---
title: "Platform Update — August 21, 2026"
slug: "platform-update-2026-08-21"
date: "2026-08-21"
tag: "Application"
summary: "Forty production releases in a week — Code Mode gains agent skills, sandboxed execution, Stripe and Vercel deploy targets; per-agent spend caps land in the OS app; the CLI ships a 6.0.0 packaging refactor with opt-in database TLS; and the learner progress report is rewritten around an LLM-written summary."
author: "ibl.ai Engineering"
linkedin: |
  Forty production releases in seven days, and the theme is agents that can actually build and ship things.

  Code Mode now runs agent skills inside a sandbox, auto-configures its own environment, and deploys to Stripe and Vercel — with api.github.com opened in the CSP so a code-mode agent can call the GitHub API directly.

  Also shipped this week across the ibl.ai platform:

  → Per-agent spend caps, settable by platform admins from the agent settings panel
  → Opt-in TLS for Postgres and MySQL in the CLI, off by default, with a PgBouncer sidecar for both legs
  → ibl-cli 6.0.0 — a full packaging refactor into the iblai_config Python package, with no operator action needed at upgrade
  → A rewritten learner progress report: an LLM-written summary in two voices, one for the learner and one for a watching guardian, drawn from the week's figures and the learner's own agent memories
  → Global, tenant-scoped agent memories with new management components
  → A HeyGen video provider, Stripe billing endpoints, and per-model LLM credentials
  → Langfuse traces now attributed to real usernames across every trace producer

  That cadence is the point. When you run the platform yourself, upstream shipping velocity is something you receive rather than something you wait on — you pull the release on your own maintenance window.

  It is also why the ownership model matters. With ibl.ai you own all the code and the data — self-hosted inside your own perimeter, model-agnostic across any LLM, usage-based with no per-seat pricing, deployable anywhere from your own cloud to a fully air-gapped network.

  #iblai #AgenticAI #EnterpriseAI #ShipIt #CodeMode #OpenSource
---

Covers releases published **2026-08-14 → 2026-08-21** across `iblai/iblai-prod-images` (8 releases) and `iblai/iblai-web-frontend` (32 releases).

| Service / Package | Image / Pin | Version Span |
|---|---|---|
| cli | `ibl-cli` (pyproject) | `5.54.1` → `6.0.0` |
| dm | `iblai-dm-pro` | `4.338.0-ai` → `4.343.0-ai` |
| lms | `iblai-lms-spa` | `0.68.1` → `0.69.2` |
| edx | `iblai-edx-pro` | `sumac.2.49.0` → `sumac.2.52.0` |
| os | `iblai-os-spa` | `0.125.1` → `0.130.0` |
| web-containers | `@iblai/web-containers` | `1.16.12` → `1.18.5` |
| mcp | `@iblai/mcp` | `1.8.13` → `1.10.4` |
| iblai-js | `@iblai/iblai-js` | `2.3.16` → `2.5.5` |
| data-layer | `@iblai/data-layer` | `1.12.5` → `1.12.106` |
| web-utils | `@iblai/web-utils` | `2.1.13` → `2.1.14` |
| auth | `@iblai/auth` | `2.2.3` → `2.2.4` |

---

## ibl-cli (`5.54.1` → `6.0.0`)

**Opt-in database TLS** (5.55.0) — two new flags, both defaulting to `false`:
- `IBL_DM.ENABLE_POSTGRES_TLS` — starts `dm-data` with `ssl=on` (self-signed cert generated at boot, non-forcing so plaintext clients still connect) and sets `DB_SSLMODE=require` on the app side. When PgBouncer is enabled, a `pgbouncer-tls-init` sidecar handles both legs. Scoped to compose deploys (`RUN_DB and not SWARM_MODE`).
- `IBL_EDX.ENABLE_MYSQL_TLS` — patches edX Django `DATABASES[*].OPTIONS.ssl_mode = REQUIRED` (client-side; MySQL 8.x already serves TLS).
- Documentation added at `docs/opt-in-db-tls.md` (covers single-server and split app / app-single setups).

**Major packaging refactor** (6.0.0) — the CLI now ships as the `iblai_config` Python package. Legacy `ibl/templates` are removed. No operator action required at upgrade time; the new package provides the same CLI entry points.

## iblai-dm-pro (`4.338.0-ai` → `4.343.0-ai`)

**Langfuse trace attribution** (4.340.1) — Langfuse traces now carry the real username as `user_id` and `metadata.username` across all trace producers: RAG embeddings, course-data training, mentor creation, metadata population, native grading, multimodal runner, the `ibl.ai` routing classifier, and Claw usage generations. Mentor-related traces include the mentor unique id when available. Health-check traces attribute to the reserved health user.

**HeyGen video provider** (4.342.0) — new endpoints for platform-level HeyGen video generation, with global-key billing and member RBAC enforcement.

**Progress report overhaul** (4.342.0, `ibl-notification-consumer` 1.47.0) —
- Each enabled-but-empty section now states "No agent interaction observed this period" instead of being hidden.
- `user_progress_config` responses expose `available_data_points` and `available_learner_scopes` for client-side discovery.
- Only courses touched during the reporting period appear; dormant enrollments are omitted.
- Course names link to the LMS; agents link to the mentor SPA at `/platform/<platform_key>/<mentor_unique_id>` via the new `SPA_DOMAIN` template global (default `os.<BASE_DOMAIN>`).
- A new **Summary** paragraph written by an LLM replaces the "Strengths & Areas for Growth" bullet list. Generated in two voices — second person for the learner, third person for a watching guardian — from the week's figures and up to 24 of the learner's agent memories. The LLM call prefers the `iblai` gateway when the tenant has a credential, falling back to OpenAI.
- Agents and courses render as tables with linked first columns (proper `th scope="col"` for screen readers). The report period reads as a plain date range.
- **Migration `0056`** re-seeds stored progress-summary templates still on a shipped default — customised templates are left alone and logged.
- **Breaking:** `parse_insights_response` / `generate_learning_insights` now return `{summary, watcher_summary}` instead of `{strengths, growth_areas}`.

**Stripe integration** (4.343.0) — Stripe payment endpoints for platform billing.

**Conversation & message analytics** (4.343.0) — conversation and message analytics are now proxied to the user analytics endpoint.

**Per-model LLM credentials** (4.343.0) — LLM credentials can now be scoped per model rather than globally. Also: refreshed category taxonomy and clearable embed icon.

**Deployment:** Run `python manage.py migrate` and then `python manage.py initiate_notifications --recreate`.

## iblai-lms-spa (`0.68.1` → `0.69.2`)

**Immutable static hosting** (0.69.0) — the LMS skills SPA now supports deployment-ID-pinned static hosting via AWS S3 + CloudFront, enabling immutable deploys and instant rollback.

**Course tab layout** (0.69.2) — course tabs now render cleanly without overlap on narrow viewports.

## iblai-edx-pro (`sumac.2.49.0` → `sumac.2.52.0`)

**LMS theme cleanup** (2.51.0) — removed an unused `/css/lms.css` `<link>` injection from `ibl-edx-lmsx-addon-theme` (0.1.6 → 0.1.7). The path was never provisioned; removing it eliminates a stale MIME-type console error when the mentor XBlock launches via Canvas LTI against the LMS domain. Deployment: shared `apps/` change, picked up on image rebuild + LMS restart, no migrations.

**SCORM XBlock decorator fix** (2.52.0) — `@XBlock.wants` decorators now correctly target `ScormXBlock` (bump `ibl-openedx-scorm-xblock` 1.2.2 → 1.2.3). Deployment: shared `apps/` change, picked up on image rebuild + LMS/CMS restart, no migrations.

## iblai-os-spa (`0.125.1` → `0.130.0`)

**ibl.ai model branding** (0.126.0) — the ibl.ai model key maps to its brand spelling; the ibl.ai label and logo appear in the nav bar, mentors table, and provider cards.

**Agent task list** (0.127.0) — when an agent calls `write_todos`, the task list renders inline on the assistant turn with i18n support. `write_todos` calls no longer appear in the generic tool-call card.

**Code mode: skills & sandboxing** (0.128.0) — code mode now supports agent skills with sandboxed execution. The code-mode agent auto-configures `.env` for the sandbox environment.

**Agent spend caps** (0.129.0) — platform admins can set per-agent spend caps from the mentor settings panel.

**Embed-mode parameter persistence** (0.129.1) — embed-mode parameters survive hard navigations within the SPA.

**CSP update** (0.129.2) — `api.github.com` added to `connect-src`, enabling direct GitHub API calls from code-mode agents.

**Code mode: Stripe & Vercel** (0.130.0) — code mode now supports Stripe integration and Vercel auto-deploy targets.

## @iblai/web-containers (`1.16.12` → `1.18.5`)

**Audit log: "All Agents" label** (1.17.0) — the platform-scoped audit-log filter was renamed from "global" to "All Agents" for clarity.

**Analytics agent picker** (1.17.0) — a new agent picker on the analytics dashboard scopes analytics views to a specific agent.

**Application submission layout** (1.17.1) — long question labels and responses in the application submission UI now wrap correctly.

**Analytics course progress summary** (1.17.2) — a new course progress summary template on the analytics page, with a review-patched form for refinement.

**Summernote rich text editor** (1.18.0) — Summernote is now integrated as the rich text editor for applicable content fields.

**Global memories** (1.18.2) — new components for viewing and managing global (tenant-scoped) agent memories.

**LTI async creation & voice instructions** (1.18.3) — LTI provider configuration now supports `async_create` mode and a voice instructions field for agent-backed LTI tools.

**User onboarding flow** (1.18.4) — a new user onboarding flow guides first-time platform users through initial setup.

**Tenant memory identity** (1.18.5) — tenant memory entries now key on the user's username rather than email address.

## @iblai/mcp (`1.8.13` → `1.10.4`)

Tracks `@iblai/web-containers`. The MCP (Model Context Protocol) server package picks up the same audit-log, analytics, Summernote, global memories, LTI, and onboarding changes surfaced through web-containers, keeping the MCP tool surface in sync.

## @iblai/iblai-js (`2.3.16` → `2.5.5`)

SDK umbrella package — re-exports updated types, hooks, and API bindings from `web-containers`, `data-layer`, `mcp`, `auth`, and `web-utils`. No standalone feature additions; version bumps track downstream packages.

## @iblai/data-layer (`1.12.5` → `1.12.106`)

**Skill state reducers** (1.12.6) — added Redux reducer exports for the skill subsystem, enabling code-mode and skill-backed features in consuming apps.

**API client updates** (1.12.103–1.12.106) — regenerated API bindings for DM 4.340–4.343 (HeyGen, progress reports, Stripe, per-model credentials) and synced type definitions across the frontend monorepo.

## @iblai/web-utils (`2.1.13` → `2.1.14`)

**Code-mode sandboxing support** — shared utilities for the code-mode sandbox lifecycle (environment setup, skill discovery).

**Tenant-switch resilience** — the tenant-mismatch polling loop no longer aborts an in-flight tenant switch, and a deadlock from a stale `switching` cookie is now broken cleanly.

## @iblai/auth (`2.2.3` → `2.2.4`)

**Custom error pages** — error pages now support an `errorType`-keyed custom message map, so platforms can show branded copy for specific error codes. The error page content is vertically centered, the error code renders in brand blue, and copy no longer self-links.