[SIkebe]

Summary

• Update GitHub.Copilot.SDK from 1.0.27 to 1.0.28 in the requested two-commit sequence:
  • 1462dd2 — update to 1.0.28-preview.0, refresh notices/runtime assertions, and add Connector identity/approval regressions.
  • 6d11175 — promote to stable 1.0.28 and its exact bundled runtime.
• Important findings: (1) the .NET API additions are five optional Connector display-label properties, not new approval identities; (2) preview bundles runtime 1.0.105-1, while stable bundles 1.0.105 despite its release prose mentioning 1.0.105-1; (3) generated RPC APIs and build targets did not change, so existing native alias/publish refresh workarounds remain necessary.
• Preserve the existing restrictive MCP policy. Regression tests round-trip both raw and derived permission display labels, retain ServerName, and deny MCP requests even when read-only, managed-approval-required, or labeled like an approved radar tool/docs host.

Evidence matrix

Official source / exact artifact	Read evidence	Relevance / decision
Preview release and linked comparison	Full release body and .NET patches; snapshot 9bc718cb608c4cd3b63e0e71c637dcf1ebfd5409	Adopt additive label support through the SDK; protect identity-based authorization.
Stable release and linked comparison	Full release body; stable snapshot fa108e71ee3025663e0dac20f2a071055d3a6b14; preview-to-stable diff changes only Node version files	Final target is stable; no additional .NET source migration.
Exact NuGet 1.0.27, 1.0.28-preview.0, 1.0.28	.nuspec, bundled props, build targets, net10 XML docs	Runtime pins are 1.0.104 → 1.0.105-1 → 1.0.105; dependencies/targets unchanged; preview/stable XML identical. Native status tests confirmed both updated pins.
NuGet repository metadata	Baseline runtime commit 9301f9874504241ceb199febd252b7411a92bd52; both new packages reference 845c22879d426535d97901908014b807e0b68d0f	These identify the runtime repository, not the public SDK snapshot. Private runtime source was not inspected.
SDK Session.cs, Client.cs, Types.cs, Generated/SessionEvents.cs, Generated/Rpc.cs	Changed handler forwarding and DTOs; unchanged client/RPC/serializer contracts established by tag diff and package XML comparison	No changes needed to response extraction, usage reconciliation, structured output, auth, lifecycle, or tool filters.
SDK ElicitationE2ETests, SessionEventSerializationTests, PermissionHandlerTests	Capability negotiation, accept/decline/cancel, serialization/permission test context	Do not enable unsupported elicitation or Connector flows merely to consume display metadata.
Runtime 1.0.105 and 1.0.105-1	Full bodies; stable mentions Fusion High/Max selection from long-context sessions; prerelease only says fixes/changes	Receive runtime refresh automatically; no claim that RepoSyncRadar exercises the runtime slash-command picker.

Adoption matrix

Added public surface	App value / decision	Verification / future condition
PermissionRequestMcp.ServerDisplayName	Additive deserialization; never use a display label for approval	New raw-permission serialization and denial tests.
PermissionPromptRequestMcp.ServerDisplayName	Same identity boundary for derived prompts	New derived-prompt serialization and denial tests.
ElicitationRequestedData.ElicitationSourceDisplayName	Automatically available in events; no supported elicitation UI today	Defer UI until an explicit, permission-safe flow exists.
ElicitationContext.ElicitationSourceDisplayName	SDK forwards event metadata into registered handlers	Defer registering handlers; existing headless capability behavior retained.
SamplingRequestedData.ServerDisplayName	Automatically available in sampling events; app does not broker MCP sampling	Defer display until a supported sampling/Connector workflow exists.

Automatic benefits are the native runtime refresh and additive event/handler metadata support in the app SDK adapter. No .NET SDK/compiler/test-tooling dependencies changed. Experimental warning boundaries, manual permissions, policy isolation, and typed structured drafts remain unchanged.

Related Issues

N/A - no issue to close

Scope

• App UI / workflow — third-party version notice only; no workflow change
• Core services / data model
• Copilot SDK / agent behavior
• Preview / WebView2
• Documentation / release readiness — version notices and audit evidence
• Tests / tooling
• Other:

Validation

• dotnet build RepoSyncRadar.sln -warnaserror — executed as dotnet build RepoSyncRadar.sln -warnaserror --verbosity quiet; passed, zero warnings/errors.
• dotnet test RepoSyncRadar.sln -- --filter-not-trait Category=Manual — executed with the documented run-level timeout: dotnet test RepoSyncRadar.sln --timeout 10m -- --filter-not-trait Category=Manual; failed: 1,585 passed, 2 failed. App 833/833, Integration 55/55, E2E 27/27; Core 670 passed/2 failed.
• Focused tests: dotnet test tests\RepoSyncRadar.App.Tests\RepoSyncRadar.App.Tests.csproj --no-build -- --filter-class RepoSyncRadar.App.Tests.Copilot.CopilotInProcessRuntimeTests --filter-class RepoSyncRadar.App.Tests.Copilot.RadarPermissionPolicyTests --filter-class RepoSyncRadar.App.Tests.Components.ThirdPartyNoticesPanelTests — preview passed 47/47, including runtime identity/hash and native policy-schema inventory. The same classes passed within the stable full App suite. Stable App suite also passed repeated-publish equal-metadata asset refresh coverage.
• N/A - no UI/WebView behavior changes; manual screenshots not required. Automated app E2E passed. Installed-package model-turn smoke was not run and remains a release gate.

The two failures are existing, unchanged Core tests: TcpPreviewPortAllocatorTests.AllocateSingle_Skips_Listening_Preferred_Port and AllocateComparison_Skips_Pair_When_After_Port_Is_Listening. Both reproduced using dotnet test tests\RepoSyncRadar.Core.Tests\RepoSyncRadar.Core.Tests.csproj --no-build -- --filter-class RepoSyncRadar.Core.Tests.Services.Preview.TcpPreviewPortAllocatorTests (2 passed/2 failed). Core source/tests have no diff against the base; unrelated fixes are intentionally excluded.

dotnet restore RepoSyncRadar.sln --verbosity quiet and git diff --check passed. An initial pipe-delimited class selector ran zero tests; it was corrected to repeated --filter-class selectors before recording focused success.

Risk And Rollback

• User impact: newer native Copilot runtime and accurate license notices; existing radar tool approvals and unsupported MCP denial stay unchanged.
• Operational risk: preview SDK/native compatibility, existing Core port-test failures, and installed-package model-turn validation not covered here. Native startup/status/shutdown, hash consistency, offline policy RPCs, publish target regressions, and app E2E passed locally on Windows ARM64; this is not a win-x64 installed-package claim.
• Rollback plan: revert both commits to restore SDK 1.0.27, runtime assertions, and notices together; keep existing alias/publish invalidation targets intact.

Release Notes

• User-facing change
• Internal-only change
• No release note needed

Release note draft:

Updated the embedded GitHub Copilot SDK to 1.0.28 and its bundled runtime to 1.0.105. Connector display metadata does not change RepoSyncRadar's restrictive tool-approval policy.

[Copilot]

🔵 Needs a closer look

The native runtime upgrade lacks win-x64 installed-package startup, model-turn, and shutdown validation; ARM64 probes and app E2E results do not establish compatibility across that package/runtime boundary.

No open issues 🎉

What changed in this PR

Updates RepoSyncRadar’s embedded GitHub Copilot SDK from 1.0.27 to 1.0.28, through separate preview and stable commits, while preserving the existing restrictive MCP approval policy.

Changes:

• Updates the SDK dependency and bundled-runtime assertion to 1.0.105.
• Refreshes third-party notices and their matching test.
• Adds regression coverage for Connector display-label serialization, identity preservation, and MCP denial.

File	Description
tests/​RepoSyncRadar.App.Tests/​Copilot/​RadarPermissionPolicyTests.cs	Tests that Connector labels preserve identity and do not change MCP denial.
tests/​RepoSyncRadar.App.Tests/​Copilot/​CopilotInProcessRuntimeTests.cs	Expects bundled runtime version 1.0.105.
tests/​RepoSyncRadar.App.Tests/​Components/​ThirdPartyNoticesPanelTests.cs	Expects SDK version 1.0.28 in notices.
src/​RepoSyncRadar.App/​Settings/​ThirdPartyNotices.cs	Updates the displayed SDK version.
Directory.Packages.props	Pins GitHub.Copilot.SDK to 1.0.28.

_{Review effort: Balanced}