EDDI 6.3.0 turns group conversations from a debate feature into a collaboration platform, and introduces the Platform Operator, a meta-agent that reads and operates the deployment with every write behind a human approval gate, superseding the Agent Father.

Groups gain the machinery a real team needs: explicit voting with quorum and weights, shared artifacts, bid-based task assignment, standing teams with backlogs and cron cadences, a facilitator with bounded moves, humans as first-class members, a NEGOTIATION style, and retro phases that harvest team-owned memory. Five preset templates ship so none of it has to be hand-wired.

EDDI also gains an OpenAI-compatible /v1 API, presenting deployed agents as OpenAI models to Open WebUI, the openai SDK, LangChain and LiteLLM. Alongside that: most tool-enabled turns now stream token-by-token, the tool orchestrator is decomposed behind a ToolSourceProvider SPI, and vault allowedAgents moves from advisory to enforced. Four security fixes apply to code that shipped in 6.2.0, so existing deployments are affected regardless of whether they adopt anything new in this release.

🚀 What's New

🧙 Platform Operator, and the end of the Agent Father

The Platform Operator (/manage/operator) is a meta-agent that reads and operates the deployment through EDDI's own API, including creating other agents, with every write behind a human approval gate. The form-based agent wizard (/manage/agents/wizard) covers the same ground without a conversation. Both call AgentSetupService.

• 🔍 Deterministic gate verification. POST /administration/operator/gate-dry-run answers "would this tool call be gated?" without executing anything, so a policy can be proven before it is trusted.
• 🔁 Caller-set tool-iteration budget on the setup API, so a long provisioning conversation is not cut off mid-way by a fixed round limit.
• 🧾 Operator metrics and audit surfaces, so operator activity is observable and reconstructable after the fact.

The Agent Father is retired, along with POST /backup/import/initialAgents and the bundled starter ZIP. See Breaking Changes.

👥 Group Collaboration: Deliberation and Work Products

The largest body of work in this release. Groups move from "agents take turns talking" to a team that can decide, produce, and persist.

Plus: convergence detection with early exit, structured verdicts and deterministic synthesis, abstention and minority reports, runtime recruitment and delegation, an agent-writable shared task list, group cost ceilings with per-child attribution, transcript windowing for rendered member context, a LiveDiscussionRegistry, speaker-level resume points, and graceful-shutdown integration.

🤖 OpenAI-Compatible API: Open WebUI, the openai SDK, LangChain, LiteLLM

A new /v1 surface presents deployed agents as OpenAI "models", so any OpenAI-protocol client can drive EDDI conversations. New integrations/openai/ package, parallel to integrations/slack/. Disabled by default; enable with eddi.openai-compat.enabled=true. Full guide: docs/open-webui-integration.md.

• 🔀 Sync and streaming dispatch on the request body's stream field, not on Accept. openai-python hardcodes Accept: application/json regardless of stream, and Open WebUI sends no Accept header at all, so content negotiation would have routed every streaming request to the JSON path. This matches the OpenAI spec and what vLLM, llama.cpp, LiteLLM and Ollama do.
• 🧵 Per-chat conversation isolation keyed on X-OpenWebUI-Chat-Id, so each chat in the client maps to its own EDDI conversation.
• 🎨 Structured outputs survive the protocol. An EDDI turn carries eight output types; the OpenAI protocol carries one string. OpenAiOutputRenderer takes the extractor's text verbatim, because a reply's wording must not depend on the channel it left through, then appends a Markdown rendering of the rest: quick replies as backticked values, images as ![alt](uri), application links as links, buttons as their label, input fields as a described prompt. Without this, an agent whose turn is a question plus five quick replies arrived as a question with no visible answers.
• 📊 Token usage reporting, including for streamed responses via stream_options.
• 🔑 Its own auth surface: API-key filter, configurable HTTP policy, optional anonymous access, and a startup guard, all separate from the main REST auth.
• 🧯 HITL-aware, multimodal-aware, with an exception mapper that returns OpenAI-shaped errors.

🪪 Caller Identity: An Agent Can Call an API As the Signed-In User

An HTTP call header may now reference the authenticated caller, so the agent calls the API with that user's credentials rather than a static one:

This matters most when an agent calls EDDI's own API, where a static credential expires within the hour, cannot be least-privilege, and attributes every action to one synthetic principal.

Resolution is deliberately narrow and fails loudly rather than degrading quietly. It is same origin only, released to the exact scheme://host:port the caller addressed, read from the inbound request rather than config, so a config naming a third-party host cannot exfiltrate the token. It is headers only for ${caller:token}, which is rejected in a query parameter, body or path. It works on authenticated turns only, so scheduled jobs and triggers cannot satisfy it. And it fails closed, erroring rather than sending an empty Bearer. The token is never persisted, since authorization headers are scrubbed before the request is written to conversation memory. An MCP server's apiKey may also carry it, sending the tool call as the chatting user. Disable with eddi.caller-identity.enabled=false.

🔑 Vault Keys Are Shared, Not Minted Per Agent

Provisioning several agents against one provider key previously left one vault entry per agent (setup.<agent>.<timestamp>.apiKey), so rotating that provider key meant hunting down N unguessably named entries. Agent setup now offers three ways to share one key, including a new REST-only vaultKeyName field that names the entry directly. With vaultKeyName and no apiKey, the entry must already exist, so a second agent needs no plaintext at all.

Pasting an existing ${vault:...} reference into the wizard's API-key field also works reliably now. The reference check was a full-string regex that never trimmed its input, so a reference copied from a UI list carried trailing whitespace, failed the match, and was vaulted as a secret whose value is a reference: a new, useless key on every setup.

🌊 Streaming: Live Output Through Tool Turns

• ⚡ Most tool-enabled turns stream token-by-token (eddi.llm.tool-loop.streaming.enabled). These turns previously ran on the synchronous ChatModel, so output arrived only once the whole tool loop had finished. ToolLoopStreamingChatModel adapts the streaming transport to the synchronous contract, and ToolLoopRunner is untouched, so retries, iteration budget, approval gate and pause/resume all keep working. A single-chunk fallback still applies where live streaming is not possible: the kill-switch off, no event sink, output-suppressed tasks, providers with no streaming builder, JSON-formatted final rounds, and the cascade-agent path. When it applies, a streamingDowngraded flag is recorded in the response metadata so the downgrade is observable rather than silent.
• 🔧 Live tool_call SSE event, emitted immediately before each tool executes, so clients can show "Using {tool}…" while the turn is still running. Only the tool name travels; arguments stay in the redacted end-of-turn trace.
• 🆔 done events carry the pause identity (hitlPausedAt), so a client can tell which pause it is looking at.
• 🚦 Known client conditions are typed error events, giving clients something actionable instead of a generic 500.
• 🩹 Leading whitespace is preserved in SSE data lines, correcting spacing in streamed replies.

🔌 MCP Server: 84 Tools

Up from 77. New group-collaboration and HITL discovery tools, plus a documentation bridge so agents can read EDDI's own docs, exposed both as MCP resources and over REST at GET /administration/docs. OpenAPI-generated tools can now read response headers.

Two further REST surfaces arrive with the group work: /groupstore/templates for listing templates and POST /{templateId}/instantiate to create a group from one, and **`/groupsto...

EDDI 6.2.0 is the largest release since 6.0. Its headline is the Human-in-the-Loop (HITL) framework: two independent human-approval gates — turn-level and per-tool-call — with Slack, REST and MCP approval surfaces, crash recovery, timeout policies and full audit trails. Alongside it, multimodal attachments become a complete pipeline, the multi-model cascade gets an enterprise pass, group conversations gain a real lifecycle (follow-up → continue → close), and a broad remediation campaign closes a cross-user tool-cache leak, three audit-ledger integrity bugs, as well as quota, serialization and cost-accounting defects.

The Manager UI ships Workforce — a second, agent-first workspace alongside the admin dashboard — plus HITL approvals, cascade editors, an analytics dashboard and a schedules overhaul.

🚀 What's New

🧑‍⚖️ Human-in-the-Loop — Two Approval Gates, Four Surfaces

EDDI can now pause an agent mid-flight and wait for a human. Two independent gates share one pause/timeout/audit machinery:

• 🔌 Tool-call gating across all 7 tool sources — builtin, http, mcp, a2a, dynamic, memory, recall. Per-tool-call verdicts, and the approver can amend the arguments before the call runs.
• 📓 Write-ahead journal — approved tool executions are journaled before they run, with transcript replay so resume re-enters the LLM loop at the same tool index. MongoDB and PostgreSQL journal stores, TTL retention, GDPR erasure.
• 💬 Slack approval surface — approval buttons with tool-pause detail blocks, an interactivity endpoint bound to the owning integration, and continuation pushed back into the conversation.
• 🤖 MCP HITL tools — list / status / resume / cancel for both regular conversations and groups, an eddi.mcp.hitl.mutations.enabled kill-switch, structured error codes, and resume_conversation named in the PAUSED_FOR_APPROVAL payload for client chaining.
• 📥 Cross-group approval inbox — GET /groups/pending-approvals, owner-filtered and bounded.
• ⏱️ Timeout & no-progress policies — WAIT / AUTO_APPROVE / AUTO_REJECT / ABORT, scoped per task with an agent-level default, armed as one-shot schedules and honored across pods.
• 🔁 Crash recovery — a startup observer repairs paused conversations after an unclean shutdown, asynchronously so it never stalls boot.
• 🛡️ Save-time linting — reserved-action near-misses (PAUSE_CONVERSATON) and inert hitlConfig blocks are flagged at deploy, not discovered in production.

Full reference: docs/hitl.md.

📎 Multimodal Attachments

• 🧩 One unified forwarder turns attachments into model content. Bytes resolve from a stored blob, a URL or base64 under uniform per-file (10 MB) and aggregate (20 MB) caps across all sources, then gate on the target model's real capabilities.
• 📄 Hybrid PDF — native document content when the model supports it, PDFBox text extraction inlined when it doesn't. Text-like files (text/*, JSON, XML, CSV, YAML) always inline, no capability required.
• 🗄️ Deletion actually deletes — conversation delete and GDPR erasure previously cascaded through a different store than uploads wrote to, so uploaded blobs were never removed.
• 🔑 Grants + owner-or-grant authorization — unguessable UUID storage refs, server-validated metadata reads, single-item download and delete, and cross-conversation grants that let group members read a shared blob without opening general access.
• 🔁 A file stays usable for the whole conversation, not just the turn it arrives on. The document itself is inlined only on the upload turn — re-sending it every turn would burn the context window — but the model keeps a way back to it. readAttachment is installed whenever the conversation has files from any turn, and when the current turn carries none the model gets a one-line note naming the earlier files and pointing at the tool. Without that note the tool is present but never looked at.
• 🔓 readAttachment does not require enableBuiltInTools. That switch gates outbound, billable capabilities — web search, scraping, HTTP. Reading a blob already stored under this conversation and authorized by ownership is neither, and gating it there meant the tool was never registered for any agent the wizards create (the flag defaults to false). An explicit builtInToolsWhitelist is still honoured.
• 👥 Group parity — attachments fan out to members and stay reachable across later phases, follow-up rounds and per-member follow-ups. Attachments and content-type behavior rules also survive a HITL pause/resume, which re-enters the same step from a reloaded conversation.
• 📖 Text extraction cap aligned to the tool-response limit — 50,000 characters (eddi.attachments.text-extraction.max-chars), up from 10,000. The old cap clamped a document to roughly three pages before the layer that actually guards the context window got a say, so a follow-up question saw far less of a PDF than the upload turn did. Larger documents stay reachable through readAttachment's page parameter and the truncator's pagination cursors.
• 🧯 Never silent — every cap hit, store failure or capability gate is recorded to attachments:errors and leaves a note the model can relay to the user.
• 📊 Forwarder metrics, GDPR portability metadata, and per-conversation quotas (50 attachments / 100 MB, configurable).

🎚️ Multi-Model Cascade — Enterprise Hardening

• ⚖️ The audit records the real model — audit:cascade_model is written from the cascade-selected step (provider/model (step N)), not the task default, so an auditor can reconstruct which model produced an answer. audit:cascade_cost and audit:cascade_token_usage added.
• 🧑‍⚖️ judgeModel — a real config block, built through the model registry with vault and global-variable resolution.
• 📡 SSE cascade events — cascade_step_start and cascade_escalation are live end-to-end.
• 💰 Ceilings — maxTotalDurationMs (wall-clock) and maxCostPerRun (dollars, from per-step inputPricePer1M / outputPricePer1M) stop escalation and return the best response so far.
• 📈 Metrics under eddi.llm.cascade.* — executions, escalations by reason, accepted step, step latency, confidence distribution, tokens, cost, ceiling exceeded.
• 🌊 The final step streams live token-by-token instead of buffering, and is no longer cancelled mid-stream.
• 🌍 Config-driven heuristics — confidence phrases and thresholds are configurable, and the no-match fallback is language-agnostic.
• ✅ Configure-time validation hard-fails only on invalid pricing/ceiling values; legacy conditions warn at deploy, so upgrading can never stop a previously-loading agent.

💬 Group Conversations — A Real Lifecycle

discuss → COMPLETED → [followup | continue]* → close → CLOSED

• 🎯 Follow up with any member — ask one agent (or the moderator) a question; both sides append to the transcript as FOLLOW_UP entries. Accepts an agent ID or a display name, case-insensitive, with available members listed on a miss.
• 🔄 Continue the full group — re-runs all phases with a new question; agents retain memory from prior rounds through reused private conversations, and a round counter increments.
• 🔒 Explicit close — ends member conversations, cleans up ephemeral agents, and locks the conversation permanently.
• 🧭 availableActions is computed into every response and memberDisplayNames maps agent IDs to names, so clients discover what they can do without transcript scanning.
• 🚦 Honest HTTP statuses — follow-up and continue failures are split by cause; a mid-round member timeout is a 504, not a 502.

⚡ Error Handling & Recovery

• 🔁 Shared retry configuration — exponential backoff and retryable-error classification, configurable per subsystem.
• 🧮 Pipeline error classification — failure audit entries, task_failed SSE events, and metrics tagged by error.type.
• 🩺 Admin state reset — PATCH /{conversationId}/state recovers stuck conversations.
• 🔌 MCP continueOnError + retry + circuit breaker, config-driven per MCP call.
• ✅ LLM response validation — config-driven policies for empty, truncated and filtered responses. Zero-token streaming failures are retried, partial responses are returned with metadata, and an interrupted stream now counts as a failure instead of a success.
• 📥 HTTP 4xx/5xx response bodies are stored in memory so an agent can react to them.

🧰 Tool Cost, Context & Cache Controls

• 🧱 maxToolContextTokens (default 60,000) — the in-turn tool context finally has a ceiling. The oldest tool exchanges are dropped, with a log line naming the knob to raise.
• 💸 maxBudgetPerConversation can bind — built-in tools are priced and rate-limited by their canonical slug, so a configured ceiling is no longer inert. A ceiling that cannot take effect now warns.
• ⏳ Cache entries expire — per-entry TTLs are honoured; previously the lifespan argument was discarded and size eviction was the only mechanism.
• 🧹 Removed config that never did anything: enableParallelExecution / parallelExecutionTimeoutMs, RAG injectionStrategy / contextTemplate, and eddi.audit.retentionDays.

🔌 MCP Server — 77 Tools

Up from 65. New: 9 HITL tools and the group follow-up / continue / close tools. The memory and GDPR tools are now reach...

EDDI 6.1.2

🚀 What's New

🤖 Task Force Discussion Style — Dynamic Multi-Agent Orchestration

Agents can now create, recruit, and delegate to sub-agents at runtime during group conversations. The new TASK_FORCE discussion style enables collaborative task orchestration where agents autonomously:

• 🏗️ Create sub-agents on-the-fly with specific roles and instructions
• 📋 Manage shared task lists — agents claim, update, and complete tasks collaboratively
• 🔄 Recruit existing agents into the conversation dynamically
• 🛡️ Guardrails — configurable provider/model allow-lists, max depth limits, and tenant quota enforcement prevent runaway agent creation

🔌 New MCP Tools

• start_group_discussion — async variant that returns immediately with a conversation ID (client polls for results)
• delete_group_conversation — REST-MCP parity, previously only available via REST API

📦 Dependency Updates

🐛 Bug Fixes

• 🔧 Jackson serialization — Disabled Quarkus 3.37's new reflection-free serializers which broke ConversationOutput (extends LinkedHashMap). The generated serializer treated it as a bean instead of a map, causing conversation data (input, actions, output) to serialize as null
• 🔧 MCP discuss_with_group — Added missing @Blocking annotation. Multi-minute TASK_FORCE discussions would block the Vert.x event loop, potentially freezing the MCP server
• 🔧 Tenant quota enforcement — Quota errors now propagate regardless of onAgentFailure policy (previously silently swallowed under SKIP policy)
• 🔧 Dynamic agent tracking — Fixed critical bugs in tracking list propagation, defensive copies in SharedTaskList, and null-safety across the dynamic agent system
• 🔧 Manager UI assets — Corrected bundled Manager UI assets that were missing in 6.1.1

🧪 Testing

• ✅ 9,645+ tests passing
• 🔒 Eliminated flaky race condition in startAndDiscussAsync test using CountDownLatch
• 📊 60+ new unit tests for the Task Force / Dynamic Agent system
• 🛡️ Concurrency and deadlock safety tests for SharedTaskList

📋 Full Changelog

6.1.1...6.1.2

EDDI v6.1.1 is a hardening release focused on security, test coverage, and developer experience. It closes critical IDOR vulnerabilities across all user-facing endpoints, achieves OpenSSF Scorecard Gold with >90% instruction / >80% branch coverage and 9,000+ tests, delivers a completely overhauled Swagger UI with branded dark mode, and fixes several concurrency bugs found during code review. The Manager UI ships parser editing, comprehensive SSE reliability fixes, and Keycloak auth improvements.

🏅 OpenSSF Scorecard — Gold Badge Achieved

EDDI has achieved OpenSSF Scorecard Gold level, up from Silver in v6.1.0.

• 9,000+ tests (up from 5,500+ in v6.1.0) — added ~3,500 new tests across 43 test files in 10 coverage rounds.
• JaCoCo CI gates raised to 90% instruction / 80% branch (from 70%/60% in v6.1.0).
• CodeQL SAST now runs on all push-to-main events (previously skipped Dependabot merges, causing Scorecard warnings).
• All CI action dependencies pinned to SHA hashes.
• Added SECURITY.md with vulnerability disclosure policy.

🛡️ Security — IDOR Remediation & Ownership Validation

A comprehensive security audit uncovered and fixed Insecure Direct Object Reference (IDOR) vulnerabilities across all user-facing REST and MCP endpoints.

New Component: OwnershipValidator

Centralized @ApplicationScoped utility for ownership checks. Three methods: validateUserAccess(), validateAndResolveUserId(), requireOwnerOrAdmin(). All checks are no-ops when authorization.enabled=false (dev mode). eddi-admin role bypasses all checks. Legacy data without ownership is allowed through gracefully. WARN-level audit logging on all failures.

Conversations (HIGH → FIXED)

Any authenticated user could previously read/modify ANY conversation by guessing the conversationId. All conversation-scoped endpoints now validate caller ownership. startConversation validates that the provided userId matches the caller's identity (admins can set any userId).

User Memory (HIGH → FIXED)

Any authenticated user could previously read/delete another user's persistent memories. All endpoints now validate that the {userId} path parameter matches the authenticated caller.

Group Conversations (HIGH → FIXED)

Any authenticated user could previously read/delete any group conversation. listGroupConversations now filters to the caller's conversations only.

MCP Memory Tools (NEW → FIXED)

MCP memory read tools now validate userId via OwnershipValidator before executing. Input validation (non-null/non-blank) runs before ownership checks for correct error messages.

Additional Security Fixes

• GDPR annotation hardening — @RolesAllowed("eddi-admin") moved to interface level.
• A2A endpoint clarity — @PermitAll added to all 5 GET discovery endpoints (intentional public access per A2A spec).
• CodeQL remediation — 12 log injection findings fixed via LogSanitizer.sanitize(). Fail-closed ownership check on ResourceStoreException.
• Secrets vault — Tenant reset endpoint added, double-vaulting bug fixed, tenantId sanitized in logs.

36 new security tests covering all ownership validation paths.

🐞 Bug Fixes

Concurrency & Null Safety (from Code Review)

• PropertySetterTask NPE — CATCH_ANY_INPUT_AS_PROPERTY handler now guards against null input:initial data, preventing pipeline crashes on empty/whitespace-only messages.
• Config version race condition — Introduced optimistic locking via storeIfCurrentVersion() on IResourceStorage. MongoDB uses version-conditioned updateOne; PostgreSQL uses UPDATE WHERE version = ?. Prevents silent last-write-wins on concurrent edits.
• ComponentCache HashMap race — Replaced HashMap with ConcurrentHashMap in the @ApplicationScoped singleton. Fixes potential map corruption under concurrent reads (every conversation turn) and writes (lazy agent deployment).
• Zombie-write snapshot clobber — After agent timeout cancellation, Thread.currentThread().isInterrupted() is now checked before onComplete(). Interrupted threads route to onFailure() instead, preventing stale LLM results from overwriting newer conversation state.

Swagger UI CSP

• Blank Swagger UI page — Fixed CSP blocking inline scripts. Two independent bugs fixed across two PRs:
  1. Initial fix: Per-path quarkus.http.filter entries with order-based precedence.
  2. Follow-up: Both filters were firing and adding separate Content-Security-Policy headers. Browser enforces the intersection (most restrictive), so Swagger's inline scripts were still blocked. Fixed by adding a negative lookahead regex to exclude /q/swagger-ui from the default CSP filter.

Other Fixes

• White page at root — index.html reverted to a simple <meta http-equiv="refresh"> redirect to /manage (was referencing deleted asset hashes after a Manager rebuild).
• Keycloak logout — Fixed incorrect logout redirect; now correctly redirects to /manage. Added post.logout.redirect.uris to Keycloak client config. Preserved idToken for id_token_hint.
• MCP stale conversation cleanup — getOrCreateManagedConversation() was catching jakarta.ws.rs.NotFoundException but the code path throws ConversationNotFoundException. Changed catch clause to the correct exception type.
• Tenant quota 404 on fresh instances — Added default tenant quota bootstrapping to both MongoTenantQuotaStore and PostgresTenantQuotaStore. Atomic bootstrap via setOnInsert (Mongo) / DO NOTHING (Postgres).
• Gitleaks false positives — Resolved false positives in rotateKek tests; added .gitleaksignore entries with per-line comments.

🔧 Swagger UI Overhaul

A complete visual and organizational overhaul of the Swagger UI developer experience.

Tag Taxonomy (40 tags, 9 categories)

All @Tag annotations reorganized from flat names to a category-based hierarchy:

• Agents — Setup, Agents, Administration, Agent Groups
• Configuration — Workflows, LLM, Behavior Rules, Dictionary, Output, API Calls, MCP Calls, Properties, Prompt Snippets, Global Variables
• Conversations — Conversations, Group Conversations, Conversation Store, Attachments
• Integrations — A2A Protocol, Capability Registry, Channel Integrations, Slack Webhook
• Knowledge & Memory — RAG Knowledge Bases, RAG Ingestion, User Memory
• Security — Authentication, Secrets Vault, Audit Trail, GDPR / Privacy, Tenant Quotas
• Administration — Backup, Schedules, Coordinator Admin, Orphan Admin, Log Admin, Descriptors
• Tools — Tool History, Template Preview, Standalone NLP
• UI — Chat UI

All 49 REST interface @Tag annotations now include description attributes. 4 previously untagged endpoints received new tags. New OpenApiTagSortFilter OAS filter sorts tags alphabetically at build time.

Branded Dark Mode

• Light mode: white backgrounds, dark text, amber-600 accents
• Dark mode (lamp toggle): EDDI Manager palette — zinc-950 bg, zinc-900 surfaces, amber-500 accents
• HTTP verb tinted operation blocks (blue GET, green POST, amber PUT, red DELETE, purple PATCH)
• EDDI logo branding in topbar

🧪 Testing

Test count grew from ~5,500 to 9,000+ across this release — a 64% increase.

• ~2,800 unit tests added in the initial coverage push across 43 files.
• 10 coverage expansion rounds targeting specific modules: AgentOrchestrator, LlmTask, StructuralMatcher, McpToolProvider, McpAdminTools, ApiCallExecutor, Expression, HistorizedResourceStore, RestImportService, A2A, GroupConversation.
• 36 security tests for OwnershipValidator, RestAgentEngine, RestUserMemoryStore, RestGroupConversation.
• 17 branch coverage tests for PropertySetterTask.
• Secrets vault tests — resetTenant, handleDekDecryptionFailure, vaultApiKey.
• JaCoCo thresholds raised: 70%/60% → 90%/80% (instruction/branch).

🐳 CI/CD & Infrastructure

• Quay.io release push — CI now pushes to Red Hat scan registry on release tags for container certification.
• CodeQL on all pushes — SAST job now runs on all push-to-main events (fixes OpenSSF Scorecard gap).
• Docker base image bump — Red Hat UBI9 OpenJDK 25 runtime updated to latest digest.
• Dependabot — ClusterFuzzLite base builder bumped (3 updates), github/codeql-action bumped to 4.36.2, UBI9 runtime bumped.
• GCP provisioning script — New script for automated Google Cloud Platform system provisioning.

📦 Dependency Upgrades

¹ LangChain4j 1.16.3 includes fix for CVE-2026-55405.

🖥️ EDDI Manager (Admin Dashboard)

The Manager UI (version 6.1.0 assets, bundled with EDDI 6.1.1) received significant updates focused on reliability, new editing capabilities, and test coverage.

New Features

• Parser Editor — Full parser configuration editor for ai.labs.parser configs with dual-mode support: inline editing within the workflow pipeline (via dialog) and standalone resource browsing at /manage/resources/parser/:id. Collapsible sections for Configuration, Dictionaries (6 built-in types + regular dict CRUD), Corrections (3 types with Levenshtein distance), and Normalizers (4 types). 49 new tests at 98.82% line coverage.
• **Quotas Dashboard ...

🚀 EDDI v6.1.0 Release Notes — 2026-06-03

EDDI v6.1.0 is our biggest release since the v6.0 launch. It delivers major new capabilities — ChromaDB vector store support, multimodal attachments, LLM-driven memory summarization, a fleet-wide Global Variable Store, and a completely rearchitected channel integration system — alongside deep security hardening, supply-chain compliance, and a test suite that has more than doubled in size.

✨ New Features

🗄️ ChromaDB & Gemini Embedding Support

Contributed by @niedch — thank you! 🙌

• ChromaDB is now a fully supported vector database backend for RAG, joining pgvector, MongoDB Atlas, Elasticsearch, and Qdrant. Includes docker-compose.chroma.yml for local development.
• Gemini Embedding Model added as a natively supported embedding provider.

⚙️ Global Variable Store (vars)

A new non-encrypted, deployment-wide key-value store for runtime configuration. Change operational values — LLM models, API endpoints, feature flags, temperatures — across all agents simultaneously without redeployment.

• Dual-backend persistence: MongoDB (globalvariables collection) and PostgreSQL (global_variables table).
• Late-binding resolution via ${vars:key} in any template or config field, resolved at runtime alongside ${vault:key}.
• Full REST CRUD API with tenant isolation.
• Template-layer access via {{vars.key}} in system prompts and HTTP call templates.

📎 Multimodal Attachments

Added end-to-end support for file attachments in conversations:

• Dual-backend storage: PostgreSQL (BYTEA) and MongoDB (GridFS) with configurable size caps (default 20MB).
• Magic-byte MIME validation for 14 file types without external dependencies.
• LLM forwarding: Images are automatically converted to base64 data URIs for maximum provider compatibility. Oversized images (>10MB) gracefully degrade to text placeholders.
• GDPR-compliant: Cross-conversation access denied by design; cascading erasure support.

🧠 DreamService — LLM-Driven Memory Summarization

A config-driven memory consolidation engine that compresses related user memory entries during scheduled "dream" cycles.

• Configurable grouping by category or agent provenance, with multi-agent visibility upgrades.
• Cost-bounded: maxSummarizationCalls and maxCostPerRun (default $0.50) prevent runaway LLM spend.
• Safety guarantees: Insert-before-delete pattern with rollback on partial failure. LLM errors or garbage output skip the group and leave originals untouched.
• LLM output guardrails: Rejects blank keys/values, truncates to safe limits, caps result count.

💬 Channel Integrations & Slack

Completely rearchitected channel integration system, decoupled from agent configurations:

• Standalone ChannelIntegrationConfiguration resource — first-class versioned MongoDB document with platform credentials, targets, and trigger keywords.
• Multi-target routing: Multiple agents or groups on a single Slack channel, with deterministic colon-required triggers (e.g., architect: question).
• Thread target locking: First message in a thread locks the target, preventing jarring mid-conversation switches.
• Direct Message support: Slack never fires app_mention in DMs — channel_type: "im" is now detected and routed correctly.
• Startup migration: Automatic, non-destructive migration of legacy ChannelConnector configs on first boot.
• MCP admin tools: 6 new tools for managing integrations programmatically.

🛡️ Agentic Safety & Orchestration

• Behavioral Counterweights: Config-driven safety injection into LLM system prompts with preset levels (cautious, strict) and customizable instructions. Strict auto-downgrades to cautious for scheduled agents.
• Identity Masking: Prepends identity concealment rules to system prompts, independent of counterweights.
• Session Checkpoints: Memory checkpoint and rollback service with type-aware property restoration, auto-pruning, and Micrometer metrics. Dual-backend (MongoDB + PostgreSQL).
• A2A Capability Registry: Deterministic round_robin strategy (replaced broken shuffle), public discovery endpoints, audit trail for capability selections, miss/strategy metrics.

🔧 Tool Response Management

• Paginated responses: Oversized tool output is split into retrievable pages via FetchToolResponsePageTool, enabling the LLM to navigate large results.
• LLM summarization: New summarize truncation strategy routes oversized responses through a cheaper model (configurable via summarizerModel), inheriting the parent task's full provider context. 6-point fallback chain degrades gracefully to truncation on any failure.
• Lazy tool discovery: DiscoverToolsTool meta-tool allows the LLM to discover available tools by category/keyword instead of receiving all schemas upfront, reducing context window overhead.

🔐 Security & Compliance

Cryptographic Agent Identity

• End-to-end Ed25519 signing of group conversation transcript entries with versioned key rotation.
• Nonce-based replay protection (Caffeine-backed, 5min TTL, 30s clock-skew tolerance).
• Fail-safe design: Signing failures discard the broken signature and fall back to unsigned entries, rather than persisting corrupt data.
• Peer verification: Receiving agents can verify prior speakers' signatures when requirePeerVerification is enabled.

Supply Chain & Infrastructure Security

• Docker image signing with Sigstore cosign (keyless OIDC) on every release.
• SLSA provenance attestation pushed to Docker Hub alongside images.
• ClusterFuzzLite continuous fuzzing for PathNavigator and MatchingUtilities — security-critical input parsers.
• Trivy image scanning gates Docker push on CRITICAL CVEs.
• Gitleaks secret scanning in CI.
• CycloneDX SBOM generation for EU AI Act compliance.
• SPDX copyright headers added to all 1,089 Java source files.

Vulnerability Fixes

• CVE-2026-42198: Pinned PostgreSQL JDBC driver to 42.7.11 (CVSS 7.5 High — SCRAM iteration count DoS).
• Log injection (CWE-117): Centralized LogSanitizer applied across 17+ files, handling \r, \n, \t, and Unicode line separators.
• Array bounds & arithmetic overflow: Guards added to CronDescriber, RestConversationStore, DescriptorStore pagination.
• TOCTOU quota fix: tryAddCost() boundary aligned with checkCostBudget(). Quota acquisition moved after all validation checks.
• Fail-closed cost accounting: PostgresTenantQuotaStore.tryAddCost() now returns DENIED on SQL failure instead of OK.

Governance

• Added GOVERNANCE.md with code review standards and CODEOWNERS.
• Force-push prohibition enforced via .githooks/pre-push hook.
• RHEL/OpenShift certification documentation rewritten.

🐞 Bug Fixes

• Docker Compose startup crash — Non-auth compose files were missing EDDI_SECURITY_ALLOW_UNAUTHENTICATED=true, causing AuthStartupGuard to block startup.
• Template error messages — Errors now include the failing parameter key, the Qute engine's specific cause, and a preview of the template, instead of a generic message.
• PowerShell install script — Fixed iwr | iex failures caused by block comments and [CmdletBinding()] in expression parser context. Switched to download-and-execute pattern.
• Boolean matching guard — MatchingUtilities now guards the Boolean branch behind an existence check.
• MongoDB healthcheck — Docker Compose now uses authenticated MongoDB healthcheck.
• MigrationLogStore injection — Migration classes now inject the IMigrationLogStore interface instead of the concrete MongoDB class, fixing failures in the PostgreSQL profile.
• Property scope loss on rollback — MemoryCheckpoint now preserves the full Property object (scope, visibility) instead of flattening to raw values.
• Tenant signing key mismatch — GroupConversationService.sign() now uses defaultTenantId instead of gc.getUserId() for private key lookup.
• Late-binding prefixes — Renamed ${eddivar:...} → ${vars:...} and ${eddivault:...} → ${vault:...} with backward-compatible dual-pattern regex.
• Tenant Quota persistence — Quota stores upgraded from in-memory only to durable MongoDB and PostgreSQL backends. Restarts no longer reset quota counters.
• Extension endpoint URI wrapping — Task type identifiers are now wrapped in a URI to clarify whether the full URI or just the identifier should be used (contributed by @niedch).
• V1 support removed — Cleaned up legacy V1 code paths and set proper default values.
• Keycloak auth integration overhaul — Added eddi-backend-audience mapper so tokens include the backend audience claim; injected a runtime __auth_config__.js endpoint so the Manager UI auto-discovers Keycloak URL, realm, and client ID without build-time config; widened CSP connect-src to allow Keycloak origins; set default user passwords to non-temporary; added static asset permit paths for new branding files (contributed by @rolandpickl).
• MCP endpoint audit — 13 fixes — Comprehensive audit of all MCP tool endpoints uncovered and fixed: empty read_resource for langchain configs (missing @JsonProperty), group discussion returning raw metadata instead of agent output, list_conversations agent filter using wrong accessor, read_conversation_log NPE on null log size, delete_agent_trigger returning 200 for missing resources, chat_managed reusing stale triggers after conversation deletion, version=0 resolution not delegating to getCurrentResourceId, returningFields filter being silently ignored, chat_managed blocking the event loop (missing @Blocking), and group discussion ...

EDDI 6.0.2 Release Notes

Release Date: April 2026
Platform: Java 25 · Quarkus 3.34.5 · langchain4j 1.13.0

EDDI 6.0.2 is a security hardening and quality assurance release. It delivers comprehensive security fixes, a 2.5× increase in test coverage, a fully rewritten Admin UI, and a hardened CI/CD pipeline — bringing the platform to OpenSSF Silver compliance readiness.

🔐 Security Hardening

SSRF Prevention

• SafeHttpClient — New centralized, SSRF-safe HTTP client with per-hop redirect validation. All LLM tools (WebScraper, PdfReader, WebSearch, Weather) migrated from inline HttpClient to @Inject SafeHttpClient
• UrlValidationUtils — Extended to block IPv6 ULA, CGNAT, IPv4-mapped IPv6, multicast, and unspecified address ranges
• Redirect hardening — Manual redirect loop (max 5 hops) with same-origin/cross-origin header policies. Overall wall-clock timeout across redirect chains

Vault & Encryption

• Per-deployment random KEK salt — Each EDDI instance now generates a unique 16-byte salt for key derivation (was hardcoded). Backward-compatible: existing deployments auto-detect and use legacy salt
• KEK rotation salt migration — rotateKek() now properly migrates from legacy to new salt during key rotation
• API key auto-vaulting — Agent setup automatically stores API keys in the Secrets Vault, persisting only vault references (${eddivault:...}) in MongoDB

Authentication & Authorization

• AuthStartupGuard — Fail-loud production auth check: EDDI refuses to start if OIDC is disabled in production (escape hatch: eddi.security.allow-unauthenticated=true)
• RBAC on 7 REST endpoints — Added @RolesAllowed annotations to previously unprotected admin/user endpoints
• Fine-grained permit rules — Static assets GET/HEAD only, health endpoint GET only, Slack webhook POST only (was blanket permit for all methods)

HTTP & Protocol

• Security response headers — X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Content-Security-Policy
• Qute strict rendering — Templates fail loudly on missing variables in production
• Jackson 3.x ban — maven-enforcer-plugin rule prevents accidental introduction via transitive dependencies
• Log injection prevention — sanitizeForLog() applied to all user-controlled identifiers in log statements

Container & Docker

• MongoDB 6.0 → 7.0.14 (pinned), with authentication enabled
• MongoDB port binding — 127.0.0.1:27017 (was all interfaces)
• Docker healthchecks added for both EDDI and MongoDB
• Base image — Pinned to immutable digest for supply-chain integrity
• CVE-2026-4424 remediated via digest pin

🧪 Testing & Quality (2,400 → 5,100+ tests · >80% coverage)

Test Suite Expansion

• 5,100+ total tests (up from ~2,400 in 6.0.1) — 4,500+ unit tests, 550+ integration tests
• >80% combined test coverage (unit + integration tests merged) — instruction, method, and class coverage all exceed 80%
• Coverage-guided fuzz testing — Jazzer v0.30.0 with harnesses for PathNavigator and MatchingUtilities (security-critical parsers)

Test Infrastructure Improvements

• Testcontainers ITs for all datastore adapters — MongoDB (75 tests) and PostgreSQL (57 tests) covering every persistence adapter
• WireMock-based API tests — Config-driven agent ITs for LLM, HTTP calls, PropertySetter, and complex rules
• JaCoCo two-tier gates — Merged UT+IT coverage gate enforced in CI

📊 Observability & Monitoring (improved)

OpenTelemetry Distributed Tracing

• Added per-task pipeline spans (eddi.pipeline.task) with task.id, task.type, conversation.id, agent.id attributes
• Backend-agnostic via OTLP protocol (Jaeger, Tempo, Datadog, Honeycomb)
• Auto-instrumented: REST endpoints, Vert.x HTTP, MongoDB
• Disabled by default — zero overhead in production without a collector

ConversationCoordinator Hardening

• Max-size limit — Configurable eddi.coordinator.max-active-conversations (default 10,000) with backpressure rejection
• Eager cleanup — Empty queues removed on drain, preventing memory leaks from abandoned conversations
• CAS loop race fix — submitInOrder / submitNext race condition resolved with compare-and-swap loop

Metrics & Dashboard

• Added 3 Micrometer gauges — active_conversations, queue_depth, total_processed
• Added pipeline task metrics — eddi.pipeline.task.duration Timer + eddi.pipeline.task.errors Counter (tagged by task.id/type)
• Added pre-built Grafana dashboard — 14 panels across 5 rows (Coordinator, Tools, Vault, NATS, HTTP/JVM)
• Added one-command monitoring stack — docker-compose.monitoring.yml (Prometheus v3.4 + Grafana 11.6 + Jaeger 2.7)

⚡ Multi-Tenancy & Quota Enforcement (improved)

• Atomic quota enforcement — Fixed TOCTOU race condition in TenantQuotaService. Check+record merged into single synchronized block per tenant
• Monthly cost reset — Fixed bug where monthlyCostUsd accumulated indefinitely (now resets on UTC calendar month boundary)
• Quota ordering fix — Quota is now acquired AFTER all validation checks, preventing quota exhaustion from invalid requests
• Metrics hygiene — Quota counters no longer inflate when quotas are disabled

🔄 CI/CD Pipeline (improved)

Security Scanning (6 new tools added)

Build & Release Hardening

• Sigstore cosign — Keyless OIDC container image signing on Docker Hub push
• Red Hat preflight — Certification check on push events (not just PRs)
• Failsafe timeout — 15-minute cap prevents CI hangs from Docker build failures
• Unified CI pipeline — GitHub Actions (compile → test → Docker build → Trivy → smoke test → ZAP → push → sign)

🖥️ EDDI Manager (improved)

The EDDI Manager was completely rewritten in 6.0.1 (React 19 + Vite + Tailwind CSS). Version 6.0.2 focuses on stability, bug fixes, and UX polish.

6.0.2 Improvements

• 🔧 Studio editors fix — Normalized eddi:// prefix handling for pipeline extension types
• 📐 Resizable panels — Side panels in Studio are now drag-resizable
• 📝 Snippet creation fix — Name validation ([a-z0-9_]+) with auto-sanitization and real error messages
• 🔄 Resilient version resolution — Resource detail pages handle undefined versions gracefully
• 🐛 9 bugs fixed from comprehensive codebase audit (auth headers, version staleness, URI schemes, UX)
• 🏗️ pkg → wf/workflow rename — All variables and IDs aligned with backend terminology
• 🔒 Cascade save hardening — Prevented stale version context causing save failures
• 🧪 16 new tests — Cascade-save and resource-usage coverage

💬 Chat UI (improved)

6.0.2 Improvements

• 📎 Attachment upload — Added file upload support with multipart form submission
• 🔄 SSE stream fix — Fixed hang on [DONE] event that left connections open
• 🔐 Security hardening — Improved input sanitization, CSP compliance, HTTPS-only cookies
• ♿ Accessibility — Added ARIA labels, keyboard navigation, focus management
• 📖 README overhaul — Aligned with EDDI ecosystem documentation styling

🔧 Platform & Dependencies

Other Improvements

• JDK 25 compatibility — --enable-native-access=ALL-UNNAMED for JNA
• WhiteSource/Mend false positive — Removed 25 bloated HTML license files that triggered Bootstrap CVE flags; replaced with 13 clean SPDX plain-text licenses
• Slack integration hardening — Improved per-agent credentials, fixed dead retry logic, enterprise-grade error handling, Jackson JSON migration, TTL caches, graceful shutdown
• Group conversation safety — Added maxTurns safety cap preventing runaway multi-agent discussions

📚 Documentation (improved)

• Architecture doc — Added sections: Multi-Agent Orchestration, MCP Integration, Persistent Memory, Agent Sync
• Project Philosophy — Expanded from 7 → 9 Pillars (added Persistent Memory, Agent Portability)
• Security Architecture — Added SSRF 3-layer model, vault encryption model, auth decision matrix
• Monitoring Guide — Added metrics reference, tracing setup, 6 alerting rules, production checklist
• Slack Integration Guide — Updated with per-agent config, troubleshooting, building custom channels
• ~6 MB stale docs purged — Removed legacy GitBook assets, research dumps, implemented plans

⬆️ Upgrade Notes

Breaking Changes

• Production auth enforcement — EDDI now refuses to start without OIDC in production mode. Set eddi.security.allow-unauthenticated=true to opt out
• Docker Compose — MongoDB now requires authentication. Copy .env.example → .env and set credentials
• Security headers — X-Frame-Options: DENY may break iframing EDDI's UI. Configure CSP if embedding is needed

Migration

• Vault salt — Fully automatic. Existing deployments continue using legacy salt; new deployments get random salt. No operator action require...

EDDI 6.0.1 · Post-GA Enhancements · April 2026
Tech Stack: Java 25 · Quarkus 3.34.3 LTS · LangChain4j 1.13.0 · React 19 · Vite

🎯 What is EDDI 6.0.1?
Following the massive v6.0.0 General Availability release, the 6.0.1 update introduces our first official natively embedded Channel Connector for Slack, bringing EDDI's advanced multi-agent capabilities directly into enterprise workspaces.

Alongside Slack integration, this release delivers significant enterprise-grade frontend refinements to the EDDI Manager, performance optimizations, and security and observability improvements across both backend and UI.

✨ Highlights

💬 Slack Integration (Preview)
EDDI now supports direct, multi-agent Slack connections through the per-agent ChannelConnector architecture.

Per-Agent Workspaces — Move away from server-level config. Each agent can connect to different Slack workspaces through dynamic ChannelConnector routing.
Groups in Slack — Native support for orchestrating multi-agent debates directly inside Slack threads, complete with intelligent "agent-follow-ups" and synthesis fallback wrappers.
Vault-Backed Credentials — Securely manage botToken and signingSecret values exclusively through EDDI's Vault SecretResolver.
Enterprise Hardening — Production-ready reliability implementing API rate-limit exponential backoff, dead-retry resolutions, TTL cache memory leak prevention, structured exhaustion logging, and infinite-loop message chunking runtime guards.
Safe Group Limits — Added a dynamic maxTurns safety cap to prevent unbounded AI loops across all discussion phases.

🖥️ Manager UI Overhaul & UX Polish
The EDDI-Manager React codebase received extensive usability refactoring ranging from observability screens to deployment setups.

Full-Fledged Logs Observability — Replaced the bare-bones logs view with real-time SSE live-streaming, agent-aware conversation filtering, and a powerful, searchable combobox conversation picker to drastically improve developer debugging.
Audit Trail Integrity Verification — Visual confirmation of data integrity with per-entry HMAC badges and conversation signing status summaries, assuring tamper-proof record validation at a glance.
Unified Combobox Secret Picker — Standardized secret management globally by deploying a modern, autocomplete-enabled Combobox (SecretKeyPicker) across Slack, RAG, and LLM config editors.
Robust Agent Trigger Selection — Managing Intent constraints replaced with a rich Agent Picker combobox equipped with debounced backend lookups by Name & ID.
Group Creation Wizard Review — Upgraded the Group Creation wizard with a comprehensive configuration review and confirmation step.
Dynamic Backend Version — The Manager sidebar actively retrieves and displays the EDDI platform version dynamically via the OpenAPI endpoint.

Full Changelog: 6.0.0...6.0.1

General Availability · April 2026

This is the production release of EDDI v6 — the most significant update since the project's inception. A ground-up modernization spanning backend architecture, security, observability, AI capabilities, and developer experience.

Tech Stack: Java 25 · Quarkus 3.34.3 LTS · LangChain4j 1.13.0 · MongoDB / PostgreSQL

🎯 What is EDDI v6?

EDDI v6 is a complete rewrite and modernization of the multi-agent orchestration middleware. Following the RC1 release candidate (March 2026) and extensive hardening, this GA release delivers production-grade reliability with 2,400+ tests, comprehensive security audits, and significant quality-of-life improvements.

What Changed Since RC1

The RC2 hardening cycle resolved 70+ issues across security, testing, import/export, CI/CD, auth, and developer experience — transforming a release candidate into a production release:

• Testing: 1,500+ → 2,400+ tests (unit + integration), 250+ new integration tests across both MongoDB and PostgreSQL
• Security audit: 6 vulnerability remediations (Mend Bolt), CodeQL SSRF + regex injection fixes, surgical model cache invalidation on vault secret rotation, template data collision protection
• Import/export hardening: Descriptor versioning, DocumentDescriptor lifecycle management, PostgreSQL UUID validation, RESTful 201 responses
• Keycloak auth: Fixed 3 compounding bugs that made --with-auth completely non-functional (OIDC hybrid mode, missing user credentials, SPA asset blocking)
• CI/CD: Unified GitHub Actions pipeline, Red Hat preflight on push, Testcontainers-based E2E tests, semver Docker tags (6.0.0, 6.0, 6, latest)
• Agent Father: API key auto-vaulting, password input mode, vault key collision fix, UX polish
• Dependencies: Quarkus 3.34.3, LangChain4j 1.13.0, swagger-annotations 2.2.48, commons-lang3 3.20.0
• Documentation: Architecture doc expanded (4 new sections), project philosophy (7 → 9 pillars), ~6 MB stale docs purged

✨ Highlights

🤖 Multi-Agent Orchestration

• 🔀 Intelligent Routing — Direct conversations to different agents based on context, rules, and intent
• 🗣️ Group Conversations — Multi-agent debates with 5 built-in discussion styles: Round Table, Peer Review, Devil's Advocate, Delphi, and Debate
• 🪆 Nested Groups — Compose groups-of-groups for tournament brackets, red-team vs blue-team, and panel reviews
• 👥 Managed Conversations — Intent-based auto-routing with one conversation per user per intent
• 🎯 Capability Matching — Discover and route to agents by skill, confidence score, and custom attributes
• 🧙 Agent Father — Meta-agent that creates other agents through conversation (ships out of the box)

🧠 12 LLM Providers

🧩 MCP Integration

• MCP Server — 42+ tools exposing full EDDI control to Claude Desktop, Cursor, IDE plugins, or any MCP client
  • Agent CRUD, deployment, conversation, diagnostics, trigger management
  • setup_agent composite tool — creates a full agent pipeline in one call
  • create_api_agent — paste an OpenAPI spec, get a fully deployed API-calling agent
  • Group conversation tools, user memory tools, resource management
• MCP Client — Agents connect to external MCP servers and use their tools during conversations

🔗 A2A Protocol

• Full Agent-to-Agent peer communication implementation
• Agent Cards for discovery and skill advertisement
• Cross-platform interoperability via langchain4j-agentic-a2a

📚 RAG — Retrieval-Augmented Generation

• 7 embedding providers: OpenAI, Ollama, Azure OpenAI, Mistral, Bedrock, Cohere, Vertex AI
• 5 vector stores: pgvector, In-Memory, MongoDB Atlas, Elasticsearch, Qdrant
• httpCall RAG — Zero-infrastructure RAG via any search API
• REST ingestion API — Async document ingestion with status tracking
• First-class versioned knowledge base resources with full CRUD

💭 Memory & Context Management

• 💾 Persistent User Memory — Cross-conversation fact retention with visibility scoping (global, agent, group)
• 🧠 LLM Memory Tools — Built-in tools agents can call to read, write, and search their own persistent memory
• 💤 Dream Consolidation — Background memory maintenance: stale pruning, contradiction detection, fact summarization
• 🪟 Token-Aware Windowing — Intelligent context packing with model-specific tokenizer support and anchored opening steps
• 📝 Rolling Summary — Incremental LLM-powered summarization of older turns with Conversation Recall Tool for drill-back
• 🔧 Property Extraction — Config-driven slot-filling with longTerm / conversation / step scoping
• 🛡️ Memory Policy (Commit Flags) — Strict write discipline marks failed task output as uncommitted and injects concise error digests for graceful degradation

📈 Smart Model Cascading

• Sequential model escalation with 4 confidence strategies (structured_output, heuristic, judge_model, none)
• Per-conversation cost budgets and tenant cost ceilings with automatic enforcement

🔐 Enterprise Security

• 🏦 Secrets Vault — Envelope encryption (PBKDF2 + AES-256) with tenant-scoped DEK/KEK rotation. API keys auto-vaulted during agent creation
• ✍️ Agent Signing — Ed25519 cryptographic identity per agent; audit entries signed with agent private keys
• 🛡️ SSRF Protection — All tools validate URLs against private IPs, internal hostnames, and non-HTTP schemes
• 🔒 Sandboxed Evaluation — Recursive-descent math parser only. No eval(), no script engines, no reflection-based execution
• 🔑 OAuth 2.0 / Keycloak — Multi-tenant authentication with correctly wired OIDC service mode
• 🛡️ Template Data Protection — Reserved key deny-list prevents LLM prompt injection into internal template variables
• 🔄 Surgical Cache Invalidation — Vault secret rotation triggers targeted model cache eviction

📜 Regulatory Compliance

🗄️ DB-Agnostic Architecture

• PostgreSQL support — Full storage adapter with JSONB + indexed columns
• MongoDB sync driver — Migrated from reactive to proper sync driver
• Switch databases with one env var: EDDI_DATASTORE_TYPE=mongodb|postgres
• Caffeine cache — Lightweight, Micrometer-instrumented (50 entries, 30min TTL)

🔄 Agent Sync & Portability

• Live Sync — Instance-to-instance agent sync with structural matching, content diffing, and selective resource picking — no ZIP intermediary
• Granular Import/Export — Upgrade strategy preserves resource IDs, prevents breaking references
• ZIP Portability — Agents portable as ZIP files with automatic secret scrubbing on export

⏰ Scheduled Execution & Heartbeats

• 🫀 Heartbeat triggers at configurable intervals for proactive agent behavior
• ⏲️ Cron scheduling with persistent or new conversation strategies
• 📊 Fire logging with status, duration, cost tracking, and retry logic
• 🌙 Dream cycles — scheduled background memory consolidation with cost ceilings per run

🖥️ Manager Dashboard

• Complete React 19 rewrite — Vite + Tailwind CSS + shadcn/ui + TanStack Query + Zustand
• 11 languages — EN, DE, FR, ES, AR (RTL), ZH, TH, JA, KO, PT, HI
• Pages: Dashboard, Agents (wizard + version picker + env badges + import/export), Chat (SSE streaming + history), Resources, Logs (live SSE), Audit Trail, Secrets, Coordinator, Schedules, Groups

📝 New in GA (Since RC1)

• 📎 Prompt Snippets — Reusable, versioned system prompt building blocks ({{snippets.safety_rules}})
• 📎 Multimodal Attachments — Image, PDF, audio, video input with MIME-based routing and content type matcher
• 🔮 Template Preview — REST endpoint for previewing resolved system prompts with sample/live data
• 🏗️ One-Command Installer — Interactive wizard for Linux, macOS, WSL2, and Windows PowerShell
• 📊 50+ Micrometer Metrics — Tools, vault, memory, scheduling, conversations
• 🔍 Compliance Startup Checks — Advisory warnings on boot for TLS and database encryption gaps

🔧 Breaking Changes (v5 → v6)

Release Candidate 1 · March 2026

This is a pre-release. It represents a complete rewrite and modernization of the EDDI platform for production evaluation. The final v6.0.0 release will follow after community feedback and stabilization.

🎯 What is EDDI v6?

EDDI v6 is the most significant update since the project's inception — a ground-up modernization of the multi-agent orchestration middleware spanning backend architecture, security, observability, AI capabilities, and developer experience. This release introduces 311 commits of new features, hardening, and quality improvements over the v5 baseline.

Tech Stack: Java 25 · Quarkus 3.34.1 LTS · LangChain4j 1.12.2 · MongoDB / PostgreSQL

✨ Highlights

🤖 Multi-Agent Orchestration (NEW)

• Group Conversations — Multi-agent debates with 5 built-in discussion styles: Round Table, Peer Review, Devil's Advocate, Delphi, and Debate
• Nested Groups — Compose groups-of-groups for tournament brackets, red-team vs blue-team, and panel reviews
• A2A Protocol — Agent-to-Agent peer communication with skill discovery and Agent Cards (via langchain4j-agentic-a2a)
• Smart Model Cascading — Sequential model escalation with 4 confidence strategies (structured_output, heuristic, judge_model, none) and per-conversation cost budgets

🧠 12 LLM Providers (was 7)

• New providers: Mistral AI, Azure OpenAI, Amazon Bedrock, Oracle GenAI
• OpenAI baseUrl — DeepSeek, Cohere, and any OpenAI-compatible endpoint via a single config field
• Provider-agnostic observability — ObservableChatModel wrapper adds timeout + logging to every provider uniformly

📚 RAG — Retrieval-Augmented Generation (NEW)

• 7 embedding providers: OpenAI, Ollama, Azure OpenAI, Mistral, Bedrock, Cohere, Vertex AI
• 5 vector stores: pgvector, In-Memory, MongoDB Atlas, Elasticsearch, Qdrant
• httpCall RAG — Zero-infrastructure RAG via any search API
• REST ingestion API — Async document ingestion with status tracking
• First-class versioned knowledge base resources with full CRUD

🧩 MCP Integration (NEW)

• MCP Server — 48+ tools exposing full EDDI control to Claude Desktop, IDE plugins, or any MCP client
  • Agent CRUD, deployment, conversation, diagnostics, trigger management
  • setup_agent composite tool — creates a full agent pipeline in one call
  • create_api_agent — paste an OpenAPI spec, get a fully deployed API-calling agent
  • Group conversation tools, user memory tools, resource management
• MCP Client — Agents connect to external MCP servers and use their tools during conversations (via langchain4j-mcp with StreamableHttpMcpTransport)

💭 Memory & Context (NEW)

• Persistent User Memory — Agents remember facts, preferences, and context across conversations with configurable visibility (self/group/global)
• Dream Service — Background consolidation: stale pruning, contradiction detection
• Token-Aware Windowing — Intelligent context packing with anchored opening steps (replaces fixed step counts)
• Rolling Summary — Incremental LLM-powered summarization of older turns with conversation recall tool

🔐 Enterprise Security (NEW)

• Secrets Vault — Tenant-scoped envelope encryption (PBKDF2 + AES-256) with DEK/KEK rotation, Micrometer metrics, negative caching fix, and REST management API
• Immutable Audit Ledger — Write-once trail with HMAC-SHA256 integrity signing for EU AI Act compliance (Articles 17/19)
• SSRF Protection — URL validation blocks private/internal addresses on all tools
• Secret Input — Password-mode chat input with auto-vault for sensitive data (API keys)
• Path traversal fix in MCP doc resources
• No dynamic code execution — OGNL removed (CVE-2025-53192), replaced with Quarkus Qute templating

🗄️ DB-Agnostic Architecture (NEW)

• PostgreSQL support — Full storage adapter with JSONB + indexed columns
• MongoDB sync driver — Migrated from reactive streams (was blocking anyway) to proper sync driver
• All stores use IResourceStorageFactory — switch DB with one env var (eddi.datastore.type)
• Caffeine cache — Replaced Infinispan with lightweight Caffeine (50 entries, 30min TTL)

🔄 NATS JetStream (NEW)

• Event bus abstraction — IEventBus interface with in-memory (default) and NATS JetStream implementations
• Dead-letter handling with retry, Micrometer metrics, Testcontainers integration tests
• Coordinator Dashboard — REST + SSE admin API with dead-letter replay/discard/purge

🖥️ Manager Dashboard (NEW)

• Complete React 19 rewrite — Vite + Tailwind CSS + shadcn/ui + TanStack Query + Zustand
• EDDI branding with dark/light theme, Noto Sans for universal language coverage
• 11 languages — EN, DE, FR, ES, AR (RTL), ZH, TH, JA, KO, PT, HI
• Pages: Dashboard, Agents (CRUD + wizard + version picker + env badges + import/export), Chat (SSE streaming + history), Resources (6 types), Logs (live SSE + history), Audit Trail (timeline), Secrets, Coordinator, Schedules, Groups
• Monaco JSON editor with form↔JSON toggle and version cascade save

💬 Chat UI

• CRA → Vite migration, SSE streaming, Keycloak auth
• Secret input mode (🔒 toggle), password field for backend-driven prompts

⚙️ Developer Experience

• One-command installer — curl | bash or iwr | iex with interactive wizard (DB, auth, monitoring choices)
• Vault key auto-generation — Every installation gets a unique cryptographic key
• Unified CI/CD — Single GitHub Actions pipeline (build → test → Docker → smoke test → preflight). CircleCI removed
• Red Hat container certification — Automated license generation, Docker compliance labels, preflight checks
• Kubernetes — Kustomize overlays, Helm charts, quickstart YAML

🔧 Architecture Changes

Breaking Changes

Naming Alignment

All v5 naming has been systematically updated:

• bot → agent (code, API, MCP tools, docs)
• package → workflow (code, API, configs)
• 349 files changed, 11,253 insertions

A V6RenameMigration runs at startup to rename MongoDB collections and rewrite stored URIs. ZIP import handles both v5 and v6 naming.

📊 By the Numbers

🐳 Docker

docker pull labsai/eddi:6.0.0-RC1

Or use the one-command installer:

# Linux / macOS / WSL2
curl -fsSL https://raw.githubusercontent.com/labsai/EDDI/main/install.sh | bash

# Windows (PowerShell)
iwr -useb https://raw.githubusercontent.com/labsai/EDDI/main/install.ps1 | iex

📖 Documentation

Full documentation: docs.labs.ai

Key guides for v6:

• Architecture — Design overview and pipeline
• LangChain Integration — 12 LLM providers
• RAG — Knowledge base setup
• MCP Server — 48+ tools reference
• A2A Protocol — Agent-to-Agent communication
• Group Conversations — Multi-agent debate
• User Memory — Cross-conversation fact retention
• Model Cascading — Cost-optimized routing
• Secrets Vault — Envelope encryption
• Audit Ledger — EU AI Act compliance
• Kubernetes — Kustomize + Helm deployment

🙏 Feedback

This is a release candidate. Please report issues, suggestions, and feedback via GitHub Issues.

*Full Changelog...

EDDI v5.6.0

What's New

AI Agent & Tooling Framework

This release introduces a comprehensive AI Agent and Tooling system, enabling EDDI bots to autonomously use tools during conversations:

• Declarative Agents — New DeclarativeAgent and DeclarativeAgentTask framework allowing bots to be configured as goal-driven agents that plan and execute multi-step tasks
• Built-in Tools — Eight ready-to-use tools available out of the box:
  • Calculator — Safe math expression evaluation with sandboxed parsing
  • DataFormatter — Structured data formatting and transformation
  • DateTime — Date and time queries and formatting
  • PdfReader — Extract and process text from PDF documents
  • TextSummarizer — Summarize long text content
  • Weather — Fetch current weather data
  • WebScraper — Scrape and parse web pages
  • WebSearch — Perform web searches and return results
• EDDI Tool Bridge (EddiToolBridge) — Integrates EDDI's existing HTTP call system as callable tools for AI agents, enabling full access to any configured REST API
• Chat Memory Integration (EddiChatMemoryStore) — Persistent memory store wired into agent tool execution for context-aware tool use across conversation turns
• Tool Execution Infrastructure — ToolExecutionService with built-in caching (ToolCacheService), rate limiting (ToolRateLimiter), and cost tracking (ToolCostTracker) for production-grade agent deployments

HTTP Client Migration: Jetty → Vert.x WebClient

• Replaced jetty-client with vertx-web-client (managed via Quarkus BOM) for a fully reactive, non-blocking HTTP client
• Implemented IHttpClient using VertxWebClientSession for proper cookie persistence
• Added memory safety checks using Content-Length header validation and post-download size verification
• Improved concurrency and interruption handling in synchronous request wrappers

Security Fixes

• SSRF Protection — Added UrlValidationUtils to validate and block requests to private/internal IP ranges in WebScraperTool, PdfReaderTool, and HttpCallExecutor
• Input Validation — Stricter validation on URL and parameter inputs across HTTP call and tool execution paths
• Safe Math Parsing — Replaced unsafe eval-style evaluation in CalculatorTool with a sandboxed expression parser to prevent injection attacks

Improvements

• ToolCacheService — Improved cache key generation for long arguments; migrated to ConcurrentHashMap for thread-safe caching
• ToolRateLimiter — Enhanced to handle concurrent tool invocations without race conditions
• AgentExecutionHelper — Better retry logic for transient/retryable errors during agent execution
• RestToolHistory — Refactored to use the conversation memory store for tool history retrieval
• HttpCallExecutor — Added null checks for memory and parameters; improved error handling
• LangchainTask — Improved lifecycle management and task reliability
• enableBuiltInTools — Type reverted from boolean to Boolean to correctly support nullable/optional configuration

Dependency Upgrades

Infrastructure & Ops

• Docker Compose: EDDI image now pinned to major version 5 instead of latest for more predictable deployments
• MongoDB: Updated to the latest supported version in docker-compose.yml
• Removed unused disableWWWAuthenticationValidation parameter from HTTP client configuration

Documentation

• New docs/security.md — Documents SSRF protection, input validation, and safe tool execution practices
• New AI Agent tooling guide — Comprehensive documentation covering Bot Father, tool configuration, and agent setup
• Updated Bot Father conversation flow, implementation summary, and LangChain tools guide

Full Changelog: 5.5.1...5.6.0