Add August 28 changelog entry

[eclairen]

Summary

Adds the August 28 changelog entry, covering the week since August 21.

Each line was checked against merged PRs, the deployed API and browser images, published package versions, and live URLs. Three drafted items changed as a result:

• Dropped the OTLP destination delivery health / circuit breaker item. Only the storage schema has merged; the PRs that expose last_export_at, last_error_at, last_error, and consecutive_failures on destination reads and add the breaker are still open, so nothing is customer-visible yet.
• Firecracker v1.16.1: dropped the CVE claim (upstream v1.15.0, v1.16.0, and v1.16.1 release notes list none) and replaced it with the snapshot-restore and jailer fixes that are actually in the range. Added that existing snapshots keep restoring on their recorded version, since there's no in-place migration.
• WebMCP: scoped to Kernel browsers generally rather than stealth browsers specifically, matching what shipped.

Other corrections:

• Bug bounty link pointed at a path that doesn't exist; it now points at the published policy page.
• Config Registry linked to a docs page that doesn't exist, so the link is dropped and the paid-plan and per-organization access requirements are stated instead.
• ap-southeast was described as a CLI-only addition. It shipped across the API, dashboard, and CLI, and regional placement is enabled per organization, so the item now says both.
• CLI item now cites the version range (v0.32.0-v0.33.0), matching prior entries.
• Telemetry docs link points at the categories page, where the control vs platform content lives.

Added, having shipped in the window but missing from the draft:

• submit_feedback tool on the MCP server.
• Managed auth retries a login when a rejected credential is corrected - the backend half of the rejected-field notice in @onkernel/managed-auth-react.
• kernel.sh agent-readable surfaces (llms.txt, index.md, OpenAPI/OAuth/MCP discovery).

Deliberately left out: project spending caps (internal only), CDP fast extension loading (partial rollout), Config Registry recommendation UI, and bug fixes.

Testing

Not run locally. All internal links resolve to pages that exist in this repo; the external links were checked live.

---

Note

Low Risk
Documentation-only changelog addition with no runtime or API behavior changes in this diff.

Overview
Adds a new August 28 <Update> block at the top of changelog.mdx, following the existing Product / Documentation split and ["Product", "Docs"] tags.

Product updates announce shipped work: a public bug bounty policy, browser telemetry split into default control vs opt-in platform (with leaner defaults and clipped executePlaywrightCode payloads), WebMCP on by default with consolidated feature flags, MCP changes (OpenAI Apps SDK domain verification, new submit_feedback with redaction), managed-auth retry on corrected credentials, CLI fx MCP install (v0.32.0–v0.33.0), Playwright target-ID memoization, and Hypeman on Firecracker v1.16.1.

Documentation updates link to new or updated guides: telemetry categories, bot-detection navigation guidance, fx MCP setup, and kernel.sh agent-readable surfaces (llms.txt, index.md, discovery endpoints, no-JS homepage fallback).

^{Reviewed by Cursor Bugbot for commit 475d5f3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Kernel	🟢 Ready	View Preview	Aug 27, 2026, 9:00 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[cursor]

Risk assessment: Very Low

Verdict: Risk is unchanged. Prior approval on 475d5f3 is retained; this run does not re-approve.

Independent review of the diff (not the PR description) shows a single-file, additive documentation change:

• Files: changelog.mdx only (+21 / −0)
• Change: One new August 28 <Update> block prepended above the existing August 21 entry, matching the current changelog pattern
• Codepaths / blast radius: Public docs changelog copy only. No docs.json, navigation, CI, snippets, or runtime/API/auth/billing/infra files
• Complexity: Markdown/MDX list items and links; no logic
• Infra / operational / security impact: None. This is not a prompt or model-instruction file
• Codeowners: No CODEOWNERS file in the repo; required code-owner review is not enabled

HEAD is still 475d5f3d80bb75e211087eb565bdfadc8b0deae4, the same commit already approved. Risk has not increased, so approval is not dismissed.

  

_{Sent by Cursor Automation: Assign PR reviewers}