Terminology fix: all references to the repo now use the correct name
molecule-core (was molecule-monorepo). No content changes beyond the
repo name update.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Mark Phase 2e as shipped — native tools=[] parameter and
response_format=json_schema now on the Anthropic native dispatch path.
- Update intro paragraph: Phase 2d is now stacked messages (#499),
Phase 2e is tools + structured output (#644, #645)
- Replace Phase 2d roadmap callout with "remaining roadmap" (vision + streaming)
- Update capability table: native tools and response_format now ✅ on
Anthropic native; 📋 roadmap for Gemini native
- Add two new sections with code examples for tools=[] and response_format
- Remove "not yet shipped" language from capability table header
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Document the canvas Memory Inspector panel — Side Panel → Memory tab.
Covers browse (LOCAL/TEAM scopes), semantic search via ?q= param,
and key expansion. Notes polling cadence (~15s heartbeat cycle).
Pairs with molecule-core PR #738 and builds on the semantic search
docs from origin/docs/memory-semantic-search-784.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Document the admin-only cross-org schedule health endpoint returning
last-fired, next-scheduled, consecutive-empty count, and phantom detection
status for every schedule in the org. Complements the per-workspace peer
health endpoint already documented. Pairs with molecule-core PRs #671 and
#796.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Document GET /workspaces/:id/metrics — WorkspaceAuth-required endpoint
returning input/output/cache-read/cache-write token counts over rolling
1h and 30d windows. Notes the canvas WorkspaceUsage panel as the live
counterpart. Security context: endpoint auth hardened in PR #696.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Document POST/DELETE /admin/orgs/:orgId/plugins/allowlist endpoints for
controlling which plugins workspaces in an org may load. Covers allowlist
semantics (empty = all permitted; non-empty = allowlist-only), relationship
to supply-chain pinning, and the two admin API endpoints. Adds both
endpoints to the API Reference table at the bottom of the page.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
molecule-core-net was incorrect — docker-compose.infra.yml and docker-compose.yml both
declare the network as molecule-monorepo-net (8+ references confirmed). Repo was renamed
to molecule-core but the network name was not changed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Repo was renamed Molecule-AI/molecule-monorepo → Molecule-AI/molecule-core.
Updates git clone URLs, cd commands, and Docker network name references
in quickstart.mdx, self-hosting.mdx, and architecture.mdx.
Note: molecule-core-net Docker network name updated from molecule-monorepo-net —
verify docker-compose.infra.yml network name matches before merging.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Documents the two security controls landed in workspace-template/adapters/smolagents:
- make_safe_env() strips *_API_KEY/*_TOKEN + SMOLAGENTS_ENV_DENYLIST from child process env
- safe_send_message() prefixes [smolagents], truncates at 2000 chars, HTML-escapes output
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- google-adk.mdx: update comparison table LangGraph example from
anthropic:claude-sonnet-4-6 → anthropic:claude-opus-4-7
- quickstart.mdx: add callout noting claude-opus-4-7 as the new
default for workspaces that don't pin a model explicitly
Pairs with molecule-core PR #743 / closes#727.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Documents GET /workspaces/:id/events/stream — WorkspaceAuth-guarded
Server-Sent Events endpoint compatible with the AG-UI protocol.
Covers envelope format, event types, curl and JS examples.
Pairs with molecule-core PR #601 (closes#590).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Quick start install example: add @1.0.0 version pin
- .mcp.json Configure example: pin to @1.0.0, remove -y auto-accept flag
- Add Callout warning explaining why pinning is required (unpinned + -y =
arbitrary code execution on package compromise) with link to npm page
- Troubleshooting: update standalone run example to use pinned version
Addresses SAFE-MCP finding NEW-003 (HIGH) from SAFE-MCP audit (PR #808).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Two-Axis Model sources table: replace mutable `github://owner/repo` row with
pinned-tag and pinned-SHA rows; clarify these are now the only valid forms
- Installing a Plugin: update GitHub example to use `#v1.0.0`; add Callout
warning that bare refs return HTTP 422 with link to Supply Chain Security section
- Install Safeguards: add `PLUGIN_ALLOW_UNPINNED` env var row (dev escape hatch)
- New "Supply Chain Security" section: explains pinned-ref enforcement (SAFE-T1102),
shows valid vs invalid ref forms, SHA-256 content integrity option with hash
computation recipe, and PLUGIN_ALLOW_UNPINNED escape hatch
Pairs with monorepo PR #775 (fix(security): plugin supply chain hardening).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PR #760 extracted medo.py from builtin_tools (where it was dead code) into
a proper agentskills.io plugin at plugins/molecule-medo/. It is now an
explicit opt-in via local://molecule-medo rather than being silently shipped
in every workspace image.
- Add Platform Opt-in Plugins table with molecule-medo
- Document the three exposed tools: create/update/publish_medo_app
- Show install flow: set MEDO_API_KEY secret, then POST to /plugins
- Show org.yaml example for declarative deployment
Pairs with monorepo PR #760 / closes#741.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PR #784 added pgvector-backed semantic search to GET /workspaces/:id/memories.
When ?q= is supplied and an embedding function is configured, results are
ordered by cosine similarity and include a similarity_score field.
Documents the query parameter, response shape, and graceful FTS fallback
so callers know the endpoint is backwards-compatible.
Pairs with monorepo PR #784 (feat: pgvector semantic search, closes#776).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Workspace config.yaml now supports a `role` field which drives
AGENTS.md generation at startup (PR #763). Every workspace publishes
an AAIF-standard /workspace/AGENTS.md so peers can discover name,
role, description, A2A endpoint, and MCP tools.
- Expand Workspaces section with AGENTS.md auto-generation details
- Add table of AGENTS.md sections and their config.yaml sources
- Add role field to all workspaces in the org definition example
- Document fallback (role → description) and non-fatal startup behaviour
Pairs with monorepo PRs #763 and #794.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
