v0.89.17

🌟 Release Highlights

This release focuses on hardening reliability across the AIC accounting pipeline, AWF/firewall integration, and safe-outputs handling, alongside a refreshed model catalog and several documentation clean-ups.

✨ What's New

• Faster, smarter logs auditing — cached workflow runs are no longer redownloaded during logs audits (#61871), and multi-target logs queries are now distributed fairly across targets (#61027), with per-run download duration/size tracked in an end-of-run stats summary (#60951).
• Updated model catalog — added gemini-3.8-flash and claude-fable-5.1 aliases and corrected pricing for gpt-6-astra/gpt-5.6-sol (#61234).
• MCP Gateway and firewall bumped — MCP Gateway updated to v0.4.25 (#61661) and gh-aw-firewall (AWF) updated to v0.28.20 (#61527) and v0.28.17 (#60945), improving compatibility and stability.
• Better automatic grading — native Copilot tool calls are now included in the automatic grader trace payload for more accurate evaluation (#61426).
• Refreshed CLI defaults and scanner image pins for more predictable compiled workflows (#61432).

🐛 Bug Fixes & Improvements

• Fixed Code Scanning Fixer timeouts and tool denials (#61605).
• Fixed slash command activation failing on CRLF line endings (#61602).
• Added support for older curl versions in the AWF installer (#61600).
• Rewrote experiments.<name> references in engine.model into valid job-scoped expressions, preventing invalid compiled workflows (#61599).
• Hardened withRetry against transient fetch failures (#61439).
• Fixed upload_artifact silently succeeding when relative paths were never staged (#61431).
• Fixed Copilot SDK multiword shell-prefix matching and a denial-guard hang (#61430).
• Empty add_labels lists are now treated as a no-op instead of failing the job (#61429).
• Added ability to opt out of the "[aw] Detection Runs" tracking issue independently of threat detection (#61428).
• The safeoutputs CLI transport now fails loudly instead of silently failing open, surfacing real errors sooner (#61427).
• Fixed false-positive AI credits rate-limit detection caused by MCP echoes (#61425).
• Imported engine config (including auth) is now preserved when a workflow sets a top-level model (#61424).
• PLAYWRIGHT_BROWSERS_PATH now uses ${{ runner.temp }} so install and launch agree on the browser path (#61423).
• Fixed several gaps in daily AIC (AI Credits) accounting: legacy runs (#61313), pre-harness failures (#61232), unassigned jobs (#61222), and missing evals now counted as zero instead of skipped (#60892).
• Stabilized the Daily Documentation Healer's runtime (#61235).
• AWF fatal startup errors are now surfaced in agent failure reports (#61199), and not_started execution evidence is recorded when AWF fails before the engine harness starts (#61202).
• Added the Go ecosystem to the network allowlist for ci-coach (#61201).
• Validated cached run uniqueness across JSONL shards to prevent duplicate accounting (#61220).
• Preserved agent accounting in fallback artifacts (#61053).
• Fixed a flaky pkg/cli test-unit crash from concurrent Cobra completion generation (#61146).

📚 Documentation

• Several self-healing documentation passes fixed inaccuracies found via issue analysis (#61683, #61443).
• Documented the threat-detection report-as-issue field (#61563).
• Trimmed and clarified the workflow structure, tools, and IssueOps reference docs (#61485, #61238, #60998).
• Updated the glossary from the daily scan (#61104).

Generated by 🚀 Release · copilot · auto · 18.5 AIC · ⊞ 11.6K

---

What's Changed

• Bump MCP Gateway to v0.4.25 by @lpcox with @Copilot in #61661
• [docs] Self-healing documentation fixes from issue analysis - 2026-09-17 by @github-actions[bot] in #61683
• [log] Add debug logging to add-workflow code paths by @github-actions[bot] in #61710
• chore: update planned Go, Actions, and docs dependencies by @mnkiefer with @Copilot in #61774
• Avoid redownloading cached runs during logs audit by @pelikhan with @Copilot in #61871

Full Changelog: v0.89.16...v0.89.17