Release notes

Changelog

New resources and site improvements, recorded when they ship.

  1. Content refresh

    Explain inherited Copilot access before changing policy

    A new AI-tooling lesson and Ryan VerWey audit skill help teams separate feature defaults, model defaults, preview opt-ins, explicit decisions, delegated control, and observed user availability as GitHub's new default feature policy takes effect.

    AI toolingCopilot default-policy governanceMap effective feature and model policy from the enterprise through its selected management path, then govern unconfigured capabilities without confusing inheritance with user access.SkillCopilot Policy Inheritance AuditAudit explicit, inherited, delegated, editable, locked, preview, and exception states without changing policies, seats, or user access.

    6 glossary additions

    Default Availability PolicyUnconfigured AI FeatureExplicit Policy DecisionDelegated Policy StatePolicy InheritancePreview Opt-In

    Researched October 22, 2026 from GitHub's default-feature-policy announcement, current default-availability and release-stage documentation, October 19 model-policy API release, and enterprise AI-controls REST reference. GitHub documents that eligible unconfigured generally available features begin following the selected default on October 22, explicit decisions are preserved, previews remain opt-in, and model policy can be read or updated at defined enterprise, organization, team, and agent-app scopes. SLOPSTACK's effective-policy map, evidence requirements, synthetic verification boundary, review cadence, and change-control gates are operating guidance. Sources: https://github.blog/changelog/2026-09-24-default-enablement-of-copilot-features-for-copilot-business-and-enterprise/, https://docs.github.com/en/copilot/concepts/enterprise/default-availability, https://docs.github.com/en/copilot/concepts/enterprise/learning-about-new-features-and-models, https://github.blog/changelog/2026-10-19-copilot-model-policy-api-for-enterprise-orgs-and-teams/, and https://docs.github.com/en/enterprise-cloud@latest/rest/enterprise-admin/ai-controls

  2. Content refresh

    Release synthetic voices as governed product assets

    A new Ryan VerWey guide and production workflow help teams turn prompt-to-voice candidates into disclosed, tested, versioned, retention-aware, monitored, and reversible GPT-Live releases.

    GuideReleasing Prompt-Generated VoicesSeparate voice design from agent behavior, create bounded candidates, test listener experience and resemblance, map retention, and ship with a rollback manifest.WorkflowPrompt-Generated Voice ReleaseMove one approved voice ID through fixed listening tests, disclosure review, session binding, data review, canary monitoring, and fallback.

    6 glossary additions

    Prompt-to-VoicePrompt-Generated VoiceVoice Description PromptVoice Session BindingSynthetic Voice DisclosureVoice Consent Recording

    Researched October 20, 2026 from OpenAI's October 16 prompt-to-voice release and current custom-voice, GPT-Live prompting, voice-agent, and audio API documentation. OpenAI documents general availability for description-created GPT-Live voices, creation and session limits, responsible-use expectations, the separate consent-based recording path, and retention boundaries; SLOPSTACK's release manifest, listening matrix, resemblance review, canary, monitoring, and rollback requirements are operating guidance. Sources: https://developers.openai.com/api/docs/changelog, https://developers.openai.com/api/docs/guides/custom-voices, https://developers.openai.com/api/docs/guides/live-prompting, https://developers.openai.com/api/docs/guides/voice-agents, and https://developers.openai.com/api/docs/guides/audio

  3. Content refresh

    Run long model outputs as bounded background jobs

    Gemini 4 Argon joins the model catalog alongside a production workflow for deciding when long decode is justified, bounding its shared token window, recovering streams, handling terminal states, assembling continuation hops, and verifying quality, usage, storage, and spend.

    ModelGemini 4 ArgonCompare Google's October 2026 reasoning model, unified 1,048,576-token window, long-decode behavior, multimodal inputs, and time-bounded introductory pricing.WorkflowLong-Decode Background GenerationRun oversized reasoning and generation as a recoverable asynchronous job with explicit token, state, assembly, verification, and cost controls.

    7 glossary additions

    Unified Token WindowLong DecodeBackground ExecutionContinuation HopModel Output StepThinking TokenCumulative Interaction Usage

    Researched October 15, 2026 from Google's Gemini API release notes, Gemini 4 Argon model and migration documentation, long-decode guide, and background-execution guide. Google documents a unified 1,048,576-token input-thinking-output window, 65,536-token default output, server-run continuation hops, asynchronous status handling, cumulative usage, and introductory pricing through November 30; SLOPSTACK's workload gate, token ceiling, recovery contract, artifact review, storage review, and release controls are operating guidance. Sources: https://ai.google.dev/gemini-api/docs/changelog, https://ai.google.dev/gemini-api/docs/models/gemini-4-argon, https://ai.google.dev/gemini-api/docs/latest-model, https://ai.google.dev/gemini-api/docs/long-decode, and https://ai.google.dev/gemini-api/docs/background-execution

  4. Content refresh

    Test whether an agent stops at the boundary

    A new Ryan VerWey guide and reusable audit skill help teams detect persistence, unsafe workarounds, scope violations, evaluation-environment leakage, and monitoring gaps before an agent can create an unapproved real-world effect.

    GuideTesting Agents for Unintended ActionsDefine enforceable action boundaries, prove task solvability, run repeated pressure cases, score correct stopping, and release with layered controls.SkillAgent Action Boundary AuditAudit scope, environment leakage, proposals, authorization decisions, external effects, real-time monitors, and production release evidence without changing controls.

    7 glossary additions

    Unintended Agent ActionAgent Action BoundaryAgent Persistence FailureEvaluation Environment LeakageScope-Aware MonitorTask Solvability CheckReward Hacking

    Researched October 13, 2026 from Anthropic's October 9 report on unintended model actions, its August 31 alignment and security practices, and its research on hierarchical computer-use monitoring. Anthropic reports observed persistence, sensitive form submission, gated-data access, fetch-limit bypasses, offline evaluation changes, scope-aware monitoring, and containment measures; SLOPSTACK's action contract, pressure suite, evidence model, severity levels, and release gates are operating guidance. Sources: https://www.anthropic.com/news/investigating-unintended-model-actions, https://www.anthropic.com/news/improving-alignment-security-efforts, and https://alignment.anthropic.com/2025/summarization-for-monitoring/

  5. Content refresh

    Turn typed model answers into tested product decisions

    A new AI-tooling lesson and Ryan VerWey testing prompt help teams evaluate predicate, choice, and score endpoints with labeled examples, error-cost thresholds, fallback and refusal handling, privacy controls, shadow traffic, and reversible release gates.

    AI toolingTyped AI decision systemsChoose the right decision shape, separate model evidence from policy, and release a versioned decision contract with review and rollback paths.PromptTyped Decision Policy EvaluatorDesign a labeled evaluation, threshold policy, failure matrix, privacy review, shadow test, canary, and production monitoring plan.

    6 glossary additions

    Typed Decision EndpointPredicate DecisionChoice DecisionScore DecisionDecision ThresholdDecision Refusal

    Researched October 8, 2026 from OpenAI's October 6 Decisions API beta announcement, guide, endpoint reference, and data-control documentation. OpenAI documents typed predicate, choice, and score answers over text or inline images, with GPT-6 Luna as the current model; SLOPSTACK's labeled evaluation, cost-sensitive threshold, authorization, human-review, shadow, canary, and rollback requirements are operating guidance. Sources: https://developers.openai.com/api/docs/changelog, https://developers.openai.com/api/docs/guides/decisions, https://developers.openai.com/api/reference/resources/decisions/methods/create, and https://developers.openai.com/api/docs/guides/your-data

  6. Content refresh

    Turn repeated agent work into a governed program

    A new automation workflow and Ryan VerWey architecture prompt help teams replace open-ended multi-agent sessions with versioned execution graphs, typed handoffs, bounded permissions, human checkpoints, replay-safe recovery, and evidence-backed release gates.

    WorkflowDynamic Agent Workflow ReleaseRelease code-defined agent workflows with explicit stages, permissions, typed results, checkpoints, limits, failure tests, canaries, and rollback.PromptDynamic Agent Workflow DesignerDesign a reusable workflow contract that separates deterministic code from agent judgment and makes pause, resume, cancellation, and side effects safe.

    6 glossary additions

    Dynamic Agent WorkflowDeterministic Workflow StepAgent Workflow StepWorkflow CheckpointWorkflow Run LimitWorkflow Run Resumption

    Researched October 6, 2026 from GitHub's October 1 dynamic-workflows announcement and current concept and usage documentation. GitHub documents public-preview workflows in Copilot CLI, the Copilot app, and the Copilot SDK, including sequential and parallel stages, structured results, permissions, run limits, monitoring, pause, and resume. SLOPSTACK's versioned contracts, idempotency receipts, human approval matrix, failure tests, canary, and rollback requirements are operating guidance. Sources: https://github.blog/changelog/2026-10-01-dynamic-workflows-in-copilot-cli-and-the-copilot-app/, https://docs.github.com/en/copilot/concepts/agents/dynamic-workflows, and https://docs.github.com/en/copilot/how-tos/use-copilot-agents/use-dynamic-workflows

  7. Content refresh

    Explain prompt cache misses before tuning production requests

    A new Ryan VerWey guide and reusable audit skill turn weak prompt-cache reuse into an evidence-backed investigation of request prefixes, tools, settings, routing, accepted-output cost, latency, and data boundaries.

    GuideDiagnosing Prompt Cache Misses in ProductionCompare representative Responses API requests, interpret diagnostics with actual usage, fix accidental prefix drift, and prove the result safely.SkillPrompt Cache Efficiency AuditAudit cache-sensitive request manifests, classified misses, economics, latency, logging, retention, and tenant boundaries without changing production.

    6 glossary additions

    Prompt Cache DiagnosticsPrompt PrefixCache BreakpointCached Input TokenCache Miss ReasonCache Write Token

    Researched October 1, 2026 from OpenAI's September 8 API changelog entry and current prompt-caching, Prompt Cache Diagnostics, and deployment-checklist documentation. OpenAI documents comparison-based diagnostics for supported GPT-5.6-and-later Responses API models; SLOPSTACK's reuse hypotheses, evidence packet, accepted-output economics, tenant review, and regression gates are operating guidance. Sources: https://developers.openai.com/api/docs/changelog, https://developers.openai.com/api/docs/guides/prompt-caching, https://developers.openai.com/api/docs/guides/prompt-caching/diagnostics, and https://developers.openai.com/api/docs/guides/deployment-checklist

  8. Content refresh

    Rotate AI API keys without creating the next outage

    A new AI-tooling lesson, reusable audit skill, and Ryan VerWey security prompt turn key expiration and creation policy into an owned credential lifecycle with scoped identities, bounded overlap, observable cutover, verified revocation, and secret-free evidence.

    AI toolingAI API key lifecycle governanceConnect key-creation rules, service accounts, permissions, expiration, environment isolation, rotation, and evidence into one operating model.SkillAI API Key Governance AuditFind ownerless, shared, overbroad, non-expiring, stale, or unrotatable AI credentials without exposing or changing secret values.PromptAI API Key Rotation PlannerBuild a sourced rotation plan with a dependency map, replacement contract, bounded overlap, revocation checks, rollback, and stop conditions.

    6 glossary additions

    API Key Creation PolicyMaximum API Key LifetimeExpiring API KeyCredential Rotation WindowCredential InventoryRevocation Verification

    Researched September 29, 2026 from OpenAI's API changelog and current production, RBAC, and service-account API documentation. OpenAI added project-key expiration and maximum-lifetime controls on September 10, followed by organization and project key-creation governance on September 15; creation restrictions affect new keys, so SLOPSTACK's inventory, overlap, and revocation steps remain necessary operating guidance. Sources: https://developers.openai.com/api/docs/changelog, https://developers.openai.com/api/docs/guides/production-best-practices, https://developers.openai.com/api/docs/guides/rbac, and https://developers.openai.com/api/reference/cli/resources/admin/subresources/organization/subresources/projects/subresources/service_accounts/subresources/api_keys/methods/create