Release v0.2.0 · MLOps-Courses/agentops-open-course

Added a bounded read-only plan → investigate → evidence_review → recommend workflow, a least-privilege coordinator path, and model-backed evaluation for the planning and reflection loop.
Added explicit learner, platform, and maintainer install tiers plus stable aggregate CI and security-scan jobs that import-smoke every built image.
Added explicit accessibility and single-maintainer governance contracts for diagrams, keyboard/contrast expectations, review authority, and the path to maintainership.
Added a repository-wide TODO.md that defines the OSS, course, runtime, security, accessibility, maintenance, and release evidence required before v1.0.0.
Added project-neutral GKE render and deployment helpers, a balanced persistent-disk storage class, and output-driven Workload Identity manifests for the optional GCP lab.

Reworked the learning path so setup stays read-only, the first model interaction happens in Chapter 2, Kubernetes deployment precedes inspection, and the capstone is the primary finish before optional project maintenance.
Unified ADK discovery behind one validated AGENT_ENTRYPOINT=agent|workflow|coordinator package boundary while constructing only the selected composition.
Made promotion a truthful offline preflight by default, with model-backed evidence required before it prints deploy and rollback commands.
Bound scheduled model evidence to one provider, immutable prompt, model digest, evaluation contract, source revision, serving context, and sampling configuration while reusing the exact MLflow transcript for required cost and groundedness verdicts.
Made skill loading and both guarded-action confirmation trajectories strict named Qwen gates, so an aggregate pass rate cannot hide a failed safety contract.
Made the optional GCP module and GKE delivery path variable-driven, quota-aware, and cheaper by default while preserving explicit plan, verification, and teardown boundaries.

Repaired the locked ADK 2.4 terminal entrypoint, which was shadowed by agent.py, and added real CLI, wheel, and container discovery coverage.
Wrapped adk eval so metric failures cannot exit successfully; each trajectory case is strict and the measured local-model baseline uses an explicit aggregate case-pass floor.
Strengthened host and load smoke tests to require successful A2A completion, made OpenTelemetry provider setup idempotent, preserved evidence across workflow nodes, and required fresh reads after approved actions.
Made approved-write replays idempotent in SQLite, bounded model-controlled runbook retrieval, serialized per-session token accounting, and protected the optional circuit-breaker registry and generation-bound transitions across worker threads.

0.1.1 - 2026-07-24

Source-synchronized course excerpts, staged prerequisite doctors, and a scored capstone for adapting the completed reference platform.
A deterministic host smoke that proves the fake-model, MCP, A2A, CORS, readiness, host/container metrics, and cleanup contracts without a provider account.
Machine-verifiable repository, Python dependency, and container-image license gates.
A real streamed A2A approval round trip plus full-conversation MLflow scoring for exact write policy, response facts, terminal confirmation pauses, and isolated state.
Initial AgentOps course structure, Python Ops Copilot, local dataset, documentation site, and infrastructure examples.
Local Qwen3/Ollama and optional GKE/Vertex learning paths behind one agentgateway contract.
Persistent A2A sessions, immutable seed data, disposable runtime state, and append-only action auditing.
Self-hosted MLflow and OpenTelemetry observability for local and Kubernetes labs.
Community health files, contribution templates, and end-to-end verification checkpoints.
Release workflow publishing Trivy-scanned, cosign-signed, SBOM-attested images to GHCR on version tags, with in-workflow verification.
Self-hosted Renovate dependency updates on a weekly schedule and a documented upgrade playbook for coordinated pins.

Local Qwen3/Ollama is now the default first model path; Gemini, Vertex AI, GKE, and hosted publication remain explicit optional integrations.
Model-provider selection is independent from direct-versus-gateway topology, and live dotenv values are scoped away from offline gates.
The Python runtime dependency set no longer installs the unused cloud-database extra.
SQLite backups now publish atomically after complete integrity checks, and restore paths reject incomplete snapshots.
Scheduled evaluation installs the exact checksum-verified Ollama release asset instead of a removed archive path.
Required Helm plugin installation and both Dockerfile frontends now use immutable reviewed source/digest pins; helm-diff platform assets are checksum-verified.
Release metadata and the pushed v tag must agree before any image build or publication.
Course chapters distinguish open-source software from optional proprietary model and cloud substrates.
Gateway, platform, and observability material tracks runnable repository resources.

Guarded actions now fail closed without confirmed, attributable approval and a bounded rationale; persistence redacts PII/credentials and reads current context inside the write transaction.
Host gateway tasks use a digest-pinned, non-root, loopback-published container with a bridge-only relay for loopback upstreams.
Kubernetes denies direct A2A ingress except from agentgateway, mounts shared state read-only in read/backup workloads, and disables unused service-account tokens.
OTLP log export uses one trace-correlated handler that redacts and bounds copied records without mutating local console logs.
Untrusted tool-output sanitization is enabled by default.
Release publishing now pushes and signs the exact local image that passed the pre-push scan instead of rebuilding it.