refactor: extract readOrLazyHealInboundSecret to dedup chat_files + registry - #2376
Merged
Merged
Conversation
…egistry The lazy-heal-on-miss pattern landed in two places this session: PR #2372 (chat_files.go::resolveWorkspaceForwardCreds — Upload + Download) and PR #2375 (registry.go::Register). Both implementations did the same thing: read → if ErrNoInboundSecret then mint inline → return outcome Different response-shape requirements but the same core mechanic. Three sites' worth of drift potential: any future heal-time condition we add (audit log, alert, secret rotation, observability) had to be applied to each site, with partial application silently re-opening the gap. Fix: extract readOrLazyHealInboundSecret in workspace_provision_shared.go returning (secret, healed, err). Each caller maps the outcome to its response shape: - chat_files: healed=true → 503 with retry hint; err != nil → 503 with RFC-#2312 reprovision hint - registry: healed=true|false + err==nil → include in response; err != nil → omit field (workspace can retry on next register) Net effect: - Single source of truth for the read+heal mechanic - Response-shape decisions stay in callers (they DO differ per feature) - Future heal-time conditions go in one place - Behavior preserved: existing TestRegister_NoInboundSecret_LazyHeals, TestRegister_NoInboundSecret_LazyHealMintFailureOmitsField, TestChatUpload_NoInboundSecret_LazyHeal*, TestChatDownload_NoInboundSecret_LazyHeal* all pass unchanged Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
April 30, 2026 11:12
HongmingWang-Rabbit
enabled auto-merge
April 30, 2026 11:12
This was referenced Apr 30, 2026
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
Serialized merge by gitea-merge-queue after current-main, genuine approvals, and required CI checks were green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The lazy-heal-on-miss pattern landed in two places this session: #2372 (chat_files `resolveWorkspaceForwardCreds`) and #2375 (registry `Register`). Both did the same core mechanic — `read → if ErrNoInboundSecret mint inline → return outcome` — wrapped in different response-shape handling.
Drift class: future heal-time conditions (audit log, alert, secret rotation, observability) had to be applied to each site, with partial application silently re-opening the gap.
Changes
Extract `readOrLazyHealInboundSecret` in `workspace_provision_shared.go` returning `(secret, healed, err)`. Each caller maps the outcome to its response shape:
Behavior preservation
Test plan
Note on chat_files response shape
Pre-refactor chat_files distinguished:
Post-refactor both surface as 503 RFC-#2312. The caller response covers both "can't determine" and "can't mint" with the same operational hint (retry / reprovision). No tests assert the specific 500 path; this is a strict simplification.
🤖 Generated with Claude Code