-
-  it("renders nothing when message is null", () => {
-    const { container } = render(
-      <ChatErrorBanner message={null} isOnline={true} onRestart={() => {}} />,
-    );
-    expect(container.textContent).toBe("");
-  });
-});
@@ -1,165 +0,0 @@
-// @vitest-environment jsdom
-//
-// Tests for the always-visible "Agent Abilities" section added to ConfigTab
-// (internal#510 broadcast_enabled, internal#511 talk_to_user_enabled; backend
-// wired in commit 29b4bffb).
-//
-// Problem this pins: the two workspace ability flags had complete wired
-// backends but NO canvas control — broadcast had none at all, talk-to-user
-// only surfaced as a ChatTab recovery banner that is invisible under its
-// TRUE default. The CTO could not see or toggle either from canvas.
-//
-// What this suite pins:
-//   1. An "Agent Abilities" section renders (always visible, not gated).
-//   2. Both toggles render and reflect the store node's ability fields,
-//      including the asymmetric defaults (broadcast FALSE, talk TRUE).
-//   3. Toggling a switch calls PATCH /workspaces/:id/abilities with the
-//      correct snake_case body and optimistically updates the store.
-
-import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
-import { render, screen, cleanup, waitFor, fireEvent } from "@testing-library/react";
-import React from "react";
-
-afterEach(cleanup);
-
-const apiGet = vi.fn();
-const apiPatch = vi.fn();
-vi.mock("@/lib/api", () => ({
-  api: {
-    get: (path: string) => apiGet(path),
-    patch: (path: string, body?: unknown) => apiPatch(path, body),
-    put: vi.fn(),
-    post: vi.fn(),
-    del: vi.fn(),
-  },
-}));
-
-// Store node carries the ability flags hydrated by the platform stream
-// (canvas-topology.ts maps broadcast_enabled/talk_to_user_enabled onto
-// node.data). Mirror that shape so the section reads real values.
-const storeUpdateNodeData = vi.fn();
-const storeRestartWorkspace = vi.fn();
-let nodeData: { broadcastEnabled?: boolean; talkToUserEnabled?: boolean } = {};
-const makeState = () => ({
-  nodes: [{ id: "ws-test", data: nodeData }],
-  restartWorkspace: storeRestartWorkspace,
-  updateNodeData: storeUpdateNodeData,
-});
-vi.mock("@/store/canvas", () => ({
-  useCanvasStore: Object.assign(
-    (selector: (s: unknown) => unknown) => selector(makeState()),
-    { getState: () => makeState() },
-  ),
-}));
-
-vi.mock("../AgentCardSection", () => ({
-  AgentCardSection: () => <div data-testid="agent-card-stub" />,
-}));
-
-import { ConfigTab } from "../ConfigTab";
-
-beforeEach(() => {
-  apiGet.mockReset();
-  apiPatch.mockReset();
-  apiPatch.mockResolvedValue({ status: "updated" });
-  storeUpdateNodeData.mockReset();
-  apiGet.mockImplementation((path: string) => {
-    if (path === `/workspaces/ws-test`) {
-      return Promise.resolve({ runtime: "claude-code" });
-    }
-    if (path === `/workspaces/ws-test/model`) {
-      return Promise.resolve({ model: "claude-opus-4-7" });
-    }
-    if (path === `/workspaces/ws-test/provider`) {
-      return Promise.resolve({ provider: "anthropic-oauth", source: "default" });
-    }
-    if (path === `/workspaces/ws-test/files/config.yaml`) {
-      return Promise.resolve({ content: "name: test\nruntime: claude-code\n" });
-    }
-    if (path === "/templates") {
-      return Promise.resolve([
-        { id: "claude-code", name: "Claude Code", runtime: "claude-code", providers: [] },
-      ]);
-    }
-    return Promise.reject(new Error(`unmocked api.get: ${path}`));
-  });
-});
-
-describe("ConfigTab Agent Abilities section", () => {
-  it("renders an always-visible 'Agent Abilities' section with both toggles", async () => {
-    nodeData = {}; // unset → defaults
-    render(<ConfigTab workspaceId="ws-test" />);
-    await waitFor(() => expect(apiGet).toHaveBeenCalled());
-    expect(
-      await screen.findByRole("button", { name: /Agent Abilities/i }),
-    ).toBeTruthy();
-    expect(screen.getByText("Talk to user")).toBeTruthy();
-    expect(screen.getByText("Broadcast to peers")).toBeTruthy();
-  });
-
-  it("reflects the asymmetric defaults: talk-to-user ON, broadcast OFF", async () => {
-    nodeData = {}; // unset → backend defaults
-    render(<ConfigTab workspaceId="ws-test" />);
-    await waitFor(() => expect(apiGet).toHaveBeenCalled());
-    const talk = (await screen.findByText("Talk to user"))
-      .closest("label")!
-      .querySelector("input") as HTMLInputElement;
-    const broadcast = screen
-      .getByText("Broadcast to peers")
-      .closest("label")!
-      .querySelector("input") as HTMLInputElement;
-    expect(talk.checked).toBe(true);
-    expect(broadcast.checked).toBe(false);
-  });
-
-  it("reflects explicit store values", async () => {
-    nodeData = { broadcastEnabled: true, talkToUserEnabled: false };
-    render(<ConfigTab workspaceId="ws-test" />);
-    await waitFor(() => expect(apiGet).toHaveBeenCalled());
-    const talk = (await screen.findByText("Talk to user"))
-      .closest("label")!
-      .querySelector("input") as HTMLInputElement;
-    const broadcast = screen
-      .getByText("Broadcast to peers")
-      .closest("label")!
-      .querySelector("input") as HTMLInputElement;
-    expect(talk.checked).toBe(false);
-    expect(broadcast.checked).toBe(true);
-  });
-
-  it("PATCHes /abilities with talk_to_user_enabled and optimistically updates the store", async () => {
-    nodeData = {}; // talk defaults true
-    render(<ConfigTab workspaceId="ws-test" />);
-    await waitFor(() => expect(apiGet).toHaveBeenCalled());
-    const talk = (await screen.findByText("Talk to user"))
-      .closest("label")!
-      .querySelector("input") as HTMLInputElement;
-    fireEvent.click(talk); // true → false
-    await waitFor(() =>
-      expect(apiPatch).toHaveBeenCalledWith("/workspaces/ws-test/abilities", {
-        talk_to_user_enabled: false,
-      }),
-    );
-    expect(storeUpdateNodeData).toHaveBeenCalledWith("ws-test", {
-      talkToUserEnabled: false,
-    });
-  });
-
-  it("PATCHes /abilities with broadcast_enabled when the broadcast toggle is flipped", async () => {
-    nodeData = {}; // broadcast defaults false
-    render(<ConfigTab workspaceId="ws-test" />);
-    await waitFor(() => expect(apiGet).toHaveBeenCalled());
-    const broadcast = (await screen.findByText("Broadcast to peers"))
-      .closest("label")!
-      .querySelector("input") as HTMLInputElement;
-    fireEvent.click(broadcast); // false → true
-    await waitFor(() =>
-      expect(apiPatch).toHaveBeenCalledWith("/workspaces/ws-test/abilities", {
-        broadcast_enabled: true,
-      }),
-    );
-    expect(storeUpdateNodeData).toHaveBeenCalledWith("ws-test", {
-      broadcastEnabled: true,
-    });
-  });
-});
@@ -405,7 +405,7 @@ export function AgentCommsPanel({ workspaceId }: { workspaceId: string }) {
        </p>
        <button
          onClick={loadInitial}
-          className="text-[10px] px-2 py-0.5 rounded bg-red-800/40 text-bad hover:bg-red-700/50 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-red-500/60 focus-visible:ring-offset-1"
+          className="text-[10px] px-2 py-0.5 rounded bg-red-800/40 text-bad hover:bg-red-700/50 transition-colors"
        >
          Retry
        </button>
@@ -610,7 +610,7 @@ function PeerTabButton({
      aria-selected={active}
      tabIndex={active ? 0 : -1}
      onClick={onClick}
-      className={`shrink-0 px-3 py-1.5 text-[10px] font-medium transition-colors whitespace-nowrap focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-cyan-500/60 focus-visible:ring-offset-1 ${
+      className={`shrink-0 px-3 py-1.5 text-[10px] font-medium transition-colors whitespace-nowrap ${
        active
          ? "border-b-2 border-cyan-500 text-cyan-200"
          : "border-b-2 border-transparent text-ink-mid hover:text-ink-mid"
@@ -33,7 +33,7 @@ export function PendingAttachmentPill({
      <button
        onClick={onRemove}
        aria-label={`Remove ${file.name}`}
-        className="ml-0.5 text-ink-mid hover:text-ink transition-colors shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/60 focus-visible:ring-offset-1"
+        className="ml-0.5 text-ink-mid hover:text-ink transition-colors shrink-0"
      >
        <svg width="10" height="10" viewBox="0 0 16 16" fill="none" aria-hidden="true">
          <path d="M4 4l8 8M12 4l-8 8" stroke="currentColor" strokeWidth="1.6" strokeLinecap="round" />
@@ -62,9 +62,8 @@ export function AttachmentChip({
  return (
    <button
      onClick={() => onDownload(attachment)}
-      aria-label={`Download ${attachment.name}`}
      title={`Download ${attachment.name}`}
-      className={`flex items-center gap-1.5 rounded-md border px-2 py-1 text-[10px] transition-colors max-w-full focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/60 focus-visible:ring-offset-1 ${toneClasses}`}
+      className={`flex items-center gap-1.5 rounded-md border px-2 py-1 text-[10px] transition-colors max-w-full ${toneClasses}`}
    >
      <FileGlyph className="shrink-0 opacity-70" />
      <span className="truncate">{attachment.name}</span>
@@ -1,85 +0,0 @@
-"use client";
-
-/**
- * ChatErrorBanner — error-state banner rendered under the chat
- * message list when an agent turn fails or the workspace is offline.
- *
- * internal#212 closes the "see workspace logs for details" pointer-to-
- * nowhere defect:
- *
- *   - The banner now renders the actionable, secret-safe failure
- *     reason that ws-server places on `ACTIVITY_LOGGED.error_detail`
- *     (provider HTTP status + error code + provider's own human
- *     message). The hook (`useChatSocket`) forwards this through
- *     `onSendError`, which the ChatTab routes into this banner's
- *     `message` prop. No hardcoded opaque text in this component.
- *
- *   - A "View activity log" button navigates the user to the Activity
- *     tab where the full row (request body, response body, timing,
- *     full error_detail) lives. Until internal#212, the banner
- *     mentioned "workspace logs" with no link — there is no separate
- *     Logs tab in the side panel; the Activity tab IS the workspace-
- *     logs surface. Routing through the existing tab makes the
- *     reference real instead of dangling.
- *
- *   - The existing Restart button (shown only when the workspace is
- *     offline) is preserved unchanged so the recovery affordance the
- *     old banner offered does not regress.
- *
- * Pure presentational — no socket subscription, no state machine. Easy
- * to unit-test in isolation and easy to compose into the ChatTab.
- */
-
-import { useCanvasStore } from "@/store/canvas";
-
-export interface ChatErrorBannerProps {
-  /** The user-visible reason. Pass `null` to render nothing. */
-  message: string | null;
-  /** Workspace reachable state — gates the Restart affordance. */
-  isOnline: boolean;
-  /** Fires when the user clicks Restart (offline-only). */
-  onRestart: () => void;
-}
-
-export function ChatErrorBanner({ message, isOnline, onRestart }: ChatErrorBannerProps) {
-  // Pulled from the global store rather than threaded through props so
-  // the chat tab does not need to know about the side-panel tab state.
-  // Matches how Toolbar.tsx triggers the audit tab (the existing
-  // precedent for cross-tab navigation).
-  const setPanelTab = useCanvasStore((s) => s.setPanelTab);
-
-  if (!message) return null;
-
-  return (
-    <div
-      // role="alert" + aria-live mirrors the project's existing WCAG
-      // 4.1.3 banner pattern (see fix/canvas-errors-aria-alert) — a
-      // screen reader announces the failure as soon as it lands.
-      role="alert"
-      aria-live="assertive"
-      className="px-3 py-2 bg-red-900/20 border-t border-red-800/30"
-    >
-      <div className="flex items-center justify-between gap-2">
-        <span className="text-[10px] text-red-300 break-words flex-1">{message}</span>
-        <div className="flex items-center gap-1.5 shrink-0">
-          <button
-            type="button"
-            onClick={() => setPanelTab("activity")}
-            className="text-[10px] px-2 py-0.5 bg-red-900/40 hover:bg-red-800/60 border border-red-700/40 text-red-200 rounded transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
-          >
-            View activity log
-          </button>
-          {!isOnline && (
-            <button
-              type="button"
-              onClick={onRestart}
-              className="text-[11px] px-2 py-0.5 bg-red-800 text-red-200 rounded hover:bg-red-700"
-            >
-              Restart
-            </button>
-          )}
-        </div>
-      </div>
-    </div>
-  );
-}
@@ -1,140 +0,0 @@
-// @vitest-environment jsdom
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { renderHook, act } from "@testing-library/react";
-
-// Capture the handler so we can drive WS events from tests. useSocketEvent
-// stores the latest handler in a ref under the hood, but since we mock
-// the hook entirely, just remember the last passed-in handler.
-let capturedHandler: ((msg: unknown) => void) | null = null;
-vi.mock("@/hooks/useSocketEvent", () => ({
-  useSocketEvent: (h: (msg: unknown) => void) => {
-    capturedHandler = h;
-  },
-}));
-
-// Canvas store mock — useChatSocket calls
-// useCanvasStore.getState().nodes for peer name resolution and reads
-// agentMessages via the selector form. Support both.
-vi.mock("@/store/canvas", () => {
-  const state = {
-    nodes: [
-      { id: "ws-self", data: { name: "Self" } },
-      { id: "ws-peer", data: { name: "Peer Agent" } },
-    ],
-    agentMessages: {} as Record<string, unknown[]>,
-    consumeAgentMessages: () => [],
-  };
-  const hook = (selector?: (s: typeof state) => unknown) =>
-    selector ? selector(state) : state;
-  hook.getState = () => state;
-  return { useCanvasStore: hook };
-});
-
-import { useChatSocket } from "../useChatSocket";
-
-beforeEach(() => {
-  capturedHandler = null;
-});
-
-afterEach(() => {
-  vi.clearAllMocks();
-});
-
-// Helper: assemble an ACTIVITY_LOGGED a2a_receive error event the way
-// the ws-server emits one when a peer call errors out. Fields mirror
-// workspace-server/internal/handlers/activity.go::logActivityExec
-// broadcast payload shape.
-function makeActivityErrorEvent(opts: { workspaceId: string; targetId?: string; errorDetail?: string | undefined }) {
-  return {
-    event: "ACTIVITY_LOGGED",
-    workspace_id: opts.workspaceId,
-    payload: {
-      activity_type: "a2a_receive",
-      method: "message/send",
-      status: "error",
-      target_id: opts.targetId ?? opts.workspaceId,
-      duration_ms: 1500,
-      ...(opts.errorDetail !== undefined ? { error_detail: opts.errorDetail } : {}),
-    },
-    timestamp: "2026-05-18T00:00:00Z",
-  };
-}
-
-describe("useChatSocket — surface error_detail to onSendError (internal#212)", () => {
-  it("forwards the secret-safe error_detail from the broadcast as the onSendError reason", () => {
-    const onSendError = vi.fn();
-    const onSendComplete = vi.fn();
-    renderHook(() =>
-      useChatSocket("ws-self", {
-        onSendError,
-        onSendComplete,
-      }),
-    );
-
-    expect(capturedHandler).not.toBeNull();
-    act(() => {
-      capturedHandler!(
-        makeActivityErrorEvent({
-          workspaceId: "ws-self",
-          errorDetail:
-            "Anthropic 403 oauth_org_not_allowed: Your organization has disabled Claude subscription access for Claude Code",
-        }),
-      );
-    });
-
-    // The hook must NOT fall back to the opaque hardcoded
-    // "Agent error (Exception) — see workspace logs for details." —
-    // that was internal#212. When the broadcast carries an
-    // error_detail, that string is the user-facing reason.
-    expect(onSendError).toHaveBeenCalledTimes(1);
-    const reason = onSendError.mock.calls[0][0] as string;
-    expect(reason).toContain("403");
-    expect(reason).toContain("oauth_org_not_allowed");
-    expect(reason).toContain("disabled Claude subscription");
-    expect(reason).not.toMatch(/see workspace logs for details/i);
-  });
-
-  it("gracefully degrades to the legacy opaque message when error_detail is absent (older ws-server)", () => {
-    // An older ws-server doesn't include error_detail in the payload.
-    // The hook must still fire onSendError with the legacy hardcoded
-    // text so the chat banner has SOMETHING to show. The fix is
-    // additive — never depend on the new field's presence.
-    const onSendError = vi.fn();
-    renderHook(() =>
-      useChatSocket("ws-self", {
-        onSendError,
-      }),
-    );
-
-    act(() => {
-      capturedHandler!(makeActivityErrorEvent({ workspaceId: "ws-self" }));
-    });
-
-    expect(onSendError).toHaveBeenCalledTimes(1);
-    const reason = onSendError.mock.calls[0][0] as string;
-    // Legacy boilerplate is the floor — never silently swallow.
-    expect(reason.length).toBeGreaterThan(0);
-  });
-
-  it("ignores errors targeted at a different workspace's peer", () => {
-    // Defense against a race where the WS hub fans out to all clients —
-    // each chat panel must only react when target_id matches its own
-    // workspace.
-    const onSendError = vi.fn();
-    renderHook(() =>
-      useChatSocket("ws-self", {
-        onSendError,
-      }),
-    );
-    act(() => {
-      capturedHandler!(
-        makeActivityErrorEvent({
-          workspaceId: "ws-self",
-          targetId: "ws-someone-else",
-          errorDetail: "irrelevant",
-        }),
-      );
-    });
-    expect(onSendError).not.toHaveBeenCalled();
-  });
-});
@@ -67,23 +67,9 @@ export function useChatSocket(
            const own = (targetId || msg.workspace_id) === workspaceId;
            if (own) {
              callbacksRef.current.onSendComplete?.();
-              // internal#212 — surface the actionable, secret-safe
-              // failure reason (provider HTTP status + error code +
-              // human-readable message) the ws-server now puts on
-              // ACTIVITY_LOGGED.error_detail. The old hardcoded
-              // "Agent error (Exception) — see workspace logs for
-              // details." is the fallback only — it pointed at a
-              // workspace-logs tab that doesn't exist, telling the
-              // user nothing they could act on.
-              //
-              // Graceful degradation: older ws-server builds don't
-              // include error_detail, so the legacy boilerplate is
-              // still the floor (never silently swallow).
-              const detail = (p.error_detail as string) || "";
-              const reason = detail
-                ? detail
-                : "Agent error (Exception) — see workspace logs for details.";
-              callbacksRef.current.onSendError?.(reason);
+              callbacksRef.current.onSendError?.(
+                "Agent error (Exception) — see workspace logs for details.",
+              );
            }
          }
        } else if (type === "a2a_send") {
@@ -351,10 +351,8 @@ export function SecretsSection({ workspaceId, requiredEnv }: { workspaceId: stri
          {showAdd ? (
            <div className="bg-surface-card/50 rounded p-2 space-y-1.5 border border-line/50">
              <input value={newKey} onChange={(e) => setNewKey(e.target.value.toUpperCase())} placeholder="KEY_NAME"
-                aria-label="Secret key name"
                className="w-full bg-surface-sunken border border-line rounded px-2 py-1 text-[10px] font-mono text-ink focus:outline-none focus:border-accent" />
              <input value={newValue} onChange={(e) => setNewValue(e.target.value)} placeholder="Value" type="password"
-                aria-label="Secret value"
                className="w-full bg-surface-sunken border border-line rounded px-2 py-1 text-[10px] text-ink focus:outline-none focus:border-accent" />
              <div className="flex gap-2">
                <button type="button" onClick={() => { if (newKey && newValue) handleSave(newKey, newValue); }} disabled={!newKey || !newValue}
@@ -99,7 +99,7 @@ export function TestConnectionButton({

 function Spinner() {
  return (
-    <svg aria-hidden="true" className="spinner" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2">
+    <svg className="spinner" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2">
      <path d="M12 2v4M12 18v4M4.93 4.93l2.83 2.83M16.24 16.24l2.83 2.83M2 12h4M18 12h4M4.93 19.07l2.83-2.83M16.24 7.76l2.83-2.83" />
    </svg>
  );
@@ -8,7 +8,6 @@ import {
  type PreflightResult,
  type Template,
 } from "@/lib/deploy-preflight";
-import { isSaaSTenant } from "@/lib/tenant";
 import { MissingKeysModal } from "@/components/MissingKeysModal";

 /**
@@ -106,7 +105,7 @@ export function useTemplateDeploy(
        const ws = await api.post<{ id: string }>("/workspaces", {
          name: template.name,
          template: template.id,
-          tier: isSaaSTenant() ? 4 : template.tier,
+          tier: template.tier,
          canvas: coords,
          ...(model ? { model } : {}),
        });
@@ -63,7 +63,7 @@ class MockWebSocket {
 (globalThis as unknown as Record<string, unknown>).WebSocket = MockWebSocket;

 // Now import the socket module (uses globalThis.WebSocket at call time)
-import { connectSocket, disconnectSocket, wakeSocket } from "../socket";
+import { connectSocket, disconnectSocket } from "../socket";
 import { useCanvasStore } from "../canvas";

 // ---------------------------------------------------------------------------
@@ -416,84 +416,3 @@ describe("RehydrateDedup", () => {
    expect(d.shouldSkip(2_700)).toBe(true);
  });
 });
-
-// ---------------------------------------------------------------------------
-// wakeSocket() — visibility-wake reconnect (regression #223 / #228)
-// ---------------------------------------------------------------------------
-//
-// Mobile browsers (iOS Safari, Chrome on Android in deep-sleep) silently
-// drop the WebSocket when the tab is backgrounded; the in-page onclose
-// fires very late or never. Without a visibility wake, the canvas stays
-// frozen until the user manually refreshes.
-//
-// The real wiring lives at module level: connectSocket installs a
-// visibilitychange/pageshow listener that calls wake() on foreground.
-// We can't dispatch DOM events here because the suite runs under the
-// `node` test environment (no `document`/`window` — see canvas/vitest
-// .config.ts). Instead we test wake() directly through the wakeSocket
-// public export, which is the same code path the listener invokes.
-
-describe("wakeSocket → reconnect (#223 / #228 — mobile visibility wake)", () => {
-  it("wake on a healthy OPEN socket does not create a new WebSocket", () => {
-    connectSocket();
-    const ws = getLastWS();
-    ws.triggerOpen();
-    // OPEN === 1. wake() should take the healthy-no-op branch.
-    (ws as unknown as { readyState: number }).readyState = 1;
-    const before = MockWebSocket.instances.length;
-    wakeSocket();
-    expect(MockWebSocket.instances.length).toBe(before);
-  });
-
-  it("wake on a CLOSED socket creates a new WebSocket (the actual #223 fix)", () => {
-    connectSocket();
-    const ws = getLastWS();
-    ws.triggerOpen();
-    // CLOSED === 3. Simulates the OS killing the socket while the tab
-    // was backgrounded. We deliberately don't fire triggerClose() —
-    // the whole point of #223 is that mobile browsers don't fire
-    // onclose when they kill the WS, so reconnect never schedules.
-    (ws as unknown as { readyState: number }).readyState = 3;
-    const before = MockWebSocket.instances.length;
-    wakeSocket();
-    expect(MockWebSocket.instances.length).toBe(before + 1);
-  });
-
-  it("wake while CONNECTING (readyState=0) does not pile another handshake", () => {
-    connectSocket();
-    const ws = getLastWS();
-    // CONNECTING === 0 — a handshake is already in flight.
-    (ws as unknown as { readyState: number }).readyState = 0;
-    const before = MockWebSocket.instances.length;
-    wakeSocket();
-    expect(MockWebSocket.instances.length).toBe(before);
-  });
-
-  it("wake cancels any pending backoff reconnect", () => {
-    const clearTimeoutSpy = vi.spyOn(globalThis, "clearTimeout");
-    connectSocket();
-    const ws = getLastWS();
-    ws.triggerOpen();
-    // Drop the socket — onclose schedules a backoff reconnect.
-    ws.triggerClose();
-    // Now wake the page. wake() should pre-empt the backoff so the
-    // user sees the canvas come back immediately, not after the
-    // exponential delay window.
-    (ws as unknown as { readyState: number }).readyState = 3;
-    clearTimeoutSpy.mockClear();
-    wakeSocket();
-    expect(clearTimeoutSpy).toHaveBeenCalled();
-    clearTimeoutSpy.mockRestore();
-  });
-
-  it("wake after disconnectSocket is a no-op (no zombie reconnect)", () => {
-    connectSocket();
-    const ws = getLastWS();
-    ws.triggerOpen();
-    disconnectSocket();
-    const before = MockWebSocket.instances.length;
-    // Singleton is null now — wake() should silently do nothing.
-    expect(() => wakeSocket()).not.toThrow();
-    expect(MockWebSocket.instances.length).toBe(before);
-  });
-});
@@ -268,46 +268,6 @@ class ReconnectingSocket {
    }
    useCanvasStore.getState().setWsStatus("disconnected");
  }
-
-  /** Force a reconnect attempt now, skipping the backoff window.
-   *  Used by the visibilitychange / pageshow handler: when a mobile
-   *  browser backgrounds the tab, the OS silently kills the WebSocket
-   *  but the in-page onclose either fires very late or never fires at
-   *  all (iOS Safari, Chrome on Android in deep-sleep). Once the user
-   *  brings the tab back, the canvas needs to reconnect within human
-   *  perception — not on whatever backoff delay was last scheduled,
-   *  which can be up to 30s. (#223 / #228)
-   *
-   *  Idempotent: if the socket is already OPEN we leave it alone; the
-   *  WebSocket is still healthy and a reconnect would just churn. */
-  wake() {
-    if (this.disposed) return;
-    // OPEN === 1. Use the numeric literal so we don't have to import
-    // WebSocket type values; the runtime constant is well-defined.
-    if (this.ws && this.ws.readyState === 1) {
-      // Healthy. Run a rehydrate to catch any events we may have missed
-      // while the tab was backgrounded — the OS does deliver some
-      // packets late, but it can also drop them, and the dedup gate
-      // collapses this with any subsequent health-check rehydrate.
-      void this.rehydrate();
-      return;
-    }
-    // CONNECTING === 0 means a handshake is already in flight. Don't
-    // pile another one on; the existing attempt or its onclose-driven
-    // reconnect will resolve.
-    if (this.ws && this.ws.readyState === 0) return;
-    // Otherwise (CLOSING, CLOSED, or null) we're in limbo. Cancel any
-    // pending backoff and reconnect now.
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = null;
-    }
-    // Reset attempt counter so the *next* failure (if any) starts from
-    // a short delay again — we just had a real user interaction, not
-    // an unattended-tab failure cascade.
-    this.attempt = 0;
-    this.connect();
-  }
 }

 export interface WorkspaceData {
@@ -346,49 +306,11 @@ export interface WorkspaceData {

 let socket: ReconnectingSocket | null = null;

-/** visibilitychange / pageshow handler. Mobile browsers (iOS Safari,
- *  Chrome on Android in deep-sleep) silently drop the WebSocket when
- *  the tab is backgrounded — the in-page `onclose` fires very late or
- *  never. Without this listener, the canvas appears frozen after the
- *  user backgrounds the PWA and returns to it: status events, agent
- *  messages, and cross-device chat broadcast don't arrive until a
- *  manual refresh (#223 / #228).
- *
- *  Both events are wired: `visibilitychange` covers tab-switch on a
- *  live page; `pageshow` covers Safari's bfcache restore, where the
- *  page comes back from cache without firing visibilitychange. */
-function onPageWake() {
-  // document is undefined in SSR; the listener never installs there,
-  // but defensively guard anyway in case this code is run via a test
-  // harness that doesn't shim it.
-  if (typeof document !== "undefined" && document.hidden) return;
-  socket?.wake();
-}
-let visibilityHandlerInstalled = false;
-function installVisibilityHandler() {
-  if (visibilityHandlerInstalled) return;
-  if (typeof document === "undefined" || typeof window === "undefined") return;
-  document.addEventListener("visibilitychange", onPageWake);
-  // `pageshow` with `event.persisted === true` is the bfcache restore
-  // signal — relevant on iOS Safari. We don't need to inspect
-  // `persisted` because waking an OPEN socket is a no-op.
-  window.addEventListener("pageshow", onPageWake);
-  visibilityHandlerInstalled = true;
-}
-function uninstallVisibilityHandler() {
-  if (!visibilityHandlerInstalled) return;
-  if (typeof document === "undefined" || typeof window === "undefined") return;
-  document.removeEventListener("visibilitychange", onPageWake);
-  window.removeEventListener("pageshow", onPageWake);
-  visibilityHandlerInstalled = false;
-}
-
 export function connectSocket() {
  if (!socket) {
    socket = new ReconnectingSocket(WS_URL);
  }
  socket.connect();
-  installVisibilityHandler();
 }

 export function disconnectSocket() {
@@ -396,14 +318,4 @@ export function disconnectSocket() {
    socket.disconnect();
    socket = null;
  }
-  uninstallVisibilityHandler();
-}
-
-/** Manually trigger the visibility-wake path. Exported so the test suite
- *  can exercise `ReconnectingSocket.wake()` without depending on a
- *  jsdom DOM (the rest of this file's tests run under the node env).
- *  Real-world callers don't need this — the visibility/pageshow listener
- *  drives it. */
-export function wakeSocket() {
-  socket?.wake();
 }
@@ -584,10 +584,6 @@
 .secrets-tab__refresh-btn:hover {
  background: #1e40af;
 }
-.secrets-tab__refresh-btn:focus-visible {
-  outline: 2px solid #1d4ed8;
-  outline-offset: 2px;
-}

 .secrets-tab__no-results {
  text-align: center;
@@ -653,10 +649,6 @@
  border-radius: 6px;
  cursor: pointer;
 }
-.delete-dialog__cancel-btn:focus-visible {
-  outline: var(--focus-ring);
-  outline-offset: var(--focus-ring-offset);
-}

 .delete-dialog__confirm-btn {
  background: var(--status-invalid);
@@ -666,10 +658,6 @@
  border-radius: 6px;
  cursor: pointer;
 }
-.delete-dialog__confirm-btn:focus-visible {
-  outline: var(--focus-ring);
-  outline-offset: var(--focus-ring-offset);
-}

 .delete-dialog__confirm-btn:disabled { opacity: 0.4; cursor: not-allowed; }

@@ -30,7 +30,10 @@
    {"name": "openclaw", "repo": "molecule-ai/molecule-ai-workspace-template-openclaw", "ref": "main"},
    {"name": "codex", "repo": "molecule-ai/molecule-ai-workspace-template-codex", "ref": "main"},
    {"name": "langgraph", "repo": "molecule-ai/molecule-ai-workspace-template-langgraph", "ref": "main"},
-    {"name": "autogen", "repo": "molecule-ai/molecule-ai-workspace-template-autogen", "ref": "main"}
+    {"name": "crewai", "repo": "molecule-ai/molecule-ai-workspace-template-crewai", "ref": "main"},
+    {"name": "autogen", "repo": "molecule-ai/molecule-ai-workspace-template-autogen", "ref": "main"},
+    {"name": "deepagents", "repo": "molecule-ai/molecule-ai-workspace-template-deepagents", "ref": "main"},
+    {"name": "gemini-cli", "repo": "molecule-ai/molecule-ai-workspace-template-gemini-cli", "ref": "main"}
  ],
  "org_templates": [
    {"name": "molecule-dev", "repo": "molecule-ai/molecule-ai-org-template-molecule-dev", "ref": "main"},
@@ -58,7 +58,6 @@ TOP_LEVEL_MODULES = {
    "a2a_response",
    "a2a_tools",
    "a2a_tools_delegation",
-    "a2a_tools_identity",
    "a2a_tools_inbox",
    "a2a_tools_memory",
    "a2a_tools_messaging",
@@ -311,17 +310,8 @@ locally.
  deps from your system Python. Plain `pip install --user` works
  but the binary lands in `~/.local/bin` (Linux) or
  `~/Library/Python/3.X/bin` (macOS) which is often not on PATH on
-  a fresh shell — `claude mcp add molecule-<workspace-slug> -- molecule-mcp`
-  then fails with "command not found" at first use.
-
-* **Server name in `claude mcp add` is workspace-specific.** The
-  Canvas "Add to Claude Code" snippet stamps a unique slug
-  (`molecule-<workspace-name>`) so a single Claude Code session can
-  talk to N molecule workspaces concurrently — `claude mcp add` keys
-  entries by name in `~/.claude.json`, so re-running with a bare
-  `molecule` name silently overwrites the prior workspace's entry.
-  See [molecule-core#1535](https://git.moleculesai.app/molecule-ai/molecule-core/pulls/1535)
-  for the canonical generator.
+  a fresh shell — `claude mcp add molecule -- molecule-mcp` then
+  fails with "command not found" at first use.

 ### Install

@@ -345,10 +335,8 @@ WORKSPACE_ID=<uuid> \\
 That exposes the same 8 platform tools (`delegate_task`, `list_peers`,
 `send_message_to_user`, `commit_memory`, etc.) that container-bound
 runtimes already get via the workspace's auto-spawned MCP. Register
-the binary in your agent's MCP config — use a workspace-specific
-server name so multi-workspace setups don't collide (e.g. Claude Code:
-`claude mcp add molecule-<workspace-slug> -- molecule-mcp` with the env
-above; the Canvas modal stamps the right slug for you).
+the binary in your agent's MCP config (e.g. Claude Code's
+`claude mcp add molecule -- molecule-mcp` with the env above).

 ### Keeping the token out of shell history

@@ -386,8 +374,8 @@ hold:
   wheel does (see `_build_initialize_result`). Nothing for you to
   do.
 2. **Claude Code installs the server as a marketplace plugin** — a
-   plain `claude mcp add molecule-<workspace-slug> -- molecule-mcp`
-   produces a non-plugin-sourced server, which Claude Code rejects with
+   plain `claude mcp add molecule -- molecule-mcp` produces a
+   non-plugin-sourced server, which Claude Code rejects with
   `channel_enable requires a marketplace plugin`. Until the
   official `moleculesai/claude-code-plugin` marketplace lands
   (tracking [#2936](https://git.moleculesai.app/molecule-ai/molecule-core/issues/2936)),
@@ -1,165 +0,0 @@
-# shellcheck shell=bash
-# Shared peer-visibility assertion core — runtime/backend-AGNOSTIC.
-#
-# WHY THIS FILE EXISTS
-# --------------------
-# The peer-visibility gate (PR #1298) was staging-only. Per the standing
-# rule that the local prod-mimic stack must run a MANDATORY local-Postgres
-# E2E BEFORE staging E2E (memory: feedback_local_must_mimic_production,
-# feedback_mandatory_local_e2e_before_ship, feedback_local_test_before_
-# staging_e2e), peer-visibility must also run against the local stack.
-#
-# The ASSERTION must be byte-identical between local and staging — only
-# provisioning differs. So the literal MCP `list_peers` call + every
-# anti-proxy / anti-native-fallback guarantee lives HERE, sourced by both
-# tests/e2e/test_peer_visibility_mcp_staging.sh (staging/CP backend) and
-# tests/e2e/test_peer_visibility_mcp_local.sh (local docker-compose
-# backend). If this assertion ever diverges between the two, that is the
-# bug — keep it in one place.
-#
-# THIS IS NOT A PROXY. pv_assert_runtime issues the byte-for-byte
-# JSON-RPC `tools/call name=list_peers` envelope to `POST
-# /workspaces/:id/mcp` using the workspace's OWN bearer token, through
-# the real WorkspaceAuth + MCPRateLimiter middleware chain — the exact
-# call mcp_molecule_list_peers makes from a canvas agent. It does NOT
-# read a registry row, /health, the heartbeat table, or
-# GET /registry/:id/peers.
-#
-# Contract:
-#   pv_assert_runtime <runtime> <ws_id> <ws_bearer> <base_url> \
-#                     <org_id_or_empty> <all_ws_ids_space_separated>
-#
-#     <org_id_or_empty>  staging: the X-Molecule-Org-Id header value.
-#                        local:   "" (the local single-tenant stack does
-#                                 not gate on the org header; the header
-#                                 is simply omitted when empty).
-#     <all_ws_ids>       every provisioned workspace id (parent + every
-#                        runtime sibling). The expected peer set for this
-#                        runtime is every id in here EXCEPT <ws_id>.
-#
-#   Sets the global PV_VERDICT to one of:
-#     OK
-#     FAIL(http=<code>)
-#     FAIL(native-fallback)
-#     FAIL(rpc=<detail>)
-#     FAIL(peers=<detail>)
-#     FAIL(unknown)
-#   Returns 0 when PV_VERDICT=OK, 1 otherwise. Never exits — the caller
-#   owns aggregation + the gate exit code (10 = regression reproduced).
-#
-# The literal JSON-RPC envelope. Identical to what
-# workspace/platform_tools/registry.py's mcp_molecule_list_peers emits.
-PV_RPC_BODY='{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_peers","arguments":{}}}'
-
-pv_assert_runtime() {
-  local rt="$1" wid="$2" wtok="$3" base_url="$4" org_id="$5" all_ws_ids="$6"
-
-  # Expected peer set = every OTHER provisioned workspace, excluding the
-  # caller itself. Byte-identical selection to the original staging script.
-  local expect_ids
-  expect_ids=$(echo "$all_ws_ids" | tr ' ' '\n' | grep -v "^${wid}$" | grep -v '^$')
-
-  # X-Molecule-Org-Id only when the backend supplies one (staging multi-
-  # tenant). Local single-tenant omits it — the same WorkspaceAuth +
-  # MCPRateLimiter chain still runs; only the tenant-routing header differs.
-  local org_header=()
-  if [ -n "$org_id" ]; then
-    org_header=(-H "X-Molecule-Org-Id: $org_id")
-  fi
-
-  local resp http_code body
-  set +e
-  resp=$(curl -sS -X POST "$base_url/workspaces/$wid/mcp" \
-    -H "Authorization: Bearer $wtok" \
-    "${org_header[@]}" \
-    -H "Content-Type: application/json" \
-    -d "$PV_RPC_BODY" \
-    -o /tmp/pv_mcp_body.json -w "%{http_code}" 2>/dev/null)
-  set -e
-  http_code="$resp"
-  body=$(cat /tmp/pv_mcp_body.json 2>/dev/null || echo '')
-
-  echo "--- $rt (ws=$wid) ---"
-  echo "    HTTP $http_code"
-  echo "    body: $(echo "$body" | head -c 600)"
-
-  # (1) HTTP 200 — a 401 (WorkspaceAuth reject, the Hermes symptom) fails here.
-  if [ "$http_code" != "200" ]; then
-    echo "  ✗ $rt: list_peers MCP call returned HTTP $http_code (expected 200)"
-    PV_VERDICT="FAIL(http=$http_code)"
-    return 1
-  fi
-
-  # (2) JSON-RPC result present, not an error object; expected sibling IDs
-  #     present; not a native-sessions fallback. Byte-identical to the
-  #     original staging script's inline python.
-  local parse
-  parse=$(echo "$body" | python3 -c "
-import sys, json
-expect = set(filter(None, '''$expect_ids'''.split()))
-try:
-    d = json.load(sys.stdin)
-except Exception as e:
-    print('PARSE_ERROR:' + str(e)); sys.exit(0)
-if isinstance(d, dict) and d.get('error') is not None:
-    print('RPC_ERROR:' + json.dumps(d['error'])[:200]); sys.exit(0)
-res = d.get('result') if isinstance(d, dict) else None
-if res is None:
-    print('NO_RESULT'); sys.exit(0)
-# MCP tools/call result shape: {content:[{type:text,text:'<json or prose>'}]}
-text = ''
-if isinstance(res, dict):
-    for c in res.get('content', []):
-        if c.get('type') == 'text':
-            text += c.get('text', '')
-text_l = text.lower()
-# Native-sessions fallback signature (the OpenClaw symptom): the agent
-# answered from its own runtime session list, not the platform peer set.
-if 'sessions_list' in text_l or 'no platform peers' in text_l or 'native session' in text_l:
-    print('NATIVE_FALLBACK:' + text[:200]); sys.exit(0)
-# The expected sibling IDs must literally appear in the returned peer text.
-found = sorted(i for i in expect if i in text)
-missing = sorted(expect - set(found))
-if not expect:
-    print('NO_EXPECTED_PEERS_CONFIGURED'); sys.exit(0)
-if missing:
-    print('MISSING_PEERS:found=%d/%d missing=%s' % (len(found), len(expect), ','.join(m[:8] for m in missing)))
-    sys.exit(0)
-print('OK:found=%d/%d' % (len(found), len(expect)))
-" 2>/dev/null)
-
-  case "$parse" in
-    OK:*)
-      echo "  ✓ $rt: list_peers returned 200 and contains all expected peers ($parse)"
-      PV_VERDICT="OK"
-      return 0
-      ;;
-    NATIVE_FALLBACK:*)
-      echo "  ✗ $rt: list_peers fell back to NATIVE sessions — sees no platform peers ($parse)"
-      PV_VERDICT="FAIL(native-fallback)"
-      return 1
-      ;;
-    RPC_ERROR:*|NO_RESULT|PARSE_ERROR:*)
-      echo "  ✗ $rt: list_peers MCP call did not return a usable result ($parse)"
-      PV_VERDICT="FAIL(rpc=$parse)"
-      return 1
-      ;;
-    MISSING_PEERS:*)
-      echo "  ✗ $rt: list_peers returned 200 but peer set is wrong/empty ($parse)"
-      PV_VERDICT="FAIL(peers=$parse)"
-      return 1
-      ;;
-    NO_EXPECTED_PEERS_CONFIGURED)
-      # Caller bug, not a runtime regression — surface loudly so a
-      # mis-wired backend can't mint a false green.
-      echo "  ✗ $rt: no expected peers were configured for this caller"
-      PV_VERDICT="FAIL(rpc=NO_EXPECTED_PEERS_CONFIGURED)"
-      return 1
-      ;;
-    *)
-      echo "  ✗ $rt: unexpected verdict '$parse'"
-      PV_VERDICT="FAIL(unknown)"
-      return 1
-      ;;
-  esac
-}
@@ -1,328 +0,0 @@
-#!/usr/bin/env bash
-# LOCAL E2E — fresh-provision peer-visibility gate via the LITERAL MCP path.
-#
-# WHY THIS EXISTS
-# ---------------
-# tests/e2e/test_peer_visibility_mcp_staging.sh (PR #1298) codified the
-# literal user-facing peer-visibility path — but staging-only. The
-# standing rule is that the local prod-mimic stack runs a MANDATORY
-# local-Postgres E2E BEFORE staging E2E (memory:
-# feedback_local_must_mimic_production, feedback_mandatory_local_e2e_
-# before_ship, feedback_local_test_before_staging_e2e,
-# feedback_real_subprocess_test_for_boot_path). A staging-only gate means
-# regressions are caught late and expensively on EC2. This is the LOCAL
-# backend: same byte-identical assertion, local docker-compose stack.
-#
-# THE ASSERTION IS NOT A PROXY and is BYTE-IDENTICAL to staging — it is
-# the SAME tests/e2e/lib/peer_visibility_assert.sh::pv_assert_runtime that
-# the staging script calls. It issues the byte-for-byte JSON-RPC
-# `tools/call name=list_peers` envelope to `POST /workspaces/:id/mcp`
-# using each workspace's OWN bearer token, through the real WorkspaceAuth
-# + MCPRateLimiter middleware chain — the exact call
-# mcp_molecule_list_peers makes from a canvas agent. It does NOT read a
-# registry row, /health, the heartbeat table, or GET /registry/:id/peers.
-#
-# Only PROVISIONING differs from staging:
-#   - staging: POST /cp/admin/orgs (cold EC2 tenant) + per-tenant admin
-#     token + each workspace's auth_token from the POST /workspaces resp.
-#   - local:   POST /workspaces directly against the local stack
-#     (BASE, default http://localhost:8080), MCP bearer minted via
-#     GET /admin/workspaces/:id/test-token (e2e_mint_test_token —
-#     deterministic, gated by MOLECULE_ENV != production). Same model
-#     every other local E2E (test_priority_runtimes_e2e.sh,
-#     test_api.sh) already uses; no new credential/provision flow.
-#
-# It is written to FAIL on today's broken Hermes/OpenClaw behavior and go
-# green only when the in-flight root-cause fixes (Hermes-401 #162,
-# OpenClaw-never-online/MCP-wiring #165) actually land — same gate
-# semantics + exit codes as the staging script. NON-required by design
-# until then (flip-to-required tracked at molecule-core#1296), and NOT
-# masked with continue-on-error (feedback_fix_root_not_symptom).
-#
-# Required env: none (local stack only).
-# Optional env:
-#   BASE                    default http://localhost:8080
-#   PV_RUNTIMES             space list; default "hermes openclaw claude-code"
-#   E2E_PROVISION_TIMEOUT_SECS  per-workspace online budget; default 900
-#                            (hermes cold apt+uv is the slow path locally)
-#   E2E_KEEP_WS             1 → skip teardown (local debugging only)
-#   LLM provider keys (a workspace boots only if its provider key is set;
-#   a runtime whose key is absent is SKIPPED, not failed — a partially
-#   keyed local env must not false-fail the gate):
-#     CLAUDE_CODE_OAUTH_TOKEN  claude-code
-#     E2E_MINIMAX_API_KEY      hermes/openclaw (MiniMax, preferred)
-#     E2E_ANTHROPIC_API_KEY    hermes/openclaw (direct Anthropic)
-#     E2E_OPENAI_API_KEY       hermes/openclaw (OpenAI)
-#
-# Exit codes (match the staging script):
-#   0  every runtime under test saw its peers via the literal MCP call
-#   1  generic failure
-#   3  a workspace never reached online within the budget
-#   10 peer-visibility regression reproduced (the gate firing as designed)
-
-set -uo pipefail
-
-source "$(dirname "$0")/_lib.sh"
-# Byte-identical assertion shared with the staging backend.
-# shellcheck source=tests/e2e/lib/peer_visibility_assert.sh
-source "$(dirname "$0")/lib/peer_visibility_assert.sh"
-
-PV_RUNTIMES="${PV_RUNTIMES:-hermes openclaw claude-code}"
-PROVISION_TIMEOUT_SECS="${E2E_PROVISION_TIMEOUT_SECS:-900}"
-NAME_PREFIX="PV-Local-$$-$(date +%H%M%S)"
-
-log()  { echo "[$(date +%H:%M:%S)] $*"; }
-ok()   { echo "[$(date +%H:%M:%S)] ✅ $*"; }
-
-CREATED_WSIDS=()
-
-# ─── Scoped teardown ───────────────────────────────────────────────────
-# Deletes ONLY the workspaces THIS run created (tracked in CREATED_WSIDS),
-# one DELETE /workspaces/:id?confirm=true each. NEVER e2e_cleanup_all_
-# workspaces / any blanket sweep — honors feedback_cleanup_after_each_test
-# and feedback_never_run_cluster_cleanup_tests_on_live_platform (a local
-# stack can still be shared with other concurrent local E2E).
-teardown() {
-  local rc=$?
-  set +e
-  if [ "${E2E_KEEP_WS:-0}" = "1" ]; then
-    echo ""
-    log "[teardown] E2E_KEEP_WS=1 — leaving ${#CREATED_WSIDS[@]} ws for debugging (REMEMBER TO DELETE)"
-    exit $rc
-  fi
-  echo ""
-  log "[teardown] deleting ${#CREATED_WSIDS[@]} workspace(s) this run created (scoped)"
-  for wid in ${CREATED_WSIDS[@]+"${CREATED_WSIDS[@]}"}; do
-    [ -n "$wid" ] || continue
-    curl -s -X DELETE "$BASE/workspaces/$wid?confirm=true" >/dev/null 2>&1 || true
-  done
-  exit $rc
-}
-trap teardown EXIT INT TERM
-
-# Pre-sweep workspaces a prior crashed run of THIS script left behind
-# (name prefix match only — never a blanket delete). The trap fires on
-# normal exit, but a kill -9 / SIGPIPE can bypass it.
-PRIOR=$(curl -s "$BASE/workspaces" | python3 -c '
-import json, sys
-try:
-    print(" ".join(w["id"] for w in json.load(sys.stdin) if w.get("name","").startswith("PV-Local-")))
-except Exception:
-    pass
-' 2>/dev/null)
-for _wid in $PRIOR; do
-  log "Pre-sweeping prior PV-Local workspace: $_wid"
-  curl -s -X DELETE "$BASE/workspaces/$_wid?confirm=true" >/dev/null 2>&1 || true
-done
-
-# ─── Local-stack preflight ─────────────────────────────────────────────
-log "0/5 local stack preflight: $BASE/health"
-if ! curl -fsS "$BASE/health" -m 5 >/dev/null 2>&1; then
-  echo "::error::Local stack not healthy at $BASE/health — bring it up (make up) before this gate. Infra, not a workspace bug (feedback_fix_root_not_symptom)." >&2
-  exit 1
-fi
-# admin/test-token is the local MCP-bearer mint path; it 404s in
-# production. If it is off, this gate cannot drive the literal call.
-if ! curl -fsS "$BASE/admin/workspaces/preflight-probe/test-token" -m 5 >/dev/null 2>&1; then
-  # A 404 here is EITHER "no such ws" (fine — endpoint is enabled) OR the
-  # endpoint is disabled (MOLECULE_ENV=production). Distinguish by body.
-  PROBE=$(curl -s "$BASE/admin/workspaces/preflight-probe/test-token" -m 5 2>/dev/null)
-  if echo "$PROBE" | grep -qi 'production\|disabled\|not found.*endpoint'; then
-    echo "::error::GET /admin/workspaces/:id/test-token disabled (MOLECULE_ENV=production?). Cannot mint a local MCP bearer." >&2
-    exit 1
-  fi
-fi
-ok "    local stack healthy"
-
-# ─── Resolve per-runtime provisioning secrets ──────────────────────────
-# Mirrors test_priority_runtimes_e2e.sh / test_staging_full_saas.sh's
-# provider-key chain. A runtime whose key is absent is SKIPPED (not
-# failed) so a partially keyed local env doesn't false-fail the gate.
-runtime_secrets() {
-  local rt="$1"
-  case "$rt" in
-    claude-code)
-      [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ] || { echo ""; return 1; }
-      python3 -c "import json,os;print(json.dumps({'CLAUDE_CODE_OAUTH_TOKEN':os.environ['CLAUDE_CODE_OAUTH_TOKEN']}))"
-      ;;
-    hermes|openclaw)
-      if [ -n "${E2E_MINIMAX_API_KEY:-}" ]; then
-        python3 -c "import json,os;k=os.environ['E2E_MINIMAX_API_KEY'];print(json.dumps({'ANTHROPIC_BASE_URL':'https://api.minimax.io/anthropic','ANTHROPIC_AUTH_TOKEN':k,'MINIMAX_API_KEY':k}))"
-      elif [ -n "${E2E_ANTHROPIC_API_KEY:-}" ]; then
-        python3 -c "import json,os;k=os.environ['E2E_ANTHROPIC_API_KEY'];print(json.dumps({'ANTHROPIC_API_KEY':k}))"
-      elif [ -n "${E2E_OPENAI_API_KEY:-}" ]; then
-        python3 -c "import json,os;k=os.environ['E2E_OPENAI_API_KEY'];print(json.dumps({'OPENAI_API_KEY':k,'OPENAI_BASE_URL':'https://api.openai.com/v1','MODEL_PROVIDER':'openai:gpt-4o','HERMES_INFERENCE_PROVIDER':'custom','HERMES_CUSTOM_BASE_URL':'https://api.openai.com/v1','HERMES_CUSTOM_API_KEY':k,'HERMES_CUSTOM_API_MODE':'chat_completions'}))"
-      else
-        echo ""; return 1
-      fi
-      ;;
-    *)
-      # Unknown runtime: provision with empty secrets and let the stack
-      # decide (kept permissive so PV_RUNTIMES can be widened later).
-      echo "{}"
-      ;;
-  esac
-}
-
-# Block until $1 reaches one of $2 (space-separated), or $3 sec elapse.
-wait_for_status() {
-  local wsid="$1" want="$2" budget="$3" start=$SECONDS last=""
-  while [ $((SECONDS - start)) -lt "$budget" ]; do
-    local s
-    s=$(curl -s "$BASE/workspaces/$wsid" | python3 -c 'import json,sys
-try:
-  d=json.load(sys.stdin); w=d.get("workspace") if isinstance(d.get("workspace"),dict) else d; print(w.get("status",""))
-except Exception:
-  print("")' 2>/dev/null || echo "")
-    [ "$s" != "$last" ] && { log "    $wsid → ${s:-<none>}"; last="$s"; }
-    for w in $want; do [ "$s" = "$w" ] && { echo "$s"; return 0; }; done
-    sleep 5
-  done
-  echo "$last"
-  return 1
-}
-
-# ─── 1. Provision parent (claude-code) + one sibling per runtime ───────
-# Same topology as the staging script: a claude-code parent plus one
-# sibling per runtime under test, so each runtime should see all others.
-log "1/5 provisioning parent (claude-code) + one sibling per runtime under test..."
-
-PARENT_SECRETS=$(runtime_secrets claude-code) || PARENT_SECRETS=""
-if [ -z "$PARENT_SECRETS" ]; then
-  # Parent still needs to exist as a peer target even without an LLM key;
-  # it never has to answer list_peers itself (it is excluded from the
-  # caller set), so an empty-secrets claude-code shell is sufficient.
-  PARENT_SECRETS="{}"
-fi
-P_RESP=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-  -d "{\"name\":\"${NAME_PREFIX}-parent\",\"runtime\":\"claude-code\",\"tier\":3,\"secrets\":$PARENT_SECRETS}")
-PARENT_ID=$(echo "$P_RESP" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))' 2>/dev/null)
-if [ -z "$PARENT_ID" ]; then
-  echo "::error::parent create failed: $(echo "$P_RESP" | head -c 300)" >&2
-  exit 1
-fi
-CREATED_WSIDS+=("$PARENT_ID")
-log "    PARENT_ID=$PARENT_ID"
-
-# NOTE: no `declare -A` — this script must also run on a local macOS dev
-# box (bash 3.2, no associative arrays) per feedback_local_must_mimic_
-# production. WS_IDS / VERDICT are kept as newline-delimited "rt<TAB>val"
-# maps with tiny get/set helpers (portable to bash 3.2+ AND ubuntu CI).
-WS_IDS_MAP=""
-VERDICT_MAP=""
-_map_set() { # _map_set <mapvarname> <key> <value>
-  local __m="$1" __k="$2" __v="$3" __cur
-  eval "__cur=\$$__m"
-  __cur=$(printf '%s' "$__cur" | grep -v "^${__k}	" || true)
-  if [ -n "$__cur" ]; then
-    eval "$__m=\$(printf '%s\n%s\t%s' \"\$__cur\" \"\$__k\" \"\$__v\")"
-  else
-    eval "$__m=\$(printf '%s\t%s' \"\$__k\" \"\$__v\")"
-  fi
-}
-_map_get() { # _map_get <mapvarname> <key>  -> stdout value (empty if absent)
-  local __m="$1" __k="$2" __cur
-  eval "__cur=\$$__m"
-  printf '%s\n' "$__cur" | awk -F'\t' -v k="$__k" '$1==k {print $2; exit}'
-}
-
-ALL_WS_IDS="$PARENT_ID"
-ACTIVE_RUNTIMES=""
-for rt in $PV_RUNTIMES; do
-  SEC=$(runtime_secrets "$rt") || SEC=""
-  if [ -z "$SEC" ]; then
-    log "    SKIP $rt — no provider key in env (partially-keyed local env; not a failure)"
-    continue
-  fi
-  R=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-    -d "{\"name\":\"${NAME_PREFIX}-$rt\",\"runtime\":\"$rt\",\"tier\":2,\"parent_id\":\"$PARENT_ID\",\"secrets\":$SEC}")
-  WID=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))' 2>/dev/null)
-  if [ -z "$WID" ]; then
-    echo "::error::$rt workspace create failed: $(echo "$R" | head -c 300)" >&2
-    exit 1
-  fi
-  _map_set WS_IDS_MAP "$rt" "$WID"
-  CREATED_WSIDS+=("$WID")
-  ALL_WS_IDS="$ALL_WS_IDS $WID"
-  ACTIVE_RUNTIMES="$ACTIVE_RUNTIMES $rt"
-  log "    $rt → $WID"
-done
-ACTIVE_RUNTIMES="$(echo "$ACTIVE_RUNTIMES" | xargs)"
-
-if [ -z "$ACTIVE_RUNTIMES" ]; then
-  echo "::error::No runtime had a provider key set — cannot run the local peer-visibility gate. Set CLAUDE_CODE_OAUTH_TOKEN and/or E2E_MINIMAX_API_KEY (or ANTHROPIC/OPENAI)." >&2
-  exit 1
-fi
-
-# ─── 2. Wait for the parent online (it is a peer target) ───────────────
-log "2/5 waiting for parent online (peer target)..."
-PF=$(wait_for_status "$PARENT_ID" "online" "$PROVISION_TIMEOUT_SECS") || true
-if [ "$PF" != "online" ]; then
-  echo "::error::parent ($PARENT_ID) never reached online (last=$PF) within ${PROVISION_TIMEOUT_SECS}s" >&2
-  exit 3
-fi
-ok "    parent online"
-
-# ─── 3. Wait for every sibling online ──────────────────────────────────
-# A runtime that never comes online locally is itself a finding: it
-# reproduces the openclaw-never-online class (#165) on the local stack.
-log "3/5 waiting for all siblings online (up to ${PROVISION_TIMEOUT_SECS}s each — cold boot)..."
-REGRESSED=0
-ONLINE_RUNTIMES=""
-for rt in $ACTIVE_RUNTIMES; do
-  wid="$(_map_get WS_IDS_MAP "$rt")"
-  S=$(wait_for_status "$wid" "online" "$PROVISION_TIMEOUT_SECS") || true
-  if [ "$S" != "online" ]; then
-    echo "  ✗ $rt ($wid): never reached online (last=$S) — reproduces the never-online class locally"
-    _map_set VERDICT_MAP "$rt" "FAIL(never-online:last=$S)"
-    REGRESSED=1
-    continue
-  fi
-  ok "    $rt online"
-  ONLINE_RUNTIMES="$ONLINE_RUNTIMES $rt"
-done
-
-# ─── 4. THE GATE — literal mcp_molecule_list_peers via POST /:id/mcp ────
-# Shared, byte-identical assertion. Local passes "" for the org id (the
-# single-tenant local stack does not gate on X-Molecule-Org-Id); the
-# literal MCP call + every anti-proxy / anti-native-fallback guarantee is
-# the SAME code the staging backend runs.
-log "4/5 driving the LITERAL list_peers MCP call per online runtime..."
-echo ""
-for rt in $ONLINE_RUNTIMES; do
-  wid="$(_map_get WS_IDS_MAP "$rt")"
-  WTOK=$(e2e_mint_test_token "$wid" 2>/dev/null || true)
-  if [ -z "$WTOK" ]; then
-    echo "--- $rt (ws=$wid) ---"
-    echo "  ✗ $rt: could not mint a local MCP bearer (admin/test-token) — cannot drive the literal call"
-    _map_set VERDICT_MAP "$rt" "FAIL(no-bearer)"
-    REGRESSED=1
-    echo ""
-    continue
-  fi
-  PV_VERDICT=""
-  pv_assert_runtime "$rt" "$wid" "$WTOK" "$BASE" "" "$ALL_WS_IDS" || REGRESSED=1
-  _map_set VERDICT_MAP "$rt" "$PV_VERDICT"
-  echo ""
-done
-
-# ─── 5. Summary + honest gate exit ─────────────────────────────────────
-echo "=== SUMMARY — LOCAL fresh-provision peer-visibility (literal MCP list_peers) ==="
-for rt in $ACTIVE_RUNTIMES; do
-  _v="$(_map_get VERDICT_MAP "$rt")"
-  printf '  %-14s %s\n' "$rt" "${_v:-NO_RUN}"
-done
-echo ""
-
-if [ "$REGRESSED" -ne 0 ]; then
-  echo "✗ GATE FAILED (LOCAL) — at least one runtime cannot see its peers via"
-  echo "  the literal mcp_molecule_list_peers call on the local prod-mimic"
-  echo "  stack. This is the SAME user-facing failure the proxy signals were"
-  echo "  hiding, reproduced locally (far faster than EC2). Expected RED until"
-  echo "  the Hermes-401 (#162) + OpenClaw-never-online/MCP-wiring (#165)"
-  echo "  root-cause fixes land; goes green only when they actually do."
-  exit 10
-fi
-
-ok "GATE PASSED (LOCAL) — every runtime under test sees its platform peers via the literal MCP call."
-exit 0
@@ -1,301 +0,0 @@
-#!/usr/bin/env bash
-# Staging E2E — fresh-provision peer-visibility gate via the LITERAL MCP path.
-#
-# WHY THIS EXISTS
-# ---------------
-# Hermes and OpenClaw were repeatedly reported "fleet-verified / cascade-
-# complete" because the *proxy* signals were green:
-#   - registry-registration + heartbeat (Hermes), and
-#   - model round-trip 200 (OpenClaw).
-# But a freshly-provisioned workspace, asked on canvas "can you see your
-# peers", actually FAILS:
-#   - Hermes: 401 on the molecule MCP `list_peers` call,
-#   - OpenClaw: falls back to native `sessions_list`, sees no platform peers.
-# Tasks #142/#159 were even marked "completed" under this same proxy flaw.
-#
-# This script codifies the LITERAL user-facing path so it can never silently
-# regress: it provisions a brand-new throwaway org + sibling workspaces via
-# the real control-plane provisioning path, then for each runtime that should
-# have platform peer-visibility it drives the EXACT MCP call the canvas agent
-# makes — `POST /workspaces/:id/mcp` JSON-RPC tools/call name=list_peers,
-# authenticated by that workspace's own bearer token through the real
-# WorkspaceAuth + MCPRateLimiter middleware chain. It then asserts:
-#   (1) HTTP 200,
-#   (2) JSON-RPC `result` present (NOT an `error` object — a -32000
-#       "tool call failed" or a 401 from WorkspaceAuth fails here),
-#   (3) the returned peer set CONTAINS the other provisioned sibling
-#       workspace IDs — not an empty list, not a native-sessions fallback.
-#
-# This is NOT a proxy. It does not look at a registry row, /health, the
-# heartbeat table, or `GET /registry/:id/peers`. It drives the byte-for-byte
-# JSON-RPC envelope that mcp_molecule_list_peers issues from a real agent.
-#
-# It is written to FAIL on today's broken Hermes/OpenClaw behavior and go
-# green only when the in-flight root-cause fixes (Hermes-401, OpenClaw MCP
-# wiring) actually land. That is the point: it is the objective proof gate.
-#
-# AUTH MODEL (mirrors tests/e2e/test_staging_full_saas.sh)
-# --------------------------------------------------------
-#   Single MOLECULE_ADMIN_TOKEN (= CP_ADMIN_API_TOKEN on Railway staging)
-#   drives: POST /cp/admin/orgs (provision), GET
-#   /cp/admin/orgs/:slug/admin-token (per-tenant token), DELETE
-#   /cp/admin/tenants/:slug (teardown). The per-tenant admin token drives
-#   tenant workspace creation; each workspace's OWN auth_token (returned by
-#   POST /workspaces) drives its MCP call.
-#
-# Required env:
-#   MOLECULE_ADMIN_TOKEN   CP admin bearer — Railway staging CP_ADMIN_API_TOKEN
-# Optional env:
-#   MOLECULE_CP_URL        default https://staging-api.moleculesai.app
-#   E2E_RUN_ID             slug suffix; CI passes ${GITHUB_RUN_ID}
-#   PV_RUNTIMES            space list; default "hermes openclaw claude-code"
-#   E2E_PROVISION_TIMEOUT_SECS  default 1800 (hermes/openclaw cold EC2 budget)
-#   E2E_MINIMAX_API_KEY / E2E_ANTHROPIC_API_KEY / E2E_OPENAI_API_KEY
-#                          LLM provider key injected so the runtime can boot
-#   E2E_KEEP_ORG           1 → skip teardown (local debugging only)
-#
-# Exit codes:
-#   0  every runtime saw its peers via the literal MCP call
-#   1  generic failure
-#   2  missing required env
-#   3  provisioning timed out
-#   4  teardown left orphan resources
-#   10 peer-visibility regression reproduced (the gate firing as designed)
-
-set -uo pipefail
-
-# The literal MCP list_peers assertion lives in the shared, backend-
-# agnostic lib so it is BYTE-IDENTICAL between this staging backend and
-# the local docker-compose backend (tests/e2e/test_peer_visibility_mcp_
-# local.sh). Only provisioning/teardown differs per backend.
-# shellcheck source=tests/e2e/lib/peer_visibility_assert.sh
-source "$(dirname "${BASH_SOURCE[0]}")/lib/peer_visibility_assert.sh"
-
-CP_URL="${MOLECULE_CP_URL:-https://staging-api.moleculesai.app}"
-ADMIN_TOKEN="${MOLECULE_ADMIN_TOKEN:?MOLECULE_ADMIN_TOKEN required — Railway staging CP_ADMIN_API_TOKEN}"
-RUN_ID_SUFFIX="${E2E_RUN_ID:-$(date +%H%M%S)-$$}"
-PV_RUNTIMES="${PV_RUNTIMES:-hermes openclaw claude-code}"
-PROVISION_TIMEOUT_SECS="${E2E_PROVISION_TIMEOUT_SECS:-1800}"
-
-# Slug MUST start with 'e2e-' so the sweep-stale-e2e-orgs safety net
-# (EPHEMERAL_PREFIXES) catches any leak this run fails to tear down.
-SLUG="e2e-pv-$(date +%Y%m%d)-${RUN_ID_SUFFIX}"
-SLUG=$(echo "$SLUG" | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z0-9-' | head -c 32)
-
-ORG_ID=""
-TENANT_URL=""
-TENANT_TOKEN=""
-
-log()  { echo "[$(date +%H:%M:%S)] $*"; }
-fail() { echo "[$(date +%H:%M:%S)] ❌ $*" >&2; exit 1; }
-ok()   { echo "[$(date +%H:%M:%S)] ✅ $*"; }
-
-admin_call() {
-  local method="$1" path="$2"; shift 2
-  curl -sS -X "$method" "$CP_URL$path" \
-    -H "Authorization: Bearer $ADMIN_TOKEN" \
-    -H "Content-Type: application/json" "$@"
-}
-tenant_call() {
-  local method="$1" path="$2"; shift 2
-  curl -sS -X "$method" "$TENANT_URL$path" \
-    -H "Authorization: Bearer $TENANT_TOKEN" \
-    -H "X-Molecule-Org-Id: $ORG_ID" \
-    -H "Content-Type: application/json" "$@"
-}
-
-# ─── Scoped teardown ───────────────────────────────────────────────────
-# Deletes ONLY the org this run created (DELETE /cp/admin/tenants/$SLUG
-# with the {"confirm":$SLUG} fat-finger guard). Never a cluster-wide
-# sweep — honors feedback_cleanup_after_each_test and
-# feedback_never_run_cluster_cleanup_tests_on_live_platform. The
-# workflow's always() step + sweep-stale-e2e-orgs are the outer nets.
-teardown() {
-  local rc=$?
-  set +e
-  if [ "${E2E_KEEP_ORG:-0}" = "1" ]; then
-    echo ""
-    log "[teardown] E2E_KEEP_ORG=1 — leaving $SLUG for debugging (REMEMBER TO DELETE)"
-    exit $rc
-  fi
-  echo ""
-  log "[teardown] DELETE /cp/admin/tenants/$SLUG (scoped to this run only)"
-  admin_call DELETE "/cp/admin/tenants/$SLUG" --max-time 120 \
-    -d "{\"confirm\":\"$SLUG\"}" >/dev/null 2>&1
-  for j in $(seq 1 24); do
-    LIST=$(admin_call GET "/cp/admin/orgs?limit=500" 2>/dev/null)
-    LEAK=$(echo "$LIST" | python3 -c "
-import sys, json
-try: d = json.load(sys.stdin)
-except Exception: print(1); sys.exit(0)
-orgs = d if isinstance(d, list) else d.get('orgs', [])
-print(sum(1 for o in orgs if o.get('slug') == '$SLUG' and o.get('instance_status') not in ('purged',) and o.get('status') != 'purged'))
-" 2>/dev/null || echo 1)
-    if [ "$LEAK" = "0" ]; then
-      log "[teardown] ✓ $SLUG purged (after ${j}x5s)"
-      exit $rc
-    fi
-    sleep 5
-  done
-  echo "::warning::[teardown] $SLUG still present after 120s — sweep-stale-e2e-orgs will catch it within MAX_AGE_MINUTES" >&2
-  [ $rc -eq 0 ] && rc=4
-  exit $rc
-}
-trap teardown EXIT INT TERM
-
-# ─── 1. Provision the throwaway org ────────────────────────────────────
-log "1/6 POST /cp/admin/orgs — slug=$SLUG"
-CREATE=$(admin_call POST /cp/admin/orgs \
-  -d "{\"slug\":\"$SLUG\",\"name\":\"E2E peer-visibility $SLUG\",\"owner_user_id\":\"e2e-runner:$SLUG\"}")
-ORG_ID=$(echo "$CREATE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null)
-[ -n "$ORG_ID" ] || fail "org creation failed: $(echo "$CREATE" | head -c 300)"
-log "    ORG_ID=$ORG_ID"
-
-# ─── 2. Wait for tenant EC2 + DNS ──────────────────────────────────────
-log "2/6 waiting for tenant instance_status=running (cold EC2 + cloudflared)..."
-DEADLINE=$(( $(date +%s) + PROVISION_TIMEOUT_SECS ))
-while true; do
-  [ "$(date +%s)" -gt "$DEADLINE" ] && fail "tenant never came up within ${PROVISION_TIMEOUT_SECS}s"
-  STATUS=$(admin_call GET "/cp/admin/orgs?limit=500" 2>/dev/null | python3 -c "
-import sys, json
-try: d = json.load(sys.stdin)
-except Exception: sys.exit(0)
-orgs = d if isinstance(d, list) else d.get('orgs', [])
-for o in orgs:
-    if o.get('slug') == '$SLUG':
-        print(o.get('instance_status') or o.get('status') or 'unknown'); break
-" 2>/dev/null)
-  case "$STATUS" in running|online|ready) break ;; esac
-  sleep 10
-done
-log "    tenant status=$STATUS"
-
-# ─── 3. Per-tenant admin token + tenant URL ────────────────────────────
-log "3/6 fetching per-tenant admin token..."
-TT_RESP=$(admin_call GET "/cp/admin/orgs/$SLUG/admin-token")
-TENANT_TOKEN=$(echo "$TT_RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('admin_token',''))" 2>/dev/null)
-[ -n "$TENANT_TOKEN" ] || fail "tenant token fetch failed: $(echo "$TT_RESP" | head -c 200)"
-
-CP_HOST=$(echo "$CP_URL" | sed -E 's#^https?://##; s#/.*$##')
-case "$CP_HOST" in
-  api.*)         DERIVED_DOMAIN="${CP_HOST#api.}" ;;
-  staging-api.*) DERIVED_DOMAIN="staging.${CP_HOST#staging-api.}" ;;
-  *)             DERIVED_DOMAIN="$CP_HOST" ;;
-esac
-TENANT_URL="https://${SLUG}.${DERIVED_DOMAIN}"
-log "    tenant url: $TENANT_URL"
-
-log "3b. waiting for tenant /health (TLS/DNS, up to 10min)..."
-for i in $(seq 1 120); do
-  curl -fsS "$TENANT_URL/health" -m 5 -k >/dev/null 2>&1 && { log "    /health ok (attempt $i)"; break; }
-  sleep 5
-done
-
-# ─── 4. Provision the parent + one sibling per runtime under test ──────
-# Inject the LLM provider key so each runtime can authenticate at boot.
-# Priority: MiniMax → direct-Anthropic → OpenAI (mirrors
-# test_staging_full_saas.sh's secrets-injection chain).
-SECRETS_JSON='{}'
-if [ -n "${E2E_MINIMAX_API_KEY:-}" ]; then
-  SECRETS_JSON=$(python3 -c "import json,os;k=os.environ['E2E_MINIMAX_API_KEY'];print(json.dumps({'ANTHROPIC_BASE_URL':'https://api.minimax.io/anthropic','ANTHROPIC_AUTH_TOKEN':k,'MINIMAX_API_KEY':k}))")
-elif [ -n "${E2E_ANTHROPIC_API_KEY:-}" ]; then
-  SECRETS_JSON=$(python3 -c "import json,os;k=os.environ['E2E_ANTHROPIC_API_KEY'];print(json.dumps({'ANTHROPIC_API_KEY':k}))")
-elif [ -n "${E2E_OPENAI_API_KEY:-}" ]; then
-  SECRETS_JSON=$(python3 -c "import json,os;k=os.environ['E2E_OPENAI_API_KEY'];print(json.dumps({'OPENAI_API_KEY':k,'OPENAI_BASE_URL':'https://api.openai.com/v1','MODEL_PROVIDER':'openai:gpt-4o','HERMES_INFERENCE_PROVIDER':'custom','HERMES_CUSTOM_BASE_URL':'https://api.openai.com/v1','HERMES_CUSTOM_API_KEY':k,'HERMES_CUSTOM_API_MODE':'chat_completions'}))")
-fi
-
-log "4/6 provisioning parent (claude-code) + one sibling per runtime under test..."
-P_RESP=$(tenant_call POST /workspaces \
-  -d "{\"name\":\"pv-parent\",\"runtime\":\"claude-code\",\"tier\":3,\"secrets\":$SECRETS_JSON}")
-PARENT_ID=$(echo "$P_RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null)
-[ -n "$PARENT_ID" ] || fail "parent create failed: $(echo "$P_RESP" | head -c 300)"
-log "    PARENT_ID=$PARENT_ID"
-
-# WS_IDS[runtime]=id ; WS_TOKENS[runtime]=auth_token (the MCP bearer)
-declare -A WS_IDS WS_TOKENS
-ALL_WS_IDS="$PARENT_ID"
-for rt in $PV_RUNTIMES; do
-  R=$(tenant_call POST /workspaces \
-    -d "{\"name\":\"pv-$rt\",\"runtime\":\"$rt\",\"tier\":2,\"parent_id\":\"$PARENT_ID\",\"secrets\":$SECRETS_JSON}")
-  WID=$(echo "$R" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null)
-  # auth_token is top-level for container runtimes; external-like nest it
-  # under connection.auth_token (verified vs staging response shape).
-  WTOK=$(echo "$R" | python3 -c "
-import sys, json
-try: d = json.load(sys.stdin)
-except Exception: print(''); sys.exit(0)
-print(d.get('auth_token') or d.get('connection', {}).get('auth_token') or '')
-" 2>/dev/null)
-  [ -n "$WID" ] || fail "$rt workspace create failed: $(echo "$R" | head -c 300)"
-  [ -n "$WTOK" ] || fail "$rt workspace did not return an auth_token — cannot drive its MCP call (resp: $(echo "$R" | head -c 300))"
-  WS_IDS[$rt]="$WID"
-  WS_TOKENS[$rt]="$WTOK"
-  ALL_WS_IDS="$ALL_WS_IDS $WID"
-  log "    $rt → $WID"
-done
-
-# ─── 5. Wait for every sibling online ──────────────────────────────────
-log "5/6 waiting for all workspaces status=online (up to ${PROVISION_TIMEOUT_SECS}s — cold boot)..."
-WS_DEADLINE=$(( $(date +%s) + PROVISION_TIMEOUT_SECS ))
-for rt in $PV_RUNTIMES; do
-  wid="${WS_IDS[$rt]}"
-  LAST=""
-  while true; do
-    [ "$(date +%s)" -gt "$WS_DEADLINE" ] && fail "$rt ($wid) never reached online (last=$LAST)"
-    S=$(tenant_call GET "/workspaces/$wid" 2>/dev/null | python3 -c "
-import sys, json
-try: d = json.load(sys.stdin)
-except Exception: sys.exit(0)
-w = d.get('workspace') if isinstance(d.get('workspace'), dict) else d
-print(w.get('status') or '')
-" 2>/dev/null)
-    [ "$S" != "$LAST" ] && { log "    $rt → $S"; LAST="$S"; }
-    case "$S" in
-      online) break ;;
-      failed) sleep 10 ;;   # transient: bootstrap-watcher 5-min deadline, heartbeat recovers
-      *)      sleep 10 ;;
-    esac
-  done
-  ok "    $rt online"
-done
-
-# ─── 6. THE GATE — literal mcp_molecule_list_peers via POST /:id/mcp ────
-# This is the byte-for-byte user-facing call. NOT GET /registry/:id/peers,
-# NOT /health, NOT the heartbeat table. JSON-RPC 2.0 tools/call,
-# name=list_peers, authenticated by the workspace's OWN bearer token
-# through WorkspaceAuth + MCPRateLimiter.
-log "6/6 driving the LITERAL list_peers MCP call per runtime..."
-echo ""
-REGRESSED=0
-declare -A VERDICT
-
-for rt in $PV_RUNTIMES; do
-  wid="${WS_IDS[$rt]}"
-  wtok="${WS_TOKENS[$rt]}"
-  # Byte-identical assertion via the shared lib. Staging passes ORG_ID as
-  # the X-Molecule-Org-Id header value; the literal MCP call + every
-  # anti-proxy / anti-native-fallback guarantee is the SAME code the
-  # local backend runs.
-  PV_VERDICT=""
-  pv_assert_runtime "$rt" "$wid" "$wtok" "$TENANT_URL" "$ORG_ID" "$ALL_WS_IDS" || REGRESSED=1
-  VERDICT[$rt]="$PV_VERDICT"
-  echo ""
-done
-
-echo "=== SUMMARY — fresh-provision peer-visibility (literal MCP list_peers) ==="
-for rt in $PV_RUNTIMES; do
-  printf '  %-14s %s\n' "$rt" "${VERDICT[$rt]:-NO_RUN}"
-done
-echo ""
-
-if [ "$REGRESSED" -ne 0 ]; then
-  echo "✗ GATE FAILED — at least one runtime cannot see its peers via the"
-  echo "  literal mcp_molecule_list_peers call. This is the real user-facing"
-  echo "  failure the proxy signals (registry row / heartbeat / model 200)"
-  echo "  were hiding. Expected RED until the Hermes-401 + OpenClaw-MCP-wiring"
-  echo "  root-cause fixes land; goes green only when they actually do."
-  exit 10
-fi
-
-ok "GATE PASSED — every runtime under test sees its platform peers via the literal MCP call."
-exit 0
@@ -1,35 +0,0 @@
-// Command t4-contract-dump prints the T4 privilege contract as YAML.
-//
-// Usage:
-//
-//	go run ./workspace-server/cmd/t4-contract-dump > t4_capabilities.yaml
-//
-// This is the seam that template-repo CI workflows consume:
-//
-//	- Template CI fetches molecule-core at pinned ref
-//	- Runs `go run ./workspace-server/cmd/t4-contract-dump` to produce
-//	  t4_capabilities.yaml
-//	- Iterates capabilities and runs each Probe inside a freshly-built
-//	  privileged container
-//	- Aggregates structured pass/fail; fails the gate on any hard miss.
-//
-// Keeping this trivial and pure-stdlib means a fork user does not need
-// a Molecule-AI Gitea token or any internal infrastructure to consume
-// the contract — `go run` against molecule-core's public source is
-// enough.
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/provisioner"
-)
-
-func main() {
-	caps := provisioner.T4PrivilegeContract()
-	if _, err := os.Stdout.WriteString(provisioner.AsYAML(caps)); err != nil {
-		fmt.Fprintln(os.Stderr, "t4-contract-dump: write failed:", err)
-		os.Exit(1)
-	}
-}
@@ -1,160 +0,0 @@
-package handlers
-
-// Regression coverage for the POLL-mode arm of the canvas user-message
-// data-loss bug (internal#470 sibling — tracked on internal#471).
-//
-// Bug (reported 2026-05-16 by CTO Hongming): "in canvas i sometimes lose
-// my own message when i exit chat". The push-mode arm was fixed by
-// #1347 (persistUserMessageAtIngest — a SYNCHRONOUS, before-dispatch,
-// context.WithoutCancel INSERT). #1347's framing asserted "poll-mode
-// workspaces were never affected — logA2AReceiveQueued already persists
-// at ingest". That assertion is OVERSTATED.
-//
-// Hongming's tenant (slug `hongming`, org 2c940477-...) has 4 workspaces,
-// ALL runtime=external with empty URL → ALL delivery_mode=poll (proven
-// empirically: a benign A2A probe returns the synthetic
-// {"delivery_mode":"poll","status":"queued"} envelope for every one).
-// So his reported loss is the POLL path, NOT the push path #1347 fixes.
-//
-// Root cause (poll arm): the poll-mode short-circuit (a2a_proxy.go ~402)
-// calls logA2AReceiveQueued and then IMMEDIATELY returns the synthetic
-// 200 {status:"queued"} to the canvas. But logA2AReceiveQueued's durable
-// INSERT runs inside h.goAsync(...) — a DETACHED goroutine with NO
-// happens-before barrier against the HTTP response. The canvas sees 200
-// ("message accepted") while the activity_logs row may not yet be — and,
-// on a workspace-server restart / deploy / OOM / EC2 hibernation between
-// the 200 and the goroutine's commit, NEVER will be — durable. There is
-// also no fallback (unlike push-mode's legacy-INSERT fallback): a
-// swallowed LogActivity error loses the message with only a log line.
-// Chat-history reads activity_logs (postgres_store.go:165-187); a missing
-// row = message gone on reopen. That is exactly Hongming's symptom.
-//
-// Fix (parity with push-mode): the poll-mode ingest persist of the
-// canvas user message must be SYNCHRONOUS — committed before the queued
-// 200 is returned — on a context.WithoutCancel derived context, so a
-// client disconnect on chat-exit and a post-response restart cannot lose
-// it. Behavior is never worse than today (best-effort; a persist error
-// still returns queued).
-//
-// TEST DESIGN NOTE: sqlmock.ExpectationsWereMet() hangs indefinitely if
-// the expected query never fires. We use a select+default+time.After
-// pattern so the test FAILS fast (not hangs) when the production code
-// regresses to async (the INSERT never fires before handler returns),
-// while still returning promptly when all expectations are met. The
-// insertDelay is kept small (50ms) to minimise suite-level timing
-// impact under -race detection, where mock delays are amplified by
-// the instrumenter's goroutine overhead.
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/gin-gonic/gin"
-)
-
-// TestProxyA2A_PollMode_PersistsUserMessageSynchronouslyBeforeQueuedResponse
-// is the defining contract: for a poll-mode workspace, the canvas user
-// message MUST be durably INSERTed into activity_logs BEFORE the synthetic
-// queued 200 is returned to the client — with NO reliance on a detached
-// async goroutine completing later.
-//
-// The test proves the ordering by making the INSERT block briefly and
-// asserting the handler does NOT return until the INSERT has completed.
-// Pre-fix (INSERT in h.goAsync, response returned immediately) the
-// handler returns ~instantly while the INSERT is still pending in the
-// goroutine → the elapsed time is far below the injected INSERT delay and
-// ExpectationsWereMet() is racy/unmet at return. Post-fix (synchronous
-// persist before the queued response) the handler return is gated on the
-// INSERT, so elapsed >= the injected delay and the expectation is met
-// deterministically at return WITHOUT any waitAsyncForTest()/sleep.
-func TestProxyA2A_PollMode_PersistsUserMessageSynchronouslyBeforeQueuedResponse(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
-
-	const wsID = "ws-poll-sync-persist"
-	// Keep delay small: -race detection amplifies mock delays significantly.
-	// A 50ms delay is sufficient to prove synchronous blocking (~50× the
-	// normal INSERT latency) without bloating the full ./... suite runtime.
-	const insertDelay = 50 * time.Millisecond
-
-	expectBudgetCheck(mock, wsID)
-
-	// lookupDeliveryMode → poll, triggering the short-circuit.
-	mock.ExpectQuery("SELECT delivery_mode FROM workspaces WHERE id").
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"delivery_mode"}).AddRow("poll"))
-
-	// workspace-name lookup inside logA2AReceiveQueued.
-	mock.ExpectQuery(`SELECT name FROM workspaces WHERE id`).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("Poll WS"))
-
-	// The durable user-message write. We delay it so a synchronous
-	// persist visibly gates the handler return; a detached-goroutine
-	// persist (pre-fix) does not. The fix must keep using
-	// context.WithoutCancel so this write survives a chat-exit cancel.
-	mock.ExpectExec("INSERT INTO activity_logs").
-		WillDelayFor(insertDelay).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: wsID}}
-
-	// callerID == "" (no X-Workspace-ID) → this is a canvas_user message,
-	// exactly Hongming's case.
-	body := `{"jsonrpc":"2.0","id":"poll-canvas-1","method":"message/send","params":{"message":{"role":"user","parts":[{"text":"my own message"}]}}}`
-	c.Request = httptest.NewRequest("POST", "/workspaces/"+wsID+"/a2a", bytes.NewBufferString(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	start := time.Now()
-	handler.ProxyA2A(c)
-	elapsed := time.Since(start)
-
-	// Defining assertion #1: the handler must not have returned the
-	// queued response before the durable INSERT committed. Pre-fix this
-	// fails (elapsed ≈ 0, INSERT still racing in goAsync).
-	if elapsed < insertDelay {
-		t.Fatalf("poll-mode queued response returned in %v, before the %v user-message INSERT — "+
-			"the message is not durable when the client/process goes away (DATA LOSS). "+
-			"Persist must be synchronous before the queued 200.", elapsed, insertDelay)
-	}
-
-	// Defining assertion #2: the durable write actually happened by the
-	// time the handler returned. ExpectionsWereMet() hangs indefinitely if
-	// the mock never fires (e.g. production code regressed to async),
-	// so we check it in a goroutine with a hard 2s timeout — fails fast
-	// (no CI hang) on regression while returning promptly on success.
-	expectDone := make(chan error, 1)
-	go func() { expectDone <- mock.ExpectationsWereMet() }()
-	select {
-	case err := <-expectDone:
-		if err != nil {
-			t.Fatalf("user-message INSERT was not durable at handler return (unmet sqlmock expectations): %v", err)
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatalf("ExpectationsWereMet() hung for >2s — INSERT mock never fired. " +
-			"Likely cause: production code regressed logA2AReceiveQueued to goAsync " +
-			"(INSERT fires after handler returns, not before).")
-	}
-
-	// Sanity: still the correct poll-mode envelope + status.
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200 (queued), got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("response is not valid JSON: %v", err)
-	}
-	if resp["status"] != "queued" || resp["delivery_mode"] != "poll" {
-		t.Errorf("poll envelope changed: got status=%v delivery_mode=%v, want queued/poll",
-			resp["status"], resp["delivery_mode"])
-	}
-}
@@ -97,28 +97,28 @@ const maxProxyResponseBody = 10 << 20
 //
 // Timeout model — three independent budgets, none of which gets in each other's way:
 //
-//  1. Client.Timeout — DELIBERATELY UNSET. Client.Timeout is a hard wall on
-//     the entire request including streamed body reads, and would pre-empt
-//     legitimate slow cold-start flows (Claude Code first-token over OAuth
-//     can take 30-60s on boot; long-running agent synthesis can stream
-//     tokens for minutes). Total-request budget is enforced per-request
-//     via context deadline (canvas = idle-only, agent-to-agent = 30 min ceiling).
+//   1. Client.Timeout — DELIBERATELY UNSET. Client.Timeout is a hard wall on
+//      the entire request including streamed body reads, and would pre-empt
+//      legitimate slow cold-start flows (Claude Code first-token over OAuth
+//      can take 30-60s on boot; long-running agent synthesis can stream
+//      tokens for minutes). Total-request budget is enforced per-request
+//      via context deadline (canvas = idle-only, agent-to-agent = 30 min ceiling).
 //
-//  2. Transport.DialContext — 10s connect timeout. When a workspace's EC2
-//     black-holes TCP connects (instance terminated mid-flight, security group
-//     flipped, NACL bug), the OS default is 75s on Linux / 21s on macOS — long
-//     enough that Cloudflare's ~100s edge timeout can fire first and surface
-//     a generic 502 page to canvas. 10s is well above realistic intra-region
-//     latencies and well below CF's edge timeout.
+//   2. Transport.DialContext — 10s connect timeout. When a workspace's EC2
+//      black-holes TCP connects (instance terminated mid-flight, security group
+//      flipped, NACL bug), the OS default is 75s on Linux / 21s on macOS — long
+//      enough that Cloudflare's ~100s edge timeout can fire first and surface
+//      a generic 502 page to canvas. 10s is well above realistic intra-region
+//      latencies and well below CF's edge timeout.
 //
-//  3. Transport.ResponseHeaderTimeout — 180s default. From request-body-end
-//     to response-headers-start. Configurable via
-//     A2A_PROXY_RESPONSE_HEADER_TIMEOUT (envx.Duration). Covers cold-start
-//     first-byte (30-60s OAuth flow above) with enough room for Opus agent
-//     turns (big context + internal delegate_task round-trips routinely exceed
-//     the old 60s ceiling). Body streaming after headers is governed by the
-//     per-request context deadline, NOT this timeout — so multi-minute agent
-//     responses still work fine.
+//   3. Transport.ResponseHeaderTimeout — 180s default. From request-body-end
+//      to response-headers-start. Configurable via
+//      A2A_PROXY_RESPONSE_HEADER_TIMEOUT (envx.Duration). Covers cold-start
+//      first-byte (30-60s OAuth flow above) with enough room for Opus agent
+//      turns (big context + internal delegate_task round-trips routinely exceed
+//      the old 60s ceiling). Body streaming after headers is governed by the
+//      per-request context deadline, NOT this timeout — so multi-minute agent
+//      responses still work fine.
 //
 // The point of (2) and (3) is to surface a *structured* 503 from
 // handleA2ADispatchError when the workspace agent is unreachable, so canvas
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Molecule AI Dev Engineer B (MiniMax)	d1d9da57e7	test(handlers): add ExpectationsWereMet check to makeTokenHandler cleanup (PR #1460 ) Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 5s Details CI / Detect changes (pull_request) Successful in 7s Details Harness Replays / detect-changes (pull_request) Successful in 4s Details Handlers Postgres Integration / detect-changes (pull_request) Successful in 8s Details Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 7s Details E2E API Smoke Test / detect-changes (pull_request) Successful in 19s Details E2E Chat / detect-changes (pull_request) Successful in 18s Details Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 8s Details gate-check-v3 / gate-check (pull_request_target) Successful in 3s Details sop-checklist / all-items-acked (pull_request) acked: 1/7 — missing: local-postgres-e2e, staging-smoke, root-cause, +3 — body-unfilled: comprehensive-testing, local-postgres-e2e, staging- Details sop-checklist / na-declarations (pull_request) N/A: (none) Details sop-checklist / all-items-acked (pull_request_target) Successful in 3s Details sop-tier-check / tier-check (pull_request_target) Successful in 4s Details qa-review / approved (pull_request_target) Successful in 7s Details security-review / approved (pull_request_target) Successful in 7s Details lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m1s Details CI / Shellcheck (E2E scripts) (pull_request) Successful in 9s Details Harness Replays / Harness Replays (pull_request) Successful in 3s Details Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Failing after 39s Details Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m7s Details E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 59s Details E2E Chat / E2E Chat (pull_request) Failing after 23s Details CI / Platform (Go) (pull_request) Failing after 3m55s Details CI / Canvas (Next.js) (pull_request) Successful in 6m27s Details CI / Canvas Deploy Reminder (pull_request) Has been skipped Details CI / Python Lint & Test (pull_request) Successful in 6m30s Details CI / all-required (pull_request) Successful in 1s Details Per agent-reviewer REQUEST_CHANGES #7034: the new sqlmock expectations were never verified with ExpectationsWereMet, so missing SELECT/INSERT calls could pass silently. Adding the check to the makeTokenHandler cleanup covers all 4 tests that use sqlmock via the shared helper (TestGetTestToken_AdminTokenRequired_CorrectToken, TestGetTestToken_WorkspaceNotFound, TestGetTestToken_IssueTokenDBError, TestGetTestToken_ResponseContainsToken). The 3 tests that don't use sqlmock (DisabledByDefault, AdminTokenRequired_WrongToken, AdminTokenRequired_MissingBearer) get the helper but the check is a no-op for them — they early-exit on status code without hitting the DB. Closes PR #1460 review blocker.	2026-06-03 22:18:12 +00:00
fullstack-engineer	fd94163e00	test(handlers): add sqlmock suite for AdminTestTokenHandler CI / Canvas Deploy Reminder (pull_request) Blocked by required conditions Details CI / Shellcheck (E2E scripts) (pull_request) Blocked by required conditions Details CI / Python Lint & Test (pull_request) Blocked by required conditions Details audit-force-merge / audit (pull_request) Has been skipped Details cascade-list-drift-gate / check (pull_request) Successful in 16s Details Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 16s Details CI / Detect changes (pull_request) Successful in 22s Details E2E API Smoke Test / detect-changes (pull_request) Successful in 28s Details E2E Chat / detect-changes (pull_request) Successful in 22s Details MCP Stdio Transport Regression / MCP stdio with regular-file stdout (pull_request) Successful in 1m56s Details Handlers Postgres Integration / detect-changes (pull_request) Successful in 15s Details Harness Replays / detect-changes (pull_request) Successful in 9s Details Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 11s Details lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m28s Details lint-mask-pr-atomicity / lint-mask-pr-atomicity (pull_request) Failing after 1m29s Details Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m22s Details lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m37s Details CI / Platform (Go) (pull_request) Failing after 5m29s Details lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m19s Details publish-runtime-autobump / bump-and-tag (pull_request) Has been skipped Details Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 17s Details Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s Details publish-runtime-autobump / pr-validate (pull_request) Successful in 38s Details gate-check-v3 / gate-check (pull_request) Successful in 8s Details qa-review / approved (pull_request) Successful in 5s Details CI / Canvas (Next.js) (pull_request) Successful in 6m20s Details security-review / approved (pull_request) Successful in 4s Details sop-checklist / na-declarations (pull_request) N/A: (none) Details Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m39s Details sop-checklist / all-items-acked (pull_request) Successful in 7s Details sop-tier-check / tier-check (pull_request) Successful in 6s Details Ops Scripts Tests / Ops scripts (unittest) (pull_request) Successful in 1m13s Details E2E Chat / E2E Chat (pull_request) Failing after 15s Details Harness Replays / Harness Replays (pull_request) Successful in 8s Details E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m39s Details Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Failing after 1m3s Details Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2m11s Details CI / all-required (pull_request) Has been cancelled Details TestTokensEnabled(): - true when MOLECULE_ENABLE_TEST_TOKENS=1 (overrides production lock) - false when MOLECULE_ENV=production - true when MOLECULE_ENV=staging (not "production") - true when MOLECULE_ENV="" (local dev default) GetTestToken(): - 404 when disabled (MOLECULE_ENV=production) - 401 when ADMIN_TOKEN set but wrong/missing - 200 + auth_token when admin token correct - 404 when workspace not found - 500 when token issue DB fails Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-18 00:39:25 +00:00