[SIkebe]

Summary

• Upgrade GitHub.Copilot.SDK from 1.0.26 to 1.0.27-preview.3 in four sequential commits in this single PR. Each commit updates the central package version, third-party notice, notice test, and native runtime version assertion.
• Add regression coverage proving Triage, Adoption, and Maintenance configs (including clones) leave ExcludedManagedSettings unset. Document this invariant without weakening enterprise policy or changing app-injected permissions.
• Preserve explicit app authentication, manual approval, disabled ambient skills/hooks, typed draft output, conservative usage reconciliation, and complete native runtime packaging.

SDK	Bundled runtime verified with GetStatusAsync()	Commit	Restore / warnings-as-errors build	Full non-manual suite
1.0.27-preview.0	1.0.104-0	b333169	Passed / passed	1,582 passed, 2 Core port-test failures
1.0.27-preview.1	1.0.104-1	c2e7821	Passed / passed	1,584 passed
1.0.27-preview.2	1.0.104-2	e7478f2	Passed / passed	1,584 passed
1.0.27-preview.3	1.0.104-3	d453341	Passed / passed	1,582 passed, same 2 Core port-test failures

Official evidence and exact-package audit

All four release bodies, their applicable comparisons, exact NuGet packages, and bundled-runtime release bodies were read before editing. NuGet dependencies and native download/copy/publish targets are unchanged across all five packages. The targets verify release archive SHA-256 checksums; existing native-alias invalidation and repeated-publish protections remain necessary.

Official source / diff read	Repository relevance and decision
SDK preview.0, 1.0.26 → preview.0 comparison, snapshot ca1103fb47dda263f34d13c489986c423598c74a	Read Client.cs, Types.cs, Host.cs, generated Rpc.cs, related session-lifetime/AHP forwarding tests, and hosting docs. New public .NET surface: policy exclusions and AHP workspace. No mandatory adapter migration.
SDK preview.1, preview.0 → .1 comparison, snapshot 53867584	Exact .NET XML is unchanged. Node's optional timer unref fix is not a .NET/WPF improvement; take only the bundled runtime refresh.
SDK preview.2, preview.1 → .2 comparison, snapshot be9764fe	Public snapshot changes runtime version only; exact .NET XML/targets unchanged.
SDK preview.3, preview.2 → .3 comparison, snapshot c57638f4	Public snapshot changes runtime version only; exact .NET XML/targets unchanged.
Runtime 1.0.104-0	Assisted permissions no longer require experimental mode: retain explicit assisted/bypass denial and verify manual/assisted behavior with offline native tests. Saved unavailable Auto preferences gain runtime fallback behavior without app changes.
Runtime 1.0.104-1, 1.0.104-2, 1.0.104-3	.2 fixes managed fusion startup on Auto and applies fusionTier; this benefits runtime-managed model selection. Attached-task waiting improves SDK Autopilot, but app workflows do not currently use that feature. .1/.3 say only “Fixes and changes”; no more specific benefits are claimed.

The exact .nuspec repository is github/copilot-agent-runtime, not the public SDK snapshot repository. Package repository commits are .0: 0bb4d7ca89df2885b6e071fe24f146c0e3049592, .1: b96e4a56fbda848877bf10f95ba26738438cd34d, .2: a18b2cdbb98a8824a9080c196e93731aafc8a9a7, .3: dc004a660c3a68dc243fc0a79283fb71c8a0db0a. Those runtime sources were not inspected. Exact package XML/public snapshot comparisons establish the available API; package props and native status establish bundled versions. Session.cs, generated session events, and existing usage/structured-output contracts have no public snapshot changes in this range.

Adoption decisions

Added public surface	Migration / value / decision	Verification or reconsideration condition
SessionConfigBase.ExcludedManagedSettings	No required migration. Selective exclusion could support a host policy broker, but RepoSyncRadar must not bypass fetched/device/helper restrictions. Leave unset; add all-purpose regression tests. Host-injected restrictions are independent.	Config/clone tests; native policy schema, composition, and manual-versus-assisted enforcement tests. Reconsider only with an explicitly designed policy-brokering requirement.
AhpHostOptions.Workspace and Rpc.HostStartRequest.Workspace	No required migration. Useful for a future remote-host feature, not the current in-process client. No AHP host/listener is created by CopilotSessionFactory; do not add a network surface just to exercise this API.	Reviewed SDK forwarding tests and hosting contract: absolute existing directory, does not change process/session working directories. Reconsider with a separately scoped remote-host UX/auth design.

No .NET SDK/compiler/test-tooling upgrade is included; no corresponding automatic improvements are claimed. No new experimental API dependency or warning suppression is introduced.

Related Issues

N/A - no issue to close.

Scope

• App UI / workflow
• Core services / data model
• Copilot SDK / agent behavior
• Preview / WebView2
• Documentation / release readiness
• Tests / tooling
• Other:

Validation

• dotnet build RepoSyncRadar.sln -warnaserror — passed at every preview, zero warnings/errors; dotnet restore RepoSyncRadar.sln also passed at every preview.
• dotnet test RepoSyncRadar.sln --timeout 10m -- --filter-not-trait Category=Manual — executed at every preview; results in the table above. Final full run is not green: two pre-existing Core port-allocation failures remain. Final App 830/830, E2E 27/27, Integrations 55/55, Core 670/672.
• Focused tests: native version/hash, managed-policy inventory/intersection, manual/assisted permissions, fusion preference composition, repeated-publish assets, config isolation, notices, factory, usage and structured drafts all passed as part of each full App suite. dotnet test tests\RepoSyncRadar.Core.Tests\RepoSyncRadar.Core.Tests.csproj --no-build -- --filter-class RepoSyncRadar.Core.Tests.Services.Preview.TcpPreviewPortAllocatorTests passed 4/4 after preview.0, but failed 2/4 after preview.3. The same failures reproduced on an untouched archive of remote main (1a9de13), using dotnet test artifacts\sdk-audit\baseline\tests\RepoSyncRadar.Core.Tests\RepoSyncRadar.Core.Tests.csproj -- --filter-class RepoSyncRadar.Core.Tests.Services.Preview.TcpPreviewPortAllocatorTests (2 passed, 2 failed). Failing cases: AllocateSingle_Skips_Listening_Preferred_Port and AllocateComparison_Skips_Pair_When_After_Port_Is_Listening. No unrelated allocator/test changes are included.
• N/A - no UI/WebView behavior changes (only the existing license version text changes); no manual screenshots. Automated WebView E2E passed at every preview. Live model turns and installed Velopack-package smoke were not run; they remain release gates.

Final app-output copilot_runtime.dll and adjacent runtime.node SHA-256 match: 6DB1CA50F9A81287958A3A850E5B6D178670F430883ECAB9A4FF057F64880B5E (Windows ARM64). Native tests also validate test-host assets rather than relying on managed package version or ping alone. git diff --check passed.

Risk And Rollback

• User impact: refreshed embedded Copilot runtime and accurate license notice; no intentional workflow, auth, or permissions changes.
• Operational risk: prerelease runtime changes, with undocumented .1/.3 internals and no live-model/installed-package validation in this task. Existing Core port tests are intermittent on this machine and also fail on baseline.
• Rollback plan: revert the four upgrade commits in reverse order and rebuild to return SDK/runtime/notices to 1.0.26/1.0.103. Existing version-aware asset refresh prevents retaining stale native aliases. No database migration or settings migration.

Release Notes

• User-facing change
• Internal-only change
• No release note needed

Release note draft:

Updated the embedded GitHub Copilot SDK to 1.0.27-preview.3 with runtime 1.0.104-3, while preserving RepoSyncRadar's manual permissions and managed-policy enforcement.

[Copilot]

🔵 Needs a closer look

Live-model and installed-package smoke validation remain outstanding for the prerelease native-runtime upgrade, leaving integration and deployment risks for human review.

No open issues 🎉

What changed in this PR

Updates RepoSyncRadar’s embedded Copilot SDK from 1.0.26 to 1.0.27-preview.3, with bundled runtime 1.0.104-3, while preserving existing authentication and permission behavior.

Changes:

• Aligns the package version, third-party notice, and version assertions.
• Adds regression tests ensuring managed-policy exclusions remain unset for all session purposes and their clones.
• Documents the managed-policy invariant without changing app-injected permissions.

File	Description
tests/​RepoSyncRadar.App.Tests/​Copilot/​SessionConfigBuilderTests.cs	Covers unset policy exclusions across session purposes and clones.
tests/​RepoSyncRadar.App.Tests/​Copilot/​CopilotInProcessRuntimeTests.cs	Updates the expected bundled runtime version.
tests/​RepoSyncRadar.App.Tests/​Components/​ThirdPartyNoticesPanelTests.cs	Updates the expected SDK notice version.
src/​RepoSyncRadar.App/​Settings/​ThirdPartyNotices.cs	Displays the upgraded SDK version.
Directory.Packages.props	Pins the SDK to 1.0.27-preview.3.
.github/​copilot-instructions.md	Documents preservation of managed-policy restrictions.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The prerelease native runtime needs human sign-off because live-model and installed-package smoke validation remain outstanding.

No open issues 🎉

_{Review effort: Balanced}