fix(platform): reapply HIGH #6 + SA auth-gating + VULN-004 SHA enforcement after platform→workspace-server rename

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, staging]
   pull_request:
-    branches: [main]
+    branches: [main, staging]
 
 jobs:
   # Detect which paths changed so downstream jobs can skip when only

.gitignore

@@ -83,6 +83,8 @@ redis_data/
 # Claude Code (local agent config — not shared)
 .claude/
 CLAUDE.md
+.mcp.json
+test-results/
 
 # Workspace instance configs (auto-generated by provisioner, not templates)
 workspace-configs-templates/ws-*
@@ -104,29 +106,17 @@ logs/
 
 # Backups
 backups/
-docs/.vitepress/dist/
 .claude-bridge/
-org-templates/**/.env
-org-templates/**/.auth-token
 
-# Migration additions (2026-04-13)
+# Migration additions
 .initial_prompt_done
-.claude-bridge/
 
 # GitHub App private key + other local-only secrets — never committed.
 .secrets/
 *.pem
 
 # Cloned-via-manifest dirs — populated locally by scripts/clone-manifest.sh,
 # tracked in their own standalone repos. Never commit to core.
-# Ignore all cloned org-template content except the molecule-dev reference
-# system-prompt template (tracked in core as the canonical shared-context
-# source; role-specific prompts live in molecule-ai-org-template-molecule-dev).
-# Pattern uses content-glob (/org-templates/*) rather than directory-ignore
-# (/org-templates/) so git can re-include specific files via ! negation.
-/org-templates/*
-!/org-templates/molecule-dev
-/org-templates/molecule-dev/*
-!/org-templates/molecule-dev/system-prompt.md
+/org-templates/
 /plugins/
 /workspace-configs-templates/

.mcp.json → .mcp.json.example

@@ -1,14 +1,5 @@
 {
   "mcpServers": {
-    "awareness-memory": {
-      "type": "stdio",
-      "command": "npx",
-      "args": [
-        "-y",
-        "@awareness-sdk/local",
-        "mcp"
-      ]
-    },
     "molecule": {
       "type": "stdio",
       "command": "npx",

CONTRIBUTING.md

@@ -27,7 +27,7 @@ git config core.hooksPath .githooks
 ./infra/scripts/setup.sh
 
 # Build and run the platform
-cd platform
+cd workspace-server
 go run ./cmd/server
 
 # In a separate terminal, run the canvas
@@ -77,13 +77,13 @@ causing a render loop when any node position changed.
 
 ```bash
 # Go (platform)
-cd platform && go test -race ./...
+cd workspace-server && go test -race ./...
 
 # Canvas (Next.js)
 cd canvas && npm test
 
 # Workspace runtime (Python)
-cd workspace-template && python -m pytest -v
+cd workspace && python -m pytest -v
 
 # E2E API tests (requires running platform)
 bash tests/e2e/test_api.sh

README.md

@@ -258,7 +258,7 @@ cd molecule-monorepo
 # `molecule-monorepo-net` Docker network. Temporal runs with
 # no auth on localhost — dev-only; production must gate it.
 
-cd platform
+cd workspace-server
 go run ./cmd/server
 
 cd ../canvas

README.zh-CN.md

@@ -257,7 +257,7 @@ cd molecule-monorepo
 # `molecule-monorepo-net` Docker 网络上。Temporal 默认无鉴权，
 # 仅用于本地开发；生产环境必须加 mTLS / API Key。
 
-cd platform
+cd workspace-server
 go run ./cmd/server
 
 cd ../canvas

canvas/src/components/tabs/ChatTab.tsx

@@ -33,7 +33,7 @@ interface A2AResponse {
 }
 
 // extractReplyText pulls the agent's text reply out of an A2A response.
-// Mirrors the Go-side extractReplyText in platform/internal/channels/manager.go.
+// Mirrors the Go-side extractReplyText in workspace-server/internal/channels/manager.go.
 function extractReplyText(resp: A2AResponse): string {
   const result = resp?.result;
   if (result?.parts) {

docs/api-reference.md

@@ -100,7 +100,7 @@ Full contract: `docs/runbooks/admin-auth.md`.
 
 ## Database
 
-Migration files live in `platform/migrations/` (latest: `022_workspace_schedules_source`). Each migration ships as a `.up.sql`/`.down.sql` pair. The migration runner globs `*.sql`, filters out `.down.sql` files, sorts alphabetically, and executes each file on boot. All `.up.sql` files must be idempotent (`CREATE TABLE IF NOT EXISTS`, `ALTER TABLE ... IF NOT EXISTS`) because the runner re-applies every migration on every boot.
+Migration files live in `workspace-server/migrations/` (latest: `022_workspace_schedules_source`). Each migration ships as a `.up.sql`/`.down.sql` pair. The migration runner globs `*.sql`, filters out `.down.sql` files, sorts alphabetically, and executes each file on boot. All `.up.sql` files must be idempotent (`CREATE TABLE IF NOT EXISTS`, `ALTER TABLE ... IF NOT EXISTS`) because the runner re-applies every migration on every boot.
 
 ### Key Tables