v0.92.6

🌟 Release Highlights

v0.92.6 strengthens the work queue, episode-based log analysis, model-catalogue resilience, and static security linting.

⚠️ Breaking Changes

• gh aw logs now requires canonical episode identity and reports coverage (#70277). Update any tooling that relied on non-canonical episode identifiers.

✨ What is New

• Episode analytics: bounded canonical episode retrieval, usage joined with recorded outcome accounting, and better unified-session episode lineage (#70322, #70281, #70205).
• Work queue: guarded clear/hard-reset commands, deterministic expiration of unclaimed entries, better diagnostics, and stronger delivery recovery (#70022, #70025, #70027, #69951, #69790).
• Security linting: new AST linters for checkout trust, prompt expressions, secret-leak taint analysis, and history-backed zizmor checks (#70131, #69813, #70356).
• Provenance & redaction: agent provenance tracking, coarse issue-body redaction, and early activation failure for stale provenance workflows (#70032, #70348).
• Model resilience: consistent model alias resolution across engines, a Copilot SDK check against the live model catalogue, and a daily model-pin checker (#69487, #70320, #70295).
• Engines: OpenCode integration migrated to v2 (#69950).
• Pure graders: graders are now pure unified-session computations (#70130).

🐛 Bug Fixes & Improvements

• Custom safe-output jobs are gated on threat detection success; threat detection applies warn-mode policy when the detection engine fails (#69995, #70325).
• Placeholder issue titles are rejected before consuming create_issue quota (#69994).
• Fixed empty configured_model for routed/fallback Copilot CLI runs (#69966).
• Fixed OTLP placeholder masks suppressing boolean job outputs (#69996).
• Safe-output footers include Work and Claim references (#69865).
• Fixed Goose release redirects, Crush stdin startup, and Aider discovery (#70282, #70214, #70021).
• Fixed PR lifecycle races and merged-base-ancestor detection (#70141, #69998).

📚 Documentation

• Specified OIDC-based AW activation admission and aligned episode specs (#70286, #70279).
• Documented claim delivery diagnostics (#69987).

Generated by 🚀 Release · copilot · auto · 15.9 AIC · ⊞ 12.3K

---

What's Changed

• Allow narrowly gated Cloud Hypervisor agent acceptance fixture by @lpcox in #69777
• Surface sub-agent failures and replace unpriced kiwi workflow models by @pelikhan in #69788
• Finalize work-queue workers inline and recover stranded runs by @pelikhan in #69790
• Resolve model aliases the same way on every engine by @SivaKesava1 with @Copilot in #69487
• Fix Pi model availability in multi-device docs tester by @pelikhan in #69869
• Fix container scan analysis tool-permission mismatch by @pelikhan in #69867
• fix: use per-model SDK providers for Contribution Check delegates by @pelikhan in #69870
• fix: include Work and Claim references in safe-output footers by @pelikhan in #69865
• [eslint-miner] eslint-factory: add no-split-filter-trim-without-trim-map rule by @github-actions[bot] in #69831
• fix(workflows): report PR content integrity blockers accurately by @pelikhan in #69866
• Fix bounded CLI coverage and delegated-failure audit reporting by @pelikhan in #69868
• [dead-code] chore: remove dead functions — 2 functions removed by @github-actions[bot] in #69936
• Fix CI parser embedding and stale policy fixtures by @pelikhan in #69943
• Migrate OpenCode integration to v2 by @pelikhan in #69950
• Add extensible AST linting and secret-leak taint analysis by @pelikhan in #69813
• Fix work-queue delivery recovery and formalize settlement guarantees by @pelikhan in #69951
• Add daily Actions/AW AST linter factory by @pelikhan with @Copilot in #69972
• Fix empty configured_model for routed and fallback Copilot CLI runs, and isolate selection-persistence errors in the post-step by @SivaKesava1 with @Copilot in #69966
• Replace Linter Miner’s unavailable model by @pelikhan with @Copilot in #69990
• Document claim delivery diagnostics by @pelikhan with @Copilot in #69987
• Preserve AWF ranked choices and request/failure metadata in unified sessions by @SivaKesava1 with @Copilot in #69848
• Gate custom safe-output jobs on threat detection success by @pelikhan with @Copilot in #69995
• Fix rendering verifier dependencies and real-log harness by @pelikhan in #70017
• Fix work queue delivery transport continuity by @pelikhan in #70016
• Fix Windows Grower reusable workflow permissions by @pelikhan in #70020
• Fix Aider discovery from an empty file context by @pelikhan in #70021
• fix: give Copilot and Pi conformance probes bounded credit headroom by @pelikhan in #70023
• Reject placeholder issue titles before consuming create_issue quota by @pelikhan with @Copilot in #69994
• Prevent OTLP placeholder masks from suppressing boolean job outputs by @pelikhan with @Copilot in #69996
• Render complete issue body ASTs once by @pelikhan in #70019
• Fix stale Linter Miner model contract in CI by @pelikhan in #70030
• Add deterministic expiration for unclaimed work queue entries by @pelikhan in #70025
• Add guarded work-queue clear and hard reset commands by @pelikhan in #70022
• Add fast authored JavaScript analysis with reviewed API summaries by @pelikhan in #70029
• Improve work-queue diagnostics for agents by @pelikhan in #70027
• Add missing compiler threat linters and reference threat rule IDs by @pelikhan in #70026
• [docs] docs: unbloat artifacts reference by @github-actions[bot] in #70108
• Preserve AWF model inventories with null endpoints and live reasoning metadata (G-7) by @SivaKesava1 with @Copilot in #70013
• Recognize merged base ancestors when the base tip advances by @pelikhan with @Copilot in #69998
• [blog] Weekly blog post – 2026-10-19 by @github-actions[bot] in #70124
• Replace retired MAI picker with available MAI-Code-1.1-Flash by @pelikhan in #70133
• Add AST threat linters for checkout trust and prompt expressions by @pelikhan in #70131
• fix(queue): bound deployment metadata retries by @pelikhan in #70129
• Track agent provenance and support coarse issue-body redaction by @pelikhan in #70032
• [spec-review] Update Safe Outputs conformance checker for recent spec changes by @github-actions[bot] in #70150
• Handle queued and in-flight PR lifecycle races by @pelikhan in #70141
• Make graders pure unified-session computations by @pelikhan in #70130
• fix(work-queue): recover transient metadata read failures by @pelikhan in #70200
• Preserve HTML image layout and code fidelity in issue reports by @pelikhan in #70158
• Fix Crush smoke engine startup on open stdin by @pelikhan in #70214
• Fix CI contracts and custom grader download failures by @pelikhan in #70217
• [archivx] Update workflow diagram — 2026-10-19 by @github-actions[bot] in #70210
• [spec-enforcer] Enforce specifications for fileutil, github, githubapi by @github-actions[bot] in #70237
• [docs] Update glossary - weekly full scan by @github-actions[bot] in #70231
• [schema-coverage] docs: add schema coverage demo for docker-image-pull-policy by @github-actions[bot] in #70183
• [instructions] Sync instruction files with release v0.92.0 by @github-actions[bot] in #70207
• Improve outcome evaluation and unified session episode lineage by @pelikhan in #70205
• fix(goose): allow GitHub release asset redirects by @pelikhan in #70282
• Fix work-queue guidance and WASM golden CI failures by @pelikhan in #70283
• docs: align episode specifications with supported behavior by @pelikhan in #70279
• Fix claim-scoped engine conformance noop checks by @pelikhan in #70284
• Join episode usage with recorded outcome accounting by @pelikhan in #70281
• [blog] Agent of the Day – 2026-10-19 by @github-actions[bot] in #70271
• [dead-code] chore: remove dead functions — 2 functions removed by @github-actions[bot] in #70270
• feat(logs)!: require canonical episode identity and report coverage by @pelikhan in #70277
• fix: replace retired model pins in three workflows by @SivaKesava1 in #70328
• fix(test): update sub-agent smoke fixture for renamed mini54-whoami by @SivaKesava1 in #70355
• fix: use model aliases for pins Copilot no longer offers by @SivaKesava1 in #70342
• Daily Model Inventory Checker: deterministic workflow model-pin check against the live Copilot catalogue by @SivaKesava1 with @Copilot in #70295
• Add history-backed zizmor checks to Actions/AW AST linters by @pelikhan in #70356
• feat(logs): add bounded canonical episode retrieval by @pelikhan in #70322
• Add unified-session contract checks (U1–U3) to smoke assertions by @SivaKesava1 with @Copilot in #70294
• fix: register staged Copilot skills and constrain optimizer recovery by @pelikhan in #70359
• Threat detection: apply the warn-mode safe-outputs policy when the detection engine fails by @SivaKesava1 with @Copilot in #70325
• Copilot SDK: refuse to start when the configured model is not in the live /reflect catalogue by @SivaKesava1 with @Copilot in #70320
• Fix secure bootstrap for repo-memory daily AIC ledgers by @pelikhan in #70358
• docs: specify OIDC-based AW activation admission by @pelikhan in #70286
• Fail activation early for stale provenance workflows by @pelikhan with @Copilot in #70348
• Record authoritative zero AIC evidence for pre-flight noops by @pelikhan with @Copilot in #70344

New Contributors

• @SivaKesava1 made their first contribution in #70328

Full Changelog: v0.92.5...v0.92.6