The AI Toolchain — issue 011, August 30, 2026

Adds POST /api/findings/retest to actively re-check a single stored finding without launching a full target scan, and GET /api/findings/retest/{id} to poll the status and verdict (still_vulnerable, fixed, inconclusive) of a running or completed re-test job. Introduces an opaque auth_profile argument (primary / secondary / none) for per-job credentials that stay server-side and never appear in job state or tool schemas, and terminal jobs report a meaningful_attempt field with counts of request, affected-request, and affected-variant.

$ curl -s https://xalgorix.example.com/api/findings/retest/<id> \
  -H 'Authorization: Bearer <token>'

Adds XALGORIX_PPROF_ADDR environment variable to enable an opt-in loopback pprof debug server for runtime profiling, e.g. XALGORIX_PPROF_ADDR=127.0.0.1:6060 xalgorix.

$ XALGORIX_PPROF_ADDR=127.0.0.1:6060 xalgorix

Supports split-APK bundle formats (.apks, .xapk, .aab) and now accepts sparse APKs that were previously rejected.

Adds native web_search support via the MiniMax provider, routing web search queries through MiniMax's own search capability; adds a configurable Gemini safety threshold to support authorized security testing use cases; and adds recommendations for current frontier models.

Groq added openai/gpt-oss-20b and openai/gpt-oss-120b to the POST https://api.groq.com/openai/v1/chat/completions endpoint. openai/gpt-oss-20b is a 20B MoE model (32 experts) with 131K token context, 32K max output tokens, built-in browser search and code execution, structured output support, and ~1000+ TPS throughput. openai/gpt-oss-120b is a 120B MoE model (128 experts) with the same 131K context and 32K max output, the same built-in browser search, code execution and structured outputs, running at ~500+ TPS. Both support reasoning capabilities.

$ curl https://api.groq.com/openai/v1/chat/completions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "openai/gpt-oss-20b", "messages": [{"role": "user", "content": "Explain why fast inference is critical for reasoning models"}]}'

$ curl https://api.groq.com/openai/v1/chat/completions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "openai/gpt-oss-120b", "messages": [{"role": "user", "content": "Summarize this patient case and flag potential drug interactions"}]}'

Adds metadata_details: true request body field to POST /v1/chat/completions to embed provider attestation, timing, and job identity details directly in the JSON response body, useful when OpenAI-compatible SDKs hide raw HTTP headers. Also adds X-Darkbloom-Metadata-Details: true request header as an alternative opt-in for the same per-request metadata embedding, supporting browser preflight flows. When opted in, metadata.location surfaces the serving provider's GeoIP region as region, region_code, country, country_code, and timezone fields; city, coordinates, and raw IPs are intentionally omitted.

$ curl https://api.darkbloom.dev/v1/chat/completions \
  -H "Authorization: Bearer sk-db-..." \
  -H "Content-Type: application/json" \
  -d '{"model":"gemma-4-26b","messages":[{"role":"user","content":"Hello!"}],"metadata_details":true,"stream":false}'

$ curl https://api.darkbloom.dev/v1/chat/completions \
  -H "Authorization: Bearer sk-db-..." \
  -H "Content-Type: application/json" \
  -H "X-Darkbloom-Metadata-Details: true" \
  -d '{"model":"gemma-4-26b","messages":[{"role":"user","content":"Hello!"}],"stream":false}'

Adds EigenLabs/Qwen3.8-27B-MTP-4bit as an MTP proposal assistant for Qwen3.8, enabled by default; disable with mtp_mode = "off", darkbloom beta disable mtp, or the DARKBLOOM_CBV2_MTP=0 environment variable.

Adds clock.curr_time and clock.sleep tools automatically when a model lists clock in its experimental_supported_tools metadata, with the separate current_time_reminder feature controlling current-time reminder injection. Adds a features.sleep_tool config key with model_driven and always_on modes to independently gate registration of the built-in sleep tool.

features:
  sleep_tool:
    mode: always_on

Preserves exec_command in completion-only (one-shot) mode when unified_exec is disabled, adding a timeout_ms argument that terminates timed-out commands with exit code 124. Removes tty, yield_time_ms, session_id, and write_stdin from one-shot exec mode when unified_exec is disabled.

Adds an optional timeoutMs parameter to thread/shellCommand to set per-command deadlines; defaults to one hour when omitted or null, treats 0 as an immediate timeout, and rejects negative values. Also adds general support for configurable timeouts on thread shell commands.

Adds an opt-in local_thread_store_shared_compression feature flag to enable zstd compression for shared rollout lineages, including referenced sources and fork pointers.

Records codex.app_server.codex_home.size_bytes metrics for the CODEX_HOME, sessions, and archived_sessions subdirectories at app-server startup.

Adds WaveSpeedTools (pip install agno[wavespeed], key from WAVESPEED_API_KEY) with generate_image and generate_video methods that accept a text prompt, poll within poll_interval and timeout, and return ToolResult carrying Image/Video artifacts.

from agno.agent import Agent
from agno.tools.wavespeed import WaveSpeedTools

agent = Agent(
    tools=[WaveSpeedTools(poll_interval=2, timeout=60)],
    markdown=True,
)
agent.print_response("Generate an image of a futuristic city at night", stream=True)

Adds AtomicMailTools with register_inbox, send_email, and list_inbox over JMAP; register_inbox provisions a new inbox via proof-of-work signup, with credentials cached to ~/.atomicmail/credentials.json and pow_timeout (default 300s) capping the solve.

from agno.agent import Agent
from agno.tools.atomicmail import AtomicMailTools

agent = Agent(
    tools=[AtomicMailTools(pow_timeout=300)],
    markdown=True,
)
agent.print_response("Register me an inbox, then check for any new messages.", stream=True)

MCPConfig.tools now publishes Agent, Team, Workflow instances, remote proxies, and component factories as named MCP tools, with component.as_tool(name=..., description=...) controlling the published name; it also publishes Toolkit instances as one MCP tool per registered method, filtered by enable_*/include_tools/exclude_tools, with ToolResult rendered as MCP content blocks including text, image, audio, embedded resource, and resource_link. as_tool() and @tool/Function also gained title and annotations parameters published over MCP, with unknown annotation keys raising at construction.

Adds query_timeout to every context provider, applying a wall-clock deadline to each query_<id> tool call (requires Python 3.11+), and adds write_tools to the five write-capable providers to replace the default write sub-agent toolset.

Adds sync, async, and streaming reasoning handlers to MoonShot (Kimi) reading reasoning_content, and routes OpenRouter through the OpenAI reasoning path. Native reasoning detection now queries the provider first before falling back to model-id matching, cached on the reasoning manager with a 10-second timeout on the Ollama, OpenRouter, and Moonshot paths; as a result a Gemini or Claude model configured for thinking may now be classified as non-reasoning when the provider reports thinking unsupported, id-based fallbacks changed so gpt-5 variants match on OpenAI and Azure OpenAI, Groq and Ollama match gpt-oss and qwen3, and qwen2.5-coder on Ollama is no longer treated as a reasoning model.

Adds Synthorai model provider (agno.models.synthorai) reading SYNTHORAI_API_KEY, defaulting to https://synthorai.io/v1; resolves model='synthorai:<model-id>' strings via the provider lookup table.

Adds SerplyTools for Google web, News, and Scholar search via the Serply API, reading SERPLY_API_KEY; web search is on by default, with search_news, search_scholar, and all=True enabling additional surfaces.

Google toolkits accept AuthConfig(interactive=False) or the env var GOOGLE_OAUTH_NONINTERACTIVE=1 to raise instead of blocking on a browser flow.

Adds ScheduleManager.list_all() and alist_all() to page the full schedule catalog, backed by a new raise_on_error argument on get_schedules; listings now break created_at ties by id.

metadata precedence on Agent, Team, and Workflow changed: a metadata= passed to run() now wins over the component-level metadata; code that read agent.metadata after a run to observe session values now sees only the constructor value.

MCPConfig/MCPServerConfig now raise on unrecognised keyword arguments at construction instead of silently ignoring them, so a typo like tool= will fail at boot.

BaseRemote.acancel_run gained a required auth_token keyword parameter; third-party BaseRemote subclasses must accept it.

RealtimeSession.send_audio() now accepts async iterables, enabling streaming microphone input from async generators rather than only discrete chunks.

async def mic_chunks():
    async for chunk in microphone_stream():
        yield chunk

async with agent.realtime('openai:gpt-realtime-2.1').session() as session:
    await session.send_audio(mic_chunks())

Introduces the @durable_operation decorator, which requires an explicit operation name, plus a public backend API for integrating third-party durable execution engines.

Adds the --mcp-config flag to the clai CLI, enabling MCP server configuration from the command line, and adds tool-call streaming support to clai.

Adds ai-safe2.manifest.json and AGENTS.md as first-class machine entry points, exposing framework version, component versions, normative paths, control counts, enforcement planes, persistence vocabulary, and conformance boundaries so agents and compliance bots can consume the framework without scraping prose. Also adds skills/mcp/data/mcp-profile-v3.1.json, a machine-readable MCP profile covering all 19 CP.5.MCP controls, and skills/mcp/data/ai-safe2-controls-v3.0.json, the 161-control core dataset for automated consumption.

Adds MCP-14 (Extension Capability Negotiation), MCP-15 (Header and Body Assertion Integrity), MCP-16 (State Handle Binding and Lifecycle), MCP-17 (MRTR Round-Trip Integrity and Replay Resistance), MCP-18 (Catalog Cache Integrity and Provenance Revalidation), and MCP-19 (Authorization Chain Integrity, intended-resource/audience binding, and SSRF boundaries), bringing the CP.5.MCP profile to 19 controls. MCP-19 carries an explicit conformance boundary: a deployment must evidence intended-resource, audience, or equivalent binding before protected dispatch, and opaque bearer-token possession alone does not satisfy the control.

Re-anchors MCP-4, MCP-7, MCP-8, MCP-11, and MCP-13 from protocol session state to framework-owned governance state (verified principals, capability grants, provenance baselines, delegation chains, governed state handles) so controls survive protocol changes such as MCP 2026-07-28. Implementations that previously anchored these controls to MCP session constructs must be re-implemented against the new bindings.

Adds MCP 2026-07-28 as the primary binding for CP.5.MCP, with a twelve-month legacy compatibility window for MCP 2025-11-25; server/discover is optional under the primary binding and its absence is not treated as a scanner failure.

doberman uninstall --global performs a device-wide removal of Claude Code and Codex hooks, project state, possession factors, the fingerprint key, and device state before removing the package via pip or pipx; --yes skips the typed DOBERMAN confirmation, --dry-run changes nothing, and --keep-package preserves the package. It writes a device-wide ~/.doberman/excluded_projects.json exclusion list so excluded projects become true no-ops (cleared by running doberman install-hooks in that project), and doberman status now reports whether the current project is in this exclusion list.

$ doberman uninstall --global --yes

doberman telemetry on|off|status (v0.18.2) added opt-in anonymous CLI telemetry, off by default, limited to allowlisted counts and command names and never on the per-tool hook or proxy hot path. In v0.18.4 telemetry switched to on-by-default (opt-out): the same five allowlisted events are sent unless disabled via doberman telemetry off, DO_NOT_TRACK, DOBERMAN_TELEMETRY=0, or the CI environment variable; doberman setup prompts with a default of Yes, and the first CLI command prints a one-line notice to stderr before anything is sent.

$ export DOBERMAN_TELEMETRY=0

$ doberman telemetry status
doberman telemetry on
doberman telemetry off

--json and --jsonl flags on scan, doctor, policy-history, and log emit machine-readable output with an explicit allowlist of already-redacted columns so future schema additions cannot leak into streams by default; tune gained a matching --json flag producing compact JSON (separators=(',', ':')) per the contract documented in docs/CLI.md.

$ doberman log --jsonl >> /var/log/doberman/decisions.jsonl

doberman update runs a timeout-bounded PyPI version check and prints the exact pip install -U upgrade command without installing anything; it is disabled under DO_NOT_TRACK, CI, or DOBERMAN_UPDATE_CHECK=off.

$ doberman update

doberman doctor gained a Password row (OK when a password factor is enrolled, otherwise a non-critical WARN with a doberman password set hint), Dash extra and TUI extra rows reporting whether starlette/textual are installed with pip install 'doberman[dash]'/[tui] hints, and a critical Hook command check that fails and names a fix when hooks reference a doberman binary not on PATH, instructing the user to restore the binary or run doberman uninstall-hooks.

Introduces a five-minute, HMAC-keyed approval memory: a repeat of an exact previously approved action re-prompts at a one-click soft_confirm instead of the full ladder, and soft confirms never chain; it never downgrades destructive/critical/excluded/tainted-session actions. doberman approvals status|clear|ttl exposes bounded human controls over this memory.

doberman egress-velocity [KNOB] [VALUE] shows or sets the burst, volume-bytes, and fanout detection thresholds directly from the CLI, with approval gating and policy-ledger recording whenever a threshold is increased.

$ doberman egress-velocity fanout 10

doberman demo --quiet suppresses banners, narration, and hints, keeping only the summary line/table and exit code, so demo can run as a CI smoke test without polluting build logs.

$ doberman demo --quiet

doberman decision-log-prune deletes resolved decision-log rows by age and/or a retained-row budget, without touching pending AUTH challenges or the policy-change ledger; mediated agents cannot invoke it via the shell. Eligibility was expanded to cover any AUTH row with a recorded outcome (approval method, denied, blocked, error, executed), not only the original three literal values.

Adds --dry-run to install-hooks that previews the exact SessionStart command the installer writes, derived from the same DASHBOARD_COMMAND constant used by the actual write path.

Adds a Copy details action to each pending approval card that copies redacted fields as formatted JSON; the stats strip now triggers an immediate trailing-debounced 150 ms refresh when a decision lands in the live feed (5 s interval kept as fallback); and the dashboard header renders the real Doberman mark as an embedded PNG data URI instead of a placeholder, keeping doberman dash a single self-contained page.

doberman 2fa reset-lockout resets TOTP lockout state, letting a locked-out user re-enroll without destroying their seed.

$ doberman 2fa reset-lockout

The secret detector now verifies its own invariants at import and degrades to a fail-closed AUTH verdict if they are ever broken, preventing both silent secret leakage and tool mediation being bricked.

Renames doberman dashboard to doberman session-summary; the old name is retained as a hidden permanent alias so existing SessionStart hooks continue to work.

Adds docs/CLI.md and docs/REASON_CODES.md, cataloguing all 51 ReasonCode values and the condition that fires each one.

Adds cluster-wide default sidecar resources configured via the varmor-config ConfigMap, with independent nonMitm/mitm resource tiers that are hot-reloadable without restarting workloads.

proxy-init now auto-detects the iptables backend (legacy/nft) and aborts with a CONFLICT error instead of silently blackholing traffic when backends conflict. This behavior requires proxyinit:v0.2 or newer; older proxy-init images will not support the new backend detection.

Adds egress audit-log persistence for Kata/micro-VM runtimes (Kata, VCI, ECI) via an in-sidecar ALS sink, with micro-VM detection driven by the varmor-config ConfigMap.

Plugin declarations move to configurations/plugins.yaml as the canonical home for plugin registration, replacing programmatic registration. Plugins listed under the plugins: key are installed and compiled into the binary at build time via make start or make docker.

plugins:
  - source: github.com/your-org/beelzebub-myplugin
  - source: github.com/your-org/[email protected]

Adds shared JSON Schema validation for honeypot service configurations, enabling beelzebub validate to enforce a common schema across all service definition files.

$ ./install.sh --local --no-run && beelzebub validate --conf-core ./configurations/beelzebub.yaml --conf-services ./configurations/services/

Improves ./install.sh with new flags --local, --docker, and --no-run for non-interactive and headless deployment workflows, useful in CI.

$ ./install.sh --local --no-run && beelzebub validate --conf-core ./configurations/beelzebub.yaml --conf-services ./configurations/services/

Introduces the ServicePlugin interface in pkg/plugin for background plugins that start automatically at runtime boot, alongside the existing CommandPlugin and HTTPPlugin interfaces.

Adds exact typed GLM native-state prefix caching (GLM typed prompt cache) with metadata validation on live restore, memory-bounded cache snapshots, and cache persistence through native MTP finalization.

Adds source-gated affine MoE pair fusion for hybrid decode, opt-in Qwen3.5 GDN decode fusion with exact gate preparation, and proven Qwen4 affine MoE pair decode with GLM mHC decode fusion. Fuses GLM KDA decode convolutions and state update, GLM mHC decode transform, GLM affine MoE down reduction, and GLM hyper-connection placement for fewer Metal dispatches; fuses Qwen GDN decode convolution state update, Qwen PLE decode convolution, and small-row gated RMSNorm for hybrid decode. Also groups GLM and Qwen4 affine projections and Qwen3.5 GDN decode projections at load time for fewer dispatches, parallelizes Qwen4 PLE decode row reads, and caches completed GLM DSA pool keys to reduce redundant computation.

Adds prefix-cache fetch provenance reporting to the /health and /v1/cache/stats endpoints.

Enables native Multi-Token Prediction (MTP) for GLM-5.3 at the public loader, with quantization mapped onto the attached head and an adaptive MTP depth policy.

Adds a --usedirectio flag to enable DirectIO model load mode, bypassing the OS page cache to reduce host memory pressure when loading large models. Also allows mlock and mmap to be combined simultaneously.

$ ./koboldcpp-linux-x64 --model mymodel.gguf --usedirectio --gpulayers 40

Adds test_thread_id and session_id parameters to the /runs/rules/validate endpoint to test multi-turn thread evaluators against a real conversation before saving it, catching mapping or logic errors early.

$ curl -X POST 'https://<your-langsmith-host>/runs/rules/validate' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: <api-key>' \
  -d '{"test_thread_id": "<thread-uuid>", "session_id": "<session-uuid>"}'

Supports OTEL_RESOURCE_ATTRIBUTES values on traces as metadata namespaced under otel.resource.*, enabling user IDs and other resource attributes to appear on traces without changing span emission code.

$ export OTEL_RESOURCE_ATTRIBUTES="user.id=u_123,deployment.environment=production"
python my_langchain_app.py

Bulk export compression now defaults to zstandard (zstd) for improved performance; adds the FF_BULK_EXPORT_DEFAULT_COMPRESSION environment variable to override compression on self-hosted deployments, letting self-hosted retain gzip via this flag.

$ export FF_BULK_EXPORT_DEFAULT_COMPRESSION=gzip

Adds targets[].models field to declare models a target serves that are absent from the catalog or live discovery — new catalog IDs, regional/preview names, or self-hosted deployments — making them available in routing and GET /v1/models.

targets:
  - id: my-azure-preview
    provider: azure-openai
    base_url: https://my-resource.openai.azure.com
    models:
      - gpt-4o-2026-preview
      - gpt-4o-mini-regional

Adds batch_target config key to forward /v1/files* and /v1/batches* transparently to a configured backend (openai, azure-openai, groq, novita, qwen); returns 501 when batch_target is unset.

batch_target: openai-prod

targets:
  - id: openai-prod
    provider: openai
    api_key: ${OPENAI_API_KEY}

Adds run.Main() and run.Run(ctx, opts...) in a new public run package, letting Go programs embed the full ferrogw server; run.Run returns startup and listen errors instead of exiting, and honours context cancellation for graceful shutdown identical to SIGTERM. Custom binaries can be built by blank-importing plugins and calling run.Main(), enabling a plugin-composition workflow without forking the gateway binary.

import (
    _ "your-org/your-plugin"
    "github.com/ferro-labs/ai-gateway/run"
)

func main() {
    ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
    defer cancel()
    if err := run.Run(ctx); err != nil {
        log.Fatal(err)
    }
}

Adds POST /v1/rerank (Cohere v2 contract) as a natively routed surface supporting cohere, together, deepinfra, nvidia-nim, and bedrock, with top_n normalised across providers (0 caps to no results, negative values are rejected). Like the other newly natively routed surfaces, it carries the full gateway lifecycle — targets, routing strategy, plugins, circuit breaker, per-target concurrency, metrics, and request logging — replacing the generic pass-through.

Adds POST /v1/audio/transcriptions and POST /v1/audio/translations (multipart upload, 25 MiB cap) as natively routed surfaces supporting openai, azure-openai, groq, together, sambanova, deepinfra, mistral, and fireworks. Adds POST /v1/audio/speech (JSON in, binary audio out; input capped at 4096 characters) supporting openai, azure-openai, groq, together, deepinfra, and mistral. All three carry the full gateway lifecycle — targets, routing, plugins, circuit breaker, concurrency, metrics, request logging — replacing generic pass-through.

Adds Gateway.RegisterProviderAs to register one provider under a distinct routing target, allowing multiple credentials for the same canonical provider while preserving all optional capabilities (streaming, embeddings, images, rerank, moderation, audio, discovery, batch, Responses, and generic pass-through).

gw.RegisterProviderAs(openaiProvider, "openai-team-a")
gw.RegisterProviderAs(openaiProvider, "openai-team-b")

Withheld config map keys in GET /admin/config are no longer returned verbatim; each entry is replaced with [REDACTED_KEY_<n>] (sorted, stable index), and a PUT body containing placeholder key names is rejected. Affected maps: mcp_servers[].env, mcp_servers[].headers, observability.exporters[].config, observability.tracing.headers, and undeclared plugin settings.

GET /health now returns version, commit, and built build metadata alongside provider status, sourced from internal/version (defaults: dev / none / unknown for unstamped local builds).

$ curl -s https://gateway.internal/health | jq '{version, commit, built}'

Adds POST /v1/responses (Responses API) as a governed, priced surface with plugins, guardrails, circuit breaker, concurrency, and request log; stateful sub-routes pin to responses_target and return 501 when it is unset.

Unifies routing internals across chat, streaming, embeddings, and image generation so retry (targets[].retry), circuit breaking, error classification, metrics, and request logging behave identically on every surface. As a result, targets[].retry — previously honoured only under fallback routing mode — is now honoured under all modes, so a target that always fails produces attempts upstream calls where it previously produced one.

render.yaml now sets GATEWAY_ENV=production, enabling startup checks that refuse to boot when ALLOW_UNAUTHENTICATED_PROXY=true or CORS_ORIGINS contains *; a Render service carrying either setting will fail its next deploy.

Outbound HTTP clients no longer follow upstream 3xx redirects — the redirect is returned to the caller as-is; requests that previously succeeded via redirect will now fail until the provider base URL is updated to the redirect target.

Adds POST /v1/moderations (OpenAI contract) as a natively routed surface supporting openai and mistral, carrying the full gateway lifecycle (targets, routing strategy, plugins, circuit breaker, concurrency, metrics, request logging) rather than generic pass-through.

Agentic MCP tool loops now run before_request plugins (guardrails, rate limiters) on every turn, not only the first; transform and logging/metrics plugin types are deliberately excluded from per-turn execution.

Adds a deletePrompt helper to the prompts subpath of @arizeai/phoenix-client, accepting a { name } or { promptId } selector (matching getPrompt style) and calling DELETE /v1/prompts/{prompt_identifier} on Phoenix server >= 13.20.0; deletion cascades to all prompt versions, version tags, and labels. Exports a PromptIdentifier type from types/prompts for the prompt-level selector union. Version-level selectors ({ versionId }, { name, tag }) are rejected rather than widened to delete the whole prompt.

import { createClient } from '@arizeai/phoenix-client';
import { deletePrompt } from '@arizeai/phoenix-client/prompts';

const client = createClient();
await deletePrompt(client, { name: 'my-rag-prompt' });

import { createClient } from '@arizeai/phoenix-client';
import { deletePrompt } from '@arizeai/phoenix-client/prompts';

const client = createClient();
await deletePrompt(client, { promptId: 'UHJvbXB0OjEyMw==' });

The bt CLI adds bt trace setup, bt trace run, and bt trace import subcommands for managing tracing plugins for Claude Code, Codex, OpenCode, and pi. This is a breaking change: the CLI now handles authentication and trace routing for these plugins, so older plugin-specific API key, project, tracing, and config-file settings must be migrated using the bt CLI migration guide and per-agent upgrade notes.

$ bt trace setup

Python SDK v0.32.0 turns off LiveKit Agents audio attachments on agent_speaking spans by default; set BRAINTRUST_CAPTURE_AGENT_AUDIO_ATTACHMENTS=true to restore the previous behavior.

Adds Kimi K3 and DeepSeek V4 Flash 0731 as built-in open-source models, requestable as kimi-k3 and deepseek-v4-flash-0731 through the Braintrust Gateway with no AI provider setup required.

TypeScript SDK versions add auto-instrumentation across a range of libraries: v3.27.0 adds Ollama and @cloudflare/think instrumentation, Anthropic beta sessions tracing via anthropic.beta.sessions.turn and anthropic.beta.sessions.thread.turn, Flue v2 support, and a vitest-evals span input override via meta.eval.input; v3.26.0 adds Cloudflare Agents and Cloudflare AI Chat auto-instrumentation.

Adds Monitoring views as named, project-scoped Dashboards with per-dashboard pages, search, starring, cloning from the built-in Cost and quality dashboard, and auto-saving of chart, filter, and grouping changes.

Python SDK v0.33.0 adds the Harbor job plugin for syncing Harbor evaluation results to Braintrust, defaulting the project name to Harbor so project_name is optional.

SHACL shapes are now stored in the triple store in a dedicated {tenant}--{project}--shapes partition (FUSEKI_SHAPES_DATASET), enabling per-tenant shape catalogs and removing the need for a shapes directory in containerised workers. FACTS_SHAPES_DIR changes from a live read directory to a read-only seed materialized into the shapes partition at startup, and the validation gate now reads the partition rather than the directory; collect_shacl_shapes(ontology_graph, shapes_dir) becomes collect_shacl_shapes(ontology_graph, stored_shapes: RDFGraph | None) and no longer performs disk I/O, so a containerised worker relying on the directory must migrate shapes to the store.

Replaces the two-valued use_ontologies_dataset: bool parameter on aselect, aconstruct, drop_named_graph, drop_all_ontology_graphs_for_iri, serialize_graph, and serialize with a StoreKind ("facts" | "ontologies" | "shapes") partition selector; the LangChain tools ontocast_sparql_select and ontocast_sparql_construct now expose a store parameter in place of use_ontologies_dataset. aserialize(ontology) previously hard-coded the ontologies dataset and silently overwrote a caller's graph_uri; it now honours a store= override, so callers relying on the silent override must pass store='ontologies' explicitly.

Adds POST /flush?include_shapes=true to optionally drop the shapes partition on flush; by default flush retains shapes, and later runs report shacl_evaluated: null instead of failing when shapes are absent. Also adds an include_shapes flag to TripleStoreManager.clean() and clean_tenancy() to control whether the SHACL shapes partition is cleared.

$ curl -X POST 'https://ontocast.example.com/flush?include_shapes=true'

GraphUpdateRenderReport now carries insert_graph and delete_graph as sibling fields instead of graph_update.triple_operations[]; to_graph_update() compiles them delete-then-insert for apply(), the SPARQL compiler, and the LangChain tool. Interleaving inserts and deletes within a single render is no longer expressible, and cached ontology-render responses are invalidated. Touches onto/model.py::GraphUpdateRenderReport, to_graph_update, prompt/graph_format.py, prompt/llm_json_schema.py.

Adds /shapes routes — GET (list stored documents), POST (upload Turtle), and DELETE /{graph_uri} — mirroring /ontologies and tenancy-scoped the same way; a document declaring <iri> a owl:Ontology is stored under that IRI so re-uploading replaces it. Implemented via new modules tool/shapes_catalog.py and api/shapes.py for shape catalog discovery.

tool/facts_invariants.py is removed; imports must switch to tool/facts_validation/ (public surface via package __init__). The data/ top-level directory and its importable data package are removed; TTL fixtures move to test/data/ontologies/, and local-source entries in run/fetch_schema_samples.py resolve via ONTOCAST_SCHEMA_SAMPLE_DIR, skipped when unset.

Adds SKL014, flagging a skill restricted only to TodoWrite or Task* tools, since Claude Code 2.1.233 removed these tools from Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models unless CLAUDE_CODE_ENABLE_TODO_TOOLS=1 is set.

$ CLAUDE_CODE_ENABLE_TODO_TOOLS=1 claude

Adds a Tasks & Jobs rail surfacing Claude Code's background jobs from ~/.claude/jobs/ (state, timeline, tokens, result) and per-session task lists from ~/.claude/tasks/ (checklist with dependency chips), with jump-to-session links and a daemon status line; job providerEnv maps are never decoded.

Adds an Insights tab inside the Analytics rail (Usage/Insights toggle) that reads session facets from ~/.claude/usage-data/ written by Claude Code's /insights command and joins outcome, friction, satisfaction, goal, and session-type data to the cost engine, showing outcome distribution, friction frequency, average cost by outcome, and per-session facet detail.

Adds a Hooks Runtime tab inside the Hooks rail (Configuration/Runtime toggle) surfacing per-hook fire counts, failures, average and max duration, session counts, and a 'not in config' badge for commands seen in transcripts that match no current hook, with Stop-hook batches marked inline in the chat view; this requires a one-time full reparse of all transcripts on first launch due to a parser version bump.

Adds CHN001, flagging each enabled channel plugin (Telegram, Discord, iMessage, fakechat) as a prompt-injection and permission-relay surface; CHN002, flagging channel plugins enabled under Vertex or Bedrock where they are silently ignored; and CHN003, surfacing the channelsEnabled org-policy key.

Adds nine additional GitLab token families to secret detection beyond glpat-: runner, OAuth, pipeline-trigger, agent, import, service-account, CI-build, feature-flag, and deploy tokens, with the glpat-/gldt- pair classified as a critical account-level credential; also protects the glab credential store in the hardening sandbox baseline, matching the existing gh entry.