Commits on Oct 21, 2026

1. ci: run required checks for merge groups (#524) …

   ## Summary
   
   Run the required status checks on GitHub merge-queue commits so approved
   pull requests can leave the queue.
   
   ## Issue resolved
   
   **#523**
   
   - Required checks ran for pull requests but not merge groups.
   - Merge-queue commits waited forever for contexts that never started.
   - PR-title validation depends on pull-request event data unavailable to
   merge groups.
   - Required context names must remain unchanged.
   
   ## Before and after
   
   **Before this PR:** Merge-queue entries waited indefinitely for
   `Conventional Commit Title`, `Python Lint & Test`, and `Pattern
   Validation`.
   
   **After merge:** CI runs required validation on merge-group commits,
   while the title job reports the same required context without invoking
   PR-only logic.
   
   ## Verification
   
   - Workflow YAML parses successfully
   - Required context ownership verified: `ci.yml` owns Python and Pattern
   checks; `pr-lint.yml` owns title check
   - Merge-group event context and concurrency behavior reviewed
   - Independent adversarial review: PASS, no security findings
   - Live merge-group execution will be proven by requeueing
   #522
   
   ## Security impact
   
   Permissions remain read-only. Actions remain SHA-pinned. The merge-group
   no-op emits a static string and receives no token environment.
   
   ## Relationships
   
   Fixes: #523
   Unblocks: #522
   Related epic: #357
   
   ## Rollback
   
   Revert this PR to remove merge-group workflow triggers.
   
   AI-assisted by OpenCode. Human review required.

   

   mogul authored Oct 21, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for d345c5c
   • Browse repository at this point

   Copy the full SHA

   d345c5c View commit details

   Browse the repository at this point in the history

2. feat(isolation): support backend-supplied provider roots (#522) …

   ## Summary
   
   Version the provider-input contract so sandbox backends can supply their
   proven read-only root without changing the provider-relative layout.
   
   ## Issue resolved
   
   **#521**
   
   - Preserve the released v1 schema and fixed path unchanged.
   - Add a separate v2 schema with `models/providers/<providerId>`.
   - Provide an explicit host-validator CLI for staged external bundles.
   - Define fail-closed backend obligations and authoritative-empty
   semantics.
   - Keep runtime mount/consumer implementation in the Quickstart backend
   layer.
   
   ## Before and after
   
   **Before this PR:** Provider bundles required one fixed absolute guest
   root that MSB could provide but current SBX could not.
   
   **After merge:** Version 2 preserves a stable provider-relative path
   beneath a backend-supplied read-only root, while version 1 remains
   byte-compatible for existing consumers.
   
   ## Verification
   
   - Provider contract tests: 168 passed
   - `make validate-provider-input-contract`: passed
   - `make validate`: passed
   - `make generate-check`: passed
   - `make test-kits`: passed
   - Ruff format/lint and `git diff --check`: passed
   - Independent adversarial reviews: all blockers resolved
   
   ## Security impact
   
   The mandatory host validator retains strict JSON, path containment,
   symlink, executable, credential-binding, URL, duplicate-provider, and
   cross-field checks. Schema and credential-binding inputs must come from
   trusted pinned/backend control-plane sources. Rejected candidates fail
   provisioning rather than becoming an empty provider set.
   
   ## Relationships
   
   Fixes: #521
   Parent epic: #357
   Unblocks: GSA-TTS/agentic-coding-quickstart#600,
   GSA-TTS/agentic-coding-quickstart#606, and
   #516
   
   ## Rollback
   
   Revert both commits in this PR. The released version 1 schema remains
   unchanged throughout.
   
   AI-assisted by OpenCode. Human review required.
   
   ---------
   
   Co-authored-by: OpenCode Agent <[email protected]>

   

   mogul and OpenCode Agent authored Oct 21, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 78d88e4
   • Browse repository at this point

   Copy the full SHA

   78d88e4 View commit details

   Browse the repository at this point in the history

3. chore(main): release 1.16.0 (#526) …

   🤖 I have created a release *beep* *boop*
   ---
   
   
   ##
   [1.16.0](v1.15.0...v1.16.0)
   (2026-10-21)
   
   
   ### Features
   
   * **isolation:** support backend-supplied provider roots
   ([#522](#522))
   ([78d88e4](78d88e4))
   
   ---
   This PR was generated with [Release
   Please](https://github.com/googleapis/release-please). See
   [documentation](https://github.com/googleapis/release-please#release-please).
   
   Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

   

   github-actions[bot] authored Oct 21, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 8e1f1ef
   • Browse repository at this point

   Copy the full SHA

   8e1f1ef View commit details

   Browse the repository at this point in the history