Portal v0.50.0 — Workspace-owned members and per-workspace billing

Each workspace now owns its members, and each workspace manages only its own billing.

Workspace members

• SSO, SCIM, and invitations create a member of that workspace instead of a personal login, so one customer's identity provider or directory can no longer reach a person's other workspaces.
• A person who wants one login across workspaces links it by proving the mailbox. A member removed and invited back at the same address moves their SSO identity to the new seat with a fresh SSO proof.
• Audit, approvals, runbooks, enrollment keys, and API keys name the exact workspace member. SIEM note: events by people now carry actor_kind: "membership" and the member's id; older rows keep "user".
• Every browser signs in once more after this release. API keys, OAuth connections, and MCP bridges keep working.

Billing

• The billing page updates the payment method, cancels at the end of the paid period, or keeps a cancelled subscription, for this workspace's subscription only.
• The Paddle customer portal button is gone, because that portal shows every subscription the payer holds. Payers reach Paddle's own pages from any receipt email.
• Linking a Paddle account another workspace already uses takes a code sent to the billing email.

Security

• The staff console requires the staff member's own second factor; member MFA resets are limited to a person in only that workspace; removing or demoting a member withdraws their pending approve votes; a queued run is refused when its initiator lost access.
• Secret-bearing sign-in and invitation URLs are no longer logged, request size caps follow the route the router matches, and a production release refuses to boot without a mail provider.
• The runner is non-dumpable and refuses its own /proc entry as an action argument.

MCP

• New cancel_run tool: an agent withdraws a run it started while it waits for approval.
• Waits default to 45 seconds, inside Slack's 60-second tool limit; replies stay inside their published schemas.
• emisar-mcp connect works with an existing Goose config, and the Windows installer follows GitHub's release-asset redirects.

Packs

• New EMQX pack: broker, client, subscription, listener, rule, and retained-message reads, plus eight writes that need approval under the default policy.
• Retired versions whose tiers let an action skip approval: docker, mysql, nginx, nomad, pfsense, postgres, and victorialogs.

Binaries for this release are Runner v0.29.0 and MCP Bridge v0.16.0. Verification steps are on the Trust page.