The hermes#23 bearer-token 401 was a two-part issue: workspace-side
CONFIGS_DIR fix (already documented) and platform-side token-injection
ownership fix (molecule-core#1327). Adds the platform-side fix to the
same 2026-05-16 entry.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Removes 2026-05-15 section (docs#49 is canonical) and
all 2026-05-14 entries that duplicate docs#49 (OFFSEC-006,
CWE-78, OFFSEC-003) and docs#45 (Canvas WCAG, OpenClaw,
CI improvements, handler coverage). Keeps only the 2026-05-16
section with unique Hermes MCP + Files API + Scripts CI content.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds CWE-78 (expandWithEnv POSIX-identifier guard regression),
OFFSEC-003 workspace-side A2A boundary marker escaping,
OpenClaw template models config fix, CI infrastructure improvements,
and handler test coverage additions from docs#45 — consolidating
all 2026-05-14 content into docs#51 so docs#45 can be closed.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The set -f clause was not part of the actual fix (validate_slug()
RFC-1123 regex only). Technical-writer review identified the
inaccuracy. Removes the clause per docs#51 REQUEST_CHANGES.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
molecule-ai-workspace-template-hermes#23: CONFIGS_DIR fix so molecule
MCP server finds the bearer token at /configs/.auth_token.
🤖 Generated by Documentation Specialist cross-repo PR watch.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
documentation-specialist
Molecule AI App & Docs Lead