v0.87.10

🌟 Release Highlights

This release focuses on scheduling controls, trajectory-based agent evaluation, and hardened MCP Gateway/validation behavior.

✨ What's New

• on.cooldown workflow gating (#56998) lets workflows enforce a minimum interval between runs, reducing noisy or redundant triggers.
• Typed on.stop-after field (#56983) now supports GitHub Actions expressions, giving finer control over when scheduled/triggered workflows should stop running.
• Trajectory graders expanded with new implementations for policy-near-miss, exploitation-error, exploration-error, lempel-ziv-trajectory-complexity, skill-constraint-coverage, and tool-output-consumption-rate (#56996, #57152, #57087, #56972, #57055, #57252), plus OpenTelemetry span reporting for grader and eval results (#57015, #57166).
• MCP Gateway bumped to v0.4.14 (#57188) and its compiler output migrated to agentId (#56990), with mutually exclusive agentId/agentIds fields now validated in the gateway schema (#56939).
• Agentic Workflow Firewall bumped to v0.28.10 (#56914).

🐛 Bug Fixes & Improvements

• Fixed Codex harness handling of unsupported-model tool-schema failures with a clearer error message (#57256).
• Fixed trajectory grader duplicate detection (#57255) and prevented oversized MCP query payloads from exceeding argument limits (#57253).
• Fixed remote MCP authentication canary tool check (#57081) and Codex MCP environment fallback rendering (#56924).
• Fixed Playwright MCP TOML sandbox configuration (#56800) and added validation for Playwright mode expressions (#56933).
• Fixed require-getexecoutput-exitcode-check false positive on destructuring assignments (#57088) and improved manualpathconcat/prefer-actions-exec-over-child-process linter detection (#57056, #56985).
• Now requires positive max-runs values in workflow schema (#56911) and rejects top-level roles: per schema validation (#56981).
• Fixed missing Undici dependency in Copilot SDK workflows (#57057) and aligned the Copilot SDK tool catalog with compiled workflow tools (#56976).
• Normalized disabled failure-issue expiry in lockfiles (#56901) and stripped bot footer noise from prompt clustering inputs (#56910).

📚 Documentation

• Fixed invalid YAML example in Job Outputs docs (#56977), broken gallery links in multi-device docs testing (#57082), and stale Daily Firewall Report scope in the metrics glossary (#56979).
• Added documentation on intent-driven workflow design (#57005).

Learn more about on.cooldown and on.stop-after in the reference docs.

Generated by 🚀 Release · copilot · auto · 21.1 AIC · ⊞ 11.8K

---

What's Changed

• [test-parallel] test: add missing t.Parallel() in codemod_mcp_network_addallowed_test.go by @github-actions[bot] in #56714
• [WIP] Fix failing GitHub Actions job Integration: Workflow Infra by @pelikhan with @Copilot in #56688
• Pi engine: route OpenAI/Codex backend through the Responses API by @pelikhan with @Copilot in #56692
• Allow conclusion in on.workflow_run frontmatter schema by @pelikhan with @Copilot in #56743
• [caveman] Optimize instruction verbosity — evals.md (2026-08-28) by @github-actions[bot] in #56727
• Avoid CodeQL false positive in manifest path validation by @pelikhan with @Copilot in #56690
• [docs-diagram] Add Safe Outputs permission-isolation diagram by @github-actions[bot] in #56828
• Fix Playwright MCP TOML sandbox configuration by @pelikhan with @Copilot in #56800
• [spec-enforcer] Enforce specifications for jsonutil, scanfindings by @github-actions[bot] in #56878
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @github-actions[bot] in #56871
• [test-parallel] test: add t.Parallel() to safe schedule calendar tests by @github-actions[bot] in #56813
• [WIP] Fix failing GitHub Actions job for misc part 2 by @pelikhan with @Copilot in #56689
• [docs] docs: consolidation v9.24 - fix vague enhanced tone issues, link 3 uncovered spec files by @github-actions[bot] in #56898
• [actions] Update GitHub Actions versions - 2026-08-29 by @github-actions[bot] in #56859
• [code-simplifier] Simplify duplicated payload validation in add_reaction_and_edit_comment.cjs by @github-actions[bot] in #56819
• [purelock] Lock down selectHistoricalOperationalValueGrader, extractHostFromRemoteURL, extractOTLPAttributesFromObsMap with pure
  [Content t by @github-actions[bot] in https://github.com//pull/56895
• Avoid CodeQL bad-redirect-check false positives in path validation guards by @pelikhan with @Copilot in #56691
• Normalize disabled failure-issue expiry in lockfiles by @pelikhan with @Copilot in #56901
• Strip bot footer noise from prompt clustering inputs by @pelikhan with @Copilot in #56910
• Require positive max-runs values in workflow schema by @pelikhan with @Copilot in #56911
• Bump Agentic Workflow Firewall to v0.28.10 by @lpcox with @Copilot in #56914
• Validate Playwright mode expressions by @pelikhan with @Copilot in #56933
• [test-parallel] test: add t.Parallel() to safe table-driven subtests in pkg/cli by @github-actions[bot] in #56954
• Warn when compiled workflows share a display name by @pelikhan with @Copilot in #56937
• Fix Codex MCP environment fallback rendering by @pelikhan with @Copilot in #56924
• [test-parallel] test: add t.Parallel() to TestCompileWorkflowWithActionRef by @github-actions[bot] in #56962
• Expand Codex and Pi workflow coverage by @pelikhan with @Copilot in #56965
• Specify mutually exclusive gateway agentId and agentIds fields by @lpcox with @Copilot in #56939
• Implement lempel-ziv-trajectory-complexity grader (Tier 1, rank 11) by @pelikhan with @Copilot in #56972
• Fix invalid YAML example in Job Outputs docs by @pelikhan with @Copilot in #56977
• Convert trajectory grader workflow to feature grower (all-you-can-eat) pattern by @pelikhan with @Copilot in #56988
• Allow GitHub network access for maintenance workflows by @pelikhan with @Copilot in #56978
• Add regression test confirming top-level roles: is rejected by schema validation by @pelikhan with @Copilot in #56981
• Fix stale Daily Firewall Report scope in metrics glossary by @pelikhan with @Copilot in #56979
• Fix invalid Smoke Copilot discussion temporary IDs by @pelikhan with @Copilot in #56973
• Resolve identifier-referenced options in require-getexecoutput-exitcode-check by @pelikhan with @Copilot in #56984
• prefer-actions-exec-over-child-process: flag hidden async-conversion cost in sync contexts by @pelikhan with @Copilot in #56985
• Optimize ambient context in moderation and test workflows by @pelikhan with @Copilot in #56974
• Enforce explicit job and step timeouts on Visual Regression Checker workflow by @pelikhan with @Copilot in #56980
• Use authoritative AWF AI-credit totals in usage reporting by @pelikhan with @Copilot in #56975
• Implement policy-near-miss trajectory grader (Tier 2, Rank 1) by @pelikhan with @Copilot in #56996
• Add typed on.stop-after field; allow GitHub Actions expressions by @pelikhan with @Copilot in #56983
• Document intent-driven workflow design by @pelikhan with @Copilot in #57005
• Add on.cooldown workflow gating by @pelikhan with @Copilot in #56998
• Align Copilot SDK tool catalog with compiled workflow tools by @pelikhan with @Copilot in #56976
• Disable unused Codex plugin startup checks by @pelikhan with @Copilot in #57004
• Emit grader results in OpenTelemetry spans by @pelikhan with @Copilot in #57015
• Migrate MCP gateway compiler output to agentId by @lpcox with @Copilot in #56990
• [WIP] Add missing organization-custom-org-roles and organization-custom-repository-roles to JSON Schema by @pelikhan with @Copilot in #56982
• [log] Add debug logging to add-package CLI orchestration paths by @github-actions[bot] in #57045
• Use a Codex-compatible model for gpclean by @pelikhan with @Copilot in #57051
• [community] Update community contributions in README by @github-actions[bot] in #57032
• manualpathconcat: detect 2-operand embedded-slash literal shape by @pelikhan with @Copilot in #57056
• Implement skill-constraint-coverage trajectory grader by @pelikhan with @Copilot in #57055
• Fix missing Undici dependency in Copilot SDK workflows by @pelikhan with @Copilot in #57057
• Fix remote MCP authentication canary tool check by @pelikhan with @Copilot in #57081
• Fix require-getexecoutput-exitcode-check false positive on destructuring-assignment ObjectPattern by @pelikhan with @Copilot in #57088
• Implement exploration-error trajectory grader by @pelikhan with @Copilot in #57087
• Fix ESLint GitHub API throw correlation across retry callbacks by @pelikhan with @Copilot in #57089
• Fix broken gallery links in multi-device docs testing by @pelikhan with @Copilot in #57082
• Report eval results in OpenTelemetry spans by @pelikhan with @Copilot in #57166
• [trajectory-grader] Implement exploitation-error by @pelikhan with @Copilot in #57152
• Normalize report formatting across audit workflows by @pelikhan with @Copilot in #57172
• [mcp-tools] Fix stale toolset list in syntax-tools-imports.md by @pelikhan with @Copilot in #57171
• Bump default MCP Gateway to v0.4.14 by @lpcox with @Copilot in #57188
• [caveman] Optimize instruction verbosity — lsp.md (2026-08-30) by @github-actions[bot] in #57242
• Fix trajectory grader duplicate detection by @pelikhan with @Copilot in #57255
• Prevent large MCP query payloads from exceeding argument limits by @pelikhan with @Copilot in #57253
• Add tool output consumption rate trajectory grader by @pelikhan with @Copilot in #57252
• Codex harness: detect unsupported-model tool-schema failures with a dedicated message by @pelikhan with @Copilot in #57256

Full Changelog: v0.87.9...v0.87.10