## mckinsey/agents-at-scale-ark — v0.1.68…v0.1.69-rc

_74 commits._

### Features
- **Secrets now support descriptions and labels** — Secrets can now be created and edited with descriptions, aliases, and labels—matching the same rich metadata features available for Configurations. The interface has been unified so both resource types share consistent form fields and editing experiences. (7b6df46)
- **Model base URL configuration support** — Models can now store their base URL in a shared Configuration instead of as a literal value, with an option to move existing literal URLs into configurations. When editing a model with a legacy literal base URL, users see a "Move to configuration" button that pre-fills a configuration dialog, allowing them to convert one-off endpoints into reusable, environment-swappable settings. (666805f)
- **feat: add description, alias and labels to secrets API (#3410)** (caf14ce)
- **feat(controller): set GOMEMLIMIT from cgroup memory limit to prevent OOM under burst (#3415)** (f5b46f5)
- **feat: a2a servers qbds update (#3375)** (e2edbd2)
- **feat(apiserver): expose metrics endpoint and add WAL/slot-lag monitoring (#3334)** (46ba66b)
- **feat: api keys QBDS update (#3326)** (8e964ed)
- **feat: a2a tasks qbds update (#3319)** (6637674)
- **feat(ark-api): expose the MCP server address source (#3188)** (f6ea1cf)
- **feat: add marketplace install feat for Ark resources spec (#3035)** (38658b2)
- **feat: events qbds update (#3148)** (159a486)
- **feat(controller): instrument broker event-emitter drops and latency (#3265)** (1ad7a7a)
- **feat: make ark-broker mandatory and drop its experimental feature flag (#3273)** (76db1b1)
- **feat(sdk): let executors stream tool calls to the broker (#3266)** (476933d)
- **feat: configurations feature integration (#3242)** (0df80b8)

### Fixes
- **Fix task reconciliation backoff logic** — Fixed an issue where annotation updates on A2A tasks were causing immediate re-reconciliation and bypassing the intended backoff delay. The controller now ignores annotation-only changes and only processes updates that affect the task's specification, status, or initial creation, allowing backoff timing to work correctly. (9720909)
- **fix: preserve ark-api uv.lock instead of deleting it on every build (#3434)** (0bac71c)
- **fix: refresh token issue (#3431)** (340b45a)
- **fix: make alias a dropdown instead of a text field (#3378)** (7a6a363)
- **fix(deps): bump grpc to v1.83.2 to address CVE-2026-84445 (#3427)** (b74183e)
- **fix: Bump xmldom to fix CVE (#3416)** (1febc5f)
- **fix: use info icon for engine tool chat notice (#3401)** (9735e64)
- **fix(completions): correct team turn ordering and Anthropic attribution (#3387)** (3ca7cc3)
- **fix(localhost-gateway): source nginx CRDs from chart dependency, fixing devspace (#3390)** (950da10)
- **fix: address CVEs from issue #3379 (#3380)** (9d9b790)
- **fix(deps): bump golang.org/x/crypto to v0.56.0 for CVE-2026-56855 and CVE-2026-78662 (#3373)** (af545a4)
- **fix: don't misclassify completed external A2A tasks as HITL resumptions (#3289)** (4ee7df0)
- **fix(executors/completions): A2A streaming surfaces cancellation cleanly (#2201)** (560f30b)
- **fix(dashboard): use MCP-appropriate placeholders in the MCP server form (#3343)** (8263604)
- **fix(ark-api): stop storing authenticating user identity on MCP auth (#3030)** (1240235)
- **fix: refactor get agents and teams to use list  (#3352)** (d1188e0)
- **fix(ark-sdk): resolve queries as the ServiceAccount named in spec.serviceAccount (#3353)** (6c31369)
- **fix(ci): cache openapi-generator JAR to avoid Maven Central rate limits (#3229)** (f7164b3)
- **fix(dashboard): list pages N+1 fan-out to ark-api (#3330)** (f062337)
- **fix: CVEs 84292 84394 fast uri (#3347)** (bb0bfe5)
- **fix(dashboard): make MCP server description optional (#3342)** (7e00825)
- **fix(dashboard): return 502/504 instead of 500 when ark-api proxy fetch fails (#3328)** (053a3a6)
- **fix(broker): bound in-memory streams by bytes and TTL, stream oversized files on load (#3297)** (313daca)
- **fix: sanitize SVG uploads and force attachment downloads to prevent stored XSS (#3291)** (182ab27)
- **fix(dashboard): scope fetched and cached data by explicit namespace (#3149)** (6eab730)
- **fix(apiserver): scope Secret/ConfigMap access to least privilege (#2685) (#3250)** (62a8741)
- **fix(postgresql): reject too-old watch resourceVersion with 410 (#2680 item 4) (#3223)** (b7a207e)
- **fix: warn when a non-MCP tool is attached to an engine-backed agent (#3300)** (0efc796)
- **fix: bump sharp to 0.35.4 for libheif RCE (XRAY-1063124) (#3315)** (d5829f4)
- **fix: bump js-yaml to 4.3.2/3.15.2 for GHSA-2883-xcg3-v3hh (XRAY-1062554) (#3313)** (c97561f)
- **fix(dashboard): highlight nested sidebar items on the active route (#3292)** (630dfd2)
- **fix: upgrade Next.js to 16.3.3 (CVE-2026-75604) (#3304)** (bc6daca)
- **fix(dashboard): disable save on invalid workflow YAML (#3230)** (f247915)
- **fix(ark-api,ark-sdk): enforce user impersonation on remaining routes (#3176)** (234854d)
- **fix(ark-sdk): apply impersonation headers on read paths (#3175)** (d2aedbd)
- **perf(apiserver): index the resource-version range queries on the PostgreSQL watch path (#3033)** (1d17021)
- **fix(apiserver): raise the postgres floor to 15 and enforce it at startup (#3169)** (a702de6)
- **fix(dashboard): scope URL query params by pathname and persist the ac… (#3147)** (5d22971)
- **fix(broker): persist in-memory streams asynchronously rather than blocking the hot path (#3272)** (293a762)
- **fix: persist MemoryUnavailable and MemoryDegraded conditions on Query status (#3277)** (722dfaf)
- **fix(ark-broker): cascade Query deletion to the sessions read model (#3261)** (ed917ba)
- **fix(postgresql): emit resume-overlap rows as Modified, not Added (#3262)** (7a617c1)
- **fix(deps): bump fast-uri to 3.1.6 for CVE-2026-75899/75931/75975/76172 (#3274)** (401c902)
- **fix: reliable ark-sdk wheel rebuilds  (#3187)** (614b3aa)
- **fix(executor): forward team transcript to a2a members and drop duplicate selector input (#3238)** (ed81ab9)

### Tests
- **test: add A2ATask controller reconcile coverage (#2384)** (fb7290e)
- **test: Add tests for HITL journeys (#3367)** (cc08cdc)
- **test: keep spec.conversationId and status.conversationId in sync (#3320)** (f35aeb2)

### Docs
- **docs: surface authentication and tenancy guides under Operate ARK (#3403)** (de4b0a5)
- **docs: updated contributing.md for dco check part (#3106)** (721c3a8)
- **docs: add etcd/postgres storage backend migration procedure (#3189)** (d861212)

### Chore
- **Version 0.1.69-rc released** — Released version 0.1.69-rc with multiple features including secrets API enhancements (description, alias, labels), marketplace install for Ark resources, configurations feature integration, improved monitoring and stability fixes. This release includes security updates, bug fixes for dashboard navigation and data handling, and performance improvements across the API server, broker, and SDK components. (b018d5b)
- **chore: Consolidate Dependabot updates (#3363)** (4acd1f3)
- **refactor(dashboard): rename workflow runs route to /workflow-runs and move sessions to /sessions (#2976)** (9160975)
- **ci: capture k3s crash diagnostics during e2e bootstrap, fix race condition (#3322)** (d936296)
- **chore: Consolidate Dependabot updates (#3337)** (f84f0cb)
- **chore: bootstrap v0.1.69 development cycle (#3260)** (66c3e7e)
- **chore: Consolidate Dependabot updates (#3268)** (557065f)
- **chore: Consolidate Dependabot updates (#3200)** (668cc18)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/mckinsey/agents-at-scale-ark?utm_source=github-action)._