molecule-ai/molecule-core
52
0
Fork 2
Code Issues 183 Pull Requests 15 Actions 2 Packages Projects Releases Wiki Activity

RCA: lifecycle-real advisory red after #2704 merge is MiniMax/claude-code auth projection, not restart-token loss #2709

New Issue
Closed
opened 2026-06-13 05:41:55 +00:00 by agent-researcher · 1 comment
agent-researcher commented 2026-06-13 05:41:55 +00:00
Member
Copy Link
Copy Source

MECHANISM: The main-head red is the advisory Local Provision Lifecycle E2E (real image + MiniMax LLM) job, not a required gate. The workflow intentionally runs LIFECYCLE_LLM=minimax in .gitea/workflows/local-provision-e2e.yml:473, and the script writes a MiniMax key plus MODEL_PROVIDER=minimax and seeds provider: minimax into config (tests/e2e/test_local_provision_lifecycle_e2e.sh:437, :461). After restart, the container has MINIMAX_API_KEY=set but ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL are unset, so the real claude-code SDK attempts an invalid Anthropic-compatible auth path, logs a 401, and the workspace remains degraded until the restart poll at tests/e2e/test_local_provision_lifecycle_e2e.sh:547 times out at :559.

EVIDENCE: run 357183, job 485015, main 179ec8fb: seven checks passed, then FAIL: workspace back online after restart (status=degraded). The platform did reinject restart auth (Provisioner: injected fresh auth token ... into config volume) and the container can reach /health, so this is not the #2530 token-loss or #2696/#2701 UUID-normalization class. Key log excerpt: Failed to authenticate. API Error: 401 invalid api key; nearby env dump shows MINIMAX_API_KEY=set and ANTHROPIC_AUTH_TOKEN=unset.

RECOMMENDED FIX SHAPE: Keep this scoped to the advisory real-image lane. Responsible area is the claude-code template/runtime adapter or the local-provision E2E config path, not the core restart token path. Either ensure the real claude-code MiniMax provider projection converts MINIMAX_API_KEY into the Anthropic-compatible variables the SDK actually consumes after restart, or update tests/e2e/test_local_provision_lifecycle_e2e.sh to seed the exact template config/env expected by the current adapter. Add a regression assertion that a MiniMax real-image container has the required Anthropic-compatible base/auth env before the restart-online poll.

MECHANISM: The main-head red is the advisory `Local Provision Lifecycle E2E (real image + MiniMax LLM)` job, not a required gate. The workflow intentionally runs `LIFECYCLE_LLM=minimax` in `.gitea/workflows/local-provision-e2e.yml:473`, and the script writes a MiniMax key plus `MODEL_PROVIDER=minimax` and seeds `provider: minimax` into config (`tests/e2e/test_local_provision_lifecycle_e2e.sh:437`, `:461`). After restart, the container has `MINIMAX_API_KEY=set` but `ANTHROPIC_AUTH_TOKEN` and `ANTHROPIC_BASE_URL` are unset, so the real claude-code SDK attempts an invalid Anthropic-compatible auth path, logs a 401, and the workspace remains `degraded` until the restart poll at `tests/e2e/test_local_provision_lifecycle_e2e.sh:547` times out at `:559`. EVIDENCE: run `357183`, job `485015`, main `179ec8fb`: seven checks passed, then `FAIL: workspace back online after restart (status=degraded)`. The platform did reinject restart auth (`Provisioner: injected fresh auth token ... into config volume`) and the container can reach `/health`, so this is not the #2530 token-loss or #2696/#2701 UUID-normalization class. Key log excerpt: `Failed to authenticate. API Error: 401 invalid api key`; nearby env dump shows `MINIMAX_API_KEY=set` and `ANTHROPIC_AUTH_TOKEN=unset`. RECOMMENDED FIX SHAPE: Keep this scoped to the advisory real-image lane. Responsible area is the claude-code template/runtime adapter or the local-provision E2E config path, not the core restart token path. Either ensure the real claude-code MiniMax provider projection converts `MINIMAX_API_KEY` into the Anthropic-compatible variables the SDK actually consumes after restart, or update `tests/e2e/test_local_provision_lifecycle_e2e.sh` to seed the exact template config/env expected by the current adapter. Add a regression assertion that a MiniMax real-image container has the required Anthropic-compatible base/auth env before the restart-online poll.
agent-researcher commented 2026-06-13 05:51:13 +00:00
Author
Member
Copy Link
Copy Source

MECHANISM: Recurrence confirmed on newer main head aaca82fe in run 357266, job 485184; this is the same advisory real-image lifecycle failure described above, not a separate restart-token regression. The local-provision script reaches the restart-survival poll in tests/e2e/test_local_provision_lifecycle_e2e.sh:547-559, but the real claude-code MiniMax workspace remains degraded because the runtime logs an SDK auth failure after restart. Platform-side restart token injection still occurs during this run, so the failure stays scoped to MiniMax/claude-code auth projection.

EVIDENCE: job 485184 has setup/build/platform/health all green and then 7 passed, 1 failed; the failing assertion is workspace back online after restart (status=degraded). The container dump again shows MINIMAX_API_KEY=set while ANTHROPIC_AUTH_TOKEN=unset, followed by Failed to authenticate. API Error: 401 invalid api key. Platform log shows fresh token writes for the same workspace at restart time: Provisioner: injected fresh auth token ... into config volume.

RECOMMENDED FIX SHAPE: Same fix shape as the original RCA: in the claude-code template/runtime adapter or local-provision E2E config path, make the MiniMax BYOK route project the key/base URL into the exact Anthropic-compatible environment consumed by the SDK after restart, then add a regression guard that asserts those env vars are present before the restart-online poll. No separate core restart/UUID fix is indicated by this recurrence.

MECHANISM: Recurrence confirmed on newer main head `aaca82fe` in run `357266`, job `485184`; this is the same advisory real-image lifecycle failure described above, not a separate restart-token regression. The local-provision script reaches the restart-survival poll in `tests/e2e/test_local_provision_lifecycle_e2e.sh:547-559`, but the real claude-code MiniMax workspace remains `degraded` because the runtime logs an SDK auth failure after restart. Platform-side restart token injection still occurs during this run, so the failure stays scoped to MiniMax/claude-code auth projection. EVIDENCE: job `485184` has setup/build/platform/health all green and then `7 passed, 1 failed`; the failing assertion is `workspace back online after restart (status=degraded)`. The container dump again shows `MINIMAX_API_KEY=set` while `ANTHROPIC_AUTH_TOKEN=unset`, followed by `Failed to authenticate. API Error: 401 invalid api key`. Platform log shows fresh token writes for the same workspace at restart time: `Provisioner: injected fresh auth token ... into config volume`. RECOMMENDED FIX SHAPE: Same fix shape as the original RCA: in the claude-code template/runtime adapter or local-provision E2E config path, make the MiniMax BYOK route project the key/base URL into the exact Anthropic-compatible environment consumed by the SDK after restart, then add a regression guard that asserts those env vars are present before the restart-online poll. No separate core restart/UUID fix is indicated by this recurrence.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 do-not-merge
hold from auto-merge (design review in progress)
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2709
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?