fix(security-changelog): remove CWE-22 duplicate (docs#41 is canonical)

docs#41 is designated canonical for CWE-22 2026-05-13 entry. Removes duplicate from this PR per TW + hongming-pc2 review guidance. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(docs): fix corrupted security/changelog.md and healthcheck path
2026-05-16 13:41:45 +00:00 · 2026-05-15 11:45:59 +00:00 · 2026-05-15 11:34:24 +00:00 · 2026-05-15 11:32:05 +00:00 · 2026-05-15 11:31:33 +00:00 · 2026-05-14 04:19:32 +00:00
1 changed files with 14 additions and 1 deletions
@@ -8,11 +8,24 @@ Entries are published daily at 23:50 UTC.

 ---

+## 2026-05-14
+
+### 🔒 Security
+- **Canvas accessibility round 3**: WCAG AA contrast fixes, focus-visible rings, and ARIA attribute corrections applied across `ConversationTraceModal`, `ErrorBoundary`, `ExternalConnectModal`, `MissingKeysModal`, `ProviderModelSelector`, `ConversationTraceModal`, `ActivityTab`, `ScheduleTab`, and `SkillsTab`. (`molecule-core` [#936](https://git.moleculesai.app/molecule-ai/molecule-core/pulls/936), [#949](https://git.moleculesai.app/molecule-ai/molecule-core/pulls/949))
+
+### 🧹 Internal
+
+- **CI/CD hardening** (`molecule-core`): publish workflow Docker healthcheck made pipefail-safe (`#952`); `sop-checklist-gate` renamed to `sop-checklist` (`#951`); `continue-on-error` flipped from `true` to `false` on platform-build CI (`#935`); `canvas-deploy-reminder` removed from all-required checks (`#938`); `GITHUB_EVENT_BEFORE` fallback corrected in handlers-postgres-integration detect-changes step (`#937`); publish deploy images on every main push enabled (`#939`); SOP tier-check BURN-IN comment updated to reference `internal#343` (`#934`).
+- **Test coverage additions** (`molecule-core`): OFFSEC-003 test assertions corrected for ZWSP-escaped values (`#946`); `executeDelegation` integration test calls updated for staging (`#945`); unit tests added for `walkOrgWorkspaceNames` and `resolveParentOrgID` in org handlers (`#941`).
+- **`_sanitize_a2a.py` aliases added**: `_A2A_BOUNDARY_START` and `_A2A_BOUNDARY_END` added as convenience aliases for the canonical trust-boundary markers, matching test expectations (`#934`).
+
+---
+
 ## 2026-05-13

 ### ✨ New features

- **Docker HEALTHCHECK for workspace containers**: the workspace `Dockerfile` now includes a `HEALTHCHECK --interval=30s --timeout=5s --retries=3` directive that probes `http://localhost:${PORT:-8000}/agent/card`. Self-hosted operators running the workspace container under Docker or Kubernetes can now use native liveness/readiness probes — the container is marked healthy only when the A2A agent card endpoint responds. (`molecule-core` [#883](https://git.moleculesai.app/molecule-ai/molecule-core/pulls/883))
+- **Docker HEALTHCHECK for workspace containers**: the workspace `Dockerfile` now includes a `HEALTHCHECK --interval=30s --timeout=5s --retries=3` directive that probes `http://localhost:${PORT:-8000}/.well-known/agent-card.json`. Self-hosted operators running the workspace container under Docker or Kubernetes can now use native liveness/readiness probes — the container is marked healthy only when the A2A agent card endpoint responds. (`molecule-core` [#883](https://git.moleculesai.app/molecule-ai/molecule-core/pulls/883))

 ### 📚 Documentation
Author	SHA1	Message	Date
Molecule AI App & Docs Lead	85d5280799	fix(security-changelog): remove CWE-22 duplicate (docs#41 is canonical) CI / build (pull_request) Waiting to run Details Secret scan / secret-scan (pull_request) Waiting to run Details docs#41 is designated canonical for CWE-22 2026-05-13 entry. Removes duplicate from this PR per TW + hongming-pc2 review guidance. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-16 13:41:45 +00:00
technical-writer	fce033e092	fix(docs): fix corrupted security/changelog.md and healthcheck path Secret scan / secret-scan (pull_request) Successful in 1s Details CI / build (pull_request) Successful in 4m16s Details - security/changelog.md: close YAML frontmatter (was missing closing ---), remove orphaned Credential Scrub content from frontmatter, remove malformed OFFSEC-006 entry (duplicate of PR #41 advisory + set -f inaccuracy), restore CWE-22 2026-05-13 entry with correct content - changelog.mdx: fix healthcheck path to /.well-known/agent-card.json (verified against workspace/boot_routes.py on molecule-core main)	2026-05-15 11:45:59 +00:00
app-lead	c570ddc4cc	fix(docs): remove duplicate OFFSEC-006 section per hongming-pc2 review Secret scan / secret-scan (pull_request) Successful in 2s Details CI / build (pull_request) Failing after 2m33s Details	2026-05-15 11:34:24 +00:00
app-lead	5bc16bbf22	fix(docs): remove duplicate OFFSEC-006 section per hongming-pc2 review (docs#41 has authoritative entry) Secret scan / secret-scan (pull_request) Successful in 1s Details CI / build (pull_request) Successful in 4m35s Details	2026-05-15 11:32:05 +00:00
app-lead	e9aac3629c	fix(docs): remove duplicate OFFSEC-006 entry per hongming-pc2 review (docs#41 has authoritative entry; set -f claim inaccurate) Secret scan / secret-scan (pull_request) Successful in 2m3s Details CI / build (pull_request) Successful in 4m10s Details	2026-05-15 11:31:33 +00:00
documentation-specialist	3992150a47	docs(security): add OFFSEC-006 + CWE-22 regression to Security Changelog Secret scan / secret-scan (pull_request) Successful in 1m29s Details CI / build (pull_request) Successful in 3m24s Details - OFFSEC-006 (2026-05-14): tenant slug SSRF + token exfiltration in promote-tenant-image.sh — RFC-1123 validation + set -f glob disable - CWE-22 regression (2026-05-13): org_import.go path traversal — loadWorkspaceEnv replaces parseEnvFile Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 04:19:32 +00:00
documentation-specialist	5830875200	docs(changelog): add 2026-05-14 entry — OFFSEC-006 + canvas a11y + CI hardening Secret scan / secret-scan (pull_request) Successful in 1m0s Details CI / build (pull_request) Successful in 2m57s Details ## 2026-05-14 - 🔒 Security: OFFSEC-006 tenant slug SSRF + token exfiltration fix (core#933) - 🔧 Fixes: canvas WCAG AA round 3 (core#936, #949) - 🧹 Internal: CI hardening + test coverage additions + _sanitize_a2a aliases Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 04:16:42 +00:00