Unreleased

These changes are available on the development branch and have not been assigned to a release version.

Provider coverage

• Added independent provider integrations for DeepSeek, Amazon Bedrock Mantle, Sarvam AI, and Wafer, including authentication, discovery, streaming where supported, normalized errors, pricing metadata, UI configuration, and provider-level tests.
• The catalog now exposes 29 built-in provider identities. Live provider discovery remains authoritative for models and capabilities that can change.

Protocol and enterprise surfaces

• Added stored Responses retrieval, retrieval streaming, deletion, cancellation, compaction, and input-item access. OpenAI supports every listed operation; Bedrock Mantle does not support input-item access. Resource calls require the same workspace and provider key affinity as creation.
• Added named cached-content CRUD for Gemini and Vertex AI, and OCR for Mistral.
• Added realtime WebSocket frame relay plus WebRTC SDP/control passthrough. Provider-native call-control proxy routes are not a SIP or telephony orchestrator, and there is no SIP/WebRTC sideband call_id attachment.
• Added one canonical server-side GAF enforcement point for JSON-RPC /mcp, POST /v1/mcp/tool/execute, Agent Mode, and nested Code Mode execution. The legacy direct MCP result cache is disabled on these governed paths until a decision-bound post-GAF cache exists.
• Refactored the Python MCP surface around the official MCP client and maintained OpenAI Agents, Anthropic, and LangChain integrations. New code uses shield.mcp.connect() or connection() with native upstream types; MCP/GAF failures use one DeepintShieldError.code boundary. The former custom models and provider loops remain deprecated compatibility shims for the 2.x line and are planned for removal in 3.0.
• Added strict OAuth 2.1 (MCP 2026-07-28) with pre-registered client first, deployment-owned Client ID Metadata Document second, and deprecated RFC 7591 registration as the final fallback, plus encrypted replica-safe pending state, refresh, reauthorization, and local-deny-first revocation.
• Added configured delegated MCP OAuth token exchange and identity-isolated, process-local Streamable HTTP sessions. The pool is bounded at 1,024 sessions per process. This delegated exchange path expects an explicitly configured endpoint; unlike the shared strict OAuth flow, it does not implement automatic protected-resource discovery or step-up/claims challenges.
• Added the Cloud Run cost tier with durable Cloud SQL authorization data and required OpenFGA/GAF startup. Its cost-first defaults scale to zero and are not a zero-latency or HA profile.
• Added SQL-backed webhook subscriptions and an at-least-once outbox with signed delivery, retries, leases, replay, idempotent enqueue, retention, and payload offload. The filesystem object store is intended for one replica; multi-replica deployments should use S3-compatible storage.

See Protocol operations, MCP OAuth 2.1, Delegated MCP authentication, and Durable webhooks and payload storage for routes, limits, and deployment guidance.

Compatibility and performance

Existing inference routes keep their prior behavior. The new lifecycle, realtime, cached-content, OCR, delegation, and delivery paths activate only when their routes or configuration are used. Ordinary inference does not gain an additional database lookup or provider-discovery request from these changes; end-to-end latency still depends on the selected provider and enabled policies.