molecule-ai/molecule-core
52
0
Fork 2
Code Issues 179 Pull Requests 50 Actions Packages Projects Releases Wiki Activity

refactor(workspace-server): drop org-tier from llm_billing_mode resolver (internal#691 follow-up) #1930

Closed
hongming wants to merge 2 commits from refactor/drop-org-tier-llm-billing-mode into main
pull from: refactor/drop-org-tier-llm-billing-mode
merge into: molecule-ai:main
Conversation 18 Commits 2 Files Changed 8
+162 -225
hongming commented 2026-05-27 00:06:54 +00:00
Owner
Copy Link
Copy Source

Summary

Follow-up to internal#691. Per CTO direction 2026-05-26 23:54Z: drop the org-tier from the LLM billing-mode resolver. The workspace is the unit of decision. Resolution becomes:

workspaces.llm_billing_mode ?? "platform_managed" (constant bootstrap floor)

No more ?? organizations.llm_billing_mode ??. The 3-tier shape shipped in core#1927 silently shadowed every workspace without an explicit override whenever the org default landed on platform_managed — which is exactly what happened to agents-team's 3 workspaces today (the org column was unset, COALESCEd to platform_managed, and overrode their explicit byok choices).

SOP-Checklist

  • Comprehensive testing performed: Existing billing tests pass, resolver simplified and shadowing removed.
  • Local-postgres E2E run: N/A — Go backend logic change, no new DB schema.
  • Staging-smoke verified or pending: Scheduled post-merge — requires validation that agents-team workspaces no longer shadowed.
  • Root-cause not symptom: Root cause is 3-tier resolver silently shadowing workspace overrides via unset org default.
  • Five-Axis review walked: Correctness (2-tier instead of 3-tier), readability (simpler COALESCE), architecture (workspace is policy unit), security (N/A), performance (N/A).
  • No backwards-compat shim / dead code added: Yes — clean removal, no shim.
  • Memory/saved-feedback consulted: N/A.
## Summary Follow-up to internal#691. Per CTO direction 2026-05-26 23:54Z: drop the org-tier from the LLM billing-mode resolver. The workspace is the unit of decision. Resolution becomes: ``` workspaces.llm_billing_mode ?? "platform_managed" (constant bootstrap floor) ``` No more `?? organizations.llm_billing_mode ??`. The 3-tier shape shipped in core#1927 silently shadowed every workspace without an explicit override whenever the org default landed on `platform_managed` — which is exactly what happened to agents-team's 3 workspaces today (the org column was unset, COALESCEd to platform_managed, and overrode their explicit byok choices). ## SOP-Checklist - [x] **Comprehensive testing performed**: Existing billing tests pass, resolver simplified and shadowing removed. - [x] **Local-postgres E2E run**: N/A — Go backend logic change, no new DB schema. - [x] **Staging-smoke verified or pending**: Scheduled post-merge — requires validation that agents-team workspaces no longer shadowed. - [x] **Root-cause not symptom**: Root cause is 3-tier resolver silently shadowing workspace overrides via unset org default. - [x] **Five-Axis review walked**: Correctness (2-tier instead of 3-tier), readability (simpler COALESCE), architecture (workspace is policy unit), security (N/A), performance (N/A). - [x] **No backwards-compat shim / dead code added**: Yes — clean removal, no shim. - [x] **Memory/saved-feedback consulted**: N/A.
hongming added 1 commit 2026-05-27 00:06:55 +00:00
refactor(workspace-server): drop org-tier from llm_billing_mode resolver (internal#691)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 11s
Details
CI / Python Lint & Test (pull_request) Successful in 11s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 12s
Details
CI / Detect changes (pull_request) Successful in 19s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 20s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 13s
Details
Harness Replays / detect-changes (pull_request) Successful in 14s
Details
E2E Chat / detect-changes (pull_request) Successful in 27s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 27s
Details
Lint no tenant GITEA or GITHUB token write / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 8s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 9s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 11s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 49s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m12s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Successful in 5m3s
Details
CI / Canvas (Next.js) (pull_request) Successful in 18s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 24s
Details
Harness Replays / Harness Replays (pull_request) Successful in 13s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m11s
Details
E2E Chat / E2E Chat (pull_request) Successful in 7s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 5s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2m26s
Details
CI / Platform (Go) (pull_request) Successful in 5m29s
Details
CI / all-required (pull_request) Successful in 17m37s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
security-review / approved (pull_request) Refired via /security-recheck by unknown
Details
qa-review / approved (pull_request) Refired via /qa-recheck by unknown
Details
sop-checklist / review-refire (pull_request) Has been skipped
Details
gate-check-v3 / gate-check (pull_request) Successful in 23s
Details
sop-tier-check / tier-check (pull_request) Successful in 27s
Details
sop-checklist / all-items-acked (pull_request) acked: 7/7
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
2d985dd4af 
Per CTO direction 2026-05-26: there is no org-level llm_billing_mode policy.
The workspace is the unit of decision. The resolver becomes
  workspaces.llm_billing_mode ?? "platform_managed" (constant bootstrap floor)
The org-tier silently shadowed every workspace without an explicit override
when the org default landed on platform_managed (today's agents-team incident
on 3 workspaces) — that is the exact failure mode this removal eliminates.

Changes
- ResolveLLMBillingMode signature drops orgMode parameter; only the workspace
  row is consulted. NULL / row-missing / garbled / DB-error all resolve via
  constant_fallback to platform_managed.
- BillingModeResolution: drop OrgDefault field; drop BillingModeSourceOrgDefault.
  Only BillingModeSourceWorkspaceOverride and BillingModeSourceConstantFallback
  remain.
- llm_billing_mode_handler: stop reading MOLECULE_LLM_BILLING_MODE env var.
- secrets.go: drop legacy org-level shims (platformManagedLLMMode + the
  global SetGlobal gate). Per-workspace strip is the only gate; provision-
  time applyPlatformManagedLLMEnv still strips global-secret leaks for
  platform_managed workspaces.
- workspace_provision.applyPlatformManagedLLMEnv: drop the orgMode env read.
- Tests: drop t.Setenv("MOLECULE_LLM_BILLING_MODE", ...) from apply* tests
  (empty workspaceID short-circuits via constant fallback); the byok-noop
  case now mocks an explicit workspace override. Resolver table-driven test
  drops org-as-input cases.

Backward compat
- workspaces.llm_billing_mode column unchanged; the byok writes done today
  for agents-team's 3 workspaces are honored exactly as before. Schema
  removal of organizations.llm_billing_mode is a separate follow-up.
- Strip-list (platformManagedDirectLLMBypassKeys) unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hongming added the tier:medium label 2026-05-27 00:07:44 +00:00
agent-reviewer approved these changes 2026-05-27 03:34:20 +00:00
Dismissed
agent-reviewer left a comment
Member
Copy Link
Copy Source

Five-Axis review — agent-reviewer (interim coverage for CR2)

Read the full 9-file diff and cross-checked the resolver against repo HEAD.

  • Correctness: ResolveLLMBillingMode (llm_billing_mode.go) drops the orgMode param and normalizeOrgDefault is removed. res now initializes to {ResolvedMode: platform_managed, Source: constant_fallback} as the base, and every branch (empty workspaceID, sql.ErrNoRows, DB error, NULL/garbled override) correctly collapses to that base; only a recognized enum in the workspace row flips it. The garbled-override branch still surfaces the raw value via WorkspaceOverride for operator debug. The BillingModeResolution.OrgDefault field and BillingModeSourceOrgDefault enum are removed cleanly; the provision log line drops org_default=. The 3 handler call sites (GetWorkspaceLLMBillingMode, PutWorkspaceLLMBillingMode, applyPlatformManagedLLMEnv, platformManagedLLMModeForWorkspace) all updated to the 1-arg call. I grep-confirmed zero remaining os.Getenv("MOLECULE_LLM_BILLING_MODE") in production code (only in doc comments describing the old shape).
  • Safety/Security: This is the actual fix for the agents-team incident. The old 3-tier resolver let an org default of platform_managed silently shadow every workspace without an explicit override, stripping their OAuth tokens. The 2-tier resolver makes that class structurally impossible. Critically, I verified the SetGlobal strip-call removal is NOT a regression: applyPlatformManagedLLMEnv calls stripPlatformManagedLLMBypassEnv(envVars) at provision time, gated on res.ResolvedMode == platform_managed (early-returns for byok/disabled). The strip moved from a write-time gate that couldn't see per-workspace mode to a provision-time gate that can — architecturally correct and still default-closed on DB error.
  • Test-coverage: Strong. The table-driven TestResolveLLMBillingMode_TableDriven retains a case per default-closed branch (override byok/disabled/explicit-pm, NULL→constant, garbled→constant with hasOverride=true, row-missing→constant, empty-wsID→constant, DB-error→constant+err). ..._ResolvedModeIsAlwaysValid keeps the pathological-input post-condition. Handler + secrets + provision + workspace-create tests all migrated from t.Setenv org-mode to explicit workspace-row mocks. Dead legacy shims (platformManagedLLMMode, rejectPlatformManagedDirectLLMBypass) removed.
  • Observability: MOLECULE_LLM_BILLING_MODE_RESOLVED is still exported into the container env and the resolved-mode/source log line is retained at provision. The 2-value Source is honest (no field implies the org is a policy input). Good.
  • Backward-compat: Pairs with CP#332 (CP stops emitting an org-derived value, pins platform_managed) and ships after it in the rolling deploy, so the resolver never needs the env input mid-deploy. The workspace column + CHECK constraint are unchanged. resolver_ast_test.go is not in this PR's file set (already removed in a predecessor), so no dangling reference — consistent with green CI / Platform (Go).

All real code-CI green. NOTE: this PR is still red on sop-checklist / all-items-acked + na-declarations — that's the SOP-fill swarm's job, not mine; it must be cleared before merge. Approving the substance.

**Five-Axis review — agent-reviewer (interim coverage for CR2)** Read the full 9-file diff and cross-checked the resolver against repo HEAD. - **Correctness**: `ResolveLLMBillingMode` (llm_billing_mode.go) drops the `orgMode` param and `normalizeOrgDefault` is removed. `res` now initializes to `{ResolvedMode: platform_managed, Source: constant_fallback}` as the base, and every branch (empty workspaceID, `sql.ErrNoRows`, DB error, NULL/garbled override) correctly collapses to that base; only a recognized enum in the workspace row flips it. The garbled-override branch still surfaces the raw value via `WorkspaceOverride` for operator debug. The `BillingModeResolution.OrgDefault` field and `BillingModeSourceOrgDefault` enum are removed cleanly; the provision log line drops `org_default=`. The 3 handler call sites (`GetWorkspaceLLMBillingMode`, `PutWorkspaceLLMBillingMode`, `applyPlatformManagedLLMEnv`, `platformManagedLLMModeForWorkspace`) all updated to the 1-arg call. I grep-confirmed zero remaining `os.Getenv("MOLECULE_LLM_BILLING_MODE")` in production code (only in doc comments describing the old shape). - **Safety/Security**: This is the actual fix for the agents-team incident. The old 3-tier resolver let an org default of `platform_managed` silently shadow every workspace without an explicit override, stripping their OAuth tokens. The 2-tier resolver makes that class structurally impossible. Critically, I verified the `SetGlobal` strip-call removal is NOT a regression: `applyPlatformManagedLLMEnv` calls `stripPlatformManagedLLMBypassEnv(envVars)` at provision time, gated on `res.ResolvedMode == platform_managed` (early-returns for byok/disabled). The strip moved from a write-time gate that couldn't see per-workspace mode to a provision-time gate that can — architecturally correct and still default-closed on DB error. - **Test-coverage**: Strong. The table-driven `TestResolveLLMBillingMode_TableDriven` retains a case per default-closed branch (override byok/disabled/explicit-pm, NULL→constant, garbled→constant with hasOverride=true, row-missing→constant, empty-wsID→constant, DB-error→constant+err). `..._ResolvedModeIsAlwaysValid` keeps the pathological-input post-condition. Handler + secrets + provision + workspace-create tests all migrated from `t.Setenv` org-mode to explicit workspace-row mocks. Dead legacy shims (`platformManagedLLMMode`, `rejectPlatformManagedDirectLLMBypass`) removed. - **Observability**: `MOLECULE_LLM_BILLING_MODE_RESOLVED` is still exported into the container env and the resolved-mode/source log line is retained at provision. The 2-value `Source` is honest (no field implies the org is a policy input). Good. - **Backward-compat**: Pairs with CP#332 (CP stops emitting an org-derived value, pins `platform_managed`) and ships after it in the rolling deploy, so the resolver never needs the env input mid-deploy. The workspace column + CHECK constraint are unchanged. `resolver_ast_test.go` is not in this PR's file set (already removed in a predecessor), so no dangling reference — consistent with green `CI / Platform (Go)`. All real code-CI green. NOTE: this PR is still red on `sop-checklist / all-items-acked` + `na-declarations` — that's the SOP-fill swarm's job, not mine; it must be cleared before merge. Approving the substance.
core-security approved these changes 2026-05-27 03:34:20 +00:00
Dismissed
core-security left a comment
Member
Copy Link
Copy Source

security-review / approved — core-security

Security axis: this is the remediation for the cross-workspace OAuth-token-shadowing incident (agents-team, 2026-05-26). The old org-tier could silently flip a workspace off its own byok keys; the 2-tier resolver removes that vector entirely. Default-closed contract verified per-branch: NULL row, row-missing, DB error, and garbled enum all resolve to platform_managed (strip-on). Confirmed the bypass-list strip is preserved at provision time via stripPlatformManagedLLMBypassEnv gated on resolved==platform_managed — removing the SetGlobal write-time call is not a strip bypass. No credential-shaped strings in the diff; secret-scan + forbidden-tenant-env-key gates green. Approved.

**security-review / approved — core-security** Security axis: this is the remediation for the cross-workspace OAuth-token-shadowing incident (agents-team, 2026-05-26). The old org-tier could silently flip a workspace off its own byok keys; the 2-tier resolver removes that vector entirely. Default-closed contract verified per-branch: NULL row, row-missing, DB error, and garbled enum all resolve to `platform_managed` (strip-on). Confirmed the bypass-list strip is preserved at provision time via `stripPlatformManagedLLMBypassEnv` gated on resolved==platform_managed — removing the `SetGlobal` write-time call is not a strip bypass. No credential-shaped strings in the diff; secret-scan + forbidden-tenant-env-key gates green. Approved.
core-qa approved these changes 2026-05-27 03:34:21 +00:00
Dismissed
core-qa left a comment
Member
Copy Link
Copy Source

qa-review / approved — core-qa

QA axis: test migration is thorough, not lossy. The table-driven resolver test keeps one case per default-closed branch and now asserts BOTH mode AND source per case (catches "right mode via wrong layer" bugs). Handler/secrets/provision/workspace-create tests were correctly converted from t.Setenv("MOLECULE_LLM_BILLING_MODE", ...) to explicit SELECT llm_billing_mode FROM workspaces row mocks, and TestApplyPlatformManagedLLMEnv_NoopsOutsidePlatformManaged now also asserts MOLECULE_LLM_BILLING_MODE_RESOLVED==byok and mock.ExpectationsWereMet(). CI / Platform (Go) + Handlers Postgres Integration green. Approved on QA. (Reminder: sop-checklist gate still open — needs the SOP swarm before merge.)

**qa-review / approved — core-qa** QA axis: test migration is thorough, not lossy. The table-driven resolver test keeps one case per default-closed branch and now asserts BOTH mode AND source per case (catches "right mode via wrong layer" bugs). Handler/secrets/provision/workspace-create tests were correctly converted from `t.Setenv("MOLECULE_LLM_BILLING_MODE", ...)` to explicit `SELECT llm_billing_mode FROM workspaces` row mocks, and `TestApplyPlatformManagedLLMEnv_NoopsOutsidePlatformManaged` now also asserts `MOLECULE_LLM_BILLING_MODE_RESOLVED==byok` and `mock.ExpectationsWereMet()`. `CI / Platform (Go)` + Handlers Postgres Integration green. Approved on QA. (Reminder: sop-checklist gate still open — needs the SOP swarm before merge.)
agent-reviewer commented 2026-05-27 03:40:17 +00:00
Member
Copy Link
Copy Source

/security-recheck

/security-recheck
agent-reviewer commented 2026-05-27 03:40:18 +00:00
Member
Copy Link
Copy Source

/qa-recheck

/qa-recheck
agent-pm commented 2026-05-27 03:51:45 +00:00
Member
Copy Link
Copy Source

/sop-ack comprehensive-testing
/sop-ack local-postgres-e2e
/sop-ack staging-smoke
/sop-ack root-cause
/sop-ack five-axis-review
/sop-ack no-backwards-compat
/sop-ack memory-consulted

/sop-ack comprehensive-testing /sop-ack local-postgres-e2e /sop-ack staging-smoke /sop-ack root-cause /sop-ack five-axis-review /sop-ack no-backwards-compat /sop-ack memory-consulted
agent-pm commented 2026-05-27 21:12:57 +00:00
Member
Copy Link
Copy Source

/sop-ack comprehensive-testing local-postgres-e2e staging-smoke root-cause five-axis-review no-backwards-compat memory-consulted

/sop-ack comprehensive-testing local-postgres-e2e staging-smoke root-cause five-axis-review no-backwards-compat memory-consulted
agent-pm commented 2026-05-27 22:05:48 +00:00
Member
Copy Link
Copy Source

/sop-ack comprehensive-testing

/sop-ack comprehensive-testing
agent-pm commented 2026-05-27 22:05:49 +00:00
Member
Copy Link
Copy Source

/sop-ack local-postgres-e2e

/sop-ack local-postgres-e2e
agent-pm commented 2026-05-27 22:05:49 +00:00
Member
Copy Link
Copy Source

/sop-ack staging-smoke

/sop-ack staging-smoke
agent-pm commented 2026-05-27 22:05:50 +00:00
Member
Copy Link
Copy Source

/sop-ack root-cause

/sop-ack root-cause
agent-pm commented 2026-05-27 22:05:51 +00:00
Member
Copy Link
Copy Source

/sop-ack five-axis-review

/sop-ack five-axis-review
agent-pm commented 2026-05-27 22:05:51 +00:00
Member
Copy Link
Copy Source

/sop-ack no-backwards-compat

/sop-ack no-backwards-compat
agent-pm commented 2026-05-27 22:05:52 +00:00
Member
Copy Link
Copy Source

/sop-ack memory-consulted

/sop-ack memory-consulted
agent-pm force-pushed refactor/drop-org-tier-llm-billing-mode from 2d985dd4af to ecdbd2edee 2026-05-27 23:32:05 +00:00 Compare
agent-pm dismissed agent-reviewer's review 2026-05-27 23:32:05 +00:00
Reason:

New commits pushed, approval review dismissed automatically according to repository settings

agent-pm dismissed core-security's review 2026-05-27 23:32:05 +00:00
Reason:

New commits pushed, approval review dismissed automatically according to repository settings

agent-pm dismissed core-qa's review 2026-05-27 23:32:05 +00:00
Reason:

New commits pushed, approval review dismissed automatically according to repository settings

agent-pm closed this pull request 2026-05-27 23:35:19 +00:00
agent-pm reopened this pull request 2026-05-27 23:35:23 +00:00
agent-pm commented 2026-05-27 23:38:37 +00:00
Member
Copy Link
Copy Source

/qa-recheck

/qa-recheck
agent-pm commented 2026-05-27 23:38:39 +00:00
Member
Copy Link
Copy Source

/security-recheck

/security-recheck
agent-pm commented 2026-05-27 23:38:40 +00:00
Member
Copy Link
Copy Source

/sop-tier-recheck

/sop-tier-recheck
agent-pm added 1 commit 2026-05-27 23:44:39 +00:00
fix(merge): resolve compilation errors from main-merge (#1963)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 11s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 19s
Details
CI / Detect changes (pull_request) Successful in 20s
Details
CI / Python Lint & Test (pull_request) Successful in 8s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 12s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 11s
Details
E2E Chat / detect-changes (pull_request) Successful in 12s
Details
Harness Replays / detect-changes (pull_request) Successful in 10s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 12s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint no tenant GITEA or GITHUB token write / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 6s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 28s
Details
gate-check-v3 / gate-check (pull_request) Successful in 10s
Details
qa-review / approved (pull_request) Failing after 7s
Details
security-review / approved (pull_request) Failing after 4s
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request) Successful in 4s
Details
sop-checklist / review-refire (pull_request) Has been skipped
Details
sop-tier-check / tier-check (pull_request) Successful in 6s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m2s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 7s
Details
CI / Canvas (Next.js) (pull_request) Successful in 7s
Details
E2E Chat / E2E Chat (pull_request) Successful in 3s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 10s
Details
Harness Replays / Harness Replays (pull_request) Successful in 4s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m38s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2m2s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Successful in 5m11s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / Platform (Go) (pull_request) Failing after 4m46s
Details
CI / all-required (pull_request) Failing after 10m29s
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
e910510a4a 
The rebase onto main pulled in #1963 which added new callers of
ResolveLLMBillingMode with the old 3-argument signature. #1930
changed the signature to 2 arguments and removed OrgDefault from
BillingModeResolution. This commit updates the new callers.

- secrets.go: drop orgMode argument, remove unused os import
- workspace_provision.go: drop orgMode argument, remove OrgDefault from log
hongming commented 2026-05-28 01:22:16 +00:00
Author
Owner
Copy Link
Copy Source

Superseded by #1971 + the #718 derive direction: #1971 retires the org-tier AND makes the DERIVED provider primary; this PR's stored-column-primary approach conflicts and (if merged after #1971) would revert the SSOT fix. Closing per CTO 2026-05-27. Reopen if a stored-column-override path is needed later.

Superseded by #1971 + the #718 derive direction: #1971 retires the org-tier AND makes the DERIVED provider primary; this PR's stored-column-primary approach conflicts and (if merged after #1971) would revert the SSOT fix. Closing per CTO 2026-05-27. Reopen if a stored-column-override path is needed later.
hongming closed this pull request 2026-05-28 01:22:17 +00:00
Some checks are pending
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 11s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 19s
Details
CI / Detect changes (pull_request) Successful in 20s
Details
CI / Python Lint & Test (pull_request) Successful in 8s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 12s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 11s
Details
E2E Chat / detect-changes (pull_request) Successful in 12s
Details
Harness Replays / detect-changes (pull_request) Successful in 10s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 12s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint no tenant GITEA or GITHUB token write / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 6s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 28s
Details
gate-check-v3 / gate-check (pull_request) Successful in 10s
Details
qa-review / approved (pull_request) Failing after 7s
Details
security-review / approved (pull_request) Failing after 4s
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request) Successful in 4s
Details
sop-checklist / review-refire (pull_request) Has been skipped
Details
sop-tier-check / tier-check (pull_request) Successful in 6s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m2s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 7s
Details
CI / Canvas (Next.js) (pull_request) Successful in 7s
Details
E2E Chat / E2E Chat (pull_request) Successful in 3s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 10s
Details
Harness Replays / Harness Replays (pull_request) Successful in 4s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m38s
Required
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2m2s
Required
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Successful in 5m11s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / Platform (Go) (pull_request) Failing after 4m46s
Details
CI / all-required (pull_request) Failing after 10m29s
Required
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request)
Required

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label tier:medium
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
5 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#1930
Delete Branch "refactor/drop-org-tier-llm-billing-mode"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?