molecule-ai/molecule-core
39
0
Fork 2
Code Issues 32 Pull Requests 5 Actions 11 Packages Projects Releases Wiki Activity

fix(workspace): update 3 assertions for OFFSEC-003 boundary wrapping (fixes #508) #512

Closed
core-devops wants to merge 1 commits from fix/508-update-boundary-assertions into main
pull from: fix/508-update-boundary-assertions
merge into: molecule-ai:main
Conversation 0 Commits 1 Files Changed 1 +15 -3
core-devops commented 2026-05-11 16:28:48 +00:00
Member
Copy Link

Summary

PR #477 added boundary wrapping to tool_delegate_task success path so the agent can distinguish trusted own output from untrusted peer-supplied content (OFFSEC-003). Three tests in test_delegation_sync_via_polling.py were still asserting exact plain-text returns from the patched mocks — both the legacy send_a2a_message path and the _delegate_sync_via_polling fallback path now return boundary-wrapped text.

Updated assertions:

  • test_flag_off_uses_send_a2a_message_not_polling
  • test_queued_sentinel_triggers_polling_fallback
  • test_non_queued_send_result_does_not_trigger_fallback

Test plan

  • pytest workspace/tests/test_delegation_sync_via_polling.py — 12/12 pass, 100% file coverage
  • CI: Python Lint & Test gate

Closes #508

🤖 Generated with Claude Code

## Summary PR #477 added boundary wrapping to tool_delegate_task success path so the agent can distinguish trusted own output from untrusted peer-supplied content (OFFSEC-003). Three tests in test_delegation_sync_via_polling.py were still asserting exact plain-text returns from the patched mocks — both the legacy send_a2a_message path and the _delegate_sync_via_polling fallback path now return boundary-wrapped text. Updated assertions: - test_flag_off_uses_send_a2a_message_not_polling - test_queued_sentinel_triggers_polling_fallback - test_non_queued_send_result_does_not_trigger_fallback ## Test plan - [x] pytest workspace/tests/test_delegation_sync_via_polling.py — 12/12 pass, 100% file coverage - [ ] CI: Python Lint & Test gate Closes #508 🤖 Generated with [Claude Code](https://claude.ai/code)
core-devops added 1 commit 2026-05-11 16:28:51 +00:00
test(workspace): update 3 assertions for OFFSEC-003 boundary wrapping (fixes #508)
Some checks failed
audit-force-merge / audit (pull_request) Has been skipped
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 13s
Details
CI / Python Lint & Test (pull_request) Failing after 6m57s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 13s
Details
sop-tier-check / tier-check (pull_request) Successful in 16s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 32s
Details
CI / Detect changes (pull_request) Successful in 35s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 34s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 36s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 2m13s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 35s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 7s
Details
CI / Platform (Go) (pull_request) Successful in 6s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 6s
Details
CI / Canvas (Next.js) (pull_request) Successful in 7s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 8s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 10s
Details
37a94ef6c3 
PR #477 added _A2A_BOUNDARY_START/END wrapping to tool_delegate_task's
success path. Three tests in test_delegation_sync_via_polling.py were
still asserting exact plain-text returns from the patched send_a2a_message
and _delegate_sync_via_polling mocks — both paths now return boundary-
wrapped text.

Updated assertions:
- test_flag_off_uses_send_a2a_message_not_polling: legacy ok
- test_queued_sentinel_triggers_polling_fallback: poll-mode response
- test_non_queued_send_result_does_not_trigger_fallback: normal reply

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
core-devops closed this pull request 2026-05-11 16:29:47 +00:00
Some checks are pending
audit-force-merge / audit (pull_request) Has been skipped
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 13s
Details
CI / Python Lint & Test (pull_request) Failing after 6m57s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 13s
Required
Details
sop-tier-check / tier-check (pull_request) Successful in 16s
Required
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 32s
Details
CI / Detect changes (pull_request) Successful in 35s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 34s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 36s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 2m13s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 35s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 7s
Details
CI / Platform (Go) (pull_request) Successful in 6s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 6s
Details
CI / Canvas (Next.js) (pull_request) Successful in 7s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 8s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 10s
Details
CI / all-required (pull_request)
Required

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
release-blocker

Blocks the staging→main promotion / a release

  
security

   
test-label-sre

   
tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  
tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  
tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

  
triage-test

test

No Label
release-blocker
security
test-label-sre
tier:high
tier:low
tier:medium
triage-test
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#512
No description provided.
Delete Branch "fix/508-update-boundary-assertions"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?