Highlights

GitLab runs now send GITLAB_TOKEN only to the run's own GitLab host, and some setups need a change on upgrade. The run stops before setup in these cases: a local fullsend run --forge gitlab with none of FULLSEND_GITLAB_URL, GITLAB_API_URL or CI_SERVER_URL set (set FULLSEND_GITLAB_URL to your instance's https URL, or https://gitlab.com); a GitLab URL that is http:// for a host other than localhost, 127.0.0.1 or ::1 (use the https URL); and a provider profile that uses YAML merge keys (<<), alias keys, duplicate keys or more than one document (write each key out once, one document per file). Agents that call GitLab under another host name no longer receive the token, and the run log lists the hosts removed. Scaffolded GitLab CI jobs set the URL for you and need no change, but they now fail on an unpinned CI_SERVER origin. See the Upgrading table in the fullsend run docs.

Jira agents can run on a service account's OAuth 2.0 client credentials. Set FULLSEND_JIRA_CLIENT_ID and FULLSEND_JIRA_CLIENT_SECRET instead of FULLSEND_JIRA_TOKEN, and fullsend run mints the sandbox's Jira token itself through a new built-in jira provider, refreshing it before it expires. The client secret never enters the sandbox, and the minted token is read-only and limited to the run's own Jira site. Minting needs tracker.jira.base_url and project, and cannot run with --offline or a custom tracker.jira.api_url. The built-in triage and code agents in agents v0.56.1 use the jira provider and accept either credential; static-token setups keep working unchanged. The provider name jira and profile id fullsend-jira are now reserved: an existing local definition under those names gets a warning and still takes precedence. The agents' jira-ro provider and profile are deprecated, so custom harnesses that list them should switch to jira before the next release.

Repositories can tighten command scanning by committing .tirith/policy.yaml. fullsend reads it from the trusted base commit, and tirith merges it as tightening only: block rules, approval rules and network denies, never allowlists or a bypass. It is enforced under Claude Code and Codex; under pi it is best effort. No repository policy applies yet to GitLab merge request runs or to GitHub review checkouts without the base commit; those runs use tirith's baseline and log a note. The sandbox also moves to tirith 0.5.0, and the hook now runs the scanner offline in an environment it builds.

Also in this release: issue transitions work the same way across trackers; github setup, github set and the token-scope checks follow GITHUB_API_URL for GitHub hosts other than github.com (no change on github.com); triage marks an issue as a duplicate only of an open issue; GitLab CI jobs skip the CLI download when the runner image already has the pinned release; and pi sub-agents keep, and are capped at, the parent's MCP and tool permissions.

Changelog

Features

• 7fbb9ce: feat(#9220): mint the sandbox Jira token from client credentials (@jwm4)
• 81769d5: feat(#9486): let a repository tighten tirith scanning with .tirith/policy.yaml (@fullsend-ai-coder[bot])
• a5bfb6a: feat(issues): add tracker-neutral issue transitions (@ederign)

Bug Fixes

• 8ee4a79: fix(#9039): honour GITHUB_API_URL in github setup and github set (@fullsend-ai-coder[bot])
• efdade2: fix(#9041): honour GITHUB_API_URL in token-scope, reconcile, eval (@fullsend-ai-coder[bot])
• a2a6fcf: fix(#9187): export COMMENT_BODY for GitLab Jira agent runs (@fullsend-ai-coder[bot])
• 1aa500a: fix(#9220): harden the minted Jira provider after review (@waynesun09)
• 9eba775: fix(#9461): bump tirith to 0.5.0 and update real-binary tests and docs (@waynesun09)
• 70b109f: fix(#9461): make the offline and approval tests conclusive, correct the docs (@waynesun09)
• 7ad4a0d: fix(#9461): tirith hook runs offline and blocks approval verdicts (@fullsend-ai-coder[bot])
• d3d8ae5: fix(#9465): fail GitLab agent job on unpinned CI_SERVER origin (@fullsend-ai-coder[bot])
• 4d1872e: fix(#9469): bound total grace wait time and retry only lost dispatches (@waynesun09)
• 5f09b30: fix(#9469): harden dispatch diagnostics and skip teardown summary (@waynesun09)
• 6f1039a: fix(#9469): retry any driver's lost dispatch and refund cut grace (@waynesun09)
• 887dd3e: fix(#9469): share grace window and mark partial waits inconclusive (@waynesun09)
• 4d02080: fix(#9472): classify GitHub server errors as infrastructure (@fullsend-ai-coder[bot])
• 8916a6f: fix(#9480): quote removed endpoints that hold control characters (@waynesun09)
• 1464551: fix(#9481): build tirith's environment and working directory in the hook (@waynesun09)
• c19c9bd: fix(#9481): run the tirith scanner in an environment the hook builds (@fullsend-ai-coder[bot])
• 73750e8: fix(#9481): stop tirith's policy search at the per-call directory (@waynesun09)
• 8841a57: fix(#9487): mask the header credential in place (@waynesun09)
• 4bd7fbe: fix(#9487): redact scheme-prefixed credentials in both redactors (@fullsend-ai-coder[bot])
• 7de9174: fix(cli): harden the per-site Jira profile renderer and docs (@waynesun09)
• c5c13c7: fix(forge): drop the tracker key from the allowlist doc comment (@tpouyer)
• b85ed7c: fix(forge): narrow agent remove's deny-all fallback to used prefixes (@tpouyer)
• 0f1bb2f: fix(forge): resolve the config allowlist the same way in every loader (@tpouyer)
• 0699a6b: fix(forge): validate merged managed agents against the effective list (@tpouyer)
• 20de06d: fix(forge): widen the agent-editing commands to the effective allowlist (@tpouyer)
• 8fa21fb: fix(forge): widen the agent-editing commands to the effective allowlist (@tpouyer)
• a955f13: fix(forge): write only the overlay allowlist in agent add and remove (@tpouyer)
• d0f94cf: fix(gitlab): bind the GitLab credential profile to the GitLab host only (@waynesun09)
• 770a8b5: fix(gitlab): compare CI_SERVER origin parts and run the check on bash 3.2 (@waynesun09)
• e8386cc: fix(gitlab): limit GITLAB_TOKEN profiles to the run's GitLab host (@fullsend-ai-coder[bot])
• 35ec01c: fix(issues): address Jira transition review findings (@ederign)
• 0e52563: fix(issues): enforce transition boundaries and sync docs (@ederign)
• 48f3db8: fix(jira): limit the minted Jira token to the run's own site (@fullsend-ai-coder[bot])
• bdd9b80: fix(runtime): cap pi children at active parent tools (@shanemcd)
• dea4c51: fix(runtime): deny unselected MCP tools in pi children (@shanemcd)
• 25cb102: fix(runtime): fail closed on pi child activation errors (@shanemcd)
• 4240d94: fix(runtime): filter MCP resources in pi parent and child runs (@shanemcd)
• acb8627: fix(runtime): map Claude MCP resources and remove dead child mode (@shanemcd)
• a55448d: fix(runtime): pass mcp__ tool names through the pi tool mapping (@shanemcd)
• fc1c01b: fix(runtime): preserve MCP permissions in pi sub-agents (@shanemcd)
• daf0e60: fix(runtime): preserve callable MCP tools in pi children (@shanemcd)
• 584653d: fix(runtime): preserve inactive pi child permissions (@shanemcd)
• 5bf1eba: fix(runtime): retain implicit pi extension permissions (@shanemcd)
• 3a554cd: fix(runtime): return structured pi manifest rejections (@shanemcd)
• e6c345c: fix(runtime): tolerate delayed pi child tool registration (@shanemcd)
• e4ea267: fix(runtime): translate pi MCP server selectors and hook names (@shanemcd)
• f56e82a: fix(runtime): validate pi MCP selectors before rendering (@shanemcd)

Refactoring

• dda5531: refactor(#9469): drop grace refund and document not-dispatched contract (@waynesun09)
• d23a729: refactor(runtime): share pi MCP resource filtering data (@shanemcd)

Others

• d277dbb: perf(#9251): skip the GitLab CLI download when the image matches the pin (@fullsend-ai-coder[bot])

Agents changes

The fleet agents ship in fullsend-ai/agents v0.56.1; its release notes list the agents changes in this release.

Changelog

Features

• 7fbb9ce: feat(#9220): mint the sandbox Jira token from client credentials (@jwm4)
• a5bfb6a: feat(issues): add tracker-neutral issue transitions (@ederign)

Bug Fixes

• efdade2: fix(#9041): honour GITHUB_API_URL in token-scope, reconcile, eval (@fullsend-ai-coder[bot])
• a2a6fcf: fix(#9187): export COMMENT_BODY for GitLab Jira agent runs (@fullsend-ai-coder[bot])
• 1aa500a: fix(#9220): harden the minted Jira provider after review (@waynesun09)
• 9eba775: fix(#9461): bump tirith to 0.5.0 and update real-binary tests and docs (@waynesun09)
• 70b109f: fix(#9461): make the offline and approval tests conclusive, correct the docs (@waynesun09)
• 7ad4a0d: fix(#9461): tirith hook runs offline and blocks approval verdicts (@fullsend-ai-coder[bot])
• d3d8ae5: fix(#9465): fail GitLab agent job on unpinned CI_SERVER origin (@fullsend-ai-coder[bot])
• 4d1872e: fix(#9469): bound total grace wait time and retry only lost dispatches (@waynesun09)
• 5f09b30: fix(#9469): harden dispatch diagnostics and skip teardown summary (@waynesun09)
• 6f1039a: fix(#9469): retry any driver's lost dispatch and refund cut grace (@waynesun09)
• 887dd3e: fix(#9469): share grace window and mark partial waits inconclusive (@waynesun09)
• 4d02080: fix(#9472): classify GitHub server errors as infrastructure (@fullsend-ai-coder[bot])
• 8916a6f: fix(#9480): quote removed endpoints that hold control characters (@waynesun09)
• 1464551: fix(#9481): build tirith's environment and working directory in the hook (@waynesun09)
• c19c9bd: fix(#9481): run the tirith scanner in an environment the hook builds (@fullsend-ai-coder[bot])
• 73750e8: fix(#9481): stop tirith's policy search at the per-call directory (@waynesun09)
• 8841a57: fix(#9487): mask the header credential in place (@waynesun09)
• 4bd7fbe: fix(#9487): redact scheme-prefixed credentials in both redactors (@fullsend-ai-coder[bot])
• c5c13c7: fix(forge): drop the tracker key from the allowlist doc comment (@tpouyer)
• b85ed7c: fix(forge): narrow agent remove's deny-all fallback to used prefixes (@tpouyer)
• 0f1bb2f: fix(forge): resolve the config allowlist the same way in every loader (@tpouyer)
• 0699a6b: fix(forge): validate merged managed agents against the effective list (@tpouyer)
• 8fa21fb: fix(forge): widen the agent-editing commands to the effective allowlist (@tpouyer)
• 20de06d: fix(forge): widen the agent-editing commands to the effective allowlist (@tpouyer)
• a955f13: fix(forge): write only the overlay allowlist in agent add and remove (@tpouyer)
• d0f94cf: fix(gitlab): bind the GitLab credential profile to the GitLab host only (@waynesun09)
• 770a8b5: fix(gitlab): compare CI_SERVER origin parts and run the check on bash 3.2 (@waynesun09)
• e8386cc: fix(gitlab): limit GITLAB_TOKEN profiles to the run's GitLab host (@fullsend-ai-coder[bot])
• 35ec01c: fix(issues): address Jira transition review findings (@ederign)
• 0e52563: fix(issues): enforce transition boundaries and sync docs (@ederign)
• bdd9b80: fix(runtime): cap pi children at active parent tools (@shanemcd)
• dea4c51: fix(runtime): deny unselected MCP tools in pi children (@shanemcd)
• 25cb102: fix(runtime): fail closed on pi child activation errors (@shanemcd)
• 4240d94: fix(runtime): filter MCP resources in pi parent and child runs (@shanemcd)
• acb8627: fix(runtime): map Claude MCP resources and remove dead child mode (@shanemcd)
• a55448d: fix(runtime): pass mcp__ tool names through the pi tool mapping (@shanemcd)
• fc1c01b: fix(runtime): preserve MCP permissions in pi sub-agents (@shanemcd)
• daf0e60: fix(runtime): preserve callable MCP tools in pi children (@shanemcd)
• 584653d: fix(runtime): preserve inactive pi child permissions (@shanemcd)
• 5bf1eba: fix(runtime): retain implicit pi extension permissions (@shanemcd)
• 3a554cd: fix(runtime): return structured pi manifest rejections (@shanemcd)
• e6c345c: fix(runtime): tolerate delayed pi child tool registration (@shanemcd)
• e4ea267: fix(runtime): translate pi MCP server selectors and hook names (@shanemcd)
• f56e82a: fix(runtime): validate pi MCP selectors before rendering (@shanemcd)

Refactoring

• dda5531: refactor(#9469): drop grace refund and document not-dispatched contract (@waynesun09)
• d23a729: refactor(runtime): share pi MCP resource filtering data (@shanemcd)

Others

• d277dbb: perf(#9251): skip the GitLab CLI download when the image matches the pin (@fullsend-ai-coder[bot])

Agents changes

The fleet agents ship in fullsend-ai/agents v0.56.1-rc.1; its release notes list the agents changes in this release.

Highlights

Jira secrets are now one pair, and this changes on upgrade. Set FULLSEND_JIRA_TOKEN, plus FULLSEND_JIRA_EMAIL for a bot account, before upgrading. fullsend forwards that pair everywhere it needs Jira, including the sandbox's read-only Jira provider. That fixes v0.55.0 Jira-sourced runs that failed at setup with requires static credentials: JIRA_TOKEN when only the new pair was set. The JIRA_TOKEN and JIRA_USER_EMAIL secrets are no longer read, and you can delete them after upgrading. Caller workflows that still pass the old names keep working for this one release, because the names stay declared as ignored inputs; run fullsend repos install to regenerate your callers before the next release removes them. Jira users also get the issue type in CEL triggers, and an optional label that marks when a run starts.

fullsend prepare-artifacts is new: it prepares what a run uploads as its artifact, and config now limits what that artifact publishes. On GitLab, fullsend can provision inference WIF for projects, and webhook activation no longer depends on merge access to the schedule. fullsend repos --verbose shows the API errors that are otherwise withheld.

Sandbox Git checks are stricter on upgrade. A checkout target must keep a real root .git; a bare repository, linked worktree, submodule, symlinked .git, alternates or commondir is refused. Reftable checkouts need Git 2.53 or later on the host. New shallow boundaries made in the sandbox are rejected, as are packed-refs over 32 MiB and .git/shallow over 4 MiB. With feedback_mode: none, a detected repository rejection stops the validation loop.

A few other changes need attention on upgrade. Polling refuses oversized event fields and commands, and skips an event that fails validation. Managed config is rendered in the schema of your pinned fullsend_ref, and readonly_repo is now inherited through base: composition. Runs deny the trace signing key, and check allowed_remote_resources when a fetch can start.

Changelog

Breaking Changes

• 24aed55: docs(#9411)!: note the JIRA_USER_EMAIL replacement and trusted-ref rule (@waynesun09)
• dd7b948: feat(#9122)!: config limits what the run artifact publishes (@fullsend-ai-coder[bot])
• 3fc95b4: feat(jira)!: stop forwarding the JIRA_TOKEN and JIRA_USER_EMAIL secrets (@waynesun09)
• 6f9bc5b: feat(poll)!: bound transported event fields; refuse oversized commands (@tpouyer)
• ec7d132: fix(#7360)!: inherit readonly_repo through base: composition (@gwenneg)
• bcf2940: fix(#8952)!: mint replaces gh enterprise token variables too (@fullsend-ai-coder[bot])
• a3bb602: fix(#9292)!: render managed config in the pinned fullsend_ref schema (@fullsend-ai-coder[bot])
• ec0ada4: fix(cli)!: adjust repository validation retry behavior (@ravelley)
• 397041f: fix(cli)!: check allowed_remote_resources when fetch can start (@tpouyer)
• d0c473b: fix(cli)!: deny the trace signing key in runs (@dhshah13)
• 2e3424d: fix(cli)!: refuse a read-only manifest before repos uninstall tears down (@dhshah13)
• 995f2ee: fix(jirapoll)!: skip an event that fails validation (@tpouyer)
• 605c7a1: fix(jirapoll)!: unmarshal EventPayload as structured JSON in DispatchRecord (@jefferyb)
• 9dd1c57: fix(repos)!: treat a repos.yaml read from a pipe or FIFO as read-only (@dhshah13)
• 3863e39: fix(sandbox)!: limit downloaded Git metadata sizes (@ravelley)
• 2d8a203: fix(sandbox)!: reject non-regular shallow metadata (@ravelley)
• 73957b4: fix(sandbox)!: require checkout root .git and reject new shallow boundaries (@ravelley)
• 36b0145: refactor(#9122)!: rename stage-artifacts to prepare-artifacts (@waynesun09)
• 7afd401: test(#9350)!: create behaviour labels via the label API, not an issue (@fullsend-ai-coder[bot])

Features

• e8e8cee: feat(#9267): provision inference WIF for GitLab projects (@fullsend-ai-coder[bot])
• 0913d32: feat(#9288): add optional Jira run-start label (@ederign)
• bd43fce: feat(#9343): decouple GitLab webhook activation from schedule merge access (@fullsend-ai-coder[bot])
• 971531a: feat(#9364): add repos --verbose to show withheld API errors (@fullsend-ai-coder[bot])
• 055368c: feat(#9411): forward FULLSEND_JIRA_TOKEN and FULLSEND_JIRA_EMAIL to jira-ro (@fullsend-ai-coder[bot])
• 774e15b: feat(behaviourtest): drop first-live-run claims; guard subtest (@tpouyer)
• 2525ca5: feat(jira): expose issue type to CEL triggers (@eshulman2)
• 78b765a: feat(poll): bound routed fields; refuse oversized Jira commands (@tpouyer)
• e8e1b0e: feat(poll): carry config-derived fields whole, fail closed on overflow (@tpouyer)
• d0c5546: feat(poll): keep control labels; scope the Jira command-body rule (@tpouyer)
• 2b6a2ad: feat(poll): share the Jira dispatch core, pin the command budget (@tpouyer)

Bug Fixes

• 2958184: fix(#2513): document artifacts.by_source for private Jira data (@fullsend-ai-coder[bot])
• 93bb074: fix(#8165): bound maskSecretLiterals memory on long matching runs (@fullsend-ai-coder[bot])
• 6ee8671: fix(#8165): redact script output before trimming and merge overlaps (@fullsend-ai-coder[bot])
• 6962d89: fix(#8747): flag path-shaped preflight_check after ${VAR} expansion (@fullsend-ai-coder[bot])
• 24aa095: fix(#8841): fall back to fork default branch for unsynced GitLab forks (@fullsend-ai-coder[bot])
• b3eb720: fix(#9040): admit fullsend-ai repos on the configured GitHub host (@fullsend-ai-coder[bot])
• 316ff46: fix(#9040): isolate cli per-repo fallback tests from GITHUB_SERVER_URL (@fullsend-ai-coder[bot])
• fdbdf1f: fix(#9040): isolate default-allowlist tests from GITHUB_SERVER_URL (@fullsend-ai-coder[bot])
• f201880: fix(#9122): GitLab uploads no artifact for level none (@waynesun09)
• 59075bd: fix(#9122): close review gaps in artifact staging (@waynesun09)
• d798056: fix(#9248): address review feedback on PR #9286 (@fullsend-ai-coder[bot])
• 7416a31: fix(#9248): clarify GitLab dispatch deferral diagnostics (@fullsend-ai-coder[bot])
• 7dacdcb: fix(#9250): drop broad merge fallback and sanitize username in Poller guidance (@fullsend-ai-coder[bot])
• d6e441c: fix(#9250): name replacement Poller and explain branch-access fix (@fullsend-ai-coder[bot])
• cb70434: fix(#9267): address review feedback on GitLab inference provisioning (PR #9360) (@fullsend-ai-coder[bot])
• da03dd1: fix(#9271): address review feedback on PR #9273 (@fullsend-ai-coder[bot])
• 214467a: fix(#9276): keep change-proposal coverage when change_proposal is unknown (@fullsend-ai-coder[bot])
• 1c0e25c: fix(#9276): quote extension_lists coverage key in error (@fullsend-ai-coder[bot])
• e220f4c: fix(#9280): retry transient create-tree 422s when committing files (@fullsend-ai-coder[bot])
• 7b7837b: fix(#9288): keep invalid Jira labels from blocking runs (@ederign)
• 8416a4c: fix(#9292): address review feedback on PR #9295 (@fullsend-ai-coder[bot])
• 509c16c: fix(#9303): retry GitHub submitted-too-quickly 403 on fork creation (@fullsend-ai-coder[bot])
• 38e4cc0: fix(#9327): redact scheme-prefixed secrets in the PostToolUse hook (@fullsend-ai-coder[bot])
• 9a34da0: fix(#9343): cover account webhook from scratch, capability gap, and trigger route (@fullsend-ai-coder[bot])
• 0974b7b: fix(#9343): keep schedule ownership checks when merge access is missing (@fullsend-ai-coder[bot])
• b98d694: fix(#9343): only treat 403/404 deploy-key push refusals as unsupported when gated (@fullsend-ai-coder[bot])
• 5986cd2: fix(#9363): add concrete protected-branch remediation steps to poller refusal message (@fullsend-ai-coder[bot])
• f049f7b: fix(#9363): report failed revocation of refused poller credential (@fullsend-ai-coder[bot])
• 24030a8: fix(#9363): report refused poller merge grant instead of token failure (@fullsend-ai-coder[bot])
• b45fed6: fix(#9367): name the GitLab UI setting in override-role errors (@fullsend-ai-coder[bot])
• e63f919: fix(#9401): avoid full history and tree walks on large GitLab repos (@fullsend-ai-coder[bot])
• e...

Changelog

Breaking Changes

• 24aed55: docs(#9411)!: note the JIRA_USER_EMAIL replacement and trusted-ref rule (@waynesun09)
• dd7b948: feat(#9122)!: config limits what the run artifact publishes (@fullsend-ai-coder[bot])
• 3fc95b4: feat(jira)!: stop forwarding the JIRA_TOKEN and JIRA_USER_EMAIL secrets (@waynesun09)
• 6f9bc5b: feat(poll)!: bound transported event fields; refuse oversized commands (@tpouyer)
• ec7d132: fix(#7360)!: inherit readonly_repo through base: composition (@gwenneg)
• bcf2940: fix(#8952)!: mint replaces gh enterprise token variables too (@fullsend-ai-coder[bot])
• a3bb602: fix(#9292)!: render managed config in the pinned fullsend_ref schema (@fullsend-ai-coder[bot])
• ec0ada4: fix(cli)!: adjust repository validation retry behavior (@ravelley)
• 397041f: fix(cli)!: check allowed_remote_resources when fetch can start (@tpouyer)
• d0c473b: fix(cli)!: deny the trace signing key in runs (@dhshah13)
• 2e3424d: fix(cli)!: refuse a read-only manifest before repos uninstall tears down (@dhshah13)
• 995f2ee: fix(jirapoll)!: skip an event that fails validation (@tpouyer)
• 605c7a1: fix(jirapoll)!: unmarshal EventPayload as structured JSON in DispatchRecord (@jefferyb)
• 9dd1c57: fix(repos)!: treat a repos.yaml read from a pipe or FIFO as read-only (@dhshah13)
• 3863e39: fix(sandbox)!: limit downloaded Git metadata sizes (@ravelley)
• 2d8a203: fix(sandbox)!: reject non-regular shallow metadata (@ravelley)
• 73957b4: fix(sandbox)!: require checkout root .git and reject new shallow boundaries (@ravelley)
• 36b0145: refactor(#9122)!: rename stage-artifacts to prepare-artifacts (@waynesun09)
• 7afd401: test(#9350)!: create behaviour labels via the label API, not an issue (@fullsend-ai-coder[bot])

Features

• e8e8cee: feat(#9267): provision inference WIF for GitLab projects (@fullsend-ai-coder[bot])
• 0913d32: feat(#9288): add optional Jira run-start label (@ederign)
• bd43fce: feat(#9343): decouple GitLab webhook activation from schedule merge access (@fullsend-ai-coder[bot])
• 971531a: feat(#9364): add repos --verbose to show withheld API errors (@fullsend-ai-coder[bot])
• 055368c: feat(#9411): forward FULLSEND_JIRA_TOKEN and FULLSEND_JIRA_EMAIL to jira-ro (@fullsend-ai-coder[bot])
• 774e15b: feat(behaviourtest): drop first-live-run claims; guard subtest (@tpouyer)
• 2525ca5: feat(jira): expose issue type to CEL triggers (@eshulman2)
• 78b765a: feat(poll): bound routed fields; refuse oversized Jira commands (@tpouyer)
• e8e1b0e: feat(poll): carry config-derived fields whole, fail closed on overflow (@tpouyer)
• d0c5546: feat(poll): keep control labels; scope the Jira command-body rule (@tpouyer)
• 2b6a2ad: feat(poll): share the Jira dispatch core, pin the command budget (@tpouyer)

Bug Fixes

• 2958184: fix(#2513): document artifacts.by_source for private Jira data (@fullsend-ai-coder[bot])
• 93bb074: fix(#8165): bound maskSecretLiterals memory on long matching runs (@fullsend-ai-coder[bot])
• 6ee8671: fix(#8165): redact script output before trimming and merge overlaps (@fullsend-ai-coder[bot])
• 6962d89: fix(#8747): flag path-shaped preflight_check after ${VAR} expansion (@fullsend-ai-coder[bot])
• 24aa095: fix(#8841): fall back to fork default branch for unsynced GitLab forks (@fullsend-ai-coder[bot])
• b3eb720: fix(#9040): admit fullsend-ai repos on the configured GitHub host (@fullsend-ai-coder[bot])
• 316ff46: fix(#9040): isolate cli per-repo fallback tests from GITHUB_SERVER_URL (@fullsend-ai-coder[bot])
• fdbdf1f: fix(#9040): isolate default-allowlist tests from GITHUB_SERVER_URL (@fullsend-ai-coder[bot])
• f201880: fix(#9122): GitLab uploads no artifact for level none (@waynesun09)
• 59075bd: fix(#9122): close review gaps in artifact staging (@waynesun09)
• d798056: fix(#9248): address review feedback on PR #9286 (@fullsend-ai-coder[bot])
• 7416a31: fix(#9248): clarify GitLab dispatch deferral diagnostics (@fullsend-ai-coder[bot])
• 7dacdcb: fix(#9250): drop broad merge fallback and sanitize username in Poller guidance (@fullsend-ai-coder[bot])
• d6e441c: fix(#9250): name replacement Poller and explain branch-access fix (@fullsend-ai-coder[bot])
• cb70434: fix(#9267): address review feedback on GitLab inference provisioning (PR #9360) (@fullsend-ai-coder[bot])
• da03dd1: fix(#9271): address review feedback on PR #9273 (@fullsend-ai-coder[bot])
• 214467a: fix(#9276): keep change-proposal coverage when change_proposal is unknown (@fullsend-ai-coder[bot])
• 1c0e25c: fix(#9276): quote extension_lists coverage key in error (@fullsend-ai-coder[bot])
• e220f4c: fix(#9280): retry transient create-tree 422s when committing files (@fullsend-ai-coder[bot])
• 7b7837b: fix(#9288): keep invalid Jira labels from blocking runs (@ederign)
• 8416a4c: fix(#9292): address review feedback on PR #9295 (@fullsend-ai-coder[bot])
• 509c16c: fix(#9303): retry GitHub submitted-too-quickly 403 on fork creation (@fullsend-ai-coder[bot])
• 38e4cc0: fix(#9327): redact scheme-prefixed secrets in the PostToolUse hook (@fullsend-ai-coder[bot])
• 9a34da0: fix(#9343): cover account webhook from scratch, capability gap, and trigger route (@fullsend-ai-coder[bot])
• 0974b7b: fix(#9343): keep schedule ownership checks when merge access is missing (@fullsend-ai-coder[bot])
• b98d694: fix(#9343): only treat 403/404 deploy-key push refusals as unsupported when gated (@fullsend-ai-coder[bot])
• 5986cd2: fix(#9363): add concrete protected-branch remediation steps to poller refusal message (@fullsend-ai-coder[bot])
• f049f7b: fix(#9363): report failed revocation of refused poller credential (@fullsend-ai-coder[bot])
• 24030a8: fix(#9363): report refused poller merge grant instead of token failure (@fullsend-ai-coder[bot])
• b45fed6: fix(#9367): name the GitLab UI setting in override-role errors (@fullsend-ai-coder[bot])
• e63f919: fix(#9401): avoid full history and tree walks on large GitLab repos (@fullsend-ai-coder[bot])
• e6e1e51: fix(#9404): add GitLab workflow rules before a catch-all when: never (@fullsend-ai-coder[bot])
• ce42073: fix(#9404): resolve aliases when detecting a catch-all workflow deny rule (@fullsend-ai-coder[bot])
• 6c5d73e: fix(behaviour): capture wrapper output through a single tee (@jflowers)
• 1a6e389: fix(behaviour): keep retry reports and exit status accurate (@jflowers)
• 97c2920: fix(behaviour): refuse infra retry on race, panic, or timeout output (@jflowers)
• 42c9ce8: fix(behaviourtest): classify only known infra failure modes (@jflowers)
• f14f4d2: fix(behaviourtest): harden failure report text (@jflowers)
• a80ad9a: fix(behaviourtest): leave cancelled WIF waits unmarked (@jflowers)
• 22d3266: fix(behaviourtest): narrow transient mint error matching (@jflowers)
• 9227da9: fix(behaviourtest): poll through transient workflow errors (@jflowers)
• b023517: fix(behaviourtest): preserve lease cause in suite mint errors (@jflowers)
• 50669f5: fix(behaviourtest): record teardown failures beside scenario errors (@jflowers)
• d0742f6: fix(behaviourtest): register redaction literals before failure recording (@jflowers)
• 3fbf9a6: fix(cli): deny-all doc qualifier, gate behaviour scenario, tests (@tpouyer)
• 565eb9b: fix(cli): differentiate fetch-gate config errors, fix docs (@tpouyer)
• 05933d7: fix(cli): name both causes and pins in the replay pin error (@tpouyer)
• 781421f: fix(cli): refuse replay of a policy URL pinned to another revision (@tpouyer)
• e090bd8...

Highlights

Jira gets a reworked setup in this release, and it changes on upgrade. Connection and poll settings now live under tracker.jira (base_url and project are required), and fullsend repos install manages Jira polling on GitHub and GitLab and migrates managed config for you. Every Jira call now goes through the Atlassian API gateway at https://api.atlassian.com. Credentials come from FULLSEND_JIRA_TOKEN (with FULLSEND_JIRA_EMAIL); JIRA_TOKEN is no longer read, and Jira secrets must be declared under env.runner. Before upgrading, confirm your Jira credential works through https://api.atlassian.com (a scoped token or a service-account token); there is no site-URL mode. Jira-sourced runs take JIRA_BASE_URL and JIRA_API_URL from config only, and fail closed before the sandbox starts when the Jira settings are missing or invalid, or with --offline.

CEL triggers can use event.actor.is_entity_assignee to let the issue's assignee start an agent (applies to Jira and GitHub custom agents). Claude Workflow progress now shows up in run output, so long workflow runs report where they are. pi transcripts now record tool call ids, arguments and results, and report calls that were cut off before they finished.

fullsend self-update replaces the CLI with the latest release, or the one --version names, after verifying the release's Sigstore signature; --dry-run reports what it would do without changing anything. This is the first release with the command, so get v0.55.0 from the release page once; later upgrades can use fullsend self-update.

The sandbox images ship pi 1.5.0 with updated pi extensions (pi-anthropic-vertex 0.2.1, pi-xai-vertex 0.3.1, pi-inference-gateway 0.2.0) and Codex 0.166.0; the agents fleet is pinned to these images. If you install the pi extensions on their own, they need pi 1.3.0 or later.

A few other changes need attention on upgrade. Retro now starts on a PR close or merge only for actors with write access, and skips the run on a CEL routing error or, on GitLab, when the event has no actor. fullsend lint --format json emits schema_version 2, with a required diagnostics[].code. A harness with an invalid schema_version now fails to load; harnesses without one are unchanged. On GitLab, head_sha is filled in for every merge request event.

Changelog

Breaking Changes

• 7bdd8fe: feat(#235)!: implement harness schema_version (ADR 0127 Decision 1) (@jflowers)
• a02c410: feat(#9074)!: replace create_issues with tracking allowed_targets (@fullsend-ai-coder[bot])
• 2fe3f6c: feat(#9075)!: migrate legacy tracker config in repos install (@fullsend-ai-coder[bot])
• 921a435: feat(#9077)!: load jira-poll settings from tracker.jira config (@fullsend-ai-coder[bot])
• 270c8ad: feat(#9078)!: build Jira issue and status clients from tracker.jira (@ggallen)
• 324a17f: feat(#9079)!: scope Jira secret access in agent runs (@ggallen)
• cbe1a72: feat(cli)!: add stable diagnostic codes to lint JSON output (@Benkapner)
• 5f54192: fix(#8912)!: close retro authorization gaps (@ralphbean)
• 951b1f8: fix(#8912)!: fail closed on missing GitLab actors (@ralphbean)
• c5c584e: fix(#8912)!: gate close-event retro by write access (@ralphbean)
• 40aba93: fix(#8912)!: require write access for PR-close retro (@ralphbean)
• a2519de: fix(#9074)!: use tracker as the single provider-discriminated key (@fullsend-ai-coder[bot])

Features

• 48d92ac: feat(#6842): record forge and CI pointers on the root run span (@AshwinUgale)
• d1fad50: feat(#7414): pass pi tool call ids, arguments and results through (@AshwinUgale)
• 355b8c3: feat(#7414): report pi calls cut off before they end as unanswered (@AshwinUgale)
• a1c6acd: feat(#9035): add Jira connection and poll settings under tracker.jira (@fullsend-ai-coder[bot])
• d31dbcb: feat(#9071): fill head_sha for every GitLab merge request event (@fullsend-ai-coder[bot])
• 30feb30: feat(#9076): converge Jira polling credentials in repos install (@fullsend-ai-coder[bot])
• cf606bd: feat(#9108): manage the GitLab Jira poll schedule in repos install (@fullsend-ai-coder[bot])
• e2dbc54: feat(#9109): manage GitHub Jira polling workflow (@ggallen)
• 8f3edbf: feat(#9116): add actor.is_entity_assignee to NormalizedEvent v1 (@fullsend-ai-coder[bot])
• 0efd2bd: feat(#9176): accept Jira OAuth 2.0 client credentials (@ggallen)
• 429d994: feat(#9218): set JIRA_API_URL and JIRA_BASE_URL for Jira-sourced runs (@fullsend-ai-coder[bot])
• 3f4cc2c: feat(cli): add self-update command (@gwenneg)

Bug Fixes

• a825de7: fix(#6702): surface rate-limit state in harness-wait timeouts (@jflowers)
• 0d6c2b5: fix(#6842): keep a GitLab relative-URL prefix in the repository URL (@AshwinUgale)
• 70afed2: fix(#6842): omit Jira repository URL and keep linked PR ids in forge pointers (@AshwinUgale)
• f43841e: fix(#7414): answer a pi call whose end line exceeds the buffer (@AshwinUgale)
• fddeded: fix(#7414): mark a pi result with no start as unmatched, correct the docs (@AshwinUgale)
• ab374d1: fix(#7414): treat a pi result with no content list as empty (@AshwinUgale)
• cf7d4e2: fix(#8731): accept own rules over included extends targets (@fullsend-ai-coder[bot])
• 9a20f47: fix(#8908): address review findings on progress redaction and naming (@jctanner)
• d7f048d: fix(#8908): derive Workflow agent status from producer metadata (@jctanner)
• 2f8dba3: fix(#8908): keep Workflow agent rows stable by index (@jctanner)
• a9174e8: fix(#8908): keep status history when updating an existing key at capacity (@jctanner)
• 798c51f: fix(#8908): mask overlapping credentials longest-first and settle tool row churn (@jctanner)
• d667f93: fix(#8908): mask the assembled task row against split credentials (@jctanner)
• 81af21d: fix(#8908): merge literal match spans and mask the joined row with the caller callback (@jctanner)
• a5dbc8d: fix(#8908): preserve sparse agent state and bound cache allocations (@jctanner)
• 498385e: fix(#8908): preserve sparse progress metadata (@jctanner)
• b29ac36: fix(#8908): redact normalized runtime secrets in the fallback pass (@jctanner)
• b0066f6: fix(#8908): redact secrets reconstructed by progress cleanup (@jctanner)
• 528416d: fix(#8908): reject progress from superseded task runs (@jctanner)
• 1a142d5: fix(#8908): render Claude Workflow progress (@jctanner)
• acf1254: fix(#8908): retain workflow controls and sparse task metadata (@jctanner)
• 55dde5e: fix(#8908): sanitize Unicode progress in a dedicated reconciler (@jctanner)
• b7ee337: fix(#8912): address review feedback (@ralphbean)
• 2f2511f: fix(#8912): enforce write floor in CEL close routing (@ralphbean)
• 2dd76a3: fix(#8912): preserve retro on merge queue closes (@ralphbean)
• 76d1b6c: fix(#8961): address review feedback on PR #9003 (@fullsend-ai-coder[bot])
• 8a0ccfd: fix(#8961): fail when repeated-agent run completion is unconfirmed (@fullsend-ai-coder[bot])
• 879f2a0: fix(#8961): keep agent artifact downloads off the ci.Driver interface (@fullsend-ai-coder[bot])
• 40547c4: fix(#8961): prevent repeated-agent artifact collisions (@ggallen)
• d61f6bb: fix(#8961): resolve default triage artifacts by logical agent (@fullsend-ai-coder[bot])
• ba24a02: fix(#8961): wait for run completion before downloading repeated-agent artifacts (@fullsend-ai-coder[bot])
• 393618f: fix(#9023): skip redundant Jira sticky-marker property writes (@fullsend-ai-coder[bot])
• 9e62382: fix(#9035): address review feedback on tracker.jira settings (@fullsend-ai-coder[bot])
• 4fd9280: fix(#9044): skip local sandbox host setup for remote OpenShell gateway (@jctanner)
• 877c381: fix(#9046): load harness .env in dummy runtime behaviour ops (@fullsend-ai-coder[bot])
• ea400d8: fix(#9048): remove the build-time gopls cache from the code image (@Benkapner)
• 8886bbe: fix(#9068): upgrade previous-contract GitLab root inputs (@fullsend-ai-coder[bot])
• e5d242d: fix(#9074): addres...

Changelog

Breaking Changes

• 7bdd8fe: feat(#235)!: implement harness schema_version (ADR 0127 Decision 1) (@jflowers)
• a02c410: feat(#9074)!: replace create_issues with tracking allowed_targets (@fullsend-ai-coder[bot])
• 2fe3f6c: feat(#9075)!: migrate legacy tracker config in repos install (@fullsend-ai-coder[bot])
• 921a435: feat(#9077)!: load jira-poll settings from tracker.jira config (@fullsend-ai-coder[bot])
• 270c8ad: feat(#9078)!: build Jira issue and status clients from tracker.jira (@ggallen)
• 324a17f: feat(#9079)!: scope Jira secret access in agent runs (@ggallen)
• cbe1a72: feat(cli)!: add stable diagnostic codes to lint JSON output (@Benkapner)
• 5f54192: fix(#8912)!: close retro authorization gaps (@ralphbean)
• 951b1f8: fix(#8912)!: fail closed on missing GitLab actors (@ralphbean)
• c5c584e: fix(#8912)!: gate close-event retro by write access (@ralphbean)
• 40aba93: fix(#8912)!: require write access for PR-close retro (@ralphbean)
• a2519de: fix(#9074)!: use tracker as the single provider-discriminated key (@fullsend-ai-coder[bot])

Features

• 48d92ac: feat(#6842): record forge and CI pointers on the root run span (@AshwinUgale)
• d1fad50: feat(#7414): pass pi tool call ids, arguments and results through (@AshwinUgale)
• 355b8c3: feat(#7414): report pi calls cut off before they end as unanswered (@AshwinUgale)
• a1c6acd: feat(#9035): add Jira connection and poll settings under tracker.jira (@fullsend-ai-coder[bot])
• d31dbcb: feat(#9071): fill head_sha for every GitLab merge request event (@fullsend-ai-coder[bot])
• 30feb30: feat(#9076): converge Jira polling credentials in repos install (@fullsend-ai-coder[bot])
• cf606bd: feat(#9108): manage the GitLab Jira poll schedule in repos install (@fullsend-ai-coder[bot])
• e2dbc54: feat(#9109): manage GitHub Jira polling workflow (@ggallen)
• 8f3edbf: feat(#9116): add actor.is_entity_assignee to NormalizedEvent v1 (@fullsend-ai-coder[bot])
• 0efd2bd: feat(#9176): accept Jira OAuth 2.0 client credentials (@ggallen)
• 429d994: feat(#9218): set JIRA_API_URL and JIRA_BASE_URL for Jira-sourced runs (@fullsend-ai-coder[bot])
• 3f4cc2c: feat(cli): add self-update command (@gwenneg)

Bug Fixes

• a825de7: fix(#6702): surface rate-limit state in harness-wait timeouts (@jflowers)
• 0d6c2b5: fix(#6842): keep a GitLab relative-URL prefix in the repository URL (@AshwinUgale)
• 70afed2: fix(#6842): omit Jira repository URL and keep linked PR ids in forge pointers (@AshwinUgale)
• f43841e: fix(#7414): answer a pi call whose end line exceeds the buffer (@AshwinUgale)
• fddeded: fix(#7414): mark a pi result with no start as unmatched, correct the docs (@AshwinUgale)
• ab374d1: fix(#7414): treat a pi result with no content list as empty (@AshwinUgale)
• cf7d4e2: fix(#8731): accept own rules over included extends targets (@fullsend-ai-coder[bot])
• 9a20f47: fix(#8908): address review findings on progress redaction and naming (@jctanner)
• d7f048d: fix(#8908): derive Workflow agent status from producer metadata (@jctanner)
• 2f8dba3: fix(#8908): keep Workflow agent rows stable by index (@jctanner)
• a9174e8: fix(#8908): keep status history when updating an existing key at capacity (@jctanner)
• 798c51f: fix(#8908): mask overlapping credentials longest-first and settle tool row churn (@jctanner)
• d667f93: fix(#8908): mask the assembled task row against split credentials (@jctanner)
• 81af21d: fix(#8908): merge literal match spans and mask the joined row with the caller callback (@jctanner)
• a5dbc8d: fix(#8908): preserve sparse agent state and bound cache allocations (@jctanner)
• 498385e: fix(#8908): preserve sparse progress metadata (@jctanner)
• b29ac36: fix(#8908): redact normalized runtime secrets in the fallback pass (@jctanner)
• b0066f6: fix(#8908): redact secrets reconstructed by progress cleanup (@jctanner)
• 528416d: fix(#8908): reject progress from superseded task runs (@jctanner)
• 1a142d5: fix(#8908): render Claude Workflow progress (@jctanner)
• acf1254: fix(#8908): retain workflow controls and sparse task metadata (@jctanner)
• 55dde5e: fix(#8908): sanitize Unicode progress in a dedicated reconciler (@jctanner)
• b7ee337: fix(#8912): address review feedback (@ralphbean)
• 2f2511f: fix(#8912): enforce write floor in CEL close routing (@ralphbean)
• 2dd76a3: fix(#8912): preserve retro on merge queue closes (@ralphbean)
• 76d1b6c: fix(#8961): address review feedback on PR #9003 (@fullsend-ai-coder[bot])
• 8a0ccfd: fix(#8961): fail when repeated-agent run completion is unconfirmed (@fullsend-ai-coder[bot])
• 879f2a0: fix(#8961): keep agent artifact downloads off the ci.Driver interface (@fullsend-ai-coder[bot])
• 40547c4: fix(#8961): prevent repeated-agent artifact collisions (@ggallen)
• d61f6bb: fix(#8961): resolve default triage artifacts by logical agent (@fullsend-ai-coder[bot])
• ba24a02: fix(#8961): wait for run completion before downloading repeated-agent artifacts (@fullsend-ai-coder[bot])
• 393618f: fix(#9023): skip redundant Jira sticky-marker property writes (@fullsend-ai-coder[bot])
• 9e62382: fix(#9035): address review feedback on tracker.jira settings (@fullsend-ai-coder[bot])
• 4fd9280: fix(#9044): skip local sandbox host setup for remote OpenShell gateway (@jctanner)
• 877c381: fix(#9046): load harness .env in dummy runtime behaviour ops (@fullsend-ai-coder[bot])
• ea400d8: fix(#9048): remove the build-time gopls cache from the code image (@Benkapner)
• 8886bbe: fix(#9068): upgrade previous-contract GitLab root inputs (@fullsend-ai-coder[bot])
• e5d242d: fix(#9074): address review feedback on tracking allowed_targets (@fullsend-ai-coder[bot])
• f9913d8: fix(#9074): align ConfigTracker with legacy barrier and fail closed on ambiguous tracker (@fullsend-ai-coder[bot])
• 38fb7d6: fix(#9074): fail runtime config load on legacy create_issues key (@fullsend-ai-coder[bot])
• 93a0c4c: fix(#9075): count comments in alias budget and follow YAML merge keys (@fullsend-ai-coder[bot])
• 2c654bb: fix(#9075): keep legacy tracker migration layers independent (@fullsend-ai-coder[bot])
• 447d567: fix(#9075): reject duplicate keys inside a merged YAML mapping (@fullsend-ai-coder[bot])
• 2ed0f08: fix(#9075): reject malformed forge config and bound alias expansion bytes (@fullsend-ai-coder[bot])
• 1ecd5ca: fix(#9076): address review feedback on Jira credential convergence (@fullsend-ai-coder[bot])
• 3503373: fix(#9076): address review feedback on Jira credential handling (@fullsend-ai-coder[bot])
• 5562601: fix(#9077): assert tenant_info handler invocation in Jira client test (@fullsend-ai-coder[bot])
• 4d3461b: fix(#9078): pass Jira credentials to status finalizer step (@fullsend-ai-coder[bot])
• 28ab5d1: fix(#9098): post config load errors to the status comment (@fullsend-ai-coder[bot])
• a1a4ef7: fix(#9116): address review on is_entity_assignee (@waynesun09)
• db2fbe3: fix(#9176): check user Jira poll caller OAuth forwarding per job (@fullsend-ai-coder[bot])
• 1867ee6: fix(#9176): guard Jira client secret masking check to GitLab (@fullsend-ai-coder[bot])
• b7a8697: fix(#9176): omit Jira OAuth secrets from token-only poll caller (@fullsend-ai-coder[bot])
• ce87aaf: fix(#9176): require user-owned Jira poll caller to forward OAuth secrets (@fullsend-ai-coder[bot])
• 48a100a: fix(#9176): verify pinned GitLab scripts support Jira OAuth (@fullsend-ai-coder[bot])
• 5e4487d...

Highlights

Jira poll actors are now authorized through Jira project roles, so the poller no longer needs project admin to check who may start an agent; the GitLab poll path forwards the same authorization lists (#8401). On GitLab, merge requests get a fresh review when new commits are pushed (#7681), fullsend run receives the normalized forge event (#9014), and runner VMs apply Fedora updates daily (#8963).

Harness images can now come from a private ghcr.io package: the run pulls them with the workflow token (#9019). fullsend lint gains JSON output with a published schema, can check a single agent, and reports reserved env.sandbox keys and GITHUB_ISSUE_URL misuse. Skill overrides can replace single files of a base skill, and runs write a persona manifest (#6158). Bot-posted /fs- slash comments are forwarded to dispatch (#8894).

Upgrade notes. GitLab: the dispatch payload no longer carries note_body, so rerun fullsend repos install with this release; an older scaffold paired with the new poller loses /fs-fix instructions and retro comments (#8954). GitHub: fullsend dispatch with a gha-event input denies non-label events from bots that are not registered with the mint (for example Dependabot or Renovate); register the bot, and give external callers a mint URL and id-token: write (#8414). Two skill entries that set the same file to different values now fail instead of one winning silently (#8981), and a URL base whose content drifted from fullsend lock fails until you run fullsend lock --update (#8979). In the agents release, the review agent no longer reads REVIEW_UX_ENABLED: to turn off the UX reviewer, remove sub-agents/user-experience.md with a skills override (agents#1858).

Changelog

Breaking Changes

• 6bdf4a3: feat(#8414)!: resolve bot roles in gha-event dispatch (@fullsend-ai-coder[bot])
• 7bdeb1d: fix(#8954)!: carry GitLab /fs-fix comment body at canonical path (@fullsend-ai-coder[bot])
• 34d63bd: fix(#8979)!: pin by dependency kind and lock a URL agent's own files (@waynesun09)
• eb94dc0: fix(#8981)!: treat equal duplicate override values as agreement (@waynesun09)

Features

• 83af920: feat(#6158): stage skill file overrides and write a persona manifest (@fullsend-ai-coder[bot])
• e5b8f3b: feat(#7681): re-review GitLab MRs when new commits are pushed (@fullsend-ai-coder[bot])
• 177d321: feat(#8401): authorize Jira poll actors without project admin (@fullsend-ai-coder[bot])
• 5b583c6: feat(#8401): resolve every Jira event through project roles under labels: project_roles (@fullsend-ai-coder[bot])
• e756514: feat(#8894): forward bot slash comments to dispatch (@ifireball)
• 76e1a31: feat(#8997): allow fullsend lint to check a single agent (@fullsend-ai-coder[bot])
• d2cb77b: feat(#9014): deliver the GitLab normalized event to fullsend run (@AshwinUgale)
• 7540925: feat(#9019): pull private ghcr.io harness images with workflow token (@fullsend-ai-coder[bot])
• 0f4bea6: feat(cli): add JSON output to fullsend lint (@Benkapner)
• 19fc671: feat(cli): publish JSON Schema for lint output (@Benkapner)

Bug Fixes

• 7d95393: fix(#6158): let a map-form child skill overlay the base skill it names (@waynesun09)
• 4d3c328: fix(#6158): match pinned-URL base skills only for a missing map-form child (@waynesun09)
• b10ddfe: fix(#6158): stage URL skills before routing and mirror persona registration (@waynesun09)
• f139684: fix(#7709): correct site workflow doc revisit trigger and mid-flight cancel wording (@fullsend-ai-coder[bot])
• c52317d: fix(#7709): drop unenforced deploy-ordering claim from site workflow docs (@fullsend-ai-coder[bot])
• 4744a07: fix(#8401): address review feedback on PR #8892 (@fullsend-ai-coder[bot])
• 965ed63: fix(#8401): address second review round on PR #8892 (@fullsend-ai-coder[bot])
• 1c999bc: fix(#8401): document opt-in jira provider, render jira policy in effective config (@fullsend-ai-coder[bot])
• dd72a4b: fix(#8401): forward the jira authorization lists on the GitLab poll path (@jwm4)
• 0c585d4: fix(#8401): make the jira authorization provider opt-in (@fullsend-ai-coder[bot])
• 0fa5e3b: fix(#8401): reject aliased mapping keys in authorization entries (@fullsend-ai-coder[bot])
• ce4ad05: fix(#8742): lint GITHUB_ISSUE_URL in consumed overlays and forge (@fullsend-ai-coder[bot])
• 59ad072: fix(#8744): report reserved env.sandbox keys in fullsend lint (@fullsend-ai-coder[bot])
• 39ca16d: fix(#8915): remove the public document graph (@rh-hemartin)
• 8ef2efe: fix(#8923): add HSTS header to mint responses (@fullsend-ai-coder[bot])
• 8eb4cce: fix(#8923): reject ambiguous HSTS values in the mint probe (@fullsend-ai-coder[bot])
• 2f315b1: fix(#8963): harden os-update drain and release failure paths (@fullsend-ai-coder[bot])
• 55cc85a: fix(#8963): keep deferred-drain jobs alive and match indented shutdown_timeout (@fullsend-ai-coder[bot])
• 6a95803: fix(#8963): replace config.toml atomically when rewriting shutdown_timeout (@fullsend-ai-coder[bot])
• af40286: fix(#8973): error when a map-form skill matches two base URL skills (@fullsend-ai-coder[bot])
• d4e11a4: fix(#8974): drop cache-path override re-pinning from the lock replay (@waynesun09)
• db92157: fix(#8974): replay skill file overrides by URL, reject empty skill source (@waynesun09)
• 9b59fe4: fix(#8974): replay skill overrides by URL across fields, keep empty source loadable (@waynesun09)
• 7c3a47e: fix(#8974): tidy skill override edge cases in staging and lock replay (@fullsend-ai-coder[bot])
• 199590f: fix(#8977): keep child values when replaying a URL base's lock entries (@fullsend-ai-coder[bot])
• 4f18c4f: fix(#8977): replay base plugin lock entries only onto their own slot (@waynesun09)
• fb5f5d9: fix(#8979): keep locked host files out of the skill list on replay (@waynesun09)
• 00b2ec7: fix(#8979): name --forge in the unpinned hint only for a child without forge keys (@waynesun09)
• 2dfdd35: fix(#8979): name the forge platform in the unpinned warning and tidy pin errors (@waynesun09)
• 2b5c74a: fix(#8979): pin a URL base's relative files to the lock entry (@fullsend-ai-coder[bot])
• d421bc5: fix(#8979): serve a file pinned only as a directory from the pinned tree (@waynesun09)
• a9bad6e: fix(#8979): warn when a current lock entry leaves dependencies unpinned (@waynesun09)
• e4aa5e2: fix(#8981): cover override replay values in the lock replay restore (@waynesun09)
• 1baa065: fix(#8981): keep direct skill overrides deduplicated against a dep (@fullsend-ai-coder[bot])
• e7fa6fc: fix(#8981): restore harness when lock replay override merge fails (@fullsend-ai-coder[bot])
• 2e8c35d: fix(#8984): keep only the transitive-skill guard after rebase (@waynesun09)
• 87271e8: fix(#8984): stop locked runs adding URL base host_files as skills (@fullsend-ai-coder[bot])
• a94352a: fix(#8992): keep harness unchanged when lock replay fails (@fullsend-ai-coder[bot])
• e0d6c08: fix(#9014): derive comment fields from the sent body, log fallbacks, clean up the event file (@AshwinUgale)
• 73c672c: fix(#9019): write the ghcr.io auth file directly instead of podman login (@tpouyer)
• 7543716: fix(deps): update module github.com/yuin/goldmark to v1.8.7 (#8967) (@renovate-fullsend[bot])
• 2276c10: fix: address review feedback on PR #8956 (@fullsend-ai-coder[bot])
• 585d5d3: fix: address review feedback on PR #8956 (round 2) (@fullsend-ai-coder[bot])
• 7ddda8d: fix: address review feedback on PR #8956 (round 3) (@fullsend-ai-coder[bot])
• 65f30d8: fix: address review feedback on PR #8957 (@fullsend-ai-coder[bot])
• 4542bf8: fix: address review feedback on PR #8980 (@fullsend-ai-coder[bot])
• 30dbbdb: fix: address review feedback on PR #9021 (@fullsend-ai-coder[bot])

Agents changes

The fleet agents ship in fullsend-ai/agents v0.54.0; its release notes list the agents changes in this release.

Changelog

Breaking Changes

• 6bdf4a3: feat(#8414)!: resolve bot roles in gha-event dispatch (@fullsend-ai-coder[bot])
• 7bdeb1d: fix(#8954)!: carry GitLab /fs-fix comment body at canonical path (@fullsend-ai-coder[bot])
• 34d63bd: fix(#8979)!: pin by dependency kind and lock a URL agent's own files (@waynesun09)
• eb94dc0: fix(#8981)!: treat equal duplicate override values as agreement (@waynesun09)

Features

• 83af920: feat(#6158): stage skill file overrides and write a persona manifest (@fullsend-ai-coder[bot])
• e5b8f3b: feat(#7681): re-review GitLab MRs when new commits are pushed (@fullsend-ai-coder[bot])
• 177d321: feat(#8401): authorize Jira poll actors without project admin (@fullsend-ai-coder[bot])
• 5b583c6: feat(#8401): resolve every Jira event through project roles under labels: project_roles (@fullsend-ai-coder[bot])
• e756514: feat(#8894): forward bot slash comments to dispatch (@ifireball)
• 76e1a31: feat(#8997): allow fullsend lint to check a single agent (@fullsend-ai-coder[bot])
• d2cb77b: feat(#9014): deliver the GitLab normalized event to fullsend run (@AshwinUgale)
• 7540925: feat(#9019): pull private ghcr.io harness images with workflow token (@fullsend-ai-coder[bot])
• 0f4bea6: feat(cli): add JSON output to fullsend lint (@Benkapner)
• 19fc671: feat(cli): publish JSON Schema for lint output (@Benkapner)

Bug Fixes

• 7d95393: fix(#6158): let a map-form child skill overlay the base skill it names (@waynesun09)
• 4d3c328: fix(#6158): match pinned-URL base skills only for a missing map-form child (@waynesun09)
• b10ddfe: fix(#6158): stage URL skills before routing and mirror persona registration (@waynesun09)
• f139684: fix(#7709): correct site workflow doc revisit trigger and mid-flight cancel wording (@fullsend-ai-coder[bot])
• c52317d: fix(#7709): drop unenforced deploy-ordering claim from site workflow docs (@fullsend-ai-coder[bot])
• 4744a07: fix(#8401): address review feedback on PR #8892 (@fullsend-ai-coder[bot])
• 965ed63: fix(#8401): address second review round on PR #8892 (@fullsend-ai-coder[bot])
• 1c999bc: fix(#8401): document opt-in jira provider, render jira policy in effective config (@fullsend-ai-coder[bot])
• dd72a4b: fix(#8401): forward the jira authorization lists on the GitLab poll path (@jwm4)
• 0c585d4: fix(#8401): make the jira authorization provider opt-in (@fullsend-ai-coder[bot])
• 0fa5e3b: fix(#8401): reject aliased mapping keys in authorization entries (@fullsend-ai-coder[bot])
• ce4ad05: fix(#8742): lint GITHUB_ISSUE_URL in consumed overlays and forge (@fullsend-ai-coder[bot])
• 59ad072: fix(#8744): report reserved env.sandbox keys in fullsend lint (@fullsend-ai-coder[bot])
• 39ca16d: fix(#8915): remove the public document graph (@rh-hemartin)
• 8ef2efe: fix(#8923): add HSTS header to mint responses (@fullsend-ai-coder[bot])
• 8eb4cce: fix(#8923): reject ambiguous HSTS values in the mint probe (@fullsend-ai-coder[bot])
• 2f315b1: fix(#8963): harden os-update drain and release failure paths (@fullsend-ai-coder[bot])
• 55cc85a: fix(#8963): keep deferred-drain jobs alive and match indented shutdown_timeout (@fullsend-ai-coder[bot])
• 6a95803: fix(#8963): replace config.toml atomically when rewriting shutdown_timeout (@fullsend-ai-coder[bot])
• af40286: fix(#8973): error when a map-form skill matches two base URL skills (@fullsend-ai-coder[bot])
• d4e11a4: fix(#8974): drop cache-path override re-pinning from the lock replay (@waynesun09)
• db92157: fix(#8974): replay skill file overrides by URL, reject empty skill source (@waynesun09)
• 9b59fe4: fix(#8974): replay skill overrides by URL across fields, keep empty source loadable (@waynesun09)
• 7c3a47e: fix(#8974): tidy skill override edge cases in staging and lock replay (@fullsend-ai-coder[bot])
• 199590f: fix(#8977): keep child values when replaying a URL base's lock entries (@fullsend-ai-coder[bot])
• 4f18c4f: fix(#8977): replay base plugin lock entries only onto their own slot (@waynesun09)
• fb5f5d9: fix(#8979): keep locked host files out of the skill list on replay (@waynesun09)
• 00b2ec7: fix(#8979): name --forge in the unpinned hint only for a child without forge keys (@waynesun09)
• 2dfdd35: fix(#8979): name the forge platform in the unpinned warning and tidy pin errors (@waynesun09)
• 2b5c74a: fix(#8979): pin a URL base's relative files to the lock entry (@fullsend-ai-coder[bot])
• d421bc5: fix(#8979): serve a file pinned only as a directory from the pinned tree (@waynesun09)
• a9bad6e: fix(#8979): warn when a current lock entry leaves dependencies unpinned (@waynesun09)
• e4aa5e2: fix(#8981): cover override replay values in the lock replay restore (@waynesun09)
• 1baa065: fix(#8981): keep direct skill overrides deduplicated against a dep (@fullsend-ai-coder[bot])
• e7fa6fc: fix(#8981): restore harness when lock replay override merge fails (@fullsend-ai-coder[bot])
• 2e8c35d: fix(#8984): keep only the transitive-skill guard after rebase (@waynesun09)
• 87271e8: fix(#8984): stop locked runs adding URL base host_files as skills (@fullsend-ai-coder[bot])
• a94352a: fix(#8992): keep harness unchanged when lock replay fails (@fullsend-ai-coder[bot])
• e0d6c08: fix(#9014): derive comment fields from the sent body, log fallbacks, clean up the event file (@AshwinUgale)
• 73c672c: fix(#9019): write the ghcr.io auth file directly instead of podman login (@tpouyer)
• 7543716: fix(deps): update module github.com/yuin/goldmark to v1.8.7 (#8967) (@renovate-fullsend[bot])
• 2276c10: fix: address review feedback on PR #8956 (@fullsend-ai-coder[bot])
• 585d5d3: fix: address review feedback on PR #8956 (round 2) (@fullsend-ai-coder[bot])
• 7ddda8d: fix: address review feedback on PR #8956 (round 3) (@fullsend-ai-coder[bot])
• 65f30d8: fix: address review feedback on PR #8957 (@fullsend-ai-coder[bot])
• 4542bf8: fix: address review feedback on PR #8980 (@fullsend-ai-coder[bot])
• 30dbbdb: fix: address review feedback on PR #9021 (@fullsend-ai-coder[bot])

Agents changes

The fleet agents ship in fullsend-ai/agents v0.54.0-rc.1; its release notes list the agents changes in this release.

Keep your OpenAI API key behind an inference gateway. If you run Fullsend on GitHub with an OpenAI API key (inference.auth: openai-api-key and the FULLSEND_OPENAI_API_KEY repository secret), we now recommend deploying an inference gateway instead (the ADR 0137 route, with agentgateway). The gateway holds the key in a secret store, each repository authenticates with its GitHub Actions OIDC token, and no repository secret holds the key, which otherwise any workflow in a selected repository can read. The trade-off is extra infrastructure to run: a cloud project, a gateway service and its configuration. The key-secret route stays supported for teams that cannot take that on. See Using an inference gateway and the operator guide.

Gateway guides target agentgateway v1.7.0. The operator and user guides now document v1.7.0 as the supported version, with a Security boundary section, the allow-rule pitfalls to avoid, pinning access to repository ids, numbered config versions with rollback, and how to watch the gateway's health and capacity. A See it in practice link points to a working deployment's README in the fullsend-ai org.

Upgrade notes. Nothing changes in the Fullsend workflows or the runner, sandbox and code images in this release. Three narrow behaviour changes to check:

• Codex (experimental runtime), delegating agents: sub-agents now run as native Codex children, with each child's model taken from subagents (or FULLSEND_CODEX_SUBAGENT_MODEL) and the run's effort. A subagents value that is not an OpenAI model id known to the pinned Codex CLI now fails the run at start-up and names the key; use openai/<id>, or <persona>: ~ to drop a persona (#8836).
• GitLab, fullsend fetch-review-threads output: the old-file line moves from original_line to old_line, and a discussion on a removed line reports that line in line with side: "left". The fleet agents are updated in step; only custom scripts that read these fields need a change (#8693).
• fullsend lock refuses to overwrite a lock file it cannot read and tells you what to do; fullsend run is unchanged (#8900).

Jira. Jira work items can now dispatch GitLab agent pipelines (#8924), and fullsend run derives the Jira work-item identity (#8922); the fleet code agent can be started from Jira with /fs-code or the ready-to-code label. fullsend run also reads mint_url from config.yaml / config.base.yaml (#8400).

Changelog

Breaking Changes

• 75d0b4b: feat(codex)!: bind native child models from subagents and FULLSEND_CODEX_SUBAGENT_MODEL (@dhshah13)
• de0bb51: fix(#8174)!: normalize review-thread position fields across forges (@fullsend-ai-coder[bot])
• 4c0c056: fix(codex)!: bind the run's effort for children and count spawns on disk (@dhshah13)
• bf361f7: fix(lock)!: refuse to overwrite an unreadable lock file (@Benkapner)

Features

• d34d195: feat(#2264): derive Jira work-item identity in fullsend run (@fullsend-ai-coder[bot])
• ac32e42: feat(#8919): dispatch Jira work items to GitLab agent pipelines (@fullsend-ai-coder[bot])
• 4b80950: feat(codex): run sub-agents as native Codex children (@dhshah13)

Bug Fixes

• 0a00349: fix(#2264): fail closed on Jira dispatch claim when channels disagree (@fullsend-ai-coder[bot])
• 345763c: fix(#2264): resolve Jira work-item identity for telemetry and update docs (@fullsend-ai-coder[bot])
• ac5359a: fix(#8173): verify review-thread roles only when authoritative (@fullsend-ai-coder[bot])
• 3d72119: fix(#8174): address review feedback on PR #8693 (@fullsend-ai-coder[bot])
• 1a2084b: fix(#8192): fail-closed mint_url precedence for local runs and reconcile-status (@mfrancisc)
• 4fcebc0: fix(#8192): honor config.base.yaml-only mint_url in status notifier (@mfrancisc)
• bd18203: fix(#8192): narrow mint_url OIDC downgrade to genuine local runs (@mfrancisc)
• 295b10b: fix(#8192): read mint_url from config.yaml/config.base.yaml in fullsend run (@mfrancisc)
• 29713b0: fix(#8192): restore statusForgeClient arg dropped by merge conflict (@mfrancisc)
• 0a84358: fix(#8887): keep terminal-phase sandbox creation diagnostics (@fullsend-ai-coder[bot])
• cf1196c: fix(#8948): mask the agentgateway version in the frozen-path diff (@waynesun09)
• 55e3e75: fix(cli): resolve mint_url via layered precedence in cancellation finalizer (@mfrancisc)
• a582931: fix(codex): count a child whose rollout head is empty or cut once (@dhshah13)
• 6a26a79: fix(codex): give the skip reason for a subagents key a skipped persona owns (@dhshah13)
• 8a079a0: fix(codex): keep children off a gateway parent and fail on a lost spawn (@dhshah13)
• 44d182c: fix(codex): keep explore children apart from default in transcript names (@dhshah13)
• 144ad64: fix(codex): name a reserved or unregistered subagents key plainly (@dhshah13)
• af43b0b: fix(codex): read a session_meta line cut before its parent by its name (@dhshah13)
• b845a4c: fix(codex): say spawn where failed spawn items count (@dhshah13)
• 5e0932d: fix(deps): update module github.com/cucumber/messages/go/v34 to v34.2.1 (@renovate-fullsend[bot])
• 1c10a41: fix: address review feedback on PR #8943 (@fullsend-ai-coder[bot])

Agents changes

The fleet agents ship in fullsend-ai/agents v0.53.0; its release notes list the agents changes in this release.

Changelog

Breaking Changes

• 75d0b4b: feat(codex)!: bind native child models from subagents and FULLSEND_CODEX_SUBAGENT_MODEL (@dhshah13)
• de0bb51: fix(#8174)!: normalize review-thread position fields across forges (@fullsend-ai-coder[bot])
• 4c0c056: fix(codex)!: bind the run's effort for children and count spawns on disk (@dhshah13)
• bf361f7: fix(lock)!: refuse to overwrite an unreadable lock file (@Benkapner)

Features

• d34d195: feat(#2264): derive Jira work-item identity in fullsend run (@fullsend-ai-coder[bot])
• ac32e42: feat(#8919): dispatch Jira work items to GitLab agent pipelines (@fullsend-ai-coder[bot])
• 4b80950: feat(codex): run sub-agents as native Codex children (@dhshah13)

Bug Fixes

• 0a00349: fix(#2264): fail closed on Jira dispatch claim when channels disagree (@fullsend-ai-coder[bot])
• 345763c: fix(#2264): resolve Jira work-item identity for telemetry and update docs (@fullsend-ai-coder[bot])
• ac5359a: fix(#8173): verify review-thread roles only when authoritative (@fullsend-ai-coder[bot])
• 3d72119: fix(#8174): address review feedback on PR #8693 (@fullsend-ai-coder[bot])
• 1a2084b: fix(#8192): fail-closed mint_url precedence for local runs and reconcile-status (@mfrancisc)
• 4fcebc0: fix(#8192): honor config.base.yaml-only mint_url in status notifier (@mfrancisc)
• bd18203: fix(#8192): narrow mint_url OIDC downgrade to genuine local runs (@mfrancisc)
• 295b10b: fix(#8192): read mint_url from config.yaml/config.base.yaml in fullsend run (@mfrancisc)
• 29713b0: fix(#8192): restore statusForgeClient arg dropped by merge conflict (@mfrancisc)
• 0a84358: fix(#8887): keep terminal-phase sandbox creation diagnostics (@fullsend-ai-coder[bot])
• cf1196c: fix(#8948): mask the agentgateway version in the frozen-path diff (@waynesun09)
• 55e3e75: fix(cli): resolve mint_url via layered precedence in cancellation finalizer (@mfrancisc)
• a582931: fix(codex): count a child whose rollout head is empty or cut once (@dhshah13)
• 6a26a79: fix(codex): give the skip reason for a subagents key a skipped persona owns (@dhshah13)
• 8a079a0: fix(codex): keep children off a gateway parent and fail on a lost spawn (@dhshah13)
• 44d182c: fix(codex): keep explore children apart from default in transcript names (@dhshah13)
• 144ad64: fix(codex): name a reserved or unregistered subagents key plainly (@dhshah13)
• af43b0b: fix(codex): read a session_meta line cut before its parent by its name (@dhshah13)
• b845a4c: fix(codex): say spawn where failed spawn items count (@dhshah13)
• 5e0932d: fix(deps): update module github.com/cucumber/messages/go/v34 to v34.2.1 (@renovate-fullsend[bot])
• 1c10a41: fix: address review feedback on PR #8943 (@fullsend-ai-coder[bot])

Agents changes

The fleet agents ship in fullsend-ai/agents v0.53.0-rc.1; its release notes list the agents changes in this release.