muster-valkey persistence model as a deliberate cache-only choice (RDB-only is intentional; every critical record is reconstructable at startup), with a per-record-type recovery table, and explain why AOF is not enabled (it does not survive PVC loss, and a config-flip restart is a data-loss footgun). Documentation only; no behaviour change. (#884)valkey (muster-valkey) component now documents that its RDB-only persistence is a deliberate cache-only choice and warns against enabling AOF to “fix” data loss: AOF lives on the same PVC so it does not survive PVC loss/recreation (the failure mode that actually occurs), and flipping appendonly in config + restart is a data-loss footgun (Valkey loads the empty AOF dir and ignores the RDB). Comment-only; no behaviour change. See giantswarm/muster#884.Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.229...v0.0.230
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.13.0...v1.14.0
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.12.4...v1.13.0
agentic-platform-connectivity: kagent agent pods may egress to the cluster Envoy LB VIP on 443/10443, so the STS plugin can reach muster’s OAuth token endpoint (served on the public ingress hostname, which resolves to a private cluster VIP) for on-behalf-of token exchange.{{ .results.<id>.<field> }} — regardless of any flag — so chaining a single value from one step into the next no longer forces that step’s entire result into the response. A new per-step/sub-step output flag controls whether a result is included in the returned document; store remains as a deprecated, backwards-compatible alias. forEach, parallel, and failure-path results are all referenceable consistently. Workflows that still use store now log a one-line deprecation warning naming the affected steps — both on the structured create/validate path and on the CRD reconciler (so a kubectl apply-ed workflow is nudged too).output template: a templated object rendered once after all steps complete, against .input / .results / .vars, and returned in place of the default {execution_id, workflow, status, input, steps[], ...} response. It can select nested fields and combine values across steps while preserving JSON structure (numbers stay numbers, arrays stay arrays), letting a workflow return a small, shaped response. When omitted, the default response is returned unchanged. Because the output template replaces the response, per-step output/store flags no longer affect the returned document when an output template is declared; this is flagged with a one-line authoring warning naming the now-inert flags. Type preservation (no lossy coercion): an output template leaf’s type comes from the value it evaluates to, never from how its rendered text looks. A bare reference path (e.g. "{{ .results.pods.items }}") keeps its original JSON type; a single-action computed leaf keeps the real type of its result, so a numeric expression like "{{ len .results.events.items }}" is a number while a computed string keeps its exact string form. This means values whose form matters — versions, IDs, zero-padded values like "08" or "1.20" — are preserved as-is, with no coercion and no quote workaround. A leaf that mixes literal text with actions (e.g. "v{{ .v }}") renders to a string. Non-finite values (NaN/Inf) are kept as strings.jsonPath / expectNot.jsonPath paths now use the same path navigator as step args and templates, gaining array indexing (e.g. items[0].name) and an optional full Go-template form where the result is exposed as .result (e.g. "{{ (index .result.items 0).name }}"). Existing dotted paths keep working. The duplicate engine.resolvePath and getValueFromPath navigators were collapsed onto a single implementation.output template can now be inspected without temporarily removing the template: pass the reserved _debug: true execution argument and the full response (execution_id, status, and steps[] with every recorded step result, not just output-flagged ones) is returned with the rendered output template alongside it under output. The _debug arg is stripped before validation and step execution, so it never collides with a workflow’s own arguments and is not passed to step tools. Separately, an output-template render error no longer discards the results of steps that already succeeded: the workflow still fails loud (the error is returned and the result is flagged isError), but the response now carries every recorded step result plus an output_error message, so the underlying data stays recoverable for debugging an output-template typo. Default (non-debug, template-renders-cleanly) behaviour is unchanged: only the rendered output template is returned when output is set, the default response otherwise.Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.12.2...v1.12.3
agentic-platform-connectivity: the kagent controller NetworkPolicy (both cilium and kubernetes flavors) scopes intra-namespace ingress to agent pods (app: kagent) and the kagent UI on the controller API port (8083), instead of allowing every pod in the kagent namespace on all ports.Full Changelog: https://github.com/giantswarm/muster/compare/v0.16.1...v0.16.2