Release chat activity/unread-count rollout + bump pinned chart versions

[rowan-stein]

User request: release the chat activity status + per-chat unread counts rollout and bump the pinned versions in bootstrap.

Service release tags:

• chat v0.3.3 ✅
• threads v0.4.10 ✅
• tracing v0.3.4 ✅
• chat-app v0.4.13 ✅
• tracing-app v0.2.6 ✅
• agents-orchestrator v0.13.13 ✅
• notifications v0.2.5 ✅
• runners v0.5.7 ✅
• gateway v0.22.7 ⏳ (v0.22.6 release failed due to a duplicate handler; fixed in gateway PR feat(platform): expose llm http port #172)

E2E unblock:

• We will not seed databases from bootstrap (bootstrap is prod-equivalent).
• The gateway E2E failure was caused by the chat-app suite trying to add a synthetic cluster-admin identity to orgs.
• Fix: agynio/e2e#70 removes the cluster-admin membership requirement so tests rely only on normal Gateway/OIDC user flows.
• CI policy update: Gateway (and other service) E2E workflows should not pass init images via workflow env: blocks. The E2E harness should use the latest published init-image tags by default.

Bootstrap changes:

• Update stacks/platform/variables.tf default *_chart_version pins to the released chart versions above.
• After gateway v0.22.7 is released and published to GHCR (chart+image), bump gateway_chart_version accordingly.
• After merge, tag bootstrap v0.3.2.

Refs:

• Architecture tracking issue (now closed): Implement chat activity status + per-chat unread counts + workload room subscriptions architecture#142
• E2E fix PR: fix(chat-app): remove cluster admin membership e2e#70

[rowan-stein]

Update:

• Service release tags were pushed, but notifications v0.2.3 and gateway v0.22.6 image builds failed.
• Fix PRs:
  • Notifications: fix(buf): skip otel go package rewrite notifications#26 (merged) → cut new tag v0.2.4
  • Gateway: fix(threads): drop duplicate handler; add unacked counts gateway#172 (in progress; CI running) → will cut new tag v0.22.7 after merge

Once charts/notifications:0.2.4 and charts/gateway:0.22.7 exist in GHCR, we can proceed with the bootstrap pinned-version bump PR.

[rowan-stein]

Notifications update:

• v0.2.4 chart published but image build failed (authz.go imported internal/.gen OTLP shim).
• Fix PR: fix(authz): use otlp trace import notifications#27 (merged).
• New release tag cut: agynio/notifications v0.2.5 (release workflow running).

Bootstrap bump should use notifications_chart_version = 0.2.5 once the image+chart are confirmed in GHCR.

[rowan-stein]

Notifications release:

• agynio/notifications v0.2.5 release workflow succeeded.
• GHCR published:
  • chart: ghcr.io/agynio/charts/notifications:0.2.5
  • image: ghcr.io/agynio/notifications:0.2.5

Bootstrap bump should pin notifications_chart_version = 0.2.5.

[rowan-stein]

Gateway e2e blocker identified:

• agynio/gateway PR feat(platform): expose llm http port #172 e2e is failing consistently (Playwright timeouts waiting for agent replies).
• E2E deploy (via bootstrap/.github/actions/provision@main) is currently using:
  • agents-orchestrator:0.13.13
  • runners:0.5.5
• agents-orchestrator 0.13.13 (PR fix(reconciler): use admin for list calls agents-orchestrator#166) routes ListWorkloads/ListVolumes through a cluster-admin identity.
• runners 0.5.5 (and 0.5.6) still filters ListWorkloads/ListVolumes by org membership when organization_id is unset, so cluster-admin can’t see workloads/volumes → orchestrator can’t reconcile → agent-based e2e tests time out.

Next action: ship a patch release of agynio/runners that allows cluster-admin to list workloads/volumes (then bump runners_chart_version in bootstrap) so gateway e2e can go green.

[rowan-stein]

New gateway E2E failure mode after runners fix:

• agynio/gateway PR feat(platform): expose llm http port #172 E2E (run https://github.com/agynio/gateway/actions/runs/24962152158 attempt 3) fails across Playwright chat-app suite with:
  • OrganizationsGateway/CreateMembership → 412 failed_precondition: identity not found
• Root cause (from agynio/e2e): chat-api defaults cluster-admin identity id to a3c1e9d2-7f4b-5e1a-9c3d-2b8f6a4e7d10.
• organizations validates membership identities by calling identity.GetIdentityType(identity_id); bootstrap currently seeds authz/OpenFGA tuples for cluster-admin but does not register that synthetic identity in the identity service, so the precondition fails.

Proposed fix (minimal unblocker): patch bootstrap (platform stack) to seed the cluster-admin identity in the identity DB (idempotent), e.g. via a one-shot Kubernetes Job that inserts the identity row once migrations are applied.

Also still pending for the rollout pins:

• bump notifications_chart_version 0.2.2 → 0.2.5
• bump chat_chart_version 0.3.1 → 0.3.3
• bump threads_chart_version 0.4.9 → 0.4.10
• bump tracing_chart_version 0.3.3 → 0.3.4
• bump chat_app_chart_version 0.4.12 → 0.4.13
• bump tracing_app_chart_version 0.2.5 → 0.2.6
• bump gateway_chart_version once v0.22.7 is released