Skip to content

v0.59.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Oct 08:17
· 402 commits to main since this release
v0.59.0
e6b92b1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • A successful bootstrap now returns a skills manifest and skillDiagnostics, over REST and native /mcp.

  • Bootstrap now resolves org-scope skill assignments (OrgSkillAssignment) together with the agent's own; an org entry in skills has scope: "org". (#2141)

  • New operator page: who can connect to your Flair.

Changed

  • The Integration Tests CI job now runs as three parallel shards behind the same required check. (#2149, #2131)

Fixed

  • The launchd launcher and resolveInstanceServingPid now check the command line of the process hdb.pid names, not only that the pid is alive (flair#2056). (#2056, #1454)

  • Boot readiness recovery mocks now exit after parent loss or a bounded wait. (#2080)

  • The README's federation and REM feature rows now match what the code does (Closes #2093). (#2093)

  • Through the Agent resource, only an administrator or trusted internal call can set Agent.status; federated peers cannot change existing local principals' status (Closes #2108). (#2108)

  • flair mcp enable --cimd-allowed-hosts sets the list in the edited config.yaml only after a preflight match with the target; without --dry-run, a mismatch is refused.

  • flair mcp enable corrects stale setup messages; a Fabric re-run completes after target-issuer binding and public-origin self-verify pass. (#2116)

  • flair mcp disable now asks for the remote target's admin password via --admin-pass in its help and missing-password error. (#2121)

  • flair mcp enable now tells operators to restart Fabric or load verified pushed secrets when confirmation is pending. (#2129)

  • Release PR text explains automatic tagging and the admin fallback for a missed run (Closes #2132) (#2132)

  • flair mcp enable now matches the checked issuer to the target's own OAuth metadata before reporting a successful metadata check. (#2134)

  • flair mcp enable now describes the connector identity mapping without claiming unconditional reads or writes. (#2135)

  • The promote block's final check waits up to 120 s for the registry to show the new latest before it reports skew. (#2140)

  • The CLI's role update sends the role's id, so ensureFlairAgentRole and ensureFlairPairInitiatorRole can change an existing role on Harper 5.2.8. (#2154)

  • flair mcp disable reports the restart request without claiming the unchecked /mcp route is unmounted. (#2159)

  • flair agent add refuses an id that already has an Agent record, and reports success only after the stored public key matches.

    Heads-up: flair agent add <id> no longer finishes silently when that id already exists. A well-formed existing row names flair agent rotate-key <id> or flair agent remove <id>. An unreadable row exits without that remedy. flair agent rotate-key writes the new private key on the Flair host. The new key file must be on the signing host before that process can use it. Configure the signing process to use the local file, then restart it. flair agent remove tries to delete that agent's Memory and Soul rows.

Security

  • An XAA assertion's jti is recorded once per instance, under the same per-key lock as agent-auth and federation nonces. (#2073)

    Heads-up: a jti claim, when present, must be a nonempty string, and
    the assertion must then carry an exp no more than 24 hours (plus 30
    seconds of clock skew) ahead. Otherwise the grant is refused with
    400 invalid_grant.

  • Flair returns a named 503 for non-health requests when Harper reports multiple workers without the unsafe opt-in or cannot read the worker count.

    Heads-up: Set THREADS_COUNT=1 and restart Flair; investigate a worker count that remains unreadable.

  • A raised root dependency override for fastify moves the repo lockfile out of the affected ranges of five fastify advisories published 2026-09-30.

    Heads-up: npm installs still carry Harper 5.2.8’s Fastify 5.11.3 pin, so these five advisories remain allowlisted until Flair uses a Harper release outside their affected ranges. No upgrade action is required.

  • A root dependency override for @grpc/grpc-js moves the repo lockfile out of the affected ranges of GHSA-f596-whhp-79r4 and GHSA-m9gg-hp2v-232j.

    Heads-up: An install whose lockfile already records an affected version keeps it until that lockfile's @grpc/grpc-js entry changes.

Full record: CHANGELOG.md

Assets 2
Loading