What changed on VegaDūta

Dynamic MCP STDIO servers (npx/uvx packages a tenant admin registers) now spawn inside an isolated mcp-stdio-runner container - no platform secrets, no route to the data tier, non-root, all capabilities dropped, memory and PID limits, and a custom seccomp profile that denies unprivileged user-namespace creation, ptrace and the kernel-attack surface. Previously the package ran as a child of the core JVM holding APP_ENCRYPTION_KEY.

Outcome-based pricing substrate: billable resolution events with evidence classification, idempotent dedupe keys, per-event price snapshots, dispute handling, and a tenant-facing summary API (GET/POST /api/tenant/resolutions).

Public status page at /status backed by a new unauthenticated GET /api/public/status endpoint reporting live component health.

Public API reference at /api-reference covering authentication and the platform's REST surface.

Agent eval gate: dataset/case/run/judge infrastructure with a per-agent quality gate that can block promotion on eval verdicts (V260).

Workflow run pause/resume and input requests (V261, V271) so long-running flows can wait on a human answer.

Community template marketplace with star ratings (V251, V264) and a public gallery at /templates.

First-party plugin catalog (IDE/browser extensions) at /plugins, served by a public GET /api/plugins/catalog.

Public share links for agents and workflows (/a/<id>, /w/<id>) backed by /api/share/** - read-only snapshots that never leak edit surfaces.

Tenant SSO / SCIM provisioning (V253) for enterprise identity rollouts.

Billing webhook event ledger (V250): provider webhooks are deduplicated on a durable unique key so a redelivery can never double-apply a money event.

Commerce product feed (V252) and public /api/commerce/feed/** endpoints for storefront-style agent catalogs.

Human handoff for channel sessions (V214): an operator can take a live WhatsApp/Telegram/etc. conversation away from the agent (AGENT / AWAITING_HUMAN / HUMAN states) and release it back.

Public documentation hubs: /docs plus the /integrations, /ai, /platform and /tutorials libraries, all server-rendered and crawlable.

Turn-level feedback signals (thumbs, star rating, edit, resolved/unresolved) feeding the RL preference pipeline.