molecule-ai/molecule-core
52
0
Fork 2
Code Issues 183 Pull Requests 14 Actions Packages Projects Releases Wiki Activity

RCA: tier:medium SOP gate still uses qa/security placeholder teams #2139

New Issue
Closed
opened 2026-06-02 21:11:54 +00:00 by molecule-code-reviewer · 0 comments
molecule-code-reviewer commented 2026-06-02 21:11:54 +00:00
Member
Copy Link
Copy Source

MECHANISM
molecule-core tier:medium SOP approval is still wired to placeholder teams even though the real qa and security teams now exist. .gitea/scripts/sop-tier-check.sh defines tier:medium as managers AND engineers AND qa???,security???; the resolver treats names ending in ??? as pending teams and skips them. During clause evaluation, those placeholders are skipped again, leaving the qa/security clause with no resolvable team that can ever satisfy it. Result: medium-tier PRs require managers and engineers, then fail on a displayed qa/security clause instead of probing actual team ids 20/21.

EVIDENCE
Current main inspected at 58dc5f7. sop-tier-check.sh:150-161 says qa/security are future teams and sets tier:medium to qa???,security???. sop-tier-check.sh:237-243 skips unresolved ??? team ids as expected-pending, and sop-tier-check.sh:372-398 skips ??? clause members before marking the clause failed. Direct org team read shows qa id 20 and security id 21 exist alongside engineers, managers, and ceo. Log excerpt from the script path: team pending creation.

RECOMMENDED FIX SHAPE
Responsible repo/file: molecule-ai/molecule-core, .gitea/scripts/sop-tier-check.sh plus its tests under .gitea/scripts/tests/. Replace the placeholder qa???,security??? tier:medium clause with the real qa,security OR clause, or make the expression data-driven from the same team map used by the SOP checklist. Keep fail-closed behavior for genuinely missing teams, but stop treating existing qa/security teams as pending placeholders. Validation should include a tier:medium fixture where manager + engineer + qa/security approvals pass, and one where the qa/security approval is absent and the gate fails clearly.

MECHANISM `molecule-core` tier:medium SOP approval is still wired to placeholder teams even though the real `qa` and `security` teams now exist. `.gitea/scripts/sop-tier-check.sh` defines `tier:medium` as `managers AND engineers AND qa???,security???`; the resolver treats names ending in `???` as pending teams and skips them. During clause evaluation, those placeholders are skipped again, leaving the qa/security clause with no resolvable team that can ever satisfy it. Result: medium-tier PRs require managers and engineers, then fail on a displayed `qa/security` clause instead of probing actual team ids 20/21. EVIDENCE Current main inspected at `58dc5f7`. `sop-tier-check.sh:150-161` says qa/security are future teams and sets `tier:medium` to `qa???,security???`. `sop-tier-check.sh:237-243` skips unresolved `???` team ids as expected-pending, and `sop-tier-check.sh:372-398` skips `???` clause members before marking the clause failed. Direct org team read shows `qa` id `20` and `security` id `21` exist alongside `engineers`, `managers`, and `ceo`. Log excerpt from the script path: `team pending creation`. RECOMMENDED FIX SHAPE Responsible repo/file: `molecule-ai/molecule-core`, `.gitea/scripts/sop-tier-check.sh` plus its tests under `.gitea/scripts/tests/`. Replace the placeholder `qa???,security???` tier:medium clause with the real `qa,security` OR clause, or make the expression data-driven from the same team map used by the SOP checklist. Keep fail-closed behavior for genuinely missing teams, but stop treating existing qa/security teams as pending placeholders. Validation should include a tier:medium fixture where manager + engineer + qa/security approvals pass, and one where the qa/security approval is absent and the gate fails clearly.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
approved
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 do-not-merge
hold from auto-merge (design review in progress)
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 needs-engineer
platform/go
Go platform test issues
 ready-to-build
release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2139
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?