[jakub-walaszczyk]

Release v0.25.4

Summary

This release improves audio transcription and fixes MaaS connections that rely on deployment-mounted CA certificates. Generated starter kits use the installed RHOAI OpenShell images and CLI, with fixes for gateway authentication, database connectivity, and cluster deployment failures. Gateway setup now provisions the downstream Red Hat OpenShell 3.6 gateway with mTLS authentication.

Changes

Changed

• Assets generator — generated starter kits run the RHOAI OpenShell CLI through Podman and build a Python 3.12 runtime on the Red Hat sandbox base; CLI and sandbox image selection follows the installed RHOAI CSV, with registry fallbacks
• OpenShell gateway — setup provisions the downstream Red Hat OpenShell 3.6 gateway with mTLS authentication and RHOAI image references; an explicit --reset option supports migration from the incompatible upstream 0.0.99 gateway database
• Dependencies — added an explicit certifi>=2026.7.22,<2027 dependency for public CA roots used alongside mounted MaaS certificates

Fixed

• Text extraction — local Whisper ASR uses native timestamp-aware long-form generation instead of fixed 30-second pipeline windows; multilingual models explicitly transcribe the source language while retaining automatic detection unless the model config specifies a language
• MaaS TLS — add mounted SSL_CERT_DIR/ca.crt bundles to public trust when ca_bundle, MAAS_CA_BUNDLE, and SSL_CERT_FILE are unset; defaults remain unchanged when the mount is absent
• MaaS TLS — preserve hashed certificate-directory trust when adding plain bundles and retain configured CA trust in synchronous and asynchronous agent chat clients
• Assets generator — OpenShell starter kits route Milvus gRPC through a local CONNECT proxy, retain native database tunneling, and use the cluster API endpoint with a CA bundle checked against that endpoint for service-account authentication
• Assets generator — OpenShell deployment respects the gateway namespace, handles Kyverno pull-secret conflicts with runtime-image mirroring and sandbox retries, and improves build completion checks and agent startup recovery
• Assets generator — make refresh-certs registers the cluster gateway and refreshes mTLS credentials; sandbox creation checks gateway connectivity before replacing an existing sandbox and reports recovery instructions when unavailable

Migration notes

No public Python API changes.

• Regenerate older starter kits and rebuild their OpenShell images to pick up the updated runtime, Makefile, and connection handling. Install Podman locally for the containerized OpenShell CLI; deployment still requires a gateway provisioned by a cluster administrator.
• When migrating an upstream OpenShell 0.0.99 gateway, its database is incompatible with the downstream 3.6 gateway. A cluster administrator must run bash scripts/setup-openshell-gateway.sh --reset to migrate. This deletes gateway records for sandboxes, policies, and stored credentials; workspace PVCs are preserved. Recreate the required sandbox deployments afterward.
• If gateway automation sets OPENSHELL_VERSION, update it to use OPENSHELL_CHART_REPO and OPENSHELL_CHART_REF for chart selection. Gateway setup now requires oc, Helm, curl, jq, and Podman; images default to references from the installed RHOAI CSV.
• Run make refresh-certs in a regenerated starter kit when gateway registration or mTLS credentials are missing or stale, including after gateway recreation or certificate rotation.

Checklist

• __version__ in ai4rag/__init__.py updated to 0.25.4
• docs/about/changelog.md updated
• All tests pass (pytest)
• Docs build successfully (mkdocs build --strict)