Merge branch 'main' into changes-history/mvp-ui

Author: maximpn

.agents/skills/evals-write-spec/SKILL.md

@@ -24,7 +24,7 @@ evaluate.describe('Suite name', { tag: tags.serverless.observability.complete },
 
   evaluate('test name', async ({ executorClient, connector }) => {
     await executorClient.runExperiment(
-      { dataset, task },
+      { datasets: [dataset], task },
       evaluators
     );
   });
@@ -202,7 +202,7 @@ export function createEvaluateDataset({
   return async ({ dataset }) => {
     await executorClient.runExperiment(
       {
-        dataset,
+        datasets: [dataset],
         task: async ({ input }) => {
           const response = await chatClient.converse({ messages: [{ message: input.question }] });
           return { messages: response.messages, steps: response.steps };

.agents/skills/evals-write-spec/references/evaluator-patterns.md

@@ -20,7 +20,7 @@ type MyTaskOutput = TaskOutput & {
 };
 
 await executorClient.runExperiment(
-  { dataset, task },
+  { datasets: [dataset], task },
   selectEvaluators<MyExample, MyTaskOutput>([
     {
       name: 'NonEmptyDocuments',
@@ -246,7 +246,7 @@ A common pattern passes both CODE and LLM evaluators to `runExperiment`:
 
 ```ts
 await executorClient.runExperiment(
-  { dataset, task },
+  { datasets: [dataset], task },
   [
     createCriteriaEvaluator({ evaluators }),
     createToolCallsEvaluator({ evaluators }),

.buildkite/scripts/common/setup_job_env.sh

@@ -130,7 +130,7 @@ EOF
 # Set up Kibana Evals secrets
 {
   if [[ "${KBN_EVALS:-}" =~ ^(1|true)$ ]]; then
-    echo "KBN_EVALS was set - exposing evals connectors and ES export credentials"
+    echo "KBN_EVALS was set - exposing evals connectors and export credentials"
 
     KBN_EVALS_CONFIG_JSON="$(vault_get kbn-evals config | base64 -d)"
     # Validate config shape (safe; does not print secrets)
@@ -145,10 +145,6 @@ EOF
     export KBN_EVALS_CONFIG_B64
     KBN_EVALS_CONFIG_B64="$(printf '%s' "$KBN_EVALS_CONFIG_JSON" | base64)"
 
-    # Elasticsearch cluster for evaluation results export
-    export EVALUATIONS_ES_URL="$(jq -r '.evaluationsEs.url // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
-    export EVALUATIONS_ES_API_KEY="$(jq -r '.evaluationsEs.apiKey // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
-
     # Optional: separate cluster for trace-based evaluators
     export TRACING_ES_URL="$(jq -r '.tracingEs.url // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
     export TRACING_ES_API_KEY="$(jq -r '.tracingEs.apiKey // empty' <<<"$KBN_EVALS_CONFIG_JSON")"

.buildkite/scripts/steps/evals/run_suite.sh

@@ -18,10 +18,10 @@ fi
 # The value should be the platform-level `pluginId` use-case identifier.
 # `@kbn/evals` defaults this to `kbn_evals`, but you can override via KBN_EVALS_TELEMETRY_PLUGIN_ID.
 
-# Set a base run id from the Buildkite build. The evaluator fixture appends the
-# connector id to produce a unique run_id per model (e.g. bk-<build>-<connector>).
-# Correlation across models in the same build uses ci.buildkite.build_id which
-# is populated automatically from BUILDKITE_BUILD_ID in score_repository.ts.
+# Set a base build run ID from the Buildkite build. This is used as a seed for
+# generating deterministic per-task experiment IDs (not as the experiment_id itself).
+# Suite-run grouping in the UI uses metadata.ci.build_id which is populated
+# automatically from BUILDKITE_BUILD_ID in the Buildkite metadata.
 if [[ -z "${TEST_RUN_ID:-}" ]] && [[ -n "${BUILDKITE_BUILD_ID:-}" ]]; then
   export TEST_RUN_ID="bk-${BUILDKITE_BUILD_ID}"
 fi

docs/extend/plugin-list.md

@@ -153,7 +153,7 @@ mapped_pages:
 | [enterpriseSearch](https://github.com/elastic/kibana/blob/main/x-pack/solutions/search/plugins/enterprise_search/README.md) | This plugin provides Kibana user interfaces for managing the Enterprise Search solution and its products, App Search and Workplace Search. |
 | [entityManager](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/entity_manager/README.md) | This plugin provides access to observed entity data, such as information about hosts, pods, containers, services, and more. |
 | [entityStore](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/entity_store/README.md) | Central place for Entities management and logs extraction. |
-| [evals](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/evals/README.md) | The Evals plugin provides an in-Kibana UI for browsing LLM evaluation run results, per-evaluator statistics, and OpenTelemetry traces produced by the @kbn/evals evaluation framework. |
+| [evals](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/evals/README.md) | The Evals plugin provides an in-Kibana UI for browsing LLM evaluation experiment results, per-evaluator statistics, and OpenTelemetry traces produced by the @kbn/evals evaluation framework. |
 | [eventLog](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/event_log/README.md) | The event log plugin provides a persistent history of alerting and action activities. |
 | [exploratoryView](https://github.com/elastic/kibana/blob/main/x-pack/solutions/observability/plugins/exploratory_view/README.md) | A shared component for visualizing observability data types via lens embeddable. For further details. |
 | [features](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/features/README.md) | The features plugin enhance Kibana with a per-feature privilege system. |

docs/reference/configuration-reference/internationalization-settings.md

@@ -30,8 +30,40 @@ When a user sets a preferred language, it is stored in their user profile and ta
 
 {{kib}} resolves the display language using the following priority chain:
 
-1. **User profile setting** — The language selected by the user in their profile or the user menu (must be one of `i18n.locales`).
-2. **`i18n.defaultLocale` config** — The server-wide default set in `kibana.yml`.
+1. **User profile setting** — The language selected by the user in their
+   profile or the user menu (must be one of `i18n.locales`).
+2. **`KBN_LOCALE` cookie** — The most recently rendered locale on this
+   browser. {{kib}} writes this cookie on every rendered response, so it
+   tracks profile changes automatically. The cookie is the fallback used
+   on surfaces where the profile isn't available — login pages, error
+   pages, and any browsing the user does after signing out. Only used
+   when the cookie value matches a locale {{kib}} can serve.
+3. **`Accept-Language` header** {applies_to}`serverless: ga` — On
+   serverless deployments, {{kib}} consults the browser's
+   `Accept-Language` preferences when neither the profile setting nor
+   the cookie produces a match. The first weighted preference that's an
+   exact match (region included) for an entry in `i18n.locales` wins.
+   This step is skipped on traditional/self-managed deployments to keep
+   existing users' language stable across upgrades.
+4. **`i18n.defaultLocale` config** — The server-wide default set in `kibana.yml`.
+
+#### About the `KBN_LOCALE` cookie
+
+{{kib}} sets a `KBN_LOCALE` cookie on every rendered response containing
+the resolved locale id (for example, `KBN_LOCALE=ja-JP`). Attributes:
+
+- Path scoped to the {{kib}} `serverBasePath`.
+- `SameSite=Lax`, `Max-Age` of one year, and `Secure` when the response is over HTTPS.
+- `HttpOnly`. The value is a preference, not a secret, but {{kib}} does not need browser-side JavaScript to read it.
+
+Privacy posture: `KBN_LOCALE` is a strictly-necessary preference cookie.
+It does not track the user, store identity, or enable cross-site activity.
+
+To disable the cookie entirely, set `i18n.allowLocaleCookie: false` in
+`kibana.yml`. When disabled, the per-user language selection still works via
+user profiles; however, anonymous pages and pages visited after signing out
+will always fall back to `i18n.defaultLocale` (or `Accept-Language` on
+serverless deployments) rather than remembering the previously resolved locale.
 
 ## Example configurations
 
@@ -51,4 +83,7 @@ i18n.defaultLocale: "en"
 
 # 4. Legacy form — still works, logs a deprecation warning at startup:
 i18n.locale: "ja-JP"
-```
+
+# 5. Disable the KBN_LOCALE cookie:
+i18n.allowLocaleCookie: false
+```

docs/reference/configuration-reference/internationalization-settings.yml

@@ -1,6 +1,6 @@
 ---
 # This file is used to generate "i18n settings" page in the product docs
-# For the schema and an example refer to the automated settings reference: 
+# For the schema and an example refer to the automated settings reference:
 # https://github.com/elastic/docs-builder/blob/main/docs/syntax/automated_settings.md
 
 product: Kibana
@@ -39,6 +39,19 @@ groups:
           ech: ga
           self: ga
 
+      - setting: i18n.allowLocaleCookie
+        description: |
+          When `true` (the default), {{kib}} writes a `KBN_LOCALE` cookie on every
+          rendered response so the browser remembers the resolved locale across
+          page loads, anonymous pages, and post-logout browsing. Set to `false`
+          to disable the cookie.
+        datatype: boolean
+        default: "true"
+        applies_to:
+          stack: ga 9.5+
+          ech: ga
+          self: ga
+
       - setting: i18n.locale
         description: |
           Set the {{kib}} interface language.
@@ -59,4 +72,4 @@ groups:
         applies_to:
           stack: deprecated 9.5+
           ech: ga
-          self: ga
+          self: ga

packages/kbn-mock-idp-plugin/public/role_switcher.tsx

@@ -33,16 +33,16 @@ export const useAuthenticator = (reloadPage = false) => {
       body: JSON.stringify(params),
     });
 
-    if (reloadPage) {
-      const form = createForm(
-        services.http.basePath.prepend('/api/security/saml/callback'),
-        response
-      );
+    const { acsUrl, ...samlFields } = response;
+    const formAction = acsUrl ?? services.http.basePath.prepend('/api/security/saml/callback');
+
+    if (reloadPage || acsUrl) {
+      const form = createForm(formAction, samlFields);
       form.submit();
       await new Promise(() => {});
     } else {
       await services.http.post('/api/security/saml/callback', {
-        body: JSON.stringify(response),
+        body: JSON.stringify(samlFields),
         asResponse: true,
         rawResponse: true,
       });

packages/kbn-mock-idp-plugin/server/plugin.ts

@@ -201,6 +201,13 @@ export const plugin: PluginInitializer<void, void, PluginSetupDependencies> = as
             const parsed = new URL(request.body.url, 'https://localhost');
             const relayState = parsed.searchParams.get('RelayState') ?? undefined;
 
+            // Kibana-bound ACS URLs are intentionally left to the `onPreResponse` rewrite above;
+            // we only override here for external SPs (e.g. UIAM).
+            const externalAcsUrl =
+              samlRequestInfo?.acsUrl && !samlRequestInfo.acsUrl.startsWith(MOCK_IDP_SP_BASE_URL)
+                ? samlRequestInfo.acsUrl
+                : undefined;
+
             return response.ok({
               body: {
                 SAMLResponse: await createSAMLResponse({
@@ -212,9 +219,13 @@ export const plugin: PluginInitializer<void, void, PluginSetupDependencies> = as
                     ? { authnRequestId: samlRequestInfo.requestId }
                     : {}),
                   ...(samlRequestInfo?.issuer ? { spEntityId: samlRequestInfo.issuer } : {}),
+                  ...(externalAcsUrl ? { acsUrl: externalAcsUrl } : {}),
                   ...serverlessOptions,
                 }),
                 ...(relayState ? { RelayState: relayState } : {}),
+                // Echoed alongside SAMLResponse so the browser's auto-submitted form posts to UIAM
+                // instead of the default Kibana ACS endpoint (see mock_idp_page form action).
+                ...(externalAcsUrl ? { acsUrl: externalAcsUrl } : {}),
               },
             });
           } catch (err) {

packages/kbn-optimizer/limits.yml

@@ -169,7 +169,7 @@ pageLoadAssetSize:
   securitySolutionEss: 38689
   securitySolutionServerless: 52082
   serverless: 7412
-  serverlessObservability: 19300
+  serverlessObservability: 21437
   serverlessSearch: 26287
   serverlessVectordb: 7618
   serverlessWorkplaceAI: 4855