fix(ci): broaden path filters to match all workflow files and CI scripts

PR #10 fixed the `.github/` → `.gitea/` rename, but the path filters
still listed individual workflow files. Any future workflow addition
(like `sop-checklist-gate.yml` in PR #8) silently bypasses CI
because neither `ci.yml` nor `release.yml` matches the path filter.

Fix: use `.gitea/workflows/*.yml` and `.gitea/workflows/*.yaml` glob
patterns in both ci.yml and release.yml, plus explicit coverage of
`.gitea/scripts/**` and `.gitea/sop-checklist-config.*` so changes
to CI scripts and config also run Go tests.

Cross-repo equivalent of:
  molecule-core #345, molecule-mcp-server #9

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.ci-auth-test-1778443313.txt

@@ -0,0 +1 @@
+ci-auth-test-1778443313

.ci-auth-test2-1778443456.txt

@@ -0,0 +1 @@
+ci-auth-test2-1778443456

.gitea/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI / Test
+
+# Runs on every PR touching Go code, and on every push to main.
+# Mirrors the test job from release.yml so PRs are validated independently
+# of the release workflow. Uses Go 1.25 to match release.yml.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.gitea/workflows/*.yml'
+      - '.gitea/workflows/*.yaml'
+      - '.gitea/scripts/**'
+      - '.gitea/sop-checklist-config.yml'
+      - '.gitea/sop-checklist-config.yaml'
+  pull_request:
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.gitea/workflows/*.yml'
+      - '.gitea/workflows/*.yaml'
+      - '.gitea/scripts/**'
+      - '.gitea/sop-checklist-config.yml'
+      - '.gitea/sop-checklist-config.yaml'
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache: true
+      - name: Tidy
+        run: go mod tidy && git diff --exit-code go.sum
+      - name: Vet
+        run: go vet ./...
+      - name: Test
+        run: go test -race -count=1 ./...

.gitea/workflows/release.yml

@@ -19,7 +19,11 @@ on:
       - '**.go'
       - 'go.mod'
       - 'go.sum'
-      - '.github/workflows/release.yml'
+      - '.gitea/workflows/*.yml'
+      - '.gitea/workflows/*.yaml'
+      - '.gitea/scripts/**'
+      - '.gitea/sop-checklist-config.yml'
+      - '.gitea/sop-checklist-config.yaml'
       - '.goreleaser.yaml'
 
 permissions:

.verify-fix-1778444420.txt

@@ -0,0 +1 @@
+verify-fix-1778444420

CLAUDE.md

@@ -4,7 +4,7 @@ Go CLI for the Molecule AI agent platform. Wraps the platform's workspace runtim
 
 **Users:** Platform operators and developers integrating with the Molecule AI platform.
 
-**Repo state (2026-04-16):** Thin/stub. Go module is initialized; core CLI commands are not yet implemented. CI (Go binary release via GoReleaser + GitHub Actions) is wired up.
+**Repo state:** Core commands implemented. 32 integration tests in `cmd/molecule/molecule_test.go`.
 
 ---
 
@@ -23,18 +23,16 @@ This CLI is the primary user-facing tool for interacting with the Molecule AI pl
 # Build the binary to ./bin/molecule (or $GOBIN/molecule)
 go build -o bin/molecule ./cmd/molecule
 
-# Run tests (none yet; add as commands are implemented)
+# Run tests — uses httptest.Server fixtures, no live platform required
 go test ./...
 
 # Run the CLI locally (requires platform env vars — see Section 5)
 ./bin/molecule --help
 ```
 
-There is no `main.go` or `cmd/molecule/main.go` yet. Creating it is the first implementation task. The module path will be auto-detected from `go.mod`.
-
 ## 3. Go Module Conventions
 
-**Module path:** `github.com/Molecule-AI/molecule-cli` (from `go.mod`)
+**Module path:** `go.moleculesai.app/cli` (from `go.mod`)
 
 **Dependency management:**
 - Use `go mod tidy` after adding or removing dependencies.
@@ -131,8 +129,8 @@ See `known-issues.md` at the repo root for the full tracked list.
 - [x] Control plane API client (initialized with `MOLECULE_API_URL`)
 - [ ] Workspace runtime client (for dev/proxy mode)
 - [ ] Configuration file (e.g., `~/.config/molecule/cli.yaml`) — workspace template per platform rules
-- [ ] Unit tests for core command logic
-- [ ] `molecule init` (bootstrap local workspace config)
+- [x] Unit tests for core command logic (32 integration tests)
+- [x] `molecule init` (bootstrap local workspace config)
 
 **Platform constraint reminders (from `constraints-and-rules.md`):**
 - Postgres is the source of truth. CLI commands that mutate state ultimately write to Postgres via the control plane.

README.md

@@ -8,12 +8,23 @@ command, or a mock for CI).
 ## Install
 
 ```bash
-go install github.com/Molecule-AI/molecule-cli/cmd/molecule@latest
+go install go.moleculesai.app/cli/cmd/molecule@latest
 ```
 
-Or download a binary from [Releases](https://github.com/Molecule-AI/molecule-cli/releases).
-Releases ship Linux/macOS/Windows × amd64/arm64 archives plus a sha256
-checksums file (see `.goreleaser.yaml`).
+The vanity import path `go.moleculesai.app/cli` resolves via the
+Molecules AI go-get responder (issue [internal#71][i71]) to our
+canonical SCM at git.moleculesai.app. It is independent of any specific
+SCM host — when we move SCMs again, no install command changes.
+
+Alternatively, build from source:
+
+```bash
+git clone https://git.moleculesai.app/molecule-ai/molecule-cli.git
+cd molecule-cli
+go build -o molecule ./cmd/molecule
+```
+
+[i71]: https://git.moleculesai.app/molecule-ai/internal/issues/71
 
 ## Quick start — connect an external workspace
 
@@ -59,7 +70,7 @@ molecule connect ws_abc \
 ### Other useful flags
 
 ```
---mode poll|push         delivery mode (default: poll; push is M4, not yet implemented)
+--mode poll|push         delivery mode (default: poll)
 --interval-ms 2000       poll cadence
 --since-secs 60          initial activity cursor lookback
 --token TOKEN            override MOLECULE_WORKSPACE_TOKEN
@@ -70,159 +81,15 @@ State (the activity cursor) is persisted to
 `~/.config/molecule/state/<workspace-id>.json` (mode 0600) so a restart
 resumes from the last delivered message.
 
-> Note: poll-mode dispatch into backends works end-to-end. Posting the
-> backend's reply back to the canvas-origin sender is still wired as a
-> TODO (see `internal/connect/connect.go` — M1.3); platform-API replies
-> for non-canvas A2A flow correctly.
-
-## Command reference
-
-The full top-level tree:
+## Other subcommands
 
 ```
-molecule
-├── workspace    list / create / inspect / delete / restart / audit / delegate
-├── agent        list / inspect / send / peers
-├── platform     audit / health
-├── config       list / get / set / init / view
-├── connect      bridge an external workspace to a local backend
-├── init         scaffold a molecule.yaml in the current directory
-└── completion   emit shell completion script (bash | zsh | fish | powershell)
+molecule agent      list / inspect agent sessions
+molecule config     view / set CLI defaults
+molecule completion generate shell completions
 ```
 
-Global flags (apply to every subcommand): `--api-url`, `--config`,
-`-o/--output table|json|yaml`, `-v/--verbose`.
-
-### `molecule workspace`
-
-Manage Molecule AI workspaces.
-
-- **`workspace list`** — list all workspaces in the org.
-  ```bash
-  molecule workspace list
-  molecule workspace list -o json
-  ```
-- **`workspace create --name <name> [flags]`** — create a workspace.
-  Flags: `--role`, `--runtime`, `--template`, `--parent-id`,
-  `--workspace-dir`, `--tier`.
-  ```bash
-  molecule workspace create --name pm-bot --role pm --runtime claude-code
-  ```
-- **`workspace inspect <workspace-id>`** — show full details for a workspace.
-  ```bash
-  molecule workspace inspect ws_01HF2K...
-  ```
-- **`workspace delete <workspace-id>`** — delete a workspace (irreversible).
-  ```bash
-  molecule workspace delete ws_01HF2K...
-  ```
-- **`workspace restart <workspace-id>`** — trigger a restart.
-  ```bash
-  molecule workspace restart ws_01HF2K...
-  ```
-- **`workspace audit`** — workspaces + agents report grouped by status.
-  ```bash
-  molecule workspace audit -o yaml
-  ```
-- **`workspace delegate <workspace-id> <target-workspace-id> <task>`** —
-  enqueue a non-blocking delegation from one workspace to another.
-  ```bash
-  molecule workspace delegate ws_pm ws_research "summarize last week"
-  ```
-
-### `molecule agent`
-
-Inspect and interact with agents.
-
-- **`agent list [workspace-id]`** — list all agents, optionally scoped
-  to one workspace.
-  ```bash
-  molecule agent list
-  molecule agent list ws_01HF2K...
-  ```
-- **`agent inspect <agent-id>`** — show full details for an agent.
-  ```bash
-  molecule agent inspect agent_abc
-  ```
-- **`agent send <agent-id> <message>`** — send a one-shot A2A message
-  to an agent and print the reply.
-  ```bash
-  molecule agent send agent_abc "what's the deploy status?"
-  ```
-- **`agent peers <workspace-id>`** — list peer workspaces reachable
-  from the given workspace.
-  ```bash
-  molecule agent peers ws_01HF2K...
-  ```
-
-### `molecule platform`
-
-Platform-level operations.
-
-- **`platform audit`** — full audit: workspaces, agents, delegation
-  counts per workspace.
-  ```bash
-  molecule platform audit -o json
-  ```
-- **`platform health`** — check `/health` and version (falls back to
-  raw probe on older platforms).
-  ```bash
-  molecule platform health
-  ```
-
-### `molecule config`
-
-View and manage CLI configuration. Values resolve in order: env vars >
-config file > defaults.
-
-- **`config list`** — list all known config keys + effective values + source.
-- **`config get <key>`** — print a single config value.
-- **`config set <key> <value>`** — write a key to `~/.config/molecule.yaml`.
-- **`config init`** — scaffold a default `molecule.yaml` in the current dir.
-- **`config view`** — print the active config file with annotations.
-
-```bash
-molecule config set api_url https://your-tenant.staging.moleculesai.app
-molecule config get api_url
-molecule config list
-```
-
-### `molecule connect`
-
-See [Quick start](#quick-start--connect-an-external-workspace) above.
-Push mode (`--mode push`) is reserved for M4 and currently exits with a
-clear error — use the default `--mode poll`.
-
-### `molecule init`
-
-Bootstrap a workspace by scaffolding `molecule.yaml` in the current
-directory. Use `--force` to replace an existing file.
-
-```bash
-molecule init
-molecule init --force
-```
-
-### `molecule completion`
-
-Emit a shell completion script. The shell name is a positional arg —
-one of `bash`, `zsh`, `fish`, `powershell`.
-
-```bash
-# bash
-source <(molecule completion bash)
-
-# zsh
-source <(molecule completion zsh)
-
-# fish
-molecule completion fish | source
-
-# PowerShell
-molecule completion powershell | Out-String | Invoke-Expression
-```
-
-The full M1 design is in [RFC #10](https://github.com/Molecule-AI/molecule-cli/issues/10).
+The full M1 design is in [RFC #10](https://git.moleculesai.app/molecule-ai/molecule-cli/issues/10) (originally filed on the suspended GitHub org; the issue may be re-filed on Gitea — check the issue tracker for the live discussion).
 
 ## License
 

cmd/molecule/main.go

@@ -6,7 +6,7 @@ package main
 import (
 	"os"
 
-	"github.com/Molecule-AI/molecule-cli/internal/cmd"
+	"go.moleculesai.app/cli/internal/cmd"
 )
 
 func main() {

go.mod

@@ -1,4 +1,4 @@
-module github.com/Molecule-AI/molecule-cli
+module go.moleculesai.app/cli
 
 go 1.25.0
 

internal/backends/backend.go

@@ -5,7 +5,7 @@
 // that registers itself via `Register()` from an `init()` block.
 // Runtime selection is done via the --backend flag.
 //
-// See RFC: https://github.com/Molecule-AI/molecule-cli/issues/10
+// See RFC: https://git.moleculesai.app/molecule-ai/molecule-cli/issues/10
 package backends
 
 import (

internal/backends/backend_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/mock" // register
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/mock" // register
 )
 
 func TestRegister_DuplicatePanics(t *testing.T) {

internal/backends/claudecode/claudecode.go

@@ -29,8 +29,8 @@ package claudecode
 import (
 	"strings"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	exec "github.com/Molecule-AI/molecule-cli/internal/backends/exec"
+	"go.moleculesai.app/cli/internal/backends"
+	exec "go.moleculesai.app/cli/internal/backends/exec"
 )
 
 func init() {

internal/backends/claudecode/claudecode_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/claudecode" // register
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/claudecode" // register
 )
 
 func requireUnix(t *testing.T) {

internal/backends/exec/exec.go

@@ -41,7 +41,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
+	"go.moleculesai.app/cli/internal/backends"
 )
 
 func init() {

internal/backends/exec/exec_test.go

@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/exec" // register
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/exec" // register
 )
 
 // requireUnix skips Windows tests that depend on /bin/sh shell semantics.

internal/backends/mock/mock.go

@@ -14,7 +14,7 @@ import (
 	"context"
 	"strings"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
+	"go.moleculesai.app/cli/internal/backends"
 )
 
 func init() {

internal/cmd/agent.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"text/tabwriter"
 
-	"github.com/Molecule-AI/molecule-cli/internal/client"
+	"go.moleculesai.app/cli/internal/client"
 	"github.com/spf13/cobra"
 )
 

internal/cmd/config.go

@@ -121,7 +121,7 @@ var configInitCmd = &cobra.Command{
 }
 
 func runConfigInit(cmd *cobra.Command, _ []string) error {
-	const defaultConfig = `# molecule CLI config — https://github.com/Molecule-AI/molecule-cli
+	const defaultConfig = `# molecule CLI config — https://git.moleculesai.app/molecule-ai/molecule-cli
 #
 # All values can be overridden by environment variables:
 #   MOLECULE_API_URL, MOLECULE_RUNTIME_URL, MOL_OUTPUT, MOL_VERBOSE, etc.

internal/cmd/connect.go

@@ -9,11 +9,11 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/claudecode" // register backend
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/exec"       // register backend
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/mock"       // register backend
-	"github.com/Molecule-AI/molecule-cli/internal/connect"
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/claudecode" // register backend
+	_ "go.moleculesai.app/cli/internal/backends/exec"       // register backend
+	_ "go.moleculesai.app/cli/internal/backends/mock"       // register backend
+	"go.moleculesai.app/cli/internal/connect"
 	"github.com/spf13/cobra"
 )
 
@@ -21,7 +21,7 @@ import (
 // molecule connect — bridge an external-runtime workspace to a local backend.
 //
 // The full M1+ design lives in the RFC at
-// https://github.com/Molecule-AI/molecule-cli/issues/10. This file owns the
+// https://git.moleculesai.app/molecule-ai/molecule-cli/issues/10. This file owns the
 // command surface; the wiring (heartbeat, activity poll, dispatch) lands in
 // internal/connect/ in subsequent PRs.
 // ---------------------------------------------------------------------------
@@ -68,7 +68,7 @@ Examples:
   molecule connect ws_01HF2K... --backend exec \
       --backend-opt cmd="python myhandler.py"
 
-See full design: https://github.com/Molecule-AI/molecule-cli/issues/10`,
+See full design: https://git.moleculesai.app/molecule-ai/molecule-cli/issues/10`,
 	Args: cobra.ExactArgs(1),
 	RunE: runConnect,
 }

internal/cmd/init.go

@@ -40,7 +40,7 @@ func runInit(cmd *cobra.Command, _ []string) error {
 
 	if _, err := os.Stat(cfgPath); err == nil {
 		if initForce {
-			content := `# molecule CLI configuration — https://github.com/Molecule-AI/molecule-cli
+			content := `# molecule CLI configuration — https://git.moleculesai.app/molecule-ai/molecule-cli
 #
 # All values can be overridden by environment variables:
 #   MOLECULE_API_URL, MOLECULE_RUNTIME_URL, MOL_OUTPUT, MOL_VERBOSE, etc.
@@ -69,7 +69,7 @@ func runInit(cmd *cobra.Command, _ []string) error {
 		return fmt.Errorf("init: %s already exists — not overwriting (use --force to replace)", cfgPath)
 	}
 
-	content := `# molecule CLI configuration — https://github.com/Molecule-AI/molecule-cli
+	content := `# molecule CLI configuration — https://git.moleculesai.app/molecule-ai/molecule-cli
 #
 # All values can be overridden by environment variables:
 #   MOLECULE_API_URL, MOLECULE_RUNTIME_URL, MOL_OUTPUT, MOL_VERBOSE, etc.

internal/cmd/platform.go

@@ -8,7 +8,7 @@ import (
 	"os"
 	"text/tabwriter"
 
-	"github.com/Molecule-AI/molecule-cli/internal/client"
+	"go.moleculesai.app/cli/internal/client"
 	"github.com/spf13/cobra"
 )
 

internal/cmd/workspace.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"text/tabwriter"
 
-	"github.com/Molecule-AI/molecule-cli/internal/client"
+	"go.moleculesai.app/cli/internal/client"
 	"github.com/spf13/cobra"
 )
 

internal/connect/connect.go

@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
+	"go.moleculesai.app/cli/internal/backends"
 )
 
 // Options carries the runtime knobs Run needs. Constructed by the cmd

internal/connect/connect_test.go

@@ -13,9 +13,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/mock" // register mock for tests
-	"github.com/Molecule-AI/molecule-cli/internal/connect"
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/mock" // register mock for tests
+	"go.moleculesai.app/cli/internal/connect"
 )
 
 // fakeServer is the minimum workspace-server stub the loops need:

internal/connect/state_test.go

@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/Molecule-AI/molecule-cli/internal/connect"
+	"go.moleculesai.app/cli/internal/connect"
 )
 
 func TestState_LoadMissingReturnsZero(t *testing.T) {

internal/lint/import_path_lint_test.go

@@ -0,0 +1,146 @@
+// Issue molecule-ai/internal#71 lint gate.
+//
+// Walks every *.go file in the module + the go.mod declaration + any
+// Dockerfile in the repo, and rejects any reference to the dead
+// github.com/Molecule-AI/* identity (or the historical
+// Molecule-AI/molecule-monorepo path).
+//
+// We had a 374+131+30+1-line "github.com/Molecule-AI/" footprint across
+// the org pre-migration. The class of bug this gate prevents:
+//
+//   - copy-pastes from old branches re-introducing the dead path
+//   - Dockerfile -ldflags strings drifting back to github.com on a
+//     refactor (the path has to match the module declaration to inject
+//     buildinfo correctly; if they disagree the binary builds but
+//     reports a wrong / stale GitSHA)
+//   - new modules added to the repo with the wrong import root because
+//     someone copied an old go.mod without thinking
+//
+// Why not just a CI shell grep: a Go test runs everywhere `go test ./...`
+// runs, including local pre-push hooks and contributor IDEs. The gate
+// fires immediately, with a per-file message that points at the line —
+// CI shell grep failures are silent until the runner picks them up.
+
+package lint
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// forbiddenSubstrings is the literal-match list. Each string MUST NOT
+// appear anywhere under the module root. Entries are checked with
+// substring matching, not regex — keep the patterns specific enough
+// that a false-positive needs an explicit allowlist entry.
+var forbiddenSubstrings = []string{
+	"github.com/Molecule-AI/",
+	"Molecule-AI/molecule-monorepo",
+}
+
+// allowlistedFiles is the per-file escape hatch. Empty by default —
+// add an entry only when there is a documented reason a forbidden
+// string MUST appear (e.g. a regression-test fixture that asserts
+// the lint gate itself rejects the string). Each entry MUST be
+// accompanied by a comment explaining why.
+var allowlistedFiles = map[string]bool{
+	// (intentionally empty — add only with justification)
+}
+
+func TestNoLegacyGitHubImportPaths(t *testing.T) {
+	moduleRoot, err := findModuleRoot()
+	if err != nil {
+		t.Fatalf("findModuleRoot: %v", err)
+	}
+
+	checkExt := map[string]bool{
+		".go":   true,
+		".mod":  true,
+		".sum":  false, // go.sum is auto-generated, refs flow from go.mod
+		".sh":   true,
+		".yml":  true,
+		".yaml": true,
+		".toml": true,
+		".md":   true,
+	".json": true, // package.json / tsconfig.json — catches ref drift in package metadata
+	}
+	checkBasename := map[string]bool{
+		"Dockerfile":        true,
+		"Dockerfile.tenant": true,
+	}
+
+	violations := 0
+	walkErr := filepath.Walk(moduleRoot, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			// Skip vendor + .git + node_modules — not our code.
+			base := info.Name()
+			if base == "vendor" || base == ".git" || base == "node_modules" || base == "testdata" {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		ext := filepath.Ext(path)
+		base := filepath.Base(path)
+		if !checkExt[ext] && !checkBasename[base] {
+			return nil
+		}
+		rel, _ := filepath.Rel(moduleRoot, path)
+		if allowlistedFiles[rel] {
+			return nil
+		}
+		// Skip the lint test itself — it legitimately names the forbidden
+		// strings as match patterns.
+		if strings.HasSuffix(rel, "import_path_lint_test.go") {
+			return nil
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		text := string(data)
+		for _, bad := range forbiddenSubstrings {
+			if strings.Contains(text, bad) {
+				// Find the line number for a useful error message.
+				for lineNo, line := range strings.Split(text, "\n") {
+					if strings.Contains(line, bad) {
+						t.Errorf("%s:%d — forbidden substring %q (use go.moleculesai.app/<area>/... per molecule-ai/internal#71)", rel, lineNo+1, bad)
+						violations++
+						break
+					}
+				}
+			}
+		}
+		return nil
+	})
+	if walkErr != nil {
+		t.Fatalf("walk: %v", walkErr)
+	}
+	if violations > 0 {
+		t.Logf("Total violations: %d. Add to allowlistedFiles ONLY with a documented justification.", violations)
+	}
+}
+
+// findModuleRoot walks up from the test's CWD to find go.mod. The Go
+// test harness sets CWD to the package directory; the module root may
+// be one or more parents up.
+func findModuleRoot() (string, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	dir := cwd
+	for {
+		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
+			return dir, nil
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return "", os.ErrNotExist
+		}
+		dir = parent
+	}
+}

known-issues.md

@@ -93,7 +93,7 @@ entries may cause CI divergence or checksum mismatches.
 
 ### Impact
 `go mod verify` in CI may fail if `go.sum` has extra entries not in the
- lock file. Additionally, if the module path (`github.com/Molecule-AI/molecule-cli`)
+ lock file. Additionally, if the module path (`go.moleculesai.app/cli`)
  is referenced via `replace` directives from other repos, those references may
 persist stale entries.
 
@@ -130,24 +130,29 @@ is set to `.` (repo root) since the main package is at `cmd/molecule`.
 
 ## KI-005 — No integration test for the full CLI lifecycle
 
-**File:** `tests/` (does not exist)  
-**Status:** Not yet implemented  
+**File:** `cmd/molecule/molecule_test.go`, `internal/`  
+**Status:** ✅ Resolved  
 **Severity:** Medium
 
-### Symptom
-There are no tests at all (per `go test ./...` — no packages match).
-As subcommands are built, there is no test harness for end-to-end CLI testing
-(e.g. `molecule workspace create --name test --output json` → verify JSON output).
+### Resolution
+`cmd/molecule/molecule_test.go` contains 32 table-driven integration tests
+covering the full CLI command surface. Each test:
+- Starts a `httptest.Server` that mirrors the platform REST API (workspace CRUD,
+  agent inspection, delegation, health, audit, config, completion scripts).
+- Builds the `molecule` binary via `go build -o <tempdir>/molecule .`
+- Executes it with `exec.Command` and validates stdout/stderr output.
 
-### Impact
-Each subcommand will be shipped without regression protection. Manual testing
-is required for every release. The absence of a `tests/` directory also means
-there is no fixture for CLI integration testing with recorded API responses.
+Test coverage includes:
+- Root help, workspace/agent/platform/config help
+- `workspace list`, `workspace inspect`, `workspace create`, `workspace delete`,
+  `workspace restart`, `workspace audit`, `workspace delegate`
+- `agent list`, `agent inspect`, `agent send`, `agent peers`
+- `platform health`, `platform audit`
+- `config init`, `config list`
+- `init`, `init --force`
+- `completion bash/zsh/fish/powershell`
+- Error paths: missing workspace, missing agent, unknown subcommand,
+  missing required args, duplicate init
 
-### Suggested fix
-Add `tests/` with:
-- `cmd/molecule/molecule_test.go` — table-driven tests for each subcommand
-  using `exec.Command("molecule", ...)` against a built binary
-- Use `molecule-sdk-python` fixture server or recorded API responses for
-  offline testing
-- Add `go test ./...` to CI; require >0 test packages before merge
+Run `go test ./...` from the repo root to execute. No live platform required —
+all tests use `httptest.Server` fixtures.