Composable Agentic Platform (CAP) - RHEL Enterprise Edition

This is a maintenance and hardening release of the Composable Agentic Platform (CAP) Console on Red Hat Enterprise Linux 10.1 (Coughlan), delivering hardened session cookies across the bundled web applications, a security update to the bundled Apache HttpClient library, Console usability fixes, and refreshed developer templates. The embedded Jetty 12.1.10 server runtime is unchanged from the previous AMI. There are no API changes and no changes to request or response behaviour. All existing rulesets, extensions, and TCL scripts continue to work unchanged.

Session cookie hardening:

• Named, hardened session cookies - Every web application in the image now issues its session cookie with an application-specific name (CONSOLEID for the Console, per-agent names such as APPSESSIONID for agent web applications) plus the HttpOnly and SameSite=Lax attributes, configured through the standard Servlet session-config element in each web.xml. The Secure attribute is added automatically when a request arrives over HTTPS, including behind a TLS-terminating load balancer or CDN that announces X-Forwarded-Proto. Previously the applications silently fell back to the container-default JSESSIONID with no attributes, because the pre-Jetty-10 cookie rename mechanism they carried is ignored by Jetty 12.
• Content editor alignment - The Console content editor now honours the configured session cookie name when maintaining its editing session, instead of assuming the container default.

Security fixes:

• Apache HttpClient (httpclient5) updated from 5.6.1 to 5.6.4 - Closes CVE-2026-64607 (medium severity): HttpClient based on the classic i/o model could fail to release the underlying connection back to the connection pool when a response carried an invalid or unsupported Content-Encoding header, which could gradually exhaust the outbound connection pool. The companion HttpCore libraries (httpcore5 5.4.3) are unchanged; HttpClient 5.6.4 is built against exactly this version, so no other library versions move.
• SBOM accuracy - The jsoup HTML parser reference recorded in the SBOM and legal notices is updated to 1.23.1 (CVE-2026-71497); this library is not shipped in the Console runtime, so this is a documentation and SBOM accuracy change only.

Console usability:

• Agent maintenance window layout - The window now keeps its full-width layout when an agent uses the HTTP input adapter security settings. Previously a long Optional parameters value (for example the Baseline security preset) compressed the information and settings columns into a narrow band; the panel now spans the whole window and long values wrap within their own column.
• Agent Definitions window title - The maintenance window title bar shows the agent description, matching the behaviour of the active agents list. Previously it showed the internal agent name.
• Refreshed developer templates - The bundled integration examples demonstrate the standard Servlet session-config element for session cookie hardening (replacing the obsolete pre-Jetty-10 context parameters), the magic.properties failOpen setting now documents its availability-versus-protection trade-off explicitly, and the current BaseApp PDA template (README plus standard and proxy-mode web.xml variants, both demonstrating the hardened session configuration) now also ships inside the Console update package so installations maintained through in-place updates receive it.

Platform updates:

• Console at build 30070, RulesBase at build 30060 - The Console application moves to build 30070 for this release; the RulesBase library is at build 30060, carrying the HttpClient update into the shared rules libraries. The CAP Agent engine remains at build 30040: engine code is unchanged, and rule execution behaviour is identical.
• No other dependency changes - Apart from HttpClient 5.6.4, all bundled dependency versions are unchanged from the previous AMI (Netty 4.2.16, HttpCore5 5.4.3, Log4j API 2.25.5, and the rest of the 30040 baseline).
• RHEL 10.1 + JDK 21 LTS baseline retained - The AMI keeps the Red Hat Enterprise Linux 10.1 (Coughlan) + JDK 21 LTS foundation, the embedded Jetty 12.1.10 server, systemd cap-console service, first-boot cap-init credential initialisation, and pre-installed AWS Systems Manager agent.
• Reproducible AMI build - The AMI is produced by the same auditable EC2 Image Builder pipeline (triggered from GitHub Actions OIDC) used for prior releases, baked from the identical CI-built Console distribution published to all other channels.

Upgrade notes:

• Existing installations can take the Console application content (usability fixes, HttpClient update, refreshed templates) as an in-place update via the TomorrowX update server; the in-place update does not perform a server-level Jetty change and requires no PDA restart. Note that the in-place update does NOT modify the web.xml files of an existing installation, so the session cookie hardening applies automatically to fresh launches from this AMI only. Existing installations that want the same hardening can add the session-config element to each web application's WEB-INF/web.xml - the BaseApp folder at the installation root, refreshed by the in-place update, contains template web.xml files showing the exact element, and "Hardening the session cookie" under Installation and Configuration in the product documentation explains each attribute. Applying it signs all users out once; they simply sign in again.
• Agents making outbound HTTP calls through the shared rules libraries receive the HttpClient update through the RulesBaseFactory extension update (build 30060) on the update server, applied through the normal extension deployment process. The CAP Agent engine itself carries no changes: no JAR replacement across PDA, Multi-Protocol, or Stress agent lib directories is needed as a result of this update.

For full documentation see: https://docs.tomorrowx.com