[pelikhan]

Summary

Upgrade available stable engine SDKs/CLIs and regenerate all 15 workflow locks with gh-aw v0.92.6. Preserve configured models, retry limits, credential isolation, and sandbox policies.

Component	Before	After
Copilot SDK (repository and standalone skill)	1.0.22	1.0.24
Copilot CLI (all workflow pins)	1.0.98	1.0.101
Anthropic SDK	0.129.0	0.133.0
Gemini CLI	0.63.0	0.64.0
gh-aw compiler/actions/cloud setup	0.92.5	0.92.6

Codex SDK/CLI 0.162.1, Pi 1.2.0, and DeepSeek SDK/runtime 0.2.0-rc.2 remain pinned because newer stable/RC versions were unavailable from the approved npm feed. Avoid unstable or older latest tags.

Integration fixes

• DeepSeek: repair the permission-preset startup failure from run 39624657417. Define matching named workspace-write/never and read-only/never presets. Disable automatic session-title inference, which adds a hidden provider request. Exercise the actual headless CLI followed by exactly three SDK judgments against a loopback fake gateway.
• Codex: replace the compiler-rejected tools.bash: false declaration with explicit native features.shell_tool = false, preserving shell disable without claiming an unsupported gh-aw command allowlist. Assert the effective generated override.
• Copilot: restore checkout dependencies with pre-agent npm ci after compiler SDK provisioning, before the custom driver loads. Assert generated installation/restore/execution ordering.
• Diagnostics: retain provider exceptions as failed-judgment error causes without retries. Pi tests verify authentication errors survive real launcher/extension boundaries.
• Update focused documentation; exclude incidental first- and third-party skill repins.

Verification

• Typecheck, lint, and whitespace checks pass.
• All 714 unit tests pass across 26 files.
• All 15 workflows compile strictly with shellcheck; one pre-existing monthly fixed-time schedule warning remains. The updated Copilot integration compiles separately without warnings.
• The sample suite has 483 failures / 218 passes. An isolated archive of unchanged HEAD reproduces the identical 483 failures / 218 passes: existing sample-length and stdin-root contract failures are outside this change.
• Read-only safety review found no confirmed new vulnerabilities; incidental skill updates raised as a scope concern were removed.

Remaining uncertainty

No hosted workflow was dispatched. Pi's historical hosted root cause remains unverified because the old fixture hid the provider exception behind Missing or invalid clarity judgment; the new cause makes the next failure actionable. Copilot's historical MCP protocol error also needs hosted evidence to confirm recovery after the CLI/compiler upgrade. Local fake-gateway checks do not establish live compatibility.

The all-workflow diagnostic dry-run gate is blocked by the existing monthly fixed-time schedule warning. Compilation and this draft PR do not grant live-test authorization.

[github-actions]

🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills...