Highlights
What this release added
- **Agentic tools phase 2 shipped:** code execution and image generation added to the explicit-invocation toolset with bounded outputs and visible result states.
- **Unified tool lifecycle:** queued/running/completed/failed/canceled states now emit consistently across search, document analysis, code execution, and image generation.
- **MCP foundation delivered:** connector registry, per-connector health/readiness checks, and per-user connector controls are now available in Settings.
- **Tool governance:** per-user agentic tool preferences, cost-tier visibility, and high-cost confirmation gating are enforced server-side across chat tool commands.
- **Reliability hardening:** agentic sessions persist in Postgres with cleanup/resume behavior, and production/performance validations are reproducible with seeded telemetry.
- **Sprint 42 verification package:** testing guide and report were added with full real-auth E2E (`20` passed, `0` failed, `6` skipped fixmes).
Fixes
What this release corrected
- Fixed fallback validation timeout handling and non-zero exit semantics so fallback regressions fail CI correctly.
- Removed redundant Journey layout server session lookup to reduce request overhead.
- Added explicit per-endpoint budget diagnostics to production validation checks.
- Fixed local signup friction by allowing non-production Turnstile bypass paths and aligning CSP for verification origins.
- Updated chat rate-limit integration mocks for the additional tool-settings DB read introduced by agentic settings enforcement.
- Hardened DB operations scripts with explicit environment targeting (`local`, `preview`, `production`) for migration and verification commands.
Known issues
What remained constrained
- `tests/e2e/share-flow.spec.ts` still contains three `test.fixme(...)` scenarios (share achievement, Stripe checkout, open-signup kill-switch) tracked as explicit Sprint 43 backlog items.
- Build may emit non-blocking MLflow warnings when `MLFLOW_TRACKING_URI` is unset.
- Two low-severity dependency vulnerabilities remain under normal maintenance tracking.