Release notes

Latest release: BullSequana AI 1.4.0

Your teams. Your roles. Your AI workspace.

BullSequana AI 1.4.0 introduces AI Hub and Data Hub, two new portal workspaces that bring model and data workflows together. AI Hub connects model discovery, MLflow experiments, registry management, and deployment visibility. Data Hub brings connections, ingestion schedules, and run diagnostics into one place.

Enterprise access is at the heart of these workflows. Build custom roles from a catalogue of 130+ fine-grained permissions, connect your organization's identity provider during tenant creation, and map OIDC group claims to tenant groups. Give teams access that matches their responsibilities without handing everyone broad administrative privileges.

Share expertise through Skills, speak your prompts and listen to answers, and explore complex questions with Deep Research. Managed Spark, hybrid search, and expanded APIs give engineering teams more ways to extend these workflows.

Release highlights

130+ permissions and custom roles that fit your organization

Move beyond broad, one-size-fits-all access. The permission catalogue contains 142 permissions available for custom tenant roles, covering AI workflows, document processing, MLflow, data ingestion, Spark, storage, credentials, and tenant administration. Separate actions such as viewing, creating, updating, deleting, running, and managing credentials where each service supports them.

• Build roles around responsibilities: combine permissions into named custom roles for your teams. Separate experiment management from model deletion, or ingestion execution from connection-credential management.
• Make informed choices: browse permissions by category, read their descriptions, and inspect implied permissions when composing a role. Built-in system roles remain available for standard responsibilities and can be inspected separately from custom roles.
• Assign once, reuse across a team: assign custom roles directly to users or to tenant groups. Group members receive the group's assigned access, reducing the need to maintain each user's permissions individually.
• Keep delegation within the tenant: custom roles do not grant platform-administrator privileges. Navigation and actions reflect effective permissions, while synchronization status makes configuration changes visible.

Custom roles add permissions alongside existing memberships and role assignments. They give administrators more precise building blocks without replacing resource-level sharing and ownership controls.

Enterprise identity from tenant creation to group-based access

Connect a tenant to your organization's sign-in system as part of the creation wizard. Choose local accounts or an external OIDC or SAML identity provider, configure the provider details, and complete the setup using the generated callback and provider credential. Optional email-domain discovery directs users to their tenant's sign-in provider.

OIDC group synchronization connects enterprise membership to platform access:

• Map the groups you already use: after creating the tenant and its groups, select the OIDC claim, such as groups, and map external group values to existing tenant groups.
• Connect membership to custom roles: assign the appropriate roles to those tenant groups. Users receive the group's assigned permissions when their external group claim matches.
• Keep mapped membership aligned at sign-in: memberships update on fresh authentication through the OIDC provider. A missing or nonmatching claim removes mapped membership, including membership previously added manually to the same mapped group.

Synchronization is optional and applies to OIDC group claims. It does not create tenant groups automatically or continuously poll your directory. Use dedicated synchronized groups and configure the provider to send the complete group claim.

A smoother first sign-in: a dedicated access-setup screen shows progress while initial permissions synchronize. The portal opens when access is ready, with retry and sign-out options if setup takes longer. This waiting state does not grant access or bypass permission checks.

Skills: make expertise reusable

Turn instructions and supporting resources into reusable Skills that travel with your team's work. The Skills library gives you one place to discover shared expertise, build your own collection, and bring the right guidance into a conversation.

• Create and refine: upload a Skill package, inspect its files, and edit your own packages directly in the portal. Publish revisions without rebuilding your workflow from scratch.
• Share and adapt: share Skills with your organization, copy a Skill to make it your own, and download packages for reuse.
• Use in chat: select Skills from the composer, see which ones are active, and deactivate them when the task changes. Activations are pinned to a specific revision, so an update does not silently replace the instructions already in use.

Voicebot: have a spoken conversation

Voicebot adds live spoken conversations with an available model or Agent. Choose a language, speak, and hear the reply. Speak over an answer to interrupt it, mute when needed, and continue in text in the same chat. Finished turns remain in conversation history.

Dictation remains separate: review and edit its transcript before sending. Read-aloud provides playback of existing assistant replies. Live Voicebot sends spoken turns automatically and uses the model and prompt, without Skills, retrieval, web search, or MCP tools. Voice features require the configured speech services and an installed voice for the chosen language.

AI Hub: from experiments to model management

AI Hub brings model discovery, experiment tracking, registry management, and deployment visibility into a dedicated workspace. Browse model cards, versions, and files; inspect deployment status and logs; and find usage examples and API-key actions alongside your models.

Connect your coding tools: the Use model panel provides model-specific installation, configuration, and launch examples for coding agents, including Claude Code, Codex, and OpenCode. Endpoint and model details are included in the examples, with API keys read from environment variables.

MLflow management is now available directly in the portal:

• Experiments: create experiments, update names, descriptions, and tags, and start runs from an experiment. Delete and restore experiments when organizing your work.
• Runs: inspect metrics and artifacts, edit names, descriptions, and tags, and update run status. Deleted runs can be restored.
• Registered models: create registry entries and edit model names, descriptions, model tags, and version tags. Registry deletion is a separate, permanent action; the portal blocks registry rename and deletion while a model is deployed.
• Focused editing: detail pages open read-only, with an explicit edit mode and warnings when leaving unsaved edits through in-app navigation. Available actions reflect your permissions.

Model presets and deployment recipes connect the catalogue to serving configuration. Predictive-model deployment also accepts supported MLflow registered model versions using the MLflow/MLServer runtime. Deployment status and callable inference availability remain distinct.

Data Hub: connect, schedule, and follow your data

Data Hub brings ingestion management into the portal, from connector discovery to run diagnostics.

• Connect sources and destinations: register digest-pinned connector images, create connections with protected credentials, test connectivity, and discover available streams.
• Build ingestion workflows: choose a source, destination, and streams; run an ingestion on demand or configure a schedule.
• Operate with visibility: follow run history, inspect diagnostics, cancel runs, and recover from saved checkpoints.
• Collaborate with control: manage ownership and sharing, with permission-aware actions throughout the workspace.

Separately, the lakehouse data catalogue strengthens coordination between data-resource permissions and Lakekeeper metadata. Tenant-aware warehouses and personal or group namespaces organize access, while scoped audit credentials support authorized auditing.

Deep Research: explore a question, not just a prompt

Deep Research turns a complex question into a guided web-research workflow. Clarify the question, review a proposed plan, follow progress, and receive a synthesized report with source citations. Research history and follow-up questions keep the investigation connected.

You can cancel a research task, and tenant administrators control the models and execution limits. Plan review has a deadline; research proceeds with the proposed plan when that deadline expires.

More capable everyday AI

• Hybrid knowledge search: retrieval combines semantic matching with BM25 keyword search by default, helping find both conceptually relevant passages and exact terms. Dense-only search remains available.
• Longer conversations: context compaction summarizes older turns while retaining recent and protected context, helping conversations continue as they approach a model's context limit. The stored conversation history is preserved.
• More flexible MCP connections: connect to upstream tools that do not require personal credentials, while retaining platform access controls and tool allowlists.
• A clearer portal: refreshed workspace navigation, service discovery, branding synchronization, API-key flows, and resource actions make common tasks easier to find.

Administration and platform operations

Bring compute closer to data workflows

Managed Spark adds cluster and job lifecycle controls, quotas, user-bound credentials, and notebook and pipeline integration. Apache Spark 4.0.4 with Python 3.12 supports the data-processing environment, including Iceberg and S3 integration.

The notebook workspace is now Development environments, available by default at workspace.<domain>. Profile access, network controls, storage trust, and pipeline integration receive further improvements. Managed Spark cluster reclamation uses a configured lifetime limit.

Operate with more control

• Tenant resources: manage optional application buckets, databases, and Milvus identities through the tenant operator, with retention policies, credential rotation, and recovery controls.
• Observability and usage: tenant-authorized log and trace queries strengthen access boundaries. BCU metering reports configured capacity and token consumption with tenant and platform attribution.
• Secrets and sizing: use an existing external Vault as an opt-in secrets backend, or retain sealed secrets. CPU and memory sizing presets, multipliers, and explicit overrides give operators more control over workload resources.
• Serving and delivery: tighter inference-route controls, updated serving components, and a non-root portal image strengthen the operational foundation. Documentation is packaged with the portal and retains its own version and enablement settings.

Inspect deployment images before rollout

The new platform image inventory CLI gives platform and security teams a configuration-based view of container images and Helm charts, without connecting to a running cluster.

• Review deployment coverage: inventory the selected configuration or include declared feature, CPU/GPU and storage variants.
• Identify what you deploy: resolve image digests and architectures, with references back to the owning components.
• Prepare security handoffs: export CSV, JSON and digest-pinned image lists for vulnerability scanning and CSIRT review, with coverage results, unresolved entries and file checksums.

Inventory generation runs locally or through a dedicated GitHub Actions workflow. This is a platform-configuration inventory, not a package SBOM or a census of running workloads; dynamically added user images require a separate site inventory.

Review the software inside release images

Release software bills of materials (SBOMs) complement the deployment inventory with package-level details for BSQAI application images. Downloadable release bundles bind the inventories to exact published image digests and include checksums, helping security teams trace dependencies to the artifacts they review. The platform CLI also provides a CycloneDX SBOM for its locked Python dependencies.

API updates

The BSQAI API expands access to Skills, Deep Research, data ingestion, managed Spark, and MLflow workflows.

• MLflow lifecycle APIs cover experiments, runs, registered models, versions, tags, aliases, artifacts, prompts, traces, evaluation datasets, logged models, workspaces, and webhooks, with permission checks on the available operations.
• Embeddings accept a string or a list of strings and return indexed results in data[], with model and usage information. Float and base64 output and optional dimensions support more integration patterns.
• Retrieval configuration exposes hybrid and dense search choices, including reciprocal-rank-fusion settings.

The embeddings response replaces the previous top-level embedding field. Update integrations that read that field to consume data[].

Upgrading from 1.3.0

For platform operators, the main compatibility changes are:

Follow the 1.3.0-to-1.4.0 upgrade guide: use the versioned CLI only for unchanged managed baselines, or the step-by-step manual procedure for modified deployments. It covers agent-assisted monitoring, stateful migrations, administrator-owned access changes and full Airbyte retirement after required extraction. Review the MLflow requirements before starting.

Selected component updates

These are application versions; Helm chart versions are tracked separately.

Previous releases

• BullSequana AI 1.3.0: September 4, 2026 · Tenant administration, model serving, MCP, and data-platform foundations
• BullSequana AI 1.2.1: August 6, 2026 · API-key compatibility, Anthropic Messages API, streaming model downloads, and reliability fixes
• BullSequana AI 1.2.0: July 21, 2026 · Sharing, branding, deployment architecture, and API updates