[Mukesh Dua (mukesh-dua)]

Summary

Add the Molecule Visualization agent and version 1.1.3 CPU tool for RDKit-based 2D molecule images, multi-molecule contact sheets, and optional interactive 3D conformers with SDF/PDB/XYZ outputs. Include complete catalog metadata, a non-root container, pinned dependencies, illustrated prompt examples, container regressions, and the related deployment fixes needed to preserve inline input templates and recognize approval requests.

Type of change

• New agent (under agents/<name>/)
• Update to an existing agent
• New starter kit (under starter-kits/<name>/)
• Update to an existing starter kit
• Schema change (docs/schemas/**)
• Workflow / script change (.github/**)
• Documentation only
• Other (describe below)

Related issue / tracking

n/a

Schema impact

• No schema changes
• Schema changes are backward compatible
• Schema changes are breaking — add the breaking-change label and link the rollout plan below

Validation checklist

• Documentation (README.md, schemas) is updated to match the change.
• No hand-edits to .auto-registry/** (it is generated post-merge).
• No OS / editor artefacts committed (.DS_Store, .env, *.swp, .idea/, .vs/, etc.).
• If model-weight files are added, they are Git-LFS tracked, ≤5 GB each, and in an allowed format.
• No secrets, customer data, or internal-only URLs are committed.
• All Markdown links resolve.

Reviewer notes (optional)

Behavior and implementation

• Single-molecule 2D PNG/SVG and optional self-contained Plotly HTML plus SDF/PDB/XYZ; gallery preserves input order and duplicates and reports partial failures.
• Inline UTF-8 input files keep SMILES and names out of shell interpolation.
• MMFF receives a bounded 2,000-iteration budget; unavailable parameters and nonconvergence remain explicit errors.
• The Python structure helper defaults to SMI/SDF/PDB/XYZ, with unsupported formats rejected before output writes; no optional CIF/gemmi dependency is required.
• Container uses digest-pinned Python 3.12, pinned direct Python dependencies, UID/GID 10001, and a minimal build context.
• Add Dependabot coverage for the tool requirements directory.
• Deployer registry substitution no longer corrupts Handlebars {{name}} expressions; validation recognizes "Please approve" and retains the approval flow.

Validation evidence

Commands were run after fast-forwarding local main from the fork:

• $env:MOLECULE_VISUALIZATION_IMAGE='molecule-visualizations:cif-fix-test'; python -B -m unittest discover -s .\agents\molecule-visualization\tools\molecule-visualization\tests -p 'test_*.py' -v — passed, 10 tests.
• python -B -m unittest discover -s .github\tests -p test_agent_deployer_validation.py -v — passed, 23 tests, including the actual PowerShell registry-substitution regression.
• python -B -m pytest .github\tests\test_security_automation.py -q -k 'dependabot_covers_all_requirements_files or ci_python_dependencies_are_pinned_and_workflows_use_the_manifest' — passed, 2 tests.
• python -B .github\scripts\validate_pr.py --changed-files $list --repo-root . --output $result — passed with all 20 proposed files supplied through a temporary changed-file list and Git's file utility on PATH. One non-blocking publisher-contact DNS warning remains because local dnspython is unavailable.
• git diff --cached --check — passed.
• python -B - with a local Markdown-link and Pillow image-verification script — passed, 17 relative links and all six PNG assets.

The test-only image overlays the final application source onto the previously validated 1.1.2 runtime; it is not a fresh canonical dependency build. The canonical 1.1.2 Dockerfile previously built successfully with ACR Tasks, while a local canonical build encountered public PyPI TLS handshake failures. The helper-default cleanup was verified in the final-source test image and has not been redeployed.

Discovery tool and agent deployment of 1.1.2 succeeded. Automated cloud validation remains input_required, awaiting platform tool confirmation, and is not claimed as passed. Human-in-the-loop and tool confirmation remain enabled. The full repository test suite was not rerun; focused tests and catalog validation are listed above.

Initial GitHub Actions results

• Dependency Review run 40933181929 failed: the tool's pinned Pillow 10.4.0 is flagged by high/critical advisories. This must be resolved before merge; no exception or bypass was applied.
• Unit Tests run 40933181850 failed on CODEOWNERS expectations in test_pr_review_workflow_security.py. This PR does not change CODEOWNERS or that test file; the latest fork sync includes the recent contributions-reviewer CODEOWNERS update.
• Agent/tool/metadata schema guard, starter-kit schema guard, Validate PR, and Secret Scan passed in the initial check run.

CI fixes in b819804

• Upgrade Pillow from 10.4.0 to 13.0.0, the patched version identified by the advisory, and update runtime tests, documentation, and image/catalog version references to 1.1.3.
• Make the existing tests ownership rule explicitly root-relative (/.github/tests/) while preserving both reviewer teams. Add regression coverage for contributions-reviewer ownership of tests, agents, and starter kits and for sibling directory isolation.
• python -B -m pytest .github\tests\test_pr_review_workflow_security.py .github\tests\test_agent_deployer_validation.py .github\tests\test_security_automation.py -q — passed, 89 tests and 11 subtests.
• python -B -m unittest discover -s .\agents\molecule-visualization\tools\molecule-visualization\tests -p 'test_*.py' -v — passed, 10 tests, with Pillow 13.0.0 and the final application source. The local test image upgrades the previously tested runtime using an official PyPI wheel whose SHA256 was verified against PyPI metadata; it is not a fresh canonical dependency build.
• python -B -m pytest .github\tests -q -k 'not test_probe_script_handles_newline_terminated_resolver_output' — passed, 932 tests and 11 subtests, one deselected. The unrestricted Windows run passed those same 932 tests but failed the existing Bash/curl PATH mock test; GitHub's Linux CI runs that test without exclusions.
• python -B .github\scripts\validate_pr.py --changed-files $list --repo-root . --output $result — passed with no warnings, using all proposed files and restored CI dependencies.
• git diff --check — passed.

No cloud redeployment was performed for 1.1.3. The deployed 1.1.2 tool and its outstanding cloud-validation approval are unchanged.

Fresh GitHub checks for b819804: all 14 passed, including Dependency Review,
the complete Linux unit-test workflow (no exclusions), catalog validation,
schema guards, CodeQL, DevSkim, Secret Scan, and CLA.