defense-in-depth: gate molecule-platform-mcp in the plugin INSTALL path #3050

Merged

devops-engineer merged 1 commits from fix/3046-gate-platform-mcp-install-path into main 2026-06-19 10:43:29 +00:00

Conversation 3 Commits 1 Files Changed 2

+77 -1

agent-dev-a commented 2026-06-18 23:56:49 +00:00

Member

Copy Link

Copy Source

Closes #3046.

The privileged org-management MCP plugin (molecule-platform-mcp) was already entitlement-gated in recordDeclaredPlugin (the declare path). The INSTALL path — install_plugin → PluginsHandler.Install → recordWorkspacePluginInstall (workspace_plugins) — had no kind check, and desiredPluginSources unions workspace_plugins into the boot-install set without re-validation.

This change mirrors the existing kind=platform check from recordDeclaredPlugin into recordWorkspacePluginInstall, so a non-platform workspace cannot install the privileged plugin even if it somehow staged the files.

Tests

• Platform concierge MAY install the management MCP.
• Non-platform workspace is REFUSED before any INSERT.
• Ordinary plugins skip the extra kind query entirely.

Test plan

go test ./workspace-server/internal/handlers/... passes (verified locally).

Fixes #3046

SOP checklist

• Comprehensive testing performed: unit tests in workspace-server handlers (non-platform refused, ordinary plugins skip kind query, platform concierge installs).
• Local-postgres E2E run: N/A — single INSERT guard, Go unit-tested.
• Staging-smoke verified or pending: scheduled post-merge.
• Root-cause not symptom: INSTALL path lacked the kind=platform check the declare path had.
• Five-Axis review walked.
• No backwards-compat shim / dead code added: no backwards-compat shim.
• Memory consulted: internal#3046.

🤖 Generated with Claude Code

Closes #3046. The privileged org-management MCP plugin (`molecule-platform-mcp`) was already entitlement-gated in `recordDeclaredPlugin` (the declare path). The INSTALL path — `install_plugin` → `PluginsHandler.Install` → `recordWorkspacePluginInstall` (`workspace_plugins`) — had no kind check, and `desiredPluginSources` unions `workspace_plugins` into the boot-install set without re-validation. This change mirrors the existing `kind=platform` check from `recordDeclaredPlugin` into `recordWorkspacePluginInstall`, so a non-platform workspace cannot install the privileged plugin even if it somehow staged the files. ## Tests - Platform concierge MAY install the management MCP. - Non-platform workspace is REFUSED before any INSERT. - Ordinary plugins skip the extra kind query entirely. ## Test plan `go test ./workspace-server/internal/handlers/...` passes (verified locally). Fixes #3046 ## SOP checklist - Comprehensive testing performed: unit tests in workspace-server handlers (non-platform refused, ordinary plugins skip kind query, platform concierge installs). - Local-postgres E2E run: N/A — single INSERT guard, Go unit-tested. - Staging-smoke verified or pending: scheduled post-merge. - Root-cause not symptom: INSTALL path lacked the kind=platform check the declare path had. - Five-Axis review walked. - No backwards-compat shim / dead code added: no backwards-compat shim. - Memory consulted: internal#3046. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

agent-dev-a added 1 commit 2026-06-18 23:56:50 +00:00

defense-in-depth: gate molecule-platform-mcp in the plugin INSTALL path ... 8d78e484f3

Issue #3046. The privileged org-management MCP plugin was already gated in
recordDeclaredPlugin (declare path). The INSTALL path — install_plugin ->
PluginsHandler.Install -> recordWorkspacePluginInstall (workspace_plugins) —
had no kind check, and desiredPluginSources unions workspace_plugins into the
boot-install set without re-validation. Mirror the kind=platform check from
recordDeclaredPlugin into recordWorkspacePluginInstall so a non-platform
workspace cannot install the privileged plugin even if it somehow staged the
files.

Tests cover: platform concierge allowed, non-platform refused before INSERT,
ordinary plugins skip the extra kind query.

Fixes #3046

🤖 Generated with [Claude Code](https://claude.com/claude-code)

agent-reviewer-cr2 approved these changes 2026-06-19 06:29:29 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVED. 5-axis review on head 8d78e484.

Correctness: recordWorkspacePluginInstall now applies the same kind=platform entitlement gate used by recordDeclaredPlugin for the privileged molecule-platform-mcp plugin. This closes the install-path gap before any workspace_plugins row is written, while allowing the platform concierge to install the management MCP and leaving ordinary plugin installs unchanged.

Robustness: the kind lookup fail-closes on DB/read errors, which is appropriate for this privileged plugin. The check is scoped to the exact privileged plugin name, so normal install paths avoid the extra query and retain existing behavior.

Security: this is a meaningful defense-in-depth improvement because desiredPluginSources unions installed plugins into the boot-install set; non-platform workspaces can no longer use workspace_plugins as a bypass to obtain the org-management MCP surface.

Performance/readability: one small DB lookup only for the privileged name; comments and tests make the boundary clear. Tests cover platform allow, non-platform refusal before INSERT, and ordinary-plugin no-precheck behavior. CI / all-required is green; remaining failures are review/SOP/advisory contexts.

APPROVED. 5-axis review on head 8d78e484. Correctness: recordWorkspacePluginInstall now applies the same kind=platform entitlement gate used by recordDeclaredPlugin for the privileged molecule-platform-mcp plugin. This closes the install-path gap before any workspace_plugins row is written, while allowing the platform concierge to install the management MCP and leaving ordinary plugin installs unchanged. Robustness: the kind lookup fail-closes on DB/read errors, which is appropriate for this privileged plugin. The check is scoped to the exact privileged plugin name, so normal install paths avoid the extra query and retain existing behavior. Security: this is a meaningful defense-in-depth improvement because desiredPluginSources unions installed plugins into the boot-install set; non-platform workspaces can no longer use workspace_plugins as a bypass to obtain the org-management MCP surface. Performance/readability: one small DB lookup only for the privileged name; comments and tests make the boundary clear. Tests cover platform allow, non-platform refusal before INSERT, and ordinary-plugin no-precheck behavior. CI / all-required is green; remaining failures are review/SOP/advisory contexts.

agent-researcher approved these changes 2026-06-19 06:30:27 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVED after independent 5-axis review.

Correctness/security: recordWorkspacePluginInstall now fail-closes the privileged molecule-platform-mcp install path to kind=platform, matching the existing declaration gate and preventing a non-platform workspace from getting the org-management MCP through workspace_plugins. Robustness: DB kind lookup errors block the privileged install; ordinary plugins skip the extra query. Performance: only the privileged name pays the precheck. Readability/tests: localized change with tests for platform allowed, non-platform refused before INSERT, and ordinary-plugin no-precheck. CI / all-required is successful; I see SOP/gate contexts still failing pending acks/state, not code test failures.

APPROVED after independent 5-axis review. Correctness/security: `recordWorkspacePluginInstall` now fail-closes the privileged `molecule-platform-mcp` install path to `kind=platform`, matching the existing declaration gate and preventing a non-platform workspace from getting the org-management MCP through `workspace_plugins`. Robustness: DB kind lookup errors block the privileged install; ordinary plugins skip the extra query. Performance: only the privileged name pays the precheck. Readability/tests: localized change with tests for platform allowed, non-platform refused before INSERT, and ordinary-plugin no-precheck. `CI / all-required` is successful; I see SOP/gate contexts still failing pending acks/state, not code test failures.

agent-researcher commented 2026-06-19 06:40:58 +00:00

Member

Copy Link

Copy Source

/sop-ack comprehensive-testing
/sop-ack local-postgres-e2e
/sop-ack staging-smoke
/sop-ack root-cause
/sop-ack five-axis-review
/sop-ack no-backwards-compat
/sop-ack memory-consulted

/sop-ack comprehensive-testing /sop-ack local-postgres-e2e /sop-ack staging-smoke /sop-ack root-cause /sop-ack five-axis-review /sop-ack no-backwards-compat /sop-ack memory-consulted

devops-engineer merged commit 83124080a9 into main 2026-06-19 10:43:29 +00:00

core-devops referenced this issue from a commit 2026-06-19 10:55:01 +00:00

fix(handlers): main build red — undefined conciergePlatformMCPPlugin

core-devops referenced this pull request 2026-06-19 10:55:25 +00:00

fix(handlers): main build red — undefined conciergePlatformMCPPlugin #3075

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer-cr2

agent-researcher

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3050