core-devops 03cee314ba chore(workspace-server): drop dead runtime_image_pins migration (closes #335, supersedes #1608) ...

Empirical finding (a6e3ff018, 2026-05-20): molecule-core's
runtime_image_pins table (mig 047) has never had a writer in any repo.
The reader at handlers/runtime_image_pin.go has been hitting
sql.ErrNoRows on every workspace provision since mig 047 landed,
silently falling through to the :latest path. CP's parallel table
(CP mig 027) is the de-facto and only SSOT — it has the writer
(POST /cp/admin/runtime-image/promote), the reader, the hard-gate
(RFC internal#541 Step 2), seeded post-suspension digests (CP mig 028),
and the admin endpoints.

This PR ratifies that reality.

Note: this is a fresh rebase against current main (tip f17375a9).
PR #1608 was cut from a base before #1585 (RFC#596 Phase 2 dual-push)
landed, so merging it would silently revert the publish-runtime.yml
Gitea-PyPI-primary path. Sub-agent a5521785 flagged this on PR #1608
comment 41389. The substantive Go logic is identical to PR #1608;
the only difference is the base.

What

- Add 20260520120000_drop_runtime_image_pins.up.sql / .down.sql to drop
  the unused table. Care zone PRESERVED: workspaces.runtime_image_digest
  column + its partial index untouched (earmarked for a future
  stale-workspace panel per RFC internal#617 §3).
- Delete handlers/runtime_image_pin.go (the dead reader) +
  handlers/runtime_image_pin_test.go.
- handlers/workspace_provision.go: replace
  resolveRuntimeImage(ctx, payload.Runtime) with Image: "" (the dead
  reader was already returning "" on every call). Rewire the
  surviving db.DB.QueryRow on this call site to QueryRowContext so
  the provision-timeout ctx stays load-bearing.
- Doc comments in provisioner/provisioner.go + provisioner/registry.go
  updated to point at CP as the SSOT instead of the dead local table.
- Add db/migration_20260520_drop_runtime_image_pins_test.go — static-
  file pin that up.sql DROPs runtime_image_pins, does NOT touch the
  care-zone column / index, and that the dead reader files cannot be
  re-added without failing the test.
- Hygiene: prune the now-stranded
  mock.ExpectQuery("SELECT digest FROM runtime_image_pins") rows in
  handlers/handlers_test.go and handlers/workspace_provision_test.go
  (the dead reader is gone, so the mock expectation can never fire).
  Provisioner test comment updated to reflect CP-as-SSOT.

Why

Two parallel-named tables with structurally incompatible schemas, only
one ever written — that is exactly the kind of internal drift
feedback_no_single_source_of_truth was written about for non-vendor
surfaces. The deletion is reversible (down.sql recreates the table)
and the only behavior change is "ctx is now propagated into the
workspace_dir DB lookup", which is a small correctness nudge.

Verification

- [x] go vet ./internal/handlers/... ./internal/db/... ./internal/provisioner/...  — clean
- [x] go build ./...  — clean
- [x] go test ./internal/handlers/ ./internal/db/ ./internal/provisioner/  — all pass (16.5s + 0.2s + 0.3s)
- [x] New regression tests assert the care-zone column is not touched + the dead reader cannot return
- [x] Empirical grep cross-check: no writer for runtime_image_pins in molecule-core; no reader for workspaces.runtime_image_digest anywhere (both confirmed in RFC internal#617 §1 + §3)
- [x] Verified clean rebase: branch parent is current main tip (f17375a9), NOT pre-#1585 stale base. Diff vs main contains ONLY the migration-drop work — no .gitea/workflows/publish-runtime.yml regression.

Tier

tier:medium + area:schema — schema/migration change. Reversible by
re-running the down-migration. Two-eye review reviewers: core-be
(read path / Go) + core-qa (migration correctness). Cascade plan to
~6 live tenant DBs per RFC internal#617 §7 +
feedback_image_promote_is_not_user_live (verify on at least 2
tenants post-deploy).

Memory consulted: feedback_no_single_source_of_truth,
feedback_image_promote_is_not_user_live,
feedback_verify_actual_endstate_not_ack_follow_sop,
reference_package_distribution_open_ecosystem_dual_push.

RFC: molecule-ai/internal#617
Supersedes: #1608

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-20 05:30:35 -07:00

..

cmd

feat(provisioner): uniform T4 privilege contract + YAML emitter

2026-05-18 14:38:58 -07:00

internal

chore(workspace-server): drop dead runtime_image_pins migration (closes #335, supersedes #1608)

2026-05-20 05:30:35 -07:00

migrations

chore(workspace-server): drop dead runtime_image_pins migration (closes #335, supersedes #1608)

2026-05-20 05:30:35 -07:00

pkg/provisionhook

feat(#1957): wire gh-identity plugin into workspace-server

2026-04-24 15:01:41 +00:00

.air.toml

feat(local-dev): air-based hot-reload for workspace-server

2026-05-08 08:10:50 -07:00

.ci-force

chore: force Platform(Go) CI run on main — validate go vet clean

2026-04-21 15:43:19 +00:00

.gitignore

feat(local-dev): containerize platform + canvas stack via docker-compose (closes #126)

2026-05-08 10:53:39 -07:00

.golangci.yaml

chore(workspace-server): add golangci.yaml disabling errcheck

2026-04-24 07:16:54 +00:00

Dockerfile

build(ws-server): add -trimpath -ldflags="-s -w" for smaller image (RFC#563)

2026-05-19 12:03:21 -07:00

Dockerfile.dev

ci(docker): pin base image digests in all Dockerfiles

2026-05-09 23:56:39 +00:00

Dockerfile.tenant

build(ws-server): add -trimpath -ldflags="-s -w" for smaller image (RFC#563)

2026-05-19 12:03:21 -07:00

entrypoint-tenant.sh

fix(memory-plugin): gate sidecar spawn on cutover-active

2026-05-05 12:39:03 -07:00

go.mod

fix(handlers): synchronize async DB users in race tests

2026-05-14 09:37:52 -07:00

go.sum

[core-lead-agent] fix(core#228): cascade fixes for PluginResolver — make main compile

2026-05-10 09:46:35 +00:00