v0.12.0-rc.2

Upgrade notes

Tenant switching

• A person whose groups match several tenants signs in through a tenant picker.
• Sign-in uses the last-used tenant when the person still matches it, from the kora_last_tenant cookie.
• The account menu lists every tenant the person matches. Choosing one runs a silent sign-in (prompt=none) and revokes the old session.
• A switch succeeds only when the fresh sign-in's claims match the target tenant. A refused switch keeps the current session.
• 409 multiple_tenants_match and 403 tenant_switch_denied list the matching tenants.
• scripts/auth-device.sh --tenant-id <id> picks the tenant for a device sign-in.
• The MCP consent page shows the active tenant and offers a switch. A consent page opened before a switch is refused.
• Sessions from before the upgrade show no switcher until the next sign-in.
• Identity logs tenant switched on each switch.

Agents

• Each agent's Istio DestinationRule is named agent-<slug>.<tenant namespace> in the system namespace.
• On the first reconcile after upgrade, each agent creates its new rule and deletes its own agent-<slug> rule.
• An agent-<slug> rule whose host belongs to another tenant's agent stays until that agent reconciles.
• Provisioning fails, naming both hosts, when a rule under the agent's name points at another service.

Observability

• Trigger spans and agents.StartRun carry kora.trigger.name alongside kora.trigger.id.
• The chat {model} span carries gen_ai.usage.* token counts and gen_ai.response.model. gen_ai.request.model stays kora's model name.

Agent CLIs

• Claude Code in the session manager is 2.1.316.

Hades @runkora/hades@0.12.0-rc.2, SHA-256 2e3764465431122c435452fa7c80ec85ea15d99094f6806780195167753f9f4f. Release candidate: the package is not published.

What's Changed

• build(deps): bump the base-images group across 3 directories with 3 updates by @dependabot[bot] in #895
• build(deps): bump the agent-clis group in /backend/cmd/session-manager/agent-clis with 2 updates by @dependabot[bot] in #896
• build(deps): bump the go-modules group in /backend with 19 updates by @dependabot[bot] in #897
• build(deps): bump the frontend group in /frontend with 29 updates by @dependabot[bot] in #898
• docs: update references to HTTP server span error status by @runkora[bot] in #899
• feat(observability): put kora.trigger.name on trigger spans by @runkora[bot] in #903
• fix(inferencegw): put token usage on the chat span under kora's model name by @runkora[bot] in #905
• fix(charts): regenerate chart READMEs at release and add values section to kora-crds by @FalcoSuessgott in #906
• fix(agents): name agent DestinationRules per tenant by @justinwilkin in #912
• docs(identity): PRD and ADR for tenant switching by @justinwilkin in #907
• feat(identity): tenant hint, eligible set and tenant switch exchange by @justinwilkin in #908
• feat(frontend): tenant picker, account menu switcher and consent tenant by @justinwilkin in #909

Full Changelog: v0.12.0-rc.1...v0.12.0-rc.2

v0.12.0-rc.1

Upgrade notes

Agents

• Agent runs execute under a Landlock allowlist. Only the harness binary, kora-shell, kora-runtime-mcp and their ELF interpreter can execute.
• The new agents.landlock chart value defaults to enforce. On a node whose kernel lacks Landlock ABI v2, the agent pod fails readiness and its session-manager log names the setting. Set bestEffort only where the node kernel has no Landlock.
• kora-shell refuses a command when the run has no sandbox and tells the agent to call provision_sandbox. It no longer falls back to local bash and refuses an interactive shell.
• agents.config.nodeMaxOldSpaceMB is removed. No process a run starts honoured it.

Observability

• Each agent run is one trace. The run resource returns trace_id when the run was sampled.
• The new global.observability.traceUrlTemplate chart value sets the trace viewer link on the run page, with {trace_id} as the placeholder. Empty shows no link.
• The ingress gateway removes traceparent and tracestate from client requests. A client trace no longer joins kora traces.
• Egress gateway CONNECT spans carry a span link to the run trace.
• Failed spans carry error.type. Server spans fail only on 5xx.
• Span names and attributes follow one vocabulary across services. Dashboards and queries built on earlier span names or attributes need updating.

Harnesses

• Claude Code through the Bedrock gateway runs with tool search disabled.
• Codex sees runtime MCP tools through the Anthropic Responses bridge.
• OpenCode search tools work offline. The session-manager image ships ripgrep.

Hades @runkora/hades@0.12.0-rc.1, SHA-256 23ec2394399f6c4c170b9597bb25a45ecfbddfc08095d313c980f0aa85358b3a. Release candidate: the package is not published.

What's Changed

• docs(guides): clarify white-labelling version compatibility and rollout by @QjStout in #862
• fix(frontend): label model gateway catalog toggles by @runkora[bot] in #843
• fix(sandbox-exec): serialize stream Send across stdout and stderr pipes by @runkora[bot] in #838
• fix(session-manager): disable Claude Code tool search on Bedrock gateway by @runkora[bot] in #869
• fix(session-manager): ship ripgrep so OpenCode search tools work offline by @runkora[bot] in #874
• fix(inferencegw): keep namespace tools in the Anthropic Responses bridge by @runkora[bot] in #875
• docs(adr): make the sandbox the only place a run executes commands by @justinwilkin in #870
• fix(agents): run agent commands only in the sandbox by @justinwilkin in #871
• feat(agents): confine agent execution with a Landlock allowlist by @justinwilkin in #872
• chore(agents): remove the Node heap setting by @justinwilkin in #877
• test(agents): cast token parameters in the run usage totals fixture by @justinwilkin in #886
• docs(adr): amend triggers ADR source principal id to trigger-source: by @runkora[bot] in #878
• fix(frontend): override glob and minimatch to clear open advisories by @runkora[bot] in #884
• feat(local): add a local LGTM stack for traces by @justinwilkin in #863
• fix(observability): correct span parents, route names and error status by @justinwilkin in #864
• fix(observability): trace units of work instead of idle loops by @justinwilkin in #876
• refactor(observability): one span vocabulary across services by @justinwilkin in #879
• feat(observability): trace each agent run as one trace by @justinwilkin in #881
• build(deps): bump the go-modules group in /backend with 13 updates by @dependabot[bot] in #827
• refactor(observability): set error.type on every failed span by @runkora[bot] in #887
• fix(edge): drop untrusted trace context at the ingress gateway by @runkora[bot] in #888
• feat(egressgw): link egress spans to the run trace by @runkora[bot] in #889

Full Changelog: v0.11.3...v0.12.0-rc.1

v0.11.3

Upgrade notes

Inference gateway

• Non-streaming POST /v1/messages responses return the provider's response body unchanged. Responses no longer carry SDK zero values such as toolset_name: "" on tool_use blocks or stop_details.type: "refusal" on every message.
• Claude Code runs through Bedrock no longer end with empty_response after a tool call. Bedrock rejected the replayed tool_use block with a 400.

Hades @runkora/hades@0.11.3, SHA-256 16278367e29ff7ca8bb4f49115d6a88a2b64340396687bbaa0bebdb2458b345c. Published to GitHub Packages.

What's Changed

• fix(inferencegw): write the provider's bytes for non-streaming messages by @seanson in #861

New Contributors

• @seanson made their first contribution in #861

Full Changelog: v0.11.2...v0.11.3

v0.11.2

Upgrade notes

Agents

• Re-applying an Agent whose scopes name an agent that does not exist yet now waits for that agent. The Agent reports pending with the missing scope in its status message and retries every 30 seconds. Before, the Agent reported Ready=True and its grant kept the old scopes.

Hades @runkora/hades@0.11.2, SHA-256 ea7904cb959c806ef3b47165b2b14c70206fdb8d46ced2fafbd260557555e930. Published to GitHub Packages.

What's Changed

• docs: name runkora at the first mention on each published page by @justinwilkin in #858
• fix(agents): fail a declared agent update when its grant is refused by @runkora[bot] in #857

Full Changelog: v0.11.1...v0.11.2

v0.11.1

Upgrade notes

Console

• The console's session cookie drops Secure when the console URL is http:// on localhost or a *.localhost name. Safari keeps the cookie on that origin, and sign-in works. HTTPS consoles and HTTP on any other host keep Secure.
• The frontend reads its own URL at runtime from KORA_APP_URL. The chart sets it from frontend.config.nextPublicAppUrl.

Agents

• The chart no longer has agents.workloads.sessionManager.serviceAccount.annotations. Agent pods carry no cloud identity annotations. Remove the value from your overrides.

Connections

• A kubernetes Connection must set baseHost. A Connection without it is rejected at apply time with a clear error, where before the CEL evaluation itself failed.

Hades @runkora/hades@0.11.1, SHA-256 85fa162253933af802397cd48ad02dfc30350cbeee22723212d7e8b9c7e92e26. Published to GitHub Packages.

What's Changed

• fix(operator): require baseHost on kubernetes Connections by @runkora[bot] in #853
• fix(agents): remove agent ServiceAccount cloud identity setting by @runkora[bot] in #841
• fix(frontend): allow the session cookie on http localhost in Safari by @runkora[bot] in #854

Full Changelog: v0.11.0...v0.11.1

v0.11.0

Hades @runkora/hades@0.11.0, SHA-256 b7250e9ff72338e362fb3a338b452f522998fda3a3df68858ccd90700c62f53b. Published to GitHub Packages.

What's Changed

• docs: update the console screenshots in the README by @justinwilkin in #747
• docs: use the full-resolution console screenshots in the README by @justinwilkin in #749
• ci: stop publishing the kora-example image by @justinwilkin in #750
• ci: publish OpenSSF Scorecard results and add the README badge by @justinwilkin in #751
• ci: sign releases keyless with the release workflow identity by @justinwilkin in #752
• fix(frontend): bump vitest and override zod to clear open dependency advisories by @runkora[bot] in #754
• fix(frontend): bump overrides to clear open dependency advisories by @runkora[bot] in #755
• ci: sign the release assets and attach SLSA provenance by @justinwilkin in #756
• ci: attest release provenance with attest-build-provenance by @justinwilkin in #757
• docs: PRD and ADR for declarative resources by @justinwilkin in #758
• feat(agents): soft delete agents and keep their run history by @justinwilkin in #759
• feat(triggers): keep triggers when their source is deleted by @justinwilkin in #760
• feat: declarative resource CRDs and the declared-item contract by @justinwilkin in #761
• feat(inference-gateway): declared virtual models by @justinwilkin in #762
• feat(triggers): declared trigger sources and triggers by @justinwilkin in #764
• feat(agents): declared environments and agents by @justinwilkin in #763
• feat(policy-service): declared roles and tenant budgets by @justinwilkin in #765
• feat(operator): project declared resources into their owning services by @justinwilkin in #766
• feat(dashboard): show declared items as managed in git and lock authoring by @justinwilkin in #767
• docs: guide and local examples for declarative resources by @justinwilkin in #768
• docs: title the user-facing pages runkora by @justinwilkin in #771
• docs: make register-mcp-server example pass restricted admission by @runkora[bot] in #732
• fix(frontend): show the agent's own model, tools and connections read-only by @runkora[bot] in #780
• fix(frontend): show Agents nav entry for per-agent read scopes by @runkora[bot] in #775
• fix(frontend): truncate the Managed by badge on agent cards by @runkora[bot] in #776
• fix(frontend): fill agent overview stat row when usage is hidden by @runkora[bot] in #777
• refactor(operator): generate deep copies and CRDs for the remaining kinds by @runkora[bot] in #778
• fix(frontend): bump @storybook/nextjs to 10.6.3 for Next 16.4 page stories by @runkora[bot] in #782
• fix(sessionmanager): fall back to message when summary has no text block by @runkora[bot] in #784
• docs: drop the private-repository wording from the install and Hades docs by @justinwilkin in #753
• fix(backend): bump cel-go to 0.30.0 to clear GO-2026-6094 by @runkora[bot] in #785
• feat(identity): bind tenants to an ID token claim so tenants can share an email domain by @runkora[bot] in #787
• fix(egressgw): serve signed release-asset reads without connection selection by @runkora[bot] in #792
• fix(triggers): retry trigger token mint before failing a dispatch by @runkora[bot] in #791
• fix(egress): tunnel TLS on non-443 ports by SNI and dialled port by @justinwilkin in #812
• feat(triggers): generic webhook source by @justinwilkin in #807
• feat(frontend): generic webhook source in the trigger console by @justinwilkin in #808
• docs: PRD and ADR for generic webhook sources by @justinwilkin in #810
• docs: add the quickstart and agent factories to the README by @justinwilkin in #821
• fix(make): poll for kora-identity OIDC init in cluster-deploy by @Burke287 in #823
• build(deps): bump the base-images group across 3 directories with 3 updates by @dependabot[bot] in #824
• build(deps): bump the agent-clis group in /backend/cmd/session-manager/agent-clis with 2 updates by @dependabot[bot] in #825
• build(deps): bump the actions group with 4 updates by @dependabot[bot] in #826
• docs: split the deployment guide into task guides by @justinwilkin in #837
• fix(backend): bump go-jose to clear GHSA-mgcc-cww5-fp2q by @runkora[bot] in #829
• fix(frontend): bump qs override to clear GHSA-6pq8-jhm2-2vcw by @runkora[bot] in #830
• docs: update ADR index for egress gateway amendment 6 by @runkora[bot] in #831
• fix(build): hold the session-manager image at Node 24.22.0 for the arm64 release build by @justinwilkin in #839
• fix(build): revert the agent CLI bump that breaks the arm64 session-manager build by @justinwilkin in #845
• build(ci): build arm64 images on native runners instead of under QEMU by @justinwilkin in #846
• fix(ci): clear the target tags when pushing release images by digest by @justinwilkin in #847
• fix(ci): read the platform digest without passing the full bake metadata by @justinwilkin in #848
• fix(ci): fix the image merge digests and the per-target layer cache by @justinwilkin in #849
• fix(frontend): take session tenant from the issued token by @runkora[bot] in #851

New Contributors

• @Burke287 made their first contribution in #823

Full Changelog: v0.10.0...v0.11.0

v0.11.0-rc.14

Hades @runkora/hades@0.11.0-rc.14, SHA-256 54c51552199730512acec5788e26dc0e0e5b21ca1ded03a62f4a8956c372f126. Release candidate: the package is not published.

What's Changed

• fix(frontend): take session tenant from the issued token by @runkora[bot] in #851

Full Changelog: v0.11.0-rc.13...v0.11.0-rc.14

v0.11.0-rc.13

Hades @runkora/hades@0.11.0-rc.13, SHA-256 0b5bc14c9c8e1b57bf52551b2f08279e69c8319fe19c38e2c5188bb255f658cc. Release candidate: the package is not published.

What's Changed

• docs: add the quickstart and agent factories to the README by @justinwilkin in #821
• fix(make): poll for kora-identity OIDC init in cluster-deploy by @Burke287 in #823
• build(deps): bump the base-images group across 3 directories with 3 updates by @dependabot[bot] in #824
• build(deps): bump the agent-clis group in /backend/cmd/session-manager/agent-clis with 2 updates by @dependabot[bot] in #825
• build(deps): bump the actions group with 4 updates by @dependabot[bot] in #826
• docs: split the deployment guide into task guides by @justinwilkin in #837
• fix(backend): bump go-jose to clear GHSA-mgcc-cww5-fp2q by @runkora[bot] in #829
• fix(frontend): bump qs override to clear GHSA-6pq8-jhm2-2vcw by @runkora[bot] in #830
• docs: update ADR index for egress gateway amendment 6 by @runkora[bot] in #831
• fix(build): hold the session-manager image at Node 24.22.0 for the arm64 release build by @justinwilkin in #839
• fix(build): revert the agent CLI bump that breaks the arm64 session-manager build by @justinwilkin in #845
• build(ci): build arm64 images on native runners instead of under QEMU by @justinwilkin in #846
• fix(ci): clear the target tags when pushing release images by digest by @justinwilkin in #847
• fix(ci): read the platform digest without passing the full bake metadata by @justinwilkin in #848
• fix(ci): fix the image merge digests and the per-target layer cache by @justinwilkin in #849

New Contributors

• @Burke287 made their first contribution in #823

Full Changelog: v0.11.0-rc.6...v0.11.0-rc.13

v0.11.0-rc.6

Upgrade notes

Egress

• A connection to an upstream on a port other than 443, such as a Kubernetes API server on 6443, works from a sandbox. List the port in egressGateway.upstreamPorts.
• TLS whose SNI is a DNS name, on a port without its own sandbox listener, matches hostname posture. A hostname grant covers that host on every port.
• Raw TCP and TLS to an IP literal on those ports keep IP posture.
• A server-first protocol on an outbound port waits up to 1s before it is forwarded.
• The egress gateway refuses loopback, unspecified and link-local upstream addresses with 403.
• The egress gateway refuses a CONNECT authority that is not exactly a hostname or IPv4 address and one port with 400.
• The sandbox egress check probes a connection's own port. Sandboxes for agents with a non-443 connection no longer wait 90 seconds.
• Signed GitHub release-asset downloads succeed for an agent that holds more than one GitHub connection. They use no connection credential.

Triggers

• A generic webhook source accepts events from any service, verified by bearer token, HMAC-SHA256 or Standard Webhooks. Create one in the console or as a TriggerSource with provider: generic.
• A trigger retries minting its token before it fails a dispatch.

Tenants

• Tenants can share an email domain when each sets oidc.claimBinding on the same issuer and client.
• The operator marks a tenant Invalid when it claims an email domain an older tenant already holds without a claim binding.
• A person whose token matches more than one tenant cannot sign in.

Runs

• A run whose model returns only a thinking block gets its summary from the first line of its prompt.

CRDs

• Six more CRDs are generated from code. Their status conditions carry the standard reason and message limits. Upgrade kora-crds with kora.

Security

• cel-go 0.30.0 clears GO-2026-6094.

Hades @runkora/hades@0.11.0-rc.6, SHA-256 fa8dd2a44fbd0830b30adb18b190a507c06db4e31f575fc5346e352a1911de7d. Release candidate: the package is not published.

Hades @runkora/hades@0.11.0-rc.6, SHA-256 fa8dd2a44fbd0830b30adb18b190a507c06db4e31f575fc5346e352a1911de7d. Release candidate: the package is not published.

What's Changed

• refactor(operator): generate deep copies and CRDs for the remaining kinds by @runkora[bot] in #778
• fix(frontend): bump @storybook/nextjs to 10.6.3 for Next 16.4 page stories by @runkora[bot] in #782
• fix(sessionmanager): fall back to message when summary has no text block by @runkora[bot] in #784
• docs: drop the private-repository wording from the install and Hades docs by @justinwilkin in #753
• fix(backend): bump cel-go to 0.30.0 to clear GO-2026-6094 by @runkora[bot] in #785
• feat(identity): bind tenants to an ID token claim so tenants can share an email domain by @runkora[bot] in #787
• fix(egressgw): serve signed release-asset reads without connection selection by @runkora[bot] in #792
• fix(triggers): retry trigger token mint before failing a dispatch by @runkora[bot] in #791
• fix(egress): tunnel TLS on non-443 ports by SNI and dialled port by @justinwilkin in #812
• feat(triggers): generic webhook source by @justinwilkin in #807
• feat(frontend): generic webhook source in the trigger console by @justinwilkin in #808
• docs: PRD and ADR for generic webhook sources by @justinwilkin in #810

Full Changelog: v0.11.0-rc.5...v0.11.0-rc.6

v0.11.0-rc.5

Upgrade notes

Console

• The sidebar shows Agents to a person who can read any agent, including through per-agent scopes such as agents:types:<slug>:read.
• The sidebar shows Connections only to a person who holds platform:connections:read.
• A person who can read an agent but not edit it sees the agent's model, framework, system instructions, MCP tools and connections as read-only text, whatever their own access.
• Agent cards truncate a long "Managed by" repository name.
• The agent overview fills its stat row when the viewer cannot see usage.

Hades @runkora/hades@0.11.0-rc.5, SHA-256 7c22ff4b2316842af18fc51672e1ec8a1de841081f119f335ec2b086c6c8489d. Release candidate: the package is not published.

What's Changed

• docs: make register-mcp-server example pass restricted admission by @runkora[bot] in #732
• fix(frontend): show the agent's own model, tools and connections read-only by @runkora[bot] in #780
• fix(frontend): show Agents nav entry for per-agent read scopes by @runkora[bot] in #775
• fix(frontend): truncate the Managed by badge on agent cards by @runkora[bot] in #776
• fix(frontend): fill agent overview stat row when usage is hidden by @runkora[bot] in #777

Full Changelog: v0.11.0-rc.4...v0.11.0-rc.5