v1.2.2

🌟 Release Highlights

This release focuses on more reliable work-queue handling, hardened firewall/proxy egress, and sturdier session normalization across engines.

✨ What's New

• Cancel obsolete work: cancel-work --obsolete adds a read-only dry-run preview, and queue maintenance now cancels obsolete worker backlog.
• Cost-aware model routing: more workflows (including PR Sous Chef) use economy model routing instead of pinned models.
• Skip-if-decision gates added to ten more Copilot workflows and AWF engine invocations to cut unnecessary runs.
• Name-based artifact upserts in update-issue.
• Strict dry-run compilation now allows workflow steps.
• Updated MCP Gateway to v0.5.6 and firewall to v0.29.11.

🐛 Bug Fixes & Improvements

• Hardened work queue launch recovery, stalled code-scanning fixer diagnostics, and deferred run binding to trusted worker activation.
• Proxy-routed provider APIs (Gemini, mini-SWE-agent bootstrap) are kept out of agent egress; OpenAI WIF detection hardened.
• Unified session fixes for Cursor, OpenCode, Pi, Gemini, and Aider; structured tool results and workflow metadata are preserved.
• Copilot tool denials are classified and incomplete-workflow reports are deduplicated.
• Safe-output branch checks no longer require the Administration permission; terminal safe-output signals are now required.

📚 Documentation

• Verbatim Squad issue bootstrap prompt, fork PR/issue-template/runner-step guidance, and obsolete_limit debug playbook entries.

Generated by 🚀 Release · copilot · auto (Claude Sonnet 5.5) · ~16 AIC · ⊞ 13.8K

---

What's Changed

• Route three Codex-on-Copilot workflows with economy model routing instead of pinned GPT Sol models by @SivaKesava1 with @Copilot in #75460
• Route four Claude Code analysis workflows through Copilot model routing (economy) by @SivaKesava1 with @Copilot in #75471
• Align modelsdev README with the implemented API by @gh-aw-bot with @Copilot in #75427
• Confirm buffered PR reviews before executing dependent safe outputs by @pelikhan with @Copilot in #75387
• Use effective runner identity and owner-only configs for safeoutputs by @lpcox with @Copilot in #75443
• [WIP] Fix cleanup and isolation for self-hosted job runtimes by @lpcox with @Copilot in #75444
• Decouple rootless CLI installation from runner topology by @lpcox with @Copilot in #75445
• [ca] chore: update eligible CLI and scanner pins by @github-actions[bot] in #75324
• Support no-sudo Copilot installation in agent and detection jobs by @lpcox with @Copilot in #75446
• Route Designer Drift Audit, Daily Documentation Diagram and Chaos PR Bundle Fuzzer with economy model routing on Copilot by @SivaKesava1 with @Copilot in #75461
• Route four pinned Codex workflows with cost/economy model routing by @SivaKesava1 with @Copilot in #75470
• Fix CGO failures from missing MCP pin and installer test setup by @pelikhan in #75593
• Stabilize checksum-verified TLA+ runtime installation by @pelikhan in #75487
• Honor imported engine secret allowlists in strict mode by @pelikhan with @Copilot in #75382
• [log] Add debug logging to NVX, AWF model policy, work-queue, checkout-ref warning, and grader loader by @github-actions[bot] in #75592
• [docs] docs: reduce repetition in cross-repository issue tracking by @github-actions[bot] in #75576
• fix(linters): handle parenthesized callees in walkdirignoredeerror, uncheckedflushreturn, sprintferrorsnew, httprespbodyclose by @github-actions[bot] in #75599
• Preserve external threat-detection retry diagnostics across jobs by @pelikhan with @Copilot in #75362
• Sync SPDD spec guidance, safeguards, and evidence maps by @gh-aw-bot with @Copilot in #75453
• Validate pip and uv executables before package checks by @gh-aw-bot with @Copilot in #75365
• Preserve runtime checkout manifests for post-job hooks by @pelikhan with @Copilot in #75381
• [eslint-miner] eslint-factory: add no-path-startswith-without-separator rule by @github-actions[bot] in #75594
• [blog] Ecosystem Spotlight – sabbasi3-factory-lab/factory by @github-actions[bot] in #75448
• Align Copilot workflow tool contracts and denial guidance by @pelikhan in #75489
• [docs] Update documentation for features from 2026-11-07 by @github-actions[bot] in #75657
• [tlc-tests] Add CancelledRerunAccounting boundary tests for daily AIC carry-forward by @github-actions[bot] in #75645
• Reject run-step expressions in shell re-evaluation contexts by @gh-aw-bot with @Copilot in #75366
• [instructions] Sync instruction files with release 1.0.1 by @github-actions[bot] in #75642
• Align multi-device docs tests with responsive navigation by @gh-aw-bot with @Copilot in #75619
• [file-diet] Split run artifact processor into focused files by @gh-aw-bot with @Copilot in #75620
• [docs] Consolidate developer specifications into instructions file by @github-actions[bot] in #75682
• Preserve cross-repository checkout identity during credential setup by @pelikhan with @Copilot in #74943
• [actions] Update GitHub Actions versions - 2026-11-07 by @github-actions[bot] in #75633
• Normalize report formatting guidance in three workflows by @gh-aw-bot with @Copilot in #75685
• Clarify sprintfbool linter fixture function names by @gh-aw-bot with @Copilot in #75687
• Add regression tests for package argument injection by @gh-aw-bot with @Copilot in #75686
• Add hourly auditor for recurring agentic workflow failures by @pelikhan with @Copilot in #75695
• Enable scoped specification updates on PR branches by @pelikhan with @Copilot in #75697
• [blog] Ecosystem Spotlight – witt3rd/review-council by @github-actions[bot] in #75698
• Document generated permissions and preserve author comments by @pelikhan with @Copilot in #75615
• Fix Markdown-escaped temporary ID resolution in safe outputs by @pelikhan with @Copilot in #75688
• [otel-reference] Expand OpenTelemetry reference guide by @github-actions[bot] in #75659
• Persist Copilot session telemetry and summarize tool performance by @gh-aw-bot with @Copilot in #75706
• Allow pi model selection from dispatch inputs by @pelikhan with @Copilot in #75385
• Account for threat detection outcomes in audit and health reports by @pelikhan with @Copilot in #75691
• [avenger] Fix stale activity_report permissions assertion in side-repo test by @github-actions[bot] in #75710
• Validate localhost URL rewrites and package arguments by @gh-aw-bot with @Copilot in #75707
• Fix missing detection verdicts caused by denied Copilot artifact access by @pelikhan with @Copilot in #75690
• Add subtle skill help callout above docs legal footer by @pelikhan with @Copilot in #75718
• Update Squad repository references to github/squad by @pelikhan with @Copilot in #75719
• Add daily enterprise DevOps documentation audit by @pelikhan with @Copilot in #75720
• Remediate Codex budget and workflow failure boundaries by @pelikhan in #75491
• Make safe-output assets readable by artifact upload by @gh-aw-bot with @Copilot in #75714
• Triage security red-team findings by @gh-aw-bot with @Copilot in #75729
• Fix CI regressions and use feed-available TypeSpec dependencies by @pelikhan in #75739
• Deduplicate JavaScript harness prompt and permission handling by @pelikhan with @Copilot in #75733
• Document tool_error in the debug playbook by @gh-aw-bot with @Copilot in #75728
• docs: clarify GHES/GHEC and ARC applicability across the gh-aw stack by @lpcox with @Copilot in #75717
• Reconcile stale work-queue Issue mirrors by @gh-aw-bot with @Copilot in #75715
• Fix PR triage safe-output targeting by @gh-aw-bot with @Copilot in #75754
• Prevent Archivx from presenting partial log coverage as weekly health by @gh-aw-bot with @Copilot in #75752
• Reject unavailable Claude web tools on Copilot inference by @pelikhan with @Copilot in #75736
• Correct daily workflow cache usage and deduplicate cache audits by @gh-aw-bot with @Copilot in #75730
• [duplicate-code] refactor: share repeated harness output pattern matchers by @github-actions[bot] in #75757
• Add stringssplitfirst analyzer by @gh-aw-bot with @Copilot in #75753
• Batch 90-day PR and issue queries to avoid MCP timeouts by @gh-aw-bot with @Copilot in #75762
• Block tracked Claude local permission settings in builds and CI by @pelikhan in #75766
• Resolve static replacement constants in no-dynamic-string-replacement by @gh-aw-bot with @Copilot in #75760
• Make guarded safe-output assets readable by the uploader by @gh-aw-bot with @Copilot in #75761
• Add daily declarative engine maintenance workflow by @pelikhan with @Copilot in #75777
• Show detector-defined threat categories in generated warnings by @pelikhan with @Copilot in #75774
• Add unchecked os cleanup analyzer by @gh-aw-bot with @Copilot in #75765
• Route Daily Code Metrics, Daily Reliability Review and Weekly OTel Reference with economy model routing by @gh-aw-bot with @Copilot in #75764
• Retire schedules from manually disabled workflows by @gh-aw-bot with @Copilot in #75794
• Update default Playwright CLI version to 0.1.23 by @gh-aw-bot with @Copilot in #75795
• Record the last agent action in failure diagnostics by @gh-aw-bot with @Copilot in #75763
• [log] Add debug logging to ATIF conversion, agentdrain snapshot loading, and CLI action/permission helpers by @github-actions[bot] in #75813
• [docs] docs: fix spelling in ecosystem spotlight post (automated spellcheck 2026-11-08) by @github-actions[bot] in #75808
• Exclude test fixtures from daily security scans by @gh-aw-bot with @Copilot in #75805
• Clarify queued ledger dependencies and correct smoke workflow sequencing by @pelikhan with @Copilot in #75818
• Exclude workflow locks from Design Decision Gate pushes by @pelikhan in #75867
• docs: refresh shared QMD index/search guidance for v2.8.3 by @pelikhan in #75869
• fix(evals): send Copilot integration identity to Decisions by @pelikhan in #75859
• Require patched zlib and libexpat in vendored Node image by @pelikhan in #75864
• fix(linters): see through parentheses in tolowerequalfold and bufioscannererunchecked by @github-actions[bot] in #75816
• Suppress static-analysis false positives in shared workflow setup by @gh-aw-bot with @Copilot in #75822
• [linter-miner] Add splitlines-on-newline custom analyzer by @gh-aw-bot with @Copilot in #75820
• Add experimental declarative mini-SWE-agent engine by @pelikhan with @Copilot in #75773
• Improve safe-output helper test coverage by @gh-aw-bot with @Copilot in #75821
• [Safe Outputs Conformance] WTD-002: Accept current threat-caution delegation in conformance checker by @github-actions[bot] in #75841
• Preserve submitted review anchors during comment identity lookup by @pelikhan in #75865
• [instructions] Sync instruction files with release 1.0.1 by @github-actions[bot] in #75875
• [spec-enforcer] Enforce specifications for linters, atif, workflowcontract by @github-actions[bot] in #75890
• [purelock] Lock down interpreterOptionEvaluatesCode with a pure-function test suite by @github-actions[bot] in #75905
• [dead-code] chore: remove dead functions — 2 functions removed by @github-actions[bot] in #75909
• Complete overdue spec cleanup and conformance updates by @gh-aw-bot with @Copilot in #75916
• Extract shared work-queue worker target resolution by @gh-aw-bot with @Copilot in #75807
• Use health-based failure discovery in Auditor by @pelikhan with @Copilot in #75921
• Add cost-aware dreaming guidance and a repo-memory pilot by @pelikhan in #75862
• Use strings.Cut for the first path component by @gh-aw-bot with @Copilot in #75920
• Fix CI fixtures for retired schedules and pinned safe-output actions by @pelikhan in #75930
• Improve persona evaluation guidance and issue labeling by @pelikhan with @Copilot in #75923
• Update Impeccable skills to v4.8.1 by @pelikhan with @Copilot in #75932
• Normalize blocked labels and cover run-step sanitization by @gh-aw-bot with @Copilot in #75793
• Preinstall JavaScript test dependencies for Daily TLC Test Expert by @pelikhan with @Copilot in #75926
• [model-inventory] Model alias inventory update - 2026-11-07 by @github-actions[bot] in #75775
• Migrate Windows workflow to canonical missing-tool safe output by @pelikhan with @Copilot in #75929
• Bump gh-aw-firewall to v0.29.10 by @lpcox with @Copilot in #75843
• [linter-miner] Add JSON unmarshal byte conversion linter by @gh-aw-bot with @Copilot in #75919
• Add blank-assigned cleanup error linter by @gh-aw-bot with @Copilot in #75922
• Accept self-repository $/ action and reusable workflow references by @pelikhan with @Copilot in #75924
• Add OpenAI workload identity federation for Codex by @pelikhan with @Copilot in #75927
• [WIP] Fix failing GitHub Actions job for access-control spec pin by @pelikhan with @Copilot in #75950
• Add shared PageIndex indexing and tree-guided documentation search by @pelikhan with @Copilot in #75939
• Add Copilot Automation group and task status tools by @pelikhan with @Copilot in #75925
• Exclude vendored YAML from ESLint custom rules by @gh-aw-bot with @Copilot in #75806
• Expand workflow_run validation test coverage by @gh-aw-bot with @Copilot in #75957
• Fix idempotent comment-removal test fixtures by @pelikhan in #75974
• docs: Define trusted indexing and read-only search patterns by @pelikhan with @Copilot in #75953
• Hash-lock Harbor conformance dependencies by @pelikhan in #75979
• Normalize report formatting across workflows by @gh-aw-bot with @Copilot in #75955
• Guard ESLint exclusion for vendored work queue YAML by @gh-aw-bot with @Copilot in #75976
• fix: align pinned global npm installs with scanning policy by @pelikhan in #75975
• Fix main CI pin checks and stale test contracts by @pelikhan in #75993
• [linter-miner] Add filepath.WalkDir preference linter by @gh-aw-bot with @Copilot in #75956
• Deduplicate incomplete workflow reports across changing diagnostics by @gh-aw-bot with @Copilot in #75987
• Replace Pi durable runtime with native session chaining by @pelikhan in #75995
• Reduce recurring red-team scanner noise by @gh-aw-bot with @Copilot in #75985
• Report durable session continuation in audit, health, and OpenTelemetry by @pelikhan in #75984
• Update GitHub MCP access-control spec pin and fetch full validation history by @pelikhan with @Copilot in #75989
• [duplicate-code] refactor(cli): deduplicate logs render option construction by @github-actions[bot] in #75992
• Support name-based artifact upserts in update-issue by @pelikhan with @Copilot in #75988
• Allow workflow steps in strict dry-run compilation by @gh-aw-bot with @Copilot in #75978
• [docs] docs: unbloat custom safe outputs reference by @github-actions[bot] in #76077
• Make PR Sous Chef comments friendlier and flag remaining CI failures by @pelikhan in #76080
• Remove redundant Copilot Decisions API integration test by @pelikhan in #76083
• Classify Copilot tool denials and align workflow allowlists by @gh-aw-bot with @Copilot in #75986
• Add skip-if-decision gate to AWF engine invocations by @pelikhan in #76008
• Add skip-if-decision gates to ten more Copilot workflows by @pelikhan in #76099
• fix: prioritize default-branch runs in health checks by @pelikhan in #76084
• [blog] Weekly blog post – 2026-11-09 by @github-actions[bot] in #76096
• fix: retain structured tool results in unified sessions by @pelikhan in #76102
• fix: populate default Gemini run-info versions by @pelikhan in #76108
• [log] Add debug logging to cli update, rollout, grader and admission files by @github-actions[bot] in #76117
• Share safe-job and safe-script config projection by @gh-aw-bot with @Copilot in #76094
• [yamllint-fixer] Fix yamllint truthy warnings: quote ambiguous YAML env scalars by @github-actions[bot] in #76100
• fix: preserve OpenCode session scope and output truncation by @pelikhan in #76101
• fix(docs): shorten weekly update SEO description by @pelikhan in #76128
• Preserve Pi message clocks and unified tool correlation by @pelikhan in #76103
• Fix Cursor native session normalization by @pelikhan in #76109
• fix(linters): see through parens, aliases and dot-imports in osexitinlibrary, rawloginlib, logfatallibrary, fprintferrorunchecke by @github-actions[bot] in #76123
• [eslint-miner] eslint-factory: add require-per-page-on-github-list-call rule by @github-actions[bot] in #76119
• fix(aider): capture provider-specific plaintext reasoning by @pelikhan in #76120
• [spec-review] Update Safe Outputs conformance checker for recent spec changes by @github-actions[bot] in #76136
• fix: collect workflow metadata in unified sessions by @pelikhan in #76111
• [jsweep] Clean workflow_metadata_helpers.cjs by @github-actions[bot] in #76127
• fix: provide valid harness decision in Aider parser test by @pelikhan in #76141
• Remove redundant arithmetic variable expansions in squid scan by @gh-aw-bot with @Copilot in #76150
• [Safe Outputs Conformance] SEC-005: Annotate update_issue.cjs cross-repo allowlist enforcement (checker false positive) by @github-actions[bot] in #76159
• Align workflow step names with repository conventions by @gh-aw-bot with @Copilot in #76129
• Cancel obsolete worker backlog during queue maintenance by @pelikhan in #76126
• [architecture] Update architecture diagram - 2026-11-09 by @github-actions[bot] in #76203
• Add cancel-work --obsolete with a read-only dry-run preview by @pelikhan in #76180
• Speed up the agentic development loop by @pelikhan in #76252
• Document exported package APIs in README specifications by @gh-aw-bot with @Copilot in #76251
• Require terminal safe-output signals by @gh-aw-bot with @Copilot in #76194
• Validate UV executable path before package lookup by @gh-aw-bot with @Copilot in #76157
• [blog] Agent of the Day – 2026-11-09 by @github-actions[bot] in #76256
• Add AWF installer failure and platform regression coverage by @gh-aw-bot with @Copilot in #76193
• Diagnose and release stalled code-scanning fixer attempts by @gh-aw-bot with @Copilot in #76184
• Remove Administration permission requirement from safe-output branch checks by @pelikhan with @Copilot in #76264
• Document obsolete_limit in the debug playbook by @pelikhan with @Copilot in #76271
• Defer work queue run binding to trusted worker activation by @pelikhan in #76253
• Normalize report formatting across workflows by @gh-aw-bot with @Copilot in #76270
• Address @copilot in PR Sous Chef CI follow-ups by @pelikhan with @Copilot in #76279
• Reduce dead-code remover workflow invocations by @pelikhan with @Copilot in #76268
• Separate Gemini proxy targets from agent firewall policy by @gh-aw-bot with @Copilot in #76272
• Harden OpenAI WIF detection and firewall wiring by @pelikhan with @Copilot in #76236
• Split workflow resolution into focused files by @gh-aw-bot with @Copilot in #76269
• Separate mini-SWE-agent bootstrap from runtime PyPI access by @pelikhan with @Copilot in #76273
• Document fork PR, issue-template, and runner-step guidance by @gh-aw-bot with @Copilot in #76299
• Expand .gitattributes test coverage by @gh-aw-bot with @Copilot in #76294
• Add sortbasicslices analyzer for basic sort helpers by @gh-aw-bot with @Copilot in #76295
• Complete SPDD spec follow-ups for November 9 by @gh-aw-bot with @Copilot in #76282
• Keep proxy-routed provider APIs out of agent egress by @gh-aw-bot with @Copilot in #76293
• Use compiler JSON metadata in the setup runtime by @pelikhan in #75997
• Deduplicate protected-file fallback issues by @gh-aw-bot with @Copilot in #76300
• Route PR Sous Chef to cost/economy model routing instead of the Haiku 4.5 pin by @SivaKesava1 with @Copilot in #76325
• Document safe-output CLI usage in Matt Pocock reviewer by @gh-aw-bot with @Copilot in #76326
• Harden uncertain work queue launch recovery and diagnostics by @pelikhan in #76331
• [WIP] Fix failing GitHub Actions job JS Tests (shard 8/8) by @pelikhan with @Copilot in #76333
• Update MCPG to v0.5.6 and firewall to v0.29.11 by @lpcox with @Copilot in #76311
• docs: add verbatim Squad issue bootstrap prompt by @pelikhan in #76364
• Regenerate workflows to satisfy setup metadata contract by @lpcox with @Copilot in #76383

Full Changelog: v1.2.1...v1.2.2