Product Updates - v3.76

This release is dominated by three platform themes: the Rise Shell (a new module-federation host app that becomes the front door to the platform, with its own Home, Settings and app-host surfaces), the Claude Runner / agentic app platform (containerised Claude Code with an API, app-scoped containers, and a security review), and ACL Restructure Phase 1 (groups as first-class principals, laying the write-side foundation for the permissions rework). Alongside these: public distribution of the Rise-X toolchain (the rise-x-mcp plugin and @rise-x/apps-sdk published to public registries, plus MCP agent-configuration tooling), cross-ecosystem work enhancements, and a set of permissions and data-fidelity fixes across the API.

🪄 Feature Updates & Enhancements

Rise Shell — new module-federation host application (Feature — Platform)

The new Rise Shell lands as the module-federation host for the apps-first redesign. It ships the core surfaces — Home (app grid, recents, ask bar), Settings (account, company, ecosystem: overview / owners / subscriptions / apps) and the app host page for federated remotes — with OIDC (PKCE) auth including silent renew and 401 recovery, live ecosystem branding (primary colour and logo sourced from session environmentSettings and applied to the shell theme and top-left menu), and global chrome built on @rise-x/ui design tokens. The Select Ecosystem page was also redesigned on @rise-x/ui. (#1524 — rise-x-app #2471, #2489, #2502)

Still open under this ticket: Shell test harness, Playwright E2E for the new surfaces, and reconciling the remaining classic ClientApp/ surfaces.

Claude Runner — containerised agentic runtime and Bulk Invoice app (Feature — AI / Developer Platform)

A new agentic execution capability: a Docker container bundling Claude Code, Python and a workspace, an API to drive a containerised Claude instance, app-scoped (per-tenant) containers, and a V0 app design wired to the Bulk Invoice API. Delivered as apps/claude_runner in rise-x-ai — a FastAPI service that runs headless Claude Code over a corpus of supplier invoices and returns a rate audit, streaming the CLI output as NDJSON, with per-run workspaces on a persisted share, bearer-JWT auth and a per-tenant user allowlist that fails closed. It runs in its own Container Apps environment behind a dedicated audit-only gateway, isolated from the existing AI service mesh. A security review was completed and its findings documented in-repo. (#1487, #1488, #1523, #1538, rise-x-app #2455 — rise-x-ai #402)

Security posture, stated plainly in the decision docs: this is a tool allowlist plus a per-tenant container in a dedicated environment — not a sandbox. The tool allowlist includes interpreters, the agent can read its own run's credential, platform writes are reachable with the calling user's own token, and egress is open. One canary tenant (woodsidehouston) is deployed. Worth a line in any customer-facing security conversation.

ACL Restructure — Phase 1: structure & groups as first-class (Feature — Platform, Permissions)

The write-side foundation for the permissions rework is now in production. Adds a RiseGroup entity, riseGroups collection and grain with system groups seeded on ecosystem creation; adds principles[] to AccessControlList alongside the legacy shape; makes RiseGroupType a required parameter on AddUser (swept repo-wide across v3, v4 and tests); and dual-writes every grant — role grants and direct per-user permissions — to both sinks in a single writer. Reads still use the legacy ACL, so there is no behavioural change for users in this phase. Legacy fields are flagged pending-obsolete and the indexed search path (acl.principles.id) is established. (#1451 — rise-x-api #2063, plus #2087 renaming ACL principle → principal)

Public distribution of the Rise-X toolchain (Feature — Developer Platform)

Rise-X's agent and app tooling is now publicly consumable:

• rise-x-mcp plugin published to a new public marketplace (rise-x/rise-x-ai-public-marketplace, marketplace name rise-x-public) — both MCP servers (prod + test), the domain skill with folded-in integration-authoring reference, and a setup skill for first-time OAuth onboarding. The MCP server implementation and rise-x-agentic-sdlc stay private. Shipped with branch/tag rulesets requiring two approvals, Actions restrictions, secret scanning, Dependabot, private vulnerability reporting, and a custom Rise-X Source-Available License. Two /code-review --fix passes caught and removed real customer tenant names from copied skill docs before anything went public. (#1525)
• @rise-x/apps-sdk published to public npm — publish target switched from GitHub Packages to registry.npmjs.org, MIT licence added, scaffolder template updated so npx @rise-x/apps-sdk init works without GitHub auth. (#1568 — rise-x-app #2492; issue still open — the marketplace skill half, Parts B/C, is outstanding)

MCP — agent-configuration CRUD tools (Feature — AI / MCP)

Five new MCP tools wrapping /api/v4/config/agent — list_agents, get_agent, create_agent, update_agent, delete_agent — closing the loop so Claude can create Rise-X AI agents on the platform and wire them into federated apps. Client-side validation mirrors the API's rules; stored apiKey and sensitive headers read back redacted and round-trip correctly on update; mutations verify writes by echo-diff and surface silently-dropped fields as warnings[]. The agent runtime also moves its MCP-server and hosted-tool caps to env-configurable settings and gains support for the image_generation hosted tool. (#1526 — rise-x-ai #401)

Cross-Ecosystem Work — fan-out and related-work panel (Feature — Platform)

Two enhancements to the cross-ecosystem capability introduced in v3.75:

• Start N target works per submission — StartCrossEcosystemWork gains an IterationCountDataPath, so one submission can start many target works in the remote ecosystem instead of exactly one. Driven by WoodsideHouston Fuel Request → ESEASA Shorebase Access Request, where the business need is one access request per truck, not per fuel request. Iterations run sequentially (the shared transaction isn't thread-safe), the allow-list consent check and relationship creation run per iteration, notifyOnCreate fires per created work, and there's a hard ceiling of 100 iterations. Behaviour is unchanged when no count path is configured. (#1545 — rise-x-api #2073)
• Scope note: the ticket proposed both an array data path and a count data path; only the count path shipped, because the driving Fuel Request flow captures trucks as a scalar (numberOfRequiredTrucks) rather than a repeating section. Array fan-out would have shipped unused. Every iteration therefore receives identical mapped data.
• Two operational caveats worth knowing: (1) any persisted flow that already has iterationSourceDataPath set will have it silently dropped and revert to starting one work, with no error or warning; (2) once at least one target work is committed, a later failure no longer aborts the source submission — created works in the other tenant are not rolled back, and the partial fan-out is logged as started=n/N.
• Related-work panel layout and click behaviour updated for cross-ecosystem works, to the agreed side-peek design. (#1372)

Apps & Dashboards — sharing model refinements (Feature — Platform)

The Apps and Dashboards sharing model is standardised on one visibility mode (Public or Private) and a two-role model (Owner / Viewer) — the Editor role is removed from both surfaces, with a one-time migration promoting existing Dashboard Editors to Owner. "Ecosystem" visibility is renamed Public; setting Public stays environment-owner-only. Under Private, an owner can share per user (Owner/Viewer), per company (Viewer only) and per subscription (View / No access). Granted companies surface in the Viewers table rather than a separate tab, and owners-only sharing plus clearer error surfacing land on the Access tab. (#1535 — rise-x-app #2488)

Invoice Checker 2.0 — refined workflow (Senegal, Houston) (Config — Senegal / Woodside Houston)

The huub-checker workflow was cut back to its most general, necessary parts and set up with text components for dynamic prompts, making the invoice checker reusable across the Senegal and Houston pilot workspaces rather than bespoke per site. (#1406)

Woodside — underpinning maintenance flows and assets (Config — Woodside)

Routine Maintenance and Corrective Maintenance flows created, together with the underpinning Heliport, PO and Contract asset types. (client-woodside #78)

Attachments — unsupported file types no longer fail the whole AI run (Enhancement — AI / Attachments)

Uploading a mix of supported and unsupported files to an AI-enabled attachment component previously failed the entire AI extraction run — a .json alongside a .pdf meant neither was processed. Unsupported types are now filtered out silently and the valid files process normally; the run only fails when no supported files were provided. (#1541 — rise-x-app #2476)

Data-grid — filter a thing column by a sibling cell in the same row (Enhancement — Builder)

A data-grid thing column can now filter its asset search against another cell in the same row — e.g. a Project column that only offers projects belonging to the Customer picked in that row — by resolving {@row.X} tokens in entityDataFilter against the editing row before the search runs. This matches the {@row.X} convention already supported for optionsDataPath and readOnlyWhen. Unresolvable tokens now drop the filter key rather than emitting it unresolved (which the API treated as no filter and answered with every asset). (#1560 — rise-x-app #2487)

A related secondary defect — a work-root-driven filter not picking up a value set during the same session — is not fixed by this change and needs its own ticket.

Currency field — datasource groundwork (Enhancement — Platform, partial)

Path-valued endpoint parameters now resolve for every HTTP verb, which is the datasource plumbing needed for an external rate lookup. (rise-x-api #2070) The Goikid-requested currency field itself — a price field with EUR/GBP/USD selection plus automatic conversion to EUR — is not delivered; #1492 remains open and In Progress. See Reconciliation.

🐞 Bug Fixes (production-detected)

Permissions

Access denied to layout despite being Ecosystem Orchestrator (#1208)

An Ecosystem Orchestrator (and therefore Workflow Owner) could see the Edit Workflow and Builder buttons but hit "Access denied to the layout … for user" on clicking through, and had to re-invite themselves as Workflow Owner to get into the builder. Layout publish permissions are repaired and the grain ecosystem load made async, so an orchestrator can now move to Builder mode for anything in their ecosystem. (PROD — PROD/bwoffshore/BSP Portfolio Management, reported by Julian Twohig.) (rise-x-api #2061)

Data integrity

Data patch/save failing in production (ADPClear) (#1546)

Selecting a barge on an ADPClear work item failed with "Failed to save patched data … BSONObj size: 16875994 is invalid. Size must be between 0 and 16793600 (16MB)" — the work document had grown past MongoDB's 16 MB document ceiling, so no further save could land. Resolved. (PROD — live app.adpclear.io work item, title states "in production".) No linked PR on the board — please confirm whether this was a code fix or a data remediation, as that changes whether the underlying size limit can recur.

⚠️ Pending PROD Confirmation (review — environment unclear or non-prod; your call on inclusion under Bug Fixes)

/api/v4/work/search fails on any sort and on user-guid filters (#1489) The v4 advanced Work search (surfaced as search_works in the Rise-X MCP) returned a bare unknown error for two whole classes of documented request: any sort term at all, and filters on createdBy / lastModifiedBy. Unsorted searches and status filters worked, so the field whitelist was only partly live — meaning Work search could not answer any "most recent" or "modified by this user" question. Fixed, along with a mandatory flowOriginId pin and a proper 504 on timeout. (Explicitly test — api-test.rise-x.io, ADPClear ecosystem, 28 July. High-impact for agent and reporting use cases.) (rise-x-api #2093)

v4 flow-creation endpoint had no authorization check (#1317) POST /api/v4/config/flow/create performed no check beyond authentication — any authenticated user with an environment header could create a draft flow and become its ACL Owner, diverging from v3 (which hard-gates on ecosystem owner) and from the public help site's own statement that only orchestrators can create workflows. Now gated on ecosystem owner or editor, failing closed, with RiseUser.System exempt for internal activation paths. (Security fix, no environment stated — found by code review of the Item Permissions Guide, not by a live report. Reachable on any deployment including PROD.) (rise-x-api #1978)

Delete/Terminate button enabled for users who aren't authorized → 40401 (#1450) The work-item Delete button was enabled by a permission check (Acl.HasAccess(Delete)) while the actual operation was authorized by a different, permission-blind rule (WorkOwnerPolicy: Owner role, or a Draft with all steps in progress). A non-Owner holding a Delete-bearing role therefore saw an enabled button on a submitted work, clicked, and got "Access denied Terminate Work". A regression from the v4 grain migration. (Reported against the ADPClear Delivery flow — a live customer ecosystem — but no explicit PROD/test qualifier; verified across 6 Delivery work items.)

Asset/entity DELETE 403s for non-owner creators (#1598) DELETE /api/v3/entity/{id} returned 403 for a user who wasn't an owner of the asset's flow type — including for an asset they had just created. The block was a second lookup inside the delete handler that fetches the flow for audit-log metadata only, but did so user-scoped and environment-blind, collapsing into an owner-only gate on the flow definition's ACL. Net effect: a member who could view and create assets of a type could not delete the ones they created, via API or the app's own toolbar. Also applied to duplicate, which would 403 after creating the copy. (Explicitly test — api-test.rise-x.io, UIAutomation ecosystem; surfaced by the nightly E2E suite running as a plain member.)

Duplicate asset creates the copy but drops all field data (#1619) Duplicating an asset from the card menu created a second entity that came back with no field data — every committed field on the source was missing on the copy, silently, with no error surfaced. The source was untouched. Distinct from the two authorization bugs above and confirmed to persist after their fixes deployed. (Detected on test by the nightly asset-crud E2E suite, red across 06/07/10 August runs. Note the user-facing severity: silent data loss on an ordinary action.) (rise-x-api #2090)

Duplicate asset required only instance Read, not create capability (#1604) A user who could merely view an asset could produce new instances of that type via Duplicate, bypassing the environment-subscription create-capability gate that plain create enforces. The gap pre-dated the #1598 fix but was masked by that bug's accidental owner-only gate; fixing #1598 exposed it. Duplicate now requires create-capability, not just Read. (No environment stated — found by code analysis while fixing #1598. Note: the issue is still open despite the fix being merged — see the Appendix.) (rise-x-api #2079)

CompanyUserResponse deserialization (rise-x-api #2075) A JsonConstructor was added to CompanyUserResponse with unit tests — a follow-up to the v3.74/v3.75 company user-search work. (No issue and no environment stated; flagged so it isn't lost.)

Maintenance grain timers stopped running past idle collection and scale-in (rise-x-api #2065) Maintenance grain timers now survive Orleans idle collection and scale-in events. (No issue and no environment stated; behaviourally significant for scheduled platform work — worth confirming whether this was a live symptom.)

🔧 Internal / Engineering (not customer-facing — listed for completeness)

• Agentic SDLC — opt-in code-metrics build flag in rise-x-api (p:RiseCodeMetrics=true, inert for normal builds) so the api-code-metrics gate can measure cyclomatic complexity, maintainability index and class coupling without transiently editing csproj files (#1539)
• Agentic PR review moved into CI for rise-x-app — the reviewer workflow plus a dispatch debug switch (#1606 — rise-x-app #2516, #2518)
• Stale-PR automation for rise-x-app — auto-close at 14 days with a warning at 7, staleness measured by last commit, plus the permissions and scheduling fixes to make it work (#1601 — rise-x-app #2504, #2507, #2511, #2512)
• Test automation — asset-lifecycle Block 4 Phase 2 (#2475), conditional-actions deferred coverage (#1486 / #2474), AT-26 route-handler sync fix (rise-x-app #2498 / #2499), AE-07 gated at the API (#2497), asset-lifecycle suite skipped in CI pending the entity-delete fix (#2503), nightly runtime cut 26.4m → 15.9m by reusing one browser context per worker (#2461), vintageRows waitFor debounce race (#2491)
• UI library — FacetedFilter exported, level-only AiConfidence, TableGroupRow cell override (rise-x-app #2500); shx for cross-platform chmod/rm in apps-sdk build scripts (#2496)
• API CI/infra — PR-gate test suite run once with v3 fixture I/O hoisted out of the per-test path (#2091); AppHost pre-built in deploy.ps1 to stop test-deploy runner OOM (#2064); target ecosystem stamped on entity redeploy, stop re-applying addUsers (#2100)
• AI platform migration (in progress) — staging environment and six per-service Bicep app stacks landed (WS1, WS2); CI workflows, CI identity, mesh cutover and cleanup still outstanding (#1442 — 2/6 sub-issues; rise-x-ai #396, #397)

🚧 In Scope on the Board but NOT Shipped (roll to v3.77 or close)

These carry release-tag:v3.76 on the Mega Board but were not at Done at the time of writing. Please confirm which should move to v3.77.

📎 Appendix — Open GitHub issues whose associated PR is merged

Requested cross-check: issues not in a completed state whose linked PR is merged. Nine cases.

Also worth noting: #1615 (targeted relationship removal + related/update authorisation hardening) is open with no merged PR — it was deliberately sequenced to rebase on top of #1628's guard fix. It documents a live cross-tenant read-access exposure on v3 POST /api/v3/work/related/update, so it belongs in the v3.77 security conversation.

📋 Notes

• Bug inclusion policy: only production-detected issues appear under Bug Fixes. For v3.76 that is two items — #1208 (PROD/bwoffshore) and #1546 (live app.adpclear.io, "in production" in the title). Everything under Pending PROD Confirmation is either explicitly test-detected (#1489, #1598, #1619), environment-unstated (#1317, #1604, rise-x-api #2075/#2065), or reported against a live customer ecosystem without an explicit environment tag (#1450 — ADPClear Delivery). Please confirm which should move up.
• The three authorisation bugs on the asset path — #1598 (delete 403s a creator), #1604 (duplicate needs only Read) and #1619 (duplicate drops field data) — are one interlocking cluster found by the nightly asset-crud suite, each exposing the next as it was fixed. #1602 is the remaining sibling (UpdateEntityByIdAsync and the relate paths share the same env-blind lookup) and is not in this release.
• The PROD bug that did not get fixed: #1596 is the clearest production defect in the v3.76 scope — customer-reported data integrity in Lupa production — and it is still at Todo. It is listed under In Scope but NOT Shipped, not under Bug Fixes.
• Board vs milestone reconciliation:
• The board's 26 rows and the PR Dashboard's 35 merged v3.76.0 PRs overlap only partially. Ten merged v3.76.0 PRs trace to issues that are not on the board — #1541, #1535, #1568, #1450, #1486, #1601, #1598, #1606, #1619, #1317 — and are included above so the note reflects what actually shipped.
• rise-x-api #2073 is the board-linked PR for #1545 (cross-ecosystem fan-out) but does not carry the v3.76.0 milestone. Confirm which release it belongs to.
• rise-x-api #2077 (the #1598 delete fix) is likewise absent from the v3.76.0 milestone despite the issue being closed in this window.
• rise-x-ai is not in the v3.76.0 milestone at all — it releases on its own cadence, so #1526 (PR #401), the Claude Runner (PR #402) and the infra migration PRs (#396, #397) are not reflected in the front-end milestone. Their PROD deployment dates need confirming separately.
• The dashboard shows v3.76.0 at 35/35 done, 0 open — a clean cut, in contrast to v3.77.0 (5/29, 24 open).
• Row 26 of the board (feat(mcp): add agent-configuration CRUD tools, #401) is the rise-x-ai pull request added to the board directly, duplicating issue #1526. Counted once.
• Repos touched this release: rise-x-eop (issues), rise-x-app (front-end, incl. the new Shell/), rise-x-api (back-end), rise-x-ai (AI services, Claude Runner, MCP server), rise-x-ai-public-marketplace (new), rise-x-support and client-woodside (config/support items).