RFC: decouple workspace config + skill delivery from Secrets Manager (#2831 root fix) #2843

Merged

devops-engineer merged 2 commits from rfc/decouple-config-skill-delivery into main 2026-06-14 12:01:24 +00:00

Conversation 1 Commits 2 Files Changed 1

+127

core-devops commented 2026-06-14 10:16:44 +00:00

Member

Copy Link

Copy Source

What

Design doc / RFC for the root fix of RCA #2831 — decouple workspace config + prompts + skills delivery from Secrets Manager (which should hold secrets only). Grounded in the live SM inventory we gathered (see #2831 comment): workspace/<id>/config = config.yaml only (~240b), zero skill secrets, JRS's config secret absent → stub + 0 skills.

Design (summary)

• Secrets ↔ assets boundary: SM keeps only tenant/<id>/bootstrap (real secrets). Config/prompts/skills move to a generic non-secret template-asset channel fetched to the persisted data volume — any template, no size cap, no per-template code.
• Reconcile/self-repair on every provision/restart/restore/auto-heal — stub/missing config heals from the template (closes the JRS class). Keeps #2838's allowlist + reconciliation scaffold.
• Deletes EnableSEOSkillPackage/SEOSkillPackageFiles/seo_skill_package.go — the per-template patch.
• Full secrets/assets boundary, migration, security, unit + e2e test plan, rollout, alternatives included.

SOP

Architectural change → this RFC is the SSOT design artifact for CTO sign-off before/alongside implementation. Implementation (core provisioner + CP/boot asset-fetch + tests + e2e + docs) tracked against this; the dev fleet's #2838 is being re-scoped to it.

Refs #2831, #2832, #2838.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

## What Design doc / RFC for the **root fix** of RCA #2831 — decouple workspace **config + prompts + skills** delivery from **Secrets Manager** (which should hold secrets only). Grounded in the live SM inventory we gathered (see #2831 comment): `workspace/<id>/config` = config.yaml only (~240b), zero skill secrets, JRS's config secret absent → stub + 0 skills. ## Design (summary) - **Secrets ↔ assets boundary:** SM keeps only `tenant/<id>/bootstrap` (real secrets). Config/prompts/skills move to a **generic non-secret template-asset channel** fetched to the persisted data volume — any template, no size cap, no per-template code. - **Reconcile/self-repair on every provision/restart/restore/auto-heal** — stub/missing config heals from the template (closes the JRS class). Keeps #2838's allowlist + reconciliation scaffold. - **Deletes** `EnableSEOSkillPackage`/`SEOSkillPackageFiles`/`seo_skill_package.go` — the per-template patch. - Full secrets/assets boundary, migration, security, **unit + e2e test plan**, rollout, alternatives included. ## SOP Architectural change → this RFC is the SSOT design artifact for CTO sign-off before/alongside implementation. Implementation (core provisioner + CP/boot asset-fetch + tests + e2e + docs) tracked against this; the dev fleet's #2838 is being re-scoped to it. Refs #2831, #2832, #2838. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core-devops added 1 commit 2026-06-14 10:16:45 +00:00

docs(rfc): decouple workspace config + skill delivery from Secrets Manager 6d787ca7ad

core-devops added 1 commit 2026-06-14 10:25:18 +00:00

rfc: add concierge-identity sibling anti-pattern (hardcoded in core → should be a template) 8e97a39dcf

agent-dev-b referenced this pull request 2026-06-14 10:44:19 +00:00

docs(rfc#2843#23): SEO patch deleted (was never on main) + close #2838 #2844

agent-dev-b referenced this issue from a commit 2026-06-14 10:48:40 +00:00

test(provisioner): SEO-patch grep-gate (RFC #2843 #23, makes #2844 substantive)

agent-dev-b referenced this issue from a commit 2026-06-14 11:05:03 +00:00

feat(provisioner#24): generic template-asset channel (RFC #2843)

agent-dev-b referenced this pull request 2026-06-14 11:05:31 +00:00

feat(provisioner#24): generic template-asset channel (RFC #2843 #24) #2845

agent-reviewer-cr2 referenced this pull request 2026-06-14 11:17:10 +00:00

feat(provisioner#24): generic template-asset channel (RFC #2843 #24) #2845

agent-reviewer-cr2 approved these changes 2026-06-14 12:01:07 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVED: #2843 is acceptable as the RFC/design artifact on head 8e97a39dcf.

5-axis review:

• Correctness: the RFC directly addresses RCA #2831 by separating secrets from non-secret config/prompts/skills, rejecting the per-template SEO patch pattern, and requiring generic template asset delivery plus boot/restart/self-repair reconciliation.
• Robustness: it calls out stub/missing config repair, restart/restore/auto-heal coverage, migration/rollback sequencing for existing SM config secrets, and unit/E2E tests that should catch silent skill drops.
• Security: the boundary is coherent: bootstrap secrets remain in SM; assets are fetched through a read-scoped template-repo channel; workspace_secrets/memory remain separate. This aligns with the #2832 credential-redaction work rather than replacing it.
• Performance: the design avoids pushing large public assets through Secrets Manager and gives transport options (shallow clone/archive/object artifact). Implementation should still enforce bounded fetch/checkout behavior, but the RFC does not introduce runtime code.
• Readability: scoped, concrete, and explicit about non-goals, deletions, rollout, and the related concierge-hardcoding anti-pattern.

Required core contexts are green on this head: CI/all-required, E2E API Smoke Test, Handlers Postgres Integration, and E2E Peer Visibility. The real-image Local Provision Lifecycle advisory is red, but it is not part of the required core merge bar for this docs-only RFC.

APPROVED: #2843 is acceptable as the RFC/design artifact on head 8e97a39dcf930e6fa97476252023925d20b69b5b. 5-axis review: - Correctness: the RFC directly addresses RCA #2831 by separating secrets from non-secret config/prompts/skills, rejecting the per-template SEO patch pattern, and requiring generic template asset delivery plus boot/restart/self-repair reconciliation. - Robustness: it calls out stub/missing config repair, restart/restore/auto-heal coverage, migration/rollback sequencing for existing SM config secrets, and unit/E2E tests that should catch silent skill drops. - Security: the boundary is coherent: bootstrap secrets remain in SM; assets are fetched through a read-scoped template-repo channel; workspace_secrets/memory remain separate. This aligns with the #2832 credential-redaction work rather than replacing it. - Performance: the design avoids pushing large public assets through Secrets Manager and gives transport options (shallow clone/archive/object artifact). Implementation should still enforce bounded fetch/checkout behavior, but the RFC does not introduce runtime code. - Readability: scoped, concrete, and explicit about non-goals, deletions, rollout, and the related concierge-hardcoding anti-pattern. Required core contexts are green on this head: CI/all-required, E2E API Smoke Test, Handlers Postgres Integration, and E2E Peer Visibility. The real-image Local Provision Lifecycle advisory is red, but it is not part of the required core merge bar for this docs-only RFC.

devops-engineer merged commit 89d39510c8 into main 2026-06-14 12:01:24 +00:00

agent-dev-b referenced this issue from a commit 2026-06-14 12:24:50 +00:00

fix(provisioner#24): blast-radius allowlist + TemplateAssets transport split

agent-dev-b referenced this issue from a commit 2026-06-14 12:43:57 +00:00

fix(approvals#66): requester-initiated withdraw endpoint

agent-dev-b referenced this issue from a commit 2026-06-14 14:52:11 +00:00

fix(provisioner#24 SCAFFOLD): template-asset interface + de-dup cfg.ConfigFiles loop

agent-dev-b referenced this pull request 2026-06-14 14:52:41 +00:00

fix(provisioner#24 SCAFFOLD): template-asset interface + de-dup cfg.ConfigFiles loop (PR-1 of keystone) #2855

agent-dev-b referenced this issue from a commit 2026-06-14 15:07:35 +00:00

fix(handlers): de-dup cfg.ConfigFiles init across inject sites (tiny)

agent-dev-b referenced this pull request 2026-06-14 15:07:56 +00:00

fix(handlers): de-dup cfg.ConfigFiles init across inject sites (tiny) #2856

agent-dev-b referenced this issue from a commit 2026-06-14 15:29:15 +00:00

fix(provisioner#24 PR-B): real Gitea TemplateAssetFetcher + wire (no stubs)

agent-dev-b referenced this pull request 2026-06-14 15:29:42 +00:00

fix(provisioner#24 PR-B): real Gitea TemplateAssetFetcher + wire (no stubs) #2857

agent-dev-b referenced this issue from a commit 2026-06-14 19:49:26 +00:00

fix(provisioner#24 PR-B): real Gitea TemplateAssetFetcher + wire (no stubs)

agent-dev-b referenced this issue from a commit 2026-06-14 19:49:26 +00:00

fix(provisioner#24 PR-B): wire Gitea TemplateAssetFetcher at boot + populate templateRepoByName in prod init

core-devops referenced this issue from a commit 2026-06-15 00:54:57 +00:00

docs(provisioner): template asset-delivery model + token runbook (RFC #2843 #27)

core-devops referenced this pull request 2026-06-15 00:55:12 +00:00

docs(provisioner): template asset-delivery model + token runbook (RFC #2843 #27) #2898

agent-dev-b referenced this issue from a commit 2026-06-15 01:25:26 +00:00

feat(provisioner): #2843 #24 PR-B — fetcher selection (real Gitea for SaaS, no-op for self-host) + public-fetch wire

agent-dev-b referenced this pull request 2026-06-15 01:25:55 +00:00

feat(provisioner): #2843 #24 PR-B — fetcher selection (real Gitea for SaaS, no-op for self-host) + public-fetch wire #2903

agent-dev-b referenced this issue from a commit 2026-06-15 06:18:42 +00:00

refactor(core): RFC #2843 §10a — de-hardcode concierge identity into platform-agent template

agent-dev-b referenced this pull request 2026-06-15 06:23:51 +00:00

refactor(core): RFC #2843 §10a — de-hardcode concierge identity into platform-agent template #2919

agent-reviewer-cr2 referenced this pull request 2026-06-15 06:30:17 +00:00

refactor(core): RFC #2843 §10a — de-hardcode concierge identity into platform-agent template #2919

agent-reviewer-cr2 referenced this pull request 2026-06-15 07:15:51 +00:00

docs(provisioner): template asset-delivery model + token runbook (RFC #2843 #27) #2898

agent-dev-b referenced this issue from a commit 2026-06-15 07:23:39 +00:00

feat(provisioner#2919): Dockerfile.platform-agent + CI drift-gate (RFC #2843 §10a IMAGE-BAKED)

agent-dev-b referenced this pull request 2026-06-15 07:24:06 +00:00

refactor(core): RFC #2843 §10a — de-hardcode concierge identity into platform-agent template #2919

agent-researcher referenced this pull request 2026-06-15 09:26:05 +00:00

refactor(core): RFC #2843 §10a — de-hardcode concierge identity into platform-agent template #2919

agent-reviewer-cr2 referenced this pull request 2026-06-15 09:34:38 +00:00

refactor(core): RFC #2843 §10a — de-hardcode concierge identity into platform-agent template #2919

agent-reviewer-cr2 referenced this pull request 2026-06-15 10:21:28 +00:00

refactor(core): RFC #2843 §10a — de-hardcode concierge identity into platform-agent template #2919

core-devops referenced this pull request 2026-06-15 15:24:22 +00:00

docs(rfc): marketplace template/plugin delivery (entitlement-brokered, encrypted, automatic) #2948

core-devops referenced this issue from a commit 2026-06-15 18:25:24 +00:00

fix(workspace): PATCH-runtime compat-check reads RESOLVED model (workspace_secret), not the workspaces.model column

core-devops referenced this pull request 2026-06-15 18:25:25 +00:00

fix(workspace): PATCH-runtime compat-check reads resolved model (unblocks seo-template conversion) #2957

agent-dev-a referenced this issue from a commit 2026-06-15 19:32:58 +00:00

fix(workspace): PATCH-runtime compat-check reads RESOLVED model (workspace_secret), not the workspaces.model column

agent-dev-a referenced this issue from a commit 2026-06-15 19:55:27 +00:00

fix(workspace): PATCH-runtime compat-check reads RESOLVED model (workspace_secret), not the workspaces.model column

core-devops referenced this issue from a commit 2026-06-15 20:21:12 +00:00

fix(concierge): restore model-seed at provision — #2919 regressed fresh platform-agent provisions to MISSING_MODEL

core-devops referenced this pull request 2026-06-15 20:24:04 +00:00

fix(concierge): restore model-seed at provision — #2919 regressed fresh platform-agent provisions to MISSING_MODEL #2966

agent-researcher referenced this pull request 2026-06-15 20:33:59 +00:00

fix(concierge): restore model-seed at provision — #2919 regressed fresh platform-agent provisions to MISSING_MODEL #2966

core-devops referenced this issue from a commit 2026-06-15 22:17:21 +00:00

test(e2e): template-asset delivery gate — fresh seo-agent must boot WITH skills (RFC #2843 regression gate)

core-devops referenced this pull request 2026-06-15 22:17:36 +00:00

test(e2e): template-asset delivery gate — fresh seo-agent must boot WITH skills (RFC #2843) #2971

agent-researcher referenced this pull request 2026-06-15 22:31:54 +00:00

RCA: SEO SaaS agents lose config, skills, memory; platform-agent backfill creates offline root #2831

agent-dev-a referenced this pull request 2026-06-16 00:36:10 +00:00

docs(design): RFC #2948 Phase 1 — decouple workspace template from runtime #2977

core-devops referenced this issue from a commit 2026-06-16 01:07:53 +00:00

Merge pull request 'test(e2e): template-asset delivery gate — fresh seo-agent must boot WITH skills (RFC #2843)' (#2971) from feat/template-delivery-e2e-gate into main

core-devops referenced this issue from a commit 2026-06-16 15:23:39 +00:00

fix(provision): resolve template-asset fetch by TEMPLATE, not runtime (fixes seo-agent skills never delivered, #32)

core-devops referenced this pull request 2026-06-16 20:01:58 +00:00

Phase 2: promote template-delivery-e2e to a required gate (remove continue-on-error) #2996

core-devops referenced this issue from a commit 2026-06-19 04:05:52 +00:00

test(provision): contract SSOT + producer-pin for the core→CP provision request

core-devops referenced this pull request 2026-06-19 04:06:10 +00:00

test(provision): contract SSOT + producer-pin for the core→CP provision request #3058

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer-cr2

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2843