NotiOps v1.0.11

NotiOps v1.0.11

One-click deployment grows up. v1.0.10 shipped the CloudFormation path with the
web chat only; this release makes the two capabilities that used to require a
local ./setup.sh run — deep root-cause investigation and multi-account
inspection — options you tick in the CloudFormation console. The default model
also changes to Grok 4.6, and three "deployed but confusing" failure modes now
say what is actually wrong. Existing deployments upgrade in place; both paths are
still supported and can be run one after the other on the same account.

⚠️ Sample/reference code, not a production-ready product. Review it with your
own security, legal, and compliance teams before deploying into an AWS account.

Features

• Deep investigation is created for you, and it is on by default. The stack
  now creates an AWS DevOps Agent Agent Space and wires the agent to it, so
  "investigate the root cause of this" works right after
  CREATE_COMPLETE instead of requiring a console visit and a manual space id.
  Controlled by the new EnableDeepInvestigation parameter (default Yes).

  • Billed per agent-second only while an investigation runs; an idle Agent Space
    costs nothing. Set it to No if you would rather not create the resource.
  • AWS DevOps Agent is not available in every Region yet. In an unsupported
    Region the space is silently skipped — the stack still reaches
    CREATE_COMPLETE and everything else works, rather than failing the whole
    deployment over an optional feature. Supported at the time of this release:
    us-east-1, us-west-2, ca-central-1, sa-east-1, ap-south-1,
    ap-southeast-1, ap-southeast-2, ap-northeast-1, eu-central-1,
    eu-west-1, eu-west-2.
  • The new DeepInvestigationStatus stack output always tells you which of the
    three states you are in — enabled, skipped because of the Region, or off
    because you chose No. "The toggle is missing from the UI" and "this Region
    cannot do it" look identical from the chat window, which is why the status is
    an unconditional output.

• Multi-account inspection from the template. The new DeployMode parameter
  (SingleAccount | MultiAccount) plus OrganizationId lets one stack cover
  an AWS Organization. In MultiAccount the stack creates the member-onboarding
  StackSets, and you then onboard accounts one click at a time from the admin
  panel.

  • MultiAccount requires that you deploy into the organization management
    account (or a CloudFormation StackSets delegated administrator) and that
    you fill in OrganizationId — it scopes the cross-account trust policies to
    your organization via aws:PrincipalOrgID. Leaving the id blank is not
    merely inconvenient: multi-account stays off, and the DeployModeStatus
    output says so.
  • Deleting the stack does not delete those StackSets or the roles they
    created in member accounts. DeployModeStatus states this too — deleting a
    stack and silently leaving IAM roles behind in other accounts is not
    something to learn later.

• Default model is now Grok 4.6 (global.xai.grok-4.6), replacing Claude
  Sonnet 5. This is the catalogue default introduced in v1.0.9, so it is one seed
  value, applied consistently: interactive chat, the non-interactive backend
  tasks (notification summaries and the like), and the documentation now all name
  the same model. Existing deployments are unaffected unless you re-seed —
  setup.sh will not overwrite a catalogue you have already customized — and any
  operator can pick a different default in Admin → Models without a redeploy.

Fixes

• A failed model call no longer renders as "(no response)". When the agent
  runtime hit an error mid-stream it emitted an error frame and then closed the
  stream normally (the HTTP response had already been a 200), which the front end
  read as "the model had nothing to say". Streamed failures are now surfaced as a
  readable explanation of what failed.

• The deep-investigation toggle is greyed out when the deployment cannot do
  it, with the reason stated, instead of offering a switch that is guaranteed to
  fail — for example when no Agent Space exists or the Region does not support
  one.

• Accounts that cannot open support cases now say so up front. Creating a
  case requires a Business or Enterprise Support plan; the check used to happen
  at submit time, so you filled in the whole form before being told. The
  limitation is now stated before you start.

• AgentCore idle session timeout is set explicitly to 3600s in the one-click
  template. The 900s default cut long-running sessions short.

Docs

• The README (both languages) gains an "Upgrade to a new version" / "Delete the
  whole environment" section — for both deployment paths, including what is
  retained on delete and what has to be removed by hand.
• A feature-by-feature setup.sh vs one-click comparison table, so the choice
  between the two paths is a table lookup rather than a reading exercise.

Tests and CI

The Python test suite is now actually run in CI. tests/ held 68 files of which
the pipeline executed 2 — the rest passed or failed depending on whether someone
ran them locally. All of them now run on every pipeline (911 tests at the time of
this release), alongside new suites covering the organization-mode stager path
and the support-case capability check.

Upgrading

One-click (CloudFormation): download notiops-webchat.template.json from the
assets below, then in the CloudFormation console update your existing stack with
it (Replace existing template). The new parameters default to
EnableDeepInvestigation=Yes and DeployMode=SingleAccount, so an update with
otherwise unchanged parameters adds the Agent Space and changes nothing else.
Measured at about a minute, because the new release's artifacts have to be staged
into your account again.

setup.sh:

git pull            # or re-clone at tag v1.0.11
./setup.sh          # re-run; existing resources are updated in place

Your data is not touched by either path: the conversation and configuration
tables are Retain, and re-seeding is idempotent.

Do not mix assets across releases — the template and the three .zip files are
cryptographically bound (each checksum is baked into the template and the release
tag is part of every object key), and the stack verifies every checksum before
use.

Asset checksums (sha256)

6d9bcd44c29325e37a78e4edf6fbae7515aed63ce1ac36300ebed6d0fde0c78b  bff.zip
92bc5a7d84073e6d4f59c540ff4d7969826c2190eaf3d11bd71fb67e9140e35c  chat-dist.zip
3738df016827001cb310b7c84e1ca50d00b60adc2f29413404978392e5e09ced  agent-code.zip

Download notiops-webchat.template.json only. The three .zip assets are
pulled into a bucket in your account by the stack itself; you never need to
download them by hand. The template is ~139 KB, above CloudFormation's
51,200-byte --template-body limit — from the CLI, upload it to S3 first and
pass --template-url.

See README for full setup, one-click deployment
for the console walkthrough, and the documentation for architecture
and operations.