Merge branch 'main' into feat/replace-title-fleet

Author: alexwizp

.agents/skills/evals-write-spec/SKILL.md

@@ -24,7 +24,7 @@ evaluate.describe('Suite name', { tag: tags.serverless.observability.complete },
 
   evaluate('test name', async ({ executorClient, connector }) => {
     await executorClient.runExperiment(
-      { dataset, task },
+      { datasets: [dataset], task },
       evaluators
     );
   });
@@ -202,7 +202,7 @@ export function createEvaluateDataset({
   return async ({ dataset }) => {
     await executorClient.runExperiment(
       {
-        dataset,
+        datasets: [dataset],
         task: async ({ input }) => {
           const response = await chatClient.converse({ messages: [{ message: input.question }] });
           return { messages: response.messages, steps: response.steps };

.agents/skills/evals-write-spec/references/evaluator-patterns.md

@@ -20,7 +20,7 @@ type MyTaskOutput = TaskOutput & {
 };
 
 await executorClient.runExperiment(
-  { dataset, task },
+  { datasets: [dataset], task },
   selectEvaluators<MyExample, MyTaskOutput>([
     {
       name: 'NonEmptyDocuments',
@@ -246,7 +246,7 @@ A common pattern passes both CODE and LLM evaluators to `runExperiment`:
 
 ```ts
 await executorClient.runExperiment(
-  { dataset, task },
+  { datasets: [dataset], task },
   [
     createCriteriaEvaluator({ evaluators }),
     createToolCallsEvaluator({ evaluators }),

.buildkite/scripts/common/setup_job_env.sh

@@ -130,7 +130,7 @@ EOF
 # Set up Kibana Evals secrets
 {
   if [[ "${KBN_EVALS:-}" =~ ^(1|true)$ ]]; then
-    echo "KBN_EVALS was set - exposing evals connectors and ES export credentials"
+    echo "KBN_EVALS was set - exposing evals connectors and export credentials"
 
     KBN_EVALS_CONFIG_JSON="$(vault_get kbn-evals config | base64 -d)"
     # Validate config shape (safe; does not print secrets)
@@ -145,10 +145,6 @@ EOF
     export KBN_EVALS_CONFIG_B64
     KBN_EVALS_CONFIG_B64="$(printf '%s' "$KBN_EVALS_CONFIG_JSON" | base64)"
 
-    # Elasticsearch cluster for evaluation results export
-    export EVALUATIONS_ES_URL="$(jq -r '.evaluationsEs.url // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
-    export EVALUATIONS_ES_API_KEY="$(jq -r '.evaluationsEs.apiKey // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
-
     # Optional: separate cluster for trace-based evaluators
     export TRACING_ES_URL="$(jq -r '.tracingEs.url // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
     export TRACING_ES_API_KEY="$(jq -r '.tracingEs.apiKey // empty' <<<"$KBN_EVALS_CONFIG_JSON")"

.buildkite/scripts/steps/evals/run_suite.sh

@@ -18,10 +18,10 @@ fi
 # The value should be the platform-level `pluginId` use-case identifier.
 # `@kbn/evals` defaults this to `kbn_evals`, but you can override via KBN_EVALS_TELEMETRY_PLUGIN_ID.
 
-# Set a base run id from the Buildkite build. The evaluator fixture appends the
-# connector id to produce a unique run_id per model (e.g. bk-<build>-<connector>).
-# Correlation across models in the same build uses ci.buildkite.build_id which
-# is populated automatically from BUILDKITE_BUILD_ID in score_repository.ts.
+# Set a base build run ID from the Buildkite build. This is used as a seed for
+# generating deterministic per-task experiment IDs (not as the experiment_id itself).
+# Suite-run grouping in the UI uses metadata.ci.build_id which is populated
+# automatically from BUILDKITE_BUILD_ID in the Buildkite metadata.
 if [[ -z "${TEST_RUN_ID:-}" ]] && [[ -n "${BUILDKITE_BUILD_ID:-}" ]]; then
   export TEST_RUN_ID="bk-${BUILDKITE_BUILD_ID}"
 fi

.buildkite/scripts/steps/kbn_ui_publish.sh

@@ -96,14 +96,11 @@ if [[ "${DRY_RUN:-}" == "1" ]]; then
 fi
 
 report_step "Fetching Artifactory credentials"
-# The secret is stored at `kv/ci-shared/serverless/cloud-ui/kbn-ui-artifactory-registry`,
-# so that engineering orgs and CIs from kibana and cloud-ui can both access it without
-# granting broader vault permissions.
-# Secret layout:
+# Secret layout at `secret/ci/elastic-kibana/kbn-ui-artifactory`:
 #   registry   - full npm registry URL
 #   npm_token  - auth token
-NPM_REGISTRY="$(vault_kv_get kv/ci-shared/serverless/cloud-ui/kbn-ui-artifactory-registry registry_url)"
-NPM_TOKEN="$(vault_kv_get kv/ci-shared/serverless/cloud-ui/kbn-ui-artifactory-registry npm_token)"
+NPM_REGISTRY="$(vault_get kbn-ui-artifactory registry)"
+NPM_TOKEN="$(vault_get kbn-ui-artifactory npm_token)"
 if [[ -z "$NPM_REGISTRY" || -z "$NPM_TOKEN" ]]; then
   echo "ERROR: Artifactory credentials missing from vault." >&2
   exit 1

.eslintrc.js

@@ -3002,8 +3002,8 @@ module.exports = {
               '@kbn/*',
               '!@kbn/i18n',
               '!@kbn/i18n-react',
-              '!@kbn/core-chrome-layout-constants',
-              '!@kbn/core-chrome-layout-utils',
+              '!@kbn/ui-chrome-layout-constants',
+              '!@kbn/ui-chrome-layout-utils',
             ],
           },
         ],

.github/CODEOWNERS

@@ -360,6 +360,8 @@ src/core/packages/user-storage/server-mocks @elastic/appex-sharedux
 src/core/test-helpers/kbn-server @elastic/kibana-core
 src/core/test-helpers/model-versions @elastic/kibana-core
 src/platform/kbn-ui/chrome-layout @elastic/appex-sharedux
+src/platform/kbn-ui/chrome-layout-constants @elastic/appex-sharedux
+src/platform/kbn-ui/chrome-layout-utils @elastic/appex-sharedux
 src/platform/kbn-ui/side-navigation @elastic/appex-sharedux
 src/platform/packages/private/analytics/utils/analytics_collection_utils @elastic/kibana-core
 src/platform/packages/private/dashboard/dashboard-navigation-options-common @elastic/kibana-presentation
@@ -915,7 +917,6 @@ src/platform/test/plugin_functional/plugins/core_plugin_route_timeouts @elastic/
 src/platform/test/plugin_functional/plugins/core_provider_plugin @elastic/kibana-core
 src/platform/test/plugin_functional/plugins/data_search @elastic/kibana-data-discovery
 src/platform/test/plugin_functional/plugins/elasticsearch_client_plugin @elastic/kibana-core
-src/platform/test/plugin_functional/plugins/eui_provider_dev_warning @elastic/appex-sharedux
 src/platform/test/plugin_functional/plugins/hardening @elastic/kibana-security
 src/platform/test/plugin_functional/plugins/index_patterns @elastic/kibana-data-discovery
 src/platform/test/plugin_functional/plugins/kbn_sample_panel_action @elastic/appex-sharedux
@@ -1189,6 +1190,7 @@ x-pack/platform/plugins/shared/inbox @elastic/security-genai-research-and-develo
 x-pack/platform/plugins/shared/index_management @elastic/kibana-management
 x-pack/platform/plugins/shared/inference @elastic/search-kibana
 x-pack/platform/plugins/shared/inference_endpoint @elastic/search-kibana
+x-pack/platform/plugins/shared/inference_workflows @elastic/search-kibana
 x-pack/platform/plugins/shared/ingest_hub @elastic/obs-onboarding-team
 x-pack/platform/plugins/shared/ingest_pipelines @elastic/kibana-management
 x-pack/platform/plugins/shared/lens @elastic/kibana-visualizations
@@ -3405,6 +3407,8 @@ x-pack/solutions/observability/plugins/observability_shared/public/components/pr
 /src/core/packages/chrome @elastic/appex-sharedux
 /src/platform/kbn-ui/_tooling @elastic/appex-sharedux
 /src/platform/kbn-ui/chrome-layout @elastic/appex-sharedux
+/src/platform/kbn-ui/chrome-layout-constants @elastic/appex-sharedux
+/src/platform/kbn-ui/chrome-layout-utils @elastic/appex-sharedux
 /src/platform/kbn-ui/side-navigation @elastic/appex-sharedux
 /x-pack/platform/test/serverless/api_integration/test_suites/favorites @elastic/appex-sharedux # Assigned per https://github.com/elastic/kibana/pull/200985
 /src/platform/test/api_integration/apis/short_url/**/*.ts @elastic/appex-sharedux # Assigned per https://github.com/elastic/kibana/pull/200209/files#r1846654156

.github/workflows/triage-bulk-needs-team.yml

@@ -153,7 +153,7 @@ mapped_pages:
 | [enterpriseSearch](https://github.com/elastic/kibana/blob/main/x-pack/solutions/search/plugins/enterprise_search/README.md) | This plugin provides Kibana user interfaces for managing the Enterprise Search solution and its products, App Search and Workplace Search. |
 | [entityManager](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/entity_manager/README.md) | This plugin provides access to observed entity data, such as information about hosts, pods, containers, services, and more. |
 | [entityStore](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/entity_store/README.md) | Central place for Entities management and logs extraction. |
-| [evals](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/evals/README.md) | The Evals plugin provides an in-Kibana UI for browsing LLM evaluation run results, per-evaluator statistics, and OpenTelemetry traces produced by the @kbn/evals evaluation framework. |
+| [evals](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/evals/README.md) | The Evals plugin provides an in-Kibana UI for browsing LLM evaluation experiment results, per-evaluator statistics, and OpenTelemetry traces produced by the @kbn/evals evaluation framework. |
 | [eventLog](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/event_log/README.md) | The event log plugin provides a persistent history of alerting and action activities. |
 | [exploratoryView](https://github.com/elastic/kibana/blob/main/x-pack/solutions/observability/plugins/exploratory_view/README.md) | A shared component for visualizing observability data types via lens embeddable. For further details. |
 | [features](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/features/README.md) | The features plugin enhance Kibana with a per-feature privilege system. |
@@ -173,6 +173,7 @@ mapped_pages:
 | [indicesMetadata](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/private/indices_metadata/README.md) | Plugin for managing and retrieving metadata about indices in Kibana. This plugin collects and processes metadata from Elasticsearch indices, data streams, ILM policies, and index templates. |
 | [inference](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference/README.md) | The inference plugin is a central place to handle all interactions with the Elasticsearch Inference API and external LLM APIs. Its goals are: |
 | [inferenceEndpoint](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference_endpoint/README.md) | A Kibana plugin |
+| [inferenceWorkflows](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference_workflows/README.md) | Registers AI workflow steps (ai.prompt, ai.summarize, ai.classify) that use the inference plugin to power LLM-based automation in Kibana Workflows. |
 | [infra](https://github.com/elastic/kibana/blob/main/x-pack/solutions/observability/plugins/infra/README.md) | This is the home of the infra plugin, which aims to provide a solution for the infrastructure monitoring use-case within Kibana. |
 | [ingestHub](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ingest_hub/README.md) | Cross-solution onboarding page for adding data sources and integrations. Gated behind the ingestHub.enabled feature flag. |
 | [ingestPipelines](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ingest_pipelines/README.md) | The ingest_pipelines plugin provides Kibana support for Elasticsearch's ingest pipelines. |

docs/extend/plugin-list.md

@@ -30,8 +30,40 @@ When a user sets a preferred language, it is stored in their user profile and ta
 
 {{kib}} resolves the display language using the following priority chain:
 
-1. **User profile setting** — The language selected by the user in their profile or the user menu (must be one of `i18n.locales`).
-2. **`i18n.defaultLocale` config** — The server-wide default set in `kibana.yml`.
+1. **User profile setting** — The language selected by the user in their
+   profile or the user menu (must be one of `i18n.locales`).
+2. **`KBN_LOCALE` cookie** — The most recently rendered locale on this
+   browser. {{kib}} writes this cookie on every rendered response, so it
+   tracks profile changes automatically. The cookie is the fallback used
+   on surfaces where the profile isn't available — login pages, error
+   pages, and any browsing the user does after signing out. Only used
+   when the cookie value matches a locale {{kib}} can serve.
+3. **`Accept-Language` header** {applies_to}`serverless: ga` — On
+   serverless deployments, {{kib}} consults the browser's
+   `Accept-Language` preferences when neither the profile setting nor
+   the cookie produces a match. The first weighted preference that's an
+   exact match (region included) for an entry in `i18n.locales` wins.
+   This step is skipped on traditional/self-managed deployments to keep
+   existing users' language stable across upgrades.
+4. **`i18n.defaultLocale` config** — The server-wide default set in `kibana.yml`.
+
+#### About the `KBN_LOCALE` cookie
+
+{{kib}} sets a `KBN_LOCALE` cookie on every rendered response containing
+the resolved locale id (for example, `KBN_LOCALE=ja-JP`). Attributes:
+
+- Path scoped to the {{kib}} `serverBasePath`.
+- `SameSite=Lax`, `Max-Age` of one year, and `Secure` when the response is over HTTPS.
+- `HttpOnly`. The value is a preference, not a secret, but {{kib}} does not need browser-side JavaScript to read it.
+
+Privacy posture: `KBN_LOCALE` is a strictly-necessary preference cookie.
+It does not track the user, store identity, or enable cross-site activity.
+
+To disable the cookie entirely, set `i18n.allowLocaleCookie: false` in
+`kibana.yml`. When disabled, the per-user language selection still works via
+user profiles; however, anonymous pages and pages visited after signing out
+will always fall back to `i18n.defaultLocale` (or `Accept-Language` on
+serverless deployments) rather than remembering the previously resolved locale.
 
 ## Example configurations
 
@@ -51,4 +83,7 @@ i18n.defaultLocale: "en"
 
 # 4. Legacy form — still works, logs a deprecation warning at startup:
 i18n.locale: "ja-JP"
-```
+
+# 5. Disable the KBN_LOCALE cookie:
+i18n.allowLocaleCookie: false
+```