v0.11.0

The course returns to Python. Version 0.9 taught it in Go; that line is archived on the go branch with its v0.9.0 and v0.9.1 releases. A Go 0.10.0 was prepared there on 2026-09-11 but never published, so this release skips that number instead of reusing it. Every URL the Go site served redirects to the matching Python page.

This release is qualified by CI, Docs, Scan, Platform, and a GKE Vertex Gemini smoke, with an explicit Eval waiver: the redesigned model-backed suite exceeds the Eval job's 120-minute CPU-runner budget with qwen3:4b-instruct. No model-backed evaluation result is claimed for 0.11.0.

🚀 Features

• (course) Split the course into laptop Python development and advanced Kubernetes platform engineering, with cumulative exercises and separate completion contracts
• (workshop) Extend the workshop to eight steps with a prompt-injection guardrail and a learner-owned MCP server; start N scaffolds failing stubs and mise run lab -- status shows progress and the next command
• (agent) Make ADK with Gemini the default; retain explicit Ollama profiles, offline checks, and an optional LangGraph/A2A comparison. See provider migration instructions
• (agent) Upgrade to Google ADK 2.10, a2a-sdk 1.1.5, and the OpenAI SDK 3.x
• (mcp) Move the MCP server to MCP Python SDK 2.x (MCPServer), serving revisions 2025-11-25 and 2026-07-28 with read-only tool annotations
• (agent) Replace the hand-rolled model fallback with ADK's FallbackModel, which fails over only on retriable 429/5xx responses and restores the request between attempts
• (evals) Introduce MLflow after grader calibration, raise live trajectory acceptance to 80% plus critical cases, and attach feedback to the exact response trace
• (platform) Add Gemini gateway and local Kubernetes profiles

🐛 Bug Fixes

• (evals) Accept ADK 2.10's App-based evaluation runner while keeping evaluator evidence ahead of the application policy, which the previous adapter rejected before any model call
• (ci) Smoke the agent image, and start its release-preflight server, on the account-free provider profile, because the Gemini default correctly refuses to start without credentials
• (ci) Start the Eval judge path on the Ollama gateway profile through the new gateway:host:ollama:start task, which the Gemini default refused without a provider key
• (observability) Align the MLflow server with the 3.16.1 client, and the host Compose image tag with the one build:mlflow-image produces

🔒 Security

• (images) Refresh the Wolfi runtime base and its python-3.13 and libstdc++ pins past busybox, OpenSSL, and Python tarfile advisories, and move both build stages to Python 3.13.15

🔒 Gates

• (smoke) Prove both MCP protocol eras and the guarded-write denial through agentgateway in smoke:host
• (licenses) Drop the google-crc32c exception from the agent profiles now that 1.9.0 declares its license
• (release) Check out the qualified source before the publish job uses the repository's Buildx action, which no release had exercised since it was extracted
• (release) Accept an explicit eval_evidence=waiver:<reason> that replaces the Eval run for one release and is published in place of model lineage; an empty input keeps Eval required
• (deps) Scope the PYSEC-2026-3740 NLTK exception to the development, evaluation, and comparison audits; runtime and MLflow audits keep zero exceptions (record)