Release 0.6.0: New UI and Knowledge Base Access Control

Highlights

A new UI. Navigation and settings were unified into a single application shell: one settings center instead of scattered per-area config, a coherent workspace nav, and consistent breadcrumbs, deep links, and pickers throughout. Most screens you touch daily have moved or been rebuilt.

Knowledge base access control. RAG knowledge bases are now fully governed. Ingestion sources are managed from the UI instead of YAML, gated by their own RBAC relations, and authorization is enforced at query time on the live agent tool path, so a search only ever sees datasources the caller can read.

Underneath both: the legacy supervisor and standalone A2A agents are gone, and the Centralized Authorization Service is now the single decision point for every resource.

Features

A new application UI

• Unified settings center: one place for personal and platform settings, replacing config spread across separate admin areas.
• Unified workspace navigation: the workspace and settings shells share one navigation model, with dynamic nav overflow and a compact right-hand cluster.
• Consistent wayfinding: breadcrumbs (including workflows), admin filter deep links, and admin sub-tab state synced to the URL, so any view can be linked and restored.
• Animated header brand, navigation, and shared tab selectors; the sidebar no longer flashes on collapse.
• Searchable team pickers, expandable config-driven agent panels, editable chat titles, and ephemeral file previews in agents and workflows.
• Release notes moved to a user-scoped view under General.
• The documentation site moved to the caipe.io root and is now responsive with a mobile navigation menu.

Knowledge base access control

• Ingestion sources in the UI: create, edit, and manage RAG ingestion source configs (Slack, Confluence, Jira, web URL, Webex) without editing YAML, gated by ingestion_source RBAC relations. The standalone tab was later folded into Data Sources.
• Query-time RBAC on the live agent path: search, fetch, jobs, and docs are scoped to the caller's accessible datasources, with an org-admin bypass.
• Agent to datasource binding: an agent's search tool can be pinned to a subset of its owning team's visible datasources, intersected with the caller's access at runtime.
• Ingestor service accounts: ingestor pods authenticate as recognized service accounts (RAG_INGESTOR_SERVICE_ACCOUNTS), list only their allowed source types, and report status through a scoped PATCH endpoint, with no per-resource grants or general write access.
• Adopt config-driven sources: an admin action migrates Helm/YAML-seeded ingestion sources into the database as permanent, team-owned records.
• OpenFGA is the source of truth for KB grants: team_kb_ownership dropped; knowledge bases are shared with teams through an OpenFGA reconciler.
• Public datasources, org-level ingest and search capabilities with an FGA coverage guarantee, per-tab authorization gates and empty states in the Knowledge sidebar, and the Graph tab gated on any readable KB.
• New ingestors: S3 documents and local file upload. Opt-in bypass for SSRF protection on web ingestion.

Authorization

• Centralized Authorization Service (CAS): core, HTTP API, and admin UI. Every permission check for agents, workflows, knowledge bases, and MCP tools flows through one service.
• Service accounts: team-owned bot identities with caller-keyed tool authorization and credential passthrough.
• Access explorer and RBAC self-check to diagnose why a principal can or cannot reach a resource; policy manifest downloads.
• OpenFGA made the source of truth for team resource access, with a decluttered team UI and split Agents/MCPs tabs.
• Archived teams grant no access, with self-check repair. Unified ownership transfer across agents, knowledge bases, and MCP tools.
• Okta and LDAP directory sync: SDK-based sync with JIT provisioning, an IdP-sync admin UI, a background sync scheduler, per-stage progress logging, user/team upserts, and OIDC_GROUP_INCLUDELIST / OIDC_GROUP_EXCLUDELIST for AD group filtering.
• Non-admin scoping for admin teams, users, stats, and feedback; admin insights scoped to owned agents with an agent filter.

Retiring the legacy runtime

• The legacy supervisor model and standalone A2A agents are removed. Dynamic agents are the only routing layer.
• A legacy_runtime_cleanup_v1 migration drops orphaned checkpoint collections and unsets metadata.agent_version / metadata.model_used on conversations and a2a_events on messages. See Upgrade; it is destructive and optional.
• Admin Insights, Metrics, and Health were rebuilt on dynamic-agent telemetry (da_turns_total, da_turn_duration_seconds, da_llm_calls_total, da_tool_calls_total, da_active_requests). Chat now persists agent_name and a measured latency_ms, so Top Agents and response-time charts populate.
• The Autonomous UI was restored on the dynamic-agents architecture.

Scheduled agents

• mcp-scheduler exposes create, list, update, and delete for scheduled jobs, each owned by its creator.
• Kubernetes CronJob backend; the caipe-cron-runner pod fires once per interval and exits.
• The JWT is relayed to the scheduler service, which validates it and derives owner_sub, so enforcement matches an interactive run. Admins can change the default schedule-editor agent from the UI.

Multimodal chat

• Attach files to chat messages as multimodal model input, shown inline in the transcript.
• Slack attachments forwarded as multimodal input.
• Per-model input capabilities declared up front, degrading cleanly and naming the model in the skip warning; input attachments capped.
• Attachment bytes offloaded to object storage, with a dropped-input-files panel in metrics and a multimodal regression harness.

Platform operations

• Audit service: a lightweight runtime plus a read UI, S3 retention controls, storage usage visibility, configurable verbosity, and connector diagnostics.
• Platform health: probes refactored to capabilities with profile-aware integration status, a dynamic-agents probe, and a steady-state operations dashboard.
• Remote MCP catalog with OAuth credential connectors; MCP servers default to streamable HTTP; mcpSecrets added as the canonical name for agentSecrets.
• Keycloak: configurable SSO session lifetime (7 day idle, 14 day max), PostgreSQL support, a caipe-cli public client for local dev tokens, and migration health surfaces.
• Object storage resolved from a shared global.storage.s3 block.
• Multiple Webex bots with 1:1 support, per-surface default agents, and a Webex Meetings MCP server.
• CI moved to native per-architecture image builds; third-party MCP images pinned.

Fixes

Roughly a thousand commits between 0.5.0 and 0.6.0 went to reliability. The concentrations:

• UI and admin: the largest single group, tracking the navigation rework and the screens rebuilt around it.
• Authorization: grant correctness, team membership performance, OpenFGA batch-check limits, stale principal cleanup, and service-account grant preservation across visibility changes.
• Identity: Okta sync throttling and reliability, auto-create team sync, Keycloak 26.x robustness and upgrade reconciliation, federated identity, and the SSO idle-timeout fix.
• Chat and dynamic agents: deprecated-agent recovery, private chat access, subagent HITL resume, tool result invariants, immutable prompt rendering, and failed conversation deletes no longer reappearing.
• Slack and Webex: file-attachment routing, agent pagination, name parsing, ephemeral nudges, Workflow Builder mentions, and space navigation.
• Security: SSRF protections in web ingestors, NoSQL injection fixes in the admin API, catalog credential boundaries, skills zip import ownership, and dependency vulnerability sweeps.

Breaking changes

No breaking Helm values changes in 0.6.0 itself. Ten changes landed between 0.5.0 and 0.6.0 that need review:

Version	Change	Who is affected
0.5.3	AgentGateway routing defaults to static (CRD-free)	Set global.agentgateway.routingMode: gateway-api if you rely on Gateway API CRs
0.5.8	Catalog API key digests moved from SHA-256 to HMAC-SHA256	Keys minted before 0.5.8 fail verification, so re-mint them
0.5.10	Slack slash-command prefix follows APP_NAME	Only if automations hardcode /caipe and you changed APP_NAME
0.5.17	NPS survey and Admin → NPS tab removed	nps.enabled is ignored; drop it from values
0.5.22	Legacy supervisor and standalone A2A agents removed	Drop supervisor.* / a2a-agents.* values
0.5.24	agentSecrets deprecated in favour of mcpSecrets	Still functional; migrate for forward compatibility
0.5.49	New channel onboardings default to mention-only	Existing channels unaffected; set listen: "all" to opt out
0.5.55	Webex bot defaults move from env vars to a structured bots array	Only tags.webex-bot: true deployments
0.5.62	agentgateway.authz.restrictedMcpServers defaults to []	Re-add entries if you deliberately restricted a server
0.6.0	The Tokens Used metric is gone from Insights, /api/users/me/insights, and /api/users/me/stats	Anything scraping those responses for a token count

Upgrade

helm upgrade ai-platform-engineering \
  oci://ghcr.io/caipe-io/charts/ai-platform-engineering \
  --version 0.6.0 \
  -f your-values.yaml

Values keys to drop

These are no-ops and can be removed:

• any supervisor.* config and a2a-agents.* standalone agent entries
• nps.enabled
• AGENT_GATEWAY_MCP_SERVER_IDS, since AgentGateway routes by profile now

If you run the Webex bot, restructure its defaults into the bots array (0.5.55). If you deliberately restricted an MCP server, re-add it to restrictedMcpServers (0.5.62).

Data migrations

Two admin-run migrations apply, under Admin → Migrations:

• 0.5.8: catalog API key rehash. Required if you use catalog API keys; clients need newly minted keys afterwards.
• 0.6.0: legacy runtime cleanup. Destructive and optional. It preserves checkpoints_conversation and workflow_checkpoints (with their writes collections) and drops every other checkpoints_* / checkpoint_writes_* collection, which are orphans from the supervisor era with no reader left. It also unsets metadata.agent_version and metadata.model_used on conversations and a2a_events on messages.

Nothing in 0.6.0 reads the data the 0.6.0 migration removes, so the upgrade is safe without running it. Run it when you want the storage back, and take a MongoDB backup first, because it is not reversible.

Enabling RBAC for the first time bootstraps the OpenFGA authorization model and backfills tuples on first run.

Verify

kubectl get pods -n <namespace>
# Send a test chat message, then check Admin → Insights shows the agent name and latency