Breaking changes
- feat(api)!: Consolidate invitations into one table with role grants (#3453)
Case management
- fix(cases): Return 404 when removing an unattached tag (#3642)
Tables
- fix(tables): Load parent metadata before column mutations (#3649)
Agents
- feat(agents): Add GPT-6 Astra and Claude Fable 5.1 to platform catalog (#3593)
- fix(agents): Tolerate unsigned thinking blocks in session history (#3598)
- docs(skills): Block database migrations in patch releases (#3616)
- fix(agents+mcp): Report current skill version on presets, never pin (#3617)
- fix(agents): Stop retrying user-denied tool calls after approval (#3630)
- fix(agents): Preserve cancellation during runtime teardown (#3647)
- feat(agents): Add Claude Opus 5.5 and Sonnet 5.5 to platform catalog (#3651)
Core actions
- fix(actions): Cap malloc arenas in DuckDB action under RLIMIT_AS (#3643)
Integrations
- feat(integrations): Add TypeSafe System One API template (#3638)
- fix(integrations): Handle OAuth token exchange failures (#3648)
Engine
- fix(engine): Preserve errors with provenance-based secret masking (#3600)
API
- feat(rbac): Synchronize membership with role changes (#3394)
- feat(rbac): Any role grants organization membership (#3447)
- feat(api+ui): Support AWS Secrets Manager as an external secret source (#3498)
- feat(api): Add Bitbucket workspace Git sync (#3601)
- fix(api): Return 422 for malformed workflow IDs (#3639)
- fix(ui+api): Count nested workflows in folder view header (#3641)
Infrastructure
- fix(infra): Read Compose healthcheck ports from container env (#3636)
- feat(infra): Support disabling TLS verification for blob storage (#3637)
- fix(infra): Replace MinIO image with Chainguard in Compose files (#3640)
Observability
- fix(logging): Preserve originating LLM proxy failure stacks (#3442)
Build system
- build: Shrink app images by removing duplicated layers (#3629)
Other changes
- test: Remove redundant and placeholder tests (#3646)
Full Changelog: 1.1.0-alpha.5...1.1.0-alpha.6