chore(sync): back-merge main into staging — manual bridge while Class D auto-sync plumbs (#165) #27

Closed

claude-ceo-assistant wants to merge 11 commits from chore/backsync-main-into-staging-task-166 into staging

pull from: chore/backsync-main-into-staging-task-166

merge into: molecule-ai:staging

molecule-ai:main

molecule-ai:fix/175-env-matched-pair-guard

molecule-ai:fix/vitest-pool-worker-startup-timeouts

molecule-ai:refactor/sop-tier-check-extract-script

molecule-ai:fix/sop-tier-check-pr-target-security

molecule-ai:ci/sop-tier-check-deploy

molecule-ai:fix/issue53-admin-token-pair-guard

molecule-ai:fix/org-import-started-event-name

molecule-ai:refactor/delete-uses-cascade-helper

molecule-ai:fix/org-import-reconcile-and-audit

molecule-ai:fix/preserve-model-secret-on-restart

molecule-ai:feat/persona-bind-mount-local-dev

molecule-ai:feat/canary-tier-filter

molecule-ai:feat/plugin-version-subscription

molecule-ai:feat/plugin-hot-reload-classifier

molecule-ai:feat/plugin-atomic-install

molecule-ai:feat/air-hot-reload-dev

molecule-ai:feat/persona-env-injection

molecule-ai:fix/external-resolver-hardening

molecule-ai:fix/issue75-class-D-gh-api-to-gitea-rest

molecule-ai:fix/cherry-3-files-vitest-postgres-e2eapi

molecule-ai:fix/promote-vitest-postgres-fixes

molecule-ai:fix/saas-plugin-install-eic

molecule-ai:fix/issue-94-e2e-api-parallel-safe-class-b

molecule-ai:migrate/issue-71-vanity-imports

molecule-ai:fix/handlers-postgres-port-collision-class-b

molecule-ai:fix/issue-96-canvas-vitest-cold-start-timeout

molecule-ai:fix/hermes-agent-doc-gitea-migration

molecule-ai:fix/196-retarget-main-to-staging-gitea-rest

molecule-ai:fix/gitea-ci-flakes-issue-88

molecule-ai:fix/pin-upload-artifact-v3-gitea

molecule-ai:fix/issue-72-auto-sync-token-canary-v2

molecule-ai:fix/issue75-class-F-gh-run-list-to-statuses

molecule-ai:fix/issue75-class-A-gh-pr-to-gitea-rest

molecule-ai:feat/issue-63-local-build-from-gitea-v2

molecule-ai:fix/195-auto-promote-staging-gitea-rest

molecule-ai:fix/144-branch-protection-check-name-parity-audit

molecule-ai:fix/harness-replays-pre-clone-manifest

molecule-ai:chore/trigger-auto-sync-verification

molecule-ai:fix/codeql-stub-on-gitea-156

molecule-ai:chore/issue173-retrigger-after-ecr-repo-create

molecule-ai:fix/issue173-inline-aws-ecr-login

molecule-ai:fix/issue173-shell-docker-push

molecule-ai:chore/retrigger-harness-replays-post-class-g

molecule-ai:fix/issue173-buildx-driver-and-cache

molecule-ai:fix/post-suspension-clone-manifest

molecule-ai:fix/issue173-followup-platform-dockerfile

molecule-ai:fix/post-suspension-github-urls

molecule-ai:fix/170-goroutine-bleed-test-isolation

molecule-ai:fix/issue173-publish-workspace-server-image

molecule-ai:fix/issue36-a2a-proxy-preflight

molecule-ai:fix/codeql-continue-on-error-156

molecule-ai:feat/demo-mock-3-bigorg-mock-runtime

molecule-ai:feat/demo-mock-1-purchase-success-modal

molecule-ai:fix/publish-path-filter-add-scripts

molecule-ai:fix/clone-manifest-gitea

molecule-ai:chore/touch-publish-workflow-to-trigger

molecule-ai:chore/retrigger-publish-post-aws-secrets

molecule-ai:chore/cherry-pick-pr23-into-main

molecule-ai:fix/auto-sync-use-devops-token

molecule-ai:chore/retrigger-staging-on-fixed-runner-image

molecule-ai:chore/drop-github-app-auth-and-ecr-swap

molecule-ai:docs/readme-comprehensive-refresh-2026-05-06

molecule-ai:feat/rfc-2945-pr-c-2-canvas-chat-history

molecule-ai:fix/issue10-runtime-aware-plugin-install

molecule-ai:fix/s8-bind-loopback-dev

molecule-ai:fix/14-cascade-gitea-dispatch

molecule-ai:docs/molecule-core-bulk-sed

molecule-ai:chore/pin-artifact-actions-v3

molecule-ai:fix/lowercase-org-slug

molecule-ai:fix/script-ghcr-and-lint-paths

molecule-ai:docs/workspace-runtime-readme-source-edit

molecule-ai:feat/eic-tunnel-pool-core-11

molecule-ai:chore/rfc-2945-pr-c-3-delete-historyhydration

molecule-ai:fix/2872-sqlmock-regex-tightening

molecule-ai:fix/cp-orphan-sweeper-2989

molecule-ai:feat/registry-prefix-env-driven-issue-6

molecule-ai:docs/readme-refresh-2026-05-06

Conversation 0 Commits 11 Files Changed 15 +586 -29

claude-ceo-assistant commented 2026-05-07 14:04:19 +00:00

Owner

Copy Link

Task #166 — manual back-sync per Hongming directive 2026-05-07.

Why

main had 9 commits not on staging, including:

• fix(workspace-server) SSOT-route container check + 422 on external (S-8 follow-up)
• fix(workspace-server) default-bind to 127.0.0.1 in dev-mode fail-open (S-8)
• fix(ci) lowercase molecule-ai/ in cross-repo workflow refs

staging had 27 commits not on main (in-flight features). They were diverged — 3-way merge.

staging E2E that runs against staging head was testing OLD code. The S-8 dev-mode fail-open fix is the urgent one.

Conflicts resolved

Four workflow files where staging has post-suspension changes from PR#23 (drop github-app-auth + GHCR→ECR) that main hasn't received:

• .github/workflows/codeql.yml
• .github/workflows/harness-replays.yml
• .github/workflows/publish-runtime.yml
• .github/workflows/publish-workspace-server-image.yml

Resolution: kept staging's side (--ours). Main's pre-suspension version would re-introduce the github-app-auth dependency that core#23 already removed.

Constraint compliance

• Per feedback_use_merge_commits_not_squash: merge commit, NOT squash.
• Did NOT touch demo path or prod tenant resources.

Next

After this lands, future direct-to-main commits auto-sync via controlplane#29 + core#26 (#165 plumbing) — no more manual bridges needed.

Task #166 — manual back-sync per Hongming directive 2026-05-07. ## Why `main` had 9 commits not on `staging`, including: - `fix(workspace-server)` SSOT-route container check + 422 on external (S-8 follow-up) - `fix(workspace-server)` default-bind to 127.0.0.1 in dev-mode fail-open (S-8) - `fix(ci)` lowercase `molecule-ai/` in cross-repo workflow refs staging had 27 commits not on main (in-flight features). They were diverged — 3-way merge. staging E2E that runs against staging head was testing OLD code. The S-8 dev-mode fail-open fix is the urgent one. ## Conflicts resolved Four workflow files where staging has post-suspension changes from PR#23 (drop github-app-auth + GHCR→ECR) that main hasn't received: - `.github/workflows/codeql.yml` - `.github/workflows/harness-replays.yml` - `.github/workflows/publish-runtime.yml` - `.github/workflows/publish-workspace-server-image.yml` Resolution: kept staging's side (`--ours`). Main's pre-suspension version would re-introduce the github-app-auth dependency that core#23 already removed. ## Constraint compliance - Per `feedback_use_merge_commits_not_squash`: merge commit, NOT squash. - Did NOT touch demo path or prod tenant resources. ## Next After this lands, future direct-to-main commits auto-sync via `controlplane#29` + `core#26` (#165 plumbing) — no more manual bridges needed.

claude-ceo-assistant added 10 commits 2026-05-07 14:04:20 +00:00

fix(workspace-server): default-bind to 127.0.0.1 in dev-mode fail-open ... f3187ea0c1

In dev mode (`MOLECULE_ENV=dev|development`, `ADMIN_TOKEN` unset) the
AdminAuth chain fails open by design so canvas at :3000 can call
workspace-server at :8080 without a bearer token. Combined with the
existing wildcard bind on `:8080`, that exposed unauthenticated
`POST /workspaces` to any same-LAN peer (S-8 in the audit RFC v1).

Couple the bind narrowness to the same signal that drives the auth
fail-open: when `middleware.IsDevModeFailOpen()` returns true, default
the listener to `127.0.0.1`. Production (`ADMIN_TOKEN` set) keeps
binding to all interfaces — its auth chain is doing the work. Operators
who need LAN exposure set `BIND_ADDR=<host>` explicitly.

* `cmd/server/main.go` — `resolveBindHost()` precedence: BIND_ADDR
  explicit > IsDevModeFailOpen() loopback > "" (all interfaces).
  Startup log line now includes the resolved bind + dev-mode-fail-open
  state for post-deploy auditing.
* `cmd/server/bind_test.go` — 8 t.Setenv table cases covering
  precedence, explicit overrides, dev/prod env words. Mutation-tested:
  removing the `IsDevModeFailOpen()` branch makes the dev-mode cases
  fail with "" vs "127.0.0.1".

Refs: molecule-core#7

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(workspace-server): SSOT-route container check + 422 on external runtimes ... c1de2287fd

Two coupled fixes for molecule-core#10 (plugin install 503 vs
status=online split-state):

1. SSOT for "is this workspace's container running" — `findRunningContainer`
   in plugins.go used to carry its own copy of `cli.ContainerInspect`, which
   collapsed transient daemon errors into the same `""` return as a
   genuinely-stopped container. Healthsweep's `Provisioner.IsRunning`
   handled the same input correctly (defensive). Promote the inspect logic
   to `provisioner.RunningContainerName`, route both consumers through it.
   Transient errors get a distinct log line on the plugins side so triage
   doesn't confuse a flaky daemon with a stopped container.

2. Runtime-aware Install/Uninstall — `runtime='external'` workspaces have
   no local container; push-install via docker exec is meaningless. They
   pull plugins via the download endpoint instead (Phase 30.3). Without a
   guard they fell through to `findRunningContainer` and 503'd with a
   misleading "container not running." Add an early 422 with a hint
   pointing at the download endpoint.

The two fixes are independent: (1) preserves correctness when the SSOT
helper is later modified; (2) eliminates the persistent split-state on
the 5 external persona-agent workspaces in this DB (and on tenant
deployments hitting the same shape).

* `internal/provisioner/provisioner.go` — new `RunningContainerName(ctx,
  cli, id) (string, error)` with three documented outcomes (running /
  stopped / transient). `Provisioner.IsRunning` now wraps it; behavior
  preserved.
* `internal/handlers/plugins.go` — `findRunningContainer` shimmed onto
  `RunningContainerName`; new `isExternalRuntime(id)` predicate.
* `internal/handlers/plugins_install.go` — Install + Uninstall reject
  external runtimes with 422 + hint, before the source-fetch step.
* `internal/handlers/plugins_install_external_test.go` — 5 cases:
  external→422, uninstall-external→422, container-backed-falls-through,
  no-runtime-lookup-fails-open, lookup-error-fails-open.
* `internal/handlers/plugins_findrunning_ssot_test.go` — two AST gates
  pin the SSOT routing so future PRs can't silently re-introduce the
  parallel impl. Mutation-tested: reverting either consumer to a direct
  `ContainerInspect` makes the gate fail.

Refs: molecule-core#10

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(ci): lowercase 'molecule-ai/' in cross-repo workflow refs ... e01077be38

Gitea is case-sensitive on owner slugs; canonical is lowercase
`molecule-ai/...`. Mixed-case `Molecule-AI/...` refs fail-at-0s
when the runner tries to resolve the cross-repo workflow / checkout.

Same fix as molecule-controlplane#12. Mechanical case-correction;
no behavior change beyond making CI resolve again.

Refs: internal#46

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Merge pull request 'fix(ci): lowercase 'molecule-ai/' in cross-repo workflow refs' (#17) from fix/lowercase-org-slug into main f2f5338183

Merge branch 'main' into fix/s8-bind-loopback-dev a674a6547e

Merge branch 'main' into fix/issue10-runtime-aware-plugin-install b72d1d3f26

Merge pull request 'fix(workspace-server): default-bind to 127.0.0.1 in dev-mode fail-open (closes #7)' (#8) from fix/s8-bind-loopback-dev into main f0015bff81

Merge branch 'main' into fix/issue10-runtime-aware-plugin-install f51722411b

Merge pull request 'fix(workspace-server): SSOT-route container check + 422 on external runtimes (closes #10)' (#12) from fix/issue10-runtime-aware-plugin-install into main 6fac24e3de

chore(sync): back-merge main into staging — manual bridge while Class D auto-sync plumbs (Task #165) ... 5835746e68

main has 9 commits not on staging (including S-8 dev-mode fail-open
fix and SSOT-route container check). staging has 27 commits not on
main (in-flight features). 3-way merge.

Per saved memory feedback_use_merge_commits_not_squash: merge,
not squash.

Manual back-sync today, auto-sync workflow takes over once
controlplane#29 + core#26 ship the AUTO_SYNC_TOKEN plumbing
(Task #165).

# Conflicts:
#	.github/workflows/codeql.yml
#	.github/workflows/harness-replays.yml
#	.github/workflows/publish-runtime.yml
#	.github/workflows/publish-workspace-server-image.yml

claude-ceo-assistant added 1 commit 2026-05-07 14:17:53 +00:00

chore: retrigger CI post F1 (network=host) runner config change dc49d8aa0f

claude-ceo-assistant closed this pull request 2026-05-07 17:25:54 +00:00

Some checks failed

Hide all checks

Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 6s

Details

Check merge_group trigger on required workflows / Required workflows have merge_group trigger (pull_request) Successful in 6s

Details

pr-guards / disable-auto-merge-on-push (pull_request) Failing after 3s

Details

CI / Detect changes (pull_request) Successful in 8s

Details

E2E API Smoke Test / detect-changes (pull_request) Successful in 8s

Details

E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 9s

Details

Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 8s

Details

Handlers Postgres Integration / detect-changes (pull_request) Successful in 10s

Details

Harness Replays / detect-changes (pull_request) Successful in 10s

Details

Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 11s

Details

Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 12s

Details

E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 11s

Details

CI / Shellcheck (E2E scripts) (pull_request) Successful in 15s

Details

Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 7s

Details

Harness Replays / Harness Replays (pull_request) Failing after 49s

Details

CodeQL / Analyze (${{ matrix.language }}) (go) (pull_request) Failing after 1m35s

Details

CodeQL / Analyze (${{ matrix.language }}) (javascript-typescript) (pull_request) Failing after 1m37s

Details

CodeQL / Analyze (${{ matrix.language }}) (python) (pull_request) Failing after 1m47s

Details

E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 3m38s

Details

Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 3m58s

Details

CI / Canvas (Next.js) (pull_request) Successful in 5m6s

Details

CI / Canvas Deploy Reminder (pull_request) Has been skipped

Details

CI / Platform (Go) (pull_request) Failing after 6m19s

Details

CI / Python Lint & Test (pull_request) Successful in 7m20s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

No Label

tier:high

tier:low

tier:medium

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#27

No description provided.