Nightly Build (v0.10.7-nightly.202609120622.174dca012)
Changes since v0.10.7-nightly.202609110625.5f09e04de:
d8840a8 Dispatch path refs on the ref as given, not slash-trimmed
b0bef6b Accept /et// paths in every repo-ref command
b070c9a fix: filter the vote's environment exactly when a directory is named
b377666 fix: close the two residual misroutes the risk rationale names
63e829f fix: take the vetoed target from the URLs the vote already resolved
cf891fb refactor(enable): only prompt for the checkpoint remote on first setup
b07a1c3 fix: resolve push URLs with git's repo-selector variables removed
859c824 fix: read a vetoed store's refs from the push destination, and keep origin uncertain
2fbff44 fix(doctor): suggest a summary provider that is actually installed
f15fe69 Report each agent's smoke verdict on its own step
d62b741 Catch hash comparisons on either side of the operator
83fc621 Use Equal for every plumbing.Hash comparison, and guard it
21bf9f3 ci: skip the SARIF upload on fork PRs, as the predecessor workflow did
65f0e29 Compare carry-forward hashes with Equal, not ==
c394f11 fix(doctor): honour the loader's local-layer verdict, isolate the tests
5569790 fix(doctor): make the summary-provider remedy runnable and layer-correct
1f88676 simplify: fold the one-const httputil package into auth
899265d auth: mint jurisdiction tokens through auth-go's sts client
de8555f coreapi: pin that the cross-juris exchange refuses a redirected POST
6d85468 deps: bump auth-go for the cross-host redirect and TLS-downgrade guards
97e2f3c Remove retired semantic search gate wording
2a6fbef Count a Codex child's API calls from its usage snapshots
077c948 fix(enable): address checkpoint destination picker findings
adc64ce fix: align the fetch-side ownership vote with the push side
7734d64 fix: a miss on a vetoed store's target is absence, not a transport failure
eaaf7d0 Only force-close Codex turns for a verified child rollout
412e864 fix: include origin's push destinations in the ownership vote
c3fa758 Revert "share the git transport shim" (keeps the review fixes)
e37982a fix(testutil): refuse shell-injectable input to the git transport shim
54f6f13 fix: vote with the read candidate's push destinations too
712c5f3 test: pin the inherited-veto mechanism and share the git transport shim
e176520 fix(status): report the dedicated read source when the election fails
bbd6e98 fix(status): treat an unresolvable read source as unknown, not as the elected remote
47c7d75 coreapi: make ListReposOutputBody.candidatesIncomplete optional too
2e495c2 fix(status): name the read source when the election fails open
e4cfdae repo protection: add sends a level only when the flag was given
afd5417 fix(status): scope the unpushed count to the elected destination
0eedf94 fix(status): do not call push URLs the checkpoint read source
a09a214 fix(status): keep read source and local-only count when pushing is off
cefc54d review: name the explicit checkpoint remote and cover the pinned case
4c8a484 fix(explain): name the supported agents for an unusable summary provider
44ce975 fix(codex): preserve child evidence and constrain rollout reads
14295ee build(deps): bump the go-dependencies group across 1 directory with 3 updates
a529dc2 fix(status): retain remote diagnostics when pushing is disabled
5a23285 fix(doctor): limit fanout warnings to selected checkpoint remote
325483e fix: prefer Entire's own signal, and bind the install to the prompted repo
7efb51f fix: name the on-demand prompt's source, and correct the EOF claim
c827855 fix: propagate a signal that reached only the plugin
190b656 fix: handle Close on the two writable handles that discarded it
99eda5c ci: make the CodeQL advanced setup correct and self-consistent
d4f783d ci: read the golangci-lint version from mise.toml
4ce53ca fix: report an unrunnable managed plugin, and stop echoing plugin arguments
c11a79f docs: state the Go 1.27.1 requirement, and be honest about ignore-tests
e75b832 build: bump Go to 1.27.1 and golangci-lint to 2.13.2
9411294 Update CodeQL workflow to remove unused languages
135aac0 fix: address review findings on on-demand plugin installation
05023e7 repo protection: an empty list needs a positively native provider
4227aa4 coreapi: pin the read-model required-field loosenings
8f76772 coreapi: refuse to empty a security list, and say what the loosenings claim
1024f14 repo protection: look up the repo only for an empty rule list
82a7711 fix(enable): validate saved checkpoint destination eligibility
9612ca1 feat(enable): select checkpoint push remote during setup
bbbf523 repo protection: say what an empty list means on a GitHub mirror
63a5798 coreapi: loosen the other new read-model fields the client never reads
c0bb11d repo: add the branch-protection subtree
69af387 coreapi: regenerate the client from the current core spec
92baa1d fix: honor configured checkpoint fetch timeout
aa41e62 fix: preserve selected remote when fetching checkpoint refs
6cd08c4 fix(status): report disabled checkpoint pushing
270d17b fix: close plugin confirmation input exactly once
7b26295 fix: preserve plugin prompt streams and cancellation
d71fd27 test(doctor): cover omitted checkpoint remote setting
7a15f32 fix(doctor): respect explicit checkpoint remote selection
5c185dd feat: install missing Graph plugin on demand
99268bb fix(codex): make rollout byte guard overflow-safe
db89972 fix(codex): close subagent tracking edge cases
f586632 fix(codex): track current subagent rollout evidence
edc1289 fix(codex): preserve concurrent child evidence
068d374 refactor(codex): simplify subagent tracking
62ba0a6 fix(codex): harden subagent checkpoint tracking
863faec fix(codex): skip empty fallback scans
a5d4e24 fix(codex): guard exact usage completeness
366fe69 fix(codex): clear stale session-end evidence
bc470d8 fix(codex): retain multi-turn child evidence
271b7f5 fix(codex): address subagent tracking review findings
32cb75e test(codex): verify subagent tracking integration
e5c44df feat(codex): reconcile subagents with exact accounting
03ebe34 feat(codex): add authoritative subagent tracking foundation