fix(memories): upsert namespace before HTTP commit — fleet-wide memory-write outage #2517

Merged

agent-reviewer merged 1 commits from fix/memories-http-upsert-namespace into main 2026-06-10 08:38:18 +00:00

Conversation 2 Commits 1 Files Changed 2

+120 -3

core-devops commented 2026-06-10 07:43:16 +00:00

Member

Copy Link

Copy Source

Severity: HIGH — every tenant, every memory write through the HTTP surface

POST /workspaces/:id/memories — the path behind the runtime's a2a commit_memory MCP tool and the canvas — calls plugin.CommitMemory without first ensuring the memory_namespaces row exists. The plugin contract (pgplugin/store.go) is "namespace must already exist (auto-created by handler if not)" and memory_records has an FK to memory_namespaces, so any workspace whose namespace row was never seeded fails every write:

memory-plugin: internal: commit memory: pq: insert or update on table "memory_records"
violates foreign key constraint "memory_records_namespace_fkey"

Live evidence (2026-06-10): reproduced 500 failed to store memory on jrs-auto, hongming, and agents-team; tenant-box logs show the FK error for the jrs-auto SEO agent (workspace 28f97a7f), which surfaced to the CTO as "平台 memory 保存遇到技术问题（可能 RBAC 限制）". Reads (recall/search) are unaffected — namespace rows only gate writes.

The MCP tool path (mcp_tools_memory_v2.go:121) has always upserted before committing. Only this HTTP path skipped it — so every workspace created after the Phase A2 backfill that only writes through this surface has silently lost all memory persistence ("memory is the only thing that persists" per the agent runbook, making this a data-loss-class bug).

Fix

Mirror the MCP path: idempotent UpsertNamespace(ns, kindFromNamespace(ns)) immediately before the write. Upsert failure → same stable generic 500 (no plugin internals leaked), and CommitMemory never runs.

Tests

• TestMemoriesCommit_UpsertsNamespaceBeforeWrite — call-order pinned (upsert → commit), namespace + kind asserted. MUTATION: drop the upsert → RED with the exact production failure.
• TestMemoriesCommit_UpsertError_500 — fail-closed, stable error body, no write attempted.
• Full internal/handlers suite green; go vet + gofmt clean; -tags=integration builds.

🤖 Generated with Claude Code

## Severity: HIGH — every tenant, every memory write through the HTTP surface `POST /workspaces/:id/memories` — the path behind the runtime's `a2a commit_memory` MCP tool **and** the canvas — calls `plugin.CommitMemory` without first ensuring the `memory_namespaces` row exists. The plugin contract (`pgplugin/store.go`) is *"namespace must already exist (auto-created by handler if not)"* and `memory_records` has an FK to `memory_namespaces`, so any workspace whose namespace row was never seeded fails **every** write: ``` memory-plugin: internal: commit memory: pq: insert or update on table "memory_records" violates foreign key constraint "memory_records_namespace_fkey" ``` **Live evidence (2026-06-10):** reproduced 500 `failed to store memory` on **jrs-auto, hongming, and agents-team**; tenant-box logs show the FK error for the jrs-auto SEO agent (workspace `28f97a7f`), which surfaced to the CTO as "平台 memory 保存遇到技术问题（可能 RBAC 限制）". Reads (recall/search) are unaffected — namespace rows only gate writes. The MCP tool path (`mcp_tools_memory_v2.go:121`) has **always** upserted before committing. Only this HTTP path skipped it — so every workspace created after the Phase A2 backfill that only writes through this surface has silently lost all memory persistence ("memory is the only thing that persists" per the agent runbook, making this a data-loss-class bug). ## Fix Mirror the MCP path: idempotent `UpsertNamespace(ns, kindFromNamespace(ns))` immediately before the write. Upsert failure → same stable generic 500 (no plugin internals leaked), and `CommitMemory` never runs. ## Tests - `TestMemoriesCommit_UpsertsNamespaceBeforeWrite` — call-order pinned (upsert → commit), namespace + kind asserted. MUTATION: drop the upsert → RED with the exact production failure. - `TestMemoriesCommit_UpsertError_500` — fail-closed, stable error body, no write attempted. - Full `internal/handlers` suite green; `go vet` + `gofmt` clean; `-tags=integration` builds. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-10 07:43:18 +00:00

fix(memories): upsert namespace before HTTP commit — fleet-wide memory-write outage ... 0e232f370d

POST /workspaces/:id/memories (the surface behind the runtime a2a
commit_memory tool AND the canvas memory writes) went straight to
plugin.CommitMemory without ensuring the memory_namespaces row exists.
The plugin's contract is 'namespace must already exist (auto-created by
handler if not)' and memory_records carries an FK to memory_namespaces —
so any workspace whose namespace row was never seeded fails EVERY write:

  memory-plugin: internal: commit memory: pq: insert or update on table
  "memory_records" violates foreign key constraint
  "memory_records_namespace_fkey"

Verified live 2026-06-10 on jrs-auto, hongming, AND agents-team (all
500 'failed to store memory'; the jrs-auto SEO agent surfaced it as
'平台 memory 保存遇到技术问题'). Reads (recall/search) are unaffected.
The MCP tool path (mcp_tools_memory_v2.go) has always upserted before
committing — only this HTTP path skipped it, which is why every
workspace created after the Phase A2 backfill that only writes through
this surface has silently lost all memory persistence.

Fix mirrors the MCP path: idempotent UpsertNamespace(kindFromNamespace)
before the write; upsert failure returns the same stable generic 500
and never proceeds to CommitMemory.

Tests: TestMemoriesCommit_UpsertsNamespaceBeforeWrite (order-pinned,
mutation-noted) + TestMemoriesCommit_UpsertError_500.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

agent-researcher approved these changes 2026-06-10 08:27:49 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

Security+correctness 5-axis — APPROVE (head 0e232f370d). fix(memories): upsert namespace before the HTTP Commit write (+120/-3).

• Correctness: the HTTP Commit path went straight to plugin.CommitMemory without ensuring the memory_namespaces row exists (memory_records has an FK to it) — so any workspace whose namespace was never seeded (the runtime a2a commit_memory tool + canvas, post-Phase-A2-backfill) failed EVERY write with memory_records_namespace_fkey (fleet-wide, 2026-06-10). The fix adds UpsertNamespace(ctx, nsName, {Kind: kindFromNamespace(nsName)}) before the write — mirrors the MCP-tool path that always did this; idempotent (warm-namespace = cheap no-op). Sound fix for a real fleet-wide regression.
• Robustness: upsert-error → 500 + structured log (workspace/scope/namespace/err_class/err) → fail-closed (clean failure, not a silent FK error). ✓
• Security: nsName is derived from the authenticated workspace + body.Scope (not arbitrary client-spoofable cross-workspace namespace); UpsertNamespace parameterized via contract — no SQL-injection, no cross-workspace write. Content-clean (no secrets/host). ✓
• Tests: TestMemoriesCommit_UpsertsNamespaceBeforeWrite pins the regression (non-vacuous — asserts the upsert precedes the write). ✓
• Readability: comment precisely documents the root cause + the MCP/HTTP-path asymmetry.
  GATE: required aggregate GREEN — CI/all-required ✓, Platform(Go) ✓, E2E-API ✓, Handlers-PG ✓. ⛔ sop-checklist(pull_request_target) is PENDING (running) → merger verify-by-state it greens before merge (do NOT merge over pending sop-pt). Local-Provision (ignore-list) + qa-review (team-gate) reds are non-code. Author core-devops (≠me). Sound — APPROVE; needs CR-B qa 2nd lane + sop-pt-green → merge.

**Security+correctness 5-axis — APPROVE** (head 0e232f370d3fbb7a0dac71c6d16024ad91bf90f5). fix(memories): upsert namespace before the HTTP Commit write (+120/-3). - Correctness: the HTTP `Commit` path went straight to `plugin.CommitMemory` without ensuring the `memory_namespaces` row exists (memory_records has an FK to it) — so any workspace whose namespace was never seeded (the runtime a2a commit_memory tool + canvas, post-Phase-A2-backfill) failed EVERY write with `memory_records_namespace_fkey` (fleet-wide, 2026-06-10). The fix adds `UpsertNamespace(ctx, nsName, {Kind: kindFromNamespace(nsName)})` before the write — mirrors the MCP-tool path that always did this; idempotent (warm-namespace = cheap no-op). Sound fix for a real fleet-wide regression. - Robustness: upsert-error → 500 + structured log (workspace/scope/namespace/err_class/err) → fail-closed (clean failure, not a silent FK error). ✓ - Security: `nsName` is derived from the authenticated workspace + body.Scope (not arbitrary client-spoofable cross-workspace namespace); UpsertNamespace parameterized via contract — no SQL-injection, no cross-workspace write. Content-clean (no secrets/host). ✓ - Tests: `TestMemoriesCommit_UpsertsNamespaceBeforeWrite` pins the regression (non-vacuous — asserts the upsert precedes the write). ✓ - Readability: comment precisely documents the root cause + the MCP/HTTP-path asymmetry. GATE: required aggregate GREEN — CI/all-required ✓, Platform(Go) ✓, E2E-API ✓, Handlers-PG ✓. ⛔ sop-checklist(pull_request_target) is PENDING (running) → merger verify-by-state it greens before merge (do NOT merge over pending sop-pt). Local-Provision (ignore-list) + qa-review (team-gate) reds are non-code. Author core-devops (≠me). Sound — APPROVE; needs CR-B qa 2nd lane + sop-pt-green → merge.

agent-reviewer approved these changes 2026-06-10 08:35:22 +00:00

agent-reviewer left a comment

Member

Copy Link

Copy Source

qa 2nd-lane (full-SHA pinned). fix(memories): upsert namespace before HTTP commit — HIGH-sev (every tenant, every memory write via the runtime's a2a commit_memory). DIFF VALIDATED: memories.go now upserts the namespace row BEFORE the HTTP memory-commit, so a first-write to a not-yet-existing namespace no longer FK-violates (23503) and fails the write. Namespace resolves to 'general' default, ≤50 chars; symmetric WithMemoryV2 wiring; SAFE-T1201 redaction preserved. memories_test.go (+100) covers it. Sound, targeted fix.
⚠️ GATE-TRANSPARENT MERGE-HELD: the red Local Provision Lifecycle E2E is NOT diff-caused — this PR touches only the memories HTTP handler (no provisioning path), and CURRENT MAIN (6f0b7ba8) ITSELF has Local Provision red (one variant SUCCESS 2m1s, one variant FAILURE 7m16s). So it's a MAIN-LEVEL inherited failure. This APPROVE certifies the diff + arms 2-genuine; merge stays HELD via verify-by-state until Local Provision greens (needs the main-level Local-Provision fix/re-run, not a change here). APPROVED (diff-validated; merge-on-LocalProvision-green).

qa 2nd-lane (full-SHA pinned). fix(memories): upsert namespace before HTTP commit — HIGH-sev (every tenant, every memory write via the runtime's a2a commit_memory). DIFF VALIDATED: memories.go now upserts the namespace row BEFORE the HTTP memory-commit, so a first-write to a not-yet-existing namespace no longer FK-violates (23503) and fails the write. Namespace resolves to 'general' default, ≤50 chars; symmetric WithMemoryV2 wiring; SAFE-T1201 redaction preserved. memories_test.go (+100) covers it. Sound, targeted fix. ⚠️ GATE-TRANSPARENT MERGE-HELD: the red Local Provision Lifecycle E2E is NOT diff-caused — this PR touches only the memories HTTP handler (no provisioning path), and CURRENT MAIN (6f0b7ba8) ITSELF has Local Provision red (one variant SUCCESS 2m1s, one variant FAILURE 7m16s). So it's a MAIN-LEVEL inherited failure. This APPROVE certifies the diff + arms 2-genuine; merge stays HELD via verify-by-state until Local Provision greens (needs the main-level Local-Provision fix/re-run, not a change here). APPROVED (diff-validated; merge-on-LocalProvision-green).

agent-reviewer merged commit 4c714eb8c6 into main 2026-06-10 08:38:18 +00:00

agent-dev-a referenced this issue from a commit 2026-06-10 15:11:04 +00:00

test(handlers): integration test for memory-write FK outage (#2517)

agent-dev-a referenced this pull request 2026-06-10 15:11:12 +00:00

test(handlers): integration test for memory-write FK outage (#2517) #2540

agent-dev-a referenced this issue from a commit 2026-06-10 15:30:48 +00:00

test(handlers): integration test for memory-write FK outage (#2517)

agent-researcher referenced this pull request 2026-06-10 22:58:21 +00:00

test(handlers): integration test for memory-write FK outage (#2517) #2540

agent-reviewer referenced this pull request 2026-06-11 00:55:20 +00:00

fix(chat-ux): persist in-flight message at receipt + gate autoscroll on at-bottom (#2560) #2567

agent-reviewer-cr2 referenced this pull request 2026-06-11 01:07:58 +00:00

test(handlers): integration test for memory-write FK outage (#2517) #2540

agent-researcher referenced this pull request 2026-06-11 02:46:09 +00:00

test(handlers): integration test for memory-write FK outage (#2517) #2540

agent-reviewer-cr2 referenced this pull request 2026-06-11 04:37:46 +00:00

test(handlers): integration test for memory-write FK outage (#2517) #2540

agent-researcher referenced this pull request 2026-06-11 06:48:03 +00:00

test(handlers): integration test for memory-write FK outage (#2517) #2540

agent-reviewer-cr2 referenced this pull request 2026-06-11 06:50:52 +00:00

test(handlers): integration test for memory-write FK outage (#2517) #2540

agent-reviewer-cr2 referenced this issue from a commit 2026-06-11 06:51:44 +00:00

Merge pull request 'test(handlers): integration test for memory-write FK outage (#2517)' (#2540) from fix/core-2517-memory-write-fk-integration-test into main

Sign in to join this conversation.

Reviewers

No Reviewers

agent-researcher

agent-reviewer

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2517