test(provision): contract SSOT + producer-pin for the core→CP provision request #3058

Merged

devops-engineer merged 2 commits from feat/provision-request-contract into main 2026-06-19 04:20:37 +00:00

Conversation 1 Commits 2 Files Changed 2

+178

core-devops commented 2026-06-19 04:06:10 +00:00

Member

Copy Link

Copy Source

What

Adds a consumer-driven contract guarding the core→control-plane provision request wire shape, so the two duplicated structs (core cpProvisionRequest ↔ CP wsProvisionRequest, in separate repos) can no longer silently drift.

• provision_request.contract.json — the SSOT field list for POST /cp/workspaces/provision, each field tagged cp_consumes true/false (+ a required note for dead fields).
• provision_request_contract_test.go — producer pin: cpProvisionRequest's JSON tags must equal the contract exactly; dead (cp_consumes:false) fields must justify themselves.

Why

core and the CP have no shared compile unit, so a field added on the sender does nothing if the receiver lacks it. That is exactly how template_assets was silently dropped — core fetches+sends config.yaml/prompts on that channel, the deployed CP has no template_assets field, so it's ignored, and SaaS boxes fall back to config_files (the restart re-stub class — see project_saas_restart_re_stub_config / RFC #2843). No test caught it because the only thing exercising the seam was post-merge black-box staging e2e.

The contract records today's reality honestly: template_assets is marked cp_consumes:false with a note flagging the dead channel (cleanup tracked separately) — converting an invisible bug into an explicit, reviewed decision.

Guard behavior (verified)

• Passes on the current struct/contract.
• Fails when a wire field is added without updating the contract (tested by injecting a drift field → caught).
• Pure unit test, no infra — runs in normal Go CI.

Companion (separate PR, molecule-controlplane)

A consumer-completeness test: wsProvisionRequest must have a json tag for every cp_consumes:true field in this contract. Together the two guards make the template_assets failure class impossible to reintroduce silently.

Context

Step 1 of the local-test parity plan (catch contract drift at the seam, in-repo, on the PR that introduces it — instead of via deployed staging e2e). Follow-ups: CP consumer test; a local/docker WorkspaceProvisioner backend with SaaS parity.

🤖 Generated with Claude Code

## What Adds a **consumer-driven contract** guarding the core→control-plane provision request wire shape, so the two duplicated structs (core `cpProvisionRequest` ↔ CP `wsProvisionRequest`, in **separate repos**) can no longer silently drift. - `provision_request.contract.json` — the SSOT field list for `POST /cp/workspaces/provision`, each field tagged `cp_consumes` true/false (+ a required `note` for dead fields). - `provision_request_contract_test.go` — **producer pin**: `cpProvisionRequest`'s JSON tags must equal the contract exactly; dead (`cp_consumes:false`) fields must justify themselves. ## Why core and the CP have no shared compile unit, so a field added on the sender does nothing if the receiver lacks it. That is **exactly how `template_assets` was silently dropped** — core fetches+sends config.yaml/prompts on that channel, the deployed CP has no `template_assets` field, so it's ignored, and SaaS boxes fall back to `config_files` (the restart re-stub class — see `project_saas_restart_re_stub_config` / RFC #2843). No test caught it because the only thing exercising the seam was post-merge black-box staging e2e. The contract records today's reality honestly: `template_assets` is marked `cp_consumes:false` with a note flagging the dead channel (cleanup tracked separately) — converting an invisible bug into an explicit, reviewed decision. ## Guard behavior (verified) - Passes on the current struct/contract. - **Fails** when a wire field is added without updating the contract (tested by injecting a drift field → caught). - Pure unit test, no infra — runs in normal Go CI. ## Companion (separate PR, molecule-controlplane) A **consumer-completeness** test: `wsProvisionRequest` must have a json tag for every `cp_consumes:true` field in this contract. Together the two guards make the template_assets failure class impossible to reintroduce silently. ## Context Step 1 of the local-test parity plan (catch contract drift at the seam, in-repo, on the PR that introduces it — instead of via deployed staging e2e). Follow-ups: CP consumer test; a local/docker `WorkspaceProvisioner` backend with SaaS parity. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-19 04:06:10 +00:00

test(provision): contract SSOT + producer-pin for the core→CP provision request ... 9836de23be

Core and the control-plane define the /cp/workspaces/provision request as two
DUPLICATED structs in two repos with no shared compile unit, so a field added on
the sender silently does nothing if the receiver lacks it. That is exactly how
`template_assets` was dropped (config.yaml/prompts never materialized on SaaS via
that channel) — RFC #2843 / project_saas_restart_re_stub_config.

Adds provision_request.contract.json as the SSOT wire shape, and a producer-pin
test asserting cpProvisionRequest's JSON tags == the contract exactly. Adding or
removing a wire field now FAILS until the contract is updated deliberately, with
an explicit cp_consumes flag per field; cp_consumes:false (a dead sent-but-ignored
field, e.g. template_assets today) must carry a justifying note. A CP-side
companion test (molecule-controlplane) will enforce that every cp_consumes:true
field is present on wsProvisionRequest.

Step 1 of the local-test parity plan: catch contract drift at the seam, in-repo,
on the PR that introduces it — instead of via post-merge black-box staging e2e.

Verified: passes on the current struct; fails when a drift field is injected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core-devops added 1 commit 2026-06-19 04:09:21 +00:00

docs(contract): repo-explicit guard prose so the byte-identical CP copy reads correctly ... 80f8e0e86e

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

agent-reviewer-cr2 approved these changes 2026-06-19 04:15:12 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVED. Five-axis review complete on current head 80f8e0e8.

Correctness: the new provision_request.contract.json honestly captures the current core→CP wire shape, including template_assets as cp_consumes:false with a note documenting the dead channel. The producer-side test reflects cpProvisionRequest JSON tags and requires exact equality with the contract field keys, so an added drift field or removed field fails until the contract is deliberately updated. Dead fields must carry a note, preventing silent sent-but-ignored channels.

Robustness/security/performance/readability: pure unit-test/contract addition; no runtime behavior, auth, or provision logic changes. The failure messages are specific enough to guide future producer/consumer updates. Visible core unit/build/all-required contexts are green; staging SaaS contexts are failing, but this PR is pure contract-test and those appear unrelated to this unit guard. No code blockers found.

APPROVED. Five-axis review complete on current head 80f8e0e8. Correctness: the new provision_request.contract.json honestly captures the current core→CP wire shape, including template_assets as cp_consumes:false with a note documenting the dead channel. The producer-side test reflects cpProvisionRequest JSON tags and requires exact equality with the contract field keys, so an added drift field or removed field fails until the contract is deliberately updated. Dead fields must carry a note, preventing silent sent-but-ignored channels. Robustness/security/performance/readability: pure unit-test/contract addition; no runtime behavior, auth, or provision logic changes. The failure messages are specific enough to guide future producer/consumer updates. Visible core unit/build/all-required contexts are green; staging SaaS contexts are failing, but this PR is pure contract-test and those appear unrelated to this unit guard. No code blockers found.

devops-engineer merged commit 99d7d1316b into main 2026-06-19 04:20:37 +00:00

molecule-code-reviewer referenced this pull request 2026-06-19 04:53:23 +00:00

Concierge declares but never installs the management-MCP plugin — molecule-platform-agent image lacks plugin boot-install (no create_workspace) [RFC#3045 remaining half] #3063

agent-dev-a referenced this pull request 2026-06-19 22:36:26 +00:00

feat(mcp): pin MCP-plugin delivery contract (core#3080) — includes prerequisite build fix #3084

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer-cr2

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3058