A new UI. Navigation and settings were unified into a single application shell: one settings center instead of scattered per-area config, a coherent workspace nav, and consistent breadcrumbs, deep links, and pickers throughout. Most screens you touch daily have moved or been rebuilt.

Knowledge base access control. RAG knowledge bases are now fully governed. Ingestion sources are managed from the UI instead of YAML, gated by their own RBAC relations, and authorization is enforced at query time on the live agent tool path, so a search only ever sees datasources the caller can read.

Underneath both: the legacy supervisor and standalone A2A agents are gone, and the Centralized Authorization Service is now the single decision point for every resource.

Features​

A new application UI​

• Unified settings center: one place for personal and platform settings, replacing config spread across separate admin areas.
• Unified workspace navigation: the workspace and settings shells share one navigation model, with dynamic nav overflow and a compact right-hand cluster.
• Consistent wayfinding: breadcrumbs (including workflows), admin filter deep links, and admin sub-tab state synced to the URL, so any view can be linked and restored.
• Animated header brand, navigation, and shared tab selectors; the sidebar no longer flashes on collapse.
• Searchable team pickers, expandable config-driven agent panels, editable chat titles, and ephemeral file previews in agents and workflows.
• Release notes moved to a user-scoped view under General.
• The documentation site moved to the caipe.io root and is now responsive with a mobile navigation menu.

Knowledge base access control​

• Ingestion sources in the UI: create, edit, and manage RAG ingestion source configs (Slack, Confluence, Jira, web URL, Webex) without editing YAML, gated by ingestion_source RBAC relations. The standalone tab was later folded into Data Sources.
• Query-time RBAC on the live agent path: search, fetch, jobs, and docs are scoped to the caller's accessible datasources, with an org-admin bypass.
• Agent to datasource binding: an agent's search tool can be pinned to a subset of its owning team's visible datasources, intersected with the caller's access at runtime.
• Ingestor service accounts: ingestor pods authenticate as recognized service accounts (RAG_INGESTOR_SERVICE_ACCOUNTS), list only their allowed source types, and report status through a scoped PATCH endpoint, with no per-resource grants or general write access.
• Adopt config-driven sources: an admin action migrates Helm/YAML-seeded ingestion sources into the database as permanent, team-owned records.
• OpenFGA is the source of truth for KB grants: team_kb_ownership dropped; knowledge bases are shared with teams through an OpenFGA reconciler.
• Public datasources, org-level ingest and search capabilities with an FGA coverage guarantee, per-tab authorization gates and empty states in the Knowledge sidebar, and the Graph tab gated on any readable KB.
• New ingestors: S3 documents and local file upload. Opt-in bypass for SSRF protection on web ingestion.

Authorization​

• Centralized Authorization Service (CAS): core, HTTP API, and admin UI. Every permission check for agents, workflows, knowledge bases, and MCP tools flows through one service.
• Service accounts: team-owned bot identities with caller-keyed tool authorization and credential passthrough.
• Access explorer and RBAC self-check to diagnose why a principal can or cannot reach a resource; policy manifest downloads.
• OpenFGA made the source of truth for team resource access, with a decluttered team UI and split Agents/MCPs tabs.
• Archived teams grant no access, with self-check repair. Unified ownership transfer across agents, knowledge bases, and MCP tools.
• Okta and LDAP directory sync: SDK-based sync with JIT provisioning, an IdP-sync admin UI, a background sync scheduler, per-stage progress logging, user/team upserts, and OIDC_GROUP_INCLUDELIST / OIDC_GROUP_EXCLUDELIST for AD group filtering.
• Non-admin scoping for admin teams, users, stats, and feedback; admin insights scoped to owned agents with an agent filter.

Retiring the legacy runtime​

• The legacy supervisor model and standalone A2A agents are removed. Dynamic agents are the only routing layer.
• A legacy_runtime_cleanup_v1 migration drops orphaned checkpoint collections and unsets metadata.agent_version / metadata.model_used on conversations and a2a_events on messages. See Upgrade; it is destructive and optional.
• Admin Insights, Metrics, and Health were rebuilt on dynamic-agent telemetry (da_turns_total, da_turn_duration_seconds, da_llm_calls_total, da_tool_calls_total, da_active_requests). Chat now persists agent_name and a measured latency_ms, so Top Agents and response-time charts populate.
• The Autonomous UI was restored on the dynamic-agents architecture.

Scheduled agents​

• mcp-scheduler exposes create, list, update, and delete for scheduled jobs, each owned by its creator.
• Kubernetes CronJob backend; the caipe-cron-runner pod fires once per interval and exits.
• The JWT is relayed to the scheduler service, which validates it and derives owner_sub, so enforcement matches an interactive run. Admins can change the default schedule-editor agent from the UI.

Multimodal chat​

• Attach files to chat messages as multimodal model input, shown inline in the transcript.
• Slack attachments forwarded as multimodal input.
• Per-model input capabilities declared up front, degrading cleanly and naming the model in the skip warning; input attachments capped.
• Attachment bytes offloaded to object storage, with a dropped-input-files panel in metrics and a multimodal regression harness.

Platform operations​

• Audit service: a lightweight runtime plus a read UI, S3 retention controls, storage usage visibility, configurable verbosity, and connector diagnostics.
• Platform health: probes refactored to capabilities with profile-aware integration status, a dynamic-agents probe, and a steady-state operations dashboard.
• Remote MCP catalog with OAuth credential connectors; MCP servers default to streamable HTTP; mcpSecrets added as the canonical name for agentSecrets.
• Keycloak: configurable SSO session lifetime (7 day idle, 14 day max), PostgreSQL support, a caipe-cli public client for local dev tokens, and migration health surfaces.
• Object storage resolved from a shared global.storage.s3 block.
• Multiple Webex bots with 1:1 support, per-surface default agents, and a Webex Meetings MCP server.
• CI moved to native per-architecture image builds; third-party MCP images pinned.

Fixes​

Roughly a thousand commits between 0.5.0 and 0.6.0 went to reliability. The concentrations:

• UI and admin: the largest single group, tracking the navigation rework and the screens rebuilt around it.
• Authorization: grant correctness, team membership performance, OpenFGA batch-check limits, stale principal cleanup, and service-account grant preservation across visibility changes.
• Identity: Okta sync throttling and reliability, auto-create team sync, Keycloak 26.x robustness and upgrade reconciliation, federated identity, and the SSO idle-timeout fix.
• Chat and dynamic agents: deprecated-agent recovery, private chat access, subagent HITL resume, tool result invariants, immutable prompt rendering, and failed conversation deletes no longer reappearing.
• Slack and Webex: file-attachment routing, agent pagination, name parsing, ephemeral nudges, Workflow Builder mentions, and space navigation.
• Security: SSRF protections in web ingestors, NoSQL injection fixes in the admin API, catalog credential boundaries, skills zip import ownership, and dependency vulnerability sweeps.

Breaking changes​

No breaking Helm values changes in 0.6.0 itself. Ten changes landed between 0.5.0 and 0.6.0 that need review:

Upgrade​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/caipe-io/charts/ai-platform-engineering \
  --version 0.6.0 \
  -f your-values.yaml

Values keys to drop​

These are no-ops and can be removed:

• any supervisor.* config and a2a-agents.* standalone agent entries
• nps.enabled
• AGENT_GATEWAY_MCP_SERVER_IDS, since AgentGateway routes by profile now

If you run the Webex bot, restructure its defaults into the bots array (0.5.55). If you deliberately restricted an MCP server, re-add it to restrictedMcpServers (0.5.62).

Data migrations​

Two admin-run migrations apply, under Admin → Migrations:

• 0.5.8: catalog API key rehash. Required if you use catalog API keys; clients need newly minted keys afterwards.
• 0.6.0: legacy runtime cleanup. Destructive and optional. It preserves checkpoints_conversation and workflow_checkpoints (with their writes collections) and drops every other checkpoints_* / checkpoint_writes_* collection, which are orphans from the supervisor era with no reader left. It also unsets metadata.agent_version and metadata.model_used on conversations and a2a_events on messages.

Nothing in 0.6.0 reads the data the 0.6.0 migration removes, so the upgrade is safe without running it. Run it when you want the storage back, and take a MongoDB backup first, because it is not reversible.

Enabling RBAC for the first time bootstraps the OpenFGA authorization model and backfills tuples on first run.

Verify​

kubectl get pods -n <namespace>
# Send a test chat message, then check Admin → Insights shows the agent name and latency

Enterprise authorization. A full cutover from role-based to relationship-based access control (ReBAC) backed by OpenFGA, with Keycloak as the identity provider and an AgentGateway ext_authz bridge enforcing per-call MCP decisions.

A workflow engine. Multi-step agentic workflows with a visual editor, human-in-the-loop approval, artifact capture, and sharing.

Alongside those: a new Webex bot, an envelope-encrypted credential store with an OAuth connector platform, and a rebuilt Skills platform.

The entire authorization stack is opt-in and disabled by default: for a stock 0.4.x deployment this is a drop-in upgrade with no values.yaml edits required.

Features​

Identity and authorization (OpenFGA ReBAC)​

• ReBAC core, admin BFF, and admin UI: a new ui/src/lib/rbac library (OpenFGA client, tuple builder, store, PDP, decision cache, role mapping, group sync, team/agent resolvers, Keycloak Admin REST helpers), the full admin BFF surface, and admin UI for teams and authorization.
• Auth foundation charts: new keycloak, openfga, openfga-authz-bridge, and agentgateway subcharts, with Keycloak realm init, token-exchange and auth-reconcile jobs, the OpenFGA model bootstrap, and the Python ext_authz bridge.
• Shared MCP agent-auth library: a new mcp-agent-auth package (JWT validation, caller-key derivation, OBO exchange, in-process JWKS cache, downstream token forwarder, PDP) wired uniformly into 13 agent MCP servers via MCPAuthMiddleware.
• RAG ReBAC with per-document ACLs: OpenFGA authorization for the RAG server, ACL propagation through every ingestor, per-document enforcement at retrieval time, and a userinfo cache for the OBO validation hot path.
• admin implies member plus an auto-provisioned Super Admins team, removing the need to dual-write tuples.
• Channel-derived team binding: the authorizing team is derived from the Slack channel, Webex space, or DM context, which is correct for multi-team users by construction. Personal DM commands added to both bots.
• Persisted onboarding defaults in platform_config, and an admin-configurable discovery cache TTL.

Workflow engine​

• Server-side workflow infrastructure, API routes, stores, and types.
• ReactFlow-based visual editor with skill isolation.
• Human-in-the-loop: waiting_for_input run cards with approval forms, hidden on terminal runs; a cancelled status.
• Step context injection, artifact capture, and warnings for unavailable resources.
• Config-driven seeding with read-only protection and a banner in the UI.
• Visibility and sharing RBAC with config-access checks on runs.
• Step-level tool restrictions via a Tool Access picker.
• YAML export/import (switched from JSON), run deletion with file cleanup, and auto-expiry.
• Workflow tools for dynamic agents, with run cards and trigger info.
• Gated behind WORKFLOWS_ENABLED.

Bots: Webex and Slack​

• New Webex bot integration: a full webex_bot integration (A2A client, app, identity linking, audit, hardening, Prometheus metrics) plus a webex-bot subchart, Dockerfile, and CI workflow.
• Slack ReBAC additions: channel-team resolver, JIT identity linking, SSE OBO, runtime policy, and opt-in first-message channel onboarding for unmapped channels.

Credentials​

• Envelope-encrypted credential store: MongoDB-backed storage with KMS-style data-key wrapping (AES-GCM with a master key), an OAuth connector platform (built-in providers, token refresh, state store, provider detection), and a Python credential-exchange client for agents. Gated behind CAIPE_CREDENTIALS_ENABLED and disabled by default.

Skills platform​

• Unified Workspace browsing every hub (GitHub, GitLab, local) in one view.
• Standalone scanner microservice, decoupled from the gateway for reliability.
• Installer rewrite with per-skill install history, multi-source hubs, ZIP export, and AI Assist for authoring.
• Skills Builder for dynamic agents, gallery filter/sort controls, and a HIDE_BUILTIN_SKILLS flag.
• AI Review module for skills and dynamic agents, with a reworked rubric.

Dynamic agents and chat​

• HITL tool approval: agents pause for explicit human approval before running a sensitive tool, with GridFS-backed storage for large artifacts.
• JWT/OBO auth plus an OpenFGA PDP gate, bringing the runtime to parity with the rest of the auth surface.
• MCP endpoint normalizer and self-heal: canonicalizes MCP URLs from bot configs (trailing slash, /mcp suffix, scheme inference), forwards request tokens via OBO, and resolves credential references.
• A curl builtin tool for PUT/POST and an allow_non_public_urls option for private endpoints.
• A generic files API, a resizable context panel, editor blocker hints, and protection for the platform default agent.
• get_file_line_count, which the agent is prompted to call before read_file so large files are read in bounded ranges.

Integrations and MCP​

• AWS MCP server and a Pod Security Standards baseline.
• LiteLLM FinOps MCP server for model cost and usage reporting, with theme-aware report images.
• VictorOps consolidated onto v2 incident reporting; Jira internal service-desk comments.

Operations​

• DocumentDB compatibility: the runtime works against AWS DocumentDB, not just vanilla MongoDB.
• Installer UX and runtime simplification; the embeddings menu in setup-caipe.sh expanded to all seven EmbeddingsFactory providers including Bedrock, Cohere, and Voyage AI.
• Documentation site redesign, and versioned docs generated at build time from release tags.

Fixes​

• Slack and chat reliability: followup prompts no longer claim knowledge of replies the agent never made; stale env-provided Slack default agent/team are dropped with a warning rather than silently honored; channel discovery uses users.conversations to dodge Slack API rate limits.
• RAG truncation and seed persistence: long retrieved documents are no longer silently cut, and seeded config survives restarts.
• Web ingestion: fixed crawling after the Scrapy 2.16 bump.
• Dynamic agent chat regression: restored chat for agents created through the UI editor.
• RBAC: scoped team admins can edit, delete, and configure their own team; previously group admins could not modify anything within their own group.
• Charts: workflow_configs included in the caipe-ui app ConfigMap so self-service workflows render; the Ollama embedding model is pulled during setup so local embeddings work out of the box.

Security​

• Keycloak client-secret hardening: a reconcile pass rotates dev placeholder secrets for the three confidential service-account clients on every install/upgrade, plus a strict-mode gate (keycloak.strictClientSecrets, default off) that fails the install if a known placeholder still mints a token. Five demo users with hardcoded passwords were removed from the bundled realm config.
• BFF admin/admin fallback removed: production requires the client_credentials path against a confidential client and fails loudly otherwise. MongoDB and NextAuth strict-mode gates added.
• MongoDB strict-password gate: mongodb.auth.strictPasswords (default off) makes install/upgrade fail fast when the root password is left at a placeholder like changeme.
• Envelope-encrypted credentials; production installs must use aws-kms (local-cmk is for non-production testing only).
• Dependency hardening: exact pins for aiohttp, websockets, and @aws-sdk/client-kms; fastmcp bumped to 3.3.1; stale MCP uv.lock files refreshed; protobuf and qs bumped.

Breaking changes​

There are no breaking Helm values changes in 0.5.0. Every key in the chart diff is additive, and the RBAC/OpenFGA/Keycloak/Webex/credentials stack ships disabled by default (tags.keycloak, tags.webex-bot, openfga.enabled, global.agentgateway.enabled, and CAIPE_CREDENTIALS_ENABLED all default to false).

Three changes landed between 0.4.0 and 0.5.0 that need attention:

Known issues​

None beyond the Slack statistics gap noted in 0.4.0.

Upgrade​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/caipe-io/charts/ai-platform-engineering \
  --version 0.5.0 \
  -f your-values.yaml

That alone is sufficient for a stock upgrade. The new authorization stack stays disabled.

Adopting the new stacks​

Data migrations​

• MongoDB: no destructive schema migration. New collections back the credential store and Slack/Webex route management; the credential store adds indexes via scripts/init-credential-mongo-indexes.ts. All are created lazily, and only when the corresponding feature is enabled.
• OpenFGA: if you enable RBAC, the chart bootstraps the authorization model and creates the caipe-openfga store. There is no prior store to migrate from.
• Keycloak: the subchart is new. Enabling it initializes the caipe realm, the token-exchange clients, and optionally the upstream IdP broker.
• active_team JWT claim: no data migration; the claim is simply no longer issued.

One admin-run migration is registered for this release under Admin → Migrations (0.5.1). Run it if you adopt RBAC.

Verify​

kubectl get pods -n <namespace>
# Send a test chat message and confirm a normal response

Rollback​

helm rollback ai-platform-engineering <previous-revision> and restore your backed-up values file. Because every 0.5.0 addition is additive and disabled by default, a stock rollback needs no data changes.

0.4.0 restructures the platform around the AG-UI protocol and makes the Next.js gateway the single front door. Streaming, conversation storage, and authentication stop being per-client concerns: the web UI, Slack bot, and dynamic agents all speak one event model and share one conversation API.

Helm values for all three components are restructured. The upgrade guide below has the complete before/after mapping.

Features​

AG-UI protocol​

• Unified streaming: the AG-UI event model replaces legacy A2A streaming across dynamic agents, the Slack bot, and the UI. Stream events are persisted server-side.
• Stream encoder abstraction: AGUIStreamEncoder and CustomStreamEncoder behind a StreamEncoder ABC.
• Slack bot rewritten on AG-UI: typing indicators with live thoughts, todo-aware streaming, and subagent suppression.

Next.js gateway architecture​

• All traffic routes through the gateway: flat /api/v1/chat/ routes authenticated with X-User-Context. Dynamic agents no longer validate tokens or accept direct browser requests.
• Config ownership moved from dynamic agents to the UI: agent CRUD, MCP servers, and the models endpoint now live in local MongoDB.
• Bearer-token auth for service accounts, which is how the Slack bot authenticates.

Shared conversation API​

• Server-owned ID generation with an idempotency_key for cross-client dedup.
• A client_type enum (webui | slack) on every conversation; all ten Slack handlers migrated.
• Delta thread context: follow-ups embed only messages since last_processed_ts, eliminating quadratic checkpoint growth on long threads.
• PATCH /api/chat/conversations/[id]/metadata with MongoDB dot-notation $set.

Dynamic agents runtime​

• ClientContext and Jinja2 system-prompt rendering.
• New wait and agent_info tools; configurable middlewares.
• NAMESPACE_CONTEXT emitted only on change, UserContext made opaque, and RBAC removed from chat routes (the gateway owns it).
• A metrics endpoint.

UI​

• Streaming markdown with rAF throttling, block animations, and cursor improvements.
• Jinja2 syntax highlighting in the system-prompt editor.
• A turns collection, decoupling stream_events from messages.
• Admin: platform statistics with Slack integration, unified filters, user detail panels, and paginated conversations.
• An LLM model config page for adding and removing models through the UI.
• A new System theme that follows the OS setting.

Fixes​

• slack: add the escalation_policy field to the VictorOps escalation config; stop the humble-followup prompt from claiming knowledge of a reply the agent never made.
• admin: key feedback dedup on (permalink, user_email) rather than permalink alone, key the Slack feedback upsert on (message_id, user_id), and fix top-user linkage.

Breaking changes​

This release contains significant breaking Helm value changes. The upgrade guide below has the complete before/after mapping.

Known issues​

The Admin Statistics page under-reports Slack conversation counts until an InteractionTracker equivalent is re-implemented in the new AG-UI Slack bot.

Upgrade​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/caipe-io/charts/ai-platform-engineering \
  --version 0.4.0 \
  -f your-values.yaml

Upgrade guide: 0.3.x → 0.4.0​

1. CAIPE UI​

Merge env: into config:. All environment variables live in one flat map.

# Before (0.3.x)
caipe-ui:
  env:
    SKILLS_DIR: "/app/data/skills"
  config:
    SSO_ENABLED: "true"

# After (0.4.0)
caipe-ui:
  config:
    SKILLS_DIR: "/app/data/skills"
    SSO_ENABLED: "true"

Rename seedConfig: to appConfig: and drop enabled:. The ConfigMap is created automatically when any of models, mcp_servers, or agents is non-empty. The chart swaps SEED_CONFIG_PATH for APP_CONFIG_PATH on your behalf.

2. Dynamic agents​

• Merge env: into config:, then delete the env: block.
• Remove AUTH_ENABLED. For a local dev bypass use DEBUG: "true"; in production omit it.
• Remove OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_REQUIRED_ADMIN_GROUP, and CORS_ORIGINS. These belong to caipe-ui now, because dynamic agents never see a browser request.

3. Slack bot, the bulk of the work​

Named keys are replaced by a flat config: map plus a top-level existingSecret:.

The Secret contents do not change: SLACK_BOT_TOKEN, SLACK_APP_TOKEN, SLACK_SIGNING_SECRET, and optionally OAUTH2_CLIENT_SECRET.

Bot config file moved. CAIPE_BOT_CONFIG → SLACK_INTEGRATION_BOT_CONFIG (set by the chart), and /etc/caipe/caipe-bot-config.yaml → /etc/caipe/bot-config.yaml in a dedicated *-bot-config ConfigMap. If neither is present the bot starts with no channel configuration and logs a warning rather than crashing.

botConfig channels use a flat agents list. The bot rejects the old keys with an explicit error.

# Before
botConfig:
  C012345678:
    name: "#example-channel"
    ai_enabled: true
    qanda:
      enabled: true
      include_bots: { enabled: true, bot_list: ["example-bot"] }
    ai_alerts: { enabled: false }

# After
botConfig:
  C012345678:
    name: "#example-channel"
    agents:
      - agent_id: "example-agent"
        users:
          enabled: true
          listen: "mention"   # "mention" | "message" | "all"
          overthink: { enabled: false }
        bots:
          enabled: true
          listen: "message"
          bot_list: ["example-bot"]

4. The unified config pattern​

All components converge on the same shape:

component:
  config: {}           # flat env vars → ConfigMap → envFrom
  existingSecret: ""   # pre-existing Secret → envFrom secretRef
  externalSecrets:
    enabled: false
  appConfig: {}        # structured YAML file, caipe-ui only
  botConfig: {}        # structured YAML file, slack-bot only

config: is always flat. No nesting, no config.env: sub-keys.

5. Pre-upgrade checklist​

• Back up values: helm get values ai-platform-engineering -o yaml > values-backup.yaml
• caipe-ui: merge env: into config:, rename seedConfig → appConfig
• dynamic-agents: merge env:, drop AUTH_ENABLED, drop OIDC/CORS keys
• slack-bot: restructure named keys into config:, set existingSecret
• botConfig: replace qanda/ai_alerts/ai_enabled with the agents list
• helm diff upgrade before applying
• Deploy, then check pod logs for config-loading messages

Rollback​

helm rollback ai-platform-engineering <previous-revision> and restore the backed-up values file. These are configuration-only changes, so no data migration has to be undone. The 0.3.x chart expects the old structure and the old values file works as-is.