fix(provisioner): export MOLECULE_MODEL (canonical model env) + read it first; drop stray brace in delegation_test.go

internal#226 follow-up #1. `molecule_runtime.config` resolves the picked model as `MOLECULE_MODEL` > `MODEL` > (legacy) `MODEL_PROVIDER` (#280) — this side of the boundary now matches: - applyRuntimeModelEnv reads `MOLECULE_MODEL` ahead of `MODEL` / `MODEL_PROVIDER`, and exports BOTH `MOLECULE_MODEL` and `MODEL` (the latter kept for back-compat with everything that already reads `os.environ["MODEL"]`). So a workspace whose secrets carry `MOLECULE_MODEL` (the unambiguous name) is honoured, and the `MODEL_PROVIDER` misnomer — which got set to provider slugs ("minimax") and even runtime names ("claude-code") — is the lowest- priority fallback, exactly as on the runtime side. - the resolution-order comment is updated to flag MODEL_PROVIDER as the legacy-and-misleadingly-named var. Also drops a stray trailing `}` in delegation_test.go (committed in 97768272 "test(delegation): add isDeliveryConfirmedSuccess helper") that made `internal/handlers` fail to parse — one of the things keeping the package from compiling for tests. Tests: TestApplyRuntimeModelEnv_SetsUniversalMODELForAllRuntimes extended to assert MOLECULE_MODEL mirrors MODEL on every case, plus two new cases (MOLECULE_MODEL env fallback; MOLECULE_MODEL beats MODEL_PROVIDER). Could not run `go test ./internal/handlers/` locally — the package is still blocked behind `internal/plugins` `SourceResolver` redeclaration (the #248 plugin-router/resolver refactor, Core-BE's lane); CI validates once that lands. The applyRuntimeModelEnv change is mechanical (same shape as the existing `MODEL` handling) — reviewer please eyeball. Companion: molecule-core#280 (runtime config.py side), molecule-ai-workspace-template-claude-code#14 (CLI-stream-error surfacing). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Merge pull request 'fix(internal#214): refresh go.sum for the go.moleculesai.app vanity path' (#247 ) from fix/internal-214-gosum-vanity-import into main
2026-05-10 03:11:41 -07:00 · 2026-05-10 09:02:33 +00:00 · 2026-05-10 09:02:04 +00:00 · 2026-05-10 08:57:54 +00:00 · 2026-05-10 07:55:39 +00:00 · 2026-05-09 23:55:20 -07:00
9 changed files with 90 additions and 118 deletions
@@ -180,7 +180,7 @@ jobs:
        # environment pypi-publish. The action mints a short-lived OIDC
        # token and exchanges it for a PyPI upload credential — no static
        # API token in this repo's secrets.
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
        with:
          packages-dir: ${{ runner.temp }}/runtime-build/dist/

@@ -48,7 +48,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
@@ -1,12 +1,10 @@
 # Staging Environment Design

-> **Status:** In Progress — Phase 36. Partially implemented. The image pipeline
-> (`:staging-<sha>`, `:staging-latest` tags on ECR) is live. Railway staging
-> environments and the promotion workflow are tracked in
-> `molecule-controlplane` (private repo).
+> **Status:** Planned — gates all future infra changes (Tunnel migration,
+> security fixes, etc.)
 >
 > **Problem:** We merge directly to main and auto-deploy to production.
-> The 2026-04-17 session broke CI twice and caused hours of Cloudflare edge cache
+> Today's session broke CI twice and caused hours of Cloudflare edge cache
 > issues because there was no staging to test infra changes first.
 >
 > **Goal:** Full staging environment that mirrors production. Every change
@@ -55,28 +53,6 @@ Developer pushes to PR branch

 ## Components

-### 0. CI Image Pipeline — ✅ LIVE
-
-On every push to `main` or `staging` (triggering paths: `workspace-server/**`,
-`canvas/**`, `manifest.json`, `scripts/**`), the Gitea Actions workflow
-(`.gitea/workflows/publish-workspace-server-image.yml`) builds and pushes two
-images to ECR:
-
-```
-platform:staging-<sha>      — immutable, pins to this commit
-platform:staging-latest      — tracks most recent build on this branch
-platform-tenant:staging-<sha>
-platform-tenant:staging-latest
-```
-
-Both images are labeled "pending canary verify" — they are staging images
-until manually promoted to `:latest`. See the workflow file for the full
-pre-clone step (manifest deps → `.tenant-bundle-deps/`), ECR auth, and build
-args.
-
-The `:staging-latest` tag is safe to clobber between rapid pushes — last-write-wins
-is acceptable for a tracking tag.
-
 ### 1. Railway: two environments

 Railway supports multiple environments per project. Create a `staging`
@@ -219,16 +195,15 @@ Until the automated workflow is built:

 ## Implementation order

-1. **Publish workflow** — ✅ DONE. `.gitea/workflows/publish-workspace-server-image.yml`
-   pushes `:staging-<sha>` + `:staging-latest` on every `main`/`staging` push.
-2. **Railway staging environment** — in `molecule-controlplane` (private)
-3. **Neon staging branch** — in `molecule-controlplane` (private)
-4. **Staging DNS** — `staging.api.moleculesai.app` CNAME to Railway (~5 min)
+1. **Railway staging environment** — create + configure vars (~30 min)
+2. **Neon staging branch** — create from main (~5 min)
+3. **Staging DNS** — `staging.api.moleculesai.app` CNAME to Railway (~5 min)
+4. **Publish workflow** — push `:staging` tag instead of `:latest` (~15 min)
 5. **Promotion workflow** — manual trigger to promote staging → production (~30 min)
 6. **Vercel staging** — configure preview deployment URL (~15 min)
 7. **Staging smoke test** — automated test after staging deploy (~30 min)

-**Done in public repo:** items 1. **Remaining:** items 2–7 (tracked in `molecule-controlplane`).
+**Total:** ~2.5 hours for full staging pipeline.

 ## Cost

@@ -1,7 +1,7 @@
 # Phase 30 Remote Workspaces — Customer FAQ

 > **Cycle:** Marketing work cycle — offline content prep
-> **Status:** Live — updated 2026-05-10 to reflect actual onboarding path
+> **Status:** Draft — needs review from Marketing Lead and Doc Specialist before publishing

 Top customer and sales-engineer questions about Phase 30 Remote Workspaces, answered in a format ready to drop into the docs site or adapt for the support team.

@@ -11,11 +11,11 @@ Top customer and sales-engineer questions about Phase 30 Remote Workspaces, answ

 **Q: What's the difference between a "container" workspace and a "remote" workspace?**

-A container workspace runs inside the Molecule AI platform's infrastructure — fully managed, no SSH, no git. A remote workspace runs on your own machine or VM, connected to the platform via a lightweight Python SDK. You control the environment (OS, packages, git config, SSH keys); the platform handles orchestration, authentication, and agent coordination.
+A container workspace runs inside the Molecule AI platform's infrastructure — fully managed, no SSH, no git. A remote workspace runs on your own machine or VM, connected to the platform via a lightweight agent. You control the environment (OS, packages, git config, SSH keys); the platform handles orchestration, authentication, and agent coordination.

 **Q: Do remote workspaces still appear in the Canvas UI?**

-Yes. Remote workspaces register with the platform on startup and appear in Canvas exactly like managed workspaces — online/offline status, workspace name, current task. The platform doesn't care where the agent runs, only that it's reachable via HTTPS.
+Yes. Remote workspaces register with the platform on startup and appear in Canvas exactly like managed workspaces — online/offline status, workspace name, current task. The platform doesn't care where the agent runs, only that it's reachable.

 **Q: Can I run both container and remote workspaces in the same org?**

@@ -23,7 +23,7 @@ Yes — in fact that's the primary pattern. A fleet might have 5 container works

 **Q: What does the remote runtime actually install on my machine?**

-The `molecule-ai-sdk` Python package (~1MB, only `requests` as a dependency). The SDK wraps all Phase 30 protocol calls. Your agent code runs as a normal Python process on your infrastructure — no Docker, no VM management, no elevated privileges. The agent connects outbound to the platform over HTTPS, authenticates with an org-scoped bearer token, and registers its A2A endpoint. That's it — no VPN, no inbound firewall holes beyond outbound HTTPS.
+The agent binary (~30MB) plus a minimal bootstrap script. No root required. The agent connects to `wss://[your-org].moleculesai.app`, authenticates with your org token, and registers its A2A endpoint. That's it — no VPN, no firewall holes beyond outbound HTTPS.

 ---

@@ -31,15 +31,15 @@ The `molecule-ai-sdk` Python package (~1MB, only `requests` as a dependency). Th

 **Q: How does the platform authenticate a remote workspace?**

-Remote workspaces authenticate with a workspace-scoped bearer token. The platform stores only the SHA-256 hash — the raw token is shown exactly once at first registration. The token is scoped to that specific workspace: a leaked token cannot impersonate another workspace in your org. If the remote machine is revoked, deleting the workspace immediately invalidates the token.
+Remote workspaces authenticate with an org-scoped bearer token (not a personal token). The platform validates the token against the tenant and provisions a session-scoped credential for A2A communication. If the remote machine is revoked from the org, the token is invalidated and the workspace goes offline within one heartbeat cycle (~15s).

 **Q: Can a remote workspace make outbound connections my firewall would block?**

-The SDK only makes outbound HTTPS calls to the platform. It does not accept inbound connections. Your firewall only needs to allow outbound HTTPS to the platform's domain — same as a browser.
+The agent only makes outbound HTTPS/WSS connections to the platform. It does not accept inbound connections. Your firewall only needs to allow `*.moleculesai.app` outbound — same as a browser.

 **Q: What happens to data if the remote workspace is disconnected or the machine is wiped?**

-Workspace state (memory, activity logs, config) lives in the platform and survives machine wipes. If the agent reconnects, it re-registers and Canvas picks up where it left off. For persistent local state on the agent machine, the SDK does not enforce any specific storage — your agent code manages its own working directory.
+Workspace state lives in the platform unless explicitly persisted. For remote workspaces, you can attach a Cloudflare Artifacts repo to snapshot state to disk on your own infrastructure. If the agent reconnects, it re-registers and Canvas picks up where it left off.

 **Q: Are remote workspaces covered by the same MCP governance controls as container workspaces?**

@@ -51,59 +51,26 @@ Yes. MCP plugin allowlists, org API key auditing, and workspace-level audit logs

 **Q: How do I get started with a remote workspace?**

-1. **Install the SDK:** `pip install molecule-ai-sdk`
-2. **Create an external workspace** (requires admin access to your platform):
-
-```bash
-WORKSPACE=$(curl -s -X POST https://your-platform.example.com/workspaces \
-  -H "Authorization: Bearer $ADMIN_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{"name":"my-agent","runtime":"external","tier":2}')
-WORKSPACE_ID=$(echo $WORKSPACE | jq -r '.id')
-echo $WORKSPACE_ID   # save this — needed by the agent
-```
-
-3. **Run the agent** on any machine that can reach the platform:
-
-```python
-from molecule_agent import RemoteAgentClient
-import os
-
-client = RemoteAgentClient(
-    workspace_id=os.environ["WORKSPACE_ID"],
-    platform_url=os.environ["PLATFORM_URL"],
-    agent_card={"name": "my-agent", "skills": ["research"]},
-)
-client.register()           # issues + caches bearer token
-secrets = client.pull_secrets()   # fetch workspace secrets
-print("Secrets:", list(secrets.keys()))
-
-# Heartbeat loop — keeps workspace visible on Canvas
-client.run_heartbeat_loop()
-```
-
-4. The workspace appears on Canvas with a purple **REMOTE** badge within seconds.
-
-For the full protocol reference (direct HTTP, Node.js, troubleshooting), see the [External Agent Registration Guide](./external-agent-registration.md).
+1. Install the agent: `curl -sSL https://get.moleculesai.app | bash`
+2. Authenticate: `molecule login --org your-org`
+3. Bootstrap: `molecule workspace init --name my-agent --runtime remote`
+4. The workspace registers with the platform and appears in Canvas within ~10 seconds.

 **Q: Can I use my existing SSH keys and git config with a remote workspace?**

-Yes. The remote SDK does not virtualize or override your shell environment. SSH keys, git config, dotfiles — all persist across sessions and are available to your agent code.
+Yes. The remote runtime does not virtualize or override your shell environment. SSH keys, git config, dotfiles — all persist across sessions and are available to the agent.

-**Q: How do I update the remote agent when a new SDK version ships?**
+**Q: How do I update the remote agent when a new version ships?**

-```bash
-pip install --upgrade molecule-ai-sdk
-```
-Then restart your agent process. Zero downtime if the agent reconnects within the heartbeat window (~30s).
+`molecule update` — pulls the latest agent binary from the platform, does a rolling restart. Zero downtime if the agent reconnects within the heartbeat window.

 **Q: What's the latency like for A2A coordination between a remote workspace and a container workspace?**

-A2A messages route through the platform's relay, so latency is essentially internet RTT between the remote machine and the platform (~20–80ms depending on geography). For comparison, container workspaces on-platform have <5ms RTT. The practical difference for most coordination patterns is imperceptible.
+A2A messages route through the platform's relay, so latency is essentially internet RTT between the remote machine and the platform's edge (~20–80ms depending on geography). For comparison, container workspaces on-platform have <5ms RTT. The practical difference for most coordination patterns is imperceptible.

 **Q: Can I run a remote workspace on a machine that's behind NAT with no public IP?**

-Yes. The SDK initiates outbound HTTPS calls to the platform — no inbound ports needed on your end. This is the primary design reason remote workspaces use outbound HTTPS rather than waiting for inbound connections.
+Yes. The agent initiates the outbound WebSocket connection to the platform — no inbound ports needed. This is the primary design reason remote workspaces use WSS rather than HTTP.

 ---

@@ -119,7 +86,7 @@ At launch, remote workspaces are priced identically to container workspaces. Fut

 **Q: What's the maximum concurrent task throughput for a single remote workspace?**

-Same as a container workspace — up to 5 concurrent delegated tasks. The remote SDK adds no throughput cap.
+Same as a container workspace — up to 5 concurrent delegated tasks. Remote runtime adds no throughput cap.

 ---

@@ -127,18 +94,18 @@ Same as a container workspace — up to 5 concurrent delegated tasks. The remote

 **Q: Remote workspace shows offline in Canvas but the process is running on my machine.**

-1. Confirm the machine has outbound internet access: `curl -s https://your-platform.example.com/health`
-2. Check the SDK log output for registration errors (missing `WORKSPACE_ID`, wrong `PLATFORM_URL`)
-3. Verify the bearer token is valid — re-register with `client.register()` to confirm
-4. Check network path: `curl -v -X POST https://your-platform.example.com/registry/heartbeat` with the token
+1. Check the agent log: `molecule logs --workspace my-agent`
+2. Confirm the machine has outbound internet access: `curl -s https://[your-org].moleculesai.app/health`
+3. Check token validity: `molecule auth status` — re-authenticate if expired
+4. Restart the agent: `molecule restart --workspace my-agent`

 **Q: A2A messages to my remote workspace are timing out.**

-The agent must call `/registry/heartbeat` every 30 seconds to stay online. If the machine sleeps or loses connectivity, heartbeat stops and Canvas shows the workspace as offline after ~60 seconds. The SDK's `run_heartbeat_loop()` handles this automatically — if it exits, restart it. On reconnect, the agent re-registers and Canvas returns to online.
+Remote workspaces must maintain the outbound WebSocket connection. If the machine sleeps or loses connectivity, the connection drops and A2A messages queue for up to 5 minutes before failing. The agent will re-register on reconnect — Canvas will show it back online.

 **Q: My remote workspace is online but can't reach internal APIs.**

-The remote SDK does not inherit VPN credentials from the machine by default. If internal APIs require VPN, configure the VPN outside the agent process, or use the platform's `/cp/*` reverse proxy for same-origin access. See [same-origin-canvas-fetches](./same-origin-canvas-fetches.md) for details.
+The remote runtime does not inherit VPN credentials from the machine by default. If internal APIs require VPN, you'll need to either configure the VPN on the host machine outside the agent, or use the platform's `/cp/*` reverse proxy for same-origin access (same-origin-canvas-fetches.md).

 ---

@@ -154,4 +121,4 @@ Modal and Railway are inference platforms — they run your code on their infras

 ---

-*Technical accuracy review: Technical Writer — 2026-05-10. Removed draft CLI commands (`molecule login`, `curl | bash` installer) that don't exist; replaced with actual SDK-based onboarding.*
+*Needs review from: Marketing Lead (voice + accuracy), Doc Specialist (technical accuracy), possibly Support for the troubleshooting section.*
@@ -4,7 +4,6 @@ go 1.25.0

 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.2
-	go.moleculesai.app/plugin/gh-identity v0.0.0-20260509010445-788988195fce
 	github.com/alicebob/miniredis/v2 v2.37.0
 	github.com/creack/pty v1.1.24
 	github.com/docker/docker v28.5.2+incompatible
@@ -19,6 +18,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/redis/go-redis/v9 v9.19.0
 	github.com/robfig/cron/v3 v3.0.1
+	go.moleculesai.app/plugin/gh-identity v0.0.0-20260509010445-788988195fce
 	golang.org/x/crypto v0.50.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -4,8 +4,6 @@ github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7Oputl
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Molecule-AI/molecule-ai-plugin-gh-identity v0.0.0-20260424033845-4fd5ac7be30f h1:YkLRhUg+9qr9OV9N8dG1Hj0Ml7TThHlRwh5F//oUJVs=
-github.com/Molecule-AI/molecule-ai-plugin-gh-identity v0.0.0-20260424033845-4fd5ac7be30f/go.mod h1:NqdtlWZDJvpXNJRHnMkPhTKHdA1LZTNH+63TB66JSOU=
 github.com/alicebob/miniredis/v2 v2.37.0 h1:RheObYW32G1aiJIj81XVt78ZHJpHonHLHW7OLIshq68=
 github.com/alicebob/miniredis/v2 v2.37.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
@@ -154,6 +152,8 @@ github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M
 github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
+go.moleculesai.app/plugin/gh-identity v0.0.0-20260509010445-788988195fce h1:ftm0ba0ukLlfqeFes+/jWnXH8XULXmRpMy3fOCZ83/U=
+go.moleculesai.app/plugin/gh-identity v0.0.0-20260509010445-788988195fce/go.mod h1:0aAqoDle2V7Cywso94MXdv1DH/HEe/0oZmcbqWYMK7g=
 go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
 go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -1262,4 +1262,3 @@ func TestExecuteDelegation_CleanProxyResponse_Unchanged(t *testing.T) {
 		t.Errorf("unmet sqlmock expectations: %v", err)
 	}
 }
-}
@@ -717,13 +717,16 @@ func deriveProviderFromModelSlug(model string) string {
 func applyRuntimeModelEnv(envVars map[string]string, runtime, model string) {
 	// Resolution order (priority high → low):
 	//   1. payload.Model (caller passed the canvas-picked model id verbatim)
-	//   2. envVars["MODEL"]  (workspace_secret persisted by /org/import via
+	//   2. envVars["MOLECULE_MODEL"]  (the canonical, unambiguous name)
+	//   3. envVars["MODEL"]  (workspace_secret persisted by /org/import via
 	//      the persona env file — MODEL=MiniMax-M2.7-highspeed etc.)
-	//   3. envVars["MODEL_PROVIDER"] (legacy: this secret was historically a
-	//      *model id* set by canvas Save+Restart's PUT /model; on the
-	//      post-2026-05-08 persona-env convention it's a *provider slug*
-	//      (e.g. "minimax") which is NOT a valid model id, so this fallback
-	//      only fires when MODEL is absent.)
+	//   4. envVars["MODEL_PROVIDER"] (legacy + misleadingly named: it carries
+	//      a *model id*, never the provider — that's LLM_PROVIDER. Historically
+	//      set by canvas Save+Restart's PUT /model; the post-2026-05-08
+	//      persona-env convention sometimes (mis)set it to a provider slug
+	//      ("minimax") or a runtime name ("claude-code"), neither a valid
+	//      model id — see internal#226. Only fires when the better-named
+	//      vars are absent.)
 	//
 	// Pre-fix bug: this function unconditionally OVERWROTE envVars["MODEL"]
 	// with the MODEL_PROVIDER slug (when payload.Model was empty), wiping
@@ -736,6 +739,9 @@ func applyRuntimeModelEnv(envVars map[string]string, runtime, model string) {
 	// and the workspace template's adapter routed to providers[0]
 	// (anthropic-oauth) and wedged at SDK initialize. Caught 2026-05-08
 	// during Phase 4 verification of template-claude-code PR #9.
+	if model == "" {
+		model = envVars["MOLECULE_MODEL"]
+	}
 	if model == "" {
 		model = envVars["MODEL"]
 	}
@@ -746,16 +752,18 @@ func applyRuntimeModelEnv(envVars map[string]string, runtime, model string) {
 		return
 	}

-	// Universal MODEL env var — every adapter that wants to honour the
-	// canvas-picked model (instead of its template's default) reads this.
-	// molecule-runtime's workspace/config.py already falls back to MODEL
-	// for runtime_config.model (#194). Without this line, the user's
-	// canvas selection is silently dropped on every templated provision —
-	// confirmed via crash-loop diagnosis on 2026-05-02 where MiniMax
-	// picks booted with model=sonnet (template default) and demanded
-	// CLAUDE_CODE_OAUTH_TOKEN. Set it FIRST so the per-runtime branches
-	// below can still layer on additional vendor-specific names without
-	// fighting over the canonical one.
+	// Canonical model env vars — molecule-runtime's workspace/config.py
+	// resolves the picked model as MOLECULE_MODEL > MODEL > (legacy)
+	// MODEL_PROVIDER (#280). Export both new names so adapters can read
+	// either; MODEL stays for backwards compat with everything that
+	// already reads os.environ["MODEL"] (the claude-code adapter does,
+	// since #194). Without this, the user's canvas selection is silently
+	// dropped on every templated provision — confirmed via crash-loop
+	// diagnosis on 2026-05-02 where MiniMax picks booted with model=sonnet
+	// (template default) and demanded CLAUDE_CODE_OAUTH_TOKEN. Set these
+	// FIRST so the per-runtime branches below can layer on additional
+	// vendor-specific names without fighting over the canonical one.
+	envVars["MOLECULE_MODEL"] = model
 	envVars["MODEL"] = model

 	switch runtime {
@@ -665,46 +665,62 @@ func TestApplyRuntimeModelEnv_SetsUniversalMODELForAllRuntimes(t *testing.T) {
 		runtime           string
 		model             string
 		modelProviderEnv  string
+		moleculeModelEnv  string
 		wantMODEL         string
 		wantHermesDefault string // empty string = must be unset
 	}{
 		{
-			name:      "claude-code: picked model populates MODEL",
+			name:      "claude-code: picked model populates MODEL + MOLECULE_MODEL",
 			runtime:   "claude-code",
 			model:     "MiniMax-M2",
 			wantMODEL: "MiniMax-M2",
 		},
 		{
-			name:              "hermes: picked model populates BOTH MODEL and HERMES_DEFAULT_MODEL",
+			name:              "hermes: picked model populates MODEL, MOLECULE_MODEL, HERMES_DEFAULT_MODEL",
 			runtime:           "hermes",
 			model:             "minimax/MiniMax-M2.7",
 			wantMODEL:         "minimax/MiniMax-M2.7",
 			wantHermesDefault: "minimax/MiniMax-M2.7",
 		},
 		{
-			name:      "langgraph: picked model populates MODEL (no vendor-specific name)",
+			name:      "langgraph: picked model populates MODEL + MOLECULE_MODEL (no vendor-specific name)",
 			runtime:   "langgraph",
 			model:     "anthropic:claude-opus-4-7",
 			wantMODEL: "anthropic:claude-opus-4-7",
 		},
 		{
-			name:      "crewai: picked model populates MODEL (no vendor-specific name)",
+			name:      "crewai: picked model populates MODEL + MOLECULE_MODEL (no vendor-specific name)",
 			runtime:   "crewai",
 			model:     "openai:gpt-4o",
 			wantMODEL: "openai:gpt-4o",
 		},
 		{
-			name:    "empty model + empty MODEL_PROVIDER fallback: nothing set",
+			name:    "empty model + no env fallback: nothing set",
 			runtime: "claude-code",
 			model:   "",
 		},
 		{
-			name:             "empty model + MODEL_PROVIDER fallback hits: MODEL set from secret",
+			name:             "empty model + MODEL_PROVIDER fallback hits: MODEL/MOLECULE_MODEL set from secret",
 			runtime:          "claude-code",
 			model:            "",
 			modelProviderEnv: "MiniMax-M2",
 			wantMODEL:        "MiniMax-M2",
 		},
+		{
+			name:             "empty model + MOLECULE_MODEL env fallback hits (canonical name)",
+			runtime:          "claude-code",
+			model:            "",
+			moleculeModelEnv: "opus",
+			wantMODEL:        "opus",
+		},
+		{
+			name:             "MOLECULE_MODEL beats MODEL_PROVIDER when both set (misnomer guard, internal#226)",
+			runtime:          "claude-code",
+			model:            "",
+			moleculeModelEnv: "opus",
+			modelProviderEnv: "claude-code",
+			wantMODEL:        "opus",
+		},
 	}

 	for _, tc := range cases {
@@ -713,11 +729,18 @@ func TestApplyRuntimeModelEnv_SetsUniversalMODELForAllRuntimes(t *testing.T) {
 			if tc.modelProviderEnv != "" {
 				envVars["MODEL_PROVIDER"] = tc.modelProviderEnv
 			}
+			if tc.moleculeModelEnv != "" {
+				envVars["MOLECULE_MODEL"] = tc.moleculeModelEnv
+			}
 			applyRuntimeModelEnv(envVars, tc.runtime, tc.model)

 			if got := envVars["MODEL"]; got != tc.wantMODEL {
 				t.Errorf("MODEL = %q, want %q", got, tc.wantMODEL)
 			}
+			// MOLECULE_MODEL (the canonical name) must mirror MODEL exactly.
+			if got := envVars["MOLECULE_MODEL"]; got != tc.wantMODEL {
+				t.Errorf("MOLECULE_MODEL = %q, want %q", got, tc.wantMODEL)
+			}
 			if got := envVars["HERMES_DEFAULT_MODEL"]; got != tc.wantHermesDefault {
 				t.Errorf("HERMES_DEFAULT_MODEL = %q, want %q", got, tc.wantHermesDefault)
 			}
Author	SHA1	Message	Date
hongming-pc2	9b930d8e39	fix(provisioner): export MOLECULE_MODEL (canonical model env) + read it first; drop stray brace in delegation_test.go sop-tier-check / tier-check (pull_request) Failing after 17s Details Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 20s Details audit-force-merge / audit (pull_request) Successful in 6s Details internal#226 follow-up #1. `molecule_runtime.config` resolves the picked model as `MOLECULE_MODEL` > `MODEL` > (legacy) `MODEL_PROVIDER` (#280) — this side of the boundary now matches: - applyRuntimeModelEnv reads `MOLECULE_MODEL` ahead of `MODEL` / `MODEL_PROVIDER`, and exports BOTH `MOLECULE_MODEL` and `MODEL` (the latter kept for back-compat with everything that already reads `os.environ["MODEL"]`). So a workspace whose secrets carry `MOLECULE_MODEL` (the unambiguous name) is honoured, and the `MODEL_PROVIDER` misnomer — which got set to provider slugs ("minimax") and even runtime names ("claude-code") — is the lowest- priority fallback, exactly as on the runtime side. - the resolution-order comment is updated to flag MODEL_PROVIDER as the legacy-and-misleadingly-named var. Also drops a stray trailing `}` in delegation_test.go (committed in `97768272` "test(delegation): add isDeliveryConfirmedSuccess helper") that made `internal/handlers` fail to parse — one of the things keeping the package from compiling for tests. Tests: TestApplyRuntimeModelEnv_SetsUniversalMODELForAllRuntimes extended to assert MOLECULE_MODEL mirrors MODEL on every case, plus two new cases (MOLECULE_MODEL env fallback; MOLECULE_MODEL beats MODEL_PROVIDER). Could not run `go test ./internal/handlers/` locally — the package is still blocked behind `internal/plugins` `SourceResolver` redeclaration (the #248 plugin-router/resolver refactor, Core-BE's lane); CI validates once that lands. The applyRuntimeModelEnv change is mechanical (same shape as the existing `MODEL` handling) — reviewer please eyeball. Companion: molecule-core#280 (runtime config.py side), molecule-ai-workspace-template-claude-code#14 (CLI-stream-error surfacing). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-10 03:11:41 -07:00
claude-ceo-assistant	3c0d00b43f	Merge pull request 'fix(internal#214): refresh go.sum for the go.moleculesai.app vanity path' (#247 ) from fix/internal-214-gosum-vanity-import into main Secret scan / Scan diff for credential-shaped strings (push) Successful in 14s Details publish-workspace-server-image / build-and-push (push) Failing after 2m14s Details	2026-05-10 09:02:33 +00:00
claude-ceo-assistant	360321db53	Merge branch 'main' into fix/internal-214-gosum-vanity-import sop-tier-check / tier-check (pull_request) Successful in 14s Details Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 15s Details audit-force-merge / audit (pull_request) Successful in 14s Details	2026-05-10 09:02:04 +00:00
claude-ceo-assistant	1a9168d632	Merge pull request 'ci: pin GitHub Actions by SHA instead of mutable tags' (#261 ) from ci/pin-action-and-base-images into main Secret scan / Scan diff for credential-shaped strings (push) Successful in 4s Details	2026-05-10 08:57:54 +00:00
core-devops	03689e3d9a	ci: pin GitHub Actions by SHA instead of mutable tags Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s Details sop-tier-check / tier-check (pull_request) Successful in 5s Details audit-force-merge / audit (pull_request) Successful in 6s Details - actions/checkout@v6 → @de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2) in secret-pattern-drift.yml - pypa/gh-action-pypi-publish@release/v1 → @cef221092ed1bacb1cc03d23a2d87d1d172e277b in publish-runtime.yml Mutable action tags (e.g. @v6, @release/v1) can silently resolve to different code over time, creating supply-chain risk. SHA-pinning ensures the exact commit runs every time. Workspace Dockerfile was already compliant (python:3.11-slim@sha256:...). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-10 07:55:39 +00:00
hongming-pc2	67840629eb	fix(internal#214): refresh go.sum for the go.moleculesai.app/plugin/gh-identity vanity path audit-force-merge / audit (pull_request) Has been skipped Details sop-tier-check / tier-check (pull_request) Successful in 6s Details Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 6s Details go.sum still carried the pre-suspension github.com/Molecule-AI/molecule-ai-plugin-gh-identity entries while go.mod requires go.moleculesai.app/plugin/gh-identity — so `go build` failed with 'missing go.sum entry'. With the go.moleculesai.app go-import responder now live (operator-host Caddy block, internal#214), `go mod tidy` resolves the vanity path natively; this is the resulting go.sum (no replace directive, no go.mod change beyond the tidy). Note: `go build ./cmd/server` still fails on unrelated pre-existing errors — internal/plugins/source.go vs drift_sweeper.go SourceResolver redeclaration (#123) and internal/router/router.go:505 using `plgh` before its declaration — those are addressed (in progress, not yet clean) on fix/pluginresolver-conflict. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-09 23:55:20 -07:00