v5.3.0

Summary

Backward-compatible protected retrieval and explicit authentication recovery,
released as v5.3.0 on 2026-10-28.

Component

Component	Version	Release commit
Agent Landing Zone Orchestrator	v5.3.0	2c0579ef29a15bc862b150c1a6a8387f74de398e

This component release does not change peer-component or umbrella manifest pins.

Added

• Native per-user Search permissions. Protected retrieval forwards the
  delegated Search credential to native permission enforcement for indexed and
  remote knowledge sources, preserving conversation-upload scope without
  constructing manual group authorization or granting blob download access.
• Official hosted forwarded credentials. Both /responses and
  /invocations accept the explicit forwarded Search credential. Work IQ uses
  its separately registered application assertion; platform partition ids,
  request-body identity and Search tokens do not substitute for that assertion.
• Bounded downstream claims recovery. Search authentication challenges
  carry only canonical, validated claims through the existing failed-turn
  contract in both hosted adapters. Ambiguous or malformed challenges do not
  initiate claims recovery, and authentication failures are non-retryable.

Changed

• Request-local credential lifecycle. Immutable delegated credentials are
  isolated across concurrent requests and cleared after the turn. Token-bearing
  hosted Responses requests avoid SDK persistence and resilient replay;
  background execution is rejected, and credential headers are sanitized.
• Manual-only dev deployment. Updating develop no longer deploys to
  Azure. The dev deployment workflow runs only through an explicitly authorized
  manual dispatch.

Validation

• Exact-main post-adoption evidence binds fresh local validation
  to release commit 2c0579ef29a15bc862b150c1a6a8387f74de398e: 2,604 JUnit cases with zero failures/errors
  and four skips, 156 passing focused cases, and all five quality checks
  (lint, typing, architecture, exceptions, policy) passing with zero
  findings. All 92 broad handlers and 92 exact allowances are preserved.

• PR 413 CI
  passed all eight jobs on protected develop.
  Release PR CI
  passed tests, frontend build, lint and typing. Its older-main metadata
  findings remain recorded; the separately authorized one-time main adoption
  and exact protection restoration are documented in the evidence above.

• Offline behavior covers native Search permission requests, official hosted
  forwarded credentials, Work IQ provenance, safe downstream claims through
  both adapters, request-local cleanup, no replay and manual-only dev
  deployment. Azure deployment is not part of this release operation.

• Normal develop synchronization CI passed all eight jobs at 8c1ac1da36c4a5896ea4ba3bfe52687d187e1d16: 2,604 JUnit cases, zero failures/errors, four skips; frontend build, all five quality checks and aggregate passed. Its runtime and protected metadata match the published main commit.

Documentation and compatibility

The service README documents manual-only dev deployment. Published product
documentation and the coordinated peer-component combination are maintained
separately by the Agent Landing Zone release owner.

Recovery

The preceding published orchestrator release is
v5.2.2,
at 243e61191a7fdc5f1cf92f2ac47b779d58be3fa3. Re-select that artifact through
the authorized deployment process if rollback is needed. This release adds no
data migration; do not move a published tag.

Develop synchronization

PR #415 merged normally after all required CI passed. Develop is synchronized at 3a0945a1b514ddfbb0358d7dd2aa144b16bc02e0, with VERSION 5.3.0 and exactly one empty [Unreleased] section. Main/tag remain at 2c0579ef29a15bc862b150c1a6a8387f74de398e.