fix(uploads): bump poll-mode size_bytes CHECK to 100MB to match push-mode (mc#1588) (#1589 )

PR #1589 � fix(uploads): bump poll-mode size_bytes CHECK to 100MB (mc#1588 follow-up) Completes the poll-mode side of the 25?100MB upload cap raise. Storage cap + migration + tests + python ingest tweaks; chat_files.go doc-comment hunk dropped post-rebase as redundant with mc#1588. 3 non-author APPROVEs from core-qa + core-security + core-devops on the rebased head 5918031. Co-authored-by: Molecule AI · core-be <core-be@agents.moleculesai.app> Co-committed-by: Molecule AI · core-be <core-be@agents.moleculesai.app>
fix(ci): add confirm:true to redeploy-fleet callers (cp#228 contract) (#1595 )
2026-05-20 09:08:27 +00:00 · 2026-05-20 08:15:06 +00:00 · 2026-05-20 07:58:35 +00:00 · 2026-05-20 00:47:10 -07:00 · 2026-05-20 00:43:00 -07:00 · 2026-05-20 00:35:38 -07:00
255 changed files with 17391 additions and 3681 deletions
@@ -65,6 +65,11 @@ class ApiError(RuntimeError):
    pass


+class MergePermissionError(ApiError):
+    """Merge failed with a permanent permission error (403/404/405).
+    The queue should skip this PR and move to the next one."""
+
+
@dataclasses.dataclass(frozen=True)
 class MergeDecision:
    ready: bool
@@ -148,15 +153,38 @@ def latest_statuses_by_context(statuses: list[dict]) -> dict[str, dict]:
    return latest


+def _is_tier_low_pending_ok(
+    latest_statuses: dict[str, dict],
+    context: str,
+    pr_labels: set[str],
+) -> bool:
+    """Return True if tier:low PR can tolerate sop-checklist pending state.
+
+    Per sop-checklist-config.yaml tier_failure_mode, tier:low uses soft-fail:
+    sop-checklist posts state=pending when acks are satisfied (missing
+    manager/ceo acks are informational only). The queue should accept
+    pending instead of waiting for success.
+    """
+    if "tier:low" not in pr_labels:
+        return False
+    if "sop-checklist" not in context:
+        return False
+    status = latest_statuses.get(context) or {}
+    return status_state(status) == "pending"
+
+
 def required_contexts_green(
    latest_statuses: dict[str, dict],
    contexts: list[str],
+    pr_labels: set[str] | None = None,
 ) -> tuple[bool, list[str]]:
    missing_or_bad: list[str] = []
    for context in contexts:
        status = latest_statuses.get(context)
        state = status_state(status or {})
        if state != "success":
+            if pr_labels and _is_tier_low_pending_ok(latest_statuses, context, pr_labels):
+                continue  # tier:low soft-fail: accept pending sop-checklist
            missing_or_bad.append(f"{context}={state or 'missing'}")
    return not missing_or_bad, missing_or_bad

@@ -209,6 +237,7 @@ def evaluate_merge_readiness(
    pr_status: dict,
    required_contexts: list[str],
    pr_has_current_base: bool,
+    pr_labels: set[str] | None = None,
 ) -> MergeDecision:
    # Check push-required contexts explicitly instead of combined state.
    # Combined state can be "failure" due to non-blocking jobs
@@ -228,7 +257,7 @@ def evaluate_merge_readiness(
    # The required_contexts list is the authoritative gate — it includes only
    # the checks that actually block merges.
    latest = latest_statuses_by_context(pr_status.get("statuses") or [])
-    ok, missing_or_bad = required_contexts_green(latest, required_contexts)
+    ok, missing_or_bad = required_contexts_green(latest, required_contexts, pr_labels)
    if not ok:
        return MergeDecision(False, "wait", "required contexts not green: " + ", ".join(missing_or_bad))
    return MergeDecision(True, "merge", "ready")
@@ -253,27 +282,32 @@ def get_combined_status(sha: str) -> dict:
    _, combined = api("GET", f"/repos/{OWNER}/{NAME}/commits/{sha}/status")
    if not isinstance(combined, dict):
        raise ApiError(f"status for {sha} response not object")
-    # Fetch full statuses list; 200 covers >99% of real-world runs.
-    # The list is ordered ascending by id (oldest first) — callers must
-    # iterate in reverse to get the newest entry per context.
-    # Best-effort: large repos (main with 550+ statuses) may time out.
-    # On timeout, fall back to the statuses[] already in the combined
-    # response (usually 30 entries — enough for most PRs, enough for
-    # main's early push-required contexts).
+    combined_statuses: list[dict] = combined.get("statuses") or []
    try:
-        _, all_statuses = api(
+        _, all_statuses_raw = api(
            "GET",
            f"/repos/{OWNER}/{NAME}/commits/{sha}/statuses",
            query={"limit": "50"},
        )
-        if isinstance(all_statuses, list):
-            combined["statuses"] = all_statuses
+        if isinstance(all_statuses_raw, list):
+            all_statuses: list[dict] = list(all_statuses_raw)
+        else:
+            all_statuses = []
    except (ApiError, urllib.error.URLError, TimeoutError, OSError) as exc:
-        # URLError covers network-level failures (DNS, refused, timeout).
-        # TimeoutError and OSError cover socket-level timeouts.
        sys.stderr.write(f"::warning::could not fetch full statuses list for {sha[:8]}: {exc}\n")
-        # Fall back to the statuses[] already in the combined response.
-        pass
+        all_statuses = []
+    # Build latest per context: process combined (ascending→reverse=newest
+    # first), then fill gaps from all_statuses (already newest-first).
+    latest: dict[str, dict] = {}
+    for status in reversed(sorted(combined_statuses, key=lambda s: s.get("id") or 0)):
+        ctx = status.get("context")
+        if isinstance(ctx, str) and ctx not in latest:
+            latest[ctx] = status
+    for status in all_statuses:
+        ctx = status.get("context")
+        if isinstance(ctx, str) and ctx not in latest:
+            latest[ctx] = status
+    combined["statuses"] = list(latest.values())
    return combined


@@ -284,8 +318,7 @@ def list_queued_issues() -> list[dict]:
        query={
            "state": "open",
            "type": "pulls",
-            # NOTE: Gitea 1.22.6 uses `label` (singular), not `labels` (plural).
-            "label": QUEUE_LABEL,
+            "labels": QUEUE_LABEL,
            "limit": "50",
        },
    )
@@ -339,7 +372,16 @@ def merge_pull(pr_number: int, *, dry_run: bool) -> None:
    print(f"::notice::merging PR #{pr_number}")
    if dry_run:
        return
-    api("POST", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/merge", body=payload, expect_json=False)
+    try:
+        api("POST", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/merge", body=payload, expect_json=False)
+    except ApiError as exc:
+        # Re-raise permission-like errors so process_once can skip this PR.
+        # 403 = no push access, 404 = repo/pr not found, 405 = not allowed.
+        msg = str(exc)
+        for code in ("403", "404", "405"):
+            if code in msg:
+                raise MergePermissionError(msg) from exc
+        raise  # re-raise other ApiErrors unchanged


 def process_once(*, dry_run: bool = False) -> int:
@@ -381,11 +423,13 @@ def process_once(*, dry_run: bool = False) -> int:
    commits = get_pull_commits(pr_number)
    current_base = pr_has_current_base(pr, commits, main_sha)
    pr_status = get_combined_status(head_sha)
+    pr_labels = label_names(pr)
    decision = evaluate_merge_readiness(
        main_status=main_status,
        pr_status=pr_status,
        required_contexts=contexts,
        pr_has_current_base=current_base,
+        pr_labels=pr_labels,
    )

    print(f"::notice::PR #{pr_number} decision={decision.action}: {decision.reason}")
@@ -408,7 +452,25 @@ def process_once(*, dry_run: bool = False) -> int:
                "deferring to next tick"
            )
            return 0
-        merge_pull(pr_number, dry_run=dry_run)
+        try:
+            merge_pull(pr_number, dry_run=dry_run)
+        except MergePermissionError as exc:
+            # Permanent merge failure (HTTP 403/404/405). Post a comment so
+            # maintainers know why, then return 0 so this tick is done.
+            # The PR stays in the queue; future ticks can retry after the
+            # permission issue is resolved.
+            sys.stderr.write(f"::error::merge permission error for PR #{pr_number}: {exc}\n")
+            post_comment(
+                pr_number,
+                (
+                    "merge-queue: merge failed with HTTP 405 'User not allowed to merge PR'. "
+                    "No available token has Can-merge permission on this repo. "
+                    "Fix: grant Can-merge to a token, or add a maintain/admin collaborator. "
+                    "Skipping to next queued PR on next tick."
+                ),
+                dry_run=dry_run,
+            )
+            return 0
        return 0
    return 0

@@ -218,6 +218,31 @@ def is_red(status: dict) -> tuple[bool, list[dict]]:

    `failed_statuses` is the list of per-context entries whose own
    `state` is in the red set; useful for the issue body.
+
+    Cancel-cascade filter (mc#1564, 2026-05-19):
+      Gitea maps BOTH `action_run.status=2 (Failure)` AND
+      `action_run.status=3 (Cancelled)` to commit-status string
+      `"failure"`. On a busy main with
+      `concurrency: cancel-in-progress: true`, every merge burst
+      cancels prior in-flight runs (status=3) — those bubble to the
+      combined-status `failure` and inflate the watchdog's red%,
+      generating phantom `[main-red]` issues (mc#1562/#1552/#1540/...).
+      Canonical Gitea 1.22.6 enum per `models/actions/status.go` +
+      `reference_gitea_action_status_enum_corrected_2026_05_19`:
+          1=Success, 2=Failure, 3=Cancelled, 4=Skipped,
+          5=Waiting, 6=Running, 7=Blocked
+      We only want status=2 (real defects) to file. At the
+      commit-status layer we don't have the integer enum directly
+      (only the `failure` rollup string), so we use the description
+      string Gitea writes when a run is cancelled — empirically
+      `"Has been cancelled"` (verified 2026-05-19 via #1562 body).
+      Real failures show `"Failing after Ns"` and are unaffected.
+      This is option B from mc#1564 (description-string filter, no
+      extra API call). Description-string stability is a soft contract
+      with Gitea; if a future release renames it, the cancel-cascade
+      entries will simply leak back through (visible-not-silent), and
+      we'll either re-pin the string or upgrade to option A (resolve
+      the underlying action_run.status integer via target_url).
    """
    combined = status.get("state")
    statuses = status.get("statuses") or []
@@ -233,11 +258,30 @@ def is_red(status: dict) -> tuple[bool, list[dict]]:
    def _entry_state(s: dict) -> str:
        return s.get("status") or s.get("state") or ""

+    def _is_cancel_cascade(s: dict) -> bool:
+        """status=3 entry per Gitea 1.22.6 description-string contract.
+        Match exactly (after strip) — substring match would catch
+        legitimate test names like "Has been cancelled by the user
+        unexpectedly" in failure logs."""
+        desc = (s.get("description") or "").strip()
+        return desc == "Has been cancelled"
+
    failed = [
        s for s in statuses
-        if isinstance(s, dict) and _entry_state(s) in red_states
+        if isinstance(s, dict)
+        and _entry_state(s) in red_states
+        and not _is_cancel_cascade(s)
    ]
-    return (combined in red_states or bool(failed), failed)
+    # Combined state alone is no longer sufficient — combined=failure
+    # may be 100% cancel-cascade. Drive `red` off the FILTERED list:
+    # if every red-shaped per-entry was cancel-cascade, `failed` is
+    # empty and we report green. Combined-failure with no per-entry
+    # detail (empty `statuses[]`) still trips red — that's the
+    # "CI emitter set combined-status directly" edge case from
+    # render_body's fallback path; we keep filing on it so the
+    # operator sees the breadcrumb.
+    combined_red_no_detail = combined in red_states and not statuses
+    return (bool(failed) or combined_red_no_detail, failed)


 # --------------------------------------------------------------------------
@@ -71,6 +71,12 @@ def build_plan(env: dict[str, str]) -> dict:
        "soak_seconds": _int_env(env, "PROD_AUTO_DEPLOY_SOAK_SECONDS", 60, minimum=0),
        "batch_size": _int_env(env, "PROD_AUTO_DEPLOY_BATCH_SIZE", 3),
        "dry_run": truthy_flag(env.get("PROD_AUTO_DEPLOY_DRY_RUN", "")),
+        # confirm:true ack required by CP /cp/admin/tenants/redeploy-fleet
+        # contract (cp#228 / task #308) for fleet-wide intent. Empty body
+        # / {confirm:false} / {only_slugs:[]} → 400. This caller is the
+        # production auto-deploy step that rolls every live tenant (canary
+        # + fan-out), no slug scoping, so confirm:true is correct.
+        "confirm": True,
    }
    if canary_slug:
        body["canary_slug"] = canary_slug
@@ -100,11 +100,12 @@ printf 'header = "Authorization: token %s"\n' "$GITEA_TOKEN" > "$CURL_AUTH_FILE"
 # (bash trap 'function' EXIT expands variables at trap-fire time, not def time).
 PR_JSON=$(mktemp)
 REVIEWS_JSON=$(mktemp)
+COMMENTS_JSON=$(mktemp)
 TEAM_PROBE_TMP=$(mktemp)
 NA_STATUSES_TMP=""  # declared here so cleanup() always has the var

 cleanup() {
-  rm -f "$CURL_AUTH_FILE" "$PR_JSON" "$REVIEWS_JSON" "$TEAM_PROBE_TMP" "${NA_STATUSES_TMP-}"
+  rm -f "$CURL_AUTH_FILE" "$PR_JSON" "$REVIEWS_JSON" "$COMMENTS_JSON" "$TEAM_PROBE_TMP" "${NA_STATUSES_TMP-}"
 }
 trap cleanup EXIT

@@ -206,7 +207,81 @@ CANDIDATES=$(jq -r --arg author "$PR_AUTHOR" --arg head "$PR_HEAD_SHA" "$JQ_FILT
 debug "candidate non-author approvers: $(echo "$CANDIDATES" | tr '\n' ' ')"

 if [ -z "$CANDIDATES" ]; then
-  echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (no candidates yet)"
+  # --- Guardrail (internal#503): explain the most common false
+  # "no candidates" red. Gitea's review event enum is EXACTLY
+  # APPROVED/REQUEST_CHANGES/COMMENT/PENDING. A wrong value ("APPROVE",
+  # lowercase, ...) is silently accepted (HTTP 200) and stored as
+  # state=PENDING. A correctly-started draft review has an EMPTY body;
+  # a NON-empty body + state==PENDING by a non-author == an intended
+  # verdict mis-filed by a wrong event string. Surface it actionably.
+  # This does NOT change the gate result (still fail-closed below) — it
+  # only converts a mystery red into a named, self-fixing error.
+  MISFILED_FILTER='.[]
+    | select(.state == "PENDING")
+    | select(.dismissed != true)
+    | select(.user.login != $author)
+    | select(((.body // "") | gsub("^\\s+|\\s+$";"") | length) > 0)
+    | "\(.id)\t\(.user.login)"'
+  MISFILED=$(jq -r --arg author "$PR_AUTHOR" "$MISFILED_FILTER" "$REVIEWS_JSON" 2>/dev/null || true)
+  if [ -n "$MISFILED" ]; then
+    echo "::error::${TEAM}-review: non-author review(s) were SUBMITTED but stored as PENDING — almost certainly the wrong Gitea review event string (internal#503)."
+    echo "::error::Gitea accepts ONLY the exact enum APPROVED / REQUEST_CHANGES / COMMENT. 'APPROVE' or lowercase is silently (HTTP 200) filed as PENDING and is invisible to this gate."
+    printf '%s\n' "$MISFILED" | while IFS="$(printf '\t')" read -r _rid _rl; do
+      [ -n "${_rid:-}" ] && echo "::error::  review id=${_rid} by '${_rl}': RE-SUBMIT via POST ${API}/repos/${OWNER}/${NAME}/pulls/${PR_NUMBER}/reviews with {\"event\":\"APPROVED\"} (correct enum) — do NOT edit the DB."
+    done
+  fi
+
+  # --- Fallback (internal#348): check issue comments for agent-approval ---
+  # core-qa-agent and core-security-agent approve via issue comments, NOT
+  # the reviews API. The reviews API returns zero entries for comment-only
+  # approvals. This fallback reads PR issue comments and extracts logins that:
+  #   1. Posted a comment matching the agent-prefix pattern for this gate:
+  #        qa      → "[core-qa-agent] APPROVED"
+  #        security → "[core-security-agent] APPROVED"
+  #      OR posted a generic approval keyword (word-anchored, case-insensitive):
+  #        APPROVED / LGTM / ACCEPTED
+  #   2. Are not the PR author
+  #   3. The team-membership probe below is the authoritative filter.
+  AGENT_PATTERN=""
+  case "$TEAM" in
+    qa)       AGENT_PATTERN="\\[core-qa-agent\\]" ;;
+    security) AGENT_PATTERN="\\[core-security-agent\\]" ;;
+  esac
+  HTTP_CODE=$(curl -sS -o "$COMMENTS_JSON" -w '%{http_code}' \
+    -K "$CURL_AUTH_FILE" "${API}/repos/${OWNER}/${NAME}/issues/${PR_NUMBER}/comments")
+  debug "GET /issues/${PR_NUMBER}/comments → HTTP ${HTTP_CODE}"
+  if [ "$HTTP_CODE" = "200" ]; then
+    # JQ expression: select non-author comments that match either the
+    # agent-prefix pattern (case-insensitive) OR a generic approval keyword.
+    JQ_APPROVALS='
+      .[] |
+      select(.user.login != $author) |
+      . as $cmt |
+      if ($agent_pattern | length) > 0 and ($cmt.body // "" | test($agent_pattern; "i")) then
+        $cmt.user.login
+      elif ($cmt.body // "" | test("\\b(APPROVED|LGTM|ACCEPTED)\\b"; "i")) then
+        $cmt.user.login
+      else
+        empty
+      end
+    '
+    CANDIDATES=$(jq -r \
+      --arg author "$PR_AUTHOR" \
+      --arg agent_pattern "$AGENT_PATTERN" \
+      "$JQ_APPROVALS" \
+      "$COMMENTS_JSON" 2>/dev/null | sort -u)
+    debug "comment-based approval candidates: $(echo "$CANDIDATES" | tr '\n' ' ')"
+
+    if [ -n "$CANDIDATES" ]; then
+      echo "::notice::${TEAM}-review: reviews API found no APPROVED reviews; found $(echo "$CANDIDATES" | wc -w | xargs) comment-based approval candidate(s) — verifying team membership..."
+    fi
+  else
+    debug "could not fetch issue comments (HTTP ${HTTP_CODE})"
+  fi
+fi
+
+if [ -z "${CANDIDATES:-}" ]; then
+  echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (no candidates from reviews API or issue comments)"
  exit 1
 fi

@@ -68,7 +68,7 @@ import sys
 import urllib.error
 import urllib.parse
 import urllib.request
-from typing import Any
+from typing import Any, Callable


 # ---------------------------------------------------------------------------
@@ -110,7 +110,7 @@ def normalize_slug(raw: str, numeric_aliases: dict[int, str] | None = None) -> s
 # for /sop-revoke (RFC#351 open question 4 — reason is captured but not
 # yet validated; future iteration may require a min-length).
 _DIRECTIVE_RE = re.compile(
-    r"^[ \t]*/(sop-ack|sop-revoke)[ \t]+([A-Za-z0-9_\- ]+?)(?:[ \t]+(.*))?[ \t]*$",
+    r"^[ \t]*/(sop-ack|sop-revoke|sop-n/a)[ \t]+([A-Za-z0-9_\- ]+?)(?:[ \t]+(.*))?[ \t]*$",
    re.MULTILINE,
 )

@@ -118,17 +118,21 @@ _DIRECTIVE_RE = re.compile(
 def parse_directives(
    comment_body: str,
    numeric_aliases: dict[int, str],
-) -> list[tuple[str, str, str]]:
-    """Extract /sop-ack and /sop-revoke directives from a comment body.
+) -> tuple[list[tuple[str, str, str]], list[tuple[str, str, str]]]:
+    """Extract /sop-ack, /sop-revoke, and /sop-n/a directives from a comment body.

-    Returns a list of (kind, canonical_slug, note) tuples where:
-      kind is "sop-ack" or "sop-revoke"
+    Returns (directives, na_directives) where each is a list of
+    (kind, canonical_slug, note) tuples:
+      kind is "sop-ack", "sop-revoke", or "sop-n/a"
      canonical_slug is the normalized form (or "" if unparseable)
      note is the trailing free-text (may be "")
+    The two lists are kept separate so call sites can unpack them
+    directly (e.g. directives, na_directives = parse_directives(...)).
    """
-    out: list[tuple[str, str, str]] = []
+    directives: list[tuple[str, str, str]] = []
+    na_directives: list[tuple[str, str, str]] = []
    if not comment_body:
-        return out
+        return directives, na_directives
    for m in _DIRECTIVE_RE.finditer(comment_body):
        kind = m.group(1)
        raw_slug = (m.group(2) or "").strip()
@@ -158,8 +162,12 @@ def parse_directives(
        note_from_group = (m.group(3) or "").strip()
        # If we collapsed multi-word slug into kebab and there's a
        # trailing-text group too, append it.
-        out.append((kind, canonical, note_from_group))
-    return out
+        entry = (kind, canonical, note_from_group)
+        if kind == "sop-n/a":
+            na_directives.append(entry)
+        else:
+            directives.append(entry)
+    return directives, na_directives


 # ---------------------------------------------------------------------------
@@ -172,8 +180,8 @@ def section_marker_present(body: str, marker: str) -> bool:
    on a non-empty line (i.e. the author actually filled it in).

    We require the marker substring AND non-whitespace content on the
-    same line OR within the next line — this prevents trivially-empty
-    checklists like:
+    same line OR within the next non-blank line — this prevents
+    trivially-empty checklists like:

        ## SOP-Checklist
        - [ ] **Comprehensive testing performed**:
@@ -182,9 +190,18 @@ def section_marker_present(body: str, marker: str) -> bool:
    from auto-passing the section-present check. The peer-ack is still
    required, but answering with empty content is captured as a soft
    finding via the section-present test alone.
+
+    NOTE: we scan forward through blank lines (the markdown-header pattern
+    is ## Header\\n\\ncontent) so that a header + blank-line + content
+    structure still satisfies the check. The backward checkbox fallback
+    catches inline markers without a preceding checkbox (mc#1099).
    """
    if not body or not marker:
        return False
+    # Strip trailing whitespace so the blank-line scan below can find
+    # content that appears on the very last line of the body (without
+    # being misled by a trailing \n or spaces).
+    body = body.rstrip()
    body_lower = body.lower()
    marker_lower = marker.lower()
    idx = body_lower.find(marker_lower)
@@ -200,13 +217,44 @@ def section_marker_present(body: str, marker: str) -> bool:
    stripped = re.sub(r"[\s\*:\-\[\]]+", "", line)
    if stripped:
        return True
-    # Fall through: check the NEXT line (multi-line answers).
-    next_line_end = body.find("\n", line_end + 1)
-    if next_line_end < 0:
-        next_line_end = len(body)
-    next_line = body[line_end + 1:next_line_end]
-    stripped_next = re.sub(r"[\s\*:\-\[\]]+", "", next_line)
-    return bool(stripped_next)
+    # Fall through: scan forward, skipping blank-only lines, until we find
+    # non-empty content or run out of body.  Handles:
+    #   ## Header          ← marker line (empty after marker)
+    #                      ← blank line (skipped)
+    #   - actual content   ← found
+    pos = line_end
+    while True:
+        # Skip the current newline and any additional newlines (blank lines).
+        while pos < len(body) and body[pos] == "\n":
+            pos += 1
+        if pos >= len(body):
+            break
+        line_end = body.find("\n", pos)
+        if line_end < 0:
+            line_end = len(body)
+        line = body[pos:line_end]
+        stripped = re.sub(r"[\s\*:\-\[\]]+", "", line)
+        if stripped:
+            return True
+        pos = line_end
+    # Last resort: the marker may appear mid-sentence (e.g.
+    # **Memory/saved-feedback consulted**: No applicable...).
+    # Search backward within the CURRENT LINE only (not preceding lines)
+    # to find a checkbox on the same line before the marker text.
+    # mc#1099 follow-up: memory-consulted detection was failing because
+    # the checkbox was on the same line before the inline marker.
+    _CHECKBOX_RE = re.compile(r"- \[[ x\]]|<input", re.IGNORECASE)
+    line_start = body.rfind("\n", 0, idx) + 1  # 0 if no newline before idx
+    before = body[line_start:idx]
+    m = _CHECKBOX_RE.search(before)
+    if not m:
+        return False
+    # Require meaningful content between the checkbox and the marker text
+    # (markdown formatting like ** or * must also be stripped).
+    # If only whitespace/markdown chars remain, the checkbox line is empty.
+    between = before[m.end() :]
+    stripped_between = re.sub(r"[\s\*:#\[\]_\-]+", "", between)
+    return bool(stripped_between)


 # ---------------------------------------------------------------------------
@@ -220,6 +268,7 @@ def compute_ack_state(
    items_by_slug: dict[str, dict[str, Any]],
    numeric_aliases: dict[int, str],
    team_membership_probe: "callable[[str, list[str]], list[str]]",
+    high_risk: bool = False,
 ) -> dict[str, dict[str, Any]]:
    """Compute per-item ack state.

@@ -249,7 +298,7 @@ def compute_ack_state(
        user = (c.get("user") or {}).get("login", "")
        if not user:
            continue
-        for kind, slug, _note in parse_directives(body, numeric_aliases):
+        for kind, slug, _note in parse_directives(body, numeric_aliases)[0]:
            if not slug:
                unparseable_per_user[user] = unparseable_per_user.get(user, 0) + 1
                continue
@@ -282,11 +331,16 @@ def compute_ack_state(
    for slug, candidates in pending_team_check.items():
        if not candidates:
            continue
-        required = items_by_slug[slug]["required_teams"]
+        # Risk-class-aware required-teams resolution (RFC#450 Option C):
+        # high-risk PRs use `required_teams_high_risk` (when set on the
+        # item); default class uses `required_teams`. The probe closure
+        # is built with the same high_risk flag so the two reads are
+        # always consistent (both sites share `resolve_required_teams`).
+        required = resolve_required_teams(items_by_slug[slug], high_risk)
        approved = team_membership_probe(slug, candidates)  # returns subset
        rejected_not_in_team[slug] = [u for u in candidates if u not in approved]
        ackers_per_slug[slug] = approved
-        # Stash required teams for description rendering.
+        # Stash resolved teams for description rendering.
        items_by_slug[slug]["_required_resolved"] = required

    return {
@@ -301,6 +355,63 @@ def compute_ack_state(
    }


+# ---------------------------------------------------------------------------
+# N/A-gate evaluation
+# ---------------------------------------------------------------------------
+
+
+def compute_na_state(
+    comments: list[dict[str, Any]],
+    author: str,
+    na_gates: dict[str, Any],
+    probe: Callable[[str, list[str]], list[str]],
+) -> dict[str, dict[str, Any]]:
+    """Evaluate which N/A gates have a valid declaration from a team member.
+
+    Returns dict[gate_name, dict] where each dict has:
+      declared: bool — at least one valid non-author team-member declared N/A
+      decl_ackers: list[str] — usernames who declared this gate N/A
+      rejected: dict with keys:
+        not_in_team: list[str] — users who tried but aren't in required teams
+    """
+    # Build per-user latest N/A directive (most-recent wins per RFC#324).
+    latest_na: dict[str, tuple[str, str]] = {}  # user → (gate, note)
+    for c in comments:
+        body = c.get("body", "") or ""
+        user = (c.get("user") or {}).get("login", "")
+        if not user:
+            continue
+        for kind, gate, note in parse_directives(body, {})[1]:
+            # [1] = na_directives only
+            if gate in na_gates:
+                latest_na[user] = (gate, note)
+
+    result: dict[str, dict[str, Any]] = {}
+    for gate, gate_cfg in na_gates.items():
+        result[gate] = {
+            "declared": False,
+            "decl_ackers": [],
+            "rejected": {"not_in_team": []},
+        }
+        decl_ackers: list[str] = []
+        not_in_team: list[str] = []
+        for user, (g, _note) in latest_na.items():
+            if g != gate:
+                continue
+            if user == author:
+                continue  # authors cannot self-declare N/A
+            approved = probe(gate, [user])
+            if approved:
+                decl_ackers.append(user)
+            else:
+                not_in_team.append(user)
+        result[gate]["declared"] = bool(decl_ackers)
+        result[gate]["decl_ackers"] = decl_ackers
+        result[gate]["rejected"]["not_in_team"] = not_in_team
+
+    return result
+
+
 # ---------------------------------------------------------------------------
 # Gitea API client
 # ---------------------------------------------------------------------------
@@ -660,6 +771,42 @@ def get_tier_mode(pr: dict[str, Any], cfg: dict[str, Any]) -> str:
    return default_mode


+def is_high_risk(pr: dict[str, Any], cfg: dict[str, Any]) -> bool:
+    """Return True when the PR is high-risk per RFC#450 Option C.
+
+    A PR is high-risk when ANY of:
+      - it carries the `tier:high` label (mechanically strictest tier), or
+      - it carries any label listed in cfg.high_risk_labels.
+
+    High-risk PRs use `required_teams_high_risk` (when set on an item)
+    instead of the default `required_teams`. Items without
+    `required_teams_high_risk` are unaffected (the default applies).
+
+    Governance fix for internal#442 — closes the inconsistency between
+    sop-tier-check (tier-aware) and sop-checklist (was tier-blind).
+    """
+    label_set = {(l.get("name") or "") for l in (pr.get("labels") or [])}
+    if "tier:high" in label_set:
+        return True
+    high_risk_labels = set(cfg.get("high_risk_labels") or [])
+    return bool(label_set & high_risk_labels)
+
+
+def resolve_required_teams(item: dict[str, Any], high_risk: bool) -> list[str]:
+    """Pick the active required_teams list for an item.
+
+    When high_risk is True AND the item declares a non-empty
+    `required_teams_high_risk`, return that. Else fall back to
+    `required_teams`. Keeping this in one helper means the gate's
+    decision shape stays single-sited even as items grow.
+    """
+    if high_risk:
+        elevated = item.get("required_teams_high_risk") or []
+        if elevated:
+            return list(elevated)
+    return list(item.get("required_teams") or [])
+
+
 def main(argv: list[str] | None = None) -> int:
    p = argparse.ArgumentParser()
    p.add_argument("--owner", required=True)
@@ -695,6 +842,7 @@ def main(argv: list[str] | None = None) -> int:
    cfg = load_config(args.config)
    items: list[dict[str, Any]] = cfg["items"]
    items_by_slug = {it["slug"]: it for it in items}
+    na_gates: dict[str, Any] = cfg.get("n/a_gates", {})
    numeric_aliases = {
        int(it["numeric_alias"]): it["slug"] for it in items if it.get("numeric_alias")
    }
@@ -719,6 +867,12 @@ def main(argv: list[str] | None = None) -> int:

    comments = client.get_issue_comments(args.owner, args.repo, args.pr)

+    # High-risk classification (RFC#450 Option C, governance fix for
+    # internal#442). Computed ONCE per PR — used by both the probe
+    # closure and compute_ack_state so the elevation decision is
+    # single-sited.
+    high_risk = is_high_risk(pr, cfg)
+
    # Build team-membership probe closure that caches results per
    # (user, team-id) so a user acking multiple items only triggers
    # one membership lookup per team.
@@ -726,7 +880,7 @@ def main(argv: list[str] | None = None) -> int:

    def probe(slug: str, users: list[str]) -> list[str]:
        item = items_by_slug[slug]
-        team_names: list[str] = item["required_teams"]
+        team_names: list[str] = resolve_required_teams(item, high_risk)
        # Resolve names → ids. NOTE: orgs/{org}/teams/search may not be
        # available — fall back to the list endpoint.
        team_ids: list[int] = []
@@ -771,7 +925,9 @@ def main(argv: list[str] | None = None) -> int:
                    # may still find membership in another team.
        return approved

-    ack_state = compute_ack_state(comments, author, items_by_slug, numeric_aliases, probe)
+    ack_state = compute_ack_state(
+        comments, author, items_by_slug, numeric_aliases, probe, high_risk=high_risk
+    )
    body_state = {it["slug"]: section_marker_present(body, it["pr_section_marker"]) for it in items}

    state, description = render_status(items, ack_state, body_state)
@@ -784,7 +940,10 @@ def main(argv: list[str] | None = None) -> int:
        description = f"[info tier:low] {description}"

    # Diagnostics to job log.
-    print(f"::notice::PR #{args.pr} author={author} head={head_sha[:7]} mode={mode}")
+    print(
+        f"::notice::PR #{args.pr} author={author} head={head_sha[:7]} "
+        f"mode={mode} risk_class={'high' if high_risk else 'default'}"
+    )
    for it in items:
        slug = it["slug"]
        ackers = ack_state[slug]["ackers"]
@@ -815,6 +974,46 @@ def main(argv: list[str] | None = None) -> int:
        description=description, target_url=target_url,
    )
    print(f"::notice::status posted: {args.status_context} → {state}")
+
+    # --- N/A gate status (RFC#324 §N/A follow-up) ---
+    # Post a separate status so review-check.sh can discover N/A declarations
+    # and waive the Gitea-approve requirement for that gate.
+    na_state: dict[str, dict[str, Any]] = {}
+    if na_gates:
+        na_state = compute_na_state(comments, author, na_gates, probe)
+
+        na_descs: list[str] = []
+        for gate, s in na_state.items():
+            if s["declared"]:
+                na_descs.append(gate)
+            decl = s["decl_ackers"]
+            rej = s["rejected"]["not_in_team"]
+            if decl:
+                print(f"::notice::  [N/A OK] {gate} — declared by {','.join(decl)}")
+            if rej:
+                print(
+                    f"::notice::  [N/A REJ] {gate} — not-in-team: {','.join(rej)}",
+                    file=sys.stderr,
+                )
+
+        na_desc = ", ".join(sorted(na_descs)) if na_descs else "(none)"
+        na_status_state = "success" if na_descs else "pending"
+        # review-check.sh reads the description to discover which gates are N/A.
+        # Include the gate names so it can grep for them.
+        na_description = f"N/A: {na_desc}" if na_descs else "N/A: (none)"
+
+        if not args.dry_run:
+            client.post_status(
+                args.owner, args.repo, head_sha,
+                state=na_status_state,
+                context="sop-checklist / na-declarations (pull_request)",
+                description=na_description,
+                target_url=target_url,
+            )
+            print(
+                f"::notice::na-declarations status → {na_status_state}: {na_description}"
+            )
+
    # By default exit 0 — the POSTed status IS the gate, NOT the job
    # conclusion. If the job exits 1 BP will see TWO failure signals
    # (one from the job's auto-status, one from our POST), making the
@@ -17,6 +17,9 @@ Scenarios:
  T8_team_not_member          — team membership → 404 (not a member) → exit 1
  T9_team_403                — team membership → 403 (token not in team) → exit 1
  T14_non_default_base        — open PR targeting staging → script exits 0 (no-op)
+  T15_comments_agent_approval — reviews empty; comments have "[core-qa-agent] APPROVED" → exit 0
+  T16_comments_generic_approval — reviews empty; comments have "APPROVED" by team member → exit 0
+  T17_comments_no_approval   — reviews empty; comments have no approval keywords → exit 1

 Usage:
  FIXTURE_STATE_DIR=/tmp/x python3 _review_check_fixture.py 8080
@@ -97,7 +100,9 @@ class Handler(http.server.BaseHTTPRequestHandler):
        # GET /repos/{owner}/{name}/pulls/{pr_number}/reviews
        m = re.match(r"^/api/v1/repos/([^/]+)/([^/]+)/pulls/(\d+)/reviews$", path)
        if m:
-            if sc in ("T4_reviews_empty", "T5_reviews_only_author"):
+            if sc in ("T4_reviews_empty", "T5_reviews_only_author",
+                      "T15_comments_agent_approval", "T16_comments_generic_approval",
+                      "T17_comments_no_approval"):
                return self._json(200, [])
            if sc == "T6_reviews_dismissed":
                return self._json(200, [{
@@ -116,6 +121,28 @@ class Handler(http.server.BaseHTTPRequestHandler):
                {"state": "APPROVED", "dismissed": False, "user": {"login": "core-devops"}, "commit_id": "abc1234"},
            ])

+        # GET /repos/{owner}/{name}/issues/{pr_number}/comments
+        m = re.match(r"^/api/v1/repos/([^/]+)/([^/]+)/issues/(\d+)/comments$", path)
+        if m:
+            if sc == "T15_comments_agent_approval":
+                return self._json(200, [
+                    {"user": {"login": "core-qa-agent"}, "body": "[core-qa-agent] APPROVED this PR. Good changes.", "id": 1},
+                    {"user": {"login": "alice"}, "body": "I authored this PR", "id": 2},
+                    {"user": {"login": "random-user"}, "body": "Looks okay to me", "id": 3},
+                ])
+            if sc == "T16_comments_generic_approval":
+                return self._json(200, [
+                    {"user": {"login": "core-qa-agent"}, "body": "APPROVED — all acceptance criteria met", "id": 1},
+                    {"user": {"login": "alice"}, "body": "-authored", "id": 2},
+                ])
+            if sc == "T17_comments_no_approval":
+                return self._json(200, [
+                    {"user": {"login": "alice"}, "body": "I authored this PR", "id": 1},
+                    {"user": {"login": "random-user"}, "body": "Looks okay to me", "id": 2},
+                ])
+            # Default scenarios (T1–T9, T14): no comments
+            return self._json(200, [])
+
        # GET /teams/{team_id}/members/{username}
        m = re.match(r"^/api/v1/teams/(\d+)/members/([^/]+)$", path)
        if m:
@@ -127,6 +154,12 @@ class Handler(http.server.BaseHTTPRequestHandler):
            # T7_team_member: member
            return self._empty(204)

+        # GET /repos/{owner}/{name}/statuses/{sha} — for N/A declaration check
+        m = re.match(r"^/api/v1/repos/([^/]+)/([^/]+)/statuses/([a-f0-9]+)$", path)
+        if m:
+            # All comment-based scenarios have no N/A declarations
+            return self._json(200, [])
+
        return self._json(404, {"path": path, "msg": "fixture: no route"})

    def do_POST(self):
@@ -118,3 +118,13 @@ def test_merge_decision_updates_stale_pr_before_merge():

    assert decision.ready is False
    assert decision.action == "update"
+
+
+def test_MergePermissionError_inherits_from_ApiError():
+    assert issubclass(mq.MergePermissionError, mq.ApiError)
+
+
+def test_MergePermissionError_message_preserved():
+    exc = mq.MergePermissionError("POST /merge -> HTTP 405: User not allowed")
+    assert "405" in str(exc)
+    assert "User not allowed" in str(exc)
@@ -36,9 +36,37 @@ def test_build_plan_defaults_to_staging_sha_target_and_prod_cp():
        "soak_seconds": 60,
        "batch_size": 3,
        "dry_run": False,
+        # cp#228 / task #308: fleet-wide intent must carry confirm:true.
+        "confirm": True,
    }


+def test_build_plan_always_sets_confirm_true_for_fleet_intent():
+    """Regression guard: every plan body MUST carry confirm:true.
+
+    CP /cp/admin/tenants/redeploy-fleet (cp#228) returns 400 on empty
+    body / {confirm:false} / {only_slugs:[]} to prevent accidental
+    fleet-wide mutation. This caller is fleet-wide intent (canary +
+    fan-out, no slug scoping), so the plan MUST carry confirm:true.
+    Pairs with cp#228's TestRedeployFleet_EmptyBodyReturns400 +
+    TestRedeployFleet_ConfirmTrueProceeds.
+    """
+    plan = prod.build_plan({"GITHUB_SHA": "abcdef1234567890"})
+    assert plan["body"]["confirm"] is True
+
+    # Operator-overridable knobs do NOT drop the ack.
+    plan = prod.build_plan(
+        {
+            "GITHUB_SHA": "abcdef1234567890",
+            "PROD_AUTO_DEPLOY_SOAK_SECONDS": "0",
+            "PROD_AUTO_DEPLOY_BATCH_SIZE": "10",
+            "PROD_AUTO_DEPLOY_DRY_RUN": "true",
+            "PROD_AUTO_DEPLOY_CANARY_SLUG": "",
+        }
+    )
+    assert plan["body"]["confirm"] is True
+
+
 def test_build_plan_rejects_non_prod_cp_without_explicit_override():
    try:
        prod.build_plan(
@@ -334,6 +334,31 @@ assert_contains "T12 jq: core-devops (non-author APPROVED) in candidates" "core-
 assert_eq "T12 jq: alice (author) NOT in candidates" "" "$(echo "$T12_CANDIDATES" | grep '^alice$' || true)"
 assert_eq "T12 jq: carol (dismissed) NOT in candidates" "" "$(echo "$T12_CANDIDATES" | grep '^carol$' || true)"

+# T15 — comment-based approval via agent prefix pattern → exit 0
+echo
+echo "== T15 comment agent-prefix approval =="
+T15_OUT=$(run_review_check "T15_comments_agent_approval")
+T15_RC=$(cat "$FIX_STATE_DIR/last_rc")
+assert_eq "T15 exit code 0 (agent-comment approval + team member)" "0" "$T15_RC"
+assert_contains "T15 comment fallback notice" "comment-based approval" "$T15_OUT"
+assert_contains "T15 core-qa-agent APPROVED" "APPROVED by core-qa-agent" "$T15_OUT"
+
+# T16 — comment-based approval via generic APPROVED keyword → exit 0
+echo
+echo "== T16 comment generic keyword approval =="
+T16_OUT=$(run_review_check "T16_comments_generic_approval")
+T16_RC=$(cat "$FIX_STATE_DIR/last_rc")
+assert_eq "T16 exit code 0 (generic-approval comment + team member)" "0" "$T16_RC"
+assert_contains "T16 comment fallback notice" "comment-based approval" "$T16_OUT"
+
+# T17 — no approval keywords in comments → exit 1
+echo
+echo "== T17 comments with no approval keywords =="
+T17_OUT=$(run_review_check "T17_comments_no_approval")
+T17_RC=$(cat "$FIX_STATE_DIR/last_rc")
+assert_eq "T17 exit code 1 (no candidates from comments)" "1" "$T17_RC"
+assert_contains "T17 no candidates error" "no candidates from reviews API or issue comments" "$T17_OUT"
+
 echo
 echo "------"
 echo "PASS=$PASS FAIL=$FAIL"
@@ -551,3 +551,267 @@ class TestEndToEndAckFlow(unittest.TestCase):

 if __name__ == "__main__":
    unittest.main(verbosity=2)
+
+
+# ---------------------------------------------------------------------------
+# compute_na_state
+# ---------------------------------------------------------------------------
+
+
+class TestComputeNaState(unittest.TestCase):
+    """Tests for /sop-n/a directive evaluation."""
+
+    def test_no_na_declarations(self):
+        cfg = sop.load_config(CONFIG_PATH)
+        na_gates = cfg.get("n/a_gates", {})
+        comments = []
+        na_state = sop.compute_na_state(comments, "alice", na_gates, lambda *_: [])
+        self.assertFalse(na_state["qa-review"]["declared"])
+        self.assertFalse(na_state["security-review"]["declared"])
+
+    def test_na_declared_by_authorized_user(self):
+        cfg = sop.load_config(CONFIG_PATH)
+        na_gates = cfg.get("n/a_gates", {})
+        comments = [_comment("bob", "/sop-n/a qa-review N/A: pure tooling change")]
+        na_state = sop.compute_na_state(comments, "alice", na_gates, lambda g, u: u)
+        self.assertTrue(na_state["qa-review"]["declared"])
+        self.assertEqual(na_state["qa-review"]["decl_ackers"], ["bob"])
+
+    def test_na_declared_by_unauthorized_user_rejected(self):
+        cfg = sop.load_config(CONFIG_PATH)
+        na_gates = cfg.get("n/a_gates", {})
+        comments = [_comment("mallory", "/sop-n/a qa-review N/A: not real team")]
+        na_state = sop.compute_na_state(comments, "alice", na_gates, lambda g, u: [])
+        self.assertFalse(na_state["qa-review"]["declared"])
+        self.assertEqual(na_state["qa-review"]["rejected"]["not_in_team"], ["mallory"])
+
+    def test_author_cannot_self_declare_na(self):
+        cfg = sop.load_config(CONFIG_PATH)
+        na_gates = cfg.get("n/a_gates", {})
+        comments = [_comment("alice", "/sop-n/a qa-review N/A: I am the author")]
+        na_state = sop.compute_na_state(comments, "alice", na_gates, lambda g, u: u)
+        self.assertFalse(na_state["qa-review"]["declared"])
+
+    def test_parse_directives_separates_na_from_ack(self):
+        directives, na_directives = sop.parse_directives(
+            "/sop-ack comprehensive-testing\n/sop-n/a qa-review N/A: no surface",
+            {},
+        )
+        self.assertEqual(len(directives), 1)
+        self.assertEqual(directives[0][0], "sop-ack")
+        self.assertEqual(len(na_directives), 1)
+        self.assertEqual(na_directives[0][0], "sop-n/a")
+        self.assertEqual(na_directives[0][1], "qa-review")
+
+
+# ---------------------------------------------------------------------------
+# RFC#450 Option C — risk-classed two-eyes (governance fix for internal#442)
+# ---------------------------------------------------------------------------
+
+
+class TestIsHighRisk(unittest.TestCase):
+    """The high-risk predicate decides which required_teams list applies.
+
+    Predicate: tier:high label OR any label in cfg.high_risk_labels.
+    """
+
+    def setUp(self):
+        self.cfg = sop.load_config(CONFIG_PATH)
+
+    def test_no_labels_is_default_class(self):
+        pr = {"labels": []}
+        self.assertFalse(sop.is_high_risk(pr, self.cfg))
+
+    def test_tier_high_is_high_risk(self):
+        pr = {"labels": [{"name": "tier:high"}]}
+        self.assertTrue(sop.is_high_risk(pr, self.cfg))
+
+    def test_tier_low_is_default_class(self):
+        pr = {"labels": [{"name": "tier:low"}]}
+        self.assertFalse(sop.is_high_risk(pr, self.cfg))
+
+    def test_tier_medium_is_default_class(self):
+        # tier:medium alone is NOT high-risk (Option C — medium routes
+        # to the wider engineers OR-set).
+        pr = {"labels": [{"name": "tier:medium"}]}
+        self.assertFalse(sop.is_high_risk(pr, self.cfg))
+
+    def test_area_security_label_is_high_risk(self):
+        pr = {"labels": [{"name": "tier:medium"}, {"name": "area:security"}]}
+        self.assertTrue(sop.is_high_risk(pr, self.cfg))
+
+    def test_area_schema_label_is_high_risk(self):
+        pr = {"labels": [{"name": "area:schema"}]}
+        self.assertTrue(sop.is_high_risk(pr, self.cfg))
+
+    def test_area_identity_label_is_high_risk(self):
+        pr = {"labels": [{"name": "area:identity"}]}
+        self.assertTrue(sop.is_high_risk(pr, self.cfg))
+
+    def test_area_fleet_image_label_is_high_risk(self):
+        pr = {"labels": [{"name": "area:fleet-image"}]}
+        self.assertTrue(sop.is_high_risk(pr, self.cfg))
+
+    def test_area_gate_meta_label_is_high_risk(self):
+        # Gate-meta = changes to sop-checklist/sop-tier-check itself.
+        pr = {"labels": [{"name": "area:gate-meta"}]}
+        self.assertTrue(sop.is_high_risk(pr, self.cfg))
+
+    def test_unknown_area_label_is_default_class(self):
+        pr = {"labels": [{"name": "area:docs"}]}
+        self.assertFalse(sop.is_high_risk(pr, self.cfg))
+
+
+class TestResolveRequiredTeams(unittest.TestCase):
+    """The team resolver picks the elevated list only for high-risk PRs
+    AND only when the item declares one — items without an elevated
+    list always use the default required_teams."""
+
+    def test_default_class_uses_default_teams(self):
+        item = {"required_teams": ["engineers", "managers", "ceo"], "required_teams_high_risk": ["ceo"]}
+        self.assertEqual(
+            sop.resolve_required_teams(item, high_risk=False),
+            ["engineers", "managers", "ceo"],
+        )
+
+    def test_high_risk_uses_elevated_teams(self):
+        item = {"required_teams": ["engineers", "managers", "ceo"], "required_teams_high_risk": ["ceo"]}
+        self.assertEqual(
+            sop.resolve_required_teams(item, high_risk=True),
+            ["ceo"],
+        )
+
+    def test_high_risk_without_elevated_falls_back_to_default(self):
+        # Items that don't declare required_teams_high_risk (e.g.
+        # comprehensive-testing, staging-smoke) are unaffected by risk-class.
+        item = {"required_teams": ["engineers"]}
+        self.assertEqual(
+            sop.resolve_required_teams(item, high_risk=True),
+            ["engineers"],
+        )
+
+    def test_empty_elevated_list_falls_back_to_default(self):
+        # A defensive case: required_teams_high_risk: [] should not
+        # silently lock out all approvers — fall back to the default
+        # so the gate stays satisfiable. (Tightening should remove the
+        # key, not set it to empty.)
+        item = {"required_teams": ["engineers"], "required_teams_high_risk": []}
+        self.assertEqual(
+            sop.resolve_required_teams(item, high_risk=True),
+            ["engineers"],
+        )
+
+
+class TestRootCauseAckEligibilityWidened(unittest.TestCase):
+    """Closes internal#442: a non-author engineers-team ack now satisfies
+    root-cause / no-backwards-compat for the default class.
+
+    The dead-managers/ceo-persona-token gridlock is the symptom; the
+    root cause is that sop-checklist ignored tier-class. These tests
+    pin the new wider-default behavior so it can't regress silently.
+    """
+
+    def setUp(self):
+        self.items = _items_by_slug()
+        self.aliases = _numeric_aliases()
+
+    @staticmethod
+    def _approve_only(allowed):
+        return lambda slug, users: [u for u in users if u in allowed]
+
+    def test_engineers_ack_satisfies_root_cause_default_class(self):
+        # Bob is in engineers only (not managers, not ceo). Default class.
+        comments = [_comment("bob", "/sop-ack root-cause")]
+        # Probe: bob is approved because root-cause now lists engineers.
+        probe = self._approve_only({"bob"})
+        state = sop.compute_ack_state(
+            comments, "alice", self.items, self.aliases, probe, high_risk=False
+        )
+        self.assertEqual(state["root-cause"]["ackers"], ["bob"])
+
+    def test_engineers_ack_satisfies_no_backwards_compat_default_class(self):
+        comments = [_comment("bob", "/sop-ack no-backwards-compat")]
+        probe = self._approve_only({"bob"})
+        state = sop.compute_ack_state(
+            comments, "alice", self.items, self.aliases, probe, high_risk=False
+        )
+        self.assertEqual(state["no-backwards-compat"]["ackers"], ["bob"])
+
+    def test_engineers_ack_alone_fails_root_cause_when_high_risk(self):
+        # High-risk PR: only ceo can ack. Engineers-only ack must fail.
+        comments = [_comment("bob", "/sop-ack root-cause")]
+        # Probe: bob is in engineers, not ceo. Under high_risk,
+        # required_teams_high_risk=[ceo] → bob is NOT approved.
+        # Probe receives the items + flag indirectly via main(); for
+        # the unit-test path we inject a probe that rejects bob.
+        probe = self._approve_only(set())  # nobody is in ceo
+        state = sop.compute_ack_state(
+            comments, "alice", self.items, self.aliases, probe, high_risk=True
+        )
+        self.assertEqual(state["root-cause"]["ackers"], [])
+        self.assertIn("bob", state["root-cause"]["rejected"]["not_in_team"])
+
+    def test_ceo_ack_satisfies_root_cause_when_high_risk(self):
+        # High-risk PR + ceo-team approver → passes (the senior path).
+        comments = [_comment("hongming", "/sop-ack root-cause")]
+        probe = self._approve_only({"hongming"})
+        state = sop.compute_ack_state(
+            comments, "alice", self.items, self.aliases, probe, high_risk=True
+        )
+        self.assertEqual(state["root-cause"]["ackers"], ["hongming"])
+
+    def test_self_ack_still_forbidden_even_with_widened_eligibility(self):
+        # Author cannot self-ack — widening teams must NOT weaken
+        # the non-author rule.
+        comments = [_comment("alice", "/sop-ack root-cause")]
+        probe = self._approve_only({"alice"})
+        state = sop.compute_ack_state(
+            comments, "alice", self.items, self.aliases, probe, high_risk=False
+        )
+        self.assertEqual(state["root-cause"]["ackers"], [])
+        self.assertIn("alice", state["root-cause"]["rejected"]["self_ack"])
+
+
+class TestHighRiskClassUsesElevatedListInConfig(unittest.TestCase):
+    """End-to-end: the shipped config + RFC#450 predicate must keep
+    root-cause / no-backwards-compat gated on ceo for high-risk PRs."""
+
+    def test_root_cause_high_risk_elevated_to_ceo_only(self):
+        items = _items_by_slug()
+        # tier:high alone makes the PR high-risk → root-cause needs ceo.
+        self.assertEqual(
+            sop.resolve_required_teams(items["root-cause"], high_risk=True),
+            ["ceo"],
+        )
+        # Default class accepts engineers/managers/ceo.
+        self.assertEqual(
+            sorted(sop.resolve_required_teams(items["root-cause"], high_risk=False)),
+            sorted(["engineers", "managers", "ceo"]),
+        )
+
+    def test_no_backwards_compat_high_risk_elevated_to_ceo_only(self):
+        items = _items_by_slug()
+        self.assertEqual(
+            sop.resolve_required_teams(items["no-backwards-compat"], high_risk=True),
+            ["ceo"],
+        )
+        self.assertEqual(
+            sorted(sop.resolve_required_teams(items["no-backwards-compat"], high_risk=False)),
+            sorted(["engineers", "managers", "ceo"]),
+        )
+
+    def test_other_items_unchanged_by_risk_class(self):
+        # Items without required_teams_high_risk are unaffected.
+        items = _items_by_slug()
+        for slug in (
+            "comprehensive-testing",
+            "local-postgres-e2e",
+            "staging-smoke",
+            "five-axis-review",
+            "memory-consulted",
+        ):
+            self.assertEqual(
+                sop.resolve_required_teams(items[slug], high_risk=False),
+                sop.resolve_required_teams(items[slug], high_risk=True),
+                f"item {slug} should not be affected by risk-class",
+            )
@@ -50,6 +50,34 @@ tier_failure_mode:
  "tier:low": soft
 default_mode: hard  # used when no tier:* label is present

+# High-risk class (RFC#450 Option C, governance-fix for internal#442).
+#
+# A PR is "high-risk" when ANY of the listed labels are applied OR when
+# the PR has `tier:high` (mechanically the strictest existing tier).
+# High-risk items use `required_teams_high_risk` (when present on the
+# item); non-high-risk items use the default `required_teams`.
+#
+# This closes the inconsistency that the SOP charter already mandates
+# `tier:high → ceo only` for the sibling `sop-tier-check` gate; the
+# sop-checklist's `root-cause` and `no-backwards-compat` items now
+# follow the same risk-classed two-eyes shape:
+#   - Default class (tier:low/medium, not high-risk): a non-author
+#     engineers/managers/ceo ack satisfies the item — 25+ live
+#     identities, no dependency on a dead/inactive senior persona
+#     token.
+#   - High-risk class (tier:high OR any high_risk_label): still
+#     requires a non-author ceo ack (durable human team).
+#
+# Tightening: add labels to high_risk_labels.
+# Loosening: remove labels.
+high_risk_labels:
+  - "risk:high"
+  - "area:security"
+  - "area:schema"
+  - "area:fleet-image"
+  - "area:identity"
+  - "area:gate-meta"
+
 items:
  - slug: comprehensive-testing
    numeric_alias: 1
@@ -78,11 +106,15 @@ items:
  - slug: root-cause
    numeric_alias: 4
    pr_section_marker: "Root-cause not symptom"
-    required_teams: [managers, ceo]
+    required_teams: [engineers, managers, ceo]
+    required_teams_high_risk: [ceo]
    description: >-
-      One-sentence root-cause statement. Ack from managers tier
-      (team-leads) or ceo. Senior judgment required to attest
-      root-cause-versus-symptom.
+      One-sentence root-cause statement. Default class: non-author
+      engineers/managers/ceo ack suffices (engineers can attest
+      root-cause-vs-symptom for routine fixes). High-risk class
+      (see `high_risk_labels`): non-author ceo ack required —
+      senior judgment for irreversible/security/identity/gate
+      changes. Closes internal#442 + tracks RFC#450.

  - slug: five-axis-review
    numeric_alias: 5
@@ -95,10 +127,14 @@ items:
  - slug: no-backwards-compat
    numeric_alias: 6
    pr_section_marker: "No backwards-compat shim / dead code added"
-    required_teams: [managers, ceo]
+    required_teams: [engineers, managers, ceo]
+    required_teams_high_risk: [ceo]
    description: >-
-      Yes/no + justification if no. Senior ack required because
-      backward-compat shims are how dead-code accretes.
+      Yes/no + justification if no. Default class: non-author
+      engineers/managers/ceo ack suffices. High-risk class
+      (see `high_risk_labels`): non-author ceo ack required —
+      senior judgment for shim-versus-real-fix on irreversible
+      surfaces. Closes internal#442 + tracks RFC#450.

  - slug: memory-consulted
    numeric_alias: 7
@@ -158,8 +158,68 @@ jobs:
            echo "NOTE: No warning in output (may be suppressed by log level)"
          fi

+      - name: Reproduce openclaw failure — pipe held OPEN, no EOF
+        run: |
+          set -euo pipefail
+          echo "=== keep-stdin-open pipe (the real openclaw / Claude Code case) ==="
+          echo ""
+          echo "Before the readline() fix this HANGS: main() did"
+          echo "  stdin.read(65536)  -> on a pipe, blocks until 64KB OR EOF."
+          echo "An MCP client sends one ~150B initialize and keeps stdin"
+          echo "open waiting for the response, so the server never parsed"
+          echo "the request and the client timed out (openclaw: 'MCP error"
+          echo "-32000: Connection closed'). The earlier regular-file /"
+          echo "heredoc-pipe steps PASSED through this bug because a file"
+          echo "(or a closing heredoc) yields EOF immediately."
+          echo ""
+
+          # Drive the server through a real pipe that stays OPEN: write
+          # one initialize, do NOT close stdin, and require a response
+          # within a hard timeout. read(65536) -> no output -> timeout
+          # kills it -> FAIL. readline() -> immediate response -> PASS.
+          python - <<'PYEOF'
+          import json, subprocess, sys, time, select
+
+          proc = subprocess.Popen(
+              [sys.executable, "a2a_mcp_server.py"],
+              stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+              stderr=subprocess.STDOUT,
+              env={**__import__("os").environ},
+          )
+          req = json.dumps({
+              "jsonrpc": "2.0", "id": 1, "method": "initialize",
+              "params": {"protocolVersion": "2024-11-05",
+                         "capabilities": {},
+                         "clientInfo": {"name": "keepopen", "version": "1"}},
+          }) + "\n"
+          proc.stdin.write(req.encode())
+          proc.stdin.flush()
+          # Deliberately DO NOT close proc.stdin — mirror a live MCP client.
+
+          deadline = time.time() + 15
+          line = b""
+          while time.time() < deadline:
+              r, _, _ = select.select([proc.stdout], [], [], 1)
+              if r:
+                  line = proc.stdout.readline()
+                  if line:
+                      break
+          proc.kill()
+
+          if not line:
+              print("FAIL: no response within 15s on an open pipe — "
+                    "stdin.read(65536) regression is back")
+              sys.exit(1)
+          resp = json.loads(line.decode())
+          assert resp.get("id") == 1 and "result" in resp, \
+              f"unexpected response: {line[:200]!r}"
+          assert resp["result"]["serverInfo"]["name"] == "molecule", \
+              f"wrong serverInfo: {line[:200]!r}"
+          print("PASS: server answered initialize on a still-open pipe")
+          PYEOF
+
      - name: Run unit tests for stdio transport
        run: |
          set -euo pipefail
          echo "=== Running stdio transport unit tests ==="
-          python -m pytest tests/test_a2a_mcp_server.py::TestStdioPipeAssertion -v --no-cov
+          python -m pytest tests/test_a2a_mcp_server.py::TestStdioPipeAssertion tests/test_a2a_mcp_server.py::TestStdioKeepOpenPipe -v --no-cov
@@ -397,18 +397,23 @@ jobs:
            scripts/promote-tenant-image.sh \
            scripts/test-promote-tenant-image.sh

+  # mc#959 root-fix (sre)
+
  canvas-deploy-reminder:
    name: Canvas Deploy Reminder
-    runs-on: ubuntu-latest
-    # This job must run on PRs because all-required needs it. The step exits
-    # 0 when it is not a main push, giving branch protection a green no-op
-    # instead of a skipped/missing required dependency.
-    needs: canvas-build
+    runs-on: docker-host
+    # mc#774 root-fix: added job-level `if:` so ci-required-drift.py's
+    # ci_job_names() detects this as github.ref-gated and skips it from F1.
+    # The step-level exit 0 handles the "not main push" case; the job-level
+    # `if:` makes the gating explicit so the drift script sees it.
+    # Runs on both main and staging pushes; step exits 0 when not applicable.
+    if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' }}
+    needs: [changes, canvas-build]
    steps:
      - name: Write deploy reminder to step summary
        env:
          COMMIT_SHA: ${{ github.sha }}
-          CANVAS_CHANGED: "true"
+          CANVAS_CHANGED: ${{ needs.changes.outputs.canvas }}
          EVENT_NAME: ${{ github.event_name }}
          REF_NAME: ${{ github.ref }}
          # github.server_url resolves via the workflow-level env override
@@ -533,11 +538,13 @@ jobs:
  all-required:
    # Aggregator sentinel — RFC internal#219 §2 (Phase 4 — closes internal#286).
    #
-    # Single stable required-status name that branch protection points at;
-    # CI churns underneath in `needs:` without any protection edits. Mirrors
-    # the molecule-controlplane Phase 2a impl shipped in CP PR#112 and
-    # referenced by `internal#286` ("Phase 4 is a single small PR... mirrors
-    # CP's existing one").
+    # Emits `CI / all-required (<event>)` where <event> is the workflow trigger
+    # (e.g. `CI / all-required (pull_request)`, `CI / all-required (push)`).
+    # Branch protection MUST be updated to require the event-suffixed name —
+    # requiring `CI / all-required` (bare, no suffix) silently blocks all merges
+    # because Gitea treats absent status contexts as pending (not skipped), and
+    # no workflow emits the bare name. Fixed: BP now requires
+    # `CI / all-required (pull_request)` per issue #1473.
    #
    # Closes the failure mode where status_check_contexts on molecule-core/main
    # only listed `Secret scan` + `sop-tier-check` (the 2 meta-gates), so real
@@ -108,7 +108,20 @@ env:

 jobs:
  detect-changes:
-    runs-on: ubuntu-latest
+    # mc#1529 follow-on: pin to `docker-host` so the e2e-api lane lands
+    # on Linux operator-host runners (molecule-runner-*) that carry the
+    # `molecule-core-net` bridge network + a working `aws ecr get-login-
+    # password | docker login` path. The bare `ubuntu-latest` label is
+    # also accepted by hongming-pc-runner-* (Windows act_runner v1.0.3),
+    # where the docker.sock-bound steps below fail non-deterministically
+    # (e.g. `docker run -d --name pg-e2e-api-...` with port-bind +
+    # `docker exec ... pg_isready` cannot work against a Windows daemon).
+    # detect-changes itself doesn't bind docker.sock, but pinning here too
+    # keeps both jobs on the same lane so we don't re-roll the dice on
+    # workspace-volume cross-host surprises and the routing rule is
+    # discoverable in one place. Mirror of mc#1543 (handlers-postgres-
+    # integration). See internal#512 for the class defect.
+    runs-on: docker-host
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -160,7 +173,10 @@ jobs:
  e2e-api:
    needs: detect-changes
    name: E2E API Smoke Test
-    runs-on: ubuntu-latest
+    # mc#1529 follow-on: must run on operator-host Linux runners (where
+    # docker.sock + `molecule-core-net` + `aws ecr ...` work). See
+    # detect-changes for the full rationale.
+    runs-on: docker-host
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -365,6 +381,9 @@ jobs:
      - name: Run poll-mode chat upload E2E (RFC #2891)
        if: needs.detect-changes.outputs.api == 'true'
        run: bash tests/e2e/test_poll_mode_chat_upload_e2e.sh
+      - name: Run today's-PR-coverage E2E (mc#1525/1535/1536/1539/1542 fix-specific assertions)
+        if: needs.detect-changes.outputs.api == 'true'
+        run: bash tests/e2e/test_today_pr_coverage_e2e.sh
      - name: Dump platform log on failure
        if: failure() && needs.detect-changes.outputs.api == 'true'
        run: cat workspace-server/platform.log || true
@@ -0,0 +1,296 @@
+name: E2E Chat
+
+# Comprehensive Playwright E2E for the unified chat stack (desktop
+# ChatTab + mobile MobileChat). Runs on every PR that touches canvas,
+# workspace-server, or this workflow file.
+#
+# Architecture:
+#   1. Ephemeral Postgres + Redis (docker, unique container names)
+#   2. workspace-server built from source, started with
+#      MOLECULE_ENV=development (fail-open auth)
+#   3. canvas dev server (npm run dev) on :3000
+#   4. Playwright tests create workspaces via API, point them at an
+#      in-process echo runtime, and exercise the full send/receive
+#      round-trip through the browser.
+#
+# Parallel-safety: same pattern as e2e-api.yml — per-run container names
+# and ephemeral host ports so concurrent jobs on the host-network runner
+# don't collide.
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [main, staging]
+
+concurrency:
+  group: e2e-chat-${{ github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: false
+
+env:
+  GITHUB_SERVER_URL: https://git.moleculesai.app
+
+jobs:
+  # bp-exempt: helper job; real gate is E2E Chat / E2E Chat (pull_request)
+  detect-changes:
+    # mc#1529 follow-on: pin to `docker-host` (Linux operator-host
+    # runners). The bare `ubuntu-latest` label is also advertised by
+    # hongming-pc-runner-* (Windows act_runner v1.0.3) where the
+    # docker.sock-bound steps below fail. Mirror of mc#1543
+    # (handlers-postgres-integration). See internal#512 for the class
+    # defect.
+    runs-on: docker-host
+    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
+    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    continue-on-error: true
+    outputs:
+      chat: ${{ steps.decide.outputs.chat }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - id: decide
+        run: |
+          BASE="${GITHUB_BASE_REF:-${{ github.event.before }}}"
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "${{ github.event.pull_request.base.sha }}" ]; then
+            BASE="${{ github.event.pull_request.base.sha }}"
+          fi
+          if [ -z "$BASE" ] || echo "$BASE" | grep -qE '^0+$'; then
+            echo "chat=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if ! git cat-file -e "$BASE" 2>/dev/null; then
+            git fetch --depth=1 origin "$BASE" 2>/dev/null || true
+          fi
+          if ! git cat-file -e "$BASE" 2>/dev/null; then
+            echo "chat=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          CHANGED=$(git diff --name-only "$BASE" HEAD)
+          if echo "$CHANGED" | grep -qE '^(canvas/|workspace-server/|\.gitea/workflows/e2e-chat\.yml$)'; then
+            echo "chat=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "chat=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  # bp-required: pending #1142 — new E2E check; add to branch protection after 3 green runs.
+  e2e-chat:
+    needs: detect-changes
+    name: E2E Chat
+    # mc#1529 follow-on: docker run/exec for postgres + redis containers.
+    # Must land on operator-host Linux (docker-host).
+    runs-on: docker-host
+    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
+    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    continue-on-error: true
+    timeout-minutes: 15
+    env:
+      PG_CONTAINER: pg-e2e-chat-${{ github.run_id }}-${{ github.run_attempt }}
+      REDIS_CONTAINER: redis-e2e-chat-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+      - name: No-op pass (paths filter excluded this commit)
+        if: needs.detect-changes.outputs.chat != 'true'
+        run: |
+          echo "No canvas / workspace-server / workflow changes — E2E Chat gate satisfied without running tests."
+          echo "::notice::E2E Chat no-op pass (paths filter excluded this commit)."
+
+      - if: needs.detect-changes.outputs.chat == 'true'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - if: needs.detect-changes.outputs.chat == 'true'
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: 'stable'
+          cache: true
+          cache-dependency-path: workspace-server/go.sum
+
+      - if: needs.detect-changes.outputs.chat == 'true'
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: canvas/package-lock.json
+
+      - name: Start Postgres (docker)
+        if: needs.detect-changes.outputs.chat == 'true'
+        run: |
+          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
+          docker run -d --name "$PG_CONTAINER" \
+            -e POSTGRES_USER=dev -e POSTGRES_PASSWORD=dev -e POSTGRES_DB=molecule \
+            -p 0:5432 postgres:16 >/dev/null
+          PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | awk -F: '/^0\.0\.0\.0:/ {print $2; exit}')
+          if [ -z "$PG_PORT" ]; then
+            PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | head -1 | awk -F: '{print $NF}')
+          fi
+          if [ -z "$PG_PORT" ]; then
+            echo "::error::Could not resolve host port for $PG_CONTAINER"
+            exit 1
+          fi
+          echo "PG_PORT=${PG_PORT}" >> "$GITHUB_ENV"
+          echo "DATABASE_URL=postgres://dev:dev@127.0.0.1:${PG_PORT}/molecule?sslmode=disable" >> "$GITHUB_ENV"
+          echo "E2E_DATABASE_URL=postgres://dev:dev@127.0.0.1:${PG_PORT}/molecule?sslmode=disable" >> "$GITHUB_ENV"
+          for i in $(seq 1 30); do
+            if docker exec "$PG_CONTAINER" pg_isready -U dev >/dev/null 2>&1; then
+              echo "Postgres ready after ${i}s"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "::error::Postgres did not become ready in 30s"
+          exit 1
+
+      - name: Start Redis (docker)
+        if: needs.detect-changes.outputs.chat == 'true'
+        run: |
+          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
+          docker run -d --name "$REDIS_CONTAINER" -p 0:6379 redis:7 >/dev/null
+          REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | awk -F: '/^0\.0\.0\.0:/ {print $2; exit}')
+          if [ -z "$REDIS_PORT" ]; then
+            REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | head -1 | awk -F: '{print $NF}')
+          fi
+          if [ -z "$REDIS_PORT" ]; then
+            echo "::error::Could not resolve host port for $REDIS_CONTAINER"
+            exit 1
+          fi
+          echo "REDIS_PORT=${REDIS_PORT}" >> "$GITHUB_ENV"
+          echo "REDIS_URL=redis://127.0.0.1:${REDIS_PORT}" >> "$GITHUB_ENV"
+          for i in $(seq 1 15); do
+            if docker exec "$REDIS_CONTAINER" redis-cli ping 2>/dev/null | grep -q PONG; then
+              echo "Redis ready after ${i}s"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "::error::Redis did not become ready in 15s"
+          exit 1
+
+      - name: Build platform
+        if: needs.detect-changes.outputs.chat == 'true'
+        working-directory: workspace-server
+        run: go build -o platform-server ./cmd/server
+
+      - name: Pick platform port
+        if: needs.detect-changes.outputs.chat == 'true'
+        run: |
+          PLATFORM_PORT=$(python3 - <<'PY'
+          import socket
+          with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+              s.bind(("127.0.0.1", 0))
+              print(s.getsockname()[1])
+          PY
+          )
+          echo "PLATFORM_PORT=${PLATFORM_PORT}" >> "$GITHUB_ENV"
+          echo "E2E_PLATFORM_URL=http://127.0.0.1:${PLATFORM_PORT}" >> "$GITHUB_ENV"
+          echo "Platform host port: ${PLATFORM_PORT}"
+
+      - name: Pick canvas port
+        if: needs.detect-changes.outputs.chat == 'true'
+        run: |
+          CANVAS_PORT=$(python3 - <<'PY'
+          import socket
+          with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+              s.bind(("127.0.0.1", 0))
+              print(s.getsockname()[1])
+          PY
+          )
+          echo "CANVAS_PORT=${CANVAS_PORT}" >> "$GITHUB_ENV"
+          echo "Canvas host port: ${CANVAS_PORT}"
+
+      - name: Start platform (background)
+        if: needs.detect-changes.outputs.chat == 'true'
+        working-directory: workspace-server
+        run: |
+          export MOLECULE_ENV=development
+          export DATABASE_URL="${DATABASE_URL}"
+          export REDIS_URL="${REDIS_URL}"
+          export PORT="${PLATFORM_PORT}"
+          export CORS_ORIGINS="http://localhost:3000,http://localhost:3001,http://localhost:${CANVAS_PORT},http://127.0.0.1:${CANVAS_PORT}"
+          ./platform-server > platform.log 2>&1 &
+          echo $! > platform.pid
+
+      - name: Wait for /health
+        if: needs.detect-changes.outputs.chat == 'true'
+        run: |
+          for i in $(seq 1 30); do
+            if curl -sf "http://127.0.0.1:${PLATFORM_PORT}/health" > /dev/null; then
+              echo "Platform up after ${i}s"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "::error::Platform did not become healthy in 30s"
+          cat workspace-server/platform.log || true
+          exit 1
+
+      - name: Install canvas dependencies
+        if: needs.detect-changes.outputs.chat == 'true'
+        working-directory: canvas
+        run: npm ci
+
+      - name: Install Playwright browsers
+        if: needs.detect-changes.outputs.chat == 'true'
+        working-directory: canvas
+        run: npx playwright install --with-deps chromium
+
+      - name: Start canvas dev server (background)
+        if: needs.detect-changes.outputs.chat == 'true'
+        working-directory: canvas
+        run: |
+          export NEXT_PUBLIC_PLATFORM_URL="http://127.0.0.1:${PLATFORM_PORT}"
+          export NEXT_PUBLIC_WS_URL="ws://127.0.0.1:${PLATFORM_PORT}/ws"
+          npx next dev --turbopack -p "${CANVAS_PORT}" > canvas.log 2>&1 &
+          echo $! > canvas.pid
+          for i in $(seq 1 30); do
+            if curl -sf "http://localhost:${CANVAS_PORT}" > /dev/null 2>&1; then
+              echo "Canvas up after ${i}s"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "::error::Canvas did not start in 30s"
+          cat canvas.log || true
+          exit 1
+
+      - name: Run Playwright E2E tests
+        if: needs.detect-changes.outputs.chat == 'true'
+        working-directory: canvas
+        run: |
+          export E2E_PLATFORM_URL="http://127.0.0.1:${PLATFORM_PORT}"
+          export E2E_DATABASE_URL="${DATABASE_URL}"
+          export PLAYWRIGHT_BASE_URL="http://localhost:${CANVAS_PORT}"
+          npx playwright test e2e/chat-desktop.spec.ts e2e/chat-mobile.spec.ts
+
+      - name: Dump platform log on failure
+        if: failure() && needs.detect-changes.outputs.chat == 'true'
+        run: cat workspace-server/platform.log || true
+
+      - name: Dump canvas log on failure
+        if: failure() && needs.detect-changes.outputs.chat == 'true'
+        run: cat canvas/canvas.log || true
+
+      - name: Upload Playwright report
+        if: failure() && needs.detect-changes.outputs.chat == 'true'
+        uses: actions/upload-artifact@v3.2.2
+        with:
+          name: playwright-report-chat
+          path: canvas/playwright-report/
+
+      - name: Stop canvas
+        if: always() && needs.detect-changes.outputs.chat == 'true'
+        run: |
+          if [ -f canvas/canvas.pid ]; then
+            kill "$(cat canvas/canvas.pid)" 2>/dev/null || true
+          fi
+
+      - name: Stop platform
+        if: always() && needs.detect-changes.outputs.chat == 'true'
+        run: |
+          if [ -f workspace-server/platform.pid ]; then
+            kill "$(cat workspace-server/platform.pid)" 2>/dev/null || true
+          fi
+
+      - name: Stop service containers
+        if: always() && needs.detect-changes.outputs.chat == 'true'
+        run: |
+          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
+          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
@@ -52,6 +52,30 @@ name: E2E Peer Visibility (literal MCP list_peers)
 #     flip-to-required-ready (mirrors e2e-staging-saas.yml's proven shape;
 #     real EC2-provisioning E2E is push/dispatch/cron only — it is 30+ min
 #     and cannot run per-PR-update).
+#
+# LOCAL BACKEND (added 2026-05-15 — feedback_local_must_mimic_production,
+# feedback_mandatory_local_e2e_before_ship, feedback_local_test_before_
+# staging_e2e)
+# --------------------------------------------------------------------
+# The standing rule is that the local prod-mimic stack runs a MANDATORY
+# local-Postgres E2E BEFORE staging E2E. A staging-only peer-visibility
+# gate caught regressions late + expensively (cold EC2). The
+# `peer-visibility-local` job below runs the SAME byte-identical
+# assertion (tests/e2e/lib/peer_visibility_assert.sh) against the local
+# docker-compose stack — built + booted exactly like e2e-api.yml's
+# proven E2E API Smoke Test job (ephemeral pg/redis ports, go build,
+# background platform-server). It runs on PR + push (local boot is
+# minutes, not the 30+ min cold-EC2 path), so peer-visibility is part of
+# the local gate that fires before the staging E2E.
+#
+# It is its OWN non-required status context `E2E Peer Visibility (local)`
+# — same non-required-by-design decision as the staging job (red until
+# Hermes-401 #162 / OpenClaw-never-online #165 land; flip-to-required
+# tracked at molecule-core#1296). It is an HONEST gate: NO
+# continue-on-error mask (feedback_fix_root_not_symptom). It is kept a
+# distinct context (not folded into e2e-api.yml's required `E2E API
+# Smoke Test`) precisely so a deliberately-RED-today gate cannot wedge
+# the required local-E2E job or any unrelated merge.

 on:
  push:
@@ -65,6 +89,8 @@ on:
      - 'workspace/a2a_mcp_server.py'
      - 'workspace/platform_tools/registry.py'
      - 'tests/e2e/test_peer_visibility_mcp_staging.sh'
+      - 'tests/e2e/test_peer_visibility_mcp_local.sh'
+      - 'tests/e2e/lib/peer_visibility_assert.sh'
      - '.gitea/workflows/e2e-peer-visibility.yml'
  pull_request:
    branches: [main]
@@ -77,6 +103,8 @@ on:
      - 'workspace/a2a_mcp_server.py'
      - 'workspace/platform_tools/registry.py'
      - 'tests/e2e/test_peer_visibility_mcp_staging.sh'
+      - 'tests/e2e/test_peer_visibility_mcp_local.sh'
+      - 'tests/e2e/lib/peer_visibility_assert.sh'
      - '.gitea/workflows/e2e-peer-visibility.yml'
  workflow_dispatch:
  schedule:
@@ -108,16 +136,160 @@ jobs:
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Validate driving script
+      - name: Validate driving scripts + shared assertion lib
        run: |
+          bash -n tests/e2e/lib/peer_visibility_assert.sh
+          echo "lib/peer_visibility_assert.sh — bash syntax OK"
          bash -n tests/e2e/test_peer_visibility_mcp_staging.sh
          echo "test_peer_visibility_mcp_staging.sh — bash syntax OK"
-          echo "Real fresh-provision MCP list_peers E2E runs on push to"
+          bash -n tests/e2e/test_peer_visibility_mcp_local.sh
+          echo "test_peer_visibility_mcp_local.sh — bash syntax OK"
+          echo "Staging fresh-provision MCP list_peers E2E runs on push to"
          echo "main / workflow_dispatch / daily cron (30+ min EC2 boot)."
+          echo "The LOCAL backend runs in the peer-visibility-local job"
+          echo "below on this same PR (local docker-compose stack)."

-  # Real gate: provisions a throwaway org + sibling-per-runtime, drives
-  # the LITERAL list_peers MCP call per runtime, asserts 200 + expected
-  # peer set, then scoped teardown. push(main)/dispatch/cron only.
+  # LOCAL gate: same byte-identical assertion against the local prod-mimic
+  # docker-compose stack — the MANDATORY local-E2E that must run BEFORE
+  # the staging E2E (feedback_mandatory_local_e2e_before_ship,
+  # feedback_local_test_before_staging_e2e). Bootstrap mirrors
+  # e2e-api.yml's proven E2E API Smoke Test job (per-run container names +
+  # ephemeral host ports so concurrent host-network act_runner runs don't
+  # collide; go build; background platform-server). Its OWN non-required
+  # status context `E2E Peer Visibility (local)` — non-required-by-design
+  # exactly like the staging job (red until #162/#165 land;
+  # flip-to-required tracked at molecule-core#1296). HONEST gate, NO
+  # continue-on-error mask (feedback_fix_root_not_symptom). Runs on PR +
+  # push (local boot is minutes, not the 30+ min cold-EC2 path).
+  # bp-required: pending #1296
+  peer-visibility-local:
+    name: E2E Peer Visibility (local)
+    runs-on: docker-host
+    timeout-minutes: 30
+    env:
+      # Per-run names + ephemeral ports — same collision-avoidance as
+      # e2e-api.yml (host-network act_runner; feedback_act_runner_*).
+      PG_CONTAINER: pg-e2e-pv-${{ github.run_id }}-${{ github.run_attempt }}
+      REDIS_CONTAINER: redis-e2e-pv-${{ github.run_id }}-${{ github.run_attempt }}
+      # LLM keys so hermes/openclaw can actually boot. The local script
+      # SKIPs (not fails) any runtime whose key is absent, so a partially
+      # keyed CI env still exercises whatever it can.
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.E2E_CLAUDE_CODE_OAUTH_TOKEN }}
+      E2E_MINIMAX_API_KEY: ${{ secrets.MOLECULE_STAGING_MINIMAX_API_KEY }}
+      E2E_ANTHROPIC_API_KEY: ${{ secrets.MOLECULE_STAGING_ANTHROPIC_API_KEY }}
+      E2E_OPENAI_API_KEY: ${{ secrets.MOLECULE_STAGING_OPENAI_API_KEY }}
+      PV_RUNTIMES: "hermes openclaw claude-code"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: 'stable'
+          cache: true
+          cache-dependency-path: workspace-server/go.sum
+      - name: Pre-pull alpine + ensure provisioner network
+        run: |
+          docker pull alpine:latest >/dev/null
+          docker network create molecule-core-net >/dev/null 2>&1 || true
+          echo "alpine:latest pre-pulled; molecule-core-net ensured."
+      - name: Start Postgres (docker, ephemeral port)
+        run: |
+          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
+          docker run -d --name "$PG_CONTAINER" \
+            -e POSTGRES_USER=dev -e POSTGRES_PASSWORD=dev -e POSTGRES_DB=molecule \
+            -p 0:5432 postgres:16 >/dev/null
+          PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | awk -F: '/^0\.0\.0\.0:/ {print $2; exit}')
+          [ -n "$PG_PORT" ] || PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | head -1 | awk -F: '{print $NF}')
+          if [ -z "$PG_PORT" ]; then
+            echo "::error::Could not resolve host port for $PG_CONTAINER"
+            docker logs "$PG_CONTAINER" || true; exit 1
+          fi
+          echo "DATABASE_URL=postgres://dev:dev@127.0.0.1:${PG_PORT}/molecule?sslmode=disable" >> "$GITHUB_ENV"
+          for i in $(seq 1 30); do
+            docker exec "$PG_CONTAINER" pg_isready -U dev >/dev/null 2>&1 && { echo "Postgres ready after ${i}s"; exit 0; }
+            sleep 1
+          done
+          echo "::error::Postgres did not become ready in 30s"; docker logs "$PG_CONTAINER" || true; exit 1
+      - name: Start Redis (docker, ephemeral port)
+        run: |
+          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
+          docker run -d --name "$REDIS_CONTAINER" -p 0:6379 redis:7 >/dev/null
+          REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | awk -F: '/^0\.0\.0\.0:/ {print $2; exit}')
+          [ -n "$REDIS_PORT" ] || REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | head -1 | awk -F: '{print $NF}')
+          if [ -z "$REDIS_PORT" ]; then
+            echo "::error::Could not resolve host port for $REDIS_CONTAINER"
+            docker logs "$REDIS_CONTAINER" || true; exit 1
+          fi
+          echo "REDIS_URL=redis://127.0.0.1:${REDIS_PORT}" >> "$GITHUB_ENV"
+          for i in $(seq 1 15); do
+            docker exec "$REDIS_CONTAINER" redis-cli ping 2>/dev/null | grep -q PONG && { echo "Redis ready after ${i}s"; exit 0; }
+            sleep 1
+          done
+          echo "::error::Redis did not become ready in 15s"; docker logs "$REDIS_CONTAINER" || true; exit 1
+      - name: Build platform
+        working-directory: workspace-server
+        run: go build -o platform-server ./cmd/server
+      - name: Pick platform port
+        run: |
+          PLATFORM_PORT=$(python3 - <<'PY'
+          import socket
+          with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+              s.bind(("127.0.0.1", 0))
+              print(s.getsockname()[1])
+          PY
+          )
+          echo "PORT=${PLATFORM_PORT}" >> "$GITHUB_ENV"
+          echo "BASE=http://127.0.0.1:${PLATFORM_PORT}" >> "$GITHUB_ENV"
+          echo "Platform host port: ${PLATFORM_PORT}"
+      - name: Kill stale platform-server before start
+        run: |
+          killed=0
+          for pid in $(grep -l "platform-serve" /proc/[0-9]*/comm 2>/dev/null); do
+            kpid="${pid%/comm}"; kpid="${kpid##*/}"
+            cmdline=$(cat "/proc/${kpid}/cmdline" 2>/dev/null | tr '\0' ' ')
+            if echo "$cmdline" | grep -q "platform-server"; then
+              echo "Killing stale platform-server pid ${kpid}"
+              kill "$kpid" 2>/dev/null || true; killed=$((killed + 1))
+            fi
+          done
+          [ "$killed" -gt 0 ] && sleep 2 || true
+          echo "stale-kill done ($killed killed)"
+      - name: Start platform (background)
+        working-directory: workspace-server
+        run: |
+          ./platform-server > platform.log 2>&1 &
+          echo $! > platform.pid
+      - name: Wait for /health
+        run: |
+          for i in $(seq 1 30); do
+            curl -sf "$BASE/health" > /dev/null && { echo "Platform up after ${i}s"; exit 0; }
+            sleep 1
+          done
+          echo "::error::Platform did not become healthy in 30s"
+          cat workspace-server/platform.log || true; exit 1
+      - name: Run LOCAL fresh-provision peer-visibility E2E (literal MCP list_peers)
+        # HONEST gate — NO continue-on-error. Red today (Hermes-401 #162 /
+        # OpenClaw-never-online #165 not yet fixed); green when they land.
+        # Non-required-by-design via its distinct status context until the
+        # molecule-core#1296 flip-to-required.
+        run: bash tests/e2e/test_peer_visibility_mcp_local.sh
+      - name: Dump platform log on failure
+        if: failure()
+        run: cat workspace-server/platform.log || true
+      - name: Stop platform
+        if: always()
+        run: |
+          if [ -f workspace-server/platform.pid ]; then
+            kill "$(cat workspace-server/platform.pid)" 2>/dev/null || true
+          fi
+      - name: Stop service containers
+        if: always()
+        run: |
+          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
+          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
+
+  # Real STAGING gate: provisions a throwaway org + sibling-per-runtime,
+  # drives the LITERAL list_peers MCP call per runtime, asserts 200 +
+  # expected peer set, then scoped teardown. push(main)/dispatch/cron only.
  peer-visibility:
    name: E2E Peer Visibility
    runs-on: ubuntu-latest
@@ -52,5 +52,9 @@ jobs:
          # explicitly instead of the combined state avoids false-pause when
          # non-blocking jobs (continue-on-error: true) have failed — those
          # failures pollute combined state but do not gate merges.
+          # NOTE: the event-suffixed context name is intentional — branch protection
+          # MUST require `CI / all-required (pull_request)` (with suffix), NOT the
+          # bare `CI / all-required`. Gitea treats absent contexts as pending, not
+          # skipped; requiring the bare name silently blocks all merges (issue #1473).
          PUSH_REQUIRED_CONTEXTS: CI / all-required (push)
        run: python3 .gitea/scripts/gitea-merge-queue.py
@@ -77,7 +77,16 @@ env:
 jobs:
  detect-changes:
    name: detect-changes
-    runs-on: ubuntu-latest
+    # mc#1529 §1: pin to `docker-host` so the integration job runs on the
+    # operator-host runners (molecule-runner-*), which carry the
+    # `molecule-core-net` bridge network this workflow depends on. PC2
+    # runners (hongming-pc-runner-*) also advertise ubuntu-latest but
+    # don't have that network — the previous `runs-on: ubuntu-latest`
+    # rolled the dice and hard-failed the bridge-inspect step ~30% of
+    # the time. detect-changes itself doesn't need the bridge, but keeping
+    # both jobs on the same label avoids workspace-volume cross-host
+    # surprises and keeps the routing rule discoverable in one place.
+    runs-on: docker-host
    # mc#774 Phase 3 (RFC §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -129,7 +138,9 @@ jobs:
  integration:
    name: Handlers Postgres Integration
    needs: detect-changes
-    runs-on: ubuntu-latest
+    # mc#1529 §1: must run on operator-host (where `molecule-core-net`
+    # exists). See detect-changes for the full routing rationale.
+    runs-on: docker-host
    # mc#774 Phase 3 (RFC §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -62,7 +62,13 @@ env:
 jobs:
  # bp-exempt: change detector only; downstream Harness Replays is the meaningful gate.
  detect-changes:
-    runs-on: ubuntu-latest
+    # mc#1529 follow-on: pin to `docker-host` so this lane lands on
+    # Linux operator-host runners (the only ones with a working
+    # docker.sock + `molecule-core-net`). The bare `ubuntu-latest`
+    # label is also matched by hongming-pc-runner-* (Windows act_runner
+    # v1.0.3), where the `docker compose ...` exec below fails. Mirror
+    # of mc#1543; see internal#512 for class defect.
+    runs-on: docker-host
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -162,7 +168,9 @@ jobs:
  harness-replays:
    needs: detect-changes
    name: Harness Replays
-    runs-on: ubuntu-latest
+    # mc#1529 follow-on: `docker compose ... ps/logs` against tenant-alpha/
+    # beta containers. Must run on operator-host Linux (docker-host).
+    runs-on: docker-host
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -0,0 +1,168 @@
+name: Lint forbidden tenant-env keys
+
+# RFC#523 Layer 3 (task #146): scan workspace_secrets-writer Go code
+# under workspace-server/ for new code that hardcodes a forbidden
+# operator-scope env var NAME (GITEA_TOKEN, CP_ADMIN_API_TOKEN,
+# RAILWAY_TOKEN, INFISICAL_OPERATOR_TOKEN, MOLECULE_OPERATOR_*, …).
+#
+# Catches the class "a new writer accidentally widens the propagation
+# set" — e.g. a future env-mutator plugin that sets envVars["GITEA_TOKEN"]
+# directly. Today the L1 runtime guard would abort the provision, but
+# this lint surfaces the offending code at PR review time instead of
+# at first provision attempt.
+#
+# Companion layers:
+#   - L1: workspace-server/internal/handlers/workspace_provision_forbidden_env.go
+#         (fail-closed abort at provision time)
+#   - L2: workspace/entrypoint.sh top-of-file env-grep + exit 1
+#
+# Open-source-template-friendly: the deny pattern is generic. A fork
+# can copy this workflow and replace OPERATOR_KEY_PATTERN with its
+# own operator-scope key names.
+#
+# Path-filter discipline:
+#   This workflow runs on every PR (no paths: filter — see
+#   feedback_path_filtered_workflow_cant_be_required). The scan itself
+#   targets workspace_secrets-writer paths via grep -r; it's fast
+#   (sub-second) so unconditional run is fine.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main, staging]
+
+env:
+  GITHUB_SERVER_URL: https://git.moleculesai.app
+
+jobs:
+  scan:
+    name: Scan workspace_secrets writers for forbidden env keys
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: Scan for forbidden operator-scope env key NAMES in writer paths
+        run: |
+          set -euo pipefail
+
+          # Forbidden EXACT-MATCH env var names. Kept in lockstep with
+          # workspace-server/internal/handlers/workspace_provision_forbidden_env.go
+          # forbiddenTenantEnvKeys. The Go-side test
+          # TestIsForbiddenTenantEnvKey_ExactMatches is the source of
+          # truth — if Go-side adds a key, also add it here (and
+          # vice-versa). Drift between the two is the failure mode this
+          # entire 3-layer guardrail is designed to catch.
+          FORBIDDEN_KEYS=(
+            "GITEA_TOKEN" "GITEA_PAT"
+            "GITHUB_TOKEN" "GITHUB_PAT" "GH_TOKEN"
+            "GITLAB_TOKEN" "GL_TOKEN"
+            "BITBUCKET_TOKEN"
+            "CP_ADMIN_API_TOKEN" "CP_ADMIN_TOKEN"
+            "INFISICAL_OPERATOR_TOKEN" "INFISICAL_BOOTSTRAP_TOKEN"
+            "RAILWAY_TOKEN" "RAILWAY_PERSONAL_API_TOKEN"
+            "HETZNER_TOKEN" "HETZNER_API_TOKEN"
+          )
+
+          # Forbidden PREFIX patterns — operator-scope families.
+          FORBIDDEN_PREFIXES=(
+            "MOLECULE_OPERATOR_"
+          )
+
+          # Writer paths: Go source under workspace-server/ that
+          # writes to the env-vars map or to workspace_secrets DB rows.
+          # Tests, the forbidden-env source itself, and the silent-
+          # strip denylist are exempt (they LIST the keys by design).
+          SCAN_ROOT="workspace-server/internal"
+          # Exempt paths fall in two classes:
+          #   1. The deny-set definitions + the silent-strip denylist:
+          #      they LIST the forbidden names by design.
+          #   2. Pre-RFC#523 persona-merge / config-read paths that
+          #      already handle these names correctly (the silent-
+          #      strip downstream + the new L1 fail-closed cover the
+          #      runtime risk; these reads are unchanged).
+          # New code MUST NOT be added to this list without reviewer
+          # signoff and a one-line justification in this diff.
+          EXEMPT_PATHS=(
+            # Class 1 — deny-set definitions
+            "workspace-server/internal/handlers/workspace_provision_forbidden_env.go"
+            "workspace-server/internal/handlers/workspace_provision_forbidden_env_test.go"
+            "workspace-server/internal/provisioner/provisioner.go"
+            "workspace-server/internal/provisioner/provisioner_test.go"
+            # Class 2 — pre-existing persona-fallback / org-helper paths
+            # that set the GITEA_TOKEN fallback lane (stripped downstream
+            # by provisioner.buildContainerEnv per forensic #145). The
+            # new L1 fail-closed runs BEFORE these writers, so any
+            # operator-scope leak via global/workspace_secrets is
+            # already caught. See applyAgentGitHTTPCreds doc-comment.
+            "workspace-server/internal/handlers/agent_git_identity.go"
+            "workspace-server/internal/handlers/org_helpers.go"
+            "workspace-server/internal/handlers/org.go"
+            # Class 2 — CP→platform admin auth (NOT a tenant env write;
+            # this is the control-plane HTTP auth header source).
+            "workspace-server/internal/provisioner/cp_provisioner.go"
+          )
+
+          # Build a single grep -F pattern: every forbidden key wrapped
+          # in quotes (Go string-literal form, which is how env-map
+          # writes appear). e.g. envVars["GITEA_TOKEN"] = ... or
+          # `"GITEA_TOKEN":` in a literal-map declaration.
+          #
+          # We deliberately match the quoted form so a comment that
+          # happens to spell the name without quotes (e.g. "see
+          # GITEA_TOKEN below") doesn't trip the lint.
+          PATTERN=""
+          for k in "${FORBIDDEN_KEYS[@]}"; do
+            PATTERN="${PATTERN}\"${k}\"\n"
+          done
+          for p in "${FORBIDDEN_PREFIXES[@]}"; do
+            # Prefix match needs a regex; switch to grep -E below for
+            # this slice. Kept conceptually here so the deny set lives
+            # in one place; scan is run twice (literal + prefix).
+            true
+          done
+
+          # Build exempt-paths grep filter — `grep -v -f` style.
+          EXEMPT_FILTER=$(mktemp)
+          trap 'rm -f "$EXEMPT_FILTER"' EXIT
+          for p in "${EXEMPT_PATHS[@]}"; do
+            echo "$p" >> "$EXEMPT_FILTER"
+          done
+
+          # --- Exact-match scan ---
+          HITS=""
+          for k in "${FORBIDDEN_KEYS[@]}"; do
+            # Only .go files; skip _test.go for the writer-path scan
+            # since tests legitimately reference the names. The
+            # writer-path lint targets PRODUCTION code only.
+            found=$(grep -rn --include='*.go' --exclude='*_test.go' "\"${k}\"" "$SCAN_ROOT" 2>/dev/null \
+                    | grep -v -F -f "$EXEMPT_FILTER" || true)
+            if [ -n "$found" ]; then
+              HITS="${HITS}${found}\n"
+            fi
+          done
+
+          # --- Prefix scan ---
+          for prefix in "${FORBIDDEN_PREFIXES[@]}"; do
+            found=$(grep -rnE --include='*.go' --exclude='*_test.go' "\"${prefix}[A-Z0-9_]+\"" "$SCAN_ROOT" 2>/dev/null \
+                    | grep -v -F -f "$EXEMPT_FILTER" || true)
+            if [ -n "$found" ]; then
+              HITS="${HITS}${found}\n"
+            fi
+          done
+
+          if [ -n "$HITS" ]; then
+            echo "::error::RFC#523 Layer 3: forbidden operator-scope env var name(s) hardcoded in tenant-workspace writer paths:"
+            printf "$HITS"
+            echo ""
+            echo "These env-var NAMES are on the operator-scope deny list (see"
+            echo "workspace-server/internal/handlers/workspace_provision_forbidden_env.go)."
+            echo "If your code legitimately needs to inject one of these for a"
+            echo "non-tenant code path, add the file to EXEMPT_PATHS in this"
+            echo "workflow with a one-line justification — reviewer signoff required."
+            exit 1
+          fi
+
+          echo "OK No forbidden operator-scope env key names hardcoded in writer paths."
@@ -0,0 +1,182 @@
+name: Lint no tenant GITEA or GITHUB token write
+
+# Task #146 — CI guardrail companion to RFC#523's `lint-forbidden-env-keys.yml`.
+#
+# `lint-forbidden-env-keys.yml` (Layer 3) catches code that hardcodes a
+# forbidden env-var key NAME as a quoted literal in workspace_secrets
+# writer paths under workspace-server/internal/.
+#
+# This workflow catches a BROADER class: any code path that reads a
+# repo-host token (GITEA_TOKEN / GITHUB_TOKEN / GH_TOKEN) and then writes
+# it into a TENANT WORKSPACE's env, secret store, user-data, or
+# provision payload. This is the actual RFC#523 threat-model statement —
+# the goal is "no tenant workspace ever receives an operator-scope repo
+# token," not just "no _quoted_ literal `GITEA_TOKEN`." A future writer
+# could route the value via a variable, a struct field, or a config key
+# and slip past the existing literal scan; this lint catches those
+# routing patterns at PR review time.
+#
+# Scope
+#   Scans the WHOLE repo's Go sources (not just workspace-server/) for
+#   co-occurrences of:
+#     - a repo-host token NAME (GITEA_TOKEN / GITHUB_TOKEN / GH_TOKEN /
+#       GITEA_PAT / GITHUB_PAT) used as os.Getenv argument or string
+#       literal
+#     - within a file that ALSO references a tenant-writer surface
+#       (`tenant`, `workspace_secrets`, `global_secrets`, `seedAllowList`,
+#       `/settings/secrets`, `userData`, `provisionPayload`,
+#       `envVars[`, `containerEnv`).
+#
+#   Co-occurrence (not single-line) is the false-positive control: a
+#   file that just LOGS the variable name (e.g. "missing GITEA_TOKEN")
+#   without touching any tenant surface won't fire.
+#
+# Drift contract with lint-forbidden-env-keys.yml
+#   Both lints share the same FORBIDDEN_KEYS list (a subset — only the
+#   repo-host tokens, since this lint's threat model is "tenant gets
+#   write access to operator's git host"). If RFC#523's deny set grows,
+#   update BOTH this file AND lint-forbidden-env-keys.yml AND the Go
+#   source-of-truth in
+#   workspace-server/internal/handlers/workspace_provision_forbidden_env.go.
+#
+# Open-source-template-friendly
+#   The patterns scanned are generic (no MOLECULE_-prefix literals).
+#   A fork can copy this workflow as-is and adjust FORBIDDEN_KEYS.
+#
+# Path-filter discipline
+#   No `paths:` filter — required-status workflows must run on every PR
+#   per `feedback_path_filtered_workflow_cant_be_required`. Scan is
+#   sub-second.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main, staging]
+
+env:
+  GITHUB_SERVER_URL: https://git.moleculesai.app
+
+jobs:
+  # bp-exempt: advisory RFC#523 lint; PR review gate is review-driven, not BP-driven.
+  # (Carried with the workflow-name rename in PR mc#1593 so the renamed
+  # context emission satisfies lint_required_context_exists_in_bp Tier 2g.)
+  scan:
+    name: Scan for repo-host token write into tenant workspace surface
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: Find Go files referencing a tenant-writer surface AND a repo-host token
+        run: |
+          set -euo pipefail
+
+          # Repo-host token NAMES — the threat-model subset. Operator-fleet
+          # tokens (CP_ADMIN_API_TOKEN, RAILWAY_TOKEN, INFISICAL_*) are
+          # caught by lint-forbidden-env-keys.yml's broader deny set; this
+          # lint focuses on the git-host class so a single co-occurrence
+          # match has a low false-positive rate.
+          FORBIDDEN_KEYS=(
+            "GITEA_TOKEN"
+            "GITEA_PAT"
+            "GITHUB_TOKEN"
+            "GITHUB_PAT"
+            "GH_TOKEN"
+          )
+
+          # Tenant-writer surface markers. A file matches the surface set
+          # if it references ANY of these strings. This is the "is this
+          # code path writing into a tenant workspace?" heuristic.
+          # Curated to catch the actual code shapes used in this repo
+          # (verified by grep against current main 2026-05-19):
+          #   - "workspace_secrets" / "global_secrets"  → DB table writes
+          #   - "seedAllowList"                          → CP-side seed table
+          #   - "/settings/secrets"                      → tenant HTTP API write
+          #   - "envVars["                               → in-memory env map write
+          #   - "containerEnv"                           → docker-run env-set
+          #   - "userData"                               → EC2 user-data script
+          #   - "provisionPayload" / "provisionContext"  → provision-request shape
+          SURFACE_PATTERN='workspace_secrets|global_secrets|seedAllowList|/settings/secrets|envVars\[|containerEnv|userData|provisionPayload|provisionContext'
+
+          # Files that legitimately reference these names AND a surface
+          # marker, but do so for guard / strip / test / doc-comment
+          # reasons. New entries require reviewer signoff and a one-line
+          # justification in the diff.
+          EXEMPT_FILES=(
+            # RFC#523 L1 deny-set source-of-truth + tests
+            "workspace-server/internal/handlers/workspace_provision_forbidden_env.go"
+            "workspace-server/internal/handlers/workspace_provision_forbidden_env_test.go"
+            # Forensic-#145 silent-strip denylist (defense-in-depth, by design lists the names)
+            "workspace-server/internal/provisioner/provisioner.go"
+            "workspace-server/internal/provisioner/provisioner_test.go"
+            # Pre-RFC#523 persona-fallback / org-helper paths. The L1
+            # fail-closed runs BEFORE these writers; downstream silent-strip
+            # also covers them. See applyAgentGitHTTPCreds doc-comment.
+            "workspace-server/internal/handlers/agent_git_identity.go"
+            "workspace-server/internal/handlers/org_helpers.go"
+            "workspace-server/internal/handlers/org.go"
+            # CP→platform admin auth (NOT a tenant env write).
+            "workspace-server/internal/provisioner/cp_provisioner.go"
+          )
+
+          # Build an extended-regex alternation of forbidden keys.
+          KEY_ALT="$(IFS='|'; echo "${FORBIDDEN_KEYS[*]}")"
+
+          # Find candidate files: Go non-test sources that contain a
+          # tenant-writer surface marker.
+          mapfile -t CANDIDATES < <(
+            grep -rlE --include='*.go' --exclude='*_test.go' \
+              "${SURFACE_PATTERN}" . 2>/dev/null \
+            | sed 's|^\./||' \
+            | sort -u
+          )
+
+          if [ "${#CANDIDATES[@]}" -eq 0 ]; then
+            echo "OK No tenant-writer-surface files found in tree (unexpected, but not a lint failure)."
+            exit 0
+          fi
+
+          HITS=""
+          for f in "${CANDIDATES[@]}"; do
+            # Skip exempt files.
+            skip=0
+            for ex in "${EXEMPT_FILES[@]}"; do
+              if [ "$f" = "$ex" ]; then skip=1; break; fi
+            done
+            [ "$skip" = "1" ] && continue
+
+            # File contains a surface marker; now grep for a forbidden
+            # key NAME. We require a QUOTED-literal match to avoid
+            # firing on a comment like "// also handle GITEA_TOKEN".
+            #
+            # The literal form catches:
+            #   - os.Getenv("GITEA_TOKEN")
+            #   - envVars["GITEA_TOKEN"] = ...
+            #   - {envKey: "GITEA_TOKEN", tenantKey: "GITEA_TOKEN"}
+            # but not:
+            #   - // see GITEA_TOKEN below   (no quotes)
+            found=$(grep -nE "\"(${KEY_ALT})\"" "$f" 2>/dev/null || true)
+            if [ -n "$found" ]; then
+              HITS="${HITS}--- ${f} ---\n${found}\n"
+            fi
+          done
+
+          if [ -n "$HITS" ]; then
+            echo "::error::Task #146 lint: repo-host token name(s) quoted in a tenant-writer-surface file:"
+            printf "$HITS"
+            echo ""
+            echo "These files reference a tenant-writer surface (workspace_secrets,"
+            echo "seedAllowList, /settings/secrets, containerEnv, userData, etc.)"
+            echo "AND quote a repo-host token name (GITEA_TOKEN/GITHUB_TOKEN/…)."
+            echo "Per RFC#523 threat model, tenant workspaces MUST NOT receive"
+            echo "operator-scope repo-host tokens. If your code legitimately needs"
+            echo "to reference one of these names in a tenant-writer file (e.g."
+            echo "a deny-set definition or silent-strip list), add the file to"
+            echo "EXEMPT_FILES with a one-line justification — reviewer signoff"
+            echo "required."
+            exit 1
+          fi
+
+          echo "OK No tenant-writer-surface file co-mentions a repo-host token literal."
@@ -0,0 +1,163 @@
+name: lint-required-workflows-docker-host-pinned
+
+# Fail-closed lint that catches workflows touching docker.sock without
+# pinning `runs-on:` to a Linux-only label.
+#
+# Class defect (internal#512 + mc#1529 + today's oc#81/82/83 + autogen#8):
+# the `ubuntu-latest` label is advertised by BOTH the Linux operator-host
+# runners (molecule-runner-*) AND the Windows act_runner v1.0.3 on
+# hongming-pc-runner-*. Job placement is non-deterministic. When a docker-
+# bound job lands on a Windows runner, `docker run`/`docker login`/
+# `docker compose` fail with platform-specific errors ("protocol not
+# available", "cannot exec", etc.) — placement-dependent, not transient.
+#
+# This lint enforces the convention: any workflow whose YAML body
+# contains a docker exec (`docker run|build|buildx|compose|pull|push|
+# exec|tag|login|cp|inspect|ps` OR `docker/build-push-action|docker/
+# login-action|docker/setup-buildx`) MUST pin every job's `runs-on:` to
+# one of:
+#   - docker-host  (general docker.sock work — molecule-runner-*)
+#   - publish      (image build/push — molecule-runner-publish-*)
+#
+# Comments and heredoc/markdown bodies that merely MENTION docker are
+# excluded by the detection rule (see scan.py below).
+#
+# Per `feedback_never_skip_ci`: this is fail-closed (exit 1 on miss).
+
+on:
+  pull_request:
+    paths:
+      - '.gitea/workflows/**'
+      - '.github/workflows/**'
+  push:
+    branches: [main, staging]
+    paths:
+      - '.gitea/workflows/**'
+      - '.github/workflows/**'
+
+permissions:
+  contents: read
+
+env:
+  GITHUB_SERVER_URL: https://git.moleculesai.app
+
+jobs:
+  lint-docker-host-pin:
+    name: Lint docker-host pin on docker-touching workflows
+    runs-on: docker-host
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Scan workflows for docker-bound jobs missing docker-host/publish pin
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import os
+          import re
+          import sys
+
+          # Docker-step detection: real exec, not just word-mention in comments.
+          # We strip comment-only lines, then look for the docker subcommand
+          # tokens at word-boundary, OR uses: docker/* actions.
+          DOCKER_EXEC = re.compile(
+              r'(?<!\w)docker\s+(run|build|buildx|compose|pull|push|exec|tag|login|cp|inspect|ps)\b'
+          )
+          DOCKER_ACTION = re.compile(
+              r'uses:\s*docker/(build-push-action|login-action|setup-buildx-action|setup-qemu-action)'
+          )
+          # Detect a job header line like `  myjob:` (2-space indent) AND its runs-on.
+          JOB_HEADER = re.compile(r'^( {2})([a-zA-Z0-9_-]+):\s*$')
+          RUNS_ON    = re.compile(r'^( {4})runs-on:\s*(.+?)\s*$')
+
+          ALLOWED_LABELS = {'docker-host', 'publish'}
+
+          fails = []
+          warnings = []
+
+          roots = []
+          for root in ('.gitea/workflows', '.github/workflows'):
+              if os.path.isdir(root):
+                  roots.append(root)
+
+          for root in roots:
+              for fn in sorted(os.listdir(root)):
+                  if not (fn.endswith('.yml') or fn.endswith('.yaml')):
+                      continue
+                  path = os.path.join(root, fn)
+                  with open(path) as f:
+                      raw_lines = f.readlines()
+
+                  # Parse job headers + their runs-on. Simple line scan; relies on
+                  # 2-space job indent + 4-space runs-on indent under `jobs:`.
+                  jobs = []
+                  current = None
+                  in_jobs = False
+                  for i, line in enumerate(raw_lines, 1):
+                      if re.match(r'^jobs:\s*$', line):
+                          in_jobs = True
+                          continue
+                      if not in_jobs:
+                          continue
+                      mh = JOB_HEADER.match(line)
+                      if mh:
+                          if current:
+                              current['end'] = i - 1
+                              jobs.append(current)
+                          current = {'name': mh.group(2), 'line': i, 'end': len(raw_lines), 'runs_on': None}
+                          continue
+                      mr = RUNS_ON.match(line)
+                      if mr and current and current['runs_on'] is None:
+                          current['runs_on'] = mr.group(2).strip()
+                  if current:
+                      jobs.append(current)
+
+                  for j in jobs:
+                      # Strip pure-comment lines for docker-exec detection so
+                      # documentation comments don't trigger the lint. Scan the
+                      # current job body only: a workflow may contain one
+                      # docker-bound job and several harmless metadata jobs.
+                      job_lines = raw_lines[j['line'] - 1:j['end']]
+                      scan_text = ''.join(
+                          l for l in job_lines
+                          if not re.match(r'^\s*#', l)
+                      )
+                      has_docker = bool(DOCKER_EXEC.search(scan_text)) or bool(DOCKER_ACTION.search(scan_text))
+                      if not has_docker:
+                          continue
+                      ro = j['runs_on']
+                      if ro is None:
+                          # Reusable workflow caller (`uses:` instead of `runs-on:`) —
+                          # skip; rule enforced in the called workflow.
+                          continue
+                      # Strip surrounding [ ] and quotes.
+                      ro_norm = ro.strip('[]').strip().strip('"\'')
+                      # Multi-label "[a, b]" — split.
+                      labels = [t.strip().strip('"\'') for t in ro_norm.split(',') if t.strip()]
+                      if any(lbl in ALLOWED_LABELS for lbl in labels):
+                          continue
+                      # Allow caller-supplied label expressions; spell the
+                      # marker indirectly so Gitea's expression parser does
+                      # not try to parse this Python heredoc.
+                      expression_marker = '$' + '{{'
+                      if any(expression_marker in lbl for lbl in labels):
+                          continue
+                      fails.append(
+                          f"{path}:{j['line']}: job `{j['name']}` uses docker but runs-on={ro!r} "
+                          f"(must be one of {sorted(ALLOWED_LABELS)})"
+                      )
+
+          if fails:
+              print("FAIL: docker-bound jobs missing docker-host/publish pin:")
+              for f in fails:
+                  print(f"  - {f}")
+              print()
+              print("Why this rule exists (internal#512 + mc#1529):")
+              print("  Bare `ubuntu-latest` is advertised by BOTH Linux operator-host")
+              print("  runners AND Windows hongming-pc-runner-* (act_runner v1.0.3).")
+              print("  Docker-bound jobs that land on Windows fail non-deterministically.")
+              print("  Pin to `docker-host` (general) or `publish` (image build/push).")
+              sys.exit(1)
+
+          print("OK: all docker-bound jobs are pinned to docker-host or publish.")
+          PY
@@ -0,0 +1,88 @@
+name: Lint shellcheck (arm64 pilot)
+
+# Mac-CI dual-track pilot (#233). ADDITIVE / NOT REQUIRED.
+#
+# Validates the arm64 self-hosted lane (no docker.sock, no privileged
+# ops) before any required gate moves onto it. Until a Mac arm64 runner
+# is registered with the `arm64` label, this workflow sits PENDING —
+# that is FINE: `arm64` is NOT in branch_protections required contexts.
+#
+# Pairs with internal#543 (RFC: Mac arm64 multi-arch runner-base).
+# No paths: filter on purpose (feedback_path_filtered_workflow_cant_be_required).
+
+on:
+  pull_request:
+    branches:
+      - main
+      - staging
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck-arm64:
+    name: shellcheck-arm64 (pilot)
+    runs-on: [self-hosted, arm64]
+    # NOT a required check; safe to sit pending until Mac runner is up.
+    # If the Mac runner has trouble pulling actions/checkout we fall
+    # back to a plain git clone (see step 'fallback clone').
+    timeout-minutes: 10
+    env:
+      GITHUB_SERVER_URL: https://git.moleculesai.app
+    steps:
+      - name: Identify runner
+        run: |
+          set -eu
+          echo "arch=$(uname -m)"
+          echo "kernel=$(uname -sr)"
+          echo "shell=$BASH_VERSION"
+          # Sanity: must actually be arm64. If amd64 sneaks in here,
+          # fail fast — that means the label routing is wrong.
+          case "$(uname -m)" in
+            aarch64|arm64) echo "arm64 confirmed" ;;
+            *) echo "ERROR: expected arm64, got $(uname -m)"; exit 1 ;;
+          esac
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Install shellcheck (arm64)
+        run: |
+          set -eu
+          if command -v shellcheck >/dev/null 2>&1; then
+            echo "shellcheck already present: $(shellcheck --version | head -1)"
+          else
+            # Prefer apt if the runner base ships it; else download arm64 binary.
+            if command -v apt-get >/dev/null 2>&1; then
+              sudo apt-get update -qq
+              sudo apt-get install -y --no-install-recommends shellcheck
+            else
+              SC_VER=v0.10.0
+              curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/${SC_VER}/shellcheck-${SC_VER}.linux.aarch64.tar.xz" \
+                | tar -xJf - --strip-components=1
+              sudo mv shellcheck /usr/local/bin/
+            fi
+          fi
+          shellcheck --version | head -2
+
+      - name: Run shellcheck on .gitea/scripts/*.sh
+        run: |
+          set -eu
+          # Only the scripts we control under .gitea/scripts. Pilot
+          # scope is intentionally narrow — broaden in a follow-up
+          # once the lane is proven.
+          mapfile -t TARGETS < <(find .gitea/scripts -maxdepth 2 -type f -name '*.sh' | sort)
+          if [ "${#TARGETS[@]}" -eq 0 ]; then
+            echo "No .sh files found under .gitea/scripts — nothing to check"
+            exit 0
+          fi
+          echo "Checking ${#TARGETS[@]} file(s):"
+          printf '  %s\n' "${TARGETS[@]}"
+          # SC1091 = couldn't follow non-constant source; expected for
+          # CI-time analysis without the full runtime layout.
+          shellcheck --severity=error --exclude=SC1091 "${TARGETS[@]}"
@@ -49,13 +49,17 @@ jobs:
  # bp-exempt: post-merge image publication side effect; CI / all-required gates source changes.
  build-and-push:
    name: Build & push canvas image
-    # REVERTED (infra/revert-docker-runner-label): `runs-on: ubuntu-latest` restored.
-    # The `docker` label is not registered on any act_runner. `runs-on: [ubuntu-latest, docker]`
-    # causes jobs to queue indefinitely with zero eligible runners — strictly worse than the
-    # pre-#599 coin-flip (50% success rate). Once the `docker` label is registered on
-    # ≥2 runners, re-apply the fix from #599 (infra/docker-runner-label).
-    # See issue #576 + infra-lead pulse ~00:30Z.
-    runs-on: ubuntu-latest
+    # Dedicated publish/release lane (internal#462 / #394 / #399). Ship
+    # path (on: push:main, canvas/**) — reserved capacity so a merged
+    # canvas fix's image build never FIFO-queues behind PR required-CI.
+    # The `publish` label resolves ONLY to the molecule-runner-publish-*
+    # sub-pool (config.publish.yaml). HARD DEPENDENCY: this MUST land
+    # AFTER the publish-lane runners are registered/advertising `publish`
+    # — the earlier #599 `docker` label attempt queued indefinitely with
+    # zero eligible runners precisely because the label was targeted
+    # before any runner advertised it (see #576). The lane is registered
+    # in this rollout (internal#462) so the precondition holds.
+    runs-on: publish
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -29,6 +29,14 @@ on:
  pull_request:
    paths:
      - "workspace/**"
+      # mc#1578 / a05add29 cure: build_runtime_package.py owns PYPROJECT_TEMPLATE
+      # (deps, classifiers, project metadata). A change there is publish-affecting
+      # even when workspace/** is untouched, so the autobump must fire to claim
+      # the next runtime-v$VERSION tag. Without this, manual tagging races PyPI
+      # (e.g. runtime-v0.1.18 collided with the 2026-04-27 PyPI 0.1.18 publish,
+      # blocking the python-multipart pin from reaching prod).
+      - "scripts/build_runtime_package.py"
+      - "scripts/test_build_runtime_package.py"
  # Bump-and-tag on main/staging push (the actual operational trigger).
  push:
    branches:
@@ -36,6 +44,8 @@ on:
      - staging
    paths:
      - "workspace/**"
+      - "scripts/build_runtime_package.py"
+      - "scripts/test_build_runtime_package.py"
  # Manual dispatch — useful when Gitea Actions API (/actions/*) is
  # unreachable (e.g. act_runner 404 on Gitea 1.22.6) and we cannot
  # re-trigger via curl.
@@ -104,7 +114,7 @@ jobs:
        with:
          python-version: "3.11"

-      - name: Compute next version from PyPI latest
+      - name: Compute next version from PyPI latest and existing tags
        id: bump
        run: |
          set -eu
@@ -112,9 +122,24 @@ jobs:
            | python -c "import sys,json; print(json.load(sys.stdin)['info']['version'])")
          MAJOR=$(echo "$LATEST" | cut -d. -f1)
          MINOR=$(echo "$LATEST" | cut -d. -f2)
-          PATCH=$(echo "$LATEST" | cut -d. -f3)
-          VERSION="${MAJOR}.${MINOR}.$((PATCH+1))"
-          echo "PyPI latest=$LATEST -> next=$VERSION"
+          TAG_LATEST=$(git tag --list "runtime-v${MAJOR}.${MINOR}.*" \
+            | sed -E 's/^runtime-v//' \
+            | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
+            | sort -V \
+            | tail -1 || true)
+          VERSION=$(PYPI_LATEST="$LATEST" TAG_LATEST="$TAG_LATEST" python - <<'PY'
+          import os
+
+          def parse(v):
+              return tuple(int(part) for part in v.split("."))
+
+          pypi = os.environ["PYPI_LATEST"]
+          tag = os.environ.get("TAG_LATEST") or pypi
+          base = max(parse(pypi), parse(tag))
+          print(f"{base[0]}.{base[1]}.{base[2] + 1}")
+          PY
+          )
+          echo "PyPI latest=$LATEST, latest runtime tag=${TAG_LATEST:-none} -> next=$VERSION"
          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::computed version $VERSION does not match PEP 440 X.Y.Z"
            exit 1
@@ -66,7 +66,10 @@ concurrency:

 jobs:
  publish:
-    runs-on: ubuntu-latest
+    # Dedicated publish/release lane (internal#462 / #394 / #399). Ship
+    # path (on: push tag runtime-v*) — reserved capacity, never FIFO
+    # behind PR-CI. `publish` resolves only to molecule-runner-publish-*.
+    runs-on: publish
    outputs:
      version: ${{ steps.version.outputs.version }}
      wheel_sha256: ${{ steps.wheel_hash.outputs.wheel_sha256 }}
@@ -159,6 +162,7 @@ jobs:
            exit 1
          fi
          python -m twine upload \
+            --verbose \
            --repository pypi \
            --username __token__ \
            --password "$PYPI_TOKEN" \
@@ -166,7 +170,9 @@ jobs:

  cascade:
    needs: publish
-    runs-on: ubuntu-latest
+    # Publish/release lane (internal#462) — downstream of the runtime
+    # publish ship job; keep it on the reserved lane too.
+    runs-on: publish
    steps:
      - name: Wait for PyPI to propagate the new version
        env:
@@ -54,7 +54,14 @@ env:

 jobs:
  build-and-push:
-    runs-on: ubuntu-latest
+    # Dedicated publish/release lane (internal#462 / #394 / #399). This
+    # is a post-merge ship job (on: push:main) — it must NOT FIFO-compete
+    # with PR required-CI on the shared pool (PR#1350's prod image build
+    # was delayed ~25min this way). The `publish` label resolves ONLY to
+    # the reserved molecule-runner-publish-* sub-pool (config.publish.yaml,
+    # OUTSIDE the managed 1..20 range) so a merged fix's image build
+    # starts immediately while PR-CI keeps the general pool.
+    runs-on: publish
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -181,7 +188,9 @@ jobs:
    name: Production auto-deploy
    needs: build-and-push
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-    runs-on: ubuntu-latest
+    # Publish/release lane (internal#462) — production deploy of a merged
+    # fix; reserved capacity, never queued behind PR-CI.
+    runs-on: publish
    timeout-minutes: 75
    env:
      CP_URL: ${{ vars.PROD_CP_URL || 'https://api.moleculesai.app' }}
@@ -89,6 +89,7 @@ on:
 permissions:
  contents: read
  pull-requests: read
+  secrets: read

 jobs:
  # bp-exempt: PR review bot signal; required merge state is enforced by CI / all-required.
@@ -68,7 +68,10 @@ jobs:
  # bp-exempt: production redeploy is a side-effect workflow, not a merge gate.
  redeploy:
    if: ${{ github.event_name == 'workflow_dispatch' }}
-    runs-on: ubuntu-latest
+    # Dedicated publish/release lane (internal#462 / #394 / #399).
+    # Production tenant redeploy — a deploy action, reserved capacity so
+    # it never queues behind PR-CI. `publish` -> molecule-runner-publish-*.
+    runs-on: publish
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -148,6 +151,11 @@ jobs:
            exit 1
          fi

+          # confirm:true ack required by CP /cp/admin/tenants/redeploy-fleet
+          # contract (cp#228 / task #308) for fleet-wide intent. Empty body
+          # / {confirm:false} / {only_slugs:[]} → 400. This caller redeploys
+          # the entire prod fleet (canary + fan-out), no slug scoping, so
+          # confirm:true is correct.
          BODY=$(jq -nc \
            --arg tag "$TARGET_TAG" \
            --arg canary "$CANARY_SLUG" \
@@ -159,7 +167,8 @@ jobs:
              canary_slug: $canary,
              soak_seconds: $soak,
              batch_size: $batch,
-              dry_run: $dry
+              dry_run: $dry,
+              confirm: true
            }')

          echo "POST $CP_URL/cp/admin/tenants/redeploy-fleet"
@@ -75,7 +75,10 @@ env:
 jobs:
  # bp-exempt: post-merge staging redeploy side effect; CI / all-required gates source changes.
  redeploy:
-    runs-on: ubuntu-latest
+    # Dedicated publish/release lane (internal#462 / #394 / #399).
+    # Post-merge staging redeploy — a deploy action, reserved capacity.
+    # `publish` -> molecule-runner-publish-* sub-pool.
+    runs-on: publish
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -120,6 +123,11 @@ jobs:
            exit 1
          fi

+          # confirm:true ack required by CP /cp/admin/tenants/redeploy-fleet
+          # contract (cp#228 / task #308) for fleet-wide intent. Empty body
+          # / {confirm:false} / {only_slugs:[]} → 400. Staging IS the
+          # canary, no slug scoping; this rolls the entire staging fleet,
+          # so confirm:true is correct.
          BODY=$(jq -nc \
            --arg tag "$TARGET_TAG" \
            --arg canary "$CANARY_SLUG" \
@@ -131,7 +139,8 @@ jobs:
              canary_slug: $canary,
              soak_seconds: $soak,
              batch_size: $batch,
-              dry_run: $dry
+              dry_run: $dry,
+              confirm: true
            }')

          echo "POST $CP_URL/cp/admin/tenants/redeploy-fleet"
@@ -1,11 +1,16 @@
-# Consolidated comment dispatcher for manual review/tier refires.
+# DEPRECATED — superseded by `.gitea/workflows/sop-checklist.yml`.
 #
+# The review-refire logic (qa/security/tier slash-command dispatch) has been
+# merged into sop-checklist.yml as the `review-refire` job. This workflow
+# is kept as a no-op stub to avoid a gap during the transition window where
+# this file may be deleted while sop-checklist.yml has not yet been merged.
+#
+# After sop-checklist.yml lands, this file will be deleted (issue #1280).
+#
+# Historical behavior (superseded):
 # Gitea 1.22 queues one run per workflow subscribed to `issue_comment` before
-# evaluating job-level `if:`. SOP-heavy PRs therefore created queue storms when
-# qa-review, security-review, sop-checklist, and sop-tier-refire all
-# listened to comments. This workflow is the single non-SOP comment subscriber:
-# ordinary comments no-op quickly; slash commands post the required status
-# contexts to the PR head SHA.
+# evaluating job-level `if:`. Previously this workflow was the single
+# non-SOP comment subscriber for qa/security/tier refire slash commands.

 name: review-refire-comments

@@ -23,91 +28,12 @@ concurrency:
  cancel-in-progress: true

 jobs:
+  # No-op stub — all refire logic moved to sop-checklist.yml review-refire job.
+  # Kept to avoid transition gap; will be deleted after sop-checklist.yml merges.
  dispatch:
    runs-on: ubuntu-latest
    steps:
-      - name: Classify comment
-        id: classify
-        env:
-          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_PR: ${{ github.event.issue.pull_request != null }}
+      - name: Deprecated — refire logic moved to sop-checklist.yml
        run: |
-          set -euo pipefail
-          {
-            echo "run_qa=false"
-            echo "run_security=false"
-            echo "run_tier=false"
-          } >> "$GITHUB_OUTPUT"
-          if [ "$IS_PR" != "true" ]; then
-            echo "::notice::not a PR comment; no-op"
-            exit 0
-          fi
-          first_line=$(printf '%s\n' "$COMMENT_BODY" | sed -n '1p')
-          case "$first_line" in
-            /qa-recheck*)
-              echo "run_qa=true" >> "$GITHUB_OUTPUT"
-              ;;
-            /security-recheck*)
-              echo "run_security=true" >> "$GITHUB_OUTPUT"
-              ;;
-            /refire-tier-check*)
-              echo "run_tier=true" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "::notice::no supported review refire slash command; no-op"
-              ;;
-          esac
-
-      - name: Check out BASE ref for trusted scripts
-        if: |
-          steps.classify.outputs.run_qa == 'true' ||
-          steps.classify.outputs.run_security == 'true' ||
-          steps.classify.outputs.run_tier == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-        with:
-          ref: ${{ github.event.repository.default_branch }}
-
-      - name: Refire qa-review status
-        if: steps.classify.outputs.run_qa == 'true'
-        env:
-          GITEA_TOKEN: ${{ secrets.RFC_324_TEAM_READ_TOKEN || secrets.GITHUB_TOKEN }}
-          GITEA_HOST: git.moleculesai.app
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-          TEAM: qa
-          TEAM_ID: '20'
-          REVIEW_CHECK_DEBUG: '0'
-          REVIEW_CHECK_STRICT: '0'
-          COMMENT_AUTHOR: ${{ github.event.comment.user.login }}
-        run: |
-          set -euo pipefail
-          .gitea/scripts/review-refire-status.sh
-
-      - name: Refire security-review status
-        if: steps.classify.outputs.run_security == 'true'
-        env:
-          GITEA_TOKEN: ${{ secrets.RFC_324_TEAM_READ_TOKEN || secrets.GITHUB_TOKEN }}
-          GITEA_HOST: git.moleculesai.app
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-          TEAM: security
-          TEAM_ID: '21'
-          REVIEW_CHECK_DEBUG: '0'
-          REVIEW_CHECK_STRICT: '0'
-          COMMENT_AUTHOR: ${{ github.event.comment.user.login }}
-        run: |
-          set -euo pipefail
-          .gitea/scripts/review-refire-status.sh
-
-      - name: Refire sop-tier-check status
-        if: steps.classify.outputs.run_tier == 'true'
-        env:
-          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
-          GITEA_HOST: git.moleculesai.app
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          COMMENT_AUTHOR: ${{ github.event.comment.user.login }}
-          SOP_DEBUG: '0'
-        run: bash .gitea/scripts/sop-tier-refire.sh
+          echo "::warning::review-refire-comments.yml is deprecated. Refire logic is now in sop-checklist.yml review-refire job. This workflow is a no-op stub pending deletion (issue #1280)."
+          exit 0
@@ -30,6 +30,11 @@ jobs:
  scan:
    name: Scan diff for credential-shaped strings
    runs-on: ubuntu-latest
+    # Hard CI gate — must complete or the PR is unmergable. 10-minute ceiling
+    # is generous for a diff-scan against a single SHA. If this times out, the
+    # runner is frozen and holding a slot — the step timeout triggers clean
+    # failure, releasing the runner for the next job.
+    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
@@ -133,6 +138,14 @@ jobs:
            [ -z "$f" ] && continue
            [ "$f" = "$SELF_GITHUB" ] && continue
            [ "$f" = "$SELF_GITEA" ] && continue
+            # Test-fixture exclude (internal#425): the secrets-detector's OWN
+            # unit-test corpus deliberately embeds credential-SHAPED example
+            # strings to exercise the detector. Verified 2026-05-18 synthetic
+            # (fabricated ghp_* fixtures, not real). Without this the scanner
+            # self-trips on its own fixtures and fail-closes every deploy.
+            # Same rationale as the SELF_* excludes above; gate NOT weakened
+            # (all other paths still fully scanned).
+            [ "$f" = "workspace-server/internal/secrets/patterns_test.go" ] && continue
            if [ -n "$DIFF_RANGE" ]; then
              ADDED=$(git diff --no-color --unified=0 "$BASE" "$HEAD" -- "$f" 2>/dev/null | grep -E '^\+[^+]' || true)
            else
@@ -16,6 +16,7 @@ on:
 permissions:
  contents: read
  pull-requests: read
+  secrets: read

 jobs:
  # bp-exempt: PR security review bot signal; required merge state is enforced by CI / all-required.
@@ -2,24 +2,20 @@
 #
 # RFC#351 Step 2 of 6 (implementation MVP).
 #
-# === DESIGN ===
+# === CONSOLIDATION (issue #1280) ===
 #
-# Goal: each PR must answer 7 SOP-checklist questions in its body,
-# and each item must have at least one /sop-ack <slug> comment from
-# a non-author peer in the required team. BP requires the
-# `sop-checklist / all-items-acked (pull_request)` status to merge.
+# This workflow is the SINGLE `issue_comment` subscriber — the logic from
+# `review-refire-comments.yml` has been merged in. Before this change:
+#   - sop-checklist.yml (pre-2026-05-16) → issue_comment:[created,edited,deleted] → runner slot used, job no-oped
+#   - review-refire-comments.yml           → issue_comment:[created]            → runner slot used, job no-oped
+#   → every non-refire comment occupied 2 runner slots for ~800 s each
+#      (~650 no-op runs/day, ~1,300 runner-slot-occupancy-hours/day).
 #
-# Triggers:
-#   - `pull_request_target`: opened, edited, synchronize, reopened
-#       → fires when PR opens, body is edited (refire — RFC#351 §4),
-#         or new code is pushed (head.sha changes → stale status would
-#         be auto-discarded by BP via dismiss_stale_reviews, but the
-#         status itself is per-SHA so we re-post on the new head).
-#   - `issue_comment`: created, edited, deleted
-#       → fires on any new comment so /sop-ack / /sop-revoke take
-#         effect immediately (Gitea 1.22.6 doesn't refire on
-#         pull_request_review per feedback_pull_request_review_no_refire,
-#         so issue_comment is the canonical refire channel).
+# Fix (PR #1345 / issue #1280):
+#   - ONE workflow, ONE issue_comment:[created] subscription (no edited/deleted)
+#   - all-items-acked job: pull_request_target OR sop slash-command comments
+#   - review-refire job: qa/security/tier refire slash commands
+#   → ~50% reduction in comment-triggered runner occupancy vs pre-fix.
 #
 # Trust boundary (mirrors RFC#324 §A4 + sop-tier-check security note):
 #   `pull_request_target` (not `pull_request`) — workflow def is loaded
@@ -51,7 +47,7 @@
 #   /sop-ack <slug-or-numeric-alias> [optional note]
 #       — register a peer-ack for one checklist item.
 #       — slug accepts kebab-case, snake_case, or natural-spaces
-#         (all normalize to canonical kebab-case).
+#         (all normalized to canonical kebab-case).
 #       — numeric 1..7 maps via config.items[*].numeric_alias.
 #       — most-recent (user, slug) directive wins.
 #
@@ -61,6 +57,13 @@
 #       — most-recent (user, slug) directive wins, so a later /sop-ack
 #         re-restores the ack.
 #
+#   /sop-n/a <gate> [reason]
+#       — declare a gate (qa-review, security-review) N/A.
+#       — see sop-checklist-config.yaml n/a_gates section.
+#
+#   /qa-recheck /security-recheck /refire-tier-check
+#       — refire the corresponding status check on the PR head.
+#
 # The eval is read-only + idempotent (read PR + comments + team
 # membership, compute, post status). Re-running on any event is safe —
 # the new status overwrites the previous one for the same context.
@@ -79,22 +82,22 @@ on:
  pull_request_target:
    types: [opened, edited, synchronize, reopened, labeled, unlabeled]
  issue_comment:
-    types: [created, edited, deleted]
+    types: [created]   # NOT [created, edited, deleted] — Gitea 1.22.6 holds a runner slot
+    # at job-parsing time, before job-level if: guards run. edited/deleted events
+    # occupied ~1,300 runner-slot-hours/day on this workflow alone during the
+    # 2026-05-16 freeze. Per PR #1345 fix.

 permissions:
  contents: read
  pull-requests: read
-  # NOTE: `statuses: write` is the GitHub-Actions name for POST /statuses.
-  # Gitea 1.22.6 may not gate on this permission key (it just checks the
-  # token), but listing it explicitly documents intent for the next
-  # platform-version upgrade.
  statuses: write
+  secrets: read

 jobs:
+  # sop-checklist gate: runs on PR lifecycle events OR sop slash commands.
+  # All other comment types (no-op text comments) no longer assign a runner
+  # because this job's if: guard short-circuits before runner assignment.
  all-items-acked:
-    # Run on pull_request_target events always. On issue_comment events,
-    # only when the comment is on a PR (issue_comment fires for issues
-    # too) and the body contains one of the slash-commands.
    if: |
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'issue_comment' &&
@@ -128,3 +131,95 @@ jobs:
            --pr "$PR_NUMBER" \
            --config .gitea/sop-checklist-config.yaml \
            --gitea-host git.moleculesai.app
+
+  # bp-exempt: informational refire handler, not a merge gate. Emits
+  # qa-review/security-review status updates on /qa-recheck et al slash commands.
+  review-refire:
+    if: |
+      github.event_name == 'issue_comment' &&
+      github.event.issue.pull_request != null
+    runs-on: ubuntu-latest
+    steps:
+      - name: Classify comment
+        id: classify
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          set -euo pipefail
+          {
+            echo "run_qa=false"
+            echo "run_security=false"
+            echo "run_tier=false"
+          } >> "$GITHUB_OUTPUT"
+          first_line=$(printf '%s\n' "$COMMENT_BODY" | sed -n '1p')
+          case "$first_line" in
+            /qa-recheck*)
+              echo "run_qa=true" >> "$GITHUB_OUTPUT"
+              ;;
+            /security-recheck*)
+              echo "run_security=true" >> "$GITHUB_OUTPUT"
+              ;;
+            /refire-tier-check*)
+              echo "run_tier=true" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "::notice::no supported review refire slash command; no-op"
+              ;;
+          esac
+
+      - name: Check out BASE ref for trusted scripts
+        if: |
+          steps.classify.outputs.run_qa == 'true' ||
+          steps.classify.outputs.run_security == 'true' ||
+          steps.classify.outputs.run_tier == 'true'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: Refire qa-review status
+        if: steps.classify.outputs.run_qa == 'true'
+        env:
+          # RFC_324_TEAM_READ_TOKEN is read-only (team membership read scope only).
+          # review-refire-status.sh POSTs to /statuses — requires write scope.
+          # SOP_TIER_CHECK_TOKEN carries write:repository + write:issue + read:organization.
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
+          GITEA_HOST: git.moleculesai.app
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          TEAM: qa
+          TEAM_ID: '20'
+          REVIEW_CHECK_DEBUG: '0'
+          REVIEW_CHECK_STRICT: '0'
+        run: |
+          set -euo pipefail
+          .gitea/scripts/review-refire-status.sh
+
+      - name: Refire security-review status
+        if: steps.classify.outputs.run_security == 'true'
+        env:
+          # RFC_324_TEAM_READ_TOKEN is read-only (team membership read scope only).
+          # review-refire-status.sh POSTs to /statuses — requires write scope.
+          # SOP_TIER_CHECK_TOKEN carries write:repository + write:issue + read:organization.
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
+          GITEA_HOST: git.moleculesai.app
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          TEAM: security
+          TEAM_ID: '21'
+          REVIEW_CHECK_DEBUG: '0'
+          REVIEW_CHECK_STRICT: '0'
+        run: |
+          set -euo pipefail
+          .gitea/scripts/review-refire-status.sh
+
+      - name: Refire sop-tier-check status
+        if: steps.classify.outputs.run_tier == 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
+          GITEA_HOST: git.moleculesai.app
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          SOP_DEBUG: '0'
+        run: bash .gitea/scripts/sop-tier-refire.sh
@@ -71,6 +71,7 @@ jobs:
    permissions:
      contents: read
      pull-requests: read
+      secrets: read
    steps:
      - name: Check out base branch (for the script)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -235,6 +235,11 @@ jobs:
          set -euo pipefail

          TARGET_TAG="staging-${SHA}"
+          # confirm:true ack required by CP /cp/admin/tenants/redeploy-fleet
+          # contract (cp#228 / task #308) for fleet-wide intent. Empty body
+          # / {confirm:false} / {only_slugs:[]} → 400. This caller promotes
+          # the verified staging image across the entire prod fleet (canary
+          # + fan-out), no slug scoping, so confirm:true is correct.
          BODY=$(jq -nc \
            --arg tag "$TARGET_TAG" \
            --argjson soak "${SOAK_SECONDS:-120}" \
@@ -244,7 +249,8 @@ jobs:
              target_tag: $tag,
              soak_seconds: $soak,
              batch_size: $batch,
-              dry_run: $dry
+              dry_run: $dry,
+              confirm: true
            }')

          if [ -n "${CANARY_SLUG:-}" ]; then
@@ -1,255 +0,0 @@
-name: canary-verify
-
-# Runs the canary smoke suite against the staging canary tenant fleet
-# after a new :staging-<sha> image lands in ECR. On green, calls the
-# CP redeploy-fleet endpoint to promote :staging-<sha> → :latest so
-# the prod tenant fleet's 5-minute auto-updater picks up the verified
-# digest. On red, :latest stays on the prior known-good digest and
-# prod is untouched.
-#
-# Registry note (2026-05-10): This workflow previously used GHCR
-# (ghcr.io/molecule-ai/platform-tenant) — that registry was retired
-# during the 2026-05-06 Gitea suspension migration when publish-
-# workspace-server-image.yml switched to the operator's ECR org
-# (153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/
-# platform-tenant). The GHCR → ECR migration was never applied to
-# this file, so canary-verify was silently smoke-testing the stale
-# GHCR image while the actual staging/prod tenants ran the ECR image.
-# Result: smoke tests could not catch a broken ECR build. Fix:
-#   - Wait step: reads SHA from running canary /health (tenant-
-#     agnostic, works regardless of registry).
-#   - Promote step: calls CP redeploy-fleet endpoint with target_tag=
-#     staging-<sha>, same mechanism as redeploy-tenants-on-main.yml.
-#     No longer attempts GHCR crane ops.
-#
-# Dependencies:
-#   - publish-workspace-server-image.yml publishes :staging-<sha>
-#     to ECR on staging and main merges.
-#   - Canary tenants are configured to pull :staging-<sha> from ECR
-#     (TENANT_IMAGE env set to the ECR :staging-<sha> tag).
-#   - Repo secrets CANARY_TENANT_URLS / CANARY_ADMIN_TOKENS /
-#     CANARY_CP_SHARED_SECRET are populated.
-
-on:
-  workflow_run:
-    workflows: ["publish-workspace-server-image"]
-    types: [completed]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  packages: write
-  actions: read
-
-env:
-  # ECR registry (post-2026-05-06 SSOT for tenant images).
-  # publish-workspace-server-image.yml pushes here.
-  IMAGE_NAME: 153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/platform
-  TENANT_IMAGE_NAME: 153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/platform-tenant
-  # CP endpoint for redeploy-fleet (used in promote step below).
-  CP_URL: ${{ vars.CP_URL || 'https://staging-api.moleculesai.app' }}
-
-jobs:
-  canary-smoke:
-    # Skip when the upstream workflow failed — no image to test against.
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
-    runs-on: ubuntu-latest
-    outputs:
-      sha: ${{ steps.compute.outputs.sha }}
-      smoke_ran: ${{ steps.smoke.outputs.ran }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Compute sha
-        id: compute
-        run: echo "sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
-
-      - name: Wait for canary tenants to pick up :staging-<sha>
-        # Poll canary health endpoints every 30s for up to 7 min instead
-        # of a fixed 6-min sleep. Exits as soon as ALL canaries report
-        # the new SHA (~2-3 min typical vs 6 min fixed). Falls back to
-        # proceeding after 7 min even if not all canaries responded —
-        # the smoke suite will catch any that didn't update.
-        #
-        # NOTE: The SHA is read from the running tenant's /health response,
-        # NOT from a registry lookup. This is registry-agnostic and works
-        # regardless of whether the tenant pulls from ECR, GHCR, or any
-        # other registry — the canary is telling us what it's actually
-        # running, which is the ground truth for smoke testing.
-        env:
-          CANARY_TENANT_URLS: ${{ secrets.CANARY_TENANT_URLS }}
-          EXPECTED_SHA: ${{ steps.compute.outputs.sha }}
-        run: |
-          if [ -z "$CANARY_TENANT_URLS" ]; then
-            echo "No canary URLs configured — falling back to 60s wait"
-            sleep 60
-            exit 0
-          fi
-          IFS=',' read -ra URLS <<< "$CANARY_TENANT_URLS"
-          MAX_WAIT=420  # 7 minutes
-          INTERVAL=30
-          ELAPSED=0
-          while [ $ELAPSED -lt $MAX_WAIT ]; do
-            ALL_READY=true
-            for url in "${URLS[@]}"; do
-              HEALTH=$(curl -s --max-time 5 "${url}/health" 2>/dev/null || echo "{}")
-              SHA=$(echo "$HEALTH" | grep -o "\"sha\":\"[^\"]*\"" | head -1 | cut -d'"' -f4)
-              if [ "$SHA" != "$EXPECTED_SHA" ]; then
-                ALL_READY=false
-                break
-              fi
-            done
-            if $ALL_READY; then
-              echo "All canaries running staging-${EXPECTED_SHA} after ${ELAPSED}s"
-              exit 0
-            fi
-            echo "Waiting for canaries... (${ELAPSED}s / ${MAX_WAIT}s)"
-            sleep $INTERVAL
-            ELAPSED=$((ELAPSED + INTERVAL))
-          done
-          echo "Timeout after ${MAX_WAIT}s — proceeding anyway (smoke suite will validate)"
-
-      - name: Run canary smoke suite
-        id: smoke
-        # Graceful-skip when no canary fleet is configured (Phase 2 not yet
-        # stood up — see molecule-controlplane/docs/canary-tenants.md).
-        # Sets `ran=false` on skip so promote-to-latest stays off (we don't
-        # want every main merge auto-promoting without gating). Manual
-        # promote-latest.yml is the release gate while canary is absent.
-        # Once the fleet is real: delete the early-exit branch.
-        env:
-          CANARY_TENANT_URLS: ${{ secrets.CANARY_TENANT_URLS }}
-          CANARY_ADMIN_TOKENS: ${{ secrets.CANARY_ADMIN_TOKENS }}
-          CANARY_CP_BASE_URL: https://staging-api.moleculesai.app
-          CANARY_CP_SHARED_SECRET: ${{ secrets.CANARY_CP_SHARED_SECRET }}
-        run: |
-          set -euo pipefail
-          if [ -z "${CANARY_TENANT_URLS:-}" ] \
-            || [ -z "${CANARY_ADMIN_TOKENS:-}" ] \
-            || [ -z "${CANARY_CP_SHARED_SECRET:-}" ]; then
-            {
-              echo "## ⚠️ canary-verify skipped"
-              echo
-              echo "One or more canary secrets are unset (\`CANARY_TENANT_URLS\`, \`CANARY_ADMIN_TOKENS\`, \`CANARY_CP_SHARED_SECRET\`)."
-              echo "Phase 2 canary fleet has not been stood up yet —"
-              echo "see [canary-tenants.md](https://git.moleculesai.app/molecule-ai/molecule-controlplane/blob/main/docs/canary-tenants.md)."
-              echo
-              echo "**Skipped — promote-to-latest will NOT auto-fire.** Dispatch \`promote-latest.yml\` manually when ready."
-            } >> "$GITHUB_STEP_SUMMARY"
-            echo "ran=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::canary-verify: skipped — no canary fleet configured"
-            exit 0
-          fi
-          bash scripts/canary-smoke.sh
-          echo "ran=true" >> "$GITHUB_OUTPUT"
-
-      - name: Summary on failure
-        if: ${{ failure() }}
-        run: |
-          {
-            echo "## Canary smoke FAILED"
-            echo
-            echo "Canary tenants rejected image \`staging-${{ steps.compute.outputs.sha }}\`."
-            echo ":latest stays pinned to the prior good digest — prod is untouched."
-            echo
-            echo "Fix forward and merge again, or investigate the specific failed"
-            echo "assertions in the canary-smoke step log above."
-          } >> "$GITHUB_STEP_SUMMARY"
-
-  promote-to-latest:
-    # On green, calls the CP redeploy-fleet endpoint with target_tag=
-    # staging-<sha> to promote the verified ECR image. This is the same
-    # mechanism as redeploy-tenants-on-main.yml — no GHCR crane ops.
-    #
-    # Pre-fix history: the old GHCR promote step used `crane tag` against
-    # ghcr.io/molecule-ai/platform-tenant, but publish-workspace-server-
-    # image.yml had already migrated to ECR on 2026-05-07 (commit
-    # 10e510f5). The GHCR tags were never updated, so this step was
-    # silently promoting a stale GHCR image while actual prod tenants
-    # pulled from ECR. Canary smoke tests were GHCR-targeted and could
-    # not catch a broken ECR build.
-    needs: canary-smoke
-    if: ${{ needs.canary-smoke.result == 'success' && needs.canary-smoke.outputs.smoke_ran == 'true' }}
-    runs-on: ubuntu-latest
-    env:
-      SHA: ${{ needs.canary-smoke.outputs.sha }}
-      CP_URL: ${{ vars.CP_URL || 'https://staging-api.moleculesai.app' }}
-      # CP_ADMIN_API_TOKEN gates write access to the redeploy endpoint.
-      # Stored at the repo level so all workflows pick it up automatically.
-      CP_ADMIN_API_TOKEN: ${{ secrets.CP_ADMIN_API_TOKEN }}
-      # canary_slug pin: deploy the verified :staging-<sha> to the canary
-      # first (soak 120s), then fan out to the rest of the fleet.
-      CANARY_SLUG: ${{ vars.CANARY_PROMOTE_SLUG || '' }}
-      SOAK_SECONDS: ${{ vars.CANARY_PROMOTE_SOAK || '120' }}
-      BATCH_SIZE: ${{ vars.CANARY_PROMOTE_BATCH || '3' }}
-    steps:
-      - name: Check CP credentials
-        run: |
-          if [ -z "${CP_ADMIN_API_TOKEN:-}" ]; then
-            echo "::error::CP_ADMIN_API_TOKEN secret is not set — promote step cannot call redeploy-fleet."
-            echo "::error::Set it at: repo Settings → Actions → Variables and Secrets → New Secret."
-            exit 1
-          fi
-
-      - name: Promote verified ECR image to :latest
-        run: |
-          set -euo pipefail
-
-          TARGET_TAG="staging-${SHA}"
-          BODY=$(jq -nc \
-            --arg tag "$TARGET_TAG" \
-            --argjson soak "${SOAK_SECONDS:-120}" \
-            --argjson batch "${BATCH_SIZE:-3}" \
-            --argjson dry false \
-            '{
-              target_tag: $tag,
-              soak_seconds: $soak,
-              batch_size: $batch,
-              dry_run: $dry
-            }')
-
-          if [ -n "${CANARY_SLUG:-}" ]; then
-            BODY=$(jq '. * {canary_slug: $slug}' --arg slug "$CANARY_SLUG" <<<"$BODY")
-          fi
-
-          echo "Calling: POST $CP_URL/cp/admin/tenants/redeploy-fleet"
-          echo "  target_tag: $TARGET_TAG"
-          echo "  body: $BODY"
-
-          HTTP_RESPONSE=$(mktemp)
-          HTTP_CODE_FILE=$(mktemp)
-          set +e
-          curl -sS -o "$HTTP_RESPONSE" -w '%{http_code}' \
-            -m 1200 \
-            -H "Authorization: Bearer $CP_ADMIN_API_TOKEN" \
-            -H "Content-Type: application/json" \
-            -X POST "$CP_URL/cp/admin/tenants/redeploy-fleet" \
-            -d "$BODY" >"$HTTP_CODE_FILE"
-          CURL_EXIT=$?
-          set -e
-
-          HTTP_CODE=$(cat "$HTTP_CODE_FILE" 2>/dev/null || echo "000")
-          [ -z "$HTTP_CODE" ] && HTTP_CODE="000"
-
-          echo "HTTP $HTTP_CODE (curl exit $CURL_EXIT)"
-          cat "$HTTP_RESPONSE" | jq . || cat "$HTTP_RESPONSE"
-
-          if [ "$HTTP_CODE" -ge 400 ]; then
-            echo "::error::CP redeploy-fleet returned HTTP $HTTP_CODE — refusing to proceed."
-            exit 1
-          fi
-
-      - name: Summary
-        run: |
-          {
-            echo "## Canary verified — :latest promoted via CP redeploy-fleet"
-            echo ""
-            echo "- **Target tag:** \`staging-${{ needs.canary-smoke.outputs.sha }}\`"
-            echo "- **Registry:** ECR (\`${TENANT_IMAGE_NAME}\`)"
-            echo "- **Canary slug:** \`${CANARY_SLUG:-<none>}\` (soak ${SOAK_SECONDS}s)"
-            echo "- **Batch size:** ${BATCH_SIZE:-3}"
-            echo ""
-            echo "CP redeploy-fleet is rolling out the verified image across the prod fleet."
-            echo "The fleet's 5-minute health-check loop will pick up the update automatically."
-          } >> "$GITHUB_STEP_SUMMARY"
@@ -300,7 +300,7 @@ jobs:

  canvas-deploy-reminder:
    name: Canvas Deploy Reminder
-    runs-on: ubuntu-latest
+    runs-on: docker-host
    needs: [changes, canvas-build]
    # Only fires on direct pushes to main (i.e. after staging→main promotion).
    if: needs.changes.outputs.canvas == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -440,4 +440,3 @@ jobs:

      # SDK + plugin validation moved to standalone repo:
      # github.com/molecule-ai/molecule-sdk-python
-
@@ -128,7 +128,7 @@ jobs:
  e2e-api:
    needs: detect-changes
    name: E2E API Smoke Test
-    runs-on: ubuntu-latest
+    runs-on: docker-host
    timeout-minutes: 15
    env:
      # Unique per-run container names so concurrent runs on the host-
@@ -88,7 +88,7 @@ jobs:
  integration:
    name: Handlers Postgres Integration
    needs: detect-changes
-    runs-on: ubuntu-latest
+    runs-on: docker-host
    env:
      # Unique name per run so concurrent jobs don't collide on the
      # bridge network. ${RUN_ID}-${RUN_ATTEMPT} is unique even across
@@ -249,4 +249,3 @@ jobs:
          # already gone (e.g. concurrent rerun race), don't fail the job.
          docker rm -f "${PG_NAME}" >/dev/null 2>&1 || true
          echo "Cleaned up ${PG_NAME}"
-
@@ -102,7 +102,7 @@ jobs:
  harness-replays:
    needs: detect-changes
    name: Harness Replays
-    runs-on: ubuntu-latest
+    runs-on: docker-host
    timeout-minutes: 30
    steps:
      - name: No-op pass (paths filter excluded this commit)
@@ -39,7 +39,7 @@ env:
 jobs:
  build-and-push:
    name: Build & push canvas image
-    runs-on: ubuntu-latest
+    runs-on: publish
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -1,400 +0,0 @@
-name: redeploy-tenants-on-main
-
-# Auto-refresh prod tenant EC2s after every main merge.
-#
-# Why this workflow exists: publish-workspace-server-image builds and
-# pushes a new platform-tenant :<sha> to ECR on every merge to main,
-# but running tenants pulled their image once at boot and never re-pull.
-# Users see stale code indefinitely.
-#
-# This workflow closes the gap by calling the control-plane admin
-# endpoint that performs a canary-first, batched, health-gated rolling
-# redeploy across every live tenant. Implemented in molecule-ai/
-# molecule-controlplane as POST /cp/admin/tenants/redeploy-fleet
-# (feat/tenant-auto-redeploy, landing alongside this workflow).
-#
-# Registry: ECR (153263036946.dkr.ecr.us-east-2.amazonaws.com/
-# molecule-ai/platform-tenant). GHCR was retired 2026-05-07 during the
-# Gitea suspension migration. The canary-verify.yml promote step now
-# uses the same redeploy-fleet endpoint (fixes the silent-GHCR gap).
-#
-# Runtime ordering:
-#   1. publish-workspace-server-image completes → new :staging-<sha> in ECR.
-#   2. This workflow fires via workflow_run, calls redeploy-fleet with
-#      target_tag=staging-<sha>. No CDN propagation wait needed —
-#      ECR image manifest is consistent immediately after push.
-#   3. Calls redeploy-fleet with canary_slug (if set) and a soak
-#      period. Canary proves the image boots; batches follow.
-#   4. Any failure aborts the rollout and leaves older tenants on the
-#      prior image — safer default than half-and-half state.
-#
-# Rollback path: re-run this workflow with a specific SHA pinned via
-# the workflow_dispatch input. That calls redeploy-fleet with
-# target_tag=<sha>, re-pulling the older image on every tenant.
-
-on:
-  workflow_run:
-    workflows: ['publish-workspace-server-image']
-    types: [completed]
-    branches: [main]
-  workflow_dispatch:
-    inputs:
-      target_tag:
-        # Empty default → auto-trigger and dispatch-without-input both
-        # resolve to `staging-<short_head_sha>` (the digest publish-image
-        # just pushed). Pre-fix this defaulted to 'latest', which only
-        # gets retagged by canary-verify's promote-to-latest job — and
-        # that job soft-skips when CANARY_TENANT_URLS is unset (the
-        # current state, until Phase 2 canary fleet is live). Result:
-        # `:latest` had been pinned to a 4-day-old digest (2026-04-28)
-        # while every main push pushed fresh `staging-<sha>` images;
-        # every prod redeploy pulled the stale `:latest` and the verify
-        # step correctly flagged 3/3 tenants STALE. Pulling the
-        # just-published `staging-<sha>` directly skips the dead retag
-        # path. When canary fleet is real, this workflow should chain
-        # on canary-verify completion (workflow_run from canary-verify),
-        # not publish-image — separate, smaller PR.
-        description: 'Tenant image tag to deploy (e.g. "latest", "staging-a59f1a6c"). Empty = auto staging-<head_sha>.'
-        required: false
-        type: string
-        default: ''
-      canary_slug:
-        description: 'Tenant slug to deploy first + soak (empty = skip canary, fan out immediately).'
-        required: false
-        type: string
-        # Must be an actual prod tenant slug (current: hongming,
-        # chloe-dong, reno-stars). The previous default 'hongmingwang'
-        # didn't match any tenant — CP soft-skipped the missing canary
-        # and the fleet rolled out without the soak gate, defeating the
-        # whole point of canary-first.
-        default: 'hongming'
-      soak_seconds:
-        description: 'Seconds to wait after canary before fanning out.'
-        required: false
-        type: string
-        default: '60'
-      batch_size:
-        description: 'How many tenants SSM redeploys in parallel per batch.'
-        required: false
-        type: string
-        default: '3'
-      dry_run:
-        description: 'Plan only — do not actually redeploy.'
-        required: false
-        type: boolean
-        default: false
-
-permissions:
-  contents: read
-  # No write scopes needed — the workflow hits an external CP endpoint,
-  # not the GitHub API.
-
-# Serialize redeploys so two rapid main pushes' redeploys don't overlap
-# and cause confusing per-tenant SSM state. Without this, GitHub's
-# implicit workflow_run queueing would *probably* serialize them, but
-# the explicit block makes the invariant defensible. Mirrors the
-# concurrency block on redeploy-tenants-on-staging.yml for shape parity.
-#
-# cancel-in-progress: false → aborting a half-rolled-out fleet would
-# leave tenants stuck on whatever image they happened to be on when
-# cancelled. Better to finish the in-flight rollout before starting
-# the next one.
-concurrency:
-  group: redeploy-tenants-on-main
-  cancel-in-progress: false
-
-jobs:
-  redeploy:
-    # Skip the auto-trigger if publish-workspace-server-image didn't
-    # actually succeed. workflow_run fires on any completion state; we
-    # don't want to redeploy against a half-built image.
-    if: |
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    steps:
-      - name: Note on ECR propagation
-        # ECR image manifests are consistent immediately after push — no
-        # CDN cache to wait for. The old GHCR-based workflow had a 30s
-        # sleep to avoid race conditions; ECR makes that unnecessary.
-        run: echo "ECR image available immediately after push — proceeding."
-
-      - name: Compute target tag
-        id: tag
-        # Resolution order:
-        #   1. Operator-supplied input (workflow_dispatch with explicit
-        #      tag) → used verbatim. Lets ops pin `latest` for emergency
-        #      rollback to last canary-verified digest, or pin a specific
-        #      `staging-<sha>` to roll back to a known-good build.
-        #   2. Default → `staging-<short_head_sha>`. The just-published
-        #      digest. Bypasses the `:latest` retag path that's currently
-        #      dead (canary-verify soft-skips without canary fleet, so
-        #      the only thing retagging `:latest` today is the manual
-        #      promote-latest.yml — last run 2026-04-28). Auto-trigger
-        #      from workflow_run uses workflow_run.head_sha; manual
-        #      dispatch with no input falls through to github.sha.
-        env:
-          INPUT_TAG: ${{ inputs.target_tag }}
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-        run: |
-          set -euo pipefail
-          if [ -n "${INPUT_TAG:-}" ]; then
-            echo "target_tag=$INPUT_TAG" >> "$GITHUB_OUTPUT"
-            echo "Using operator-pinned tag: $INPUT_TAG"
-          else
-            SHORT="${HEAD_SHA:0:7}"
-            echo "target_tag=staging-$SHORT" >> "$GITHUB_OUTPUT"
-            echo "Using auto tag: staging-$SHORT (head_sha=$HEAD_SHA)"
-          fi
-
-      - name: Call CP redeploy-fleet
-        # CP_ADMIN_API_TOKEN must be set as a repo/org secret on
-        # molecule-ai/molecule-core, matching the staging/prod CP's
-        # CP_ADMIN_API_TOKEN env. Stored in Railway, mirrored to this
-        # repo's secrets for CI.
-        env:
-          CP_URL: ${{ vars.CP_URL || 'https://api.moleculesai.app' }}
-          CP_ADMIN_API_TOKEN: ${{ secrets.CP_ADMIN_API_TOKEN }}
-          TARGET_TAG: ${{ steps.tag.outputs.target_tag }}
-          CANARY_SLUG: ${{ inputs.canary_slug || 'hongming' }}
-          SOAK_SECONDS: ${{ inputs.soak_seconds || '60' }}
-          BATCH_SIZE: ${{ inputs.batch_size || '3' }}
-          DRY_RUN: ${{ inputs.dry_run || false }}
-        run: |
-          set -euo pipefail
-
-          if [ -z "${CP_ADMIN_API_TOKEN:-}" ]; then
-            echo "::error::CP_ADMIN_API_TOKEN secret not set — skipping redeploy"
-            echo "::notice::Set CP_ADMIN_API_TOKEN in repo secrets to enable auto-redeploy."
-            exit 1
-          fi
-
-          BODY=$(jq -nc \
-            --arg tag "$TARGET_TAG" \
-            --arg canary "$CANARY_SLUG" \
-            --argjson soak "$SOAK_SECONDS" \
-            --argjson batch "$BATCH_SIZE" \
-            --argjson dry "$DRY_RUN" \
-            '{
-              target_tag: $tag,
-              canary_slug: $canary,
-              soak_seconds: $soak,
-              batch_size: $batch,
-              dry_run: $dry
-            }')
-
-          echo "POST $CP_URL/cp/admin/tenants/redeploy-fleet"
-          echo "  body: $BODY"
-
-          HTTP_RESPONSE=$(mktemp)
-          HTTP_CODE_FILE=$(mktemp)
-          # Route -w into its own tempfile so curl's exit code (e.g. 56
-          # on connection-reset, 22 on --fail-with-body 4xx/5xx) can't
-          # pollute the captured stdout. The previous inline-substitution
-          # shape produced "000000" on connection reset (curl wrote
-          # "000" via -w, then the inline echo-fallback appended another
-          # "000") — caught on the 2026-05-04 redeploy of sha 2b862f6.
-          # set +e/-e keeps the non-zero curl exit from tripping the
-          # outer pipeline. See lint-curl-status-capture.yml for the
-          # CI gate that pins this fix shape.
-          set +e
-          curl -sS -o "$HTTP_RESPONSE" -w '%{http_code}' \
-            -m 1200 \
-            -H "Authorization: Bearer $CP_ADMIN_API_TOKEN" \
-            -H "Content-Type: application/json" \
-            -X POST "$CP_URL/cp/admin/tenants/redeploy-fleet" \
-            -d "$BODY" >"$HTTP_CODE_FILE"
-          set -e
-          # Stderr from curl (e.g. dial errors with -sS) goes to the runner
-          # log so operators can see WHY a connection failed. Stdout is
-          # captured to $HTTP_CODE_FILE because that's where -w writes.
-          HTTP_CODE=$(cat "$HTTP_CODE_FILE" 2>/dev/null || echo "000")
-          [ -z "$HTTP_CODE" ] && HTTP_CODE="000"
-
-          echo "HTTP $HTTP_CODE"
-          cat "$HTTP_RESPONSE" | jq . || cat "$HTTP_RESPONSE"
-
-          # Pretty-print per-tenant results in the job summary so
-          # ops can see which tenants were redeployed without drilling
-          # into the raw response.
-          {
-            echo "## Tenant redeploy fleet"
-            echo ""
-            echo "**Target tag:** \`$TARGET_TAG\`"
-            echo "**Canary:** \`$CANARY_SLUG\` (soak ${SOAK_SECONDS}s)"
-            echo "**Batch size:** $BATCH_SIZE"
-            echo "**Dry run:** $DRY_RUN"
-            echo "**HTTP:** $HTTP_CODE"
-            echo ""
-            echo "### Per-tenant result"
-            echo ""
-            echo '| Slug | Phase | SSM Status | Exit | Healthz | Error |'
-            echo '|------|-------|------------|------|---------|-------|'
-            jq -r '.results[]? | "| \(.slug) | \(.phase) | \(.ssm_status // "-") | \(.ssm_exit_code) | \(.healthz_ok) | \(.error // "-") |"' "$HTTP_RESPONSE" || true
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [ "$HTTP_CODE" != "200" ]; then
-            echo "::error::redeploy-fleet returned HTTP $HTTP_CODE"
-            exit 1
-          fi
-          OK=$(jq -r '.ok' "$HTTP_RESPONSE")
-          if [ "$OK" != "true" ]; then
-            echo "::error::redeploy-fleet reported ok=false (see summary for which tenant halted the rollout)"
-            exit 1
-          fi
-          echo "::notice::Tenant fleet redeploy reported ssm_status=Success — verifying actual image roll on each tenant..."
-
-          # Stash the response for the verify step. $RUNNER_TEMP outlasts
-          # the step boundary; $HTTP_RESPONSE doesn't.
-          cp "$HTTP_RESPONSE" "$RUNNER_TEMP/redeploy-response.json"
-
-      - name: Verify each tenant /buildinfo matches published SHA
-        # ROOT FIX FOR #2395.
-        #
-        # `redeploy-fleet`'s `ssm_status=Success` means "the SSM RPC
-        # didn't error" — NOT "the new image is running on the tenant."
-        # `:latest` lives in the local Docker daemon's image cache; if
-        # the SSM document does `docker compose up -d` without an
-        # explicit `docker pull`, the daemon serves the previously-
-        # cached digest and the container restarts on stale code.
-        # 2026-04-30 incident: hongmingwang's tenant reported
-        # ssm_status=Success at 17:00:53Z but kept serving pre-501a42d7
-        # chat_files for 30+ min — the lazy-heal fix never reached the
-        # user despite green deploy + green redeploy.
-        #
-        # This step closes the gap by curling each tenant's /buildinfo
-        # endpoint (added in workspace-server/internal/buildinfo +
-        # /Dockerfile* GIT_SHA build-arg, this PR) and comparing the
-        # returned git_sha to the SHA the workflow expects. Mismatches
-        # fail the workflow, which is what `ok=true` should have
-        # guaranteed all along.
-        #
-        # When the redeploy was triggered by workflow_dispatch with a
-        # specific tag (target_tag != "latest"), the expected SHA may
-        # not equal ${{ github.sha }} — in that case we resolve via
-        # GHCR's manifest. For workflow_run (default :latest) the
-        # workflow_run.head_sha is the SHA that just published.
-        env:
-          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          TARGET_TAG: ${{ steps.tag.outputs.target_tag }}
-          # Tenant subdomain template — slugs from the response are
-          # appended. Production CP issues `<slug>.moleculesai.app`;
-          # staging CP issues `<slug>.staging.moleculesai.app`. This
-          # workflow runs on main → prod CP → no `staging.` infix.
-          TENANT_DOMAIN: 'moleculesai.app'
-        run: |
-          set -euo pipefail
-
-          EXPECTED_SHORT="${EXPECTED_SHA:0:7}"
-          if [ "$TARGET_TAG" != "latest" ] \
-             && [ "$TARGET_TAG" != "$EXPECTED_SHA" ] \
-             && [ "$TARGET_TAG" != "staging-$EXPECTED_SHORT" ]; then
-            # workflow_dispatch with a pinned tag that isn't the head
-            # SHA — operator is rolling back / pinning. Skip the
-            # verification because we don't have the expected SHA in
-            # this context (would need to crane-inspect the GHCR
-            # manifest, which is a follow-up). Failing-open here is
-            # safe: the operator chose the tag deliberately.
-            #
-            # `staging-<short_head_sha>` IS verified — it's the new
-            # auto-trigger default (see Compute target tag step) and
-            # the digest under that tag SHOULD match EXPECTED_SHA.
-            echo "::notice::target_tag=$TARGET_TAG (operator-pinned) — skipping per-tenant SHA verification."
-            exit 0
-          fi
-
-          RESP="$RUNNER_TEMP/redeploy-response.json"
-          if [ ! -s "$RESP" ]; then
-            echo "::error::redeploy-response.json missing or empty — verify step ran without a response to read"
-            exit 1
-          fi
-
-          # Pull only successfully-redeployed tenants. Any tenant that
-          # halted the rollout already failed the previous step, so we
-          # don't double-count them here.
-          mapfile -t SLUGS < <(jq -r '.results[]? | select(.healthz_ok == true) | .slug' "$RESP")
-          if [ ${#SLUGS[@]} -eq 0 ]; then
-            echo "::warning::No tenants reported healthz_ok — nothing to verify"
-            exit 0
-          fi
-
-          echo "Verifying ${#SLUGS[@]} tenant(s) against EXPECTED_SHA=${EXPECTED_SHA:0:7}..."
-
-          # Two distinct failure modes — STALE (the #2395 bug class, hard-fail)
-          # vs UNREACHABLE (teardown race, soft-warn). See the staging variant's
-          # comment for the full rationale; same logic applies on prod even
-          # though prod has fewer ephemeral tenants — the asymmetry would be a
-          # gratuitous fork.
-          STALE_COUNT=0
-          UNREACHABLE_COUNT=0
-          STALE_LINES=()
-          UNREACHABLE_LINES=()
-          for slug in "${SLUGS[@]}"; do
-            URL="https://${slug}.${TENANT_DOMAIN}/buildinfo"
-            # 30s total: tenant just SSM-restarted, may still be coming
-            # up. Retry-on-empty rather than retry-on-status — we want
-            # to fail fast on "responded with wrong SHA", not "still
-            # warming up".
-            BODY=$(curl -sS --max-time 30 --retry 3 --retry-delay 5 --retry-connrefused "$URL" || true)
-            ACTUAL_SHA=$(echo "$BODY" | jq -r '.git_sha // ""' 2>/dev/null || echo "")
-            if [ -z "$ACTUAL_SHA" ]; then
-              UNREACHABLE_COUNT=$((UNREACHABLE_COUNT + 1))
-              UNREACHABLE_LINES+=("| $slug | (no /buildinfo response) | ${EXPECTED_SHA:0:7} | ⚠ unreachable (likely teardown race) |")
-              continue
-            fi
-            if [ "$ACTUAL_SHA" = "$EXPECTED_SHA" ]; then
-              echo "  $slug: ${ACTUAL_SHA:0:7} ✓"
-            else
-              STALE_COUNT=$((STALE_COUNT + 1))
-              STALE_LINES+=("| $slug | ${ACTUAL_SHA:0:7} | ${EXPECTED_SHA:0:7} | ❌ stale |")
-            fi
-          done
-
-          {
-            echo ""
-            echo "### Per-tenant /buildinfo verification"
-            echo ""
-            echo "Expected SHA: \`${EXPECTED_SHA:0:7}\`"
-            echo ""
-            if [ $STALE_COUNT -gt 0 ]; then
-              echo "**${STALE_COUNT} STALE tenant(s) — these did NOT pick up the new image despite ssm_status=Success:**"
-              echo ""
-              echo "| Slug | Actual /buildinfo SHA | Expected | Status |"
-              echo "|------|----------------------|----------|--------|"
-              for line in "${STALE_LINES[@]}"; do echo "$line"; done
-              echo ""
-            fi
-            if [ $UNREACHABLE_COUNT -gt 0 ]; then
-              echo "**${UNREACHABLE_COUNT} unreachable tenant(s) — likely teardown race (soft-warn, not failing):**"
-              echo ""
-              echo "| Slug | Actual /buildinfo SHA | Expected | Status |"
-              echo "|------|----------------------|----------|--------|"
-              for line in "${UNREACHABLE_LINES[@]}"; do echo "$line"; done
-              echo ""
-            fi
-            if [ $STALE_COUNT -eq 0 ] && [ $UNREACHABLE_COUNT -eq 0 ]; then
-              echo "All ${#SLUGS[@]} tenants returned matching SHA. ✓"
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [ $UNREACHABLE_COUNT -gt 0 ]; then
-            echo "::warning::$UNREACHABLE_COUNT tenant(s) unreachable post-redeploy. Likely benign teardown race — CP healthz monitor catches real outages."
-          fi
-
-          # Belt-and-suspenders sanity floor: same logic as the staging
-          # variant — see that file's comment for the full rationale.
-          # Floor only applies when fleet >= 4; below that, canary-verify
-          # is the actual gate.
-          TOTAL_VERIFIED=${#SLUGS[@]}
-          if [ $TOTAL_VERIFIED -ge 4 ] && [ $UNREACHABLE_COUNT -gt $((TOTAL_VERIFIED / 2)) ]; then
-            echo "::error::$UNREACHABLE_COUNT of $TOTAL_VERIFIED tenant(s) unreachable — exceeds 50% threshold on a fleet large enough that this signals a real outage, not teardown race."
-            exit 1
-          fi
-
-          if [ $STALE_COUNT -gt 0 ]; then
-            echo "::error::$STALE_COUNT tenant(s) returned a stale SHA. ssm_status=Success was misleading — see job summary."
-            exit 1
-          fi
-
-          echo "::notice::Tenant fleet redeploy complete — all reachable tenants on ${EXPECTED_SHA:0:7} (${UNREACHABLE_COUNT} unreachable, soft-warned)."
@@ -1,362 +0,0 @@
-name: redeploy-tenants-on-staging
-
-# Auto-refresh staging tenant EC2s after every staging-branch merge.
-#
-# Mirror of redeploy-tenants-on-main.yml, with the staging-CP host and
-# the :staging-latest tag. Sister workflow exists for prod (rolls
-# :latest after canary-verify). Both share the same shape — just
-# different CP_URL + target_tag + admin token secret.
-#
-# Why this workflow exists: publish-workspace-server-image now builds
-# on every staging-branch push (PR #2335), pushing
-# platform-tenant:staging-latest to GHCR. Existing tenants pulled
-# their image once at boot and never re-pull, so the new image just
-# sits unused until the tenant is reprovisioned.
-#
-# This workflow closes the gap by calling staging-CP's
-# /cp/admin/tenants/redeploy-fleet, which performs a canary-first,
-# batched, health-gated SSM redeploy across every live staging tenant.
-# Same endpoint shape as prod CP — only the host differs.
-#
-# Runtime ordering:
-#   1. publish-workspace-server-image completes on staging branch →
-#      new :staging-latest in GHCR.
-#   2. This workflow fires via workflow_run, waits 30s for GHCR's CDN
-#      to propagate the new tag.
-#   3. Calls redeploy-fleet with no canary (staging IS canary; we don't
-#      need a sub-canary inside it). Soak still applies to the first
-#      tenant in case of bad-deploy detection.
-#   4. Any failure aborts the rollout and leaves older tenants on the
-#      prior image — safer default than half-and-half state.
-#
-# Rollback path: re-run with workflow_dispatch + target_tag=staging-<sha>
-# of a known-good build.
-
-on:
-  workflow_run:
-    workflows: ['publish-workspace-server-image']
-    types: [completed]
-    branches: [main]
-  workflow_dispatch:
-    inputs:
-      target_tag:
-        description: 'Tenant image tag to deploy (e.g. "staging-latest" or "staging-a59f1a6c"). Defaults to staging-latest when empty.'
-        required: false
-        type: string
-        default: 'staging-latest'
-      canary_slug:
-        description: 'Tenant slug to deploy first + soak (empty = skip canary, fan out immediately). Default empty for staging since staging itself is the canary.'
-        required: false
-        type: string
-        default: ''
-      soak_seconds:
-        description: 'Seconds to wait after canary before fanning out. Only meaningful if canary_slug is set.'
-        required: false
-        type: string
-        default: '60'
-      batch_size:
-        description: 'How many tenants SSM redeploys in parallel per batch.'
-        required: false
-        type: string
-        default: '3'
-      dry_run:
-        description: 'Plan only — do not actually redeploy.'
-        required: false
-        type: boolean
-        default: false
-
-permissions:
-  contents: read
-  # No write scopes needed — the workflow hits an external CP endpoint,
-  # not the GitHub API.
-
-# Serialize per-branch so two rapid staging pushes' redeploys don't
-# overlap and cause confusing per-tenant SSM state. cancel-in-progress
-# is false because aborting a half-rolled-out fleet leaves tenants
-# stuck on whatever image they happened to be on when cancelled.
-concurrency:
-  group: redeploy-tenants-on-staging
-  cancel-in-progress: false
-
-jobs:
-  redeploy:
-    # Skip the auto-trigger if publish-workspace-server-image didn't
-    # actually succeed. workflow_run fires on any completion state; we
-    # don't want to redeploy against a half-built image.
-    if: |
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    steps:
-      - name: Wait for GHCR tag propagation
-        # GHCR's edge cache takes ~15-30s to consistently serve the new
-        # :staging-latest manifest after the registry accepts the push.
-        # Same rationale as redeploy-tenants-on-main.yml.
-        run: sleep 30
-
-      - name: Call staging-CP redeploy-fleet
-        # CP_STAGING_ADMIN_API_TOKEN must be set as a repo/org secret
-        # on molecule-ai/molecule-core, matching staging-CP's
-        # CP_ADMIN_API_TOKEN env var (visible in Railway controlplane
-        # / staging environment). Stored separately from the prod
-        # CP_ADMIN_API_TOKEN so a leak of one doesn't auth the other.
-        env:
-          CP_URL: ${{ vars.STAGING_CP_URL || 'https://staging-api.moleculesai.app' }}
-          CP_STAGING_ADMIN_API_TOKEN: ${{ secrets.CP_STAGING_ADMIN_API_TOKEN }}
-          TARGET_TAG: ${{ inputs.target_tag || 'staging-latest' }}
-          CANARY_SLUG: ${{ inputs.canary_slug || '' }}
-          SOAK_SECONDS: ${{ inputs.soak_seconds || '60' }}
-          BATCH_SIZE: ${{ inputs.batch_size || '3' }}
-          DRY_RUN: ${{ inputs.dry_run || false }}
-        run: |
-          set -euo pipefail
-
-          # Schedule-vs-dispatch hardening (mirrors sweep-cf-orphans
-          # and sweep-cf-tunnels): hard-fail on auto-trigger when the
-          # secret is missing so a misconfigured-repo doesn't silently
-          # serve stale staging tenants. Soft-skip on operator dispatch.
-          if [ -z "${CP_STAGING_ADMIN_API_TOKEN:-}" ]; then
-            if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-              echo "::warning::CP_STAGING_ADMIN_API_TOKEN secret not set — skipping redeploy"
-              echo "::warning::Set CP_STAGING_ADMIN_API_TOKEN in repo secrets to enable auto-redeploy."
-              echo "::notice::Pull the value from staging-CP's CP_ADMIN_API_TOKEN env in Railway."
-              exit 0
-            fi
-            echo "::error::staging redeploy cannot run — CP_STAGING_ADMIN_API_TOKEN secret missing"
-            echo "::error::set it at Settings → Secrets and Variables → Actions; pull from staging-CP's CP_ADMIN_API_TOKEN env in Railway."
-            exit 1
-          fi
-
-          BODY=$(jq -nc \
-            --arg tag "$TARGET_TAG" \
-            --arg canary "$CANARY_SLUG" \
-            --argjson soak "$SOAK_SECONDS" \
-            --argjson batch "$BATCH_SIZE" \
-            --argjson dry "$DRY_RUN" \
-            '{
-              target_tag: $tag,
-              canary_slug: $canary,
-              soak_seconds: $soak,
-              batch_size: $batch,
-              dry_run: $dry
-            }')
-
-          echo "POST $CP_URL/cp/admin/tenants/redeploy-fleet"
-          echo "  body: $BODY"
-
-          HTTP_RESPONSE=$(mktemp)
-          HTTP_CODE_FILE=$(mktemp)
-          # Route -w into its own tempfile so curl's exit code (e.g. 56
-          # on connection-reset) can't pollute the captured stdout. The
-          # previous inline-substitution shape produced "000000" on
-          # connection reset — caught on main variant 2026-05-04
-          # redeploying sha 2b862f6. Same fix shape as the synth-E2E
-          # §9c gate (PR #2797). See lint-curl-status-capture.yml for
-          # the CI gate that pins this fix shape.
-          set +e
-          curl -sS -o "$HTTP_RESPONSE" -w '%{http_code}' \
-            -m 1200 \
-            -H "Authorization: Bearer $CP_STAGING_ADMIN_API_TOKEN" \
-            -H "Content-Type: application/json" \
-            -X POST "$CP_URL/cp/admin/tenants/redeploy-fleet" \
-            -d "$BODY" >"$HTTP_CODE_FILE"
-          set -e
-          # Stderr from curl (-sS shows dial errors etc.) goes to the
-          # runner log so operators can see WHY a connection failed.
-          HTTP_CODE=$(cat "$HTTP_CODE_FILE" 2>/dev/null || echo "000")
-          [ -z "$HTTP_CODE" ] && HTTP_CODE="000"
-
-          echo "HTTP $HTTP_CODE"
-          cat "$HTTP_RESPONSE" | jq . || cat "$HTTP_RESPONSE"
-
-          {
-            echo "## Staging tenant redeploy fleet"
-            echo ""
-            echo "**Target tag:** \`$TARGET_TAG\`"
-            echo "**Canary:** \`${CANARY_SLUG:-(none — staging is itself the canary)}\` (soak ${SOAK_SECONDS}s)"
-            echo "**Batch size:** $BATCH_SIZE"
-            echo "**Dry run:** $DRY_RUN"
-            echo "**HTTP:** $HTTP_CODE"
-            echo ""
-            echo "### Per-tenant result"
-            echo ""
-            echo '| Slug | Phase | SSM Status | Exit | Healthz | Error |'
-            echo '|------|-------|------------|------|---------|-------|'
-            jq -r '.results[]? | "| \(.slug) | \(.phase) | \(.ssm_status // "-") | \(.ssm_exit_code) | \(.healthz_ok) | \(.error // "-") |"' "$HTTP_RESPONSE" || true
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          # Distinguish "real fleet failure" from "E2E teardown race".
-          #
-          # CP returns HTTP 500 + ok=false whenever ANY tenant in the
-          # fleet failed SSM or healthz. In practice the recurring source
-          # of these is ephemeral test tenants being torn down by their
-          # parent E2E run mid-redeploy: the EC2 dies → SSM exit=2 or
-          # healthz timeout → CP marks the fleet failed → this workflow
-          # goes red even though every operator-facing tenant rolled fine.
-          #
-          # Ephemeral slug prefixes (kept in sync with sweep-stale-e2e-orgs.yml
-          # — see that file for the source-of-truth list and rationale):
-          #   - e2e-*       — canvas/saas/ext E2E suites
-          #   - rt-e2e-*    — runtime-test harness fixtures (RFC #2251)
-          # Long-lived prefixes that are NOT ephemeral and MUST hard-fail:
-          # demo-prep, dryrun-*, dryrun2-*, plus all human tenant slugs.
-          #
-          # Filter: if HTTP=500/ok=false AND every failed slug matches an
-          # ephemeral prefix, treat as soft-warn and let the verify step
-          # downstream handle unreachable-vs-stale (#2402). Any non-ephemeral
-          # failure or a non-500 HTTP response remains a hard failure.
-          OK=$(jq -r '.ok // "false"' "$HTTP_RESPONSE")
-          FAILED_SLUGS=$(jq -r '
-            .results[]?
-            | select((.healthz_ok != true) or (.ssm_status != "Success"))
-            | .slug' "$HTTP_RESPONSE" 2>/dev/null || true)
-          EPHEMERAL_PREFIX_RE='^(e2e-|rt-e2e-)'
-          NON_EPHEMERAL_FAILED=$(printf '%s\n' "$FAILED_SLUGS" | grep -v '^$' | grep -Ev "$EPHEMERAL_PREFIX_RE" || true)
-
-          if [ "$HTTP_CODE" = "200" ] && [ "$OK" = "true" ]; then
-            : # happy path — fall through to verification
-          elif [ "$HTTP_CODE" = "500" ] && [ -z "$NON_EPHEMERAL_FAILED" ] && [ -n "$FAILED_SLUGS" ]; then
-            COUNT=$(printf '%s\n' "$FAILED_SLUGS" | grep -Ec "$EPHEMERAL_PREFIX_RE" || true)
-            echo "::warning::redeploy-fleet returned HTTP 500 but every failed tenant ($COUNT) is ephemeral (e2e-*/rt-e2e-*) — treating as teardown race, soft-warning."
-            printf '%s\n' "$FAILED_SLUGS" | sed 's/^/::warning::  failed: /'
-          elif [ "$HTTP_CODE" != "200" ]; then
-            echo "::error::redeploy-fleet returned HTTP $HTTP_CODE"
-            if [ -n "$NON_EPHEMERAL_FAILED" ]; then
-              echo "::error::non-ephemeral tenant(s) failed:"
-              printf '%s\n' "$NON_EPHEMERAL_FAILED" | sed 's/^/::error::  /'
-            fi
-            exit 1
-          else
-            # HTTP=200 but ok=false (shouldn't happen with current CP
-            # but keep the gate for completeness).
-            echo "::error::redeploy-fleet reported ok=false (see summary for which tenant halted the rollout)"
-            exit 1
-          fi
-          echo "::notice::Staging tenant fleet redeploy reported ssm_status=Success — verifying actual image roll on each tenant..."
-
-          cp "$HTTP_RESPONSE" "$RUNNER_TEMP/redeploy-response.json"
-
-      - name: Verify each staging tenant /buildinfo matches published SHA
-        # Mirror of the verify step in redeploy-tenants-on-main.yml — see
-        # there for the rationale (#2395 root fix). Staging has the same
-        # ssm_status-success-but-stale-image hazard and benefits from the
-        # same gate. Diff: TENANT_DOMAIN includes the `staging.` infix.
-        env:
-          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          TARGET_TAG: ${{ inputs.target_tag || 'staging-latest' }}
-          TENANT_DOMAIN: 'staging.moleculesai.app'
-        run: |
-          set -euo pipefail
-
-          # staging-latest is the staging-side moving tag; treat it the
-          # same way main treats `latest`. Operator-pinned SHAs skip
-          # verification (see main variant for why).
-          if [ "$TARGET_TAG" != "staging-latest" ] && [ "$TARGET_TAG" != "latest" ] && [ "$TARGET_TAG" != "$EXPECTED_SHA" ]; then
-            echo "::notice::target_tag=$TARGET_TAG (operator-pinned) — skipping per-tenant SHA verification."
-            exit 0
-          fi
-
-          RESP="$RUNNER_TEMP/redeploy-response.json"
-          if [ ! -s "$RESP" ]; then
-            echo "::error::redeploy-response.json missing or empty"
-            exit 1
-          fi
-
-          mapfile -t SLUGS < <(jq -r '.results[]? | select(.healthz_ok == true) | .slug' "$RESP")
-          if [ ${#SLUGS[@]} -eq 0 ]; then
-            echo "::warning::No staging tenants reported healthz_ok — nothing to verify"
-            exit 0
-          fi
-
-          echo "Verifying ${#SLUGS[@]} staging tenant(s) against EXPECTED_SHA=${EXPECTED_SHA:0:7}..."
-
-          # Two distinct failure modes here:
-          #   STALE_COUNT      — tenant returned a SHA that doesn't match. THIS is
-          #                      the #2395 bug class: tenant up + serving old code.
-          #                      Always hard-fail the workflow.
-          #   UNREACHABLE_COUNT — tenant didn't respond. Almost always a benign
-          #                      teardown race: redeploy-fleet snapshot says
-          #                      healthz_ok=true, then the E2E suite tears the
-          #                      ephemeral tenant down before this step runs (the
-          #                      e2e-* fixtures churn 5-10/hour on staging). Soft-
-          #                      warn so we don't block staging→main on cleanup.
-          #                      Real "tenant up but unreachable" is caught by CP's
-          #                      own healthz monitor + the post-redeploy alert; we
-          #                      don't need to double-count it here.
-          STALE_COUNT=0
-          UNREACHABLE_COUNT=0
-          STALE_LINES=()
-          UNREACHABLE_LINES=()
-          for slug in "${SLUGS[@]}"; do
-            URL="https://${slug}.${TENANT_DOMAIN}/buildinfo"
-            BODY=$(curl -sS --max-time 30 --retry 3 --retry-delay 5 --retry-connrefused "$URL" || true)
-            ACTUAL_SHA=$(echo "$BODY" | jq -r '.git_sha // ""' 2>/dev/null || echo "")
-            if [ -z "$ACTUAL_SHA" ]; then
-              UNREACHABLE_COUNT=$((UNREACHABLE_COUNT + 1))
-              UNREACHABLE_LINES+=("| $slug | (no /buildinfo response) | ${EXPECTED_SHA:0:7} | ⚠ unreachable (likely teardown race) |")
-              continue
-            fi
-            if [ "$ACTUAL_SHA" = "$EXPECTED_SHA" ]; then
-              echo "  $slug: ${ACTUAL_SHA:0:7} ✓"
-            else
-              STALE_COUNT=$((STALE_COUNT + 1))
-              STALE_LINES+=("| $slug | ${ACTUAL_SHA:0:7} | ${EXPECTED_SHA:0:7} | ❌ stale |")
-            fi
-          done
-
-          {
-            echo ""
-            echo "### Per-tenant /buildinfo verification (staging)"
-            echo ""
-            echo "Expected SHA: \`${EXPECTED_SHA:0:7}\`"
-            echo ""
-            if [ $STALE_COUNT -gt 0 ]; then
-              echo "**${STALE_COUNT} STALE tenant(s) — these did NOT pick up the new image despite ssm_status=Success:**"
-              echo ""
-              echo "| Slug | Actual /buildinfo SHA | Expected | Status |"
-              echo "|------|----------------------|----------|--------|"
-              for line in "${STALE_LINES[@]}"; do echo "$line"; done
-              echo ""
-            fi
-            if [ $UNREACHABLE_COUNT -gt 0 ]; then
-              echo "**${UNREACHABLE_COUNT} unreachable tenant(s) — likely E2E teardown race (soft-warn, not failing):**"
-              echo ""
-              echo "| Slug | Actual /buildinfo SHA | Expected | Status |"
-              echo "|------|----------------------|----------|--------|"
-              for line in "${UNREACHABLE_LINES[@]}"; do echo "$line"; done
-              echo ""
-            fi
-            if [ $STALE_COUNT -eq 0 ] && [ $UNREACHABLE_COUNT -eq 0 ]; then
-              echo "All ${#SLUGS[@]} staging tenants returned matching SHA. ✓"
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [ $UNREACHABLE_COUNT -gt 0 ]; then
-            echo "::warning::$UNREACHABLE_COUNT staging tenant(s) unreachable post-redeploy. Likely benign teardown race — CP healthz monitor catches real outages."
-          fi
-
-          # Belt-and-suspenders sanity floor: if MORE than half the fleet is
-          # unreachable AND the fleet is large enough that "half down" is
-          # statistically meaningful, this is a real outage (e.g. new image
-          # crashes on startup), not a teardown race. Hard-fail.
-          #
-          # Floor only applies when TOTAL_VERIFIED >= 4 — below that, the
-          # canary-verify step is the actual gate for "all tenants down"
-          # detection (it runs against the canary first and aborts the
-          # rollout if the canary fails to come up). Without the >=4 gate,
-          # a 1-tenant fleet (e.g. a single ephemeral e2e-* tenant on a
-          # quiet staging push) would re-flake on the exact teardown-race
-          # condition #2402 fixed: 1 of 1 unreachable = 100% > 50% → fail.
-          TOTAL_VERIFIED=${#SLUGS[@]}
-          if [ $TOTAL_VERIFIED -ge 4 ] && [ $UNREACHABLE_COUNT -gt $((TOTAL_VERIFIED / 2)) ]; then
-            echo "::error::$UNREACHABLE_COUNT of $TOTAL_VERIFIED staging tenant(s) unreachable — exceeds 50% threshold on a fleet large enough that this signals a real outage, not teardown race."
-            exit 1
-          fi
-
-          if [ $STALE_COUNT -gt 0 ]; then
-            echo "::error::$STALE_COUNT staging tenant(s) returned a stale SHA. ssm_status=Success was misleading — see job summary."
-            exit 1
-          fi
-
-          echo "::notice::Staging tenant fleet redeploy complete — all reachable tenants on ${EXPECTED_SHA:0:7} (${UNREACHABLE_COUNT} unreachable, soft-warned)."
@@ -57,24 +57,24 @@ See `CLAUDE.md` for a full list of environment variables and their purposes.

 This repo is scoped to **code** (canvas, workspace, workspace-server, related
 infra). Public content (blog posts, marketing copy, OG images, SEO briefs,
-DevRel demos) lives in [`Molecule-AI/docs`](https://git.moleculesai.app/molecule-ai/docs).
+DevRel demos) lives in [`molecule-ai/docs`](https://git.moleculesai.app/molecule-ai/docs).
 The `Block forbidden paths` CI gate fails any PR that writes to `marketing/`
-or other removed paths — open against `Molecule-AI/docs` instead.
+or other removed paths — open against `molecule-ai/docs` instead.

 | Content type | Target |
 |---|---|
-| Blog posts | `Molecule-AI/docs` → `content/blog/<YYYY-MM-DD-slug>/` |
-| Doc pages | `Molecule-AI/docs` → `content/docs/` |
-| Marketing copy / PMM positioning | `Molecule-AI/docs` → `marketing/` |
-| OG images, visual assets | `Molecule-AI/docs` → `app/` or `marketing/` |
-| SEO briefs | `Molecule-AI/docs` → `marketing/` |
-| DevRel demos (runnable code) | Standalone repo under `Molecule-AI/`, OR embedded in `Molecule-AI/docs` |
-| Launch checklists, internal tracking | GitHub Issues — **not** committed files |
+| Blog posts | `molecule-ai/docs` → `content/blog/<YYYY-MM-DD-slug>/` |
+| Doc pages | `molecule-ai/docs` → `content/docs/` |
+| Marketing copy / PMM positioning | `molecule-ai/docs` → `marketing/` |
+| OG images, visual assets | `molecule-ai/docs` → `app/` or `marketing/` |
+| SEO briefs | `molecule-ai/docs` → `marketing/` |
+| DevRel demos (runnable code) | Standalone repo under `molecule-ai/`, OR embedded in `molecule-ai/docs` |
+| Launch checklists, internal tracking | Gitea Issues — **not** committed files |
 | Engineering docs (`docs/adr/`, `docs/architecture/`, `docs/incidents/`) | This repo (internal, not published) |
 | Live product pages (e.g. `canvas/src/app/pricing/page.tsx`) | This repo (these are app code, not marketing copy) |

 If a PR fails the `Block forbidden paths` check, the contents belong in
-`Molecule-AI/docs`. No CI drag, no Canvas E2E, content lands in minutes.
+`molecule-ai/docs`. No CI drag, no Canvas E2E, content lands in minutes.

 ## Development Workflow

@@ -106,7 +106,7 @@ causing a render loop when any node position changed.

 #### Auto-merge & the "extra commit" trap

-**Two system guards protect against pushing commits after auto-merge has been enabled.** Don't try to work around them — they exist because we shipped a half-merged PR on 2026-04-27 (`#2174` merged with only its first commit; the second was orphaned on a branch GitHub had already deleted).
+**Two system guards protect against pushing commits after auto-merge has been enabled.** Don't try to work around them — they exist because we shipped a half-merged PR on 2026-04-27 (`#2174` merged with only its first commit; the second was orphaned on a branch the host had already deleted).

 1. **Repo-wide:** "Automatically delete head branches" is on. Once a PR merges, the branch is deleted server-side. Any subsequent `git push` to that branch fails with `remote rejected — no such branch`.

@@ -145,7 +145,7 @@ Fix violations before committing — the hook will reject the commit.

 ### CI Pipeline

-CI runs on GitHub Actions with a self-hosted runner. External contributors:
+CI runs on Gitea Actions with self-hosted runners. External contributors:
 PRs from forks will not trigger CI automatically. A maintainer will review
 and run CI manually.

@@ -190,9 +190,9 @@ Runs the full regression suite against a fixture HTTP server. No network access
 Code in this repo lands in molecule-core. Some related runtime artifacts
 live in their own repos:

- [`Molecule-AI/molecule-ai-workspace-runtime`](https://git.moleculesai.app/molecule-ai/molecule-ai-workspace-runtime) — Python adapter SDK (`molecule_runtime`) that runs inside containerized Molecule workspaces. Bridges Claude Code SDK / hermes / langgraph / etc. → A2A queue.
- [`Molecule-AI/molecule-sdk-python`](https://git.moleculesai.app/molecule-ai/molecule-sdk-python) — `A2AServer` + `RemoteAgentClient` for external agents that register over the public `/registry/register` flow.
- [`Molecule-AI/molecule-mcp-claude-channel`](https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel) — Claude Code channel plugin. Bridges A2A traffic into a running Claude Code session via MCP `notifications/claude/channel`. Polling-based (no tunnel required); install with `claude --channels plugin:molecule@Molecule-AI/molecule-mcp-claude-channel`.
+- [`molecule-ai/molecule-ai-workspace-runtime`](https://git.moleculesai.app/molecule-ai/molecule-ai-workspace-runtime) — Python adapter SDK (`molecule_runtime`) that runs inside containerized Molecule workspaces. Bridges Claude Code SDK / hermes / langgraph / etc. → A2A queue.
+- [`molecule-ai/molecule-sdk-python`](https://git.moleculesai.app/molecule-ai/molecule-sdk-python) — `A2AServer` + `RemoteAgentClient` for external agents that register over the public `/registry/register` flow.
+- [`molecule-ai/molecule-mcp-claude-channel`](https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel) — Claude Code channel plugin. Bridges A2A traffic into a running Claude Code session via MCP `notifications/claude/channel`. Polling-based (no tunnel required); install inside Claude Code via `/plugin marketplace add https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel.git` → `/plugin install molecule@molecule-channel`, then launch with `claude --dangerously-load-development-channels=plugin:molecule@molecule-channel`.

 When extending the **A2A surface** in molecule-core (`workspace-server/internal/handlers/a2a_proxy.go` etc.), consider whether the change has a downstream impact on the runtime SDK or the channel plugin — they're versioned independently but share the wire shape.

@@ -206,7 +206,7 @@ See `CLAUDE.md` for detailed architecture documentation, including:

 ## Reporting Issues

-Use GitHub Issues with a clear title and reproduction steps. Include:
+Use Gitea Issues with a clear title and reproduction steps. Include:
 - What you expected
 - What actually happened
 - Platform/OS version
@@ -214,8 +214,9 @@ Use GitHub Issues with a clear title and reproduction steps. Include:

 ## Security

-If you discover a security vulnerability, please report it privately via
-GitHub Security Advisories rather than opening a public issue.
+If you discover a security vulnerability, please report it privately by
+opening an issue against `molecule-ai/internal` (a private repo only
+maintainers can see) rather than filing a public issue here.

 ## License

@@ -4,10 +4,10 @@
 # use this Makefile; CI calls docker compose / go test directly so the
 # Makefile can evolve without breaking the build.

-.PHONY: help dev up down logs build test
+.PHONY: help dev up down logs build test e2e-peer-visibility

 help: ## Show this help.
-	@grep -E '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-12s\033[0m %s\n", $$1, $$2}'
+	@grep -E '^[a-zA-Z0-9_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-22s\033[0m %s\n", $$1, $$2}'

 dev: ## Start the full stack with air hot-reload for the platform service.
 	docker compose -f docker-compose.yml -f docker-compose.dev.yml up
@@ -26,3 +26,13 @@ build: ## Force a fresh build of the platform image (no cache).

 test: ## Run Go unit tests in workspace-server/.
 	cd workspace-server && go test -race ./...
+
+# ─── Local prod-mimic E2E gates ────────────────────────────────────────
+# Run the LITERAL peer-visibility MCP list_peers gate against the
+# already-running local stack (`make up` or `make dev`). Same byte-
+# identical assertion as the staging gate — only provisioning differs.
+# Skips any runtime whose provider key is absent (partially-keyed env
+# is fine). See tests/e2e/test_peer_visibility_mcp_local.sh for the
+# env contract (CLAUDE_CODE_OAUTH_TOKEN / E2E_MINIMAX_API_KEY / etc).
+e2e-peer-visibility: ## Run the LOCAL peer-visibility MCP gate vs the running stack (needs `make up` first).
+	bash tests/e2e/test_peer_visibility_mcp_local.sh
@@ -238,7 +238,7 @@ The result is not just “an agent that learns.” It is **an organization that
 - subscribe to one or more workspaces; peer messages surface as conversation turns; replies route back through Molecule's A2A
 - no tunnel, no public endpoint — the plugin self-registers each watched workspace as `delivery_mode=poll` and long-polls `/activity?since_id=…`
 - multi-tenant friendly: one plugin install can watch workspaces across multiple Molecule tenants (`MOLECULE_PLATFORM_URLS` per-workspace)
- install via the standard marketplace flow: `/plugin marketplace add Molecule-AI/molecule-mcp-claude-channel` → `/plugin install molecule-channel@molecule-mcp-claude-channel`
+- install via the standard marketplace flow: `/plugin marketplace add https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel.git` → `/plugin install molecule@molecule-channel`, then launch with `claude --dangerously-load-development-channels=plugin:molecule@molecule-channel`

 ## Built For Teams That Need More Than A Demo

@@ -237,7 +237,7 @@ Molecule AI 并不是要替代下面这些 framework，而是把它们纳入更
 - 订阅一个或多个 workspace；peer 的消息会以 user-turn 出现，回复会经 Molecule A2A 路由出去
 - 无需公网隧道、无需公开端点 —— 插件启动时自动把每个 watched workspace 注册成 `delivery_mode=poll`，长轮询 `/activity?since_id=…`
 - 多租户友好：单次安装即可同时 watch 跨多个 Molecule 租户的 workspace（`MOLECULE_PLATFORM_URLS` 按 workspace 配置）
- 通过标准 marketplace 流程安装：`/plugin marketplace add Molecule-AI/molecule-mcp-claude-channel` → `/plugin install molecule-channel@molecule-mcp-claude-channel`
+- 通过标准 marketplace 流程安装：`/plugin marketplace add https://git.moleculesai.app/molecule-ai/molecule-mcp-claude-channel.git` → `/plugin install molecule@molecule-channel`，然后用 `claude --dangerously-load-development-channels=plugin:molecule@molecule-channel` 启动

 ## 适合什么团队

@@ -1 +1,2 @@
-trigger
+trigger
+retrigger 2026-05-20T04:09Z after op-config#110 (HOME=/home/runner) deploy to fleet — internal#603
@@ -0,0 +1,173 @@
+import { test, expect } from "@playwright/test";
+import { startEchoRuntime } from "./fixtures/echo-runtime";
+import { seedWorkspace, startHeartbeat, cleanupWorkspace } from "./fixtures/chat-seed";
+
+
+test.describe("Desktop ChatTab", () => {
+  let cleanup: () => Promise<void> = async () => {};
+  let workspaceId = "";
+  let workspaceName = "";
+
+  test.beforeAll(async () => {
+    const echo = await startEchoRuntime();
+    const ws = await seedWorkspace(echo.baseURL);
+    workspaceId = ws.id;
+    workspaceName = ws.name;
+    const stopHeartbeat = startHeartbeat(ws.id, ws.authToken);
+
+    cleanup = async () => {
+      stopHeartbeat();
+      await echo.stop();
+    };
+  });
+
+  test.afterAll(async () => {
+    await cleanupWorkspace(workspaceId);
+    await cleanup();
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await page.setViewportSize({ width: 1280, height: 800 });
+    await page.goto("/");
+    await page.waitForSelector(".react-flow__node", { timeout: 10_000 });
+    // Dismiss onboarding guide if present.
+    const skipGuide = page.getByText("Skip guide");
+    if (await skipGuide.isVisible().catch(() => false)) {
+      await skipGuide.click();
+    }
+    // Click the workspace node by its exact name label.
+    await page.getByText(workspaceName, { exact: true }).first().click();
+    // Wait for the side panel chat tab to be clickable, then click it.
+    await page.locator('#tab-chat').click();
+    await page.waitForSelector("[data-testid='chat-panel']", { timeout: 5_000 });
+    // Wait for the workspace status to flip to online and the textarea to be enabled.
+    await expect(page.locator("textarea").first()).toBeEnabled({ timeout: 15_000 });
+  });
+
+  test("chat panel loads without error", async ({ page }) => {
+    const hasEmptyState = await page.getByText("Send a message to start chatting.").isVisible().catch(() => false);
+    const hasHistory = await page.locator("[data-testid='chat-panel']").locator("div").count() > 3;
+    expect(hasEmptyState || hasHistory).toBeTruthy();
+  });
+
+  test("send text message and receive echo response", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("What is the weather?");
+    await page.getByRole("button", { name: /Send/ }).first().click();
+
+    await expect(page.getByText("What is the weather?")).toBeVisible({ timeout: 5_000 });
+    await expect(page.getByText("Echo: What is the weather?")).toBeVisible({ timeout: 15_000 });
+  });
+
+  test("history persists across reload", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("Persistence test");
+    await page.getByRole("button", { name: /Send/ }).first().click();
+
+    await expect(page.getByText("Echo: Persistence test")).toBeVisible({ timeout: 15_000 });
+
+    await page.reload();
+    await page.waitForSelector(".react-flow__node", { timeout: 10_000 });
+    await page.getByText(workspaceName, { exact: true }).first().click();
+    await page.locator('#tab-chat').click();
+    await page.waitForSelector("[data-testid='chat-panel']", { timeout: 5_000 });
+    // Wait for the workspace status to flip to online and the textarea to be enabled.
+    await expect(page.locator("textarea").first()).toBeEnabled({ timeout: 15_000 });
+
+    await expect(page.getByText("Persistence test", { exact: true })).toBeVisible({ timeout: 5_000 });
+    await expect(page.getByText("Echo: Persistence test")).toBeVisible({ timeout: 5_000 });
+  });
+
+  test("file attachment round-trip", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("Please read this file");
+
+    const fileInput = page.locator("[data-testid='chat-panel'] input[type='file']").first();
+    await fileInput.setInputFiles({
+      name: "test.txt",
+      mimeType: "text/plain",
+      buffer: Buffer.from("secret content abc123"),
+    });
+
+    await expect(page.getByText("test.txt")).toBeVisible({ timeout: 3_000 });
+
+    await page.getByRole("button", { name: /Send/ }).first().click();
+
+    await expect(page.getByText("Echo: Please read this file")).toBeVisible({ timeout: 15_000 });
+  });
+
+  test("activity log appears during send", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("Trigger activity");
+    await page.getByRole("button", { name: /Send/ }).first().click();
+
+    // Activity log container should appear during the send flow.
+    await expect(page.locator("[data-testid='activity-log']").first()).toBeVisible({ timeout: 10_000 }).catch(() => {
+      // Activity log may not be present in all layouts.
+    });
+  });
+});
+
+test.describe("Desktop ChatTab — Markdown rendering", () => {
+  let cleanup: () => Promise<void> = async () => {};
+  let workspaceId = "";
+  let workspaceName = "";
+
+  test.beforeAll(async () => {
+    const echo = await startEchoRuntime();
+    const ws = await seedWorkspace(echo.baseURL);
+    workspaceId = ws.id;
+    workspaceName = ws.name;
+    const stopHeartbeat = startHeartbeat(ws.id, ws.authToken);
+
+    cleanup = async () => {
+      stopHeartbeat();
+      await echo.stop();
+    };
+  });
+
+  test.afterAll(async () => {
+    await cleanupWorkspace(workspaceId);
+    await cleanup();
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await page.setViewportSize({ width: 1280, height: 800 });
+    await page.goto("/");
+    await page.waitForSelector(".react-flow__node", { timeout: 10_000 });
+    const skipGuide2 = page.getByText("Skip guide");
+    if (await skipGuide2.isVisible().catch(() => false)) {
+      await skipGuide2.click();
+    }
+    await page.getByText(workspaceName, { exact: true }).first().click();
+    await page.locator('#tab-chat').click();
+    await page.waitForSelector("[data-testid='chat-panel']", { timeout: 5_000 });
+    // Wait for the workspace status to flip to online and the textarea to be enabled.
+    await expect(page.locator("textarea").first()).toBeEnabled({ timeout: 15_000 });
+  });
+
+  test("code block renders <pre>", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("```js\nconst x = 1;\n```");
+    await page.getByRole("button", { name: /Send/ }).first().click();
+
+    await expect(page.getByText("Echo: ```js")).toBeVisible({ timeout: 15_000 });
+
+    const pre = page.locator("pre").first();
+    await expect(pre).toBeVisible({ timeout: 5_000 });
+    await expect(pre).toContainText("const x = 1;");
+  });
+
+  test("table renders <table>", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("| A | B |\n|---|---|\n| 1 | 2 |");
+    await page.getByRole("button", { name: /Send/ }).first().click();
+
+    await expect(page.getByText("Echo: | A | B |")).toBeVisible({ timeout: 15_000 });
+
+    const table = page.locator("table").first();
+    await expect(table).toBeVisible({ timeout: 5_000 });
+    await expect(table).toContainText("A");
+    await expect(table).toContainText("1");
+  });
+});
@@ -0,0 +1,97 @@
+import { test, expect } from "@playwright/test";
+import { startEchoRuntime } from "./fixtures/echo-runtime";
+import { seedWorkspace, startHeartbeat, cleanupWorkspace } from "./fixtures/chat-seed";
+
+
+test.describe("MobileChat", () => {
+  let cleanup: () => Promise<void> = async () => {};
+  let workspaceId = "";
+
+  test.beforeAll(async () => {
+    const echo = await startEchoRuntime();
+    const ws = await seedWorkspace(echo.baseURL);
+    workspaceId = ws.id;
+    const stopHeartbeat = startHeartbeat(ws.id, ws.authToken);
+
+    cleanup = async () => {
+      stopHeartbeat();
+      await echo.stop();
+    };
+  });
+
+  test.afterAll(async () => {
+    await cleanupWorkspace(workspaceId);
+    await cleanup();
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await page.setViewportSize({ width: 375, height: 812 });
+    // Navigate directly to the mobile chat view.
+    await page.goto(`/?m=chat&a=${workspaceId}`);
+    await page.waitForSelector("[data-testid='chat-panel']", { timeout: 10_000 });
+    // Wait for the workspace status to flip to online and the textarea to be enabled.
+    await expect(page.locator("textarea").first()).toBeEnabled({ timeout: 15_000 });
+    // Dismiss onboarding guide if present.
+    const skipGuide = page.getByText("Skip guide");
+    if (await skipGuide.isVisible().catch(() => false)) {
+      await skipGuide.click();
+    }
+  });
+
+  test("chat panel loads without error", async ({ page }) => {
+    const hasEmptyState = await page.getByText("Send a message to start chatting.").isVisible().catch(() => false);
+    const hasHistory = await page.locator("[data-testid='chat-panel']").locator("div").count() > 3;
+    expect(hasEmptyState || hasHistory).toBeTruthy();
+  });
+
+  test("send text message and receive echo response", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("Mobile test message");
+    await page.getByRole("button", { name: /Send/ }).first().click();
+
+    await expect(page.getByText("Mobile test message")).toBeVisible({ timeout: 5_000 });
+    await expect(page.getByText("Echo: Mobile test message")).toBeVisible({ timeout: 15_000 });
+  });
+
+  test("history persists across reload", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("Mobile persistence");
+    await page.getByRole("button", { name: /Send/ }).first().click();
+
+    await expect(page.getByText("Echo: Mobile persistence")).toBeVisible({ timeout: 15_000 });
+
+    await page.reload();
+    await page.waitForSelector("[data-testid='chat-panel']", { timeout: 10_000 });
+
+    await expect(page.getByText("Mobile persistence", { exact: true })).toBeVisible({ timeout: 5_000 });
+    await expect(page.getByText("Echo: Mobile persistence")).toBeVisible({ timeout: 5_000 });
+  });
+
+  test("composer auto-grows with multi-line text", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    const initialHeight = await textarea.evaluate((el: HTMLElement) => el.offsetHeight);
+
+    await textarea.fill("Line 1\nLine 2\nLine 3\nLine 4\nLine 5");
+    await page.waitForTimeout(300);
+
+    const grownHeight = await textarea.evaluate((el: HTMLElement) => el.offsetHeight);
+    expect(grownHeight).toBeGreaterThan(initialHeight);
+  });
+
+  test("file attachment in mobile chat", async ({ page }) => {
+    const textarea = page.locator("textarea").first();
+    await textarea.fill("Mobile file test");
+
+    const fileInput = page.locator("[data-testid='chat-panel'] input[type='file']").first();
+    await fileInput.setInputFiles({
+      name: "mobile.txt",
+      mimeType: "text/plain",
+      buffer: Buffer.from("mobile secret"),
+    });
+
+    await expect(page.getByText("mobile.txt")).toBeVisible({ timeout: 3_000 });
+
+    await page.getByRole("button", { name: /Send/ }).first().click();
+    await expect(page.getByText("Echo: Mobile file test")).toBeVisible({ timeout: 15_000 });
+  });
+});
@@ -0,0 +1,187 @@
+/**
+ * E2E seed fixture for chat tests.
+ *
+ * Creates an external workspace via the workspace-server API, extracts the
+ * auto-minted auth token, then overrides the DB row so it appears "online"
+ * with an echo-runtime URL.  External runtime is used because the health
+ * sweep skips Docker checks for external workspaces; we keep the workspace
+ * alive with periodic heartbeats.
+ */
+
+import { randomUUID } from "node:crypto";
+
+const PLATFORM_URL = process.env.E2E_PLATFORM_URL ?? "http://localhost:8080";
+
+export interface SeededWorkspace {
+  id: string;
+  name: string;
+  agentURL: string;
+  authToken: string;
+}
+
+/**
+ * Create an external workspace and wire it to the echo runtime.
+ */
+export async function seedWorkspace(echoURL: string): Promise<SeededWorkspace> {
+  // 1. Create external workspace (no URL — platform will mint an auth token).
+  const runId = Math.random().toString(36).slice(2, 8);
+  const wsName = `Chat E2E Agent ${runId}`;
+  const createRes = await fetch(`${PLATFORM_URL}/workspaces`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ name: wsName, tier: 1, external: true, runtime: "external" }),
+  });
+  if (!createRes.ok) {
+    const text = await createRes.text();
+    throw new Error(`Failed to create workspace: ${createRes.status} ${text}`);
+  }
+  const ws = (await createRes.json()) as {
+    id: string;
+    name: string;
+    connection?: { auth_token?: string };
+  };
+  const authToken = ws.connection?.auth_token;
+  if (!authToken) {
+    throw new Error("Workspace created but no auth_token returned");
+  }
+
+  // 2. Direct DB update: mark online + point url at echo runtime.
+  //    The platform blocks loopback URLs at the API layer (SSRF guard),
+  //    so we bypass via psql for local E2E.
+  const dbUrl = process.env.E2E_DATABASE_URL;
+  if (!dbUrl) {
+    throw new Error("E2E_DATABASE_URL must be set for DB seeding");
+  }
+  const pgRegex = /postgres:\/\/([^:]+):([^@]+)@([^:]+):(\d+)\/([^?]+)/;
+  const m = dbUrl.match(pgRegex);
+  if (!m) {
+    throw new Error(`Cannot parse E2E_DATABASE_URL: ${dbUrl}`);
+  }
+  const [, user, pass, host, port, db] = m;
+
+  // Pre-seed a platform_inbound_secret so chat file uploads don't trigger
+  // the lazy-heal 503 "retry in 30 s" path on first use.
+  const inboundSecret = Array.from({ length: 43 }, () =>
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"[
+      Math.floor(Math.random() * 64)
+    ],
+  ).join("");
+
+  const psql = [
+    `PGPASSWORD=${pass} psql`,
+    `-h ${host} -p ${port} -U ${user} -d ${db}`,
+    `-c "UPDATE workspaces SET status = 'online', url = '${echoURL}', platform_inbound_secret = '${inboundSecret}' WHERE id = '${ws.id}'"`,
+  ].join(" ");
+
+  const { execSync } = await import("node:child_process");
+  try {
+    execSync(psql, { stdio: "pipe", timeout: 30_000 });
+  } catch (err) {
+    throw new Error(`DB update failed: ${err}`);
+  }
+
+  return { id: ws.id, name: wsName, agentURL: echoURL, authToken };
+}
+
+/**
+ * Start a heartbeat interval that keeps an external workspace alive.
+ * Returns a stop function.
+ */
+export function startHeartbeat(
+  workspaceId: string,
+  authToken: string,
+  intervalMs = 30_000,
+): () => void {
+  const send = () => {
+    fetch(`${PLATFORM_URL}/registry/heartbeat`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${authToken}`,
+      },
+      body: JSON.stringify({
+        workspace_id: workspaceId,
+        error_rate: 0,
+        sample_error: "",
+        active_tasks: 0,
+        current_task: "",
+        uptime_seconds: 0,
+      }),
+    }).catch(() => {});
+  };
+
+  // Send immediately so the first heartbeat lands before the stale sweep.
+  send();
+  const timer = setInterval(send, intervalMs);
+
+  return () => clearInterval(timer);
+}
+
+/**
+ * Seed chat-history rows for a workspace.
+ */
+export async function seedChatHistory(
+  workspaceId: string,
+  messages: Array<{ role: "user" | "agent"; content: string }>,
+): Promise<void> {
+  const dbUrl = process.env.E2E_DATABASE_URL;
+  if (!dbUrl) return;
+
+  const pgRegex = /postgres:\/\/([^:]+):([^@]+)@([^:]+):(\d+)\/([^?]+)/;
+  const m = dbUrl.match(pgRegex);
+  if (!m) return;
+  const [, user, pass, host, port, db] = m;
+
+  const values = messages
+    .map(
+      (msg, i) =>
+        `('${randomUUID()}', '${workspaceId}', '${msg.role}', '${msg.content.replace(/'/g, "''")}', NOW() - INTERVAL '${messages.length - i} seconds')`,
+    )
+    .join(",");
+
+  const sql = `INSERT INTO chat_messages (id, workspace_id, role, content, created_at) VALUES ${values};`;
+
+  const { execSync } = await import("node:child_process");
+  const psql = `PGPASSWORD=${pass} psql -h ${host} -p ${port} -U ${user} -d ${db} -c "${sql}"`;
+  execSync(psql, { stdio: "pipe", timeout: 10_000 });
+}
+
+/**
+ * Delete a seeded workspace row directly from the DB.
+ * Uses psql (same credentials as seedWorkspace) so we bypass any
+ * workspace-server side-effects (container stop, cascade cleanup, etc.)
+ * that can race or 500 on external workspaces.
+ */
+export async function cleanupWorkspace(workspaceId: string): Promise<void> {
+  const dbUrl = process.env.E2E_DATABASE_URL;
+  if (!dbUrl) return;
+
+  const pgRegex = /postgres:\/\/([^:]+):([^@]+)@([^:]+):(\d+)\/([^?]+)/;
+  const m = dbUrl.match(pgRegex);
+  if (!m) return;
+  const [, user, pass, host, port, db] = m;
+
+  const psql = `PGPASSWORD=${pass} psql -h ${host} -p ${port} -U ${user} -d ${db} -c "DELETE FROM workspaces WHERE id = '${workspaceId}'"`;
+
+  const { execSync } = await import("node:child_process");
+  try {
+    execSync(psql, { stdio: "pipe", timeout: 30_000 });
+  } catch {
+    // Best-effort cleanup; don't fail the test suite if the row is already gone.
+  }
+}
+
+/**
+ * Mint a workspace auth token so the canvas can make authenticated API
+ * calls (WorkspaceAuth middleware).
+ */
+export async function mintTestToken(workspaceId: string): Promise<string> {
+  const res = await fetch(
+    `${PLATFORM_URL}/admin/workspaces/${workspaceId}/test-token`,
+  );
+  if (!res.ok) {
+    throw new Error(`Failed to mint test token: ${res.status}`);
+  }
+  const data = (await res.json()) as { auth_token: string };
+  return data.auth_token;
+}
@@ -0,0 +1,180 @@
+/**
+ * Minimal A2A echo runtime for E2E tests.
+ *
+ * Listens on an ephemeral port, receives A2A JSON-RPC `message/send`
+ * requests, and returns a response with the original text echoed back.
+ * Also implements the workspace-side chat upload ingest endpoint so
+ * file-attachment E2E can exercise the full upload → send → echo
+ * round-trip.
+ *
+ * Usage (inside test fixture):
+ *   const echo = await startEchoRuntime();
+ *   // ... seed workspace with agent_url pointing to echo.baseURL ...
+ *   echo.stop();
+ */
+
+import { createServer, type Server } from "node:http";
+
+export interface EchoRuntime {
+  baseURL: string;
+  stop: () => Promise<void>;
+  lastRequest: { method: string; text: string; files: unknown[] } | null;
+}
+
+/** Parse a minimal multipart body and extract the first file's name + content. */
+function parseMultipart(body: Buffer): { name: string; mimeType: string; content: Buffer } | null {
+  // Find the boundary line (first line starting with "--").
+  const str = body.toString("binary");
+  const firstDash = str.indexOf("--");
+  if (firstDash === -1) return null;
+  const eol = str.indexOf("\r\n", firstDash);
+  if (eol === -1) return null;
+  const boundary = str.slice(firstDash + 2, eol);
+  const boundaryMarker = "\r\n--" + boundary;
+
+  // Find the first part that has a filename in Content-Disposition.
+  let pos = eol + 2;
+  while (pos < str.length) {
+    const nextBoundary = str.indexOf(boundaryMarker, pos);
+    if (nextBoundary === -1) break;
+    const part = str.slice(pos, nextBoundary);
+
+    const cdMatch = part.match(/Content-Disposition:[^\r\n]*filename="([^"]+)"/i);
+    if (cdMatch) {
+      const name = cdMatch[1];
+      const ctMatch = part.match(/Content-Type:\s*([^\r\n]+)/i);
+      const mimeType = ctMatch ? ctMatch[1].trim() : "application/octet-stream";
+      // Body starts after the first double-CRLF in the part.
+      const bodyStart = part.indexOf("\r\n\r\n");
+      if (bodyStart !== -1) {
+        // Extract the raw bytes (not the string) so binary is safe.
+        const headerBytes = Buffer.byteLength(part.slice(0, bodyStart + 4), "binary");
+        const partStartInBody = Buffer.byteLength(str.slice(0, pos + bodyStart + 4), "binary");
+        const partEndInBody = Buffer.byteLength(str.slice(0, nextBoundary), "binary");
+        const content = body.subarray(partStartInBody, partEndInBody);
+        return { name, mimeType, content };
+      }
+    }
+    pos = nextBoundary + boundaryMarker.length;
+    // Skip trailing "--" (end marker) or CRLF.
+    if (str.slice(pos, pos + 2) === "--") break;
+    if (str.slice(pos, pos + 2) === "\r\n") pos += 2;
+  }
+  return null;
+}
+
+export async function startEchoRuntime(): Promise<EchoRuntime> {
+  let lastRequest: EchoRuntime["lastRequest"] = null;
+
+  const server = createServer((req, res) => {
+    // CORS: allow the canvas origin (localhost:3000) to call us.
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+
+    const url = req.url ?? "/";
+
+    // Workspace-side chat upload ingest (RFC #2312).
+    if (url === "/internal/chat/uploads/ingest" && req.method === "POST") {
+      const chunks: Buffer[] = [];
+      req.on("data", (chunk: Buffer) => chunks.push(chunk));
+      req.on("end", () => {
+        const body = Buffer.concat(chunks);
+        const file = parseMultipart(body);
+        if (!file) {
+          res.writeHead(400);
+          res.end(JSON.stringify({ error: "no files field" }));
+          return;
+        }
+        const sanitized = file.name.replace(/[^a-zA-Z0-9._\-]/g, "_").replace(/ /g, "_");
+        const prefix = Array.from({ length: 32 }, () =>
+          Math.floor(Math.random() * 16).toString(16),
+        ).join("");
+        const response = {
+          files: [
+            {
+              uri: `workspace:/workspace/.molecule/chat-uploads/${prefix}-${sanitized}`,
+              name: sanitized,
+              mimeType: file.mimeType,
+              size: file.content.length,
+            },
+          ],
+        };
+        res.setHeader("Content-Type", "application/json");
+        res.writeHead(200);
+        res.end(JSON.stringify(response));
+      });
+      return;
+    }
+
+    // Default: A2A JSON-RPC handler.
+    let body = "";
+    req.setEncoding("utf8");
+    req.on("data", (chunk: string) => {
+      body += chunk;
+    });
+    req.on("end", () => {
+      res.setHeader("Content-Type", "application/json");
+      try {
+        const rpc = JSON.parse(body);
+        const msg = rpc.params?.message;
+        const textParts =
+          msg?.parts
+            ?.filter((p: { kind?: string; text?: string }) => p.kind === "text")
+            .map((p: { text?: string }) => p.text)
+            .filter(Boolean) ?? [];
+        const fileParts =
+          msg?.parts?.filter((p: { kind?: string }) => p.kind === "file") ?? [];
+        const text = textParts.join("\n");
+
+        lastRequest = {
+          method: rpc.method ?? "unknown",
+          text,
+          files: fileParts,
+        };
+
+        const replyText = text
+          ? `Echo: ${text}`
+          : fileParts.length > 0
+            ? "Echo: received your file(s)."
+            : "Echo: hello";
+
+        const response = {
+          jsonrpc: "2.0",
+          id: rpc.id ?? null,
+          result: {
+            parts: [{ kind: "text", text: replyText }],
+          },
+        };
+
+        res.writeHead(200);
+        res.end(JSON.stringify(response));
+      } catch {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: "invalid json" }));
+      }
+    });
+  });
+
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  const baseURL = `http://127.0.0.1:${port}`;
+
+  return {
+    baseURL,
+    stop: () =>
+      new Promise((resolve) => {
+        server.close(() => resolve(undefined));
+      }),
+    get lastRequest() {
+      return lastRequest;
+    },
+  };
+}
@@ -5,9 +5,10 @@ export default defineConfig({
  timeout: 30_000,
  expect: { timeout: 10_000 },
  fullyParallel: false,
+  workers: 1,
  retries: 0,
  use: {
-    baseURL: "http://localhost:3000",
+    baseURL: process.env.PLAYWRIGHT_BASE_URL || "http://localhost:3000",
    headless: true,
    screenshot: "only-on-failure",
  },
@@ -0,0 +1,113 @@
+import { describe, it, expect, vi } from "vitest";
+
+// Marketing-launch SEO (mc#1486). These tests pin the public crawler
+// contract: anything that flips public marketing routes to disallow,
+// drops the sitemap from robots.txt, or removes the OG image
+// reference from root metadata should fail loudly here.
+
+// next/font and the rest of the layout's runtime tree are not
+// vitest-compatible (next/font expects the Next.js compiler swc
+// transform). We import layout.tsx only for its exported `metadata`
+// constant — mock the font module to a constructor-returning stub.
+vi.mock("next/font/google", () => ({
+  Inter: () => ({ variable: "--font-inter" }),
+  JetBrains_Mono: () => ({ variable: "--font-jetbrains" }),
+}));
+
+import robots from "../robots";
+import sitemap from "../sitemap";
+import { metadata } from "../layout";
+
+describe("robots.ts", () => {
+  it("allows public marketing routes and blocks authed/app routes", () => {
+    const r = robots();
+    expect(r.rules).toBeDefined();
+    const rule = Array.isArray(r.rules) ? r.rules[0] : r.rules!;
+    expect(rule.userAgent).toBe("*");
+    const allow = Array.isArray(rule.allow) ? rule.allow : [rule.allow];
+    expect(allow).toEqual(expect.arrayContaining(["/", "/pricing", "/blog"]));
+    const disallow = Array.isArray(rule.disallow)
+      ? rule.disallow
+      : [rule.disallow];
+    expect(disallow).toEqual(
+      expect.arrayContaining(["/api/", "/orgs", "/cp/"]),
+    );
+  });
+
+  it("declares the sitemap URL", () => {
+    const r = robots();
+    expect(r.sitemap).toMatch(/\/sitemap\.xml$/);
+  });
+
+  it("declares a canonical host", () => {
+    const r = robots();
+    expect(r.host).toMatch(/^https:\/\//);
+  });
+});
+
+describe("sitemap.ts", () => {
+  it("includes apex, pricing, and the live blog post", () => {
+    const entries = sitemap();
+    const urls = entries.map((e) => e.url);
+    expect(urls.some((u) => u.endsWith("/"))).toBe(true);
+    expect(urls.some((u) => u.endsWith("/pricing"))).toBe(true);
+    expect(
+      urls.some((u) => u.includes("/blog/2026-04-20-chrome-devtools-mcp")),
+    ).toBe(true);
+  });
+
+  it("does NOT include authed/app routes", () => {
+    const entries = sitemap();
+    const urls = entries.map((e) => e.url);
+    expect(urls.some((u) => u.includes("/orgs"))).toBe(false);
+    expect(urls.some((u) => u.includes("/api/"))).toBe(false);
+  });
+
+  it("sets a non-zero priority and a valid changeFrequency on every entry", () => {
+    const valid = new Set([
+      "always",
+      "hourly",
+      "daily",
+      "weekly",
+      "monthly",
+      "yearly",
+      "never",
+    ]);
+    for (const e of sitemap()) {
+      expect(e.priority).toBeGreaterThan(0);
+      expect(valid.has(String(e.changeFrequency))).toBe(true);
+    }
+  });
+});
+
+describe("root layout metadata", () => {
+  it("sets a templated title + non-empty description", () => {
+    const t = metadata.title as { default: string; template: string };
+    expect(t.default).toMatch(/Molecule AI/);
+    expect(t.template).toMatch(/%s/);
+    expect((metadata.description ?? "").length).toBeGreaterThan(50);
+  });
+
+  it("declares OG + Twitter text fields (image comes from opengraph-image.tsx)", () => {
+    const og = metadata.openGraph;
+    expect(og).toBeDefined();
+    expect((og as { title: string }).title).toMatch(/Molecule AI/);
+    expect((og as { description: string }).description.length).toBeGreaterThan(
+      50,
+    );
+    const tw = metadata.twitter;
+    expect(tw).toBeDefined();
+    // Next.js typings narrow twitter.card to a union — assert via cast.
+    expect((tw as { card: string }).card).toBe("summary_large_image");
+  });
+
+  it("sets a canonical alternate", () => {
+    expect(metadata.alternates?.canonical).toBe("/");
+  });
+
+  it("enables indexing at the metadata level (robots.ts owns per-route)", () => {
+    const r = metadata.robots as { index: boolean; follow: boolean };
+    expect(r.index).toBe(true);
+    expect(r.follow).toBe(true);
+  });
+});
@@ -27,9 +27,78 @@ import {
  themeBootScript,
 } from "@/lib/theme-cookie";

+// Marketing-launch SEO (mc#1486). Canonical apex is app.moleculesai.app —
+// tenant subdomains (<slug>.moleculesai.app) reuse the same Next.js build
+// but are gated behind auth (AuthGate redirects anonymous → /cp/auth/login)
+// and are de-indexed in robots.ts. The metadata here applies to the
+// public marketing surface served from the apex host.
+//
+// Override per-route by exporting a page-level `metadata`/`generateMetadata`
+// — Next.js merges page metadata over layout metadata using
+// `title.template` for "<page> | Molecule AI" composition.
+const SITE_URL =
+  process.env.NEXT_PUBLIC_SITE_URL ?? "https://app.moleculesai.app";
+
 export const metadata: Metadata = {
-  title: "Molecule AI",
-  description: "AI Org Chart Canvas",
+  metadataBase: new URL(SITE_URL),
+  title: {
+    default: "Molecule AI — the AI org chart canvas",
+    template: "%s | Molecule AI",
+  },
+  description:
+    "Molecule AI is an org-chart canvas for AI agent teams. Wire Claude Code, Codex, Hermes, and OpenClaw agents into a governed multi-agent workspace with credit metering, audit, and one-click runtime provisioning.",
+  applicationName: "Molecule AI",
+  keywords: [
+    "AI agents",
+    "multi-agent",
+    "agent orchestration",
+    "AI org chart",
+    "Claude Code",
+    "Codex",
+    "MCP",
+    "agent governance",
+    "A2A",
+    "agent runtime",
+  ],
+  authors: [{ name: "Molecule AI" }],
+  creator: "Molecule AI",
+  publisher: "Molecule AI",
+  alternates: { canonical: "/" },
+  // OG + Twitter images come from the file-convention sibling
+  // `opengraph-image.tsx` — Next.js auto-attaches them to og:image
+  // and twitter:image when present at the segment root. We keep the
+  // text fields here so they win over per-page metadata when a page
+  // doesn't override them. `images: []` as the structural fallback
+  // for hosts that won't follow the file convention; the real URL
+  // is injected by Next.js at build time from opengraph-image.tsx.
+  openGraph: {
+    type: "website",
+    siteName: "Molecule AI",
+    url: SITE_URL,
+    title: "Molecule AI — the AI org chart canvas",
+    description:
+      "Wire Claude Code, Codex, Hermes, and OpenClaw agents into a governed multi-agent workspace. Credit metering, audit, and one-click runtime provisioning.",
+    locale: "en_US",
+  },
+  twitter: {
+    card: "summary_large_image",
+    title: "Molecule AI — the AI org chart canvas",
+    description:
+      "Wire Claude Code, Codex, Hermes, and OpenClaw agents into a governed multi-agent workspace.",
+  },
+  icons: {
+    icon: "/molecule-icon.png",
+    apple: "/molecule-icon.png",
+  },
+  // robots.ts owns the per-route allow/disallow contract; this is the
+  // header-level fallback for routes the crawler reaches before
+  // robots.txt resolves. Default = index public marketing routes;
+  // app/auth/api/orgs are noindex'd by robots.ts.
+  robots: {
+    index: true,
+    follow: true,
+    googleBot: { index: true, follow: true, "max-image-preview": "large" },
+  },
 };

 export default async function RootLayout({
@@ -94,6 +163,75 @@ export default async function RootLayout({
          nonce={nonce}
          dangerouslySetInnerHTML={{ __html: themeBootScript }}
        />
+        {/*
+         * JSON-LD structured data (mc#1486). Two graph nodes:
+         *
+         *   - Organization: surfaces the brand to Google Knowledge
+         *     Graph + Bing entity index. URL+logo+sameAs are the
+         *     minimum recommended set for new brands without a
+         *     Wikipedia page.
+         *
+         *   - WebSite: enables the sitelinks search box and tells
+         *     crawlers the canonical site URL when the same content
+         *     is reachable via multiple subdomains (apex + tenant).
+         *
+         * Type-application/ld+json runs synchronously without
+         * executing JS, so 'strict-dynamic' isn't required — we still
+         * carry the nonce because production CSP's default-src 'self'
+         * applies to any <script> element. The "type" attribute is
+         * what keeps the browser from running the body as JS, but
+         * CSP nonces are gated on the element not the type, so we
+         * include the nonce too.
+         */}
+        <script
+          type="application/ld+json"
+          nonce={nonce}
+          dangerouslySetInnerHTML={{
+            __html: JSON.stringify({
+              "@context": "https://schema.org",
+              "@graph": [
+                {
+                  "@type": "Organization",
+                  "@id": `${SITE_URL}#organization`,
+                  name: "Molecule AI",
+                  url: SITE_URL,
+                  logo: `${SITE_URL}/molecule-icon.png`,
+                  sameAs: [
+                    "https://github.com/molecule-ai",
+                    "https://x.com/moleculeai",
+                  ],
+                },
+                {
+                  "@type": "WebSite",
+                  "@id": `${SITE_URL}#website`,
+                  url: SITE_URL,
+                  name: "Molecule AI",
+                  publisher: { "@id": `${SITE_URL}#organization` },
+                  inLanguage: "en-US",
+                },
+                {
+                  "@type": "SoftwareApplication",
+                  "@id": `${SITE_URL}#software`,
+                  name: "Molecule AI",
+                  applicationCategory: "DeveloperApplication",
+                  operatingSystem: "Web",
+                  description:
+                    "Org-chart canvas for AI agent teams with credit metering, audit, and one-click runtime provisioning.",
+                  url: SITE_URL,
+                  offers: {
+                    "@type": "AggregateOffer",
+                    priceCurrency: "USD",
+                    lowPrice: "0",
+                    highPrice: "99",
+                    offerCount: "3",
+                    url: `${SITE_URL}/pricing`,
+                  },
+                  publisher: { "@id": `${SITE_URL}#organization` },
+                },
+              ],
+            }),
+          }}
+        />
      </head>
      <body className={`bg-surface text-ink ${interFont.variable} ${monoFont.variable}`}>
        <ThemeProvider initialTheme={theme}>
@@ -0,0 +1,82 @@
+import { ImageResponse } from "next/og";
+
+// Marketing-launch SEO (mc#1486). Next.js App-Router file-system OG
+// convention: served as `/opengraph-image` and auto-attached as
+// `og:image` + `twitter:image`. Dynamic (not a static PNG in /public)
+// so we can iterate the brand mark + tagline pre-launch without
+// churning a binary blob in git history.
+export const runtime = "edge";
+
+export const alt = "Molecule AI — the AI org chart canvas";
+export const size = { width: 1200, height: 630 };
+export const contentType = "image/png";
+
+export default function OG() {
+  return new ImageResponse(
+    (
+      <div
+        style={{
+          width: "100%",
+          height: "100%",
+          display: "flex",
+          flexDirection: "column",
+          alignItems: "flex-start",
+          justifyContent: "center",
+          padding: "80px",
+          background:
+            "linear-gradient(135deg, #0a0a0a 0%, #1a1a2e 60%, #16213e 100%)",
+          color: "#ffffff",
+          fontFamily: "system-ui, -apple-system, sans-serif",
+        }}
+      >
+        <div
+          style={{
+            fontSize: 28,
+            color: "#a3a3c2",
+            letterSpacing: "0.18em",
+            textTransform: "uppercase",
+            marginBottom: 24,
+          }}
+        >
+          Molecule AI
+        </div>
+        <div
+          style={{
+            fontSize: 76,
+            fontWeight: 700,
+            lineHeight: 1.05,
+            letterSpacing: "-0.02em",
+            maxWidth: 980,
+          }}
+        >
+          The AI org chart canvas
+        </div>
+        <div
+          style={{
+            fontSize: 32,
+            color: "#c8c8d8",
+            marginTop: 32,
+            lineHeight: 1.3,
+            maxWidth: 980,
+          }}
+        >
+          Wire Claude Code, Codex, Hermes, and OpenClaw agents into a governed
+          multi-agent workspace.
+        </div>
+        <div
+          style={{
+            position: "absolute",
+            right: 80,
+            bottom: 80,
+            fontSize: 22,
+            color: "#7a7a96",
+            display: "flex",
+          }}
+        >
+          moleculesai.app
+        </div>
+      </div>
+    ),
+    { ...size },
+  );
+}
@@ -103,7 +103,7 @@ export default function Home() {
                setHydrationError(null);
                window.location.reload();
              }}
-              className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm"
+              className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
            >
              Retry
            </button>
@@ -115,7 +115,9 @@ export default function Home() {

  return (
    <>
-      <Canvas />
+      <main aria-label="Agent canvas">
+        <Canvas />
+      </main>
      <Legend />
      <CommunicationOverlay />
      {hydrationError && (
@@ -134,7 +136,7 @@ export default function Home() {
              setHydrationError(null);
              window.location.reload();
            }}
-            className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm"
+            className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
          >
            Retry
          </button>
@@ -176,7 +178,7 @@ brew services start redis`}</pre>
      </p>
      <button
        onClick={() => window.location.reload()}
-        className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm mt-2"
+        className="px-4 py-2 bg-accent-strong hover:bg-accent text-white rounded-md text-sm mt-2 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
      >
        Reload
      </button>
@@ -0,0 +1,45 @@
+import type { MetadataRoute } from "next";
+
+// Marketing-launch SEO (mc#1486). Next.js App-Router robots convention:
+// this file is served as `/robots.txt` at build time and is the single
+// source of truth for crawler allow/disallow.
+//
+// Contract:
+//   - Public marketing routes (/, /pricing, /blog/*) are crawlable.
+//   - Authed/app routes (/orgs, /api/*) are noindex'd. They render
+//     useful content only after a session round-trip, so a crawler hit
+//     just wastes our crawl budget and exposes endpoint shapes.
+//   - Tenant subdomains (<slug>.moleculesai.app) share this build but
+//     are blocked at the host level by the canvas middleware sending
+//     an `X-Robots-Tag: noindex` header — robots.txt is per-host and
+//     this file's `host` field claims the apex as canonical.
+//
+// Note: `sitemap` is published via the sibling `sitemap.ts` route; we
+// reference it explicitly here so crawlers don't have to guess.
+const SITE_URL =
+  process.env.NEXT_PUBLIC_SITE_URL ?? "https://app.moleculesai.app";
+
+export default function robots(): MetadataRoute.Robots {
+  return {
+    rules: [
+      {
+        userAgent: "*",
+        allow: ["/", "/pricing", "/blog"],
+        // Authed app surface + API + transient checkout returns. The
+        // /orgs route boots the org-selector behind AuthGate; even
+        // though SSR returns markup, that markup is a login wall when
+        // hit by an unauthenticated crawler, so indexing it dilutes
+        // brand searches with a "Please sign in" snippet.
+        disallow: [
+          "/orgs",
+          "/orgs/",
+          "/api/",
+          "/cp/",
+          "/checkout/",
+        ],
+      },
+    ],
+    sitemap: `${SITE_URL}/sitemap.xml`,
+    host: SITE_URL,
+  };
+}
@@ -0,0 +1,42 @@
+import type { MetadataRoute } from "next";
+
+// Marketing-launch SEO (mc#1486). App-Router sitemap convention: this
+// file is served as `/sitemap.xml` and enumerates the public marketing
+// surface for search crawlers + AI training pipelines.
+//
+// Scope deliberately narrow:
+//   - Apex landing, pricing, and the (currently single) blog post.
+//   - Authed app routes are excluded — they're disallowed in robots.ts
+//     and would appear as "Please sign in" wall to a crawler.
+//
+// `lastModified` uses a build-time timestamp rather than per-route
+// fs.stat so the same value applies regardless of where the build
+// runs (Vercel/Railway/local). When we add CMS-backed blog content,
+// swap to a per-entry timestamp from the source-of-truth metadata.
+const SITE_URL =
+  process.env.NEXT_PUBLIC_SITE_URL ?? "https://app.moleculesai.app";
+
+const BUILD_DATE = new Date();
+
+export default function sitemap(): MetadataRoute.Sitemap {
+  return [
+    {
+      url: `${SITE_URL}/`,
+      lastModified: BUILD_DATE,
+      changeFrequency: "weekly",
+      priority: 1.0,
+    },
+    {
+      url: `${SITE_URL}/pricing`,
+      lastModified: BUILD_DATE,
+      changeFrequency: "weekly",
+      priority: 0.9,
+    },
+    {
+      url: `${SITE_URL}/blog/2026-04-20-chrome-devtools-mcp`,
+      lastModified: new Date("2026-04-20"),
+      changeFrequency: "monthly",
+      priority: 0.6,
+    },
+  ];
+}
@@ -132,7 +132,7 @@ export function AuditTrailPanel({ workspaceId }: Props) {

  if (loading) {
    return (
-      <div className="flex items-center justify-center h-32">
+      <div role="status" aria-live="polite" className="flex items-center justify-center h-32">
        <span className="text-xs text-ink-mid">Loading audit trail…</span>
      </div>
    );
@@ -133,13 +133,13 @@ export function ConversationTraceModal({ open, workspaceId: _workspaceId, onClos
            {/* Timeline */}
            <div className="flex-1 overflow-y-auto px-5 py-4">
              {loading && (
-                <div className="text-xs text-ink-mid text-center py-8">
+                <div role="status" aria-live="polite" className="text-xs text-ink-mid text-center py-8">
                  Loading trace from all workspaces...
                </div>
              )}

              {!loading && entries.length === 0 && (
-                <div className="text-xs text-ink-mid text-center py-8">
+                <div role="status" aria-live="polite" className="text-xs text-ink-mid text-center py-8">
                  No activity found
                </div>
              )}
@@ -105,7 +105,7 @@ export function EmptyState() {

        {/* Template grid */}
        {loading ? (
-          <div className="flex items-center justify-center gap-2 text-xs text-ink-mid py-4">
+          <div role="status" aria-live="polite" className="flex items-center justify-center gap-2 text-xs text-ink-mid py-4">
            <Spinner />
            Loading templates...
          </div>
@@ -15,7 +15,7 @@
 //     ($AGENT_URL). They ARE NOT filled in server-side because the
 //     server doesn't know where the operator's agent will live.

-import { useCallback, useState } from "react";
+import { useCallback, useRef, useState } from "react";
 import * as Dialog from "@radix-ui/react-dialog";

 type Tab = "python" | "curl" | "claude" | "mcp" | "hermes" | "codex" | "openclaw" | "kimi" | "fields";
@@ -84,6 +84,33 @@ export function ExternalConnectModal({ info, onClose }: Props) {
    : "python";
  const [tab, setTab] = useState<Tab>(initialTab);
  const [copiedKey, setCopiedKey] = useState<string | null>(null);
+  const tabRefs = useRef<Map<Tab, HTMLButtonElement | null>>(new Map());
+
+  const handleTabKeyDown = useCallback(
+    (e: React.KeyboardEvent<HTMLButtonElement>, current: Tab, tabs: Tab[]) => {
+      const idx = tabs.indexOf(current);
+      if (e.key === "ArrowRight" || e.key === "ArrowDown") {
+        e.preventDefault();
+        const next = tabs[(idx + 1) % tabs.length];
+        setTab(next);
+        tabRefs.current.get(next)?.focus();
+      } else if (e.key === "ArrowLeft" || e.key === "ArrowUp") {
+        e.preventDefault();
+        const prev = tabs[(idx - 1 + tabs.length) % tabs.length];
+        setTab(prev);
+        tabRefs.current.get(prev)?.focus();
+      } else if (e.key === "Home") {
+        e.preventDefault();
+        setTab(tabs[0]);
+        tabRefs.current.get(tabs[0])?.focus();
+      } else if (e.key === "End") {
+        e.preventDefault();
+        setTab(tabs[tabs.length - 1]);
+        tabRefs.current.get(tabs[tabs.length - 1])?.focus();
+      }
+    },
+    [],
+  );

  const copy = useCallback(async (value: string, key: string) => {
    try {
@@ -160,6 +187,19 @@ export function ExternalConnectModal({ info, onClose }: Props) {
    `MOLECULE_WORKSPACE_TOKEN=${info.auth_token}`,
  );

+  // Build the tab list once so both the tab bar and keyboard handler
+  // share the same ordered array. Computed here (after all filled* vars)
+  // so TypeScript's block-scoping analysis can reach them.
+  const tabList: Tab[] = [];
+  if (filledUniversalMcp) tabList.push("mcp");
+  tabList.push("python");
+  if (filledChannel) tabList.push("claude");
+  if (filledHermes) tabList.push("hermes");
+  if (filledCodex) tabList.push("codex");
+  if (filledOpenClaw) tabList.push("openclaw");
+  if (filledKimi) tabList.push("kimi");
+  tabList.push("curl", "fields");
+
  return (
    <Dialog.Root open onOpenChange={(o) => !o && onClose()}>
      <Dialog.Portal>
@@ -180,34 +220,18 @@ export function ExternalConnectModal({ info, onClose }: Props) {
            aria-label="Connection snippet format"
            className="mt-4 flex gap-1 border-b border-line"
          >
-            {(() => {
-              // Build the tab order dynamically. Claude Code first
-              // (when offered) since it's the simplest setup; Python
-              // SDK second (full register+heartbeat+inbound); Universal
-              // MCP third (any MCP-aware runtime, outbound-only); curl
-              // for one-shot register; Fields for raw values.
-              // Tab order: Universal MCP first (default, runtime-
-              // agnostic primitives), then runtime-specific channel/
-              // SDK tabs, then curl + Fields. Each runtime tab only
-              // appears when the platform supplies the snippet — no
-              // dead "tab missing snippet" UX.
-              const tabs: Tab[] = [];
-              if (filledUniversalMcp) tabs.push("mcp");
-              tabs.push("python");
-              if (filledChannel) tabs.push("claude");
-              if (filledHermes) tabs.push("hermes");
-              if (filledCodex) tabs.push("codex");
-              if (filledOpenClaw) tabs.push("openclaw");
-              if (filledKimi) tabs.push("kimi");
-              tabs.push("curl", "fields");
-              return tabs;
-            })().map((t) => (
+            {tabList.map((t) => (
              <button
                key={t}
                type="button"
                role="tab"
+                id={`tab-${t}`}
                aria-selected={tab === t}
+                aria-controls={`panel-${t}`}
+                tabIndex={tab === t ? 0 : -1}
+                ref={(el) => { tabRefs.current.set(t, el); }}
                onClick={() => setTab(t)}
+                onKeyDown={(e) => handleTabKeyDown(e, t, tabList)}
                className={`px-3 py-2 text-sm border-b-2 -mb-px transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-surface ${
                  tab === t
                    ? "border-accent text-ink"
@@ -235,18 +259,39 @@ export function ExternalConnectModal({ info, onClose }: Props) {
            ))}
          </div>

-          {/* Snippet area */}
-          <div className="mt-3">
-            {tab === "claude" && filledChannel && (
-              <SnippetBlock
-                value={filledChannel}
-                label="Claude Code channel — polls workspace's A2A; no tunnel needed"
-                copyKey="claude"
-                copied={copiedKey === "claude"}
-                onCopy={() => copy(filledChannel, "claude")}
-              />
-            )}
-            {tab === "python" && (
+          {/* Snippet area — all panels always in the DOM so aria-controls
+              targets are stable. Hidden panels use aria-hidden so screen
+              readers skip them; active panel uses role=tabpanel with
+              aria-labelledby pointing to the tab button. */}
+          <div className="mt-3" data-testid="snippet-panels">
+            {/* Claude Code tab */}
+            <div
+              id="panel-claude"
+              data-testid="panel-claude"
+              role="tabpanel"
+              aria-labelledby="tab-claude"
+              hidden={tab !== "claude" || !filledChannel}
+              className={tab === "claude" && filledChannel ? "" : "hidden"}
+            >
+              {filledChannel && (
+                <SnippetBlock
+                  value={filledChannel}
+                  label="Claude Code channel — polls workspace's A2A; no tunnel needed"
+                  copyKey="claude"
+                  copied={copiedKey === "claude"}
+                  onCopy={() => copy(filledChannel, "claude")}
+                />
+              )}
+            </div>
+            {/* Python SDK tab */}
+            <div
+              id="panel-python"
+              data-testid="panel-python"
+              role="tabpanel"
+              aria-labelledby="tab-python"
+              hidden={tab !== "python"}
+              className={tab === "python" ? "" : "hidden"}
+            >
              <SnippetBlock
                value={filledPython}
                label="Python SDK — includes heartbeat loop (push-mode, needs public URL)"
@@ -254,8 +299,16 @@ export function ExternalConnectModal({ info, onClose }: Props) {
                copied={copiedKey === "python"}
                onCopy={() => copy(filledPython, "python")}
              />
-            )}
-            {tab === "curl" && (
+            </div>
+            {/* curl tab */}
+            <div
+              id="panel-curl"
+              data-testid="panel-curl"
+              role="tabpanel"
+              aria-labelledby="tab-curl"
+              hidden={tab !== "curl"}
+              className={tab === "curl" ? "" : "hidden"}
+            >
              <SnippetBlock
                value={filledCurl}
                label="curl — one-shot register only (no heartbeat)"
@@ -263,53 +316,111 @@ export function ExternalConnectModal({ info, onClose }: Props) {
                copied={copiedKey === "curl"}
                onCopy={() => copy(filledCurl, "curl")}
              />
-            )}
-            {tab === "mcp" && filledUniversalMcp && (
-              <SnippetBlock
-                value={filledUniversalMcp}
-                label="Universal MCP — standalone register + heartbeat + tools for any MCP-aware runtime (Claude Code, hermes, codex). Pair with Python or Claude Code tab if you need inbound A2A delivery."
-                copyKey="mcp"
-                copied={copiedKey === "mcp"}
-                onCopy={() => copy(filledUniversalMcp, "mcp")}
-              />
-            )}
-            {tab === "hermes" && filledHermes && (
-              <SnippetBlock
-                value={filledHermes}
-                label="Hermes channel — bridges this workspace's A2A traffic into your hermes-agent session as platform messages (push parity with Claude Code). Long-poll based; no tunnel needed."
-                copyKey="hermes"
-                copied={copiedKey === "hermes"}
-                onCopy={() => copy(filledHermes, "hermes")}
-              />
-            )}
-            {tab === "codex" && filledCodex && (
-              <SnippetBlock
-                value={filledCodex}
-                label="Codex MCP config — wires the molecule MCP server into ~/.codex/config.toml. Outbound tools today; inbound A2A push needs the Python SDK tab paired in (codex's MCP runtime doesn't route arbitrary notifications/* yet)."
-                copyKey="codex"
-                copied={copiedKey === "codex"}
-                onCopy={() => copy(filledCodex, "codex")}
-              />
-            )}
-            {tab === "openclaw" && filledOpenClaw && (
-              <SnippetBlock
-                value={filledOpenClaw}
-                label="OpenClaw MCP config — wires the molecule MCP server via openclaw mcp set + starts the gateway on loopback. Outbound tools today; inbound A2A push on an external openclaw needs the Python SDK tab paired in (a sessions.steer bridge daemon is future work)."
-                copyKey="openclaw"
-                copied={copiedKey === "openclaw"}
-                onCopy={() => copy(filledOpenClaw, "openclaw")}
-              />
-            )}
-            {tab === "kimi" && filledKimi && (
-              <SnippetBlock
-                value={filledKimi}
-                label="Kimi CLI — self-contained Python bridge. Registers, heartbeats, polls for canvas messages, and echoes replies back. NAT-safe (no public URL). Run in a background terminal or via launchd."
-                copyKey="kimi"
-                copied={copiedKey === "kimi"}
-                onCopy={() => copy(filledKimi, "kimi")}
-              />
-            )}
-            {tab === "fields" && (
+            </div>
+            {/* Universal MCP tab */}
+            <div
+              id="panel-mcp"
+              data-testid="panel-mcp"
+              role="tabpanel"
+              aria-labelledby="tab-mcp"
+              hidden={tab !== "mcp" || !filledUniversalMcp}
+              className={tab === "mcp" && filledUniversalMcp ? "" : "hidden"}
+            >
+              {filledUniversalMcp && (
+                <SnippetBlock
+                  value={filledUniversalMcp}
+                  label="Universal MCP — standalone register + heartbeat + tools for any MCP-aware runtime (Claude Code, hermes, codex). Pair with Python or Claude Code tab if you need inbound A2A delivery."
+                  copyKey="mcp"
+                  copied={copiedKey === "mcp"}
+                  onCopy={() => copy(filledUniversalMcp, "mcp")}
+                />
+              )}
+            </div>
+            {/* Hermes tab */}
+            <div
+              id="panel-hermes"
+              data-testid="panel-hermes"
+              role="tabpanel"
+              aria-labelledby="tab-hermes"
+              hidden={tab !== "hermes" || !filledHermes}
+              className={tab === "hermes" && filledHermes ? "" : "hidden"}
+            >
+              {filledHermes && (
+                <SnippetBlock
+                  value={filledHermes}
+                  label="Hermes channel — bridges this workspace's A2A traffic into your hermes-agent session as platform messages (push parity with Claude Code). Long-poll based; no tunnel needed."
+                  copyKey="hermes"
+                  copied={copiedKey === "hermes"}
+                  onCopy={() => copy(filledHermes, "hermes")}
+                />
+              )}
+            </div>
+            {/* Codex tab */}
+            <div
+              id="panel-codex"
+              data-testid="panel-codex"
+              role="tabpanel"
+              aria-labelledby="tab-codex"
+              hidden={tab !== "codex" || !filledCodex}
+              className={tab === "codex" && filledCodex ? "" : "hidden"}
+            >
+              {filledCodex && (
+                <SnippetBlock
+                  value={filledCodex}
+                  label="Codex MCP config — wires the molecule MCP server into ~/.codex/config.toml. Outbound tools today; inbound A2A push needs the Python SDK tab paired in (codex's MCP runtime doesn't route arbitrary notifications/* yet)."
+                  copyKey="codex"
+                  copied={copiedKey === "codex"}
+                  onCopy={() => copy(filledCodex, "codex")}
+                />
+              )}
+            </div>
+            {/* OpenClaw tab */}
+            <div
+              id="panel-openclaw"
+              data-testid="panel-openclaw"
+              role="tabpanel"
+              aria-labelledby="tab-openclaw"
+              hidden={tab !== "openclaw" || !filledOpenClaw}
+              className={tab === "openclaw" && filledOpenClaw ? "" : "hidden"}
+            >
+              {filledOpenClaw && (
+                <SnippetBlock
+                  value={filledOpenClaw}
+                  label="OpenClaw MCP config — wires the molecule MCP server via openclaw mcp set + starts the gateway on loopback. Outbound tools today; inbound A2A push on an external openclaw needs the Python SDK tab paired in (a sessions.steer bridge daemon is future work)."
+                  copyKey="openclaw"
+                  copied={copiedKey === "openclaw"}
+                  onCopy={() => copy(filledOpenClaw, "openclaw")}
+                />
+              )}
+            </div>
+            {/* Kimi tab */}
+            <div
+              id="panel-kimi"
+              data-testid="panel-kimi"
+              role="tabpanel"
+              aria-labelledby="tab-kimi"
+              hidden={tab !== "kimi" || !filledKimi}
+              className={tab === "kimi" && filledKimi ? "" : "hidden"}
+            >
+              {filledKimi && (
+                <SnippetBlock
+                  value={filledKimi}
+                  label="Kimi CLI — self-contained Python bridge. Registers, heartbeats, polls for canvas messages, and echoes replies back. NAT-safe (no public URL). Run in a background terminal or via launchd."
+                  copyKey="kimi"
+                  copied={copiedKey === "kimi"}
+                  onCopy={() => copy(filledKimi, "kimi")}
+                />
+              )}
+            </div>
+            {/* Fields tab */}
+            <div
+              id="panel-fields"
+              data-testid="panel-fields"
+              role="tabpanel"
+              aria-labelledby="tab-fields"
+              hidden={tab !== "fields"}
+              className={tab === "fields" ? "" : "hidden"}
+            >
              <div className="space-y-2">
                <Field label="workspace_id" value={info.workspace_id} onCopy={() => copy(info.workspace_id, "wsid")} copied={copiedKey === "wsid"} />
                <Field label="platform_url" value={info.platform_url} onCopy={() => copy(info.platform_url, "url")} copied={copiedKey === "url"} />
@@ -323,7 +434,7 @@ export function ExternalConnectModal({ info, onClose }: Props) {
                <Field label="registry_endpoint" value={info.registry_endpoint} onCopy={() => copy(info.registry_endpoint, "reg")} copied={copiedKey === "reg"} />
                <Field label="heartbeat_endpoint" value={info.heartbeat_endpoint} onCopy={() => copy(info.heartbeat_endpoint, "hb")} copied={copiedKey === "hb"} />
              </div>
-            )}
+            </div>
          </div>

          <div className="mt-5 flex justify-end gap-2">
@@ -344,7 +344,7 @@ function ProviderPickerModal({
  // wrapper's bounds instead of the viewport.
  if (typeof document === "undefined") return null;

-  const allSaved = entries.length > 0 && entries.every((e) => e.saved);
+  const allSaved = entries.every((e) => e.saved);
  const anySaving = entries.some((e) => e.saving);
  const runtimeLabel = runtime
    .replace(/[-_]/g, " ")
@@ -440,6 +440,7 @@ function ProviderPickerModal({
                      onChange={(e) => updateEntry(index, { value: e.target.value.trimStart() })}
                      placeholder={entry.key.includes("API_KEY") ? "sk-..." : "Enter value"}
                      type="password"
+                      aria-label={`Value for ${entry.key}`}
                      ref={index === 0 ? firstInputRef : undefined}
                      onKeyDown={(e) => {
                        if (e.key === "Enter" && entry.value.trim()) {
@@ -459,7 +460,7 @@ function ProviderPickerModal({
                )}

                {entry.error && (
-                  <div className="mt-1.5 text-[10px] text-bad">{entry.error}</div>
+                  <div role="alert" aria-live="assertive" className="mt-1.5 text-[10px] text-bad">{entry.error}</div>
                )}
              </div>
            ))}
@@ -616,7 +617,7 @@ function AllKeysModal({
  if (!open) return null;
  if (typeof document === "undefined") return null;

-  const allSaved = entries.length > 0 && entries.every((e) => e.saved);
+  const allSaved = entries.every((e) => e.saved);
  const anySaving = entries.some((e) => e.saving);
  const runtimeLabel = runtime
    .replace(/[-_]/g, " ")
@@ -694,6 +695,7 @@ function AllKeysModal({
                    onChange={(e) => updateEntry(index, { value: e.target.value.trimStart() })}
                    placeholder={entry.key.includes("API_KEY") ? "sk-..." : "Enter value"}
                    type="password"
+                    aria-label={`Value for ${entry.key}`}
                    autoFocus={index === 0}
                    onKeyDown={(e) => {
                      if (e.key === "Enter" && entry.value.trim()) {
@@ -718,7 +720,7 @@ function AllKeysModal({
          ))}

          {globalError && (
-            <div className="px-3 py-2 bg-red-950/40 border border-red-800/50 rounded-lg text-[11px] text-bad">
+            <div role="alert" aria-live="assertive" className="px-3 py-2 bg-red-950/40 border border-red-800/50 rounded-lg text-[11px] text-bad">
              {globalError}
            </div>
          )}
@@ -62,21 +62,12 @@ export function ThemeToggle({ className = "" }: { className?: string }) {
      }
      setTheme(OPTIONS[next].value);
      // Move focus to the new button so arrow-key navigation is continuous.
-      // Use direct-child query to scope strictly to this radiogroup's buttons
-      // and avoid accidentally focusing unrelated [role=radio] elements
+      // Query is already scoped to radiogroup so no child-combinator needed;
+      // avoids accidentally focusing unrelated [role=radio] elements
      // elsewhere in the DOM (e.g. React Flow canvas nodes).
-      // Guard: skip focus if the current target is no longer in the document
-      // (e.g. React StrictMode double-invokes handlers during re-render).
-      if (!e.currentTarget.isConnected) return;
      const radiogroup = e.currentTarget.closest("[role=radiogroup]") as HTMLElement | null;
-      if (!radiogroup) return;
-      // Use children[] instead of querySelectorAll("> [role=radio]") to avoid
-      // jsdom's child-combinator selector parsing issues in test environments.
-      const btns = Array.from(radiogroup.children).filter(
-        (el): el is HTMLButtonElement =>
-          el.tagName === "BUTTON" && el.getAttribute("role") === "radio"
-      );
-      if (next < btns.length) btns[next]?.focus();
+      const btns = radiogroup?.querySelectorAll<HTMLButtonElement>("[role=radio]");
+      btns?.[next]?.focus();
    },
    []
  );
@@ -13,17 +13,20 @@ import { isExternalLikeRuntime } from "@/lib/externalRuntimes";

 /** Descendant count for the "N sub" badge — children are first-class nodes
 *  rendered as full cards inside this one via React Flow's native parentId,
- *  so we don't need to subscribe to the actual child list here. */
+ *  so we don't need to subscribe to the actual child list here.
+ *  Selecting `nodes` stably avoids a new selector reference on every store
+ *  update (React error #185 / Zustand + React 19 Object.is strictness). */
 function useDescendantCount(nodeId: string): number {
-  return useCanvasStore(
-    useCallback((s) => countDescendants(nodeId, s.nodes), [nodeId])
-  );
+  const nodes = useCanvasStore((s) => s.nodes);
+  return useMemo(() => countDescendants(nodeId, nodes), [nodeId, nodes]);
 }

+/** Boolean flag used to drive min-size and NodeResizer dimensions.
+ *  Selecting `nodes` stably avoids re-render loops (same issue as
+ *  useDescendantCount). */
 function useHasChildren(nodeId: string): boolean {
-  return useCanvasStore(
-    useCallback((s) => s.nodes.some((n) => n.data.parentId === nodeId), [nodeId])
-  );
+  const nodes = useCanvasStore((s) => s.nodes);
+  return useMemo(() => nodes.some((n) => n.data.parentId === nodeId), [nodes, nodeId]);
 }

 /** Eject/extract arrow icon — visually distinct from delete ✕ */
@@ -71,7 +71,7 @@ export function WorkspaceUsage({ workspaceId }: WorkspaceUsageProps) {
            <SkeletonRow />
          </>
        ) : error ? (
-          <p className="text-xs text-bad" data-testid="usage-error">
+          <p role="alert" aria-live="assertive" className="text-xs text-bad" data-testid="usage-error">
            {error}
          </p>
        ) : metrics ? (
@@ -131,7 +131,9 @@ describe("ExternalConnectModal — tab switching", () => {
  it("switches to the Python SDK tab and shows the snippet with stamped token", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /python sdk/i }));
-    const preEl = document.querySelector("pre");
+    // Query within the python panel so we get the right pre (not the first in DOM).
+    const pythonPanel = document.querySelector("[data-testid='panel-python']");
+    const preEl = pythonPanel?.querySelector("pre");
    expect(preEl?.textContent).toContain("AUTH_TOKEN");
    // The placeholder is replaced with the real auth token
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
@@ -140,7 +142,9 @@ describe("ExternalConnectModal — tab switching", () => {
  it("switches to the curl tab and shows the snippet with stamped token", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /curl/i }));
-    const preEl = document.querySelector("pre");
+    // Query within the curl panel so we get the right pre (not the first in DOM).
+    const curlPanel = document.querySelector("[data-testid='panel-curl']");
+    const preEl = curlPanel?.querySelector("pre");
    expect(preEl?.textContent).toContain("curl");
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
  });
@@ -148,9 +152,11 @@ describe("ExternalConnectModal — tab switching", () => {
  it("switches to the Fields tab and shows raw values", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /fields/i }));
-    expect(screen.getByText("ws-123")).toBeTruthy();
-    expect(screen.getByText("https://app.example.com")).toBeTruthy();
-    expect(screen.getByText("secret-auth-token-abc")).toBeTruthy();
+    // Query within the fields panel for specific values.
+    const fieldsPanel = document.querySelector("[data-testid='panel-fields']");
+    expect(fieldsPanel?.textContent).toContain("ws-123");
+    expect(fieldsPanel?.textContent).toContain("https://app.example.com");
+    expect(fieldsPanel?.textContent).toContain("secret-auth-token-abc");
  });

  it("hides the Hermes tab when hermes_channel_snippet is absent", () => {
@@ -168,7 +174,8 @@ describe("ExternalConnectModal — snippet token stamping", () => {
  it("stamps the real auth_token into the Python snippet instead of the placeholder", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /python sdk/i }));
-    const preEl = document.querySelector("pre");
+    const pythonPanel = document.querySelector("[data-testid='panel-python']");
+    const preEl = pythonPanel?.querySelector("pre");
    expect(preEl?.textContent).not.toContain("<paste from create response>");
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
  });
@@ -176,7 +183,8 @@ describe("ExternalConnectModal — snippet token stamping", () => {
  it("stamps the real auth_token into the curl snippet", () => {
    renderAndFlush(defaultInfo);
    fireEvent.click(screen.getByRole("tab", { name: /curl/i }));
-    const preEl = document.querySelector("pre");
+    const curlPanel = document.querySelector("[data-testid='panel-curl']");
+    const preEl = curlPanel?.querySelector("pre");
    // curl template uses WORKSPACE_AUTH_TOKEN placeholder, not the generic one
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
  });
@@ -184,7 +192,8 @@ describe("ExternalConnectModal — snippet token stamping", () => {
  it("stamps the real auth_token into the Universal MCP snippet", () => {
    renderAndFlush(defaultInfo);
    // Default tab is Universal MCP
-    const preEl = document.querySelector("pre");
+    const mcpPanel = document.querySelector("[data-testid='panel-mcp']");
+    const preEl = mcpPanel?.querySelector("pre");
    expect(preEl?.textContent).toContain("secret-auth-token-abc");
    expect(preEl?.textContent).not.toContain("<paste from create response>");
  });
@@ -193,8 +202,10 @@ describe("ExternalConnectModal — snippet token stamping", () => {
 describe("ExternalConnectModal — copy functionality", () => {
  it("calls navigator.clipboard.writeText with the snippet text", () => {
    renderAndFlush(defaultInfo);
-    // Default tab is Universal MCP
-    fireEvent.click(screen.getByRole("button", { name: /^copy$/i }));
+    // Default tab is Universal MCP — query the copy button within the mcp panel.
+    const mcpPanel = document.querySelector("[data-testid='panel-mcp']");
+    const copyBtn = mcpPanel?.querySelector("button");
+    if (copyBtn) fireEvent.click(copyBtn);
    expect(clipboardWriteText).toHaveBeenCalledWith(
      expect.stringContaining("secret-auth-token-abc"),
    );
@@ -227,7 +238,8 @@ describe("ExternalConnectModal — missing optional fields", () => {
    };
    renderAndFlush(minimalInfo);
    fireEvent.click(screen.getByRole("tab", { name: /fields/i }));
-    expect(screen.getByText("(missing)")).toBeTruthy();
+    const fieldsPanel = document.querySelector("[data-testid='panel-fields']");
+    expect(fieldsPanel?.textContent).toContain("(missing)");
  });

  it("hides the Hermes tab when hermes_channel_snippet is absent", () => {
@@ -11,13 +11,21 @@ import { render, screen, fireEvent, cleanup, act } from "@testing-library/react"
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { TestConnectionButton } from "../ui/TestConnectionButton";
 import type { SecretGroup } from "@/types/secrets";
-import { validateSecret } from "@/lib/api/secrets";
+import { validateSecret, ApiError } from "@/lib/api/secrets";

 // ─── Mock validateSecret ──────────────────────────────────────────────────────
 // vi.mock is hoisted, so validateSecret (imported above) refers to the mocked
 // namespace value once vi.mock runs. Use vi.mocked() to access it in tests.
 vi.mock("@/lib/api/secrets", () => ({
  validateSecret: vi.fn(),
+  ApiError: class ApiError extends Error {
+    status: number;
+    constructor(status: number, message: string) {
+      super(message);
+      this.name = "ApiError";
+      this.status = status;
+    }
+  },
 }));

 // SecretGroup is a string literal type: 'github' | 'anthropic' | 'openrouter' | 'custom'
@@ -102,7 +110,7 @@ describe("TestConnectionButton — state machine", () => {
    expect(screen.getByText("Permission denied")).toBeTruthy();
  });

-  it("shows generic error message on unexpected exception", async () => {
+  it("shows a connectivity message on a genuine network exception", async () => {
    vi.mocked(validateSecret).mockRejectedValue(new Error("timeout"));
    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." />);

@@ -110,8 +118,23 @@ describe("TestConnectionButton — state machine", () => {
    await act(async () => { /* flush */ });

    expect(screen.getByRole("alert")).toBeTruthy();
-    // The error detail is hardcoded to "Connection timed out. Service may be down."
-    expect(document.body.querySelector('[role="alert"]')?.textContent).toMatch(/timed out/i);
+    // A real thrown network error → honest connectivity message (not a
+    // fabricated "service down"); see internal#492.
+    expect(document.body.querySelector('[role="alert"]')?.textContent).toMatch(
+      /could not reach the validation service/i,
+    );
+  });
+
+  it("does not claim a timeout when the validate endpoint 404s (internal#492)", async () => {
+    vi.mocked(validateSecret).mockRejectedValue(new ApiError(404, "Not Found"));
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush */ });
+
+    const alert = document.body.querySelector('[role="alert"]')?.textContent ?? "";
+    expect(alert).not.toMatch(/timed out/i);
+    expect(alert).toMatch(/not available/i);
  });
 });

@@ -24,16 +24,20 @@ import {
 */
 export function DropTargetBadge() {
  const dragOverNodeId = useCanvasStore((s) => s.dragOverNodeId);
-  const targetName = useCanvasStore((s) => {
-    if (!s.dragOverNodeId) return null;
-    const n = s.nodes.find((nn) => nn.id === s.dragOverNodeId);
+  // Select nodes stably first — deriving targetName and childCount inside
+  // the same selector creates a new return value on every store mutation
+  // even when neither has changed (React error #185 / Zustand Object.is).
+  const nodes = useCanvasStore((s) => s.nodes);
+  const targetName = (() => {
+    if (!dragOverNodeId) return null;
+    const n = nodes.find((nn) => nn.id === dragOverNodeId);
    return (n?.data as WorkspaceNodeData | undefined)?.name ?? null;
-  });
-  const childCount = useCanvasStore((s) =>
-    !s.dragOverNodeId
+  })();
+  const childCount = (() =>
+    !dragOverNodeId
      ? 0
-      : s.nodes.filter((n) => n.parentId === s.dragOverNodeId).length,
-  );
+      : nodes.filter((n) => n.parentId === dragOverNodeId).length
+  )();
  const { getInternalNode, flowToScreenPosition } = useReactFlow();
  if (!dragOverNodeId || !targetName) return null;
  const internal = getInternalNode(dragOverNodeId);
@@ -1,6 +1,6 @@
 "use client";

-import { useCallback, useEffect, useRef } from "react";
+import { useCallback, useEffect, useMemo, useRef } from "react";
 import { useReactFlow } from "@xyflow/react";
 import { useCanvasStore } from "@/store/canvas";
 import { appendClass, removeClass } from "@/store/classNames";
@@ -153,10 +153,17 @@ export function useCanvasViewport() {
  // fit, the user has to manually pan + zoom to find what they just
  // created. Only fires when TRANSITIONING from some-provisioning to
  // zero-provisioning — not on every re-render.
-  const provisioningCount = useCanvasStore(
-    (s) => s.nodes.filter((n) => n.data.status === "provisioning").length,
+  //
+  // Selecting `nodes` stably (array reference) avoids the
+  // `.filter().length` anti-pattern which creates a new number on every
+  // store update and breaks the wasProvisioning/hasProvisioning
+  // transition detection (React error #185 / Zustand + React 19).
+  const nodes = useCanvasStore((s) => s.nodes);
+  const provisioningCount = useMemo(
+    () => nodes.filter((n) => n.data.status === "provisioning").length,
+    [nodes],
  );
-  const nodeCount = useCanvasStore((s) => s.nodes.length);
+  const nodeCount = nodes.length;

  useEffect(() => {
    const hasProvisioning = provisioningCount > 0;
@@ -223,6 +223,7 @@ export function MobileCanvas({
            textTransform: "uppercase",
            fontWeight: 600,
          }}
+          className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
        >
          Reset
        </button>
@@ -2,25 +2,31 @@

 // 04 · Chat — message thread + composer + sub-tabs.
 // Wired to the same /workspaces/:id/a2a (method message/send) endpoint
-// that the desktop ChatTab uses, but with a slimmer surface: no
-// attachments, no A2A topology overlay, no conversation tracing.
+// that the desktop ChatTab uses. Render parity with desktop ChatTab is
+// achieved by reusing its renderers rather than forking a reduced
+// mobile path: the Agent Comms sub-tab mounts the same AgentCommsPanel,
+// and message attachments route through the same AttachmentPreview
+// dispatch the desktop My-Chat bubble uses (#231/#232).

-import { useCallback, useEffect, useRef, useState } from "react";
+import { useEffect, useMemo, useRef, useState } from "react";
+import ReactMarkdown from "react-markdown";
+import remarkGfm from "remark-gfm";

-import { api } from "@/lib/api";
 import { useCanvasStore } from "@/store/canvas";
+import { type ChatAttachment, type ChatMessage, createMessage } from "@/components/tabs/chat/types";
+import {
+  useChatHistory,
+  useChatSend,
+  useChatSocket,
+} from "@/components/tabs/chat/hooks";
+import { AgentCommsPanel } from "@/components/tabs/chat/AgentCommsPanel";
+import { AttachmentPreview } from "@/components/tabs/chat/AttachmentPreview";
+import { downloadChatFile } from "@/components/tabs/chat/uploads";

 import { toMobileAgent } from "./components";
 import { MOBILE_FONT_MONO, MOBILE_FONT_SANS, usePalette } from "./palette";
 import { Icons, StatusDot, TierChip } from "./primitives";

-interface ChatMessage {
-  id: string;
-  role: "user" | "agent" | "system";
-  text: string;
-  ts: string;
-}
-
 const formatStoredTimestamp = (iso: string): string => {
  const d = new Date(iso);
  if (isNaN(d.getTime())) return "";
@@ -29,15 +35,170 @@ const formatStoredTimestamp = (iso: string): string => {

 type SubTab = "my" | "a2a";

-interface A2AResponseShape {
-  result?: {
-    parts?: Array<{ kind?: string; text?: string }>;
-  };
-  error?: { message?: string };
-}
+function MarkdownBubble({
+  children,
+  dark,
+  accent,
+}: {
+  children: string;
+  dark: boolean;
+  accent: string;
+}) {
+  const codeBg = dark ? "rgba(255,255,255,0.08)" : "rgba(0,0,0,0.06)";
+  const codeBlockBg = dark ? "#1a1a1a" : "#f5f5f0";
+  const linkColor = accent;
+  const quoteBorder = dark ? "rgba(255,250,240,0.15)" : "rgba(40,30,20,0.15)";

-const formatTime = (date: Date) =>
-  date.toLocaleTimeString([], { hour: "numeric", minute: "2-digit" });
+  return (
+    <ReactMarkdown
+      remarkPlugins={[remarkGfm]}
+      components={{
+        p: ({ children }) => (
+          <div style={{ margin: "2px 0", lineHeight: "inherit" }}>{children}</div>
+        ),
+        a: ({ href, children }) => (
+          <a
+            href={href}
+            target="_blank"
+            rel="noopener noreferrer"
+            style={{ color: linkColor, textDecoration: "underline" }}
+          >
+            {children}
+          </a>
+        ),
+        pre: ({ children }) => (
+          <pre
+            style={{
+              background: codeBlockBg,
+              padding: "8px 10px",
+              borderRadius: 8,
+              overflow: "auto",
+              fontSize: 12,
+              lineHeight: 1.5,
+              fontFamily: MOBILE_FONT_MONO,
+              margin: "4px 0",
+            }}
+          >
+            {children}
+          </pre>
+        ),
+        code: ({ children, className }) => {
+          const isBlock = className != null && String(className).length > 0;
+          if (isBlock) {
+            return (
+              <code style={{ fontFamily: MOBILE_FONT_MONO, fontSize: 12 }}>
+                {children}
+              </code>
+            );
+          }
+          return (
+            <code
+              style={{
+                background: codeBg,
+                padding: "1px 4px",
+                borderRadius: 4,
+                fontSize: 13,
+                fontFamily: MOBILE_FONT_MONO,
+              }}
+            >
+              {children}
+            </code>
+          );
+        },
+        ul: ({ children }) => (
+          <ul style={{ margin: "4px 0", paddingLeft: 18, listStyle: "disc" }}>
+            {children}
+          </ul>
+        ),
+        ol: ({ children }) => (
+          <ol style={{ margin: "4px 0", paddingLeft: 18, listStyle: "decimal" }}>
+            {children}
+          </ol>
+        ),
+        li: ({ children }) => <li style={{ margin: "2px 0" }}>{children}</li>,
+        strong: ({ children }) => (
+          <strong style={{ fontWeight: 600 }}>{children}</strong>
+        ),
+        em: ({ children }) => <em style={{ fontStyle: "italic" }}>{children}</em>,
+        h1: ({ children }) => (
+          <div style={{ fontSize: 16, fontWeight: 700, margin: "4px 0" }}>{children}</div>
+        ),
+        h2: ({ children }) => (
+          <div style={{ fontSize: 15, fontWeight: 700, margin: "4px 0" }}>{children}</div>
+        ),
+        h3: ({ children }) => (
+          <div style={{ fontSize: 14, fontWeight: 700, margin: "4px 0" }}>{children}</div>
+        ),
+        h4: ({ children }) => (
+          <div style={{ fontSize: 14, fontWeight: 600, margin: "4px 0" }}>{children}</div>
+        ),
+        h5: ({ children }) => (
+          <div style={{ fontSize: 13, fontWeight: 600, margin: "4px 0" }}>{children}</div>
+        ),
+        h6: ({ children }) => (
+          <div style={{ fontSize: 13, fontWeight: 600, margin: "4px 0" }}>{children}</div>
+        ),
+        blockquote: ({ children }) => (
+          <blockquote
+            style={{
+              borderLeft: `2px solid ${quoteBorder}`,
+              margin: "4px 0",
+              paddingLeft: 8,
+              opacity: 0.85,
+            }}
+          >
+            {children}
+          </blockquote>
+        ),
+        hr: () => (
+          <hr
+            style={{
+              border: "none",
+              borderTop: `0.5px solid ${quoteBorder}`,
+              margin: "6px 0",
+            }}
+          />
+        ),
+        table: ({ children }) => (
+          <table
+            style={{
+              borderCollapse: "collapse",
+              fontSize: 13,
+              margin: "4px 0",
+              width: "100%",
+            }}
+          >
+            {children}
+          </table>
+        ),
+        thead: ({ children }) => <thead style={{ fontWeight: 600 }}>{children}</thead>,
+        th: ({ children }) => (
+          <th
+            style={{
+              border: `0.5px solid ${quoteBorder}`,
+              padding: "4px 6px",
+              textAlign: "left",
+            }}
+          >
+            {children}
+          </th>
+        ),
+        td: ({ children }) => (
+          <td
+            style={{
+              border: `0.5px solid ${quoteBorder}`,
+              padding: "4px 6px",
+            }}
+          >
+            {children}
+          </td>
+        ),
+      }}
+    >
+      {children}
+    </ReactMarkdown>
+  );
+}

 export function MobileChat({
  agentId,
@@ -49,21 +210,40 @@ export function MobileChat({
  onBack: () => void;
 }) {
  const p = usePalette(dark);
-  const node = useCanvasStore((s) => s.nodes.find((n) => n.id === agentId));
-  const [messages, setMessages] = useState<ChatMessage[]>([]);
+  const nodes = useCanvasStore((s) => s.nodes);
+  const node = useMemo(() => nodes.find((n) => n.id === agentId), [nodes, agentId]);
  const [draft, setDraft] = useState("");
  const [tab, setTab] = useState<SubTab>("my");
-  const [sending, setSending] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const [historyLoading, setHistoryLoading] = useState(true);
-  const [historyError, setHistoryError] = useState<string | null>(null);
  const scrollRef = useRef<HTMLDivElement>(null);
-  // Synchronous re-entry guard. `setSending(true)` schedules a state
-  // update but doesn't flush before a second tap can fire send() — a ref
-  // mirrors the desktop ChatTab pattern (sendInFlightRef) and closes the
-  // double-send race a stale `sending` lets through.
-  const sendInFlightRef = useRef(false);
  const composerRef = useRef<HTMLTextAreaElement>(null);
+  const fileInputRef = useRef<HTMLInputElement>(null);
+  const [pendingFiles, setPendingFiles] = useState<File[]>([]);
+
+  const {
+    messages,
+    loading: historyLoading,
+    loadError: historyError,
+    loadInitial,
+    appendMessageDeduped,
+  } = useChatHistory(agentId);
+
+  const {
+    sending,
+    uploading,
+    sendMessage,
+    error: sendError,
+    clearError,
+    releaseSendGuards,
+  } = useChatSend(agentId, {
+    getHistoryMessages: () => messages,
+    onUserMessage: appendMessageDeduped,
+    onAgentMessage: appendMessageDeduped,
+  });
+
+  useChatSocket(agentId, {
+    onAgentMessage: appendMessageDeduped,
+    onSendComplete: releaseSendGuards,
+  });

  // Auto-grow the textarea: reset height to 'auto' so the scrollHeight
  // shrinks when the user deletes text, then size to scrollHeight up to
@@ -82,73 +262,19 @@ export function MobileChat({
    }
  }, [messages]);

-  // Load chat history on mount / agent switch.
-  const loadHistory = useCallback(async () => {
-    setHistoryLoading(true);
-    setHistoryError(null);
-    try {
-      const resp = await api.get<{
-        messages: Array<{
-          id: string;
-          role: string;
-          content: string;
-          timestamp: string;
-        }>;
-      }>(`/workspaces/${agentId}/chat-history?limit=50`);
-      const loaded = (resp.messages ?? []).map((m) => ({
-        id: m.id,
-        role: m.role as "user" | "agent" | "system",
-        text: m.content,
-        ts: formatStoredTimestamp(m.timestamp),
-      }));
-      setMessages(loaded);
-    } catch (e) {
-      setHistoryError(e instanceof Error ? e.message : "Failed to load history");
-    } finally {
-      setHistoryLoading(false);
-    }
-  }, [agentId]);
-
+  // Consume any agent messages that arrived while history was loading.
+  const initialConsumeDoneRef = useRef(false);
  useEffect(() => {
-    let cancelled = false;
-    loadHistory().then(() => {
-      if (cancelled) return;
-      // Consume any agent messages that arrived while history was loading.
-      const consume = useCanvasStore.getState().consumeAgentMessages;
-      const msgs = consume(agentId);
-      if (msgs.length > 0) {
-        setMessages((prev) => [
-          ...prev,
-          ...msgs.map((m) => ({
-            id: m.id,
-            role: "agent" as const,
-            text: m.content,
-            ts: formatStoredTimestamp(m.timestamp),
-          })),
-        ]);
-      }
-    });
-    return () => { cancelled = true; };
-  }, [agentId, loadHistory]);
-
-  // Consume live agent pushes while the panel is mounted.
-  const pendingAgentMsgs = useCanvasStore((s) => s.agentMessages[agentId]);
-  useEffect(() => {
-    if (!pendingAgentMsgs || pendingAgentMsgs.length === 0) return;
+    if (historyLoading || initialConsumeDoneRef.current) return;
+    initialConsumeDoneRef.current = true;
    const consume = useCanvasStore.getState().consumeAgentMessages;
    const msgs = consume(agentId);
-    if (msgs.length > 0) {
-      setMessages((prev) => [
-        ...prev,
-        ...msgs.map((m) => ({
-          id: m.id,
-          role: "agent" as const,
-          text: m.content,
-          ts: formatStoredTimestamp(m.timestamp),
-        })),
-      ]);
+    for (const m of msgs) {
+      appendMessageDeduped(
+        createMessage("agent", m.content, m.attachments),
+      );
    }
-  }, [pendingAgentMsgs, agentId]);
+  }, [historyLoading, agentId, appendMessageDeduped]);

  if (!node) {
    return (
@@ -171,58 +297,43 @@ export function MobileChat({
  const a = toMobileAgent(node);
  const reachable = a.status === "online" || a.status === "degraded";

+  const onFilesPicked = (fileList: FileList | null) => {
+    if (!fileList) return;
+    const picked = Array.from(fileList);
+    setPendingFiles((prev) => {
+      const keyed = new Set(prev.map((f) => `${f.name}:${f.size}`));
+      return [...prev, ...picked.filter((f) => !keyed.has(`${f.name}:${f.size}`))];
+    });
+    if (fileInputRef.current) fileInputRef.current.value = "";
+  };
+
+  const removePendingFile = (index: number) =>
+    setPendingFiles((prev) => prev.filter((_, i) => i !== index));
+
+  // Route attachment downloads through the same authenticated helper
+  // the desktop ChatTab uses (downloadChatFile) so platform-scheme
+  // URIs get a real Blob with auth headers instead of about:blank.
+  const downloadAttachment = (att: ChatAttachment) => {
+    downloadChatFile(agentId, att).catch(() => {
+      // AttachmentPreview's own error affordance covers the in-bubble
+      // failure state; matches ChatTab's behaviour of not double-
+      // reporting a download failure.
+    });
+  };
+
  const send = async () => {
    const text = draft.trim();
-    if (!text || sending || !reachable) return;
-    if (sendInFlightRef.current) return;
-    sendInFlightRef.current = true;
+    if ((!text && pendingFiles.length === 0) || sending || !reachable) return;
+    clearError();
    setDraft("");
-    setError(null);
-    setSending(true);
-    const myMsg: ChatMessage = {
-      id: crypto.randomUUID(),
-      role: "user",
-      text,
-      ts: formatTime(new Date()),
-    };
-    setMessages((m) => [...m, myMsg]);
-
-    try {
-      const res = await api.post<A2AResponseShape>(`/workspaces/${agentId}/a2a`, {
-        method: "message/send",
-        params: {
-          message: {
-            role: "user",
-            messageId: crypto.randomUUID(),
-            parts: [{ kind: "text", text }],
-          },
-        },
-      });
-      const reply =
-        res.result?.parts?.find((part) => part.kind === "text")?.text ?? "";
-      if (reply) {
-        setMessages((m) => [
-          ...m,
-          {
-            id: crypto.randomUUID(),
-            role: "agent",
-            text: reply,
-            ts: formatTime(new Date()),
-          },
-        ]);
-      } else if (res.error?.message) {
-        setError(res.error.message);
-      }
-    } catch (e) {
-      setError(e instanceof Error ? e.message : "Failed to send");
-    } finally {
-      setSending(false);
-      sendInFlightRef.current = false;
-    }
+    const files = pendingFiles;
+    setPendingFiles([]);
+    await sendMessage(text, files);
  };

  return (
    <div
+      data-testid="chat-panel"
      style={{
        height: "100%",
        display: "flex",
@@ -245,6 +356,7 @@ export function MobileChat({
            type="button"
            onClick={onBack}
            aria-label="Back"
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 36,
              height: 36,
@@ -291,6 +403,7 @@ export function MobileChat({
          <button
            type="button"
            aria-label="More"
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 36,
              height: 36,
@@ -321,6 +434,7 @@ export function MobileChat({
                key={t.id}
                type="button"
                onClick={() => setTab(t.id)}
+                className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                style={{
                  padding: "4px 0 8px",
                  border: "none",
@@ -339,7 +453,19 @@ export function MobileChat({
        </div>
      </div>

+      {/* Agent Comms — reuse the desktop AgentCommsPanel verbatim so
+          mobile renders the identical peer/A2A + delegation feed
+          (history GET + live socket events) instead of a placeholder
+          (#231). The panel owns its own scroll/load/error/empty
+          states, matching ChatTab's agent-comms tabpanel. */}
+      {tab === "a2a" && (
+        <div style={{ flex: 1, minHeight: 0, overflow: "hidden" }}>
+          <AgentCommsPanel workspaceId={agentId} />
+        </div>
+      )}
+
      {/* Messages */}
+      {tab === "my" && (
      <div
        ref={scrollRef}
        style={{
@@ -351,30 +477,45 @@ export function MobileChat({
          gap: 8,
        }}
      >
-        {tab === "a2a" && (
-          <div
-            style={{
-              padding: "20px 4px",
-              textAlign: "center",
-              color: p.text3,
-              fontSize: 13,
-            }}
-          >
-            Agent Comms — peer-to-peer A2A traffic surfaces in the Comms tab.
-          </div>
-        )}
        {tab === "my" && historyLoading && (
-          <div style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
+          <div role="status" aria-live="polite" style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            Loading chat history…
          </div>
        )}
        {tab === "my" && !historyLoading && historyError && messages.length === 0 && (
-          <div style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
-            {historyError}
+          <div
+            role="alert"
+            style={{
+              padding: "14px 4px",
+              textAlign: "center",
+              color: p.failed,
+              fontSize: 13,
+            }}
+          >
+            <div style={{ marginBottom: 8 }}>Could not load chat history.</div>
+            <button
+              type="button"
+              onClick={() => {
+                loadInitial();
+              }}
+              aria-label="Retry loading chat history"
+              className="focus:outline-none focus-visible:ring-2 focus-visible:ring-red-400"
+              style={{
+                padding: "6px 14px",
+                borderRadius: 14,
+                border: `0.5px solid ${p.failed}`,
+                background: "transparent",
+                color: p.failed,
+                fontSize: 12,
+                cursor: "pointer",
+              }}
+            >
+              Retry
+            </button>
          </div>
        )}
        {tab === "my" && !historyLoading && !historyError && messages.length === 0 && (
-          <div style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
+          <div role="status" aria-live="polite" style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            Send a message to start chatting.
          </div>
        )}
@@ -402,7 +543,31 @@ export function MobileChat({
                    overflowWrap: "anywhere",
                  }}
                >
-                  {m.text}
+                  {m.content && (
+                    <MarkdownBubble dark={dark} accent={p.accent}>
+                      {m.content}
+                    </MarkdownBubble>
+                  )}
+                  {m.attachments && m.attachments.length > 0 && (
+                    <div
+                      style={{
+                        display: "flex",
+                        flexWrap: "wrap",
+                        gap: 4,
+                        marginTop: m.content ? 6 : 0,
+                      }}
+                    >
+                      {m.attachments.map((att, i) => (
+                        <AttachmentPreview
+                          key={`${m.id}-${i}`}
+                          workspaceId={agentId}
+                          attachment={att}
+                          onDownload={downloadAttachment}
+                          tone={mine ? "user" : "agent"}
+                        />
+                      ))}
+                    </div>
+                  )}
                  <div
                    style={{
                      fontSize: 10,
@@ -411,13 +576,13 @@ export function MobileChat({
                      fontFamily: MOBILE_FONT_MONO,
                    }}
                  >
-                    {m.ts}
+                    {formatStoredTimestamp(m.timestamp)}
                  </div>
                </div>
              </div>
            );
          })}
-        {error && (
+        {sendError && (
          <div
            role="alert"
            style={{
@@ -429,11 +594,17 @@ export function MobileChat({
              fontSize: 12,
            }}
          >
-            {error}
+            {sendError}
          </div>
        )}
      </div>
+      )}

+      {/* Footer ID + composer belong to My Chat only. The Agent Comms
+          tab is a read-only peer/A2A feed (parity with desktop
+          ChatTab, where the agent-comms tabpanel has no composer). */}
+      {tab === "my" && (
+      <>
      {/* Footer ID */}
      <div
        style={{
@@ -460,6 +631,61 @@ export function MobileChat({
          backdropFilter: "blur(14px)",
        }}
      >
+        {pendingFiles.length > 0 && (
+          <div
+            style={{
+              display: "flex",
+              flexWrap: "wrap",
+              gap: 6,
+              marginBottom: 8,
+              paddingLeft: 2,
+            }}
+          >
+            {pendingFiles.map((f, i) => (
+              <div
+                key={`${f.name}:${f.size}`}
+                style={{
+                  display: "flex",
+                  alignItems: "center",
+                  gap: 4,
+                  padding: "3px 8px",
+                  borderRadius: 10,
+                  background: dark ? "#2a2823" : "#ece9e0",
+                  fontSize: 12,
+                  color: p.text2,
+                  maxWidth: "100%",
+                }}
+              >
+                <span
+                  style={{
+                    overflow: "hidden",
+                    textOverflow: "ellipsis",
+                    whiteSpace: "nowrap",
+                  }}
+                >
+                  {f.name}
+                </span>
+                <button
+                  type="button"
+                  onClick={() => removePendingFile(i)}
+                  aria-label={`Remove ${f.name}`}
+                  className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
+                  style={{
+                    border: "none",
+                    background: "transparent",
+                    color: p.text3,
+                    cursor: "pointer",
+                    fontSize: 12,
+                    padding: 0,
+                    lineHeight: 1,
+                  }}
+                >
+                  ✕
+                </button>
+              </div>
+            ))}
+          </div>
+        )}
        <div
          style={{
            display: "flex",
@@ -471,21 +697,33 @@ export function MobileChat({
            padding: "6px 6px 6px 12px",
          }}
        >
+          <input
+            ref={fileInputRef}
+            type="file"
+            multiple
+            style={{ display: "none" }}
+            onChange={(e) => onFilesPicked(e.target.files)}
+            aria-hidden="true"
+          />
          <button
            type="button"
+            onClick={() => fileInputRef.current?.click()}
+            disabled={!reachable || sending || uploading}
            aria-label="Attach"
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 32,
              height: 32,
              borderRadius: 999,
              border: "none",
-              cursor: "pointer",
+              cursor: reachable && !sending && !uploading ? "pointer" : "not-allowed",
              background: "transparent",
              color: p.text3,
              flexShrink: 0,
              display: "flex",
              alignItems: "center",
              justifyContent: "center",
+              opacity: !reachable || sending || uploading ? 0.4 : 1,
            }}
          >
            {Icons.attach({ size: 16 })}
@@ -494,6 +732,7 @@ export function MobileChat({
            ref={composerRef}
            value={draft}
            onChange={(e) => setDraft(e.target.value)}
+            aria-label="Message"
            onKeyDown={(e) => {
              // Enter sends; Shift+Enter inserts a newline. Skip when the
              // IME is composing — pressing Enter to commit a Chinese/
@@ -517,7 +756,12 @@ export function MobileChat({
              border: "none",
              outline: "none",
              background: "transparent",
-              fontSize: 14.5,
+              // iOS Safari/PWA zooms the viewport when a focused textarea
+              // has a computed font-size below 16px. 14.5 triggers that
+              // focus-zoom; the page looks broken until the user pinches
+              // back (#224, same class as desktop #1434 / sibling #225).
+              // 16px is the minimum that keeps focus from zooming.
+              fontSize: 16,
              lineHeight: 1.4,
              color: p.text,
              padding: "6px 0",
@@ -531,31 +775,38 @@ export function MobileChat({
          <button
            type="button"
            onClick={send}
-            disabled={!draft.trim() || !reachable || sending}
+            disabled={(!draft.trim() && pendingFiles.length === 0) || !reachable || sending || uploading}
            aria-label="Send"
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 36,
              height: 36,
              borderRadius: 999,
              border: "none",
-              cursor: draft.trim() && !sending ? "pointer" : "not-allowed",
+              cursor: (draft.trim() || pendingFiles.length === 0) && !sending && !uploading ? "pointer" : "not-allowed",
              flexShrink: 0,
              background:
-                draft.trim() && reachable && !sending
+                (draft.trim() || pendingFiles.length > 0) && reachable && !sending && !uploading
                  ? p.accent
                  : dark
                    ? "#2a2823"
                    : "#ece9e0",
-              color: draft.trim() && reachable && !sending ? "#fff" : p.text3,
+              color: (draft.trim() || pendingFiles.length > 0) && reachable && !sending && !uploading ? "#fff" : p.text3,
              display: "flex",
              alignItems: "center",
              justifyContent: "center",
            }}
          >
-            {Icons.send({ size: 16 })}
+            {uploading ? (
+              <span style={{ fontSize: 10, fontWeight: 600 }}>↑</span>
+            ) : (
+              Icons.send({ size: 16 })
+            )}
          </button>
        </div>
      </div>
+      </>
+      )}
    </div>
  );
 }
@@ -231,6 +231,7 @@ export function MobileComms({ dark }: { dark: boolean }) {
                fontSize: 13,
                fontWeight: 500,
              }}
+              className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            >
              {o.label}
              <span
@@ -251,11 +252,11 @@ export function MobileComms({ dark }: { dark: boolean }) {

      <div style={{ padding: "0 14px", display: "flex", flexDirection: "column", gap: 8 }}>
        {loading && items.length === 0 ? (
-          <div style={{ padding: "30px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
+          <div role="status" aria-live="polite" style={{ padding: "30px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            Loading recent comms…
          </div>
        ) : filtered.length === 0 ? (
-          <div style={{ padding: "30px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
+          <div role="status" aria-live="polite" style={{ padding: "30px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            No A2A traffic yet.
          </div>
        ) : (
@@ -2,7 +2,7 @@

 // 03 · Agent detail — pills + tabbed content (Overview/Activity/Config/Memory).

-import { useEffect, useState } from "react";
+import { useEffect, useMemo, useState } from "react";

 import { api } from "@/lib/api";
 import { useCanvasStore } from "@/store/canvas";
@@ -32,7 +32,10 @@ export function MobileDetail({
  onChat: () => void;
 }) {
  const p = usePalette(dark);
-  const node = useCanvasStore((s) => s.nodes.find((n) => n.id === agentId));
+  // Selecting `nodes` stably avoids the `.find()` anti-pattern that
+  // creates a new return value on every store update (React error #185).
+  const nodes = useCanvasStore((s) => s.nodes);
+  const node = useMemo(() => nodes.find((n) => n.id === agentId), [nodes, agentId]);
  const [tab, setTab] = useState<TabId>("overview");

  if (!node) {
@@ -80,11 +83,12 @@ export function MobileDetail({
            type="button"
            onClick={onBack}
            aria-label="Back"
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={iconButtonStyle(p, dark)}
          >
            {Icons.back({ size: 18 })}
          </button>
-          <button type="button" aria-label="More" style={iconButtonStyle(p, dark)}>
+          <button type="button" aria-label="More" className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900" style={iconButtonStyle(p, dark)}>
            {Icons.more({ size: 18 })}
          </button>
        </div>
@@ -180,6 +184,7 @@ export function MobileDetail({
              key={t.id}
              type="button"
              onClick={() => setTab(t.id)}
+              className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
              style={{
                padding: "8px 14px",
                borderRadius: 999,
@@ -211,6 +216,8 @@ export function MobileDetail({
        <button
          type="button"
          onClick={onChat}
+          data-testid="mobile-chat-cta"
+          className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
          style={{
            width: "100%",
            height: 52,
@@ -412,6 +419,8 @@ function DetailActivity({ workspaceId, dark }: { workspaceId: string; dark: bool
  if (items === null) {
    return (
      <div
+        role="status"
+        aria-live="polite"
        style={{
          background: p.surface,
          borderRadius: 16,
@@ -200,6 +200,7 @@ export function MobileHome({
          justifyContent: "center",
          boxShadow: "0 8px 24px rgba(40,30,20,0.25), 0 2px 6px rgba(40,30,20,0.15)",
        }}
+        className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
      >
        {Icons.plus({ size: 22 })}
      </button>
@@ -92,6 +92,7 @@ export function MobileMe({
                    border: on ? `2px solid ${p.text}` : "2px solid transparent",
                    boxShadow: on ? `0 0 0 2px ${p.bg} inset` : "none",
                  }}
+                  className="focus:outline-none focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                />
              );
            })}
@@ -184,6 +185,7 @@ function SegmentedRow({
              fontSize: 13,
              fontWeight: 600,
            }}
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
          >
            {o.label}
          </button>
@@ -148,6 +148,7 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
            type="button"
            onClick={onClose}
            aria-label="Close"
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: 32,
              height: 32,
@@ -170,6 +171,8 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
        <div style={{ padding: "0 14px" }}>
          {loadingTemplates ? (
            <div
+              role="status"
+              aria-live="polite"
              style={{
                padding: "24px 8px",
                textAlign: "center",
@@ -214,6 +217,8 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
                      setTplId(t.id);
                      setTier(tCode);
                    }}
+                    aria-label={`Select template: ${t.name} (tier ${t.tier})`}
+                    className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                    style={{
                      background: on
                        ? dark
@@ -302,6 +307,7 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
          <input
            value={name}
            onChange={(e) => setName(e.target.value)}
+            aria-label="Agent name"
            placeholder={tplId
              ? (templates.find((t) => t.id === tplId)?.name ?? "agent-name")
              : "agent-name"}
@@ -312,7 +318,12 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
              border: `0.5px solid ${p.border}`,
              borderRadius: 12,
              fontFamily: MOBILE_FONT_MONO,
-              fontSize: 13.5,
+              // iOS Safari/PWA zooms the viewport when a focused input has
+              // a computed font-size below 16px; the layout jumps and the
+              // page looks broken until the user pinches back (#224 / #225,
+              // same class as desktop #1434). 16px is the minimum that
+              // suppresses that focus-zoom.
+              fontSize: 16,
              color: p.text,
              outline: "none",
              boxSizing: "border-box",
@@ -330,6 +341,8 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
                key={t}
                type="button"
                onClick={() => setTier(t)}
+                aria-label={`Select tier ${t}: ${TIER_LABEL[t]}`}
+                className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
                style={{
                  flex: 1,
                  padding: "10px 8px",
@@ -377,6 +390,8 @@ export function MobileSpawn({ dark, onClose }: { dark: boolean; onClose: () => v
            type="button"
            onClick={handleSpawn}
            disabled={busy || !tplId || templates.length === 0}
+            aria-label="Spawn agent"
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              width: "100%",
              height: 52,
@@ -8,11 +8,27 @@
 * NOTE: No @testing-library/jest-dom — use DOM APIs.
 */
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { cleanup, render, waitFor } from "@testing-library/react";
+import { act, cleanup, render, waitFor } from "@testing-library/react";
 import React from "react";

 import { MobileChat } from "../MobileChat";

+// ─── Mock API ─────────────────────────────────────────────────────────────────
+// vi.mock without a factory auto-mocks the module. In tests, we configure
+// api.get / api.post directly (they are vi.fn() from the auto-mock).
+// Tests that need specific behaviour use mockResolvedValueOnce on the
+// auto-mocked functions.
+vi.mock("@/lib/api");
+import { api } from "@/lib/api";
+
+// AgentCommsPanel (mounted by the Agent Comms sub-tab, #231) subscribes
+// to the global socket via useSocketEvent. Stub it to a no-op so the
+// panel mounts without the real ReconnectingSocket — the parity tests
+// only assert the panel renders (vs the old static placeholder).
+vi.mock("@/hooks/useSocketEvent", () => ({
+  useSocketEvent: vi.fn(),
+}));
+
 // ─── Mock store ───────────────────────────────────────────────────────────────

 const mockAgentId = "ws-chat-test";
@@ -28,16 +44,18 @@ const mockStoreState = {
    height?: number;
  }>,
  agentMessages: {} as Record<string, Array<{ id: string; content: string; timestamp: string }>>,
+  consumeAgentMessages: () => [],
 };

 vi.mock("@/store/canvas", () => ({
  useCanvasStore: Object.assign(
-    vi.fn((sel) => sel(mockStoreState)),
+    vi.fn((sel?: (state: typeof mockStoreState) => unknown) => {
+      if (sel) return sel(mockStoreState);
+      return mockStoreState;
+    }),
    {
-      getState: () => ({
-        ...mockStoreState,
-        consumeAgentMessages: vi.fn(() => []),
-      }),
+      getState: () => mockStoreState,
+      subscribe: vi.fn(() => vi.fn()),
    },
  ),
  summarizeWorkspaceCapabilities: vi.fn((data: Record<string, unknown>) => {
@@ -59,20 +77,6 @@ vi.mock("@/store/canvas", () => ({
  }),
 }));

-// ─── Mock API ─────────────────────────────────────────────────────────────────
-
-const { mockApiPost } = vi.hoisted(() => ({
-  mockApiPost: vi.fn().mockResolvedValue({ result: { parts: [] } }),
-}));
-
-const { mockApiGet } = vi.hoisted(() => ({
-  mockApiGet: vi.fn().mockResolvedValue({ messages: [] }),
-}));
-
-vi.mock("@/lib/api", () => ({
-  api: { get: mockApiGet, post: mockApiPost },
-}));
-
 // ─── Fixtures ────────────────────────────────────────────────────────────────

 const onlineNode = {
@@ -157,10 +161,23 @@ function renderChat(agentId: string, dark = false) {

 beforeEach(() => {
  mockOnBack.mockClear();
-  mockApiGet.mockClear();
  mockStoreState.nodes = [];
  mockStoreState.agentMessages = {};
-  mockApiPost.mockClear();
+  // jsdom doesn't implement scrollIntoView. The Agent Comms tab now
+  // mounts AgentCommsPanel (#231), which scrolls its feed to bottom on
+  // arrival; a no-op stub keeps the panel from throwing under jsdom
+  // (same stub AgentCommsPanel's own render test installs).
+  Element.prototype.scrollIntoView =
+    vi.fn() as unknown as Element["scrollIntoView"];
+  // Set up spies on the real api methods. Tests override these per-call.
+  const getSpy = vi.spyOn(api, "get");
+  const postSpy = vi.spyOn(api, "post");
+  getSpy.mockResolvedValue({ messages: [], reached_end: true });
+  postSpy.mockResolvedValue({ result: { parts: [] } });
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
 });

 afterEach(() => {
@@ -246,6 +263,20 @@ describe("MobileChat — composer", () => {
    const sendBtn = container.querySelector('[aria-label="Send"]') as HTMLButtonElement;
    expect(sendBtn.disabled).toBe(true);
  });
+
+  // Regression #224: the composer textarea must render with font-size
+  // ≥ 16px. iOS Safari and PWAs auto-zoom the viewport when a focused
+  // input has a computed font-size below 16px — the layout jumps and
+  // the page looks broken until the user pinches back. Same class as
+  // desktop #1434 / sibling MobileSpawn #225.
+  it("composer textarea renders at font-size 16px or greater (iOS focus-zoom regression #224)", () => {
+    const { container } = renderChat(mockAgentId);
+    const textarea = container.querySelector("textarea") as HTMLTextAreaElement;
+    expect(textarea).toBeTruthy();
+    const fs = Number.parseFloat(textarea.style.fontSize);
+    expect(Number.isFinite(fs)).toBe(true);
+    expect(fs).toBeGreaterThanOrEqual(16);
+  });
 });

 // ─── Tabs ─────────────────────────────────────────────────────────────────────
@@ -277,18 +308,26 @@ describe("MobileChat — empty state", () => {
  });

  it('shows "Send a message to start chatting." when no messages', async () => {
-    const { container } = renderChat(mockAgentId);
-    await waitFor(() =>
-      expect(container.textContent ?? "").toContain("Send a message to start chatting."),
-    );
+    // History fetch resolves immediately in tests (mockResolvedValue).
+    // act() flushes the microtask queue so the component reaches its
+    // post-load state before we assert.
+    let renderResult: ReturnType<typeof renderChat>;
+    await act(async () => {
+      renderResult = renderChat(mockAgentId);
+    });
+    const { container } = renderResult!;
+    expect(container.textContent ?? "").toContain("Send a message to start chatting.");
  });

  it("shows no messages when agentMessages[agentId] is absent (undefined)", async () => {
+    // Explicitly set to empty to simulate no stored messages
    mockStoreState.agentMessages = {};
-    const { container } = renderChat(mockAgentId);
-    await waitFor(() =>
-      expect(container.textContent ?? "").toContain("Send a message to start chatting."),
-    );
+    let renderResult: ReturnType<typeof renderChat>;
+    await act(async () => {
+      renderResult = renderChat(mockAgentId);
+    });
+    const { container } = renderResult!;
+    expect(container.textContent ?? "").toContain("Send a message to start chatting.");
  });
 });

@@ -334,3 +373,275 @@ describe("MobileChat — dark mode", () => {
    expect(container.querySelector('[aria-label="Back"]')).toBeTruthy();
  });
 });
+
+// ─── Chat history loading ────────────────────────────────────────────────────
+
+describe("MobileChat — chat history", () => {
+  beforeEach(() => {
+    mockStoreState.nodes = [onlineNode];
+  });
+
+  it("calls GET /workspaces/:id/chat-history on mount", async () => {
+    await act(async () => {
+      renderChat(mockAgentId);
+    });
+    expect(api.get).toHaveBeenCalledWith(
+      expect.stringContaining(`/workspaces/${mockAgentId}/chat-history`),
+    );
+  });
+
+  it("shows loading state while history is fetching", () => {
+    // Do NOT await — check the pre-resolve state.
+    const { container } = renderChat(mockAgentId);
+    expect(container.textContent ?? "").toContain("Loading chat history…");
+  });
+
+  it("shows empty state after history resolves with no messages", async () => {
+    // beforeEach already sets api.get to resolve with empty — no override needed.
+    let renderResult: ReturnType<typeof renderChat>;
+    await act(async () => {
+      renderResult = renderChat(mockAgentId);
+    });
+    const { container } = renderResult!;
+    expect(container.textContent ?? "").toContain("Send a message to start chatting.");
+  });
+
+  it("renders messages from history response", async () => {
+    vi.spyOn(api, "get").mockResolvedValueOnce({
+      messages: [
+        {
+          id: "msg-1",
+          role: "user",
+          content: "Hello agent",
+          timestamp: "2026-04-25T10:00:00Z",
+        },
+        {
+          id: "msg-2",
+          role: "agent",
+          content: "Hello back",
+          timestamp: "2026-04-25T10:00:01Z",
+        },
+      ],
+      reached_end: true,
+    });
+    let renderResult: ReturnType<typeof renderChat>;
+    await act(async () => {
+      renderResult = renderChat(mockAgentId);
+    });
+    const { container } = renderResult!;
+    expect(container.textContent ?? "").toContain("Hello agent");
+    expect(container.textContent ?? "").toContain("Hello back");
+  });
+
+  it("maps user role from API correctly", async () => {
+    vi.spyOn(api, "get").mockResolvedValueOnce({
+      messages: [
+        {
+          id: "msg-u",
+          role: "user",
+          content: "user message",
+          timestamp: "2026-04-25T10:00:00Z",
+        },
+      ],
+      reached_end: true,
+    });
+    let renderResult: ReturnType<typeof renderChat>;
+    await act(async () => {
+      renderResult = renderChat(mockAgentId);
+    });
+    // User messages render right-aligned. The text content check is sufficient
+    // to confirm the message appeared.
+    const { container } = renderResult!;
+    expect(container.textContent ?? "").toContain("user message");
+  });
+
+  it("shows error state when history fetch fails", async () => {
+    vi.spyOn(api, "get").mockRejectedValue(new Error("Network error"));
+    let renderResult: ReturnType<typeof renderChat>;
+    await act(async () => {
+      renderResult = renderChat(mockAgentId);
+    });
+    const { container } = renderResult!;
+    expect(container.textContent ?? "").toContain("Could not load chat history.");
+    expect(container.textContent ?? "").toContain("Retry");
+  });
+
+  it("Retry button re-fetches history after error", async () => {
+    // Make the initial mount call fail so the Retry button appears, then
+    // make the retry call succeed so we can verify the full flow.
+    const getSpy = vi.spyOn(api, "get");
+    getSpy
+      .mockRejectedValueOnce(new Error("Network error"))
+      .mockResolvedValueOnce({ messages: [], reached_end: true });
+
+    let renderResult: ReturnType<typeof renderChat>;
+    await act(async () => {
+      renderResult = renderChat(mockAgentId);
+    });
+    const { container } = renderResult!;
+
+    // Error state should be shown with Retry button.
+    expect(container.textContent ?? "").toContain("Could not load chat history.");
+    expect(container.textContent ?? "").toContain("Retry");
+
+    // Click Retry — the button's onClick fires api.get again.
+    // The second mockResolvedValueOnce makes it succeed.
+    const retryBtn = Array.from(container.querySelectorAll("button")).find(
+      (b) => b.textContent?.trim() === "Retry",
+    );
+    expect(retryBtn).toBeTruthy();
+    await act(async () => {
+      retryBtn?.click();
+    });
+
+    // waitFor polls until the retry resolves and component re-renders.
+    await waitFor(() => {
+      expect(container.textContent ?? "").toContain("Send a message to start chatting.");
+    });
+    // Initial call + retry = 2.
+    expect(getSpy).toHaveBeenCalledTimes(2);
+  });
+});
+
+// ─── #232 · Attachment render parity with desktop ChatTab ────────────────────
+//
+// Regression for the CTO-reported mobile bug: MobileChat used to render
+// only m.content (no attachment surface), so files sent/received in a
+// conversation were invisible on mobile while desktop showed them. The
+// fix routes m.attachments through the same AttachmentPreview the
+// desktop ChatTab bubble uses.
+
+describe("MobileChat — attachment render parity (#232)", () => {
+  beforeEach(() => {
+    mockStoreState.nodes = [onlineNode];
+  });
+
+  it("renders an attachment from a history message via AttachmentPreview", async () => {
+    const getSpy = vi.spyOn(api, "get");
+    // useChatHistory reads { messages, reached_end }.
+    getSpy.mockResolvedValueOnce({
+      messages: [
+        {
+          id: "m-att-1",
+          role: "agent",
+          content: "Here is the report",
+          attachments: [
+            {
+              name: "report.csv",
+              uri: "workspace://out/report.csv",
+              mimeType: "text/csv",
+              size: 2048,
+            },
+          ],
+          timestamp: new Date().toISOString(),
+        },
+      ],
+      reached_end: true,
+    });
+
+    let rr: ReturnType<typeof renderChat>;
+    await act(async () => {
+      rr = renderChat(mockAgentId);
+    });
+    const { container } = rr!;
+
+    // A non-image attachment renders the AttachmentChip download button
+    // with title="Download <name>" — same component the desktop bubble
+    // dispatches through AttachmentPreview.
+    await waitFor(() => {
+      const chip = container.querySelector('[title="Download report.csv"]');
+      expect(chip).toBeTruthy();
+    });
+    expect(container.textContent ?? "").toContain("report.csv");
+  });
+});
+
+// ─── #231 · Agent Comms (A2A/peer) render parity with desktop ChatTab ────────
+//
+// Regression for the CTO-reported mobile bug: the Agent Comms sub-tab
+// rendered a static placeholder string ("peer-to-peer A2A traffic
+// surfaces in the Comms tab") instead of the real feed. The fix mounts
+// the same AgentCommsPanel the desktop ChatTab agent-comms tabpanel
+// uses, so peer/A2A + delegation activity is visible on mobile.
+
+describe("MobileChat — Agent Comms render parity (#231)", () => {
+  beforeEach(() => {
+    mockStoreState.nodes = [onlineNode];
+  });
+
+  it("mounts AgentCommsPanel on the Agent Comms tab (not the old placeholder)", async () => {
+    const getSpy = vi.spyOn(api, "get");
+    // 1st GET: useChatHistory (My Chat) on mount.
+    getSpy.mockResolvedValueOnce({ messages: [], reached_end: true });
+    // 2nd GET: AgentCommsPanel's activity load when the tab is shown.
+    // Empty list → panel renders its own empty state, which still
+    // proves AgentCommsPanel mounted (vs. the removed placeholder).
+    getSpy.mockResolvedValueOnce([]);
+
+    let rr: ReturnType<typeof renderChat>;
+    await act(async () => {
+      rr = renderChat(mockAgentId);
+    });
+    const { container } = rr!;
+
+    const commsTab = Array.from(container.querySelectorAll("button")).find(
+      (b) => b.textContent?.trim() === "Agent Comms",
+    );
+    expect(commsTab).toBeTruthy();
+    await act(async () => {
+      commsTab!.click();
+    });
+
+    await waitFor(() => {
+      const text = container.textContent ?? "";
+      // The panel's empty state — proves AgentCommsPanel mounted.
+      expect(text).toContain("No agent-to-agent communications yet.");
+    });
+    // The old hard-coded placeholder must be gone.
+    expect(container.textContent ?? "").not.toContain(
+      "peer-to-peer A2A traffic surfaces in the Comms tab",
+    );
+    // The panel hit its activity endpoint.
+    expect(getSpy).toHaveBeenCalledWith(
+      expect.stringContaining(`/workspaces/${mockAgentId}/activity`),
+    );
+  });
+
+  it("renders a peer message on the Agent Comms tab", async () => {
+    const getSpy = vi.spyOn(api, "get");
+    getSpy.mockResolvedValueOnce({ messages: [], reached_end: true });
+    // a2a_receive from a peer → AgentCommsPanel.toCommMessage maps it
+    // to an inbound bubble with the request text.
+    getSpy.mockResolvedValueOnce([
+      {
+        id: "act-1",
+        activity_type: "a2a_receive",
+        source_id: "peer-ws-uuid",
+        target_id: mockAgentId,
+        method: "message/send",
+        summary: "peer asked something",
+        request_body: { task: "Please review PR 42" },
+        response_body: null,
+        status: "ok",
+        created_at: new Date().toISOString(),
+      },
+    ]);
+
+    let rr: ReturnType<typeof renderChat>;
+    await act(async () => {
+      rr = renderChat(mockAgentId);
+    });
+    const { container } = rr!;
+
+    const commsTab = Array.from(container.querySelectorAll("button")).find(
+      (b) => b.textContent?.trim() === "Agent Comms",
+    );
+    await act(async () => {
+      commsTab!.click();
+    });
+
+    await waitFor(() => {
+      expect(container.textContent ?? "").toContain("Please review PR 42");
+    });
+  });
+});
@@ -93,6 +93,24 @@ describe("MobileSpawn — render", () => {
    expect(input).toBeTruthy();
  });

+  // Regression #224 / #225: the agent-name input must render with a
+  // font-size ≥ 16px. iOS Safari and PWAs auto-zoom the viewport when a
+  // focused input has a computed font-size below 16px — the layout
+  // jumps and the page looks broken until the user pinches back.
+  it("renders the name input at font-size 16px or greater (iOS focus-zoom regression)", () => {
+    apiGetSpy.mockResolvedValue(mockTemplates);
+    render(<MobileSpawn dark={true} onClose={vi.fn()} />);
+    const input = document.querySelector(
+      'input[aria-label="Agent name"]',
+    ) as HTMLInputElement | null;
+    expect(input).toBeTruthy();
+    // Parse the inline style font-size — jsdom doesn't run a layout
+    // engine, so getComputedStyle reports the inline value verbatim.
+    const fs = Number.parseFloat(input!.style.fontSize);
+    expect(Number.isFinite(fs)).toBe(true);
+    expect(fs).toBeGreaterThanOrEqual(16);
+  });
+
  it("renders all 4 tier buttons", () => {
    apiGetSpy.mockResolvedValue(mockTemplates);
    render(<MobileSpawn dark={true} onClose={vi.fn()} />);
@@ -133,6 +133,7 @@ export function TabBar({
            aria-label={t.label}
            onClick={() => onChange(t.id)}
            onKeyDown={(e) => handleKeyDown(e, idx)}
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              background: "none",
              border: "none",
@@ -288,8 +289,10 @@ export function AgentCard({
  return (
    <button
      type="button"
+      data-testid="workspace-card"
      aria-label={`${agent.name}, status: ${agent.status}, tier ${agent.tier}${agent.remote ? ", remote" : ""}`}
      onClick={onClick}
+      className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
      style={{
        display: "block",
        width: "100%",
@@ -443,6 +446,7 @@ export function FilterChips({
            type="button"
            aria-checked={on}
            onClick={() => onChange(o.id)}
+            className="focus:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-100 dark:focus-visible:ring-offset-zinc-900"
            style={{
              display: "inline-flex",
              alignItems: "center",
@@ -160,14 +160,14 @@ export function OrgTokensTab() {
            </code>
            <button
              onClick={handleCopy}
-              className="shrink-0 px-2 py-1.5 bg-emerald-800/40 hover:bg-emerald-700/50 border border-emerald-700/40 rounded text-[10px] text-good transition-colors"
+              className="shrink-0 px-2 py-1.5 bg-emerald-800/40 hover:bg-emerald-700/50 border border-emerald-700/40 rounded text-[10px] text-good transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
            >
              {copied ? 'Copied' : 'Copy'}
            </button>
          </div>
          <button
            onClick={() => setNewToken(null)}
-            className="text-[9px] text-good/60 hover:text-good transition-colors"
+            className="text-[9px] text-good/60 hover:text-good transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
          >
            Dismiss
          </button>
@@ -219,7 +219,7 @@ export function OrgTokensTab() {
              </div>
              <button
                onClick={() => setRevokeTarget(t)}
-                className="text-[10px] text-bad/70 hover:text-bad transition-colors px-2 py-1 shrink-0"
+                className="text-[10px] text-bad/70 hover:text-bad transition-colors px-2 py-1 shrink-0 focus:outline-none focus-visible:ring-2 focus-visible:ring-red-400 focus-visible:ring-offset-1"
              >
                Revoke
              </button>
@@ -3,16 +3,24 @@ import { useState, useCallback, useRef, useEffect } from 'react';
 import type { Secret, SecretGroup } from '@/types/secrets';
 import { useSecretsStore } from '@/stores/secrets-store';
 import { StatusBadge } from '@/components/ui/StatusBadge';
-import { RevealToggle } from '@/components/ui/RevealToggle';
 import { KeyValueField } from '@/components/ui/KeyValueField';
 import { ValidationHint } from '@/components/ui/ValidationHint';
 import { TestConnectionButton } from '@/components/ui/TestConnectionButton';
 import { validateSecretValue } from '@/lib/validation/secret-formats';
 import { SERVICES } from '@/lib/services';

-const AUTO_HIDE_MS = 30_000;
 const VALIDATION_DEBOUNCE_MS = 400;

+// Secret values are write-only from the browser: the server List endpoint
+// "Never exposes values", there is no per-secret decrypt route, and the
+// only decrypted path (GET /secrets/values) is bulk + token-gated for
+// remote agents. The old eye/RevealToggle was a dead affordance — it
+// flipped its own icon but could never reveal anything, which read as
+// "this doesn't work" (esp. once clicked → eye-with-slash). We show an
+// honest static indicator instead; rotation is via Edit.
+const WRITE_ONLY_TITLE =
+  'Value is write-only and cannot be revealed — use Edit to replace/rotate it';
+
 interface SecretRowProps {
  secret: Secret;
  workspaceId: string;
@@ -31,28 +39,12 @@ export function SecretRow({ secret, workspaceId }: SecretRowProps) {
  const setSecretStatus = useSecretsStore((s) => s.setSecretStatus);

  const isEditing = editingKey === secret.name;
-  const [revealed, setRevealed] = useState(false);
  const [editValue, setEditValue] = useState('');
  const [validationError, setValidationError] = useState<string | null>(null);
  const [isSaving, setIsSaving] = useState(false);
  const [saveError, setSaveError] = useState<string | null>(null);
  const debounceRef = useRef<ReturnType<typeof setTimeout>>(undefined);
  const editBtnRef = useRef<HTMLButtonElement>(null);
-  const revealTimerRef = useRef<ReturnType<typeof setTimeout>>(undefined);
-
-  // Auto-hide revealed value after 30s
-  useEffect(() => {
-    if (revealed) {
-      clearTimeout(revealTimerRef.current);
-      revealTimerRef.current = setTimeout(() => setRevealed(false), AUTO_HIDE_MS);
-      return () => clearTimeout(revealTimerRef.current);
-    }
-  }, [revealed]);
-
-  // Reset revealed state when panel closes (session-only)
-  useEffect(() => {
-    return () => setRevealed(false);
-  }, []);

  // Debounced validation
  useEffect(() => {
@@ -133,11 +125,15 @@ export function SecretRow({ secret, workspaceId }: SecretRowProps) {
          {secret.masked_value}
        </span>
        <div className="secret-row__actions">
-          <RevealToggle
-            revealed={revealed}
-            onToggle={() => setRevealed((r) => !r)}
-            label={`Toggle reveal ${secret.name}`}
-          />
+          <span
+            data-testid="write-only-indicator"
+            className="secret-row__write-only"
+            role="img"
+            aria-label={`${secret.name} value is write-only and cannot be revealed; use Edit to replace it`}
+            title={WRITE_ONLY_TITLE}
+          >
+            🔒
+          </span>
          <StatusBadge status={secret.status} />
          <button
            type="button"
@@ -16,7 +16,40 @@ interface TokensTabProps {
  workspaceId: string;
 }

+// The settings panel passes the literal sentinel "global" when no canvas
+// node is selected. Workspace tokens are inherently per-workspace — there
+// is no /workspaces/global/tokens endpoint (querying the uuid column with
+// "global" 500s on Postgres). The org-wide equivalent lives in the
+// separate "Org API Keys" tab. Mirrors the sentinel-awareness that
+// api/secrets.ts already has (workspaceId === 'global' → /settings/secrets).
+const GLOBAL_WORKSPACE_ID = 'global';
+
 export function TokensTab({ workspaceId }: TokensTabProps) {
+  if (workspaceId === GLOBAL_WORKSPACE_ID) {
+    return (
+      <div className="p-4 space-y-4">
+        <div>
+          <h3 className="text-sm font-semibold text-ink">API Tokens</h3>
+          <p className="text-[10px] text-ink-mid mt-0.5">
+            Bearer tokens for authenticating API calls to this workspace.
+          </p>
+        </div>
+        <div className="text-center py-6">
+          <p className="text-xs text-ink-mid">Select a workspace node first</p>
+          <p className="text-[10px] text-ink-mid mt-1">
+            Workspace tokens are scoped to a single workspace. Select a node
+            on the canvas to manage its tokens, or use the{' '}
+            <span className="text-accent font-medium">Org API Keys</span> tab
+            for org-wide API keys.
+          </p>
+        </div>
+      </div>
+    );
+  }
+  return <WorkspaceTokensTab workspaceId={workspaceId} />;
+}
+
+function WorkspaceTokensTab({ workspaceId }: TokensTabProps) {
  const [tokens, setTokens] = useState<Token[]>([]);
  const [loading, setLoading] = useState(true);
  const [creating, setCreating] = useState(false);
@@ -107,14 +140,14 @@ export function TokensTab({ workspaceId }: TokensTabProps) {
            </code>
            <button
              onClick={handleCopy}
-              className="shrink-0 px-2 py-1.5 bg-emerald-800/40 hover:bg-emerald-700/50 border border-emerald-700/40 rounded text-[10px] text-good transition-colors"
+              className="shrink-0 px-2 py-1.5 bg-emerald-800/40 hover:bg-emerald-700/50 border border-emerald-700/40 rounded text-[10px] text-good transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
            >
              {copied ? 'Copied' : 'Copy'}
            </button>
          </div>
          <button
            onClick={() => setNewToken(null)}
-            className="text-[9px] text-good/60 hover:text-good transition-colors"
+            className="text-[9px] text-good/60 hover:text-good transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
          >
            Dismiss
          </button>
@@ -159,7 +192,7 @@ export function TokensTab({ workspaceId }: TokensTabProps) {
              </div>
              <button
                onClick={() => setRevokeTarget(t)}
-                className="text-[10px] text-bad/70 hover:text-bad transition-colors px-2 py-1"
+                className="text-[10px] text-bad/70 hover:text-bad transition-colors px-2 py-1 focus:outline-none focus-visible:ring-2 focus-visible:ring-red-400 focus-visible:ring-offset-1"
              >
                Revoke
              </button>
@@ -138,14 +138,54 @@ describe("SecretRow — display mode", () => {
    expect(document.querySelector('[role="row"]')).toBeTruthy();
  });

-  it("has Reveal, Copy, Edit, Delete buttons", () => {
+  it("has Copy, Edit, Delete buttons", () => {
    render(<SecretRow secret={GITHUB_SECRET} workspaceId="ws-1" />);
-    expect(screen.getByTestId("reveal-toggle")).toBeTruthy();
    expect(screen.getByRole("button", { name: /copy/i })).toBeTruthy();
    expect(screen.getByRole("button", { name: /edit/i })).toBeTruthy();
    expect(screen.getByRole("button", { name: /delete/i })).toBeTruthy();
  });

+  // Regression: the reveal/eye control was a dead affordance. Clicking it
+  // flipped its own icon (eye → eye-with-slash) but never revealed the value,
+  // because secret values are write-only from the browser (server List
+  // "Never exposes values"; there is no per-secret decrypt endpoint and the
+  // client has no plaintext-fetch function). The honest fix removes the
+  // toggle and shows a static "write-only / cannot be revealed" indicator.
+  // See internal tracking issue + internal#210/#211.
+  it("does NOT render a reveal/eye toggle (values are write-only)", () => {
+    render(<SecretRow secret={GITHUB_SECRET} workspaceId="ws-1" />);
+    expect(screen.queryByTestId("reveal-toggle")).toBeNull();
+    expect(
+      screen.queryByRole("button", { name: /toggle reveal/i }),
+    ).toBeNull();
+  });
+
+  it("shows a write-only indicator explaining the value cannot be revealed", () => {
+    render(<SecretRow secret={ANTHROPIC_SECRET} workspaceId="ws-1" />);
+    const indicator = screen.getByTestId("write-only-indicator");
+    expect(indicator).toBeTruthy();
+    // Affordance must be honest: explain it cannot be revealed and that
+    // Edit is the rotate path. It must not be a clickable button.
+    const title = indicator.getAttribute("title") ?? "";
+    expect(title.toLowerCase()).toMatch(/write-only|cannot be revealed/);
+    expect(indicator.tagName).not.toBe("BUTTON");
+  });
+
+  it("write-only indicator is present for the Anthropic/OAuth-token row too", () => {
+    // The reported bug singled out CLAUDE_CODE_OAUTH_TOKEN (anthropic group);
+    // the fix is group-agnostic — every row gets the same honest affordance.
+    const OAUTH_SECRET = {
+      name: "CLAUDE_CODE_OAUTH_TOKEN",
+      masked_value: "••••••••••••••••9d2a",
+      group: "anthropic" as const,
+      status: "unverified" as const,
+      updated_at: "2024-01-04",
+    };
+    render(<SecretRow secret={OAUTH_SECRET} workspaceId="ws-1" />);
+    expect(screen.queryByTestId("reveal-toggle")).toBeNull();
+    expect(screen.getByTestId("write-only-indicator")).toBeTruthy();
+  });
+
  it("shows invalid status correctly", () => {
    render(<SecretRow secret={CUSTOM_SECRET} workspaceId="ws-1" />);
    expect(screen.getByTestId("status-badge").getAttribute("data-status")).toBe("invalid");
@@ -302,3 +302,35 @@ describe("TokensTab — error", () => {
    expect(document.querySelector('[role="status"]')).toBeNull();
  });
 });
+
+// ─── "global" sentinel (no node selected) ────────────────────────────────────
+//
+// Regression: SettingsPanel passes the literal "global" when no canvas
+// node is selected. workspace tokens are per-workspace and there is no
+// /workspaces/global/tokens endpoint — calling it 500'd
+// ("invalid input syntax for type uuid: global"). The tab must NOT call
+// the API in that state and must point the user at the Org API Keys tab.
+describe("TokensTab — global sentinel (no node selected)", () => {
+  beforeEach(() => {
+    mockApiGet.mockReset();
+    mockApiPost.mockReset();
+    mockApiGet.mockRejectedValue(new Error("should not be called"));
+  });
+
+  it("does not call the API and shows a pointer to Org API Keys", async () => {
+    render(<TokensTab workspaceId="global" />);
+    await flush();
+    expect(mockApiGet).not.toHaveBeenCalled();
+    expect(mockApiPost).not.toHaveBeenCalled();
+    expect(document.body.textContent).toContain("Select a workspace node");
+    expect(document.body.textContent).toContain("Org API Keys");
+    // No error banner, no scary 500 surfacing.
+    expect(document.querySelector(".text-bad")).toBeNull();
+  });
+
+  it("has no create button in the global state", async () => {
+    render(<TokensTab workspaceId="global" />);
+    await flush();
+    expect(document.body.textContent).not.toContain("New Token");
+  });
+});
@@ -185,7 +185,7 @@ export function ActivityTab({ workspaceId }: Props) {
      {/* Activity list */}
      <div className="flex-1 overflow-y-auto p-3 space-y-1.5">
        {loading && activities.length === 0 && (
-          <div className="text-xs text-ink-mid text-center py-8">Loading activity...</div>
+          <div role="status" aria-live="polite" className="text-xs text-ink-mid text-center py-8">Loading activity...</div>
        )}

        {error && (
@@ -243,7 +243,7 @@ export function BudgetSection({ workspaceId }: Props) {
          onClick={handleSave}
          disabled={saving}
          data-testid="budget-save-btn"
-          className="px-4 py-1.5 bg-accent-strong hover:bg-accent active:bg-accent-strong rounded-lg text-xs font-medium text-white disabled:opacity-50 transition-colors"
+          className="px-4 py-1.5 bg-accent-strong hover:bg-accent active:bg-accent-strong rounded-lg text-xs font-medium text-white disabled:opacity-50 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
        >
          {saving ? "Saving…" : "Save"}
        </button>
@@ -255,14 +255,14 @@ export function ChannelsTab({ workspaceId }: Props) {
        </h3>
        <button
          onClick={() => setShowForm(!showForm)}
-          className="text-[10px] px-2.5 py-1 rounded bg-accent-strong/20 text-accent hover:bg-accent-strong/30 transition"
+          className="text-[10px] px-2.5 py-1 rounded bg-accent-strong/20 text-accent hover:bg-accent-strong/30 transition focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
        >
          {showForm ? "Cancel" : "+ Connect"}
        </button>
      </div>

      {error && (
-        <div className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+        <div role="alert" aria-live="assertive" className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
          {error}
        </div>
      )}
@@ -308,7 +308,7 @@ export function ChannelsTab({ workspaceId }: Props) {
                            <button
                              onClick={handleDiscover}
                              disabled={discovering || !formValues["bot_token"]}
-                              className="text-[10px] px-2 py-0.5 rounded bg-accent-strong/20 text-accent hover:bg-accent-strong/30 transition disabled:opacity-40"
+                              className="text-[10px] px-2 py-0.5 rounded bg-accent-strong/20 text-accent hover:bg-accent-strong/30 transition disabled:opacity-40 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
                            >
                              {discovering ? "Detecting..." : "Detect Chats"}
                            </button>
@@ -5,16 +5,20 @@ import ReactMarkdown from "react-markdown";
 import remarkGfm from "remark-gfm";
 import { api } from "@/lib/api";
 import { useCanvasStore, type WorkspaceNodeData } from "@/store/canvas";
-import { useSocketEvent } from "@/hooks/useSocketEvent";
 import { type ChatMessage, type ChatAttachment, createMessage, appendMessageDeduped } from "./chat/types";
-import { uploadChatFiles, downloadChatFile, isPlatformAttachment } from "./chat/uploads";
+import { downloadChatFile, isPlatformAttachment } from "./chat/uploads";
 import { PendingAttachmentPill } from "./chat/AttachmentViews";
 import { AttachmentPreview } from "./chat/AttachmentPreview";
-import { extractFilesFromTask } from "./chat/message-parser";
 import { AgentCommsPanel } from "./chat/AgentCommsPanel";
+import { ChatErrorBanner } from "./chat/ChatErrorBanner";
 import { appendActivityLine } from "./chat/activityLog";
 import { runtimeDisplayName } from "@/lib/runtime-names";
 import { ConfirmDialog } from "@/components/ConfirmDialog";
+import { useChatHistory } from "./chat/hooks/useChatHistory";
+import { useChatSend } from "./chat/hooks/useChatSend";
+import { useChatSocket } from "./chat/hooks/useChatSocket";
+
+export { extractReplyText } from "./chat/hooks/useChatSend";

 interface Props {
  workspaceId: string;
@@ -23,147 +27,6 @@ interface Props {

 type ChatSubTab = "my-chat" | "agent-comms";

-// A2A response shape (subset). The full schema is in @a2a-js/sdk but we only
-// need parts/artifacts text + file extraction for the synchronous fallback.
-interface A2AFileRef {
-  name?: string;
-  mimeType?: string;
-  uri?: string;
-  bytes?: string;
-  size?: number;
-}
-// Outbound shape matches a2a-sdk's JSON-RPC `SendMessageRequest`
-// Pydantic union (TextPart | FilePart | DataPart). The flat
-// protobuf shape `{url, filename, mediaType}` is rejected at the
-// request boundary with `Field required` errors — keep this
-// outbound shape unless a2a-sdk migrates the JSON-RPC schema.
-interface A2APart {
-  kind: string;
-  text?: string;
-  file?: A2AFileRef;
-}
-interface A2AResponse {
-  result?: {
-    parts?: A2APart[];
-    artifacts?: Array<{ parts: A2APart[] }>;
-  };
-}
-
-// Internal-self-message filtering moved server-side in RFC #2945
-// PR-C/D — the platform's /chat-history endpoint applies the
-// IsInternalSelfMessage predicate before returning rows, so the
-// client no longer needs the local backstop on the history path.
-// The proper fix is still X-Workspace-ID header (source_id=workspace_id);
-// the platform-side prefix filter handles the residual cases.
-
-// extractReplyText pulls the agent's text reply out of an A2A response.
-// Concatenates ALL text parts (joined with "\n") rather than returning
-// just the first. Claude Code and other runtimes commonly emit multi-
-// part text replies for long content (markdown tables, code blocks),
-// and the prior "first part wins" implementation silently truncated
-// the rest — observed on a 15k-char Wave 1 brief that rendered only
-// the table header. Mirrors extractTextsFromParts in message-parser.ts.
-//
-// Server-side counterpart in workspace-server/internal/channels/
-// manager.go has the same single-part bug; fix that too if/when a
-// channel-delivered reply (Slack, Lark, etc.) gets truncated.
-export function extractReplyText(resp: A2AResponse): string {
-  const collect = (parts: A2APart[] | undefined): string => {
-    if (!parts) return "";
-    return parts
-      .filter((p) => p.kind === "text")
-      .map((p) => p.text ?? "")
-      .filter(Boolean)
-      .join("\n");
-  };
-  const result = resp?.result;
-  const collected: string[] = [];
-  const fromParts = collect(result?.parts);
-  if (fromParts) collected.push(fromParts);
-  // Walk artifacts even if parts had text — some producers (Hermes
-  // tool calls) emit a summary in parts AND details in artifacts.
-  // Returning early on parts dropped the artifact body silently.
-  if (result?.artifacts) {
-    for (const a of result.artifacts) {
-      const t = collect(a.parts);
-      if (t) collected.push(t);
-    }
-  }
-  return collected.join("\n");
-}
-
-// Agent-returned files live on the same response shape as text —
-// delegated to extractFilesFromTask in message-parser.ts, which also
-// walks status.message.parts (that ChatTab's legacy text extractor
-// doesn't). Single source of truth for file-part parsing across
-// live chat, activity log replay, and any future consumers.
-
-/** Initial chat history page size. The newest N messages are rendered
- *  on first paint; older history is fetched on demand via loadOlder()
- *  when the user scrolls the top sentinel into view. */
-const INITIAL_HISTORY_LIMIT = 10;
-/** Subsequent older-history batch size. Larger than INITIAL so a long
- *  scroll-back doesn't fan out into many round-trips. */
-const OLDER_HISTORY_BATCH = 20;
-
-/**
- * Load chat history from the platform's typed /chat-history endpoint.
- *
- * Server-side rendering of activity_logs rows into ChatMessage shape
- * lives in workspace-server/internal/messagestore/postgres_store.go
- * (RFC #2945 PR-C/D). The server already applies the canvas-source
- * filter, the internal-self-message predicate, the role decision
- * (status=error vs agent-error prefix → system), and the v0/v1
- * file-shape extraction. Canvas just renders what it receives.
- *
- * Wire shape (mirrors ChatMessage exactly, no per-row mapping needed):
- *
- *   GET /workspaces/:id/chat-history?limit=N&before_ts=T
- *   200 → {"messages": ChatMessage[], "reached_end": boolean}
- *
- * Pagination:
- *  - Pass `limit` to bound the page size (newest-first from server).
- *  - Pass `beforeTs` (RFC3339) to fetch rows STRICTLY OLDER than that
- *    timestamp. Combined with limit, this yields the next-older page
- *    when scrolling backward through history.
- *
- * `reachedEnd` is propagated from the server. The server computes it
- * by comparing rowCount vs limit so a partial last page is correctly
- * detected even when the row→bubble fan-out is non-1:1 (each row
- * produces 1-2 bubbles).
- */
-async function loadMessagesFromDB(
-  workspaceId: string,
-  limit: number,
-  beforeTs?: string,
-): Promise<{ messages: ChatMessage[]; error: string | null; reachedEnd: boolean }> {
-  try {
-    const params = new URLSearchParams({ limit: String(limit) });
-    if (beforeTs) params.set("before_ts", beforeTs);
-    const resp = await api.get<{ messages: ChatMessage[]; reached_end: boolean }>(
-      `/workspaces/${workspaceId}/chat-history?${params.toString()}`,
-    );
-
-    // Server emits oldest-first within the page (RFC #2945 PR-C-2
-    // post-fix: server reverses row-aware before returning so the
-    // wire is display-ready). Canvas appends/prepends without
-    // reordering — this avoids the pair-flip bug a naive flat
-    // reverse causes when each row produces a (user, agent) pair
-    // with the same timestamp.
-    return {
-      messages: resp.messages ?? [],
-      error: null,
-      reachedEnd: resp.reached_end,
-    };
-  } catch (err) {
-    return {
-      messages: [],
-      error: err instanceof Error ? err.message : "Failed to load chat history",
-      reachedEnd: true,
-    };
-  }
-}
-
 /**
 * ChatTab container — renders sub-tab bar + My Chat or Agent Comms panel.
 */
@@ -171,7 +34,7 @@ export function ChatTab({ workspaceId, data }: Props) {
  const [subTab, setSubTab] = useState<ChatSubTab>("my-chat");

  return (
-    <div className="flex flex-col h-full">
+    <div data-testid="chat-panel" className="flex flex-col h-full">
      {/* Sub-tab bar — role="tablist" so screen readers expose tab context */}
      <div
        role="tablist"
@@ -247,268 +110,68 @@ export function ChatTab({ workspaceId, data }: Props) {
 * MyChatPanel — user↔agent conversation (extracted from original ChatTab).
 */
 function MyChatPanel({ workspaceId, data }: Props) {
-  const [messages, setMessages] = useState<ChatMessage[]>([]);
  const [input, setInput] = useState("");
-  // `sending` is strictly the "this tab kicked off a send and hasn't
-  // seen the reply yet" signal. Previously this was initialized from
-  // data.currentTask to pick up in-flight agent work on mount, but
-  // that conflated agent-busy (workspace heartbeat) with user-
-  // in-flight (local send): when the WS dropped a TASK_COMPLETE event,
-  // currentTask lingered, the component re-mounted with sending=true,
-  // and the Send button stayed disabled forever even though nothing
-  // local was in flight. For the "agent is busy, show spinner" UX,
-  // use data.currentTask directly in the render path.
-  const [sending, setSending] = useState(false);
-  const [thinkingElapsed, setThinkingElapsed] = useState(0);
+  const [pendingFiles, setPendingFiles] = useState<File[]>([]);
  const [activityLog, setActivityLog] = useState<string[]>([]);
-  const [loading, setLoading] = useState(true);
-  const [loadError, setLoadError] = useState<string | null>(null);
-  const currentTaskRef = useRef(data.currentTask);
-  const sendingFromAPIRef = useRef(false);
+  const [thinkingElapsed, setThinkingElapsed] = useState(0);
  const [agentReachable, setAgentReachable] = useState(false);
  const [error, setError] = useState<string | null>(null);
  const [confirmRestart, setConfirmRestart] = useState(false);
-  const bottomRef = useRef<HTMLDivElement>(null);
-  // First-mount scroll-to-bottom needs `behavior: "instant"` — long
-  // conversations smooth-animate for ~300ms which any concurrent
-  // re-render can interrupt, leaving the user stuck mid-conversation
-  // when the chat tab opens. Subsequent appends (new agent messages)
-  // keep `smooth` for the visual "landing" feel. Flipped the first
-  // time messages.length goes positive, so a workspace switch (which
-  // remounts ChatTab) gets a fresh instant jump too.
-  const hasInitialScrollRef = useRef(false);
-  // Lazy-load older history on scroll-up.
-  // - containerRef = the scrollable messages viewport
-  // - topRef       = sentinel above the messages list; IO observes it
-  //                  and triggers loadOlder() when it enters view
-  // - hasMore      = false once a fetch returns < limit rows; stops IO
-  // - loadingOlder = drives the "Loading older messages…" UI label
-  // - inflightRef  = synchronous guard against double-entry of loadOlder
-  //                  when the IO callback fires twice in the same
-  //                  microtask (state-based guard would be stale until
-  //                  the next React commit)
-  // - scrollAnchorRef = saves distance-from-bottom before a prepend
-  //                  so the useLayoutEffect below can restore the
-  //                  user's exact viewport position. Without this,
-  //                  prepending older messages would jump the scroll
-  //                  position by the height of the new content.
-  // - oldestMessageRef / hasMoreRef = let the loadOlder closure read
-  //                  the latest values without taking them as deps —
-  //                  every live agent push mutates `messages`, and
-  //                  having loadOlder depend on `messages` would tear
-  //                  down + re-arm the IntersectionObserver on every
-  //                  push. Refs decouple the observer lifecycle from
-  //                  message-list updates.
+  const [dragOver, setDragOver] = useState(false);
+
  const containerRef = useRef<HTMLDivElement>(null);
  const topRef = useRef<HTMLDivElement>(null);
-  const [hasMore, setHasMore] = useState(true);
-  const [loadingOlder, setLoadingOlder] = useState(false);
-  const inflightRef = useRef(false);
-  // The scroll anchor includes the first-message id as it was BEFORE
-  // the prepend — see useLayoutEffect below for why. Without this tag,
-  // a live agent push that appends WHILE loadOlder is in flight would
-  // run useLayoutEffect against the append (anchor still set), the
-  // "restore" math would scroll the user to a stale offset, AND the
-  // append's normal scroll-to-bottom would be swallowed.
-  const scrollAnchorRef = useRef<
-    { savedDistanceFromBottom: number; expectFirstIdNotEqual: string | null } | null
-  >(null);
-  const oldestMessageRef = useRef<ChatMessage | null>(null);
-  const hasMoreRef = useRef(true);
-  // Monotonic token bumped on workspace switch + on every loadOlder
-  // entry. Each fetch's .then() captures its own token; if the token
-  // has moved, the resolved messages belong to a stale workspace or a
-  // superseded fetch and we silently drop them. Without this guard, a
-  // workspace switch mid-fetch would have the in-flight promise
-  // resolve into the new workspace's setMessages — the user sees
-  // someone else's history briefly.
-  const fetchTokenRef = useRef(0);
-  // Files the user has picked but not yet sent. Cleared on send
-  // (upload success) or by the × on each pill.
-  const [pendingFiles, setPendingFiles] = useState<File[]>([]);
-  const [uploading, setUploading] = useState(false);
+  const bottomRef = useRef<HTMLDivElement>(null);
+  const hasInitialScrollRef = useRef(false);
  const fileInputRef = useRef<HTMLInputElement>(null);
-  // Guard against a double-click during the upload phase: React
-  // state updates from the click that started the upload haven't
-  // flushed yet, so the disabled-button logic sees `uploading=false`
-  // from the closure and lets a second `sendMessage` enter. A ref
-  // observes the latest value synchronously.
-  const sendInFlightRef = useRef(false);
-  // Monotonic token bumped on every sendMessage entry. Each .then()/
-  // .catch() captures its own token in closure and bails if a newer
-  // send has superseded it — prevents a late HTTP response for an
-  // earlier message from clobbering the flags / appending text that
-  // belong to a newer in-flight send. Race scenario the token closes:
-  // (1) send msg #1 (2) WS push for msg #1 arrives, releases guards
-  // (3) user sends msg #2 (4) HTTP for msg #1 finally lands — without
-  // the token check, .then() sees sendingFromAPIRef=true (set by
-  // msg #2's send), enters the main body, and processes msg #1's body
-  // as if it were msg #2's reply.
-  const sendTokenRef = useRef(0);
+  const dragDepthRef = useRef(0);
+  const pasteCounterRef = useRef(0);

-  // Release every in-flight send guard at once. Used by every site
-  // that ends a send: pendingAgentMsgs WS push, ACTIVITY_LOGGED
-  // a2a_receive ok/error WS event, HTTP .then() success, and HTTP
-  // .catch() success. Keep these in lockstep — a future contributor
-  // adding a new "I saw the reply" path that only clears `sending` +
-  // `sendingFromAPIRef` (the natural pair) silently re-introduces
-  // the post-WS Send-button freeze, because the disabled-button
-  // logic can't see `sendInFlightRef` and so the visible state diverges
-  // from the synchronous re-entry guard at line 464.
-  const releaseSendGuards = useCallback(() => {
-    setSending(false);
-    sendingFromAPIRef.current = false;
-    sendInFlightRef.current = false;
-  }, []);
+  const history = useChatHistory(workspaceId, containerRef);
+  const chatSend = useChatSend(workspaceId, {
+    getHistoryMessages: () => history.messages,
+    onUserMessage: (msg) => history.setMessages((prev) => [...prev, msg]),
+    onAgentMessage: (msg) => history.setMessages((prev) => appendMessageDeduped(prev, msg)),
+  });
+  const { sending, uploading, sendMessage, error: sendError, clearError: clearSendError, releaseSendGuards, sendingFromAPIRef } = chatSend;

-  // Initial-load fetch — used by the mount effect and the "Retry"
-  // button below. Single source of truth so the two paths can't drift
-  // (e.g. INITIAL_HISTORY_LIMIT bumped in the effect but not the
-  // retry, leading to inconsistent first-paint sizes).
-  const loadInitial = useCallback(() => {
-    setLoading(true);
-    setLoadError(null);
-    setHasMore(true);
-    // Bump the token; any in-flight fetch from the previous workspace
-    // (or a previous retry) will see token != myToken in its .then()
-    // and silently bail — the late response can't clobber the new
-    // workspace's state.
-    fetchTokenRef.current += 1;
-    const myToken = fetchTokenRef.current;
-    loadMessagesFromDB(workspaceId, INITIAL_HISTORY_LIMIT).then(
-      ({ messages: msgs, error: fetchErr, reachedEnd }) => {
-        if (fetchTokenRef.current !== myToken) return;
-        setMessages(msgs);
-        setLoadError(fetchErr);
-        setHasMore(!reachedEnd);
-        setLoading(false);
-      },
-    );
-  }, [workspaceId]);
+  const displayError = error || sendError;

-  // Load chat history on mount / workspace switch.
-  // Initial load is bounded to INITIAL_HISTORY_LIMIT (newest 10) — the
-  // rest streams in as the user scrolls up via loadOlder() below. Pre-
-  // 2026-05-05 this fetched the newest 50 in one shot; on a long-running
-  // workspace that meant 50× message-bubble paint + DOM cost on every
-  // tab-open even when the user only wanted to read the last few.
-  useEffect(() => {
-    loadInitial();
-  }, [loadInitial]);
-
-  // Mirror the latest oldest-message + hasMore into refs so loadOlder
-  // can read them without taking `messages` as a dep. Every live push
-  // through agentMessages would otherwise recreate loadOlder and tear
-  // down the IO observer.
-  useEffect(() => {
-    oldestMessageRef.current = messages[0] ?? null;
-  }, [messages]);
-  useEffect(() => {
-    hasMoreRef.current = hasMore;
-  }, [hasMore]);
-
-  // Fetch the next-older batch and prepend. Stable identity (deps =
-  // [workspaceId]) so the IntersectionObserver effect below doesn't
-  // re-arm on every messages update.
-  const loadOlder = useCallback(async () => {
-    // inflightRef is the load-bearing guard — synchronous, set BEFORE
-    // any await, so two IO callbacks dispatched in the same microtask
-    // can't both pass. The state checks are defensive secondary
-    // gates for the slow-scroll case.
-    if (inflightRef.current || !hasMoreRef.current) return;
-    const oldest = oldestMessageRef.current;
-    if (!oldest) return;
-    const container = containerRef.current;
-    if (!container) return;
-    inflightRef.current = true;
-    // Capture the user's distance-from-bottom BEFORE we prepend so the
-    // useLayoutEffect can restore it after the new DOM lands. The
-    // expectFirstIdNotEqual tag is what the layout effect checks
-    // against `messages[0].id` to disambiguate prepend (id changed) vs
-    // append (id unchanged → live message landed mid-fetch). Without
-    // it, an agent push during loadOlder runs the "restore" against a
-    // stale anchor — user gets yanked + the append's bottom-pin is
-    // swallowed.
-    scrollAnchorRef.current = {
-      savedDistanceFromBottom: container.scrollHeight - container.scrollTop,
-      expectFirstIdNotEqual: oldest.id,
-    };
-    fetchTokenRef.current += 1;
-    const myToken = fetchTokenRef.current;
-    setLoadingOlder(true);
-    try {
-      const { messages: older, reachedEnd } = await loadMessagesFromDB(
-        workspaceId,
-        OLDER_HISTORY_BATCH,
-        oldest.timestamp,
-      );
-      // Workspace switched (or another loadOlder bumped the token)
-      // mid-fetch — drop these results, they belong to a stale tab.
-      if (fetchTokenRef.current !== myToken) {
-        scrollAnchorRef.current = null;
-        return;
+  useChatSocket(workspaceId, {
+    onAgentMessage: (msg) => {
+      history.setMessages((prev) => appendMessageDeduped(prev, msg));
+      if (sendingFromAPIRef.current) {
+        releaseSendGuards();
      }
-      if (older.length > 0) {
-        setMessages((prev) => [...older, ...prev]);
-      } else {
-        // Nothing came back — clear the anchor so the next paint doesn't
-        // try to "restore" against a no-op prepend.
-        scrollAnchorRef.current = null;
+    },
+    onActivityLog: (entry) => {
+      if (!sending) return;
+      setActivityLog((prev) => appendActivityLine(prev, entry));
+    },
+    onSendComplete: () => {
+      if (sendingFromAPIRef.current) {
+        releaseSendGuards();
      }
-      setHasMore(!reachedEnd);
-    } finally {
-      setLoadingOlder(false);
-      inflightRef.current = false;
-    }
-  }, [workspaceId]);
-
-  // IntersectionObserver on the top sentinel. Fires loadOlder() the
-  // moment the user scrolls within 200px of the top. AbortController
-  // unwires cleanly on workspace switch / unmount; root is the
-  // scrollable container so we observe only what's visible inside it.
-  //
-  // Dependencies:
-  //  - loadOlder    — stable per workspaceId (refs decouple it from
-  //                   message updates), so this dep is here for the
-  //                   workspace-switch case only
-  //  - hasMore      — re-run when older history runs out so we
-  //                   disconnect cleanly
-  //  - hasMessages  — load-bearing: the sentinel JSX is gated on
-  //                   `messages.length > 0`, so topRef.current is null
-  //                   on the empty-messages render. We re-arm exactly
-  //                   once when messages first land. NOT depending on
-  //                   `messages.length` (or `messages`) directly so
-  //                   each subsequent message append doesn't tear down
-  //                   + re-arm the observer.
-  const hasMessages = messages.length > 0;
-  useEffect(() => {
-    const top = topRef.current;
-    const container = containerRef.current;
-    if (!top || !container) return;
-    if (!hasMore) return; // stop observing when no older history exists
-    const ac = new AbortController();
-    const io = new IntersectionObserver(
-      (entries) => {
-        if (ac.signal.aborted) return;
-        if (entries[0]?.isIntersecting) loadOlder();
-      },
-      { root: container, rootMargin: "200px 0px 0px 0px", threshold: 0 },
-    );
-    io.observe(top);
-    ac.signal.addEventListener("abort", () => io.disconnect());
-    return () => ac.abort();
-  }, [loadOlder, hasMore, hasMessages]);
+    },
+    onSendError: (err) => {
+      if (sendingFromAPIRef.current) {
+        releaseSendGuards();
+        setError(err);
+      }
+    },
+  });

  // Agent reachability
  useEffect(() => {
    const reachable = data.status === "online" || data.status === "degraded";
    setAgentReachable(reachable);
-    setError(reachable ? null : `Agent is ${data.status}`);
-  }, [data.status]);
-
-  useEffect(() => {
-    currentTaskRef.current = data.currentTask;
-  }, [data.currentTask]);
+    if (reachable) {
+      setError(null);
+      clearSendError();
+    } else {
+      setError(`Agent is ${data.status}`);
+    }
+  }, [data.status, clearSendError]);

  // Scroll behavior across messages updates:
  //  - Prepend (loadOlder landed)  → restore the user's saved
@@ -518,71 +181,24 @@ function MyChatPanel({ workspaceId, data }: Props) {
  // paint — otherwise the user sees the page jump for one frame.
  useLayoutEffect(() => {
    const container = containerRef.current;
-    const anchor = scrollAnchorRef.current;
-    // Only honor the anchor when this messages-update is the prepend
-    // we expected. messages[0].id is the test:
-    //   - prepend  → messages[0] is one of the older rows → id !== expectFirstIdNotEqual
-    //   - append   → messages[0] unchanged → id === expectFirstIdNotEqual → fall through
-    // Without this check, an agent push that lands mid-loadOlder would
-    // run the restore against the append's update, yank the user's
-    // scroll, AND swallow the append's bottom-pin.
+    const anchor = history.scrollAnchorRef.current;
    if (
      anchor &&
      container &&
-      messages.length > 0 &&
-      messages[0].id !== anchor.expectFirstIdNotEqual
+      history.messages.length > 0 &&
+      history.messages[0].id !== anchor.expectFirstIdNotEqual
    ) {
      container.scrollTop = container.scrollHeight - anchor.savedDistanceFromBottom;
-      scrollAnchorRef.current = null;
+      history.scrollAnchorRef.current = null;
      return;
    }
-    // Instant on first arrival of messages — smooth-scroll on a long
-    // conversation gets interrupted by concurrent renders and leaves
-    // the user stuck in the middle. After the first jump, subsequent
-    // appends animate as before.
-    if (!hasInitialScrollRef.current && messages.length > 0) {
+    if (!hasInitialScrollRef.current && history.messages.length > 0) {
      hasInitialScrollRef.current = true;
      bottomRef.current?.scrollIntoView({ behavior: "instant" as ScrollBehavior });
      return;
    }
    bottomRef.current?.scrollIntoView({ behavior: "smooth" });
-  }, [messages]);
-
-  // Consume agent push messages (send_message_to_user) from global store.
-  // Runtimes like Claude Code SDK deliver their reply via a WS push rather
-  // than the /a2a HTTP response — when that happens, the push is the
-  // authoritative "reply arrived" signal for the UI, so clear `sending`
-  // here too. The HTTP .then() coordinates through sendingFromAPIRef so
-  // whichever path clears first wins.
-  const pendingAgentMsgs = useCanvasStore((s) => s.agentMessages[workspaceId]);
-  useEffect(() => {
-    if (!pendingAgentMsgs || pendingAgentMsgs.length === 0) return;
-    const consume = useCanvasStore.getState().consumeAgentMessages;
-    const msgs = consume(workspaceId);
-    for (const m of msgs) {
-      // Dedupe in case the agent proactively pushed the same text the
-      // HTTP /a2a response already delivered (observed with the Hermes
-      // runtime, which emits both a reply body and a send_message_to_user
-      // push for the same content). Attachments ride along with the
-      // message so files returned by the A2A_RESPONSE WS path render
-      // their download chips.
-      setMessages((prev) => appendMessageDeduped(prev, createMessage("agent", m.content, m.attachments)));
-    }
-    if (sendingFromAPIRef.current && msgs.length > 0) {
-      // Reply arrived via WS push (e.g. claude-code SDK). Release all
-      // three guards together — without sendInFlightRef the next
-      // sendMessage() silently no-ops at the synchronous re-entry
-      // check.
-      releaseSendGuards();
-    }
-  }, [pendingAgentMsgs, workspaceId]);
-
-  // Resolve workspace ID → name for activity display
-  const resolveWorkspaceName = useCallback((id: string) => {
-    const nodes = useCanvasStore.getState().nodes;
-    const node = nodes.find((n) => n.id === id);
-    return (node?.data as WorkspaceNodeData)?.name || id.slice(0, 8);
-  }, []);
+  }, [history.messages, history.scrollAnchorRef]);

  // Elapsed timer while sending
  useEffect(() => {
@@ -609,211 +225,43 @@ function MyChatPanel({ workspaceId, data }: Props) {
    setActivityLog([`Processing with ${runtimeDisplayName(data.runtime)}...`]);
  }, [sending, data.runtime]);

-  // Subscribe to global WS via the singleton ReconnectingSocket (no
-  // per-component WebSocket — the previous pattern dropped events
-  // silently on any reconnect because each panel's raw socket had no
-  // onclose handler).
-  useSocketEvent((msg) => {
-    if (!sending) return;
-    try {
-        if (msg.event === "ACTIVITY_LOGGED") {
-          // Filter to events for THIS workspace. The platform's
-          // BroadcastOnly fires to every connected client, and
-          // without this guard a sibling workspace's a2a_send would
-          // surface as "→ Delegating to X..." inside the wrong
-          // chat panel. (workspace_id on the WS envelope is the
-          // workspace whose activity_log row we just wrote.)
-          if (msg.workspace_id !== workspaceId) return;
+  // IntersectionObserver on the top sentinel. Fires loadOlder() the
+  // moment the user scrolls within 200px of the top. AbortController
+  // unwires cleanly on workspace switch / unmount; root is the
+  // scrollable container so we observe only what's visible inside it.
+  const hasMessages = history.messages.length > 0;
+  useEffect(() => {
+    const top = topRef.current;
+    const container = containerRef.current;
+    if (!top || !container) return;
+    if (!history.hasMore) return;
+    const ac = new AbortController();
+    const io = new IntersectionObserver(
+      (entries) => {
+        if (ac.signal.aborted) return;
+        if (entries[0]?.isIntersecting) history.loadOlder();
+      },
+      { root: container, rootMargin: "200px 0px 0px 0px", threshold: 0 },
+    );
+    io.observe(top);
+    ac.signal.addEventListener("abort", () => io.disconnect());
+    return () => ac.abort();
+  }, [history.loadOlder, history.hasMore, hasMessages]);

-          const p = msg.payload || {};
-          const type = p.activity_type as string;
-          const method = (p.method as string) || "";
-          const status = (p.status as string) || "";
-          const targetId = (p.target_id as string) || "";
-          const durationMs = p.duration_ms as number | undefined;
-          const summary = (p.summary as string) || "";
-
-          let line = "";
-          if (type === "a2a_receive" && method === "message/send") {
-            const targetName = resolveWorkspaceName(targetId || msg.workspace_id);
-            if (status === "ok" && durationMs) {
-              const sec = Math.round(durationMs / 1000);
-              line = `← ${targetName} responded (${sec}s)`;
-              // The platform logs a successful a2a_receive once the workspace
-              // has fully produced its reply. That's the authoritative "done"
-              // signal for the spinner — clear it even if the reply hasn't
-              // surfaced through the store yet (it may be delivered shortly
-              // via pendingAgentMsgs or the HTTP .then()).
-              const own = (targetId || msg.workspace_id) === workspaceId;
-              if (own && sendingFromAPIRef.current) {
-                releaseSendGuards();
-              }
-            } else if (status === "error") {
-              line = `⚠ ${targetName} error`;
-              const own = (targetId || msg.workspace_id) === workspaceId;
-              if (own && sendingFromAPIRef.current) {
-                releaseSendGuards();
-                setError("Agent error (Exception) — see workspace logs for details.");
-              }
-            }
-          } else if (type === "a2a_send") {
-            const targetName = resolveWorkspaceName(targetId);
-            line = `→ Delegating to ${targetName}...`;
-          } else if (type === "task_update") {
-            if (summary) line = `⟳ ${summary}`;
-          } else if (type === "agent_log") {
-            // Per-tool-use telemetry from claude_sdk_executor's
-            // _report_tool_use. The summary already carries an icon
-            // + human-readable args (📄 Read /path, ⚡ Bash: …)
-            // so we render it verbatim. No icon prefix here — the
-            // emoji at the start of summary is the visual marker.
-            if (summary) line = summary;
-          }
-
-          if (line) {
-            setActivityLog((prev) => appendActivityLine(prev, line));
-          }
-        } else if (msg.event === "TASK_UPDATED" && msg.workspace_id === workspaceId) {
-          const task = (msg.payload?.current_task as string) || "";
-          if (task) {
-            setActivityLog((prev) => appendActivityLine(prev, `⟳ ${task}`));
-          }
-        }
-        // A2A_RESPONSE is already consumed by the store and its text is
-        // appended to messages via the pendingAgentMsgs effect above; we
-        // don't need to duplicate it here.
-    } catch { /* ignore */ }
-  });
-
-  const sendMessage = async () => {
+  const handleSend = async () => {
    const text = input.trim();
-    const filesToSend = pendingFiles;
-    // Allow sending if EITHER text OR attachments are present — a user
-    // can drop a file with no text and the agent still receives it.
-    if ((!text && filesToSend.length === 0) || !agentReachable || sending || uploading) return;
-    // Synchronous re-entry guard — see sendInFlightRef comment.
-    if (sendInFlightRef.current) return;
-    sendInFlightRef.current = true;
-
-    // Upload attachments first so we can include URIs in the A2A
-    // message parts. Sequential-before-send: a message with references
-    // to files not yet staged would fail agent-side; staging happens
-    // synchronously via /chat/uploads before message/send dispatch.
-    let uploaded: ChatAttachment[] = [];
-    if (filesToSend.length > 0) {
-      setUploading(true);
-      try {
-        uploaded = await uploadChatFiles(workspaceId, filesToSend);
-      } catch (e) {
-        setUploading(false);
-        sendInFlightRef.current = false;
-        setError(e instanceof Error ? `Upload failed: ${e.message}` : "Upload failed");
-        return;
-      }
-      setUploading(false);
-    }
-
+    const files = pendingFiles;
+    if ((!text && files.length === 0) || !agentReachable || sending || uploading) return;
    setInput("");
    setPendingFiles([]);
-    setMessages((prev) => [...prev, createMessage("user", text, uploaded)]);
-    setSending(true);
-    sendingFromAPIRef.current = true;
+    clearSendError();
    setError(null);
-    // Capture this send's token so the .then()/.catch() callbacks can
-    // detect a newer send that may have superseded them. See the
-    // sendTokenRef declaration for the race scenario this closes.
-    const myToken = ++sendTokenRef.current;
-
-    // Build conversation history from prior messages (last 20)
-    const history = messages
-      .filter((m) => m.role === "user" || m.role === "agent")
-      .slice(-20)
-      .map((m) => ({
-        role: m.role === "user" ? "user" : "agent",
-        parts: [{ kind: "text", text: m.content }],
-      }));
-
-    // A2A parts: text part (if any) + file parts (per attachment). The
-    // agent sees both in a single turn, matching the A2A spec shape.
-    // Wire shape is v0 — see A2APart definition above.
-    const parts: A2APart[] = [];
-    if (text) parts.push({ kind: "text", text });
-    for (const att of uploaded) {
-      parts.push({
-        kind: "file",
-        file: {
-          name: att.name,
-          mimeType: att.mimeType,
-          uri: att.uri,
-          size: att.size,
-        },
-      });
-    }
-
-    // A2A calls can legitimately take minutes — LLM latency +
-    // multi-turn tool use is common on slower providers (Hermes+minimax,
-    // Claude Code invoking bash/file tools, etc.). The 15s default
-    // would silently abort the fetch here, leaving the server to
-    // complete the reply and the user staring at
-    // "agent may be unreachable". Match the upload timeout (60s × 2)
-    // for the happy-path ceiling; anything longer is genuinely stuck.
-    api.post<A2AResponse>(`/workspaces/${workspaceId}/a2a`, {
-      method: "message/send",
-      params: {
-        message: {
-          role: "user",
-          messageId: crypto.randomUUID(),
-          parts,
-        },
-        metadata: { history },
-      },
-    }, { timeoutMs: 120_000 })
-      .then((resp) => {
-        // Bail without touching any flags if a newer sendMessage has
-        // already run — its myToken bumped sendTokenRef, so this is
-        // a stale callback for an earlier message. The newer send
-        // owns the in-flight guards now.
-        if (sendTokenRef.current !== myToken) return;
-        // Skip if the WS A2A_RESPONSE event already handled this response.
-        // Both paths (WS + HTTP) check sendingFromAPIRef — whichever clears
-        // it first wins, the other becomes a no-op (no duplicate messages).
-        if (!sendingFromAPIRef.current) {
-          sendInFlightRef.current = false;
-          return;
-        }
-        const replyText = extractReplyText(resp);
-        const replyFiles = extractFilesFromTask((resp?.result ?? {}) as Record<string, unknown>);
-        if (replyText || replyFiles.length > 0) {
-          setMessages((prev) =>
-            appendMessageDeduped(prev, createMessage("agent", replyText, replyFiles)),
-          );
-        }
-        releaseSendGuards();
-      })
-      .catch(() => {
-        // Stale-callback guard — same rationale as .then().
-        if (sendTokenRef.current !== myToken) return;
-        // Same dedup guard as .then(): if a WS path (pendingAgentMsgs
-        // or ACTIVITY_LOGGED a2a_receive ok) already delivered the
-        // reply, sendingFromAPIRef is already false and there's
-        // nothing to roll back. Surfacing "Failed to send" here would
-        // contradict the agent reply the user is currently reading —
-        // exactly the false-positive observed when the HTTP request
-        // hung up (proxy idle / 502) after WS already won.
-        if (!sendingFromAPIRef.current) {
-          sendInFlightRef.current = false;
-          return;
-        }
-        releaseSendGuards();
-        setError("Failed to send message — agent may be unreachable");
-      });
+    await sendMessage(text, files);
  };

  const onFilesPicked = (fileList: FileList | null) => {
    if (!fileList) return;
    const picked = Array.from(fileList);
-    // Deduplicate against current pending set by name+size — user
-    // picking the same file twice shouldn't append it.
    setPendingFiles((prev) => {
      const keyed = new Set(prev.map((f) => `${f.name}:${f.size}`));
      return [...prev, ...picked.filter((f) => !keyed.has(`${f.name}:${f.size}`))];
@@ -824,35 +272,7 @@ function MyChatPanel({ workspaceId, data }: Props) {
  const removePendingFile = (index: number) =>
    setPendingFiles((prev) => prev.filter((_, i) => i !== index));

-  // Monotonic counter so two paste events within the same wall-clock
-  // second still produce distinct filenames. Without this, on
-  // Firefox (where pasted images have an empty `file.name`), two
-  // pastes ~100ms apart could yield identical synthetic names AND
-  // identical sizes, collapsing into one attachment via the
-  // `name:size` dedup in onFilesPicked.
-  const pasteCounterRef = useRef(0);
-
-  /** Paste-from-clipboard image attachment.
-   *
-   *  Browser clipboard image items arrive as `File`s whose `name` is
-   *  often a generic "image.png" (Chrome) or empty (Firefox/Safari),
-   *  so two consecutive screenshot pastes collide on the name+size
-   *  dedup the file-picker uses. Re-tag each pasted image with a
-   *  per-paste unique name so dedup keeps them apart and the upload
-   *  pipeline (which expects a non-empty filename) is happy.
-   *
-   *  Falls through to onFilesPicked via direct File[] (NOT through
-   *  the DataTransfer constructor — that throws on Safari < 14.1
-   *  and old Edge, silently aborting the paste).
-   *
-   *  Only intercepts the paste when the clipboard has at least one
-   *  image; text-only pastes fall through to the textarea's default
-   *  behaviour. */
  const mimeToExt = (mime: string): string => {
-    // Avoid raw `mime.split("/")[1]` — that yields `"svg+xml"`,
-    // `"jpeg"`, `"webp"` etc. which produce ugly filenames and may
-    // trip server-side extension allowlists. Map known types
-    // explicitly; unknown falls back to a safe default.
    if (mime === "image/svg+xml") return "svg";
    if (mime === "image/jpeg") return "jpg";
    if (mime === "image/png") return "png";
@@ -873,26 +293,16 @@ function MyChatPanel({ workspaceId, data }: Props) {
      const file = item.getAsFile();
      if (!file) continue;
      const ext = mimeToExt(file.type);
-      const stamp = new Date()
-        .toISOString()
-        .replace(/[:.]/g, "-")
-        .slice(0, 19);
+      const stamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
      const seq = pasteCounterRef.current++;
      const fname = `pasted-${stamp}-${seq}-${i}.${ext}`;
      imageFiles.push(new File([file], fname, { type: file.type }));
    }
    if (imageFiles.length === 0) return;
    e.preventDefault();
-    // Reuse the picker path so file-size guards, dedup, and pending-
-    // list state all run through the same code. Build a synthetic
-    // FileList-like object to avoid the DataTransfer constructor —
-    // that's missing on Safari < 14.1 / old Edge and would silently
-    // throw, leaving the paste a no-op.
    addPastedFiles(imageFiles);
  };

-  // Variant of onFilesPicked that accepts a File[] directly, sidestepping
-  // the DataTransfer-FileList round-trip. Same dedup + state shape.
  const addPastedFiles = (files: File[]) => {
    setPendingFiles((prev) => {
      const keyed = new Set(prev.map((f) => `${f.name}:${f.size}`));
@@ -900,11 +310,6 @@ function MyChatPanel({ workspaceId, data }: Props) {
    });
  };

-  // Drag-and-drop staging. dragDepthRef counts enter vs leave events so
-  // the overlay doesn't flicker when the cursor crosses nested children
-  // (textarea, buttons) — dragenter/dragleave fire for every boundary.
-  const [dragOver, setDragOver] = useState(false);
-  const dragDepthRef = useRef(0);
  const dropEnabled = agentReachable && !sending && !uploading;
  const isFileDrag = (e: React.DragEvent) =>
    Array.from(e.dataTransfer.types || []).includes("Files");
@@ -934,9 +339,6 @@ function MyChatPanel({ workspaceId, data }: Props) {
  };

  const downloadAttachment = (att: ChatAttachment) => {
-    // Errors here are rare but user-visible (401 on a revoked token,
-    // 404 if the agent deleted the file). Surface via the inline
-    // error banner — the message list itself stays untouched.
    downloadChatFile(workspaceId, att).catch((e) => {
      setError(e instanceof Error ? `Download failed: ${e.message}` : "Download failed");
    });
@@ -990,26 +392,26 @@ function MyChatPanel({ workspaceId, data }: Props) {
      )}
      {/* Messages */}
      <div ref={containerRef} className="flex-1 overflow-y-auto p-3 space-y-3">
-        {loading && (
+        {history.loading && (
          <div className="text-xs text-ink-mid text-center py-4">Loading chat history...</div>
        )}
-        {!loading && loadError !== null && messages.length === 0 && (
+        {!history.loading && history.loadError !== null && history.messages.length === 0 && (
          <div
            role="alert"
            className="mx-2 mt-2 rounded-lg border border-red-800/50 bg-red-950/30 px-3 py-2.5"
          >
            <p className="text-[11px] text-bad mb-1.5">
-              Failed to load chat history: {loadError}
+              Failed to load chat history: {history.loadError}
            </p>
            <button
-              onClick={loadInitial}
+              onClick={history.loadInitial}
              className="text-[10px] px-2 py-0.5 rounded bg-red-800 text-red-200 hover:bg-red-700 transition-colors"
            >
              Retry
            </button>
          </div>
        )}
-        {!loading && loadError === null && messages.length === 0 && (
+        {!history.loading && history.loadError === null && history.messages.length === 0 && (
          <div className="text-xs text-ink-mid text-center py-8">
            No messages yet. Send a message to start chatting with this agent.
          </div>
@@ -1027,12 +429,12 @@ function MyChatPanel({ workspaceId, data }: Props) {
            instead of showing a "no more messages" footer — the user's
            scroll resting against the top of the conversation IS the
            signal. */}
-        {hasMore && messages.length > 0 && (
+        {history.hasMore && history.messages.length > 0 && (
          <div ref={topRef} className="text-xs text-ink-mid text-center py-1">
-            {loadingOlder ? "Loading older messages…" : " "}
+            {history.loadingOlder ? "Loading older messages…" : " "}
          </div>
        )}
-        {messages.map((msg) => (
+        {history.messages.map((msg) => (
          <div key={msg.id} className={`flex ${msg.role === "user" ? "justify-end" : "justify-start"}`}>
            <div
              className={`max-w-[85%] rounded-lg px-3 py-2 text-xs ${
@@ -1191,22 +593,19 @@ function MyChatPanel({ workspaceId, data }: Props) {
        <div ref={bottomRef} />
      </div>

-      {/* Error banner */}
-      {error && (
-        <div className="px-3 py-2 bg-red-900/20 border-t border-red-800/30">
-          <div className="flex items-center justify-between">
-            <span className="text-[10px] text-red-300">{error}</span>
-            {!isOnline && (
-              <button
-                onClick={() => setConfirmRestart(true)}
-                className="text-[11px] px-2 py-0.5 bg-red-800 text-red-200 rounded hover:bg-red-700"
-              >
-                Restart
-              </button>
-            )}
-          </div>
-        </div>
-      )}
+      {/* Error banner — internal#212: surfaces the secret-safe
+          actionable failure reason that ws-server places on
+          ACTIVITY_LOGGED.error_detail (propagated via
+          useChatSocket → onSendError → setError) and offers a
+          "View activity log" affordance that navigates the user to
+          the Activity tab where the full row lives. The previous
+          inline JSX hardcoded "see workspace logs for details" with
+          no link — there is no separate Logs tab. */}
+      <ChatErrorBanner
+        message={displayError}
+        isOnline={isOnline}
+        onRestart={() => setConfirmRestart(true)}
+      />

      {/* Input */}
      <div className="p-3 border-t border-line">
@@ -1263,7 +662,7 @@ function MyChatPanel({ workspaceId, data }: Props) {
                e.keyCode !== 229
              ) {
                e.preventDefault();
-                sendMessage();
+                handleSend();
              }
            }}
            onPaste={onPasteIntoComposer}
@@ -1273,7 +672,7 @@ function MyChatPanel({ workspaceId, data }: Props) {
            className="flex-1 bg-surface-card border border-line rounded-lg px-3 py-2 text-xs text-ink placeholder-ink-soft dark:bg-zinc-800 dark:border-zinc-600 dark:placeholder-zinc-500 focus:outline-none focus:border-accent focus-visible:ring-2 focus-visible:ring-accent/40 resize-none disabled:opacity-50"
          />
          <button
-            onClick={sendMessage}
+            onClick={handleSend}
            disabled={(!input.trim() && pendingFiles.length === 0) || !agentReachable || sending || uploading}
            className="px-4 py-2 bg-accent-strong hover:bg-accent text-xs font-medium rounded-lg text-white disabled:opacity-30 transition-colors shrink-0"
          >
@@ -81,7 +81,7 @@ function AgentCardSection({ workspaceId }: { workspaceId: string }) {
            spellCheck={false} rows={12}
            className="w-full bg-surface-card border border-line rounded p-2 text-[10px] font-mono text-ink focus:outline-none focus:border-accent resize-none"
          />
-          {error && <div className="px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">{error}</div>}
+          {error && <div role="alert" aria-live="assertive" className="px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">{error}</div>}
          <div className="flex gap-2">
            <button type="button" onClick={handleSave} disabled={saving}
              className="px-2 py-1 bg-accent hover:bg-accent-strong text-[10px] rounded text-white disabled:opacity-50 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-surface">
@@ -109,6 +109,130 @@ function AgentCardSection({ workspaceId }: { workspaceId: string }) {
  );
 }

+// --- Agent Abilities Section ---
+//
+// Always-visible on/off controls for the two workspace-level ability flags
+// (broadcast_enabled, talk_to_user_enabled). Both are mutated through the
+// same admin endpoint the ChatTab recovery banner already uses
+// (PATCH /workspaces/:id/abilities) and reflected into the canvas store node
+// data (broadcastEnabled / talkToUserEnabled) so every surface that reads
+// useCanvasStore.nodes stays consistent without a full re-hydrate.
+//
+// Before this section there was NO canvas control for either flag: the
+// backend was fully wired (workspace_abilities.go / workspace_broadcast.go /
+// agent_message_writer.go, see commit 29b4bffb + internal#510/#511) but the
+// only frontend affordance was the ChatTab recovery banner, which renders
+// solely when talk_to_user_enabled===false and so is invisible under the
+// TRUE default and never existed at all for broadcast.
+function AgentAbilitiesSection({ workspaceId }: { workspaceId: string }) {
+  // Read the live ability flags off the canvas store node — the platform
+  // event stream hydrates these (canvas-topology.ts maps the workspace row's
+  // broadcast_enabled/talk_to_user_enabled onto node data), so this stays in
+  // sync with the recovery banner and avoids a duplicate GET. Mirrors the
+  // store-read pattern used by AgentCardSection above.
+  const node = useCanvasStore((s) =>
+    s.nodes?.find?.((n) => n.id === workspaceId),
+  );
+  // Defaults match the backend column defaults + canvas-topology mapping:
+  // broadcast_enabled defaults FALSE, talk_to_user_enabled defaults TRUE.
+  const broadcastEnabled = node?.data.broadcastEnabled ?? false;
+  const talkToUserEnabled = node?.data.talkToUserEnabled ?? true;
+
+  // Track an in-flight PATCH per field so a double-click can't fire two
+  // racing writes, and surface a one-line error if the server rejects.
+  const [pending, setPending] = useState<null | "broadcast" | "talk">(null);
+  const [error, setError] = useState<string | null>(null);
+
+  const patchAbility = async (
+    which: "broadcast" | "talk",
+    body: { broadcast_enabled: boolean } | { talk_to_user_enabled: boolean },
+    optimistic: Partial<{ broadcastEnabled: boolean; talkToUserEnabled: boolean }>,
+  ) => {
+    setError(null);
+    setPending(which);
+    // Optimistic store update — the toggle flips immediately; on failure we
+    // roll back to the server-truth value the store last held.
+    const prev = {
+      broadcastEnabled,
+      talkToUserEnabled,
+    };
+    useCanvasStore.getState().updateNodeData(workspaceId, optimistic);
+    try {
+      await api.patch(`/workspaces/${workspaceId}/abilities`, body);
+    } catch (e) {
+      // Roll back the optimistic change to last-known server truth.
+      useCanvasStore.getState().updateNodeData(workspaceId, {
+        broadcastEnabled: prev.broadcastEnabled,
+        talkToUserEnabled: prev.talkToUserEnabled,
+      });
+      setError(
+        e instanceof Error ? e.message : "Failed to update ability — try again",
+      );
+    } finally {
+      setPending(null);
+    }
+  };
+
+  return (
+    <Section title="Agent Abilities">
+      <p className="text-[10px] text-ink-mid px-1 pb-1">
+        Workspace-level permissions for this agent. Changes apply immediately
+        (no restart required).
+      </p>
+      <div className="space-y-2">
+        <div>
+          <Toggle
+            label="Talk to user"
+            checked={talkToUserEnabled}
+            onChange={(v) =>
+              pending
+                ? undefined
+                : patchAbility(
+                    "talk",
+                    { talk_to_user_enabled: v },
+                    { talkToUserEnabled: v },
+                  )
+            }
+          />
+          <p className="text-[10px] text-ink-mid mt-0.5 ml-6">
+            When off, the agent&apos;s <code className="font-mono">send_message_to_user</code>{" "}
+            and <code className="font-mono">POST /notify</code> calls are
+            rejected (403) — it must route updates through a parent workspace.
+          </p>
+        </div>
+        <div>
+          <Toggle
+            label="Broadcast to peers"
+            checked={broadcastEnabled}
+            onChange={(v) =>
+              pending
+                ? undefined
+                : patchAbility(
+                    "broadcast",
+                    { broadcast_enabled: v },
+                    { broadcastEnabled: v },
+                  )
+            }
+          />
+          <p className="text-[10px] text-ink-mid mt-0.5 ml-6">
+            When on, the agent may <code className="font-mono">POST /broadcast</code>{" "}
+            to message all non-removed agent workspaces in the org. Off by
+            default — only privileged orchestrators should hold this.
+          </p>
+        </div>
+      </div>
+      {pending && (
+        <div className="mt-2 text-[10px] text-ink-mid">Saving…</div>
+      )}
+      {error && (
+        <div role="alert" aria-live="assertive" className="mt-2 px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">
+          {error}
+        </div>
+      )}
+    </Section>
+  );
+}
+
 // --- Main ConfigTab ---

 interface ModelSpec {
@@ -795,6 +919,7 @@ export function ConfigTab({ workspaceId }: Props) {
                  <label className="text-[10px] text-ink-mid block mb-1">Model</label>
                  <input
                    type="text"
+                    aria-label="Model"
                    value={currentModelId}
                    onChange={(e) => {
                      const v = e.target.value;
@@ -885,6 +1010,8 @@ export function ConfigTab({ workspaceId }: Props) {
            )}
          </Section>

+          <AgentAbilitiesSection workspaceId={workspaceId} />
+
          {/* Claude Settings — shown for claude-code runtime or claude/anthropic model names */}
          {(config.runtime === "claude-code" ||
            (config.runtime_config?.model || config.model || "").toLowerCase().includes("claude") ||
@@ -995,7 +1122,7 @@ export function ConfigTab({ workspaceId }: Props) {
      )}

      {error && (
-        <div className="mx-3 mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">{error}</div>
+        <div role="alert" aria-live="assertive" className="mx-3 mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">{error}</div>
      )}
      {!error && RUNTIMES_WITH_OWN_CONFIG.has(config.runtime || "") && (
        <div className="mx-3 mb-2 px-3 py-1.5 bg-surface-sunken/50 border border-line rounded text-xs text-ink-mid">
@@ -157,7 +157,7 @@ export function DetailsTab({ workspaceId, data }: Props) {
              </select>
            </Field>
            {saveError && (
-              <div className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+              <div role="alert" aria-live="assertive" className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
                {saveError}
              </div>
            )}
@@ -203,7 +203,7 @@ export function DetailsTab({ workspaceId, data }: Props) {
            {isRestartable && (
              <div className="pt-2">
                {restartError && (
-                  <div className="mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+                  <div role="alert" aria-live="assertive" className="mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
                    {restartError}
                  </div>
                )}
@@ -307,7 +307,7 @@ export function DetailsTab({ workspaceId, data }: Props) {
      {/* Delete */}
      <Section title="Danger Zone">
        {deleteError && (
-          <div className="mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+          <div role="alert" aria-live="assertive" className="mb-2 px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
            {deleteError}
          </div>
        )}
@@ -82,7 +82,7 @@ export function EventsTab({ workspaceId }: Props) {
      </div>

      {error && (
-        <div className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+        <div role="alert" aria-live="assertive" className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
          {error}
        </div>
      )}
@@ -102,7 +102,7 @@ export function ExternalConnectionSection({ workspaceId }: Props) {
      </div>

      {error && (
-        <div className="mt-2 px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">
+        <div role="alert" aria-live="assertive" className="mt-2 px-2 py-1 bg-red-900/30 border border-red-800 rounded text-[10px] text-bad">
          {error}
        </div>
      )}
@@ -45,11 +45,54 @@ export function FilesTab({ workspaceId, data }: Props) {
  if (data && isExternalLikeRuntime(data.runtime)) {
    return <NotAvailablePanel runtime={data.runtime} />;
  }
-  return <PlatformOwnedFilesTab workspaceId={workspaceId} />;
+  return <PlatformOwnedFilesTab workspaceId={workspaceId} runtime={data?.runtime} />;
 }

-function PlatformOwnedFilesTab({ workspaceId }: { workspaceId: string }) {
-  const [root, setRoot] = useState("/configs");
+/** Picks the initial root for the FilesTab dropdown based on the
+ *  workspace's runtime. Decision: per-runtime default (Hongming
+ *  2026-05-15, internal#425 Decisions §2).
+ *
+ *  - openclaw → `/agent-home` (the agent's identity/state — the
+ *    user-facing interesting files for that runtime live in
+ *    `~/.openclaw/` inside the container, which `/agent-home` maps to
+ *    via the Phase 2b docker-exec backend).
+ *  - everything else (claude-code, hermes, external-like, undefined)
+ *    → `/configs` (the legacy default — managed config that flows
+ *    through the per-runtime indirection in
+ *    workspace-server/internal/handlers/template_files_eic.go).
+ *
+ *  When the runtime is undefined (legacy callers that don't thread
+ *  `data` through, or a workspace whose runtime field hasn't loaded
+ *  yet) the default is `/configs` — matches today's behaviour, no
+ *  surprise.
+ *
+ *  Note on `/agent-home` pre-Phase-2b: the backend short-circuits
+ *  with HTTP 501 and the canonical "implementation pending" body.
+ *  The tab renders empty + the error banner explains. This is by
+ *  design — lets us land the canvas UX before the backend ships,
+ *  per the RFC's phased rollout. The 501 is graceful: it doesn't
+ *  poison error toasts or generate "workspace not found" noise.
+ *
+ *  Adding a new runtime that should default to `/agent-home`: add it
+ *  to the agentHomeDefaultRuntimes set below. Adding a runtime that
+ *  should default to a different root: extend this function. */
+const agentHomeDefaultRuntimes = new Set(["openclaw"]);
+
+function defaultRootForRuntime(runtime: string | undefined): string {
+  if (runtime && agentHomeDefaultRuntimes.has(runtime)) {
+    return "/agent-home";
+  }
+  return "/configs";
+}
+
+function PlatformOwnedFilesTab({
+  workspaceId,
+  runtime,
+}: {
+  workspaceId: string;
+  runtime?: string;
+}) {
+  const [root, setRoot] = useState(() => defaultRootForRuntime(runtime));
  const [selectedFile, setSelectedFile] = useState<string | null>(null);
  const [fileContent, setFileContent] = useState("");
  const [editContent, setEditContent] = useState("");
@@ -223,7 +266,7 @@ function PlatformOwnedFilesTab({ workspaceId }: { workspaceId: string }) {
        // immediately. Delete-All hovers DARKER (bg-red-700) — same AA
        // contrast trap that bit ConfirmDialog/ApprovalBanner. Cancel
        // lifts to surface-elevated instead of the prior no-op hover.
-        <div role="alertdialog" aria-labelledby="files-delete-all-msg" className="mx-3 mt-2 px-3 py-2 bg-red-950/30 border border-red-800/40 rounded space-y-1.5">
+        <div role="alertdialog" aria-modal="false" aria-labelledby="files-delete-all-msg" className="mx-3 mt-2 px-3 py-2 bg-red-950/30 border border-red-800/40 rounded space-y-1.5">
          <p id="files-delete-all-msg" className="text-xs text-bad">Delete all {files.filter((f) => !f.dir).length} files? This cannot be undone.</p>
          <div className="flex gap-2">
            <button type="button" onClick={() => { handleDeleteAll(); setShowDeleteAll(false); }} className="px-2 py-0.5 bg-red-700 hover:bg-red-600 text-[10px] rounded text-white transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-red-500/60 focus-visible:ring-offset-1 focus-visible:ring-offset-surface">Delete All</button>
@@ -237,7 +280,7 @@ function PlatformOwnedFilesTab({ workspaceId }: { workspaceId: string }) {
      )}

      {confirmDelete && (
-        <div role="alertdialog" aria-labelledby="files-delete-one-msg" className="mx-3 mt-2 px-3 py-2 bg-amber-950/30 border border-amber-800/40 rounded space-y-1.5">
+        <div role="alertdialog" aria-modal="false" aria-labelledby="files-delete-one-msg" className="mx-3 mt-2 px-3 py-2 bg-amber-950/30 border border-amber-800/40 rounded space-y-1.5">
          <p id="files-delete-one-msg" className="text-xs text-warm">Delete <span className="font-mono">{confirmDelete}</span>{files.find((f) => f.path === confirmDelete && f.dir) ? " and all its contents" : ""}?</p>
          <div className="flex gap-2">
            <button type="button" onClick={confirmDeleteFile} className="px-2 py-0.5 bg-red-700 hover:bg-red-600 text-[10px] rounded text-white transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-red-500/60 focus-visible:ring-offset-1 focus-visible:ring-offset-surface">Delete</button>
@@ -3,6 +3,22 @@
 import { useRef } from "react";
 import { getIcon } from "./tree";

+// secretShapeMarker is the canonical body the workspace-server Files
+// API returns when a file's path OR content matched a credential
+// regex (internal#425 RFC, Phase 2b — backed by
+// workspace-server/internal/secrets.ScanBytes). The marker is a
+// fixed prefix so the canvas can detect it without parsing JSON and
+// without round-tripping the matched bytes through the editor (which
+// would defeat the purpose — clipboard, browser history, log
+// surfaces would all see them).
+//
+// Today (Phase 1 / before 2b ships) the backend returns 501 for the
+// only root that uses this path, so the marker is dead code until
+// 2b lands. Wiring it in now keeps the canvas + backend contracts
+// aligned in one PR rather than a follow-up. The constant is
+// importable so a future test can pin the exact string.
+export const SECRET_SHAPE_DENIED_MARKER = "<denied: secret-shape>";
+
 interface Props {
  selectedFile: string | null;
  fileContent: string;
@@ -31,6 +47,22 @@ export function FileEditor({
  const editorRef = useRef<HTMLTextAreaElement>(null);
  const isDirty = editContent !== fileContent;

+  // internal#425 Phase 3: detect the secret-shape denial marker and
+  // render a placeholder instead of the editor. The marker comes
+  // from workspace-server Phase 2b (secrets.ScanBytes) which refuses
+  // to surface the file's bytes. We deliberately don't expose
+  // the matched pattern's Name here — the canvas just shows the
+  // generic denial. The Files API log surface has the Pattern.Name
+  // for operators who need to debug a false positive.
+  const isSecretShapeDenied = fileContent === SECRET_SHAPE_DENIED_MARKER;
+
+  // /agent-home is read-only from the canvas (Phase 2b ships read +
+  // delete; Phase-2b-followup may add write). Edits to /configs are
+  // unchanged. Until 2b ships, /agent-home returns 501 so this
+  // read-only gate is also dead code, but wiring it in now keeps
+  // the UI honest the moment 2b lands without a follow-up canvas PR.
+  const isReadOnlyRoot = root !== "/configs";
+
  if (!selectedFile) {
    return (
      <div className="flex-1 flex items-center justify-center">
@@ -75,11 +107,42 @@ export function FileEditor({
      {/* Editor area */}
      {loadingFile ? (
        <div className="p-4 text-xs text-ink-mid">Loading...</div>
+      ) : isSecretShapeDenied ? (
+        // Files API refused to surface this file's bytes because its
+        // path or content matched a credential regex
+        // (workspace-server/internal/secrets, internal#425 Phase 2b).
+        // We render a placeholder INSTEAD OF the textarea so the
+        // matched bytes never enter the DOM. Clipboard / view-source
+        // / element-inspector all see the placeholder, not the
+        // credential.
+        <div
+          role="region"
+          aria-label="File content denied"
+          className="flex-1 flex items-center justify-center p-6 bg-surface"
+        >
+          <div className="max-w-md text-center space-y-2">
+            <div className="text-2xl opacity-40">🛡️</div>
+            <p className="text-[11px] font-mono text-warm">
+              {SECRET_SHAPE_DENIED_MARKER}
+            </p>
+            <p className="text-[10px] text-ink-mid leading-relaxed">
+              The platform refused to surface this file because its
+              path or content matched a credential-shape pattern.
+              The bytes never left the workspace container.
+            </p>
+            <p className="text-[10px] text-ink-mid leading-relaxed">
+              If this is a false positive (test fixture, docs example,
+              or content that happens to share a credential's shape),
+              rename the file or adjust the content via the workspace
+              terminal so the regex no longer matches, then refresh.
+            </p>
+          </div>
+        </div>
      ) : (
        <textarea
          ref={editorRef}
          value={editContent}
-          readOnly={root !== "/configs"}
+          readOnly={isReadOnlyRoot}
          onChange={(e) => setEditContent(e.target.value)}
          onKeyDown={(e) => {
            if ((e.metaKey || e.ctrlKey) && e.key === "s") {
@@ -38,6 +38,15 @@ export function FilesToolbar({
          <option value="/home">/home</option>
          <option value="/workspace">/workspace</option>
          <option value="/plugins">/plugins</option>
+          {/* internal#425 Phase 1+3: container-internal $HOME root.
+              Backend lands the docker-exec dispatch in Phase 2b. Until
+              then the stub returns 501 with a canonical
+              "implementation pending" message — the dropdown renders
+              the option so the canvas affordance is design-frozen
+              even before the backend ships.
+              Runtime-default selection logic in FilesTab.tsx picks
+              this as the initial value for openclaw workspaces. */}
+          <option value="/agent-home">/agent-home</option>
        </select>
        <span className="text-[10px] text-ink-mid">{fileCount} files</span>
      </div>
@@ -0,0 +1,181 @@
+// @vitest-environment jsdom
+/**
+ * Tests for the /agent-home root selector + per-runtime default-root
+ * + secret-shape denial placeholder (internal#425 Phase 3).
+ *
+ * Separate file so the diff is reviewable as a unit and the existing
+ * FilesToolbar / FileEditor / FilesTab tests don't have to grow
+ * agent-home-specific cases. Once Phase 2b lands, the read-only +
+ * 501-stub assertions here can be tightened (or moved into the main
+ * test file as the agent-home root becomes a first-class affordance).
+ */
+import React from "react";
+import { render, screen, cleanup } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { FilesToolbar } from "../FilesToolbar";
+import {
+  FileEditor,
+  SECRET_SHAPE_DENIED_MARKER,
+} from "../FileEditor";
+
+afterEach(cleanup);
+
+describe("internal#425 Phase 3 — /agent-home root selector", () => {
+  it("dropdown includes /agent-home as an option", () => {
+    // Pins the affordance is in the DOM even pre-Phase-2b — the
+    // canvas design freezes today, the backend lands the dispatch
+    // later. Without this, a future refactor that drops the option
+    // would silently regress the RFC's Phase 1 contract (canvas
+    // visibility) without breaking any other test.
+    render(
+      <FilesToolbar
+        root="/configs"
+        setRoot={vi.fn()}
+        fileCount={0}
+        onNewFile={vi.fn()}
+        onUpload={vi.fn()}
+        onDownloadAll={vi.fn()}
+        onClearAll={vi.fn()}
+        onRefresh={vi.fn()}
+      />,
+    );
+    const select = screen.getByRole("combobox", {
+      name: /file root directory/i,
+    }) as HTMLSelectElement;
+    const values = Array.from(select.options).map((o) => o.value);
+    expect(values).toContain("/agent-home");
+  });
+
+  it("dropdown shows /agent-home as the SELECTED root when prop is /agent-home", () => {
+    render(
+      <FilesToolbar
+        root="/agent-home"
+        setRoot={vi.fn()}
+        fileCount={0}
+        onNewFile={vi.fn()}
+        onUpload={vi.fn()}
+        onDownloadAll={vi.fn()}
+        onClearAll={vi.fn()}
+        onRefresh={vi.fn()}
+      />,
+    );
+    const select = screen.getByRole("combobox", {
+      name: /file root directory/i,
+    }) as HTMLSelectElement;
+    expect(select.value).toBe("/agent-home");
+  });
+});
+
+describe("internal#425 Phase 3 — secret-shape denial placeholder", () => {
+  // Files API Phase 2b returns SECRET_SHAPE_DENIED_MARKER as the file
+  // body when the file's path or content matched a credential regex.
+  // The editor MUST render the marker as a placeholder, not pump it
+  // through the textarea — that would put the marker (and any future
+  // matched bytes if the backend contract changes) into the DOM
+  // value, clipboard, and inspector.
+
+  it("renders the denial placeholder INSTEAD of the textarea when fileContent is the marker", () => {
+    render(
+      <FileEditor
+        selectedFile="agent/.openclaw/secrets.env"
+        fileContent={SECRET_SHAPE_DENIED_MARKER}
+        editContent={SECRET_SHAPE_DENIED_MARKER}
+        setEditContent={vi.fn()}
+        loadingFile={false}
+        saving={false}
+        success={null}
+        root="/agent-home"
+        onSave={vi.fn()}
+        onDownload={vi.fn()}
+      />,
+    );
+    // Placeholder region present
+    expect(
+      screen.getByRole("region", { name: /file content denied/i }),
+    ).toBeTruthy();
+    // Marker text visible (so a debugging operator sees the canonical
+    // contract string without having to dig into the source).
+    expect(screen.getByText(SECRET_SHAPE_DENIED_MARKER)).toBeTruthy();
+    // Critically: NO textarea — the bytes never reach a controlled
+    // input. A regression that re-introduces the textarea path would
+    // make the matched marker (and any future content) selectable +
+    // copyable.
+    expect(screen.queryByRole("textbox")).toBeNull();
+  });
+
+  it("renders the textarea normally when fileContent is regular content", () => {
+    render(
+      <FileEditor
+        selectedFile="config.yaml"
+        fileContent="name: openclaw\n"
+        editContent="name: openclaw\n"
+        setEditContent={vi.fn()}
+        loadingFile={false}
+        saving={false}
+        success={null}
+        root="/configs"
+        onSave={vi.fn()}
+        onDownload={vi.fn()}
+      />,
+    );
+    expect(screen.getByRole("textbox")).toBeTruthy();
+    expect(screen.queryByRole("region", { name: /file content denied/i }))
+      .toBeNull();
+  });
+
+  it("/agent-home renders textarea READ-ONLY for non-denied content", () => {
+    // Phase 2b ships read + delete on /agent-home; write semantics
+    // are decided later. Until then, the canvas presents the editor
+    // as read-only so a user can't type into a buffer that the
+    // backend will refuse to PUT. Without this gate, the user would
+    // edit, hit Save, get a 501, and lose their context for why.
+    render(
+      <FileEditor
+        selectedFile=".openclaw/agent-card.json"
+        fileContent='{"name":"openclaw"}'
+        editContent='{"name":"openclaw"}'
+        setEditContent={vi.fn()}
+        loadingFile={false}
+        saving={false}
+        success={null}
+        root="/agent-home"
+        onSave={vi.fn()}
+        onDownload={vi.fn()}
+      />,
+    );
+    const textarea = screen.getByRole("textbox") as HTMLTextAreaElement;
+    expect(textarea.readOnly).toBe(true);
+  });
+
+  it("/configs renders textarea WRITABLE (regression guard for the read-only gate)", () => {
+    render(
+      <FileEditor
+        selectedFile="config.yaml"
+        fileContent="name: x\n"
+        editContent="name: x\n"
+        setEditContent={vi.fn()}
+        loadingFile={false}
+        saving={false}
+        success={null}
+        root="/configs"
+        onSave={vi.fn()}
+        onDownload={vi.fn()}
+      />,
+    );
+    const textarea = screen.getByRole("textbox") as HTMLTextAreaElement;
+    expect(textarea.readOnly).toBe(false);
+  });
+});
+
+describe("internal#425 Phase 3 — marker constant is the canonical string", () => {
+  // The marker string is part of the canvas <-> workspace-server
+  // contract. The workspace-server emits this exact body; the canvas
+  // detects it by exact-equality. A typo on either side would
+  // silently break detection — the canvas would render the literal
+  // string in the textarea instead of the placeholder. Pin the
+  // contract value here.
+  it("matches the contract value '<denied: secret-shape>'", () => {
+    expect(SECRET_SHAPE_DENIED_MARKER).toBe("<denied: secret-shape>");
+  });
+});
@@ -194,7 +194,7 @@ export function ScheduleTab({ workspaceId }: Props) {
        </span>
        <button
          onClick={() => { resetForm(); setShowForm(true); }}
-          className="text-[11px] px-2 py-0.5 bg-accent-strong/20 text-accent rounded hover:bg-accent-strong/30 transition-colors"
+          className="text-[11px] px-2 py-0.5 bg-accent-strong/20 text-accent rounded hover:bg-accent-strong/30 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
        >
          + Add Schedule
        </button>
@@ -275,7 +275,7 @@ export function ScheduleTab({ workspaceId }: Props) {
              Enabled
            </label>
          </div>
-          {error && <div className="text-[10px] text-bad">{error}</div>}
+          {error && <div role="alert" aria-live="assertive" className="text-[10px] text-bad">{error}</div>}
          <div className="flex gap-2">
            <button
              type="button"
@@ -339,7 +339,7 @@ export function ScheduleTab({ workspaceId }: Props) {
                          ? "Last run OK — click to disable"
                          : "Never run — click to enable"
                      }
-                      className={`w-2 h-2 rounded-full flex-shrink-0 ${
+                      className={`w-2 h-2 rounded-full flex-shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900 ${
                        sched.last_status === "error"
                          ? "bg-red-400"
                          : sched.last_status === "ok"
@@ -376,7 +376,7 @@ export function ScheduleTab({ workspaceId }: Props) {
                  <button
                    onClick={() => handleRunNow(sched)}
                    aria-label={`Run schedule ${sched.name} now`}
-                    className="text-[11px] px-1.5 py-0.5 text-accent hover:bg-accent-strong/20 rounded transition-colors"
+                    className="text-[11px] px-1.5 py-0.5 text-accent hover:bg-accent-strong/20 rounded transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
                    title="Run now"
                  >
                    ▶
@@ -384,7 +384,7 @@ export function ScheduleTab({ workspaceId }: Props) {
                  <button
                    onClick={() => handleEdit(sched)}
                    aria-label={`Edit schedule ${sched.name}`}
-                    className="text-[11px] px-1.5 py-0.5 text-ink-mid hover:bg-surface-card rounded transition-colors"
+                    className="text-[11px] px-1.5 py-0.5 text-ink-mid hover:bg-surface-card rounded transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
                    title="Edit"
                  >
                    ✎
@@ -392,7 +392,7 @@ export function ScheduleTab({ workspaceId }: Props) {
                  <button
                    onClick={() => setPendingDelete({ id: sched.id, name: sched.name })}
                    aria-label={`Delete schedule ${sched.name}`}
-                    className="text-[11px] px-1.5 py-0.5 text-bad hover:bg-red-600/20 rounded transition-colors"
+                    className="text-[11px] px-1.5 py-0.5 text-bad hover:bg-red-600/20 rounded transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-red-400 focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
                    title="Delete"
                  >
                    ✕
--- a/Show More
+++ b/Show More