Skip to main content

Release 0.5.51 — Okta Baseline Bootstrap, Slack Routing Performance, IdP Sync Observability

Erik Lutz
Erik Lutz
Sri Aradhyula
Sri Aradhyula

Released: 2026-07-13 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.51 Previous release: 0.5.50

Highlights​

0.5.51 fixes a critical gap where directory-synced users couldn't pass the AgentGateway ext_authz gate on their first login, hardens Slack event routing with per-stage timing logs and server-side OpenFGA filtering, and makes IdP sync progress observable through structured stage logs.

Bug Fixes​

Directory-synced users bootstrapped with baseline OpenFGA access​

The baseline OpenFGA grants required for a user to pass AgentGateway's coarse MCP ext_authz gate — specifically the mcp-gateway-call grant (user:<sub> caller mcp_gateway:list) — were only written by the interactive web-login path. Users provisioned by Okta directory sync (who may never have logged into the web UI) lacked these grants and were silently rejected at the gateway on their first API call. The sync now bootstraps baseline access before applying team-level grants, and member resolution is parallelized to keep the sync fast on large orgs.

(#2203)

Slack routing: unfiltered OpenFGA read causing slow event handling​

The Slack event pipeline was reading all OpenFGA tuples for a subject without server-side filtering, then filtering client-side by channel. On deployments with many channels per user this produced large tuple reads that added visible latency to every Slack event. Tuple reads are now filtered server-side by channel subject.

(#2210)

New Features​

IdP sync: per-stage progress logging​

The Okta/LDAP directory sync now emits structured log lines at each stage of a sync run — plan, reconcile, member resolution, and OpenFGA write — so operators can see where time is spent and diagnose stalls in large-org syncs without resorting to debug-level output.

(#2203)

Slack routing: stage timing logs at DEBUG level​

Lightweight stage-timing logs are added across the Slack event pipeline (middleware entry, RBAC context enrichment, mention/message handler entry, _route_to_agent entry, channel-match duration) at DEBUG level, making it possible to profile where delays accumulate between Slack event receipt and agent response.

(#2210)

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.50.

Upgrade Guide: 0.5.50 → 0.5.51​

No values changes required.

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.51 \
  -f your-values.yaml