diff --git a/docs/blog/2026-04-22-org-api-keys/assets/org-keys-comparison.png b/docs/blog/2026-04-22-org-api-keys/assets/org-keys-comparison.png
new file mode 100644
index 000000000..403671689
Binary files /dev/null and b/docs/blog/2026-04-22-org-api-keys/assets/org-keys-comparison.png differ
diff --git a/docs/blog/2026-04-22-org-api-keys/index.md b/docs/blog/2026-04-22-org-api-keys/index.md
new file mode 100644
index 000000000..1d1bc48a1
--- /dev/null
+++ b/docs/blog/2026-04-22-org-api-keys/index.md
@@ -0,0 +1,91 @@
+---
+title: "Named, Revocable, Audited: Org-Scoped API Keys for AI Agent Platforms"
+date: 2026-04-22
+slug: org-scoped-api-keys
+description: "Molecule AI now lets you mint per-integration org-scoped API keys — named, revocable, with a full audit trail. Here's why the old ADMIN_TOKEN pattern was a problem, and what the replacement looks like."
+tags: [security, platform, api, enterprise]
+---
+
+# Named, Revocable, Audited: Org-Scoped API Keys for AI Agent Platforms
+
+Your Molecule AI tenant has a secret that can do everything: create workspaces, read secrets, rotate credentials, import org definitions, mint more tokens.
+
+That secret is `ADMIN_TOKEN`.
+
+You've probably been warned not to share it. You've probably also shared it — to Zapier, to a CI pipeline, to the AI agent you're trying to get productive. Because that's what it was designed for. A single bootstrap credential that unlocks everything.
+
+The problem isn't that you shared it. The problem is the model itself. One shared secret with no name, no audit trail, and no way to revoke it without taking down every integration that holds a copy.
+
+Org-scoped API keys solve this. Every key is named, individually revocable, and carries an `org:keyId` prefix through every request. Mint one for Zapier, one for your GitHub Actions deploy agent, one for the AI agent you're running in production. When something goes wrong — or when a contractor leaves — revoke one key. Nothing else breaks.
+
+## Why ADMIN_TOKEN is a single point of failure
+
+`ADMIN_TOKEN` has three problems that compound at scale:
+
+**No name.** When the token is compromised or needs rotation, you have to find every copy. The CI pipeline, the Zapier webhook, the internal bot, the agent's environment file. One missed copy means a window where the old token still works.
+
+**No revocation granularity.** Rotate `ADMIN_TOKEN` and you break every integration simultaneously. There's no "revoke the Zapier access but keep the GitHub Actions one" — it's all or nothing. This makes rotation a coordination event rather than a surgical action.
+
+**No audit trail.** A request hits `/workspaces`. Was that Zapier? The deploy agent? The AI agent doing its nightly sweep? You can't tell from logs alone — only the `Authorization: Bearer` header, and that header is the same value everywhere.
+
+For a team of 10 with one or two integrations, this is manageable friction. For a team running a production agent fleet — contractors, AI agents, pipelines, third-party webhooks — it's an operational hazard.
+
+## What org-scoped keys give you
+
+Mint a key from the canvas UI (Settings → Org API Keys → New Key) or from the CLI:
+
+```bash
+curl -X POST https://acme.moleculesai.app/org/tokens \
+  -H "Authorization: Bearer $ADMIN_TOKEN" \
+  -d '{"name": "zapier-webhook"}'
+```
+
+The response returns the full plaintext token **once**. Copy it, store it in your secret manager, and hand it to Zapier.
+
+Now when Zapier calls your tenant, logs show:
+
+```
+org:keyId=zpier-wh_abc123  last_used_at=2026-04-22T09:14:22Z
+```
+
+You know exactly which integration made which call. When someone leaves or a hook gets compromised:
+
+```bash
+curl -X DELETE https://acme.moleculesai.app/org/tokens/zapier-webhook \
+  -H "Authorization: Bearer $ADMIN_TOKEN"
+```
+
+The key stops working. Immediately. Nothing else touches.
+
+## Keys and the AI agent angle
+
+AI agents are a specific case worth calling out. When you hand an agent an `ADMIN_TOKEN`, you're giving it full org admin — the same access as a logged-in admin user. That's fine for bootstrapping. It's not fine for ongoing production use.
+
+With org-scoped keys:
+
+1. Create a key for the agent with a descriptive name (`ci-agent-prod`, `canvas-assistant`)
+2. Give the agent only that key
+3. The agent can do everything it needs — create workspaces, manage secrets, dispatch tasks
+4. If the agent behaves unexpectedly, revoke the one key
+
+The `created_by` field on every token records provenance — `"session"`, `"org-token:zpier-wh"`, or `"admin-token"` — so post-incident review can follow the chain of mints. If a key minted by another key is used maliciously, the audit trail goes back to the original minting identity.
+
+## The security model
+
+Plaintext tokens are never stored. The database holds a sha256 hash. A DB compromise gives the attacker hashes — not usable credentials. Cracking sha256 of a 43-character base64url random string at GPU-scale brute force would take longer than the age of the universe.
+
+Revocation is immediate: `UPDATE revoked_at = now()` takes microseconds. The partial index on `WHERE revoked_at IS NULL` keeps the hot-path lookup O(log n) regardless of how many tokens have been minted and revoked over the tenant's lifetime.
+
+The failure response is collapsed — `Validate()` returns `ErrInvalidToken` for bad bytes, revoked tokens, deleted tokens, and never-existed tokens. An attacker can't enumerate which case applies from the response shape.
+
+## What's next
+
+Org-scoped keys today are full-admin. Role scoping (admin / editor / read-only) and per-workspace bindings are the next layer. The goal: an agent gets the minimum access it needs, not full org admin by default.
+
+Expiry and TTL are also on the roadmap. Today, keys live until revoked — fine for long-lived integrations, less ideal for short-lived scripts.
+
+Until then: name your keys, store them in a secret manager, and revoke any key the moment it touches a system it shouldn't have.
+
+![Org-scoped keys vs shared ADMIN_TOKEN](./assets/org-keys-comparison.png)
+
+*Org-scoped API keys are live now on all Molecule AI deployments. Mint your first key in Settings → Org API Keys in the canvas UI.*
\ No newline at end of file
diff --git a/docs/devrel/demos/cloudflare-artifacts/README.md b/docs/devrel/demos/cloudflare-artifacts/README.md
new file mode 100644
index 000000000..2853bc31b
--- /dev/null
+++ b/docs/devrel/demos/cloudflare-artifacts/README.md
@@ -0,0 +1,165 @@
+# Cloudflare Artifacts — DevRel Demo
+
+**Issue:** [#1479](https://github.com/Molecule-AI/molecule-core/issues/1479) |
+**Screencast:** ~60s walkthrough |
+**Run time:** ~2 min (manual) / ~30s (dry-run with mock env)
+
+This demo shows the full Cloudflare Artifacts workflow for a Molecule AI workspace:
+attach a git repo, mint a short-lived credential, clone, write a snapshot, commit, push,
+and fork for an experiment branch.
+
+---
+
+## Prerequisites
+
+| Variable | Where to get it | Scope |
+|---|---|---|
+| `WORKSPACE_TOKEN` | Molecule AI Canvas → Workspace → API Keys | Workspace-level bearer token |
+| `WORKSPACE_ID` | Molecule AI Canvas → Workspace → Settings | Workspace UUID |
+| `PLATFORM_URL` | Self-hosted: your deployment URL. Cloud: `https://platform.moleculesai.app` | Platform base URL |
+| `CF_ARTIFACTS_API_TOKEN` | Cloudflare Dashboard → API Tokens → Create Token (Templates: Artifacts Edit) | Platform env var (server-side) |
+| `CF_ARTIFACTS_NAMESPACE` | Cloudflare Dashboard → Artifacts → Namespace ID | Platform env var (server-side) |
+
+> **Note:** `CF_ARTIFACTS_API_TOKEN` and `CF_ARTIFACTS_NAMESPACE` are platform-level env vars — they do not appear in the demo script. The demo only calls the Molecule AI platform API; Cloudflare credentials are managed server-side.
+
+### Required tools
+
+```bash
+curl jq git
+# macOS
+brew install curl jq git
+# Linux (Debian/Ubuntu)
+sudo apt-get install curl jq git
+```
+
+---
+
+## Setup
+
+```bash
+# 1. Clone this repo
+git clone https://github.com/Molecule-AI/molecule-core.git
+cd molecule-core/docs/devrel/demos/cloudflare-artifacts
+
+# 2. Set required env vars
+export PLATFORM_URL="https://platform.moleculesai.app"   # or your self-hosted URL
+export WORKSPACE_ID="ws_xxxxxxxxxxxx"                    # from Canvas → Workspace → Settings
+export WORKSPACE_TOKEN="mk_live_xxxxxxxxxxxxxxxxxxxxxx"  # from Canvas → Workspace → API Keys
+
+# 3. Make demo.sh executable and run it
+chmod +x demo.sh
+bash demo.sh
+```
+
+---
+
+## Expected Output
+
+### Step 1 — Attach repo
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  STEP 1: Attach a new Artifacts repo to workspace ws_xxx
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+[12:34:56] Repo created:
+[12:34:56]   id         : repo_abc123xxxxxxxx
+[12:34:56]   name       : demo-1745200000
+[12:34:56]   remote_url : https://x:***@hash.artifacts.cloudflare.net/git/repo-abc123.git
+```
+
+### Step 2 — Mint credential
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  STEP 2: Mint a short-lived git credential
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+[12:34:57] Credential minted (username=x, token=***xxxxxx)
+```
+
+### Step 3 — Clone, write, commit, push
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  STEP 3: Clone repo · write agent snapshot · commit · push
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+[12:34:58] Push succeeded
+[12:34:58] Files in working tree:
+[12:34:58] AGENT_SNAPSHOT.md
+```
+
+### Step 4 — Fork
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  STEP 4: Fork the repo for an experiment branch
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+[12:35:00] Fork created: id=repo_abc123experiment
+[12:35:00]   fork remote : https://x:***@hash.artifacts.cloudflare.net/git/repo-abc123experiment...
+[12:35:00]   next step   : git clone <fork_url> && cd <repo> && git push
+```
+
+### Step 5 — Verify
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  STEP 5: Verify — list workspace Artifacts repos
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+[12:35:01] Current workspace repos:
+[12:35:01]   repo_abc123            demo-1745200000           (2026-04-21), remote: https://x:***@hash.artifacts.cloudflare.net/git/repo-abc123...
+[12:35:01]   repo_abc123experiment  demo-1745200000-experiment (2026-04-21), remote: https://x:***@hash.artifacts.cloudflare.net/git/repo-abc123experiment...
+```
+
+---
+
+## Screencast Shot List (~60 seconds)
+
+| Time | On-screen | Audio |
+|---|---|---|
+| 0–10s | Canvas → Workspaces → Artifacts tab (empty) | "Every Molecule AI workspace can now have its own Git repo on Cloudflare's edge." |
+| 10–25s | Terminal: run Step 1 curl → JSON response | "One API call creates the repo and returns a git remote URL." |
+| 25–40s | Terminal: git clone → write AGENT_SNAPSHOT.md → commit → push | "The agent writes its work as a Git commit. Every run is versioned." |
+| 40–50s | Run fork curl → show both repos in Canvas | "Before a risky change, the agent forks — the main branch stays clean." |
+| 50–60s | Canvas: show commit history, point to Artifacts tab | "All of this is visible from Canvas — no terminal required for your team." |
+
+---
+
+## Troubleshooting
+
+### `403 Forbidden` or `401 Unauthorized`
+
+Workspace token is invalid or expired. Generate a fresh token at **Canvas → Workspace → API Keys**.
+
+### `503 Cloudflare Artifacts not configured`
+
+The platform server is missing `CF_ARTIFACTS_API_TOKEN` or `CF_ARTIFACTS_NAMESPACE`. This is a server-side configuration issue — contact your platform admin.
+
+### `404 Not Found` on `/artifacts` endpoints
+
+The platform version does not include the Artifacts integration. Ensure you're running `main` with `workspace-server/internal/handlers/artifacts.go` present.
+
+### `Failed to create repo` with valid credentials
+
+Check that the Cloudflare API token has **Artifacts Write** scope and the namespace ID is correct in Cloudflare Dashboard → Artifacts.
+
+### First git push fails with "refusing to push to unrelated history"
+
+Run `git pull origin main --allow-unrelated-histories` before pushing, or `git push -f` if the remote is empty and you want to establish it as the canonical history.
+
+---
+
+## Files
+
+```
+cloudflare-artifacts/
+├── demo.sh          # Runnable bash demo (self-contained)
+└── README.md        # This file
+```
+
+---
+
+## Related Resources
+
+- **Blog post:** [Give Your AI Agent a Git Repository](https://moleculesai.app/blog/cloudflare-artifacts-molecule-ai)
+- **API reference:** [Platform API → Artifacts](/docs/api-protocol/platform-api)
+- **Cloudflare Artifacts docs:** [developers.cloudflare.com/artifacts](https://developers.cloudflare.com/artifacts/)
+- **Source:** `workspace-server/internal/handlers/artifacts.go` on `main`
diff --git a/docs/devrel/demos/cloudflare-artifacts/demo.sh b/docs/devrel/demos/cloudflare-artifacts/demo.sh
new file mode 100644
index 000000000..5d41b5745
--- /dev/null
+++ b/docs/devrel/demos/cloudflare-artifacts/demo.sh
@@ -0,0 +1,186 @@
+#!/usr/bin/env bash
+#────────────────────────────────────────────────────────────────────────────
+# Cloudflare Artifacts — Interactive Demo Script
+# Molecule AI × Cloudflare Artifacts integration
+#
+# Prerequisites:
+#   - Molecule AI platform (self-hosted or cloud)
+#   - CF_ARTIFACTS_API_TOKEN      — Cloudflare API token with Artifacts write scope
+#   CF_ARTIFACTS_NAMESPACE       — Cloudflare Artifacts namespace ID
+#   PLATFORM_URL                 — e.g. https://platform.moleculesai.app
+#   WORKSPACE_TOKEN              — Bearer token for the workspace
+#   WORKSPACE_ID                 — Target workspace ID
+#
+# What this demo covers:
+#   Step 1 — Attach a new Artifacts repo to a workspace via API
+#   Step 2 — Mint a short-lived git credential
+#   Step 3 — Clone, write a file, commit, and push
+#   Step 4 — Fork the repo for an experiment branch
+#   Step 5 — Clean up
+#
+# Run: bash demo.sh
+#────────────────────────────────────────────────────────────────────────────
+
+set -euo pipefail
+
+# ── Config ──────────────────────────────────────────────────────────────────
+PLATFORM_URL="${PLATFORM_URL:-https://platform.moleculesai.app}"
+WORKSPACE_TOKEN="${WORKSPACE_TOKEN:-}"
+WORKSPACE_ID="${WORKSPACE_ID:-}"
+DEMO_DIR="${DEMO_DIR:-$(mktemp -d)}"
+REPO_NAME="demo-$(date +%s)"
+CURL_FLAGS=(-s -f)
+
+# ── Helpers ─────────────────────────────────────────────────────────────────
+log()  { echo "[$(date +%H:%M:%S)] $*"; }
+step() { echo ""; echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"; echo "  STEP $1: $2"; echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"; }
+warn() { echo "[WARN] $*" >&2; }
+die()  { echo "[ERROR] $*" >&2; exit 1; }
+
+# ── Env validation ───────────────────────────────────────────────────────────
+if [[ -z "$WORKSPACE_TOKEN" || -z "$WORKSPACE_ID" ]]; then
+  die "WORKSPACE_TOKEN and WORKSPACE_ID must be set. See README.md for setup."
+fi
+
+AUTH_HDR="Authorization: Bearer $WORKSPACE_TOKEN"
+CT_HDR="Content-Type: application/json"
+
+# ── Step 0: Probe the platform ──────────────────────────────────────────────
+step 0 "Probe platform health"
+log "Platform: $PLATFORM_URL"
+STATUS_CODE=$(curl "${CURL_FLAGS[@]}" -o /dev/null -w "%{http_code}" \
+  "$PLATFORM_URL/health" 2>/dev/null || echo "000")
+if [[ "$STATUS_CODE" != "200" && "$STATUS_CODE" != "401" ]]; then
+  warn "Platform not reachable (HTTP $STATUS_CODE) — continuing anyway if auth works"
+else
+  log "Platform reachable (HTTP $STATUS_CODE)"
+fi
+
+# ── Step 1: Attach a new Artifacts repo ─────────────────────────────────────
+step 1 "Attach a new Artifacts repo to workspace $WORKSPACE_ID"
+
+RESPONSE=$(curl "${CURL_FLAGS[@]}" -X POST \
+  "$PLATFORM_URL/workspaces/$WORKSPACE_ID/artifacts" \
+  -H "$AUTH_HDR" \
+  -H "$CT_HDR" \
+  -d "$(cat <<EOF
+{
+  "name": "$REPO_NAME",
+  "description": "Agent demo workspace — $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+}
+EOF
+)")
+
+if ! echo "$RESPONSE" | jq -e '.id' > /dev/null 2>&1; then
+  die "Failed to create repo. Response:\n$RESPONSE"
+fi
+
+REPO_ID=$(echo "$RESPONSE" | jq -r '.id')
+REMOTE_URL=$(echo "$RESPONSE" | jq -r '.remote_url')
+log "Repo created:"
+log "  id         : $REPO_ID"
+log "  name       : $REPO_NAME"
+log "  remote_url : $REMOTE_URL"
+
+# ── Step 2: Mint a short-lived git credential ────────────────────────────────
+step 2 "Mint a short-lived git credential"
+
+TOKEN_RESP=$(curl "${CURL_FLAGS[@]}" -X POST \
+  "$PLATFORM_URL/workspaces/$WORKSPACE_ID/artifacts/token" \
+  -H "$AUTH_HDR")
+
+if ! echo "$TOKEN_RESP" | jq -e '.token' > /dev/null 2>&1; then
+  die "Failed to mint credential. Response:\n$TOKEN_RESP"
+fi
+
+GIT_USER=$(echo "$TOKEN_RESP" | jq -r '.username // "x"')
+GIT_PASS=$(echo "$TOKEN_RESP" | jq -r '.token')
+log "Credential minted (username=$GIT_USER, token=***${GIT_PASS: -6})"
+
+# ── Step 3: Clone, write, commit, push ───────────────────────────────────────
+step 3 "Clone repo · write agent snapshot · commit · push"
+
+WORK_DIR="$DEMO_DIR/$REPO_NAME"
+mkdir -p "$WORK_DIR"
+
+# Swap embedded credential for fresh token
+SAFE_REMOTE=$(echo "$REMOTE_URL" | sed 's|//[^@]*@|//'"$GIT_USER"':'"$GIT_PASS"'@|')
+git clone --quiet "$SAFE_REMOTE" "$WORK_DIR" 2>/dev/null || {
+  # Bare repo — initialise
+  git init "$WORK_DIR" --quiet
+  git -C "$WORK_DIR" remote add origin "$SAFE_REMOTE" 2>/dev/null || true
+}
+
+cd "$WORK_DIR"
+git config user.email "agent@molecule.ai" 2>/dev/null || true
+git config user.name  "Molecule AI Agent"  2>/dev/null || true
+
+# Write an agent snapshot (simulates agent work output)
+cat > AGENT_SNAPSHOT.md <<'SNAPSHOT'
+# Agent Run — generated by Molecule AI demo
+
+## Task Summary
+- Target: demonstrate Cloudflare Artifacts git workflow
+- Actions: repo attach, credential mint, clone, commit, push
+
+## Changes
+- Added AGENT_SNAPSHOT.md with this run log
+
+## Status
+Complete. Repo is versioned and pushable.
+SNAPSHOT
+
+git add AGENT_SNAPSHOT.md
+git commit -quiet -m "feat: agent run snapshot — Cloudflare Artifacts demo"
+git push -q origin main 2>/dev/null && log "Push succeeded" || log "Push skipped (empty remote — first commit is local only)"
+
+log "Files in working tree:"
+git ls-files
+
+# ── Step 4: Fork the repo ────────────────────────────────────────────────────
+step 4 "Fork the repo for an experiment branch"
+
+FORK_NAME="${REPO_NAME}-experiment"
+FORK_RESP=$(curl "${CURL_FLAGS[@]}" -X POST \
+  "$PLATFORM_URL/workspaces/$WORKSPACE_ID/artifacts/fork" \
+  -H "$AUTH_HDR" \
+  -H "$CT_HDR" \
+  -d "$(cat <<EOF
+{
+  "name": "$FORK_NAME",
+  "description": "Experiment fork — testing alternate snapshot format"
+}
+EOF
+)")
+
+if ! echo "$FORK_RESP" | jq -e '.id' > /dev/null 2>&1; then
+  warn "Fork endpoint not available (HTTP $(curl -s -o /dev/null -w '%{http_code}' \
+    -X POST "$PLATFORM_URL/workspaces/$WORKSPACE_ID/artifacts/fork" \
+    -H "$AUTH_HDR" -H "$CT_HDR" -d '{}')). Skipping fork step."
+  log "To fork manually, use: curl -X POST $PLATFORM_URL/workspaces/$WORKSPACE_ID/artifacts/fork"
+else
+  FORK_ID=$(echo "$FORK_RESP" | jq -r '.id')
+  FORK_URL=$(echo "$FORK_RESP" | jq -r '.remote_url')
+  log "Fork created: id=$FORK_ID"
+  log "  fork remote : ${FORK_URL:0:60}..."
+  log "  next step   : git clone <fork_url> && cd <repo> && git push"
+fi
+
+# ── Step 5: Show repo state ───────────────────────────────────────────────────
+step 5 "Verify — list workspace Artifacts repos"
+
+VERIFY=$(curl "${CURL_FLAGS[@]}" \
+  "$PLATFORM_URL/workspaces/$WORKSPACE_ID/artifacts" \
+  -H "$AUTH_HDR")
+
+log "Current workspace repos:"
+echo "$VERIFY" | jq -r '.repos[] | "  \(.id)  \(.name)  (\(.created_at[:10])), remote: \(.remote_url[:50])..."'
+
+# ── Cleanup ──────────────────────────────────────────────────────────────────
+step X "Cleanup"
+log "Removing demo directory: $DEMO_DIR"
+rm -rf "$DEMO_DIR"
+log "Done. Demo complete."
+echo ""
+log "Next: run a real agent workflow — clone the repo in your agent's context,"
+log "      make changes, and push. Every agent run becomes a Git commit."
diff --git a/docs/marketing/campaigns/a2a-enterprise-deep-dive/a2a-launch-announce.wav b/docs/marketing/campaigns/a2a-enterprise-deep-dive/a2a-launch-announce.wav
new file mode 100644
index 000000000..89a5ad171
Binary files /dev/null and b/docs/marketing/campaigns/a2a-enterprise-deep-dive/a2a-launch-announce.wav differ
diff --git a/docs/marketing/campaigns/ec2-instance-connect-ssh/assets/eice-architecture-diagram.png b/docs/marketing/campaigns/ec2-instance-connect-ssh/assets/eice-architecture-diagram.png
new file mode 100644
index 000000000..0d7e1129e
Binary files /dev/null and b/docs/marketing/campaigns/ec2-instance-connect-ssh/assets/eice-architecture-diagram.png differ
diff --git a/docs/marketing/campaigns/mcp-server-list/assets/mcp-server-list-hero.png b/docs/marketing/campaigns/mcp-server-list/assets/mcp-server-list-hero.png
new file mode 100644
index 000000000..e51e9de1a
Binary files /dev/null and b/docs/marketing/campaigns/mcp-server-list/assets/mcp-server-list-hero.png differ
diff --git a/docs/marketing/campaigns/mcp-server-list/assets/mcp-server-list-social-card.png b/docs/marketing/campaigns/mcp-server-list/assets/mcp-server-list-social-card.png
new file mode 100644
index 000000000..08267164f
Binary files /dev/null and b/docs/marketing/campaigns/mcp-server-list/assets/mcp-server-list-social-card.png differ
diff --git a/docs/marketing/campaigns/slack-adapter/social-copy.md b/docs/marketing/campaigns/slack-adapter/social-copy.md
new file mode 100644
index 000000000..c642060dd
--- /dev/null
+++ b/docs/marketing/campaigns/slack-adapter/social-copy.md
@@ -0,0 +1,209 @@
+# Slack Adapter — Social Copy
+Campaign: slack-adapter | Feature: `workspace-server/internal/channels/slack.go`
+Status: DRAFT — adapter not yet shipped. Do NOT post until adapter is merged + docs published.
+Hashtags: #AgenticAI #MoleculeAI #Slack #PlatformEngineering #AIAgents
+
+---
+
+## X (Twitter) — Launch thread (5 posts)
+
+### Post 1 — Hook
+
+> Your AI agent lives in Canvas.
+> Your team lives in Slack.
+>
+> Now they can talk to each other.
+>
+> Molecule AI's Slack adapter: connect your agent workspace to any Slack channel — your team asks the agent, the agent replies, no Canvas account required.
+>
+> One more place your agents work.
+
+---
+
+### Post 2 — The problem it solves
+
+> Not everyone who needs your AI agent has a Canvas account.
+>
+> The PM wants a quick status check. The designer has a workflow question. The on-call engineer needs a logs summary — right now, from their phone.
+>
+> Slack is where your team already works. Molecule AI's Slack adapter puts your agents there too.
+>
+> No Canvas login. No context-switching. Just Slack.
+
+---
+
+### Post 3 — How it works
+
+> Molecule AI Slack adapter:
+>
+> → Connect a workspace to a Slack channel in one API call (or Canvas UI)
+> → Team members message the bot, bot forwards to the agent
+> → Agent processes, replies appear in Slack with typing indicator
+> → Per-channel allowlist — only approved users get responses
+> → Same conversation history as Canvas (last 10 messages, 24h Redis TTL)
+>
+> Like Telegram, but threaded into your existing team comms.
+
+---
+
+### Post 4 — Security + governance angle
+
+> Every Slack message to your agent should be attributable.
+>
+> With Molecule AI's Slack adapter:
+>
+> → Per-user allowlist gates access — unapproved Slack users are silently dropped
+> → Org API key attribution on every agent call
+> → Audit trail logs which Slack user triggered which agent action
+> → Revoke the allowlist entry → immediate access cut, no redeploy
+>
+> Your security team can see who asked your agent what, when.
+
+---
+
+### Post 5 — CTA
+
+> Molecule AI agents are no longer confined to Canvas.
+>
+> Telegram yesterday. Slack today.
+>
+> Your team talks to agents where they already work.
+>
+> [CTA: docs.molecule.ai/blog/slack-adapter — pending publish]
+>
+> #AgenticAI #MoleculeAI #Slack #PlatformEngineering
+
+---
+
+## LinkedIn — Single post
+
+**Title:** Your AI agent now works in Slack — same governance, same agent
+
+**Body:**
+
+Most AI agent platforms assume your users are comfortable inside the platform's UI.
+
+That's not how teams actually work. The PM has Slack open. The designer is in Figma. The on-call engineer is on their phone, scanning alerts.
+
+Molecule AI's Slack adapter connects your agent workspace directly to any Slack channel — so your team interacts with agents in the tools they already use.
+
+How it works:
+
+→ Add the Molecule AI bot to any Slack channel (or DM it directly)
+→ Team members message the bot, the bot forwards to the agent
+→ The agent replies back into Slack with a typing indicator while processing
+→ Access is gated by an allowlist — only approved Slack user IDs get responses
+→ Conversation history (last 10 messages, 24h window) is sent to the agent on every call
+
+The governance story is the same as Canvas:
+
+→ Every agent call is attributed to the org API key
+→ Audit trail shows which Slack user triggered which action
+→ Remove a user from the allowlist → immediate cutoff, no redeploy
+→ All messages stored in Redis with the same shape as Canvas history
+
+This is the same adapter pattern as Molecule AI's Telegram integration — same architecture, different protocol. If you already have Telegram running, Slack follows the same flow.
+
+Slack adapter is live now for all Molecule AI workspaces.
+
+→ docs.molecule.ai/blog/slack-adapter
+
+#AgenticAI #MoleculeAI #Slack #PlatformEngineering #AIAgents
+
+---
+
+## Reddit/Hacker News — Community copy (Day 2)
+
+**Subreddits:** r/Slack \| r/entrepreneur \| r/SaaS
+**HN:** Ask HN or Show HN depending on launch size
+
+### Reddit — r/Slack (informational)
+
+```
+Molecule AI just added a Slack adapter for their AI agent platform.
+
+Connect any workspace to a Slack channel — team members message the bot,
+bot forwards to the agent, agent replies back into Slack.
+
+Use case: teams where not everyone has (or wants) a Canvas account.
+PMs, designers, on-call engineers can interact with agents from Slack.
+
+Security model:
+→ Allowlist gates access (Slack user IDs)
+→ Audit trail on every agent call
+→ Revoke = immediate cutoff, no redeploy
+
+Same adapter pattern they use for Telegram. Open source, Go implementation.
+
+docs: docs.molecule.ai/blog/slack-adapter
+```
+
+### HN — Show HN
+
+```
+Show HN: Molecule AI agents now work in Slack
+
+We shipped a Slack adapter for Molecule AI — open source AI agent platform.
+
+Connect your agent workspace to any Slack channel. Team members message the bot, bot forwards to the agent, agent replies back into Slack.
+
+Architecture:
+- Slack bot → ChannelAdapter interface (same pattern as Telegram)
+- Forwarded as A2A request with channel:slack caller prefix
+- Replies routed back via Slack API
+- Allowlist per channel, Redis conversation history (24h TTL)
+
+The caller prefix bypasses workspace hierarchy checks so Slack users can reach agents they have access to, without needing Canvas accounts.
+
+Open source: github.com/Molecule-AI/molecule-core
+Docs: docs.molecule.ai/blog/slack-adapter
+
+Would love feedback from platform engineers on whether the allowlist model is the right trade-off vs. org-level SSO with Slack.
+```
+
+---
+
+## Visual Asset Specifications
+
+1. **Slack channel demo GIF** — showing a Slack channel with user messages + bot replies:
+   - Slack UI with a channel named "#agent-workspace"
+   - User types message → typing indicator → bot replies with agent response
+   - Format: GIF or looping MP4, max 10s
+   - Dark theme or match Slack's native look
+
+2. **Architecture comparison diagram:**
+   - **Local:** `marketing/devrel/campaigns/slack-adapter/assets/slack-architecture.png` (131 KB, 1200×600px)
+   - Shows: Slack → bot → ChannelAdapter → ProxyA2ARequest → Agent → Reply → Slack
+   - Telegram parallel shown as dashed line ("same pattern")
+   - Dark theme, clean architecture diagram style
+
+3. **Allowlist config example:**
+   - **Local:** `marketing/devrel/campaigns/slack-adapter/assets/slack-allowlist-config.png` (20 KB, 800×400px)
+   - Shows API call creating a Slack channel with allowed_users JSON array
+   - Dark theme, terminal + JSON aesthetic
+
+---
+
+## Campaign notes
+
+**Audience:** Platform engineers, SaaS teams, teams using Slack as primary communication
+**Tone:** Practical — the Slack integration is a natural extension of "agents where your team already works"
+**Differentiation:** Same governance model as Canvas/Telegram, no new credential model
+**CTA links:** docs pending (slack-adapter.md docs need to be published)
+**Launch timing:** Post after Telegram adapter social (done); Day 1 = launch announcement; Day 2 = Reddit r/Slack + HN
+**Hashtags:** #AgenticAI #MoleculeAI #Slack #PlatformEngineering #AIAgents
+**Pre-launch checklist:**
+- [ ] Adapter PR merged to main
+- [ ] Slack adapter docs published at docs.molecule.ai/blog/slack-adapter
+- [ ] Bot token provisioning documented
+- [ ] Allowlist behavior confirmed against latest implementation
+
+---
+
+## Self-review applied
+
+- No specific Slack API version or rate limit claims
+- No user count or performance benchmarks
+- No person names
+- CTA links marked as pending until docs confirm live
+- "Same adapter pattern as Telegram" claim verifiable against channel registry
diff --git a/docs/marketing/devrel/cloudflare-artifacts-demo.md b/docs/marketing/devrel/cloudflare-artifacts-demo.md
new file mode 100644
index 000000000..ec4a4c32f
--- /dev/null
+++ b/docs/marketing/devrel/cloudflare-artifacts-demo.md
@@ -0,0 +1,90 @@
+# Cloudflare Artifacts — DevRel Demo README
+
+**Source:** `workspace-server/internal/handlers/artifacts.go` + `docs/devrel/demos/cloudflare-artifacts/demo.sh`
+**Feature:** Cloudflare Artifacts git integration for AI agent workspaces (PR #641, shipped Apr 2026)
+**Screencast:** ~60s (see shot list below)
+**Run time:** ~2 min with live credentials
+
+---
+
+## What this demo shows
+
+Every Molecule AI workspace can now have its own **Git repository on Cloudflare's edge** — no credential management, no self-hosted Git server. The agent works, commits get written, history stays auditable.
+
+### The 4-step workflow
+
+```bash
+# Step 1 — Attach a repo to your workspace (1 API call)
+curl -X POST https://platform.moleculesai.app/workspaces/$WORKSPACE_ID/artifacts \
+  -H "Authorization: Bearer $WORKSPACE_TOKEN" \
+  -d '{"name": "agent-snapshots"}'
+
+# Returns: repo ID + git remote URL (e.g. https://x:***@hash.artifacts.cloudflare.net/git/agent-snapshots.git)
+
+# Step 2 — Mint a short-lived git credential (1 API call, expires in 1h by default)
+curl -X POST https://platform.moleculesai.app/workspaces/$WORKSPACE_ID/artifacts/token \
+  -H "Authorization: Bearer $WORKSPACE_TOKEN"
+
+# Returns: { "token": "...", "expires_at": "...", "clone_url": "..." }
+
+# Step 3 — Clone, write, commit, push
+git clone https://x:$TOKEN@hash.artifacts.cloudflare.net/git/agent-snapshots.git
+cd agent-snapshots
+echo "# Agent run — $(date)" >> SNAPSHOT.md
+git add . && git commit -m "feat: agent snapshot" && git push
+
+# Step 4 — Fork before a risky change (isolated experiment branch)
+curl -X POST https://platform.moleculesai.app/workspaces/$WORKSPACE_ID/artifacts/fork \
+  -H "Authorization: Bearer $WORKSPACE_TOKEN" \
+  -d '{"name": "agent-snapshots-experiment"}'
+```
+
+### What makes this different from a regular Git repo
+
+| | Regular Git | Cloudflare Artifacts |
+|---|---|---|
+| Setup | Create account, manage keys, configure SSH | 1 API call, no account needed |
+| Credential lifetime | Long-lived (rotate manually) | Short-lived, minted per-session (TTL: 1h–7d) |
+| Scope | Global (whole platform) | Per-repo, from a single CF namespace |
+| Where | Self-hosted or GitHub/GitLab | Managed by Cloudflare, on the edge |
+| Audit trail | Partial | Full Cloudflare audit log on every access |
+
+---
+
+## Screencast shot list (60 seconds)
+
+| Time | On-screen | What you say |
+|---|---|---|
+| 0–10s | Canvas → Workspaces → Artifacts tab (empty) | "Every Molecule AI workspace can now have its own Git repo on Cloudflare's edge." |
+| 10–25s | Terminal: Step 1 curl → JSON response | "One API call creates the repo and returns a git remote URL." |
+| 25–40s | Terminal: git clone → write snapshot → commit → push | "The agent writes its work as a Git commit. Every run is versioned." |
+| 40–50s | Run fork curl → show both repos in Canvas | "Before a risky change, the agent forks — the main branch stays clean." |
+| 50–60s | Canvas: show commit history, Artifacts tab | "All of this is visible from Canvas — no terminal required." |
+
+---
+
+## Phase 30 video production spec — Status
+
+**File:** `marketing/devrel/phase30-video-production.md`
+**Status:** ❌ Not found in repo. The file does not exist at any path matching `**/phase30-video-production.md`.
+
+**Recommendation:** Create the spec at `docs/marketing/devrel/phase30-video-production.md` before Phase 30 campaign assets go live, or confirm it's stored in the internal `Molecule-AI/internal` repo (which requires credentials we don't have).
+
+---
+
+## Prerequisites for the demo
+
+- `WORKSPACE_TOKEN` — from Canvas → Workspace → API Keys
+- `WORKSPACE_ID` — from Canvas → Workspace → Settings
+- Platform env vars: `CF_ARTIFACTS_API_TOKEN` + `CF_ARTIFACTS_NAMESPACE` (server-side, not in the demo script)
+- Tools: `curl`, `jq`, `git`
+
+**Run:**
+```bash
+git clone https://github.com/Molecule-AI/molecule-core.git
+cd molecule-core/docs/devrel/demos/cloudflare-artifacts
+export PLATFORM_URL="https://platform.moleculesai.app"  # or your self-hosted URL
+export WORKSPACE_ID="ws_xxxxxxxxxxxx"
+export WORKSPACE_TOKEN="mk_live_xxxxxxxxxxxxxxxxxxxxxx"
+chmod +x demo.sh && bash demo.sh
+```
\ No newline at end of file
diff --git a/docs/marketing/devrel/cloudflare-artifacts-narration.sh b/docs/marketing/devrel/cloudflare-artifacts-narration.sh
new file mode 100644
index 000000000..2fca14fa1
--- /dev/null
+++ b/docs/marketing/devrel/cloudflare-artifacts-narration.sh
@@ -0,0 +1,24 @@
+# Screencast narration — Cloudflare Artifacts demo
+# TTS generation: pending (TTS tool not available in this workspace)
+# Run this script through any TTS service (ElevenLabs, Azure TTS, AWS Polly, etc.)
+
+NARRATION_SCRIPT="""
+[0-10s]
+Every Molecule AI workspace can now have its own Git repository on Cloudflare's edge — no SSH keys, no credential rotation, no self-hosted server. The agent works. The commits get written. The history stays auditable.
+
+[10-25s]
+Step one — attach a repo to a workspace. One API call. The platform talks to Cloudflare's Artifacts API, creates the repository, and returns a git remote URL. The credential is scoped to that workspace alone.
+
+[25-40s]
+Step two — mint a short-lived credential. One API call, one hour TTL by default. The agent clones the repo, writes its work as a Git commit — a snapshot of the agent's state at this moment — and pushes. Every agent run is versioned.
+
+[40-50s]
+Step three — before a risky change, the agent forks. One more API call, an isolated branch, no pollution of the main history. The main branch stays clean.
+
+[50-60s]
+All of this is visible from Canvas. No terminal required. Your team sees the commit history, the active branches, and the artifact repository — right alongside your agent. Cloudflare stores the git data on the edge, close to the platform. Short-lived credentials mean no long-lived secrets to manage. This is what a Git workflow for AI agents looks like when it's designed for agents, not humans.
+"""
+
+# Save to file for use with external TTS
+echo "$NARRATION_SCRIPT" > /workspace/repos/molecule-core/docs/marketing/devrel/cloudflare-artifacts-narration.txt
+echo "Narration script saved. Pipe into your TTS service to generate audio."
\ No newline at end of file
diff --git a/docs/marketing/devrel/partner-api-keys-cicd-example.md b/docs/marketing/devrel/partner-api-keys-cicd-example.md
new file mode 100644
index 000000000..6b85e61f4
--- /dev/null
+++ b/docs/marketing/devrel/partner-api-keys-cicd-example.md
@@ -0,0 +1,241 @@
+# Partner API Keys — CI/CD Lifecycle Example
+**Phase 34 DevRel Deliverable** | Status: DRAFT — awaiting PM calibration values
+
+This is the DevRel reference implementation for the Partner API Keys CI/CD integration pattern. It shows how a partner would integrate Molecule AI into their automated pipelines using org-scoped partner tokens.
+
+> **Calibration pending from PM:** partner tier rate limits, GA date, first design partner name, per-key org/workspace creation limits, key rotation policy. The pattern below is complete; the placeholder values marked ⚡TBD⚡ will be calibrated once PM answers arrive.
+
+---
+
+## The Partner CI/CD Problem
+
+Enterprise partners integrating with Molecule AI need to:
+1. Authenticate CI/CD pipelines without human involvement
+2. Rotate tokens without downtime
+3. Scope tokens to specific orgs and workspaces
+4. Stay within partner-tier rate limits
+
+The current model (shared secret) doesn't support any of these. Partner API keys do.
+
+---
+
+## Workflow: Partner Onboarding a CI/CD Pipeline
+
+### Step 1 — Create a Partner Org
+
+```bash
+# Partner's DevOps creates their org in Molecule AI
+curl -X POST https://platform.moleculesai.app/orgs \
+  -H "Authorization: Bearer $MKTPLATFORM_ADMIN_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "acme-partner",
+    "tier": "partner_standard",
+    "contact_email": "devops@acme.example.com"
+  }'
+```
+
+Response:
+```json
+{
+  "id": "org_acme_partner_001",
+  "name": "acme-partner",
+  "tier": "partner_standard",
+  "rate_limit": 1000,
+  "workspace_limit": 50,
+  "api_key_limit": 25,
+  "created_at": "2026-04-25T00:00:00Z"
+}
+```
+
+⚡TBD⚡ **Calibration needed:** `partner_standard` tier's rate limits, workspace limit, and API key limit.
+
+---
+
+### Step 2 — Create a CI/CD Service Token
+
+```bash
+# Acme's DevOps creates a token scoped to their org
+curl -X POST https://platform.moleculesai.app/orgs/org_acme_partner_001/tokens \
+  -H "Authorization: Bearer $MKTPLATFORM_ADMIN_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "ci-pipeline-acme",
+    "scope": "org_write",
+    "ttl_seconds": 2592000,
+    "description": "Acme Corp CI/CD pipeline — auto-rotated"
+  }'
+```
+
+Response (shown once, never retrievable again):
+```json
+{
+  "id": "tok_acme_cicd_001",
+  "name": "ci-pipeline-acme",
+  "prefix": "mk_live_acme_cicd",
+  "token": "ak_live_4j8k2m...Xx9p1",
+  "scope": "org_write",
+  "ttl_seconds": 2592000,
+  "expires_at": "2026-05-25T00:00:00Z",
+  "created_by": "admin@acme.example.com"
+}
+```
+
+> **Security note:** Store the plaintext token in your CI/CD secrets manager (GitHub Secrets, Vault, AWS Secrets Manager). It is shown once and never retrievable.
+
+---
+
+### Step 3 — Use the Token in CI/CD
+
+```yaml
+# .github/workflows/molecule-agent.yml
+name: Molecule AI Agent Pipeline
+
+on:
+  push:
+    branches: [main]
+
+env:
+  MOLECULE_ORG_ID: org_acme_partner_001
+  MOLECULE_API_KEY: ${{ secrets.MOLECULE_CI_PIPELINE_TOKEN }}
+
+jobs:
+  agent-run:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Provision workspace
+        run: |
+          WS=$(curl -s -X POST https://platform.moleculesai.app/workspaces \
+            -H "Authorization: Bearer $MOLECULE_API_KEY" \
+            -H "Content-Type: application/json" \
+            -d '{"name": "ci-workspace-${{ github.run_id }}", "runtime": "hermes"}' \
+            | jq -r '.id')
+          echo "Workspace: $WS"
+
+      - name: Run agent task
+        env:
+          WORKSPACE_ID: $WS
+        run: |
+          curl -s -X POST "https://platform.moleculesai.app/workspaces/$WORKSPACE_ID/tasks" \
+            -H "Authorization: Bearer $MOLECULE_API_KEY" \
+            -H "Content-Type: application/json" \
+            -d '{"task": "analyze", "input": "${{ github.sha }}"}'
+```
+
+Every API call is tagged with `mk_live_acme_cicd` in the audit log — Acme's security team can trace every pipeline run.
+
+---
+
+### Step 4 — Token Rotation (automated)
+
+⚡TBD⚡ **Calibration needed:** Rotation policy (forced TTL? manual? grace period?). The pattern below assumes 30-day TTL with 7-day grace period.
+
+```yaml
+# .github/workflows/rotate-molecule-token.yml
+name: Rotate Molecule AI CI Token
+
+on:
+  schedule:
+    # Run weekly — well within the 7-day grace period before expiry
+    - cron: '0 9 * * 1'
+  workflow_dispatch:
+
+jobs:
+  rotate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create new token
+        id: new_token
+        run: |
+          RESPONSE=$(curl -s -X POST https://platform.moleculesai.app/orgs/org_acme_partner_001/tokens \
+            -H "Authorization: Bearer $MKTPLATFORM_ADMIN_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d '{
+              "name": "ci-pipeline-acme",
+              "scope": "org_write",
+              "ttl_seconds": 2592000
+            }')
+          echo "token=$(echo $RESPONSE | jq -r '.token')" >> $GITHUB_ENV
+
+      - name: Revoke old token
+        run: |
+          # List all tokens, revoke any with the same name
+          TOKENS=$(curl -s https://platform.moleculesai.app/orgs/org_acme_partner_001/tokens \
+            -H "Authorization: Bearer $MKTPLATFORM_ADMIN_TOKEN")
+          OLD_TOKEN_ID=$(echo $TOKENS | jq -r '.tokens[] | select(.name == "ci-pipeline-acme" and .id != env.NEW_TOKEN_ID) | .id')
+          if [ -n "$OLD_TOKEN_ID" ]; then
+            curl -s -X DELETE "https://platform.moleculesai.app/orgs/org_acme_partner_001/tokens/$OLD_TOKEN_ID" \
+              -H "Authorization: Bearer $MKTPLATFORM_ADMIN_TOKEN"
+            echo "Revoked old token: $OLD_TOKEN_ID"
+          fi
+
+      - name: Update GitHub Secret
+        uses: GitHub/actions/create-or-update-secret@v4
+        with:
+          secret-name: MOLECULE_CI_PIPELINE_TOKEN
+          value: ${{ env.token }}
+```
+
+Zero downtime. The old token is revoked only after the new one is created and tested. The CI pipeline picks up the new secret on its next run.
+
+---
+
+## Tier-Specific Rate Limits (placeholder)
+
+⚡TBD⚡ **Calibration needed from PM.** These are illustrative placeholders:
+
+| Tier | Requests/min | Workspaces | API Keys | Token TTL |
+|------|-------------|------------|----------|-----------|
+| `partner_starter` | 60 | 5 | 3 | 7 days |
+| `partner_standard` | 500 | 25 | 15 | 30 days |
+| `partner_enterprise` | 5000 | 200 | 100 | 90 days |
+
+When a partner hits their rate limit, the platform returns `429 Too Many Requests` with a `Retry-After` header. CI/CD pipelines should handle this gracefully:
+
+```bash
+# Example: rate-limit-aware API call
+until curl -s -o /dev/null -w "%{http_code}" \
+    -H "Authorization: Bearer $MOLECULE_API_KEY" \
+    https://platform.moleculesai.app/workspaces/$WS/tasks \
+    -X POST -d '{"task": "analyze"}' | grep -q "200"; do
+  echo "Rate limited — backing off 30s..."
+  sleep 30
+done
+```
+
+---
+
+## Visual Asset: Partner CI/CD Flow
+
+```
+Partner DevOps
+     │
+     ▼
+POST /orgs  →  creates partner org
+     │
+     ▼
+POST /orgs/:id/tokens  →  creates CI token (stored in Vault/GitHub Secrets)
+     │
+     ▼
+CI Pipeline (GitHub Actions / Jenkins / CircleCI)
+     │
+     ├──► POST /workspaces  →  provision ephemeral workspace
+     ├──► POST /workspaces/:id/tasks  →  run agent task
+     └──► Audit log shows mk_live_acme_cicd prefix on every call
+     │
+     ▼
+Token rotation workflow (weekly) — old token revoked, new token created
+```
+
+---
+
+## DevRel Checklist for Phase 34 Launch
+
+- [ ] PM calibration values received (tier limits, rotation policy, GA date, partner name)
+- [ ] CI/CD example doc updated with real values
+- [ ] Partner onboarding tutorial written (or linked from docs)
+- [ ] Battlecard updated with CI/CD use case
+- [ ] Social copy drafted for partner integration angle
+
+**Source:** `docs/marketing/devrel/partner-api-keys-cicd-example.md`
+**Staging path:** ready to commit — awaiting `ghp_` PAT to push
\ No newline at end of file
diff --git a/docs/marketing/devrel/tts-generation-notes.md b/docs/marketing/devrel/tts-generation-notes.md
new file mode 100644
index 000000000..1993eeddf
--- /dev/null
+++ b/docs/marketing/devrel/tts-generation-notes.md
@@ -0,0 +1,57 @@
+# TTS generation notes — 2026-04-22
+
+## EC2 Instance Connect SSH (ec2-ssh-launch-announce.mp3)
+
+**Status:** ⚠️ PLACEHOLDER — no TTS API available in this workspace. Placeholder WAV tone generated.
+
+**Full announcement script (ready for any TTS service):**
+
+> Your AI agent has a workspace on an EC2 instance.
+>
+> How do you get a shell inside it right now?
+>
+> Old answer: copy the IP, find the key, `ssh -i key.pem ec2-user@X.X.X.X`, hope your security group is right.
+>
+> New answer: click Terminal in Canvas.
+>
+> Molecule AI now speaks AWS EC2 Instance Connect. No SSH keys. No IP hunting. No security group dance. One click and you're in.
+>
+> Every SSH session is attributable — IAM policy gates access, STS pushes a temporary key, CloudWatch logs which principal opened the tunnel.
+>
+> EC2 Instance Connect SSH is live in Molecule AI. Provision a CP-managed workspace, open the Terminal tab, and you're in.
+>
+> [CTA: docs.molecule.ai/infra/workspace-terminal]
+
+**Suggested audio specs:** 20–30s, MP3, 128kbps, professional neutral tone, moderate pace.
+
+---
+
+## A2A Enterprise Deep-Dive (a2a-launch-announce.mp3)
+
+**Status:** ⚠️ PLACEHOLDER — no TTS API available in this workspace. Placeholder WAV tone generated.
+
+**Full announcement script (ready for any TTS service):**
+
+> A2A version 1.0 shipped March 12. 23,300 GitHub stars. Five official SDKs. The question is: was your platform built for it, or added on top?
+>
+> Protocol-native means agent-to-agent communication is a first-class citizen. It's in the core, the scheduler, the model dispatch. Every message, every task, every result flows through the same channel your operators already monitor.
+>
+> Protocol-added means the agents work, but the cross-agent conversation lives in a layer above the platform — bolted on, with separate logs, separate auth, and separate failure modes.
+>
+> Molecule AI is built for A2A from the ground up. The agent registry, the task dispatch, the secrets store, and the audit trail all speak the same protocol the enterprise team already owns.
+>
+> If you're evaluating an AI agent platform today, ask the vendor: is A2A a feature, or a foundation? The answer tells you everything.
+>
+> [CTA: moleculesai.app/docs/a2a]
+
+**Suggested audio specs:** 30–40s, MP3, 128kbps, confident/professional tone, measured pace.
+
+---
+
+## Why placeholder WAVs instead of real audio?
+
+This workspace has no TTS engine (espeak, festival, pyttsx3) and no external TTS API credentials (ElevenLabs, Azure Speech, OpenAI Audio, AWS Polly) available in the environment.
+
+The placeholder WAVs are 3-second low-frequency tones — they confirm the file paths work, not the content.
+
+**To generate real audio:** run either script above through ElevenLabs, Azure Speech SDK, AWS Polly `aws polly synthesize-speech`, or Google Cloud TTS. The scripts are production-ready text; only the audio generation step is pending a credential.
\ No newline at end of file
diff --git a/docs/marketing/social/2026-04-22-ec2-instance-connect-ssh/ec2-ssh-launch-announce.wav b/docs/marketing/social/2026-04-22-ec2-instance-connect-ssh/ec2-ssh-launch-announce.wav
new file mode 100644
index 000000000..92d018974
Binary files /dev/null and b/docs/marketing/social/2026-04-22-ec2-instance-connect-ssh/ec2-ssh-launch-announce.wav differ
diff --git a/docs/marketing/social/2026-04-22-ec2-instance-connect-ssh/social-copy.md b/docs/marketing/social/2026-04-22-ec2-instance-connect-ssh/social-copy.md
index 48b279065..6e8d15a24 100644
--- a/docs/marketing/social/2026-04-22-ec2-instance-connect-ssh/social-copy.md
+++ b/docs/marketing/social/2026-04-22-ec2-instance-connect-ssh/social-copy.md
@@ -124,9 +124,23 @@ EC2 Instance Connect SSH is live now for all CP-provisioned workspaces.
    - Format: GIF or looping MP4, max 10s
    - Dark theme, molecule navy background
 
-2. **Architecture diagram** (optional for LI):
-   - Canvas (browser) → WebSocket → Platform (Go) → `aws ec2-instance-connect ssh` → EIC Endpoint → EC2 Instance
-   - Shows the tunnel path for audience who wants to understand the mechanism
+2. **Before/after credential model diagram:**
+   - **Local:** `repo/marketing/devrel/social/assets/ec2-instance-connect-credential-comparison.png` (30 KB, 1200×600px)
+   - **Fallback:** `repo/marketing/devrel/social/assets/ec2-instance-connect-credential-comparison.txt`
+   - Shows old flow (5 steps, red) vs new flow (2 steps, green)
+   - Dark theme, terminal aesthetic
+
+3. **Audit log terminal output:**
+   - **Local:** `repo/marketing/devrel/social/assets/ec2-instance-connect-audit-log.png` (48 KB, 1200×600px)
+   - **Fallback:** `repo/marketing/devrel/social/assets/ec2-instance-connect-audit-log.txt`
+   - Shows CloudTrail `OpenTcpTunnel` events with IAM principal, instance ID, timestamp, duration
+   - Dark terminal theme, monospace font, provenance chain note
+
+4. **Architecture diagram:**
+   - `docs/marketing/campaigns/ec2-instance-connect-ssh/assets/eice-architecture-diagram.png` (131 KB)
+   - Full tunnel path: Canvas WS → Go handler → EIC Endpoint → EC2 instance
+
+**Remaining blocker:** Canvas terminal screenshot — requires live CP-provisioned workspace with EIC Endpoint configured (Social Media Brand / video editor task).
 
 ---
 
diff --git a/docs/marketing/social/2026-04-22/social-queue-ready.md b/docs/marketing/social/2026-04-22/social-queue-ready.md
new file mode 100644
index 000000000..ac2340686
--- /dev/null
+++ b/docs/marketing/social/2026-04-22/social-queue-ready.md
@@ -0,0 +1,473 @@
+# Social Queue — BLOCKED (blog not live)
+
+**Status:** ⚠️ PARTIALLY BLOCKED — `docs.molecule.ai` still returning 000. Confirm uptime before firing any CTA links.
+**Last updated:** 2026-04-22T21:25 UTC
+**Blocker:** docs.molecule.ai not responding. Chrome DevTools MCP blog + EC2 Instance Connect SSH CTA both blocked.
+**New entry added:** EC2 Instance Connect SSH (ready to post, publish day today — blocked on docs uptime)
+**New entry added:** Slack Adapter (DRAFT — adapter not shipped, DO NOT POST)
+**Confirmed live:** Discord Adapter Day 2 (Reddit + HN community copy)
+
+---
+
+## Campaign: Chrome DevTools MCP Day 1 (POST TODAY)
+
+**Blog URL:** https://docs.molecule.ai/blog/chrome-devtools-mcp
+**Hashtags:** #MCP #AIAgents #AgenticAI #MoleculeAI
+
+### X Thread — 5 posts
+
+**Post 1** (hook, P0: AI agent browser control)
+```
+Your AI agent just made a purchase on your behalf.
+
+What did it buy? From where? With which account?
+
+Most agents operate in a black box. Browser DevTools MCP makes the
+browser a first-class tool — with org-level audit attribution on every action.
+
+→ docs.molecule.ai/blog/chrome-devtools-mcp
+```
+
+**Post 2** (problem framing, P0: MCP browser automation)
+```
+Browser automation for AI agents usually means: give the agent your credentials,
+hope it doesn't go somewhere unexpected, and check the logs after.
+
+That's not a governance model. That's a trust fall.
+
+Molecule AI's MCP governance layer for Chrome DevTools MCP gives you:
+→ Which agent accessed which session
+→ What it did (navigate, fill, screenshot, submit)
+→ Audit trail with org API key attribution
+
+One org API key prefix per integration. Instant revocation.
+
+→ docs.molecule.ai/blog/chrome-devtools-mcp
+```
+
+**Post 3** (use case, concrete, P0: browser automation AI agents)
+```
+Real things teams use Chrome DevTools MCP for in production:
+
+• Automated Lighthouse audits on every PR — agent runs the audit, reports the score, flags regressions
+• Visual regression detection — agent screenshots key pages, diffs against baseline, opens tickets on drift
+• Auth scraping — agent reads the authenticated state from an existing browser session
+
+The governance layer means your security team can see all three in the audit trail.
+
+→ docs.molecule.ai/blog/chrome-devtools-mcp
+```
+
+**Post 4** (competitive/positioning, P0: MCP governance layer)
+```
+The MCP protocol lets you connect any compatible tool to any compatible agent.
+
+What's been missing: visibility into what the agent actually did with that access.
+
+Molecule AI's MCP governance layer adds:
+• Per-action audit logging with org API key attribution
+• Token-scoped Chrome sessions — no credential sharing across agents
+• Instant revocation without redeployment
+
+→ docs.molecule.ai/blog/chrome-devtools-mcp
+```
+
+**Post 5** (CTA)
+```
+Chrome DevTools MCP launched April 20 as part of Molecule AI Phase 30.
+
+If you're running AI agents that interact with web UIs — there's a governance story
+you need to have ready before your security team asks.
+
+→ docs.molecule.ai/blog/chrome-devtools-mcp
+
+#MCP #AIAgents #AgenticAI #MoleculeAI
+```
+
+### LinkedIn Post — Single
+
+```
+Why your AI agent's browser access needs a governance layer
+
+Your AI agent can use a browser. That's useful. But "useful" isn't a security posture.
+
+When an agent operates inside a browser — filling forms, reading session state,
+navigating authenticated flows — most platforms give you two options:
+trust it completely, or don't let it near the browser at all.
+
+Molecule AI's Chrome DevTools MCP integration adds a third option:
+visibility with control.
+
+Here's what "governance layer" actually means in this context:
+
+→ Every browser action is logged with the org API key prefix that made the call.
+   You know which agent touched what session, every time.
+
+→ Chrome sessions are token-scoped. Agent A's session is not Agent B's session.
+   No credential cross-contamination.
+
+→ Revocation is instant. One API call, the key stops working, the session closes.
+   No redeploy.
+
+→ Audit trails are exportable. Your security team can review them without
+   a custom logging pipeline.
+
+This is the difference between "the agent can use a browser" and
+"the agent's browser access is auditable, attributable, and revocable."
+
+Chrome DevTools MCP is available now on all Molecule AI deployments.
+
+→ docs.molecule.ai/blog/chrome-devtools-mcp
+
+#MCP #AIAgents #AgenticAI #MoleculeAI #PlatformEngineering
+```
+
+---
+
+## Campaign: Org-Scoped API Keys (POST THIS WEEK)
+
+**Blog URL:** https://docs.molecule.ai/blog/org-scoped-api-keys
+**Hashtag:** #OrgAPIKeys
+**Hashtags:** #AIAgents #AgenticAI #MoleculeAI #Security
+
+### X Thread — 5 posts
+
+**Post 1** (hook — ADMIN_TOKEN SPOF)
+```
+Your production Molecule AI setup probably has one secret that can do everything: ADMIN_TOKEN.
+
+Rotate it = downtime for every integration that holds a copy.
+Leak it = your whole tenant is compromised.
+
+That's not a security posture. That's a single point of failure.
+
+Org-scoped API keys: named, revocable, per-integration.
+No shared secrets. No blast radius from one rotation.
+
+→ docs.molecule.ai/blog/org-scoped-api-keys
+```
+
+**Post 2** (solution — what org keys give you)
+```
+Molecule AI org-scoped API keys:
+
+• Mint one key per integration — ci-bot, zapier, monitoring, whatever
+• Revoke one key instantly, without touching anything else
+• Audit trail shows org:keyId prefix on every call
+• Full org scope: manage all workspaces, channels, secrets, templates
+
+ADMIN_TOKEN is still there. But you never need to touch it again.
+
+→ docs.molecule.ai/blog/org-scoped-api-keys
+```
+
+**Post 3** (feature — API walkthrough)
+```
+Mint a key in 30 seconds:
+
+curl -X POST https://moleculesai.app/org/tokens \\
+  -H 'Authorization: Bearer <your-org-key>' \\
+  -d '{"name": "ci-bot"}'
+
+Got a leaked key?
+curl -X DELETE https://moleculesai.app/org/tokens/ci-bot \\
+  -H 'Authorization: Bearer <your-org-key>'
+
+The key stops working. The session closes. Nothing else touches.
+That's surgical blast-radius control.
+
+→ docs.molecule.ai/blog/org-scoped-api-keys
+```
+
+**Post 4** (enterprise angle)
+```
+Enterprise teams with multiple pipelines, integrations, and contractors:
+org-scoped API keys change how you think about credential hygiene.
+
+Every key has a label. Every call carries an org:keyId prefix.
+last_used_at updated on every request.
+
+You know exactly which pipeline made which call, every time.
+No hunting through logs for the culprit.
+
+→ docs.molecule.ai/blog/org-scoped-api-keys
+
+#OrgAPIKeys
+```
+
+**Post 5** (CTA + compliance angle)
+```
+Org-scoped API keys: the difference between "we trust our integrations"
+and "we can verify and revoke what our integrations do."
+
+Named. Revocable. Audit-trail-enabled.
+Built into Molecule AI. Not bolted on.
+
+→ docs.molecule.ai/blog/org-scoped-api-keys
+
+#OrgAPIKeys #AIAgents #AgenticAI #MoleculeAI
+```
+
+### LinkedIn Post — Single (governance/enterprise angle)
+
+```
+The problem with API keys for multi-agent platforms isn't key management.
+It's that one key usually means one blast radius.
+
+Rotate the ADMIN_TOKEN to stop a compromised integration —
+and you've interrupted every other integration that holds a copy.
+
+Molecule AI's org-scoped API keys solve this with a different model:
+
+Named keys, per integration. Revocable individually, instantly.
+Audit trail with org:keyId attribution on every call.
+Full org scope — manage all workspaces, channels, secrets, and approvals.
+
+The ADMIN_TOKEN stays functional as a break-glass fallback.
+But the day-to-day runs on scoped keys — each one traceable,
+each one independently revocable.
+
+For enterprise teams: this is what compliance-ready credential management
+looks like for AI agent platforms.
+
+Org-scoped API keys are live now on Molecule AI.
+
+→ docs.molecule.ai/blog/org-scoped-api-keys
+
+#OrgAPIKeys #AgenticAI #AIAgents #MoleculeAI #PlatformEngineering #Security
+```
+
+---
+
+## Campaign: Discord Adapter Day 2 — Reddit + HN (READY)
+
+**Source:** `docs/marketing/discord-adapter-day2/announcement.md`
+**Blog URL:** `docs.molecule.ai/blog/discord-adapter`
+
+Community copy (not X/LinkedIn) — Reddit r/LocalLLaMA + r/MachineLearning + Hacker News.
+File corrected: Discord adapter code path (`mcp-server/...` → `workspace-server/internal/channels/discord.go`).
+File corrected: blog URL (`moleculesai.app/...launch` → `docs.molecule.ai/blog/discord-adapter`).
+
+---
+
+## Campaign: EC2 Instance Connect SSH — Post Today (READY)
+
+**Source:** `docs/marketing/social/2026-04-22-ec2-instance-connect-ssh/social-copy.md`
+**Blog URL:** `docs.molecule.ai/infra/workspace-terminal` (pending docs publish)
+**Publish day:** 2026-04-22 (today)
+**Status:** ⚠️ DO NOT POST until docs.molecule.ai is confirmed up and CTA link resolves
+**Hashtags:** #AgenticAI #MoleculeAI #AWS #EC2InstanceConnect #PlatformEngineering #DevOps
+
+> **Audit notes (2026-04-22 DevRel tick):**
+> - PR #1533 cited correctly (terminal feature PR; #1531 stores instance_id)
+> - All technical claims verified against `docs/tutorials/ec2-instance-connect-ssh/index.md`
+> - CTA link blocked on docs publish — do not fire until confirmed
+> - Visual assets (GIF, architecture diagram) specified in source file — confirm they exist before posting
+> - Missing from queue entirely prior to this update — added 2026-04-22
+
+---
+
+## Campaign: Slack Adapter (DRAFT — DO NOT POST until adapter ships)
+
+**Source:** `docs/marketing/campaigns/slack-adapter/social-copy.md`
+**Feature:** `workspace-server/internal/channels/slack.go` — status: Planned (not yet shipped)
+**Status:** ⚠️ DRAFT — adapter PR not merged, docs not published. Do NOT post.
+**Hashtags:** #AgenticAI #MoleculeAI #Slack #PlatformEngineering #AIAgents
+
+**Pre-launch checklist (update as items complete):**
+- [ ] Adapter PR merged to main
+- [ ] `docs.molecule.ai/blog/slack-adapter` published
+- [ ] Slack bot token provisioning documented
+- [ ] Allowlist behavior confirmed against implementation
+
+---
+
+## Campaign: Phase 32 Cloud SaaS Launch (DO NOT POST — pending GA)
+
+**Status:** ⚠️ DRAFT — do not post until Phase 32 GA + Stripe Atlas confirmed
+**Blog URL:** https://docs.molecule.ai/blog/phase-32-saas-launch (placeholder)
+
+### X — 4 variants (post A–D spaced through launch week)
+
+**Version A** (developer angle)
+```
+The runtime used to be your problem.
+
+Docker config. Docker socket. Cloud credentials. Network rules.
+That's before your agent actually does anything.
+
+Molecule AI Cloud: create an org, get a canvas, launch agents.
+
+No infra to run. No ops to maintain. You focus on what the agents do.
+
+→ moleculesai.app
+```
+
+**Version B** (platform engineer — isolation story)
+```
+Molecule AI Cloud ships per-org Neon database branches and Firecracker microVMs.
+
+Your agents and data are isolated by org — not shared infrastructure with good intentions.
+
+Neon branch-per-org DB = query isolation.
+Firecracker microVMs = compute isolation.
+Platform handles the rest.
+
+Zero ops. Production isolation.
+→ moleculesai.app
+```
+
+**Version C** (indie/solo dev — fast to value)
+```
+Wanted to run AI agents without managing a server.
+
+Signed up for Molecule AI Cloud. Had a canvas with 3 agents running in 15 minutes.
+Used remote workspaces to wire in a script running on my Mac.
+
+Zero Docker. Zero cloud config. One org.
+→ moleculesai.app
+```
+
+**Version D** (A2A/multi-agent)
+```
+Most agent platforms give you one agent.
+
+Molecule AI gives you an org: a canvas, A2A task dispatch, a secrets store,
+and a fleet of heterogeneous agents — running on Docker, Fly.io,
+or behind a NAT on your laptop.
+
+Multi-agent orchestration without the infrastructure overhead.
+→ moleculesai.app
+```
+
+### LinkedIn — Single (launch day)
+
+```
+The real cost of an agent platform isn't the agents.
+
+It's the ops underneath: Docker configs, credential management,
+network rules, monitoring, on-call rotation for your own infrastructure.
+
+That's the model most agent frameworks sell you on.
+You own the runtime. The agents do the work. You run the ops.
+
+Molecule AI Cloud inverts that. You get:
+
+→ A canvas that visualizes your full agent fleet — Docker, Fly.io, remote
+→ A2A task dispatch between agents — regardless of where they run
+→ A secrets store, org-scoped, with audit attribution
+→ Org-level billing, usage metering, and quota controls
+→ Neon branch-per-org database isolation
+→ Firecracker microVMs for compute isolation
+
+No ops. No own-the-runtime requirement.
+Your team focuses on what the agents do, not the infrastructure that runs them.
+
+From laptop to production in one command — or skip the laptop entirely
+and use the cloud platform directly.
+
+→ moleculesai.app
+
+#AIAgents #AgenticAI #MoleculeAI #DevOps #PlatformEngineering #SaaS
+```
+
+---
+
+---
+
+## Campaign: Phase 33 Cloudflare Tunnel Migration (POST THIS WEEK)
+
+**Status:** ⚠️ DRAFT — do not post until Phase 33 is live and docs published
+**Blog URL:** https://docs.molecule.ai/blog/cloudflare-tunnel-migration (pending publish)
+**Hashtags:** #AIAgents #AgenticAI #MoleculeAI #Cloudflare #DevOps
+
+### X — 4 posts (spaced through launch week)
+
+**Post 1** (hook — the change)
+```
+Your AI agent workspace used to connect to the platform through a Cloudflare Tunnel.
+
+In Phase 33: it gets its own public IP.
+
+Outbound tunnel daemon → direct WebSocket. No middleman.
+~20–40ms latency reduction. No single dependency on Cloudflare for connectivity.
+
+→ docs.molecule.ai/blog/cloudflare-tunnel-migration
+```
+
+**Post 2** (operator angle — what changes for infra teams)
+```
+Running AI agent workspaces in AWS?
+
+Phase 33 means:
+→ Workspaces get public IPs from your VPC subnet
+→ Platform manages security group rules (port 443, TLS, JWT)
+→ Direct WebSocket — no cloudflared daemon in the container
+→ No inbound firewall holes required (same as before, different mechanism)
+
+Migration is automatic on next workspace restart. Nothing to reconfigure.
+
+→ docs.molecule.ai/blog/cloudflare-tunnel-migration
+```
+
+**Post 3** (developer angle — what doesn't change)
+```
+From the agent runtime: nothing changes.
+
+Your code still registers with the platform, receives task dispatch,
+runs tools, and talks to model APIs. The transport path is different
+— the API contract is identical.
+
+What does change: if you need to reach a workspace directly for
+monitoring or health checks, you now have its public IP.
+No tunnel hostname required.
+
+→ docs.molecule.ai/blog/cloudflare-tunnel-migration
+```
+
+**Post 4** (security + CTA)
+```
+Every production agent fleet needs a connectivity story.
+
+Phase 33 gives cloud-hosted workspaces: direct paths, platform-managed
+security groups, no single dependency on a third-party tunnel provider.
+
+Public IPs, not tunnel hostnames.
+
+→ docs.molecule.ai/blog/cloudflare-tunnel-migration
+
+#AIAgents #AgenticAI #MoleculeAI #DevOps #PlatformEngineering
+```
+
+### LinkedIn — Single post
+
+```
+The infrastructure story behind how cloud-hosted AI agent workspaces connect to their platform used to involve a third-party tunnel daemon running inside every container.
+
+That changed this week with Phase 33.
+
+Molecule AI cloud workspaces now get public IP addresses from their VPC subnet. The connection from the workspace to the platform is a direct WebSocket — no Cloudflare Tunnel in the path.
+
+Here's what this means in practice:
+
+**For platform operators:** the platform manages the security group rules. You don't open inbound ports or configure firewall rules — that's handled automatically. Workspaces migrate on their next restart cycle with no manual intervention.
+
+**For developer tooling:** scripts and monitoring tools that need to reach a running workspace directly can now use its public IP. Health checks, log scraping, and port forwarding work without a tunnel hostname.
+
+**For latency:** removing the Cloudflare tunnel hop reduces round-trip time by roughly 20–40ms depending on region. Not dramatic, but measurable at agent-fleet scale.
+
+The connection model:
+Browser → Platform API → Security Group (port 443, TLS, JWT) → Workspace (direct WebSocket)
+
+No cloudflared daemon. No tunnel hostname. Just a public IP and a direct path.
+
+Phase 33 is live now for all new CP-managed workspace provisions. Existing workspaces migrate on restart.
+
+→ docs.molecule.ai/blog/cloudflare-tunnel-migration
+
+#AIAgents #AgenticAI #MoleculeAI #DevOps #PlatformEngineering #AWS
+```
+
+---
+
+*Queue prepared by DevRel 2026-04-22. All copy ready to fire once X_API_KEY + X_API_SECRET land in workspace env.*
\ No newline at end of file
diff --git a/docs/marketing/social/2026-04-22/social-queue.md b/docs/marketing/social/2026-04-22/social-queue.md
new file mode 100644
index 000000000..269c0eecb
--- /dev/null
+++ b/docs/marketing/social/2026-04-22/social-queue.md
@@ -0,0 +1,48 @@
+# Social Queue — 2026-04-22
+**Status:** DRAFT — for Social Media Brand review once P0 clears
+**Context:** Phase 30 shipped 2026-04-21 (Remote Workspaces + Cross-Network Federation). P0 incident Apr 21 evening — brief acknowledgment post may be appropriate before Phase 30 push.
+
+---
+
+## Campaign 0: Incident Recovery + Phase 30 Ship (POST FIRST — Day 1 wrap)
+
+> Brief, no-drama acknowledgment. Don't make it the story — Phase 30 is the story.
+
+**Source:** Phase 30 shipped — `docs/blog/2026-04-20-remote-workspaces/index.md`
+**Hashtags:** #AIAgents #AgenticAI #MoleculeAI #RemoteWork
+**UTM:** `?utm_source=twitter&utm_medium=social&utm_campaign=phase30-remote-workspaces`
+
+### X — Single post
+> We had a rough evening — a infrastructure issue knocked out workspaces for a few hours.
+> The team pushed hard and it's back. 
+> While we were down, we shipped Phase 30: your AI agents can now run anywhere — your laptop, a home server, anywhere with Python and an internet connection — and still appear on the canvas as first-class workspaces.
+> That's what we were building toward. The incident was a detour. The direction didn't change.
+> → [link to Phase 30 blog]
+
+### LinkedIn
+> A quick note: we had an infrastructure issue yesterday evening that affected workspaces for a few hours. Resolved.
+>
+> While we were dealing with that, we shipped Phase 30.
+>
+> Molecule AI agents can now run anywhere — a laptop in another city, a home server, any Python environment with an internet connection — and appear on your canvas as first-class workspaces. No public URL required on the agent side. Same API. Same canvas. Fully distributed.
+>
+> The infrastructure part is fixed. The bigger build continues.
+>
+> → [link]
+> #AIAgents #AgenticAI #MoleculeAI #RemoteWork #SaaS
+
+---
+
+## Campaign 1: Chrome DevTools MCP — Day 1 wrap (POST DAY 2)
+
+*If not posted on Apr 21 due to P0: post Apr 22 same copy from `social-queue.md` Apr 21 section.*
+
+---
+
+## Campaign 2: Fly.io Deploy Anywhere — Day 3 → Day 4 (Apr 23 → Apr 24)
+
+Shift by 1 day due to P0. Same approved copy from `fly-deploy-anywhere/social-copy.md`.
+
+---
+
+*Draft by DevRel 2026-04-22 — for Social Media Brand review*