Merge branch 'main' into fix/stdio-clean

Rename the canonical function to `_assert_stdio_is_pipe_compatible`
with a deprecated alias `_warn_if_stdio_not_pipe` for backward
compat. Updates all 5 test import sites.

Fixes dangling monkeypatch targets in test_a2a_mcp_server_http.py
(which patches `_assert_stdio_is_pipe_compatible`; main's source
defined the old name, causing patches to silently no-op).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/review-refire-comments.yml

@@ -18,10 +18,6 @@ permissions:
   pull-requests: read
   statuses: write
 
-concurrency:
-  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.event.issue.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   dispatch:
     runs-on: ubuntu-latest

.gitea/workflows/sop-checklist.yml

@@ -70,7 +70,7 @@ name: sop-checklist
 # Cancel any in-progress runs for the same PR to prevent
 # stale runs from overwriting newer status contexts.
 concurrency:
-  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
+  group: ${{ github.repository }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 # bp-required: yes  ← emits sop-checklist / all-items-acked (pull_request)

.gitea/workflows/sop-tier-check.yml

@@ -61,10 +61,6 @@ on:
   pull_request_review:
     types: [submitted, dismissed, edited]
 
-concurrency:
-  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   tier-check:
     runs-on: ubuntu-latest

workspace-server/internal/handlers/activity_test.go

@@ -63,31 +63,6 @@ func TestSessionSearchReturnsActivityAndMemory(t *testing.T) {
 	}
 }
 
-func TestSessionSearch_DBError(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	handler := NewActivityHandler(broadcaster)
-
-	mock.ExpectQuery("WITH session_items AS").
-		WillReturnError(context.DeadlineExceeded)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-123/session-search?q=test", bytes.NewBufferString(""))
-	c.Request.Header.Set("Content-Type", "application/json")
-	c.Params = gin.Params{{Key: "id", Value: "ws-123"}}
-
-	handler.SessionSearch(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 on DB error, got %d", w.Code)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
 // ---------- Activity List source filter ----------
 
 func TestActivityList_SourceCanvas(t *testing.T) {

workspace-server/internal/handlers/delegation_test.go

@@ -543,33 +543,6 @@ func TestDelegationRecord_RejectsInvalidUUID(t *testing.T) {
 	}
 }
 
-func TestDelegationRecord_DBInsertFails(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	wh := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
-	h := NewDelegationHandler(wh, broadcaster)
-
-	mock.ExpectExec("INSERT INTO activity_logs").
-		WillReturnError(fmt.Errorf("connection refused"))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
-	body := `{"target_id":"550e8400-e29b-41d4-a716-446655440001","task":"hello","delegation_id":"del-xyz"}`
-	c.Request = httptest.NewRequest("POST", "/delegations/record", bytes.NewBufferString(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	h.Record(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 on DB insert failure, got %d", w.Code)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
 func TestDelegationUpdateStatus_CompletedInsertsResultRow(t *testing.T) {
 	mock := setupTestDB(t)
 	setupTestRedis(t)

workspace-server/internal/handlers/external_connection.go

@@ -646,12 +646,8 @@ const externalOpenClawTemplate = `# OpenClaw MCP config — outbound tool path.
 # external machine today, pair with the Python SDK tab.
 
 # 1. Install openclaw CLI + the workspace runtime wheel:
-#    The version pin (>=0.1.999) ensures the "molecule-mcp" console
-#    script is present — it is what keeps the workspace ALIVE on canvas
-#    (register-on-startup + 20s heartbeat). Older versions only ship
-#    a2a_mcp_server which does not heartbeat.
 npm install -g openclaw@latest
-pip install "molecule-ai-workspace-runtime>=0.1.999"
+pip install molecule-ai-workspace-runtime
 
 # 2. Onboard openclaw against your model provider (one-time setup).
 #    --non-interactive needs an explicit --provider + --model so it