Released: 2026-07-28
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.63
Previous release: 0.5.62
0.5.63 is a small fix for the credential sharing panel: the team picker was querying an admin-only endpoint and showing "No teams available" for regular users, even when they belonged to a team they could share with.
No breaking changes. Drop-in upgrade from 0.5.62.
None known at this time.
Drop-in upgrade — no values.yaml edits required.
No Helm values changes between 0.5.62 and 0.5.63. Drop-in upgrade.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.63 \
-f your-values.yaml
kubectl get pods -n <namespace>
If non-admin users previously saw "No teams available" when trying to share a credential, confirm their team now appears in the picker.
No values.yaml changes required.
No diff — values.yaml is identical between 0.5.62 and 0.5.63.
Released: 2026-07-26
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.62
Previous release: 0.5.61
0.5.62 gives admins finer control over who can see and edit the Scheduler agent, fixes several skills-catalog authorization bugs that were dropping skills for API-key and JWT callers, and stops the Webex bot from dropping messages during reconnect storms. It also changes the default AgentGateway authorization posture for the scheduler MCP server — see Breaking Changes below.
caipe-skills.py, install.sh, update-caipe-skills). Both paths now resolve a subject correctly.agent_skills, returning only default filesystem skills — it now returns the full set of globally-visible skills.user:-prefixed value the route handler actually sends, so the bypass never fired — global skills were still filtered out for CLI callers. Fixed and covered by regression tests.ConnectionClosedOK) and abnormal (ConnectionClosedError) WebSocket closes from Mercury, instead of only the abnormal case — closing a gap where a clean-but-expired webSocketUrl caused a drop-reconnect-drop loop and missed messages.<sitemapindex>) instead of treating each child sitemap URL as a page, fixing sites that split their sitemap into multiple files silently ingesting zero content.AgentGateway restrictedMcpServers default changed from [scheduler] to []. Caller-level mcp_server:<id>#can_invoke authorization is no longer enforced for the scheduler MCP target by default — restricting it is now opt-in via Helm values instead of baked into the chart default. See Breaking Changes for the upgrade action.
Affected key: agentgateway.authz.restrictedMcpServers (exact path depends on your chart layout — check your rendered values)
Before (0.5.61):
authz:
restrictedMcpServers:
- scheduler
After (0.5.62):
authz:
restrictedMcpServers: []
Action: If you rely on the scheduler MCP target requiring per-caller can_invoke authorization, set restrictedMcpServers: [scheduler] explicitly in your values.yaml before upgrading. Left unset, any caller with general MCP gateway access can invoke the scheduler MCP target — use the Scheduler admin-only UI toggle (see What's New) as your access control instead, or restore the old Helm-level restriction.
None known at this time.
Not a drop-in upgrade if you depend on the previous restrictedMcpServers: [scheduler] default — see Breaking Changes. Otherwise no other values.yaml edits required.
See above: restrictedMcpServers default changed from [scheduler] to [].
values.yaml if neededauthz:
restrictedMcpServers:
- scheduler
Add this only if you want to keep enforcing caller-level authorization on the scheduler MCP target the way 0.5.61 and earlier did by default.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.62 \
-f your-values.yaml
kubectl get pods -n <namespace>
If your Scheduler is set to admin-only access in Admin Settings, confirm the Scheduler tab is now correctly hidden for a non-admin test user.
If your values.yaml does not set restrictedMcpServers explicitly, scheduler MCP access control now depends entirely on the Scheduler admin-only UI toggle rather than the AgentGateway default — review which one your deployment actually needs before upgrading.
--- 0.5.61
+++ 0.5.62
@@ -1490,9 +1490,8 @@
algorithms:
- RS256
# Require caller-level `mcp_server:<id>#can_invoke` authorization only for
- # these AgentGateway MCP targets.
- restrictedMcpServers:
- - scheduler
+ # these AgentGateway MCP targets. Empty by default; restrictions are opt-in.
+ restrictedMcpServers: []
audit:
enabled: true
serviceUrl: ""
Released: 2026-07-24
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.61
Previous release: 0.5.60
0.5.61 fixes an SSO session bug that was randomly logging out idle users, adds per-user OAuth token support to the Webex and Confluence MCP servers, and lets admins click into a day's feedback directly from the Insights trend chart.
Clicking a point on the Admin → Insights feedback trend chart now opens the Feedback tab pre-filtered to that day, with Back returning you to Statistics. Existing source, user, and simulation filters carry through unchanged. (#2283)
Insights readers can now open the user drawer for users within their permitted resource scope or team, not just full admins — while server-side RBAC still governs exactly which conversations are visible. Top Users cards are now paginated (10 rows per page) instead of loading everything at once. (#2285)
No breaking changes. Drop-in upgrade from 0.5.60.
None known at this time.
Drop-in upgrade — no values.yaml edits required.
No Helm values changes between 0.5.60 and 0.5.61. Drop-in upgrade.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.61 \
-f your-values.yaml
kubectl get pods -n <namespace>
If users on your deployment were reporting random logouts after long idle periods, confirm those stop occurring after this upgrade.
No values.yaml changes required.
No diff — values.yaml is identical between 0.5.60 and 0.5.61.
Released: 2026-07-23
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.59
Previous release: 0.5.58
0.5.59 adds a remote MCP catalog to the MCP Server Editor — browse and add pre-configured remote MCP providers (Amplitude, Figma, Linear, Notion, ThousandEyes, AWS, PagerDuty, and more) without hand-writing server config. This release also republishes the mcp-webex image that was missing from 0.5.58, and fixes a deployment default that broke built-in workflow tools for dynamic agents.
NEXT_PUBLIC_REMOTE_MCP_CATALOG_ENABLED. (#2263)CAIPE_API_URL to the in-cluster CAIPE UI service for the release, fixing built-in workflow tool calls that previously failed with "No scheme supplied" when the value was left unset. (#2255)mcp-webex:0.5.58 was missing from ghcr.io due to a CI digest-naming collision (see the 0.5.58 release notes). The fix landed in the 0.5.58 prereleases and this tag republishes a working mcp-webex:0.5.59 image — no action needed beyond upgrading past 0.5.58.
No breaking changes. Drop-in upgrade from 0.5.58.
None known at this time.
Drop-in upgrade — no values.yaml edits required.
Comment-only change: dynamic-agents.config.CAIPE_API_URL now documents that leaving it empty defaults to the in-cluster CAIPE UI service (http://<release-name>-caipe-ui:3000), and should only be overridden when pointing dynamic agents at an external CAIPE UI/BFF. No key was added, removed, or renamed.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.59 \
-f your-values.yaml
Set NEXT_PUBLIC_REMOTE_MCP_CATALOG_ENABLED=true in the CAIPE UI environment to enable the catalog dialog in the MCP Server Editor.
kubectl get pods -n <namespace>
If you were hitting ImagePullBackOff on mcp-webex:0.5.58, confirm it resolves once you're on 0.5.59.
No values.yaml changes required.
--- 0.5.58
+++ 0.5.59
@@ -1094,7 +1094,9 @@
# Connections & Secrets credential exchange client. Disabled by default.
CAIPE_CREDENTIALS_ENABLED: "false"
CREDENTIAL_API_URL: ""
- # CAIPE UI server base URL for built-in workflow tools.
+ # CAIPE UI server base URL for built-in workflow tools. Leave empty to get
+ # the in-cluster default http://<release-name>-caipe-ui:3000; override only
+ # when pointing dynamic-agents at an external CAIPE UI/BFF.
CAIPE_API_URL: ""
CREDENTIAL_SERVICE_AUDIENCE: "caipe-credential-service"
USE_IMPERSONATION_TOKENS: "false"
Released: 2026-07-23
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.60
Previous release: 0.5.59
0.5.60 is a focused fix for deployments that enable login-time team auto-creation: OIDC group membership now syncs into OpenFGA team tuples even when no explicit group-sync rules are configured, restoring team-scoped resource sharing for non-admin users.
IDENTITY_SYNC_LOGIN_AUTO_CREATE_TEAMS is enabled but no identity_group_sync rules are configured, login now synthesizes a passthrough rule mapping each OIDC group to a same-named team instead of silently writing zero OpenFGA membership tuples. This was breaking team-scoped resource sharing (for example, the team dropdown in secret sharing) for every non-admin user on affected deployments. Behavior is unchanged if you already configure identity_group_sync rules, or if auto-create is off. (#2282)No breaking changes. Drop-in upgrade from 0.5.59.
None known at this time.
Drop-in upgrade — no values.yaml edits required.
No Helm values changes between 0.5.59 and 0.5.60. Drop-in upgrade.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.60 \
-f your-values.yaml
kubectl get pods -n <namespace>
If you run with IDENTITY_SYNC_LOGIN_AUTO_CREATE_TEAMS=true and no identity_group_sync rules, expect newly logged-in users to start getting team-membership tuples written on next login — this is the intended fix, not a regression.
No values.yaml changes required.
No diff — values.yaml is identical between 0.5.59 and 0.5.60.
Released: 2026-07-22
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.57
Previous release: 0.5.56
0.5.57 is a focused reliability pass on the Admin Insights dashboard introduced in recent releases: stats now load independently per card, filters apply consistently everywhere, message counts no longer double-count each conversation turn, and the user activity drawer works again.
Each Admin Insights stat card now fetches and renders as soon as its own data is ready, instead of the whole dashboard waiting on the slowest section. Filter changes are debounced, stale requests are cancelled, and only bot-dependent sections refetch when the bot filter changes.
(#2260)
No breaking changes. Drop-in upgrade from 0.5.56.
None known at this time.
Drop-in upgrade — no values.yaml edits required. This release only changes Admin Insights behavior; no Helm values changed.
No Helm values changes between 0.5.56 and 0.5.57. Drop-in upgrade.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.57 \
-f your-values.yaml
kubectl get pods -n <namespace>
If your team relies on Admin Insights message totals for reporting, expect totals to roughly halve after this upgrade — that's the double-counting fix, not a data loss.
No values.yaml changes required. No action needed beyond the chart bump.
No diff — values.yaml is identical between 0.5.56 and 0.5.57.
Released: 2026-07-22
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.58
Previous release: 0.5.57
0.5.58 is an internal CI reliability release with no application-facing changes: container image builds for arm64 now run on native ARM runners instead of QEMU emulation, fixing intermittent build timeouts and out-of-memory failures that were affecting release tagging.
Known issue: the mcp-webex container image failed to publish under this exact 0.5.58 tag due to a CI bug (see Known Issues below). If you use the Webex MCP server, pin mcp-webex to 0.5.57 or latest instead of 0.5.58 until you upgrade to a later release.
RAG images and the remaining 11 image-building CI workflows (agentgateway config bridge, OpenFGA authz bridge, Keycloak init, audit service, CAIPE UI, dynamic agents, MCP servers, scheduler, skill scanner, Slack bot, Webex bot) now build their arm64 variant on native ubuntu-24.04-arm runners instead of cross-building via QEMU emulation. QEMU emulation had started timing out or exhausting runner memory on heavier images (e.g. ingestors/default installing Chromium), causing release-tagging CI runs to fail. (#2272, #2274)
No breaking changes. Drop-in upgrade from 0.5.57.
mcp-webex image missing for the 0.5.58 tag. The [CI][MCP] MCP Servers Docker Build and Push workflow failed on this release's tag push: the manifest-merge step for mcp-webex errored with a digest "not found", caused by a digest-artifact naming collision across the 11 parallel MCP server image builds. Every other MCP server image (and every other service image in this release) published successfully — only mcp-webex:0.5.58 is affected.
fix(ci): disambiguate digest artifact patterns to prevent name-prefix collisions), but that fix landed in the 0.5.58-dev.2/0.5.58-dev.3 prereleases — after the 0.5.58 tag was already cut. It was never backported to republish the numbered 0.5.58 tag itself.ghcr.io/cnoe-io/mcp-webex:0.5.58 does not exist. ghcr.io/cnoe-io/mcp-webex:latest is unaffected and currently points past this issue.values.yaml pins mcp-webex to 0.5.58 explicitly, the image pull will fail. Pin it to 0.5.57 or latest instead, or wait for the next numbered release, which will include the fix.Drop-in upgrade for every component except mcp-webex — no values.yaml edits required. This release is CI-tooling-only; no application code changed.
No Helm values changes between 0.5.57 and 0.5.58. Drop-in upgrade.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.58 \
-f your-values.yaml
Do not pin mcp-webex to 0.5.58 — that tag does not exist on ghcr.io. Keep it on 0.5.57 or latest:
mcpWebex:
image:
tag: "0.5.57" # or "latest" — do not use "0.5.58"
All other component images are unaffected and safe to bump to 0.5.58.
kubectl get pods -n <namespace>
Check that any pod using the mcp-webex image actually pulled and started — an ImagePullBackOff there is the symptom of this known issue.
No values.yaml changes required, aside from avoiding an explicit mcp-webex:0.5.58 pin as described above.
No diff — values.yaml is identical between 0.5.57 and 0.5.58.
Released: 2026-07-21
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.56
Previous release: 0.5.55
0.5.56 tightens who can see what in Admin Insights: non-admins now only see data for resources they own, with a new agent filter to narrow further. Operators syncing Active Directory / OIDC groups into CAIPE teams can now include or exclude specific groups by regex instead of syncing every group a user belongs to. The MCP tool picker in the admin lab is now a searchable combobox instead of a plain dropdown, and two unreliable Insights stats (self-resolution, estimated hours saved) have been removed.
(#2209)
Two new environment variables control which Active Directory groups get synced into CAIPE teams from the OIDC member_of claim:
OIDC_GROUP_INCLUDELIST — comma-separated regex patterns; only matching groups are synced. Unset means all groups are included (no change from prior behavior).OIDC_GROUP_EXCLUDELIST — comma-separated regex patterns; matching groups are dropped, and any existing team membership from an excluded group is actively removed on the user's next login.Both lists can be combined — includelist is applied first, then excludelist.
(#2237)
Org admins can now see, search, and page through all service accounts in the platform, not just ones belonging to their own team.
The MCP tool picker in the admin lab is now a searchable combobox instead of a plain <select>, making it usable when a tool list is long.
No breaking changes. Drop-in upgrade from 0.5.55.
None known at this time.
Drop-in upgrade — no values.yaml edits required. The Helm chart's default values are unchanged between 0.5.55 and 0.5.56.
No Helm values changes between 0.5.55 and 0.5.56. Drop-in upgrade.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.56 \
-f your-values.yaml
If you want to limit which AD/OIDC groups sync into CAIPE teams, set one or both new env vars on the UI deployment:
env:
OIDC_GROUP_INCLUDELIST: "^caipe-.*,^platform-.*"
OIDC_GROUP_EXCLUDELIST: "^contractors-.*"
Leaving both unset preserves existing behavior — no action required to upgrade safely.
kubectl get pods -n <namespace>
No values.yaml changes are required. If you rely on the Insights "self-resolution" or "estimated hours saved" cards, note that they are removed in this release and will no longer appear on the Admin Insights dashboard.
No diff — values.yaml is identical between 0.5.55 and 0.5.56.
Released: 2026-07-17
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.55
Previous release: 0.5.54
0.5.55 significantly expands the Webex integration: a single deployment can now host multiple distinct Webex bots, each routing to different agents and enforcing independent direct-message access policies. Separately, users can now set independent default agents for the web interface, Slack, and Webex rather than sharing one platform-wide DM default.
Webex bot operators: this release changes the bot configuration format. See the upgrade guide for migration steps.
Operators can now configure any number of Webex bot identities within a single platform deployment. Each bot is independent:
disabled, allowlist, or open to all users.This makes it possible, for example, to have a general-purpose bot in shared spaces and a restricted bot for a specific team — both running on the same platform.
Legacy migration: Existing space-to-agent assignments created before this release do not carry a bot identity. A Legacy Migration tab in the Admin UI lists all spaces in this state so operators can assign them to the correct bot before cutting over.
(#2184)
Users can now set independent default agents for each surface they use:
Slack and Webex selectors appear only when those integrations are active on the platform. The platform-wide default remains the fallback for any surface without a personal preference. Admins set the platform default from Admin > Settings > Agents.
The legacy shared DM default is retired. Existing selections fall back to the platform default automatically; an optional cleanup migration is available from the Admin tracked-migrations UI.
(#2233)
The previous flat env-var approach for Webex bot defaults (WEBEX_DEFAULT_TEAM_SLUG, WEBEX_DEFAULT_AGENT_ID, WEBEX_AUTO_ASSIGN_UNMAPPED_SPACES) is replaced by a structured bots array in Helm values. See the upgrade guide below.
This only affects deployments with tags.webex-bot: true. Deployments that do not run the Webex bot are unaffected.
The following env vars are removed from the webex-bot subchart:
| Removed key | Replacement |
|---|---|
WEBEX_DEFAULT_TEAM_SLUG | webex-bot.bots[*].spaces.defaultTeamSlug |
WEBEX_DEFAULT_AGENT_ID | webex-bot.bots[*].spaces.defaultAgentId or webex-bot.bots[*].directMessages.defaultAgentId |
WEBEX_AUTO_ASSIGN_UNMAPPED_SPACES | replaced by per-bot spaces.accessMode |
The new configuration uses a bots array. Each entry describes one bot identity:
Before (0.5.54):
webex-bot:
env:
WEBEX_DEFAULT_TEAM_SLUG: "platform"
WEBEX_DEFAULT_AGENT_ID: "agent-platform"
WEBEX_AUTO_ASSIGN_UNMAPPED_SPACES: "false"
After (0.5.55):
webex-bot:
bots:
- id: "primary"
name: "Platform Bot"
tokenEnv: "WEBEX_BOT_TOKEN" # env var holding the bot token in your secret
spaces:
accessMode: "all_spaces" # or "allowlist"
defaultTeamSlug: "platform"
defaultAgentId: "agent-platform"
directMessages:
accessMode: "all_users" # or "disabled" or "allowlist"
defaultAgentId: "agent-platform"
The legacy dm_default_agent_id field in user preferences is retired. Existing values fall back to the platform default automatically — no action required. To clean up the retired field from the database, run the user_preferences_default_agent_cleanup_v1 migration from Admin > Tracked Migrations after upgrading.
If you run the Webex bot (tags.webex-bot: true), replace the removed env vars with the new bots array as shown above.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.55 \
-f your-values.yaml
After the upgrade, open Admin > Integrations > Legacy Migration and assign any unattributed spaces to the correct bot.
kubectl get pods -n <namespace>
- WEBEX_DEFAULT_TEAM_SLUG: ""
- WEBEX_DEFAULT_AGENT_ID: ""
WEBEX_THREAD_CONTEXT_ENABLED: "true"
WEBEX_THREAD_CONTEXT_MAX_MESSAGES: "10"
WEBEX_THREAD_CONTEXT_MAX_CHARS: "4000"
- WEBEX_AUTO_ASSIGN_UNMAPPED_SPACES: "false"
- WEBEX_DEFAULT_TEAM_SLUG: ""
- WEBEX_DEFAULT_AGENT_ID: ""
+ # One runtime pod can host multiple bot identities. Each bot owns its group
+ # space and direct-message policy. Automatic modes require both defaults.
+ bots: []
+ # - id: "primary"
+ # name: "Primary bot"
+ # tokenEnv: "PRIMARY_WEBEX_BOT_TOKEN"
+ # spaces:
+ # accessMode: "all_spaces"
+ # defaultTeamSlug: "platform"
+ # defaultAgentId: "agent-platform"
+ # directMessages:
+ # accessMode: "all_users"
+ # defaultAgentId: "agent-personal"
Released: 2026-07-16
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.54
Previous release: 0.5.53
0.5.54 delivers a fully rebuilt admin access preview that accurately simulates what any user or team can see without touching their session, consolidates default agent settings into a single organized surface, and fixes a set of Slack bot reliability issues that were causing escalation and on-call flows to fail silently.
The View As mode in Admin now provides an accurate, read-only simulation of any user or team's effective access. The admin's own session is never modified — no target-user token is minted, and no state is altered. The preview reflects the selected subject's navigation access, data visibility, and team membership exactly as they would experience it.
Administrators can switch preview subjects without stale data from the previous subject carrying over.
(#2218)
The Settings surface now has a single Default Agent card. Each user can set a personal default for the web interface via a compact dropdown, and administrators see a clearly separated section for platform-wide controls. The platform default is shown as the fallback option in the personal selector, so the effective resolution is always visible.
The Import Agents action moves into the admin-only Agents tab, where it belongs.
(#2218)
Tab selectors across the Admin surface now animate smoothly using a shared measured indicator. The indicator moves between tabs on the same navigation level without stretching or jitter. A reduced-motion preference disables the animation. Keyboard and accessibility behavior is unchanged.
(#2217)
The Users and Teams admin page no longer fetches all members and then filters in the browser. Lookups are now paginated and scoped to the team in Mongo and Keycloak, which significantly reduces load time for organizations with large user bases.
Several Slack bot action handlers — feedback, retry, escalation — were failing because they could not resolve which conversation to associate the action with. The fixes ensure the correct conversation identity is resolved before any downstream call:
No breaking changes. Drop-in upgrade from 0.5.53.
No Helm values changes between 0.5.53 and 0.5.54. Drop-in upgrade.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.54 \
-f your-values.yaml
Released: 2026-07-15
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.52
Previous release: 0.5.51
0.5.52 adds deep links across the Agents surface so resource editors can be shared and bookmarked, fixes a session expiry bug that was logging users out despite a successful silent refresh, corrects Slack escalation and message-delete failures caused by a missing agent_id, and makes the dynamic-agents Prometheus metrics port configurable.
The Agents surface now uses URL-backed deep links throughout, so resource editors can be shared, refreshed, and navigated with browser history.
?tab=agents&agent=<id>&step=<step>?tab=mcp-servers&server=<id>?tab=llm-models&model=<id>(#2212)
A new METRICS_PORT env var (and corresponding Helm value) lets the dynamic-agents Prometheus /metrics endpoint be served on a dedicated port, separate from the main API port. This unblocks running the main API port under strict mTLS while keeping the metrics endpoint accessible to Prometheus without mTLS.
(#2135)
TokenExpiryGuard was treating any transient silent-refresh failure as a terminal logout trigger. Users in caipe-preview environments were being kicked out and forced to sign in again despite the UI banner claiming a refresh was in progress. The guard now tolerates transient failures and only forces logout after exhausting retries.
(#2220)
_resolve_conversation_id performs a get-or-create lookup keyed by thread_ts, but the conversation-creation API validates that agent_id is non-empty before reaching the lookup. The Slack bot's "Get help" escalation and message-delete handlers were calling _resolve_conversation_id without passing agent_id, causing an HTTP 400 on every call. The agent_id is now passed correctly in both handlers.
(#2222)
The Admin View as flow now provides an accurate read-only access preview. The previous implementation was showing an opaque user ID or blank page. The fix uses access simulation (not session impersonation) — the signed-in admin session is unchanged, no target-user token is minted, and no session state is altered.
(#2206)
The "Unlinked Access" modal (Platform Settings tab) now wraps its scopes list and add-scope form in a scrollable container (max-h-[65vh] overflow-y-auto) instead of growing the dialog past the viewport.
(#2224)
No breaking changes. Drop-in upgrade from 0.5.51.
No values changes required unless you want to configure a dedicated metrics port:
dynamic-agents:
env:
METRICS_PORT: "9090"
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.52 \
-f your-values.yaml
Released: 2026-07-15
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.52
Previous release: 0.4.18
0.5.52 marks a major milestone for the platform. The 0.5.x series ships six headline capabilities that fundamentally expand what you can build and how the platform governs access: a new agentic workflow engine, a configurable Webex bot, bring-your-own credentials and impersonation tokens for MCP servers, fully custom agent definitions, relationship-based fine-grained authorization, and agent-driven scheduled jobs. This post summarizes what changed from 0.4.18 to 0.5.52.
The entire authorization stack ships disabled by default — upgrading from 0.4.18 requires no values.yaml changes if you are not opting into RBAC, Webex, or credentials.
The platform now ships a first-class workflow engine backed by LangGraph. You can build multi-step agentic workflows that fan out to sub-agents, pause for human approval, and resume — all tracked in a live UI timeline.
waiting_for_input state, the approval form renders directly inside the chat card. No navigation required.The previous Task Builder tab is superseded by the new workflow engine. The legacy standalone supervisor and A2A agents are removed; all routing now flows through the dynamic agent layer.
A full Webex bot integration ships as a first-class platform component.
tags.webex-bot: false).You can now bring your own credentials to MCP tool calls — either as personal OAuth tokens, service account credentials, or PKCE public-client flows for integrations that don't support a fixed scope.
requested_subject impersonation) so scheduled and automated runs execute as the owning user — access enforcement is identical to interactive runs.Enable with CAIPE_CREDENTIALS_ENABLED: "true" and set CREDENTIAL_KEY_PROVIDER: "aws-kms" for production.
The dynamic agents runtime is now the sole routing layer for the platform. You can define, deploy, and manage agents entirely from the UI without writing code or modifying Helm values.
/mcp suffixes — the platform canonicalizes them automatically.The platform ships a complete relationship-based access control (ReBAC) stack backed by OpenFGA and Keycloak. Every access decision — agents, knowledge bases, MCP tools, workflows, credentials — flows through a single authorization service.
The entire stack ships disabled by default. Enable with:
tags.keycloak: true
openfga.enabled: true
openfgaAuthzBridge.enabled: true
global.agentgateway.enabled: true
Agents can now create, manage, and run scheduled jobs without manual intervention.
mcp-scheduler tool exposes create, list, update, and delete operations for scheduled jobs. Each job is owned by the creating user — only they (or their team members) can manage it.caipe-cron-runner pod fires once per schedule interval and exits.agent#use) is identical to an interactive run — if the owner's access was revoked, the run fails closed.Enable with:
scheduler:
enabled: true
helm install/upgrade. Strict-mode gate (keycloak.strictClientSecrets) fails the install if dev placeholders are still in use.admin/admin against Keycloak — production requires the client_credentials path and fails loudly otherwise.aiohttp, websockets, @aws-sdk/client-kms, protobuf, qs.No breaking Helm values changes from 0.4.18 to 0.5.52 for operators who are not opting into RBAC, Webex, or credentials. All new configuration is additive with working defaults.
Two behavioral notes:
active_team JWT claim removed — replaced by channel-derived team binding. Operators upgrading from 0.4.18 are unaffected (the claim was never issued by that release). Any external code that inspected active_team on a CAIPE-issued JWT should switch to reading the channel/space context.
Legacy supervisor and standalone A2A agents removed — if your values.yaml references those components, the entries can be dropped. Dynamic agents are the supported routing layer from 0.5.22 onward.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.52 \
-f your-values.yaml
For the full incremental upgrade path with per-release values diffs, see the individual release notes for 0.5.0 through 0.5.45.
Drop-in for stock 0.4.18 deployments. Every new capability is additive and gated behind a feature flag that defaults to disabled. The only required review is whether your values.yaml references the legacy supervisor or standalone A2A agents (safe to remove).
| Step | What to enable | Key values |
|---|---|---|
| 1 | Dynamic agents (already default) | No change |
| 2 | RBAC + OpenFGA | tags.keycloak, openfga.enabled, openfgaAuthzBridge.enabled, global.agentgateway.enabled |
| 3 | Webex bot | tags.webex-bot: true |
| 4 | Credentials store | CAIPE_CREDENTIALS_ENABLED: "true", CREDENTIAL_KEY_PROVIDER: "aws-kms" |
| 5 | Scheduler | scheduler.enabled: true |
If present in your values.yaml, these are now no-ops and can be removed:
supervisor.*) configa2a-agents.* standalone agent entriesAGENT_GATEWAY_MCP_SERVER_IDS: "jira" (no longer needed — AgentGateway handles routing based on profile)No MongoDB schema migrations are required for the drop-in path. If enabling RBAC, the OpenFGA init job bootstraps the authorization model and backfills existing tuples automatically on first run.
kubectl get pods -n <namespace>
# Send a test chat message and confirm a normal response
Released: 2026-07-15
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.53
Previous release: 0.5.52
0.5.53 extends default SSO session lifetimes so users are no longer signed out after eight hours of inactivity, and improves the experience when an agent has been deprecated — users can now pick a replacement or pick up a conversation where they left off without losing context.
The default Keycloak SSO session lifetime increases from 8 hours idle / 24 hours maximum to 7 days idle / 14 days maximum. Users who authenticate via an external identity provider (such as Duo SSO) are no longer forced to sign in again each day as long as they stay active within the window.
The idle timeout resets on each page visit, so a working user will not be interrupted. Operators can tune the values to match their organization's policy without modifying the chart — see the upgrade guide below.
When a conversation is linked to an agent that has since been deprecated, the UI now shows the full conversation history and offers two clear recovery paths:
Previously, deprecated-agent conversations showed a partial view with no clear way forward.
No breaking changes. Drop-in upgrade from 0.5.52.
No Helm values changes between 0.5.52 and 0.5.53.
The updated SSO defaults take effect the next time keycloak-init runs (on pod start for Helm deployments, or docker compose run --rm keycloak-init for Compose). Existing realms that were already initialized retain their previous values until init-idp is re-applied.
To customize the limits without changing the chart, set any of these in your values.yaml under the keycloak subchart env block, or in .env for Compose:
| Variable | Default | Description |
|---|---|---|
KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT | 604800 (7 d) | Idle timeout in seconds |
KEYCLOAK_SSO_SESSION_MAX_LIFESPAN | 1209600 (14 d) | Absolute max session length in seconds |
KEYCLOAK_ACCESS_TOKEN_LIFESPAN | 3600 (1 h) | Access-token TTL in seconds |
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.53 \
-f your-values.yaml
Released: 2026-07-13
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.51
Previous release: 0.5.50
0.5.51 fixes a critical gap where directory-synced users couldn't pass the AgentGateway ext_authz gate on their first login, hardens Slack event routing with per-stage timing logs and server-side OpenFGA filtering, and makes IdP sync progress observable through structured stage logs.
The baseline OpenFGA grants required for a user to pass AgentGateway's coarse MCP ext_authz gate — specifically the mcp-gateway-call grant (user:<sub> caller mcp_gateway:list) — were only written by the interactive web-login path. Users provisioned by Okta directory sync (who may never have logged into the web UI) lacked these grants and were silently rejected at the gateway on their first API call. The sync now bootstraps baseline access before applying team-level grants, and member resolution is parallelized to keep the sync fast on large orgs.
(#2203)
The Slack event pipeline was reading all OpenFGA tuples for a subject without server-side filtering, then filtering client-side by channel. On deployments with many channels per user this produced large tuple reads that added visible latency to every Slack event. Tuple reads are now filtered server-side by channel subject.
(#2210)
The Okta/LDAP directory sync now emits structured log lines at each stage of a sync run — plan, reconcile, member resolution, and OpenFGA write — so operators can see where time is spent and diagnose stalls in large-org syncs without resorting to debug-level output.
(#2203)
Lightweight stage-timing logs are added across the Slack event pipeline (middleware entry, RBAC context enrichment, mention/message handler entry, _route_to_agent entry, channel-match duration) at DEBUG level, making it possible to profile where delays accumulate between Slack event receipt and agent response.
(#2210)
No breaking changes. Drop-in upgrade from 0.5.50.
No values changes required.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.51 \
-f your-values.yaml
Released: 2026-07-10
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.48
Previous release: 0.5.47
0.5.48 fixes a critical gap in Okta directory sync (synced users lacked a Keycloak federated identity and couldn't SSO login), stops Slack bot/user names with spaces from being parsed as multiple entries, and patches a NoSQL injection vulnerability in the GridFS store.
Okta directory sync was provisioning shell users in Keycloak but never writing a federatedIdentities record for them. That record was previously only created by Keycloak's idp-auto-link authenticator during an actual interactive SSO login, leaving sync-provisioned users unable to complete SSO sign-in without first logging in manually. The sync now registers the federated identity directly during provisioning.
(#2181)
Slack route allow-lists (bots, users) and escalation user lists (ping users, delete admins) are now stored and edited as arrays end-to-end instead of comma/space-joined strings. A multi-word name like "My Bot" can no longer be parsed into separate entries ("My", "Bot") when typed or re-read from the database.
(#2180)
delete_by_key_prefix in gridfs_store.py was interpolating a caller-supplied prefix directly into a MongoDB $regex pattern without escaping. Added re.escape() to sanitize the input before regex construction. Also upgrades Playwright Node CVEs and bumps APK packages in ingestor images.
(#2160)
No breaking changes. Drop-in upgrade from 0.5.47.
No values changes required.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.48 \
-f your-values.yaml
Released: 2026-07-10
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.49
Previous release: 0.5.48
0.5.49 makes Okta IdP sync resilient to invalid display names, already-linked identities, and event-loop stalls in large orgs; restores correct tool result invariants for dynamic agents on Bedrock; and changes the default channel/space onboarding mode to mention-only to prevent bots from responding to every message in newly connected channels.
The header brand now shows a one-shot active-gradient sweep and sparkle finish on hover or keyboard focus, with a refreshed navigation layout.
(#2187)
Three reliability issues in the Okta IdP sync are fixed:
"Jane Doe (Contractor)" were passed directly to Keycloak's admin API, triggering error-person-name-invalid-character responses. Names are now sanitized before provisioning.409 and already-linked responses are now handled gracefully.(#2190)
A ValidationException was occurring on Bedrock Converse when an assistant toolUse reached the next model call without an adjacent toolResult. This was caused by the PatchToolCallsMiddleware not being applied to all code paths in the dynamic agents runtime. The invariant is now enforced consistently across all agent configurations.
(#2182)
Slack channel and Webex space onboarding (bulk-apply defaults, single onboard endpoints, ghost-route materialization, and auto-assign of unmapped channels/spaces) now defaults new routes to listen: "mention" instead of listen: "all". Previously, onboarding a channel caused the bot to respond to every message posted there, which was unexpected in active team channels.
(#2192)
Real Keycloak API errors (network failures, 500s) were being swallowed and surfaced as user-not-found responses, making it impossible to distinguish a missing user from an API outage. Errors are now propagated correctly.
(#2192)
No breaking changes. Drop-in upgrade from 0.5.48.
New Slack/Webex channel onboardings will default to mention-only mode. Existing configured channels are unaffected. To restore the previous all-messages behavior on new onboardings, set listen: "all" explicitly in the channel config.
No values changes required.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.49 \
-f your-values.yaml
Released: 2026-07-10
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.50
Previous release: 0.5.49
0.5.50 fixes two agent reliability issues: Slack Workflow Builder @mentions now resolve the bot identity correctly instead of crashing on a missing user field, and the general-purpose deep-agent subagent correctly applies tool result invariants after the 0.5.49 fix.
When a Slack Workflow Builder step @mentions the bot, Slack delivers an app_mention event with bot_id set and no user field. The bot's handle_mention handler assumed every mention was human-authored (user_id = event.get("user")), so bot-authored workflow steps produced a missing user_id error. The handler now detects bot-authored mentions and resolves the bot's own identity as the sender, also minting an unlinked service account token for bot_message-subtype mentions.
(#2193)
Follow-up to #2182 (0.5.49). The PatchToolCallsMiddleware invariant fix was applied to the parent Dynamic Agent and configured subagents, but the general-purpose subagent in deep-agents mode is built independently and retained the narrower upstream middleware only. Tool result invariants are now applied to the general-purpose subagent as well.
(#2196)
No breaking changes. Drop-in upgrade from 0.5.49.
No values changes required.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.50 \
-f your-values.yaml
Released: 2026-07-09
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.43
Previous release: 0.5.42
0.5.43 delivers the inline HITL (human-in-the-loop) input form directly in the chat timeline and fixes a Slack bot crash introduced by a stale keyword argument.
Workflow runs that reach a waiting_for_input interrupt state now render the input form inline inside the chat message card — no page navigation required. The form matches the agent HITL panel style and submits via the existing interrupt resume API.
(#2148)
SlackChannelRebacDecision was being called with a user_allowed keyword argument that no longer exists in the updated signature, causing a TypeError crash on channel-authorization checks.
(#2152)
No breaking changes. Drop-in upgrade from 0.5.42.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.43 \
-f your-values.yaml
Released: 2026-07-09
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.44
Previous release: 0.5.43
0.5.44 is a targeted CI/docs patch. All Wolfi-based Docker images now retry apk add with exponential backoff to survive transient APK mirror failures, and the missing workflows.md docs page that was breaking Docusaurus builds is added.
All Wolfi (Chainguard) based Dockerfiles — keycloak-init, slack-bot, webex-bot, skill-scanner, Dockerfile.mcp, config-bridge, openfga-bridge — now retry apk add with exponential backoff (5 s, 10 s, 20 s) when a transient mirror error causes the package manager to exit non-zero. Dockerfile.keycloak-init previously had no retry at all and was the source of intermittent CI failures.
(#2153)
Added docs/docs/features/workflows.md which was referenced by features.tsx but missing, causing Docusaurus to fail with a broken-link error on every docs build.
(#2153)
No breaking changes. Drop-in upgrade from 0.5.43.
No values changes required.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.44 \
-f your-values.yaml
Released: 2026-07-09
Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.45
Previous release: 0.5.43
0.5.45 brings the inline HITL (human-in-the-loop) input form directly into the chat timeline, fixes the Webex MCP 401 auth error, restores live workflow run status polling, and makes all Wolfi-based Docker builds resilient to transient APK mirror failures.
Workflow runs that reach a waiting_for_input interrupt state now render the input form inline inside the chat message card — no page navigation required. The form matches the agent HITL panel style and submits via the existing interrupt resume API. Each card also polls for live status updates until the run reaches a terminal state.
The Webex MCP server was not forwarding the provider token from the UI. Fixed by using X-CAIPE-Provider-Token as the credential source so the bot's Webex API token is correctly injected into MCP tool calls.
(#2150)
All Wolfi (Chainguard) based Dockerfiles now retry apk add up to 3 times with a linear backoff (5 s, 10 s) when a transient mirror error causes the package manager to exit non-zero. Dockerfile.keycloak-init previously had no retry at all and was the source of intermittent reconcile-test CI failures. All images continue to pin python-3.13 — the correct versioned Wolfi package name.
(#2153)
Added docs/docs/features/workflows.md which was referenced by features.tsx but missing, causing Docusaurus to fail with a broken-link error on every docs build.
(#2153)
No breaking changes. Drop-in upgrade from 0.5.43.
No values changes required.
helm upgrade ai-platform-engineering \
oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
--version 0.5.45 \
-f your-values.yaml