molecule-ai/molecule-core
51
0
Fork 2
Code Issues 159 Pull Requests 161 Actions 10 Packages Projects Releases Wiki Activity

fix(ci): move bp-directive into lint window (#2186 follow-up) #2210

Closed
core-be wants to merge 3 commits from fix/2185-bp-directive-window into feat/2185-manifest-entry-existence-check
pull from: fix/2185-bp-directive-window
merge into: molecule-ai:feat/2185-manifest-entry-existence-check
Conversation 12 Commits 3 Files Changed 1
+82
core-be commented 2026-06-04 05:19:23 +00:00
Member
Copy Link
Copy Source

What

Moves the bp-required: pending #2185 directive in manifest-entry-existence-check.yml to within the 3-line window above the check-entries: job key.

Why

The lint script lint_required_context_exists_in_bp.py scans _DIRECTIVE_WINDOW = 3 lines above a job key for directive comments. The original placement had the directive 5 lines above the job key, so the lint would fail to detect it and flag the new emission as a violation.

How

Condensed the comment block and placed the directive on the last line before the job key (line 40, job key on line 41). Verified with the lint regex locally.

Related

  • PR #2186 (the workflow introduction)
  • internal#350 (Tier 2g lint spec)

/sop-ack comprehensive-test
/sop-ack security-review N/A — no runtime code
/sop-ack docs-updated N/A — no user-facing change
/sop-ack backwards-compatible
/sop-ack rollback-plan N/A — no deployment change
/sop-ack monitoring-alerts N/A — no new alerts
/sop-ack runbook-linked N/A — no ops change

## What Moves the bp-required: pending #2185 directive in manifest-entry-existence-check.yml to within the 3-line window above the check-entries: job key. ## Why The lint script lint_required_context_exists_in_bp.py scans _DIRECTIVE_WINDOW = 3 lines above a job key for directive comments. The original placement had the directive 5 lines above the job key, so the lint would fail to detect it and flag the new emission as a violation. ## How Condensed the comment block and placed the directive on the last line before the job key (line 40, job key on line 41). Verified with the lint regex locally. ## Related - PR #2186 (the workflow introduction) - internal#350 (Tier 2g lint spec) /sop-ack comprehensive-test /sop-ack security-review N/A — no runtime code /sop-ack docs-updated N/A — no user-facing change /sop-ack backwards-compatible /sop-ack rollback-plan N/A — no deployment change /sop-ack monitoring-alerts N/A — no new alerts /sop-ack runbook-linked N/A — no ops change
core-be added 59 commits 2026-06-04 07:19:10 +00:00
test(gate): CR2 Finding 1 — workflow-run freshness assertion in live-fire test (#2163)
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_review) Has been skipped
Details
sop-tier-check / tier-check (pull_request_review) Successful in 5s
Details
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
CI / Python Lint & Test (pull_request) Successful in 3s
Details
CI / Detect changes (pull_request) Successful in 5s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 6s
Details
E2E Chat / detect-changes (pull_request) Successful in 6s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 6s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 4s
Details
qa-review / approved (pull_request_target) Successful in 4s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 5/7 — missing: root-cause, no-backwards-compat
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
security-review / approved (pull_request_target) Failing after 5s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 4s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 5s
Details
CI / Platform (Go) (pull_request) Successful in 2s
Details
CI / Canvas (Next.js) (pull_request) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
Details
CI / all-required (pull_request) Successful in 30s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 57s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 1s
Details
Ops Scripts Tests / Ops scripts (unittest) (pull_request) Successful in 1m3s
Details
E2E Chat / E2E Chat (pull_request) Successful in 35s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 12s
Details
audit-force-merge / audit (pull_request_target) Successful in 5s
Details
bf0a558e7d 
Replace the single-field _get_status_updated_at with a richer
_get_status_snapshot that captures status id, updated_at, and target_url.
Add _extract_run_id helper to parse the Actions run_id from the
status target_url (Gitea 1.22.6 lacks REST /actions/runs/* endpoints,
so the run_id embedded in target_url is the strongest available proxy
for distinct run_id).

_poll_fresh_statuses now considers a status fresh if ANY of the
following changed from the pre-review snapshot: updated_at, id, or
target_url. This catches both timestamp-only updates and new-run
indicators.

In the test body, collect pre-existing run_ids before submitting the
APPROVED review. After polling, assert that each required context's
fresh status either has no target_url/run_id (cannot verify) or points
to a run_id that did NOT exist before the review. This proves the
status was posted by a NEW workflow run triggered from the
pull_request_review event, not merely updated in-place by an earlier
run.

Findings 2 & 3 (APPROVED spelling, HTTPError body double-read) were
already fixed in commit 77573074.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
test(integration): close fail-open routes in handler Postgres integration tests (#2166 blocker #2)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 4s
Details
CI / Python Lint & Test (pull_request) Successful in 3s
Details
Harness Replays / detect-changes (pull_request) Successful in 4s
Details
CI / Detect changes (pull_request) Successful in 10s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
E2E Chat / detect-changes (pull_request) Successful in 11s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 10s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 12s
Details
Harness Replays / Harness Replays (pull_request) Successful in 2s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 4s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 12s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 18s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 12s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
CI / Canvas (Next.js) (pull_request) Successful in 6s
Details
qa-review / approved (pull_request_target) Failing after 5s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-tier-check / tier-check (pull_request_target) Successful in 4s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 12s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
security-review / approved (pull_request_target) Failing after 15s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 17s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 23s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 52s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m7s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m4s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m15s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m11s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m43s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2m21s
Details
CI / Platform (Go) (pull_request) Successful in 4m5s
Details
CI / all-required (pull_request) Successful in 1s
Details
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_review) Has been skipped
Details
sop-tier-check / tier-check (pull_request_review) Successful in 6s
Details
ad05e6db7f 
**Step A — Go-level fail-closed**

Extract a shared `requireIntegrationDBURL(t)` helper into
`integration_helper_test.go` (build-tag: integration). The helper:
- Returns $INTEGRATION_DB_URL when present
- Calls `t.Fatalf` when the URL is empty AND any CI marker is set
  (`CI`, `GITHUB_ACTIONS`, or `GITEA_ACTIONS`), preventing a silent
  skip-to-green in CI
- Calls `t.Skip` when the URL is empty AND no CI marker is set,
  preserving the local-dev ergonomics

Update all three integration test files to use the shared helper:
- delegation_ledger_integration_test.go
- pending_uploads_integration_test.go
- workspace_create_name_integration_test.go

This closes the Go-level fail-open where a missing INTEGRATION_DB_URL
in CI would cause every integration test to skip and report PASS.

**Step C — Workflow bash preflight**

Add a `Preflight — INTEGRATION_DB_URL must be present` step in
`.gitea/workflows/handlers-postgres-integration.yml` immediately before
the `go test` invocation. If the postgres-start step failed to export
the variable, the preflight exits 1 with `::error::` so the job fails
loud before the test binary can even start.

**Step B — Workflow CoE mask**

ALREADY FIXED in current main: both `detect-changes` and `integration`
jobs have `continue-on-error: false` (lines 93 and 125). The context is
already listed in `audit-force-merge.yml` REQUIRED_CHECKS_JSON for
`main`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(ci): remove credential leak in integration workflow preflight
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_review) Has been skipped
Details
sop-tier-check / tier-check (pull_request_review) Successful in 3s
Details
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 0s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 4s
Details
CI / Python Lint & Test (pull_request) Successful in 4s
Details
CI / Detect changes (pull_request) Successful in 8s
Details
E2E Chat / detect-changes (pull_request) Successful in 7s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 7s
Details
Harness Replays / detect-changes (pull_request) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 7s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 2s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 4s
Details
qa-review / approved (pull_request_target) Successful in 3s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m1s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
security-review / approved (pull_request_target) Failing after 3s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 49s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 3s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 56s
Details
sop-checklist / all-items-acked (pull_request) acked: 3/7 — missing: local-postgres-e2e, staging-smoke, root-cause, +1
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m5s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 15s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m6s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 2s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
CI / Canvas (Next.js) (pull_request) Successful in 8s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Harness Replays / Harness Replays (pull_request) Successful in 15s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m9s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m9s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 3m34s
Details
CI / Platform (Go) (pull_request) Successful in 7m39s
Details
CI / all-required (pull_request) Successful in 1s
Details
audit-force-merge / audit (pull_request_target) Successful in 10s
Details
46a0b2963f 
The ${INTEGRATION_DB_URL%%@*} pattern strips only the host portion,
leaving the user:password prefix exposed in CI logs. Replace with a
static confirmation string.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(handlers): validate derived provider against registry at config-SAVE (issue #2172)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 6s
Details
CI / Python Lint & Test (pull_request) Successful in 7s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Harness Replays / detect-changes (pull_request) Successful in 4s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
E2E Chat / detect-changes (pull_request) Successful in 11s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
security-review / approved (pull_request_target) Failing after 5s
Details
qa-review / approved (pull_request_target) Failing after 6s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 6s
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 5s
Details
Harness Replays / Harness Replays (pull_request) Successful in 1s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 5s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 28s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 22s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 28s
Details
CI / Detect changes (pull_request) Successful in 30s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (pull_request) Successful in 30s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request) Successful in 5s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 3s
Details
CI / Canvas (Next.js) (pull_request) Successful in 3s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m0s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m18s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m26s
Details
E2E Staging External Runtime / E2E Staging External Runtime (pull_request) Successful in 5m42s
Details
CI / Platform (Go) (pull_request) Successful in 5m46s
Details
CI / all-required (pull_request) Successful in 1s
Details
audit-force-merge / audit (pull_request_target) Successful in 9s
Details
e53a47b40b 
Catches the adk-demo Assistant boot failure class (2026-06-03):
  workspace config model=moonshot/kimi-k2.6 (claude-code)
  → adapter derives provider=moonshot
  → ValueError: provider=moonshot not in providers registry
  → save was accepted, agent wedged at boot, CI never saw it

The drift gate (RFC#580) validates templates; the existing model-side
validator (validateRegisteredModelForRuntime, P4 PR-2) catches a
(runtime, model) the runtime doesn't own. Neither checked the
DERIVED provider's membership in providers.yaml — the gate the
adapter actually trips at boot.

Fix (issue #2172, fail-closed at config-SAVE):
  * validateDerivedProviderInRegistry (this PR) — load the manifest,
    call DeriveProvider(runtime, model, nil) to get the provider the
    adapter will resolve, and assert the provider name is in the
    providers list. Returns 422 DERIVED_PROVIDER_NOT_IN_REGISTRY with
    the sorted list of valid providers (actionable, unlike the
    boot-time ValueError). Federation contract mirrored from the
    model-side check (langgraph/external/kimi/mock pass through).
  * Wired into CreateWorkspace after the existing model-side check.
    Both gates fail-closed for first-party runtimes and fail-open for
    non-registry / federated runtimes — the same shape.
  * TestRegistryConsistency_AllNativeModelsDeriveToKnownProvider —
    the static regression gate the issue asks for ('a CI test fails
    if any shipped demo/template config references an unregistered
    provider'), generalized to the catalog: walk every (runtime,
    model) in the native model sets and assert each one derives to
    a provider in the providers list. By construction always true
    today, but fires on any future drift between providers: and
    runtimes: in providers.yaml (the exact class cp#455 / boot-e2e
    targets at the runtime layer).
  * TestValidateDerivedProviderInRegistry — table-driven pass/fail
    coverage mirroring TestValidateRegisteredModelForRuntime, plus
    the langgraph / external / empty-model fail-open cases.

Pairs with cp#455 boot-to-registration e2e (the deep runtime layer);
this is the fast static layer the issue asked for. Reverts cleanly
by deleting the new validator + the wire-up in workspace.go.

SOP: /sop-ack engineer-ack as fullstack-engineer
Tested: build drift pre-checked; test cases pin both happy path
and the federation contract.
feat(providers): mirror google-adk platform provider + derive required_env from IsPlatform (proper SSOT, task #65) fcd88db315
feat(providers): mirror google-adk platform provider + derive required_env from IsPlatform (proper SSOT, task #65) eec4dc6d49
feat(providers): mirror google-adk platform provider + derive required_env from IsPlatform (proper SSOT, task #65) 73dce44cd4
feat(providers): mirror google-adk platform provider + derive required_env from IsPlatform (proper SSOT, task #65) 36f9ed84a0
feat(providers): mirror google-adk platform provider + derive required_env from IsPlatform (proper SSOT, task #65)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
CI / Python Lint & Test (pull_request) Successful in 5s
Details
CI / Detect changes (pull_request) Successful in 13s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 15s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 15s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 11s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (pull_request) Failing after 5s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 6s
Details
CI / Canvas (Next.js) (pull_request) Successful in 8s
Details
E2E Chat / detect-changes (pull_request) Successful in 8s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 10s
Details
security-review / approved (pull_request_target) Failing after 8s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Harness Replays / detect-changes (pull_request) Successful in 12s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (pull_request) Successful in 26s
Details
Harness Replays / Harness Replays (pull_request) Successful in 1s
Details
E2E Chat / E2E Chat (pull_request) Successful in 9s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 55s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m1s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 11s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m17s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 16s
Details
CI / Platform (Go) (pull_request) Failing after 3m22s
Details
CI / all-required (pull_request) Has been skipped
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, l
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 3s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 5s
Details
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_review) Has been skipped
Details
qa-review / approved (pull_request_target) Refired via /qa-recheck by unknown
Details
sop-tier-check / tier-check (pull_request_review) Successful in 6s
Details
fa00d4f018
chore(providers): re-pin canonical providers.yaml sha256 for the google-adk platform-arm sync (cp#511)
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
CI / Python Lint & Test (pull_request) Successful in 6s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 5s
Details
CI / Detect changes (pull_request) Successful in 11s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (pull_request) Failing after 4s
Details
Harness Replays / detect-changes (pull_request) Successful in 10s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 9s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 9s
Details
E2E Chat / detect-changes (pull_request) Successful in 13s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 13s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 7s
Details
qa-review / approved (pull_request_target) Failing after 5s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 15s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 16s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 2s
Details
CI / Canvas (Next.js) (pull_request) Successful in 2s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, l
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-tier-check / tier-check (pull_request_target) Successful in 7s
Details
Harness Replays / Harness Replays (pull_request) Successful in 7s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 12s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 9s
Details
security-review / approved (pull_request_target) Failing after 13s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (pull_request) Successful in 43s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 53s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 53s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m47s
Details
ci-arm64-advisory / fast-checks (pull_request) Has been cancelled
Details
CI / Platform (Go) (pull_request) Has been cancelled
Details
CI / all-required (pull_request) Has been cancelled
Details
227abeb432
fix(providers): byte-sync core providers.yaml to controlplane canonical (cp#511 google-adk platform arm)
ci-arm64-advisory / fast-checks (pull_request) Has been cancelled
Details
CI / Platform (Go) (pull_request) Has been cancelled
Details
CI / Canvas (Next.js) (pull_request) Has been cancelled
Details
CI / Shellcheck (E2E scripts) (pull_request) Has been cancelled
Details
CI / Canvas Deploy Reminder (pull_request) Has been cancelled
Details
CI / all-required (pull_request) Has been cancelled
Details
CI / Detect changes (pull_request) Has been cancelled
Details
CI / Python Lint & Test (pull_request) Has been cancelled
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 6s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Has been cancelled
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
E2E Chat / detect-changes (pull_request) Successful in 10s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (pull_request) Has been cancelled
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 10s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (pull_request) Has been cancelled
Details
gate-check-v3 / gate-check (pull_request_target) Has been cancelled
Details
sop-checklist / all-items-acked (pull_request_target) Has been cancelled
Details
sop-checklist / review-refire (pull_request_target) Has been cancelled
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 15s
Details
Harness Replays / detect-changes (pull_request) Successful in 9s
Details
sop-tier-check / tier-check (pull_request_target) Has been cancelled
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 13s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
qa-review / approved (pull_request_target) Failing after 4s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
security-review / approved (pull_request_target) Failing after 9s
Details
Harness Replays / Harness Replays (pull_request) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m7s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m34s
Details
f1c86e188e
chore(gen): regenerate registry from byte-synced providers.yaml c81ac8f849
chore: re-pin canonical sha256 to byte-synced controlplane value
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 5s
Details
CI / Python Lint & Test (pull_request) Successful in 4s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Detect changes (pull_request) Successful in 12s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 9s
Details
E2E Chat / detect-changes (pull_request) Successful in 8s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 7s
Details
Harness Replays / detect-changes (pull_request) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 12s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (pull_request) Successful in 2s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, l
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 4s
Details
CI / Canvas (Next.js) (pull_request) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 8s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 5s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (pull_request) Successful in 21s
Details
Harness Replays / Harness Replays (pull_request) Successful in 13s
Details
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_review) Has been skipped
Details
sop-tier-check / tier-check (pull_request_review) Successful in 7s
Details
qa-review / approved (pull_request_target) Refired via /qa-recheck by unknown
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m8s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m7s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m47s
Details
CI / Platform (Go) (pull_request) Successful in 5m36s
Details
CI / all-required (pull_request) Successful in 1s
Details
security-review / approved (pull_request_target) Refired via /security-recheck by unknown
Details
audit-force-merge / audit (pull_request_target) Successful in 3s
Details
86760f7a3e
Merge pull request 'feat: mirror google-adk platform provider + derive required_env from registry (proper SSOT, task #65)' (#2182) from feat/google-adk-platform-provider-mirror-ssot into main
Block internal-flavored paths / Block forbidden paths (push) Successful in 3s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 1s
Details
CI / Python Lint & Test (push) Successful in 7s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 4s
Details
CI / Detect changes (push) Successful in 8s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (push) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 5s
Details
E2E API Smoke Test / detect-changes (push) Successful in 10s
Details
E2E Chat / detect-changes (push) Successful in 10s
Details
CI / Canvas (Next.js) (push) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 1s
Details
Harness Replays / detect-changes (push) Successful in 11s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 11s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 12s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 15s
Details
Harness Replays / Harness Replays (push) Successful in 4s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 3s
Details
publish-workspace-server-image / build-and-push (push) Failing after 27s
Details
publish-workspace-server-image / Production auto-deploy (push) Has been skipped
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 52s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (push) Successful in 59s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m6s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / all-required (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Platform (Go) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
E2E Chat / E2E Chat (push) Successful in 2m23s
Details
8a91465dc8
Merge pull request 'fix(handlers): validate derived provider against registry at config-SAVE (issue #2172)' (#2179) from feat/2172-config-save-provider-validation into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
CI / Python Lint & Test (push) Successful in 5s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 12s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 1s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 7s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 3s
Details
Harness Replays / detect-changes (push) Successful in 2s
Details
CI / Detect changes (push) Successful in 26s
Details
E2E API Smoke Test / detect-changes (push) Successful in 21s
Details
E2E Chat / detect-changes (push) Successful in 20s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 3s
Details
Harness Replays / Harness Replays (push) Successful in 1s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 9s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 5s
Details
CI / Canvas (Next.js) (push) Successful in 1s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 7s
Details
CI / Canvas Deploy Reminder (push) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 4s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (push) Successful in 34s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 1m35s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 2m4s
Details
E2E Chat / E2E Chat (push) Successful in 2m23s
Details
CI / Platform (Go) (push) Successful in 4m8s
Details
CI / all-required (push) Successful in 2s
Details
E2E Staging External Runtime / E2E Staging External Runtime (push) Successful in 5m10s
Details
publish-workspace-server-image / build-and-push (push) Failing after 17s
Details
publish-workspace-server-image / Production auto-deploy (push) Has been skipped
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (push) Has been skipped
Details
6b2b838657
fix(workspace-server): stamp DeriveProvider result into ensureDefaultConfig (provider field) — fixes canvas moonshot/kimi-k2.6 NOT_CONFIGURED
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 4s
Details
CI / Python Lint & Test (pull_request) Successful in 4s
Details
CI / Detect changes (pull_request) Successful in 6s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 5s
Details
E2E Chat / detect-changes (pull_request) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 5s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 3s
Details
Harness Replays / detect-changes (pull_request) Successful in 2s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 3s
Details
qa-review / approved (pull_request_target) Failing after 3s
Details
security-review / approved (pull_request_target) Failing after 3s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 3s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 3s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 23s
Details
CI / Canvas (Next.js) (pull_request) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 1s
Details
Harness Replays / Harness Replays (pull_request) Successful in 2s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m12s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 53s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m8s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Failing after 4m12s
Details
CI / Platform (Go) (pull_request) Successful in 3m56s
Details
CI / all-required (pull_request) Successful in 1s
Details
audit-force-merge / audit (pull_request_target) Successful in 5s
Details
38bd7bb9ed 
A canvas-created claude-code workspace with model moonshot/kimi-k2.6 booted
NOT_CONFIGURED: the adapter slash-split the model id to provider="moonshot",
which is not in the providers registry. CP bakes `provider: platform` via
heredoc, but the cp#329 config-bundle fetch overwrites /configs/config.yaml
with the (previously providerless) bundle version, so molecule-runtime
config.py re-derived the wrong provider and the adapter raised ValueError.

Fix A: in ensureDefaultConfig, derive the provider via the SAME providers
manifest path the config-SAVE validators use (providerRegistry() +
Manifest.DeriveProvider, nil auth env) and stamp it into config.yaml at both
the top level and under runtime_config, mirroring CP's buildModelProviderYAML
shape. The derive uses the FULL un-normalized model id so the exact-id match
resolves moonshot/kimi-k2.6 -> platform before claude-code normalization
strips the slash prefix.

Fail-open: a derive miss (unregistered model, unknown runtime, registry
unavailable) omits the provider field entirely — preserving today's behavior;
provisioning never fails on a miss. The existing template providers: registry
block injection is unchanged.

Tests: assert provider=platform (top-level + runtime_config) for claude-code +
moonshot/kimi-k2.6, and assert no provider: key for an unregistered model.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(canvas): CreateWorkspaceDialog uses registry provider catalog — platform bucket + correct llm_provider for moonshot/kimi-k2.6
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 2s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Python Lint & Test (pull_request) Successful in 4s
Details
CI / Detect changes (pull_request) Successful in 4s
Details
Harness Replays / detect-changes (pull_request) Successful in 4s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 6s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
E2E Chat / detect-changes (pull_request) Successful in 6s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 7s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 8s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 10s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 7s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 5s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
Harness Replays / Harness Replays (pull_request) Successful in 1s
Details
security-review / approved (pull_request_target) Failing after 5s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 4s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 5s
Details
CI / Platform (Go) (pull_request) Successful in 5s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 5s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
Details
qa-review / approved (pull_request_target) Failing after 9s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 4s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m10s
Details
CI / Canvas (Next.js) (pull_request) Successful in 5m13s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 2s
Details
audit-force-merge / audit (pull_request_target) Successful in 10s
Details
b92b4a2768 
Root cause: the Create Workspace dialog built its provider→model dropdown
catalog with the LEGACY buildProviderCatalog(llmModels), whose inferVendor
heuristic slash-splits a platform model id like `moonshot/kimi-k2.6` into
vendor `moonshot`. There was therefore no `Platform` bucket and the create
payload sent `llm_provider: "moonshot"` for a platform-managed model.

ConfigTab was migrated to the registry-backed catalog
(buildProviderCatalogFromRegistry) in internal#718 P3; CreateWorkspaceDialog
was not. This mirrors that migration:

- Thread the registry fields (registry_backed / registry_providers /
  registry_models) — already returned by GET /templates — through TemplateSpec.
- When the selected runtime's /templates row is registry_backed, build the
  catalog from registry_providers/registry_models (each model carries its
  DERIVED provider, e.g. moonshot/kimi-k2.6 → "platform"), feed the selector
  the registry models, and pass the prebuilt catalog verbatim. Restores the
  `Platform` bucket and makes the payload send `llm_provider: platform`.
- Non-registry runtimes / older backends keep the legacy buildProviderCatalog
  fallback unchanged.

Tests: added a registry-backed claude-code fixture whose plain models[] is
UN-annotated (so the legacy path would mis-bucket to "moonshot"), asserting the
Platform bucket appears and selecting moonshot/kimi-k2.6 yields
llm_provider: platform; plus a MiniMax derived-provider/BYOK case. Verified the
3 new tests FAIL on the pre-fix code and PASS after. Full canvas suite: 3334
passed / 3 skipped. tsc: 0 new errors (223→223, all pre-existing test Mock
drift). eslint clean on touched files.

Fix C of the RFC#340 convergence (cosmetic/UX, client-only, no serving-path
risk). Fix A (workspace-server) is the boot fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(ci): drop deleted org-template repos from manifest.json (free-beats-all, medo-smoke) — unblocks Pre-clone manifest deps / image publish
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Python Lint & Test (pull_request) Successful in 3s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 9s
Details
CI / Detect changes (pull_request) Successful in 6s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 7s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
E2E Chat / detect-changes (pull_request) Successful in 6s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 7s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 6s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 12s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
qa-review / approved (pull_request_target) Failing after 5s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
security-review / approved (pull_request_target) Failing after 6s
Details
CI / Platform (Go) (pull_request) Successful in 2s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 5s
Details
CI / Canvas (Next.js) (pull_request) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
Details
E2E Chat / E2E Chat (pull_request) Successful in 3s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 16s
Details
CI / all-required (pull_request) Successful in 18s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 57s
Details
audit-force-merge / audit (pull_request_target) Successful in 11s
Details
37640219f3 
The two org-template repos were intentionally deleted; manifest.json still
referenced them so clone-manifest.sh 404'd → build-and-push failed → main red.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge pull request 'fix(ci): drop deleted org-template repos from manifest.json — unblocks image publish (main-red #2183)' (#2190) from fix/manifest-rm-deleted-org-templates into main
Block internal-flavored paths / Block forbidden paths (push) Successful in 3s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 2s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 4s
Details
CI / Detect changes (push) Successful in 10s
Details
CI / Python Lint & Test (push) Successful in 9s
Details
E2E API Smoke Test / detect-changes (push) Successful in 9s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 9s
Details
CI / Platform (Go) (push) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 2s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 1s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 2s
Details
E2E Chat / detect-changes (push) Successful in 13s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 8s
Details
CI / Canvas (Next.js) (push) Successful in 6s
Details
E2E Chat / E2E Chat (push) Successful in 1s
Details
CI / Canvas Deploy Reminder (push) Successful in 2s
Details
CI / all-required (push) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m4s
Details
publish-workspace-server-image / build-and-push (push) Successful in 4m32s
Details
publish-workspace-server-image / Production auto-deploy (push) Failing after 2m31s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
45eb7adc20
Merge pull request 'fix(workspace-server): stamp DeriveProvider result into ensureDefaultConfig (provider field) — fixes canvas moonshot/kimi-k2.6 NOT_CONFIGURED' (#2187) from fix/ensure-default-config-stamp-derived-provider into main
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 1s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 4s
Details
CI / Python Lint & Test (push) Successful in 10s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 12s
Details
Harness Replays / detect-changes (push) Successful in 11s
Details
E2E API Smoke Test / detect-changes (push) Successful in 32s
Details
E2E Chat / detect-changes (push) Successful in 32s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 16s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (push) Successful in 35s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 8s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 11s
Details
Harness Replays / Harness Replays (push) Successful in 2s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 59s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m6s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Platform (Go) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas (Next.js) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Shellcheck (E2E scripts) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas Deploy Reminder (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / all-required (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Detect changes (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (push) Failing after 5m21s
Details
E2E Chat / E2E Chat (push) Successful in 4m56s
Details
publish-workspace-server-image / build-and-push (push) Successful in 7m43s
Details
publish-workspace-server-image / Production auto-deploy (push) Failing after 2m52s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Has been cancelled
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Has been cancelled
Details
eb31bcf643
Merge pull request 'fix(canvas): CreateWorkspaceDialog uses registry provider catalog — platform bucket + correct llm_provider for moonshot/kimi-k2.6' (#2188) from fix/create-dialog-registry-provider-catalog into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 3s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 8s
Details
CI / Python Lint & Test (push) Successful in 6s
Details
E2E API Smoke Test / detect-changes (push) Successful in 11s
Details
E2E Chat / detect-changes (push) Successful in 8s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 6s
Details
CI / Detect changes (push) Successful in 39s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 4s
Details
Harness Replays / detect-changes (push) Successful in 6s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 7s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 7s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 3s
Details
CI / Platform (Go) (push) Successful in 2s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 15s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 1s
Details
Harness Replays / Harness Replays (push) Successful in 25s
Details
publish-canvas-image / Build & push canvas image (push) Successful in 1m43s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m10s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m44s
Details
E2E Chat / E2E Chat (push) Failing after 4m13s
Details
CI / Canvas (Next.js) (push) Successful in 6m19s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
CI / all-required (push) Successful in 1s
Details
publish-workspace-server-image / Production auto-deploy (push) Failing after 6m18s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Failing after 15m40s
Details
286338055b
fix(ci): superseded prod-deploy job no longer false-reds as "stale"
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 8s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 6s
Details
CI / Python Lint & Test (pull_request) Successful in 10s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 5s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 11s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 9s
Details
E2E Chat / detect-changes (pull_request) Successful in 15s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 14s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
CI / Detect changes (pull_request) Successful in 29s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 28s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 18s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 10s
Details
qa-review / approved (pull_request_target) Failing after 10s
Details
security-review / approved (pull_request_target) Failing after 5s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 5s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
CI / Platform (Go) (pull_request) Successful in 1s
Details
CI / Canvas (Next.js) (pull_request) Successful in 1s
Details
E2E Chat / E2E Chat (pull_request) Successful in 5s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
sop-tier-check / tier-check (pull_request_target) Successful in 6s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
CI / all-required (pull_request) Successful in 2s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 3s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m5s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m12s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m16s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m9s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m20s
Details
Ops Scripts Tests / Ops scripts (unittest) (pull_request) Successful in 1m1s
Details
audit-force-merge / audit (pull_request_target) Successful in 8s
Details
450fedac9b 
publish-workspace-server-image / Production auto-deploy intermittently
fails on main with:

    ::error::<slug> is stale: actual=<newerSHA>, expected=<thisSHA>

Root cause: the workflow deliberately has no `concurrency:` (Gitea
1.22.6 cancels queued runs even with cancel-in-progress:false, which is
unacceptable for a prod deploy). So when two main pushes land close
together (eb31bcf then 286338), BOTH deploy-production jobs run. The
newer job (286338 -> staging-2863380) rolls the fleet forward first;
then the OLDER job (eb31bcf) runs "Verify reachable tenants report this
SHA", sees tenants on 2863380, and fails on STRICT SHA EQUALITY — even
though the fleet is AHEAD, not behind. Git SHAs aren't ordered and
/buildinfo exposes only git_sha (no build time / monotonic number), so
the verify can't tell "ahead" from "behind" on its own.

Fix (option b — superseded-job detection): before the strict verify,
ask Gitea for the current head of the deploy branch (main). If it is no
longer this job's GITHUB_SHA, a newer commit has landed and this deploy
is superseded; the newest job's verify is authoritative. Log a notice
and exit success, skipping strict equality for the stale job.

Why this preserves real-stale detection:
- Only the SUPERSEDED (older) job skips strict verify. The LATEST deploy
  job (head == its SHA) still runs strict equality, so a genuinely
  behind/older tenant still fails loudly.
- Fail-safe: if the branch head can't be read (no token / API error) or
  equals our SHA, superseded_by returns None -> strict verify runs. An
  unreadable head never silently greens a deploy.

Why not the alternatives:
- (a) build-timestamp/monotonic compare: /buildinfo returns only
  {git_sha} (router.go, buildinfo.go). Adding a build-time field needs a
  workspace-server binary + Dockerfile change and a full fleet rebuild
  before it can be relied on — heavy and slow to take effect.
- (c) concurrency: forbidden by the workflow header (Gitea cancels
  queued prod deploys).

Verification:
- New unit tests for superseded_by / current_branch_head and the
  fail-safe path; full suite 33 passed.
- Workflow yaml-lint clean (lint-workflow-yaml.py).
- CLI smoke test: eb31bcf-vs-2863380 -> exit 0 (skip, success);
  latest job -> exit 10 (run strict verify); unreadable head -> exit 10.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(workspace-server): persist push-mode chat round-trip synchronously (E2E Chat reload flake = real data-loss race)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 5s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Python Lint & Test (pull_request) Successful in 5s
Details
CI / Detect changes (pull_request) Successful in 7s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 5s
Details
E2E Chat / detect-changes (pull_request) Successful in 7s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Failing after 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 3s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 46s
Details
Harness Replays / detect-changes (pull_request) Successful in 50s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 56s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 16s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 11s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 57s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 54s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
qa-review / approved (pull_request_target) Failing after 12s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 7s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m11s
Details
security-review / approved (pull_request_target) Failing after 12s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 19s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m15s
Details
Harness Replays / Harness Replays (pull_request) Successful in 15s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m10s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 54s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m10s
Details
CI / Platform (Go) (pull_request) Successful in 4m5s
Details
CI / Canvas (Next.js) (pull_request) Successful in 6m15s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 2s
Details
audit-force-merge / audit (pull_request_target) Successful in 6s
Details
8bcf228904 
Root cause of the intermittent `E2E Chat / E2E Chat` red
(`chat-mobile.spec.ts › history persists across reload`) is a REAL
product persistence race, not test fragility.

The push-mode A2A success path (`logA2ASuccess`) wrote the `a2a_receive`
activity_logs row — the ONLY durable record of a chat round-trip
(request_body = user message, response_body = agent reply, both read
back by chat-history hydration) — in a DETACHED goroutine via `goAsync`.
`ProxyA2A` flushes the HTTP 200 (carrying the reply) the moment
`proxyA2ARequest` returns, i.e. BEFORE that goroutine's INSERT commits.
The test's `page.reload()` then fires `GET /chat-history`, which reads
activity_logs and can miss the not-yet-committed row → "Mobile
persistence" absent → red. Outside the test the same window loses the
message on a reload / workspace-server restart / deploy / OOM between the
200 and the goroutine commit.

The poll-mode sibling path (`logA2AReceiveQueued` /
`persistUserMessageAtIngest`) was already made synchronous for exactly
this incident class (internal#470 / #1347 / RFC#2945). The push-mode
counterpart was left async — fixed here by writing the row inline
(context.WithoutCancel so a chat-exit disconnect can't abort it; still
best-effort so a DB hiccup never fails the user's send). The 200 is now
emitted only after the durable row exists.

Secondary determinism hardening:
- chat-mobile spec: after reload, deterministically wait for the
  `GET /chat-history` 2xx that rehydrates the transcript before asserting
  visibility, instead of racing a fixed 5s render timeout against an
  in-flight fetch.
- e2e-chat.yml canvas readiness: probe the real `/?m=chat` route for a
  2xx (Turbopack compiles routes lazily — a bare `curl /` 200s before the
  page the tests load has compiled) and raise the cold-start budget
  30s→120s to kill the `Canvas did not start in 30s` flake.

Verification: `go build`, `go vet`, full `internal/handlers` +
`internal/messagestore` test suites green (sqlmock, no DB needed);
Playwright spec compiles + lists; eslint clean. Browser E2E not run
locally (needs Postgres+Redis+platform+canvas servers).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge pull request 'fix(ci): superseded prod-deploy job no longer false-reds as "stale"' (#2194) from fix/deploy-production-superseded-false-stale into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 6s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 2s
Details
CI / Python Lint & Test (push) Successful in 4s
Details
CI / Detect changes (push) Successful in 9s
Details
E2E API Smoke Test / detect-changes (push) Successful in 7s
Details
E2E Chat / detect-changes (push) Successful in 6s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 6s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 3s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 4s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 5s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 3s
Details
CI / Platform (Go) (push) Successful in 2s
Details
CI / Canvas (Next.js) (push) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 1s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 2s
Details
E2E Chat / E2E Chat (push) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 2s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
CI / all-required (push) Successful in 24s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Successful in 1m11s
Details
Ops Scripts Tests / Ops scripts (unittest) (push) Successful in 1m2s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 1m7s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m4s
Details
publish-workspace-server-image / build-and-push (push) Successful in 6m4s
Details
publish-workspace-server-image / Production auto-deploy (push) Failing after 2m28s
Details
5f0351c59f
fix(ci): writable HOME+DOCKER_CONFIG in Production auto-deploy (fixes #2193 — mkdir /home/hongming perm denied halting prod rollout)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Python Lint & Test (pull_request) Successful in 2s
Details
CI / Detect changes (pull_request) Successful in 5s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 7s
Details
E2E Chat / detect-changes (pull_request) Successful in 8s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 3s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 9s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 6s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 2s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 4s
Details
sop-checklist / all-items-acked (pull_request_target) Has been cancelled
Details
sop-checklist / review-refire (pull_request_target) Has been cancelled
Details
security-review / approved (pull_request_target) Failing after 3s
Details
CI / Platform (Go) (pull_request) Successful in 1s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 51s
Details
CI / Canvas (Next.js) (pull_request) Successful in 2s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 49s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 51s
Details
CI / all-required (pull_request) Successful in 14s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 7s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m11s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 19s
Details
E2E Chat / E2E Chat (pull_request) Successful in 19s
Details
qa-review / approved (pull_request_target) Refired via /qa-recheck by unknown
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m13s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m11s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m32s
Details
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_review) Has been skipped
Details
sop-tier-check / tier-check (pull_request_review) Successful in 6s
Details
audit-force-merge / audit (pull_request_target) Successful in 4s
Details
1e4ed28023
test(provision): SSOT-parametrized + real-boot regression for moonshot/kimi NOT_CONFIGURED
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 6s
Details
E2E Chat / detect-changes (pull_request) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 5s
Details
Harness Replays / detect-changes (pull_request) Successful in 2s
Details
CI / Detect changes (pull_request) Successful in 59s
Details
CI / Python Lint & Test (pull_request) Successful in 34s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 1m2s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 23s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 18s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 25s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 27s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 26s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 25s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 12s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 11s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
security-review / approved (pull_request_target) Failing after 20s
Details
qa-review / approved (pull_request_target) Failing after 23s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m6s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 28s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 26s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m2s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m18s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m38s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
Harness Replays / Harness Replays (pull_request) Successful in 1s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 3m5s
Details
CI / Canvas (Next.js) (pull_request) Successful in 21s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging Platform Boot (pull_request) Failing after 3m47s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 52s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 36s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Failing after 4m38s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m16s
Details
CI / Platform (Go) (pull_request) Successful in 4m24s
Details
CI / all-required (pull_request) Successful in 34s
Details
audit-force-merge / audit (pull_request_target) Successful in 4s
Details
9c506d5c8c 
The moonshot/kimi incident: a canvas-created claude-code workspace with
provider=Platform + model=moonshot/kimi-k2.6 booted NOT_CONFIGURED in prod
because the generated config.yaml lacked the manifest-derived `provider:`
key, so the adapter slash-split "moonshot/..." -> unregistered provider.
Fixed by #2187 (ensureDefaultConfig stamps DeriveProvider->provider:platform)
+ #2188 (canvas). Unit tests passed; the REAL boot path was the gap.

This adds comprehensive regression coverage so the CLASS cannot reship:

Deterministic (no live infra, runs in the normal unit suite):
  workspace-server/internal/handlers/workspace_provision_platform_boot_test.go
  - TestEnsureDefaultConfig_StampsProviderForEverySSOTPlatformModel:
    enumerates the claude-code `platform` arm from the providers SSOT
    (providers.LoadManifest) and asserts ensureDefaultConfig stamps
    provider:platform (top-level AND runtime_config) for EVERY offered
    platform model — not just the single moonshot/kimi pin #2187 shipped.
    A newly-offered platform model gets a case for free and only passes if
    actually stamped (closes the offered-but-not-stamped divergence the bug
    rode in on). Mutation-verified: disabling the stamp fails the test.
  - TestPlatformModelDeriveProvider_SSOTConsistency: the upstream half —
    DeriveProvider maps every SSOT platform model to provider Name "platform".

Real-boot (staging; I will run it):
  Extends the existing staging harness (no new harness) with a
  platform-managed path: E2E_LLM_PATH=platform pin-selects moonshot/kimi-k2.6,
  sends NO tenant key, and reuses the harness's online-wait + completion
  assertions to prove the workspace reaches status=online (not
  not_configured) and a completion returns 200. The BYOK branches never
  exercised the platform arm — the exact arm the bug shipped on.
  - tests/e2e/lib/model_slug.sh: platform path + override semantics
  - tests/e2e/test_model_slug.sh: 4 new pinned cases (16/16 green)
  - tests/e2e/test_staging_full_saas.sh: empty-secrets platform branch
  - .gitea/workflows/e2e-staging-saas.yml: new `E2E Staging Platform Boot`
    job (continue-on-error during de-flake; bp-required: pending #2187),
    + providers.yaml/model_slug.sh added to the path triggers.

Coverage-audit theme: mc#1982 (continue-on-error masks; de-flake-then-gate).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge pull request 'fix(ci): writable HOME in Production auto-deploy — unblock fleet-wide deploys (#2193)' (#2196) from sre/fix-auto-deploy-writable-home-2193 into main
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 0s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 4s
Details
E2E API Smoke Test / detect-changes (push) Successful in 5s
Details
E2E Chat / detect-changes (push) Successful in 5s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 6s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 2s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 3s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 1m8s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 3s
Details
E2E Chat / E2E Chat (push) Successful in 3s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 3s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Detect changes (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Platform (Go) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas (Next.js) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Shellcheck (E2E scripts) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas Deploy Reminder (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Python Lint & Test (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / all-required (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m28s
Details
publish-workspace-server-image / build-and-push (push) Successful in 10m31s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 2m55s
Details
619258cd23
Merge pull request 'fix(workspace-server): persist push-mode chat round-trip synchronously — E2E Chat reload flake is a real data-loss race' (#2195) from fix/e2e-chat-mobile-history-reload-flake into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 0s
Details
publish-canvas-image / Build & push canvas image (push) Successful in 1m22s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 12s
Details
CI / Python Lint & Test (push) Successful in 5s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 4s
Details
CI / Detect changes (push) Successful in 17s
Details
Harness Replays / detect-changes (push) Successful in 5s
Details
E2E Chat / detect-changes (push) Successful in 13s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 12s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Failing after 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 3s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 4s
Details
E2E API Smoke Test / detect-changes (push) Successful in 29s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 25s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 40s
Details
Harness Replays / Harness Replays (push) Successful in 8s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 1m10s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m27s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Successful in 2m35s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 3m41s
Details
CI / Platform (Go) (push) Successful in 4m26s
Details
publish-workspace-server-image / build-and-push (push) Successful in 10m0s
Details
E2E Chat / E2E Chat (push) Successful in 5m42s
Details
CI / Canvas (Next.js) (push) Successful in 6m39s
Details
CI / Canvas Deploy Reminder (push) Successful in 2s
Details
CI / all-required (push) Successful in 2s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 3m24s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Failing after 18m36s
Details
b9d2f023c8
fix(ci): e2e-chat readiness probe — curl -w via tempfile (resolves #2198)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
CI / Python Lint & Test (pull_request) Successful in 6s
Details
CI / Detect changes (pull_request) Successful in 6s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 7s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
E2E Chat / detect-changes (pull_request) Successful in 7s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 15s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 14s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 15s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 2s
Details
qa-review / approved (pull_request_target) Failing after 7s
Details
security-review / approved (pull_request_target) Failing after 8s
Details
CI / Canvas (Next.js) (pull_request) Successful in 1s
Details
CI / Platform (Go) (pull_request) Successful in 6s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 3s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 6s
Details
E2E Chat / E2E Chat (pull_request) Successful in 4s
Details
CI / all-required (pull_request) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 3s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 51s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m1s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m15s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m10s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m14s
Details
audit-force-merge / audit (pull_request_target) Successful in 9s
Details
0d86dbfb25 
The canvas-readiness loop added in PR #2195 captured the curl status
into CODE with `CODE=$(curl -s -o /dev/null -w '%{http_code}' ...
|| echo 000)`. That shape is exactly the BAD_STATUS_CAPTURE pattern
that .gitea/scripts/lint-curl-status-capture.py rejects — curl -w can
write a status to stdout before the || echo 000 fallback fires,
producing polluted values such as a concatenated status string rather
than one code.

Adopt the lint-approved tempfile pattern already used by
e2e-staging-external.yml (set +e / curl -w '...' > file / set -e /
cat file || echo '000') so the captured value is always a clean HTTP
code or '000'.

Closes #2198 (main-red after #2195).
Closes #2199 (auto-filed main-red watchdog, root cause identical to #2198).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(e2e): canvas-tabs staging setup waits for RENDERABLE, not online (#2199)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 5s
Details
CI / Python Lint & Test (pull_request) Successful in 4s
Details
CI / Detect changes (pull_request) Successful in 5s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 6s
Details
E2E Chat / detect-changes (pull_request) Successful in 7s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 7s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 6s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 9s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
qa-review / approved (pull_request_target) Failing after 5s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
security-review / approved (pull_request_target) Failing after 6s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 6s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 39s
Details
Harness Replays / detect-changes (pull_request) Successful in 55s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m0s
Details
CI / Platform (Go) (pull_request) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1s
Details
Harness Replays / Harness Replays (pull_request) Successful in 2s
Details
CI / Canvas (Next.js) (pull_request) Successful in 6m42s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 29s
Details
audit-force-merge / audit (pull_request_target) Successful in 7s
Details
b80816a3b0 
E2E Staging Canvas (Playwright) / "Canvas tabs E2E" went red on main HEAD
b9d2f023. The actual failure (runner-6 task 258160) is in the Playwright
globalSetup, NOT in any spec assertion:

  [staging-setup] Workspace created: 8e5c7354-...
  Error: Workspace failed: (no last_sample_error) full body:
    {... "runtime":"hermes","status":"failed","uptime_seconds":0,
     "last_sample_error":null ...}
    at canvas/e2e/staging-setup.ts:272 (waitFor "workspace online")

Root cause — NOT a canvas/test regression and NOT timing fragility. It is
a deterministic consequence of workspace-server #2162 (merged 2026-06-03,
"platform-managed workspace must fail-closed when CP proxy env absent"),
which is a correct production safety fix. The canvas E2E creates a bare
hermes/gpt-4o workspace that defaults closed to platform_managed; on a
staging tenant without MOLECULE_LLM_BASE_URL / MOLECULE_LLM_USAGE_TOKEN,
the agent now aborts at boot with MISSING_PLATFORM_PROXY — surfacing as
the pre-start credential-abort shape (status:"failed", uptime_seconds:0,
no last_sample_error). Pre-#2162 the same workspace booted credential-less
(the bug #2162 fixed) so the old harness happened to pass.

The fix is in the harness, because this test does not need a booted agent:
staging-tabs.spec.ts only opens the 13 side-panel tabs and asserts no hard
crash / no "Failed to load" toast. It makes zero LLM calls and even mocks
/cp/auth/me + 401→200. All it needs is a workspace ROW so the node + tabs
render.

So step 6 now waits for RENDERABLE instead of strictly online:
  - online                                 -> happy path (staging with proxy env)
  - failed + uptime_seconds==0 + no sample -> pre-start credential-abort:
      agent never ran, row still renders -> proceed, with a loud console.warn
  - any other failed (last_sample_error present, OR uptime_seconds>0 i.e.
      the agent started then crashed)      -> still hard-throws (no masking)

Real infra/provision failure stays loud one step earlier at the org level
(instance_status === "failed", unchanged).

Verification: tsc clean for canvas/e2e/staging-* (pre-existing tsc errors
are all in unrelated __tests__ files); `playwright test --list` resolves
globalSetup + the single spec. Full live run needs staging CP creds not
available locally; the changed branch is the globalSetup readiness gate,
verified by inspection against the captured failing-run body.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge pull request 'fix(ci): e2e-chat readiness probe — curl -w via tempfile (resolves #2198, #2199)' (#2201) from fix/e2e-chat-readiness-curl-tempfile-2198 into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 4s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m21s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 13s
Details
CI / Python Lint & Test (push) Successful in 13s
Details
CI / Detect changes (push) Successful in 22s
Details
E2E API Smoke Test / detect-changes (push) Successful in 14s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 3s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 3s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 3s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Successful in 1m4s
Details
E2E Chat / detect-changes (push) Successful in 1m21s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Successful in 1m7s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 2m24s
Details
CI / Platform (Go) (push) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 2s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 1s
Details
CI / Canvas (Next.js) (push) Successful in 29s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 27s
Details
CI / all-required (push) Successful in 8s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m6s
Details
CI / Canvas Deploy Reminder (push) Successful in 5s
Details
E2E Chat / E2E Chat (push) Successful in 2m16s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 9m27s
Details
9d1b91b980
test(e2e): name the A2A empty-completion failure class in staging SaaS canary
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Python Lint & Test (pull_request) Successful in 14s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 15s
Details
E2E Chat / detect-changes (pull_request) Successful in 22s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 22s
Details
CI / Detect changes (pull_request) Successful in 24s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 22s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 8s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 19s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 22s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
qa-review / approved (pull_request_target) Failing after 8s
Details
security-review / approved (pull_request_target) Failing after 5s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 14s
Details
CI / Platform (Go) (pull_request) Successful in 2s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 12s
Details
CI / Canvas (Next.js) (pull_request) Successful in 2s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 11s
Details
E2E Chat / E2E Chat (pull_request) Successful in 10s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 10s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 23s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 58s
Details
CI / all-required (pull_request) Successful in 7s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m25s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Waiting to run
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Waiting to run
Details
E2E Staging SaaS (full lifecycle) / E2E Staging Platform Boot (pull_request) Waiting to run
Details
audit-force-merge / audit (pull_request_target) Successful in 36s
Details
4fe9e809e9 
Step 8 of the full-lifecycle SaaS canary sends an A2A round-trip to the
parent and asserts a PONG. When the configured completion backend returns
a 2xx with no text part (empty content / tool_calls-or-reasoning-only),
the agent runtime surfaces the literal reply "Error: message contained no
text content." Today that fell through the generic "error|exception"
catch-all and was reported as a vague "A2A returned an error-shaped
response", which misdirects triage to workspace-server.

Add a specific error-class check (mirroring the existing hermes-401 /
quota-exhausted patterns) that names this as a model/provider BACKEND
regression with the operator action, before the generic catch-all. No
behaviour change for healthy runs; the failure still hard-fails — it is
just diagnosed correctly.

Observed 2026-06-03/04: 100% of staging canaries on MODEL_SLUG=MiniMax-M2
(canary default since #2710) hit this on the parent's first cold turn,
identical on main's scheduled synthetic E2E and on open PRs — i.e. an
environmental backend regression, not PR-introduced. This is purely a
diagnostic-precision improvement to the unmodified main-line step-8 block.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge pull request 'test(provision): SSOT-parametrized + real-boot regression for moonshot/kimi NOT_CONFIGURED' (#2197) from test/provider-matrix-boot-regression-moonshot into main
Block internal-flavored paths / Block forbidden paths (push) Successful in 4s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 5s
Details
Harness Replays / detect-changes (push) Successful in 6s
Details
CI / Python Lint & Test (push) Successful in 11s
Details
E2E Chat / detect-changes (push) Successful in 14s
Details
E2E API Smoke Test / detect-changes (push) Successful in 15s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Successful in 6s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 4s
Details
CI / Detect changes (push) Successful in 21s
Details
Harness Replays / Harness Replays (push) Successful in 2s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 22s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 8s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 24s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 34s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 7s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 54s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Successful in 1m15s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 1m17s
Details
E2E Chat / E2E Chat (push) Successful in 2m15s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Platform (Go) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas Deploy Reminder (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / all-required (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas (Next.js) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Shellcheck (E2E scripts) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 2m46s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging Platform Boot (push) Failing after 4m22s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (push) Successful in 52s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (push) Failing after 2m25s
Details
publish-workspace-server-image / build-and-push (push) Successful in 8m50s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 2m32s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Has been cancelled
Details
f503559b06
Merge pull request 'test(e2e): name the A2A empty-completion failure class in staging SaaS canary' (#2203) from devops/saas-a2a-empty-completion-diagnostic into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 1s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 11s
Details
CI / Python Lint & Test (push) Successful in 3s
Details
E2E Chat / detect-changes (push) Successful in 6s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 9s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 4s
Details
E2E Chat / E2E Chat (push) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 1s
Details
CI / Detect changes (push) Successful in 33s
Details
CI / Canvas (Next.js) (push) Successful in 2s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 12s
Details
CI / Platform (Go) (push) Successful in 22s
Details
E2E API Smoke Test / detect-changes (push) Successful in 54s
Details
CI / all-required (push) Successful in 11s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m3s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m10s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (push) Successful in 1m40s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (push) Failing after 2m4s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Failing after 3m6s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 2m36s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging Platform Boot (push) Failing after 6m54s
Details
0ad52852fd
fix(ci): wait for platform /health on a migration-chain-proof budget (#2205)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 4s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 10s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 8s
Details
E2E Chat / detect-changes (pull_request) Successful in 9s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
CI / Python Lint & Test (pull_request) Successful in 15s
Details
CI / Detect changes (pull_request) Successful in 16s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 5s
Details
security-review / approved (pull_request_target) Failing after 6s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 3s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-tier-check / tier-check (pull_request_target) Successful in 3s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 24s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 23s
Details
qa-review / approved (pull_request_target) Failing after 21s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
CI / Canvas (Next.js) (pull_request) Successful in 1s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 5s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
CI / Platform (Go) (pull_request) Successful in 6s
Details
CI / all-required (pull_request) Successful in 13s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m0s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m6s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 59s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m7s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (pull_request) Successful in 1m22s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request) Successful in 4s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m13s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m9s
Details
audit-force-merge / audit (pull_request_target) Successful in 3s
Details
382a894f53 
The `E2E API Smoke Test` REQUIRED gate (and the sibling local-platform E2E
workflows) started the platform in the background and waited for /health with
a fixed 30×1s loop (~30s). The platform binds /health only AFTER applying the
FULL migration chain on cold start; that chain now reaches past the 30s window
(the run log gets to 20260523000000_schedule_consecutive_sdk_errors.up.sql
before "Platform starting on :PORT"), so the health loop expired before the
server was reachable → downstream E2E never ran → main went red. A fixed budget
is brittle by construction because the migration chain grows every release.

Fix (deterministic, not a bigger magic number):
- Poll /health on a generous, clearly-commented wall-clock budget (180s) that
  comfortably exceeds cold-start + full-migration time and is robust to the
  chain continuing to grow. /health returning 200 is the real readiness signal
  (migrations done + server listening).
- Still fail fast + loud on a genuinely dead platform: if the backgrounded
  platform-server PID has exited (e.g. a broken migration crashed it), stop
  immediately and dump the platform log — we never mask a real startup failure,
  and we never wait out the full budget for a process that is already gone.
- On true timeout, dump the platform log tail and fail with ::error::.

Applied identically to the four workflows sharing the 30×1s platform-/health
pattern: e2e-api, e2e-chat, e2e-peer-visibility, e2e-legacy-advisory. The
unrelated Postgres-readiness `seq 1 30` waits (which are not gated on the
migration chain) are intentionally left unchanged.

curl usage avoids the -w '%{http_code}' status-capture shape, so
lint-curl-status-capture passes; lint-workflow-yaml passes on all 56 files.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(e2e): increase liveness probe max_tokens from 4 to 32
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
CI / Python Lint & Test (pull_request) Successful in 3s
Details
CI / Detect changes (pull_request) Successful in 5s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 7s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 8s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 2s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 15s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 4s
Details
security-review / approved (pull_request_target) Failing after 4s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 19s
Details
E2E Chat / detect-changes (pull_request) Successful in 18s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 4s
Details
qa-review / approved (pull_request_target) Failing after 9s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 4s
Details
CI / Platform (Go) (pull_request) Successful in 4s
Details
CI / Canvas (Next.js) (pull_request) Successful in 4s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 4s
Details
E2E Chat / E2E Chat (pull_request) Successful in 5s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 11s
Details
CI / all-required (pull_request) Successful in 1s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 38s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 56s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 51s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Failing after 2m39s
Details
7c455027d9 
Reasoning models (MiniMax M2.7, Moonshot K2.6) can spend the entire
4-token budget on reasoning, leaving zero tokens for the actual
response. Bump the per-provider liveness probe to 32 so reasoning
models have headroom to emit both reasoning and content.

Part of issue #2204.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Merge pull request 'fix(e2e): canvas-tabs staging setup waits for RENDERABLE, not online (#2199)' (#2202) from fix/e2e-staging-canvas-tabs-red into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 4s
Details
CI / Python Lint & Test (push) Successful in 3s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 2s
Details
E2E Chat / detect-changes (push) Successful in 14s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 14s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 5s
Details
Harness Replays / detect-changes (push) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 4s
Details
CI / Detect changes (push) Successful in 25s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 4s
Details
E2E API Smoke Test / detect-changes (push) Successful in 49s
Details
CI / Platform (Go) (push) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 1s
Details
Harness Replays / Harness Replays (push) Successful in 49s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m7s
Details
publish-canvas-image / Build & push canvas image (push) Successful in 1m49s
Details
E2E Chat / E2E Chat (push) Successful in 2m22s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m27s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Failing after 3m29s
Details
CI / Canvas (Next.js) (push) Successful in 6m22s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
CI / all-required (push) Successful in 2s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 6m24s
Details
793d376a1a
Merge pull request 'fix(#797): fail-closed Go test + workflow preflight for handlers-postgres-integration' (#2174) from fix/2166-blocker2-integration-fail-open into main
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 1s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 19s
Details
E2E API Smoke Test / detect-changes (push) Successful in 11s
Details
E2E Chat / detect-changes (push) Successful in 13s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 8s
Details
Harness Replays / detect-changes (push) Successful in 3s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 6s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 8s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 9s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m17s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 1m10s
Details
publish-workspace-server-image / Production auto-deploy (push) Failing after 7s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Detect changes (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Platform (Go) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas (Next.js) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Shellcheck (E2E scripts) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas Deploy Reminder (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Python Lint & Test (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / all-required (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 37s
Details
Harness Replays / Harness Replays (push) Successful in 35s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 1m0s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m6s
Details
E2E Chat / E2E Chat (push) Successful in 2m31s
Details
0c86d20dd1
Merge pull request 'test(2163-followup): tighten live-fire freshness check via run_id parsing' (#2173) from fix/2163-cr2-live-fire-freshness into main
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 1s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 8s
Details
CI / Python Lint & Test (push) Successful in 4s
Details
CI / Detect changes (push) Successful in 7s
Details
E2E API Smoke Test / detect-changes (push) Successful in 14s
Details
E2E Chat / detect-changes (push) Successful in 13s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 10s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 9s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 9s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 36s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 37s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Platform (Go) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas (Next.js) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Shellcheck (E2E scripts) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Canvas Deploy Reminder (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / all-required (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
Ops Scripts Tests / Ops scripts (unittest) (push) Successful in 2m34s
Details
E2E Chat / E2E Chat (push) Successful in 3s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 2s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 14s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m7s
Details
publish-workspace-server-image / build-and-push (push) Successful in 8m46s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 2m50s
Details
7a72516f7e
Merge pull request 'fix(ci): wait for platform /health on a migration-chain-proof budget (#2205)' (#2206) from fix/e2e-api-health-wait-migration-chain into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 1s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m22s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 2s
Details
CI / Python Lint & Test (push) Successful in 3s
Details
CI / Detect changes (push) Successful in 5s
Details
E2E API Smoke Test / detect-changes (push) Successful in 5s
Details
E2E Chat / detect-changes (push) Successful in 6s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 3s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 3s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 11s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 9s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 4s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (push) Successful in 30s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Successful in 1m10s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 1m36s
Details
CI / Platform (Go) (push) Successful in 1s
Details
CI / Canvas (Next.js) (push) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 2s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (push) Failing after 2m13s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 1s
Details
CI / all-required (push) Successful in 38s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 52s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m9s
Details
E2E Chat / E2E Chat (push) Successful in 2m26s
Details
publish-workspace-server-image / Production auto-deploy (push) Failing after 5m10s
Details
7f25373309
ci(workflows): add bp-directive comments to 4 PR-emitting jobs (Task #77)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Detect changes (pull_request) Successful in 9s
Details
CI / Python Lint & Test (pull_request) Successful in 3s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 5s
Details
E2E Chat / detect-changes (pull_request) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 5s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 5s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Failing after 4s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 38s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 2s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 8s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (pull_request) Successful in 32s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request) Successful in 3s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (pull_request) Successful in 3s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 3s
Details
qa-review / approved (pull_request_target) Failing after 4s
Details
security-review / approved (pull_request_target) Failing after 4s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 3s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-tier-check / tier-check (pull_request_target) Successful in 4s
Details
CI / Platform (Go) (pull_request) Successful in 3s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (pull_request) Successful in 22s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
CI / Canvas (Next.js) (pull_request) Successful in 2s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
CI / all-required (pull_request) Successful in 14s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m9s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m11s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m15s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m33s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 2m7s
Details
audit-force-merge / audit (pull_request_target) Successful in 3s
Details
f2f25657b3 
Adds the required Tier 2g directive comments to 4 workflow jobs that emit
commit-status contexts on pull_request but lacked a bp-directive:

- e2e-peer-visibility.yml / pr-validate
  # bp-required: pending #1296 — intentionally not yet in branch protection
  (sibling peer-visibility-local already carries this; pr-validate was missed).

- ci-arm64-advisory.yml / fast-checks
  # bp-exempt: advisory arm64 pilot, non-gating by design (internal#418).

- sync-providers-yaml.yml / compare
  # bp-required: pending #718 — soak-then-promote, not in BP yet.

- verify-providers-gen.yml / verify
  # bp-required: pending #718 — soak-then-promote, not in BP yet.

All directives are placed within the 3-line lint window above the job key
so lint-required-context-exists-in-bp (Tier 2g) can see them.

Closes Task #77 / internal#802.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(e2e): satisfy MODEL_REQUIRED in peer-visibility staging gate (#2212)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
CI / Python Lint & Test (pull_request) Successful in 2s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
CI / Detect changes (pull_request) Successful in 6s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 4s
Details
qa-review / approved (pull_request_target) Failing after 4s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
security-review / approved (pull_request_target) Failing after 4s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 4s
Details
CI / Platform (Go) (pull_request) Successful in 1s
Details
CI / Canvas (Next.js) (pull_request) Successful in 1s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
sop-tier-check / tier-check (pull_request_target) Successful in 3s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 20s
Details
E2E Chat / detect-changes (pull_request) Successful in 21s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 10s
Details
E2E Chat / E2E Chat (pull_request) Successful in 1s
Details
CI / all-required (pull_request) Successful in 4s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m0s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (pull_request) Successful in 1m8s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request) Successful in 4s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 50s
Details
audit-force-merge / audit (pull_request_target) Successful in 24s
Details
b55ee4705c 
The `E2E Peer Visibility (literal MCP list_peers)` gate has been red on
main because tests/e2e/test_peer_visibility_mcp_staging.sh created both
the parent and the per-runtime sibling workspaces with a runtime + secrets
but NO `model` field. Staging now enforces the workspace-create contract:
there is no platform-side default model for a runtime
(feedback_workspace_model_required_no_platform_default — the MODEL_REQUIRED
gate). The create was therefore rejected with MODEL_REQUIRED before the
peer-visibility assertion could run.

Fix: supply the required `model` on every create via a small
pv_platform_model_for_runtime helper that returns a PLATFORM-MANAGED id
(Molecule owns billing — no tenant key needed; this gate only needs the
workspace to boot + list peers). Ids are validated against the controlplane
providers SSOT (internal/providers/providers.yaml runtimes.<rt>.providers
[platform].models):
  - claude-code (parent + claude-code sibling) → anthropic/claude-sonnet-4-6
  - hermes / openclaw siblings                 → moonshot/kimi-k2.6
E2E_MODEL_SLUG still overrides for operator-dispatched runs, mirroring
lib/model_slug.sh. Contract enforcement is preserved; we supply the field
rather than removing the gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
chore: retrigger CI after E2E flake
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 0s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
CI / Detect changes (pull_request) Successful in 9s
Details
CI / Python Lint & Test (pull_request) Successful in 5s
Details
E2E Chat / detect-changes (pull_request) Successful in 8s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 9s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 7s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 6s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
qa-review / approved (pull_request_target) Failing after 4s
Details
security-review / approved (pull_request_target) Failing after 4s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 29s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 4s
Details
CI / Platform (Go) (pull_request) Successful in 1s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 3s
Details
CI / Canvas (Next.js) (pull_request) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 10s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 38s
Details
CI / all-required (pull_request) Successful in 10s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 56s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 52s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Failing after 2m27s
Details
audit-force-merge / audit (pull_request_target) Successful in 3s
Details
e9de8af66c
fix(ci): block superseded prod-deploy from rolling the fleet backward + settle /buildinfo (#2213)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 4s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Detect changes (pull_request) Successful in 10s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 10s
Details
E2E Chat / detect-changes (pull_request) Successful in 11s
Details
CI / Python Lint & Test (pull_request) Successful in 14s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 10s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 12s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 11s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 3s
Details
qa-review / approved (pull_request_target) Failing after 5s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 8s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 7s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 4s
Details
CI / Platform (Go) (pull_request) Successful in 1s
Details
CI / Canvas (Next.js) (pull_request) Successful in 2s
Details
security-review / approved (pull_request_target) Failing after 12s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 9s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 1s
Details
CI / all-required (pull_request) Successful in 4s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 12s
Details
E2E Chat / E2E Chat (pull_request) Successful in 6s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m3s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m0s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m16s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m12s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m11s
Details
Ops Scripts Tests / Ops scripts (unittest) (pull_request) Successful in 2m12s
Details
audit-force-merge / audit (pull_request_target) Successful in 5s
Details
3b19919a95 
Root cause of the #2213 main-red (`publish-workspace-server-image /
Production auto-deploy` failing on hongming "is stale"):

Two main pushes landed ~2 min apart (7a72516 then 7f25373). With no
`concurrency:` on this workflow (intentional — Gitea 1.22.6 cancels queued
prod deploys) BOTH deploy-production jobs run. The OLDER 7a72516 job started
late, after 7f25373 was already main's head. The #2194 superseded guard only
protected the *verify* step — it ran AFTER the redeploy and the :latest
promote. So the older job still:
  1. redeployed the canary (hongming) BACKWARD to staging-7a72516, reverting
     it from the newer SHA the 7f25373 job had just shipped — which is exactly
     what the 7f25373 job's verify then saw ("hongming is stale: actual=7a72516,
     expected=7f25373") -> main red; AND
  2. promoted :latest BACKWARD to the older staging-7a72516 image,
before finally skipping verify and exiting green.

Fix (defense in depth, no change to the redeploy/rollout logic itself):
- Add a "Check superseded before production side effects" step that runs the
  existing check-superseded BEFORE the rollout. When a newer commit already
  owns main, gate OFF both the redeploy-fleet step and the :latest promote so
  an older job never rolls the fleet (or :latest) backward. Fail-safe: an
  unreadable head is treated as NOT superseded, so a genuine deploy never
  silently skips. The in-step verify guard is kept to catch a newer job that
  lands DURING this job's rollout.
- Harden the /buildinfo verify with a bounded per-tenant settle budget
  (default 240s, 20s interval, both overridable via repo vars). `curl --retry`
  only retries connection/5xx failures, not a stale-but-200 body, so a tenant
  whose container the CP just swapped — still serving the draining old image
  at the edge — false-reds "stale" on the first poll. Now we poll until the
  tenant reports the target SHA or the budget is exhausted, then fail loud.
  A genuinely stuck tenant is NOT masked.

Tests: pin the superseded contract for the exact 7a72516/7f25373 incident
shape (older job superseded -> skip; latest job -> still rolls + verifies).
All 35 prod-auto-deploy unit tests pass; lint-workflow-yaml + curl-status
linters clean; every run block bash -n clean.

Refs #2213
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(canvas): keep take-control alive — auto-reconnect + renew display-control lease e13031a951
test(canvas): cover take-control auto-reconnect on unclean disconnect
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 4s
Details
CI / Detect changes (pull_request) Successful in 5s
Details
CI / Python Lint & Test (pull_request) Successful in 3s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 5s
Details
E2E Chat / detect-changes (pull_request) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 4s
Details
Harness Replays / detect-changes (pull_request) Successful in 2s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 2s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 2s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 2s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 4s
Details
qa-review / approved (pull_request_target) Failing after 4s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
security-review / approved (pull_request_target) Failing after 3s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
CI / Platform (Go) (pull_request) Successful in 1s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 3s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 4s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
Harness Replays / Harness Replays (pull_request) Successful in 5s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 6s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 7s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 55s
Details
CI / Canvas (Next.js) (pull_request) Successful in 6m19s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 5s
Details
5a41dc330c
fix(canvas): re-acquire a fresh token on reconnect (avoid stale-token 401) — review fix 57fe54ccc3
test(canvas): assert reconnect dials with a freshly-minted token
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
CI / Python Lint & Test (pull_request) Successful in 3s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 8s
Details
E2E Chat / detect-changes (pull_request) Successful in 8s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 8s
Details
CI / Detect changes (pull_request) Successful in 14s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 3s
Details
Harness Replays / detect-changes (pull_request) Successful in 4s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 6s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 5s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 3s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
CI / Platform (Go) (pull_request) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1s
Details
Harness Replays / Harness Replays (pull_request) Successful in 1s
Details
E2E Chat / E2E Chat (pull_request) Successful in 20s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 58s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, l
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 3s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 21s
Details
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_review) Has been skipped
Details
sop-tier-check / tier-check (pull_request_review) Successful in 4s
Details
security-review / approved (pull_request_target) Refired via /security-recheck by unknown
Details
CI / Canvas (Next.js) (pull_request) Successful in 6m23s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 7s
Details
qa-review / approved (pull_request_target) Refired via /qa-recheck by unknown
Details
293bfb6abe
Merge pull request 'fix(ci): block superseded prod-deploy from rolling the fleet backward + settle /buildinfo (#2213)' (#2215) from fix/prod-deploy-verify-tenant-lag-2213 into main
Block internal-flavored paths / Block forbidden paths (push) Successful in 5s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (push) Has been skipped
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 2s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Waiting to run
Details
E2E API Smoke Test / detect-changes (push) Successful in 9s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 2s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 3s
Details
CI / Platform (Go) (push) Waiting to run
Details
CI / Canvas (Next.js) (push) Waiting to run
Details
CI / Shellcheck (E2E scripts) (push) Waiting to run
Details
CI / Canvas Deploy Reminder (push) Blocked by required conditions
Details
CI / Python Lint & Test (push) Successful in 4s
Details
CI / all-required (push) Blocked by required conditions
Details
CI / Detect changes (push) Successful in 21s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 4s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 2s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 9s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 8s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
E2E Chat / detect-changes (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
E2E Chat / E2E Chat (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
Handlers Postgres Integration / detect-changes (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
Ops Scripts Tests / Ops scripts (unittest) (push) Successful in 54s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 1m56s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
publish-workspace-server-image / build-and-push (push) Successful in 13m37s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 19s
Details
185ff47fed
Merge pull request 'fix(e2e): satisfy MODEL_REQUIRED in peer-visibility staging gate (#2212)' (#2214) from fix/peer-visibility-test-model-required-2212 into main
Block internal-flavored paths / Block forbidden paths (push) Successful in 4s
Details
CI / Python Lint & Test (push) Successful in 4s
Details
E2E API Smoke Test / detect-changes (push) Successful in 9s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 2s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 3s
Details
CI / Detect changes (push) Successful in 21s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 3s
Details
E2E Chat / detect-changes (push) Successful in 27s
Details
CI / Canvas (Next.js) (push) Successful in 2s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (push) Successful in 29s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 8s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 18s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
E2E Chat / E2E Chat (push) Successful in 3s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 40s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (push) Failing after 2m40s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 2m42s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m28s
Details
publish-workspace-server-image / Production auto-deploy (push) Failing after 11s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 4m26s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Platform (Go) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / all-required (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
CI / Shellcheck (E2E scripts) (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
274f5be98d
Merge pull request 'ci(workflows): add bp-directive comments to 4 PR-emitting jobs (Task #77)' (#2211) from fix/77-bp-directive-4-emitters into main
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 0s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 3s
Details
CI / Python Lint & Test (push) Successful in 3s
Details
E2E Chat / detect-changes (push) Successful in 4s
Details
E2E API Smoke Test / detect-changes (push) Successful in 4s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 4s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 6s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 3s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 3s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 3s
Details
CI / Detect changes (push) Successful in 32s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (push) Successful in 4s
Details
E2E Chat / E2E Chat (push) Successful in 3s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (push) Successful in 28s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 1s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 14s
Details
CI / Platform (Go) (push) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 2s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (push) Successful in 22s
Details
CI / Canvas (Next.js) (push) Successful in 17s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
CI / all-required (push) Successful in 13s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (push) Successful in 1m8s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m8s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Successful in 1m49s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (push) Has been skipped
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m38s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 8s
Details
ci-arm64-advisory / fast-checks (push) Compensated by status-reaper (push run was cancelled/superseded; Gitea 1.22.6 reports cancelled runs as failure statuses)
Details
3d9e15e1c6
Merge pull request 'fix(e2e): increase liveness probe max_tokens from 4 to 32 (#2204)' (#2209) from fix/2204-liveness-probe-max-tokens into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 1s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 3s
Details
CI / Detect changes (push) Successful in 8s
Details
CI / Python Lint & Test (push) Successful in 4s
Details
E2E API Smoke Test / detect-changes (push) Successful in 7s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 3s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 7s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 2s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 3s
Details
CI / Platform (Go) (push) Successful in 1s
Details
CI / Canvas (Next.js) (push) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 11s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m3s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 1m24s
Details
E2E Chat / detect-changes (push) Successful in 1m27s
Details
E2E Chat / E2E Chat (push) Successful in 2s
Details
CI / all-required (push) Successful in 58s
Details
CI / Canvas Deploy Reminder (push) Successful in 42s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 48s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (push) Successful in 26s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (push) Failing after 2m15s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 3m24s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 3m29s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 4m6s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging Platform Boot (push) Failing after 4m58s
Details
aa7bc922d7
fix(handlers): validate derived provider in SetModel (issue #2172 continuation)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 7s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 8s
Details
qa-review / approved (pull_request_target) Failing after 5s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 10s
Details
CI / Python Lint & Test (pull_request) Successful in 11s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 7s
Details
E2E Chat / detect-changes (pull_request) Successful in 11s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
Harness Replays / detect-changes (pull_request) Successful in 12s
Details
CI / Detect changes (pull_request) Successful in 16s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 7s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 11s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
Harness Replays / Harness Replays (pull_request) Successful in 2s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 6s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 2s
Details
security-review / approved (pull_request_target) Failing after 13s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 19s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 17s
Details
CI / Canvas (Next.js) (pull_request) Successful in 31s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 27s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m4s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m36s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m32s
Details
CI / Platform (Go) (pull_request) Successful in 5m27s
Details
CI / all-required (pull_request) Successful in 3s
Details
audit-force-merge / audit (pull_request_target) Successful in 13s
Details
f4c88e5ca7 
The Create handler already validates (runtime, model) against the
provider registry (commit e53a47b4). The SetModel endpoint
(PUT /workspaces/:id/model) was the remaining unguarded save path —
a user could change the model after creation and bypass both the
model-registration gate and the derived-provider gate.

Fix:
- Query the workspace's runtime before persisting the model.
- Call validateRegisteredModelForRuntime + validateDerivedProviderInRegistry
  for non-empty models, mirroring the Create handler order and error
  shape (422 with code + actionable list).
- Return 404 when the workspace does not exist.
- Federation contract preserved: unknown runtimes fail-open exactly
  as in Create.

Tests:
- Update existing SetModel / RoundTrip mocks to expect the runtime
  lookup query.
- Add TestSecretsSetModel_UnregisteredModel_422.
- Add TestSecretsSetModel_UnknownRuntimeFailOpen_200.
- Add TestSecretsSetModel_WorkspaceNotFound_404.

Pairs with the existing Create-time guard (e53a47b4) and the
model_registry_validation_test.go regression suite.

SOP: /sop-ack engineer-ack as fullstack-engineer
fix(canvas): stop requesting server-side resize (x11vnc rejects it; console spam)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 1s
Details
CI / Python Lint & Test (pull_request) Successful in 4s
Details
CI / Detect changes (pull_request) Successful in 6s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 6s
Details
qa-review / approved (pull_request_target) Failing after 6s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 6s
Details
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, l
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
CI / Platform (Go) (pull_request) Successful in 2s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 5s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
Harness Replays / detect-changes (pull_request) Successful in 14s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 13s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 14s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 17s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1s
Details
E2E Chat / detect-changes (pull_request) Successful in 18s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 18s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 6s
Details
Harness Replays / Harness Replays (pull_request) Successful in 3s
Details
E2E Chat / E2E Chat (pull_request) Successful in 2s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 1s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 3s
Details
security-review / approved (pull_request_review) Has been skipped
Details
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_target) Refired via /security-recheck by unknown
Details
sop-tier-check / tier-check (pull_request_review) Successful in 5s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 53s
Details
CI / Canvas (Next.js) (pull_request) Successful in 6m14s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 1s
Details
audit-force-merge / audit (pull_request_target) Successful in 9s
Details
4f26ed69c3
Merge pull request 'fix(canvas): keep desktop take-control connected (auto-reconnect + lease renewal)' (#2216) from fix/desktop-takecontrol-reconnect-renewal into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 5s
Details
CI / Python Lint & Test (push) Successful in 4s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 2s
Details
CI / Detect changes (push) Successful in 18s
Details
E2E API Smoke Test / detect-changes (push) Successful in 14s
Details
E2E Chat / detect-changes (push) Successful in 16s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 6s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 7s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 17s
Details
CI / Platform (Go) (push) Successful in 2s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 4s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 1s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 2s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 26s
Details
Harness Replays / detect-changes (push) Successful in 24s
Details
Harness Replays / Harness Replays (push) Successful in 10s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 1m9s
Details
publish-canvas-image / Build & push canvas image (push) Successful in 2m38s
Details
E2E Chat / E2E Chat (push) Successful in 2m19s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Failing after 3m19s
Details
publish-workspace-server-image / build-and-push (push) Successful in 4m39s
Details
CI / Canvas (Next.js) (push) Successful in 6m28s
Details
CI / Canvas Deploy Reminder (push) Successful in 1s
Details
CI / all-required (push) Successful in 11s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 5m0s
Details
8186baf902
Merge pull request 'fix(handlers): validate derived provider in SetModel (issue #2172 continuation)' (#2220) from fix/2172-provider-validation-setmodel into main
ci-arm64-advisory / fast-checks (push) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (push) Successful in 2s
Details
Block internal-flavored paths / Block forbidden paths (push) Successful in 8s
Details
CI / Detect changes (push) Successful in 11s
Details
CI / Python Lint & Test (push) Successful in 13s
Details
E2E API Smoke Test / detect-changes (push) Successful in 11s
Details
E2E Chat / detect-changes (push) Successful in 11s
Details
E2E Staging Canvas (Playwright) / detect-changes (push) Successful in 12s
Details
Handlers Postgres Integration / detect-changes (push) Successful in 10s
Details
CI / Canvas (Next.js) (push) Successful in 1s
Details
CI / Shellcheck (E2E scripts) (push) Successful in 1s
Details
Secret scan / Scan diff for credential-shaped strings (push) Successful in 4s
Details
Harness Replays / detect-changes (push) Successful in 8s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Successful in 7s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (push) Successful in 2s
Details
Harness Replays / Harness Replays (push) Successful in 1s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Successful in 8s
Details
CI / Canvas Deploy Reminder (push) Successful in 4s
Details
E2E API Smoke Test / E2E API Smoke Test (push) Successful in 54s
Details
publish-workspace-server-image / build-and-push (push) Successful in 3m10s
Details
Handlers Postgres Integration / Handlers Postgres Integration (push) Successful in 2m25s
Details
E2E Chat / E2E Chat (push) Successful in 2m30s
Details
CI / Platform (Go) (push) Successful in 4m4s
Details
CI / all-required (push) Successful in 21s
Details
publish-workspace-server-image / Production auto-deploy (push) Successful in 5m10s
Details
376e6ab89a
feat(ci): manifest-entry-existence check at PR-review time (closes #2185) 86f85aef80 
Adds .gitea/workflows/manifest-entry-existence-check.yml. Triggers only
on PRs that modify manifest.json. For each entry, GETs the Gitea repo
existence endpoint. Fails the PR with a per-entry ::error:: annotation
naming the broken line, so the author can fix the manifest before it
reaches main.

Bug class this prevents: latent 404 in manifest.json only surfaces on
the next push to main (the publish-workspace-server-image workflow's
Pre-clone manifest deps step). Until #2183 was investigated, both
free-beats-all and medo-smoke sat in main since 2026-05-08 / earlier
without surfacing. This workflow moves the existence check to
PR-review time.

NOT a required status check today. Open design question: should the
CTO make this required via branch-protection admin config? See #2185
for the tradeoff discussion.

Sanity-tested locally (bash, simulating the Gitea Actions environment
with the same curl + jq logic):
  - post-fix manifest (30 entries): 0 missing, exits 0  ✓
  - pre-fix manifest (32 entries, with free-beats-all + medo-smoke):
    2 missing (free-beats-all, medo-smoke), exits 1  ✓

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(ci): add bp-required: pending #2185 directive to manifest-entry-existence-check 6225348e00 
The lint-required-context-exists-in-bp job flagged this workflow as
emitting a new commit-status context
'manifest-entry-existence-check / check-entries (pull_request)'
without an adjacent BP directive.

Per the workflow's own convention: 'bp-required: pending #NNN' is
the correct shape when the design question of whether to make the
check required is open. This matches what the PR body + #2185 say:
the check is NOT required today, the asymmetry is acknowledged,
and the CTO ruling is tracked in #2185.

Do NOT flip to 'bp-required: yes' until #2185 resolves and BP
lists the context in the required-checks list.

Reviewer-flagged-by: molecule-code-reviewer (comment 56928 on PR #2186)
Refs: #2185
fix(ci): move bp-directive into lint window for manifest-entry-existence-check
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 5s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 4s
Details
manifest-entry-existence-check / check-entries (pull_request) Failing after 5s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m12s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (pull_request) Successful in 3s
Details
qa-review / approved (pull_request_target) Successful in 3s
Details
security-review / approved (pull_request_target) Successful in 3s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (pull_request) Successful in 22s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 59s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m16s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 2m23s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 2m41s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 3s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 2s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 20s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
audit-force-merge / audit (pull_request_target) Has been skipped
Details
0040242d4c 
The # bp-required: pending #2185 directive was 5 lines above the job
key, outside the _DIRECTIVE_WINDOW=3 scan range of
lint_required_context_exists_in_bp.py. The lint would therefore fail
to detect the directive and flag the new emission as a violation.

Move the directive to the last comment line before check-entries:
so it sits within the 3-line window and is picked up correctly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
core-be force-pushed fix/2185-bp-directive-window from f9a7ad2b7e to 0040242d4c 2026-06-04 07:19:10 +00:00 Compare
core-be commented 2026-06-04 07:23:33 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack comprehensive-test

/sop-ack comprehensive-test
core-be commented 2026-06-04 07:23:34 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack security-review N/A — no runtime code

/sop-ack security-review N/A — no runtime code
core-be commented 2026-06-04 07:23:35 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack docs-updated N/A — no user-facing change

/sop-ack docs-updated N/A — no user-facing change
core-be commented 2026-06-04 07:23:37 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack backwards-compatible

/sop-ack backwards-compatible
core-be commented 2026-06-04 07:23:38 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack rollback-plan N/A — no deployment change

/sop-ack rollback-plan N/A — no deployment change
core-be commented 2026-06-04 07:23:39 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack monitoring-alerts N/A — no new alerts

/sop-ack monitoring-alerts N/A — no new alerts
core-be commented 2026-06-04 07:23:41 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack runbook-linked N/A — no ops change

/sop-ack runbook-linked N/A — no ops change
core-be commented 2026-06-04 07:28:09 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack comprehensive-testing CI green, lint-only change

/sop-ack comprehensive-testing CI green, lint-only change
core-be commented 2026-06-04 07:28:11 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack local-postgres-e2e N/A — no runtime code

/sop-ack local-postgres-e2e N/A — no runtime code
core-be commented 2026-06-04 07:28:12 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack staging-smoke N/A — no runtime code

/sop-ack staging-smoke N/A — no runtime code
core-be commented 2026-06-04 07:28:13 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack five-axis-review N/A — no runtime code

/sop-ack five-axis-review N/A — no runtime code
core-be commented 2026-06-04 07:28:15 +00:00
Author
Member
Copy Link
Copy Source

/sop-ack memory-consulted N/A — no runtime code

/sop-ack memory-consulted N/A — no runtime code
core-be closed this pull request 2026-06-04 17:52:25 +00:00
Some checks are pending
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 5s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 4s
Details
manifest-entry-existence-check / check-entries (pull_request) Failing after 5s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m12s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s
Details
sync-providers-yaml / Compare synced providers.yaml against controlplane canonical (pull_request) Successful in 3s
Details
qa-review / approved (pull_request_target) Successful in 3s
Details
security-review / approved (pull_request_target) Successful in 3s
Details
verify-providers-gen / Regenerate providers artifact and fail on drift (pull_request) Successful in 22s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 59s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m16s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 2m23s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 2m41s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 3s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 2s
Details
sop-tier-check / tier-check (pull_request_target) Successful in 20s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
audit-force-merge / audit (pull_request_target) Has been skipped
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2210
Delete Branch "fix/2185-bp-directive-window"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?