What's new in release 1.0

This page summarizes release 1.0.0 of the Navin Platform: the Control Plane API, its workers, the portal, the deployment manifests and the OS packages. Version of the packages: 1.0.0 (os/navin-platform/VERSION, os/navin-manager/VERSION, os/navin-manager-agent/VERSION); version of the Helm chart: 1.0.0 (deploy/helm/enterprise-ai/Chart.yaml).

Related documents:

• Release notes 1.0.0: locked components with their version and licence, SQL migrations, delivered work items (generated by tools/release/notes.py).
• Install the Navin Platform and Upgrade.
• Configuration reference, Helm values reference, OS compatibility.

New features

Installation and distribution

• OS packages for the platform (navin-platform), the Navin Manager console (navin-manager) and the node agent (navin-manager-agent, Python and static Go): DEB (Ubuntu 24.04), RPM (RHEL family 9; the agent from RHEL 8) and pacman (Arch Linux). The platform runs as hardened systemd units grouped by navin-platform.target, with a local PostgreSQL configured by navin-platform-db local and the CLI navin-platform (migrate, status, check, version).
• Guided installer navin-install: checks first (preflight), standalone or cluster mode, resumable, with offline archives per family of systems (navin-install-<version>-<family>.tar.gz).
• Signed package repositories for apt, dnf and pacman (os/repo.sh --sign), and navinctl on every host (status, restart, logs, db status, check).
• Helm chart enterprise-ai with three profiles: values-prod.yaml, values-ha.yaml, values-onprem-gpu.yaml.
• GitOps with one Argo CD ApplicationSet in four layers (infra, data, platform, apps), every third-party chart pinned to an exact version, and the Terraform module platform-bootstrap for the cluster foundation.
• Signed, reproducible release bundle with SBOM, Cosign signatures, Trivy verdict and an offline proof (tools/release/airgap-check.sh).
• Local development: make install, make start and one set of make <service>-* targets per service of the Docker Compose stack.

Identity, access and governance

• Single sign on with Keycloak (OpenID Connect, authorization code with PKCE), LDAP or Active Directory federated in Keycloak, administrators given by directory groups (navin-platform-admins, navin-admins-<tenant>).
• Local sign in for the first administrator, with a password to change at the first sign in and account lockout.
• Multi-tenant isolation with FORCE ROW LEVEL SECURITY on every tenant table, organizations, business units, projects and environments.
• Authorization by roles, OpenFGA relationships and OPA policies on every gateway, with signed policy bundles (EAI_OPA_DELIVERY=bundle).
• Context Authority: signed ExecutionContext, delegations, mandates and break glass access.
• Workload identity with SPIFFE and SPIRE.
• Offline licences signed with Ed25519 (12 or 36 months), checked by the license_check job.

Models and inference

• Model gateway through LiteLLM v1.106.5 with provider registry, model registry, capability check of each request, fallbacks and kill switches per provider, model and tenant.
• Local inference with vLLM (GPU or CPU, one Deployment per model, KEDA on the queue) and Ollama.
• Embeddings of the RAG and of the agent memory through the gateway (local model bge-m3 in the on premises profile), reindexing when the embedding model changes.
• FinOps: versioned prices, estimated cost and quota reservation before execution, measured cost, reconciliation with the invoices, budget alerts.

Agents, tools and MCP

• Agent runtime with durable execution (Temporal), human approvals, heartbeats, sandboxes (gVisor, Kata) and an agent kill switch.
• MCP Runtime on the ToolHive Operator: isolated MCP instances per tenant, project and user, created on demand, put to sleep and destroyed after use. MCP servers are internal only: public servers are refused.
• Marketplace of signed packs, with business packs installed and used end to end.

Data and documents

• Governed RAG: ACL per document and per fragment, quarantine, citations, hybrid search and reranking, Qdrant.
• File security: every file quarantined and scanned by ClamAV and YARA-X before ingestion (EAI_FILE_SCAN_MODE).
• DLP with Presidio, tokenization, encryption with OpenBao Transit or a client HSM (PKCS#11), retention and lineage.
• Client storage adapters: AWS S3, Azure Blob, Google Cloud Storage, IBM COS and SeaweedFS, with capability discovery.

Voice and multimodal

• Speech to text (faster-whisper), text to speech (Kokoro), voice activity detection (Silero), diarization (pyannote), live voice with LiveKit and participant consent.
• Realtime WebSocket with single use token, rate and size limits, and streaming output DLP.
• GPU media workers consuming NATS JetStream, scaled by KEDA on the consumer lag.

Observability, audit and security operations

• Prometheus metrics of the API and of the workers, alert rules, SLO with error budgets, OpenTelemetry traces, Opik for AI traces, Jaeger, OpenSearch for the logs, analytics export to ClickHouse. The platform ships no dashboard server (ADR-0169): machines and services are followed in the Navin Manager (service monitoring tab with its history in the database, host metrics), agents, LLM gateway, FinOps, SLO and security in the portal screens.
• Audit trail in a hash chain per tenant (GET /v1/audit/verify), Audit Gateway with signed seals, daily signed WORM export, SIEM forwarding (webhook, syslog, Wazuh).
• SOC and AI-SDR: detections from Falco, Tetragon and OpenSearch, containment orders, kill switch verified by receipts, four eyes recovery.

Network and cluster security

• Default deny network policies with Cilium, per workload DNS allowlist, cloud metadata denied, WireGuard encryption and SPIFFE mutual authentication between nodes.
• Kyverno admission: image signatures and provenance, Pod Security.
• APISIX gateway with TLS, Coraza WAF and OWASP CRS, rate limits.

SDK and developer tools

• SDK for Python (enterprise_ai, CLI enterprise-ai), TypeScript (@enterprise-ai/sdk, @enterprise-ai/realtime), Go (enterprise-ai-go) and Java (enterprise-ai-java, enterprise-ai-spring).

Changes

Area	Change
Startup	With EAI_ENVIRONMENT=prod the API refuses to start while a production rule is broken and prints every rule (eai.security.startup); staging logs them. A host installed from packages is configured for prod.
Metrics	GET /metrics requires EAI_METRICS_TOKEN (32 characters minimum) outside dev and test.
Embeddings	local-hash-256 (hashing embedder) is refused in production: set a registry embedding model such as bge-m3-vllm.
Files	EAI_FILE_SCAN_MODE=enforce is required in production.
Settings	List settings accept a comma separated text or a JSON array (EAI_CORS_ORIGINS="https://a,https://b" no longer stops the startup).
Database logins	The API uses a runtime login without DDL right (EAI_RUNTIME_DATABASE_URL, member of eai_runtime); migrations and worker use the administrator login.
Observability	OpenSearch (Apache-2.0) replaces Loki for the logs, Opik replaces Langfuse for the AI traces; the dashboards are in the Navin Manager and the portal (ADR-0169), a Grafana run by the client can be linked as a console (licence policy: no AGPL component shipped, ADR-0101).
Internal TLS	The hops between chart workloads are encrypted by Cilium WireGuard and authenticated by SPIFFE; the data services keep their own certificates.

Fixed issues

Issue	Fix
APISIX called the Control Plane over HTTPS while it serves HTTP only: every API call answered 502	Routes of deploy/apisix call the Control Plane over HTTP inside the cluster, encrypted by Cilium
A comma separated EAI_CORS_ORIGINS crashed the startup	List settings read with NoDecode (services/control-plane/src/eai/config.py)
Portal scripts answered 400 after a build run next to a running server	Separate folders for npm run dev (.next-dev) and npm run build (.next)
make start waited for an old log message before declaring the worker started	Start check of the worker fixed
The lifecycle test of make start collided with a local stack already running	Test isolated from the running stack

Known issues

Issue	Workaround
The effects on a running cluster (Tekton controller, Harbor, Kyverno admission, Cilium, KEDA, HPA, Velero backup and restore, Argo CD sync) are validated offline only, without an acceptance cluster	Run the verification and the restore drill on an acceptance cluster before production
High availability on Kubernetes is configured (HA_CONFIGURED), not validated by a recorded failover; MULTI_CLUSTER is not supported	Record a failover test per HA group; plan disaster recovery by restore (Hosting)
Kyverno image signature verification needs access to the Harbor registry of the client	Mirror and sign the images in Harbor
The chart references vLLM (v0.33.0) and Ollama (0.40.14) by tag without digest: eai-image-provenance refuses them outside the signed Harbor projects	Mirror them under harbor.<site>/mirror/ and sign them (Air-gapped installation)
platform.env.example of the package suggests EAI_OIDC_AUDIENCE='eai-control-plane', while the realm shipped in deploy/keycloak puts the audience control-plane in the tokens	Set the audience the tokens of your realm carry (control-plane with the shipped realm)
global.region of the chart is not read by the templates	Set the data residency per tenant (data_residency)
No aarch64 build of the platform and console packages; Debian is not supported for them	Use x86_64 servers with Ubuntu 24.04, the RHEL family 9 or Arch Linux
On Arch Linux the platform package depends on the Python it was built for	Install the Navin release built for the new Python before a Python upgrade
Opik needs a MySQL 8.4 state database (GPL-2.0) that the platform does not ship	Provide MySQL separately, or run without the opik profile
SeaweedFS runs only in the compose stack	Use the S3 compatible object storage of the client in production
Release notes 1.0.0 list the migrations V001 to V196 (89 files); the repository holds V001__core_schema.sql to V201__mcp_runtime_lifecycle.sql (94 files)	Regenerate the notes with tools/release/notes.py when the bundle is built

Deprecations and removals

Item	Status	Replacement
Legacy WORM store EAI_S3_* for the audit export	Kept as the last fallback	Storage profile with purpose audit_worm, or EAI_AUDIT_WORM_STORAGE_PROFILE
Keys in the environment EAI_CONTEXT_SIGNING_KEY, EAI_AUDIT_SEAL_SIGNING_KEY	Dev and test only, refused in production	EAI_CONTEXT_SIGNING_KEY_REF, EAI_AUDIT_SEAL_SIGNING_KEY_REF (OpenBao references)
EAI_AUDIT_SIGNING=hmac	Dev and test only, refused in production	transit or auto with OpenBao
Certificates control-plane-mtls and litellm-mtls	Removed (mounted nowhere)	Cilium WireGuard and SPIFFE mutual authentication
Loki, Langfuse, Grafana	Removed from the shipped stack	OpenSearch, Opik; dashboards of the Navin Manager and the portal; a Grafana of the client is linked with EAI_GRAFANA_URL and the Grafana dashboards stay available as an add-on in docs/observability/grafana