Arcade 1.9.5

This release flips two chart defaults — usage-event tracking and OTLP telemetry export are now both off out of the box — refreshes the bundled application images (appVersion 5e662d5 → d94d6bd), applies three engine schema changes, and remediates 19 dependency advisories in the shipped images. Read the upgrade notes before rolling: both default changes can alter a running deployment's observable behavior.

This release applies engine schema changes. Migrations run automatically on helm upgrade unless engine.database.migrations is false. No coordinator or experience-api schema changes ship in this release.

• Engine — changes the storage type of tool input/output schemas so that a tool's declared parameter order survives storage. Required: the "parameters reach models in declared order" fix does not hold until it applies. Rows written before the migration keep their old key order until the next worker reconcile rewrites them (at least daily).
• Engine — one-time backfill lowercasing stored tool metadata (service domains, behavior operations). Not required by anything else in this release; it supports internal metadata-matching consistency. Rollback is a no-op: the original mixed-case values are unrecoverable.
• Engine — adds a partial index on tool-execution lookups. Not required by anything else in this release; it speeds the new project-scoped execution-history API on large deployments.

• Disabling a server now removes its tools everywhere. Previously the disabled flag was honored only on the server's own detail view — its tools stayed in project and gateway listings and could still be executed. Now they leave all listings and calls are refused.
• Worker health checks now apply the same SSRF gate as other worker dials and no longer reflect raw connection errors. Previously a project API key could register a worker pointing at an internal address and use the health endpoint as a blind SSRF oracle. Stored session-verifier URLs are also validated.
• Operator RBAC, when enabled, is now enforced on the user-sources API, matching the other operator resources.
• Internal details no longer leak to clients: chat stream errors stop carrying internal error internals, and worker API responses mask internal worker URIs.

Advisories remediated in the bundled application images since 5e662d5:

• CVE-2026-5773 — curl/libcurl removed from the dashboard image (no upstream fix published; the packages were unused)
• CVE-2026-6276 — curl/libcurl removed from the dashboard image (same removal)
• CVE-2026-41178 — go.opentelemetry.io/otel v1.44.0
• CVE-2026-46600 — golang.org/x/net v0.57.0
• CVE-2026-49852 (GHSA-gg9x-qcx2-xmrh) — joserfc 1.7.3
• CVE-2026-53540 (GHSA-v9pg-7xvm-68hf) — python-multipart 0.0.32
• CVE-2026-53550 — js-yaml 3.15.0 (nested resolution)
• CVE-2026-56852 (GO-2026-5970) — golang.org/x/text v0.39.0
• CVE-2026-59869 — js-yaml 4.3.0 / 3.15.0 (nested resolutions)
• CVE-2026-59881 — aiohttp 3.14.3
• CVE-2026-59939 — httplib2 0.32.0
• CVE-2026-69243 — aiohttp 3.14.3
• CVE-2026-69244 — aiohttp 3.14.3
• CVE-2026-69247 — cryptography 50.0.0
• GHSA-45rx-2jwx-cxfr — @opentelemetry/sdk-node 0.220.0
• GHSA-hrxh-6v49-42gf — google.golang.org/grpc v1.82.1
• GHSA-qq9h-g4jm-xgf3 — better-auth 1.6.22
• GHSA-r277-6w6q-xmqw — kin-openapi v0.145.0
• GHSA-rjwr-m7qx-3fjr — oapi-codegen v2.8.0

• Project-scoped tool-execution history API: list, detail, and count endpoints over the execution history the engine already records, gated by a new admin-scoped executions:read permission. Execution inputs and outputs are withheld unless explicitly requested; diagnostic errors are always surfaced.
• System_ManageAuthorization gateway built-in (opt-in via the engine's manage_authorization.enabled plus a per-org flag): gathers a job's authorization needs into one consolidated ask — one authorization link per service, skipping services the user has already authorized.
• Per-resource metadata_read in operator RBAC: read access to resource metadata can now be granted separately from full resource read.
• The MCP tools/list page size is configurable via the engine's features.tools_list_page_size (default 100).
• Snowflake toolkit, with per-user, per-role access.
• Gmail toolkit gains archive_email, trash_email, report_spam, plural triage_emails / change_email_labels, and a secure unsubscribe tool.
• Linear toolkit gains a resolve_comment tool.
• New supportImages.postgres (repository / tag / pullPolicy) makes the wait-for-db init image mirrorable, and the OpenFGA bootstrap wait container now honors supportImages.curl — closing the two init containers that still pulled from Docker Hub after the v1.9.4 supportImages support. Defaults unchanged.
• New coordinator.enableVerifierConfirmUserEndpoint renders the coordinator setting custom session verifiers need, replacing the manual ConfigMap patch that had to be re-applied after every upgrade.

• Usage-event tracking is governed by a single usageTracking toggle, disabled by default (see upgrade notes).
• Telemetry defaults to stdout logs only; OTLP export is opt-in (see upgrade notes).
• MCP gateways now always support protocol version 2026-07-28, negotiated per-request via the Mcp-Protocol-Version header.
• MCP gateways without a project binding now resolve the caller's server-side default project automatically, fail-closed: no resolvable default is a 403, a resolver outage is a 503, and rejected calls record no usage.
• API request-validation errors are structured and human-readable, and a tool that times out downstream returns a typed timeout error instead of a generic 500.
• Linear toolkit: project tools use a unified status vocabulary, eight tools return typed structured outputs, and write tools declare the read scopes they actually use.
• Daytona toolkit: pagination migrated to limit/offset with a next_offset echo.
• Google file-picker URLs are returned in a dedicated top-level field, never in prose, and the picker app id is derived from the OAuth client id.
• The dashboard tools page loads the catalog lazily with server-side search.
• The MCP gateway tool picker was redesigned: per-tool setup requirements surface in the picker, search folds into one list with an All/Selected switch, and bulk changes can be undone.

• The engine keeps serving existing workers when one worker fails to build, instead of failing startup entirely.
• Tool parameters now reach models in the order the tool declared them: ingest from external MCP servers, storage, and schema serialization all preserve declared order. This also stops spurious catalog-version churn on every worker re-sync. Requires this release's engine schema change.
• Remote MCP OAuth integrations: the engine sends the RFC 8707 resource indicator, falls back to the root protected-resource document, catalogues a remote server with the worker's own credential, and returns an actionable error when the OAuth server does not support Dynamic Client Registration.
• MCP protocol conformance: invalid envelopes get structured JSON-RPC errors on both the stateless and sessionful paths, protocol-version negotiation tolerates non-date version strings, signed and large integer request ids are accepted, transport rejections have one shape, and access failures surface as JSON-RPC errors instead of HTTP 500s.
• Tool allow-lists match case-insensitively, so allow-listed tools no longer drop out over capitalization differences.
• Operator RBAC reliability: concurrent role changes are serialized instead of racing, the configured authorization model is validated at boot, and transient authorization-store connection failures are retried.
• helm upgrade --install --wait no longer deadlocks when rbac.enabled is true without a pinned store id: OpenFGA schema setup and bootstrap now converge as regular resources instead of post-install hooks.
• Upgrades that add new RBAC relations no longer crash-loop the coordinator: the init container waits for the authorization model shipped in the OpenFGA image and pins its id before the coordinator starts.
• The dashboard re-authenticates expired sessions via an OIDC redirect instead of leaving a dead UI on session-expiry 401s.
• Playground tool errors render their actual message instead of [object Object].
• Engine stability: in-flight tool handlers are canceled when a stateless MCP client aborts, and timed-out authorization polls no longer leak resources.
• Gmail toolkit: hardened send/reply/draft-delete error handling, draft batch-fetch returns partial results and retries rate limits, and replies carry safe MIME alternatives.
• Notion toolkit: title searches return all matches (misses are retryable), and metadata retrieval works for database IDs.
• Toolkit fixes: Excel reads large worksheets fully, Google Search no longer blocks the worker event loop, and Slack message user enrichment is faster.

• appVersion moves to d94d6bd, shipping current coordinator / engine / worker / dashboard / experience-api (and OpenFGA) images.
• Usage tracking (action may be required). workersUsageTracking → usageTracking.enabled + usageTracking.url, default off. See upgrade notes.
• Telemetry (action may be required). OTLP export off by default; enabled OTLP endpoints that are unreachable at startup now crash-loop the pod. See upgrade notes.
• Engine schema changes. Three migrations run on upgrade (one required by the declared-parameter-order fix, one irreversible backfill). See the migrations section.
• Air-gapped / private-registry installs (optional). Mirror supportImages.postgres in addition to busybox / curl; the OpenFGA bootstrap wait image now honors your supportImages.curl override.
• Custom session verifiers (optional). Set coordinator.enableVerifierConfirmUserEndpoint: true instead of patching the coordinator ConfigMap by hand.
• Operator RBAC. The authorization model gains metadata_read relations and an executions:read permission; the chart applies the new model automatically and now pins its id before the coordinator starts, so no manual model management is needed. helm upgrade --wait deadlocks and crash-loops on RBAC bring-up are fixed.

• MCP gateways always support the 2026-07-28 protocol (header-negotiated); MCP error and version-negotiation shapes are conformant; tools/list page size is configurable.
• A disabled server's tools leave listings and refuse calls.
• Static (project-unbound) gateway calls resolve the caller's default project fail-closed.
• Tool parameters serialize in declared order everywhere.
• New read surface: project-scoped tool-execution history (list / detail / count), inputs and outputs opt-in.
• Toolkit contracts: Linear status vocabulary unified + typed outputs; Daytona pagination is limit/offset; Google picker URLs move to a dedicated field; Gmail and Snowflake gain tools.