Kubernaut v1.5.6

What's Changed

• fix(security): pin golang.org/x/text in db-migrate goose builder (#1763, CVE-2026-56852) by @jordigilh in #1781
• fix(ci): pin crun>=1.14.3 to fix podman OCI spec v1.2.1 incompatibility (#1784) by @jordigilh in #1785
• fix(v1.5): consolidated bugfix wave — #1771, #1772, #1773, #1775, #1777 (partial) by @jordigilh in #1779
• fix(ci): align crun/podman fix with main's approach (Issue #1769) by @jordigilh in #1788
• fix(apifrontend): backport BR-SESS-013 reinvocation race fix to v1.5 (#1776) by @jordigilh in #1783
• fix(1794-backport-v1.5): live SSE complete event never carried RCA data by @jordigilh in #1800
• fix(datastorage): scope remediation history query by target resource (#1802 backport) by @jordigilh in #1810
• fix(kubernautagent): backport #898 -- wire production emitters for EventTypeSessionResumed/EventTypeInteractiveK8sCall by @jordigilh in #1813
• fix(kubernautagent): buffer investigation events before Subscribe to close #1811 race (v1.5 backport) by @jordigilh in #1821
• fix(ci): bump v1.5 golangci-lint timeout 5m->10m to match main by @jordigilh in #1833
• fix(kubernautagent): use peak-concurrency, not wall-clock, to prove IT-KA-970-001 parallelism (#1552 v1.5 backport) by @jordigilh in #1831
• fix(apifrontend): fail fast on unrecognized model family under provider: vertex_ai (#1792 v1.5 backport) by @jordigilh in #1824
• fix(kubernautagent): reattach real RCA on interactive session race instead of orphaning it (#1818 v1.5 backport) by @jordigilh in #1852
• fix(apifrontend): backport #1658 -- prevent raw tool-call arg leak when alert tools are disabled (v1.5) by @jordigilh in #1836
• fix(apifrontend): remove ungrounded LLM severity fallback (Tier 3, #1839) [v1.5 backport] by @jordigilh in #1857
• fix(e2e): scope AF investigate grounding to a dedicated fixture, not default/nginx by @jordigilh in #1868
• fix(apifrontend): honor per-profile credentials in vertex_ai severity-triage clients (#1731) by @jordigilh in #1870
• fix(kubernautagent): typed tool-budget-exhausted error + per-investigation anomaly isolation (#1889, #1892) by @jordigilh in #1895
• fix(k8s): self-heal RESTMapper cache on lookup failure (#1888) by @jordigilh in #1896
• deps(v1.5): Bump the all-go-deps group with 10 updates by @dependabot[bot] in #1905
• fix(af): harness-enforced phase-transition consent guard (DD-AF-011, #1899) by @jordigilh in #1910
• Fix #1912 + #1915: driverActive never cleared + full_remediation not prompt-wired by @jordigilh in #1920
• fix(apifrontend): harness-enforced actionability gate for Phase 2 (#1918) by @jordigilh in #1925
• fix(apifrontend): populate causal_chain/tool_calls_count in session_active fallback artifact (v1.5 backport) by @jordigilh in #1929
• fix(apifrontend): remove internal acronym leaks from interactive-investigation status messages (#1916) by @jordigilh in #1932
• fix(kubernautagent): Sonnet-5 thinking-block round-trip, gate-retry message propagation, console ThinkingPanel fallback (#1935) by @jordigilh in #1939
• fix(kubernautagent): propagate accumulated tool-call history in workflow-discovery phase (#1945) by @jordigilh in #1947
• fix(apifrontend): backport console-access gate to release/v1.5 (#1919, #1941) by @jordigilh in #1942
• fix(kubernautagent): bound tool-call and LLM-call execution to close #1949 hang by @jordigilh in #1951
• fix(af): backport #1493 — accept bare RAR names in kubernaut_get_approval_request by @jordigilh in #1958
• fix(af): bound pooled MCP tool calls and Claude/Vertex-Claude LLM calls with client-side timeouts by @jordigilh in #1960
• fix(af): simplify ParseRARID to bare-name-only, matching ParseRRID (release/v1.5) by @jordigilh in #1962
• release: prepare v1.5.6-rc1 by @jordigilh in #1965
• docs(changelog): backfill v1.5.6 Fixed/Security entries by @jordigilh in #1990
• fix(af/ka/ro/aa): pprof gate, session hang, phaseGuardAfter, reasoning dedup, RO timeout race, MCP logger, alert mis-correlation, KA finalization gap (#1995/#1997/#2003/#2010/#2011/#2017/#2018/#2019) by @jordigilh in #2000
• fix(apifrontend,aianalysis): reject unmanaged resources (#2022) + grounded present_decision (#2023) + confidence-gated severity correlation (#2027) + interactive session resync (#2029) by @jordigilh in #2026
• fix(e2e/apifrontend): give E2E-AF-1396-001 its own grounding fixture by @jordigilh in #2058
• fix(apifrontend): mark severity-triage fallback RCA Provisional so #2023's grounding guard never caches it by @jordigilh in #2069
• fix(kubernautagent,gateway,aianalysis): propagate resource apiVersion end-to-end from signal ingestion to workflow discovery (#2061, #2064, #2066) by @jordigilh in #2072
• Fix #2073 (present_decision schema failure), #2075 (complete_no_action race), and #2080 (session-lost/adoption race) by @jordigilh in #2079
• deps(v1.5): Bump the all-go-deps group with 13 updates by @dependabot[bot] in #2084
• fix(kubernautagent,apifrontend,aianalysis): workflow_discovery hang from silent gate-retry LLM calls + tool_call_start wire-format mismatch (#2086, #2089) by @jordigilh in #2091
• fix: interactive-session batch — #2092, #2094, #2098, #2100 by @jordigilh in #2102
• fix(kubernautagent): centralize aiagent_mcp_interactive_sessions_active decrement in Release() by @jordigilh in #2107
• docs(changelog): backfill v1.5.6 Fixed entries for rc3->rc4 by @jordigilh in #2108
• fix(apifrontend): convert canonicalGroundedRCA to gob-safe map[string]any (#2110) by @jordigilh in #2112
• docs(changelog): backfill v1.5.6 Fixed entry for rc4->rc5 (#2110) by @jordigilh in #2114
• fix(v1.5.6): port #2111 gob-safety boundary hardening + fix #2118 confidence drop + fix #2120 gate undeclared-tool retry by @jordigilh in #2122
• docs(changelog): backfill v1.5.6 Fixed entry for rc5->rc6 (#2110,#2118,#2120,#2124) by @jordigilh in #2125
• release: prepare v1.5.6 GA by @jordigilh in #2127

Full Changelog: v1.5.5...v1.5.6