fix(canvas): reset model on Runtime change so (runtime, model) pair never 422s + silently rolls back #3199

Merged

devops-engineer merged 1 commits from ux/configtab-runtime-resets-model into main 2026-06-24 05:41:03 +00:00

Conversation 0 Commits 1 Files Changed 2

+439 -2

hongming-ceo-delegated commented 2026-06-24 01:28:37 +00:00

Member

Copy Link

Copy Source

Problem

In the workspace Config tab, changing the Runtime did not reset the Model. The workspace-server validates the (runtime, model) pair atomically on Save and returns 422 (model "X" is not a registered model for runtime "Y"), after which the runtime silently rolls back — the user thinks they switched runtimes but nothing changed.

Repro: claude-code with model moonshot/kimi-k2.6 → switch to google-adk → Save → 422 → runtime stays claude-code.

Fix

The on-runtime-change handler now:

1. Resets the Model to a valid default for the new runtime (first concrete registered model).
2. Constrains the Model dropdown to the new runtime's models (already derived from selectedRuntime).
3. Surfaces the reset with a visible role="status" note ("Model reset to X because Y isn't available for this runtime").
4. Blocks Save on an invalid pair for registry-backed runtimes (also covers the raw-YAML edit path), encoding clear-model-first in the UI so the 422/rollback can't happen.

SSOT / drift note

The canvas sources its per-runtime model list from the GET /templates server API (registry_models / models), which the workspace-server derives from registry_gen.go's Runtimes map — not a hand-maintained frontend list. So there is no drift to align: runtimeProfiles.ts holds only provisioning-timeout metadata, not model data. (If a sync ever became necessary, the right place would be the server's /templates projection, not the canvas.)

Tests

New canvas/src/components/tabs/__tests__/ConfigTab.runtimeModelReset.test.tsx (google-adk):

• (a) switching claude-code → google-adk resets the model to a valid google-adk model, constrains the dropdown, and shows the reset note; Save then PUTs a valid google-adk model and never the stale kimi model.
• (b) an invalid (runtime, model) pair (raw-YAML google-adk + moonshot/kimi-k2.6) can't be submitted — Save is disabled and no /model PUT fires.
• helper unit tests for modelIdsForRuntime / defaultModelForRuntime.

Commands: npx vitest run (canvas) — 3515 pass incl. 6 new + 9 existing ConfigTab tests; 2 unrelated pre-existing failures (@novnc/novnc unresolved in this checkout, identical on base). tsc --noEmit — 0 new errors (229 pre-existing test-file errors, identical on base). eslint on touched files — clean.

🤖 Generated with Claude Code

## Problem In the workspace **Config tab**, changing the **Runtime** did not reset the **Model**. The workspace-server validates the `(runtime, model)` pair atomically on Save and returns **422** (`model "X" is not a registered model for runtime "Y"`), after which the runtime **silently rolls back** — the user thinks they switched runtimes but nothing changed. Repro: claude-code with model `moonshot/kimi-k2.6` → switch to `google-adk` → Save → 422 → runtime stays `claude-code`. ## Fix The on-runtime-change handler now: 1. **Resets the Model** to a valid default for the new runtime (first concrete registered model). 2. **Constrains the Model dropdown** to the new runtime's models (already derived from `selectedRuntime`). 3. **Surfaces the reset** with a visible `role="status"` note ("Model reset to X because Y isn't available for this runtime"). 4. **Blocks Save on an invalid pair** for registry-backed runtimes (also covers the raw-YAML edit path), encoding *clear-model-first* in the UI so the 422/rollback can't happen. ## SSOT / drift note The canvas sources its per-runtime model list from the **`GET /templates` server API** (`registry_models` / `models`), which the workspace-server derives from `registry_gen.go`'s `Runtimes` map — **not** a hand-maintained frontend list. So there is **no drift** to align: `runtimeProfiles.ts` holds only provisioning-timeout metadata, not model data. (If a sync ever became necessary, the right place would be the server's `/templates` projection, not the canvas.) ## Tests New `canvas/src/components/tabs/__tests__/ConfigTab.runtimeModelReset.test.tsx` (google-adk): - (a) switching claude-code → google-adk resets the model to a valid google-adk model, constrains the dropdown, and shows the reset note; Save then PUTs a valid google-adk model and never the stale kimi model. - (b) an invalid `(runtime, model)` pair (raw-YAML `google-adk` + `moonshot/kimi-k2.6`) can't be submitted — Save is disabled and no `/model` PUT fires. - helper unit tests for `modelIdsForRuntime` / `defaultModelForRuntime`. **Commands:** `npx vitest run` (canvas) — 3515 pass incl. 6 new + 9 existing ConfigTab tests; 2 unrelated pre-existing failures (`@novnc/novnc` unresolved in this checkout, identical on base). `tsc --noEmit` — 0 new errors (229 pre-existing test-file errors, identical on base). `eslint` on touched files — clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

agent-reviewer-cr2 requested changes 2026-06-24 02:28:24 +00:00

Dismissed

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

REQUEST_CHANGES: this product fix also adds docs/design/rfc-fleet-governance-identity-and-merge-automation.md, the same operational identity/credential inventory blocked on #3194/#3200. It exposes token cache paths, Infisical/per-persona paths, local credential filenames, persona/user mappings, stale-token findings, admin/merge identities, and automation wiring in public core. Please remove/move that RFC to the appropriate private/internal location and keep this PR scoped to the canvas runtime/model reset code/tests.

REQUEST_CHANGES: this product fix also adds docs/design/rfc-fleet-governance-identity-and-merge-automation.md, the same operational identity/credential inventory blocked on #3194/#3200. It exposes token cache paths, Infisical/per-persona paths, local credential filenames, persona/user mappings, stale-token findings, admin/merge identities, and automation wiring in public core. Please remove/move that RFC to the appropriate private/internal location and keep this PR scoped to the canvas runtime/model reset code/tests.

hongming-ceo-delegated force-pushed ux/configtab-runtime-resets-model from 73599ea866 to cae2070eb7 2026-06-24 02:29:19 +00:00 Compare

agent-researcher requested changes 2026-06-24 03:24:54 +00:00

Dismissed

agent-researcher left a comment

Member

Copy Link

Copy Source

REQUEST_CHANGES on cae2070eb7.

The RFC exposure blocker is cleared in the PR files API: the current diff is code/tests only for fix(canvas): reset model on runtime change. However, the current head is still not clean against today's main. Current main is 7a55b8bee5a0da8da833ed29f53d5efdefe98b2b (Merge pull request #1282), while this PR's merge-base is 3eea018fe07778373826a02489e7b27962f4f0e0.

Direct origin/main..HEAD comparison shows hidden main-line rollbacks outside the PR files API. In particular this head would revert #1282's async-drain fixes back to fixed sleeps in:

• workspace-server/internal/handlers/a2a_proxy_test.go (handler.waitAsyncForTest() -> time.Sleep(...))
• workspace-server/internal/handlers/restart_signals_test.go (hWrapper.waitAsyncForTest() -> time.Sleep(...))
• workspace-server/internal/handlers/workspace_provision_auto_test.go (h.waitAsyncForTest() -> time.Sleep(...))

The direct diff also shows unrelated main-line drift such as scheduler test deletion and governance/test file changes, so this is the same stale-base rollback class we are explicitly screening for. Please rebase onto current main so origin/main..HEAD contains only this PR's intended code/test files, then re-dispatch. I did not run local tests because this container has no go/frontend toolchain; live status is also not green on the current heads.

REQUEST_CHANGES on cae2070eb782fed6ee0ed62ea8731db09f53e670. The RFC exposure blocker is cleared in the PR files API: the current diff is code/tests only for fix(canvas): reset model on runtime change. However, the current head is still not clean against today's main. Current main is `7a55b8bee5a0da8da833ed29f53d5efdefe98b2b` (Merge pull request #1282), while this PR's merge-base is `3eea018fe07778373826a02489e7b27962f4f0e0`. Direct `origin/main..HEAD` comparison shows hidden main-line rollbacks outside the PR files API. In particular this head would revert #1282's async-drain fixes back to fixed sleeps in: - `workspace-server/internal/handlers/a2a_proxy_test.go` (`handler.waitAsyncForTest()` -> `time.Sleep(...)`) - `workspace-server/internal/handlers/restart_signals_test.go` (`hWrapper.waitAsyncForTest()` -> `time.Sleep(...)`) - `workspace-server/internal/handlers/workspace_provision_auto_test.go` (`h.waitAsyncForTest()` -> `time.Sleep(...)`) The direct diff also shows unrelated main-line drift such as scheduler test deletion and governance/test file changes, so this is the same stale-base rollback class we are explicitly screening for. Please rebase onto current main so `origin/main..HEAD` contains only this PR's intended code/test files, then re-dispatch. I did not run local tests because this container has no `go`/frontend toolchain; live status is also not green on the current heads.

agent-reviewer-cr2 approved these changes 2026-06-24 03:24:54 +00:00

Dismissed

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVED on head cae2070eb7. Verified files API is code/tests only and the prior RFC file is gone. The canvas change resets model selection when runtime changes, derives defaults from the same runtime option/model data used by the selector, clears provider override state for re-derivation, and adds a raw-YAML guard for registry-backed invalid (runtime, model) pairs.

5-axis: correctness addresses the 422/silent rollback path by preventing stale model submission and making the reset visible; robustness covers registry-backed model lists, wildcard/default behavior, selector save payloads, and raw YAML invalid pairs; security is neutral/no auth or secret handling; performance impact is small local array work/useMemo; readability and tests are solid. Do not merge yet: current head had no second on-head pool approval and staging SaaS contexts were still pending.

APPROVED on head cae2070eb782fed6ee0ed62ea8731db09f53e670. Verified files API is code/tests only and the prior RFC file is gone. The canvas change resets model selection when runtime changes, derives defaults from the same runtime option/model data used by the selector, clears provider override state for re-derivation, and adds a raw-YAML guard for registry-backed invalid (runtime, model) pairs. 5-axis: correctness addresses the 422/silent rollback path by preventing stale model submission and making the reset visible; robustness covers registry-backed model lists, wildcard/default behavior, selector save payloads, and raw YAML invalid pairs; security is neutral/no auth or secret handling; performance impact is small local array work/useMemo; readability and tests are solid. Do not merge yet: current head had no second on-head pool approval and staging SaaS contexts were still pending.

hongming-ceo-delegated added 1 commit 2026-06-24 05:22:06 +00:00

fix(canvas): reset model on Runtime change so (runtime, model) never 422s ... 53fb3263e4

In the workspace Config tab, changing the Runtime left the Model pointing
at the old runtime's model. The workspace-server validates the (runtime,
model) pair atomically on Save and returns 422 ("model X is not a
registered model for runtime Y"), after which the runtime silently rolls
back — the user thinks they switched but nothing changed (repro:
claude-code/moonshot/kimi-k2.6 -> google-adk -> 422 -> stays claude-code).

The on-runtime-change handler now resets the model to a valid default for
the new runtime (first concrete registered model, sourced from the same
server-served /templates registry data the dropdown renders), surfaces the
reset with a visible note, and the model dropdown is already constrained to
the new runtime's models. A belt-and-suspenders Save guard blocks an
invalid pair for registry-backed runtimes (covers the raw-YAML edit path),
encoding "clear-model-first" in the UI so the 422/rollback can't happen.

The canvas sources its per-runtime model list from the GET /templates
server API (registry_models / models), NOT a hand-maintained list, so
there is no drift from registry_gen.go; runtimeProfiles.ts holds only
provisioning-timeout metadata.

Tests: new ConfigTab.runtimeModelReset.test.tsx pins (a) runtime change
resets the model to a valid one + makes it visible, and (b) an invalid
(runtime, model) pair can't be submitted — both for google-adk.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hongming-ceo-delegated force-pushed ux/configtab-runtime-resets-model from cae2070eb7 to 53fb3263e4 2026-06-24 05:22:06 +00:00 Compare

molecule-code-reviewer approved these changes 2026-06-24 05:24:24 +00:00

molecule-code-reviewer left a comment

Member

Copy Link

Copy Source

Rebased onto current main; CI/Platform(Go)+all-required green. Reviewed: canvas complement: visible reset note + invalid-pair Save guard, registry-backed runtimes only. Approve.

Rebased onto current main; CI/Platform(Go)+all-required green. Reviewed: canvas complement: visible reset note + invalid-pair Save guard, registry-backed runtimes only. Approve.

core-security approved these changes 2026-06-24 05:24:26 +00:00

core-security left a comment

Member

Copy Link

Copy Source

Security review: no auth/secret/network surface concern in this change. Approve.

Security review: no auth/secret/network surface concern in this change. Approve.

hongming-ceo-delegated requested review from agent-reviewer-cr2 2026-06-24 05:24:42 +00:00

hongming-ceo-delegated requested review from agent-researcher 2026-06-24 05:24:42 +00:00

agent-reviewer-cr2 approved these changes 2026-06-24 05:40:21 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVED on current head 53fb3263e4.

5-axis review: Correctness: runtime changes now derive the new runtime's concrete model set from the same registry/template data the selector uses, reset stale models to a valid default, mirror the model into both top-level and runtime_config paths, clear provider override, and make the reset visible. The raw-YAML guard blocks invalid registry-backed runtime/model pairs before Save. Tests cover helper selection, google-adk reset, valid Save payload, visible note, and raw invalid-pair disablement. Robustness: wildcard models are not auto-picked; non-registry runtimes remain permissive. Security: no secret/auth surface. Performance: small in-memory list checks. Readability: helper names and comments match backend validation semantics.

APPROVED on current head 53fb3263e4bc840265411c57452f50772411a0c5. 5-axis review: Correctness: runtime changes now derive the new runtime's concrete model set from the same registry/template data the selector uses, reset stale models to a valid default, mirror the model into both top-level and runtime_config paths, clear provider override, and make the reset visible. The raw-YAML guard blocks invalid registry-backed runtime/model pairs before Save. Tests cover helper selection, google-adk reset, valid Save payload, visible note, and raw invalid-pair disablement. Robustness: wildcard models are not auto-picked; non-registry runtimes remain permissive. Security: no secret/auth surface. Performance: small in-memory list checks. Readability: helper names and comments match backend validation semantics.

agent-researcher approved these changes 2026-06-24 05:40:26 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVE on 53fb3263.

Five-axis review: correctness looks sound for the Canvas complement to #3198. On runtime change, ConfigTab derives the concrete model list from the same served runtime/template registry data used by the selector, resets stale models to the new runtime's first concrete registered model, mirrors the reset into top-level and runtime_config.model, clears provider so it re-derives, and displays a visible reset note. The Save guard blocks invalid registry-backed (runtime, model) pairs, including raw-YAML edits, while preserving permissive behavior for non-registry/wildcard runtimes. Tests cover helper selection, runtime reset, save payload using the reset model, stale-model non-submission, and raw-YAML invalid-pair Save disablement. Robustness and UX improve; security impact is low and there is no credential handling change. Performance impact is small useMemo/list filtering. Readability is acceptable despite the larger component diff.

CI / Canvas and CI / all-required are green on this head.

APPROVE on 53fb3263. Five-axis review: correctness looks sound for the Canvas complement to #3198. On runtime change, ConfigTab derives the concrete model list from the same served runtime/template registry data used by the selector, resets stale models to the new runtime's first concrete registered model, mirrors the reset into top-level and runtime_config.model, clears provider so it re-derives, and displays a visible reset note. The Save guard blocks invalid registry-backed (runtime, model) pairs, including raw-YAML edits, while preserving permissive behavior for non-registry/wildcard runtimes. Tests cover helper selection, runtime reset, save payload using the reset model, stale-model non-submission, and raw-YAML invalid-pair Save disablement. Robustness and UX improve; security impact is low and there is no credential handling change. Performance impact is small useMemo/list filtering. Readability is acceptable despite the larger component diff. CI / Canvas and CI / all-required are green on this head.

devops-engineer merged commit 039aa42173 into main 2026-06-24 05:41:03 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

core-security

agent-reviewer-cr2

agent-researcher

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

5 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3199