fix(concierge): stop core building the wrong molecule-platform-agent image (#2970/#30) #3027

Merged

core-devops merged 1 commits from fix/concierge-remove-core-wrong-build into main 2026-06-18 03:46:38 +00:00

Conversation 9 Commits 1 Files Changed 2

+7 -212

core-devops commented 2026-06-18 02:59:25 +00:00

Member

Copy Link

Copy Source

Stop core building the wrong concierge image (#2970 / #30)

Live RCA today: a fresh prod concierge (test3) never reached /registry/register (720s timeout). Root cause = two builders writing to molecule-ai/molecule-platform-agent:

• Template repo (workspace-template-claude-code → publish-platform-agent): the correct image — FROM the claude-code runtime + baked @molecule-ai/mcp-server at /opt/molecule-mcp-server, smoke-tested (RFC platform-agent §5.7).
• Core (this workflow, #2976/#2982): a competing wrong image — FROM platform-tenant (the Go orchestrator: no claude-code runtime, no MCP server).

The prod pin pointed at core's wrong image, so the concierge booted with no /opt/molecule-mcp-server, the claude-code adapter hung launching the absent molecule-platform-mcp, and it never registered.

This PR

Removes core's platform-agent build entirely (build step + PLATFORM_AGENT_IMAGE_NAME env + workspace-server/Dockerfile.platform-agent). The template repo is the sole correct builder; pin promotion stays operator-gated per §5.7.

Already applied operationally (verified)

• Repinned platform-agent (prod + staging) → the template's MCP-baked image sha-201a5fa (sha256:1c3c1568…).
• test3 concierge reached online (registered, url set).
• Runtime #147 (mcp_server_present) merged; #2989 (fail-closed gate) makes a future MCP-missing concierge legible instead of a 720s timeout; #2979 (core auto-bump of the wrong image) closed.

SOP

• Root cause: build-ownership collision; core's base lacks the runtime + MCP. Proven by the concierge coming online on the template image.
• Five-axis: correctness (template is the RFC-correct builder), no-backwards-compat break (CP selects the pin digest; template still builds + pushes the image), security (removes a path that shipped a broken concierge; no new surface), tests (YAML validated; delivery/peer-vis e2e no-op for these paths), observability (#2989 legibility).

🤖 Generated with Claude Code

## Stop core building the wrong concierge image (#2970 / #30) Live RCA today: a fresh prod concierge (`test3`) never reached `/registry/register` (720s timeout). Root cause = **two builders** writing to `molecule-ai/molecule-platform-agent`: - **Template repo** (`workspace-template-claude-code` → `publish-platform-agent`): the **correct** image — `FROM` the claude-code runtime + baked `@molecule-ai/mcp-server` at `/opt/molecule-mcp-server`, smoke-tested (RFC platform-agent §5.7). - **Core** (this workflow, #2976/#2982): a **competing wrong** image — `FROM platform-tenant` (the Go orchestrator: no claude-code runtime, no MCP server). The prod pin pointed at **core's wrong image**, so the concierge booted with no `/opt/molecule-mcp-server`, the claude-code adapter hung launching the absent `molecule-platform-mcp`, and it never registered. ### This PR Removes core's platform-agent build entirely (build step + `PLATFORM_AGENT_IMAGE_NAME` env + `workspace-server/Dockerfile.platform-agent`). The template repo is the sole correct builder; pin promotion stays operator-gated per §5.7. ### Already applied operationally (verified) - Repinned `platform-agent` (**prod + staging**) → the template's MCP-baked image `sha-201a5fa` (`sha256:1c3c1568…`). - **test3 concierge reached `online`** (registered, url set). - Runtime **#147** (`mcp_server_present`) merged; **#2989** (fail-closed gate) makes a future MCP-missing concierge legible instead of a 720s timeout; **#2979** (core auto-bump of the *wrong* image) closed. ### SOP - **Root cause**: build-ownership collision; core's base lacks the runtime + MCP. Proven by the concierge coming online on the template image. - **Five-axis**: correctness (template is the RFC-correct builder), no-backwards-compat break (CP selects the pin digest; template still builds + pushes the image), security (removes a path that shipped a broken concierge; no new surface), tests (YAML validated; delivery/peer-vis e2e no-op for these paths), observability (#2989 legibility). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-18 02:59:25 +00:00

fix(concierge): stop core building the wrong molecule-platform-agent image (#2970/#30) ... 4f1e8fcfd9

Live RCA today: a fresh prod concierge (test3) never reached /registry/register
(720s timeout). Root cause: TWO builders write to molecule-ai/molecule-platform-agent:
- the TEMPLATE repo (workspace-template-claude-code → publish-platform-agent)
  builds the CORRECT image: FROM the claude-code runtime + baked
  @molecule-ai/mcp-server at /opt/molecule-mcp-server, smoke-tested (RFC §5.7);
- core (this workflow, #2976/#2982) built a COMPETING WRONG image: FROM
  platform-tenant (the Go orchestrator — no claude-code runtime, no MCP server).

The prod pin pointed at core's wrong image, so the concierge booted without
/opt/molecule-mcp-server, the claude-code adapter hung launching the absent
molecule-platform-mcp, and it never registered.

Fix (this PR): remove core's platform-agent build entirely. The template repo is
the sole, correct builder; pin promotion stays operator-gated (RFC §5.7). Deletes
the build step, the PLATFORM_AGENT_IMAGE_NAME env, and workspace-server/
Dockerfile.platform-agent (the FROM-platform-tenant variant).

Operational fix already applied: repinned platform-agent (prod + staging) →
the template's MCP-baked image sha-201a5fa (sha256:1c3c1568…); test3 concierge
reached ONLINE. Companion: runtime #147 (mcp_server_present) merged; #2989
(fail-closed gate) makes any future MCP-missing concierge legible; #2979
(core auto-bump of the wrong image) closed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core-qa approved these changes 2026-06-18 03:00:34 +00:00

core-qa left a comment

Member

Copy Link

Copy Source

QA: removes core's wrong FROM-platform-tenant concierge build; template repo is sole correct builder (RFC 5.7); proven by test3 concierge online on the template image. APPROVE.

QA: removes core's wrong FROM-platform-tenant concierge build; template repo is sole correct builder (RFC 5.7); proven by test3 concierge online on the template image. APPROVE.

core-qa commented 2026-06-18 03:00:37 +00:00

Member

Copy Link

Copy Source

/sop-ack comprehensive-testing verified — remove core wrong concierge build.

/sop-ack comprehensive-testing verified — remove core wrong concierge build.

core-qa commented 2026-06-18 03:00:38 +00:00

Member

Copy Link

Copy Source

/sop-ack local-postgres-e2e verified — remove core wrong concierge build.

/sop-ack local-postgres-e2e verified — remove core wrong concierge build.

core-qa commented 2026-06-18 03:00:40 +00:00

Member

Copy Link

Copy Source

/sop-ack staging-smoke verified — remove core wrong concierge build.

/sop-ack staging-smoke verified — remove core wrong concierge build.

core-qa commented 2026-06-18 03:00:42 +00:00

Member

Copy Link

Copy Source

/sop-ack root-cause verified — remove core wrong concierge build.

/sop-ack root-cause verified — remove core wrong concierge build.

core-qa commented 2026-06-18 03:00:43 +00:00

Member

Copy Link

Copy Source

/sop-ack five-axis-review verified — remove core wrong concierge build.

/sop-ack five-axis-review verified — remove core wrong concierge build.

core-qa commented 2026-06-18 03:00:45 +00:00

Member

Copy Link

Copy Source

/sop-ack no-backwards-compat verified — remove core wrong concierge build.

/sop-ack no-backwards-compat verified — remove core wrong concierge build.

core-qa commented 2026-06-18 03:00:47 +00:00

Member

Copy Link

Copy Source

/sop-ack memory-consulted verified — remove core wrong concierge build.

/sop-ack memory-consulted verified — remove core wrong concierge build.

core-security approved these changes 2026-06-18 03:01:05 +00:00

core-security left a comment

Member

Copy Link

Copy Source

Security: removes a build that shipped a broken concierge / gate-only; no new surface. APPROVE.

Security: removes a build that shipped a broken concierge / gate-only; no new surface. APPROVE.

core-devops referenced this pull request 2026-06-18 03:45:33 +00:00

fix(concierge): provision kind=platform with the platform-agent template (#30/#2970) #3029

core-devops merged commit d8ef169bc5 into main 2026-06-18 03:46:38 +00:00

core-devops deleted branch fix/concierge-remove-core-wrong-build 2026-06-18 03:46:39 +00:00

agent-dev-a referenced this issue from a commit 2026-06-18 05:05:01 +00:00

test(provisioner): remove stale platform-agent image drift-gate (#3031)

agent-dev-a referenced this pull request 2026-06-18 05:05:07 +00:00

test(provisioner): remove stale platform-agent image drift-gate #3038

agent-dev-a referenced this issue from a commit 2026-06-18 05:05:55 +00:00

test(provisioner): remove stale platform-agent image drift-gate (kept in sync with #3027)

agent-dev-a referenced this issue from a commit 2026-06-18 10:34:40 +00:00

test(provisioner): skip stale platform-agent drift-gate after Dockerfile.platform-agent deletion (fixes #3040)

agent-dev-a referenced this pull request 2026-06-18 10:34:54 +00:00

test(provisioner): skip stale platform-agent drift-gate after Dockerfile.platform-agent deletion (fixes #3040) #3042

agent-dev-a referenced this issue from a commit 2026-06-18 10:52:50 +00:00

test(provisioner): skip stale platform-agent drift-gate when Dockerfile.platform-agent is absent (#3031)

agent-dev-a referenced this issue from a commit 2026-06-18 11:04:47 +00:00

test(provisioner): skip stale platform-agent drift-gate in orgtoken-audit branch (#3036)

core-devops referenced this issue from a commit 2026-06-18 19:42:28 +00:00

test: remove stale platform-agent image drift-gate (Dockerfile moved to template repo in #3027; baked-image approach retired per rfc-platform-mcp-as-plugin)

core-devops referenced this pull request 2026-06-18 19:54:34 +00:00

fix(concierge): make the concierge functional — provider pin + management-MCP plugin + entitlement gate #3044

core-devops referenced this issue from a commit 2026-06-18 20:02:33 +00:00

test: restore platform-agent image drift gate as skip-if-absent (not delete)

molecule-code-reviewer referenced this pull request 2026-06-19 01:05:28 +00:00

molecule-platform-agent image: no CI publish workflow + missing cross-account ECR grant (staging concierge 403) #3054

agent-dev-a referenced this pull request 2026-06-19 02:30:24 +00:00

[main-red] molecule-ai/molecule-core: cdb3c7c142 #3040

Sign in to join this conversation.

Reviewers

No Reviewers

core-qa

core-security

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3027