v0.84.0

🌟 Release Highlights

This release promotes gh aw forecast to stable, adds new footer template variables for cost/detection reporting, introduces a Rig-based repository intelligence workflow, and includes numerous reliability fixes across the safe-outputs and MCP layers.

✨ What's New

• gh aw forecast is no longer experimental — the command drops its [EXPERIMENTAL] label in favor of a permanent accuracy disclosure, and the underlying spec is promoted to a stable v1.0.0 draft. (#48911)
• Richer footer template variables — custom messages.footer templates can now access individual cost/detection components ({ai_model}, {ai_model_short}, {ai_credits_unit}, {detection_conclusion}, {detection_reason}, and per-component AI credit breakdowns) instead of only the pre-formatted suffix string. See Footers reference and Safe Outputs reference. (#48946)
• New daily repository intelligence workflow — a shared Graft MCP wrapper plus a scheduled workflow that turns the last 24 hours of repository activity into codebase-aware findings (changed subsystems, blast radius, hotspots) instead of raw change logs. (#48881)
• Rig-based custom harness for ambient context optimization — the token-shrinking workflow now generates opportunities via a Rig custom harness with a strict JSON output contract, reducing prompt bloat. (#48885)
• Progressive disclosure for skill install summaries — the frontmatter skills install section of the job step summary is now collapsible, matching other summary sections. (#48905)

🐛 Bug Fixes & Improvements

• Fixed unbounded pagination in check_rate_limit so runs stop paginating once a threshold is exceeded, preventing excessive API usage. (#48972)
• Threat detection engine failures now surface with a [!WARNING] banner instead of [!CAUTION] for clearer severity signaling. (#48940)
• Fixed list_workflows/list_label MCP scripts where a per_page → perPage rename had silently broken pagination limits. (#48942)
• push_to_pull_request_branch now correctly resolves side-repo checkout/branch when origin/HEAD is unset. (#48786)
• Branch updates that hit a workflows-scope 403 are now treated as non-fatal, with a token fallback added for add_comment. (#48900)
• Fixed tool denial failures and added an alpine:latest container pin in the daily agent-of-the-day blog writer workflow. (#48933, #48947)
• Removed unnecessary contents: read permission from safe-output handlers, tightening least-privilege defaults. (#48913)

📚 Documentation

• Documented a Claude Code guided-authoring workaround for agentic-workflows create. (#48957)
• Added workshop links to key user-journey documentation pages. (#48914)
• Documented jq file injection technique for safe-output body fields. (#48909)
• Fixed the default output path for the audit command in the CLI reference. (#48908)
• Updated a stale on.command: reference to on.slash-command: in workflow validation docs. (#48916)

🔧 Internal

• Upgraded the MCP Go SDK to v1.7.0 and decoupled mcp inspect output from deprecated root types. (#48851)
• Migrated tools.go to Go 1.24 tool directives and removed dead gosec config. (#48830)
• Added fixture-level formal compliance tests for the Monte Carlo forecast engine and expanded semver_precise_test.go coverage with testify. (#48936, #48960)
• Removed 4 dead functions repository-wide via automated dead-code scan. (#48917)

Generated by 🚀 Release · aut00 · 21.8 AIC · ⊞ 11K

---

What's Changed

• Suppress no-op Workflow Health Dashboard issues by @pelikhan with @Copilot in #48831
• Improve forecast command output by @pelikhan in #48839
• [spec-extractor] docs: update pkg/cli specification for gh aw doctor command by @github-actions[bot] in #48843
• chore(deps): bump charmbracelet/x/exp/golden to v0.0.0-20260727090823-41c9e6be3365 by @pelikhan with @Copilot in #48852
• [docs] Update glossary - daily scan by @github-actions[bot] in #48848
• Migrate tools.go to Go 1.24 tool directives; remove dead gosec config from .golangci.yml by @pelikhan with @Copilot in #48830
• Update Copilot default model fallback to "auto" by @pelikhan with @Copilot in #48847
• Add shared Graft wrapper and daily repository intelligence workflow by @pelikhan with @Copilot in #48881
• Add Rig-based custom harness flow to ambient context optimizer workflow by @pelikhan with @Copilot in #48885
• docs: hint at jq file injection for safe-output body fields by @pelikhan with @Copilot in #48909
• docs: fix audit command default output path in CLI reference by @pelikhan with @Copilot in #48908
• Remove fable from large model alias by @pelikhan with @Copilot in #48915
• docs: add workshop links to key user-journey pages by @pelikhan with @Copilot in #48914
• fix: treat workflows-scope 403 on branch update as non-fatal; add token fallback for add_comment by @pelikhan with @Copilot in #48900
• [dead-code] chore: remove dead functions — 4 functions removed by @github-actions[bot] in #48917
• feat: wrap skill install step summary in progressive disclosure details block by @pelikhan with @Copilot in #48905
• Remove experimental state from forecast command and simplify output by @pelikhan in #48911
• Add fixture-level formal compliance tests for Monte Carlo forecast engine (FC-P3/P4/P6/P8/P9/P10) by @pelikhan with @Copilot in #48936
• fix: update stale on.command: reference to on.slash-command: in check_command_position by @pelikhan with @Copilot in #48916
• fix: resolve tool denial failures in daily-agent-of-the-day-blog-writer by @pelikhan with @Copilot in #48933
• fix: use [!WARNING] banner for threat detection engine failures instead of [!CAUTION] by @pelikhan with @Copilot in #48940
• Fix list_workflows/list_label mcp-scripts: rename per_page → perPage and fix silently ignored pagination limit by @pelikhan with @Copilot in #48942
• runtime: resolve side-repo checkout/branch correctly for push_to_pull_request_branch when origin/HEAD is unset by @pelikhan with @Copilot in #48786
• fix: add alpine:latest container pin and recompile daily-agent-of-the-day-blog-writer by @pelikhan with @Copilot in #48947
• Remove unnecessary contents: read from safe-output handlers by @pelikhan with @Copilot in #48913
• feat(messages): expose individual AI cost and detection variables in footer templates by @pelikhan with @Copilot in #48946
• Upgrade MCP Go SDK to v1.7.0 and decouple inspect output from deprecated root types by @pelikhan with @Copilot in #48851
• panicinlibrarycode: recognize sync.OnceValue/OnceFunc panic exemptions by @pelikhan with @Copilot in #48956
• Add go network identifier to experiments and repository-quality-improver workflows by @pelikhan with @Copilot in #48962
• docs: document Claude Code guided-authoring workaround for agentic-workflows create by @pelikhan with @Copilot in #48957
• test(semver): upgrade semver_precise_test.go to testify + expand coverage by @pelikhan with @Copilot in #48960

Full Changelog: v0.83.5...v0.84.0