production introspection disable and query depth cap (desci-infra 2.0.1)

Author: github-actions[bot]

api-reference/changelog.md

@@ -10,6 +10,12 @@ This page tracks breaking changes, deprecations, and additions across the Molecu
 
 ## Labs API
 
+### GraphQL introspection disabled and query depth capped in production
+
+The production endpoint (shared by all Molecule APIs — see [API Overview](README.md)) no longer serves `__schema` / `__type` introspection queries: they now return a validation error. `__typename` still resolves. Selection-set depth is also capped at 10 in production, with scalar leaves counted as a level (`{ root { child { name } } }` is depth 3). A query beyond that limit fails at execution time with `errorType: "QueryDepthLimitReached"` and partial data — a plain GraphQL error, not the catalogued error shape used elsewhere, so handle both.
+
+**Migration:** If your codegen or tooling discovers the schema by introspecting the production endpoint, that now fails — request a current copy of the schema from the Molecule team (see [Getting Support](README.md)) rather than introspecting production. If you see `QueryDepthLimitReached`, flatten the query to 10 levels of nesting or fewer; this limit was not previously enforced.
+
 ### `*V2` operations and pre-OCL naming removed
 
 The legacy `*V2` operations and the pre-OCL naming have been **removed**. The current API is `oclId`-based. If you are migrating from an older integration, use the current names below.

release-notes/labs-api.md

@@ -8,8 +8,15 @@ icon: flask
 Changes to the [Labs API](../api-reference/labs-api/README.md) that affect integrations. Versions not
 listed shipped nothing consumer-visible.
 
-_No entries yet._ Entries are added per release by the docs-sync pipeline; see
-[Overview](README.md) for the format.
+## 2.0.1
+
+_Released 2026-08-18_
+
+### Breaking changes
+
+#### GraphQL introspection disabled and query depth capped in production
+
+The production endpoint no longer serves `__schema` / `__type` introspection queries — they return a validation error. `__typename` still resolves. Selection-set depth is also capped at 10 in production; a query beyond that fails at execution time with `errorType: "QueryDepthLimitReached"` rather than the usual error shape. See [API Changelog & Migration](../api-reference/changelog.md#graphql-introspection-disabled-and-query-depth-capped-in-production) for details and migration steps.
 
 For migrations off the pre-OCL naming and the `*V2` operations, see
 [API Changelog & Migration](../api-reference/changelog.md).