August 2026 Changelog

Monthly Cosmos platform change summary for August 2026

changelogmonthly

Updated 2026-09-28

Verified 2026-09-28

Highlights

Cost controls — a new cross-service cost-management system enforces per-session, per-user, and per-org spending limits. Observer tracks usage in Redis, User Service gates logins on exceeded limits, and the frontend adds an in-chat cost notice lane and admin settings panel.
Prompt (KV) caching — opt-in Anthropic prompt caching lands in ADK with per-agent configuration in Configurator. The frontend adds a toggle to agent settings.
Cosmos Code — a new consumer application (EY's fork of OpenChamber) joins the platform. 41 commits establish the initial runtime, Cosmos provider, session management, and branding.
Model reasoning controls — Configurator now declares per-model reasoning capabilities (thinking, effort levels). ADK resolves them at runtime. The frontend exposes thinking and effort controls in agent configuration.
Checkmarx CI — Checkmarx SAST scanning is enabled across all major services (ADK, Chat, Configurator, Frontend, MCP, Observer, Storage, User Service).
Storage enhancements — folder stats, org-wide metrics, file-type browsing, and zip/unzip destination overrides.

Type	Change
feat	Opt-in Anthropic prompt (KV) caching for `azure_claude` / `claude-opus-4-7`
feat	Resolve thinking and effort against per-model capabilities
feat	Enforce per-session cost limits during streaming
feat	Report model context window in usage frames
feat	Client-configurable tool-call timeout
feat	Read per-(user, org) period cost hashes from Redis
fix	Redis pool timeouts and async cost-guard reads
fix	Recognize OpenCode-style tool names in artifact replay
fix	Request summarized thinking on models that omit it by default
security	Remediate Checkmarx HIGH SSRF and MEDIUM findings
ci	Enable Checkmarx scanning

Type	Change
feat	Map ADK cost warnings to a dedicated notice frame
fix	Remove hardcoded BYOT query value
fix	Remediate Aquasec CVE findings
ci	Enable Checkmarx scanning

Type	Change
feat	Initial Cosmos fork: rebrand runtime paths, carry credentials across rename
feat	Expose Cosmos organizations as providers with login and context
feat	On-demand Cosmos catalog sync endpoint
feat	Session-level change tracking, snapshot support, plan/build agent handoff
fix	Resolve Cosmos auth directory from `APP_DIR`
fix	Break filesystem/search circular import
docs	Cosmos fork overview and file-based SDK link

Type	Change
feat	Per-org session cost configuration and limit commands
feat	Declare model reasoning capabilities; persist thinking/effort config
feat	Per-agent `prompt_caching` opt-out flag
feat	Org metrics: graphs bucket and `collections.indexed_file_count`
feat	Storage metrics via `cosmos-storage-v3` /metrics/ endpoint
feat	Analyzer metrics API
feat	Emit activity events on cost-limit override changes
fix	Disable authentication on health-check endpoint for K8s probes
fix	Drop redundant HTTP fallback in StorageClient base URL
security	Remediate Aquasec CVE findings and Checkmarx findings
ci	Enable Checkmarx scanning

Type	Change
feat	In-chat cost notice lane and cost-control admin settings
feat	Model-aware thinking and effort controls in agent config
fix	Tolerate empty-bodied upload-session responses
security	Upgrade Next.js to 16.3.3
security	Remediate Checkmarx SAST findings
ci	Enable Checkmarx scanning

Type	Change
fix	Stop ping middleware from crashing session on connection close
security	Remediate Checkmarx findings
ci	Enable Checkmarx scanning

Type	Change
feat	Per-(user, org) weekly/monthly usage buckets in Redis
feat	Detect per-session cost crossings and notify User Service
feat	Register new cost-alert action codes; template-render weekly/monthly
fix	Rehydrate period counter from durable events; widen TTL, fix pool timeouts
security	Remediate Wiz dependency CVEs
ci	Enable Checkmarx scanning

Type	Change
feat	`GET /items/{id}/stats/` — permission-filtered folder subtree rollup
feat	`GET /metrics/` — org-wide storage rollup with Redis TTL cache
feat	File-type browsing, `mime_type` list filter
feat	Destination override on zip/unzip (`target_parent_id`/`target_parent_path`)
feat	Direct children counts on folder items in browse and single-item GET
feat	Filename support on zip/unzip endpoints
fix	Roll back DB session before reuse in promotion failure handlers
security	Remediate Checkmarx findings
ci	Enable Checkmarx scanning

Type	Change
feat	Session cost alerts, emails, and login enforcement on exceeded limits
feat	Scope `UserCostAlert` unique constraint by `org_id`
fix	Re-apply account disable on post-wipe re-crossings
fix	Normalise casing, add org name, and gate environment in cost-alert emails
security	Remediate Checkmarx findings
ci	Enable Checkmarx scanning

Type	Change
feat	`reasoningEvent` option to stream model thinking
feat	`sessionProfile` and `toolResultMaxBytes` options
feat	Per-response token usage in ADK V2
feat	Server-reported context window in usage frames
docs	Document `file:` link consumption from Cosmos Code

Type	Change
feat	RAP runtime-verification tools (service binding, OData metadata)
feat	RAP v4 binding support
feat	Session-scoped ADT client pool with batched DDIC resolution
fix	Refresh Cosmos access tokens before every Bridge call
fix	Forward bearer token on SAP routes
fix	Save Target Protocol guidance; drop object-package-inventory panel
fix	Real DDIC source, chat activity, panel dedupe
security	Remove unpatched `image-size` from container image
security	Remediate Wiz critical and high CVEs