v0.11.0 — Extended MCP OAuth, file attachments, live GFS changes

A minor release, led by extended MCP OAuth, file attachments and FileReference ingress, live GFS change propagation, and a hardening pass across auth, rate limits, and the stateless runtime. 1080 non-merge commits since v0.10.0. No breaking changes.

Extended MCP OAuth

• Remote and generic OAuth flows, grants oversight, and proactive token rotation for MCP servers (#796).
• Remote MCP servers whose authorization server lacks RFC 9207 install through a per-server callback (#960).
• Connector create and add-remote move to header buttons, and the connector detail view refreshes in place (#988, #1029).

Files and attachments

• FileReference v1, inline file-attachment ingress, and structured GFS references (#822).
• Desktop uploads any file from the agent chat composer as an inline attachment, with image previews, a dismissible new-chat nudge, and resend with attachments (#932, #859).
• mcp-host processes large GFS files in the caller workspace, and the GFS download store is redesigned and bounded on the workspace PVC (#979, #1028).
• Live GFS entity changes propagate to clients (#794).

Models and tools

• Grok subscription chats accept image input, with a 35 MiB visual request envelope (#806).
• Oversized native tools are deferred through discovery, and native tool approvals are scoped to the task (#1005, #1028).

Security and hardening

• Password authentication gains abuse controls, password tables align with the deployment access contract, and workflow template parsing is hardened (#1010, #1052).
• JWT signing and verifier key configuration is hardened (#948). rpc-proxy rejects empty RPC subjects (#962). The mcp-host SSRF classifier covers special-purpose ranges (#947).
• Runtime column ACLs and GCP test gaps are closed (#1053).
• Control-plane quotas are coordinated across endpoints, and Control UI recovers from 429s (#987).

Runtime and reconcilers

• The stateless runtime contains watch loss and preserves Desktop chats (#849).
• HCC prepares the runtime bootstrap for safe resource rollouts (#1013).
• WorkflowRecipe reconciler reads StatefulSets and Contexts before creating them and stops DELETE write-storms on leftover policies (#998, #855).

UI

• Guardrails detail pages, plugin SDK menu placement, GFM Markdown tables, and persistent admin banners (#631).
• Agent LLM secret editing is restored, with LLM secret name gating, Access tab tokens, a usage scroll fix, and a GFS listing cap (#1014, #973).
• Subscription hub connected state, dropdown contrast, team agents list styling, an improved Profile Portal home, and the sandbox-ui embed no longer outlives its tab (#857, #975, #926, #1054).

Upgrade notes

Two CRDs change — apply charts/clerum-crds before the app. mcpservers.clerum.io gains the extended OAuth schema: spec.oauth adds an optional source (remote or generic) with its endpoint and client settings, and the static required list moves into CEL rules keyed on source. Existing servers without source keep requiring id, provider, clientIdRef, and clientSecretRef. New CEL transition rules make oauth.id, oauth.provider, the presence of oauth.source, and the pinned settings of a remote server immutable after install; workflowrecipes.clerum.io changes descriptions only. Deploy with gcp-prod-deploy-crds (or the equivalent for your cluster) ahead of the workload rollout; the prod deploy's CRD guard fails an apply until they are current.

deploy/base changes only in control-plane:

• codex-llm-proxy and grok-llm-proxy raise their memory limit to 2048Mi and the V8 old-space cap to 768 MiB. grok-llm-proxy-config adds GROK_LLM_PROXY_MAX_VISUAL_BODY_BYTES: "36700160".
• host-context-controller gains stateless Host idle settings (30 min idle, 15 min floor, 60 s drain grace, 10 s heartbeat poll).
• control-api-config adds per-route rate limits and raises the plugin SDK and approval limits. The workflow approval gateway allows 35 MiB bodies on the provider-attempt authorize route, with 90 s proxy timeouts and a canonical upstream path.

No new services, RBAC, or ServiceAccounts, so no post-deploy RBAC sync is needed.

Images

Release images are promoted, not rebuilt — release-images.yml copies the exact digests already proven on :latest into :v0.11.0, so they are byte-identical to what was tested.

Pull by tag, or pin by digest:

ghcr.io/evenfire-ai/<image>:v0.11.0

The same set is attached to this release as release-images-v0.11.0.json, so a deployment can consume the digests directly rather than scraping this table.

Image	Digest
airtable-mcp-server	sha256:9f1b6cd4f11aa47229d942973dde9ef463896c3d854efe0a97c92dfb4ce625c0
channel-reader	sha256:34c0a9c94b27159552600aea3ee6d309033f320a5ca225311f04ce3fdd8614b7
clerum-workflow-base	sha256:f509abe754f5235d7655847fe91884f91eb6f828a33417fb6d324f4484eb0457
codex-llm-proxy	sha256:dc786effef3f4a1423efa96759127bf495d417ed410eaf1665ac6fb5bb027b45
control-api	sha256:ce955e7f87b9da686e586abb102452b0251aeea2052a060a7afc7f217dff76f5
control-ui	sha256:bcf00fbee7854095e2b5652a45ce1cdac5afc8a90e5c3e5af1ebbae83a37bf5e
external-rest-api	sha256:d8ff3cb98b3af53b901002c59d571e985fbd66cc64867729d2ceee515f2fe4fb
gfs-controller	sha256:39ae7c450b756fefb3a63633683ecfe438fe38a8ba5e24da5f6ccea5099731eb
grok-llm-proxy	sha256:d4ae4b69c7ef33a85eb327954e60a74463d7b61b0e36af0a1de2ab72d849125b
host-context-controller	sha256:fd537b88ade23583477b6b15539761ef1d8e893a6995297568e2349029cce11f
mcp-host	sha256:0c0610fc449200ae4e87127ddf1ada16c35af7abd0f6a650bb57be6e309eab77
mcp-host-desktop	sha256:33707a2708021233ba57ae191037538791b5dd1342e6027b39f65099b4783736
mcp-host-full	sha256:f70707a00259a581f1aabc2aa484c25e66e271660852026cd47f7aa42aacadec
mcp-host-slim	sha256:9b38d0d4d627b529f74b40d3fec05e74436730a55cce4c6415dac71a2089bad5
mcp-proxy	sha256:092b5c8a2a34c3c8a46954ba489daa7ca740f13d1815d11d65311231e671d6b2
mock-mcp-server	sha256:caac410b30133c21d110544996f5cdb7f71462d08411d8df5654da853516e007
mock-stdio-mcp-server	sha256:7fc0bca8f6dbfcefe16810602a8596b1f198125eae794ef144f84d2300bccce5
nginx-egress-proxy	sha256:4d677d4ce64afb1055b539e0aac5bafad85c2aaa2adc55de555bb07de3d09edd
playwright-server	sha256:e1b7568078b53d0522dbdc3c3f16d4457ed1808461b7e92aaa2f751844af6a28
profile-ui	sha256:d03dc0da63a75d084de7f3b0c0af8d38efbe72b4d2a6e94aa2566d2c17b45096
rpc-proxy	sha256:a4ebf1cadf41d50fde9ea86de890ab57966418e1d907d518ea33ee3cfd4997da
stdio-bridge	sha256:f47925d0af73384348074cfe480eb778772f194bde8e40c6b0de04de9c6474fa
web-search-mcp	sha256:38f3e3dea9640b7345b7dddc7c56f80b0e27bcc6f118df931742d15e641adace
webhook-gateway	sha256:87514e276e58fcbce62e7ead80686001c042c00b11432f5323a51e90a6e947a5
webhook-proxy	sha256:c2c5fa27adf81ddab9dade72e3ffa9b961477570f1d373b9ab149feee6e4c693
workflow-approval-request-reader	sha256:f041d5946a9e7f8f6860f0053a86b355f5ca62c5d5fc5ac1c735fbec015b2310
workflow-coordinator	sha256:af061a720ad64b9b82b64b10d2d50751a1f3a28fa61e3478553a32e3149564a9
workflow-recipes	sha256:2cdd2d9530675f2800d316bb570def459e9acca3d624e391f4bf5ce98433c0bc
workflow-snippet-runner	sha256:4e143c6f03bc7b538b0029df27a1b8b109cfc2ce07019bbbb2124763f73caeb5
workspace-files-controller	sha256:82b0edd2d2085094d835c15a91e7d11a0e68694413ac7d996227824864b95806