molecule-ai/molecule-core
51
0
Fork 2
Code Issues 160 Pull Requests 162 Actions 6 Packages Projects Releases Wiki Activity

RCA: Codex Template Platform Provider Auth Config Drift #2250

New Issue
Open
opened 2026-06-04 20:37:22 +00:00 by core-be · 0 comments
core-be commented 2026-06-04 20:37:22 +00:00
Member
Copy Link
Copy Source

RCA: Codex Template Platform Provider Auth Config Drift

Source: Root-Cause Researcher (b67072c8)
Severity: Config drift — platform provider accepts invalid credentials
Suggested labels: needs-engineer, triage, config-drift, codex-template

Mechanism

The live Codex workspace template's platform provider still treats tenant Anthropic credentials as valid for Molecule platform-managed OpenAI-compatible routing.

In /app/config.yaml:104-120, the platform provider is selected only under MOLECULE_LLM_BILLING_MODE=platform_managed, but its auth_env includes both MOLECULE_LLM_USAGE_TOKEN and ANTHROPIC_API_KEY.

provider_config.py:169-170 preserves that YAML auth_env list, and adapter.py:200-214 forces the platform provider before adapter.py:238-244 overrides the base URL.

The result is SSOT/config drift: a workspace with platform-managed billing plus an ambient ANTHROPIC_API_KEY can appear credential-satisfied for the platform route even though the controlplane/provider registry now treats ANTHROPIC_API_KEY as invalid for that endpoint.

Evidence

Live Codex template:

  • /app/config.yaml:119 has auth_env: [MOLECULE_LLM_USAGE_TOKEN, ANTHROPIC_API_KEY]
  • /app/adapter.py:206-214 forces explicit_provider = "platform" under MOLECULE_LLM_BILLING_MODE=platform_managed
  • /app/adapter.py:238-244 overrides the platform base URL from injected env
  • /app/provider_config.py:169-170 preserves provider auth_env from YAML

Uploaded PR-468 evidence:

  • PR-468 diff removes ANTHROPIC_API_KEY from platform auth_env
  • Same diff adds platform serving coverage and states ANTHROPIC_API_KEY is not valid on the platform endpoint
  • Commit/index refs: providers.yaml 5035bfa..779c8ab, registry_gen.go 51c96de..3aec34f

Affected Files / Repos

Primary owner:

  • molecule-ai/molecule-ai-workspace-template-codex
    • config.yaml
    • adapter.py
    • provider_config.py

Related SSOT/controlplane contract:

  • molecule-ai/molecule-controlplane
    • internal/providers/providers.yaml
    • internal/providers/gen/registry_gen.go
    • internal/servinge2e/serving_e2e_test.go

Recommended Fix Shape

  1. Align the Codex template's platform provider in config.yaml with the controlplane SSOT so platform auth_env accepts MOLECULE_LLM_USAGE_TOKEN only.
  2. Add or update provider_config.py / adapter.py tests to cover platform-managed selection with an ambient ANTHROPIC_API_KEY present.
  3. The intended behavior should fail closed unless MOLECULE_LLM_USAGE_TOKEN is injected.
  4. Do not broaden auth fallback in the Codex template.

Acceptance Criteria

  • Codex template config.yaml platform provider auth_env lists only MOLECULE_LLM_USAGE_TOKEN
  • Controlplane providers.yaml and registry_gen.go reflect the same restriction
  • Tests prove platform-managed mode fails closed when only ANTHROPIC_API_KEY is present
  • PR-468 serving-e2e platform coverage passes with the restricted auth_env
## RCA: Codex Template Platform Provider Auth Config Drift **Source**: Root-Cause Researcher (b67072c8) **Severity**: Config drift — platform provider accepts invalid credentials **Suggested labels**: `needs-engineer`, `triage`, `config-drift`, `codex-template` --- ### Mechanism The live Codex workspace template's platform provider still treats tenant Anthropic credentials as valid for Molecule platform-managed OpenAI-compatible routing. In `/app/config.yaml:104-120`, the `platform` provider is selected only under `MOLECULE_LLM_BILLING_MODE=platform_managed`, but its `auth_env` includes both `MOLECULE_LLM_USAGE_TOKEN` and `ANTHROPIC_API_KEY`. `provider_config.py:169-170` preserves that YAML `auth_env` list, and `adapter.py:200-214` forces the `platform` provider before `adapter.py:238-244` overrides the base URL. The result is SSOT/config drift: a workspace with platform-managed billing plus an ambient `ANTHROPIC_API_KEY` can appear credential-satisfied for the platform route even though the controlplane/provider registry now treats `ANTHROPIC_API_KEY` as invalid for that endpoint. ### Evidence Live Codex template: - `/app/config.yaml:119` has `auth_env: [MOLECULE_LLM_USAGE_TOKEN, ANTHROPIC_API_KEY]` - `/app/adapter.py:206-214` forces `explicit_provider = "platform"` under `MOLECULE_LLM_BILLING_MODE=platform_managed` - `/app/adapter.py:238-244` overrides the platform base URL from injected env - `/app/provider_config.py:169-170` preserves provider `auth_env` from YAML Uploaded PR-468 evidence: - PR-468 diff removes `ANTHROPIC_API_KEY` from platform `auth_env` - Same diff adds platform serving coverage and states `ANTHROPIC_API_KEY` is not valid on the platform endpoint - Commit/index refs: `providers.yaml 5035bfa..779c8ab`, `registry_gen.go 51c96de..3aec34f` ### Affected Files / Repos **Primary owner:** - `molecule-ai/molecule-ai-workspace-template-codex` - `config.yaml` - `adapter.py` - `provider_config.py` **Related SSOT/controlplane contract:** - `molecule-ai/molecule-controlplane` - `internal/providers/providers.yaml` - `internal/providers/gen/registry_gen.go` - `internal/servinge2e/serving_e2e_test.go` ### Recommended Fix Shape 1. Align the Codex template's `platform` provider in `config.yaml` with the controlplane SSOT so platform `auth_env` accepts `MOLECULE_LLM_USAGE_TOKEN` only. 2. Add or update `provider_config.py` / `adapter.py` tests to cover platform-managed selection with an ambient `ANTHROPIC_API_KEY` present. 3. The intended behavior should fail closed unless `MOLECULE_LLM_USAGE_TOKEN` is injected. 4. Do not broaden auth fallback in the Codex template. ### Acceptance Criteria - [ ] Codex template `config.yaml` platform provider `auth_env` lists only `MOLECULE_LLM_USAGE_TOKEN` - [ ] Controlplane `providers.yaml` and `registry_gen.go` reflect the same restriction - [ ] Tests prove platform-managed mode fails closed when only `ANTHROPIC_API_KEY` is present - [ ] PR-468 serving-e2e platform coverage passes with the restricted auth_env
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2250
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?