Release 0.5.21

What's Changed

• fix(mcp): GitLab credential probe fallback and SA tool picker fixes by @cisco-erilutz in #2003

Full Changelog: 0.5.20...0.5.21

Release 0.5.20

What's Changed

• docs(releases): add missing release blogs for 0.5.11–0.5.18 by @sriaradhyula in #1977
• fix(mcp): route Confluence provider tokens through AgentGateway by @sriaradhyula in #1976
• fix(ui,chart): handle Kubernetes tcp:// port env vars and wire platform health probe hosts by @sriaradhyula in #1983
• feat(mcp): default servers to streamable HTTP by @sriaradhyula in #1991
• feat(admin): improve health and integration diagnostics by @sriaradhyula in #1992
• feat(admin,mcp): self-service integration panel modes, bulk onboarding, and credential relink by @sriaradhyula in #1985
• fix(caipe-ui): replace per-pod token Map with MongoDB-backed L1+L2 store by @sriaradhyula in #1987
• fix(docker-compose): Update to wire openfga into first install ui by @sriaradhyula in #1907

Full Changelog: 0.5.19...0.5.20

Release 0.5.19

What's Changed

• fix(charts): default AUDIT_SERVICE_URL to release-scoped audit-service by @kevkantes in #1974
• fix(identity-sync): remove proactive Okta credential health check on page load by @kevkantes in #1975

Full Changelog: 0.5.18...0.5.19

Release 0.5.18

What's Changed

• feat(ui): remove NPS score page, survey, and settings by @kevkantes in #1919
• fix(rbac): replace unsupported $facet in team members pagination for DocumentDB by @kevkantes in #1924
• fix(setup-caipe): Missing AGENTGATEWAY_TARGETS_TOKEN by @sibuthomasmathew in #1914
• feat(rag): add S3 document ingestor by @dabcoder in #1875
• fix(ui): handle Kubernetes tcp:// port env vars in platform health probes by @sriaradhyula in #1927
• chore(repo): remove beads issue tracking by @sriaradhyula in #1945
• fix: credential team sharing authz by @MarwaOuledElHadjAli in #1943
• docs: fix typo 'seperate' -> 'separate' in two CHANGELOG files by @meichuanyi in #1940
• feat(audit): add lightweight audit service runtime by @sriaradhyula in #1946
• feat(github): use gh cli-backed file contents tool by @artdroz in #1721
• fix(ci): satisfy zizmor security scan by @sriaradhyula in #1954
• refactor(audit): route producers through audit service by @sriaradhyula in #1947
• fix(deps): resolve dependabot security alerts by @sriaradhyula in #1872
• fix(helm): keep MCP servers while disabling A2A agents by @sriaradhyula in #1925
• feat(audit): add audit-service read UI by @sriaradhyula in #1948
• fix(security): remove agntcy slim sdk usage by @sriaradhyula in #1955
• perf(ui): cache health and RBAC gate checks by @sriaradhyula in #1949
• fix(deps): update torch for rag embeddings by @sriaradhyula in #1962
• fix(rbac): address admin and chat regressions by @sriaradhyula in #1950
• docs: document AGENTGATEWAY_TARGETS_TOKEN in .env.example by @sriaradhyula in #1938
• docs(rag): clarify health proxy auth behavior by @sriaradhyula in #1963
• docs(blog): What's New in 0.5 — end-user feature overview by @sriaradhyula in #1918
• docs(audit): document audit performance benchmarks by @sriaradhyula in #1951
• fix(compose): use canonical caipe-ui image tag by @sriaradhyula in #1966
• fix(mcp): promote custom servers to agentgateway routes by @sriaradhyula in #1926
• ci(rag): build only changed RAG components instead of all three by @dabcoder in #1970
• feat(credentials): integrate secrets UX with AgentGateway MCP routing by @sriaradhyula in #1967
• fix(workflows): allow non-admins to create and save workflows by @sriaradhyula in #1973

Full Changelog: 0.5.17...0.5.18

Release 0.5.17

What's Changed

• fix(docker-compose): align docker-compose files by @sriaradhyula in #1886
• fix(slack): remove ephemeral identity verification error message by @kevkantes in #1902
• feat(rbac): add background scheduler for IdP directory sync by @kevkantes in #1901
• fix(workflows): portal visibility dropdown and fix runs-to-workflows nav by @kevkantes in #1900
• docs: fix typo 'seperate' -> 'separate' in CHANGELOG by @meichuanyi in #1898
• fix(rbac): unblock superadmin conversations and tool grants by @sriaradhyula in #1904
• chore(compose): align oss all-in-one stack by @sriaradhyula in #1887
• fix(ui): prefer exact changelog release prompts by @sriaradhyula in #1908
• ci(agents): make a2a image builds opt-in by @sriaradhyula in #1905
• add opt-out checkbox to suppress feedback regeneration by @jasonc3-sys in #1793
• feat(ui): paginate admin teams/members/IdP-sync history + self-heal OpenFGA drift by @kevkantes in #1916
• feat(ui): add platform health probes by @sriaradhyula in #1909

New Contributors

• @meichuanyi made their first contribution in #1898
• @jasonc3-sys made their first contribution in #1793

Full Changelog: 0.5.16...0.5.17

Release 0.5.16

What's Changed

• fix(slack): fix loguru format strings and remove noisy oauth cache debug log by @kevkantes in #1879
• fix(admin): allow unlinked service account tool grants by @sriaradhyula in #1880
• fix(dynamic-agents): surface CAS 4xx as its real status instead of collapsing to 503 by @kevkantes in #1878
• fix: unlinked service account catalog grants by @sriaradhyula in #1870
• fix(slack): let team members manage shared integrations by @sriaradhyula in #1883
• fix(rbac): expand MCP wildcard grants safely by @subbaksh in #1889
• fix(rbac): upsert bootstrap idp-sync rule by ID to fix stale provider_id by @kevkantes in #1881
• perf(admin): lazy-load tab data on first visit; parallelise stats queries by @kevkantes in #1882
• test(rbac): add identity sync browser regression by @sriaradhyula in #1892
• feat(rbac): expose policy manifest downloads by @sriaradhyula in #1891
• fix(ci): harden release workflows and add actions scan by @sriaradhyula in #1851
• fix(chat): prevent auto-create on login race and unify permanent delete logic by @kevkantes in #1896
• feat(admin): scope teams, users, stats, and feedback for non-admin users by @kevkantes in #1894
• fix(rbac): treat team managers as owner-team members by @sriaradhyula in #1895
• fix(agent-editor): simplify owner team transfer by @subbaksh in #1893

Full Changelog: 0.5.15...0.5.16

Release 0.5.15

What's Changed

• fix(admin): default to Settings tab and rename Default Agent to General by @kevkantes in #1862
• fix(admin): clarify unlinked access description for admins by @kevkantes in #1861
• test(service-accounts): add token passthrough Playwright coverage by @sriaradhyula in #1844
• fix(chart): duplicate app.kubernetes.io/name by @nunoferna in #1845
• fix(ui): stabilize service account RBAC e2e by @sriaradhyula in #1855
• test(ui): add admin settings e2e regression by @sriaradhyula in #1869
• chore(deps): Bump the npm_and_yarn group across 2 directories with 4 updates by @dependabot[bot] in #1858
• fix: make AgentGateway provider-token passthrough declarative by @sriaradhyula in #1859
• fix(ui): soften required-field treatment on agent create form by @kevkantes in #1865
• fix(rbac): simplify owner-team ownership UI and drop grant-preview copy by @kevkantes in #1873
• feat(admin): sync admin nested sub-tabs to the subtab URL param by @kevkantes in #1867
• chore(slack-bot): remove SLACK_INTEGRATION_SILENCE_ENV flag by @kevkantes in #1874
• fix(ui): import Button in team ownership fields by @sriaradhyula in #1876
• fix(slack): send service_account subject to CAS for SA-run channels; clarify route copy by @kevkantes in #1877

New Contributors

• @nunoferna made their first contribution in #1845

Full Changelog: 0.5.14...0.5.15

---

⚠️ CI BUILD FAILURE ⚠️

One or more CI builds failed for this release. Please investigate and either:

1. Fix the issues and re-run the failed workflows
2. Delete this draft release and create a new one

Updated: 2026-06-16 17:41:31 UTC

Release 0.5.14

What's Changed

• fix(setup): production-ready setup-caipe.sh — prereqs, domain/TLS, Keycloak, dynamic agents by @sriaradhyula in #1823
• fix(validate): Remove weather-agent validation by @sibuthomasmathew in #1790
• [codex] feat(agentgateway): render config bridge targets from BFF by @sriaradhyula in #1852
• fix(jira-mcp): add assign_issue tool using dedicated assignee endpoint by @kevkantes in #1846
• fix(rag): sync uv lock metadata by @sriaradhyula in #1856

Full Changelog: 0.5.13...0.5.14

---

⚠️ CI BUILD FAILURE ⚠️

One or more CI builds failed for this release. Please investigate and either:

1. Fix the issues and re-run the failed workflows
2. Delete this draft release and create a new one

Updated: 2026-06-15 19:34:13 UTC

Release 0.5.13

What's Changed

• fix(docs): repair MDX breakage in FGA module-api contract page by @sriaradhyula in #1837
• fix(rbac): repair MCP OpenFGA drift and local file ingestion by @sriaradhyula in #1838
• fix(webex): replace static agent route mappings by @subbaksh in #1820
• feat(agentgateway): enable agentgateway and github-mcp-server by default in 0.5.x by @sriaradhyula in #1762
• fix(chart): make GitHub MCP server opt-in by @sriaradhyula in #1839
• feat(rbac): Service Accounts — team-owned bot identities + caller-keyed tool authz by @cisco-erilutz in #1780
• fix(ui): keep service account team picker searchable by @sriaradhyula in #1840
• fix(rbac): set AFFIRMATIVE on bot's own token-exchange permission during reconciliation by @sriaradhyula in #1787
• feat(rbac): combine AD group admins with super-admins team access by @sriaradhyula in #1792
• fix(dynamic-agents): bump vulnerable dependencies by @sriaradhyula in #1841
• feat(slack): Run As identity (user / service account) + unlinked-user fallback for Slack routing by @cisco-erilutz in #1784
• fix(ui): prevent unlinked access modal control bleed by @sriaradhyula in #1842
• feat(service-accounts): credential passthrough (provider tokens) for service accounts by @cisco-erilutz in #1796
• fix(ui): refresh mcp server list by @sriaradhyula in #1816
• refactor(slack): route all Slack-bot Keycloak access through the BFF; drop direct admin creds by @kevkantes in #1800

Full Changelog: 0.5.12...0.5.13

Release 0.5.12

What's Changed

• docs(releases): backfill release notes and published-versions for 0.5.5–0.5.10 by @sriaradhyula in #1815
• fix(setup): auto-install missing prereqs and gate sudo on user consent by @sriaradhyula in #1821
• fix(setup): auto-install kind during prerequisites check by @sriaradhyula in #1822
• chore(deps): resolve dependabot alerts by @sriaradhyula in #1818
• feat(authz): Centralized Authorization Service (CAS) — core, HTTP API, admin UI by @sriaradhyula in #1770
• feat(workflows): workflow RBAC on CAS (re-implements #1751) by @sriaradhyula in #1772
• fix(dynamic-agents): restore workflow settings dropped by 020dc93 by @sriaradhyula in #1766
• test(rbac): add admin browser regression by @sriaradhyula in #1829
• chore(agentgateway): structured authz logging in config bridge by @sriaradhyula in #1825
• fix(supervisor): eager MCP init via A2A lifespan hook by @sriaradhyula in #1830
• feat(ui): ephemeral file preview in agents and workflows by @sriaradhyula in #1831
• fix(ui): MCP OpenFGA reconcile, CAS-backed authz, and team sharing by @sriaradhyula in #1819

Full Changelog: 0.5.11...0.5.12