Changelog — May 2026

Release notes for May 2026. For the latest releases see the current changelog.

---

2026-05-31

✨ New features

• Resend a pending invitation: org owners and admins can now re-send an invitation to an invitee whose original email never arrived (e.g. when the address already had a Molecule account). (molecule-controlplane #422)
• Google ADK (Gemini) runtime support: the google-adk runtime is now registered platform-wide, serving Gemini (gemini-2.5-pro) via Vertex AI with keyless authentication, so it appears correctly in the runtime picker and templates. (molecule-controlplane #424, #426)

🐛 Bug fixes

• Codex agents stuck on "NOT CONFIGURED": fixed Codex workspaces failing to start because the provider registry no longer matched the deployed adapter. The OpenAI provider is now split into subscription and API arms and synced across the platform. (molecule-controlplane #423, molecule-core #2025)
• Codex sign-ins getting burned: shared ChatGPT OAuth tokens were being invalidated when multiple Codex workspaces refreshed independently. Token refresh is now handled by a single central owner, preventing the repeated logouts. (molecule-core #2023)
• Wrong runtime shown in Config tab: the workspace Config runtime dropdown silently dropped google-adk, showing the wrong option for those workspaces. The picker is now driven by the canonical runtime registry. (molecule-core #2016)

2026-05-30

✨ New features

• Invite teammates and manage org roles: organizations can now list, invite, assign roles to, and remove members from the dashboard, backed by WorkOS invitations. (molecule-controlplane #407)
• Choose how workspace data is kept: workspaces now carry a durable-data choice (persist / ephemeral / auto) that flows from the workspace compute settings through to provisioning, with a keep-vs-prune choice applied safely at delete time. (molecule-core #2014, molecule-controlplane #415)
• Roomier desktop-control workspaces: browser-use (desktop-control) workspaces now default to a larger t3.xlarge instance, so a headed Chromium plus VNC desktop and agent no longer saturate CPU and go unresponsive. (molecule-controlplane #410)
• Keyless Vertex AI for google-adk: the google-adk runtime can now authenticate to Vertex AI via Workload Identity Federation (ADC), no API keys required, matching org policy. (molecule-controlplane #416, #421)

🐛 Bug fixes

• Inviting existing accounts now works: inviting an address that already has a Molecule account no longer fails with "failed to send invitation email" and silently drops the member; the invitation is kept and a fallback email is sent via Resend when WorkOS can't notify them. (molecule-controlplane #412, #413)
• Funded suspended orgs resume reliably: any billing-suspended organization with a positive credit balance now resumes, not just those paid through Stripe — credit grants from admin adjustments, plan changes, signup, and comps now clear the suspension. (molecule-controlplane #403)
• Member IAM hardening: invite rollbacks use a detached context so a stranded pending row no longer blocks retries, and email-sent status is reported honestly. (molecule-controlplane #411, #414)

🧹 Internal

• Real-Postgres end-to-end test gating for member IAM (molecule-controlplane #409).
• Browser-profile directory consolidated to a single source published by the provisioner (molecule-controlplane #417).

2026-05-29

✨ New features

• Per-workspace LLM budgets across four time windows: workspace budgets now enforce independent hourly, daily, weekly, and monthly spending ceilings, giving the Budget tab finer control over runaway LLM spend. (molecule-core #2009)
• Org member management in the control plane: org owners can now list members, invite people by email, change roles, and remove members, with invitations delivered via WorkOS. (molecule-controlplane #405)
• Google ADK runtime support: the Google ADK runtime is now selectable when creating a workspace and is registered end-to-end across the platform and control plane. (molecule-core #2003, molecule-controlplane #402)
• Schedules survive workspace recreation: when a workspace is recreated, its runtime schedules now migrate onto the new workspace instead of being orphaned, plus new admin endpoints to monitor and clean up any stray schedules. (molecule-core #2007, #2008)

🐛 Bug fixes

• Correct provider credentials injected for bring-your-own-key tenants: agents no longer fall back to a stray tenant-wide OAuth credential over the provider you configured, and BYOK tenants can again store their own vendor API keys at the global scope. (molecule-core #2000, #2002)
• Workspaces no longer stuck provisioning on multi-disk hosts: hardened persistent data-volume detection so workspaces on instances with more than one disk boot reliably instead of hanging in "provisioning". (molecule-controlplane #404, #399)
• File uploads route correctly on production tenants: fixed a routing gap that caused upload-related requests to silently 404 on production. (molecule-controlplane #406)
• Safe migration onto persistent data volumes: existing workspaces can now move to the persistent data volume without losing their working directory on first recreate, and the older restore-on-recreate path is correctly skipped once a workspace is enrolled. (molecule-controlplane #398, #401)

🧹 Internal

• Wired the Google ADK runtime into the end-to-end test suite and corrected inaccurate runtime tutorials. (molecule-core #2012, #2004)
• Isolated the staging deploy smoke test onto a dedicated Anthropic key so platform credit drains can't wedge production deploys. (molecule-controlplane #400)

2026-05-28

✨ New features

• Workspace data now survives recreates for every runtime: claude-code, codex, hermes, and openclaw kept their state outside /workspace, so it was wiped on each instance recreate or container swap; that state is now persisted on the durable data volume like the other runtimes. (molecule-controlplane #395)
• Automatic data-volume recovery: if a workspace's data volume is missing, it is now auto-restored from its most recent snapshot without operator intervention, with retention handling. (molecule-controlplane #390)

🐛 Bug fixes

• New workspaces no longer stranded in "provisioning": a fresh workspace EC2 could fail to boot when the ECR credential helper was missing at startup; added a static-login fallback plus an apt lock-wait so the image always pulls. This was the root cause of the incident that stranded all five agents-team workspaces. (molecule-controlplane #383, #384)
• Workspace data-volume races fixed: fast recreates could orphan a workspace's /workspace by creating a fresh empty volume over a still-detaching one, and slow boots could miss the volume attach window entirely. Reattach is now robust against a detaching survivor, the mount runs before the image pull, and the boot poll window was widened. (molecule-controlplane #387, #396, #397)
• Correct billing/credential mode at provision time: the platform-vs-BYOK decision now derives from the effective model rather than the raw request payload, so workspaces are provisioned against the right provider. (molecule-core #1995)
• Unregistered runtime/model combinations are now rejected upfront: requesting a model that a runtime does not support now returns a clear 422 UNREGISTERED_MODEL_FOR_RUNTIME at create time instead of silently proceeding. (molecule-core #1981)
• Fleet deploys no longer silently skip tenants: the production auto-deploy now discovers tenants from the authoritative EC2 source and verifies every tenant landed on the target build, closing the gap that left agents-team 46 hours behind with no straggler reported. (molecule-core #1998, molecule-controlplane #394)
• Billing-resume tunnel self-heal hardened: fixed two production defects in the post-resume self-heal (idempotent DNS, dash-safe SSM), verified end-to-end against staging. (molecule-controlplane #386)

🧹 Internal

• Distributed the provider-registry SSOT into molecule-core via codegen + verify-CI and reconciled the legacy vendor:model vocabulary, all with no behavior change. (molecule-core #1970, #1980, molecule-controlplane #380)
• Repointed the billing/credential decision to derive the provider from the registry. (molecule-core #1972, molecule-controlplane #378)

2026-05-27

🔒 Security

• Cross-tenant isolation in peer discovery and A2A routing: fixed paths that computed an org-root sibling set without an org scope, which could expose peers and route agent-to-agent requests across tenant boundaries; discovery and routing are now scoped to the caller's org. (molecule-core #1954)
• Canvas chat identity fix without privilege escalation: restored canvas chat for poll-mode canvas-user-identity workspaces while closing a cross-workspace escalation path in caller-token validation. (molecule-core #1948)
• BYOK and subscription workspaces no longer run on platform credits: workspaces whose billing mode is not platform-managed were still being injected with the platform's global Claude Code OAuth token; LLM credential resolution is now gated by the workspace's resolved billing mode. (molecule-core #1934, #1963)

✨ New features

• Larger workspace configurations: workspace config and prompts are now delivered via Secrets Manager instead of being packed into the EC2 user-data, retiring the ~12 KB cap that blocked larger agent configs. (molecule-controlplane #358, molecule-core #1937)
• Persistent workspace data volume: workspace state can now live on a standalone EBS data volume that survives instance recreate and is re-attached by workspace ID, with its own DR snapshots and a cost guardrail capping volume size. (molecule-controlplane #348, #366, #367)
• Provider selection now sets billing mode: choosing a non-platform provider (e.g. Claude Code subscription via OAuth) in the workspace Config tab now updates the workspace's LLM billing mode instead of silently leaving it platform-managed. (molecule-core #1935)
• Platform-managed LLM groundwork for more runtimes: added an OpenAI Responses API surface to the platform proxy and a canonical per-runtime provider matrix, unblocking platform-billed codex and laying the SSOT for offering platform-managed LLM on additional runtimes. (molecule-controlplane #360, #364, #359, #352)
• Self-service path for suspended orgs: a billing-suspended tenant subdomain now points to an add-credits page instead of dead-ending on a raw Cloudflare tunnel error. (molecule-controlplane #344)

🐛 Bug fixes

• Claude Code workspaces 404ing on every LLM call: removed a stray trailing /v1 from the platform-managed Anthropic base URL that caused a doubled path and broke all Claude Code workspaces. (molecule-controlplane #351)
• Anthropic outage for workspace agents: the platform proxy now forwards the client anthropic-beta header on Anthropic passthrough, fixing a break where Claude was unavailable for every workspace agent. (molecule-controlplane #362)
• Background LLM tier leaking to Anthropic: platform-managed Claude Code workspaces on a non-Anthropic model no longer leak title-generation, summarization, and quota-probe calls to real Anthropic. (molecule-controlplane #350)
• Kimi K2.6 reasoning content dropped: Moonshot's Anthropic-protocol responses are now passed through directly so reasoning content is no longer lost in protocol translation. (molecule-controlplane #334)
• Workspace recreate failures from snapshot restore: fixed the AWS InvalidBlockDeviceMapping rejection on root-device snapshot restore, and resolved data-volume device-name and disk-topology conflicts that left workspaces stuck provisioning. (molecule-controlplane #331, #339, #363, #365)
• Tenant unreachable after billing resume: a deleted Cloudflare tunnel left resumed orgs stuck on a permanent Error 1033; CP now self-heals the tunnel on resume and guards the suspended-org sweep. (molecule-controlplane #346)
• Stopped orchestrator never restarting: a workspace-recreate sweep could stop a tenant orchestrator EC2 and leave it down; a watchdog now auto-starts a stopped orchestrator. (molecule-controlplane #369)
• Expired ECR token failures: workspace nodes no longer hit 403/no basic auth credentials after the static 12-hour ECR token expired; the credential helper is now baked into the AMI and used on every pull. (molecule-controlplane #371)
• Leaked workspace EC2s and orphaned containers: the sweeper now reaps workspace instances with no live workspace row, and orphaned snapshot containers are reaped before relaunch to stop a crash-loop. (molecule-controlplane #347, #374)
• Workspace delete left dangling instances: the delete path now retries the EC2 stop with bounded backoff and emits a durable leak event instead of relying solely on the orphan sweeper. (molecule-core #1932)
• Hardcoded model and billing defaults removed: the platform no longer emits a hardcoded default LLM model or a per-org billing mode; workspace templates own model defaults and the workspace is the unit of billing-mode decision. (molecule-controlplane #330, #332)
• EC2 billing accrual correctness: accrual rows are now reaped on deprovision and stopped instances are skipped, fixing two billing-lifecycle bugs. (molecule-controlplane #355)
• Memory commit and JSONB hardening: the writable v2 memory namespace is now upserted before commit, and several paths were hardened against malformed inserts and dropped agent-to-agent requests on marshal failures. (molecule-core #1925, #1938, #1949, #1950)

🧹 Internal

• Goroutine-leak cleanup (time.After → time.NewTimer) in long-running loops, plus runtime-image-pin skew, region-scoping, and tenant image-refresh header fixes. (molecule-core #1939, #1940; molecule-controlplane #338, #356, #353)
• Provider-registry SSOT foundation and proxy protocol-based routing (additive, no behavior change). (molecule-controlplane #343, #376, #377, #341)
• CI/deploy reliability: bounded Railway-sync retries, ssh-auth-failure classification, a hard platform-models prod-promote gate, race-detector and integration-test fixes, and red-main watchdog hygiene. (molecule-controlplane #354, #361, #373, #345, #349; molecule-core #1920, #1945, #1943)

2026-05-26

🔒 Security

• Platform-managed LLM keys can no longer be bypassed: workspaces on platform-managed LLM mode now reject tenant-supplied provider keys (KIMI_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) and Hermes custom provider/base-URL overrides, so all traffic stays on the platform proxy instead of escaping to BYOK credentials. (molecule-core #1922, #1863)
• Closed a Canvas auth bypass: removed a forgeable same-origin (Referer/Origin) shortcut in workspace auth; tenant Canvas now authenticates via a control-plane-verified member session instead. (molecule-core #1924)
• Hardened HTTP server against slowloris: added a read-header timeout to the workspace server. (molecule-core #1880)

✨ New features

• Per-workspace LLM billing mode: you can now override the LLM billing mode (platform-managed vs. BYOK) on an individual workspace instead of inheriting only the org default. A new LLM Billing section in the Config tab shows the resolved mode and where it came from. (molecule-core #1927, #1928; molecule-controlplane #319)
• Automatic workspace backup before destructive changes: deleting or recreating a workspace now snapshots its root EBS volume first, with implicit restore on the next provision within a 24h window. (molecule-controlplane #301, #317)
• Richer billing usage data: the org usage endpoint now returns typed LLM and EC2 billing summaries (requests, tokens, cost, credits) from the billing ledgers, and EC2 usage rolls up by provisioned instance metadata with refunds factored in. (molecule-controlplane #305, #315)
• Workspaces seed schedules from their template: a workspace created directly from a workspace template now lands with the same schedule grid as the org/import path. (molecule-core #1929)

🐛 Bug fixes

• Mobile Canvas chat now updates in real time: agent replies and your own outbound messages appear live across all sessions without a refresh; fixed a missing WebSocket wake-recovery path and added cross-session message broadcast. (molecule-core #1435, #1470)
• MCP delegations no longer error: fixed a SQL placeholder mismatch that caused a runtime failure on every MCP delegation. (molecule-core #1365)
• Moonshot/Kimi reliability: platform-managed Moonshot/Kimi Anthropic requests are now bridged through the OpenAI-compatible upstream (including streaming and tool-use), and usage is correctly billed even when the client disconnects mid-request. (molecule-controlplane #304, #306)
• EC2 billing accuracy: actual-cost reconciliation now applies the org service fee, tolerates missing/null resource metadata, preserves instance metadata across observed rows, and continues true-up past capped orgs instead of aborting the batch. (molecule-controlplane #310, #311, #313, #314)
• Canvas accessibility: settings panels, modals, and dialogs gained visible focus rings, ARIA tab patterns, live-region error announcements, and accessible input labels for keyboard and screen-reader users. (molecule-core #1406, #1464, #1467, #1468)
• Canvas model picker reflects real templates: the create-workspace dialog now derives provider/model options from the selected runtime template instead of a hardcoded fallback catalog, and legacy templates without a runtime field load again. (molecule-core #1926, #1810)
• Restored the legacy memories endpoint: GET /memories works again as a shim over the v2 memory plugin, so older SDK callers stop 404'ing. (molecule-core #1852)
• Fixed stale Claude channel setup docs: removed a non-existent --channels flag and dead org paths that blocked users setting up the Claude channel. (molecule-core #1471)
• Stripe secret sync hardened: deploys now fail loudly if Stripe billing secrets can't be synced, routed through a Stripe-scoped operator command. (molecule-controlplane #307)

🧹 Internal

• Large reliability sweep across the workspace server: surfaced dozens of previously-ignored DB, JSON, and I/O errors (e.g. RowsAffected, json.Unmarshal/Marshal, io.ReadAll, http.NewRequest) so failures return correct status codes instead of silently masking as 404s or empty payloads. (molecule-core #1899, #1906, #1914, #1918, #1919)
• CI/test hardening and lint cleanup: gate-check, watchdog, required-check alignment, runner labels, deploy timeouts, and Stage C snapshot smoke. (molecule-core #1764, #1858, #1898; molecule-controlplane #312, #321)
• Staging deploy pipeline hardened to upload checked-out source and require the proxy route surface before passing readiness. (molecule-controlplane #322)

2026-05-25

✨ New features

• Platform-managed LLM: workspaces can now run on built-in platform-managed LLM access — no BYOK key required. Create Workspace adds auth-mode controls for platform-managed, BYOK API key, and Claude OAuth, with an OpenAI-compatible and native Anthropic-compatible proxy on the control plane (including MiniMax and Kimi-coding routing) so usage bills through the platform. New blank and SEO-agent workspaces default to provider Platform with moonshot/kimi-k2.6. (molecule-core #1815, #1833; molecule-controlplane #275, #278, #299)
• Runtime + template selection in Create Workspace: the New Workspace dialog now uses a Runtime dropdown (Claude Code, Codex, Hermes, OpenClaw) and a separate Workspace Template picker, deriving Provider and Model choices from template metadata and only prompting for credentials when a chosen model needs them. The SEO agent ships as the first visible product template. (molecule-core #1842, #1846, #1848, #1850; molecule-controlplane #293)
• Live template refresh: workspace templates now refresh from a repo cache, with an admin endpoint to sync templates immediately without rebuilding the tenant image. (molecule-core #1853)
• Chat file attachments: agents can attach files in messages to you, and those attachments now show up in live chat and in saved history, including framed PDF previews contained inside the chat panel. (molecule-core #1824, #1829, #1839, #1841)
• Auto-credit cap billing: paid orgs can enable automatic overage credits with a configurable cap, validated against plan, Stripe customer, and overage subscription. (molecule-controlplane #295)
• Cost-efficient headless workspaces: headless (no-display) workspaces now default to smaller, cheaper compute, while desktop-enabled workspaces keep the full profile. (molecule-core #1825)

🐛 Bug fixes

• Safer workspace deletes: deleting a workspace now requires confirming its name, and returns details about active tasks, children, and schedules before any cascade runs. (molecule-core #1826)
• Desktop control fixes: copy/paste, Caps Lock, and Shift-modified keys now work in the Display tab, browser sessions can take control of the desktop, and the desktop browser launches reliably for display-enabled workspaces. (molecule-core #1832, #1854; molecule-controlplane #286, #287, #289, #292, #294, #298)
• Attachment previews stay viewable: legacy attachment URLs are rewritten so previews load with auth instead of broken images, PDF Blob previews are no longer blocked by CSP, and uploads remain previewable/downloadable after an agent has consumed them. (molecule-core #1840, #1845, #1849)
• Billing suspension lifecycle: orgs that exhaust credits now enter a 30-day suspension window that stops tenant and workspace compute, resumes it after a credit top-up, and purges only after the window expires; one-time top-ups no longer mutate plan or grant fields. Org detail responses also now include the same billing credit fields as the org list. (molecule-controlplane #296, #288)
• More reliable tenant provisioning: a new tenant is only marked running after its public URL passes an edge reachability check, avoiding tenants reported as ready while still unreachable. (molecule-controlplane #276)

🧹 Internal

• Restricted maintained workspace runtimes to Claude Code, Codex, Hermes, and OpenClaw, and hid raw runtime defaults from user-facing template surfaces. (molecule-core #1827, #1847)
• Hardened the deploy pipeline's LLM/Stripe secret sync (operator-side reads, base64 SSH key, key-format validation) and fixed deploy smoke/CI status checks. (molecule-controlplane #277, #281, #285, #291)
• Formalized the org-per-EC2 architecture RFC, scoped production auto-deploy into canary/batch calls, and added advisory CI plus billing/test coverage. (molecule-core #1819, #1838, #1843; molecule-controlplane #297)

2026-05-24

🔒 Security

• Take Control desktop streams are now private: live remote-desktop sessions are served over a trusted VNC client with a short-lived signed session token (passed out-of-band, never in request URLs or logs), and the workspace stream stays localhost-only. (molecule-core #1752, molecule-controlplane #263)
• Re-hardened tenant instance endpoints against enumeration: per-tenant rate limiting was restored on the routes that expose instance details, after a refactor had inadvertently dropped it. (molecule-controlplane #185)

✨ New features

• Edit container compute settings from Canvas: you can now change a workspace's runtime image, instance type, root volume size, and display enablement/resolution directly in Canvas, with Save, Save & Restart, and Restart-to-apply flows for changes that need a container restart. (molecule-core #1800)
• Platform-managed LLM billing: orgs can run on platform-managed, bring-your-own-key, or disabled LLM modes, with token usage metered against a provider-neutral price catalog (seeded with OpenAI, Anthropic, and Moonshot/Kimi pricing) so agents can use models without supplying their own keys. (molecule-controlplane #272, #273)
• Usage-based overage billing: paid subscriptions now carry a metered overage price, and credit overage is reported to Stripe per billing tick. (molecule-controlplane #264, #267)
• Compute billed by actual resources: EC2 usage is now priced from the recorded instance type and volume size per tenant rather than a flat sweep, with actual-cost reconciliation against AWS Cost Explorer. (molecule-controlplane #269, #271)

🐛 Bug fixes

• User messages render in the right bubble: messages fanned across sessions were missing a role field and showed up styled as agent replies; they now render correctly as user bubbles. (molecule-core #1517)
• Memory writes now persist correctly: canvas-facing memory writes were still landing in the legacy store, and a follow-up fix resolved an HTTP 500 regression on saving memories caused by invalid JSON for empty metadata. (molecule-core #1794, #1798)
• Memory tab refreshes live: the Canvas Memory inspector now updates immediately when an agent commits a memory via MCP tools, instead of requiring a manual reload. (molecule-core #1795, #1749)
• Accessibility on Canvas controls: screen readers now correctly announce file-editor save/load status, console loading state, and skip decorative icons, with visible focus rings on key buttons (WCAG 1.1.1/2.4.7/4.1.3). (molecule-core #1452, #1455)
• A2A access for Canvas users: human Canvas users could hit 403 errors when reaching agents in poll-mode workspaces; their identity is now recognized correctly. (molecule-core #1756)

🧹 Internal

• Narrowed the supported workspace runtime set to Claude Code, Codex, Hermes, and OpenClaw, removing retired AutoGen/LangGraph/deepagents surfaces across templates, defaults, and registry/pin migrations. (molecule-core #1765, #1785, molecule-controlplane #266, #270)
• Completed the memory backend migration from the legacy v1 store to the v2 plugin (schema isolation, fallback removal, table drop, and post-migration cleanup). (molecule-core #1742, #1747, #1809)
• CI/runner-lane hardening, billing/E2E test coverage, and the Go module rename to the Gitea path. (molecule-core #1766, #1816, molecule-controlplane #186)

2026-05-23

🔒 Security

• Slowloris hardening: HTTP servers now enforce a header-read timeout, limiting how long a client can stall while sending request headers. (molecule-core #1715)

✨ New features

• Desktop display for workspaces: workspaces can now be created with a graphical desktop session. New Workspace exposes Display controls (default t3.xlarge / 80GB / 1920x1080) under Container Config, and the control plane provisions a managed Xvfb/XFCE/noVNC session on the workspace EC2 with stream ingress opened only for display-enabled workspaces. (molecule-core #1732, molecule-controlplane #258)
• Canvas Display & Container tabs: new workspace side-panel tabs surface display availability, a control-lock/takeover affordance, and read-only runtime/container details, with a live viewer iframe once a session is available. (molecule-core #1701, #1705, #1711, #1718, #1726)
• Per-workspace compute sizing: workspaces now carry a structured compute spec (instance type, root volume, display config) that is persisted on create and restored across restart/resume. (molecule-core #1695)

🐛 Bug fixes

• Scheduled runs no longer report false success: scheduler now detects adapter and SDK errors hidden inside HTTP 200 responses (rate limits, quota exhaustion, JSON-RPC error bodies, A2A message envelopes) instead of recording them as "completed", so persistent schedule outages surface to operators. (molecule-core #1698, #1699, #1716)
• Cron starvation fixed: native-session adapters now use the platform A2A queue, so a single long-running agent can no longer block back-to-back cron fires (previously bounced 503 for hours). The A2A first-response budget was also raised to 5 minutes so scheduled turns are not falsely marked failed when durably queued. (molecule-core #1685, #1751)
• Workspaces require an explicit model: removed the legacy default-model fallback that could pair an incompatible model with a runtime (e.g. a Codex agent wedging forever in "not configured"); a model must now be set at create time. (molecule-core #1667)
• GitHub auth in workspaces: a GH_PAT secret is now aliased to GH_TOKEN/GITHUB_TOKEN at provision time so the gh CLI and git credential helpers can authenticate to private repos. (molecule-core #1697)
• Tenant request routing on EC2: the control plane now HTTP-proxies tenant traffic to the workspace cloudflared tunnel instead of emitting a Fly-only replay header, fixing routing for EC2-hosted tenants. (molecule-controlplane #257)
• Workspace image provisioning: fixed runtime-image handling so langgraph pins can be promoted/rolled back, claude-code-default resolves to its correct image, operator-promoted pins survive control-plane redeploys, and cross-account ECR pulls authenticate against the right registry. (molecule-controlplane #259, #260, #261, #262)
• More reliable error reporting: a broad sweep of channel adapters (Slack, Discord, Lark), trace/memory/provisioner proxies, and DB list handlers now surface read, decode, and mid-iteration errors instead of silently treating them as success or returning truncated results. (molecule-core #1713, #1717, #1720, #1722)

🧹 Internal

• Test hermeticity and timeout hardening: SSRF/admin-token tests isolated from inherited env vars, plus a 30s timeout on the GitHub app-token client. (molecule-core #1703, #1728)
• CI: new advisory Mac arm64 fast-check lane to relieve the amd64 queue, plus fixes for canvas/workspace-server image publishing, runner-label matching, and empty-PR review-check noise. (molecule-core #1442, #1740, #1743, #1744)
• Started the swaggo → OpenAPI → generated-client pipeline on the schedules handler. (molecule-core #1707)

2026-05-22

✨ New features

• Billing invoice history: You can now list your past invoices, including amount, plan, status, billing period, and a downloadable PDF link. Orgs without billing set up get a clean empty result. (molecule-controlplane #254)

🐛 Bug fixes

• Tenant status accuracy: Deprovisioned tenants no longer show up as stuck "provisioning" in the dashboard. (molecule-controlplane #244)
• Model startup reliability: Fixed a case where a stale model-provider value could be emitted alongside an already-set model, causing agent adapter setup to fail at startup. (molecule-controlplane #239)
• Claude Code onboarding snippet: Corrected the canvas-served Claude Code channel setup instructions, which previously used an invalid launch flag. (molecule-core #1661)

🧹 Internal

• Stabilized the staging end-to-end test suite: routable-workspace readiness gating, A2A cold-start/busy retries, EC2-leak teardown checks, and a stable MiniMax model default (molecule-core #1660, #1666, #1671, #1677).
• Repaired the control-plane deploy pipeline end to end — CI status parser, Railway CLI install via npm, checkout ordering, and best-effort Stripe-secret sync (molecule-controlplane #240–#245, #250).
• Migrated remaining CI workflows from GitHub to Gitea and routed T4 egress through the Molecule-owned endpoint (molecule-controlplane #252; molecule-core #1658).

2026-05-21

✨ New features

• Richer activity feed: the workspace activity endpoint now accepts an opt-in ?include=peer_info flag that surfaces the peer's name, role, and agent-card URL alongside each entry. (molecule-core #1654)

🐛 Bug fixes

• Agent-to-agent delegation no longer loops: fixed a self-delegation case that could trap an external workspace agent in a 400-error loop, and made the rejection message agent-readable. (molecule-core #1624)
• Reliable cross-agent delegation routing: server-side MCP delegate_task/delegate_task_async now route through the platform A2A proxy, and external-runtime loopback URLs are preserved instead of being incorrectly rewritten, so delegation between agents reaches the right target. (molecule-core #1643, #1632)
• No more leaked workspace machines on teardown: deleting a tenant now sweeps workspace EC2 instances that were still launching during teardown, preventing orphaned machines (root cause of a staging vCPU-limit incident). (molecule-controlplane #237)

🧹 Internal

• Hardened the staging peer-visibility E2E and the tenant-image publish pipeline: added a production-safe admin workspace-token mint route, fixed Docker/buildx config isolation, and pointed staging tenants at the correct published ECR image (molecule-core #1633, #1641; molecule-controlplane #235, #236).
• Reduced CI runner load by path-scoping required lanes and keeping heavyweight browser E2E off the normal PR path; improved main-CI watchdog/status-reaper to suppress cancel-cascade false positives (molecule-core #1628, #1634, #1635).
• Restored and hardened the AWS Secrets Manager janitor schedule, removed the now-unused core workspace copy, and refreshed external-workspace docs (molecule-core #1651, #1620, #1640).

2026-05-20

✨ New features

• Larger chat-file uploads: the per-file upload cap is now 100 MB (up from 50 MB), with matching limits for external/laptop-runtime workspaces and a single GET /uploads/limits source of truth. (molecule-core #1588, #1589, #1604)
• Organization details in Settings: a new Organization tab shows your current org's name, slug, and UUID with copy buttons, plus the other orgs you belong to — no more digging through devtools. (molecule-core #1621)
• Live workspace env edits: a new admin endpoint lets operators update environment variables on a running workspace without reprovisioning it. (molecule-controlplane #230)

🐛 Bug fixes

• Codex 401 on every turn, fixed: multi-line secrets such as CODEX_AUTH_JSON were being silently dropped during provisioning, breaking codex authentication; they are now delivered correctly. (molecule-controlplane #225)
• Empty org on tenant subdomains, fixed: /cp/auth/me returned a blank org_id for users signed in on a tenant subdomain; it now populates correctly. (molecule-controlplane #234)
• Clearer upload errors: an over-size upload no longer reports a misleading "timeout" — it now surfaces the real file-size reason. (molecule-core #1588)
• Better progress and error feedback for external workspaces: messages to external/MCP (poll-mode) workspaces now show a queued/in-progress state instead of appearing to hang, failed delegations carry their real error detail, and A2A error hints point at the Activity tab and away from the unnecessary "restart" prompt for in-flight long-running tasks. (molecule-core #1618, #1606, #1607, #1617)
• "Stop All" now cancels cleanly: canvas issues a polite task cancel before restarting a workspace, so stopping work no longer relies on a hard restart. (molecule-core #1619)
• Save no longer triggers restart storms: rapid file-save bursts in claude-code workspaces could cause a tight re-provision loop; saves are now debounced. (molecule-core #1623)
• Personal GitHub tokens accepted again: pasting your own scoped GITHUB_TOKEN into the workspace Secrets tab is no longer incorrectly blocked, while operator-leaked tokens stay blocked. (molecule-core #1622)
• Workspace admin listing restored: GET /cp/admin/orgs/:slug/workspaces no longer returns a 503; the workspace lister is now wired up. (molecule-controlplane #233)
• Safer fleet redeploys: redeploy-fleet now requires explicit confirmation or a slug list instead of silently rolling every live tenant on an empty request. (molecule-controlplane #228, molecule-core #1595)
• Correct template sources: workspace/org template registry URLs were repointed from the suspended GitHub org to the canonical Gitea host with the right repo names. (molecule-controlplane #229)

🧹 Internal

• Runtime-package publishing now pushes to the Gitea PyPI registry first with PyPI as best-effort fallback, plus autobump and CI-trigger fixes to remove a publishing single-point-of-failure. (molecule-core #1585, #1580)
• CI/SSOT cleanup: ECR registry sourced from a shared variable, dead GitHub workflows and a duplicate runtime-image migration removed, and SOP-checklist workflow consolidation plus OOM/pagination hardening. (molecule-core #1611, #1615, #1612, #1610, #1333, molecule-controlplane #227, #231, #232)

2026-05-19

🔒 Security

• Tenant workspaces can no longer receive operator-scope credentials: workspaces now refuse to start if any fleet-scope secret (e.g. Gitea/admin/Railway tokens) is present in their environment, and GITHUB_TOKEN was removed from the tenant secret seed list — closing an escalation path from a single compromised workspace to the whole platform. (molecule-core #1555, molecule-controlplane #204)

✨ New features

• Usage overage billing: overage beyond your plan is now metered and pushed to Stripe with a configurable per-tenant service fee. (molecule-controlplane #190)
• Crawlable marketing homepage: the Canvas landing page now ships full SEO metadata, Open Graph/Twitter cards, sitemap, robots, and structured data. (molecule-core #1537)
• Clearer chat error messages: when an agent errors, the chat banner now shows the actual provider status, error code, and human-readable reason (with secrets redacted) and links to the Activity tab, instead of an opaque "see workspace logs" message. (molecule-core #1549, #1550)
• Safer admin org creation: POST /cp/admin/orgs now supports ?dry_run and rejects unknown JSON fields instead of silently dropping them. (molecule-controlplane #191)
• Fail-fast on unpinned runtimes: provisioning now returns a clear 422 RUNTIME_PIN_MISSING instead of silently falling back when no runtime image is pinned for the requested runtime/region — no EC2 is launched on the failure path. (molecule-controlplane #194, #195)

🐛 Bug fixes

• Peer visibility / MCP connectivity restored: fixed the stdio read loop that broke list_peers and live MCP clients by blocking until a full buffer filled instead of reading line-by-line — root cause of the 2026-05-15 openclaw peer-visibility outage. (molecule-core #1307)
• Per-workspace MCP server naming: connecting multiple workspaces no longer overwrites each other's MCP config — the per-workspace slug fix now covers the Codex, openclaw, Hermes, and Kimi runtime tabs, not just the universal snippet. (molecule-core #1536)
• Self-delegation no longer deadlocks: a workspace delegating a task to its own ID no longer echoes back and hangs on its own run lock. (molecule-core #1539)
• Model vs provider config wedge fixed: workspaces no longer boot into a broken/NOT_CONFIGURED state when a model id (e.g. gpt-5.5, opus) was mistakenly written into the provider field; the picked model id and provider name are now stored separately, and invalid providers are rejected at the config setter. (molecule-controlplane #213, #220, molecule-core #1581)
• PDF/file chat uploads fixed: chat file uploads (e.g. PDFs) that returned an opaque "failed to parse multipart form" now work — the missing python-multipart dependency is pinned in the runtime, and upload errors now report the actual cause. (molecule-core #1578, #1575, #1583)
• Workspace restart thrashing stopped: a single secrets update no longer fans out into repeated stop/provision cycles that killed just-launched instances. (molecule-core #1556)
• No more orphaned instances on recreate: recreating a workspace now terminates the prior EC2 instance even when the tenant-side stop failed, and fleet redeploys correctly find tenants whose org status had drifted. (molecule-controlplane #218, #197)
• Durable git auth for dev workspaces: dev workspaces now receive git HTTP credentials from their persona token, closing a recurring git-auth gap. (molecule-core #1542)
• Deploy pipeline now actually fires: fixed a workflow-parser issue that had silently prevented the control-plane deploy pipeline from ever running on main. (molecule-controlplane #221, #223)
• Agent identity cards: production-team agents no longer display a raw UUID and blank role; their name, role, and description are now seeded correctly. (molecule-core #1563)

🧹 Internal

• Removed the legacy native-systemd workspace boot fallback now that all workspaces run containerized, plus related dead-code and secret-seed cleanup. (molecule-controlplane #211, #219)
• Observability and cost work: structured JSON logging baseline, a structured audit-log emitter, longer sweep-loop intervals to cut idle DB compute, a lookup cache for redeploy bursts, and staging-only auto-reap tags. (molecule-controlplane #201, #209, #212, molecule-core #1572)
• CI hardening, build hygiene, governance, docs, and added E2E coverage — including pinning docker-bound jobs to Linux runners, removing dead workflows, sibling-merge build-break repairs, and stale install/doc fixes. (molecule-controlplane #208, #215, #216, molecule-core #1558, #1554, #1566)

2026-05-18

No customer-visible changes on 2026-05-18. All PRs merged were internal CI fixes, test fixture cleanups, or RFCs.

---

2026-05-17

🐛 Bug fixes

• Agent-to-agent delegation restored: a regression had left fleet-wide A2A delegation failing because the delegation context was tied to the inbound HTTP request and got cancelled early; delegation now runs on a detached context. (molecule-core #1446)
• Workspace Tokens tab no longer errors with no node selected: opening Settings → Workspace Tokens (or creating a token there) without a canvas node selected returned a 500; it now works. (molecule-core #1415)
• Honest Secrets UI: the non-functional "reveal" eye on write-only secrets was replaced with a clear write-only indicator, and the Secrets "Test" action now reports the real failure reason instead of always showing a fake "Connection timed out." (molecule-core #1421, #1424)
• Clearer error when saving config.yaml during provisioning: editing a workspace's config.yaml while the workspace was still coming up returned an opaque signal: killed 500; it now returns an actionable message. (molecule-core #1426)
• Agent identity reconciliation: agent card identity is now reconciled from the trusted workspaces record. (molecule-core #1427)

🧹 Internal

• Merge-queue hardening: stop infinite-retrying PRs that return 403/404/405 merge errors, and correct status deduplication for the combined sort order. (molecule-core #1417, #1428)
• CI/test cleanup: surface PyPI 403 response bodies in the publish step, and replace placeholder token fixtures tripping the secret scanner. (molecule-core #1390, #1430, #1431)

2026-05-16

🔒 Security

• Workspace peer visibility restored: agents could fail to see their teammates (a fleet-wide list_peers 401) because per-workspace auth tokens were written root-owned and unreadable by the agent process. Token files are now injected agent-owned. (molecule-core #1327)
• SCM write tokens kept out of tenant workspaces: added a CI-enforced guardrail so workspace containers can never be handed a Git SCM write token. (molecule-core #1277)

✨ New features

• T4 full-access tier: T4 workspaces now grant full root-level control of their dedicated single-tenant EC2 host, with privileged container access and host/Docker socket mounts. (molecule-controlplane #175)
• Workspace sizing decoupled from access tier: how large your workspace box is is no longer tied to your access tier — the two are now configured independently. (molecule-controlplane #173)

🐛 Bug fixes

• No more lost canvas messages on chat exit: poll-mode tenants could lose a message they had just sent if they left the chat; user messages are now persisted before the request returns. (molecule-core #1350)
• Workspace auth now persists and self-heals: /configs is mounted read-write so each workspace's bearer token and platform-inbound secret survive and can be re-written as needed. (molecule-controlplane #169)
• Fleet provisioning outage fixed: a regression that broke new workspace provisioning was resolved by compressing the generated cloud-init user-data. (molecule-controlplane #171)
• Top-up payments now grant credits reliably: a missing Stripe checkout.session.completed registration could drop credit grants on top-ups; this is now wired correctly (plus a subscription period-end fix). (molecule-controlplane #172)
• Cleaner agent inboxes: self-delegation echo rows are now filtered out of the inbox poller. (molecule-core #1348)

🧹 Internal

• Runtime catalog narrowed to the maintained set (dropped crewai/deepagents/gemini-cli, retired the gemini org template). (molecule-core #1385, molecule-controlplane #179)
• New automated E2E gates for peer visibility plus a data-race fix and test/CI hardening. (molecule-core #1298, #1267, #1242)
• Dedicated publish/deploy CI lane so urgent prod builds no longer queue behind PR CI; CP test fix unblocking CI. (molecule-core #1376, molecule-controlplane #180)

2026-05-15

✨ New features

• Workspace broadcast and talk-to-user controls: workspaces can now fan out an org-wide notification to all peers via the broadcast_message tool (admin-gated, off by default), and admins can disable a workspace's ability to message the user directly. (molecule-core #1121, #1224)
• New workspace identity tools: workspaces gain get_runtime_identity (reports the running model, provider, tier, and runtime) and update_agent_card (updates the agent's published card). (molecule-core #1240)
• Pay-as-you-go credit top-ups: buy credits via Stripe Checkout, with credits granted automatically on successful payment. (molecule-controlplane #161)

🐛 Bug fixes

• Newly created workspaces could not load files or save config: per-workspace security groups now allow the management tunnel through, fixing the "No files / No config file found" state and restoring the Files API, Save & Restart, and plugin installs on freshly spawned workspaces. (molecule-controlplane #167)
• Canvas "Save & Restart" timed out for OpenClaw workspaces: skipped a needless config write that OpenClaw never reads and raised the request timeout, so saves now complete. (molecule-core #1237, #1241)
• OpenClaw workspaces could drop offline after setup: the OpenClaw install snippet now pins a runtime version that ships the heartbeat wrapper, keeping the workspace shown as alive on canvas. (molecule-core #1143)

🧹 Internal

• Provisioner config-wiring and command-injection hardening, plus a base provider-routing resolver and adapter refactor. (molecule-core #1078, #1138)
• CI reliability: replaced the polling-based required-checks sentinel with a dependency graph and throttled duplicate SOP/refire jobs. (molecule-core #1096, #1134)
• Expanded automated test coverage for the chat stack and the billing/credits system. (molecule-core #1142, molecule-controlplane #161)

2026-05-14

🔒 Security

• Org template env-var leak closed: org YAML config values can no longer leak host environment variables (e.g. $HOME) through variable expansion — references are now treated literally unless the entire value is a single recognized variable (CWE-78). (molecule-core #1030, #1072)
• Agent-to-agent message hardening: A2A delegation output now escapes boundary markers and truncates closers before sanitization, preventing crafted peer messages from spoofing trusted boundaries (OFFSEC-003). (molecule-core #1059, #1073)
• Per-tenant rate limiting restored: four tenant-side routes that authenticate with an admin token regained per-tenant rate limiting. (molecule-controlplane #157)
• Symlink-escape and SSRF guards: config-file collection now skips symlinks (OFFSEC-010), and the tenant-image promote script validates tenant slugs to block SSRF and token exfiltration (OFFSEC-006). (molecule-core #1075, #930)

✨ New features

• Mobile sign-in: OAuth now supports deep-link callbacks (molecule:// and Expo exp://), so the mobile app can complete login and capture the session. (molecule-controlplane #149, #151)
• Mobile push tokens auto-provisioned: the platform Expo push token is now propagated to every tenant automatically via the Secrets Manager bootstrap bundle. (molecule-controlplane #159)
• HTTP/SSE transport for A2A: the A2A MCP server can now run over HTTP/SSE in addition to stdio, enabling agent-to-agent connectivity in non-PTY deployments (SSH, container exec, CI runners). (molecule-core #909)
• Tenant-supplied workspace config: workspace provisioning now accepts and writes tenant-supplied config_files into /configs before runtime start. (molecule-controlplane #155)

🐛 Bug fixes

• Deploy button stuck disabled: runtimes with no required environment variables (e.g. Openclaw) could not be deployed because the Deploy button stayed permanently disabled. (molecule-core #1038)
• Mobile chat history: the mobile chat panel now loads prior conversation history on open instead of showing only the live buffer. (molecule-core #1062, #1069)
• Delegation status lookups: pending delegations are now found correctly — the delegation ID is written where the status check reads it. (molecule-core #998)
• Production deploy reliability: tenant redeploys now refresh ECR auth before pulling images, skip non-running and stale tenants so a single dead tenant can't block the whole rollout, and target the correct production subnet for workspace provisioning. (molecule-controlplane #150, #152, #155, #154)
• Accessibility (WCAG AA): multiple rounds of contrast fixes and keyboard focus rings across canvas — buttons, badges, error/status text, tier legend, and icon buttons in Schedule/Budget/Channels tabs. (molecule-core #902, #928, #931, #936, #949, #988, #990)
• Silent DB iteration errors: added missing rows.Err() checks so mid-stream query errors during secrets/credits/admin scans surface instead of returning partial results as success. (molecule-core #1021, molecule-controlplane #156, #158)

🧹 Internal

• Large CI/CD recovery effort to unblock a red main: workflow-lint and required-job-fanout fixes, GITHUB_EVENT_BEFORE handling for push events, merge-queue gating on real push status, and per-step build timeouts (molecule-core #904, #919, #995, #997).
• Review-gate plumbing: corrected qa/security review-gate tokens, added a /sop-n/a declaration command, and collapsed duplicate review-refire triggers (molecule-core #910, #915, #925).
• Extensive added unit/handler test coverage and main↔staging promotion sync commits (molecule-core #956, #980, #1005).

2026-05-13

🔒 Security

• Org import path-traversal closed: restored the resolveInsideRoot guard so a malicious org YAML (e.g. filesDir: "../../../etc") can no longer read arbitrary server files through the workspace .env loader (CWE-22). (molecule-core #810)
• A2A peer responses re-sanitized: re-applied sanitize_a2a_result so peer-controlled agent-to-agent text passes through the prompt-injection trust boundary before entering agent context (OFFSEC-003). (molecule-core #800)
• Memory write corruption fixed: corrected a query-parameter indexing bug in memory PatchNamespace that mismatched fields when expiry and metadata were updated together (OFFSEC-004). (molecule-core #832)

✨ New features

• Search on mobile canvas: SearchDialog is now mounted in the mobile shell, so Cmd+K search works on small viewports as well as desktop. (molecule-core #837)
• Kimi as a bring-your-own-compute runtime: kimi and kimi-cli are now accepted as first-class external runtimes. (molecule-core #771)
• Broader MCP transport support: the MCP server now uses a universal stdio transport with runtime-adaptive notifications, fixing connections over PTYs, files, and sockets that the previous pipe transport rejected. (molecule-core #778)

🐛 Bug fixes

• Mobile chat no longer freezes: removed an unstable store selector that triggered an infinite re-render loop in mobile chat. (molecule-core #717)
• Cleaner chat for empty tasks: blank agent tasks now render as empty text instead of an error chip. (molecule-core #807)
• Workspace API auth fixed: workspaces are now provisioned with the real admin token instead of a placeholder, resolving 401s on platform/admin API calls; existing stale placeholders are healed on startup. (molecule-core #885, #893, #898)
• Local image builds unblocked: added the Docker CLI (and buildx) to the workspace-server image so the colocated local-build path works without an external registry. (molecule-core #765, #796)
• Actionable terminal diagnostics: the SSH-key diagnose probe now surfaces the underlying AWS error verbatim (e.g. AccessDeniedException: ec2-instance-connect:OpenTunnel) instead of an opaque exit code. (molecule-core #755, #809, #834)
• Canvas accessibility: WCAG AA contrast fixes for amber buttons and badges, TermsGate dialog/backdrop restructure with proper screen-reader and disabled-state handling, and case-insensitive file-icon lookup. (molecule-core #859, #854, #697)
• Workspace container healthcheck: added a Dockerfile HEALTHCHECK probing the agent-card endpoint for faster detection of unhealthy workspaces. (molecule-core #883)

🧹 Internal

• Large expansion of automated test coverage across handlers, canvas, websocket hub, and memory store (representative: molecule-core #783, #860, #823).
• CI/CD hardening: serialized merge queue, workflow-status emitter linting, branch-protection drift gates, and automatic production tenant deploy after green main (representative: molecule-core #819, #877, #824).
• Control-plane vanity-import migration to go.moleculesai.app and a build unblocker (molecule-controlplane #32, #144).

2026-05-12

🔒 Security

• OFFSEC-001: MCP endpoint information disclosure fixed: the JSON-RPC -32601 error handler in mcp.go was reflecting user-controlled req.Method back into the error message. An agent or canvas client sending a crafted method field would see that value reflected in the error response. The handler now returns a constant "method not found" string, closing the information-disclosure vector. (molecule-core #692)

🐛 Bug fixes

• Canvas focus-visible regression fixed in FilesTab and BudgetSection: a regression introduced in recent canvas updates caused focus-visible rings to stop rendering on FilesTab and BudgetSection components. Restored to full WCAG 2.4.7 compliance — keyboard and assistive-technology users see a visible focus indicator on all interactive elements in these panels. (molecule-core #614)

🧹 Internal

• CI quality hardening (molecule-core): status-reaper revised to sweep the last 10 main commits (up from 1) to catch stranded statuses from concurrent workflows; fixed a broken concurrency block that caused duplicate alerts on Gitea 1.22.6. (molecule-core #633, #618)
• CI infrastructure fixes (molecule-core): runner label pinned for docker-capable runners in publish workflows; ubuntu-latest runner restored after a revert; sop-tier-check now gracefully handles empty/invalid tokens in staging; per-package diagnostic step added to the publish pipeline; workflow_run triggers replaced with push+paths across affected workflows for Gitea 1.22.6 compatibility. (molecule-core #636, #609, #606, #694)
• Test coverage additions (molecule-core): 180+ new test cases across canvas, UI, tabs, platform/bundle, and workspace modules — covering FilesTab, BudgetSection, NotAvailablePanel, FilesToolbar, KeyValueField, RevealToggle, ValidationHint, getSkills, extractSkills, exporter.go, buildBundleConfigFiles, and a2a_response.py queue envelope. (molecule-core #614, #611, #629, #600, #616, #592, #626, #587, #621)

---

2026-05-11

✨ New features

• Delegation results auto-surfaced to agents: when a delegate_task call completes, the results are now automatically injected into the agent's next turn — no explicit check_task_status call required. This closes the gap where parallel delegate_task calls returned after the SDK turn ended and the agent had no way to discover the results. (molecule-core #358)
• claude_code runtime support for 4 plugins: the audit, compliance, hitl, and security-scan plugins now include a claude_code adapter, resolving the registry gap warning when using Claude Code as the agent runtime with these plugins. (molecule-ai-plugin-molecule-audit #6, molecule-ai-plugin-molecule-compliance #6, molecule-ai-plugin-molecule-hitl #6, molecule-ai-plugin-molecule-security-scan #6)
• MCP HTTP/SSE transport improvements: a2a_mcp_server.py now correctly identifies itself as "molecule" (was "a2a-delegation"), emits SSE heartbeats with data: null (was invalid data: {}), and only sends a heartbeat when the connection is idle — eliminating spurious heartbeat noise on every response. (molecule-ai-workspace-runtime #12)

🔧 Fixes

• Canvas WCAG 2.4.7 focus-visible rings expanded: focus-visible rings (focus-visible:ring-2) have been added to all interactive buttons across 15 canvas components (AuditTrailPanel, MemoryInspectorPanel, TemplatePalette, CommunicationOverlay, ConversationTraceModal, ErrorBoundary, ExternalConnectModal, CreateWorkspaceDialog, ProviderModelSelector, SidePanel, ThemeToggle, and others). Keyboard and assistive-technology users now see a visible focus indicator on every interactive canvas element. (molecule-core #421)

• OFFSEC-003: delegation result fields sanitized on platform side: tool_check_task_status now calls sanitize_a2a_result() on summary and response_preview fields before embedding them in JSON output — both when returning a single delegation by delegation_id and when listing all recent delegations. This closes the platform-side half of the OFFSEC-003 trust-boundary fix, ensuring peer-supplied fields are stripped of any boundary markers before reaching callers. (molecule-core #417, #416)

• Proxy-path delegation results now visible in delegation list: when a workspace delegates via POST /workspaces/:id/a2a (the A2A proxy path), the result is now correctly stored and returned by GET /workspaces/:id/delegations. Previously these rows were logged with the wrong activity type and invisible to the delegation list endpoint — callers polling for results would see an incomplete set. The platform-side logging fix (molecule-core #483) and the workspace heartbeat fix (molecule-core #501) ship together — the proxy now writes correct rows, and the heartbeat loop now polls them so agents wake up to consume delegation results without manual check_task_status calls.

• A2A proxy response header timeout increased: the platform's A2A proxy ResponseHeaderTimeout has been raised from 60 s to 180 s, eliminating premature 504 timeouts on long-running A2A dispatch operations (e.g. agent synthesis, cold-start OAuth flows). The timeout is now also configurable per-deployment via the A2A_PROXY_RESPONSE_HEADER_TIMEOUT environment variable. (molecule-core #331)

• A2A push-mode queue response now correctly sets delivery_mode: the A2A response parser now explicitly sets delivery_mode="push" on Queued variants returned from push-mode workspace queue envelopes. Previously it silently defaulted, causing callers that branch on v.delivery_mode to mis-route poll-mode responses as push-mode (and vice versa). (molecule-core #356)

• PLATFORM_URL defaults aligned across runtime modules: all workspace runtime modules (a2a_cli.py, a2a_client.py, a2a_mcp_server.py, and 10 others) now consistently default PLATFORM_URL to http://host.docker.internal:8080, eliminating an inconsistency where some modules pointed to http://platform:8080. (molecule-ai-workspace-runtime #12)

• MCP server setup command corrected: the get_remote_agent_setup_command tool now emits the correct pip install command (pip install molecule-ai-sdk and path molecule-sdk-python/) instead of the incorrect pip install molecule-sdk / sdk/python/. Users following the tool's output will now get a working setup. (molecule-mcp-server #4)

• CWE-117: log injection vulnerability fixed in workspace stdout/stderr routing: _sanitize_for_external() and the stderr parameter have been restored in the workspace executor. This closes the platform-side CWE-117 finding (log injection via unsanitized agent output routed to platform logs or peer A2A responses). Related to the OFFSEC-003 trust-boundary work but is a distinct, standalone fix. (molecule-core #573)

🧹 Internal

• CI fixes (molecule-core): publish-runtime.yml split into two workflows (tags-only publisher + autobump) and a Gitea workflow_dispatch.inputs parser bug (causing the workflow to be silently ignored) has been fixed. (molecule-core #349, #352, #353)
• CI infrastructure improvements (molecule-ci): a graceful runner restart script with unit tests has been added, improving operational reliability of CI runners. (molecule-ci #8)
• Delegation results sanitization (molecule-ai-workspace-runtime): read_delegation_results() now sanitizes content from peer delegation responses before injecting them into the agent context, ensuring trust-boundary markers are stripped before results are surfaced. (molecule-ai-workspace-runtime #13)
• CI migration wave (second pass): a second wave of CI workflow renames from .github/workflows/ to .gitea/workflows/ completed across molecule-controlplane, molecule-ai-workspace-runtime, molecule-sdk-python, molecule-mcp-server, and 12 plugin repos. (molecule-ai-* #various)
• CI policy enforcement (molecule-core): ci-required-drift detector (port from molecule-controlplane#112) and audit-force-merge sidecar reconcile workflow added, implementing RFC internal#219 §4+§6 phases. (molecule-core #422)
• main-never-red watchdog (molecule-core): new main-red-watchdog CI workflow added as a safety net to detect and alert when main enters a failing state, complementing the existing ci-required-drift policy. (molecule-core #423)
• CI wave three — platform + templates (molecule-core, workspace templates): a third CI migration wave completed, porting the validate workflow to .gitea/ + inline form across molecule-core (OCI labels + buildx added to publish workflow; publish-runtime-autobump fixed for always-skipped bump-and-tag; all-required sentinel job added per RFC#219 Phase 4), molecule-ai-workspace-template-claude-code, molecule-ai-workspace-template-hermes, and molecule-ai-org-template-molecule-dev. (molecule-core #559, #563, #553, etc.; workspace templates various CI ports)
• CI quality hardening (molecule-core): gate-check-v3 received multiple fixes — explicit 15 s timeout on HTTP calls, combined-state self-referential fallback removed, token no longer appears in curl argv, checkout now uses base SHA. (molecule-core #604, #564, #549, #556)
• CI policy scope extended (molecule-core): status-reaper now compensates for Gitea 1.22.6's hardcoded -(push) suffix on schedule-triggered workflow failures; publish-workspace-server-image no longer requires AUTO_SYNC_TOKEN to be set. (molecule-core #589, #572)

---

2026-05-10

✨ New features

• MCP HTTP/SSE transport for Hermes: a2a_mcp_server.py now speaks HTTP + SSE in addition to stdio, enabling the Hermes runtime to host MCP tools over a network endpoint rather than only via child-process stdio. (molecule-ai-workspace-runtime #5)
• molecule-sdk-python: RemoteAgentClient now accepts org_id and origin kwargs in its constructor, enabling org-scoped registration and origin tracking from the first handshake. (molecule-sdk-python #7)
• molecule-sdk-python: fetch_inbound() now supports peer_id and before_ts filter params for targeted message retrieval — useful for polling a specific peer's pending tasks. (molecule-sdk-python #6)
• molecule-sdk-python: new strip_a2a_boundary() helper for safely stripping the [A2A_RESULT_FROM_PEER] trust-boundary marker from peer A2A responses (OFFSEC-003). Works correctly on both pre- and post-OFFSEC-003 responses. (molecule-sdk-python #8)

🔧 Fixes

• molecule-app: WCAG 2.4.7 focus-visible rings added to all customer-facing buttons (ThemeToggle, Track-issue Link, and general CTA buttons) — keyboard and assistive-technology users now see a visible focus indicator on every interactive element. (molecule-app #5, #9, #10)
• status.moleculesai.app aggregator: the status page's probe result aggregator was rewritten to correctly compute composite uptime across all monitored endpoints — resolving false-down alerts caused by a data-structure bug in the previous implementation. (molecule-ai-status #10)
• molecule-sdk-python: InboundMessage now surfaces peer_name, peer_role, and agent_card_url fields, enabling callers to attribute and inspect inbound A2A messages without a separate registry lookup. (molecule-sdk-python #5)
• molecule-cli: CI test workflow added — molecule ci test now runs a reproducible test suite against any workspace template. (molecule-cli #3)
• molecule-ai-workspace-runtime: a2a-sdk dependency pinned to >=1.0.0 to match the actual code — eliminates a version mismatch that caused AttributeError on newer SDK builds. (molecule-ai-workspace-runtime #4)

📚 Docs

• molecule-sdk-python: README API surface additions covering the Phase 30.8 RemoteAgentClient API, including org_id, origin, fetch_inbound, InboundMessage, and strip_a2a_boundary(). (molecule-sdk-python #4)
• molecule-ai-status: status page documentation updated to reflect the new Gitea-native uptime probe replacing the Upptime dependency. (molecule-ai-status #4)
• molecule-sdk-python: pytest-asyncio documented as an optional test dependency in CLAUDE.md. (molecule-sdk-python #3)
• Remote Workspaces guide: full RemoteAgentClient API reference added to content/docs/guides/remote-workspaces.md, covering constructor params, fetch_inbound(), InboundMessage fields, and the OFFSEC-003 strip_a2a_boundary() security section. (docs #13)
• status.moleculesai.app: status page aggregator fix documented in the changelog. (docs #14)

🧹 Internal

• CI migration wave: 22 repos migrated CI workflows from .github/workflows/ to .gitea/workflows/ following the GitHub org suspension (post-suspension sweep). Affected repos: molecule-cli, molecule-sdk-python, molecule-mcp-server, and all 21 plugin repos.
• Plugin hygiene: 20 plugin repos received .gitignore Python-ignores (__pycache__/, *.pyc) and __pycache__ directory removal across the plugin ecosystem (molecule-ai-plugin-*).
• Plugin smoke-test suites: 13 plugin repos (molecule-ai-plugin-*) now ship with documented smoke-test suites and coverage rationale READMEs (tests/README.md), adding test counts ranging from 21 to 26 tests per plugin.
• Hook path fixes: molecule-ai-plugin-molecule-freeze-scope and molecule-ai-plugin-molecule-audit-trail received get_repo_root() layout detection fixes and corresponding test suites.
• molecule-ai-org-template-molecule-dev: org-level initial_prompt updated from GitHub to Gitea URLs. (molecule-ai-org-template-molecule-dev #8)
• molecule-ai-workspace-template-claude-code: adapter alias-map now correctly maps yaml_provider for runtime-wheel defaults. (molecule-ai-workspace-template-claude-code #12)
• molecule-ai-plugin-molecule-careful-bash: token exfiltration pattern block (OFFSEC-002) now documented in known-issues.md. (molecule-ai-plugin-molecule-careful-bash #3)
• molecule-ci: 7 reusable workflows ported to .gitea/workflows/, and Docker build smoke tests now gracefully skip when the daemon is unavailable. (molecule-ci #6, #7)

✨ New features

• A2A priority queue — Phase 1: task dispatch now supports a priority field (low / normal / high / urgent). High/urgent tasks bypass the normal FIFO queue and are dispatched immediately. (molecule-core #225)
• Plugin drift detector + queue + admin apply endpoint: a new plugin drift detection system monitors loaded plugins against their pinned SHAs and surfaces drift via a queue; admins can review and apply corrections via a new /admin/plugin-apply endpoint. (molecule-core #204)
• workspace-server pre-restart A2A drain signal: the workspace-server now sends a pre-restart A2A drain signal before restarting, allowing peer workspaces to gracefully drain pending tasks instead of timing out. (molecule-core #207)
• Admin auth runbook: new admin-auth.md runbook documents the test-token route lockdown and AdminAuth middleware behaviour for operators. (molecule-core #220)
• Static .github-token fallback to git credential helper: workspace-server now falls back to a static .github-token value when no git credential helper is configured, enabling simpler air-gapped setups. (molecule-core #219)
• Keyboard shortcuts in Toolbar help dialog: all keyboard shortcuts are now documented in a Toolbar help dialog accessible from the canvas top bar. (molecule-core #244)
• HTTP/SSE transport for Hermes MCP: a2a_mcp_server.py now exposes --transport=http --port=<N> for Hermes workspaces that prefer HTTP + SSE over stdio. Endpoints: POST /mcp (JSON-RPC), GET /mcp/stream (SSE), GET /health. (molecule-ai-workspace-runtime #5)
• RemoteAgentClient org_id and origin kwargs: RemoteAgentClient now accepts org_id (injected as X-Molecule-Org-Id header) and origin (injected as Origin header for request tracing) as constructor kwargs. Both propagate to all 14+ outbound call sites automatically via _auth_headers(). (molecule-sdk-python #7)
• RemoteAgentClient fetch_inbound() filter params: fetch_inbound() now accepts peer_id (narrow to a specific peer's messages) and before_ts (RFC3339 timestamp for cursor-based pagination). Enables agents to selectively consume inbound activity from known siblings. (molecule-sdk-python #6)
• InboundMessage enrichment fields: InboundMessage now exposes typed peer_name, peer_role, and agent_card_url attributes, surfaced from the platform's peer registry at dispatch time. Previously these were only accessible via the raw channel envelope. (molecule-sdk-python #5)
• strip_a2a_boundary() — OFFSEC-003 trust-boundary SDK helper: molecule-sdk-python now exports strip_a2a_boundary(text) to strip [A2A_RESULT_FROM_PEER]...[/A2A_RESULT_FROM_PEER] wrappers from peer-generated content. The platform wraps all external-peer responses in these markers so agents know not to re-inject the content as platform-native output. Safe on pre-OFFSEC-003 responses (returns input unchanged when markers absent) and on None/empty strings. (molecule-sdk-python #8)

🔧 Fixes

• Canvas accessibility — WCAG 2.4.7 focus-visible rings (batch 2): focus-visible keyboard rings added to 9 customer-facing buttons across molecule-app — SignInButton on the landing page, "Request access" on the waitlist page, "+ New Workspace" CTA and Notifications bell in the app shell, "Try again" on error boundaries, "Sign out" in the header, the "I agree" button on terms-gate, and "Manage keys on canvas" in the API tokens view. ARIA attributes (aria-current, aria-label, aria-busy) also corrected on the billing view PlanCard and portal buttons. All rings use semantic color tokens — no hardcoded hex colors. (molecule-app #5)
• Canvas accessibility — WCAG 2.4.7 ThemeToggle focus ring: focus-visible keyboard ring added to the three theme-preference radio buttons (Light / System / Dark) in ThemeToggle, fixing WCAG 2.4.7 for the theme switcher. (molecule-app #10)
• Canvas accessibility — WCAG 2.4.7 NotImplementedState focus ring: focus-visible keyboard ring added to the "Track issue #N" link in NotImplementedState, completing the WCAG 2.4.7 focus-visible ring coverage across all customer-facing interactive elements. (molecule-app #9)
• SSRF validation before writing external workspace URL: the workspace handler now validates URLs against SSRF allowlists before writing external workspace configurations. (molecule-core #221)
• Dockerfile tenant chown /org-templates: /org-templates directory now correctly chowned to the canvas user to fix EACCES on mkdir for external resolvers. (molecule-core #223)
• CI ghcr → ECR migration + POST route smoke tests: canary-verify workflow migrated from GHCR to ECR; new POST route smoke tests added for deployment verification. (molecule-core #217)
• CI dorny/paths-filter → shell-based git diff: replaced dorny/paths-filter with shell-based git diff for Gitea Actions compatibility. (molecule-core #208)
• SOP tier-check clause splitter strips newlines: the SOP tier-check script's clause splitter now correctly preserves newlines, fixing every tier:low PR CI failure. (molecule-core #243)
• SOP tier-check APPROVER_TEAMS pattern matching: outer quotes removed from case patterns in APPROVER_TEAMS matching logic, fixing approval team resolution. (molecule-core #231)
• CI port publish-workspace-server-image.yml to .gitea/workflows/: publish-workspace-server-image.yml migrated from .github/workflows/ to .gitea/workflows/ for Gitea Actions parity. (molecule-core #237)
• CI port publish-runtime.yml to .gitea/workflows/: publish-runtime.yml migrated from .github/workflows/ to .gitea/workflows/ for Gitea Actions parity. (molecule-core #211)
• Docker base image digests pinned: base image digests pinned in all Dockerfiles to ensure reproducible builds and prevent unexpected base image updates. (molecule-core #199)
• KeyboardShortcutsDialog corrected: keyboard shortcuts dialog text corrected and min-clamp test expectations fixed. (molecule-core #200)
• MODEL_PROVIDER env var deprecated: the MODEL_PROVIDER env var was misnamed — it carried the model ID (e.g. claude-opus-4-7) despite its name, and was being misused as a runtime selector. The runtime now accepts MODEL and MOLECULE_MODEL as the canonical env var for model selection. MODEL_PROVIDER still works but emits a deprecation warning. (molecule-core #280)
• delegate_task self-delegation guard: calling delegate_task with your own workspace ID now returns an early actionable error instead of deadlocking the task lock. Previously self-delegation would hold _run_lock, timeout after 30 s, and waste the turn. (molecule-core #291)
• status.moleculesai.app false "down" reports fixed: the custom uptime-probe binary correctly writes raw JSONL results but the aggregator step — which renders history/<slug>.yml and history/summary.json in Upptime format — was not migrated when the probe moved from Upptime to the custom binary post-2026-05-06. The missing aggregator caused status.moleculesai.app to show false-positive outages for Canvas and other endpoints. Resolved by adding the probe result aggregator. (molecule-ai-status #10)

📚 Docs

• Canvas known issues section cleaned up: duplicate entries removed from known issues; pre-commit action link fixed. (molecule-core #202)
• Canvas controls section corrected: Canvas Controls section corrected to reflect current keyboard navigation and MiniMap state. (molecule-core #201)

🧹 Internal

• SOP tier-check AND-composition of required team approvals per tier: tier-check now enforces AND-composition of required team approvals per tier (tier:high). (molecule-core #225)
• Canvas structural tests for TIER_CONFIG and COMM_TYPE_LABELS: structural tests added for canvas TIER_CONFIG and COMM_TYPE_LABELS constants. (molecule-core #245)

---

2026-05-09

✨ New features

• Keyboard-accessible canvas node resize: Cmd/Ctrl+Arrow keys now resize canvas nodes in the topology view, satisfying WCAG AA keyboard navigation requirements. (molecule-core #192)
• Keyboard-accessible edge anchors: Enter/Space on an edge now selects the anchor for keyboard-based topology editing. (molecule-core #190)

🔧 Fixes

• Handlers auto-restart workspace after file write/delete/replace: file mutations via the Canvas editor now correctly trigger workspace restart, ensuring the agent picks up the new file state without manual intervention. (molecule-core #188)
• CI gh api → Gitea API migration: all GitHub Actions gh api calls replaced with Gitea-compatible alternatives — CI now runs cleanly in Gitea Actions without GitHub dependency. (molecule-core #191)
• WCAG AA contrast fix + KeyboardShortcutsDialog improvements: toolbar contrast ratios corrected for WCAG AA compliance; keyboard shortcuts dialog now scrolls properly on small viewports. (molecule-core #198)

📚 Docs

• Canvas accessibility audit — all gaps now closed: the accessibility audit doc updated to reflect fully closed status. (molecule-core #197)
• Canvas controls section corrected: keyboard accessibility and MiniMap presence now correctly documented. (molecule-core #201)
• Stale audit doc text fixed: stale text from PR #182 corrected in canvas audit documentation. (molecule-core #187)

🧹 Internal

• gh-identity module path migration: github.com/Molecule-AI/gh-identity imports migrated to git.moleculesai.app/molecule-ai/gh-identity across all workspace templates. (molecule-core #189)
• Pending uploads test isolation fix: sweeper test isolation corrected — eliminates cross-test pollution in CI. (molecule-core #185)
• Poll error counter to 0 before assert: RecordsMetricsOnSuccess now polls error counter to 0 before asserting, eliminating flaky E2E test failures. (molecule-core #194)

---

2026-05-08

🔧 Fixes

• molecule-app CI testTimeout bumped to 20s: vitest testTimeout increased to 20 s to handle shared act_runner load on the molecule-app repo. (molecule-app #4)
• molecule-app drops staging branch — trunk-based migration: first repo of the trunk-based development migration; staging branch removed. (molecule-app #3)
• docs CI switches to ubuntu-latest: docs repo CI now uses ubuntu-latest now that the repo is public. (docs #4)

---

2026-05-07

📚 Docs

• Install guide — GitHub.com refs → Gitea: all active github.com/Molecule-AI references migrated to git.moleculesai.app/molecule-ai in the installation docs. (docs #1)
• Website github.com → Gitea link migration: molecules-market website links updated to point at Gitea. (landingpage #3)
• molecule-monorepo → molecule-core rename (Phase 4): landingpage follow-up renaming of molecule-monorepo to molecule-core in all cross-repo references. (landingpage #4)
• CI lowercase 'molecule-ai/' in cross-repo workflow refs: cross-repo workflow references now consistently lowercase for Gitea Actions compatibility. (landingpage #2)
• Market Purchase button on tier cards: demo Mock #1 — Purchase button now appears on tier cards in the molecules-market. (landingpage #5)

🔧 Fixes

• molecule-app runs-on ubuntu-latest: Hetzner runner labels post-suspension; CI now uses ubuntu-latest. (molecule-app #1)
• molecule-app GitHub → Gitea URL migration: all github.com/Molecule-AI references migrated to git.moleculesai.app/molecule-ai in molecule-app. (molecule-app #2)
• docs GitHub → Gitea URL migration: github.com/Molecule-AI references migrated to Gitea across docs repo. (docs #3)

---

2026-05-06

🧹 Internal

• molecule-core org-wide Gitea URL migration: all github.com/Molecule-AI references migrated to git.moleculesai.app/molecule-ai across all repos in the org. (molecule-core)
• Hetzner act-runner suspension: CI runners updated to use ubuntu-latest labels following Hetzner act-runner suspension. (molecule-app #1)

---

← Back to the current changelog · April 2026