v0.6.0-alpha.12

What's Changed

• docs: Simplify ibac demo — drop redundant authbridge rebuild step by @huang195 in #433
• feat(authbridge): Allow empty pipeline plugin lists by @huang195 in #438
• feat(authbridge): Add envoy-sidecar mTLS demo by @huang195 in #440
• fix(mtls-demo): Patch namespace CM + align permissive across modes by @huang195 in #441
• fix(ibac): Guard nil Session and bypass MCP housekeeping by @kellyaa in #443
• feat(abctl): Add built-in Namespaces → Pods picker with auto port-forward by @huang195 in #445
• fix(ibac): Self-heal make demo-ibac on stale local images by @huang195 in #444
• feat(abctl): Picker polish and post-#445 cleanup by @huang195 in #446
• feat(abctl): Surface plugin runtime config in plugin-detail pane by @huang195 in #447
• feat(abctl): In-place pipeline editor with hot-reload by @huang195 in #448
• feat: Plugin catalog + abctl visibility & validation by @huang195 in #449
• fix(ibac): Bypass transport-layer calls and let agents take self-actions by @huang195 in #450
• fix(ibac): Bypass MCP session-terminate DELETE as transport_stream by @huang195 in #451
• refactor(plugins): Push protocol classification down to parsers by @huang195 in #452
• broker plugin: Adding logs by @davidhadas in #454
• import tokenbroker by @davidhadas in #460
• Feat: Inline plugin-config templates in abctl edit by @huang195 in #461
• fix(ibac): Raise judge token cap and request JSON mode by @kellyaa in #462
• refactor(authbridge): simplify PluginCapabilities — remove unused fields by @huang195 in #463
• chore(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #437
• chore(deps): Bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #436
• chore(deps): Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #435
• chore(deps): Bump github/codeql-action from 4.35.3 to 4.36.0 by @dependabot[bot] in #434
• build(deps): Bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #402
• chore(deps): Bump github.com/charmbracelet/x/ansi from 0.11.6 to 0.11.7 in /authbridge/cmd/abctl by @dependabot[bot] in #415
• feat(authbridge): credential placeholder swap (hide real tokens from the agent) by @huang195 in #464
• fix(authbridge): post-#464 follow-ups — abctl pipeline panic + echo demo preflight by @huang195 in #470
• docs(weather-agent): UI-first rewrite of advanced demo + LLM setup by @mrsabath in #466
• build(deps): bump Go 1.24→1.25, grpc to v1.81.1, fsnotify to v1.10.1 by @pdettori in #465
• build(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #473
• build(deps): Bump github/codeql-action from 4.36.0 to 4.36.1 by @dependabot[bot] in #475
• fix(authbridge): record inbound allow events without requiring a2a-parser by @huang195 in #471
• epic: add SPARC pre-tool reflection plugin, service, and demo by @OsherElhadad in #478
• docs(weather-agent): fix installer secret namespace in demo-ui by @mrsabath in #439
• feat(sparc-service): one-command install; deploy SPARC via a shared i… by @OsherElhadad in #479
• Adding an opa plugin by @davidhadas in #427
• fix(authbridge): Stream text/event-stream responses frame-by-frame by @kellyaa in #480
• feat(proxy-init): add enforce-drop mode for proxy-sidecar egress enforcement by @huang195 in #484
• feat: Add transparent listener + enforce-redirect for proxy-sidecar egress by @huang195 in #485
• CI: grant pull-request read permission for verify-pr-title job to pr-verifier caller by @rh-dnagornuks in #495
• Feat(opa): implement singleton OPA SDK to eliminate duplicate bundle … by @davidhadas in #491
• Fix: Capture in-cluster TCP egress in enforce-redirect (keep DNS direct) by @huang195 in #498
• Fix: Exempt DNS by resolv.conf nameservers, retire CLUSTER_CIDRS by @huang195 in #499
• Fix: remediate security audit findings in authbridge by @varshaprasad96 in #496
• Fix: Pin IBAC user intent against FIFO eviction; add listener.skip_hosts by @kellyaa in #500
• Fix: Render MCP-protocol error frame on outbound deny by @kellyaa in #501
• Fix: Select iptables backend by kernel module, fail loud on misprogram by @huang195 in #518
• Feat: Add build-tag based plugin selection for authbridge binaries by @Schimuneck in #520
• Feat: IdP-agnostic token exchange plugin interface by @akram in #521
• Feat: Outbound TLS bridge (Phase 1) — decrypt agent egress HTTPS into the pipeline by @huang195 in #522
• Fix: Run the TLS bridge without SPIRE (need-driven SPIFFE provider; drop in-process trust self-check) by @huang195 in #523
• Feat: Add Anthropic Messages API support to inference-parser by @huang195 in #526
• Feat: Add AI-assisted GitHub issue agent POC by @omerboehm in #492
• Feat(abctl): one row per network message, show every message by @huang195 in #527
• Fix(bypass): add /metrics to default JWT bypass paths by @jordigilh in #534
• Docs: update demos to use AgentRuntime to enroll agents/tools instead of manual labeling by @rh-dnagornuks in #494
• Fix: Forward-proxy inference SSE event: lines + outbound session pinning by @huang195 in #618
• Refactor: Collapse authbridge-lite into a build-tag variant of authbridge-proxy by @huang195 in #621
• Fix: Gate TLS-bridge leaf cache on wall-clock validity (survive suspend) by @huang195 in #622
• Feat/GitHub issue agent rbac scope gating by @omerboehm in #619
• chore: 🔧 Update PR review workflow for title case insensitivity by @evaline-ju in #627
• build(deps): Bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in #472
• build(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #474
• build(deps): Bump github/codeql-action from 4.36.1 to 4.36.2 by @dependabot[bot] in #487
• build(deps): Bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.62.0 by @dependabot[bot] in #536
• build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #535
• Docs: Diagram of AuthBridge plugin decision sequence by @esnible in #629
• build(deps): Bump library/alpine from 3.23 to 3.24 in /authbridge/proxy-init by @dependabot[bot] in #517
• build(deps): Bump rojopolis/spellcheck-github-actions from 0.62.0 to 0.63.0 by @dependabot[bot] in #631
• build(deps): Bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in #636
• build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #632
• Docs: Quote curl command so that link is not rendered by @esnible in #649
• build(deps): Bump langchain-core from 1.4.7 to 1.4.8 by @dependabot[bot] in #537
• build(deps): Update python-dotenv requirement from >=1 to >=1.2.2 by @dependabot[bot] in #540
• build(deps): Bump langchain-openai from 1.3.2 to 1.3.4 by @dependabot[bot] in #538
• Feat: litellm-budget-track plugin for daily spend enforcement by @aslom in #654
• Fix reverse-proxy SSE/streaming fidelity (event: lines, gzip, header propagation, Host) by @pdettori in #657
• Feat: add static-inject AuthBridge plugin for static credential injection by @pdettori in #655
• Feat: context-guru context-engineering plugin + demo by @OsherElhadad in #660
• build(deps): Bump langchain-core from 1.4.8 to 1.4.9 by @dependabot[bot] in #668
• build(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #665
• build(deps): Bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in #664
• build(deps): Bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #663
• Fix: Address context-guru plugin review feedback (#660) by @OsherElhadad in #672
• build(deps): Bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @dependabot[bot] in #662
• build(deps): Bump github/codeql-action/init, autobuild, analyze from 4.36.3 to 4.37.0 by @dependabot[bot] in #666
• build(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.0 in /authbridge/cmd/authbridge-envoy by @dependabot[bot] in #637
• build(deps): Bump langgraph from 1.2.5 to 1.2.9 by @dependabot[bot] in #667
• build(deps): Bump langchain-openai from 1.3.4 to 1.3.5 by @dependabot[bot] in #669
• build(deps): Bump authlib deps and tidy dependent modules by @pdettori in #673
• build(deps): Bump opa to 1.18.2 and pin oras-go to patched 2.6.2 by @pdettori in #674
• Fix: Forward-proxy streams SSE responses without a StreamingResponder by @huang195 in #675
• Docs: Add AIAC specification documents by @oblinder in #661
• Feat: Add CPEX plugin by @araujof in #493
• ⚠️ Rename Kagenti → Rossoctl across kagenti-extensions (→ rossocortex) by @Ibrahim2595 in #678
• Refactor: Rename rossocortex → cortex (fix module paths) by @Ibrahim2595 in #680
• Fix: duplicate build-args key in Build-Publish workflow by @mrsabath in #693

New Contributors

• @kellyaa made their first contribution in #443
• @OsherElhadad made their first contribution in #478
• @varshaprasad96 made their first contribution in #496
• @Schimuneck made their first contribution in #520
• @omerboehm made their first contribution in #492
• @jordigilh made their first contribution in #534
• @evaline-ju made their first contribution in #627
• @oblinder made their first contribution in #661
• @araujof made their first contribution in #493
• @Ibrahim2595 made their first contribution in #678

Full Changelog: v0.6.0-alpha.4...v0.6.0-alpha.12