MCP Runtime v0.12.1

MCP Runtime v0.12.1 delivers a macOS Adapter desktop preview with a persistent per-user daemon, isolated profile URLs, and client configuration installs for Cursor, Codex, Claude Code, and VS Code.

Download MCPRuntimeAdapter-unsigned-preview.zip, unzip it, move the app to Applications, and choose Install and start. This desktop build is an unsigned preview; Developer ID signing and notarization are not configured. macOS may require allowing it in System Settings → Privacy & Security. The archive supports Apple Silicon and Intel and includes its service CLI. Release assets include a universal CLI and SHA256SUMS.

The website links directly to the desktop download. On macOS 13+, the shell installer also accepts --with-desktop to install the CLI and app together in your user directories, with release checksum verification and existing-app preservation.

Sign in with mcp-runtime auth login, then add a profile using the platform server name and an active Agent ID. Profiles show OAuth required when enabled by the server; complete OAuth in your MCP client separately from certificate enrollment. Advanced settings support alternate namespaces and full custom MCP endpoints. Use Connect your agent to install/export the complete configuration, including its local profile credential.

Breaking local adapter change: the old top-level adapter profile commands are removed. Recreate older profiles with adapter service profile or the desktop app and replace client configs with the new per-profile credential. Existing platform sessions are not automatically revoked. Certificate renewal cannot extend the session's authorized expiry. No platform database reset is required by this release.

Agent details now show creator and team ownership, visible session lifecycle, recorded certificate issuance, and exact-agent MCP tool-call analytics. Certificate recording starts with this release; older/unrecorded issuance is unknown, and one session can have several certificates. Activity and certificate tables state their time window and visibility limits. This uses the existing audit store and needs no platform database reset; deploy the platform components together to use the new views.

Go builds use 1.26.10 for the crypto/x509 security update. Service controls now locate the bundled CLI correctly; Codex config uses valid TOML escaping and preserves incompatible existing entries; local secrets and LaunchAgent files use private atomic writes.

See the client connection guide and full changelog. Authenticated Cully OAuth callback and sleep/wake acceptance remain unverified for this desktop preview.

This release also adds inline Team member/owner and associated Agent information, plus server-detail install actions for Claude, Claude Code, Codex, Cursor and VS Code. The hosted deployment workflow now enforces its target cluster identity and verifies a protected configuration/TLS snapshot before update; it preserves existing mcp-auth by default.

v0.12.0 publication was returned to draft after its Windows CLI build failed. Its original tag is preserved. v0.12.1 removes the cross-platform build dependency and builds all five distributed CLI targets in CI and pre-release checks. No additional platform setup or database reset is required.

MCP Runtime v0.11.1

This patch release restores authenticated MCP calls on installs upgraded to
0.11.0 and makes upgrade failures easier to diagnose. Update the gateway and
operator images together with mcp-runtime update. Stored http platform
analytics ingest URLs in MCPServer specs are replaced by the operator's HTTPS
default automatically, so no manual spec edit is needed. Do not set
OAUTH_INTERNAL_ISSUER_URL on public or production installs. No new setup
migration is required beyond the 0.11.0 notes.

Fixed

• Platform updates retain resource-history access on enforcing CNIs by deriving kubelet egress from setup's serving trust and current node UID/InternalIP pairs. Stale and unrelated destinations are removed; missing trust permits no kubelet egress, and invalid/unreadable trust stops the update. Rerun setup to establish trust for replaced nodes (#832).
• Release image source verification ignores inherited Git environment variables so the selected --source checkout and index are checked directly. Its Git test fixture also isolates temporary repository writes from commit-hook metadata (#843).
• Gateway idempotency admission reserves tombstone capacity for in-flight requests, keeping the per-session limit bounded when concurrent calls finish with ambiguous or non-replayable outcomes. Existing protected keys remain available; new keyed calls receive 429 idempotency_capacity while the session's remaining tombstone slots are reserved (#842).
• The operator derives the analytics ingest URL instead of trusting a stored one. An MCPServer whose spec.analytics.ingestURL still holds the plain-http platform ingest URL written by an older release (mcp-ingest.<namespace>.svc[.cluster.local] or the operator's own ingest host) now uses the operator's HTTPS default, so the server reconciles and rolls instead of failing with managed analytics transport requires an HTTPS ingest URL. No manual edit is needed; external http URLs and URLs with embedded credentials are still rejected.
• MCP gateway OAuth issuer discovery and JWKS fetches use the system trust store again instead of the analytics ingest CA, so authenticated requests to servers with a public HTTPS issuer no longer fail with 503 oauth_provider_unavailable (regression in 0.11.0). Analytics ingest TLS is unchanged and still pins the internal CA.

Changed

• mcp-runtime update migration guards now name the exact next command (mcp-runtime setup from the target release with the install's existing options, then mcp-runtime update) and link to the new upgrade troubleshooting section. Behavior and when the guards fire are unchanged.
• Docs: add a 0.11.0 to 0.11.1 upgrade note and troubleshooting for 503 oauth_provider_unavailable, the managed analytics transport requires an HTTPS ingest URL operator error, the token audience migration guard order, and rolling back a hand-imported image. State that production must not set OAUTH_INTERNAL_ISSUER_URL.
• Docs: correct the GET /api/v1/runtime/servers description: in public platform mode anonymous callers receive the public catalog namespace only.

MCP Runtime v0.11.0

[0.11.0] - 2026-10-19

This breaking release binds platform login tokens to platform-api and exchanges
them for short-lived single-audience runtime and analytics tokens. Sign in again
after setup. Image-only updates do not migrate the split Ingress routes.
Existing plaintext analytics installs need an encrypted backup, fresh TLS setup,
and restore before image updates. Production workload identity requires a
dedicated issuer; preserve registry trust and the current mcp-auth deployment.
Scoped Grafana and the new ingress isolation need an enforcing CNI. Credential
broker providers other than Kubernetes Secrets stay disabled. Rerun setup or
update so ingest, the gateway, the operator, and the APIs move together.

Security

• Credential resolution no longer holds the platform-wide session lock while reading a provider, so a slow provider cannot stall session revocation. State is re-validated after the read, a revocation during it denies the request, and requests are rate limited (cold tokens only, per source address and globally, before TokenReview; verified tokens are cached by hash for 10 seconds and renewable for 60 seconds through a per-token budget, definite rejections for 5 seconds, and transient TokenReview errors are never cached, so invalid traffic cannot deny valid gateways; per server after authentication), and a binding or source replaced with the same revision during the read is detected by full-content comparison, with a 5-second negative cache for provider failures; excess requests receive 429. Credential source version accepts only letters, digits, _ and - (#260).
• Dashboard session-proxy responses are always Cache-Control: no-store (upstream cache headers and validators are dropped), and oversized write bodies return 413 request_too_large instead of a generic 502 upstream_error.
• Encrypt non-test analytics traffic with Kafka mutual TLS, verified ClickHouse TLS and HTTPS ingest, preserving the infrastructure CA and using renewable service certificates. Existing plaintext Kafka installations require encrypted backups, fresh TLS setup and restore before image updates; explicit local test mode retains plaintext (#110).
• Setup outside test mode refuses to import or preserve existing platform credentials whose value is the changeme example placeholder, naming only the Secret and key. Replace the value with a unique secret and rerun setup; setup never rotates it silently, and test mode is unchanged (#110).
• Ingest binds audit attribution for projected ServiceAccount callers to the verified Pod and its UID-checked controller chain to the current MCPServer, rejecting unbound tokens and events whose server, namespace or UID disagree (403 attribution_mismatch). Service-key and OIDC callers are unchanged. Apply the release's k8s/06-ingest.yaml (rerun setup/update) so ingest can read the ownership chain; until then projected-token events are rejected (#110).
• The dashboard session proxy no longer lets a percent-encoded ? or # in a path segment truncate the upstream path after the write allowlist approved it (for example turning a team-member removal into a team delete). The decoded path is now sent verbatim; runtime-api authorization still applies to every request.
• MCPServer ingress policies isolate raw upstream listeners for adapter and non-adapter gateways and restrict gateway metrics to Prometheus. Namespace generic Deployment allowances no longer broaden stamped MCPServer pods; deploy the matching runtime API/operator and complete policy/workload reconciliation on an enforcing CNI before relying on the boundary (#110).
• Ingest refuses startup without an authentication source and denies unconfigured intake. Public runtime probes omit initialization details. Login rate limits and audit IPs use the socket peer unless MCP_TRUSTED_PROXY_CIDRS explicitly identifies trusted forwarding proxies; configure precise proxy CIDRs to retain client attribution behind ingress (#110).
• Session CSR and issued-certificate validation reject hidden SAN identity types and unknown extended key usages. The disposable issuer-approval rehearsal now uses the reviewed cert-manager/approver versions and refuses existing cluster names (#538).
• Restrict bundled Kafka ingress to ingest, processor, topic initialization and broker peers. Unscoped platform updates apply this release-declared policy to existing installs as well as fresh setup (#775, #110).
• Platform login tokens now authorize only platform-api. Gateway and UI proxies exchange them for runtime/analytics tokens with one audience and a maximum 60-second lifetime; direct cross-service and multi-audience bearer replay is rejected. Deploy the matching APIs, UI, Traefik configuration and split Ingress rules together through setup, then sign in again; image-only updates do not migrate existing ingress routes (#325).

Added

• Namespace-scoped credential bindings deliver approved Kubernetes Secret credentials to authorized tool calls without exposing values through management APIs. The CLI manages metadata and exact Kubernetes Secret permissions. Enable with a supported setup refresh and an HTTPS broker origin; credential-enabled servers require matching schema-v6 gateways, current managed-agent sessions and same-Pod upstream delivery (#260).

• Opt-in Idempotency-Key header for governed tools/call requests: keys are scoped to the verified principal, session and MCPServer UID, identical retries replay the stored reply (Idempotency-Replayed: true) only after fresh authorization, a conflicting request returns 409, and an ambiguous upstream outcome is never re-executed. Streaming, content-encoded or oversized replies are not replayable, per-scope and per-principal quotas evict only completed replies (never in-flight entries or ambiguous-outcome tombstones), delegated-header servers are rejected, state is per gateway sidecar (5 minute TTL, bounded), and requests without the header are unchanged. See the design note (#110).

• Contributor performance checks add policy/rule, platform bearer, session/certificate and TLS microbenchmarks, plus bounded Kind-only gateway/direct overhead, concurrency plateau and exact-trace audit visibility measurements. Baselines require matching environment/traffic fingerprints; analytics scenarios now require an explicit admin test API key via PERF_API_KEY. Recorded live baselines and historical proxy comparisons remain pending (#692).

• Admin sizing dashboards and E2E reports collect authenticated kubelet node/container CPU, working memory, filesystem, network and driver-reported volume history, alongside separate requests/PVC reservations and collection overhead. Existing installs require supported setup refresh for public serving trust and the projected scrape token; missing volume statistics remain explicit and retain local sampling fallback (#680).

• The account menu links to My workspace, with actual team memberships, authorized management links, visible versus manageable servers, personal access and clearly scoped activity. Administrators have a separate Platform overview with complete directory totals, server failures, health and audit links; deployment attribution remains explicitly unavailable for historical servers (#542).

• Access grants support monitor mode through the CLI and dashboard, recording would-deny tool, trust and side-effect decisions without bypassing identity, session or matching enforcing-grant checks. Monitor policies require schema-v5-capable gateways (#307).

• adapter enroll checks the operator's adapter-certificate configuration, matching workload issuer/trust domain, issuer readiness, and the selected route's actual client-certificate TLSOption before creating a session. Enrollment completion preserves concurrent revocation, and failure cleanup conditionally removes only the caller's pending session. update installs the required read-only preflight permissions while preserving the operator's existing on/off choice (#539).

• Team user creation no longer accepts passwords as command-line arguments; it prompts for a hidden, confirmed password or accepts it through stdin. The CLI can remove team memberships with explicit confirmation before removing a team's only owner. Administrators can permanently deactivate disposable accounts with user deactivate <id> --yes, atomically revoking stored credentials and human sessions, removing memberships and recording audit while protecting sole owners/admins. Bearer requests now resolve current account and membership state through platform identity; deploy the platform, runtime and analytics APIs together, and retain their internal identity connectivity (#536).

• Per-user macOS adapter service controls, isolated owner-protected profiles and a native Dock companion expose local readiness, upstream authentication and bounded diagnostics. Source packaging supports Apple Sil...

MCP Runtime v0.10.0

This breaking release moves runtime sessions from Kubernetes policy documents to Postgres-backed platform storage and server-scoped gateway synchronization. Policy schema v4 requires matching platform-api, runtime-api, operator and gateway versions. Use the v0.10.0 CLI and a backed-up fresh setup; an images-only update is insufficient for the new sync listener, projected tokens and network/RBAC wiring. Preserve platform databases, registry images, required Secrets and certificates, and external identity-provider data/TLS state. Restore required application data, restart platform-api after any Postgres restore, redeploy servers through the CLI, and re-enroll adapters: old Kubernetes sessions are intentionally not imported. Deleted session names remain reserved. Rehearse recovery before resetting the hosted platform; see the release deployment procedure.

Added

• Resource owners can look up one known recipient team and select its active agents or stable member IDs for time-bound cross-team grants; the form offers only recipient modes accepted by server validation. Gateway audit records expose actor and resource team IDs separately; grant-wide session revocation is atomic across linked namespaces, and directory outages report service unavailable rather than invalid membership (#469).
• Agent session details now link exact recorded authorizing grants, show visible lifecycle counts, and preview and verify deactivation impact. Admin gateway audit links open shared namespace-qualified grant/session details with server-filtered seven-day decision activity; missing attribution and partial failures are explicit (#549, #309).
• Platform-api now provides Postgres session persistence and a dedicated, server-scoped gateway sync audience with revocation tombstones, bounded change retention, restore epochs, and atomic agent deactivation. Gateways authenticate with Pod-bound projected tokens without database credentials or the shared internal token; runtime management and gateway authorization now use this storage in #659 (#718).

Changed

• Runtime sessions are persisted by platform-api in Postgres and synchronized into server-scoped gateway caches; session changes no longer rewrite policy ConfigMaps. Policy schema v4 requires matching updated gateways. Use the platform CLI/UI for sessions; direct --use-kube session management is rejected. Re-enroll adapters after upgrading rather than importing old Kubernetes session state. New adapter session names prevent retired certificates from naming replacement bindings (#659, #718).

Fixed

• Certificate E2E checks wait for transient Traefik route 404s only inside their explicitly enabled startup window after server recreation. Persistent routing failures still time out, and accepting a retired certificate still fails immediately instead of being retried (#752).

• Platform readiness reads the final HTTP status after bounded curl retries, so a recovered connection refusal no longer fails a healthy setup; failed probes, malformed status and non-200 responses still fail. Staging failure diagnostics continue collecting workload/configuration/certificate metadata when setup fails before API login (#750, #751).

• Post-setup platform API readiness tolerates a brief Service endpoint propagation delay after the deployment becomes Ready, while still failing after a bounded retry window (#748).

• The cross-team certificate E2E journey waits for initial Traefik TLS and session readiness instead of exiting on an early handshake failure; retries stay bounded and use the recipient certificate without forwarding a preceding fixture's OAuth token (#748).

• Platform API ingress accepts bundled and Helm/k3s Traefik pod labels and the analytics API authentication client, restoring public registry authentication and analytics requests while keeping the gateway session-sync port isolated from those callers (#718, #745).

• Retiring a server through the CLI or UI invalidates and removes its grants and sessions across namespaces, removes exclusively managed analytics credentials using namespace-scoped cleanup permissions that are repaired for CLI-applied servers, and reports cleanup failures for retry. Republishing the same server name cannot authorize delayed writes from its previous deployment; admins can retry retirement for already absent servers without removing shared pull credentials or audit history (#707).

• Administrators and team owners can manage or remove grants and sessions while a server is retiring, including after partial cleanup failures. New grant/session issuance remains blocked with an explicit conflict response, and ownership checks retain the retiring server's labels (#743).

• Certificate revocation E2E probes use the time remaining in their one-second observation budget instead of cancelling every HTTP request after 200 ms. They still reject late or incorrect denials and report transport/status metadata when the bound is missed (#744).

Security

• Deleted session names remain permanently reserved within their namespace so an old certificate cannot inherit a replacement session's access. After deletion, create a new session name or re-enroll the adapter; recreating a deleted name returns 409 Conflict, including after server retirement and republishing (#718).

Full changelog: v0.9.0...v0.10.0

Validation: PR CI and Pre-release Regression passed, including the disposable-VM installation and multi-team E2E suites.

MCP Runtime v0.9.0

MCP Runtime 0.9.0 adds gateway observability and filtered admin analytics, plus a public test-mcpsnoop example for inspecting real MCP request and response payloads. Server views now show gateway status, and analytics includes MCP methods, tools, server/team scope filters, request rates, latency/errors, callers, sessions, traffic, and trace links. mcp-runtime update now manages the org and public platform modes and their catalog namespaces.

Breaking change: platform mode tenant is removed. Use org as the default organization mode or public for public previews and public MCP hosting. Publishing scope tenant remains available for team-only servers; org is for the full organization. Update existing configurations that specify platform mode tenant before using this release.

The hosted reference platform was already running the reviewed candidate. This release publishes the Runtime CLI and platform manifest; it does not automatically redeploy the hosted platform. Existing data, certificates, and MCP Auth configuration are retained.

See the 0.9.0 changelog. PR: #740.

v0.8.1

MCP Runtime v0.8.1 makes a request debuggable end to end and teaches mcp-runtime update to deliver configuration, not just images.

v0.8.0 was tagged but its release workflow rejected the new manifest (third-party gateway pin and config-only components), so it has no assets; v0.8.1 is the same content with that check fixed and covered by a unit test. Use v0.8.1.

Correlated request debugging (#722, #728)

• Gateway stage spans, ingress and MCP-server tracing, and internal HTTP connection-phase events; managed ingress uses Traefik 3.7.14 with OTLP and JSON access logs.
• Runtime HTTP responses carry X-Trace-ID from the active span, with protection against upstream header overrides.
• Correlated completion logs with bounded namespace/server/tool and policy-version context, quiet healthy probes, and no headers, bodies or arguments.
• Bounded per-tool metrics with sampled trace exemplars on service and tool latency histograms; Grafana links trace to logs and metrics and exemplars to traces. See docs/request-debugging.md.

update delivers configuration (#730, #736)

• Applies the ServiceAccounts, RBAC, ConfigMaps (declared keys only), container flags and pod resolver options a release declares in config/release/wiring.yaml, restarts the workloads that read a changed ConfigMap, and restores the previous values if a rollout fails.
• Updates the platform gateway (Traefik), Prometheus and Grafana as config-managed components.
• update and setup accept --expect-cluster-id; setup refuses to drop or swap an installed MCP Auth server.
• hack/deploy/reference/rollout.sh and setup.sh are removed (a new minor version); use mcp-runtime update --to v0.8.1 --build --expect-cluster-id <uid> and mcp-runtime setup directly. backup.sh, restore.sh and reset.sh remain as recovery tools.

Security and fixes

• A tested cert-manager approver-policy set (config/cert-manager/approval-policies.yaml) and a Kind rehearsal: only the runtime API can obtain a session-bound identity certificate. Required before enabling MCP_ADAPTER_CERTIFICATES=true in production.
• Namespace pull credentials include the doctor smoke image, fixing the cluster diagnostics smoke checks (#732); platform APIs and the UI set resolver ndots: "3" (#706).

Upgrade: use the v0.8.1 CLI. There are no CRD changes and no full setup is needed. Rotate each namespace's pull credential once (mcp-runtime registry enable-auth --pull-namespace <namespace> --realm ...) so the diagnostics smoke image can be pulled.

See the changelog and the reference deployment guide.

Validation: CI and all 15 Pre-release Regression jobs, including strict-production staging, passed on the tagged revision.

v0.8.0

Superseded by v0.8.1. This tag has no assets: its release workflow rejected the new manifest (a third-party gateway image pin and config-only components), so the CLI binaries and platform manifest were never published. v0.8.1 has the same content with that check fixed and covered by a unit test. Use v0.8.1.

v0.7.2

MCP Runtime v0.7.2 restores usage analytics for MCP servers whose gateway sidecars were rejected by mcp-ingest, and teaches mcp-runtime update to deliver this kind of change.

• Gateway sidecars authenticate to mcp-ingest with a projected ServiceAccount token (audience mcp-ingest, validated by TokenReview, accepted only from the mcp-workload ServiceAccount) instead of a copied ingest API key. Servers whose key was missing or stale were answered with 401, which left the usage analytics dashboard empty.
• mcp-runtime update now applies the ServiceAccounts, RBAC and Deployment wiring a release declares in platform-manifest.json, in addition to images and CRDs. Declared RBAC is validated (no wildcard or escalate/bind/impersonate rules, platform namespaces only, bindings only to roles in the same bundle). Only differing objects are written, previous wiring is restored if a rollout fails, and --only skips objects and blocks workloads that need a missing ServiceAccount.
• cluster doctor adds ingest service account auth and gateway analytics delivery checks and updates gateway analytics credentials for projected tokens.
• Gateways count undelivered events in mcp_gateway_analytics_emit_failures_total, and k8s/11-prometheus.yaml adds the MCPGatewayAnalyticsEmitFailures alert.
• Go dependencies are updated across the root and service modules.

Upgrade: use the v0.7.2 CLI (older CLIs reject the new manifest fields) and mcp-runtime update --to v0.7.2; no full setup is needed. Running gateways pick up the token volume when the operator reconciles. The new Prometheus alert is a ConfigMap change that update does not apply, so it reaches an existing cluster on the next setup. There are no CRD changes.

Fixes #719 (implemented in #720) and #724 (implemented in #726).

See the changelog and reference deployment guide.

Validation: CI and all 15 Pre-release Regression jobs, including strict-production staging, passed on the tagged revision.

MCP Runtime v0.7.1

MCP Runtime v0.7.1 fixes registry authentication handling during full setup.

• Public registry ingress authentication remains enabled during image builds and publication, including failed builds.
• Setup reruns retain native registry token authentication, its certificate trust mount and ClusterIP-only Service.
• Platform setup preserves the registry token broker's signing configuration and Secret mount, plus the Runtime API native pull setting, before rolling workloads.
• Fresh public TLS setup authenticates registry pulls with a bcrypt-hashed bootstrap credential until platform-api is ready, then restores platform authentication and enables native tokens.
• Operator pull credentials are provisioned before rollout. Existing native scoped credentials are retained; missing native scopes fail closed instead of falling back to a platform admin key.
• Setup aborts when existing registry authentication cannot be inspected. Staging monitors anonymous registry access throughout setup.

This patch updates the CLI setup path and introduces no API or CRD contract changes. Use the v0.7.1 CLI for setup. Existing installation requirements introduced in v0.7.0 still apply; an image-only update does not apply those installation changes. Preserve existing data, Secrets and certificates and follow the reference deployment runbook when reapplying full setup.

Fixes #690, implemented in #691, and #694, implemented in #695.

See the changelog and reference deployment guide.

Validation: CI and QA E2E and all 15 Pre-release Regression jobs, including strict-production staging, passed on the tagged revision. Staging observed 386 anonymous registry probes during setup with no successful anonymous response.

MCP Runtime v0.7.0

This release enables native registry authentication by default for production-shaped
TLS installs and replaces static MCP-server ingress egress rules with policies
managed per server. These changes require a backed-up fresh setup of the hosted
reference platform; an image-only update does not apply the installation changes.
Preserve registry storage, required platform data, TLS/workload-issuer keys and the
external identity provider, then restore and verify using
Reference Deployment. Reissue registry pull
credentials rather than restoring old credentials. Verify authenticated pushes,
fresh platform and tenant image pulls, denied anonymous registry requests, server
routing and governed adapter calls before returning the platform to service.

Added

• QA E2E captures CPU, memory, disk and Grafana/Prometheus observations across setup and test stages, preserving missing samples and failed-run status in reports (#683).

Changed

• setup --test-mode deploys one replica per platform Deployment and StatefulSet, with a single Kafka controller/broker and replication factor 1, reducing local test resource requirements. Use --test-mode --test-multi-replica for the normal replica layout when testing redundancy or shared state. Use a fresh test cluster when changing Kafka replica modes; setup preserves existing stores by rejecting quorum changes. Contributor docs record macOS ARM64/Colima sizing and measurement conditions (#683).

• Breaking: The operator manages per-server Traefik egress policies for actual serving ports and reports TraefikEgressReady conditions. Fresh setup is required for the v0.7.0 reference deployment; the static policy no longer grants fixed ports into server namespaces (#630).

• Server cards show an OAuth badge only when the server reports OAuth support, and omit the badge when authentication support is unknown. Header credential labels remain available.

• Organization and Platform pages appear directly in the main console sidebar and compact navigation, eliminating the second administration sidebar. Navigation filtering and active states include each section.

Fixed

• Disposable staging adapter fixtures rotate pull credentials for their own server namespace instead of copying another namespace credential. HTTPS enrollment tests retain repository isolation (#687).

• Tenant image publishing selects the trusted registry helper namespace when native authentication is active, with namespace-scoped pod permissions. Staging probes negotiate scoped bearer tokens and verify image pulls with the owning namespace credential (#685).

• Package-docs startup bounds Go parallelism within the deployed process budget. CI tests under the same CPU, memory and process limits, and remote readiness probes use host HTTP rather than spawning another process in the container.

• First-install setup applies the requested registry PVC size before creation, checks Docker buildx before image builds, rejects partial password-admin credentials while preserving saved pairs, and propagates external TLS proxy UI settings. Rollout and registry-auth restoration tolerate bounded transient Kubernetes API failures; image uploads reject unsafe redirects with an HTTPS-origin diagnostic, and tenant setup prints membership steps (#666).

• The package-docs image uses the root module's Go toolchain version in its build and runtime stages, preventing startup failures after a Go requirement bump. Module requirement changes now run the package-docs PR smoke test.

• Setup reports the cert-manager version it actually installs, and repair guidance follows the installed release rather than a retired manifest; drift checks keep the pin, logs, and docs aligned (#628).

• Promtail uses the Kubernetes node name for pod discovery and streams labeled logs across platform and tenant namespaces instead of relying on a static-path fallback (#629).

• Ingest readiness serves a bounded, cached Kafka check with DNS/connect timing and failure metrics, and resolves cluster FQDNs directly using ndots:3 (#626).

• Grafana loads every bundled dashboard with stable datasource UIDs; cluster doctor detects persisted admin credential drift without revealing or resetting credentials (#631).

• update --build publishes bundled-registry images through an in-cluster helper using the selected kubeconfig, context and registry-auth client, avoiding host DNS failures and ambient-cluster credential selection (#679).

Security

• Breaking: Production-shaped TLS setup enables scoped backend registry authentication and narrows registry access to authorized ingress, publication helpers, and probes. Anonymous backend reads and writes are refused, leaked service keys are rotated and setup fails if activation fails. Lab/test HTTP installs retain explicit warnings about anonymous backends (#632).

• Platform images and modules build with Go 1.26.9 and golang.org/x/net v0.60.0. Those releases fix HTTP/2 CPU exhaustion from repeated window updates (CVE-2026-78669), excessive CPU from large Range headers (CVE-2026-78667), and memory exhaustion from malformed TLS ECH references (CVE-2026-97031).

Full changelog: v0.6.6...v0.7.0

Validation: Pre-release Regression passed, including disposable Staging E2E, on commit 307cc957eb09858198e3eb0a39c517cb7a662c68. The tagged candidate is merged into main with identical contents.