v2.6.0

2.6.0 (2026-09-13)

Features

• implement-issue: send lifecycle hand-offs to a fresh session and shrink inline runs to one task (#523) (#584) (a85c0d3)
• profile-repo: name GitLab and Azure DevOps trackers in the profile (#504) (#568) (265b0e4)
• skills: close GHE host-resolution gaps left after #514 (#530) (#581) (9388358)
• tracker: one tracker contract, and a capable verdict at Step 1 (#505) (#583) (6336d9b)

Bug Fixes

• auto-dev: fail open when a credential's literal '@' makes the userinfo unparseable (#546) (#564) (dfba5cc)
• auto-dev: retro-taxonomy steering category no longer claims the kit ships no AGENTS.md (#557) (#563) (3cf9e0b)
• ci: the plugin-manifest JSON check covers every manifest host-adapters.py knows about, not a shorter hand-typed list (#556) (#576) (87d5adf)
• deps: update non-major dependencies (#577) (c191c9f)
• hooks: deny a named-path checkout that would discard an uncommitted edit (#560) (#569) (92ab8ee)
• hooks: handle launcher option forms in write-gate unwrapping (#562) (#582) (d7eec49)
• hooks: recognize command substitution inside double-quoted write-gate arguments (#559) (#588) (dba0395)
• hooks: the auto-dev stop gate allows a stop while the supervisor is actively cycling (#548) (#574) (15fe040)
• merge-pr: every guarded-pr-merge.sh call site points at the invocation fallback (#414) (#571) (7356234)
• merge-pr: one bounded follow-up lookup on a timeout-reasoned base verdict (#561) (#572) (518df1c)
• merge-pr: treat a run awaiting approval as needs-approval, not failed (#495) (#580) (83b721c)
• scripts: host-adapters.py check refuses RULE_COPIES with no host adapter (#558) (#585) (4a31099)
• scripts: host-adapters.py's $1 guard and replace share one token boundary, so $10+ can't be mistaken for $1 (#555) (#573) (b8f63e8)