* docs(python-mcp-server-generator): rewrite skill for MCP Python SDK v2
- Target MCP Python SDK v2 (MCPServer) and MCP specification 2026-07-28
- Replace FastMCP imports with `from mcp.server import MCPServer`
- Rewrite the description with explicit triggers and exclusions
- Add the compatibility field (uv, Python 3.10+, npx for the Inspector)
- Add a five-step workflow checklist: create, write, test, validate, configure
- Pin the SDK with `uv add "mcp[cli]>=2,<3"` and use a flat uv app layout
- Add server and in-memory Client test templates
- Add a test-fix-retest validation loop with `uv run pytest`
- Add a Gotchas section for SDK v1 to v2 changes and deprecated features
- Move Streamable HTTP guidance to references/streamable-http.md
- Remove generic guidance that the model already knows
* docs(python-mcp-server): update instructions for MCP Python SDK v2
- Target MCP Python SDK v2 (MCPServer) and MCP specification 2026-07-28
- Replace FastMCP imports with MCPServer and mcp.server.mcpserver imports
- Move transport options from the constructor to run() and streamable_http_app()
- Use Resolve and Elicit for user input instead of ctx.elicit()
- Use ctx.notify_tools_changed() for list change notifications
- Explain ToolError and MCPError behavior for tool failures
- Mark sampling, protocol logging, and roots as deprecated
- Add transport security, CORS, and multi-worker guidance
- Add an in-memory Client test pattern
- Rewrite the text in ASD-STE100 Simplified Technical English
- Use single-quoted frontmatter values
* docs(python-mcp-expert): update agent for MCP Python SDK v2
- Target MCP Python SDK v2 (MCPServer) and MCP specification 2026-07-28
- Replace the retired GPT-4.1 model with GPT-6 Sol
- Replace FastMCP guidance with MCPServer guidance
- Add guidance for transport options, Resolve and Elicit, and notify_tools_changed()
- Explain ToolError and MCPError behavior for tool failures
- Mark sampling, protocol logging, and roots as deprecated
- Add SDK v1 to v2 migration as a supported scenario
- Rewrite the text in ASD-STE100 Simplified Technical English
- Use single-quoted frontmatter values
* chore(python-mcp-development): update plugin metadata for MCP Python SDK v2
- Remove FastMCP from the plugin description and README
- Describe the actual plugin contents: one skill and one agent
- Replace the fastmcp keyword with mcp-python-sdk
- Bump the plugin version to 2.0.0
- Regenerate marketplace.json and docs/README.plugins.md
* fix(python-mcp-server-generator): correct transport security, lifespan, and SSE notes
* fix(python-mcp-server): remove invalid structured_output advice and align with skill
* fix(python-mcp-expert): add missing SDK v2 rules and remove repeated guidance
* fix(python-mcp-expert): remove the retired model from frontmatter
* fix(python-mcp-server-generator): state Node.js as the MCP Inspector prerequisite
* Cleanup of CODEOWNER
Removed a lot of excessive codeowners
Created a new team for reviewing/approving workshops
Removed workflow that did auto-assignment
* Route workshop changes to workshop reviewers
Add workshop ownership, intent labeling, reviewer routing, approval-domain coverage, and maintainer documentation for the new workshop review team.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Simplify foundry-hosted-agent-copilotkit skill and add plugin
Rewrite the skill around Foundry-native primitives and the current
package lines (CopilotKit v2, @ag-ui 1.x, agent-framework-ag-ui 1.4,
azd azure.yaml-only hosted agents), verified end to end against a
deployed Foundry hosted agent with Playwright.
- Consolidate 6 references into wiring.md, hitl.md, troubleshooting.md
- Default wiring: FoundryAgent + AG-UI adapter gateway that keeps no
thread state (Foundry conversation id is the AG-UI thread id)
- HITL via CopilotKit v2 useInterrupt; document two interop shims
- Drop obsolete workarounds for closed agent-framework issues
- Add foundry-hosted-agent-copilotkit plugin bundling the skill with
Microsoft Learn and Foundry MCP servers
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review: per-interrupt approvals, at-most-once wording, pinned ag-ui install
- hitl.md: render one card per open interrupt and resolve each by id;
document how parallel gated calls surface with agent-framework-ag-ui 1.4.0
- wiring.md/SKILL.md: a pre-effect watermark is at-most-once; exactly-once
needs a destination-enforced idempotency key or a single transaction
- wiring.md: install @ag-ui/client at the version the installed runtime pins
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Show conversation startup errors instead of an endless loading state
The wiring.md page example now checks the /api/thread response status,
validates the conv_ id, and renders caught network/JSON/HTTP errors.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Phase 3: canvas smoke-test evidence, safe auto-merge, and weekly review metrics (#4184)
Adds the canvas-smoke-test check with review evidence, a config-gated safe auto-merge workflow (disabled by default), and a weekly review operating metrics workflow, plus maintainer docs.
Refs github/awesome-copilot#4184
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Trigger safe auto-merge sweep after Submission Gate Writer completes
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Rename thirdParty identifier to satisfy codespell
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address Copilot review on canvas smoke test, auto-merge, and metrics
- Bind canvas report writer to the triggering workflow_run PR (base/head repo, ref, SHA)
- Bound PNG inflation by IHDR-derived size and a decoded-bytes budget
- Classify file: URLs as unsafe manifest paths
- Follow CommonJS require() and literal dynamic imports; error on missing
reachable targets and devDependency-only runtime imports
- Validate removed extension paths and orphaned plugins instead of skipping
- Warn on .py/.rb/.pl scripts
- Auto-merge: support CODEOWNERS teams (fail closed), front matter authors,
list PRs by head SHA, only fall back to direct merge on clean status,
drop ineffective check_run trigger
- Metrics: ignore reviews before the PR was ready for review
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Docs: note microsoft/azure-dev-tools as a portable marketplace for the review model
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Auto-merge: only trust submission-gate runs from the Submission Gate Writer
Adds trusted_checks (default submission-gate -> external_id
submission-gate-writer). Any other check run or status with that name on the
head SHA blocks arming, so a PR-defined job cannot satisfy the gate.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden canvas smoke-test checker
- String-, template-, and regex-aware comment stripping so literals containing // cannot hide imports
- Never follow symlinks or read non-regular files; bounded, contained reads
- Validate plugins whose plugin.json was deleted
- Reject unsafe extension IDs in plugin manifests before materialization
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Phase 3: remove auto-merge, isolate canvas smoke test, harden checker
- Remove safe auto-merge (config, workflow, script, tests, labels) per
maintainer review; documented as deferred pending a security review.
- Restore validate-canvas-extensions.yml to main and move the smoke test
to its own canvas-smoke-test.yml workflow scoped to extensions/**.
- Reject duplicate IHDR chunks in preview PNGs.
- Mask string/template/regex literal contents before extracting dynamic
import() and require() specifiers.
- Resolve package.json imports aliases through the same classifier and
module graph; fail closed on alias shapes that cannot be analyzed.
- Rename docs to canvas-evidence-and-metrics.md and update references.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix canvas smoke and review metrics findings
- Trigger canvas smoke tests for plugin changes while skipping expensive setup when target detection finds no canvas coverage.
- Fail reachable data: imports while preserving warnings for unreachable module data: imports.
- Use base plugin manifests for deleted bundle plugin detection and fail closed when base manifests cannot be read.
- Paginate GraphQL PR review pages before computing weekly review metrics.
- Report workflow run API collection errors as incomplete automation health instead of not found.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address follow-up canvas review findings
Fail closed on non-literal runtime imports, require canonical PNG termination, restrict comment updates to github-actions[bot], and paginate external-plugin label events.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Add Draw canvas extension
Draw is a GitHub Copilot app canvas for simple diagrams: shapes, arrows
that stay attached, text and a freehand pen. The user and Copilot edit the
same drawing. Copilot can create, change, lay out and export it through
canvas actions, and the Ask Copilot button sends the drawing to the chat.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address Copilot review feedback
- Refuse changes that would take a drawing past 5,000 elements with a
clear error instead of silently dropping elements, and stop the canvas
from retrying a refused save.
- Keep collision suffixes within the 48-character id limit.
- Keep a drawing and report the error when deleting its file fails.
- Retry failed drawing writes, and report them in the canvas and in agent
action results instead of only logging them.
- List pen strokes in the get_drawing outline.
- Let Space and Enter work normally on focused buttons.
- Only use Tab to add a step when a shape is selected, so Tab can move
focus out of the canvas.
- Pick readable text colors for accent and danger backgrounds.
- Hide "Bring to front" and "Send to back" when only arrows are selected,
since arrows always draw on top.
- Report theme save failures from /api/settings and set_theme.
- Keep the top bar buttons visible when the status text is long, and
remove leftover theme debug logging.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address second Copilot review
- Add node:test suites for the loopback server (Host and token checks,
static file allowlist and CSP, every API route, live events and save
error reporting), the drawing store, layout label references and
solid-fill text contrast. Run them with `node --test` in extensions/draw.
- Give every popover an accessible name. The delete confirmation is now an
alertdialog described by its question.
- Build the id and label lookups in buildFromSpec once, instead of once per
element or per edge.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address third Copilot review
- Switching drawings or asking Copilot no longer goes ahead when the edits
on screen could not be saved first. Draw stays on the drawing and offers
"Discard changes", and a switch started by the agent moves the server back
to the drawing the panel still shows. Deleted drawings never hold the panel.
- Agent actions write the drawing before returning, so a disk problem is
reported by the action that caused it.
- Count edge crossings with a Fenwick tree (O(E log V)) and typed arrays.
The layout is unchanged; the worst case is about three times faster.
- Reconnecting brings back a save error that still applies.
- The selection keeps up to MAX_ELEMENTS ids instead of 1,000.
- Tests for the actions wrapper, the selection limit and crossing counts.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address fourth Copilot review
- Stop an old save from undoing the last one. Each change the page
sends now has a number, and the server drops one older than a change
it already applied (refused changes do not count). The save sent when
the panel closes also sets every element the change still on its way
touched to what the editor shows, so either arrival order ends with
what is on screen.
- get_drawing reads a big drawing in parts of about 30,000 characters
(start and nextStart), can list only some ids or the selection, cuts
labels longer than 300 characters in the outline, and counts a huge
selection instead of listing it.
- Ask sends at most about 16,000 characters of outline and says how
to read the rest with get_drawing.
- After switching away from a drawing with "Discard changes" while a
save was on its way, send edits made in the new drawing once it
returns.
- Tests for all of the above.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address fifth Copilot review
- Exports stay with the drawing they came from. The agent's export
request names the drawing, the page answers with the id it actually
drew, and the server turns down a mismatch instead of saving the
image under the wrong drawing. Save as PNG and Ask read the id right
before rendering, and Ask keeps the question if another drawing
opens while it is sending.
- When the server tidies up a save, for example by capping a size, it
sends the stored drawing back and the page shows that instead of
assuming it was stored as sent. The tidy-up is not an undo step, so
undo cannot get stuck on it.
- Shapes are capped at 5000 wide or tall everywhere. Growing a shape
for a longer label or a bigger text size caps the height before
centering, so the shape no longer jumps.
- Rebuilding the style bar keeps keyboard focus on the same button,
and hiding it moves focus to the canvas.
- Edits refresh the drawing list, batched so a burst of edits sends it
once, and a copied drawing is listed with its real element count.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address sixth Copilot review
- Ask refuses (409) to send a question when the panel shows another
drawing than the one it is about, and the page keeps the draft. The
context it sends now includes the drawingId.
- Actions on the shown drawing take an optional drawingId. If the canvas
shows a different drawing, they change nothing and say which one it
shows.
- Temp file names for atomic writes include a counter, so two writes of
one file in the same millisecond no longer share a temp file.
- The canvas works from the keyboard and with screen readers: the SVG is
a focusable application with a description, N and Shift+N select
elements, Enter adds shapes and text or connects shapes with the arrow
tool, Ctrl+Shift+Arrow resizes, and a live region reads out the tool,
the selection and each change. Tab now moves focus instead of adding a
step, except while typing a label.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address seventh Copilot review
- Saving: a write that fails part way (a full disk, say) no longer leaves
its temp file behind. Every retry picks a new temp name, so these used
to pile up.
- Diagram specs: a node or text with only x or only y is now an error that
names the item, instead of being laid out automatically and silently
dropping the coordinate that was given. Non-numeric x or y is an error
too.
- Switching drawings: while the panel waits to save the current drawing
before showing another one, the server already sends the new drawing's
changes, save status and selection. These are now kept and applied when
the switch finishes, instead of being dropped.
- Showing the drawing that is already on screen (an agent calling
open_drawing on it, or two switches to the same drawing) is now a normal
update. It no longer reloads the editor, which wiped the undo history,
the selection and the zoom, and it no longer warns about unsaved changes
while a save is being refused. The server keeps the panel's selection in
that case too.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address eighth Copilot review
- State file: writes of .state.json (which drawing each panel shows) now
run one at a time, and each one takes the state as it is when its turn
comes. An older write that is slow to finish (Windows can briefly lock
a file) can no longer land after a newer one, and flush() now also
waits for a state write that had already started.
- Placement: when every spot tried next to a shape is taken, a new shape
now goes just past everything in that direction, in line with the
shape, instead of on top of existing content. This covers both the
editor's "add a connected step" command and add_elements.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address ninth Copilot review
Tab in the label editor now adds the next step only for shape labels.
For free text and arrow labels it keeps its normal job and moves focus
on, and the blur saves the edit. The README and the in-app shortcut list
now say "a shape's label".
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address tenth Copilot review
- Label wrapping searches for how many words or characters fit on a
line instead of adding one at a time, so a long label with no spaces
is no longer quadratic. The output is unchanged.
- Arrows attached to nothing follow their elbow or curve route too.
- A selection the agent makes while the user drags or edits a label is
shown once they finish, unless they picked something else meanwhile.
- A drawing name more than one drawing has no longer opens the first
one; the error lists their ids, and an exact id always picks one.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address eleventh Copilot review
- Pen strokes stay bounded while drawing: once a stroke holds 10,000
points it is simplified and thinned to 5,000. A saved stroke keeps an
even spread of its points with both ends, instead of losing its end
past 5,000 points. Simplification runs in pieces of 512 points, so its
time grows in step with the stroke rather than with its square.
- Live updates send the element-level ops that made a change, against
the drawing one change earlier, instead of the whole drawing to every
other panel. A panel that finds a change missing fetches the whole
drawing again.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address twelfth Copilot review
- The save a page sends as it closes is marked keepalive whenever it fits
the browser's 64 KiB limit. That limit covers all keepalive requests
together, so splitting would not help; a bigger save goes as an
ordinary request.
- Pen strokes keep at most 2,000 points, so even the biggest one fits in
that save. A test checks the biggest stroke and labels against the limit.
- A rename goes to the drawing it was typed for. It is cancelled if the
panel moves to another drawing, it does not undo a rename the agent made
meanwhile, and its reply never moves the panel.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address thirteenth Copilot review
- Turn down a layout that would put a shape or text past the +/-1,000,000
position limit (very long arrow labels spread the layers that far).
Saving used to move such positions back to the limit, stacking shapes on
top of each other while the action reported success. set_diagram and
add_elements now fail with invalid_diagram, and layout with
layout_too_big, and nothing is changed.
- Fetch the drawing each time the event stream connects, not only on
reconnects. A change made after the page loaded the drawing but before
the server registered the new connection was never delivered.
- List text size on shapes, arrows and text, and color on text, in the
get_drawing outline, and say that styles left out are the defaults.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address fourteenth Copilot review
- open_drawing now waits for the canvas to take the drawing. The switch
carries an id, and the page confirms it once it shows the drawing, or,
when it has edits it cannot save yet, moves the panel back with the same
id. A refusal becomes an unsaved_changes error, and no answer within 10
seconds is reported as unconfirmed, with advice to pin drawingId.
- Pen hit testing no longer makes an object for every point on every
pointer move. Stroke extents are cached per points array, strokes out of
reach are skipped by their box, and the rest are measured straight from
the stored pairs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address fifteenth Copilot review
- Automatic layout counts the placeholders its long arrows need before
making any, and turns down a drawing that needs more than 100,000. A
long chain with many arrows across it could otherwise need millions,
which kept the extension busy for most of a minute. layout fails with
layout_too_big, and set_diagram and add_elements with invalid_diagram,
and nothing is changed.
- relayout now returns { elements, error } like buildFromSpec, so the
layout action gets this and the position range check from one place.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* new instruction make-blog-post.instructions
* Revise blog post instructions for clarity
Updated post file layout and clarified approval process for posting.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update automation mode and documentation linking instructions
Clarified automation mode description and updated linking instructions for documentation.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Refine blog post destination and conflict instructions
Clarify instructions for handling destination paths and conflicts.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Revise blog post instructions for drafts and naming
Clarified instructions for handling drafts and file naming rules.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update instructions for staged mode gate closure
Clarified the closing condition for the gate in staged mode.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* polish: apply notes suggesting closer look needed
* Refine blog post creation instructions
Clarified instructions for writing and uploading blog posts, including changes to venue-specific copy handling and slug conventions.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* polish: apply suggested notes, update generated marketplace
* polish: apply suggested notes
* new skill make-blog-post
* Revise voice profile guidelines and blog platform details
Updated guidelines for voice profile and blog platforms.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix argument-hint formatting in SKILL.md
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: machine-specific sample locations, address prev. miss
* resolve: workflow order, author id, overlap generator detect behave err.
* resolve: previously missed review items
* resolve: previously missed review items
* Update destination handling instructions in SKILL.md
Clarify instructions on handling user-specified destinations and workspace paths.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184)
Phase 2 (enforcement) of github/awesome-copilot#4184:
- submission-gate aggregate required check (reader) with infra vs contribution failure classification
- merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy
- Submission Gate Writer maintaining state labels and a persistent status comment
- /rerun-checks and /request-review PR commands
- validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix codespell findings and add spelling to submission gate checks
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden submission gate per review feedback
- Publish the submission-gate check from the trusted writer via the Checks API
and flag any other submission-gate check run as tampering
- Fail closed on truncated file lists, unscannable diffs, permission lookup
errors, and skipped required checks
- Discard evaluations when the PR head or reviews change mid-run
- Low tier requires a resource owner approval
- Commands must start the comment, matching the workflow filter
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address #4190 review: command reader/writer, pools, paths, staleness
- Split /rerun-checks and /request-review into a read-only issue_comment
reader and a workflow_run writer that re-reads the comment, PR, and
permission before writing.
- Drop the workflow-security pool; agentic workflows and hooks are
content (medium unless they add scripts or hook commands); the core
pool is core-maintainers.
- Include each check's workflow file and eng scripts in its paths.
- Discard evaluations when the base branch or risk labels change; run
the gate on PR edits (retargeting).
- Correct copies of the writer's check that claim success while the
evaluation fails.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on lost contributor signal; publish gate check before labels
- A contributor check whose pr-check job succeeded but whose result artifact
is missing or unreadable is now an infrastructure failure, so a lost HIGH
signal can't lower the approval tier.
- Publish the submission-gate check right after stale-state revalidation;
label and comment sync are independent and reported afterwards.
- Revert the self-path added to validate-agentic-workflows-pr.yml's trigger:
that workflow rejects any .github change. Exempt it in the drift test.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on bad routing config; advisory checks never hold the gate
- loadGateConfig: a missing review-routing.yml still falls back, but a
file that can't be parsed (or whose pools isn't a mapping) now throws
instead of silently relaxing approvals.
- Pending required: false checks no longer keep the PR in
awaiting-automation or the gate check in progress, and the polling loop
doesn't wait on them. They render as pending (advisory).
- PR commands: 👀 marks a command as claimed; 🚀 is written only after
the reply is posted and is the only replay guard, so a run that failed
partway can be retried.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix codespell: unparseable -> unparsable
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Phase 1: distributed CODEOWNERS and automated reviewer routing (#4184)
- Replace the individual default CODEOWNERS owner with the core-maintainer
team and add domain team ownership for extensions, plugins, content,
hooks, workflows, .github, and eng.
- Add .github/review-routing.yml as the single source of truth for reviewer
pools, routes, labels, and SLA settings (ships in dry-run mode).
- Add eng/review-routing.mjs (+ unit tests) with business-day math,
least-loaded reviewer selection, routing and escalation planning, and
workflow_run artifact validation.
- Add Review Routing (workflow_run/dispatch/schedule), Review Routing Request
(read-only needs-reviewer reader), and Review Escalation (weekday schedule)
workflows.
- Add needs-reviewer, review-overdue, review-escalated to setup-labels.
- Document the model in docs/maintainers/review-routing.md.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address review feedback on reviewer routing and escalation
- Escalate at routedOn + escalation business days (Mon -> Fri)
- Leave labels untouched when requestReviewers fails and fail the job
- Serialize read/plan/apply per PR across routing and escalation
- Treat Label PR Intent artifact labels as authoritative
- Re-route to an uncovered pool on head changes without restarting SLA
- Use the due-label timestamp as the review boundary
- Fall back to pool/escalation teams and report what was requested
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address second-round review feedback on review routing (#4184)
- CODEOWNERS: route /hooks/ and /workflows/ to content reviewers, drop the
separate /.github/workflows/ rule, and leave per-resource owner lines as on
main (their removal is deferred to a separate cleanup).
- Routing: ignore pending requests for unavailable reviewers when checking
coverage; needs-reviewer excludes prior reviewers and changes nothing when no
new reviewer can be requested.
- Escalation comments show the actual routing date.
- Cap sweep matrices at 256 targets and defer the remainder.
- Docs: best-effort load balancing, matrix cap, and needs-reviewer semantics.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Route workflow and hooks labels to the content pool (#4184)
Drop the workflow-security reviewer pool per maintainer feedback: agentic
workflows and hooks are reviewed like other content, and the repository's
own GitHub Actions workflows stay with core maintainers.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Pin routing contract in tests; make CONTRIBUTING routing note dry-run aware
- Assert the exact label-to-pool mapping and priority order, pool set, and default/escalation pools for the shipped config.
- CONTRIBUTING.md: describe automatic routing as active only once dry_run is turned off.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Simplify dry_run validation condition
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Adds a skill for taking a Windows desktop app through its first Microsoft
Store submission: product identity, an unsigned Store MSIX, package
inspection, WACK with report verification, every Partner Center section,
and certification monitoring. It includes PowerShell scripts for MSIX
inspection and WACK, a guarded Playwright controller for Partner Center,
references, and templates.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 33e33f93-bd16-4262-8026-fc42063cef78
The README build fetched the live GitHub MCP registry to decide whether to
link server names, which made output nondeterministic (e.g. Apify) and
caused the validate-readme check to fail intermittently.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add v-development skill
Teach Copilot V language development: toolchain, v.mod layout, build/test/fmt, and Option/Result error handling.
* Fix v-development skill accuracy
Correct v.mod schema (dependencies), manifest optionality, entry-point guidance, VPM registry URL, and globals rule per official V docs.
* Correct mutability and Option/Result propagation guidance
Variables use mut, only struct sections use mut:; postfix ? propagates Options, ! propagates errors; no forced unwrap.
* Scope compilation, nil, and mutability guidance to verified behavior
v run excludes test files; nil only in unsafe/C interop; mutable parameters documented.
* Keep example Config fields immutable
The port field was never mutated; placing it under mut: contradicted the immutable-by-default guidance.
* Recommend json2 over superseded json module
Official V docs teach json2 for encoding/decoding.
* feat(skills): add test-gap-audit and docs-sync-audit
Two repo-agnostic review skills that answer questions the existing testing and
documentation skills do not.
test-gap-audit asks which behaviour is not covered, rather than how to write a
test in a given framework. Given no scope it audits the whole repository,
inventories the testable surfaces, and reports which routes, services, jobs and
contracts have no tests, too few assertions, or only indirect coverage. It
bundles coverage_map.py, which detects the test framework and naming convention,
then matches every source file to tests by name, by mirrored path, and by what
the test files actually import, and ranks the unmatched by risk keyword and size.
docs-sync-audit compares what the docs claim against what the code does. It
bundles docs_drift.py, which checks documented npm scripts and make targets
against the ones that exist, relative Markdown links against the filesystem, and
environment variable names in both directions. It also reports a documented
setting that is read only inside a module nothing imports, which is configuration
that reads as working but cannot take effect.
Both are read-only: they report and do not edit unless asked. Both emit the same
contract, so a finding always carries a P0-P3 severity and a path:line you can
open. Both scripts are Python standard library only, install nothing, and are
accelerators rather than requirements, so each skill still works when the script
cannot run.
The existing testing and docs skills here are framework-specific, which is where
most of the value is. These are the repo-agnostic complement: pytest-coverage
raises coverage inside a pytest project, and this decides where coverage is
missing across a repository regardless of language.
* fix: satisfy codespell and regenerate all generated docs
Two CI failures on the first push.
codespell flagged `testng` and `shouldBe` in coverage_map.py. Both are
legitimate identifiers rather than typos: TestNG is the Java test framework the
script detects by name, and shouldBe is the Kotlin and Scala assertion method
matched by its assertion-detection regex. Added both to ignore-words-list with a
comment each, following the convention already used for the other entries.
validate-readme failed because I had reverted docs/README.agents.md. `npm start`
rewrites a Dynatrace MCP URL there from re-fetched external plugin data, which is
unrelated to these skills, so I had excluded it to keep the diff scoped. That was
wrong: the check regenerates every generated file and compares, so the commit has
to carry whatever the build produces. Restored.
---------
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Add dev container configuration instructions
Twelve sourced rules for reviewing and authoring devcontainer.json, Dev
Container Features, and Codespaces lifecycle configuration. Every rule
cites the Dev Container specification, the reference CLI source, or
official vendor documentation, and needs only file reading rather than a
container build.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZ5Ak8ifbxDC6zQvJQt26T
* Regenerate instructions index
Output of `npm start` (eng/update-readme.mjs + eng/generate-marketplace.mjs)
after adding instructions/devcontainers.instructions.md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZ5Ak8ifbxDC6zQvJQt26T
* Allow two source-faithful spellings in codespell
`implementors` is a path segment in the containers.dev specification URLs
that instructions/devcontainers.instructions.md cites, and `evaulated` is
spelled that way inside a verbatim quotation from the Dev Container
Features specification. Neither can be corrected without breaking a link
or falsifying a quote.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZ5Ak8ifbxDC6zQvJQt26T
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Add research experiment discipline instructions
* Convert to a custom agent per review feedback
* Drop accidental generator churn from README.agents.md
Adds a skill that converts text, markdown, or the output of another
skill into an MP3 using Kyutai pocket-tts, a small neural TTS model
that runs on CPU.
No existing skill in the collection generates audio, so this fills a
gap rather than duplicating one. It is designed as a terminal step in
a chain: roundup, daily-prep, or meeting-minutes produce the text,
speak-summary makes it listenable.
Two details worth calling out:
- The bulk of SKILL.md is guidance on rewriting written prose for the
ear before synthesising. Feeding markdown straight into a TTS engine
produces something technically correct and unlistenable, so that
step carries most of the value.
- Synthesis is local and CPU-only, so nothing is sent to a cloud
speech service and the skill works unattended in a headless
container as well as on a laptop.
The bundled script bootstraps pocket-tts into a cached virtualenv on
first use, selecting a Python in the supported >=3.10,<3.15 range
rather than assuming python3 qualifies, and failing with actionable
guidance when none is available.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1a70aa08-b622-4825-ad63-5a12370add1f
* fix(eng): list nested skill assets instead of directory names
* test(eng): clean up temp dirs and cover nested SKILL.md assets
* fix(eng): do not follow symlinks when listing bundled assets
* fix(eng): keep file symlinks in bundled asset lists
* Add Git Worktree Explorer canvas
Add an interactive repository, worktree, branch, and commit graph with GitHub PR enrichment, safe inspection actions, and shared lane visualization.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69dd5824-7094-4b82-8cfa-83c2fbe53307
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address review feedback for Git Worktree Explorer
Security
- Quote copied shell commands (git -C / git log) with shell-safe single quoting and --end-of-options via new public/shell-quote.mjs
- Move repository path into the untrusted data block of the commit Ask Copilot prompt
Performance
- Compute branch divergence with a single `git for-each-ref %(ahead-behind:...)` query (Git 2.41+), falling back to rev-list with bounded concurrency (8) instead of one process per branch
- Drop the unused `git show --stat` summary from commit details
Correctness
- Only attach same-repository pull requests to local branches (filter isCrossRepository / headRepositoryOwner)
- Resolve the default branch by full name or upstream instead of a suffix match (server + client)
- Preserve already-loaded commit pages when a load-more request fails; only reset requests show the error state
- Size the lane graph from the widest row (lanes + branch badges + text) and collapse >3 branch tips into a "+N more" badge
Accessibility / UX
- Add aria-pressed to view toggles and graph nodes; replace the unimplemented ARIA tree with group/button semantics
- preventDefault on Space/Enter for branch badges so keyboard activation does not scroll
- Use a lane palette that meets 3:1 contrast in both light and dark themes (tested)
- Mobile inspector no longer auto-opens on snapshot load and gains a close button
Tests: 19 -> 29
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
* Migrate git-worktree-explorer to plugins/ manifest layout
Move the manifest from extensions/git-worktree-explorer/.github/plugin/plugin.json to plugins/git-worktree-explorer/plugin.json with README and copilot-extension.json, matching the extensions-container migration (#2334). Regenerated marketplace.json and docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
* Address follow-up review: shell-specific quoting and sibling row controls
- quoteShellArg/formatShellCommand take a target shell; PowerShell doubles apostrophes while POSIX uses '\\''. app.js detects the platform and reports which syntax was copied.
- Commit rows no longer nest branch badge buttons inside the row button; the row button and badges are sibling controls.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
* Make the closed mobile inspector inert and restore focus to the graph
When the inspector overlay is dismissed on narrow viewports it is now marked inert/aria-hidden so its controls leave the tab order and accessibility tree, focus returns to the selected graph control, Escape closes it, and viewport changes re-sync the state.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: 69dd5824-7094-4b82-8cfa-83c2fbe53307
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
An on-call error-triage canvas for GitHub Copilot: scans live Sentry
issues, groups them by urgency, and hands issues off for tracking or a
fix PR. Registers a reusable canvas extension under extensions/ with a
matching plugins/sentry-triage manifest.
The extension runs a loopback HTTP/SSE server per canvas instance
(host-allow-listed, per-instance capability token never broadcast over
SSE), renders the triage board server- and client-side, and drives
model turns over a single shared Copilot session serialized so scan and
work turns can't interleave. Work state is prototype-pollution-guarded
against agent-controlled tracking keys, and sendAndWait timeouts are
handled without duplicating external side effects.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add poka-yoke skill: make misuse unrepresentable rather than warned against
Mistake-proofing, applied to code. The skill pushes toward devices that make
a wrong action impossible or self-announcing, rather than instructions asking
someone to avoid it, and refuses to accept a comment or a convention as a fix.
The gap it addresses. Given a design, models readily list what to fix and
rarely state what the fix makes impossible. Measured across 591 blind-graded
runs and six model families, responses named the foreclosed set 42% of the
time unprompted and 81% with this skill applied. Assertions were written
before the runs and graded blind to configuration.
Stated with its limits, because they matter: every run was the first turn of
a fresh session, so this measures the ceiling rather than what survives a
long working session; the comparison was against no methodology rather than a
different one, so it does not establish that this particular method caused
the gain; and the skill costs something measurable, making responses somewhat
worse at spotting the specific defect already on the page while better at
changing the shape that allowed it. All of that is in the skill body rather
than omitted.
Bundled, all self-contained, no network access and no dependencies:
scripts/detect_hazards.py standard-library scanner, 42 pattern rules
across 20 hazard shapes, five languages
references/hazard-catalog.md the taxonomy with device per shape
references/lang-*.md Python, TypeScript, Go and Rust patterns
Verified with npm run skill:validate and npm run build. Raw benchmark runs,
the harness and the assertion checklists are public at
https://github.com/rainmanjam/poka-yoke
* Rename HasTable to HasFrom in the TypeScript typestate example
codespell failed the PR: it reads HasTable as a misspelling of hashtable.
The identifier is a legitimate generic parameter on a typestate builder,
QueryBuilder<HasTable, HasWhere>, so this is a false positive, but it is our
file breaking their gate and the fix costs nothing.
HasFrom is also the better name: the flag tracks whether .from() has been
called, not whether a table exists.
Renamed in the upstream repository too, so the two copies do not diverge on
day one. Verified the whole bundle is codespell-clean locally.
* Correct the effect figures in the poka-yoke skill
The submitted numbers (42% -> 81%) could not be reproduced from the upstream
gradings. Recomputed over the six models the sentence describes: 45% -> 80%
across 132 verdicts. Adds the per-scenario breakdown, which is the more useful
claim: the gains are in tasks where nobody asked for a design review.
* feat(plugins): add fluentui-blazor plugin bundling skill and MCP server
Bundle the existing skills/fluentui-blazor skill with the official Fluent UI
Blazor MCP server (NuGet: Microsoft.FluentUI.AspNetCore.McpServer, launched via
dnx) so users get usage guidance plus live component, enum, icon, documentation,
and v4-to-v5 migration lookup from a single plugin install.
The skill is referenced, not copied; skills/fluentui-blazor/ is unchanged.
Regenerated marketplace.json and docs/README.plugins.md via npm run build.
* fix(eng): count MCP servers in README plugin item totals
update-readme.mjs summed agents, skills and extensions but ignored
composition.mcpServers, while generate-website-data.mjs already counted MCP
entries. The README and website catalogs therefore disagreed for any plugin
declaring an MCP server.
Mirror the website generator logic, including the .mcp.json path form and
multi-server files, so both catalogs report the same totals. Affects
awesome-copilot (4 to 5 items) and fluentui-blazor (1 to 2 items).
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(plugins): align fluentui-blazor MCP config with the Agent Plugin spec
Rename .mcp.json to mcp.json at the plugin root and add the
https://agent-plugins.org/schemas/1.0.0/mcp.schema.json reference, matching the
Agent Plugin MCP server specification. Drop the manifest mcpServers reference,
since clients discover mcp.json without it.
Also correct a README claim that the server reads the library version in use.
Its documentation is generated at package build time and serves the version it
was built against, which is what the Prerequisites section already stated.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: regenerate plugins README after restoring the mcpServers manifest reference
Re-adding extensions[com.github.awesome-copilot].mcpServers to plugin.json makes
the item counter include the bundled MCP server, so the fluentui-blazor row goes
from 1 to 2 items. The generated file was not refreshed at the time, which failed
the validate-readme check.
* refactor(plugins): drop the mcpServers manifest reference for fluentui-blazor
Clients discover the plugin-root mcp.json on their own, and the
com.github.awesome-copilot namespace is stripped from the served manifest by
materialize-plugins.mjs, so the field had no effect on the published plugin.
Regenerate docs/README.plugins.md in the same commit: the item counter keys off
the manifest field, so the row goes back from 2 to 1 item and validate-readme
would otherwise fail.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(plugins): scope the fluentui-blazor PR to the plugin itself
Drop extensions[com.github.awesome-copilot].mcpServers from plugin.json as
requested in review: clients discover the plugin-root mcp.json on their own, and
materialize-plugins.mjs strips this namespace from the served manifest, so the
field never reached clients.
Revert the item-counter change to eng/update-readme.mjs and regenerate. Counting
MCP servers is a repo-wide concern and now lives in its own pull request, so this
one only adds the plugin.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add repo-standardizer skill: polish any GitHub repo surface
* fix(skill): remove non-string metadata and fix template README refs for vally lint
* docs(skill): drop markdown relative links from README language-switcher example
Vally valid-refs flagged ./README.md and ./README.zh.md as missing file
references; they are generated artifacts, not skill files. Keep the
example as plain text to satisfy the linter.
* fix(template): add missing language switcher to English README template
Align with README.zh.md template and SKILL.md switcher convention:
current language as plain text, other languages as relative links.
---------
Co-authored-by: programmingWTF <programmingWTF@users.noreply.github.com>
Bruce MoeandCopilot App
Aaron PowellandCopilot
Julia MuiruriandCopilot App
Burak Kaygusuz
Dan WahlinandAaron Powell
Burke HollandandCopilot App
John HaugabookandCopilot Autofix powered by AI
Ulises Jeremias
Jonathan Russ
Andrew ArnottandCopilot
github-actions[bot]andPretaSOFT
sudhirp25
Ricky
Mnimiy
CrabbbandБаньковский Станислав Евгеньевич
Sandra AhlgrimmandCopilot App
Marco Antonio SilvaandCopilot
Furkan RehaandAaron Powell
Emil DanandClaude Opus 5
Cahid Arda
Pierce BogganandCopilot App
Guo Cheng
Alex Sokol
Sam RoweandCopilot App
Sepuri Sai Krishna
grgy078033
Liz TomandCopilot App
Shannon Atkinson
Muhammad Ubaid Raza
Samuel Bushi
Adrien ClerboisandCopilot Autofix powered by AI
Guiyu LiandprogrammingWTF