Release/1.18.0

.claude/skills/kaizen-research/SKILL.md

@@ -29,12 +29,50 @@ Friday early morning (~6am MT). `kaizen-review-prep` runs ~2 hours later (~8am M
    - https://aws.amazon.com/blogs/machine-learning/ (filter: bedrock, agentcore)
    - Filter to: Bedrock, AgentCore, Bedrock Agents, Knowledge Bases, Guardrails, model availability/region/quota changes.
 
-2. **Strands Agents SDK**
-   - https://github.com/strands-agents/sdk-python/releases
-   - https://github.com/strands-agents/sdk-python/blob/main/CHANGELOG.md
-   - https://github.com/strands-agents/sdk-python/issues?q=is%3Aissue+sort%3Aupdated-desc
+2. **Strands Agents SDK** — note the repo moved: `strands-agents/sdk-python` now
+   redirects to **`strands-agents/harness-sdk`** (a monorepo; the Python SDK lives
+   under `strands-py/`). Use the new name — `gh` search against the old one errors.
+   - https://github.com/strands-agents/harness-sdk/releases
+   - https://github.com/strands-agents/harness-sdk/blob/main/strands-py/CHANGELOG.md
+   - https://github.com/strands-agents/harness-sdk/issues?q=is%3Aissue+sort%3Aupdated-desc
    - For each new release, identify: breaking changes, new hooks/features, fixes that map to current usage in `backend/src/agents/main_agent/`.
 
+2a. **Prompt caching across providers — standing watch (added 2026-09-05)**
+
+   We carry custom code that exists only because Strands' caching support is
+   Bedrock/Anthropic-shaped. Upstream is converging on a provider-agnostic
+   `CacheConfig`, so this is a **subtraction** item: each upstream landing should
+   delete code here, not add it. Check every run, and check it for *all* cacheable
+   families — Anthropic, OpenAI/GPT, and any newly cacheable model — not just the
+   one that prompted this.
+
+   Our carried code, and what would retire it:
+
+   | Ours | Retired by |
+   |---|---|
+   | `usage_normalization.py` — maps `cache_write_tokens`, which Strands drops | [harness-sdk#4193](https://github.com/strands-agents/harness-sdk/pull/4193) (ours) merging + releasing |
+   | `usage_normalization.py` — disjointness shim for OpenAI's inclusive `input_tokens` | [harness-sdk#3546](https://github.com/strands-agents/harness-sdk/issues/3546) landing a `Usage` convention contract |
+   | `build_prompt_cache_key()` in `bedrock_responses.py` | `strands/models/_openai_cache.py::apply_cache_config` — **already on upstream main**, maps `CacheConfig.cache_key` → `prompt_cache_key`. Adopt on the next pin bump. |
+   | `apply_explicit_prompt_cache()` (breakpoints) | No upstream equivalent yet — `apply_cache_config` emits no `prompt_cache_breakpoint`. Ours is OFF by default (measured 57% worse); don't re-enable without re-running the probe. |
+   | `cache_ttl_seconds_for()` in `observability/prompt_cache.py` | A model-derived TTL upstream. Note `apply_cache_config` maps ttl to `prompt_cache_retention` (`in_memory`/`24h`), *not* GPT-5.6's `prompt_cache_options.ttl: "30m"` — so these are not yet the same concept. |
+
+   Each run, answer:
+   - Does the pinned Strands version now ship `_openai_cache.py` / a `CacheConfig`
+     that covers a provider we hand-roll? If so, propose the swap and say which of
+     our modules shrinks.
+   - Did `CacheConfig` gain a field (`cache_key`, `tools_ttl`, `system_prompt_ttl`, …)
+     that maps onto something we do manually?
+   - Any new Bedrock model family with prompt caching? Confirm which API surface
+     serves it — GPT-5.6 caches **only** over the Responses API, and the same model
+     over Converse caches not at all.
+   - Movement on #3546 / #4193, or a new `Usage` convention. Both change what our
+     cost math may assume.
+
+   ⚠️ Never adopt an upstream caching default on inspection alone. This stack has
+   already shipped one caching change whose premise was wrong and cost ~57% more
+   in a live measurement. `backend/scripts/probe_gpt56_cache_rates.py` is the gate:
+   beat the current arm, measured, before switching.
+
 3. **Reference repo — `aws-samples/sample-strands-agent-with-agentcore`**
    - https://github.com/aws-samples/sample-strands-agent-with-agentcore/commits/main
    - Diff the last 7 days (or "since last research run" — whichever is longer). Identify new patterns, removed approaches, or fixes that map to constructs in this repo: agent setup, tool registration, AgentCore Identity flows, Memory configuration, Gateway/MCP wiring.

.github/workflows/nightly.yml

@@ -10,6 +10,22 @@
 #   all                                Run all tracks with default branches
 #                                      (tests + deploy + e2e on develop)
 #
+#   <branch> MUST be `main` or `develop`. Any other branch is rejected with an
+#   error. This is a security boundary, not an oversight: the workflow is
+#   triggered by `schedule`/`workflow_dispatch`, so it runs in the context of the
+#   default branch and its jobs can WRITE the default-branch GitHub Actions cache
+#   scope. Checking out an arbitrary ref would let unreviewed code execute while
+#   holding that cache token and poison entries that privileged workflows later
+#   restore (CWE-349; CodeQL actions/cache-poisoning/*).
+#
+#   The refs are assigned as literal strings in the parser below rather than
+#   sliced out of the track token — keep it that way, so attacker-influenced
+#   text never reaches a `ref:`.
+#
+#   To exercise a feature branch, open a pull request: tests.yml runs per-PR in a
+#   non-privileged context. To make another long-lived branch nightly-testable,
+#   add explicit cases for it in the parser below.
+#
 # Examples:
 #   test-backend-develop
 #   test-frontend-main,test-backend-main
@@ -121,25 +137,58 @@ jobs:
                   run_e2e=true
                   e2e_ref="develop"
                   ;;
-                test-backend-*)
+                test-backend-main)
+                  run_test_backend=true
+                  test_backend_ref="main"
+                  ;;
+                test-backend-develop)
                   run_test_backend=true
-                  test_backend_ref="${token#test-backend-}"
+                  test_backend_ref="develop"
                   ;;
-                test-frontend-*)
+                test-frontend-main)
                   run_test_frontend=true
-                  test_frontend_ref="${token#test-frontend-}"
+                  test_frontend_ref="main"
                   ;;
-                deploy-*)
+                test-frontend-develop)
+                  run_test_frontend=true
+                  test_frontend_ref="develop"
+                  ;;
+                deploy-main)
                   run_deploy=true
-                  deploy_ref="${token#deploy-}"
+                  deploy_ref="main"
                   ;;
-                scan-images-*)
+                deploy-develop)
+                  run_deploy=true
+                  deploy_ref="develop"
+                  ;;
+                scan-images-main)
                   run_scan_images=true
-                  scan_images_ref="${token#scan-images-}"
+                  scan_images_ref="main"
+                  ;;
+                scan-images-develop)
+                  run_scan_images=true
+                  scan_images_ref="develop"
                   ;;
-                e2e-*)
+                e2e-main)
                   run_e2e=true
-                  e2e_ref="${token#e2e-}"
+                  e2e_ref="main"
+                  ;;
+                e2e-develop)
+                  run_e2e=true
+                  e2e_ref="develop"
+                  ;;
+                test-backend-*|test-frontend-*|deploy-*|scan-images-*|e2e-*)
+                  # Refuse any branch outside the allowlist above. This workflow
+                  # runs on `schedule`/`workflow_dispatch`, i.e. in the context of
+                  # the default branch, where the job can WRITE the default-branch
+                  # Actions cache scope. Checking out an arbitrary ref here would
+                  # let unreviewed code run with that cache token and poison
+                  # entries that privileged workflows later restore
+                  # (CWE-349; CodeQL actions/cache-poisoning/*).
+                  echo "::error::Track '$token' names a branch outside the allowlist (main, develop)."
+                  echo "::error::Nightly runs privileged; testing an arbitrary branch here risks Actions cache poisoning."
+                  echo "::error::To test another branch, open a PR (tests.yml runs per-PR) or add the branch to the allowlist in this workflow."
+                  exit 1
                   ;;
                 *)
                   echo "::warning::Unknown track token: $token"

.github/workflows/platform.yml

@@ -99,6 +99,15 @@ jobs:
       # http://localhost:4200 for a local SPA pointed at this deployment.
       # Empty on prod. Mirrors CDK_MCP_SANDBOX_EXTRA_FRAME_ANCESTORS below.
       CDK_ARTIFACTS_EXTRA_FRAME_ANCESTORS: ${{ vars.CDK_ARTIFACTS_EXTRA_FRAME_ANCESTORS }}
+      # "Shared with you" inbox on the artifact library. Default OFF,
+      # opt-in — the reverse of the flags above, because the surface ships
+      # ahead of the product decision about it. Unset resolves to an empty
+      # string, which config.ts treats as off; set the
+      # `CDK_ARTIFACT_SHARE_INBOX_ENABLED` variable to "true" in an
+      # environment to reveal it there. The fan-out rows the inbox reads are
+      # written regardless of this flag, so turning it on shows a complete
+      # inbox with no backfill.
+      CDK_ARTIFACT_SHARE_INBOX_ENABLED: ${{ vars.CDK_ARTIFACT_SHARE_INBOX_ENABLED }}
       CDK_FRONTEND_CERTIFICATE_ARN: ${{ vars.CDK_FRONTEND_CERTIFICATE_ARN }}
       # MCP Apps sandbox-proxy origin (mcp-sandbox.{domain}). Without the
       # cert ARN the construct silently falls back to the CloudFront default

.gitignore

@@ -156,4 +156,4 @@ internal-docs/
 *-report-*.pdf
 audit-*.pdf
 audit-*.md
-review-*.pdf
+review-*.pdf

.kiro/specs/base-color-theming/.config.kiro

@@ -0,0 +1 @@
+{"specId": "7c3f1a48-9d52-4e6b-b0a7-2f8c41d9e5b3", "workflowType": "requirements-first", "specType": "feature"}