Molecule AI Dev Engineer B (MiniMax) 3029dbc7c5 feat(provisioner): #2843 #24 PR-B — fetcher selection (real Gitea for SaaS, no-op for self-host) + public-fetch wire ...

PR-B keystone (RFC #2843 #24) — the substantive REMOVE-SM ARCH
change that gates on RFC #2843's CTO sign-off (7d508035, STILL
PENDING). Per the dispatch: this PR builds + gets driver-review +
HOLDS on the 7d508035 gate (same as #2852); I will NOT route a
2nd-genuine reviewer until sign-off.

This commit ships the CRITICAL selection scaffolding (the wire
that the public-fetch activation #2900 + the cap fix #2845
plus this PR's removal-of-SM-as-config-transport all stack on):

CHANGES
=======

1. workspace-server/internal/provisioner/template_assets.go
   - NEW: noopTemplateAssetFetcher type — self-host default.
     Load() returns (nil, nil) — "no assets to add" — so the
     call site in collectCPConfigFiles treats self-host as the
     "no external asset channel" case (cfg.TemplatePath +
     cfg.ConfigFiles handle /configs locally).
   - NEW: NoopTemplateAssetFetcher() constructor — exported so
     main.go can wire it via the selection helper.
   - NEW: FetcherSelection struct — the selection result
     (Fetcher, Authenticated, Mode) returned by the selection
     helper.
   - NEW: SelectTemplateAssetFetcher(isSaaSTenant, baseURL, token) —
     the selection matrix:
       * isSaaSTenant() && token != ""  -> real Gitea, Authenticated=true
       * isSaaSTenant() && token == ""  -> real Gitea, Authenticated=false
         (the public-fetch activation: molecule-ai/* PUBLIC templates)
       - !isSaaSTenant()                 -> no-op fetcher, Authenticated=false
         (self-host: cfg.TemplatePath + cfg.ConfigFiles handle locally)
     The isSaaSTenant func is plumbed in as an argument (not
     package-level lookup) so the selection is testable in
     isolation.

2. workspace-server/cmd/server/main.go
   - NEW: isSaaSDeployment() helper — mirrors handlers.saasMode
     but is in the main package (handlers is unexported; main
     is a separate package). Resolution: MOLECULE_DEPLOY_MODE
     first, MOLECULE_ORG_ID fallback (same as handlers.saasMode).
   - REPLACED the env-var-gated wiring
     (`if token != "" { SetGiteaTemplateFetcher(...) } else { disabled }`)
     with the new selection-helper call:
       sel := provisioner.SelectTemplateAssetFetcher(isSaaSDeployment, baseURL, token)
       wh.SetGiteaTemplateFetcher(sel.Fetcher)
     The log line is now driven by sel.Mode + sel.Authenticated
     (3 explicit modes: "self-host-noop", SaaS-with-token,
     SaaS-without-token). The fetcher is wired on EVERY boot
     (no-token case = public-fetch, not disabled).

3. workspace-server/internal/provisioner/template_assets_test.go
   - NEW: TestSelectTemplateAssetFetcher_SaaS_GiteaFetcher:
     with-token and without-token (public-fetch) SaaS cases
   - NEW: TestSelectTemplateAssetFetcher_SelfHost_NoopFetcher:
     self-host selection, plus Load() returns (nil, nil)
   - NEW: TestSelectTemplateAssetFetcher_NilSaaSCheck_FallsBackToNoop:
     nil isSaaSTenant closure safely falls back to no-op

VERIFICATION
============

  - go build ./...  -- clean
  - go vet ./cmd/server/ ./internal/provisioner/  -- clean
  - gofmt -l  -- clean (all 3 files)
  - go test ./internal/provisioner/  -- 0.141s, all green
  - go test ./internal/handlers/  -- 26.1s, all green (no regression)
  - 3 new selection tests pass

DEFERRED (CP-side or follow-up PRs)
====================================

The user's PR-B scope included 3 more pieces that are NOT in
this commit because they depend on out-of-this-repo or
defer-until-CTO-signoff surfaces:

(a) "writes assets to /configs (writeFileViaEIC + copyFilesToContainer)":
    - LOCAL Docker path (provisioner.go WriteFilesToContainer for
      ConfigFiles): needs a sibling WriteTemplateAssetsToContainer
      helper. The current code does NOT write TemplateAssets to
      /configs on the local path (only the SaaS wire field is
      populated). DEFERRED to a follow-up PR that integrates
      TemplateAssets into the local Start() flow.
    - HANDLER SaaS path (writeFileViaEIC): the templates handler
      already has the writer, but the actual /configs write on
      SaaS happens in the CONTROLPLANE (molecule-controlplane, a
      separate repo). The wire field TemplateAssets on
      cpProvisionRequest is the molecule-core side of the contract.
      The CP-side change is owned by the controlplane team.
    - PR-B's contribution on the molecule-core side: set up the
      selection + wire field. The CP-side handler is a controlplane
      follow-up.

(b) "REMOVES Secrets-Manager as the config/asset transport":
    - The substantive change happens in the controlplane: the CP
      currently stages ConfigFiles through AWS Secrets Manager (with
      the 256 KiB cap). The PR-B intent is: assets that came from
      the fetcher (TemplateAssets) should NOT be staged through SM
      (use a non-secret channel: S3 non-secret bucket, Gitea asset
      pin, etc.). The controlplane owns the SM removal; this repo's
      contribution is the wire field + the selection that lets
      the CP route assets differently.
    - The 7d508035 CTO sign-off gates the SM-removal specifically.
      Per the dispatch, PR-B cannot merge until 7d508035 lands.
      Driver will personally review the SM-removal once the CP
      change is in.

(c) "Infisical read-only template-repo token (env/secret-projection)":
    - The current code uses MOLECULE_TEMPLATE_REPO_TOKEN env var
      (main.go:694 templateRepoToken()). This IS the env-projection
      point — the env var is set by the operator's Infisical
      bootstrap (the same pattern as GIT_HTTP_PASSWORD). The
      pattern is already in place; no code change needed.
    - Out-of-scope to add explicit Infisical SDK integration
      (operator-side concern, not a molecule-core change).

(d) "fetcher selection: real Gitea for SaaS, no-op for self-host":
    - THIS COMMIT. No-op fetcher type + selection helper +
      main.go wiring + 3 tests. Done.

(e) e2e tests (the user mentioned driver owns e2e verification):
    - Driver's verification per the dispatch is the 716 KB seo-all
      on /configs sanity check. That's the driver's e2e lane.
    - Unit tests in this repo: 3 selection tests + 7 fetcher
      tests (gitea_template_assets_test.go) + 2 cap tests
      (template_assets_test.go) + the existing TestWorkspaceCreate
      + TestWorkspaceUpdate + the rest of the handlers suite
      (26.1s all green). I added what the molecule-core unit
      surface can pin; the e2e lane is the driver's.

MERGE-GATE
============

This PR is the substantive REMOVE-SM ARCH change which is exactly
what RFC #2843's CTO sign-off (7d508035, STILL PENDING) gates.
Per the dispatch: open it for the driver's personal review, but
it MUST NOT MERGE until 7d508035 lands.

Routing: I am NOT requesting a 2nd-genuine reviewer until sign-off.
The driver will personally review. Same posture as #2852 (closed
post-driver-decision, branch preserved, work held on gate).

netrc/GITEA env-var auth -- no inline tokens.

2026-06-15 01:25:24 +00:00

..

e2e-names

fix(provisioner): SSOT workspace volume naming + e2e-names CLI (SEV-2499 follow-up)

2026-06-10 15:38:35 +00:00

gen-providers

feat(providers): P2-A internal#718 — bring the provider registry to molecule-core via codegen + verify-CI (additive, zero behavior change)

2026-05-27 17:10:12 -07:00

memory-backfill

chore(go-module): #1760 rename Go module to git.moleculesai.app/molecule-ai/molecule-core/workspace-server (#1816)

2026-05-24 23:37:18 +00:00

memory-plugin-postgres

chore(go-module): #1760 rename Go module to git.moleculesai.app/molecule-ai/molecule-core/workspace-server (#1816)

2026-05-24 23:37:18 +00:00

server

feat(provisioner): #2843 #24 PR-B — fetcher selection (real Gitea for SaaS, no-op for self-host) + public-fetch wire

2026-06-15 01:25:24 +00:00

t4-contract-dump

chore(go-module): #1760 rename Go module to git.moleculesai.app/molecule-ai/molecule-core/workspace-server (#1816)

2026-05-24 23:37:18 +00:00