This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+2 more
Affected surfaces
Summary
AI summaryAdded tenant-wide safeMode control with gate-all and halt modes plus a new Flow tab for parametric flow customization.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds per‑tenant `config.safeMode` with modes gate-all and halt. Adds per‑tenant `config.safeMode` with modes gate-all and halt. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Feature | Medium |
Adds Flow tab with parametric flow customization options. Adds Flow tab with parametric flow customization options. Source: llm_adapter@2026-06-13 Confidence: low |
— |
| Feature | Low |
Introduces `gate-all` safe mode restricting autopilots to human gate. Introduces `gate-all` safe mode restricting autopilots to human gate. Source: granite4.1:30b@2026-06-13-audit Confidence: low |
— |
| Feature | Low |
Introduces `halt` safe mode causing startRun to throw and returning 503 Retry-After. Introduces `halt` safe mode causing startRun to throw and returning 503 Retry-After. Source: granite4.1:30b@2026-06-13-audit Confidence: low |
— |
| Feature | Low |
Restricts safeMode changes to admin/compliance‑lead roles with push alerts on change. Restricts safeMode changes to admin/compliance‑lead roles with push alerts on change. Source: granite4.1:30b@2026-06-13-audit Confidence: low |
— |
| Feature | Low |
Adds Flow tab in operator console for viewing autopilot flows. Adds Flow tab in operator console for viewing autopilot flows. Source: granite4.1:30b@2026-06-13-audit Confidence: low |
— |
| Feature | Low |
Provides parametric flow customization: rename signer, skip optional steps, add checkpoint. Provides parametric flow customization: rename signer, skip optional steps, add checkpoint. Source: granite4.1:30b@2026-06-13-audit Confidence: low |
— |
Full changelog
Safe mode — tenant-wide action-control switch
Per-tenant config.safeMode (default off) — restrict autopilots on anomaly/incident. An AI firewall controls what an agent does right now, not just who has access (docs/AI-FIREWALL.md).
gate-all— every new case forced to a human gate regardless of confidence (reversible volume still runs; nothing irreversible auto-runs);forced-to-gatewritten to the hash-chained audit.halt—startRunthrows; ingest + manual start return 503 Retry-After; pending cases stay parked.- Server:
safeModevalidated, admin/compliance-lead only, push alert on change. Console Ops: off/gate-all/halt control + persistent banner. Tests 44/44; verified live.
Flow tab + per-tenant parametric flow customization
The operator console gains a Flow tab (see the autopilot the signer signs inside of) + three parametric overrides (rename signer / skip optional steps / add a checkpoint), safety invariants re-validated by construction. (Shipped in this release.)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About great_cto
Engineering-management layer of 34 specialist AI agents covering the full SDLC (architect, PM, senior-dev, reviewer, QA, security, devops, L3-support + 18 archetype-specific reviewers) with auto-detected archetypes and compliance gates (PCI-DSS, HIPAA, FedRAMP, GDPR, EU AI Act). Runs in Claude Code, Cursor, Codex CLI, Aider, and Continue via AGENTS.md + MCP. MIT.
Related context
Related tools
Earlier breaking changes
- v2.72.2 Removes Autopilot sidebar item and Operate topbar button from dev board.
- v2.55.0 Hard-gates the Build board; redirects invite sessions to Operate for operators.
- v2.43.0 Runtime now blocks autonomous execution of irreversible actions without prior human checkpoint.
- v2.43.0 Adds reversible and blastRadius fields to every flow step.
- v2.32.0 Removed AgentShield scanner and its CLI commands.
Beta — feedback welcome: [email protected]