Boise-State-Development · philmerrell · Jul 18, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,18 @@ All notable changes to this project are documented in this file. Format follows
 
 For narrative release notes written for operators and product owners, see [RELEASE_NOTES.md](RELEASE_NOTES.md).
 
+## [1.7.1] - 2026-07-17
+
+Patch release fixing a Word-document save failure in the AgentCore Runtime and advancing the **session-metadata static-sort-key migration** (issue #175) to its write side. Word tools now resolve the user-files bucket's real region instead of pinning to `AWS_REGION`, so `PutObject` no longer fails with `PermanentRedirect`. On the storage side, new sessions are now born with a static sort key and legacy rows self-migrate in place on their next write, structurally eliminating the ghost-row race behind the "Failed to parse session item" warnings and closing the first-turn duplicate-row race. No infra or data migration; ship through `backend.yml`.
+
+### ✨ Improved
+
+- Static-sort-key write path for session metadata (issue #175 Phase 1b) — new sessions are born at a static sort key (`S#{session_id}` + `SessionRecencyIndex` keys) guarded by a real `attribute_not_exists(PK)` conditional put, and legacy rows do a one-time in-place migration to the static SK on their next write. Rows no longer rotate on every message, so the ghost-row race that produced "Failed to parse session item" warnings is structurally eliminated for migrated rows, and the deterministic SK closes the first-turn duplicate-row race the old timestamped SK could not gate. `delete_session` resolves the raw SK via the GSI (catching migrated rows the old reconstruction missed) and soft-deletes in place. The recency index is updated (`SET GSI4`) for active rows and removed for deleted ones (#673)
+
+### 🐛 Fixed
+
+- Word-document `PutObject` no longer fails with `PermanentRedirect` in the AgentCore Runtime — the user-files S3 client pinned its endpoint to `https://s3.{AWS_REGION}.amazonaws.com`, but the runtime's `AWS_REGION` does not reliably match the bucket region and the explicit `endpoint_url` disabled botocore's automatic region redirect. The client now resolves the bucket's true region via `HeadBucket` (`x-amz-bucket-region`, backed by the `s3:ListBucket` the runtime role already has) and drops the hardcoded `endpoint_url`, fixing both the save and the presigned download URL (#674)
+
 ## [1.7.0] - 2026-07-17
 
 Feature release adding a full **Word (.docx) document toolset** for the agent and advancing the **session-metadata static-sort-key migration** (issue #175) through its read-side phases. The agent can now create, modify, list, and read Word documents — rendered inline in chat with a download button — behind the `create_word_document` capability toggle. On the storage side, a new sparse `SessionRecencyIndex` GSI plus a dual-scheme union reader let session listing work whether or not a session's base sort key has been migrated, deploying safely in any order. Also bumps `strands-agents` to 1.48.0 to fix an "Agent force-stopped" crash on non-PDF document uploads. Requires a CDK deploy for the new GSI; ships the rest via `backend.yml` + the frontend pipeline.

diff --git a/README.md b/README.md
@@ -8,7 +8,7 @@
 **An open-source, production-ready Generative AI platform for institutions**
 *Built by Boise State University, designed for everyone.*
 
-[![Release](https://img.shields.io/badge/Release-v1.7.0-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
+[![Release](https://img.shields.io/badge/Release-v1.7.1-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
 [![Nightly](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml/badge.svg)](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml)
 
 ![Python](https://img.shields.io/badge/Python-3.13+-3776AB?style=flat&logo=python&logoColor=white)
@@ -296,7 +296,7 @@ agentcore-public-stack/
 
 See [RELEASE_NOTES.md](RELEASE_NOTES.md) for the full changelog, including new features, bug fixes, platform upgrades, and deployment notes for each release.
 
-**Current release:** v1.7.0
+**Current release:** v1.7.1
 
 ---
 

diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
@@ -1,3 +1,32 @@
+# Release Notes — v1.7.1
+
+**Release Date:** July 17, 2026
+**Previous Release:** v1.7.0 (July 17, 2026)
+
+---
+
+> 🚀 **Backend-only release.** No CDK deploy and no data migration — ship through `backend.yml`. Session rows self-migrate to the static sort key on their next write; nothing to run.
+
+---
+
+## Highlights
+
+v1.7.1 is a patch fixing a Word-document save failure and advancing the **session-metadata static-sort-key migration** (issue #175) to its write side. Saving a generated Word document no longer fails with `PermanentRedirect` in the AgentCore Runtime — the S3 client now resolves the user-files bucket's real region instead of trusting `AWS_REGION`. On the storage side, new sessions are now **born with a static sort key** and legacy rows **self-migrate in place** on their next write, so rows stop rotating on every message — structurally eliminating the ghost-row race behind the "Failed to parse session item" warnings and closing the first-turn duplicate-row race.
+
+## Fixed — Word-document saves failing with `PermanentRedirect`
+
+The user-files S3 client pinned its endpoint to `https://s3.{AWS_REGION}.amazonaws.com`. In the AgentCore Runtime, `AWS_REGION` does not reliably match the bucket's region, and the explicit `endpoint_url` disabled botocore's automatic S3 region redirect — so `PutObject` failed with `PermanentRedirect` and Word-document saves broke. The client (`agents/builtin_tools/word_document_tool.py`) now resolves the bucket's true region via `HeadBucket` (reading the `x-amz-bucket-region` header, which maps to the `s3:ListBucket` permission the runtime role already holds — avoiding the ungranted `s3:GetBucketLocation`) and drops the hardcoded `endpoint_url`. This fixes both the save and the presigned download URL region; if the region lookup is ever unavailable, botocore's now-enabled built-in redirect still corrects it.
+
+## Session-metadata static-sort-key migration (issue #175, write-side)
+
+v1.7.0 landed the read side (every reader tolerates both sort-key schemes); v1.7.1 turns on the **write** side. New sessions are now created at a static base sort key (`S#{session_id}` plus the `SessionRecencyIndex` keys) behind a real `attribute_not_exists(PK)` conditional put, and any still-legacy row does a one-time in-place migration to the static SK on its next write. Because the row no longer encodes `lastMessageAt` in the sort key, it never moves — the ghost-row race that produced "Failed to parse session item" warnings is structurally eliminated for every migrated row, and the deterministic sort key makes the first-turn duplicate-row guard meaningful for the first time. `delete_session` now resolves the raw sort key via the GSI (catching migrated rows the old `S#ACTIVE#…` reconstruction missed) and soft-deletes in place; the sparse recency index is set for active rows and removed for deleted ones. All resolve-then-update writers already operate on the current sort key and need no change. Covered by `TestWriteSideMigration` (born-static, one-time migrate, no rotation, in-place/legacy soft-delete, end-to-end) against the real `ConditionalCheckFailedException` contract.
+
+## 🚀 Deployment notes
+
+Ship through `backend.yml` (app-api + inference-api). No CDK deploy and no data migration — rows migrate themselves on their next write, and readers already tolerate both schemes as of v1.7.0. No breaking changes.
+
+---
+
 # Release Notes — v1.7.0
 
 **Release Date:** July 17, 2026

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.7.0
+1.7.1
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentcore-stack"
-version = "1.7.0"
+version = "1.7.1"
 requires-python = ">=3.10"
 description = "Multi-agent conversational AI system with AWS Bedrock AgentCore"
 readme = "README.md"

diff --git a/backend/uv.lock b/backend/uv.lock
diff --git a/frontend/ai.client/package-lock.json b/frontend/ai.client/package-lock.json
diff --git a/frontend/ai.client/package.json b/frontend/ai.client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ai.client",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "scripts": {
     "ng": "ng",
     "start": "ng serve",

diff --git a/infrastructure/package-lock.json b/infrastructure/package-lock.json
diff --git a/infrastructure/package.json b/infrastructure/package.json
@@ -1,6 +1,6 @@
 {
   "name": "infrastructure",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "bin": {
     "infrastructure": "bin/infrastructure.js"
   },