Skip to main content

Release 0.5.49 — Okta Sync Reliability, Tool Result Invariants, Mention-Only Onboarding Default

Erik Lutz
Erik Lutz
Sri Aradhyula
Sri Aradhyula

Released: 2026-07-10 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.49 Previous release: 0.5.48

Highlights​

0.5.49 makes Okta IdP sync resilient to invalid display names, already-linked identities, and event-loop stalls in large orgs; restores correct tool result invariants for dynamic agents on Bedrock; and changes the default channel/space onboarding mode to mention-only to prevent bots from responding to every message in newly connected channels.

New Features​

Animated header brand and navigation​

The header brand now shows a one-shot active-gradient sweep and sparkle finish on hover or keyboard focus, with a refreshed navigation layout.

(#2187)

Bug Fixes​

Okta IdP sync resilient to invalid names and already-linked identities​

Three reliability issues in the Okta IdP sync are fixed:

  • Invalid character 400s — display names like "Jane Doe (Contractor)" were passed directly to Keycloak's admin API, triggering error-person-name-invalid-character responses. Names are now sanitized before provisioning.
  • Already-linked identity errors — if a user already had a federated identity from a previous sync or manual SSO, the sync was failing instead of treating it as success. 409 and already-linked responses are now handled gracefully.
  • Event-loop stalls — the sync was blocking the async event loop during synchronous member passes for large orgs, causing health probe timeouts and apparent hangs. The loop now yields periodically during member resolution.

(#2190)

Dynamic agents tool result invariants restored​

A ValidationException was occurring on Bedrock Converse when an assistant toolUse reached the next model call without an adjacent toolResult. This was caused by the PatchToolCallsMiddleware not being applied to all code paths in the dynamic agents runtime. The invariant is now enforced consistently across all agent configurations.

(#2182)

Channel/space onboarding defaults to mention-only listen mode​

Slack channel and Webex space onboarding (bulk-apply defaults, single onboard endpoints, ghost-route materialization, and auto-assign of unmapped channels/spaces) now defaults new routes to listen: "mention" instead of listen: "all". Previously, onboarding a channel caused the bot to respond to every message posted there, which was unexpected in active team channels.

(#2192)

Keycloak lookup failures no longer masked as not-found​

Real Keycloak API errors (network failures, 500s) were being swallowed and surfaced as user-not-found responses, making it impossible to distinguish a missing user from an API outage. Errors are now propagated correctly.

(#2192)

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.48.

Behavioral note​

New Slack/Webex channel onboardings will default to mention-only mode. Existing configured channels are unaffected. To restore the previous all-messages behavior on new onboardings, set listen: "all" explicitly in the channel config.

Upgrade Guide: 0.5.48 → 0.5.49​

No values changes required.

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.49 \
  -f your-values.yaml