core-devops
b1da145611
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 12s
E2E Chat / detect-changes (pull_request) Successful in 12s
E2E API Smoke Test / detect-changes (pull_request) Successful in 18s
E2E Workspace Lifecycle (staginge2e) / E2E Workspace Lifecycle (staging) (pull_request) Has been skipped
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 14s
E2E Chat / E2E Chat (pull_request) Successful in 6s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 13s
E2E Workspace Lifecycle (staginge2e) / E2E Workspace Lifecycle (compile+skip) (pull_request) Successful in 22s
Harness Replays / detect-changes (pull_request) Successful in 10s
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 13s
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 7s
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (pull_request) Successful in 41s
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request) Has been skipped
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 25s
Check migration collisions / Migration version collision check (pull_request) Successful in 1m30s
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m24s
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 2m38s
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 2m27s
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 21s
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 55s
qa-review / approved (pull_request_target) Failing after 5s
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
security-review / approved (pull_request_target) Failing after 4s
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
sop-checklist / na-declarations (pull_request) N/A: (none)
sop-checklist / all-items-acked (pull_request_target) Successful in 4s
sop-checklist / review-refire (pull_request_target) Has been skipped
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 34s
gate-check-v3 / gate-check (pull_request_target) Successful in 31s
Harness Replays / Harness Replays (pull_request) Successful in 11s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m16s
E2E Staging External Runtime / E2E Staging External Runtime (pull_request) Successful in 6m21s
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 4m2s
Local Provision Lifecycle E2E / Local Provision Lifecycle E2E (stub) (pull_request) Failing after 4m18s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 5m20s
E2E Staging SaaS (full lifecycle) / E2E Staging Concierge user_tasks (pull_request) Has been skipped
E2E Staging SaaS (full lifecycle) / E2E Staging Concierge Creates Workspace (pull_request) Has been skipped
E2E Staging SaaS (full lifecycle) / E2E Staging Concierge Platform Agent (pull_request) Has been skipped
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 32s
E2E Staging SaaS (full lifecycle) / E2E Staging Concierge (compile+skip) (pull_request) Successful in 1m24s
Local Provision Lifecycle E2E / Local Provision Lifecycle E2E (real image + MiniMax LLM, advisory) (pull_request) Failing after 7m8s
E2E Staging SaaS (full lifecycle) / E2E Staging Platform Boot (pull_request) Failing after 6m18s
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Failing after 7m29s
CI / Detect changes (pull_request) Successful in 9s
CI / Python Lint & Test (pull_request) Successful in 9s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 21s
CI / Platform (Go) (pull_request) Successful in 4m2s
CI / Canvas (Next.js) (pull_request) Failing after 8m40s
CI / all-required (pull_request) Has been skipped
CI / Canvas Deploy Status (pull_request) Has been skipped
Independent security review of #2385 found a privilege-escalation path: POST /registry/register is bootstrap-allowed for a fresh workspace id and wrote the caller-supplied kind, while workspaces_platform_root_check only enforces 'platform => parent_id IS NULL' (NOT a single root). So an ordinary in-VPC workspace could register a fresh UUID as {"kind":"platform"}, mint a second org root, and POST /workspaces/:id/restart it — the shared provision path then injects MOLECULE_API_KEY=ADMIN_TOKEN (tenant-wide org-admin credential) into any kind='platform' workspace, on self-host AND SaaS. That breaks the invariant that only the concierge gets the org MCP + admin token. Defense in depth: - migration 20260607000000_one_platform_root: partial UNIQUE index (kind) WHERE kind='platform' — at most one platform root per (single-org) tenant DB. isPlatformRootViolation now also maps the 23505 to a friendly 409. - registry.go Register: app-layer guard refusing to CREATE or PROMOTE a row to kind='platform' via the public path (reserve that for the AdminAuth/boot-gated install paths); a platform agent re-registering its already-platform row is unaffected. Placed after the token check to avoid side-channeling row existence. - corrected the false 'CHECK structurally guarantees one per org' claims in the 20260606 migration + integration-test header. Tests: - registry_test.go: rejects fresh kind=platform (403), rejects workspace->platform promotion (403), allows already-platform re-register (200). - kind_platform_root_integration_test.go: real-PG test that a SECOND platform root is rejected by the unique index (the CHECK alone accepts it). - canvas-topology-pure.test.ts: cover stripPlatformRootForMap (QA HIGH gap) — abs-position reparent math, platform-edge drop, grandchild preservation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>