v0.6.0

Platform Orchestrator Helm chart 0.6.0

This release adds organization-scoped SCIM 2.0 provisioning. Identity providers
can create, update, deactivate, and reactivate users, synchronize groups, and
drive Platform Orchestrator role assignments through explicit group mappings.

Included versions

Component	Version
Control plane	v2.1.0
Data plane	v3.1.0
IAM	v2.3.0
Runner	v3.0.0
Console	v1.2.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• IAM implements the SCIM 2.0 service-provider discovery, Users, and Groups
  resources under /scim/v2/orgs/{org_id}.
• A dedicated, hashed service-user bearer token can be limited to the two SCIM
  provisioning permissions in one organization. Requests and directory results
  remain tenant-scoped.
• Deprovisioning revokes active sessions and device logins, prevents SSO and
  invitation paths from restoring access, and preserves memberships in other
  organizations.
• Organization owners can map SCIM groups to built-in or configurable roles by
  using /orgs/{org_id}/scim/group-mappings.
• Provisioning changes emit audit events over NATS.
• The IAM Gateway API route now exposes both the SCIM protocol and group-mapping
  management endpoints.

Upgrade

Upgrade normally from chart 0.5.0. The IAM database migrations run during
startup. SCIM is opt-in per organization, so existing authentication and role
assignments continue unchanged until an owner creates a token and configures an
identity provider.

Bearer tokens cannot be recovered after creation. Store each token in the
identity provider or a secret manager, rotate it if it is exposed, and use a
different token for every organization.

Qualification

• The final IAM tree passed 430 unit tests, 348 clean-database integration
  tests, the SpiceDB-to-Casbin upgrade and rollback test, go vet,
  golangci-lint, and govulncheck.
• SCIM user and group lifecycle, role mapping, deprovisioning, token rotation,
  tenant isolation, pagination, filtering, concurrent updates, and common
  identity-provider interoperability cases are covered by the integration
  suite.
• The audited image and feature chart were deployed to WX1 and exercised
  end-to-end before release.
• The chart route is protected by a rendered-manifest contract test.