v0.86.3

🌟 Release Highlights

This release focuses on hardening AWF sandbox runtimes, tightening security around dynamic exec/CLI calls, and trimming legacy engine support, alongside a steady stream of internal reliability and code-quality improvements.

⚠️ Breaking Changes

• Pydantic engine removed — the Pydantic AI integration, its smoke workflow, and related docs/registry entries have been removed (#52843). Workflows using engine: pydantic should migrate to a supported engine.
• Firecracker support removed (#52774) — superseded by the Cloud Hypervisor runtime work below.

✨ What's New

• Cloud Hypervisor runtime (preview) — gh-aw now supports sandbox.agent.runtime: cloud-hypervisor as a preview microVM runtime alongside docker-sbx/gvisor, including release-asset digest verification and scoped /dev/kvm access (#52119, #52588).
• AWF firewall bumped to v0.28.1, pulling in the Cloud Hypervisor prerequisites and refreshed container digests (#52607).
• More resilient MCP gateway — a single unreachable non-critical MCP server no longer aborts the whole gateway startup (#52075), MCP log queries return partial results instead of timing out (#52412), and engine-filtered log queries get a longer timeout (#52063).
• New Agent Job Health Monitor workflow to track fleet-wide agent-job failure rates (#52108).

🐛 Bug Fixes & Improvements

• Hardened exec.Command/child-process call sites against shell-flag and CWE-78/89 style injection across pkg/cli and linter rules (#52401, #52909, #52905, #52707).
• Removed vulnerable container digest pins for the AWF api-proxy and squid images (#52900, #52829).
• Fixed the Linter Miner crashing on model: inherited inline sub-agents (#52133).
• Fixed Claude Code CLI abnormal exits and cold-start connection refusals via improved harness retry classification (#52837, #52198).
• Documented license policy exceptions for Debian/Alpine base OS packages in container images (#52912, #52904).

📚 Documentation

• Clarified gh aw init docs for Copilot-only agent/MCP artifacts (#52581).
• Unbloated the troubleshooting/common-issues guide and refreshed the glossary (#52189).
• Documented harness watchdog and retry runtime settings (#52511).> Generated by 🚀 Release · auto · 25.3 AIC · ⊞ 11.6K

---

What's Changed

• [purelock] Lock down extractExperimentVariantStubs, isValidToolName, validateObjectInput with pure-function test suites by @github-actions[bot] in #52048
• Allow repository_dispatch user rate limits by @pelikhan with @Copilot in #52101
• Report terminal Claude failures after recovered continue retries by @pelikhan with @Copilot in #52057
• Add Agent Job Health Monitor to own fleet-wide agent-job failure rate by @pelikhan with @Copilot in #52108
• [slides] Fix layout overflow on security slides by @github-actions[bot] in #52114
• Compile unified AWF enclaves through mcpg by @lpcox in #50920
• Address Persona Explorer findings: trigger ambiguity, digest grouping, compliance example by @pelikhan with @Copilot in #52121
• Trim unused Matt Pocock skills from skills-reviewer workflow by @pelikhan with @Copilot in #52122
• Consolidate JobStep/JobStepData identical structs in pkg/cli by @pelikhan with @Copilot in #52120
• Allow jq in Breaking Change Checker by @pelikhan with @Copilot in #52128
• Add preview Cloud Hypervisor runtime support for sandbox.agent.runtime with docker-sbx parity by @lpcox with @Copilot in #52119
• Fix Linter Miner crash: unsupported model: inherited on inline sub-agents by @pelikhan with @Copilot in #52133
• Extend MCP logs timeout for engine-filtered queries by @pelikhan with @Copilot in #52063
• Add formal RS-05a checkout gate coverage by @pelikhan with @Copilot in #52103
• Split pkg/workflow/compiler_types.go by lifecycle: options, mutators, types by @pelikhan with @Copilot in #52109
• Tighten SPDD compliance specs and fixtures by @pelikhan with @Copilot in #52111
• Degrade unreachable non-critical MCP servers instead of aborting gateway startup by @pelikhan with @Copilot in #52075
• Improve test quality in compiler_file_size_test.go by @pelikhan with @Copilot in #52129
• Fix error message compliance in runs_on_validation, frontmatter_extraction_metadata, reactions, call_workflow_validation, and ambient_folders by @pelikhan with @Copilot in #52177
• Fix error message compliance in 5 pkg/workflow files by @pelikhan with @Copilot in #52180
• Fix error message compliance: pre-activation jobs, GitHub tools validation, evals config, spec, and package manifest files by @pelikhan with @Copilot in #52179
• Raise error-message compliance for sandbox and workflow run validation paths by @pelikhan with @Copilot in #52176
• [docs] docs: unbloat troubleshooting common issues by @github-actions[bot] in #52189
• Give the four log-entry structs a shared LogEntry interface by @pelikhan with @Copilot in #52107
• Deduplicate declarative constraint builders in tool_description_enhancer.go by @pelikhan with @Copilot in #52157
• Deduplicate safe-output parser wrapper boilerplate with parseConfigScaffoldWithPostProcess by @pelikhan with @Copilot in #52158
• [model-inventory] Add missing MAI-Code model entry and correct Copilot cache-read pricing by @pelikhan with @Copilot in #52191
• Fix error message compliance in 5 low-scoring pkg/workflow files by @pelikhan with @Copilot in #52178
• Raise error-message compliance for workflow validation batch (5 files) by @pelikhan with @Copilot in #52174
• Base full-mode patch/bundle on GITHUB_SHA when running from a non-default branch by @pelikhan with @Copilot in #52164
• Fix package README error lint failure by @pelikhan with @Copilot in #52196
• Add direct Ollama inference preflight and failure diagnostics by @pelikhan with @Copilot in #52197
• Fix PR context renderer test assertion by @pelikhan with @Copilot in #52201
• Retry cold-start Claude connection refusals as fresh runs by @pelikhan with @Copilot in #52198
• [docs] docs: trim repetitive sections in cost management reference by @github-actions[bot] in #52393
• docs: note that non-default labels must exist before running the triage workflow by @pelikhan with @Copilot in #52376
• Route PR code-quality reviews through the Copilot gateway by @pelikhan with @Copilot in #52377
• [instructions] Sync instruction files with release v0.86.2 by @github-actions[bot] in #52262
• [eslint-miner] eslint-factory: add require-sync-exec-timeout rule by @github-actions[bot] in #52265
• [spec-extractor] Update package specifications: pkg/cli README type coverage by @github-actions[bot] in #52271
• [docs] Update glossary - daily scan by @github-actions[bot] in #52274
• [purelock] Lock down parseSamplesValue, ErrorSeverity.Heading, ErrorSeverity.Icon with pure-function test suites by @github-actions[bot] in #52295
• Reduce pkg/workflow largefunc backlog via frontmatter parser helper extraction by @pelikhan with @Copilot in #52219
• Use static GraphQL query constants in project_command.go by @pelikhan with @Copilot in #52378
• Use ctxutil for nil context fallbacks by @pelikhan with @Copilot in #52414
• Normalize report formatting guidance for daily workflows by @pelikhan with @Copilot in #52413
• Add custom validation hooks for repo and cache memory by @pelikhan with @Copilot in #52053
• Close SPDD daily spec-review action items for security-architecture and access-control specs by @pelikhan with @Copilot in #52531
• Add regression tests preventing committed tool binaries by @pelikhan with @Copilot in #52540
• Fail closed on unrecognized autonomy/write-scope values when seeding compiled policy by @pelikhan with @Copilot in #52539
• [eslint-miner] eslint-miner: add require-nan-check-after-split-index-parse rule by @github-actions[bot] in #52473
• Document harness watchdog and retry runtime settings by @dsyme with @Copilot in #52511
• Guard git command arguments against flag injection (Sighthound findings) by @pelikhan with @Copilot in #52401
• [test-parallel] Add t.Parallel() to safe subtests in TestAnalyzeAccessLogsDirectory by @github-actions[bot] in #52250
• Fix coverage.findProfile path matching so perf-linter coverage gating actually applies by @pelikhan with @Copilot in #52566
• Migrate inline report-formatting guidance to the shared/reporting.md import by @pelikhan with @Copilot in #52542
• Enforce Sentrux architecture constraints by @pelikhan with @Copilot in #52573
• Extract shared smoke-test brevity prompt and import across 21 smoke workflows by @pelikhan with @Copilot in #52565
• Refactor nested YAML value extraction by @pelikhan with @Copilot in #52212
• Complete Cloud Hypervisor runtime compilation by @lpcox in #52588
• Clarify gh aw init docs for Copilot-only agent/MCP artifacts by @pelikhan with @Copilot in #52581
• Track container CVE burn-down Critical-first with a consolidated parent issue by @pelikhan with @Copilot in #52580
• Extract shared engine harness retry runner by @pelikhan with @Copilot in #52381
• Anchor Failure Investigator log capture to error markers by @pelikhan with @Copilot in #52620
• Reduce pkg/cli package manifest largefunc backlog by @pelikhan with @Copilot in #52218
• Return partial MCP logs results before gateway timeout by @pelikhan with @Copilot in #52412
• Remove shadowed GitHubToken field re-declarations in project safe-output configs by @pelikhan with @Copilot in #52543
• Restore frontmatter schema consistency coverage by @pelikhan with @Copilot in #52577
• Deduplicate YAML scalar matcher logic in schema suggestions parser by @pelikhan with @Copilot in #52592
• deps: bump safe patch updates for x/crypto, x/mod, and lipgloss by @pelikhan with @Copilot in #52669
• [test-parallel] Add t.Parallel() to safe Go tests in agentdrain and cli packages by @github-actions[bot] in #52660
• Bump gh-aw-firewall to v0.28.1 by @lpcox in #52607
• Remove Firecracker support by @lpcox in #52774
• Rename pkg/fileutil private helpers for discoverability by @pelikhan with @Copilot in #52582
• [log] Add debug logging to files with minimal or no existing coverage by @github-actions[bot] in #52624
• [instructions] Sync instruction files with release v0.86.2 by @github-actions[bot] in #52677
• Update SPDD specification maintenance artifacts by @pelikhan with @Copilot in #52756
• Detect chained string methods on interpolated commands in exec/child_process rules by @pelikhan with @Copilot in #52707
• Normalize report formatting across 34 non-compliant workflows by @pelikhan with @Copilot in #52699
• [docs] Update glossary - daily scan by @github-actions[bot] in #52692
• [spec-extractor] Re-verify package specifications for parser, repoutil, semverutil, sliceutil by @github-actions[bot] in #52689
• [eslint-miner] eslint-factory: add no-empty-catch-block rule by @github-actions[bot] in #52681
• Fix Copilot SDK API proxy routing in docker-sbx by @pelikhan with @Copilot in #52210
• Refactor duplicate console format helpers and unify integer tag dispatch; add MCPServerID validity API by @pelikhan with @Copilot in #52220
• [dead-code] chore: remove dead functions — 5 functions removed by @github-actions[bot] in #52508
• Consolidate CLI not-found error classification by @pelikhan with @Copilot in #52621
• [community] Update community contributions in README by @github-actions[bot] in #52812
• Remove vulnerable gh-aw-firewall/squid:0.27.44 digest pin from shared container pin catalogs by @pelikhan with @Copilot in #52829
• Embed AggregatedSummaryBase in MCPFailureSummary by @pelikhan with @Copilot in #52670
• Show outcomes output directory default in help by @pelikhan with @Copilot in #52830
• [purelock] Lock down extractAmbientFolders, secretRequirementsFromAuthDefinition, firstForbiddenCharInModelToken with pure-function test su
  [Content truncated due to length] by @github-actions[bot] in #52719
• Add spec_test.go for ctxutil package by @pelikhan with @Copilot in #52729
• Detect sandbox shell-expansion guard rejections; steer agents toward jq -Rs for multi-line safeoutputs bodies by @pelikhan with @Copilot in #52578
• Fix Go Logger safe-output accounting and failure diagnostics by @pelikhan with @Copilot in #52661
• Add gh-aw-detection: true to 8 audit/report/detector workflows by @pelikhan with @Copilot in #52662
• Improve test quality for activation checkout tests with testify by @pelikhan with @Copilot in #52698
• Fix module-level mutable state in create_agent_session.cjs handler by @pelikhan with @Copilot in #52696
• [actions] Update GitHub Actions versions - 2026-08-14 by @github-actions[bot] in #52667
• Stage behavior-defined engine CLIs into the docker-sbx visible path by @pelikhan with @Copilot in #52576
• Add heuristic fallback for skill selection when pr-triage sub-agent fails by @pelikhan with @Copilot in #52708
• Harden assign_to_agent concurrency: isolate handler state and serialize MCP stdin dispatch by @pelikhan with @Copilot in #52034
• Remove Pydantic engine and smoke workflow by @pelikhan with @Copilot in #52843
• Normalize report formatting in daily-* workflows: h3+ headers and <details> progressive disclosure by @pelikhan with @Copilot in #52838
• [instructions] Sync instruction files with release v0.86.2 by @github-actions[bot] in #52872
• [test-parallel] Add t.Parallel() to safe cross-run audit and agent example tests by @github-actions[bot] in #52860
• Make threat-detect binary install step continue-on-error in warn mode by @pelikhan with @Copilot in #52400
• Fix Design Decision Gate false failures caused by the LLM invocation cap by @pelikhan with @Copilot in #52836
• [docs] Update editor preview screenshots - 2026-08-15 by @github-actions[bot] in #52869
• Raise max-turn-cache-misses for Smoke Crush to avoid hard-fail on transient proxy cache misses by @pelikhan with @Copilot in #52892
• Refactor objective mapping source-of-truth: remove dead label/value constants and align docs/specs to runtime defaults by @pelikhan with @Copilot in #52831
• Cut AI Moderator token usage by pre-fetching capped moderation context by @pelikhan with @Copilot in #52891
• [eslint-miner] eslint-factory: add require-lastindex-reset-before-global-exec-loop rule by @github-actions[bot] in #52875
• Reduce EnforceSafeUpdate parameter count with options struct by @pelikhan with @Copilot in #52614
• Enable per-PR continuity memory writes in PR Code Quality Reviewer by @pelikhan with @Copilot in #52759
• Bound go-logger manifest.json size to prevent oversized-file timeout loop by @pelikhan with @Copilot in #52896
• [actions] Update GitHub Actions versions - 2026-08-15 by @github-actions[bot] in #52864
• Harden cloud-hypervisor privileged runtime path and add explicit human-review warning by @pelikhan with @Copilot in #52757
• [docs] Consolidate developer specifications into instructions file (2026-08-15) by @github-actions[bot] in #52897
• [avenger] Fix prettier formatting in eslint-factory rule by @github-actions[bot] in #52899
• [purelock] Lock down firstForbiddenCharInParamValue, validateGCPWIFEngineAuth, hasPullRequestTargetTrigger with pure-function test suites by @github-actions[bot] in #52890
• Bump CLI, MCP SDK, and scanner image defaults by @pelikhan with @Copilot in #52855
• Fix Crush harness sending chat-completions requests to unresolvable api-proxy host by @pelikhan with @Copilot in #52895
• Remove vulnerable AWF api-proxy 0.27.44 container pin by @pelikhan with @Copilot in #52900
• Fix Claude Code CLI abnormal exit (code 159): classify fatal-signal crashes in harness retry logic by @pelikhan with @Copilot in #52837
• Gracefully noop Test Quality Sentinel on prefetch failure by @pelikhan with @Copilot in #52902
• Accept Alpine base OS packages as a documented grant license policy exception by @pelikhan with @Copilot in #52904
• [avenger] Fix stale prompt assertion in cache memory integration test by @github-actions[bot] in #52910
• Strengthen getParsedSchemaDoc return type from any to map[string]any by @pelikhan with @Copilot in #52906
• Fix gh-aw-node ip-address patch verification and clear container license findings by @pelikhan with @Copilot in #52908
• Treat re-assigned options bindings as possibly shell-enabled in no-child-process-interpolated-command by @pelikhan with @Copilot in #52909
• Add license policy exceptions for github-mcp-server Debian base OS packages by @pelikhan with @Copilot in #52912
• Update golang.org/x/tools to v0.49.0 by @pelikhan with @Copilot in #52913
• Harden dynamic exec arguments in experiments/dependabot paths by @pelikhan with @Copilot in #52905
• Split pkg/cli/update_actions.go into focused modules by @pelikhan with @Copilot in #52901
• test: enforce compiler threat compliance catalog bijection by @pelikhan with @Copilot in #52915
• Annotate reviewed RGS-012 outbound HTTP steps in workflow sources by @pelikhan with @Copilot in #52917
• Bump grafana MCP container image to 1.1.0-alpine and refresh pinned digest by @pelikhan with @Copilot in #52925

Full Changelog: v0.86.2...v0.86.3