Release 1.1.0: Automation, Access, and Runtime Updates

Highlights

CAIPE 1.1 adds scheduled and webhook-triggered agent runs, Projects and hosted agentic applications, clearer RAG permissions, and opt-in DocumentDB support. It also moves the platform to Python 3.14 and Node.js 24, improves streaming and audit behavior, and hardens the Helm chart's workload defaults.

Fresh setup-caipe.sh installations enable the scheduler and autonomous-agent services by default. Operators can opt out when those capabilities are not needed.

What's New

Automation and scheduling

• Autonomous-agent workspace — Separate administration from team access, keep scheduled and autonomous conversations in dedicated history sections, and continue a specific webhook run from its conversation.
• Webhook controls — Add minimum schedule intervals, payload-size limits, bounded per-task and global queues, and concurrency limits for more predictable operation.
• Default onboarding — Fresh setup-caipe.sh installs enable scheduler and autonomous-agent services. Use ENABLE_SCHEDULER=false and/or ENABLE_AUTONOMOUS_AGENTS=false to opt out (#2681).

Projects and hosted applications

• Projects workspace — Add the Projects feature flag, navigation, and initial workspace surface (#2646, #2647, #2648).
• Hosted agentic applications — Add a configuration-driven hosted runtime and a Weather reference runtime for application examples.

Persistence and model operations

• DocumentDB support — Add an opt-in, MongoDB-wire-compatible DocumentDB provider for Compose, Helm, and setup-caipe.sh; MongoDB remains the default and switching providers does not migrate data automatically (#2418).
• LiteLLM model onboarding — Seed additional model definitions and upstream credentials from files or persisted Kubernetes objects, then inspect the configured model and alias map with setup-caipe.sh models (#2682).
• Python 3.14 runtime — Upgrade the platform runtime and document the pymilvus compatibility bound (#2722).

Runtime and administration

• Node.js 24 and js-yaml 5 — Move the UI, docs, repository tooling, and RBAC browser tests to Node.js 24 and update direct JavaScript consumers to js-yaml 5 (#2723).
• Consolidated administration — Group RBAC, chat, and self-check records under Audit, move access tools under Access Operations, and put developer tools under Account & Access (#2721).
• Slack bot maintenance — Split authorization, routing, conversations, actions, and streaming into focused modules with broader regression coverage. Slack-visible behavior is unchanged (#2596).

RAG and administration

• Explicit RAG access — Retire the special Platform RAG collection behavior, make agent access unrestricted by default, and support explicit collection or datasource scoping.
• Self-service bulk permissions — Move bulk owner and search-access editing to the Ingest page, preserving the same authorization and publication-approval rules as single-source edits.
• Config-driven sources — Seed datasources from application configuration and improve collection, agent-access, and feature documentation.

Bug Fixes

• Installer: use the CAIPE chart registry, validate chart versions, harden Kind and interactive input handling, and continue the core install when optional Langfuse tracing cannot be deployed (#2665, #2666, #2667).
• Installer: use the loopback-safe *.localtest.me default, preserve dynamic-agent authorization settings, and configure RAG ingestor OIDC and host aliases consistently (#2671, #2675, #2679, #2684).
• Local inference: keep in-cluster Ollama pointed at the real upstream model in LiteLLM mode and set the required LiteLLM embedding behavior (#2673, #2674).
• Agentic applications: preserve root mount paths and return bounded responses for large requests (#2656).
• Streaming: prevent recursive timeline updates during high-volume dynamic-agent streams (#2719).
• Audit: omit no-op policy reconciliations and show the reconciliation scope and relationship counts for changes and failures (#2720).
• UI and authorization: fail closed on application routes, preserve agent colors and resource names in navigation, and remove the unsafe AgentGateway repair action (#2654, #2696, #2698, #2699).
• RAG ingestion: return actionable errors for non-public or login-walled pages and validate datasource access when publishing collections.

Security

• setup-caipe.sh now requires explicit consent before privileged installation and host configuration operations. Failed or unattended consent reads deny sudo by default (#2668).
• Webhook payloads are bounded before parsing and per-task webhook secrets can use the existing AWS KMS envelope-encryption configuration. Plaintext webhook secrets should not be placed in chart values.
• Application routes fail closed when authorization context is missing, and the unsafe AgentGateway repair action has been removed.
• Workloads default to non-root, least-privilege security contexts where their images support them. Service-account token automount is disabled where Kubernetes API access is not required, and previously unbounded platform components now have CPU and memory defaults (#2469).

Breaking Changes

• RAG collection semantics: collection membership is no longer a substitute for datasource search access. Review agents that relied on the retired Platform RAG collection and set explicit datasource or collection scope where required.
• Fresh setup footprint: new setup-caipe.sh installs enable scheduler and autonomous-agent services by default. Disable them explicitly if the previous smaller footprint is required.
• Runtime compatibility: platform images now use Python 3.14. Custom extensions or images that depend on Python 3.13 should be tested and rebuilt before deployment.
• JavaScript tooling: the UI, docs, repository tooling, and RBAC browser tests require Node.js >=24.11.0 <25.
• Custom Helm resources: extraDeploy is replaced by extraDeployMap. Existing resources under extraDeploy are not rendered until they are migrated.
• Saved administration links: retired Security & Policy and Developer URLs do not redirect to their new locations.

Known Issues

• The 1.1.0 chart applies non-root defaults that prevent the stock Milvus containers and Keycloak initialization jobs from starting. This is corrected in 1.1.1 (#2749).
• The test-only @istanbuljs/load-nyc-config dependency retains a js-yaml 4 compatibility override. Direct consumers use js-yaml 5.
• The RAG server remains on pymilvus 2.6.9 for compatibility with langchain-milvus 0.3.3.

---

Upgrade Guide: 1.0.0 → 1.1.0

Overview

This release changes RAG authorization behavior, runtime requirements, and the custom resource values format. Migrate extraDeploy before upgrading, then review the RAG access model and optional scheduler and autonomous-agent limits. Fresh installer runs also have a larger default service footprint.

Helm Values Changes

Breaking Changes

extraDeploy is replaced by extraDeployMap. Give each resource a stable key:

# Before
extraDeploy:
  - apiVersion: v1
    kind: ConfigMap
    metadata:
      name: example-config

# After
extraDeployMap:
  example-config:
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: example-config

Update Helm flags from extraDeploy.<index> to extraDeployMap.<key>. Resources left under extraDeploy are not rendered.

New Optional Fields

Key	Default	Description
mongodb.provider	mongodb	Select MongoDB or the opt-in DocumentDB provider.
mongodb.documentdb.image.tag	pg17-0.113.0	Pinned DocumentDB Local image tag.
dynamic-agents.config.AUTHZ_SERVICE_URL	""	CAS endpoint for agent and Autonomous entitlement checks.
dynamic-agents.config.CAIPE_ORG_KEY	caipe	Organization key shared with the UI.
autonomous-agents.config.MINIMUM_SCHEDULE_INTERVAL_SECONDS	1800	Minimum gap between cron or interval fires.
autonomous-agents.config.WEBHOOK_MAX_PAYLOAD_BYTES	1048576	Maximum webhook payload size.
autonomous-agents.config.WEBHOOK_MAX_PENDING_*	bounded defaults	Per-task, per-owner, global, and payload queue bounds.
autonomous-agents.config.WEBHOOK_MAX_CONCURRENT_*	bounded defaults	Per-owner and global webhook concurrency bounds.
autonomous-agents.config.CREDENTIAL_KMS_CMK_ID	""	Optional AWS KMS CMK for envelope-encrypted task secrets.
autonomous-agents.config.CREDENTIAL_KMS_REGION	""	AWS region for the task-secret KMS key.
scheduler.limits.minimumScheduleIntervalSeconds	1800	Minimum permitted interval between recurring cron fires.

Deprecated / Removed Keys

Key	Replacement
extraDeploy	extraDeployMap

Upgrade Runbook

1. Back up deployment configuration

Save the current Helm values and take the normal persistence backup required by your operational policy. Provider changes do not migrate data automatically.

2. Migrate custom Helm resources

Replace extraDeploy with extraDeployMap using the keyed format above. Render the chart and confirm every custom resource is present before applying the upgrade.

If another deployment owns the Milvus service account, set:

rag-stack:
  milvus:
    serviceAccount:
      ragStackManaged: false

3. Update build runtimes

Use Python >=3.14,<3.15 for Python projects and Node.js >=24.11.0 <25 for the UI, docs, repository tooling, and RBAC browser tests. Recreate local environments and run clean dependency installs.

4. Review RAG access

Identify agents or datasources that relied on the retired Platform RAG collection. Assign explicit owner/search access to datasources and use an agent's collection or datasource restriction only where scoped access is intended.

5. Review optional values

Keep the defaults for a standard upgrade. If enabling DocumentDB, set mongodb.provider: documentdb and review the DocumentDB image, credentials, TLS, and persistence settings. If using per-task webhook secrets, configure the KMS fields and an appropriate workload identity; do not store plaintext secrets in values.yaml.

6. Update saved administration links

• RBAC Audit, Chat Audit, and Self Check move to /admin/security/audit.
• Access Explorer, Keycloak, and Migrations move to /admin/security/access-operations.
• Developer settings move to /settings/account-and-access.

7. Update the chart

helm upgrade ai-platform-engineering \
  oci://ghcr.io/caipe-io/charts/ai-platform-engineering \
  --version 1.1.0 \
  -f your-values.yaml

8. Verify

kubectl get pods -n <namespace>
kubectl get events -n <namespace> --sort-by=.lastTimestamp

Then verify chat, agent access, RAG search, scheduled runs, and webhook delivery if those features are enabled. Confirm that the scheduler and autonomous-agent services have the expected replica count and that webhook queue limits match the deployment's capacity.

Personal Impact Analysis

No values.yaml was supplied for a deployment-specific comparison. For the default Helm configuration, the main manual review items are the extraDeployMap migration, explicit RAG permissions, Python 3.14 and Node.js 24 compatibility, and the optional DocumentDB and KMS settings.

Full Values Diff

The substantive chart changes replace extraDeploy with extraDeployMap, add the optional MongoDB-compatible DocumentDB provider, add dynamic-agent authorization and organization settings, bound autonomous webhook and schedule work, and add KMS configuration for task secrets. The chart also adds workload security and resource defaults across platform components.