v0.19.0

Changelog

Added

• orlojctl dev local development loop: watch manifest files or directories, debounce and reapply changes, and optionally rerun one selected Task with live phase and log output. Runnable Tasks are skipped unless --run is explicit, invalid intermediate saves do not stop the watcher, and non-default namespaces flow through apply, watch, and log requests.
• Session checkpointing and time travel: Session-owned agent loops now persist versioned snapshots at safe ReAct step boundaries, recover from the latest compatible checkpoint after worker lease loss, and expose APIs to inspect, hash-verify/replay, rewind, or fork a Session from a checkpoint. Rewinds preserve abandoned events for audit, forks materialize independent history, and per-Session count/age policies bound checkpoint retention. The Console now renders checkpoints in the live Session timeline, distinguishes active and abandoned lineages, and provides replay, rewind/resume, and fork controls.
• Durable interactive Sessions: a new Session resource binds a multi-turn conversation to an AgentSystem, serializes idempotent user turns, persists replayable ordered events, streams reconnectable SSE with Last-Event-ID, and supports interruption, pause/resume, cancellation, idle expiry, worker leases, approvals, and stale-writer fencing. Session turns execute through existing Tasks so AgentSystem orchestration and governance remain compatible. Includes a minimal Console chat experience, an orlojctl chat <agent-system> REPL with streaming output, named Session resume, and inline ToolApproval decisions, plus interactive API and CLI design guides.
• OpenAI-compatible /v1/chat/completions: POST /v1/chat/completions maps model to an AgentSystem and executes chat messages through a one-turn Session. Streaming requests forward native OpenAI-compatible and Anthropic text deltas as OpenAI SSE chunks, with one-shot fallback for other gateways, keepalives, and [DONE]; non-streaming requests return the durable completed Session message. See Call AgentSystems via OpenAI Chat Completions.
• Console trace waterfall: the task Trace tab now renders real spans (operations are drawn from start to finish using their recorded latency), grouped into collapsible per-agent lanes with a time axis, per-event t+offset and duration columns, multi-row expansion, and a wall-clock duration stat that replaces the misleading summed "total latency". Live-streamed trace events now populate the agent lane when the server provides it. Branch-aware sub-lanes nest via parent_branch_id, the header shows a cumulative token sparkline, and expanded events can copy their JSON to the clipboard.
• Console confirm dialogs: destructive actions (resource deletion, CRD-managed warnings) use a styled in-app confirmation dialog instead of window.confirm across all detail pages.
• Console task list sorting & virtualization: the Tasks page drives server sort / order / phase query params from column headers and phase pills (default created_at desc), and virtualizes large result sets.
• GET /v1/tasks sort/phase: list tasks with sort (name | created_at | phase), order (asc | desc), and phase filter.
• Trace event branch parent: TaskTraceEvent.parent_branch_id is persisted and streamed when known; live task.trace step events include Agent and BranchID for agent-lane grouping.

Changed

• Console visual refresh: layered dark-theme surfaces (distinct canvas, panel, and card tones), higher-contrast secondary text, softer sidebar active state, design tokens for radius/spacing/typography (including migration of hard-coded sizes in component CSS), keyboard focus rings, reduced-motion support, self-hosted Inter/JetBrains Mono fonts, skeleton loading states on detail pages (and A2A Registry / Capabilities), task detail tabs deep-linkable via ?tab=, and message filters as dismissible chips with debounced apply (no Apply button). Dashboard bento sidebar uses denser count tiles.
• orlojctl logs --follow / -f: polls task/agent logs and prints new lines as they appear, until interrupted with Ctrl+C. --follow-interval sets the poll period (default 2s).
• A2A v1.0 JSON-RPC compatibility: the existing A2A endpoint now accepts the v1 SendMessage, SendStreamingMessage, GetTask, ListTasks, CancelTask, and SubscribeToTask methods while preserving Orloj's legacy tasks/* methods. Outbound A2A tools negotiate v1 JSON-RPC from supportedInterfaces and retain legacy fallback.
• A2A v1.0 gRPC binding: orlojd can expose the normative A2A service on a separate listener with shared task handling, bearer authorization, TLS configuration, and Agent Card discovery.
• A2A push notifications: v1 JSON-RPC and gRPC clients can create, get, list, and delete persistent per-task callback configurations. Task events are delivered with bounded retries through SSRF-safe HTTP; credentials are encrypted in PostgreSQL when secret encryption is configured.
• A2A v1.0 Agent Cards: generated cards now advertise supportedInterfaces, required default content modes, v1 security schemes and requirements, agent versions, and normative skill fields while retaining legacy discovery fields. Operators can sign cards with RFC 8785 canonicalization and detached JWS using RSA, P-256 ECDSA, or Ed25519 keys, and can require trusted signatures on fetched remote cards.

Security

• A2A ownership and availability hardening: push configurations are keyed by the authorized internal Task instead of caller-controlled external IDs; required Agent Card verification now fails closed; and per-IP rate limits, a global 10-waiter ceiling, and a 30-minute maximum wait apply across JSON-RPC and gRPC.
• Session checkpoint hardening: checkpoint APIs expose metadata instead of raw runtime state, serialized state is capped at 4 MiB, retained tool results are redacted and truncated to 64 KiB without duplicate memory copies, and retention is capped at 100 checkpoints or 720 hours.
• Interactive output and error hardening: orlojctl chat renders terminal control characters as inert text, while Session and checkpoint APIs log internal store failures without returning SQL or driver details.

v0.18.0

Added

• Anthropic OAuth access tokens: the Anthropic model gateway now sends Authorization: Bearer for credentials with the sk-ant-oat prefix (or an explicit Bearer prefix), while standard API keys continue to use x-api-key. Same ModelEndpoint auth.secretRef works for both.
• orlojctl auth login: new CLI command that authenticates with username/password against a native-mode server and saves a bearer token to the active profile. Eliminates the need to manually configure API tokens for CLI access.
• POST /v1/auth/cli-token: new API endpoint that accepts credentials and returns a bearer token for CLI use (native auth mode only).
• orlojctl config use auth probe: switching profiles now checks /v1/auth/me and prints whether the profile's credentials are valid, warning if unauthenticated.
• orlojctl config get resolution sources: now shows where the effective server and token are coming from (profile, env var, or default), making env-override issues visible.
• orlojd CORS configuration: --cors-allowed-origins / ORLOJ_CORS_ALLOWED_ORIGINS enables cross-origin API access; defaults to same-origin only.
• orlojd native TLS: --tls-cert-file / --tls-key-file (or ORLOJ_TLS_CERT_FILE / ORLOJ_TLS_KEY_FILE) for HTTPS without a terminating proxy.
• Makefile convenience targets: make test and make lint.

Changed

• Release attribution: official Docker images and GoReleaser release archives now include LICENSE, NOTICE, and TRADEMARKS.md; README/TRADEMARKS clarify redistribution, optional “Powered by Orloj” attribution, and branding expectations.
• Pagination cursors now emit scoped namespace/name continue tokens (bare ?after= values remain accepted).
• Container CLI tools default to the operator-configured container network (none by default) instead of implicit bridge access.

Fixed

• gRPC tool runtime SSRF: outbound gRPC dials now route through SafeDialer, blocking DNS-rebind to private/metadata IPs at connection time.
• Container HTTP tool endpoints are validated with ValidateEndpointURL before sandbox execution.
• Namespace authorization: mutation requests reject metadata.namespace values that do not match the effective request namespace.
• Label-filtered list pagination no longer returns under-filled pages or empty pages with a non-empty continue token.
• SSE resource watches enforce a 30-minute max duration and cap concurrent watch connections globally and per client IP.
• Store error responses no longer leak internal driver/connection details to API clients.
• WASM module resolver rejects plaintext http:// module refs and blocks local path traversal outside the cache directory.
• OAuth2 token cache is bounded with LRU eviction; token-endpoint error bodies are redacted.
• Postgres migrations use a pinned connection for advisory locking; constraint migrations are idempotent on re-run.
• Task webhook delivery lookup uses an indexed GetByEndpointID store method instead of a full-table scan.
• Agent job SQL updates increment resourceVersion to avoid clobbering concurrent task writes.
• Unsupported mutation Content-Type requests receive 415 Unsupported Media Type.

Security

• Go toolchain bumped to 1.26.5 across go.mod, CI, and Docker builds (fixes GO-2026-5856 / CVE-2026-42505 in crypto/tls).
• Docker base images pinned by digest (golang:1.26.5-alpine, alpine:3.23).
• Secret CLI flags (--api-key, --secret-encryption-key, --auth-reset-admin-password) log a warning when used; prefer env vars to avoid ps exposure.
• Reference structured audit sink: agentruntime.SlogAuditSink (runtime/audit_sink_slog.go) writes audit events as structured JSON via log/slog. Wire it through Extensions.Audit to get a durable audit trail; audit logging remains off (no-op) by default. See Audit Logging.
• Threat model documentation: new docs/pages/operations/threat-model.md consolidating trust boundaries, attacker model, controls, and operator-owned residual risks.
• Documented audit-logging and multi-tenant guidance: docs/pages/operations/security.md now states that audit logging is operator-supplied (with retention/integrity guidance and a reference sink).
• Dependency updates: bumped Go modules (AWS SDK, pgx, NATS, pgvector, wazero, OpenTelemetry, gRPC), Alpine 3.23 runtime images, GitHub Actions pins, and frontend packages (React 19, Vite 8). Vocs 2.x deferred — requires a separate docs migration.

v0.17.0

Added

• A2A protocol support: expose selected AgentSystems as discoverable A2A agents via spec.a2a.enabled, accept inbound A2A task requests (JSON-RPC), call external A2A agents as type: a2a tools, and maintain a configured registry of remote agents. Includes Agent Card generation from systems, POST /a2a and per-system POST /v1/agent-systems/{name}/a2a JSON-RPC endpoints, GET /.well-known/agent-card.json discovery, auth-filtered GET /v1/a2a/agents registry endpoint, scoped API-token role a2a, Orloj/A2A task state mapping, outbound A2A client with SSRF protection, A2A-specific Prometheus metrics, orlojctl a2a card and orlojctl a2a test CLI commands, React SPA A2A Registry page, Helm chart a2a.* values, and comprehensive documentation.
• Per-system A2A invoke auth: new spec.a2a.auth field on AgentSystem ("public" or "bearer", default "bearer") allows individual systems to accept unauthenticated A2A invoke while the control plane remains token-protected. Public systems' Agent Cards omit authentication.schemes, and the A2A registry shows public systems to unauthenticated callers.

Fixed

• A2A: tasks/get and tasks/cancel auth bypass on bearer systems: unauthenticated callers could read task output and cancel tasks on spec.a2a.auth: bearer systems if they knew the A2A task ID. The permissive a2aIdentityAllowsSystem gate now enforces the same bearer requirement as tasks/send and tasks/sendSubscribe.
• A2A: tasks/sendSubscribe namespace mismatch: subscribe created tasks in the request query-param namespace (defaulting to "default") instead of using the target AgentSystem's namespace, causing task lookup misses for non-default namespaces.
• A2A: --api-key flag not wired into authorizer: running orlojd --api-key secret without the ORLOJ_API_TOKEN env var left auth open while Agent Cards advertised bearer. The flag value is now propagated to the env before server init.
• A2A: tasks/get/tasks/cancel cross-system task ID collision: findTaskByA2AID searched all tasks globally by label. When invoked via a per-system URL (/v1/agent-systems/{name}/a2a), the lookup is now scoped to the target system.
• A2A: tasks/get/tasks/cancel missing task ID validation: get and cancel accepted empty params.id. Empty IDs are now rejected consistently across all four JSON-RPC methods.
• A2A: subscribe SSE write errors ignored: heartbeat and status writes did not check for errors, allowing the poll loop to spin briefly after client disconnect. Write failures now terminate the stream immediately and record client_disconnected in telemetry.
• A2A: cancel reason unbounded: params.reason on tasks/cancel had no length limit and was stored verbatim. Now capped at 1024 characters with rune-safe truncation.
• Helm CRD drift: charts/orloj/templates/operator-crds.yaml was missing the spec.a2a.auth field present in config/crd/bases/orloj.dev_agentsystems.yaml.
• CLI: orlojctl a2a card ignored --namespace flag: the namespace flag was not applied to the card fetch URL. Non-default namespace systems now resolve correctly.
• Docs: stale A2A security description: docs/pages/concepts/a2a-interoperability.md incorrectly stated that JSON-RPC endpoints require global bearer auth; updated to describe per-system spec.a2a.auth model.

Changed

• UI: Gold/bronze design system: replaced green accent palette with a warm gold (#F5B041) and bronze (#D68930) theme across all surfaces, sidebar, cards, and graph nodes. Updated dark and light theme CSS variables for a premium modern feel.
• UI: Control plane dashboard: redesigned home page with a bento layout, lifecycle summary cards, resource quick links, and a live task trace feed.
• UI: Agent system detail page: redesigned from tab-based layout to a single-page bento-box dashboard featuring a System Health Horizon banner (task success rate with sparkline, API reachability, workers online), full-width topology view with glowing gold edges and pulsing running nodes, and a three-column bottom grid (system definitions, recent tasks, task trace timeline).
• Docs: README Orloj in Action media: refreshed screenshots and lifecycle GIF in docs/public/readme/ for the updated web console.

v0.16.1

Changelog

Added

• Trusted private MCP HTTP servers: McpServer.spec.allowPrivate: true now permits HTTP MCP transports to connect to trusted RFC 1918 / ULA / CGNAT destinations, such as in-cluster Kubernetes Services, while loopback, link-local, cloud metadata, and unspecified addresses remain blocked. The field is supported in manifests, CRDs, Helm-embedded CRDs, OpenAPI, and resource docs.

v0.16.0

Changelog

Added

• Helm chart: CRD sync operator templates: new operator.* values section and six templates (operator-deployment, operator-serviceaccount, operator-rbac, operator-pdb, operator-servicemonitor, operator-crds) for deploying the orloj-operator CRD sync controller. Includes ClusterRole/ClusterRoleBinding for orloj.dev CRDs, leader election leases, and event recording. All 8 CRD manifests are bundled in operator-crds.yaml (conditional on operator.installCRDs). Adds crdConflictPolicy value (default warn) and passes it to the server deployment as ORLOJ_CRD_CONFLICT_POLICY.
• Kubernetes agent execution: agents in multi-agent tasks can now run as ephemeral Kubernetes Jobs instead of in-process on the worker. The orchestrator (TaskController or AgentMessageConsumerManager) delegates eligible agents to K8s Jobs running the worker image in --single-agent mode. Agents with Docker-dependent tools (container isolation or stdio MCP servers with images) transparently fall back to in-process execution. Crash recovery detects existing Jobs by deterministic naming and resumes watching. New --agent-k8s-* flags (--agent-k8s-enabled, --agent-k8s-namespace, --agent-k8s-service-account, --agent-k8s-image, --agent-k8s-job-ttl, --agent-k8s-default-memory, --agent-k8s-default-cpu) configure the runtime. Helm chart adds agentExecution.kubernetes.* values and conditional RBAC for Job/Pod access.
• Kubernetes tool isolation backend: tools can now execute as ephemeral Kubernetes Jobs by setting isolation_mode: kubernetes in the tool spec. The new backend coexists with the existing Docker container backend -- per-tool isolation_mode selects which one handles each tool. New --tool-k8s-* flags (--tool-k8s-enabled, --tool-k8s-namespace, --tool-k8s-service-account, --tool-k8s-job-ttl, --tool-k8s-default-image) configure the runtime independently of --tool-isolation-backend. Helm chart adds toolIsolation.kubernetes.* values and conditional RBAC for Job/Pod/Secret access. Includes KubernetesSecretResolver for resolving secrets from Kubernetes Secrets when running in-cluster.
• CRD sync operator (orloj-operator): optional component that makes Orloj resources real Kubernetes CRDs, enabling kubectl apply and GitOps (Argo CD, Flux) for resource management. The operator watches 8 CRD kinds (Agent, AgentSystem, Tool, McpServer, ModelEndpoint, Memory, AgentPolicy, Secret) and syncs them into Orloj's Postgres store. Status flows back to CRD .status subresources so kubectl get agents shows phase. Includes ownership annotation (orloj.dev/managed-by: crd-sync), conflict guard on the REST API (--crd-conflict-policy), finalizer-based deletion, and frontend badges/warnings for CRD-managed resources. Supports orloj.dev/target-namespace annotation to decouple K8s namespace from Orloj namespace. Deployed via operator.enabled: true in Helm values. Documentation: operator deployment guide (deploy/kubernetes-operator), kubectl-vs-orlojctl comparison guide, architecture overview update, --crd-conflict-policy flag reference, and operator troubleshooting section.

Fixed

• Message-driven agent consumer missing K8s tool runtime: AgentMessageConsumerManager.processMessage was not calling ConfigureKubernetesRuntime when building the tool runtime stack, causing tools with isolation_mode: kubernetes to fail in message-driven execution mode.
• CI: CRD schema drift detection: CI now regenerates CRD manifests and fails if the checked-in YAML is stale, preventing operator schema from diverging from Go type definitions.
• Operator integration tests (envtest): full envtest-based test suite exercises the CRD reconciler against a real Kubernetes API server — covers create/update/delete lifecycle, all 8 CRD kinds, upsert error → SyncError status, StatusWriter writeback, and delete retry. Also adds HTTP handler-level tests verifying the POST conflict guard across all resource kinds and all 3 policy modes. CI runs these tests automatically.

v0.15.0

Changelog

Added

• Agent Evaluation Framework: new EvalDataset and EvalRun resource kinds for declarative agent evaluation. Includes four scoring strategies (exact_match, llm_judge, manual, custom), a comparison API (GET /v1/eval-runs/compare), manual review workflow with export/annotate/import/finalize, and full orlojctl eval CLI subcommand tree. New database migration 013_eval_framework.up.sql, OpenAPI schemas, and TypeScript frontend types.

Fixed

• EvalRun docs and frontend type mismatches: documentation used dataset instead of dataset_ref, showed agent_overrides as a list instead of a map, and used system_prompt instead of prompt. Frontend TypeScript types matched the incorrect docs rather than the Go backend. All examples, reference docs, and frontend types now match the actual EvalRunSpec schema.
• EvalRun output grading and progress: scoring prefers the agent's final model line (last_output), strips step=N model_output= prefixes and markdown fences before comparison, and JSONPath scoring parses fenced JSON. Running-phase reconciliation persists completedSamples for live progress; DeadLetter tasks are counted like failures for completion and cancellation. Re-applying an EvalRun resets non-terminal phases (clearing stale results) while preserving terminal Succeeded and PendingReview status.
• OpenAPI: EvalRun-related paths and schema fields aligned with the HTTP API.
• Helm chart hardening: conditional NATS URL args (avoid passing empty --nats-url= when NATS is disabled), templated containerPort and probe settings from values (instead of hardcoded), added seccompProfile: RuntimeDefault to pod security contexts, security context on helm test pod, removed dead postgres-password key from chart-managed Secret, and removed placeholder sub-chart directories that shadowed real helm dependency update.

Changed

• EvalRun suspended by default on apply: orlojctl apply now creates EvalRun resources in a suspended state (spec.suspended: true) so they do not execute automatically. Use orlojctl apply --run to start immediately, orlojctl eval start <name> to start a suspended run, or orlojctl eval run (unchanged) to create and start in one step. New POST /v1/eval-runs/{name}/start API endpoint.
• Sealed Secrets UI consolidated into Secrets page: removed the dedicated "Sealed Secrets" navigation entry and pages. Secrets that originate from a SealedSecret now show a "Sealed" source badge in the list and detail views, with the owning SealedSecret name. Old /sealed-secrets URLs redirect to /secrets.
• JetStream API migrated to jetstream package: the agent message bus now uses jetstream.New(nc) and the push-based consumer.Messages() iterator instead of the deprecated nc.JetStream() v1 API with PullSubscribe/Fetch polling. This eliminates idle CPU from the 2-second poll loop and delivers messages instantly via server-side push with heartbeats.
• Stream bounded by MaxBytes: the ORLOJ_AGENT_MESSAGES stream now enforces a 1 GiB MaxBytes cap alongside the existing 7-day MaxAge, preventing unbounded disk growth during message bursts.
• Consumer poison-message protection: JetStream consumers now set AckWait: 120s and MaxDeliver: 10, terminating messages that fail processing after 10 attempts instead of redelivering indefinitely.
• Redundant task lookup eliminated: handleDelivery now passes the already-fetched task into processMessage, removing a duplicate tasks.Get round-trip on every agent message.
• Event bus publish failure monitoring: NATSBus now tracks cumulative publish failures with a new PublishFailures() accessor for health checks and metrics export, and includes the running failure count in log messages.

v0.14.1

Changelog

Changed

• docker-compose.yml updated for codebase parity: added explicit --max-concurrent-tasks to workers, surfaced commonly-needed operator env vars (ORLOJ_AUTH_MODE, ORLOJ_API_TOKEN, ORLOJ_SETUP_TOKEN, ORLOJ_SECRET_ENCRYPTION_KEY, ORLOJ_LOG_LEVEL, ORLOJ_LOG_FORMAT, ORLOJ_TOOL_ISOLATION_BACKEND) on orlojd, added ORLOJ_LOG_LEVEL/ORLOJ_LOG_FORMAT to workers, and defined an explicit orloj Docker network for all services.

Fixed

• orlojworker Dockerfile missing wget: the orlojworker container stage now installs wget to match orlojd, ensuring compose healthchecks work reliably.

v0.14.0

Changelog

Added

• Global log level for daemons: orlojd and orlojworker accept --log-level, --debug, and ORLOJ_LOG_LEVEL so operators can raise or lower verbosity without rebuilding. Operations docs, the server flags reference, and the Helm chart README include examples (including runtimeConfig.ORLOJ_LOG_LEVEL for clusters). Telemetry records the effective parsed log level, forwards debug bridge logs when enabled, and routes configured error-level fatals through the error logger so shutdown paths stay consistent with the chosen level.
• Targeted debug instrumentation: additional debug logging around startup/runtime configuration, tool runtime setup, task scheduling and claim/heartbeat loops, worker capacity, and the agent message consumer (receive, skip, retry, ack, and routing decisions) to trace message-driven execution without enabling full trace spam.
• Kubernetes-style memory suffixes: ParseMemoryBytes now accepts Gi, Mi, Ki suffixes (IEC binary, 1024-based) alongside Docker-style g, m, k.
• Agent.ResolvedModel() accessor: provides a clear read path for the runtime-resolved model ID, discouraging direct field access on the json:"-" tagged Spec.Model.

Changed

• Relaxed container isolation defaults: MCP server and tool runtime containers no longer apply --read-only, --cap-drop=ALL, or --security-opt no-new-privileges. The container boundary, resource limits, and network controls remain the primary isolation mechanism. This improves compatibility with images that require writable filesystems or Linux capabilities (e.g. Chromium-based MCP servers).
• Anthropic API timeout increased: HTTP timeout for Anthropic API calls raised from 30s to 120s to prevent timeouts on large contexts.

Fixed

• DeepCopy BlockedOn pointer isolation: Task.DeepCopy() now deep-copies the BlockedOn pointer, preventing shared mutable state across task copies during concurrent reconciliation.
• Regex ReDoS protection + caching: Edge condition output_matches patterns are length-limited (512 chars) at normalization time and compiled regexes are cached, eliminating per-evaluation re-compilation and catastrophic backtracking vectors.
• Integer overflow in ParseMemoryBytes: Memory values that overflow int64 when multiplied by their unit (e.g. "9999999999g") now return an error instead of a negative result passed to Docker resource flags.
• OutputSchema validation: Agent output_schema is now validated during normalization — requires a root "type" key, caps nesting at 10 levels, and limits serialized size to 64 KB.
• YAML multi-document rejection: All manifest parsers now reject --- document separators with a descriptive error, preventing silent field corruption from multi-document streams.
• NormalizeGraphJoin rejects invalid values: Unknown join.mode or join.on_failure values now return errors instead of being silently replaced with defaults.
• Task.Normalize requires system for run mode: A Task with mode: run and empty spec.system is now rejected at normalization time rather than failing at runtime.
• EncodeTaskApprovalResumeContext error propagation: The function now returns errors instead of silently returning empty maps on marshal/unmarshal failure.
• Memory ingest content size limit: memory.ingest now rejects payloads exceeding 10 MB, preventing OOM from unbounded content ingestion.
• Deterministic memory search results: SharedMemoryStore.Search now sorts results by key before truncating to topK, producing consistent results across calls.
• Sealed secret AAD includes algorithm version: GCM additional authenticated data now includes AES-256-GCM-v1 as a prefix, with backward-compatible fallback to the legacy AAD format during unseal.
• YAML inline array quoted commas: The manifest parser's flow array split now respects quoted strings, so values like ["hello, world", b] parse correctly instead of splitting on the embedded comma.
• Standalone orlojworker MCP execution parity: standalone workers now build and own an McpSessionManager, configure MCP execution on the task controller, pass MCP dependencies into message-driven agent consumers, start the idle reaper, and close MCP sessions on shutdown. This brings standalone orlojworker behavior in line with embedded orlojd workers so generated type=mcp tools can execute in both task-controller and message-driven flows.
• Provider-safe tool names across model gateways: OpenAI-compatible/OpenAI, Azure OpenAI, Anthropic, Bedrock, and Ollama now share consistent tool-name aliasing. Runtime tool names such as memory.write are sanitized for provider requests, parsed responses map back to runtime names, and multi-turn assistant tool-call history is re-aliased through the current request's tool alias map so history names match the provider tools array. This fixes follow-up turn failures for MCP-style names and built-ins with dots.
• Trusted local model endpoints under allowPrivate: ModelEndpoint.spec.allowPrivate: true now permits trusted local/private model gateways, including loopback Ollama and local OpenAI-compatible servers, while still blocking cloud metadata, link-local, and unspecified addresses. Generic tool and MCP egress protections remain unchanged.
• Anthropic consecutive user messages: Tool result and text messages with the same user role are now merged into a single message, fixing 400 errors from the Anthropic Messages API.
• Empty Anthropic content handling: When Anthropic returns 200 OK with an empty content array, the agent worker now completes gracefully instead of erroring with "model response missing message content" and retrying indefinitely.
• Agent worker termination on empty output: The agent loop now stops when no tools are available and the model produces no output, preventing infinite loops.

v0.13.0

Changelog

Added

• Tool approval input visibility: ToolApproval resources now capture the full tool call arguments in spec.input so reviewers can see exactly what they are approving. The frontend detail page renders the input as formatted JSON, and orlojctl get tool-approvals includes a truncated INPUT column.
• McpServer spec.default_tool_runtime: MCP server manifests now support a default_tool_runtime field that sets the default timeout, isolation mode, and retry policy for all generated Tool resources. This avoids needing per-tool runtime overrides for servers with uniform latency characteristics.
• Real-time trace streaming: Agent execution trace events (tool calls, model calls, step completions) now stream to the frontend in real time via SSE rather than appearing in a batch after execution completes. The TaskDetail trace tab shows events as they happen during long-running agent executions. Intermediate task upserts after each agent in a pipeline ensure partial progress is persisted even if the task is interrupted.
• Per-tool and per-McpServer container resource limits: Tool manifests now support spec.cli.resources and McpServer manifests support spec.resources with memory, cpus, and pids_limit fields that override the global --tool-container-{memory,cpus,pids-limit} defaults. This allows resource-intensive tools (e.g. Chromium-based MCP servers) to declare their own container limits without raising the global defaults for all tools. Operator-level ceilings (--tool-container-max-memory, --tool-container-max-cpus, --tool-container-max-pids-limit) can optionally cap per-tool overrides; manifests exceeding the ceiling are rejected at apply time.
• Provider-level prompt caching for Anthropic and Bedrock: The Anthropic gateway now sends cache_control markers on system messages and tool definitions, enabling Anthropic's server-side prompt caching (up to 90% input token cost reduction on cached prefixes). The Bedrock gateway appends cachePoint blocks to system content and tool configurations for equivalent savings when using Claude models via AWS Bedrock. No configuration required — caching hints are sent automatically on all requests.

v0.12.1

Changelog

Added

• TaskSchedule spec.task_template: Schedules now support inline task specs via task_template, matching the existing TaskWebhook capability. This eliminates the need for a separate template Task resource when only the schedule references it. task_ref and task_template are mutually exclusive; existing schedules using task_ref continue to work unchanged.

Fixed

• YAML manifest parser silently drops fields: the constrained-YAML parser ignored several documented spec fields, causing them to be silently discarded on apply. Fixed: image_pull_secret on Tool CLI and McpServer, fallback_model_refs and allowed_tools on Agent, allowPrivate on ModelEndpoint, max_child_depth and max_child_tasks on AgentPolicy, headerName/tokenURL/scopes on McpServer auth, algorithm/payload_format/payload_prefix/payload_separator/signature_encoding/header_format/signature_key/timestamp_key on TaskWebhook auth, and task_template.mode on TaskSchedule and TaskWebhook. JSON manifests were unaffected.