fix(cli): correct merge-queue contexts and ci.yml/release.yml path filters

Two separate issues fixed together:

1. gitea-merge-queue.yml REQUIRED_CONTEXTS: CI workflow posts
   "CI / Test / test (pull_request)" — the workflow triggers on
   pull_request events so Gitea uses "(pull_request)" suffix (not
   "(push)" as was previously documented).

2. ci.yml and release.yml path filters: the post-suspension sweep
   renamed .github/workflows/ → .gitea/workflows/ but the path
   filters inside both files still referenced .github/workflows/.
   Corrected to .gitea/workflows/ so the CI actually runs on
   subsequent PRs touching workflow files.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.ci-auth-test-1778443313.txt

@@ -0,0 +1 @@
+ci-auth-test-1778443313

.ci-auth-test2-1778443456.txt

@@ -0,0 +1 @@
+ci-auth-test2-1778443456

.gitea/scripts/gitea-merge-queue.py

@@ -0,0 +1,370 @@
+#!/usr/bin/env python3
+"""gitea-merge-queue — conservative serialized merge bot for Gitea.
+
+Gitea 1.22.6 has auto-merge (`pull_auto_merge`) but no GitHub-style merge
+queue. This script provides the missing serialized policy in user space:
+
+1. Pick the oldest open PR carrying QUEUE_LABEL.
+2. Refuse to act unless main is green.
+3. Refuse fork PRs; the queue may only mutate same-repo branches.
+4. If the PR branch does not contain current main, call Gitea's
+   /pulls/{n}/update endpoint and stop. CI must rerun on the updated head.
+5. If the updated PR head has all required contexts green, merge with the
+   non-bypass merge actor token.
+
+The script is intentionally one-PR-per-run. Workflow/cron concurrency should
+serialize invocations so two green PRs cannot merge against the same main.
+"""
+
+from __future__ import annotations
+
+import argparse
+import dataclasses
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+
+def _env(key: str, *, default: str = "") -> str:
+    return os.environ.get(key, default)
+
+
+GITEA_TOKEN = _env("GITEA_TOKEN")
+GITEA_HOST = _env("GITEA_HOST")
+REPO = _env("REPO")
+WATCH_BRANCH = _env("WATCH_BRANCH", default="main")
+QUEUE_LABEL = _env("QUEUE_LABEL", default="merge-queue")
+HOLD_LABEL = _env("HOLD_LABEL", default="merge-queue-hold")
+UPDATE_STYLE = _env("UPDATE_STYLE", default="merge")
+REQUIRED_CONTEXTS_RAW = _env(
+    "REQUIRED_CONTEXTS",
+    default=(
+        "CI / all-required (pull_request),"
+        "sop-checklist / all-items-acked (pull_request)"
+    ),
+)
+
+OWNER, NAME = (REPO.split("/", 1) + [""])[:2] if REPO else ("", "")
+API = f"https://{GITEA_HOST}/api/v1" if GITEA_HOST else ""
+
+
+class ApiError(RuntimeError):
+    pass
+
+
+@dataclasses.dataclass(frozen=True)
+class MergeDecision:
+    ready: bool
+    action: str
+    reason: str
+
+
+def _require_runtime_env() -> None:
+    for key in ("GITEA_TOKEN", "GITEA_HOST", "REPO", "WATCH_BRANCH", "QUEUE_LABEL"):
+        if not os.environ.get(key):
+            sys.stderr.write(f"::error::missing required env var: {key}\n")
+            sys.exit(2)
+    if UPDATE_STYLE not in {"merge", "rebase"}:
+        sys.stderr.write("::error::UPDATE_STYLE must be merge or rebase\n")
+        sys.exit(2)
+
+
+def api(
+    method: str,
+    path: str,
+    *,
+    body: dict | None = None,
+    query: dict[str, str] | None = None,
+    expect_json: bool = True,
+) -> tuple[int, Any]:
+    url = f"{API}{path}"
+    if query:
+        url = f"{url}?{urllib.parse.urlencode(query)}"
+    data = None
+    headers = {
+        "Authorization": f"token {GITEA_TOKEN}",
+        "Accept": "application/json",
+    }
+    if body is not None:
+        data = json.dumps(body).encode("utf-8")
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, method=method, data=data, headers=headers)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            raw = resp.read()
+            status = resp.status
+    except urllib.error.HTTPError as exc:
+        raw = exc.read()
+        status = exc.code
+
+    if not (200 <= status < 300):
+        snippet = raw[:500].decode("utf-8", errors="replace") if raw else ""
+        raise ApiError(f"{method} {path} -> HTTP {status}: {snippet}")
+    if not raw:
+        return status, None
+    try:
+        return status, json.loads(raw)
+    except json.JSONDecodeError as exc:
+        if expect_json:
+            raise ApiError(f"{method} {path} -> HTTP {status} non-JSON: {exc}") from exc
+        return status, {"_raw": raw.decode("utf-8", errors="replace")}
+
+
+def required_contexts(raw: str) -> list[str]:
+    return [part.strip() for part in raw.split(",") if part.strip()]
+
+
+def status_state(status: dict) -> str:
+    return str(status.get("status") or status.get("state") or "").lower()
+
+
+def latest_statuses_by_context(statuses: list[dict]) -> dict[str, dict]:
+    latest: dict[str, dict] = {}
+    for status in statuses:
+        context = status.get("context")
+        if isinstance(context, str) and context not in latest:
+            latest[context] = status
+    return latest
+
+
+def required_contexts_green(
+    latest_statuses: dict[str, dict],
+    contexts: list[str],
+) -> tuple[bool, list[str]]:
+    missing_or_bad: list[str] = []
+    for context in contexts:
+        status = latest_statuses.get(context)
+        state = status_state(status or {})
+        if state != "success":
+            missing_or_bad.append(f"{context}={state or 'missing'}")
+    return not missing_or_bad, missing_or_bad
+
+
+def label_names(issue: dict) -> set[str]:
+    return {
+        label["name"]
+        for label in issue.get("labels", [])
+        if isinstance(label, dict) and isinstance(label.get("name"), str)
+    }
+
+
+def choose_next_queued_issue(
+    issues: list[dict],
+    *,
+    queue_label: str,
+    hold_label: str = "",
+) -> dict | None:
+    candidates = []
+    for issue in issues:
+        labels = label_names(issue)
+        if queue_label not in labels:
+            continue
+        if hold_label and hold_label in labels:
+            continue
+        if "pull_request" not in issue:
+            continue
+        candidates.append(issue)
+    candidates.sort(key=lambda issue: (issue.get("created_at") or "", int(issue["number"])))
+    return candidates[0] if candidates else None
+
+
+def pr_contains_base_sha(commits: list[dict], base_sha: str) -> bool:
+    for commit in commits:
+        sha = commit.get("sha") or commit.get("id")
+        if sha == base_sha:
+            return True
+    return False
+
+
+def pr_has_current_base(pr: dict, commits: list[dict], main_sha: str) -> bool:
+    if pr.get("merge_base") == main_sha:
+        return True
+    return pr_contains_base_sha(commits, main_sha)
+
+
+def evaluate_merge_readiness(
+    *,
+    main_status: dict,
+    pr_status: dict,
+    required_contexts: list[str],
+    pr_has_current_base: bool,
+) -> MergeDecision:
+    main_state = str(main_status.get("state") or "").lower()
+    if main_state != "success":
+        return MergeDecision(False, "pause", f"main status is {main_state or 'missing'}")
+    if not pr_has_current_base:
+        return MergeDecision(False, "update", "PR head does not contain current main")
+
+    pr_state = str(pr_status.get("state") or "").lower()
+    if pr_state != "success":
+        return MergeDecision(False, "wait", f"PR combined status is {pr_state or 'missing'}")
+
+    latest = latest_statuses_by_context(pr_status.get("statuses") or [])
+    ok, missing_or_bad = required_contexts_green(latest, required_contexts)
+    if not ok:
+        return MergeDecision(False, "wait", "required contexts not green: " + ", ".join(missing_or_bad))
+    return MergeDecision(True, "merge", "ready")
+
+
+def get_branch_head(branch: str) -> str:
+    _, body = api("GET", f"/repos/{OWNER}/{NAME}/branches/{branch}")
+    commit = body.get("commit") if isinstance(body, dict) else None
+    sha = commit.get("id") if isinstance(commit, dict) else None
+    if not isinstance(sha, str) or len(sha) < 7:
+        raise ApiError(f"branch {branch} response missing commit id")
+    return sha
+
+
+def get_combined_status(sha: str) -> dict:
+    _, body = api("GET", f"/repos/{OWNER}/{NAME}/commits/{sha}/status")
+    if not isinstance(body, dict):
+        raise ApiError(f"status for {sha} response not object")
+    return body
+
+
+def list_queued_issues() -> list[dict]:
+    _, body = api(
+        "GET",
+        f"/repos/{OWNER}/{NAME}/issues",
+        query={
+            "state": "open",
+            "type": "pulls",
+            "labels": QUEUE_LABEL,
+            "limit": "50",
+        },
+    )
+    if not isinstance(body, list):
+        raise ApiError("queued issues response not list")
+    return body
+
+
+def get_pull(pr_number: int) -> dict:
+    _, body = api("GET", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}")
+    if not isinstance(body, dict):
+        raise ApiError(f"PR #{pr_number} response not object")
+    return body
+
+
+def get_pull_commits(pr_number: int) -> list[dict]:
+    _, body = api("GET", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/commits")
+    if not isinstance(body, list):
+        raise ApiError(f"PR #{pr_number} commits response not list")
+    return body
+
+
+def post_comment(pr_number: int, body: str, *, dry_run: bool) -> None:
+    print(f"::notice::comment PR #{pr_number}: {body.splitlines()[0][:160]}")
+    if dry_run:
+        return
+    api("POST", f"/repos/{OWNER}/{NAME}/issues/{pr_number}/comments", body={"body": body})
+
+
+def update_pull(pr_number: int, *, dry_run: bool) -> None:
+    print(f"::notice::updating PR #{pr_number} with base branch via style={UPDATE_STYLE}")
+    if dry_run:
+        return
+    api(
+        "POST",
+        f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/update",
+        query={"style": UPDATE_STYLE},
+        expect_json=False,
+    )
+
+
+def merge_pull(pr_number: int, *, dry_run: bool) -> None:
+    payload = {
+        "Do": "merge",
+        "MergeTitleField": f"Merge PR #{pr_number} via Gitea merge queue",
+        "MergeMessageField": (
+            "Serialized merge by gitea-merge-queue after current-main, "
+            "SOP, and required CI checks were green."
+        ),
+    }
+    print(f"::notice::merging PR #{pr_number}")
+    if dry_run:
+        return
+    api("POST", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/merge", body=payload, expect_json=False)
+
+
+def process_once(*, dry_run: bool = False) -> int:
+    contexts = required_contexts(REQUIRED_CONTEXTS_RAW)
+    main_sha = get_branch_head(WATCH_BRANCH)
+    main_status = get_combined_status(main_sha)
+    if str(main_status.get("state") or "").lower() != "success":
+        print(f"::notice::queue paused: {WATCH_BRANCH}@{main_sha[:8]} is not green")
+        return 0
+
+    issue = choose_next_queued_issue(
+        list_queued_issues(),
+        queue_label=QUEUE_LABEL,
+        hold_label=HOLD_LABEL,
+    )
+    if not issue:
+        print("::notice::merge queue empty")
+        return 0
+
+    pr_number = int(issue["number"])
+    pr = get_pull(pr_number)
+    if pr.get("state") != "open":
+        print(f"::notice::PR #{pr_number} is not open; skipping")
+        return 0
+    if pr.get("base", {}).get("ref") != WATCH_BRANCH:
+        post_comment(pr_number, f"merge-queue: skipped; base branch is not `{WATCH_BRANCH}`.", dry_run=dry_run)
+        return 0
+    if pr.get("head", {}).get("repo_id") != pr.get("base", {}).get("repo_id"):
+        post_comment(pr_number, "merge-queue: skipped; fork PRs are not supported by the serialized queue.", dry_run=dry_run)
+        return 0
+
+    head_sha = pr.get("head", {}).get("sha")
+    if not isinstance(head_sha, str) or len(head_sha) < 7:
+        raise ApiError(f"PR #{pr_number} missing head sha")
+    commits = get_pull_commits(pr_number)
+    current_base = pr_has_current_base(pr, commits, main_sha)
+    pr_status = get_combined_status(head_sha)
+    decision = evaluate_merge_readiness(
+        main_status=main_status,
+        pr_status=pr_status,
+        required_contexts=contexts,
+        pr_has_current_base=current_base,
+    )
+
+    print(f"::notice::PR #{pr_number} decision={decision.action}: {decision.reason}")
+    if decision.action == "update":
+        update_pull(pr_number, dry_run=dry_run)
+        post_comment(
+            pr_number,
+            (
+                f"merge-queue: updated this branch with `{WATCH_BRANCH}` at "
+                f"`{main_sha[:12]}`. Waiting for CI on the refreshed head."
+            ),
+            dry_run=dry_run,
+        )
+        return 0
+    if decision.ready:
+        latest_main_sha = get_branch_head(WATCH_BRANCH)
+        if latest_main_sha != main_sha:
+            print(
+                f"::notice::main moved {main_sha[:8]} -> {latest_main_sha[:8]}; "
+                "deferring to next tick"
+            )
+            return 0
+        merge_pull(pr_number, dry_run=dry_run)
+        return 0
+    return 0
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--dry-run", action="store_true")
+    args = parser.parse_args()
+    _require_runtime_env()
+    return process_once(dry_run=args.dry_run)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
+

.gitea/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI / Test
+
+# Runs on every PR touching Go code, and on every push to main.
+# Mirrors the test job from release.yml so PRs are validated independently
+# of the release workflow. Uses Go 1.25 to match release.yml.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.gitea/workflows/ci.yml'
+  pull_request:
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.gitea/workflows/ci.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache: true
+      - name: Tidy
+        run: go mod tidy && git diff --exit-code go.sum
+      - name: Vet
+        run: go vet ./...
+      - name: Test
+        run: go test -race -count=1 ./...

.gitea/workflows/gitea-merge-queue.yml

@@ -0,0 +1,41 @@
+name: gitea-merge-queue
+
+on:
+  schedule:
+    - cron: '*/5 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gitea-merge-queue-${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  queue:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out queue script from main
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: Process one queued PR
+        env:
+          GITEA_TOKEN: ${{ secrets.AUTO_SYNC_TOKEN }}
+          GITEA_HOST: git.moleculesai.app
+          REPO: ${{ github.repository }}
+          WATCH_BRANCH: ${{ github.event.repository.default_branch }}
+          QUEUE_LABEL: merge-queue
+          HOLD_LABEL: merge-queue-hold
+          UPDATE_STYLE: merge
+          # Context names: CI workflow (.gitea/workflows/ci.yml) is "CI / Test", job is "test"
+          # → "CI / Test / test". The workflow triggers on pull_request events,
+          # so Gitea posts "(pull_request)" suffix. Note: ci.yml is in .gitea/workflows/
+          # but the path filter references .github/workflows/ci.yml — the filter never matches
+          # so the CI only runs via release.yml's pull_request trigger (same test job).
+          REQUIRED_CONTEXTS: >-
+            CI / Test / test (pull_request)
+        run: python3 .gitea/scripts/gitea-merge-queue.py

.gitea/workflows/release.yml

@@ -19,7 +19,7 @@ on:
       - '**.go'
       - 'go.mod'
       - 'go.sum'
-      - '.github/workflows/release.yml'
+      - '.gitea/workflows/release.yml'
       - '.goreleaser.yaml'
 
 permissions:

.verify-fix-1778444420.txt

@@ -0,0 +1 @@
+verify-fix-1778444420

CLAUDE.md

@@ -4,7 +4,7 @@ Go CLI for the Molecule AI agent platform. Wraps the platform's workspace runtim
 
 **Users:** Platform operators and developers integrating with the Molecule AI platform.
 
-**Repo state (2026-04-16):** Thin/stub. Go module is initialized; core CLI commands are not yet implemented. CI (Go binary release via GoReleaser + GitHub Actions) is wired up.
+**Repo state:** Core commands implemented. 32 integration tests in `cmd/molecule/molecule_test.go`.
 
 ---
 
@@ -23,18 +23,16 @@ This CLI is the primary user-facing tool for interacting with the Molecule AI pl
 # Build the binary to ./bin/molecule (or $GOBIN/molecule)
 go build -o bin/molecule ./cmd/molecule
 
-# Run tests (none yet; add as commands are implemented)
+# Run tests — uses httptest.Server fixtures, no live platform required
 go test ./...
 
 # Run the CLI locally (requires platform env vars — see Section 5)
 ./bin/molecule --help
 ```
 
-There is no `main.go` or `cmd/molecule/main.go` yet. Creating it is the first implementation task. The module path will be auto-detected from `go.mod`.
-
 ## 3. Go Module Conventions
 
-**Module path:** `github.com/Molecule-AI/molecule-cli` (from `go.mod`)
+**Module path:** `go.moleculesai.app/cli` (from `go.mod`)
 
 **Dependency management:**
 - Use `go mod tidy` after adding or removing dependencies.
@@ -131,8 +129,8 @@ See `known-issues.md` at the repo root for the full tracked list.
 - [x] Control plane API client (initialized with `MOLECULE_API_URL`)
 - [ ] Workspace runtime client (for dev/proxy mode)
 - [ ] Configuration file (e.g., `~/.config/molecule/cli.yaml`) — workspace template per platform rules
-- [ ] Unit tests for core command logic
-- [ ] `molecule init` (bootstrap local workspace config)
+- [x] Unit tests for core command logic (32 integration tests)
+- [x] `molecule init` (bootstrap local workspace config)
 
 **Platform constraint reminders (from `constraints-and-rules.md`):**
 - Postgres is the source of truth. CLI commands that mutate state ultimately write to Postgres via the control plane.

README.md

@@ -8,12 +8,23 @@ command, or a mock for CI).
 ## Install
 
 ```bash
-go install github.com/Molecule-AI/molecule-cli/cmd/molecule@latest
+go install go.moleculesai.app/cli/cmd/molecule@latest
 ```
 
-Or download a binary from [Releases](https://github.com/Molecule-AI/molecule-cli/releases).
-Releases ship Linux/macOS/Windows × amd64/arm64 archives plus a sha256
-checksums file (see `.goreleaser.yaml`).
+The vanity import path `go.moleculesai.app/cli` resolves via the
+Molecules AI go-get responder (issue [internal#71][i71]) to our
+canonical SCM at git.moleculesai.app. It is independent of any specific
+SCM host — when we move SCMs again, no install command changes.
+
+Alternatively, build from source:
+
+```bash
+git clone https://git.moleculesai.app/molecule-ai/molecule-cli.git
+cd molecule-cli
+go build -o molecule ./cmd/molecule
+```
+
+[i71]: https://git.moleculesai.app/molecule-ai/internal/issues/71
 
 ## Quick start — connect an external workspace
 
@@ -59,7 +70,7 @@ molecule connect ws_abc \
 ### Other useful flags
 
 ```
---mode poll|push         delivery mode (default: poll; push is M4, not yet implemented)
+--mode poll|push         delivery mode (default: poll)
 --interval-ms 2000       poll cadence
 --since-secs 60          initial activity cursor lookback
 --token TOKEN            override MOLECULE_WORKSPACE_TOKEN
@@ -70,159 +81,15 @@ State (the activity cursor) is persisted to
 `~/.config/molecule/state/<workspace-id>.json` (mode 0600) so a restart
 resumes from the last delivered message.
 
-> Note: poll-mode dispatch into backends works end-to-end. Posting the
-> backend's reply back to the canvas-origin sender is still wired as a
-> TODO (see `internal/connect/connect.go` — M1.3); platform-API replies
-> for non-canvas A2A flow correctly.
-
-## Command reference
-
-The full top-level tree:
+## Other subcommands
 
 ```
-molecule
-├── workspace    list / create / inspect / delete / restart / audit / delegate
-├── agent        list / inspect / send / peers
-├── platform     audit / health
-├── config       list / get / set / init / view
-├── connect      bridge an external workspace to a local backend
-├── init         scaffold a molecule.yaml in the current directory
-└── completion   emit shell completion script (bash | zsh | fish | powershell)
+molecule agent      list / inspect agent sessions
+molecule config     view / set CLI defaults
+molecule completion generate shell completions
 ```
 
-Global flags (apply to every subcommand): `--api-url`, `--config`,
-`-o/--output table|json|yaml`, `-v/--verbose`.
-
-### `molecule workspace`
-
-Manage Molecule AI workspaces.
-
-- **`workspace list`** — list all workspaces in the org.
-  ```bash
-  molecule workspace list
-  molecule workspace list -o json
-  ```
-- **`workspace create --name <name> [flags]`** — create a workspace.
-  Flags: `--role`, `--runtime`, `--template`, `--parent-id`,
-  `--workspace-dir`, `--tier`.
-  ```bash
-  molecule workspace create --name pm-bot --role pm --runtime claude-code
-  ```
-- **`workspace inspect <workspace-id>`** — show full details for a workspace.
-  ```bash
-  molecule workspace inspect ws_01HF2K...
-  ```
-- **`workspace delete <workspace-id>`** — delete a workspace (irreversible).
-  ```bash
-  molecule workspace delete ws_01HF2K...
-  ```
-- **`workspace restart <workspace-id>`** — trigger a restart.
-  ```bash
-  molecule workspace restart ws_01HF2K...
-  ```
-- **`workspace audit`** — workspaces + agents report grouped by status.
-  ```bash
-  molecule workspace audit -o yaml
-  ```
-- **`workspace delegate <workspace-id> <target-workspace-id> <task>`** —
-  enqueue a non-blocking delegation from one workspace to another.
-  ```bash
-  molecule workspace delegate ws_pm ws_research "summarize last week"
-  ```
-
-### `molecule agent`
-
-Inspect and interact with agents.
-
-- **`agent list [workspace-id]`** — list all agents, optionally scoped
-  to one workspace.
-  ```bash
-  molecule agent list
-  molecule agent list ws_01HF2K...
-  ```
-- **`agent inspect <agent-id>`** — show full details for an agent.
-  ```bash
-  molecule agent inspect agent_abc
-  ```
-- **`agent send <agent-id> <message>`** — send a one-shot A2A message
-  to an agent and print the reply.
-  ```bash
-  molecule agent send agent_abc "what's the deploy status?"
-  ```
-- **`agent peers <workspace-id>`** — list peer workspaces reachable
-  from the given workspace.
-  ```bash
-  molecule agent peers ws_01HF2K...
-  ```
-
-### `molecule platform`
-
-Platform-level operations.
-
-- **`platform audit`** — full audit: workspaces, agents, delegation
-  counts per workspace.
-  ```bash
-  molecule platform audit -o json
-  ```
-- **`platform health`** — check `/health` and version (falls back to
-  raw probe on older platforms).
-  ```bash
-  molecule platform health
-  ```
-
-### `molecule config`
-
-View and manage CLI configuration. Values resolve in order: env vars >
-config file > defaults.
-
-- **`config list`** — list all known config keys + effective values + source.
-- **`config get <key>`** — print a single config value.
-- **`config set <key> <value>`** — write a key to `~/.config/molecule.yaml`.
-- **`config init`** — scaffold a default `molecule.yaml` in the current dir.
-- **`config view`** — print the active config file with annotations.
-
-```bash
-molecule config set api_url https://your-tenant.staging.moleculesai.app
-molecule config get api_url
-molecule config list
-```
-
-### `molecule connect`
-
-See [Quick start](#quick-start--connect-an-external-workspace) above.
-Push mode (`--mode push`) is reserved for M4 and currently exits with a
-clear error — use the default `--mode poll`.
-
-### `molecule init`
-
-Bootstrap a workspace by scaffolding `molecule.yaml` in the current
-directory. Use `--force` to replace an existing file.
-
-```bash
-molecule init
-molecule init --force
-```
-
-### `molecule completion`
-
-Emit a shell completion script. The shell name is a positional arg —
-one of `bash`, `zsh`, `fish`, `powershell`.
-
-```bash
-# bash
-source <(molecule completion bash)
-
-# zsh
-source <(molecule completion zsh)
-
-# fish
-molecule completion fish | source
-
-# PowerShell
-molecule completion powershell | Out-String | Invoke-Expression
-```
-
-The full M1 design is in [RFC #10](https://github.com/Molecule-AI/molecule-cli/issues/10).
+The full M1 design is in [RFC #10](https://git.moleculesai.app/molecule-ai/molecule-cli/issues/10) (originally filed on the suspended GitHub org; the issue may be re-filed on Gitea — check the issue tracker for the live discussion).
 
 ## License
 

cmd/molecule/main.go

@@ -6,7 +6,7 @@ package main
 import (
 	"os"
 
-	"github.com/Molecule-AI/molecule-cli/internal/cmd"
+	"go.moleculesai.app/cli/internal/cmd"
 )
 
 func main() {

go.mod

@@ -1,4 +1,4 @@
-module github.com/Molecule-AI/molecule-cli
+module go.moleculesai.app/cli
 
 go 1.25.0
 

internal/backends/backend.go

@@ -5,7 +5,7 @@
 // that registers itself via `Register()` from an `init()` block.
 // Runtime selection is done via the --backend flag.
 //
-// See RFC: https://github.com/Molecule-AI/molecule-cli/issues/10
+// See RFC: https://git.moleculesai.app/molecule-ai/molecule-cli/issues/10
 package backends
 
 import (

internal/backends/backend_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/mock" // register
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/mock" // register
 )
 
 func TestRegister_DuplicatePanics(t *testing.T) {

internal/backends/claudecode/claudecode.go

@@ -29,8 +29,8 @@ package claudecode
 import (
 	"strings"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	exec "github.com/Molecule-AI/molecule-cli/internal/backends/exec"
+	"go.moleculesai.app/cli/internal/backends"
+	exec "go.moleculesai.app/cli/internal/backends/exec"
 )
 
 func init() {

internal/backends/claudecode/claudecode_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/claudecode" // register
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/claudecode" // register
 )
 
 func requireUnix(t *testing.T) {

internal/backends/exec/exec.go

@@ -41,7 +41,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
+	"go.moleculesai.app/cli/internal/backends"
 )
 
 func init() {

internal/backends/exec/exec_test.go

@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/exec" // register
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/exec" // register
 )
 
 // requireUnix skips Windows tests that depend on /bin/sh shell semantics.

internal/backends/mock/mock.go

@@ -14,7 +14,7 @@ import (
 	"context"
 	"strings"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
+	"go.moleculesai.app/cli/internal/backends"
 )
 
 func init() {

internal/cmd/agent.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"text/tabwriter"
 
-	"github.com/Molecule-AI/molecule-cli/internal/client"
+	"go.moleculesai.app/cli/internal/client"
 	"github.com/spf13/cobra"
 )
 

internal/cmd/config.go

@@ -121,7 +121,7 @@ var configInitCmd = &cobra.Command{
 }
 
 func runConfigInit(cmd *cobra.Command, _ []string) error {
-	const defaultConfig = `# molecule CLI config — https://github.com/Molecule-AI/molecule-cli
+	const defaultConfig = `# molecule CLI config — https://git.moleculesai.app/molecule-ai/molecule-cli
 #
 # All values can be overridden by environment variables:
 #   MOLECULE_API_URL, MOLECULE_RUNTIME_URL, MOL_OUTPUT, MOL_VERBOSE, etc.

internal/cmd/connect.go

@@ -9,11 +9,11 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/claudecode" // register backend
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/exec"       // register backend
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/mock"       // register backend
-	"github.com/Molecule-AI/molecule-cli/internal/connect"
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/claudecode" // register backend
+	_ "go.moleculesai.app/cli/internal/backends/exec"       // register backend
+	_ "go.moleculesai.app/cli/internal/backends/mock"       // register backend
+	"go.moleculesai.app/cli/internal/connect"
 	"github.com/spf13/cobra"
 )
 
@@ -21,7 +21,7 @@ import (
 // molecule connect — bridge an external-runtime workspace to a local backend.
 //
 // The full M1+ design lives in the RFC at
-// https://github.com/Molecule-AI/molecule-cli/issues/10. This file owns the
+// https://git.moleculesai.app/molecule-ai/molecule-cli/issues/10. This file owns the
 // command surface; the wiring (heartbeat, activity poll, dispatch) lands in
 // internal/connect/ in subsequent PRs.
 // ---------------------------------------------------------------------------
@@ -68,7 +68,7 @@ Examples:
   molecule connect ws_01HF2K... --backend exec \
       --backend-opt cmd="python myhandler.py"
 
-See full design: https://github.com/Molecule-AI/molecule-cli/issues/10`,
+See full design: https://git.moleculesai.app/molecule-ai/molecule-cli/issues/10`,
 	Args: cobra.ExactArgs(1),
 	RunE: runConnect,
 }

internal/cmd/init.go

@@ -40,7 +40,7 @@ func runInit(cmd *cobra.Command, _ []string) error {
 
 	if _, err := os.Stat(cfgPath); err == nil {
 		if initForce {
-			content := `# molecule CLI configuration — https://github.com/Molecule-AI/molecule-cli
+			content := `# molecule CLI configuration — https://git.moleculesai.app/molecule-ai/molecule-cli
 #
 # All values can be overridden by environment variables:
 #   MOLECULE_API_URL, MOLECULE_RUNTIME_URL, MOL_OUTPUT, MOL_VERBOSE, etc.
@@ -69,7 +69,7 @@ func runInit(cmd *cobra.Command, _ []string) error {
 		return fmt.Errorf("init: %s already exists — not overwriting (use --force to replace)", cfgPath)
 	}
 
-	content := `# molecule CLI configuration — https://github.com/Molecule-AI/molecule-cli
+	content := `# molecule CLI configuration — https://git.moleculesai.app/molecule-ai/molecule-cli
 #
 # All values can be overridden by environment variables:
 #   MOLECULE_API_URL, MOLECULE_RUNTIME_URL, MOL_OUTPUT, MOL_VERBOSE, etc.

internal/cmd/platform.go

@@ -8,7 +8,7 @@ import (
 	"os"
 	"text/tabwriter"
 
-	"github.com/Molecule-AI/molecule-cli/internal/client"
+	"go.moleculesai.app/cli/internal/client"
 	"github.com/spf13/cobra"
 )
 

internal/cmd/workspace.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"text/tabwriter"
 
-	"github.com/Molecule-AI/molecule-cli/internal/client"
+	"go.moleculesai.app/cli/internal/client"
 	"github.com/spf13/cobra"
 )
 

internal/connect/connect.go

@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
+	"go.moleculesai.app/cli/internal/backends"
 )
 
 // Options carries the runtime knobs Run needs. Constructed by the cmd

internal/connect/connect_test.go

@@ -13,9 +13,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Molecule-AI/molecule-cli/internal/backends"
-	_ "github.com/Molecule-AI/molecule-cli/internal/backends/mock" // register mock for tests
-	"github.com/Molecule-AI/molecule-cli/internal/connect"
+	"go.moleculesai.app/cli/internal/backends"
+	_ "go.moleculesai.app/cli/internal/backends/mock" // register mock for tests
+	"go.moleculesai.app/cli/internal/connect"
 )
 
 // fakeServer is the minimum workspace-server stub the loops need:

internal/connect/state_test.go

@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/Molecule-AI/molecule-cli/internal/connect"
+	"go.moleculesai.app/cli/internal/connect"
 )
 
 func TestState_LoadMissingReturnsZero(t *testing.T) {

internal/lint/import_path_lint_test.go

@@ -0,0 +1,146 @@
+// Issue molecule-ai/internal#71 lint gate.
+//
+// Walks every *.go file in the module + the go.mod declaration + any
+// Dockerfile in the repo, and rejects any reference to the dead
+// github.com/Molecule-AI/* identity (or the historical
+// Molecule-AI/molecule-monorepo path).
+//
+// We had a 374+131+30+1-line "github.com/Molecule-AI/" footprint across
+// the org pre-migration. The class of bug this gate prevents:
+//
+//   - copy-pastes from old branches re-introducing the dead path
+//   - Dockerfile -ldflags strings drifting back to github.com on a
+//     refactor (the path has to match the module declaration to inject
+//     buildinfo correctly; if they disagree the binary builds but
+//     reports a wrong / stale GitSHA)
+//   - new modules added to the repo with the wrong import root because
+//     someone copied an old go.mod without thinking
+//
+// Why not just a CI shell grep: a Go test runs everywhere `go test ./...`
+// runs, including local pre-push hooks and contributor IDEs. The gate
+// fires immediately, with a per-file message that points at the line —
+// CI shell grep failures are silent until the runner picks them up.
+
+package lint
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// forbiddenSubstrings is the literal-match list. Each string MUST NOT
+// appear anywhere under the module root. Entries are checked with
+// substring matching, not regex — keep the patterns specific enough
+// that a false-positive needs an explicit allowlist entry.
+var forbiddenSubstrings = []string{
+	"github.com/Molecule-AI/",
+	"Molecule-AI/molecule-monorepo",
+}
+
+// allowlistedFiles is the per-file escape hatch. Empty by default —
+// add an entry only when there is a documented reason a forbidden
+// string MUST appear (e.g. a regression-test fixture that asserts
+// the lint gate itself rejects the string). Each entry MUST be
+// accompanied by a comment explaining why.
+var allowlistedFiles = map[string]bool{
+	// (intentionally empty — add only with justification)
+}
+
+func TestNoLegacyGitHubImportPaths(t *testing.T) {
+	moduleRoot, err := findModuleRoot()
+	if err != nil {
+		t.Fatalf("findModuleRoot: %v", err)
+	}
+
+	checkExt := map[string]bool{
+		".go":   true,
+		".mod":  true,
+		".sum":  false, // go.sum is auto-generated, refs flow from go.mod
+		".sh":   true,
+		".yml":  true,
+		".yaml": true,
+		".toml": true,
+		".md":   true,
+	".json": true, // package.json / tsconfig.json — catches ref drift in package metadata
+	}
+	checkBasename := map[string]bool{
+		"Dockerfile":        true,
+		"Dockerfile.tenant": true,
+	}
+
+	violations := 0
+	walkErr := filepath.Walk(moduleRoot, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			// Skip vendor + .git + node_modules — not our code.
+			base := info.Name()
+			if base == "vendor" || base == ".git" || base == "node_modules" || base == "testdata" {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		ext := filepath.Ext(path)
+		base := filepath.Base(path)
+		if !checkExt[ext] && !checkBasename[base] {
+			return nil
+		}
+		rel, _ := filepath.Rel(moduleRoot, path)
+		if allowlistedFiles[rel] {
+			return nil
+		}
+		// Skip the lint test itself — it legitimately names the forbidden
+		// strings as match patterns.
+		if strings.HasSuffix(rel, "import_path_lint_test.go") {
+			return nil
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		text := string(data)
+		for _, bad := range forbiddenSubstrings {
+			if strings.Contains(text, bad) {
+				// Find the line number for a useful error message.
+				for lineNo, line := range strings.Split(text, "\n") {
+					if strings.Contains(line, bad) {
+						t.Errorf("%s:%d — forbidden substring %q (use go.moleculesai.app/<area>/... per molecule-ai/internal#71)", rel, lineNo+1, bad)
+						violations++
+						break
+					}
+				}
+			}
+		}
+		return nil
+	})
+	if walkErr != nil {
+		t.Fatalf("walk: %v", walkErr)
+	}
+	if violations > 0 {
+		t.Logf("Total violations: %d. Add to allowlistedFiles ONLY with a documented justification.", violations)
+	}
+}
+
+// findModuleRoot walks up from the test's CWD to find go.mod. The Go
+// test harness sets CWD to the package directory; the module root may
+// be one or more parents up.
+func findModuleRoot() (string, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	dir := cwd
+	for {
+		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
+			return dir, nil
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return "", os.ErrNotExist
+		}
+		dir = parent
+	}
+}

known-issues.md

@@ -93,7 +93,7 @@ entries may cause CI divergence or checksum mismatches.
 
 ### Impact
 `go mod verify` in CI may fail if `go.sum` has extra entries not in the
- lock file. Additionally, if the module path (`github.com/Molecule-AI/molecule-cli`)
+ lock file. Additionally, if the module path (`go.moleculesai.app/cli`)
  is referenced via `replace` directives from other repos, those references may
 persist stale entries.
 
@@ -130,24 +130,29 @@ is set to `.` (repo root) since the main package is at `cmd/molecule`.
 
 ## KI-005 — No integration test for the full CLI lifecycle
 
-**File:** `tests/` (does not exist)  
-**Status:** Not yet implemented  
+**File:** `cmd/molecule/molecule_test.go`, `internal/`  
+**Status:** ✅ Resolved  
 **Severity:** Medium
 
-### Symptom
-There are no tests at all (per `go test ./...` — no packages match).
-As subcommands are built, there is no test harness for end-to-end CLI testing
-(e.g. `molecule workspace create --name test --output json` → verify JSON output).
+### Resolution
+`cmd/molecule/molecule_test.go` contains 32 table-driven integration tests
+covering the full CLI command surface. Each test:
+- Starts a `httptest.Server` that mirrors the platform REST API (workspace CRUD,
+  agent inspection, delegation, health, audit, config, completion scripts).
+- Builds the `molecule` binary via `go build -o <tempdir>/molecule .`
+- Executes it with `exec.Command` and validates stdout/stderr output.
 
-### Impact
-Each subcommand will be shipped without regression protection. Manual testing
-is required for every release. The absence of a `tests/` directory also means
-there is no fixture for CLI integration testing with recorded API responses.
+Test coverage includes:
+- Root help, workspace/agent/platform/config help
+- `workspace list`, `workspace inspect`, `workspace create`, `workspace delete`,
+  `workspace restart`, `workspace audit`, `workspace delegate`
+- `agent list`, `agent inspect`, `agent send`, `agent peers`
+- `platform health`, `platform audit`
+- `config init`, `config list`
+- `init`, `init --force`
+- `completion bash/zsh/fish/powershell`
+- Error paths: missing workspace, missing agent, unknown subcommand,
+  missing required args, duplicate init
 
-### Suggested fix
-Add `tests/` with:
-- `cmd/molecule/molecule_test.go` — table-driven tests for each subcommand
-  using `exec.Command("molecule", ...)` against a built binary
-- Use `molecule-sdk-python` fixture server or recorded API responses for
-  offline testing
-- Add `go test ./...` to CI; require >0 test packages before merge
+Run `go test ./...` from the repo root to execute. No live platform required —
+all tests use `httptest.Server` fixtures.