fix(workspace-server): rename workspace_secrets MODEL_PROVIDER → MODEL + drop legacy fallback #1581

Merged

core-devops merged 1 commits from fix/workspace-server-rename-MODEL_PROVIDER-to-MODEL into main 2026-05-19 22:31:24 +00:00

Conversation 3 Commits 1 Files Changed 6

+284 -75

core-be commented 2026-05-19 22:21:25 +00:00

Member

Copy Link

Copy Source

Root cause

The workspace_secrets row holding a picked model id was keyed MODEL_PROVIDER — a misleading name that bled into applyRuntimeModelEnv’s fallback chain. When the secrets loader hydrated envVars["MODEL_PROVIDER"] with the row value (often a provider slug like minimax or a runtime name like claude-code, neither a valid model id), applyRuntimeModelEnv used it as a fallback and the slug propagated to CP user-data as the picked model. Adapters then wedged at SDK initialize.

Caught in failed-workspace 95ed3ff2 (2026-05-02) and again as the Researcher 67941000 / Reviewer 95e6487f poisoning 2026-05-19 — root-cause refs ab12af50 + a7e8892.

CP-side slot-separation already merged via cp#213 + cp#220. This is the workspace-server companion.

Changes

File	Change
workspace-server/internal/handlers/secrets.go	GetModel / setModelSecret (SELECT + INSERT + DELETE): key MODEL_PROVIDER → MODEL
workspace-server/internal/handlers/workspace_provision.go	applyRuntimeModelEnv: drop the line-817 envVars["MODEL_PROVIDER"] fallback so a stale legacy row can never leak into envVars["MODEL"]
workspace-server/migrations/20260519000000_workspace_secrets_model_provider_rename.{up,down}.sql	Idempotent rename of any pre-existing MODEL_PROVIDER rows; on conflict the existing MODEL row wins
secrets_test.go + workspace_provision_shared_test.go	Pin literal 'MODEL' in all sqlmock regexes; new TestSecretsModel_RoundTrip + new TestApplyRuntimeModelEnv_StaleMODELPROVIDERNeverLeaksIntoMODEL regression guard

Before / after

Before (secrets.go):

VALUES ($1, 'MODEL_PROVIDER', $2, $3)

After:

VALUES ($1, 'MODEL', $2, $3)

Before (workspace_provision.go):

if model == "" { model = envVars["MODEL"] }
if model == "" { model = envVars["MODEL_PROVIDER"] }  // <-- the slug-fallback bug

After:

if model == "" { model = envVars["MODEL"] }
// MODEL_PROVIDER fallback dropped; rename migration handles legacy rows.

Migration

In-PR. Idempotent (re-running on already-renamed schema is a no-op). On (workspace_id, MODEL) conflict the existing MODEL row wins (persona-env files commonly set MODEL=... directly, so the more-canonical value is preserved). Currently-poisoned workspaces (Researcher 67941000, Reviewer 95e6487f) are being recreated in parallel via fresh-reprovision dispatch abe512c2 — not in scope here; the migration still ships so any other poisoned workspace gets cleaned automatically on rollout.

Breaking changes for consumers

• The env var MODEL_PROVIDER continues to be honoured by the Python runtime (workspace/config.py) as a legacy fallback for already-running containers. No change there.
• The workspace_secrets row name MODEL_PROVIDER is renamed to MODEL. External scripts that read that row directly will need to migrate. None known: canvas + CP both go through the SecretsHandler API which is updated here.

Tests

• go build ./... clean
• go vet ./... clean
• go test ./internal/handlers/ -count=1 PASS (15.9s)
• Added: TestSecretsModel_RoundTrip_KeyIsMODELNotMODEL_PROVIDER
• Added: TestApplyRuntimeModelEnv_StaleMODELPROVIDERNeverLeaksIntoMODEL
• Updated to pin 'MODEL' literal: TestSecretsGetModel_Default, TestSecretsGetModel_DBError, TestSecretsSetModel_Upsert, TestSecretsSetModel_EmptyClears, TestWorkspaceCreate_FirstDeploy_PersistsModelAndProvider, TestWorkspaceCreate_FirstDeploy_UnknownModel_OnlyMintModelProvider, TestApplyRuntimeModelEnv_SetsUniversalMODELForAllRuntimes, TestApplyRuntimeModelEnv_PersonaEnvMODELSecretPreserved

Refs

• ab12af50, a7e8892 (root-cause analyses)
• cp#213, cp#220 (CP-side prior art)
• internal#226 (misnomer guard background)
• feedback_passwords_in_chat_are_burned — no creds in this PR

Review queue

Per molecule-core: core-devops + core-security + core-qa 3-reviewer relay.

---

🤖 Generated with Claude Code

## Root cause The `workspace_secrets` row holding a picked model id was keyed `MODEL_PROVIDER` — a misleading name that bled into `applyRuntimeModelEnv`’s fallback chain. When the secrets loader hydrated `envVars["MODEL_PROVIDER"]` with the row value (often a provider slug like `minimax` or a runtime name like `claude-code`, neither a valid model id), `applyRuntimeModelEnv` used it as a fallback and the slug propagated to CP user-data as the *picked model*. Adapters then wedged at SDK initialize. Caught in failed-workspace `95ed3ff2` (2026-05-02) and again as the **Researcher `67941000` / Reviewer `95e6487f` poisoning 2026-05-19** — root-cause refs `ab12af50` + `a7e8892`. CP-side slot-separation already merged via **cp#213 + cp#220**. This is the workspace-server companion. ## Changes | File | Change | |---|---| | `workspace-server/internal/handlers/secrets.go` | `GetModel` / `setModelSecret` (SELECT + INSERT + DELETE): key `MODEL_PROVIDER` → `MODEL` | | `workspace-server/internal/handlers/workspace_provision.go` | `applyRuntimeModelEnv`: drop the line-817 `envVars["MODEL_PROVIDER"]` fallback so a stale legacy row can never leak into `envVars["MODEL"]` | | `workspace-server/migrations/20260519000000_workspace_secrets_model_provider_rename.{up,down}.sql` | Idempotent rename of any pre-existing `MODEL_PROVIDER` rows; on conflict the existing `MODEL` row wins | | `secrets_test.go` + `workspace_provision_shared_test.go` | Pin literal `'MODEL'` in all sqlmock regexes; new `TestSecretsModel_RoundTrip` + new `TestApplyRuntimeModelEnv_StaleMODELPROVIDERNeverLeaksIntoMODEL` regression guard | ## Before / after **Before** (`secrets.go`): ```go VALUES ($1, 'MODEL_PROVIDER', $2, $3) ``` **After**: ```go VALUES ($1, 'MODEL', $2, $3) ``` **Before** (`workspace_provision.go`): ```go if model == "" { model = envVars["MODEL"] } if model == "" { model = envVars["MODEL_PROVIDER"] } // <-- the slug-fallback bug ``` **After**: ```go if model == "" { model = envVars["MODEL"] } // MODEL_PROVIDER fallback dropped; rename migration handles legacy rows. ``` ## Migration In-PR. Idempotent (re-running on already-renamed schema is a no-op). On `(workspace_id, MODEL)` conflict the existing `MODEL` row wins (persona-env files commonly set `MODEL=...` directly, so the more-canonical value is preserved). Currently-poisoned workspaces (Researcher `67941000`, Reviewer `95e6487f`) are being recreated in parallel via fresh-reprovision dispatch `abe512c2` — not in scope here; the migration still ships so any *other* poisoned workspace gets cleaned automatically on rollout. ## Breaking changes for consumers - The **env var** `MODEL_PROVIDER` continues to be honoured by the Python runtime (`workspace/config.py`) as a legacy fallback for already-running containers. No change there. - The **`workspace_secrets` row name** `MODEL_PROVIDER` is renamed to `MODEL`. External scripts that read that row directly will need to migrate. None known: canvas + CP both go through the `SecretsHandler` API which is updated here. ## Tests - `go build ./...` clean - `go vet ./...` clean - `go test ./internal/handlers/ -count=1` PASS (15.9s) - Added: `TestSecretsModel_RoundTrip_KeyIsMODELNotMODEL_PROVIDER` - Added: `TestApplyRuntimeModelEnv_StaleMODELPROVIDERNeverLeaksIntoMODEL` - Updated to pin `'MODEL'` literal: `TestSecretsGetModel_Default`, `TestSecretsGetModel_DBError`, `TestSecretsSetModel_Upsert`, `TestSecretsSetModel_EmptyClears`, `TestWorkspaceCreate_FirstDeploy_PersistsModelAndProvider`, `TestWorkspaceCreate_FirstDeploy_UnknownModel_OnlyMintModelProvider`, `TestApplyRuntimeModelEnv_SetsUniversalMODELForAllRuntimes`, `TestApplyRuntimeModelEnv_PersonaEnvMODELSecretPreserved` ## Refs - `ab12af50`, `a7e8892` (root-cause analyses) - `cp#213`, `cp#220` (CP-side prior art) - `internal#226` (misnomer guard background) - `feedback_passwords_in_chat_are_burned` — no creds in this PR ## Review queue Per molecule-core: `core-devops` + `core-security` + `core-qa` 3-reviewer relay. --- 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-be added 1 commit 2026-05-19 22:21:25 +00:00

fix(workspace-server): rename workspace_secrets MODEL_PROVIDER -> MODEL + drop legacy fallback ... 58aee78519

Root cause: the workspace_secrets row that holds a picked model id was
keyed MODEL_PROVIDER — a misleading name that bled into the
applyRuntimeModelEnv fallback chain. When the workspace_secrets loader
hydrated envVars["MODEL_PROVIDER"] with the row value (often a provider
slug like "minimax" or a runtime name like "claude-code", neither a
valid model id), applyRuntimeModelEnv used it as a fallback and the
slug propagated to CP user-data as the picked model. Adapters then
wedged at SDK initialize. Caught in failed-workspace 95ed3ff2
(2026-05-02) and again as the Researcher 67941000 / Reviewer 95e6487f
poisoning 2026-05-19 — abe512c2 root-cause analysis (ab12af50 + a7e8892).

CP-side slot-separation already merged via cp#213 + cp#220. This is the
workspace-server companion.

Changes:
- secrets.go GetModel/setModelSecret: workspace_secrets key
  'MODEL_PROVIDER' -> 'MODEL' (read + write + delete)
- workspace_provision.go applyRuntimeModelEnv: drop the MODEL_PROVIDER
  fallback (line 817) so a stale legacy row left from before the
  migration can never leak into envVars["MODEL"]
- 20260519000000_workspace_secrets_model_provider_rename.{up,down}.sql:
  idempotent rename of any pre-existing 'MODEL_PROVIDER' rows; on
  conflict the existing 'MODEL' row wins (persona-env files commonly
  set MODEL=... directly so the more-canonical value is preserved)
- Tests updated to pin the literal 'MODEL' key in all sqlmock regexes
  + new TestSecretsModel_RoundTrip + new
  TestApplyRuntimeModelEnv_StaleMODELPROVIDERNeverLeaksIntoMODEL
  regression guard

Currently-poisoned workspaces (Researcher 67941000, Reviewer 95e6487f)
are being handled in parallel via fresh-reprovision dispatch abe512c2
— not in scope here. The migration still ships so any other poisoned
workspace gets cleaned on rollout.

Backwards compatibility: the env-var MODEL_PROVIDER continues to be
honoured by the Python runtime (workspace/config.py) as a legacy env-
var fallback for already-running containers; only the workspace_secrets
column name + the workspace-server-side envVars fallback are renamed/
dropped. External scripts that read workspace_secrets rows directly
keyed 'MODEL_PROVIDER' will need to migrate to 'MODEL' (none known —
canvas + CP both go through the SecretsHandler API).

Refs: ab12af50, a7e8892, cp#213, cp#220, internal#226

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core-devops approved these changes 2026-05-19 22:30:53 +00:00

core-devops left a comment

Member

Copy Link

Copy Source

APPROVE — core-devops axis. CI/all-required is green. Migration 20260519000000 is idempotent (WHERE NOT EXISTS + DELETE leftover MODEL_PROVIDER rows), and runs automatically on next workspace-server deploy. The applyRuntimeModelEnv fallback at workspace_provision.go:817 (model = envVars["MODEL_PROVIDER"]) is correctly removed — that was the abe512c2 finding root-cause. Up/down migration symmetry is documented and accepts the discard-on-rollback tradeoff. No deploy-side risk.

APPROVE — core-devops axis. CI/all-required is green. Migration 20260519000000 is idempotent (WHERE NOT EXISTS + DELETE leftover MODEL_PROVIDER rows), and runs automatically on next workspace-server deploy. The applyRuntimeModelEnv fallback at workspace_provision.go:817 (model = envVars["MODEL_PROVIDER"]) is correctly removed — that was the abe512c2 finding root-cause. Up/down migration symmetry is documented and accepts the discard-on-rollback tradeoff. No deploy-side risk.

core-security approved these changes 2026-05-19 22:30:53 +00:00

core-security left a comment

Member

Copy Link

Copy Source

APPROVE — core-security axis. Zero new attack surface: no secrets, no exfil paths, no new IO. workspace_secrets continues to use the same encrypted_value + encryption_version columns. Rename is row-level, no schema/index change, no privilege change. Down migration is intentionally lossy in the destructive-DELETE direction, but the loss is bounded to duplicate MODEL_PROVIDER rows that the up migration discarded; surviving MODEL row carries the canonical value. No PII/credential implication.

APPROVE — core-security axis. Zero new attack surface: no secrets, no exfil paths, no new IO. workspace_secrets continues to use the same encrypted_value + encryption_version columns. Rename is row-level, no schema/index change, no privilege change. Down migration is intentionally lossy in the destructive-DELETE direction, but the loss is bounded to duplicate MODEL_PROVIDER rows that the up migration discarded; surviving MODEL row carries the canonical value. No PII/credential implication.

core-qa approved these changes 2026-05-19 22:30:53 +00:00

core-qa left a comment

Member

Copy Link

Copy Source

APPROVE — core-qa axis. Test coverage is correct: TestSecretsModel_RoundTrip_KeyIsMODELNotMODEL_PROVIDER pins the literal MODEL key on both SetModel INSERT and GetModel SELECT — a regression to MODEL_PROVIDER would fail the sqlmock expectation. TestWorkspaceCreate_FirstDeploy_PersistsModelAndProvider re-anchored on word-boundary MODEL (not MODEL_PROVIDER substring). 2 net-new tests + 8 re-anchored as advertised. CI/all-required green at 22:28Z. Migration is idempotent so re-deploys are safe.

APPROVE — core-qa axis. Test coverage is correct: TestSecretsModel_RoundTrip_KeyIsMODELNotMODEL_PROVIDER pins the literal MODEL key on both SetModel INSERT and GetModel SELECT — a regression to MODEL_PROVIDER would fail the sqlmock expectation. TestWorkspaceCreate_FirstDeploy_PersistsModelAndProvider re-anchored on word-boundary MODEL (not MODEL_PROVIDER substring). 2 net-new tests + 8 re-anchored as advertised. CI/all-required green at 22:28Z. Migration is idempotent so re-deploys are safe.

core-devops merged commit e89f0ce605 into main 2026-05-19 22:31:24 +00:00

core-devops deleted branch fix/workspace-server-rename-MODEL_PROVIDER-to-MODEL 2026-05-19 22:31:24 +00:00

core-devops referenced this issue from a commit 2026-05-19 22:31:25 +00:00

fix(workspace-server): rename workspace_secrets MODEL_PROVIDER → MODEL (#1581)

Sign in to join this conversation.

Reviewers

No Reviewers

core-devops

core-security

core-qa

Labels

Clear labels

area/ci

CI/CD pipeline issues

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

4 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#1581