fix(ci): align TEMPLATES cascade list with manifest.json workspace_templates

The cascade-list-drift-gate structural gate (RFC #388 PR-3) compares TEMPLATES in publish-runtime.yml against manifest.json's workspace_templates. Stale entries (crewai, deepagents, gemini-cli — repos that no longer exist) cause the gate to fail on any PR that touches manifest.json. Re-align TEMPLATES to the 6 templates that actually exist: claude-code, hermes, openclaw, codex, langgraph, autogen.
trigger: re-run qa/sec CI checks (SOP_TIER_CHECK_TOKEN now provisioned per KI-008)
2026-05-18 09:04:17 +00:00 · 2026-05-18 09:00:27 +00:00 · 2026-05-18 07:12:13 +00:00 · 2026-05-18 04:38:44 +00:00 · 2026-05-18 00:46:52 +00:00 · 2026-05-18 00:40:10 +00:00
16 changed files with 409 additions and 59 deletions
@@ -44,7 +44,10 @@ REQUIRED_CONTEXTS_RAW = _env(
    "REQUIRED_CONTEXTS",
    default=(
        "CI / all-required (pull_request),"
-        "sop-checklist / all-items-acked (pull_request)"
+        "sop-checklist / all-items-acked (pull_request),"
+        "E2E Chat / E2E Chat (pull_request),"
+        "qa-review / approved (pull_request),"
+        "security-review / approved (pull_request)"
    ),
 )
 # Required contexts for push (main/staging) runs. The push CI uses the same
@@ -65,6 +68,11 @@ class ApiError(RuntimeError):
    pass


+class MergePermissionError(ApiError):
+    """Merge failed with a permanent permission error (403/404/405).
+    The queue should skip this PR and move to the next one."""
+
+
@dataclasses.dataclass(frozen=True)
 class MergeDecision:
    ready: bool
@@ -148,15 +156,38 @@ def latest_statuses_by_context(statuses: list[dict]) -> dict[str, dict]:
    return latest


+def _is_tier_low_pending_ok(
+    latest_statuses: dict[str, dict],
+    context: str,
+    pr_labels: set[str],
+) -> bool:
+    """Return True if tier:low PR can tolerate sop-checklist pending state.
+
+    Per sop-checklist-config.yaml tier_failure_mode, tier:low uses soft-fail:
+    sop-checklist posts state=pending when acks are satisfied (missing
+    manager/ceo acks are informational only). The queue should accept
+    pending instead of waiting for success.
+    """
+    if "tier:low" not in pr_labels:
+        return False
+    if "sop-checklist" not in context:
+        return False
+    status = latest_statuses.get(context) or {}
+    return status_state(status) == "pending"
+
+
 def required_contexts_green(
    latest_statuses: dict[str, dict],
    contexts: list[str],
+    pr_labels: set[str] | None = None,
 ) -> tuple[bool, list[str]]:
    missing_or_bad: list[str] = []
    for context in contexts:
        status = latest_statuses.get(context)
        state = status_state(status or {})
        if state != "success":
+            if pr_labels and _is_tier_low_pending_ok(latest_statuses, context, pr_labels):
+                continue  # tier:low soft-fail: accept pending sop-checklist
            missing_or_bad.append(f"{context}={state or 'missing'}")
    return not missing_or_bad, missing_or_bad

@@ -209,6 +240,7 @@ def evaluate_merge_readiness(
    pr_status: dict,
    required_contexts: list[str],
    pr_has_current_base: bool,
+    pr_labels: set[str] | None = None,
 ) -> MergeDecision:
    # Check push-required contexts explicitly instead of combined state.
    # Combined state can be "failure" due to non-blocking jobs
@@ -228,7 +260,7 @@ def evaluate_merge_readiness(
    # The required_contexts list is the authoritative gate — it includes only
    # the checks that actually block merges.
    latest = latest_statuses_by_context(pr_status.get("statuses") or [])
-    ok, missing_or_bad = required_contexts_green(latest, required_contexts)
+    ok, missing_or_bad = required_contexts_green(latest, required_contexts, pr_labels)
    if not ok:
        return MergeDecision(False, "wait", "required contexts not green: " + ", ".join(missing_or_bad))
    return MergeDecision(True, "merge", "ready")
@@ -253,27 +285,32 @@ def get_combined_status(sha: str) -> dict:
    _, combined = api("GET", f"/repos/{OWNER}/{NAME}/commits/{sha}/status")
    if not isinstance(combined, dict):
        raise ApiError(f"status for {sha} response not object")
-    # Fetch full statuses list; 200 covers >99% of real-world runs.
-    # The list is ordered ascending by id (oldest first) — callers must
-    # iterate in reverse to get the newest entry per context.
-    # Best-effort: large repos (main with 550+ statuses) may time out.
-    # On timeout, fall back to the statuses[] already in the combined
-    # response (usually 30 entries — enough for most PRs, enough for
-    # main's early push-required contexts).
+    combined_statuses: list[dict] = combined.get("statuses") or []
    try:
-        _, all_statuses = api(
+        _, all_statuses_raw = api(
            "GET",
            f"/repos/{OWNER}/{NAME}/commits/{sha}/statuses",
            query={"limit": "50"},
        )
-        if isinstance(all_statuses, list):
-            combined["statuses"] = all_statuses
+        if isinstance(all_statuses_raw, list):
+            all_statuses: list[dict] = list(all_statuses_raw)
+        else:
+            all_statuses = []
    except (ApiError, urllib.error.URLError, TimeoutError, OSError) as exc:
-        # URLError covers network-level failures (DNS, refused, timeout).
-        # TimeoutError and OSError cover socket-level timeouts.
        sys.stderr.write(f"::warning::could not fetch full statuses list for {sha[:8]}: {exc}\n")
-        # Fall back to the statuses[] already in the combined response.
-        pass
+        all_statuses = []
+    # Build latest per context: process combined (ascending→reverse=newest
+    # first), then fill gaps from all_statuses (already newest-first).
+    latest: dict[str, dict] = {}
+    for status in reversed(sorted(combined_statuses, key=lambda s: s.get("id") or 0)):
+        ctx = status.get("context")
+        if isinstance(ctx, str) and ctx not in latest:
+            latest[ctx] = status
+    for status in all_statuses:
+        ctx = status.get("context")
+        if isinstance(ctx, str) and ctx not in latest:
+            latest[ctx] = status
+    combined["statuses"] = list(latest.values())
    return combined


@@ -314,6 +351,25 @@ def post_comment(pr_number: int, body: str, *, dry_run: bool) -> None:
    api("POST", f"/repos/{OWNER}/{NAME}/issues/{pr_number}/comments", body={"body": body})


+def add_hold_label(pr_number: int, *, dry_run: bool) -> None:
+    """Apply the hold label so the queue skips this PR and processes the next."""
+    print(f"::notice::adding `{HOLD_LABEL}` to PR #{pr_number}")
+    if dry_run:
+        return
+    try:
+        api(
+            "POST",
+            f"/repos/{OWNER}/{NAME}/issues/{pr_number}/labels",
+            body={"labels": [HOLD_LABEL]},
+        )
+    except ApiError as exc:
+        # 404 = PR already closed/deleted; 422 = label already present (Gitea
+        # returns 422 for duplicate label assignment — not a real error).
+        if "404" in str(exc) or "422" in str(exc):
+            return
+        sys.stderr.write(f"::warning::could not add hold label to PR #{pr_number}: {exc}\n")
+
+
 def update_pull(pr_number: int, *, dry_run: bool) -> None:
    print(f"::notice::updating PR #{pr_number} with base branch via style={UPDATE_STYLE}")
    if dry_run:
@@ -338,7 +394,16 @@ def merge_pull(pr_number: int, *, dry_run: bool) -> None:
    print(f"::notice::merging PR #{pr_number}")
    if dry_run:
        return
-    api("POST", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/merge", body=payload, expect_json=False)
+    try:
+        api("POST", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}/merge", body=payload, expect_json=False)
+    except ApiError as exc:
+        # Re-raise permission-like errors so process_once can skip this PR.
+        # 403 = no push access, 404 = repo/pr not found, 405 = not allowed.
+        msg = str(exc)
+        for code in ("403", "404", "405"):
+            if code in msg:
+                raise MergePermissionError(msg) from exc
+        raise  # re-raise other ApiErrors unchanged


 def process_once(*, dry_run: bool = False) -> int:
@@ -380,11 +445,13 @@ def process_once(*, dry_run: bool = False) -> int:
    commits = get_pull_commits(pr_number)
    current_base = pr_has_current_base(pr, commits, main_sha)
    pr_status = get_combined_status(head_sha)
+    pr_labels = label_names(pr)
    decision = evaluate_merge_readiness(
        main_status=main_status,
        pr_status=pr_status,
        required_contexts=contexts,
        pr_has_current_base=current_base,
+        pr_labels=pr_labels,
    )

    print(f"::notice::PR #{pr_number} decision={decision.action}: {decision.reason}")
@@ -399,6 +466,22 @@ def process_once(*, dry_run: bool = False) -> int:
            dry_run=dry_run,
        )
        return 0
+    if decision.action == "wait":
+        # Required contexts are not green. Auto-hold so the queue stops cycling
+        # on this PR and processes the next. Holds are removed manually once the
+        # blocker (e.g. qa/sec gate, missing SOP_TIER_CHECK_TOKEN) is resolved.
+        add_hold_label(pr_number, dry_run=dry_run)
+        post_comment(
+            pr_number,
+            (
+                f"merge-queue: auto-held — required contexts not green: "
+                f"{decision.reason}. "
+                "Remove the `merge-queue-hold` label and re-label `merge-queue` "
+                "to restart queue processing once the blocker is resolved."
+            ),
+            dry_run=dry_run,
+        )
+        return 0
    if decision.ready:
        latest_main_sha = get_branch_head(WATCH_BRANCH)
        if latest_main_sha != main_sha:
@@ -407,7 +490,44 @@ def process_once(*, dry_run: bool = False) -> int:
                "deferring to next tick"
            )
            return 0
-        merge_pull(pr_number, dry_run=dry_run)
+        try:
+            merge_pull(pr_number, dry_run=dry_run)
+        except MergePermissionError as exc:
+            # HTTP 403/404/405. Distinguish status-check gate (405 with
+            # "Not all required status checks") from a genuine permission
+            # error. Case-insensitive match — Gitea uses "Not all required..."
+            # (capital N) while other paths may return lowercase.
+            msg_lower = str(exc).lower()
+            is_status_check_failure = "not all required status checks successful" in msg_lower
+            if is_status_check_failure:
+                # Gitea's merge gate blocked us — a required context (e.g.
+                # E2E Chat, qa-review, security-review) is failing. Auto-add
+                # hold so the queue skips this PR and processes the next.
+                add_hold_label(pr_number, dry_run=dry_run)
+                post_comment(
+                    pr_number,
+                    (
+                        "merge-queue: merge blocked by Gitea's status-check gate "
+                        "(E2E Chat, qa-review, security-review, or other required "
+                        "context failing). Auto-held via `merge-queue-hold`. "
+                        "Remove the hold label to requeue once CI is green."
+                    ),
+                    dry_run=dry_run,
+                )
+                return 0
+            # Genuine permission error — token lacks Can-merge.
+            sys.stderr.write(f"::error::merge permission error for PR #{pr_number}: {exc}\n")
+            post_comment(
+                pr_number,
+                (
+                    "merge-queue: merge failed with HTTP 405 'User not allowed to merge PR'. "
+                    "No available token has Can-merge permission on this repo. "
+                    "Fix: grant Can-merge to a token, or add a maintain/admin collaborator. "
+                    "Skipping to next queued PR on next tick."
+                ),
+                dry_run=dry_run,
+            )
+            return 0
        return 0
    return 0

@@ -118,3 +118,64 @@ def test_merge_decision_updates_stale_pr_before_merge():

    assert decision.ready is False
    assert decision.action == "update"
+
+
+def test_MergePermissionError_inherits_from_ApiError():
+    assert issubclass(mq.MergePermissionError, mq.ApiError)
+
+
+def test_MergePermissionError_message_preserved():
+    exc = mq.MergePermissionError("POST /merge -> HTTP 405: User not allowed")
+    assert "405" in str(exc)
+    assert "User not allowed" in str(exc)
+
+
+def test_merge_decision_waits_when_required_contexts_not_green():
+    """When a required context (e.g. qa-review, E2E Chat) is not success, the
+    decision is 'wait' — the queue can then auto-hold on this."""
+    required = [
+        "CI / all-required (pull_request)",
+        "sop-checklist / all-items-acked (pull_request)",
+        "qa-review / approved (pull_request)",
+    ]
+    decision = mq.evaluate_merge_readiness(
+        main_status={
+            "state": "success",
+            "statuses": [{"context": "CI / all-required (push)", "status": "success"}],
+        },
+        pr_status={
+            "state": "failure",
+            "statuses": [
+                {"context": "CI / all-required (pull_request)", "status": "success"},
+                {"context": "sop-checklist / all-items-acked (pull_request)", "status": "success"},
+                {"context": "qa-review / approved (pull_request)", "status": "failure"},
+            ],
+        },
+        required_contexts=required,
+        pr_has_current_base=True,
+        pr_labels=None,
+    )
+    assert decision.ready is False
+    assert decision.action == "wait"
+    assert "qa-review" in decision.reason
+
+
+def test_tier_low_sop_checklist_pending_soft_fail():
+    """tier:low PRs get soft-fail on sop-checklist: pending is accepted."""
+    required = ["sop-checklist / all-items-acked (pull_request)"]
+    statuses = {
+        "sop-checklist / all-items-acked (pull_request)": {"status": "pending"}
+    }
+    ok, missing = mq.required_contexts_green(statuses, required, pr_labels={"tier:low"})
+    assert ok is True
+    assert missing == []
+
+
+def test_tier_low_sop_checklist_failure_not_soft_fail():
+    """tier:low soft-fail only covers pending, not actual failure."""
+    required = ["sop-checklist / all-items-acked (pull_request)"]
+    statuses = {
+        "sop-checklist / all-items-acked (pull_request)": {"status": "failure"}
+    }
+    ok, missing = mq.required_contexts_green(statuses, required, pr_labels={"tier:low"})
+    assert ok is False
@@ -162,6 +162,7 @@ jobs:
            exit 1
          fi
          python -m twine upload \
+            --verbose \
            --repository pypi \
            --username __token__ \
            --password "$PYPI_TOKEN" \
@@ -266,7 +267,7 @@ jobs:
          fi

          GITEA_URL="${GITEA_URL:-https://git.moleculesai.app}"
-          TEMPLATES="claude-code hermes openclaw codex langgraph crewai autogen deepagents gemini-cli"
+          TEMPLATES="claude-code hermes openclaw codex langgraph autogen"
          FAILED=""
          SKIPPED=""

@@ -89,6 +89,7 @@ on:
 permissions:
  contents: read
  pull-requests: read
+  secrets: read  # required for SOP_TIER_CHECK_TOKEN team-membership probe

 jobs:
  # bp-exempt: PR review bot signal; required merge state is enforced by CI / all-required.
@@ -16,6 +16,7 @@ on:
 permissions:
  contents: read
  pull-requests: read
+  secrets: read  # required for SOP_TIER_CHECK_TOKEN team-membership probe

 jobs:
  # bp-exempt: PR security review bot signal; required merge state is enforced by CI / all-required.
@@ -30,10 +30,7 @@
    {"name": "openclaw", "repo": "molecule-ai/molecule-ai-workspace-template-openclaw", "ref": "main"},
    {"name": "codex", "repo": "molecule-ai/molecule-ai-workspace-template-codex", "ref": "main"},
    {"name": "langgraph", "repo": "molecule-ai/molecule-ai-workspace-template-langgraph", "ref": "main"},
-    {"name": "crewai", "repo": "molecule-ai/molecule-ai-workspace-template-crewai", "ref": "main"},
-    {"name": "autogen", "repo": "molecule-ai/molecule-ai-workspace-template-autogen", "ref": "main"},
-    {"name": "deepagents", "repo": "molecule-ai/molecule-ai-workspace-template-deepagents", "ref": "main"},
-    {"name": "gemini-cli", "repo": "molecule-ai/molecule-ai-workspace-template-gemini-cli", "ref": "main"}
+    {"name": "autogen", "repo": "molecule-ai/molecule-ai-workspace-template-autogen", "ref": "main"}
  ],
  "org_templates": [
    {"name": "molecule-dev", "repo": "molecule-ai/molecule-ai-org-template-molecule-dev", "ref": "main"},
@@ -44,4 +41,3 @@
    {"name": "mock-bigorg", "repo": "molecule-ai/molecule-ai-org-template-mock-bigorg", "ref": "main"}
  ]
 }
-// Triggered by Integration Tester at 2026-05-10T08:52Z
@@ -44,8 +44,8 @@ func NewWorkspaceImageService(docker *dockerclient.Client) *WorkspaceImageServic
 // AllRuntimes is the canonical list mirroring docs/workspace-runtime-package.md.
 // Update both when a new template is added.
 var AllRuntimes = []string{
-	"claude-code", "langgraph", "crewai", "autogen",
-	"deepagents", "hermes", "gemini-cli", "openclaw",
+	"claude-code", "langgraph", "autogen",
+	"hermes", "openclaw",
 }

 // RefreshResult is the per-call outcome surfaced to HTTP callers AND logged
@@ -96,13 +96,70 @@ var fallbackRuntimes = map[string]struct{}{
 // Caller logs + falls back to fallbackRuntimes on any error. Not
 // returning the fallback here ourselves so the caller can decide
 // how loud to be about the miss (prod = WARN, tests = silent).
+// stripJSON5Comments removes a JSON5-style // trailing comment from manifest.json.
+// The Integration Tester appends "// Triggered by ..." at the very end of the file.
+// This comment is always after the final closing brace, so we scan only that
+// suffix rather than trying to track string-context across the whole file.
+// This avoids false-positives on legitimate // in URL values (e.g. http://foo.com/bar).
+func stripJSON5Comments(data []byte) []byte {
+	// Find the last '}' — everything before it is guaranteed standard JSON.
+	lastBrace := -1
+	for i := len(data) - 1; i >= 0; i-- {
+		if data[i] == '}' {
+			lastBrace = i
+			break
+		}
+	}
+	if lastBrace == -1 {
+		return data // no JSON structure found — return as-is, json.Unmarshal will error
+	}
+	// Everything after lastBrace is the trailing suffix to clean.
+	suffixStart := lastBrace + 1
+	if suffixStart >= len(data) {
+		return data // no suffix
+	}
+	suffix := data[suffixStart:]
+	// Strip leading whitespace at the start of the suffix.
+	cleanSuffix := trimLeadingWhitespace(suffix)
+	if len(cleanSuffix) == 0 || cleanSuffix[0] != '/' {
+		return data // suffix is empty or starts with non-comment — nothing to strip
+	}
+	// Remove the trailing comment (everything from the first // to end of file).
+	// Rebuild: prefix + suffix with comment stripped.
+	before := data[:suffixStart]
+	// Trim trailing whitespace from before so we don't leave a dangling newline.
+	trimmedBefore := trimTrailingWhitespace(before)
+	// Append a single newline so the JSON file ends cleanly.
+	result := append(trimmedBefore, '\n')
+	return result
+}
+
+func trimLeadingWhitespace(b []byte) []byte {
+	i := 0
+	for i < len(b) && (b[i] == ' ' || b[i] == '\t' || b[i] == '\n' || b[i] == '\r') {
+		i++
+	}
+	return b[i:]
+}
+
+func trimTrailingWhitespace(b []byte) []byte {
+	i := len(b)
+	for i > 0 && (b[i-1] == ' ' || b[i-1] == '\t' || b[i-1] == '\n' || b[i-1] == '\r') {
+		i--
+	}
+	return b[:i]
+}
+
 func loadRuntimesFromManifest(path string) (map[string]struct{}, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err
 	}
+	// The Integration Tester appends "// Triggered by ..." to manifest.json.
+	// json.Unmarshal rejects it; strip // comments first (same as clone-manifest.sh).
+	clean := stripJSON5Comments(data)
 	var m manifestFile
-	if err := json.Unmarshal(data, &m); err != nil {
+	if err := json.Unmarshal(clean, &m); err != nil {
 		return nil, err
 	}
 	out := map[string]struct{}{
@@ -83,6 +83,70 @@ func TestLoadRuntimesFromManifest_MalformedJSON(t *testing.T) {
 	}
 }

+func TestLoadRuntimesFromManifest_TrailingJSON5Comment(t *testing.T) {
+	// The Integration Tester appends "// Triggered by Integration Tester at ..."
+	// to manifest.json after cloning. json.Unmarshal rejects it; stripJSON5Comments
+	// must remove the trailing comment so load succeeds.
+	dir := t.TempDir()
+	path := filepath.Join(dir, "manifest.json")
+	_ = os.WriteFile(path, []byte(`{
+		"workspace_templates": [
+			{"name": "langgraph", "repo": "org/t"}
+		]
+	}
+	// Triggered by Integration Tester at 2026-05-10T08:52Z`), 0600)
+
+	got, err := loadRuntimesFromManifest(path)
+	if err != nil {
+		t.Fatalf("load failed despite trailing comment: %v", err)
+	}
+	if _, ok := got["langgraph"]; !ok {
+		t.Errorf("langgraph missing from result: %v", keys(got))
+	}
+}
+
+func TestStripJSON5Comments(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "trailing comment after closing brace removed",
+			in:   "{}\n// Triggered by Integration Tester\n",
+			want: "{}\n",
+		},
+		{
+			name: "embedded_in_url_preserved",
+			in:   `{"url":"http://foo.com/bar"}`,
+			want: `{"url":"http://foo.com/bar"}`,
+		},
+		{
+			name: "no_closing_brace_returns_input_unchanged",
+			in:   "no json here // comment",
+			want: "no json here // comment",
+		},
+		{
+			name: "comment_only_after_closing_brace_stripped",
+			in:   `{"a":1}` + "\n// Triggered by Integration Tester at 2026-05-10T08:52Z",
+			want: `{"a":1}` + "\n",
+		},
+		{
+			name: "clean_json_unchanged",
+			in:   `{"workspace_templates":[]}` + "\n",
+			want: `{"workspace_templates":[]}` + "\n",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := string(stripJSON5Comments([]byte(tc.in)))
+			if got != tc.want {
+				t.Errorf("stripJSON5Comments(%q): got %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
 // TestRealManifestParses — sanity check against the actual
 // monorepo manifest.json so a future schema change to that file
 // (e.g. workspace_templates → workspace_runtime_templates) surfaces
@@ -23,8 +23,8 @@ package models
 //   - claude-code: "sonnet" — Anthropic's CLI accepts the short
 //     name and resolves it via the operator's anthropic-oauth or
 //     ANTHROPIC_API_KEY chain.
-//   - everything else (hermes, langgraph, crewai, autogen, deepagents,
-//     codex, openclaw, gemini-cli, external, ""): a fully-qualified
+//   - everything else (hermes, langgraph, autogen, codex, openclaw,
+//     external, ""): a fully-qualified
 //     vendor:model slug that the universal MODEL_PROVIDER chain in
 //     molecule-core PR #247 can route via per-vendor required_env.
 //
@@ -21,12 +21,9 @@ func TestDefaultModel(t *testing.T) {
 		// as a generic "unknown" failure.
 		{"hermes", "anthropic:claude-opus-4-7"},
 		{"langgraph", "anthropic:claude-opus-4-7"},
-		{"crewai", "anthropic:claude-opus-4-7"},
 		{"autogen", "anthropic:claude-opus-4-7"},
-		{"deepagents", "anthropic:claude-opus-4-7"},
 		{"codex", "anthropic:claude-opus-4-7"},
 		{"openclaw", "anthropic:claude-opus-4-7"},
-		{"gemini-cli", "anthropic:claude-opus-4-7"},
 		{"external", "anthropic:claude-opus-4-7"},

 		// Unknown / empty — fall through to universal default rather
@@ -190,7 +190,7 @@ func TestEnsureLocalImage_RepoNotFound(t *testing.T) {
 	opts.HTTPClient = srv.Client()
 	opts.remoteHeadSha = nil // exercise real HTTP path

-	_, err := ensureLocalImageWithOpts(context.Background(), "crewai", opts)
+	_, err := ensureLocalImageWithOpts(context.Background(), "hermes", opts)
 	if err == nil {
 		t.Fatalf("expected error, got nil")
 	}
@@ -35,6 +35,19 @@ import (
 // drift-risk #6.
 var ErrNoBackend = errors.New("provisioner: no backend configured (zero-valued receiver)")

+// ErrUnresolvableRuntime is returned by selectImage when a workspace
+// names a runtime that has no resolvable image (not in RuntimeImages and
+// no operator-pinned cfg.Image). RFC internal#483 + security review 4269:
+// previously such a request silently fell through to DefaultImage
+// (langgraph) — a user asking for crewai would get a langgraph container
+// with no signal. The CTO standing directive
+// (feedback_platform_must_hardgate_base_contract) is fail-closed: a
+// named-but-unresolvable runtime must reject with a structured,
+// runtime-naming error so the existing provision-failed notify/log path
+// surfaces it, NOT silently degrade. The genuinely-unspecified (empty)
+// runtime is still a distinct, legitimate path that keeps DefaultImage.
+var ErrUnresolvableRuntime = errors.New("provisioner: requested runtime has no resolvable image")
+
 // RuntimeImages maps runtime names to their Docker image refs.
 // Each standalone template repo publishes its image via the reusable
 // publish-template-image workflow in molecule-ci on every main merge.
@@ -104,20 +117,33 @@ type WorkspaceConfig struct {
 // selectImage resolves the final Docker image ref for a workspace. The handler
 // layer is the source of truth — if it set cfg.Image (the digest-pinned form
 // from runtime_image_pins, #2272), honor that. Otherwise fall back to the
-// runtime→tag lookup in RuntimeImages (legacy `:latest` behavior). When the
-// runtime isn't recognized either, fall back to DefaultImage so Start() still
-// has something to hand Docker — surfacing a "No such image" later is more
-// actionable than a silent "" panic in ContainerCreate.
-func selectImage(cfg WorkspaceConfig) string {
+// runtime→tag lookup in RuntimeImages (legacy `:latest` behavior).
+//
+// Fail-closed contract (RFC internal#483 / security review 4269 /
+// feedback_platform_must_hardgate_base_contract): if the workspace NAMES a
+// runtime that resolves to no image (not in RuntimeImages, no pinned
+// cfg.Image), reject with ErrUnresolvableRuntime instead of silently
+// substituting DefaultImage. Pre-fix, removing crewai/deepagents/gemini-cli
+// from the catalog left those create requests silently provisioning a
+// langgraph container — the user asked for crewai and got langgraph with no
+// signal. The error propagates through Start → markProvisionFailed, which
+// already broadcasts WorkspaceProvisionFailed and records the message.
+//
+// The genuinely-unspecified runtime (empty cfg.Runtime, e.g. an org template
+// that doesn't pin one) is an intended distinct path and still resolves to
+// DefaultImage — only a NAMED-but-unresolvable runtime is rejected.
+func selectImage(cfg WorkspaceConfig) (string, error) {
 	if cfg.Image != "" {
-		return cfg.Image
+		return cfg.Image, nil
 	}
 	if cfg.Runtime != "" {
 		if img, ok := RuntimeImages[cfg.Runtime]; ok {
-			return img
+			return img, nil
 		}
+		return "", fmt.Errorf("%w: runtime %q (known runtimes: %v)",
+			ErrUnresolvableRuntime, cfg.Runtime, knownRuntimes)
 	}
-	return DefaultImage
+	return DefaultImage, nil
 }

 // Workspace-access constants for #65. Matches the CHECK constraint on
@@ -336,7 +362,15 @@ func (p *Provisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string, e

 	env := buildContainerEnv(cfg)

-	image := selectImage(cfg)
+	image, imgErr := selectImage(cfg)
+	if imgErr != nil {
+		// Fail-closed: a named-but-unresolvable runtime must not silently
+		// become DefaultImage (RFC internal#483 / review 4269). The caller's
+		// error path (markProvisionFailed) broadcasts the failure + records
+		// the message so the canvas surfaces it.
+		log.Printf("Provisioner: refusing to start %s: %v", cfg.WorkspaceID, imgErr)
+		return "", imgErr
+	}

 	// Local-build mode (issue #63 / Task #194): when MOLECULE_IMAGE_REGISTRY
 	// is unset, the OSS contributor path skips the registry pull entirely
@@ -513,7 +513,10 @@ func TestWorkspaceConfig_ResetClaudeSessionFieldPresent(t *testing.T) {
 // we lose the "one bad publish doesn't break every workspace" guarantee.
 func TestSelectImage_PrefersExplicitImage(t *testing.T) {
 	pinned := "ghcr.io/molecule-ai/workspace-template-claude-code@sha256:3d6761a97ed07d7d33cfc19a8fbab81175d9d9179618d493dbc00c5f7ef076a3"
-	got := selectImage(WorkspaceConfig{Runtime: "claude-code", Image: pinned})
+	got, err := selectImage(WorkspaceConfig{Runtime: "claude-code", Image: pinned})
+	if err != nil {
+		t.Fatalf("selectImage with cfg.Image=pinned: unexpected error %v", err)
+	}
 	if got != pinned {
 		t.Errorf("selectImage with cfg.Image=pinned: got %q, want %q", got, pinned)
 	}
@@ -523,28 +526,46 @@ func TestSelectImage_PrefersExplicitImage(t *testing.T) {
 // pin lookup deliberately bypassed via WORKSPACE_IMAGE_LOCAL_OVERRIDE).
 // selectImage must use the legacy runtime→:latest map.
 func TestSelectImage_FallsBackToRuntimeMap(t *testing.T) {
-	got := selectImage(WorkspaceConfig{Runtime: "claude-code", Image: ""})
+	got, err := selectImage(WorkspaceConfig{Runtime: "claude-code", Image: ""})
+	if err != nil {
+		t.Fatalf("selectImage with empty Image: unexpected error %v", err)
+	}
 	want := RuntimeImages["claude-code"]
 	if got != want {
 		t.Errorf("selectImage with empty Image: got %q, want %q", got, want)
 	}
 }

-// TestSelectImage_UnknownRuntimeFallsBackToDefault preserves today's
-// behavior — an unrecognized runtime resolves to DefaultImage rather than
-// "" so ContainerCreate gets a usable arg and surfaces a meaningful
-// "No such image" error if the default itself is missing.
-func TestSelectImage_UnknownRuntimeFallsBackToDefault(t *testing.T) {
-	got := selectImage(WorkspaceConfig{Runtime: "no-such-runtime"})
-	if got != DefaultImage {
-		t.Errorf("selectImage with unknown runtime: got %q, want DefaultImage %q", got, DefaultImage)
+// TestSelectImage_NamedUnresolvableRuntimeRejects pins the fail-closed
+// contract (RFC internal#483 / security review 4269 /
+// feedback_platform_must_hardgate_base_contract): a NAMED runtime with no
+// resolvable image must reject with ErrUnresolvableRuntime, NOT silently
+// substitute DefaultImage. Pre-fix this returned langgraph — a user asking
+// for a removed runtime (crewai/deepagents/gemini-cli) silently got a
+// langgraph container. "crewai" is the concrete regression from the
+// security finding.
+func TestSelectImage_NamedUnresolvableRuntimeRejects(t *testing.T) {
+	for _, rt := range []string{"no-such-runtime", "crewai", "deepagents", "gemini-cli"} {
+		got, err := selectImage(WorkspaceConfig{Runtime: rt})
+		if !errors.Is(err, ErrUnresolvableRuntime) {
+			t.Errorf("selectImage(%q): got err %v, want ErrUnresolvableRuntime", rt, err)
+		}
+		if got != "" {
+			t.Errorf("selectImage(%q): got image %q, want \"\" on reject", rt, got)
+		}
+		if err != nil && !strings.Contains(err.Error(), rt) {
+			t.Errorf("selectImage(%q): error must name the offending runtime, got %v", rt, err)
+		}
 	}
 }

 // TestSelectImage_EmptyRuntimeFallsBackToDefault: same invariant for the
 // no-runtime-supplied path (legacy callers / older handler code).
 func TestSelectImage_EmptyRuntimeFallsBackToDefault(t *testing.T) {
-	got := selectImage(WorkspaceConfig{})
+	got, err := selectImage(WorkspaceConfig{})
+	if err != nil {
+		t.Fatalf("selectImage with zero cfg: unexpected error %v (empty runtime is a legitimate DefaultImage path)", err)
+	}
 	if got != DefaultImage {
 		t.Errorf("selectImage with zero cfg: got %q, want DefaultImage %q", got, DefaultImage)
 	}
@@ -808,7 +829,7 @@ func TestIsImageNotFoundErr(t *testing.T) {
 		{"nil", nil, false},
 		{"moby no such image", fmtErr(`Error response from daemon: No such image: workspace-template:openclaw`), true},
 		{"no such image lowercase", fmtErr(`error: no such image: foo:bar`), true},
-		{"image not found", fmtErr(`Error: image "workspace-template:crewai" not found`), true},
+		{"image not found", fmtErr(`Error: image "workspace-template:hermes" not found`), true},
 		{"generic not found without image", fmtErr(`container not found`), false},
 		{"unrelated error", fmtErr(`connection refused`), false},
 		{"permission denied", fmtErr(`permission denied`), false},
@@ -21,9 +21,6 @@ var knownRuntimes = []string{
 	"autogen",
 	"claude-code",
 	"codex",
-	"crewai",
-	"deepagents",
-	"gemini-cli",
 	"hermes",
 	"langgraph",
 	"openclaw",
@@ -53,8 +53,8 @@ func TestRuntimeImage_AllKnownRuntimes(t *testing.T) {
 		}
 	}
 	// Pin the count so adding a runtime requires explicit test acknowledgement.
-	if len(knownRuntimes) != 9 {
-		t.Errorf("knownRuntimes length = %d, want 9 (autogen, claude-code, codex, crewai, deepagents, gemini-cli, hermes, langgraph, openclaw)", len(knownRuntimes))
+	if len(knownRuntimes) != 6 {
+		t.Errorf("knownRuntimes length = %d, want 6 (autogen, claude-code, codex, hermes, langgraph, openclaw)", len(knownRuntimes))
 	}
 }