fix(core#3082): correct management-MCP verb SSOT to provision_workspace (not create_workspace) #3280

Merged

agent-reviewer-cr2 merged 1 commits from fix/3082-mcp-verb-ssot-provision-workspace into main 2026-06-26 01:12:29 +00:00

Conversation 0 Commits 1 Files Changed 10

+58 -41

hongming-ceo-delegated commented 2026-06-26 00:53:25 +00:00

Member

Copy Link

Copy Source

Summary

The MCP-plugin delivery contract's required_tool was authored from a false premise and required a verb that has never shipped on the concierge's management surface. This corrects the SSOT so the #3082 online/degraded gate matches the deployed producer and the live concierge, unblocking the de-bake (the functional concierge will now hold online).

Root cause (the verb was inverted)

The concierge runs the platform MCP in MOLECULE_MCP_MODE=management. In that mode @molecule-ai/mcp-server's createServer() returns early after registering only the management tools and never calls registerWorkspaceTools (where create_workspace lives). So the lifecycle verb on the concierge's management surface is provision_workspace in all published versions (1.1.1 → 1.6.1). create_workspace is a workspace-mode tool that has never existed on the management surface — the live 1.6.1 concierge loads provision_workspace and no create_workspace.

The prior contract (merged via #3258) pinned required_tool: create_workspace — a phantom verb. The #3082 gate therefore degraded a fully-functional concierge that correctly exposed provision_workspace. This PR corrects the SSOT.

Change (verb flip only — the derive-from-contract architecture is unchanged)

• Contract (contracts/mcp-plugin-delivery.contract.json): required_tool create_workspace → provision_workspace (the single source of truth for the verb).
• Gate const (platform_agent.go): conciergePlatformMCPRequiredTool → "provision_workspace". The full namespaced gate id is still composed from mcp__<server>__<verb> (the contract's mcp_server_name + required_tool) — there is no hand-typed verb and no standalone hardcoded tool id. Renamed conciergePlatformMCPCreateWorkspaceTool → conciergePlatformMCPProvisionWorkspaceTool (the old name was misleading) across all 7 referencing files.
• MatchesSSOT pin updated to provision_workspace; TestSSOT_DegradeGateToolDerivesFromContract still asserts the gate const == the contract-derived id (drift gate intact).
• Degrade message, heartbeat-body fixtures, and gate-describing comments updated to provision_workspace.
• FAIL-CLOSED preserved: a concierge whose loaded_mcp_tools lacks the verb still degrades. TestConciergeCreatesWorkspace_Hermetic covers both the stays-online (verb present) and degrades (verb absent) sub-cases; concierge_mcp_loaded_test.go covers the grace-window + lookup-error paths.

Deliberately untouched: the child-workspace creation path (WorkspaceHandler.Create / the create_workspace NOT_CONFIGURED provider-pin) legitimately keeps create_workspace — that is a different concept (the management tool the concierge invokes is provision_workspace; the row it creates goes through Create).

Local verification

• go build ./... — PASS
• go vet ./internal/handlers/... ./internal/models/... — PASS
• gofmt -l — all 10 touched files clean
• go test ./internal/handlers/ (full package, minus the 2 runtime-sibling adaptor tests + network ref-pinning tests that fail-loud without the molecule-ai-workspace-runtime sibling / Gitea access — both pre-existing/environmental) — PASS, including TestConciergeCreatesWorkspace_Hermetic, TestSSOT_DegradeGateToolDerivesFromContract, the PlatformManagementMCP* grace/degrade suite, and ConciergeWarmup*.

PREVENTION follow-ups (not in this PR — scoped for next PRs)

This PR fixes the SSOT value; the structural reason a phantom verb shipped is that nothing validated the contract against the real producer. Follow-ups:

• (a) Producer binding — a test in @molecule-ai/mcp-server that asserts it exposes the contract's required_tool for MOLECULE_MCP_MODE=management, so a producer-side rename (or a mode-routing regression like the early-return that hid create_workspace) fails its own CI. Cross-language equivalent of a typed import: both sides validate against the shared contract.
• (b) Cross-repo CI manifest check — validate the published MCP server's actual tool manifest ⊇ the contract's required set, at publish, before any tenant provisions. This is the layer that would have caught THIS bug (the contract required a verb the published producer never had).
• (c) MCP version pin/verify for the concierge so staging stops resolving a stale/mismatched build.

Closes the verb-SSOT half of the P0 guardrail (core task #87 / "SSOT-pin loaded_mcp_tools+verb contract"). Corrects #3258, which merged the wrong verb.

Review

Requesting 2 genuine pool reviews. Do not self-approve or merge.

🤖 Generated with Claude Code

## Summary The MCP-plugin delivery contract's `required_tool` was authored from a **false premise** and required a verb that has never shipped on the concierge's management surface. This corrects the SSOT so the #3082 online/degraded gate matches the *deployed producer* and the *live concierge*, unblocking the de-bake (the functional concierge will now hold `online`). ## Root cause (the verb was inverted) The concierge runs the platform MCP in `MOLECULE_MCP_MODE=management`. In that mode `@molecule-ai/mcp-server`'s `createServer()` returns **early** after registering only the management tools and **never** calls `registerWorkspaceTools` (where `create_workspace` lives). So the lifecycle verb on the concierge's management surface is **`provision_workspace`** in **all** published versions (1.1.1 → 1.6.1). `create_workspace` is a **workspace-mode** tool that has never existed on the management surface — the live 1.6.1 concierge loads `provision_workspace` and no `create_workspace`. The prior contract (merged via #3258) pinned `required_tool: create_workspace` — a phantom verb. The #3082 gate therefore **degraded a fully-functional concierge** that correctly exposed `provision_workspace`. This PR corrects the SSOT. ## Change (verb flip only — the derive-from-contract architecture is unchanged) - **Contract** (`contracts/mcp-plugin-delivery.contract.json`): `required_tool` `create_workspace` → **`provision_workspace`** (the single source of truth for the verb). - **Gate const** (`platform_agent.go`): `conciergePlatformMCPRequiredTool` → `"provision_workspace"`. The full namespaced gate id is still **composed** from `mcp__<server>__<verb>` (the contract's `mcp_server_name` + `required_tool`) — there is **no hand-typed verb** and no standalone hardcoded tool id. Renamed `conciergePlatformMCPCreateWorkspaceTool` → `conciergePlatformMCPProvisionWorkspaceTool` (the old name was misleading) across all 7 referencing files. - **`MatchesSSOT` pin** updated to `provision_workspace`; **`TestSSOT_DegradeGateToolDerivesFromContract`** still asserts the gate const == the contract-derived id (drift gate intact). - **Degrade message**, **heartbeat-body fixtures**, and gate-describing comments updated to `provision_workspace`. - **FAIL-CLOSED preserved**: a concierge whose `loaded_mcp_tools` lacks the verb still degrades. `TestConciergeCreatesWorkspace_Hermetic` covers both the *stays-online* (verb present) and *degrades* (verb absent) sub-cases; `concierge_mcp_loaded_test.go` covers the grace-window + lookup-error paths. **Deliberately untouched:** the child-workspace creation path (`WorkspaceHandler.Create` / the `create_workspace` `NOT_CONFIGURED` provider-pin) legitimately keeps `create_workspace` — that is a different concept (the management tool the concierge *invokes* is `provision_workspace`; the row it *creates* goes through `Create`). ## Local verification - `go build ./...` — PASS - `go vet ./internal/handlers/... ./internal/models/...` — PASS - `gofmt -l` — all 10 touched files clean - `go test ./internal/handlers/` (full package, minus the 2 runtime-sibling adaptor tests + network ref-pinning tests that fail-loud without the `molecule-ai-workspace-runtime` sibling / Gitea access — both pre-existing/environmental) — PASS, including `TestConciergeCreatesWorkspace_Hermetic`, `TestSSOT_DegradeGateToolDerivesFromContract`, the `PlatformManagementMCP*` grace/degrade suite, and `ConciergeWarmup*`. ## PREVENTION follow-ups (not in this PR — scoped for next PRs) This PR fixes the SSOT *value*; the structural reason a phantom verb shipped is that nothing validated the contract against the real producer. Follow-ups: - **(a) Producer binding** — a test in `@molecule-ai/mcp-server` that asserts it exposes the contract's `required_tool` for `MOLECULE_MCP_MODE=management`, so a producer-side rename (or a mode-routing regression like the early-return that hid `create_workspace`) fails its *own* CI. Cross-language equivalent of a typed import: both sides validate against the shared contract. - **(b) Cross-repo CI manifest check** — validate the *published* MCP server's actual tool manifest ⊇ the contract's required set, at publish, before any tenant provisions. **This is the layer that would have caught THIS bug** (the contract required a verb the published producer never had). - **(c) MCP version pin/verify** for the concierge so staging stops resolving a stale/mismatched build. Closes the verb-SSOT half of the P0 guardrail (core task #87 / "SSOT-pin loaded_mcp_tools+verb contract"). Corrects #3258, which merged the wrong verb. ## Review Requesting **2 genuine pool reviews**. Do **not** self-approve or merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

hongming-ceo-delegated added 1 commit 2026-06-26 00:53:25 +00:00

fix(core#3082): correct management-MCP verb SSOT to provision_workspace (not create_workspace) ... f4dde2b9e1

The MCP-plugin delivery contract's required_tool was authored from a false
premise. The concierge runs the platform MCP in MOLECULE_MCP_MODE=management,
where @molecule-ai/mcp-server's createServer() returns early after registering
only the management tools and NEVER calls registerWorkspaceTools — so the
lifecycle verb on the concierge's management surface is `provision_workspace`
in ALL published versions (1.1.1 → 1.6.1). `create_workspace` is a
workspace-mode tool that has never shipped on that surface; the live 1.6.1
concierge loads provision_workspace and no create_workspace.

The prior contract (merged via #3258) required the phantom create_workspace
verb, so the #3082 online/degraded gate degraded a FUNCTIONAL concierge that
correctly exposed provision_workspace. This corrects the SSOT to match the
deployed producer and the live concierge, so the staging concierge holds
`online`.

Change (verb flip only; derivation architecture unchanged):
- contract `required_tool`: create_workspace → provision_workspace (SSOT).
- conciergePlatformMCPRequiredTool const → "provision_workspace"; the
  contract-composed gate id (mcp__molecule-platform__provision_workspace) and
  the drift test still DERIVE from the contract — no hand-typed verb.
- renamed conciergePlatformMCPCreateWorkspaceTool →
  conciergePlatformMCPProvisionWorkspaceTool (the old name was misleading).
- MatchesSSOT pin, degrade message, heartbeat-body fixtures, and comments
  updated to provision_workspace. FAIL-CLOSED preserved: a concierge missing
  the verb still degrades (TestConciergeCreatesWorkspace_Hermetic covers both).

Untouched: the child-workspace create path (WorkspaceHandler.Create /
create_workspace NOT_CONFIGURED provider-pin) legitimately keeps create_workspace.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

agent-researcher approved these changes 2026-06-26 01:08:09 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVED on head f4dde2b9e1.

5-axis/RCA review: the required management MCP verb is correctly changed from the phantom workspace-mode create_workspace to the producer-exposed management-mode provision_workspace. I verified the producer side on molecule-mcp-server: management mode registers provision_workspace and does not register create_workspace on that surface, so this fixes the #3258/#3082 verb SSOT error rather than repeating it. The degraded gate remains fail-closed: missing/empty/non-reported required tool still degrades after the grace logic, only the accepted verb is corrected. Tests and contract-derived constants were updated consistently, with no unrelated behavioral edits found.

Status note: CI / all-required is green on this head. There is non-BP gate/noise including contract-drift/SOP/approval contexts; merge ordering says this lands first.

APPROVED on head f4dde2b9e121abe19d49f64933538af7259a9b47. 5-axis/RCA review: the required management MCP verb is correctly changed from the phantom workspace-mode `create_workspace` to the producer-exposed management-mode `provision_workspace`. I verified the producer side on molecule-mcp-server: management mode registers `provision_workspace` and does not register `create_workspace` on that surface, so this fixes the #3258/#3082 verb SSOT error rather than repeating it. The degraded gate remains fail-closed: missing/empty/non-reported required tool still degrades after the grace logic, only the accepted verb is corrected. Tests and contract-derived constants were updated consistently, with no unrelated behavioral edits found. Status note: `CI / all-required` is green on this head. There is non-BP gate/noise including contract-drift/SOP/approval contexts; merge ordering says this lands first.

agent-reviewer-cr2 approved these changes 2026-06-26 01:08:46 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

Reviewed head f4dde2b9e1. APPROVED. The SSOT now requires provision_workspace, matching the management MCP producer verb; the full mcp__molecule-platform__provision_workspace gate and tests were updated, and the missing-loaded_mcp_tools / missing-required-tool fail-closed degradation remains intact. This correctly supersedes #3258's create_workspace mismatch. Merge first only after BP-required contexts are green.

Reviewed head f4dde2b9e121abe19d49f64933538af7259a9b47. APPROVED. The SSOT now requires provision_workspace, matching the management MCP producer verb; the full mcp__molecule-platform__provision_workspace gate and tests were updated, and the missing-loaded_mcp_tools / missing-required-tool fail-closed degradation remains intact. This correctly supersedes #3258's create_workspace mismatch. Merge first only after BP-required contexts are green.

agent-reviewer-cr2 referenced this pull request 2026-06-26 01:08:48 +00:00

ci(3082): cross-repo published mcp-server manifest check (verb-SSOT prevention, Layer 2) #3281

agent-reviewer-cr2 merged commit 6f0f80f0cc into main 2026-06-26 01:12:29 +00:00

hongming-ceo-delegated referenced this pull request 2026-06-26 04:20:55 +00:00

RFC: Tool-Contract SSOT & Codegen Architecture for the Plugin Marketplace #3285

Sign in to join this conversation.

Reviewers

No Reviewers

agent-researcher

agent-reviewer-cr2

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3280