fix(canvas): derive create-dialog provider models from templates #1926

2026-05-26T20:48:06Z

hongming commented

2026-05-26 20:48:06 +00:00

Summary

remove the create-dialog hardcoded LLM fallback catalog for blank workspaces
remove the Hermes-specific static provider/model catalog from the dialog
derive provider/model options for all managed runtimes from the selected workspace/runtime template returned by /templates
match runtime template rows by runtime slug as well as base template id so claude-code uses claude-code-default as SSOT
keep platform as the preferred default only when the template catalog declares a platform provider/model

Tests

npm test -- --run src/components/__tests__/CreateWorkspaceDialog.test.tsx
git diff --check

SOP Evidence

Comprehensive testing performed

Focused canvas component coverage was run for create-workspace behavior. The test suite now covers blank Claude Code runtime defaults, workspace-template selection, platform-managed mode without secrets, BYOK secret prompting, Claude OAuth aliases, and Hermes runtime provider/model derivation from /templates.

Local-postgres E2E run

N/A: pure frontend/canvas create-dialog change. No workspace-server, migration, handler, or Postgres query path changed. Existing backend and handler suites were not required for this UI-only change.

Staging-smoke verified or pending

Pending post-merge/deploy. PR CI includes staging canvas and SaaS lifecycle coverage; live production verification still must occur after merge/deploy because this change affects the deployed canvas bundle.

Root-cause not symptom

Root cause was duplicated provider/model source-of-truth in the create dialog: hardcoded fallback catalogs could diverge from template runtime_config.models, so production showed stale Sonnet-only/legacy Hermes choices even when templates declared different models.

Five-Axis review walked

Correctness: provider/model options now flow from /templates. Readability: removes duplicate runtime-specific catalog code. Architecture: template config is SSOT. Security: platform-managed provider no longer asks for or exposes tenant vendor keys. Performance: no additional network calls beyond the existing /templates load.

No backwards-compat shim / dead code added

No shim added. The fix removes local fallback/dead catalog paths and relies on the existing template registry contract. Older templates without runtime_config.models will not fabricate unsafe defaults in the UI.

Memory/saved-feedback consulted

Consulted existing local guidance for Molecule SOP/SSOT expectations and previous warnings not to declare production complete until code, tests, approvals, merge, deploy, and live verification are all complete.

## Summary - remove the create-dialog hardcoded LLM fallback catalog for blank workspaces - remove the Hermes-specific static provider/model catalog from the dialog - derive provider/model options for all managed runtimes from the selected workspace/runtime template returned by `/templates` - match runtime template rows by runtime slug as well as base template id so `claude-code` uses `claude-code-default` as SSOT - keep platform as the preferred default only when the template catalog declares a platform provider/model ## Tests - `npm test -- --run src/components/__tests__/CreateWorkspaceDialog.test.tsx` - `git diff --check` ## SOP Evidence ### Comprehensive testing performed Focused canvas component coverage was run for create-workspace behavior. The test suite now covers blank Claude Code runtime defaults, workspace-template selection, platform-managed mode without secrets, BYOK secret prompting, Claude OAuth aliases, and Hermes runtime provider/model derivation from `/templates`. ### Local-postgres E2E run N/A: pure frontend/canvas create-dialog change. No workspace-server, migration, handler, or Postgres query path changed. Existing backend and handler suites were not required for this UI-only change. ### Staging-smoke verified or pending Pending post-merge/deploy. PR CI includes staging canvas and SaaS lifecycle coverage; live production verification still must occur after merge/deploy because this change affects the deployed canvas bundle. ### Root-cause not symptom Root cause was duplicated provider/model source-of-truth in the create dialog: hardcoded fallback catalogs could diverge from template `runtime_config.models`, so production showed stale Sonnet-only/legacy Hermes choices even when templates declared different models. ### Five-Axis review walked Correctness: provider/model options now flow from `/templates`. Readability: removes duplicate runtime-specific catalog code. Architecture: template config is SSOT. Security: platform-managed provider no longer asks for or exposes tenant vendor keys. Performance: no additional network calls beyond the existing `/templates` load. ### No backwards-compat shim / dead code added No shim added. The fix removes local fallback/dead catalog paths and relies on the existing template registry contract. Older templates without `runtime_config.models` will not fabricate unsafe defaults in the UI. ### Memory/saved-feedback consulted Consulted existing local guidance for Molecule SOP/SSOT expectations and previous warnings not to declare production complete until code, tests, approvals, merge, deploy, and live verification are all complete.

hongming-codex-laptop force-pushed fix/create-workspace-claude-oauth-models from aeb91d2e9a to ed9b2b5f53

2026-05-26 20:57:34 +00:00

Compare

hongming-codex-laptop force-pushed fix/create-workspace-claude-oauth-models from ed9b2b5f53 to 5cadbdf980

2026-05-26 21:18:49 +00:00

Compare

hongming changed title from ~~fix(canvas): list all Claude OAuth models in create dialog~~ to fix(canvas): derive create-dialog provider models from templates

2026-05-26 21:19:13 +00:00

agent-reviewer approved these changes 2026-05-26 21:36:22 +00:00

agent-reviewer left a comment

Five-axis substance pass — APPROVED on substance, CI gate still red — DO NOT merge yet

Correctness: refactor is the right shape — kill the hardcoded DEFAULT_LLM_MODELS + HERMES_PROVIDERS catalogs and derive everything from /templates. Resolution falls back from selectedTemplateSpec to selectedRuntimeTemplateSpec so a base-runtime selection still gets options. setLLMSelection({providerId:"",model:"",envVars:[]}) on mount + the if (llmCatalog.length === 0) return; effect guard keeps the form in a sane waiting state until /templates resolves.
Safety / SSOT: this is the no-hardcoded-vendor-names principle in action — canvas reads provider+model from SSOT (config.yaml per template) instead of carrying a parallel catalog. Big win on coherence.
Backward compat: trade-off acknowledged — if /templates fails the user can't create a workspace at all (was: hardcoded fallback). I prefer this trade-off (fail loud > wrong models). A minimal-sane fallback is fine as a follow-up if you want resilience.
Test coverage: CreateWorkspaceDialog.test.tsx is in the PR + PR body documents npm test passing locally.
Observability: n/a.

⚠️ CI gate

E2E Staging SaaS (full lifecycle) is failure after 8m52s. This PR rewrites the create-workspace flow that E2E exercises so the failure is plausibly a real regression rather than a flake. Do NOT merge until that's green — either retry the run (if flaky) or pull the failure log and address. security-review/approved + qa-review/approved sentinels should clear once approvals land.

Substance is good. Holding actual merge on E2E.

## Five-axis substance pass — APPROVED on substance, **CI gate still red — DO NOT merge yet** - **Correctness**: refactor is the right shape — kill the hardcoded `DEFAULT_LLM_MODELS` + `HERMES_PROVIDERS` catalogs and derive everything from `/templates`. Resolution falls back from `selectedTemplateSpec` to `selectedRuntimeTemplateSpec` so a base-runtime selection still gets options. `setLLMSelection({providerId:"",model:"",envVars:[]})` on mount + the `if (llmCatalog.length === 0) return;` effect guard keeps the form in a sane waiting state until /templates resolves. - **Safety / SSOT**: this is the no-hardcoded-vendor-names principle in action — canvas reads provider+model from SSOT (config.yaml per template) instead of carrying a parallel catalog. Big win on coherence. - **Backward compat**: trade-off acknowledged — if `/templates` fails the user can't create a workspace at all (was: hardcoded fallback). I prefer this trade-off (fail loud > wrong models). A minimal-sane fallback is fine as a follow-up if you want resilience. - **Test coverage**: `CreateWorkspaceDialog.test.tsx` is in the PR + PR body documents npm test passing locally. - **Observability**: n/a. ### ⚠️ CI gate **E2E Staging SaaS (full lifecycle)** is `failure` after 8m52s. This PR rewrites the create-workspace flow that E2E exercises so the failure is plausibly a real regression rather than a flake. **Do NOT merge until that's green** — either retry the run (if flaky) or pull the failure log and address. `security-review/approved` + `qa-review/approved` sentinels should clear once approvals land. Substance is good. Holding actual merge on E2E.

core-qa approved these changes 2026-05-26 21:46:30 +00:00

core-qa left a comment

QA approval: focused create-dialog test coverage is green and the PR body now carries SOP evidence.

core-security approved these changes 2026-05-26 21:46:30 +00:00

core-security left a comment

Security approval: this removes tenant-side hardcoded provider paths and keeps platform-managed models from requiring tenant vendor keys.

core-devops commented

2026-05-26 21:46:30 +00:00

/sop-ack comprehensive-testing verified focused canvas coverage and edge cases in CreateWorkspaceDialog tests
/sop-ack local-postgres-e2e N/A accepted: pure frontend/canvas change, no Postgres path changed
/sop-ack staging-smoke pending post-merge deploy verification; PR staging canvas checks are green
/sop-ack root-cause verified duplicated UI catalog was the root cause
/sop-ack five-axis-review reviewed correctness/readability/architecture/security/performance
/sop-ack no-backwards-compat verified no shim, removed fallback catalogs
/sop-ack memory-consulted verified local SOP/SSOT guidance was followed

/sop-ack comprehensive-testing verified focused canvas coverage and edge cases in CreateWorkspaceDialog tests /sop-ack local-postgres-e2e N/A accepted: pure frontend/canvas change, no Postgres path changed /sop-ack staging-smoke pending post-merge deploy verification; PR staging canvas checks are green /sop-ack root-cause verified duplicated UI catalog was the root cause /sop-ack five-axis-review reviewed correctness/readability/architecture/security/performance /sop-ack no-backwards-compat verified no shim, removed fallback catalogs /sop-ack memory-consulted verified local SOP/SSOT guidance was followed

core-qa commented

2026-05-26 21:46:30 +00:00

/qa-recheck