fix(copaw): configure static MinIO alias in Kubernetes

[shiyiyue1102]

Summary

• configure the static mc alias for Kubernetes Workers using MinIO when no MC_HOST_<alias> is present
• preserve the controller-issued MC_HOST_<alias> path for OSS
• fail explicitly when storage.provider=oss has no controller-issued credentials instead of falling back to placeholder static credentials
• retain the static fallback when the provider is absent for mixed-version compatibility

Root cause

FileSync._ensure_alias() previously skipped mc alias set for every Kubernetes Worker because it assumed mc-wrapper configured the alias. The wrapper only provisions MC_HOST_agentteams for OSS/STS; it is intentionally a pass-through for MinIO. Therefore default Kubernetes + MinIO Workers had neither an MC_HOST_agentteams alias nor a static alias, and mc mirror agentteams/... resolved its source as a local filesystem path.

The fix makes the decision provider-aware:

• existing MC_HOST_agentteams: use the controller-issued alias (OSS/STS)
• provider=oss without MC_HOST_agentteams: fail explicitly because the credential contract is broken
• MinIO, or a missing provider from a mixed-version controller: configure the existing static endpoint/access-key/secret alias

Reproduction

On origin/main at eeaab643, both the new regression test and an isolated real-MinIO container test reproduce the issue. The released v1.2.3 image fails with:

Unable to stat source `agentteams/agentteams-storage/agents/smoke/`.
Requested path `/root/.copaw-worker/agentteams/agentteams-storage/agents/smoke/` not found.

Verification

• python -m pytest tests/test_worker_sync.py tests/test_copaw_worker_entrypoint.py -q — 9 passed
• python -m compileall -q src/copaw_worker
• git diff --check origin/main...HEAD
• isolated container test against MinIO RELEASE.2025-04-22T22-12-26Z:
  • released v1.2.3: reproduced the local-path failure above
  • patched image, Kubernetes + MinIO: initial mirror succeeded; .copaw/config.json, .copaw/providers.json, and .copaw/workspaces/default/agent.json were materialized; a runtime session file was uploaded and read back from MinIO
  • patched image, Kubernetes + existing MC_HOST_agentteams: the same mirror, bridge, and runtime-persistence flow succeeded, covering the OSS/STS alias boundary
  • an absent shared/ prefix remained a non-fatal warning as designed and did not block initialization

The unfiltered local CoPaw suite was also attempted, but it is not a clean baseline in this environment: 87 unrelated failures occur across bridge, Matrix, health, and other existing test areas. The touched sync and credential-entrypoint scopes pass independently.

This is a current-main, provider-aware, tested alternative to #901, which remains blocked on the missing tests and OSS credential boundary.

Fixes #957
Fixes #1226

---

Summary

• configure the static mc alias for Kubernetes Workers using MinIO when no MC_HOST_<alias> is present
• preserve the controller-issued MC_HOST_<alias> path for OSS
• fail explicitly when storage.provider=oss has no controller-issued credentials instead of falling back to placeholder static credentials
• retain the static fallback when the provider is absent for mixed-version compatibility

Root cause

FileSync._ensure_alias() previously skipped mc alias set for every Kubernetes Worker because it assumed mc-wrapper configured the alias. The wrapper only provisions MC_HOST_agentteams for OSS/STS; it is intentionally a pass-through for MinIO. Therefore default Kubernetes + MinIO Workers had neither an MC_HOST_agentteams alias nor a static alias, and mc mirror agentteams/... resolved its source as a local filesystem path.

The fix makes the decision provider-aware:

• existing MC_HOST_agentteams: use the controller-issued alias (OSS/STS)
• provider=oss without MC_HOST_agentteams: fail explicitly because the credential contract is broken
• MinIO, or a missing provider from a mixed-version controller: configure the existing static endpoint/access-key/secret alias

Reproduction

On origin/main at eeaab643, both the new regression test and an isolated real-MinIO container test reproduce the issue. The released v1.2.3 image fails with:

Unable to stat source `agentteams/agentteams-storage/agents/smoke/`.
Requested path `/root/.copaw-worker/agentteams/agentteams-storage/agents/smoke/` not found.

Verification

• python -m pytest tests/test_worker_sync.py tests/test_copaw_worker_entrypoint.py -q — 9 passed
• python -m compileall -q src/copaw_worker
• git diff --check origin/main...HEAD
• isolated container test against MinIO RELEASE.2025-04-22T22-12-26Z:
• released v1.2.3: reproduced the local-path failure above
• patched image, Kubernetes + MinIO: initial mirror succeeded; .copaw/config.json, .copaw/providers.json, and .copaw/workspaces/default/agent.json were materialized; a runtime session file was uploaded and read back from MinIO
• patched image, Kubernetes + existing MC_HOST_agentteams: the same mirror, bridge, and runtime-persistence flow succeeded, covering the OSS/STS alias boundary
• an absent shared/ prefix remained a non-fatal warning as designed and did not block initialization

The unfiltered local CoPaw suite was also attempted, but it is not a clean baseline in this environment: 87 unrelated failures occur across bridge, Matrix, health, and other existing test areas. The touched sync and credential-entrypoint scopes pass independently.

This is a current-main, provider-aware, tested alternative to #901, which remains blocked on the missing tests and OSS credential boundary.

Fixes #957
Fixes #1226