v0.81.4

🌟 Release Highlights

This release focuses on reliability, performance, and new operational capabilities — fixing silent failures across the compiler and agent harnesses, reducing wasted credits on hot paths, and adding important new tooling.

✨ What's New

• --org flag for upgrade command (#41335) — The upgrade command now supports --org and --repos flags, matching the org-wide mode already available in update. Bulk-preview or open upgrade PRs across an entire organization with a single command.

• Daily YAML Lint Fixer workflow (#41574) — A new agentic workflow automatically fixes yamllint violations in generated *.lock.yml files, keeping CI lint checks clean without manual intervention.

• AWF Firewall startup failure detection (#41472) — Firewall proxy startup failures (e.g., DNS not yet resolving at probe time) are now detected and surfaced in the agent failure issue — making previously silent infra failures immediately actionable.

• Spec-driven engine.env allowlist (#41465) — The engine environment variable allowlist is now derived from GetSupportedEnvVarKeys rather than a fragile runtime heuristic, enabling strict: false to be safely removed from smoke workflows.

• Copilot engine launched from ${GITHUB_WORKSPACE} (#41459) — The Copilot engine now starts from the workspace root, enabling APM skill discovery for context-aware agent behaviour.

🐛 Bug Fixes & Improvements

• Silent YAML parse errors fixed (#41577) — Five yaml.Unmarshal call sites in workflow_builder.go were silently discarding errors, producing empty step lists on malformed YAML with no diagnostic. All errors now propagate correctly.

• Copilot SDK hang bounded by idle watchdog (#41572) — After an agent's final tool result, sendAndWait could hang indefinitely until the step timeout killed the runner. A post-completion idle watchdog now bounds this wait, preventing wasted runner minutes.

• Codex harness no longer drains tokens on rate-limit reconnects (#41385) — When Codex hit a TPM rate limit and exhausted reconnect retries, the harness kept retrying unnecessarily. It now recognises exhausted-reconnect exits and stops, preserving credits.

• Claude harness stops retrying on max_runs_exceeded (#41361) — Fresh-run fallbacks no longer burn the full quota when a session has already hit its 20-invocation limit.

• Issue Monster false-positive 429 detection eliminated (#41471) — Rate-limit false positives no longer trigger spurious failure handling.

• assign_to_agent no longer posts error comments on PRs (#41475) — Error comments are now only posted to issues, matching expected behaviour.

• Daily schedule runs restored (#41362) — Daily schedule runs broken since June 5 are now fixed.

• workflow_call permissions use union of caller + worker (#41387) — Imported workflow_call permissions in generated call jobs are now correctly annotated.

⚡ Performance

• YAML generation is faster (#41333) — Duplicate run-script scans in the skip-validation fast path collapsed to a single pass, restoring compilation performance.

• Design Decision Gate costs reduced (#41332) — Now defaults to Sonnet instead of Opus and skips issue lookups on no-op paths, meaningfully reducing AI credit consumption per run.

🔒 Security

• Safe-output detection hardened (#41547) — Detection stays in warn mode on parser/agent failures, ensuring non-reviewable safe outputs are blocked rather than passed through silently.

• Pi threat-detection model normalisation (#41545) — Pi threat-detection models are now normalised before Copilot fallback, preventing misclassification due to model name variance.

🔧 Internal

• Bumped gh-aw-firewall to v0.27.11 and regenerated pinned workflow artifacts (#41555)
• Bumped Codex 0.142.1 and Copilot SDK 1.0.4 (#41430)
• Extracted shared org-wide runner for update and upgrade commands (#41553)

Generated by 🚀 Release · 44.1 AIC · ⊞ 8.3K

---

What's Changed

• [community] Update community contributions in README by @github-actions[bot] in #41359
• Lower Design Decision Gate runtime cost with Sonnet default and conditional issue lookups by @pelikhan with @Copilot in #41332
• Add GitHub lockdown guard-policy warning and sync security specs by @pelikhan with @Copilot in #41331
• Reduce YAMLGeneration time by collapsing duplicate run-script scans by @pelikhan with @Copilot in #41333
• fix(go-logger): restore daily schedule runs broken since June 5 by @pelikhan with @Copilot in #41362
• feat: add --org to upgrade command by @pelikhan with @Copilot in #41335
• Surface assign-to-agent auth/availability failures in agent failure issues/comments by @pelikhan with @Copilot in #41336
• chore: set sandbox.agent.sudo: false on 30% of agentic workflows by @pelikhan with @Copilot in #41380
• [ubuntu-image] research: update Ubuntu runner image analysis for 20260622.220.1 by @github-actions[bot] in #41373
• [code-scanning-fix] Fix workflow-graphql-static-concat: extract GraphQL query to named constant by @github-actions[bot] in #41357
• fix(manualmutexunlock): distinguish struct instances sharing a mutex field by @pelikhan with @Copilot in #41383
• Add nolint parity to non-enforced context-family linters by @pelikhan with @Copilot in #41382
• Fix stale frontmatter hash in design-decision-gate.lock.yml by @pelikhan with @Copilot in #41390
• Enable Copilot assignment permissions in Issue Monster workflow by @pelikhan with @Copilot in #41389
• [jsweep] Clean upload_assets.cjs by @github-actions[bot] in #41371
• fix: improve agent assignment failure issue reports by @pelikhan with @Copilot in #41392
• [spec-extractor] Update package specifications for tty, types, typeutil, workflow by @github-actions[bot] in #41414
• fix: stop codex harness retry loop draining tokens on exhausted rate-limit reconnects by @pelikhan with @Copilot in #41385
• refactor: consolidate triplicate merge helpers and add sliceutil.SortedKeys by @pelikhan with @Copilot in #41388
• fix: use union of caller + worker permissions for call-workflow jobs by @pelikhan with @Copilot in #41387
• fix: revert sandbox.agent.sudo to true in glossary-maintainer workflow by @pelikhan with @Copilot in #41426
• Handle known Windows ConPTY runner failure in daily CLI integration by @pelikhan with @Copilot in #41428
• fix(firewall): skip non-Squid diagnostic lines in generate_usage_activity_summary by @pelikhan with @Copilot in #41429
• chore: bump Codex 0.142.1, Copilot SDK 1.0.4 by @pelikhan with @Copilot in #41430
• Send GraphQL-Features header for issue intent mutations when issue_intents runtime feature is enabled by @pelikhan with @Copilot in #41425
• Issue Monster: eliminate false-positive 429 rate-limit detection by @pelikhan with @Copilot in #41471
• Standardize CLI help section order and GHE note wording by @pelikhan with @Copilot in #41461
• feat: spec-driven engine.env allowlist via GetSupportedEnvVarKeys; remove strict: false from smoke workflows by @pelikhan with @Copilot in #41465
• Annotate imported workflow_call permissions in generated call jobs by @pelikhan with @Copilot in #41464
• fix: prevent assign_to_agent from posting error comments on PRs by @pelikhan with @Copilot in #41475
• Reduce sandbox.agent.sudo: false usage to policy target across agentic workflows by @pelikhan with @Copilot in #41463
• Update existing MCP configs with required gh-aw server fields by @pelikhan with @Copilot in #41462
• feat: detect AWF firewall startup failures and surface them in the agent failure issue by @pelikhan with @Copilot in #41472
• Render runtime features only when configured; move output behind details disclosure by @pelikhan with @Copilot in #41358
• Align safe-outputs bundle pre-check with post-apply file detection by @pelikhan with @Copilot in #41457
• Fix Daily Cache Strategy Analyzer codex model variant to avoid model-not-found failures by @pelikhan with @Copilot in #41541
• Simplify assign-to-agent flow to issue assignee REST APIs with canonical bot login resolution by @pelikhan with @Copilot in #41524
• update org resilience by @pelikhan in #41513
• Fix empty firewall allowlist in Codex external detection job (gh-aw-detection) by @pelikhan with @Copilot in #41525
• Normalize Pi threat-detection models before Copilot fallback by @pelikhan with @Copilot in #41545
• [caveman] Optimize instruction verbosity — cli-commands, campaign (2026-06-25) by @github-actions[bot] in #41544
• Keep detection in warn mode on parser/agent failures so non-reviewable safe outputs are blocked by @pelikhan with @Copilot in #41547
• Fix docs homepage slide preview when the bundled PDF is an LFS pointer by @pelikhan with @Copilot in #41540
• copilot engine: launch from ${GITHUB_WORKSPACE} to enable APM skill discovery by @pelikhan with @Copilot in #41459
• Bump default gh-aw-firewall to v0.27.11 and regenerate pinned workflow artifacts by @lpcox with @Copilot in #41555
• refactor: extract shared org-wide runner for update and upgrade commands by @pelikhan with @Copilot in #41553
• feat: add daily-yamllint-fixer agentic workflow by @pelikhan with @Copilot in #41574
• fix: resolve InvalidPDFException and add mobile nav toggle test by @pelikhan with @Copilot in #41575
• console: swap supplementary-plane emoji for lightweight Unicode symbols by @pelikhan with @Copilot in #41578
• fix(copilot-sdk): post-completion idle watchdog to bound SDK hang after final tool result by @pelikhan with @Copilot in #41572
• fix: propagate yaml.Unmarshal errors in workflow_builder.go (5 silent sites) by @pelikhan with @Copilot in #41577

Full Changelog: v0.81.3...v0.81.4