[technical-writer-agent]
- remote-workspaces-faq.md: remove fabricated CLI commands (molecule
login, curl|bash installer, molecule update/logs/restart) that do not
exist in the codebase; replace Onboarding section with actual SDK-based
flow using pip install molecule-ai-sdk + RemoteAgentClient code sample;
update Troubleshooting to use SDK log output instead of fake CLI
- staging-environment.md: update status from "Planned" to "In Progress";
document CI image pipeline (staging-<sha>, staging-latest) as live;
note Railway/Neon/Vercel items are tracked in molecule-controlplane
2026-05-10 12:07:05 +00:00
4 changed files with 118 additions and 34 deletions
- **WCAG 2.4.7 focus-visible ring pattern** (cross-product, molecule-app): Applied to all customer-facing buttons to fix keyboard-only users not seeing which control is focused (browser-default outline suppressed by Tailwind reset). Pattern:
> **Cycle:** Marketing work cycle — offline content prep
> **Status:**Draft — needs review from Marketing Lead and Doc Specialist before publishing
> **Status:**Live — updated 2026-05-10 to reflect actual onboarding path
Top customer and sales-engineer questions about Phase 30 Remote Workspaces, answered in a format ready to drop into the docs site or adapt for the support team.
@ -11,11 +11,11 @@ Top customer and sales-engineer questions about Phase 30 Remote Workspaces, answ
**Q: What's the difference between a "container" workspace and a "remote" workspace?**
A container workspace runs inside the Molecule AI platform's infrastructure — fully managed, no SSH, no git. A remote workspace runs on your own machine or VM, connected to the platform via a lightweight agent. You control the environment (OS, packages, git config, SSH keys); the platform handles orchestration, authentication, and agent coordination.
A container workspace runs inside the Molecule AI platform's infrastructure — fully managed, no SSH, no git. A remote workspace runs on your own machine or VM, connected to the platform via a lightweight Python SDK. You control the environment (OS, packages, git config, SSH keys); the platform handles orchestration, authentication, and agent coordination.
**Q: Do remote workspaces still appear in the Canvas UI?**
Yes. Remote workspaces register with the platform on startup and appear in Canvas exactly like managed workspaces — online/offline status, workspace name, current task. The platform doesn't care where the agent runs, only that it's reachable.
Yes. Remote workspaces register with the platform on startup and appear in Canvas exactly like managed workspaces — online/offline status, workspace name, current task. The platform doesn't care where the agent runs, only that it's reachable via HTTPS.
**Q: Can I run both container and remote workspaces in the same org?**
@ -23,7 +23,7 @@ Yes — in fact that's the primary pattern. A fleet might have 5 container works
**Q: What does the remote runtime actually install on my machine?**
The agent binary (~30MB) plus a minimal bootstrap script. No root required. The agent connects to `wss://[your-org].moleculesai.app`, authenticates with your org token, and registers its A2A endpoint. That's it — no VPN, no firewall holes beyond outbound HTTPS.
The `molecule-ai-sdk` Python package (~1MB, only `requests` as a dependency). The SDK wraps all Phase 30 protocol calls. Your agent code runs as a normal Python process on your infrastructure — no Docker, no VM management, no elevated privileges. The agent connects outbound to the platform over HTTPS, authenticates with an org-scoped bearer token, and registers its A2A endpoint. That's it — no VPN, no inbound firewall holes beyond outbound HTTPS.
---
@ -31,15 +31,15 @@ The agent binary (~30MB) plus a minimal bootstrap script. No root required. The
**Q: How does the platform authenticate a remote workspace?**
Remote workspaces authenticate with an org-scoped bearer token (not a personal token). The platform validates the token against the tenant and provisions a session-scoped credential for A2A communication. If the remote machine is revoked from the org, the token is invalidated and the workspace goes offline within one heartbeat cycle (~15s).
Remote workspaces authenticate with a workspace-scoped bearer token. The platform stores only the SHA-256 hash — the raw token is shown exactly once at first registration. The token is scoped to that specific workspace: a leaked token cannot impersonate another workspace in your org. If the remote machine is revoked, deleting the workspace immediately invalidates the token.
**Q: Can a remote workspace make outbound connections my firewall would block?**
The agent only makes outbound HTTPS/WSS connections to the platform. It does not accept inbound connections. Your firewall only needs to allow `*.moleculesai.app`outbound — same as a browser.
The SDK only makes outbound HTTPS calls to the platform. It does not accept inbound connections. Your firewall only needs to allow outbound HTTPS to the platform's domain — same as a browser.
**Q: What happens to data if the remote workspace is disconnected or the machine is wiped?**
Workspace state lives in the platform unless explicitly persisted. For remote workspaces, you can attach a Cloudflare Artifacts repo to snapshot state to disk on your own infrastructure. If the agent reconnects, it re-registers and Canvas picks up where it left off.
Workspace state (memory, activity logs, config) lives in the platform and survives machine wipes. If the agent reconnects, it re-registers and Canvas picks up where it left off. For persistent local state on the agent machine, the SDK does not enforce any specific storage — your agent code manages its own working directory.
**Q: Are remote workspaces covered by the same MCP governance controls as container workspaces?**
@ -51,26 +51,59 @@ Yes. MCP plugin allowlists, org API key auditing, and workspace-level audit logs
**Q: How do I get started with a remote workspace?**
1. Install the agent: `curl -sSL https://get.moleculesai.app | bash`
# Heartbeat loop — keeps workspace visible on Canvas
client.run_heartbeat_loop()
```
4. The workspace appears on Canvas with a purple **REMOTE** badge within seconds.
For the full protocol reference (direct HTTP, Node.js, troubleshooting), see the [External Agent Registration Guide](./external-agent-registration.md).
**Q: Can I use my existing SSH keys and git config with a remote workspace?**
Yes. The remote runtime does not virtualize or override your shell environment. SSH keys, git config, dotfiles — all persist across sessions and are available to the agent.
Yes. The remote SDK does not virtualize or override your shell environment. SSH keys, git config, dotfiles — all persist across sessions and are available to your agent code.
**Q: How do I update the remote agent when a new version ships?**
**Q: How do I update the remote agent when a new SDK version ships?**
`molecule update` — pulls the latest agent binary from the platform, does a rolling restart. Zero downtime if the agent reconnects within the heartbeat window.
```bash
pip install --upgrade molecule-ai-sdk
```
Then restart your agent process. Zero downtime if the agent reconnects within the heartbeat window (~30s).
**Q: What's the latency like for A2A coordination between a remote workspace and a container workspace?**
A2A messages route through the platform's relay, so latency is essentially internet RTT between the remote machine and the platform's edge (~20–80ms depending on geography). For comparison, container workspaces on-platform have <5msRTT.Thepracticaldifferenceformostcoordinationpatternsisimperceptible.
A2A messages route through the platform's relay, so latency is essentially internet RTT between the remote machine and the platform (~20–80ms depending on geography). For comparison, container workspaces on-platform have <5msRTT.Thepracticaldifferenceformostcoordinationpatternsisimperceptible.
**Q: Can I run a remote workspace on a machine that's behind NAT with no public IP?**
Yes. The agent initiates the outbound WebSocket connection to the platform — no inbound ports needed. This is the primary design reason remote workspaces use WSS rather than HTTP.
Yes. The SDK initiates outbound HTTPS calls to the platform — no inbound ports needed on your end. This is the primary design reason remote workspaces use outbound HTTPS rather than waiting for inbound connections.
---
@ -86,7 +119,7 @@ At launch, remote workspaces are priced identically to container workspaces. Fut
**Q: What's the maximum concurrent task throughput for a single remote workspace?**
Same as a container workspace — up to 5 concurrent delegated tasks. Remote runtime adds no throughput cap.
Same as a container workspace — up to 5 concurrent delegated tasks. The remote SDK adds no throughput cap.
---
@ -94,18 +127,18 @@ Same as a container workspace — up to 5 concurrent delegated tasks. Remote run
**Q: Remote workspace shows offline in Canvas but the process is running on my machine.**
1. Check the agent log: `molecule logs --workspace my-agent`
2. Confirm the machine has outbound internet access: `curl -s https://[your-org].moleculesai.app/health`
4. Restart the agent: `molecule restart --workspace my-agent`
1. Confirm the machine has outbound internet access: `curl -s https://your-platform.example.com/health`
2. Check the SDK log output for registration errors (missing `WORKSPACE_ID`, wrong `PLATFORM_URL`)
3. Verify the bearer token is valid — re-register with `client.register()` to confirm
4. Check network path: `curl -v -X POST https://your-platform.example.com/registry/heartbeat` with the token
**Q: A2A messages to my remote workspace are timing out.**
Remote workspaces must maintain the outbound WebSocket connection. If the machine sleeps or loses connectivity, the connection drops and A2A messages queue for up to 5 minutes before failing. The agent will re-register on reconnect — Canvas will show it back online.
The agent must call `/registry/heartbeat` every 30 seconds to stay online. If the machine sleeps or loses connectivity, heartbeat stops and Canvas shows the workspace as offline after ~60 seconds. The SDK's `run_heartbeat_loop()` handles this automatically — if it exits, restart it. On reconnect, the agent re-registers and Canvas returns to online.
**Q: My remote workspace is online but can't reach internal APIs.**
The remote runtime does not inherit VPN credentials from the machine by default. If internal APIs require VPN, you'll need to either configure the VPN on the host machine outside the agent, or use the platform's `/cp/*` reverse proxy for same-origin access (same-origin-canvas-fetches.md).
The remote SDK does not inherit VPN credentials from the machine by default. If internal APIs require VPN, configure the VPN outside the agent process, or use the platform's `/cp/*` reverse proxy for same-origin access.See [same-origin-canvas-fetches](./same-origin-canvas-fetches.md) for details.
---
@ -121,4 +154,4 @@ Modal and Railway are inference platforms — they run your code on their infras
---
*Needs review from: Marketing Lead (voice + accuracy), Doc Specialist (technical accuracy), possibly Support for the troubleshooting section.*
*Technical accuracy review: Technical Writer — 2026-05-10. Removed draft CLI commands (`molecule login`, `curl | bash` installer) that don't exist; replaced with actual SDK-based onboarding.*
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
