What’s New in Gluesync 2.3

AI Studio is an in-product Control Plane workspace for customer-managed AI. Alongside governed Spark chat agents, it now provides Enterprise brain, Build & publish, Runs, Models & routing, and Governance & developer API workspaces. Super admins administer the encrypted provider vault (OpenAI, OpenAI-compatible, Anthropic, Azure OpenAI, and Ollama) from Settings or directly from Models & routing → Add provider; managers can review providers and estimated spend. Chat agents run with the signed-in user’s permissions and a per-agent Core Hub MCP tool allow-list. Settings → AI agents (MCP) remains the separate surface for external MCP clients.

The new agent platform publishes immutable skill and agent versions, starts durable asynchronous runs with idempotency and SSE event history, and routes TEXT workloads through a canonical model catalog. Governance adds owner/API-key budgets, usage and audit views, scoped gsa_ platform keys, a native /api/ai/v1 API, and OpenAI-compatible /v1/models and /v1/chat/completions endpoints. See AI Studio and AI agent platform for roles, current TEXT-only limits, configuration, and API behavior. Super admins can also enable or disable a vaulted provider without deleting its credentials.

The MANAGER role can publish skills and agent versions. Super admin is no longer the only role that can freeze a skill or agent into an immutable snapshot.

Super admins can leave a provider in the vault and flip it off without deleting credentials. Disabled providers are rejected at chat time, so a temporary outage, spend freeze, or model swap does not force you to tear down the vault entry. Turn it back on when you are ready.

AI Studio keeps searchable conversation history with configurable retention, and can explain a notification in plain language using a read-only MCP tool set scoped to that alert’s pipeline, agent, and entity.

Spark and published AI Studio agents no longer stop at a fixed eight-round tool cap. A loop policy bounds each turn by step ceiling (per surface), identical-call fingerprints, failure streaks, duration, and cost, with clear stop reasons when a loop would otherwise spin. Published agent runs persist every provider and capability step so a Hub restart can resume idempotent work or mark at-most-once writes ambiguous. Human-session writes the role allows run immediately after approval recording; API-key and Chronos writes pause at WAITING_APPROVAL until a signed-in user resolves them. Destructive Spark tools (delete_pipeline, delete_connection, reset_pipeline_checkpoint, delete_entities, redo_sync) park in chat until the user confirms. See AI Studio and AI agent platform.

MANAGER and SUPER_ADMIN can reach pipeline mutation tools from the in-product AI helper. A write never runs straight from the model: the first call is held as a pending action bound to owner, conversation, and source pipeline, and only an explicit confirmation within five minutes executes it. Credentials on create_connection stay redacted from responses, traces, and persisted conversations.

The OpenAI-compatible agent platform gateway adds streamed chat completions, the Responses API surface (tool definitions pass through; the gateway does not execute them), embeddings, automatic model fallback with circuit breaking, exact response caching isolated by owner, API key, and model, and redaction-aware Prometheus/OTLP telemetry. GET /api/ai/v1/capabilities lists only what that Core Hub node can execute. See AI Studio and AI agent platform.

Schema-grounded chat and suffix-only Tab SQL autocomplete in Query Studio reuse the same BYO LLM vault as AI Studio. Autocomplete proposes the next tokens and does not rewrite what you already typed. Classified PII cells are never sent to the model. See AI helper and Tab autocomplete and PII discovery and masking.

The Hub-owned gluesync.ai SQL surface makes AI, optional Spark agents, and read-only MCP tools available through Query Forge (SELECT answer FROM gluesync.ai WHERE question = … AND spark_agent = …). answer is the plain result; proposed_sql is a review-only draft. Queries are read-only. See AI as SQL virtual catalog.

The Spark Pipeline creator can hold an ordered multi-pipeline plan in the conversation, resume the first incomplete pipeline on continue, and move a pipeline out of Draft when the final required SOURCE and TARGET connections are attached — the same completion path the manual wizard uses. Credentials are redacted before they reach the provider or the stored history, tool-orchestration text stays out of chat replies, and the UI surfaces the actual Draft blockers instead of guessing.

Every Ask Spark chat, pipeline creator agents included, now gets search_documentation (public Gluesync documentation) and search_support_knowledge (anonymized support ticket history) on top of the tools saved on the agent. Both are read-only and run without an approval step. Spark searches only when you ask for help, such as how something works, how to set it up, or how to fix an error, and it cites only documentation links and tickets those tools returned. If the knowledge search is unreachable, Spark carries on without it instead of inventing links, and documentation links in answers always point to https://docs.molo17.com.

When AI Studio explains a notification, Spark can call search_support_knowledge (anonymized hosted ticket search) alongside documentation search. Empty or unavailable support results are ordinary tool outcomes, so the explanation still completes.

The Chronos Schedules and Events pages now open a Spark panel grounded on that page. Spark reads pipelines, entities, groups, and the existing schedules or trigger flows to answer questions. Managers and super admins can ask it to create, update, enable or disable, run, or delete schedules, and to create, update, enable or disable, fire, or regenerate the token of trigger flows. Every write waits as a change awaiting confirmation and runs only when you confirm it; cancelling discards it. Other roles get the read-only tools. The panel needs a BYO LLM to be configured.

Chronos 0.3.0 can invoke a published agent through ai_agent_run. The call uses prompt templates, a payload allow-list, and loop guards so a workflow cannot send unexpected fields or spin the model forever.

Spark agents can send custom INFO, WARNING, or CRITICAL notifications through configured Core Hub webhooks and SMTP email. Manual sends require configuration-change permission and bypass saved event and severity filters so an approved agent can report on demand. The catalog also adds webhook and email configuration, test, delivery-log, dead-letter, and retention tools. See Core Hub MCP server.

The Enterprise brain is the shared knowledge layer behind every Spark agent and every external MCP client, managed from its own AI Studio → Enterprise brain workspace. Core Hub walks the schemas of your SQL-capable agents into a graph stored in a dedicated gluesync-ai-brain.db (including foreign-key edges from MySQL, MariaDB, Oracle, SQL Server, and Db2 alongside the PostgreSQL-family connectors), keeps the procedural memories agents build while working (shared by default, private on request, never rows or secrets), lets agents publish skills from what they just did, and admits approved HTTPS company tools from a preset gallery (Slack, Gmail, GitHub, GitLab, Notion, Microsoft Outlook, Teams, Word, OneDrive and SharePoint, Microsoft Foundry, Azure Resource Manager, Microsoft Learn, and many others) or a custom MCP URL. Access tokens for those tools are pasted once, stored encrypted, and never returned. Keyword search is always available; embeddings are suggested when an embedding-capable model is configured. External clients use a copyable setup prompt (with a local-only reachability warning when Core Hub is on loopback) and the search_enterprise_brain, list_published_agents, start_agent_run, get_agent_run, and publish_skill MCP tools. See Enterprise brain.

Some remote MCP servers refuse a pasted personal access token; GitLab’s MCP endpoint, for example, answers 403. When Core Hub reads OAuth metadata from such a server, the company-tool wizard now completes an OAuth (PKCE) sign-in and stores a scoped token instead. A specific 403 that is not about authentication, such as MCP being disabled for the group, is shown as the server’s own message and does not start a sign-in. Nothing is stored before the callback, so an abandoned sign-in keeps the current token, and the redirect is accepted behind a reverse proxy or Gluesync Connect. Tool discovery on a server that already has a stored token now refreshes its tool list in place.

The company-tool gallery now includes the Microsoft Agent 365 tooling servers: Microsoft Outlook (read, search, and send mail), Microsoft 365 Calendar (events, availability, and scheduling), Microsoft Teams (chats and channels), Microsoft Word (documents and comments), and Microsoft OneDrive and SharePoint (files). Each asks for your Microsoft Entra tenant ID and signs in with OAuth. Alongside them come Microsoft Foundry (models, knowledge, and evaluations), Azure Resource Manager (Azure resources and template deployments), both OAuth, and Microsoft Learn, a public documentation and code-sample search that needs no credentials.

The Enterprise brain dashboard shows a per-table field count and a catalog you can drill into (column type, primary key, foreign key). Catalog listing and field drill-down apply the caller’s Query Studio data-access policy: a denied table is omitted. Brain search ranks schema-graph hits and memories for the question; the chat transcript surfaces the sources that were used under Enterprise brain sources.

Company tools can use a per-user OAuth sign-in (tokens stored encrypted per Core Hub user; run results stay in that user’s private memory) as well as a shared company credential. A remote tool the vendor marked readOnlyHint runs without an approval step. Approved company tools are also registered on the Core Hub MCP server as company_<server>_<tool>; set GLUESYNC_MCP_DYNAMIC_COMPANY_TOOLS=false to turn that off. See Enterprise brain.

When an insert hits a row that already exists on the target, each entity can choose UPSERT (the previous default), SKIP, or FAIL. Non-duplicate failures still surface. Targets where a duplicate key cannot arise hide or caveat the setting.

A field function writes a target-side scalar function in place of a bind placeholder (Oracle pkg.f_…, and the same shape on other RDBMS writers that declare the capability). Use it when the value lives only on the target — business date, sequence helper — without a second UPDATE pass or a source-side change. See Field functions.

Write reusable Java functions once at pipeline level, publish and install them, and bind them to target columns in the Fields Editor. A function can take several source columns (or fixed values), be shared by many entities and UDFs in the same pipeline, and be tested before it touches replicated data. See Custom Field Functions.

A Custom Field Function can compose a target primary-key column from its bound source key columns. Inserts, updates, and deletes always carry those source key columns, so the composed key stays reconstructable when locating the target row. Saving an entity that used to fail with a "key cannot be composed" error is now allowed on this path.

A target entity can carry both a mapping UDF and field functions. The UDF runs first; field functions then run on its output. Cast mismatches fail at write time, not at configuration time.

You can write and test a mapping UDF on an entity that includes array or map columns. The editor mockup no longer fails on those types, and the test run feeds the same array shape agents produce in production so a function that works in the editor works on the wire.

Every mapping UDF now receives isSnapshot (Java/Kotlin) immediately before the logger: true when the row comes from a snapshot, false for CDC. Core Hub migrates every installed UDF at startup to the new signature — there is no fallback to the old shape — and refuses to publish a function that already declares isSnapshot itself or that Gluesync cannot call. The Control Plane surfaces which UDFs need a change.

Targets that fold unquoted identifiers now declare a single accepted case (UPPERCASE or LOWERCASE). Core Hub normalizes target column names and filter clauses when an entity is saved, CREATE TABLE follows the node’s case, and the UI forces that case as you type (with a tooltip). Snowflake, GridGain, and Db2 for i fold upper; Cassandra, ScyllaDB, Informix, and CockroachDB fold lower. Connectors that quote identifiers report BOTH and stay free. Existing stored configs are left untouched until the next entity save.

The Fields Editor maps columns with arrows drawn in a gutter between the source and the target table. Drag from one dot to another, or use a click or the keyboard. One arrow model covers 1:1, N:1, 1:N, a source column that is read but not written, and a target column fed only by a field function or the UDF. M:N is refused. On an N:1 target, Add a custom field function opens the editor with a function already declared on those source columns and binds it once it is published.

Arrows are proposed by name (exact case first, then a unique case-insensitive match) or by ordinal position. Reset mapping restores the proposal and Clear mapping removes every arrow. Keys are derived from the physical keys and the arrows, and a source primary key cannot be linked to a non-key column of a target that has a primary key. Removing an arrow can be undone one step at a time.

On edit, a saved column that discovery no longer returns drops only its own arrows. A saved target column missing from the database stays as a row tagged "No longer in the database" and blocks the save until it is deleted.

Query Studio on a MongoDB agent accepts JSON query objects, mongosh-style commands, and SQL. Core Hub translates SQL into a MongoDB aggregation, keeps the path read-only, applies offsets server-side, and enforces connection-scoped data-access policies by collection (including collections reached through $lookup, $graphLookup, and $unionWith). Cancellation stops the in-flight job on a shared read client. See Query Studio.

Next to in-place cell editing, the Query Studio result grid gains Add row and Delete row. Both show up under the same gate as cell editing — Writable mode, a single-table result, and a primary key found by schema discovery — and only when the connection dialect is not MongoDB (any casing or surrounding spaces; a blank dialect is also hidden). Any other non-blank dialect has the actions. Add row opens a modal with one field per result column plus a NULL checkbox; an empty field is stored as an empty string. Delete row sits in an Actions column and asks for confirmation; the row is matched by its primary key (IS NULL for a null key value). Both send a parameterized INSERT or DELETE through the existing query execute route, so the route’s writable permission, audit, and history apply; there is no separate API. Inside a manual transaction on desktop the change waits for Commit; Gluesync Mobile always auto-commits. MongoDB does not support row insert or delete. See Inserting and deleting result rows.

Editing a primary-key cell in Query Studio used to fail when foreign keys or check constraints still referenced the old value. Core Hub now relaxes the relevant constraints for that UPDATE — per dialect hooks for SQL Server, MySQL/MariaDB/SingleStore (FOREIGN_KEY_CHECKS), Oracle (referencing constraints; refused inside a manual transaction because DDL auto-commits), and Db2 LUW (SET INTEGRITY) — then restores them in the same transaction, rolling back on failure so constraints are never left disabled.

Core Hub classifies columns that look like personally identifiable information (email, phone, names, addresses, tax and national ids, bank accounts, secrets, and more), shows tags in Query Studio and pipeline editors, and masks those cells in Query Studio results, copies, and exports. Multilingual column-name aliases and regional checksums cover common identifiers across the Americas, Europe, Africa, Asia, and Australia. AI Studio and MCP SQL results stay masked. Super admins can disable platform-wide Query Studio masking under Settings → Global settings (on by default). See PII discovery and masking.

Super admins can set a per-user, per-wired-connection data-access policy: OPEN (default) or RESTRICTED, with schema and optional table ALLOW/DENY rules where deny wins. The same matrix can carry PII unmask grants at schema, table, or column scope. The guard applies on Query Studio, AI SQL, and MCP/Spark SQL paths without adding new UserRoles. See Query Studio and PII discovery and masking.

Query Studio data-access templates are no longer limited to Hub UserRole names. Super admins can save and list custom named templates (for example analyst) alongside the built-in VIEWER and MANAGER role templates, then apply a template to replace a user’s per-connection policies. GET /query-studio/data-access/templates returns the built-ins plus every stored custom template. See Query Studio.

When a user who signed in through OIDC clicks Logout, Core Hub still ends the local Gluesync session first, then returns an IdP logout URL from discovery end_session_endpoint (no custom Signout URL field). The UI follows that URL with id_token_hint, client_id, and post_logout_redirect_uri = \{CoreHub origin}/ui/v2/login, which the customer must register on the IdP allowlist. Local-realm logout is unchanged. See Logout flow.

A target-only ClickHouse agent loads snapshots and CDC over the official JDBC driver (HTTP/S). Generated tables with keys use ReplacingMergeTree(_version, _is_deleted) so every change is a new version of its key and deletes are tombstones (_is_deleted = 1); Query Studio and the Validator read with final = 1. Writes go as multi-row INSERT … VALUES batches (no Gluesync bulk loader); insert-conflict strategies are unsupported. Every Gluesync data type is mapped. See the agent documentation when published.

SQL Server CDC and Change Tracking sources can enable database-level (and, for CDC with recursion protection, sidecar table) change capture during setup when "Enable automatic Change Data Capture / Change Tracking activation" is on. The option is off by default; a migration rewrites the former disableAutomaticDatabaseCDCActivation flag so upgrades keep working. With the option off, setup continues and posts a warning that includes the statements to run by hand; with it on, a failed enable fails setup with those statements in the error. Snapshot-only entities and unchanged configuration saves do not trigger the path.

Kafka, Solace, and Google Pub/Sub targets can set includeBeforeImage so updates fill before with prior column values and deletes carry the pre-delete image when that is all the source sent. Off stays byte-identical to the previous payload. Pub/Sub also carries the shared transaction id already present on Kafka and Solace.

When two entities read the same IBM i physical file, file descriptions stay keyed by the file and each entity keeps its own column types, precision, and CCSID at decode time. Column attributes no longer overwrite each other in a shared per-table map.

On IBM i (AS/400), a stopped entity used to keep receiving journal changes into its arena cache until retention swept them, which could fill the disk. With suspendCaptureForInactiveEntities enabled (unset means off — existing agents are unchanged), an entity that stays neither syncing nor snapshotting past inactiveEntityCaptureSuspensionDelayMinutes (default 30) is suspended: its table leaves the shared journal read when no sibling still needs it, it leaves the cache fan-out, and its cache is deleted. On start it catches up by reading the journal directly from its last confirmed transaction until the shared reader’s rejoin point, then returns to the cache. Suspension is refused when the journal can no longer reach that position. Turning the flag on moves the recovery window from source-change retention to journal-receiver retention. IBM i only.

Validator compares one entity with its target and can write the source values back. Open it from the Control Plane, from an entity’s Validate action, or from entity detail. POST /data-comparison/runs accepts pipelineId and entityId alone; Core Hub fills the agents and the primary key. POST /data-comparison/runs/{jobId}/reconciliation accepts reconcileAll so a caller does not have to page difference ids.

Finished runs emit gluesync.validation.started, gluesync.validation.completed, gluesync.validation.differences-found, gluesync.validation.failed, and gluesync.validation.reconciled. Webhooks, email, and in-app notifications can subscribe to those types.

Chronos action Validate (entity_validate) runs the same comparison per selected entity. With reconciliation off, a run that finds differences fails the job and the difference breakdown is the error Chronos sends on webhook and email. With reconciliation on, Chronos calls reconcileAll and fails only when a difference could not be written. See Validator and Schedule validation.

Source inactivity detection learns each entity’s cadence instead of using a naive quiet floor: sparse entities stay quiet without false incidents, heartbeat liveness stays independent, and overlapping target-side stall alerts are off in v2. Baselines and incidents survive a Core Hub restart. Keep algorithmVersion: 1 for the legacy path. See Smart alerts.

Support (and operators) can empty Core Hub’s own log files and their rolled archives without stopping the process (POST /global-config/support/clear-logs), with an optional sweep of support archives in the logs directory. Agent and Conductor logs stay out of scope.

Agents connect to Core Hub through a plugin interface instead of managing individual WebSocket sessions. This unlocks higher throughput under heavy pipeline workloads (pooled connections), simpler horizontal scaling (each agent installs as a plugin package), and safer upgrades handled by Conductor, which decommissions legacy 2.1 agents once the plugin is live. If you are coming from 2.1, Conductor guides the migration.

An MCP server runs inside Core Hub (same JVM, same RBAC). Point Claude, Cursor, or any MCP client at /mcp or /mcp/http. The 2.3 catalog is 125 built-in tools; see Core Hub MCP catalog (125 tools). Tool calls use the caller’s bearer token. AI Studio (above) is the in-product workspace on top of this server; Settings → AI agents (MCP) remains the surface for external clients.

Cache-based CDC readers persist position in Core Hub instead of a local checkpoint file, so an agent move or restart no longer resets the reader. Read errors retry instead of jumping the checkpoint. AS/400, MySQL, MariaDB, Informix, and Oracle LogMiner are in this set, with REST/WS exposure and Prometheus scrape series when a reader has persisted a position.

Source agents that used Chronicle Queue as their local cache now use ArenaCache, Gluesync’s own disk-backed cache. The role is unchanged — decouple capture from Core Hub, survive short outages, expire rows by "Source change retention in hours" — but files are per entity, cheaper on disk, and recover more cleanly after a crash. Upgrade when lag is low: Chronicle Queue files are not read by the new agent. See Source-side cache.

Query Studio remains the SQL workbench embedded in the Control Plane (multi-tab editor, schema browser, explain plan, WebSocket progress, CSV/JSON/SQL/XLSX export, saved queries, 90-day audit, read-only by default). Sessions can begin / commit / rollback on a dedicated connection, UPDATE a cell in place, and run on mobile; 2.3 adds row insert and delete on the same grid (see Query Studio: insert and delete rows from the result grid). External modules (including Chronos) can call it. Oracle CLOB / NCLOB cells render as text; Couchbase can be queried via SQL++. Classified PII columns are tagged and masked in the result grid. See Query Studio and PII discovery and masking.

Query Forge remains the federated query gateway via JDBC (jdbc:gluesync://<host>:<port>), Personal API Token only (gsp_…), scoped to pipelines and agents, read-only with filter and projection pushdown. See Query Forge. 2.3 adds the gluesync.ai catalog on this path (see AI as SQL virtual catalog).

The official Grafana pack (dashboard ID 22907) tracks row and byte throughput, snapshot progress, stalled entities, CDC source-reader freshness, Core Hub internal latency, live JDBC connections by purpose, HikariCP pool pressure, host CPU/memory/network, and JVM heap/GC. The Prometheus /metrics endpoint is the source of truth. Pipeline name filters entity delivery panels; pipeline id filters checkpoint lag. See Grafana dashboards and Metrics reference.

Smart alerts still use an allowlist for Monitored objects (empty means nobody; new objects stay off until you add them), Low / Normal / High sensitivity plus cooldown, and pipeline-level overrides. Nested EWMA, latency-pattern, and seasonal knobs may still appear on the wire for compatibility; those legacy detectors no longer fire. 2.3 adds v2 inactivity detection (see Smart alerts v2).

Also still in this train: over-the-air updates with per-component progress and changelog; notifications hub (SMTP, CloudEvents webhooks, history, snooze); technical columns (transaction ID, timestamp, modifying user, operation type); Chronos chained events, webhooks, platform-bound events, JWT/RBAC, and Query Studio actions; Conductor; the rebuilt pipeline wizard, Scheduler, Modules Manager, and Control Plane lists; Gluesync Mobile; pipeline maintenance mode and reset; live connection registry and the internal connections catalog (no Control Plane picker yet); realm-aware user management and OIDC.

These agents remain available in 2.3 (they were not added in this train):