fix(image): build+push the molecule-platform-agent concierge image (concierge identity) #2976

Merged

core-devops merged 1 commits from fix/wire-platform-agent-image-build into main 2026-06-16 01:07:45 +00:00

Conversation 0 Commits 1 Files Changed 2

+48 -2

core-devops commented 2026-06-16 00:33:25 +00:00

Member

Copy Link

Copy Source

Fixes: the concierge identity image is built by nothing and pushed nowhere

You flagged the misleading naming — this is the root of it. The concierge (kind=platform) is supposed to run a dedicated molecule-platform-agent image that bakes its identity (config.yaml/prompts/mcp_servers/identity-fallback.sh) from the platform-agent template via Dockerfile.platform-agent (#2919/#2955). But the pipeline was never wired:

• manifest.json had no platform-agent entry → clone-manifest.sh never staged the template at .tenant-bundle-deps/workspace-configs-templates/platform-agent → the Dockerfile's COPY source was missing.
• publish-workspace-server-image.yml never built Dockerfile.platform-agent → molecule-ai/molecule-platform-agent ECR is empty (0 images); the only "platform" image (molecule-ai/platform) is a month stale (2026-05-15).

So #2955's identity bake was built by nothing and pushed nowhere; the concierge falls back to a non-identity image and boots as generic Claude Code (verified on test2: 218 B config, no prompts, no identity after restart).

Changes

1. manifest.json — pin the platform-agent template (ref e5c8302, config.yaml present) so clone-manifest.sh stages it into the build context. Supersedes the closed #2959.
2. publish-workspace-server-image.yml — add a Build & push platform-agent image step: builds Dockerfile.platform-agent with BASE_IMAGE=<just-built platform image>, pushes molecule-ai/molecule-platform-agent:staging-<sha>+:staging-latest. Runs after the base platform build (it FROMs it).

Follow-ups after merge (operational)

1. Promote runtime_image_pins('platform-agent') → molecule-platform-agent:staging-latest so the CP selects it (core#2495).
2. Re-provision concierges → identity-fallback.sh fills /configs.
3. The template-delivery-e2e gate (#2971) asserts the concierge boots with identity — it confirms the fix and guards against regression.

---

SOP Checklist (RFC#351)

Root-cause not symptom: The concierge identity image (molecule-platform-agent) was built by nothing and pushed nowhere — manifest had no platform-agent entry (template never staged) AND publish-workspace-server-image never built Dockerfile.platform-agent. Fixes both root causes (stage + build), not the symptom.

Comprehensive testing performed: manifest.json validated (JSON + TestManifest_RefPinning passes in CI with the manifest token; local 404s are auth-only, hit all 3 private templates equally). Workflow YAML lint-valid; build step mirrors the proven base-platform/tenant steps; BASE_IMAGE + PLATFORM_AGENT_TEMPLATE_DIR arg names verified against Dockerfile.platform-agent. End-to-end asserted by template-delivery-e2e (#2971).

Local-postgres E2E run: N/A — CI/image-pipeline + manifest change, no schema/handler logic.

Staging-smoke verified or pending: Pending — after merge the image builds; promote the pin + re-provision, then template-delivery-e2e confirms the concierge boots with identity.

Five-Axis review walked: Correctness (build after base, FROM it; template staged by manifest); Security (no token in image — clone-manifest strips .git; read-only template); Performance (one extra image build, cache-from/to); Observability (labels + tags); Tests (e2e gate asserts the outcome).

No backwards-compat shim / dead code added: No shim — adds the missing build + manifest entry; supersedes the closed #2959.

Memory consulted: project_rfc2843_rollout_authorization, reference_runtime_fix_deploy_path, project_platform_agent_org_root_shipped.

🤖 Generated with Claude Code

## Fixes: the concierge identity image is built by nothing and pushed nowhere You flagged the misleading naming — this is the root of it. The concierge (`kind=platform`) is supposed to run a dedicated **`molecule-platform-agent`** image that bakes its identity (config.yaml/prompts/mcp_servers/`identity-fallback.sh`) from the platform-agent template via `Dockerfile.platform-agent` (#2919/#2955). But the pipeline was never wired: - `manifest.json` had **no `platform-agent` entry** → `clone-manifest.sh` never staged the template at `.tenant-bundle-deps/workspace-configs-templates/platform-agent` → the Dockerfile's `COPY` source was missing. - `publish-workspace-server-image.yml` **never built `Dockerfile.platform-agent`** → `molecule-ai/molecule-platform-agent` ECR is **empty (0 images)**; the only "platform" image (`molecule-ai/platform`) is **a month stale (2026-05-15)**. So #2955's identity bake was built by nothing and pushed nowhere; the concierge falls back to a non-identity image and boots as generic Claude Code (verified on test2: 218 B config, no prompts, no identity after restart). ### Changes 1. **`manifest.json`** — pin the `platform-agent` template (ref `e5c8302`, config.yaml present) so `clone-manifest.sh` stages it into the build context. Supersedes the closed #2959. 2. **`publish-workspace-server-image.yml`** — add a *Build & push platform-agent image* step: builds `Dockerfile.platform-agent` with `BASE_IMAGE=<just-built platform image>`, pushes `molecule-ai/molecule-platform-agent:staging-<sha>`+`:staging-latest`. Runs after the base platform build (it `FROM`s it). ### Follow-ups after merge (operational) 1. Promote `runtime_image_pins('platform-agent')` → `molecule-platform-agent:staging-latest` so the CP selects it (core#2495). 2. Re-provision concierges → `identity-fallback.sh` fills `/configs`. 3. The **`template-delivery-e2e`** gate (#2971) asserts the concierge boots **with** identity — it confirms the fix and guards against regression. --- ## SOP Checklist (RFC#351) **Root-cause not symptom:** The concierge identity image (molecule-platform-agent) was built by nothing and pushed nowhere — manifest had no platform-agent entry (template never staged) AND publish-workspace-server-image never built Dockerfile.platform-agent. Fixes both root causes (stage + build), not the symptom. **Comprehensive testing performed:** manifest.json validated (JSON + TestManifest_RefPinning passes in CI with the manifest token; local 404s are auth-only, hit all 3 private templates equally). Workflow YAML lint-valid; build step mirrors the proven base-platform/tenant steps; BASE_IMAGE + PLATFORM_AGENT_TEMPLATE_DIR arg names verified against Dockerfile.platform-agent. End-to-end asserted by template-delivery-e2e (#2971). **Local-postgres E2E run:** N/A — CI/image-pipeline + manifest change, no schema/handler logic. **Staging-smoke verified or pending:** Pending — after merge the image builds; promote the pin + re-provision, then template-delivery-e2e confirms the concierge boots with identity. **Five-Axis review walked:** Correctness (build after base, FROM it; template staged by manifest); Security (no token in image — clone-manifest strips .git; read-only template); Performance (one extra image build, cache-from/to); Observability (labels + tags); Tests (e2e gate asserts the outcome). **No backwards-compat shim / dead code added:** No shim — adds the missing build + manifest entry; supersedes the closed #2959. **Memory consulted:** project_rfc2843_rollout_authorization, reference_runtime_fix_deploy_path, project_platform_agent_org_root_shipped. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-16 00:33:27 +00:00

fix(image): build+push the molecule-platform-agent concierge image (fixes concierge identity never deploying) ... ab3accdf66

The concierge (kind=platform) is meant to run a dedicated molecule-platform-agent
image that bakes its identity (config.yaml/prompts/mcp_servers/identity-fallback.sh)
from the platform-agent template via Dockerfile.platform-agent (#2919/#2955). But:
  - manifest.json had NO platform-agent entry → clone-manifest.sh never staged the
    template at .tenant-bundle-deps/workspace-configs-templates/platform-agent →
    Dockerfile.platform-agent's COPY source was missing.
  - publish-workspace-server-image.yml never built Dockerfile.platform-agent → the
    molecule-ai/molecule-platform-agent ECR repo is EMPTY (0 images); molecule-ai/
    platform is a month stale (2026-05-15).
So #2955's identity bake was built by nothing and pushed nowhere — the concierge
falls back to a non-identity image and boots as generic Claude Code (user-reported
on test2; verified: 218B config, no prompts, no identity after restart).

Changes:
  - manifest.json: pin the platform-agent template (ref e5c8302, config.yaml present)
    so clone-manifest.sh stages it into the build context. Updates the
    _pinning_contract note (supersedes the closed #2959).
  - publish-workspace-server-image.yml: add a "Build & push platform-agent image"
    step — builds ./workspace-server/Dockerfile.platform-agent with
    BASE_IMAGE=<just-built platform image>, pushes molecule-ai/molecule-platform-agent
    :staging-<sha>+:staging-latest. Runs after the base platform build (FROM it).

Follow-ups after merge: (1) promote runtime_image_pins('platform-agent') →
molecule-platform-agent:staging-latest so the CP selects it (core#2495); (2)
re-provision concierges → identity-fallback fills /configs. The template-delivery-e2e
gate (#2971) asserts the concierge boots WITH identity, so it confirms the fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core-devops requested review from agent-reviewer-cr2 2026-06-16 00:59:46 +00:00

core-devops merged commit e48b5f73ef into main 2026-06-16 01:07:45 +00:00

core-devops referenced this issue from a commit 2026-06-16 01:31:16 +00:00

fix(image): auto-bump the platform-agent concierge image pin on every publish (true auto-bump)

core-devops referenced this pull request 2026-06-16 01:31:17 +00:00

fix(image): auto-bump the platform-agent concierge image pin (true auto-bump) #2979

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer-cr2

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2976