fix(org): per-workspace plugins UNION with defaults; '!' prefix opts out (#68) - #71
Merged
Merged
Conversation
…out (#68) Per-workspace `plugins:` now UNIONS with `defaults.plugins` instead of replacing. A leading `!` or `-` on a per-workspace entry opts a default out. Backward-compatible: re-listing defaults still dedupes to the same list. Refactored the inline REPLACE logic into a pure helper `mergePlugins` in org.go so it's unit-testable. Five TestPlugins_* cases added. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
marked this pull request as ready for review
April 14, 2026 20:21
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Apr 14, 2026
- docs/edit-history/2026-04-14.md: append tick-6 covering PR #71 (plugins UNION) and PR #72 (tick-5 docs-sync) - CLAUDE.md: Go test count 726 -> 731 (+5 TestPlugins_*); add Plugins section note on UNION + !/- opt-out semantics - PLAN.md: add "Recently launched (2026-04-14 tick-6)" entry noting issue #68 is resolved by PR #71 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
4 tasks
HongmingWang-Rabbit
added a commit
that referenced
this pull request
Apr 14, 2026
…tics #71 just merged — per-workspace `plugins:` now UNIONs with `defaults.plugins` instead of replacing it. Simplifies every override in molecule-dev/ from "defaults+1 = list 10 items" to "defaults+1 = list 1 item": PM: 11 items → 2 (workflow-triage + workflow-retro) Research Lead: 10 items → 1 (browser-automation) Market Analyst: 10 items → 1 Technical Researcher: 10 items → 1 Competitive Intel: 10 items → 1 Security Auditor: 12 items → 3 (code-review + cross-vendor-review + llm-judge) UIUX Designer: 10 items → 1 (browser-automation) Every workspace still receives the full 9-plugin default set (ecc, molecule-dev, superpowers, careful-bash, prompt-watchdog, audit-trail, session-context, cron-learnings, update-docs) — verified by reading mergePlugins() in platform/internal/handlers/org.go:645. Also drops the stale "REPLACE not UNION" warning comments and points defaults' header comment at the new union behaviour. Net diff: ~30 lines removed, ~10 added. Template is now meaningfully easier to extend — each new defaults.plugin propagates everywhere without sweeping per-role lists. Closes follow-up scope from PR #70.
4 tasks
HongmingWang-Rabbit
added a commit
that referenced
this pull request
Apr 14, 2026
…leanup chore(template): simplify per-role plugin lists using #71 union semantics
HongmingWang-Rabbit
added a commit
that referenced
this pull request
Apr 15, 2026
…te / channels Today's crons are all REVIEW (Security audit, UIUX audit, QA tests). Nothing actively pushes the team to EVOLVE the four levers CEO named: templates, plugins, channels, watchlist. The team-runs-24/7 goal needs both — defensive reviews AND offensive evolution. Adds 4 new schedules: 1. Research Lead — Daily ecosystem watch (0 8 * * *) Survey github.com/trending + HN + AI-blogs for new agent-infra projects from the last 24h. Add 1-3 entries to docs/ecosystem-watch.md per day, commit to chore/eco-watch-YYYY-MM-DD branch + push + PR. Re-enables the watchlist pipeline that was paused earlier today. 2. Technical Researcher — Weekly plugin curation (0 9 * * 1, Mondays) Inventory plugins/ + builtin_tools/ + recent landings. Identify gaps (builtin not exposed as plugin; role missing extras; rarely-used plugin in defaults). Survey upstream (claude.ai cookbook, MCP servers, anthropic/openai/langchain blogs). File 1-3 plugin proposals per week as GH issues with concrete integration sketches. 3. Dev Lead — Daily template fitness audit (30 8 * * *) Health-check the template itself: stale system prompts, schedules not firing (catches the #85 scheduler-died failure mode), roles missing plugins they should have, missing crons, channel gaps. File issues for any drift. Designed to catch the silent-stall pattern from today's incident. 4. DevOps Engineer — Weekly channel expansion survey (0 10 * * 1, Mondays) PM is the only role with a channel today (Telegram). Survey what channel infra the platform supports + what role-channel pairings would actually help (Security→email-on-critical, DevOps→Slack-on-CI-break, etc). File channel-proposal issues. All four crons end with the structured audit_summary routing per #51/#75 (category, severity, issues, top_recommendation) so they integrate with the platform-level category_routing PM uses to fan out work. The template's existing category_routing block already maps research / plugins / template / channels — these new crons consume exactly those slots. Also drops three stale "# UNION with defaults (#71)" comments left from the cleanup PR — those plugins lists are now self-documenting after #71. Aligns with north-star goal: team should run 24/7 AND keep getting better across templates / plugins / channels / watchlist. This PR closes the gap where the "review" half of the loop was running but the "evolve" half had no active driver.
This was referenced Apr 15, 2026
airenostars
added a commit
that referenced
this pull request
Apr 15, 2026
Every agent in the reno-stars org (marketing, sales, dev, coordinator) plausibly needs browser access at some point — social posts, GBP edits, directory submissions, InvoiceSimple publish. Without the plugin on first import, agents fall back to launching their own Chromium inside the container, which doesn't have the operator's authenticated Chrome profile (no logged-in sessions, no saved cookies). Per-agent opt-out via `!browser-automation` is already supported (PR #71 UNION merge semantics) if any specific role shouldn't have it. Closes #213
3 tasks
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Apr 15, 2026
#266, #275) Closes #266 and #275. Per-role install matrix matching the per-tick #266 triage comment. ## Added plugins | Role | Plugin | Rationale | |---|---|---| | Backend Engineer | molecule-hitl | Scope includes destructive DB migrations + runtime config changes — @requires_approval stops unattended agents from shipping prod schema mutations. | | DevOps Engineer | molecule-hitl | Scope covers fly deploys + registry pushes + CI pipeline mutations — @requires_approval before destructive infra ops. | | Security Auditor | molecule-hitl | Gates public issue filing for critical findings; prevents false-positive spam of the tracker. | | Security Auditor | molecule-security-scan | Primary consumer of gosec/bandit/CVE scanning via builtin_tools/security_scan.py. Security Auditor system prompt already expects to run these tools; this wires them. | ## Per-PR #71 semantics Each workspace's `plugins:` UNIONs with `defaults.plugins` — these additions don't drop any existing plugin. Security Auditor's list went from 3 → 5; Backend + DevOps Engineer now have a role-specific list layered on top of defaults. ## NOT adding (yet) Dev Lead / Research Lead / Technical Researcher / QA Engineer / UIUX Designer / PM / Documentation Specialist — none have destructive ops scope in the role description. If you want belt-and-suspenders HITL coverage I can extend this PR; leaving narrow for now. ## Test plan - [x] YAML parses cleanly (python3 -c 'import yaml; yaml.safe_load(...)') - [x] Three edited roles' plugins lists verified by walk-script - [ ] Next org re-import activates the plugins on each workspace container - [ ] Agents invoke request_approval / security_scan from their system prompts after re-import Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This was referenced Apr 15, 2026
Merged
Closed
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
Merged after 7-gate verification. Gates: 1 (CI 6/6 + 1 skip) pass, 2 (build/vet) pass, 3 (5 new TestPlugins_* + backward-compat) pass, 4 (security) pass, 5 (design) pass with 1 yellow, 6 (line review) pass, 7 N/A. Backward-compat verified: molecule-dev/org.yaml re-lists [ecc, molecule-dev, superpowers, browser-automation] in each role; under new UNION+dedupe the merged set is identical to the prior REPLACE result. PR #70's 1 yellow (REPLACE verbosity / re-listing chore) is now closed by this change — orgs can drop the re-listing once confident. Cross-vendor-review: second-model tooling unavailable in this worktree; Claude-only review applied per standing rule fallback. Yellow (non-blocking, follow-up): opt-out semantics (`!plugin` / `-plugin`) are documented only in the code comment. Safety plugins like `molecule-careful-bash` can be disabled by an org.yaml using `!molecule-careful-bash` — this is operator-controlled config per I-2 and therefore acceptable, but docs/plugins/ should get an "overriding defaults" page in a follow-up. noteworthy: plugin-semantics-change
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
- docs/edit-history/2026-04-14.md: append tick-6 covering PR #71 (plugins UNION) and PR #72 (tick-5 docs-sync) - CLAUDE.md: Go test count 726 -> 731 (+5 TestPlugins_*); add Plugins section note on UNION + !/- opt-out semantics - PLAN.md: add "Recently launched (2026-04-14 tick-6)" entry noting issue #68 is resolved by PR #71 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
…tics #71 just merged — per-workspace `plugins:` now UNIONs with `defaults.plugins` instead of replacing it. Simplifies every override in molecule-dev/ from "defaults+1 = list 10 items" to "defaults+1 = list 1 item": PM: 11 items → 2 (workflow-triage + workflow-retro) Research Lead: 10 items → 1 (browser-automation) Market Analyst: 10 items → 1 Technical Researcher: 10 items → 1 Competitive Intel: 10 items → 1 Security Auditor: 12 items → 3 (code-review + cross-vendor-review + llm-judge) UIUX Designer: 10 items → 1 (browser-automation) Every workspace still receives the full 9-plugin default set (ecc, molecule-dev, superpowers, careful-bash, prompt-watchdog, audit-trail, session-context, cron-learnings, update-docs) — verified by reading mergePlugins() in platform/internal/handlers/org.go:645. Also drops the stale "REPLACE not UNION" warning comments and points defaults' header comment at the new union behaviour. Net diff: ~30 lines removed, ~10 added. Template is now meaningfully easier to extend — each new defaults.plugin propagates everywhere without sweeping per-role lists. Closes follow-up scope from PR #70.
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
…leanup chore(template): simplify per-role plugin lists using #71 union semantics
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
…te / channels Today's crons are all REVIEW (Security audit, UIUX audit, QA tests). Nothing actively pushes the team to EVOLVE the four levers CEO named: templates, plugins, channels, watchlist. The team-runs-24/7 goal needs both — defensive reviews AND offensive evolution. Adds 4 new schedules: 1. Research Lead — Daily ecosystem watch (0 8 * * *) Survey github.com/trending + HN + AI-blogs for new agent-infra projects from the last 24h. Add 1-3 entries to docs/ecosystem-watch.md per day, commit to chore/eco-watch-YYYY-MM-DD branch + push + PR. Re-enables the watchlist pipeline that was paused earlier today. 2. Technical Researcher — Weekly plugin curation (0 9 * * 1, Mondays) Inventory plugins/ + builtin_tools/ + recent landings. Identify gaps (builtin not exposed as plugin; role missing extras; rarely-used plugin in defaults). Survey upstream (claude.ai cookbook, MCP servers, anthropic/openai/langchain blogs). File 1-3 plugin proposals per week as GH issues with concrete integration sketches. 3. Dev Lead — Daily template fitness audit (30 8 * * *) Health-check the template itself: stale system prompts, schedules not firing (catches the #85 scheduler-died failure mode), roles missing plugins they should have, missing crons, channel gaps. File issues for any drift. Designed to catch the silent-stall pattern from today's incident. 4. DevOps Engineer — Weekly channel expansion survey (0 10 * * 1, Mondays) PM is the only role with a channel today (Telegram). Survey what channel infra the platform supports + what role-channel pairings would actually help (Security→email-on-critical, DevOps→Slack-on-CI-break, etc). File channel-proposal issues. All four crons end with the structured audit_summary routing per #51/#75 (category, severity, issues, top_recommendation) so they integrate with the platform-level category_routing PM uses to fan out work. The template's existing category_routing block already maps research / plugins / template / channels — these new crons consume exactly those slots. Also drops three stale "# UNION with defaults (#71)" comments left from the cleanup PR — those plugins lists are now self-documenting after #71. Aligns with north-star goal: team should run 24/7 AND keep getting better across templates / plugins / channels / watchlist. This PR closes the gap where the "review" half of the loop was running but the "evolve" half had no active driver.
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
Every agent in the reno-stars org (marketing, sales, dev, coordinator) plausibly needs browser access at some point — social posts, GBP edits, directory submissions, InvoiceSimple publish. Without the plugin on first import, agents fall back to launching their own Chromium inside the container, which doesn't have the operator's authenticated Chrome profile (no logged-in sessions, no saved cookies). Per-agent opt-out via `!browser-automation` is already supported (PR #71 UNION merge semantics) if any specific role shouldn't have it. Closes #213
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
#266, #275) Closes #266 and #275. Per-role install matrix matching the per-tick #266 triage comment. ## Added plugins | Role | Plugin | Rationale | |---|---|---| | Backend Engineer | molecule-hitl | Scope includes destructive DB migrations + runtime config changes — @requires_approval stops unattended agents from shipping prod schema mutations. | | DevOps Engineer | molecule-hitl | Scope covers fly deploys + registry pushes + CI pipeline mutations — @requires_approval before destructive infra ops. | | Security Auditor | molecule-hitl | Gates public issue filing for critical findings; prevents false-positive spam of the tracker. | | Security Auditor | molecule-security-scan | Primary consumer of gosec/bandit/CVE scanning via builtin_tools/security_scan.py. Security Auditor system prompt already expects to run these tools; this wires them. | ## Per-PR #71 semantics Each workspace's `plugins:` UNIONs with `defaults.plugins` — these additions don't drop any existing plugin. Security Auditor's list went from 3 → 5; Backend + DevOps Engineer now have a role-specific list layered on top of defaults. ## NOT adding (yet) Dev Lead / Research Lead / Technical Researcher / QA Engineer / UIUX Designer / PM / Documentation Specialist — none have destructive ops scope in the role description. If you want belt-and-suspenders HITL coverage I can extend this PR; leaving narrow for now. ## Test plan - [x] YAML parses cleanly (python3 -c 'import yaml; yaml.safe_load(...)') - [x] Three edited roles' plugins lists verified by walk-script - [ ] Next org re-import activates the plugins on each workspace container - [ ] Agents invoke request_approval / security_scan from their system prompts after re-import Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #68.
Change
Per-workspace
plugins:now UNIONS withdefaults.pluginsinstead of replacing.A leading
!(or-) prefix opts a default out for that workspace.Examples:
Tests
5 new TestPlugins_* cases in org_test.go covering union, dedupe,
!opt-out,-opt-out, and backward-compat re-listing.Migration
None — existing org.yaml files keep working. Operators who were re-listing defaults can shorten their YAML at any time.
🤖 Generated with Claude Code