Portal v0.36.0 — Staged runbooks and hardened enterprise identity

Staged runbooks can now carry a production operation from declared inputs to a bounded, reviewable result, while enterprise identity fails closed across OIDC, SCIM, sessions, and audit attribution.

Runbooks

• Typed inputs bind once, stages run sequentially or in parallel against selected runner groups, and steps can extract named outputs, test success conditions, and wait within explicit bounds.
• One approval freezes the complete execution plan before work begins. Canonical JSON uses the same definition shape as the console and MCP, and execution pages show attempts, outputs, waits, and terminal causes in order.

Security and identity

• OIDC discovery, JWKS refresh, and redirects share one bounded address policy that rechecks the response actually received; changing an issuer clears credentials tied to the old one.
• SCIM bodies are bounded before authentication, group patches apply atomically in wire order, and disabling a connection retires the sessions and pending identity links it vouched for.
• Runs and approvals resolve a person's name through membership in that action's account, preventing cross-workspace profile leakage into the audit surface.

MCP and packs

• The bridge and portal adopt the 2026-07-28 MCP routing headers and dual-era endpoint, including OAuth Client ID Metadata Documents.
• The catalog now carries 91 packs and 1,386 actions, with new bounded diagnostics for GCP, Pure FlashArray, Terraform, Nomad, OIDC/JWKS, nftables, TCP, and Docker Compose.
• Missing source commands and HTTP error responses now fail pack actions instead of letting a downstream pipe or successful transport report an empty success.

Documentation

• Authentication and directory documentation now provides one operator path across SSO, SCIM, account access, and the Okta, Entra, JumpCloud, Google Workspace, Keycloak, and generic OIDC guides.