Blog

Weekly Update – October 19, 2026

Oct 19, 2026

It was a busy week for github/gh-aw: five pre-releases, v0.92.1 through v0.92.5, landed between October 15 and 17. The theme was observability, security hardening and keeping engines current.

Release Highlights

v0.92.5

A security and diagnostics release.

Structured reports (#69756, #69755): generated issues now use a normalized report AST, and Actions-native and AW Markdown workflow ASTs were added.
Better failure visibility (#69788, #69467, #69432): sub-agent failures are surfaced, unavailable models are diagnosed, and audit/logs handle sub-agent instances without an agentId.
Safer MCP compile (#69510): MCP compile is read-only unless write tools are enabled.
Redaction (#69520, #69517): detection outputs and CLI proxy startup diagnostics are redacted before publication or artifact upload.
Dependency bumps to MCP Gateway v0.4.35 and firewall v0.28.62.

v0.92.4 and v0.92.3

You can now set create-issue: false to disable automatic issue output (#69369).
CLI-generated PR descriptions are richer, and there’s a new --pr-message flag (#69378).
gh aw upgrade now respects workflow engines and opt-out flags (#69362).
Copilot SDK sessions register MCP gateway servers, so MCP tools are available as expected (#69231).

v0.92.2 and v0.92.1

Every gh aw command that creates pull requests supports --auto-merge.
Engine upgrades: Copilot CLI 1.0.98, Codex 0.163.0, Gemini CLI 0.64.0, Goose 1.54.0, Kiro CLI 2.31.1 and Antigravity CLI 1.3.6 (#69146).
logs gained automatic failure clustering and investigation plans (#68954).
New offline skill command and SAML-safe instruction downloads (#69043).
health supports logs-style date windows (#69048).

Agent of the Week: daily-firewall-report

The network watchdog that collects firewall logs and reports on which domains your agentic workflows are reaching.

Its three most recent runs (October 6–8) were scheduled early-morning runs on the Copilot engine. Each ran for 10 to 27 minutes, and the firewall data it gathered showed 81 requests across the three runs, all allowed and none blocked, spread across api.githubcopilot.com, Sentry and Grafana ingest endpoints.

The funny part: a firewall reporter whose own firewall had nothing to block, while the runs themselves all stopped at the MCP Gateway start step. Even the watchers need a good night’s sleep.

Usage tip: Schedule a firewall report so unexpected domains show up in a daily summary instead of during an incident.

→ View the workflow on GitHub

Try It Out

Upgrade to v0.92.5 and tell us what you think. Feedback and contributions are always welcome in github/gh-aw.

Agent of the Day – October 16, 2026

Oct 16, 2026

Copilot

Docs rot quietly. A feature ships on Tuesday, and by Friday nobody remembers that the reference page never heard about it. Today’s Agent of the Day is the workflow that keeps that from happening, and it also had a bumpy week.

Agent of the Day: Daily Documentation Updater

The Daily Documentation Updater wakes up around 10:00 UTC, reviews what merged recently, and opens a pull request when the documentation needs to catch up. It runs on the Codex engine and uses the create-pull-request safe output, so any change reaches the repo as a reviewable PR.

Here is what the logs show for the last three days:

Run	Started (UTC)	Duration	Result
38551459107	Oct 14, 10:42	10.2m	Success
38722208333	Oct 15, 10:42	37s	Failure
38888962279	Oct 16, 10:42	31s	Failure

The good run

The Oct 14 run used about 1.08 million tokens across 19 model invocations and about 197 AI credits. Its session shows it going through a batch of freshly merged work, including:

#68421: Show work titles and descriptions in work-queue issues
#68424: Add Anthropic Claude Haiku 5.5 pricing
#68426: Support numeric targets and improve diagnostic errors in push_to_pull_request_branch
#68428: Include AWF steering events in unified session audit reports

It also looked at the CLI consistency report, #68442, which is the kind of context that tells it where the docs and the CLI have drifted apart. That is the useful part of this agent: it connects “what merged” to “what the docs now owe readers”.

The rough mornings

On Oct 15 and Oct 16 the run ended in about half a minute. In both cases the audit data points to the same place: the activation job failed at the step Restore daily AIC scan observations, before the agent started. The agent never ran, so these are infrastructure failures rather than a documentation mistake. They are worth fixing because a daily workflow that silently skips two days is a doc backlog in the making.

Cost at a glance

Combined workflow activity chart

The successful run’s friction data is a useful reminder that long sessions rebuild context: peak input was about 79k tokens, but cumulative input reached roughly 1.07M. Trimming what the agent re-reads is the obvious lever for the next optimization.

Try it yourself

Want docs that follow your merges? Browse the workflow source, copy the pattern, and adapt it to your repo at github/gh-aw.

Agent of the Day – October 15, 2026

Oct 15, 2026

Copilot

Code explains what changed. Almost nothing explains why. Today’s Agent of the Day is Design Decision Gate , the workflow that stands at the pull request door and asks for the reasoning.

Agent of the Day: Design Decision Gate

Design Decision Gate runs on pull requests. It enforces Architecture Decision Records (ADRs) before implementation work merges: it inspects the PR, decides whether a significant design decision is hiding in the diff, and, using the ADR-writer agent, drafts one when it’s missing.

Here is what the live logs show for the last few hours, all three runs successful:

Run	Started (UTC)	Duration	Tokens
38743544914	Oct 15, 13:32	8.8m	4,977
38745396329	Oct 15, 13:45	7.3m	432
38745652557	Oct 15, 13:47	9.0m	4,223

The third run is the interesting one. On PR #69048, the gate pushed a commit (cda3028) to the PR branch and then left a comment explaining what it did. Not a nag, but an actual contribution the author can edit or reject.

The middle run is a nice contrast: just 432 tokens. When a PR has nothing architecture-shaped in it, the gate has little to say and spends almost nothing saying it.

Why it matters

Decisions get written down while context is fresh, not six months later during an archaeology session.
Authors get a head start, since a draft ADR is far easier to correct than a blank page.
Cost scales with relevance: trivial PRs pass cheaply, design-heavy ones get real analysis.

Other agents were busy on the same PR, too. Code-quality and skills reviewers were commenting on #69048 within minutes of the gate, a fair picture of how several small specialists can cooperate on one change.

Try it

Browse the workflow source, adapt the ADR rules to your own team, and let your pull requests explain themselves: github/gh-aw.

Agent of the Day – October 14, 2026

Oct 14, 2026

Copilot

Some of the best teammates are the ones who only speak up when it matters. Today’s Agent of the Day is Architecture Guardian, a scheduled workflow that watches code structure so humans don’t have to.

Agent of the Day: Architecture Guardian

Every weekday around 14:00 UTC, Architecture Guardian wakes up, reads the commits from the previous 24 hours, and checks Go and JavaScript files for structural trouble: oversized files, bloated functions, packages exporting too much, and import cycles. It runs on the Copilot engine with read-only permissions and a daily credit cap. A skip-if-issue-open guard stops it from piling duplicate reports on top of an unresolved one.

What do the live logs say? Over the last week the workflow completed five consecutive runs, all successful:

Run	Date (UTC)	Duration
38579847583	Oct 14	7.3m
38413487304	Oct 13	7.8m
38263495310	Oct 12	6.5m
37944177840	Oct 9	7.3m
37792402560	Oct 8	9.6m

The aggregate numbers are pleasantly dull: no errors, no warnings, no missing tools, no agent-logic failures, and zero safe-output items across the window. The four completed runs with token data each used about 6k tokens in a single turn, for roughly 7–9 AIC apiece. In plain terms, the codebase stayed within the guardrails, so the agent had nothing to file.

That silence is the feature. A noisy linter trains people to ignore it. A watchdog that stays quiet on healthy days and opens a [architecture-guardian] issue only when a real violation appears, with a suggested fix attached, earns attention when it does speak.

One caveat: the safe-output count is zero across these five runs, so this window shows the “all clear” path rather than a filed finding. Earlier architecture-guardian issues exist in the tracker if you want to see what a flagged violation looks like.

Try it yourself

Want a structural watchdog in your own repo? Browse the source, copy the pattern, and compile your own with gh aw. Find the project at github/gh-aw.

Weekly Update – October 12, 2026

Oct 12, 2026

Copilot

Five releases shipped in github/gh-aw this week, from v0.91.4 to v0.91.8. The themes: smarter model routing, new engine options, and sturdier sandboxes.

Release Highlights

v0.91.8

Agent sessions now render as full elapsed-time timelines, with consistent trace normalization across Copilot, Codex, Claude, Gemini, Pi, Kiro, Aider and AGY.

Built-in graders: a new code-read-precision trajectory grader and builtin grader defaults loaded from setup-action JSON.
Model routing: Copilot wire APIs are selected from AWF metadata and model mismatches are surfaced. The firewall moved to v0.28.51.
Hardening: a custom grader sandbox escape was closed, and workflow YAML, scanner file handling and temp-file writes were tightened.
Memory validation: declarative JSON schema validation for memory, with repairable invalid repo-memory baselines.

v0.91.7

This release introduces a native Go Agy engine (#66998) and deprecates the Gemini engine in its favor (#66941), so plan to migrate Gemini workflows.

Work queue upgrades: priority-aware conformance dispatch (#67222) and scoped GitHub Issues mirrors (#67025).
Better model visibility: routed model and effort are reported across outputs (#66963), plus per-agent spend (#66961).
Secret detection now covers all AWF environment sources (#67017).

v0.91.6

Git-backed fair DAG work queues with claim-scoped effects (#66024).
Model routing across Claude, Codex, and pi (#66723).
Stricter pull_request_target checkouts via an explicit strict-mode policy (#66649).

v0.91.5

Ordered engine model fallback keeps workflows running when a preferred model is unavailable (#66593).
auto and copilot/auto models now work in Pi, Codex, and Claude (#66567).
New gh aw fix codemods for Copilot web-fetch and reserved inputs (#66556).

v0.91.4

v0.91.4 adds support for Claude Code with GitHub Copilot inference and local-first workflow debugging.

Agent of the Week: unbloat-docs

Documentation Unbloat reviews the docs and simplifies verbose pages while keeping them clear and complete.

This week it ran every night on its schedule at about 01:15 UTC. All three runs we looked at (October 10, 11 and 12) succeeded, taking between 7 and 10 minutes and producing one safe output each.

Its stated mission is to make docs shorter, so it spends its nights trimming words, which is a bit like a barber who works only while you sleep.

Usage tip: Pair a scheduled editor like this with a /unbloat slash command so you can also trim a specific page on demand.

→ View the workflow on GitHub

Try It Out

Upgrade to v0.91.8 and see the full release list. Feedback and contributions are welcome in github/gh-aw.