Comparing changes

## Summary Raise the OpenCode kit OpenAI-compatible adapter SSE idle timeout from 120000 to 300000 ms, retaining the separate 600000 ms total request limit. Add fresh-install, renderer-owned upgrade, historical legacy migration, and repeated-render regression coverage. Document the distinction and longer stalled-stream detection time. ## Motivation and live evidence Repeated Astra report-generation attempts under OpenCode 1.18.32 failed with `SSE read timed out` approximately 120.5–120.7 seconds after stream start. After applying 300000 ms and refreshing/reloading the runtime, the previously stalled agent completed its report without another observed SSE timeout. One separate upstream connection-termination error before headers was observed. This is supporting live evidence, not a controlled causal proof or a live OpenCode v2 test. Independent source review confirmed that the kit-pinned v2.0.30 supports the same settings (SSE event idle timeout versus total deadline). ## Plan and related work Based on current main including #530. That epic increment moved config ownership into the OpenCode kit renderer, so the change belongs there rather than in the retired USAi config template. Refs: #357. Checked open #495: its catalog/default-emitter work does not touch these files. Historical production fixture and legacy ownership fingerprint remain unchanged. ## Eligibility & Accountability Human author of record to confirm before marking ready: - [ ] Federal employee or contractor eligibility attested. - [ ] Understands and accepts accountability for the change. - [ ] Attests right to release under CC0-1.0. ## AI Assistance Disclosure - [x] AI-assisted: OpenCode (gpt-6-astra) implemented and verified the change; separate OpenCode (gpt-5.6-terra) adversarial review returned no blockers, including a final delta review. - [ ] Independent human review completed. ## Type of Change - [x] Bug fix - [x] Documentation update ## Testing / verification transcript Observed in the development sandbox on 2026-10-23 UTC: | Check | Result | | --- | --- | | Targeted regression before implementation | Failed as expected: old 120000 value | | `make validate` | PASS: 47/47; existing advisory documentation/allowlist warnings | | `make validate-kits` | PASS: 11 kits + 2 templates | | `make validate-provider-input-contract` | PASS: 3 bundles | | `make test-kits` | PASS: 57 OpenCode + 14 USAi kit + 20 Paseo + 103 catalog/emitter tests | | `make test` | PASS: 667 tests, 140.53 seconds; initial 120-second tool deadline was insufficient | | `node --check` on changed JavaScript files | PASS | | Direct Markdown library lint of README | PASS: 1 file, 0 errors (default rules with MD013 disabled); normal CLI selection excludes kit README | | `git diff --check` | PASS | | Full diff review for secrets | PASS; no secret values added | | `pre-commit run --files ...` | BLOCKED during hook environment setup: pip CA bundle raised X509 NO_CERTIFICATE_OR_CRL_FOUND | Initial new test incorrectly required byte-identical repeated output; existing renderer changes key ordering, so the final test checks parsed semantic equality while asserting both timeout values. Full kit suite then passed. No hook or CI bypass was used. No dependency changes; no separate compilation step applies. CI lint/security checks remain required before readiness/merge. ## Safety Checklist - [x] No secret values, PII, CUI, customer data, or internal endpoints added. - [x] No auth, permission, credential, egress, or ownership-policy changes. - [x] Neutral provider input contract unchanged. - [x] Existing tests retain fail-closed ownership protections. ## Security impact and rollback Availability tradeoff: genuinely silent streams can take three additional minutes to fail; the ten-minute total request bound remains. Revert this commit to restore the two-minute idle limit, rerender config, and reload the runtime. ## Reviewer notes Draft pending CI and human review. Existing renderer/test files exceed the file-size guideline (812/870 lines); the production behavior change is one value plus explanatory comments, with no architectural refactor. New test is under 50 lines. Confirm timeout behavior on the kit-pinned runtime when performing live deployment verification.

## Summary Improve Paseo kit startup diagnostics, UI artifact lookup, guest CLI discovery, and cold-start root initialization while preserving exact UI readiness checks and genuine restart recovery. ### Approved plan / changes - Opt-in `PASEO_KIT_TIMING=1` fixed-label, numeric guest-uptime records; an environment-only diagnostic overlay enables startup and attach together. Normal kit consumers remain uninstrumented. A dedicated timing log avoids collecting daemon output. - Resolve the installed CLI/server package for the exact Brotli artifact before the compatibility filesystem search. Prefer the per-user installation even when absent from inherited PATH; preserve exact byte comparison. - Publish a managed `~/.local/bin/paseo` symlink on startup/resume. Preserve foreign destinations; repair only links matching the kit's target receipt. - Before npm work, optionally seed an absent config from physical guest `ACQ_WORKSPACE` through the existing config lock. Initialize-only never overwrites an existing config entry. Existing attach/root-change restart behavior remains; cold initialization is opportunistic, with no launch-ownership claim. - Run the existing health stage on both root-result paths, followed by unchanged UI validation: 30 health attempts, initial UI probe plus 60 retries, existing sleeps/predicates. Detached exit zero remains distinct from readiness success. Lifecycle rationale: `integrations/isolation/acq-kits/paseo/docs/decisions/supervisor-owns-daemon-wrapper-pins-worktrees.md`. ## Eligibility & Accountability Human attestations remain for the author of record: - [ ] I am a federal employee or contractor. - [ ] I understand this change and can explain it in my own words. - [ ] I attest I have the right to release this work under CC0-1.0. ## AI Assistance Disclosure - [x] OpenCode AI assisted investigation, implementation, tests, documentation, and PR preparation. The human approved each lifecycle scope and performed real host validation. - [x] A separate adversarial AI review covered the entire accumulated PR and the upstream integration; reported blockers were resolved and re-reviewed clean before push. - [ ] Independent human code review completed. Required before merge; not claimed here. ## Type of Change - [x] Bug fix - [x] Enhancement to existing integration - [x] Documentation update ## Motivation and observed host evidence User-run MSB measurements used the local kit and sanitized fixed-format timing collection. Quickstart probe changes and ignored local artifacts are not included in this PR. | Observation | Evidence / limitation | |---|---| | Artifact lookup | 4.850s before the fast path; 0.010s in the isolated artifact-only comparison, later below the 0.01s clock resolution. Exact UI checks passed. This supports a lookup-stage improvement, not a total-startup claim. | | CLI availability | Bare nonlogin exec, login Bash, and interactive Bash resolved the public link to the kit CLI and reported 0.12.0. Visibility persisted after warm restart. Warm daemon readiness and skipped Paseo installation were not proven by those commands. | | Failed intermediate seed-only run | Root was unchanged and no restart occurred, but installation took 67.70s. Skipping the old restart branch also skipped its health allowance: UI polling exhausted before daemon launch. Exit zero was **not** a readiness pass. | | Corrected final run, 2026-10-23 19:05 UTC | `root_unchanged`; no restart/fallback markers; health wait 6.03–33.40s succeeded; every UI check succeeded, `ui_wait_end rc=0` at 33.54s. Install 26.96s, config 2.27s, launch-to-health 2.66s, full UI stage 0.14s. | The corrected run verifies the two-stage control flow; it does not replay the earlier 67-second install workload. Its total was 96.496s, including 38.901s pre-create activity with prompts, so it is not a comparable total-speed result. Installation variability remains unexplained. A separate earlier run that still showed fallback is not conflated with the final verified run. **Revision boundary:** these live observations cover the completed 59-test implementation before incorporating latest main. This branch now builds on `a1206c5`, preserving upstream pre-boot lock reconciliation from #488. Its isolated test entry remains before timing/seed initialization. The combined tree passed local tests and fresh adversarial review; it has not had another real MSB host run. Narrow quoting/JS-output adjustments make the upstream section ShellCheck-clean without changing its output. Paseo remains pinned to 0.12.0. Initial comparisons confirmed the old pinned kit source and initial worktree base matched before instrumentation. ## Testing / verification transcript - [x] `make test` — **667 passed** on the upstream-integrated tree. - [x] `TMPDIR=/tmp/opencode node --test 'integrations/isolation/acq-kits/paseo/tests/*.test.mjs'` — **63 passed**, including 59 implementation tests and 4 upstream reconciliation tests; rerun after final lint adjustments. - [x] `make validate validate-kits scan-shell generate-check` — all validators passed; 11 kits + 2 templates valid; unsafe-shell scan 0 errors/0 warnings; INDEX.yaml and CATALOG.md current. Existing unrelated documentation/network advisory warnings remain. - [x] `shellcheck -x -P integrations/isolation/acq-kits/paseo/files/home -s sh` on startup, shim, and timing helper — clean after final adjustments. - [x] `sh -n` on startup/shim; `node --check` on root helper; `git diff --cached --check` — passed. - [x] Explicit Python `jsonschema.validate` of the nested timing overlay against `schemas/kit-hybrid-v1.schema.json` — passed. The standard kit scanner does not discover the nested overlay. - [x] Sensitive-term validation plus staged-diff secret/token/password/private-key pattern review — no credentials found in added content. Gitleaks and shfmt were unavailable; no independent Gitleaks scan or formatter pass claimed. - [x] Real host scenarios above, performed by the human; no MSB service was run in the coding sandbox. Tests cover opt-in gating/labels, phase ordering/status, nested/hoisted and off-PATH package layouts, large truncated bundles, link ownership and failure handling, version-match startup, locked initialization orderings, invalid homes/config entries, and exhausted readiness budgets versus exit status. ## Safety and security impact - [x] No secrets, real PII/CUI, customer data, internal endpoints, or host project paths added. - [x] No new dependencies, version changes, listener/port/egress policy changes, or authentication changes. - [x] Timing contains fixed labels and numeric fields only; collection still must allowlist complete records. No raw environment, command arguments, or daemon output is retained by instrumentation. - [x] Exact UI checks and real failure fallback are preserved. Cooperative config locking is retained; no claim of exclusive control over manual launchers. ## Rollback Revert this PR and reapply/recreate the sandbox with the previous kit. Omit the diagnostic overlay to disable timing immediately. Existing guest logs, seeded config, and a managed CLI symlink are persistent guest state; reverting source does not erase them. Recreating a disposable guest restores the prior lifecycle without deleting user project data. Do not remove unrelated CLI links or reset existing worktree settings automatically. ## Reviewer notes - Code-owner review and CI remain required; neither human approval nor completed CI is claimed. - Startup is now about 507 lines after integration of upstream reconciliation (already a large inline function); `ui_ready` slightly exceeds the 50-line guideline. Kept the lifecycle in its existing file and exact predicate together to avoid an unrelated refactor during this measured change. - INDEX covers patterns; no pattern inventory change was needed. - No related issue is claimed closed. #488 is an already-integrated prerequisite, not work implemented here.

## Context Updates the opt-in Paseo acq kit to install and match `@getpaseo/cli` version `0.13.0`. Paseo 0.13 changed `paseo daemon status --json` to report a direct `"localDaemon": "running"` value, so the kit verifier now accepts that format. ## Plan - Update both runtime version pins. - Align warm-resume fixture versions with the new pin. - Extend the live verifier for the Paseo 0.13 daemon-status response. - Add regression coverage for accepted and rejected status shapes. ## Verification | Command | Result | | --- | --- | | `node --test 'tests/**/*.test.mjs'` in `integrations/isolation/acq-kits/paseo` | Passed: 65 tests |\n| `bash -n scripts/verify` | Passed |\n| `python3 integrations/isolation/acq-kits/validate-kits.py --strict` | Passed: 11 kits and 2 templates |\n| `make validate` | Passed; existing advisory sensitive-term and allowlist warnings only |\n| `make test` | Passed: 667 tests |\n| `git diff --check` | Passed |\n| Independent adversarial review | No blockers found |\n| `RUN_ACQ=1 ./scripts/verify` | Passed end-to-end against Paseo 0.13: all checks passed, including step 5a local CLI discovery, host-port delivery, daemon self-healing, and project registration. The local offline schema subcheck skipped because the host Python environment lacks `jsonschema` and `pyyaml`. |\n\n## Rollback\n\nRevert commits `6f45a12` and `2513386` to restore the prior `0.12.0` pin and status parser.\n\n## Security Impact\n\nNo authentication, authorization, data-handling, or attack-surface change. This updates the pinned upstream CLI package and its verifier compatibility only.\n\n## AI Assistance\n\nOpenCode, an AI coding agent, prepared this change. A human reviewer must review and approve before merge. --------- Co-authored-by: OpenCode Agent <[email protected]>

…utral catalog (#542) ## Summary Carries `reasoning` and input-modality metadata through the USAi catalog, the neutral model catalog (`acq-neutral-model-catalog/v1`, additive optional fields), and the OpenCode kit's rendered provider config. Unknown stays absent; `false` and text-only are preserved; nothing is inferred from model names. Builder emission from models.dev is opt-in (`--include-capabilities`) and **no capability values are committed** until a live verification is recorded. Prime Agent work is out of scope. Refs #366 (follow-ups #539, #540, #541). ## Context OpenCode 1.x (v1.18.35): a config-defined model with no `modalities` resolves to image=false. The kit's old fallback (`npm install -g opencode-ai`) resolved to 1.x. OpenCode 2.0.30 defaults an unlisted model to text+image. Explicit modalities make behavior version-independent. A live run (OpenCode 2.0.30, 24 USAi models, no modality metadata) found 20 of 24 read a synthetic image (9 exact, 11 with misread characters), 1 refused on policy grounds, 3 unavailable or unusable; an explicit `["text"]` override made the two retested models refuse images. Single samples: these are not a root-cause claim for the reported failure, and no values are committed from them. See ADR 0006. ## Changes - Builder (`integrations/providers/usai/scripts/build-catalog.mjs`): opt-in capability enrichment; malformed upstream entries warn and are treated as unknown. - Schemas: additive optional model fields in the USAi and neutral schemas (no version bump; old renderers ignore unknown model keys, old validators reject them, which is documented as a rollout requirement). - Normalizer and OpenCode renderer: validated, fail-closed translation; renderer emits no effort or variants. - ADR 0006 (proposed), synthetic-image validation procedure, README updates. - Tests: source-to-render fixtures, allowlist-equality, guard against committed unverified capabilities in the catalog, shipped snapshot and schema fixtures. ## Verification - `node --test`: providers/usai 120+, opencode kit 62, usai-provider kit 18 (all pass). - `pytest scripts/tests/test_provider_input_contract.py`: 204 passed. - `make validate`, `make generate-check`: pass. - Independent adversarial review: no blockers; 3 majors and minors fixed and re-reviewed. ## Rollback Revert this PR; the committed catalog and snapshots carry no capability fields, so nothing else depends on it. ## Security impact No auth, credential, or network changes. The renderer fails closed on out-of-allowlist modalities or non-boolean `reasoning`. AI-assisted (OpenCode); human review required. ADR 0006 needs CODEOWNERS review per ADR 0004. Co-authored-by: OpenCode Agent <[email protected]>

…st mount (#543) ## Summary Lets a Quickstart MSB consumer run the oci-engine kit's root startup scripts from a host-authoritative read-only mount instead of agent-writable copies (the Patterns side of audit finding G3 under GSA-TTS/agentic-coding-quickstart#503). The oci-engine grant script and storage-driver helper are marked `readonly: true` and passed to the root startup command as whole argv tokens. ## Context A sudo guest can edit the guest-resident files that root re-runs on every MSB heal. Quickstart's read-only mount mechanism (`_acq_msb_stage_readonly_file`, present from v4.0.2) rewrites exact argv tokens to `/var/lib/acq/host/kit-files/...` for kits that opt in, but no shipped kit did. Pairs with the MSB host-recorded `:ro` decision in [Quickstart PR #637](GSA-TTS/agentic-coding-quickstart#637), which removes the guest probe from that decision. If the host fails to stage one of the two files, the pair is mixed and is refused for that boot. ## Changes - `oci-engine`: `readonly: true` on the grant script and storage helper. The root startup command classifies its two tokens together. **Both under `/var/lib/acq/host/kit-files/`** (no `..`): run those files, or refuse (stderr error, exit 1) if either is missing; it never falls back to the root-owned copy. **Both `/home/agent/*`:** the legacy case for a consumer that ignores the flag; it uses the root-owned copy published at create time, as before. **Anything else, including a mixed pair:** refuse. The grant script re-validates the helper it sources as root and refuses a missing selected mount helper. A refusal costs only that boot's device grant and storage re-evaluation; Quickstart reports a failing startup command as a warning and continues. - `readonly` registered in `schemas/kit-hybrid-v1.schema.json`; `validate-kits.py` rejects any value but the literal `true`/`false` and flow-style `command:` lists (the consumer's line-based reader ignores or drops them). - `zscaler-ca-certificate` and `opendesign` are intentionally not marked (reasons in their READMEs): the zscaler cert is staged at start with no create-time root-owned copy to fall back to, and opendesign's only root command is an inline `mkdir`/`chown`. - Loud warnings and `scripts/verify` cover "neither the mount copy nor a published copy exists"; the install phase's trust in `/home/agent` at create time is documented. ## Verification - Full `scripts/tests` (715 passed), `validate-kits --strict`, `make validate`, `make generate-check`, markdownlint on the changed docs. - Offline tests run the real startup body, grant script and install script against a temp tree: missing mount grant, missing mount helper, legacy fallback, mixed and traversal cases. Mutation checks (falling back on a missing mount file, allowing a mixed pair, removing the `..` check, a refusal that exits 0, the grant script accepting `/home/agent`) each fail a test. - Two independent adversarial reviews, then a third round after an external review. Not run: `make ci`, shellcheck, any live msb/sbx sandbox. ## Rollout Needs a Patterns release and a `PATTERNS_KIT_REF` pin bump in Quickstart. Older Quickstart releases (v4.0.0 to v4.0.2) and sbx ignore the flag and use the root-owned fallback, so nothing regresses there. Live MSB check after the bump: argv carries `/var/lib/acq/host/kit-files/...`, no scripts remain in `/home/agent`, device grants and storage driver still apply, a write to the mount fails (EROFS), and an older sandbox with no `:ro` mount takes the fallback with the warning. Also confirm storage is configured before first use now that install no longer seeds `storage.conf` when the flag is honored. ## Rollback Revert this PR. ## Security impact Removes a path where root could execute a guest-writable or create-time copy after the backend had selected the read-only mount. Residual: the install step still trusts `/home/agent` at create time, the root-owned legacy copies are guest-tamperable under `sudo` (so the legacy path is not tamper-resistant, unchanged from before), and the read-only property depends on the backend's mount enforcement. AI-assisted (OpenCode); human review required. Co-authored-by: OpenCode Agent <[email protected]>

…#550) ## Summary The devenv image now installs devenv 2.4.0 from a pinned `nixos-unstable` rev (`DEVENV_NIXPKGS_REV`), while direnv stays on the existing nixos-26.05 pin (`NIXPKGS_REV`). This fixes devenv 2.1.2 ignoring the signing keys of a repo's `cachix.pull` caches, which forces source builds that sandbox egress blocks. `VERSION` goes to `2.1.0`. ## Eligibility & Accountability - [x] I am a **federal employee or contractor** (PRs merge with `@GSA-TTS/agentic-coding-team` code-owner approval; eligibility is attested here, not authenticated). *Anyone may open issues without this.* - [x] **I understand this change and can explain it in my own words** — I am the author of record and accountable for it. - [x] By opening this PR, I **attest I have the right to release this work** under the repository's [CC0-1.0](../LICENSE) dedication. ## AI Assistance Disclosure - [x] AI tools were used in this contribution - [x] I verified all AI-generated content: no fabricated/hallucinated APIs, dependencies, citations, or placeholder content; any AI-suggested dependency was confirmed to exist. - [x] Any inherited/reused third-party material retains its original license and is identified (not represented as public domain). ## Type of Change - [x] Bug fix - [x] Infrastructure/tooling change ## Motivation `devenv-shell:2.0.0` and `devenv-opencode:2.0.0` ship devenv 2.1.2, which has [cachix/devenv#3176](cachix/devenv#3176): it passes an empty `extra-trusted-public-keys`, so Nix ignores every substitute from `devenv.cachix.org` (the `devenv-nixpkgs/rolling` default) and other cachix caches. In a sandbox the resulting source builds fail with `403` from source mirrors that aren't on the egress allowlist; 3 of 5 login.gov repos failed this way on `2.0.0` and all build on `1.0.0`. [cachix/devenv#3178](cachix/devenv#3178) fixed it in devenv 2.3.1, but `release-26.05` still packages 2.1.2. ## Changes - `Dockerfile`: new `ARG DEVENV_NIXPKGS_REV=31ecbaca1bdefa45dffc409f0250bd8039ea0010`, used only for `#devenv`; direnv keeps `NIXPKGS_REV`. The comment records why, that both revs are signed by the `cache.nixos.org` key the image already trusts, and to drop the second pin once the stable branch packages devenv ≥ 2.3.1. - `VERSION`: `2.0.0` → `2.1.0` (devenv stays 2.x, so this is a minor bump under the image contract). - `README.md`: documents the second pin, advises against `2.0.0`, and lists `DEVENV_NIXPKGS_REV` among the toolchain changes that need a `VERSION` bump. Kits that pin tools to `NIXPKGS_REV` to share the image's closures are unaffected; only devenv's closure comes from the second rev. ## Testing - [x] Ran `make validate` locally (all checks pass) - [ ] Ran `make test` (if applicable) - [x] Tested with at least one real scenario - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) format Acceptance criteria from the issue, checked against a `workflow_dispatch` build of this branch ([run 40781422183](https://github.com/GSA-TTS/agentic-coding-patterns/actions/runs/40781422183), which built all four variant/arch images by digest without publishing tags) and an msb sandbox on the arm64 `devenv-shell` digest: - [x] `devenv version` in the image reports ≥ 2.3.1 on amd64 and arm64. arm64: `devenv 2.4.0 (aarch64-linux)` in the sandbox. amd64: the build log installs `/nix/store/yqm4mhvx…-devenv-2.4.0`; `devenv version` itself was not run on amd64. - [x] devenv is substituted from `cache.nixos.org` on both architectures (no source build in the CI log). All four jobs log `copying path '…-devenv-2.4.0' from 'https://cache.nixos.org'` and no `building` lines. - [x] In a sandbox on the new image, a repo that pulls from `devenv.cachix.org` builds its shell with no "ignoring substitute" warnings. identity-idp (which downloads many `devenv.cachix.org` NARs) and data-transformation (which uses `nixpkgs-python.cachix.org`) both build; neither of them, nor identity-devops, logs an "ignoring substitute" warning. Also verified: - `pkgs/by-name/de/devenv/package.nix` at `31ecbaca` declares `version = "2.4.0"`. - `31ecbaca` was the `nixos-unstable` branch head when this PR was opened, so it passed the Hydra channel gate. Known remaining failure, separate from this fix and not a regression: identity-devops fails on arm64 on both this image and `devenv-shell:1.0.0` (devenv 1.11.2), at the same `bash53-001` source fetch. Its lock pins `devenv` and `devenv-nixpkgs` commits from December 2025, and `devenv-tasks-2.0.0` and `python3-3.12.12` for aarch64-linux at those revs are in none of `cache.nixos.org`, `devenv.cachix.org` or `nixpkgs-python.cachix.org`. Building them pulls in source fetches from `ftpmirror.gnu.org`, which egress blocks. The image trusts and substitutes every path that is cached; a `devenv update` in that repo is the likely fix. ## Safety Checklist - [x] No secrets, API keys, tokens, or passwords included - [x] No PII (names, emails, SSNs, addresses) - [x] No CUI (Controlled Unclassified Information) - [x] No internal URLs, hostnames, or system paths - [x] No customer data or proprietary information ## Validation Results ``` make validate ✓ All validators passed ``` ## Related Issues Closes #549 ## Additional Context Alternatives considered in the issue: backporting devenv ≥ 2.3.1 to `release-26.05` (fixes it at the source, but the timing is outside this repo's control; worth requesting in parallel), baking cachix keys into `nix.conf` (hard-codes keys for caches that individual repos choose), and kit-side workarounds (fixes one consumer at a time).

🤖 I have created a release *beep* *boop* --- ## [1.18.0](v1.17.0...v1.18.0) (2026-10-28) ### Features * **kits:** run oci-engine root startup scripts from the read-only host mount ([#543](#543)) ([94f807a](94f807a)) * **opencode:** carry reasoning and input-modality metadata in the neutral catalog ([#542](#542)) ([918e46d](918e46d)) ### Bug Fixes * **devenv-image:** take devenv 2.4.0 from a pinned nixos-unstable rev ([#550](#550)) ([ae0a921](ae0a921)) * **opencode:** allow five-minute stream idle gaps ([#533](#533)) ([9fe6440](9fe6440)) * **paseo-kit:** improve startup readiness and CLI discovery ([#535](#535)) ([3fcab2d](3fcab2d)) * **paseo:** bump pinned CLI to 0.13.0 ([#536](#536)) ([a290d5d](a290d5d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Navigation Menu

Repository navigation

Comparing changes

Open a pull request

Commits on Oct 23, 2026

Commits on Oct 25, 2026

Commits on Oct 26, 2026

Commits on Oct 28, 2026

Commits on Oct 29, 2026

This comparison is taking too long to generate.

Uh oh!