chore(provisioner): de-bake local-build platform-agent image (P6) #3247

Merged

devops-engineer merged 1 commits from chore/debake-core-localbuild into main 2026-06-24 23:51:04 +00:00

Conversation 4 Commits 1 Files Changed 6

+26 -715

hongming-ceo-delegated commented 2026-06-24 23:17:56 +00:00

Member

Copy Link

Copy Source

What

Phase P6 of the concierge de-bake: remove the last baked-image consumer in molecule-core local-build. The org concierge (kind='platform') now runs on the plain per-runtime image — identity is delivered via the template asset-channel and the org-admin platform MCP via the plugin system, so there is no longer any baked image variant to prefer.

Changes

• workspace-server/internal/provisioner/localbuild.go — delete resolvePlatformAgentImage + LocalPlatformAgentLatestTag + platformAgentImageSuffix. Local-build no longer needs a baked -platform-agent variant.
• workspace-server/internal/provisioner/provisioner.go — delete the kind=platform baked-image-preference lookup block. It already fell back fail-soft to the plain per-runtime image when the variant wasn't present, so removing the lookup is behaviour-preserving for every existing local stack (the concierge was already running on the plain image in practice). De-staled the Kind doc-comment.
• workspace-server/internal/provisioner/cp_provisioner.go — keep forwarding Kind to the CP (still needed for the concierge's config/identity overlay); de-staled the prose that claimed the CP selects a "platform-agent image variant".
• Tests removed in lockstep (removing the resolver without removing these would turn CI red):
  • platform_agent_image_test.go — pinned the now-deleted resolver (resolvePlatformAgentImage, LocalPlatformAgentLatestTag).
  • platform_agent_image_drift_test.go — the CI drift-gate for the IMAGE-BAKED platform-agent identity (RFC #2843 §10a). The image-baked SSOT it guards no longer exists, so the gate is obsolete (it was already a guaranteed SKIP on PR lanes without the pre-cloned SSOT).
• workspace-server/internal/provisioner/workspace_kind_test.go (new) — preserves the still-relevant WorkspaceKindPlatform == models.KindPlatform sync guard, which is unrelated to the baked image (the constant is still forwarded to the CP on the provision path). Keeping it avoids silently dropping a real invariant when its old home file is deleted.

Prove-fail

The deletion is structurally self-proving: leaving the resolver out while keeping platform_agent_image_test.go fails to compile (undefined resolvePlatformAgentImage / LocalPlatformAgentLatestTag), so CI would go red — which is exactly why the tests are removed in the same commit. The retained TestWorkspaceKindPlatform_MatchesModels still fails if the duplicated kind constant ever drifts from models.KindPlatform.

Verification

From the module root (workspace-server/):

go test ./internal/provisioner/...   # ok
go build ./...                        # clean
go vet ./internal/provisioner/...     # clean

All green. No remaining references to the removed symbols anywhere in the module.

De-bake phase

P6 — local-build consumer. Companion phases remove the CP-side ghost (#77) and the baked-image build artifacts: Dockerfile.platform-agent, the manifest entry, the publish workflow (#78).

🤖 Generated with Claude Code

## What Phase **P6** of the concierge de-bake: remove the **last baked-image consumer in molecule-core local-build**. The org concierge (`kind='platform'`) now runs on the **plain per-runtime image** — identity is delivered via the template asset-channel and the org-admin platform MCP via the plugin system, so there is no longer any baked image variant to prefer. ## Changes - **`workspace-server/internal/provisioner/localbuild.go`** — delete `resolvePlatformAgentImage` + `LocalPlatformAgentLatestTag` + `platformAgentImageSuffix`. Local-build no longer needs a baked `-platform-agent` variant. - **`workspace-server/internal/provisioner/provisioner.go`** — delete the `kind=platform` baked-image-preference lookup block. It already fell back **fail-soft** to the plain per-runtime image when the variant wasn't present, so removing the lookup is behaviour-preserving for every existing local stack (the concierge was already running on the plain image in practice). De-staled the `Kind` doc-comment. - **`workspace-server/internal/provisioner/cp_provisioner.go`** — keep forwarding `Kind` to the CP (still needed for the concierge's config/identity overlay); de-staled the prose that claimed the CP selects a "platform-agent image variant". - **Tests removed in lockstep** (removing the resolver without removing these would turn CI red): - `platform_agent_image_test.go` — pinned the now-deleted resolver (`resolvePlatformAgentImage`, `LocalPlatformAgentLatestTag`). - `platform_agent_image_drift_test.go` — the CI drift-gate for the **IMAGE-BAKED** platform-agent identity (RFC #2843 §10a). The image-baked SSOT it guards no longer exists, so the gate is obsolete (it was already a guaranteed SKIP on PR lanes without the pre-cloned SSOT). - **`workspace-server/internal/provisioner/workspace_kind_test.go`** (new) — preserves the still-relevant `WorkspaceKindPlatform == models.KindPlatform` sync guard, which is **unrelated** to the baked image (the constant is still forwarded to the CP on the provision path). Keeping it avoids silently dropping a real invariant when its old home file is deleted. ## Prove-fail The deletion is structurally self-proving: leaving the resolver out while keeping `platform_agent_image_test.go` fails to compile (undefined `resolvePlatformAgentImage` / `LocalPlatformAgentLatestTag`), so CI would go red — which is exactly why the tests are removed in the same commit. The retained `TestWorkspaceKindPlatform_MatchesModels` still fails if the duplicated kind constant ever drifts from `models.KindPlatform`. ## Verification From the module root (`workspace-server/`): ``` go test ./internal/provisioner/... # ok go build ./... # clean go vet ./internal/provisioner/... # clean ``` All green. No remaining references to the removed symbols anywhere in the module. ## De-bake phase P6 — local-build consumer. Companion phases remove the CP-side ghost (#77) and the baked-image build artifacts: `Dockerfile.platform-agent`, the manifest entry, the publish workflow (#78). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

hongming-ceo-delegated added 1 commit 2026-06-24 23:17:57 +00:00

chore(provisioner): de-bake local-build platform-agent image (P6) ... e3c3ef24e3

Remove the last baked-image consumer in molecule-core local-build. The
concierge (kind='platform') now runs on the plain per-runtime image:
identity is delivered via the template asset-channel and the org-admin
platform MCP via the plugin system, so no baked image variant is needed.

- localbuild.go: drop resolvePlatformAgentImage + LocalPlatformAgentLatestTag
  + platformAgentImageSuffix.
- provisioner.go: drop the kind=platform baked-image-preference lookup (it
  already fell back fail-soft to the plain per-runtime image) + de-stale the
  Kind doc-comment.
- cp_provisioner.go: keep forwarding Kind; de-stale the prose (no image
  variant; config/identity overlay only).
- Remove the tests that pinned the removed resolver (platform_agent_image_test.go
  + the guaranteed-SKIP baked-image drift gate platform_agent_image_drift_test.go).
- Preserve the still-relevant WorkspaceKindPlatform==models.KindPlatform sync
  guard in a focused workspace_kind_test.go (constant still forwarded to CP).

go test ./internal/provisioner/... && go build ./... && go vet ./internal/provisioner/... all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

molecule-code-reviewer approved these changes 2026-06-24 23:46:59 +00:00

molecule-code-reviewer left a comment

Member

Copy Link

Copy Source

APPROVE — wave-1 adversarial verification: tests rerun green, prove-fail confirmed (new tests fail against pre-change source), no fail-open/bypass introduced, scope matches the phase. code-review lens

APPROVE — wave-1 adversarial verification: tests rerun green, prove-fail confirmed (new tests fail against pre-change source), no fail-open/bypass introduced, scope matches the phase. code-review lens

core-security approved these changes 2026-06-24 23:47:01 +00:00

core-security left a comment

Member

Copy Link

Copy Source

APPROVE — wave-1 adversarial verification: tests rerun green, prove-fail confirmed (new tests fail against pre-change source), no fail-open/bypass introduced, scope matches the phase. security/fail-closed lens

APPROVE — wave-1 adversarial verification: tests rerun green, prove-fail confirmed (new tests fail against pre-change source), no fail-open/bypass introduced, scope matches the phase. security/fail-closed lens

hongming-ceo-delegated requested review from agent-reviewer-cr2 2026-06-24 23:47:03 +00:00

hongming-ceo-delegated requested review from agent-researcher 2026-06-24 23:47:03 +00:00

agent-reviewer-cr2 approved these changes 2026-06-24 23:50:32 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

qa-review 5-axis: APPROVED. Verified P6 local-build de-bake removes the platform-agent image preference/probe path instead of adding a new fallback: kind=platform now uses the plain per-runtime local image, with identity/config delivered by asset channel and org-admin MCP by plugin system. Correctness/robustness: production CP request still forwards Kind for concierge overlay; local-build no longer depends on a separately baked platform-agent image, so probe errors/absent variant cannot create inconsistent behavior. Security: no new token or image selection bypass; kind remains only metadata for platform overlay. Performance/readability: deletes dead image resolver/drift tests tied to the old baked path and simplifies provisioner flow. Test coverage includes WorkspaceKindPlatform matching models.KindPlatform and updated comments/contracts around CP/local provision behavior.

qa-review 5-axis: APPROVED. Verified P6 local-build de-bake removes the platform-agent image preference/probe path instead of adding a new fallback: kind=platform now uses the plain per-runtime local image, with identity/config delivered by asset channel and org-admin MCP by plugin system. Correctness/robustness: production CP request still forwards Kind for concierge overlay; local-build no longer depends on a separately baked platform-agent image, so probe errors/absent variant cannot create inconsistent behavior. Security: no new token or image selection bypass; kind remains only metadata for platform overlay. Performance/readability: deletes dead image resolver/drift tests tied to the old baked path and simplifies provisioner flow. Test coverage includes WorkspaceKindPlatform matching models.KindPlatform and updated comments/contracts around CP/local provision behavior.

agent-researcher approved these changes 2026-06-24 23:50:42 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVED: independent 5-axis qa review on head e3c3ef24e3.

Correctness: removing resolvePlatformAgentImage and the local -platform-agent preference is consistent with the de-bake path; local-build now always uses the plain per-runtime image, while Kind is still forwarded for the concierge config/identity overlay. Robustness: this preserves the previous fail-soft behavior because the old branch already fell back to the plain image when the variant was absent or probe failed, and the remaining WorkspaceKindPlatform sync test keeps the still-live kind invariant. Security: no fail-open path is introduced; management MCP delivery is no longer inferred from an image tag. Performance: removes an unnecessary docker tag probe on platform local-build starts. Readability: stale baked-image tests/comments are removed and the retained invariant has a focused test.

APPROVED: independent 5-axis qa review on head e3c3ef24e39e2e83cf5420350a169761a68da626. Correctness: removing resolvePlatformAgentImage and the local -platform-agent preference is consistent with the de-bake path; local-build now always uses the plain per-runtime image, while Kind is still forwarded for the concierge config/identity overlay. Robustness: this preserves the previous fail-soft behavior because the old branch already fell back to the plain image when the variant was absent or probe failed, and the remaining WorkspaceKindPlatform sync test keeps the still-live kind invariant. Security: no fail-open path is introduced; management MCP delivery is no longer inferred from an image tag. Performance: removes an unnecessary docker tag probe on platform local-build starts. Readability: stale baked-image tests/comments are removed and the retained invariant has a focused test.

devops-engineer merged commit 8a56e7bc70 into main 2026-06-24 23:51:04 +00:00

hongming-ceo-delegated referenced this pull request 2026-06-25 01:41:15 +00:00

test(guardrails): G0 concierge prompt-filename SSOT guardrail + self-test (task #80) #3251

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

core-security

agent-reviewer-cr2

agent-researcher

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

5 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3247