{
  "schemaVersion": "1.0",
  "title": "CrewAI connector changelog",
  "description": "This changelog records source-confirmed CrewAI connector baselines and the operator action required by each change. Artifact digests and retained release evidence, not the version string alone, identify a deployable release.",
  "canonical": "https://getaip.org/docs/connectors/crewai/changelog",
  "route": "/docs/connectors/crewai/changelog",
  "source": "docs/connectors/crewai/changelog.md",
  "protocol": "Agent Interoperability Protocol",
  "protocolVersion": "1.0",
  "section": "Connectors",
  "documentType": "Connector",
  "language": "en",
  "downloads": {
    "md": "/docs/download/connectors/crewai/changelog.md",
    "txt": "/docs/download/connectors/crewai/changelog.txt",
    "json": "/docs/download/connectors/crewai/changelog.json",
    "pdf": "/docs/download/connectors/crewai/changelog.pdf"
  },
  "content": {
    "format": "text/markdown",
    "markdown": "---\ntitle: CrewAI connector changelog\ndescription: >-\n  Track the reviewed CrewAI connector baseline, compatibility boundary,\n  migration actions, and requalification triggers\nkind: release-reference\naudience: integrator\nappliesTo: \"1.x\"\nwritingStandard: \"aip-docs/1.0\"\nlastReviewedRevision: \"97be86e9efedf07ecf1783b03800f683f107fb04\"\nconnector: crewai\naliases:\n  - CrewAI connector versions\n  - CrewAI connector release history\n  - aip-host-crewai changelog\n---\n\n# CrewAI connector changelog\n\nThis changelog records source-confirmed CrewAI connector baselines and the\noperator action required by each change. Artifact digests and retained release\nevidence, not the version string alone, identify a deployable release.\n\nThe reviewed commits remain in the workspace `1.0.0` line. Intermediate source\ncommits are not presented as separately published semantic releases.\n\n## Current reviewed baseline\n\n| Property | Value |\n|---|---|\n| Connector version line | `1.0.0` |\n| AIP protocol | `1.0` |\n| Connector profile | `aip.connector.crewai.v1` |\n| Reviewed AIP source | `97be86e9efedf07ecf1783b03800f683f107fb04` |\n| Reviewed source time | `2026-07-26T10:41:19Z` |\n| Sidecar package | `aip-crewai-sidecar` `1.0.0` |\n| Default CrewAI package set | `crewai`, `crewai-core`, and `crewai-cli` `1.15.5` |\n| Method-verification source | `bfa652a7be8637562cc9b0833f75d927a64552d1` |\n| Public operations per fully admitted crew | 10 |\n| Durable job operations | 7 |\n| Control operations | 3 |\n\nThis table identifies source behavior. A production record must also identify\nthe Rust host digest, sidecar digest, crew-code digest, admission package,\nconfiguration revision, and qualification evidence.\n\n## 1.0.0 reviewed hardening baseline\n\nSource revision `97be86e9efedf07ecf1783b03800f683f107fb04` is the documentation baseline.\nIt confirms the following surfaces.\n\n### Added\n\n- standalone `aip-host-crewai` using the common connector-host lifecycle;\n- immutable type, version, instance, and replica identity;\n- operation-specific capabilities for status, events, cancel, batch, replay,\n  training, testing, knowledge, and memory;\n- a frozen ten-operation catalogue verified against one CrewAI source commit;\n- bounded input and output schemas for every operation;\n- a lockfile-frozen Python sidecar artifact;\n- durable job records keyed by AIP Action ID;\n- canonical request hashing with collision rejection;\n- ordered replayable sidecar events and cursor reads;\n- explicit archive confirmation for terminal records;\n- product-fleet image, execution, restart, outage, and recovery evidence paths.\n\n### Hardened\n\n- sidecar Bearer authentication is required outside explicit loopback\n  development;\n- host-to-sidecar transport requires HTTPS outside loopback and disables\n  redirects;\n- token, descriptor, response, input, output, event, state, and retention bounds\n  fail closed;\n- journal admission persists before provider task scheduling;\n- one exclusive nonblocking lock fences each journal to one process;\n- journal replacement uses a same-directory temporary file and durability\n  flushes;\n- restored running records become failed with explicit uncertainty;\n- runtime storage, connector health, lease, and drain state gate routing\n  readiness;\n- credential revision policy is checked before provider side effects;\n- sidecar logs use Action identity while terminal events avoid raw exception\n  text.\n\n### Changed\n\n- one descriptor now includes an explicit operation allowlist;\n- one crew can expose up to ten distinct capabilities instead of one base run\n  capability;\n- startable operations use `/jobs` and `/jobs/stream` as the canonical private\n  routes;\n- `/runs` aliases remain only for legacy run compatibility;\n- status and events target a durable Action through `run_action_id`;\n- cancellation support is advertised only for run, batch, replay, train, and\n  test;\n- sidecar health must prove a durable journal, every configured crew, and every\n  descriptor-admitted operation;\n- horizontal capacity uses independent connector instances instead of shared\n  sidecar state.\n\n### Known limitations\n\n- provider exactly-once effects are not guaranteed;\n- cancellation does not prove termination of CrewAI worker threads or external\n  tools;\n- `remote_stop_confirmed: true` proves only sidecar acknowledgement;\n- the sidecar has no Prometheus metrics route;\n- the deterministic qualification crew does not call an external model or\n  tool provider;\n- the pinned fleet procedure does not execute every operation end to end;\n- workspace version `1.0.0` does not distinguish every source hardening commit.\n\n## Earlier 1.0.0 source baseline\n\nThe AIP Core `1.0.0` source commit\n`034a520608eea44e6b14e61c34734bd402d989c0` contained an earlier CrewAI\nconnector shape.\n\nThat state had:\n\n- one descriptor with ID, name, and optional description;\n- one base capability for each configured crew;\n- run, streamed run, and cancellation mapping through the sidecar;\n- optional sidecar Bearer configuration;\n- a simpler HTTP client and error inventory;\n- no standalone `aip-host-crewai` crate;\n- no fixed ten-operation catalogue;\n- no descriptor operation allowlist;\n- no reviewed durable multi-operation journal and process fence;\n- no CrewAI entry in the production product-fleet topology.\n\nThe comparison describes two source states with the same workspace version. It\ndoes not establish that an earlier container was publicly released.\n\n## Migration from the earlier source shape\n\nApply these actions before moving an existing integration to the reviewed\nbaseline.\n\n| Area | Required action |\n|---|---|\n| Artifact identity | Build or select separately admitted host and sidecar digests |\n| Deployment | Run the Rust host and Python sidecar as distinct processes |\n| Descriptors | Add exact operation allowlists and review generated capability IDs |\n| Routing | Register type, version, instance, replica, tenant, account, endpoint, and lease identity |\n| Sidecar URL | Use private HTTPS or explicit loopback HTTP; remove credentials, query, and fragment |\n| Authentication | Project one owner-controlled token to both processes |\n| State | Provision one protected persistent volume per sidecar instance |\n| Training | Add protected training storage before enabling `train` |\n| Identity | Preserve Action ID and idempotency key across recovery |\n| Operations | Update callers from a single run capability to operation-specific IDs |\n| Events | Resume durable events by target Action ID and cursor |\n| Cancellation | Treat route success as sidecar evidence, not provider termination |\n| Qualification | Re-run source, image, execution, restart, and failure gates |\n\nDo not migrate by attaching the new sidecar to an unreviewed old host. The\nprivate route, request model, operation metadata, health contract, and failure\nsemantics must remain one compatible pair.\n\n## Compatibility rules\n\nThe reviewed connector remains compatible with AIP `1.0` at the native wire\nboundary. The CrewAI-specific profile and private sidecar contract have their\nown compatibility requirements.\n\nA change requires a new artifact identity and requalification when it affects:\n\n- a capability ID, kind, schema, risk, approval, idempotency, or side-effect\n  contract;\n- a sidecar route, request, response, event, status, auth, or timeout rule;\n- CrewAI package versions or the method-verification source revision;\n- crew factory code, model, tool, knowledge, memory, or training behavior;\n- request hashing, journal format, locking, persistence, or archive behavior;\n- host signing, registry identity, credential policy, storage, or lifecycle;\n- an image base, runtime user, entrypoint, dependency graph, or trust evidence.\n\nDocumentation-only clarification can retain the artifact identity when it does\nnot change code, schemas, manifests, examples that define behavior, or\nqualification claims.\n\n## Upgrade acceptance record\n\nFor each adopted baseline, record:\n\n```text\nConnector version:\nAIP source revision:\nHost image digest:\nSidecar image digest:\nSidecar lockfile digest:\nCrewAI package versions:\nCrew source digest:\nAdmission package digest:\nConfiguration revision:\nQualification run and evidence digest:\nMigration reviewer:\nAccepted at:\nRollback pair:\n```\n\nNever record only `1.0.0`. That string can describe multiple source and image\nstates in the reviewed history.\n\n## Changelog maintenance\n\nAdd a new entry only after the corresponding source and artifact identities are\nfixed. Each entry must list added, changed, deprecated, removed, fixed, security,\nmigration, compatibility, qualification, and known-limitation information when\napplicable.\n\nKeep planned work outside this file. Mark a surface deprecated only when a\ncommitted artifact defines the replacement and lifecycle.\n\n## Related documentation\n\n- [CrewAI connector overview](README.md)\n- [Deploy the CrewAI connector](operations/deployment.md)\n- [CrewAI sidecar contract and lockfile](reference/sidecar-contract-and-lockfile.md)\n- [CrewAI idempotency, cancellation, and process fencing](reference/idempotency-cancellation-and-process-fencing.md)\n- [Qualify the CrewAI connector](qualification/README.md)\n",
    "text": "CrewAI connector changelog\n\nThis changelog records source-confirmed CrewAI connector baselines and the\noperator action required by each change. Artifact digests and retained release\nevidence, not the version string alone, identify a deployable release.\n\nThe reviewed commits remain in the workspace 1.0.0 line. Intermediate source\ncommits are not presented as separately published semantic releases.\n\nCurrent reviewed baseline\n\n| Property | Value |\n\n| Connector version line | 1.0.0 |\n| AIP protocol | 1.0 |\n| Connector profile | aip.connector.crewai.v1 |\n| Reviewed AIP source | 97be86e9efedf07ecf1783b03800f683f107fb04 |\n| Reviewed source time | 2026-07-26T10:41:19Z |\n| Sidecar package | aip-crewai-sidecar 1.0.0 |\n| Default CrewAI package set | crewai, crewai-core, and crewai-cli 1.15.5 |\n| Method-verification source | bfa652a7be8637562cc9b0833f75d927a64552d1 |\n| Public operations per fully admitted crew | 10 |\n| Durable job operations | 7 |\n| Control operations | 3 |\n\nThis table identifies source behavior. A production record must also identify\nthe Rust host digest, sidecar digest, crew-code digest, admission package,\nconfiguration revision, and qualification evidence.\n\n1.0.0 reviewed hardening baseline\n\nSource revision 97be86e9efedf07ecf1783b03800f683f107fb04 is the documentation baseline.\nIt confirms the following surfaces.\n\nAdded\n• standalone aip-host-crewai using the common connector-host lifecycle;\n• immutable type, version, instance, and replica identity;\n• operation-specific capabilities for status, events, cancel, batch, replay,\n  training, testing, knowledge, and memory;\n• a frozen ten-operation catalogue verified against one CrewAI source commit;\n• bounded input and output schemas for every operation;\n• a lockfile-frozen Python sidecar artifact;\n• durable job records keyed by AIP Action ID;\n• canonical request hashing with collision rejection;\n• ordered replayable sidecar events and cursor reads;\n• explicit archive confirmation for terminal records;\n• product-fleet image, execution, restart, outage, and recovery evidence paths.\n\nHardened\n• sidecar Bearer authentication is required outside explicit loopback\n  development;\n• host-to-sidecar transport requires HTTPS outside loopback and disables\n  redirects;\n• token, descriptor, response, input, output, event, state, and retention bounds\n  fail closed;\n• journal admission persists before provider task scheduling;\n• one exclusive nonblocking lock fences each journal to one process;\n• journal replacement uses a same-directory temporary file and durability\n  flushes;\n• restored running records become failed with explicit uncertainty;\n• runtime storage, connector health, lease, and drain state gate routing\n  readiness;\n• credential revision policy is checked before provider side effects;\n• sidecar logs use Action identity while terminal events avoid raw exception\n  text.\n\nChanged\n• one descriptor now includes an explicit operation allowlist;\n• one crew can expose up to ten distinct capabilities instead of one base run\n  capability;\n• startable operations use /jobs and /jobs/stream as the canonical private\n  routes;\n• /runs aliases remain only for legacy run compatibility;\n• status and events target a durable Action through runactionid;\n• cancellation support is advertised only for run, batch, replay, train, and\n  test;\n• sidecar health must prove a durable journal, every configured crew, and every\n  descriptor-admitted operation;\n• horizontal capacity uses independent connector instances instead of shared\n  sidecar state.\n\nKnown limitations\n• provider exactly-once effects are not guaranteed;\n• cancellation does not prove termination of CrewAI worker threads or external\n  tools;\n• remotestopconfirmed: true proves only sidecar acknowledgement;\n• the sidecar has no Prometheus metrics route;\n• the deterministic qualification crew does not call an external model or\n  tool provider;\n• the pinned fleet procedure does not execute every operation end to end;\n• workspace version 1.0.0 does not distinguish every source hardening commit.\n\nEarlier 1.0.0 source baseline\n\nThe AIP Core 1.0.0 source commit\n034a520608eea44e6b14e61c34734bd402d989c0 contained an earlier CrewAI\nconnector shape.\n\nThat state had:\n• one descriptor with ID, name, and optional description;\n• one base capability for each configured crew;\n• run, streamed run, and cancellation mapping through the sidecar;\n• optional sidecar Bearer configuration;\n• a simpler HTTP client and error inventory;\n• no standalone aip-host-crewai crate;\n• no fixed ten-operation catalogue;\n• no descriptor operation allowlist;\n• no reviewed durable multi-operation journal and process fence;\n• no CrewAI entry in the production product-fleet topology.\n\nThe comparison describes two source states with the same workspace version. It\ndoes not establish that an earlier container was publicly released.\n\nMigration from the earlier source shape\n\nApply these actions before moving an existing integration to the reviewed\nbaseline.\n\n| Area | Required action |\n\n| Artifact identity | Build or select separately admitted host and sidecar digests |\n| Deployment | Run the Rust host and Python sidecar as distinct processes |\n| Descriptors | Add exact operation allowlists and review generated capability IDs |\n| Routing | Register type, version, instance, replica, tenant, account, endpoint, and lease identity |\n| Sidecar URL | Use private HTTPS or explicit loopback HTTP; remove credentials, query, and fragment |\n| Authentication | Project one owner-controlled token to both processes |\n| State | Provision one protected persistent volume per sidecar instance |\n| Training | Add protected training storage before enabling train |\n| Identity | Preserve Action ID and idempotency key across recovery |\n| Operations | Update callers from a single run capability to operation-specific IDs |\n| Events | Resume durable events by target Action ID and cursor |\n| Cancellation | Treat route success as sidecar evidence, not provider termination |\n| Qualification | Re-run source, image, execution, restart, and failure gates |\n\nDo not migrate by attaching the new sidecar to an unreviewed old host. The\nprivate route, request model, operation metadata, health contract, and failure\nsemantics must remain one compatible pair.\n\nCompatibility rules\n\nThe reviewed connector remains compatible with AIP 1.0 at the native wire\nboundary. The CrewAI-specific profile and private sidecar contract have their\nown compatibility requirements.\n\nA change requires a new artifact identity and requalification when it affects:\n• a capability ID, kind, schema, risk, approval, idempotency, or side-effect\n  contract;\n• a sidecar route, request, response, event, status, auth, or timeout rule;\n• CrewAI package versions or the method-verification source revision;\n• crew factory code, model, tool, knowledge, memory, or training behavior;\n• request hashing, journal format, locking, persistence, or archive behavior;\n• host signing, registry identity, credential policy, storage, or lifecycle;\n• an image base, runtime user, entrypoint, dependency graph, or trust evidence.\n\nDocumentation-only clarification can retain the artifact identity when it does\nnot change code, schemas, manifests, examples that define behavior, or\nqualification claims.\n\nUpgrade acceptance record\n\nFor each adopted baseline, record:\n\nConnector version:\nAIP source revision:\nHost image digest:\nSidecar image digest:\nSidecar lockfile digest:\nCrewAI package versions:\nCrew source digest:\nAdmission package digest:\nConfiguration revision:\nQualification run and evidence digest:\nMigration reviewer:\nAccepted at:\nRollback pair:\n\nNever record only 1.0.0. That string can describe multiple source and image\nstates in the reviewed history.\n\nChangelog maintenance\n\nAdd a new entry only after the corresponding source and artifact identities are\nfixed. Each entry must list added, changed, deprecated, removed, fixed, security,\nmigration, compatibility, qualification, and known-limitation information when\napplicable.\n\nKeep planned work outside this file. Mark a surface deprecated only when a\ncommitted artifact defines the replacement and lifecycle.\n\nRelated documentation\n• CrewAI connector overview (README.md)\n• Deploy the CrewAI connector (operations/deployment.md)\n• CrewAI sidecar contract and lockfile (reference/sidecar-contract-and-lockfile.md)\n• CrewAI idempotency, cancellation, and process fencing (reference/idempotency-cancellation-and-process-fencing.md)\n• Qualify the CrewAI connector (qualification/README.md)\n"
  },
  "integrity": {
    "algorithm": "sha256",
    "sourceDigest": "9c0d37fde7196f0878ab10a7b944a0e876d7f9134b91c6b82580539c93e68bfc"
  }
}