v2.6.0

Added

• Repository-local release skill: Added a reusable GitHub Copilot release skill that discovers and reconciles authoritative version evidence, prepares SemVer-aligned release metadata and sanitized notes, validates branch and pull-request targets, and documents rollback paths while requiring explicit human approval before publishing tags, releases, packages, images, deployments, or Azure changes.
• Opt-in hosted-agent cross-version continuity (HOSTED_CONTINUITY_ENABLED, default false): Added an alternative, BFF-owned continuity model for the CHAT_BACKEND=hosted_agent runtime so multi-turn conversations survive hosted-runtime version upgrades. When enabled, this UI — not the hosted runtime — becomes the exclusive owner of the Foundry managed Conversation used for continuity: it creates, reads, appends to, and deletes the managed conversation through the standard Conversations REST surface, while the hosted runtime itself stays fully stateless and history-blind (it never receives a conversation_id or previous_response_id and needs zero Conversations RBAC). Every turn acquires a one-in-flight lock per conversation, reads ordered history from the system-of-record, applies an explicit bounded-history policy (drop-oldest by item count then by an estimated token budget, never dropping the single most recent item), and appends the completed turn back fail-closed. While the feature flag is false (the default for all existing deployments), none of this new code path runs and current hosted-agent behavior is unchanged.
• Delegated, platform-enforced owner binding as the preferred/default continuity model (Azure/GPT-RAG#591, "OQ-OWN"): HOSTED_CONVERSATION_OWNER_BINDING now defaults to delegated once continuity is enabled. The middle tier asserts a trusted x-ms-user-identity header (derived only from the caller's validated Entra oid) so the platform itself enforces per-user Conversation ownership; delegated mode fails closed at startup unless both HOSTED_CONVERSATION_OWNER_BINDING_VALIDATED=true and HOSTED_AGENT_PROTOCOL_VERSION >= 2.0.0 are explicitly set. capability mode remains a fully supported, explicit disabled fallback.
• Panel user-facing conversation history/feedback/deletion surfaces (issue Azure/GPT-RAG#611, ADR-0004): Added the gpt-rag-ui side of the optional administrative panel's user-facing contract — GET /panel/conversations, GET /panel/conversations/{id}/messages, POST/GET /panel/conversations/{id}/feedback, and owner-initiated DELETE /panel/conversations/{id}. Every endpoint is mounted unconditionally so a disabled deployment answers a genuine 503 (never a bare 404) until DEPLOY_ADMINISTRATIVE_PANEL, PANEL_HISTORY_ENABLED, and hosted-agent continuity are all active; every read/feedback/delete is preceded by a Cosmos-only owner-index check before the managed-Conversations store is ever touched, and a non-owner or missing conversation returns an identical opaque 404. New panel-only Cosmos containers carry metadata only (identifiers, titles, timestamps, feedback) — never message bodies or document/citation content. All new settings default to fully inert/disabled.

Changed

• Microsoft Foundry hosted/no-panel is now the default chat runtime for fresh deployments: When CHAT_BACKEND is absent or blank, the UI now selects hosted_agent and validates its explicit base URL, data-plane scope, finite timeout, signed-in user token path, and OBO confidential-client credentials without falling back to the Container Apps orchestrator or a managed identity. CHAT_BACKEND=orchestrator remains an explicit supported fallback. Existing deployments retain classic behavior only through the umbrella deployment's sticky Azure App Configuration selection.

Security

• Rejected client-presented hosted-continuity conversation handles now fail closed instead of silently starting a new conversation (ADR-0003): Previously, any rejection of a client-presented conversation reference (cross-user id, forged/stolen/guessed id, expired/retired-key capability, or malformed reference) was treated identically as "start a fresh managed conversation instead", producing a success-shaped response for what may be an attempted IDOR/BOLA probe against another user's conversation and letting "did I get a fresh conversation?" double as an existence oracle. The coordinator now distinguishes a genuinely absent handle (a legitimate new chat) from a presented handle that fails validation for any reason — the latter now raises a single opaque ConversationNotFoundError: no conversation is created, the hosted agent is never invoked, and nothing is appended for that turn. Generic transport/5xx failures are unaffected and continue to surface as explicit dependency/persistence errors.

Compatibility

All new capabilities in this release are opt-in and default to inert/disabled (HOSTED_CONTINUITY_ENABLED=false, DEPLOY_ADMINISTRATIVE_PANEL=false, PANEL_HISTORY_ENABLED=false). The classic orchestrator backend and the existing hosted-agent stateless path are unchanged for deployments that do not opt in. The security fix (fail-closed conversation-handle validation) only changes behavior on a rejected client-presented handle, which previously silently masked as a fresh conversation; a legitimate new chat with no presented handle is unaffected.

Validation

• 405 Python 3.12 unit tests passed locally and in release PR CI (python -m unittest discover -s tests -p "test_*.py").
• Agentic engineering asset validation passed (python .github/scripts/validate-agentic-assets.py — 3 agents, 5 skills, scoped instructions).
• Verified develop HEAD contains merge commits 1588286, 4130237, b85f86d, ee3b53b (PRs #96, #97, #98, #99) as ancestors before branching the release.
• Release branch, VERSION, changelog heading, tag, and release title are synchronized at 2.6.0 / v2.6.0.

No Azure resources were changed or deployed. Live hosted-agent continuity, panel, identity, consent, RBAC, and multi-user authorization validation remain deployment gates for operators who opt in.