Portal v0.51.0 — Workspace sign-in, service accounts, and clearer pack availability

Workspace sign-in, service accounts, and clearer pack availability.

Sign in directly to the workspace you want to use. Each member has that workspace's email, MFA, and SSO settings; personal logins are gone. Apps such as Ryker use service accounts with their own keys and scoped access.

Console

• Create service accounts and API keys from their own Settings page.
• Change an email sign-in address from Profile after proving the new mailbox. Directory sync can update member emails and shows refused changes.
• See which actions are available and which runners reported an exact pack version and hash. Trust, connectivity, host readiness, and local admission remain separate; partial evidence is labeled as partial.
• Clearer forms, confirmations, filters, icons, emails, and setup instructions.

Runner and MCP Bridge

• Local admission is reported separately from the complete trusted pack descriptor. Locally disallowed actions remain refused.
• Plainer CLI failure messages and next steps.
• Recommended components: Runner v0.30.0 and MCP Bridge v0.17.0, published separately.

Security and packs

• Staff sign-in is independent of workspace sign-in. Identity, MFA, invitation, session, and erasure paths enforce tighter bounds and current authority.
• MCP and audit-export request caps per client address; refused SSO sign-ins appear in the workspace audit trail.
• Erlang/OTP 29.1.1, Mint 1.10.2, and the Debian PCRE2 fixes.
• A new SuperTokens pack for auth-core health, users, sessions, and roles, with gated mutations.
• EMQX missing-credential messages survive redaction. Prometheus deletion tests check a historical sample without racing the next scrape.

This release's source and artifacts are published independently of the hosted Portal rollout. Production deployment uses its reviewed saved Terraform plan and a manual Apply.