feat: install platform agent as org root (Phase 1) #2371

Merged

devops-engineer merged 1 commits from feat/platform-agent-install into main 2026-06-06 22:18:52 +00:00

Conversation 2 Commits 1 Files Changed 5

+361

devops-engineer commented 2026-06-06 17:32:38 +00:00

Member

Copy Link

Copy Source

Phase 1 of the org-level platform agent (RFC #2360). Stacked on #2361 (Phase 0) — base is feat/platform-agent-kind; will retarget to main once #2361 merges.

Adds the idempotent operation that makes the concierge the org root: POST /admin/org/platform-agent (AdminAuth) → installPlatformAgent(). In one transaction it (1) upserts the platform-agent row (kind=platform, parent_id NULL) via ON CONFLICT, (2) re-parents the org's existing root(s) under it, (3) moves the org-anchor refs that key off the root workspace id — org_api_tokens.org_id + org_plugin_allowlist.org_id — old root → platform agent.

Routing unchanged — platform-as-root reuses existing ancestor/descendant rules; sameOrg still isolates tenants.

The CP calls this at org-provision (new orgs) and the existing-org backfill (CTO-authorized to run post-merge, snapshot+rollback).

Tests

• Unit: handler bad-input 400.
• Real-Postgres integration: proves re-parent + both anchor migrations + orgRootID/sameOrg resolve to the platform agent + idempotency. Verified locally (postgres:15, all migrations apply, green).
• Allowlisted in the workspaces-INSERT bulk-create regression guard with its ON CONFLICT safety note.

Audit note

The re-parent moves the org anchor; audit confirmed exactly 2 anchor tables (org_api_tokens, org_plugin_allowlist). rescue_bundles.org_id is the CP org UUID (MOLECULE_ORG_ID), a different namespace — not affected.

🤖 Generated with Claude Code

Phase 1 of the org-level platform agent (RFC #2360). **Stacked on #2361 (Phase 0)** — base is `feat/platform-agent-kind`; will retarget to `main` once #2361 merges. Adds the idempotent operation that makes the concierge the org root: `POST /admin/org/platform-agent` (AdminAuth) → `installPlatformAgent()`. In one transaction it (1) upserts the platform-agent row (`kind=platform`, `parent_id NULL`) via ON CONFLICT, (2) re-parents the org's existing root(s) under it, (3) moves the org-anchor refs that key off the root workspace id — `org_api_tokens.org_id` + `org_plugin_allowlist.org_id` — old root → platform agent. **Routing unchanged** — platform-as-root reuses existing ancestor/descendant rules; `sameOrg` still isolates tenants. The CP calls this at org-provision (new orgs) and the existing-org backfill (CTO-authorized to run post-merge, snapshot+rollback). ### Tests - Unit: handler bad-input 400. - **Real-Postgres integration**: proves re-parent + both anchor migrations + `orgRootID`/`sameOrg` resolve to the platform agent + idempotency. Verified locally (postgres:15, all migrations apply, green). - Allowlisted in the workspaces-INSERT bulk-create regression guard with its ON CONFLICT safety note. ### Audit note The re-parent moves the org anchor; audit confirmed exactly 2 anchor tables (`org_api_tokens`, `org_plugin_allowlist`). `rescue_bundles.org_id` is the CP org UUID (`MOLECULE_ORG_ID`), a different namespace — not affected. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

devops-engineer added the tier:medium label 2026-06-06 17:55:12 +00:00

devops-engineer changed target branch from feat/platform-agent-kind to main 2026-06-06 18:25:49 +00:00

devops-engineer added 1 commit 2026-06-06 18:26:01 +00:00

feat(workspace-server): install platform agent as org root (Phase 1) ... 1c42488be7

Add the idempotent, transactional operation that makes the org-level concierge
the org root (RFC docs/design/rfc-platform-agent.md): POST /admin/org/platform-agent
(AdminAuth) + installPlatformAgent().

In ONE transaction it:
  1. upserts the platform-agent row (kind='platform', parent_id NULL, tier 0)
     via ON CONFLICT (id) DO UPDATE;
  2. re-parents the org's existing root(s) under it;
  3. moves the org-anchor references that key off the root workspace id —
     org_api_tokens.org_id and org_plugin_allowlist.org_id — from each old root
     to the platform agent, so a tenant's admin tokens + plugin allowlist never
     point at a stale anchor.

Routing is UNCHANGED: once the platform agent is the root, the existing
ancestor/descendant rules in registry/access.go give it universal in-org reach
and org_scope.go keeps tenant isolation intact.

The CP calls this at org-provision (new orgs, clean) and during the existing-org
backfill rollout. Idempotent: a second call is a no-op.

Tests: handler bad-input unit test; real-Postgres integration test proving the
re-parent + both anchor migrations + orgRootID/sameOrg resolution + idempotency
(sqlmock cannot evaluate the post-tx row state). Allowlisted in the
workspaces-INSERT bulk-create regression guard with its ON CONFLICT safety note.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

devops-engineer force-pushed feat/platform-agent-install from 3665faa5ca to 1c42488be7 2026-06-06 18:26:01 +00:00 Compare

devops-engineer closed this pull request 2026-06-06 18:46:16 +00:00

devops-engineer reopened this pull request 2026-06-06 18:46:24 +00:00

molecule-code-reviewer approved these changes 2026-06-06 22:13:47 +00:00

molecule-code-reviewer left a comment

Member

Copy Link

Copy Source

Independent review confirmed: install op idempotently makes the platform agent the org root, re-parents the existing root, and migrates the 2 org-anchor tables (org_api_tokens + org_plugin_allowlist) in one tx; real-PG integration test proves re-parent + anchor migration + orgRootID/sameOrg resolution + idempotency; allowlisted in the bulk-INSERT guard. Required checks green. Approving.

Independent review confirmed: install op idempotently makes the platform agent the org root, re-parents the existing root, and migrates the 2 org-anchor tables (org_api_tokens + org_plugin_allowlist) in one tx; real-PG integration test proves re-parent + anchor migration + orgRootID/sameOrg resolution + idempotency; allowlisted in the bulk-INSERT guard. Required checks green. Approving.

core-security approved these changes 2026-06-06 22:18:50 +00:00

core-security left a comment

Member

Copy Link

Copy Source

Security review: transactional re-parent + anchor migration is atomic; no routing change (platform==root reuses existing rules); sameOrg isolation preserved. Approving.

Security review: transactional re-parent + anchor migration is atomic; no routing change (platform==root reuses existing rules); sameOrg isolation preserved. Approving.

devops-engineer merged commit 96f6dff691 into main 2026-06-06 22:18:52 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

core-security

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label tier:medium

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2371