🔄 Refresh `foundry-agt` — 7 signal(s), impact: high

[unsafecode]

🔄 Refresh foundry-agt — consolidated freshness report

• Signals: 7
• Highest impact: high
• Automation tier: auto

---

HIGH — 🔄 Refresh foundry-agt — agent-governance-toolkit 3.6.0 → 3.7.0

🔄 Refresh foundry-agt — PyPI package agent-governance-toolkit drift

• Pinned: agent-governance-toolkit~=3.6.0 (cap window covers patch upgrades)
• Latest: agent-governance-toolkit==3.7.0
• Changelog: https://github.com/microsoft/agent-governance-toolkit/releases

Run the pin file's validation.script with PINNED_VERSION=3.7.0 to verify the skill still works against the new release.

⚠️ Surgical edits only — no search-and-replace

Edit ONLY these fields:

• references/upstream-pin.md: packages[name=agent-governance-toolkit].version → 3.7.0
• references/upstream-pin.md: the matching cap in validation.script (e.g. bump ~=X.Y.Z floor — keep the ~= operator, never switch to bare ==)
• references/upstream-pin.md: last_validated, validated_by: copilot-bot
• SKILL.md: metadata.version (PATCH bump)

Do NOT run a global search-and-replace on the version number. SKILL.md body and pin-file prose contain historical proof-of-validation text (e.g. verified against agent-governance-toolkit 3.6.0); those are records, not refresh targets. The gate will reject any SKILL.md body change without [skill-rewrite].

Acceptance criteria

• PR touches ONLY references/upstream-pin.md and SKILL.md (frontmatter only)
• metadata.version bumped PATCH only
• All pip specifiers stay ~=X.Y.Z (compatible release)
• CI gate automation-pr-gate.yml passes
• CI gate skill-validation.yml passes
• CI gate pin-validation.yml passes (re-runs validation.script on the runner — proof, not claim)

---

HIGH — 🔄 Refresh foundry-agt — agent-framework 1.3.0 → 1.6.0

🔄 Refresh foundry-agt — PyPI package agent-framework drift

• Pinned: agent-framework~=1.3.0 (cap window covers patch upgrades)
• Latest: agent-framework==1.6.0
• Changelog: https://pypi.org/project/agent-framework/#history

Run the pin file's validation.script with PINNED_VERSION=1.6.0 to verify the skill still works against the new release.

⚠️ Surgical edits only — no search-and-replace

Edit ONLY these fields:

• references/upstream-pin.md: packages[name=agent-framework].version → 1.6.0
• references/upstream-pin.md: the matching cap in validation.script (e.g. bump ~=X.Y.Z floor — keep the ~= operator, never switch to bare ==)
• references/upstream-pin.md: last_validated, validated_by: copilot-bot
• SKILL.md: metadata.version (PATCH bump)

Do NOT run a global search-and-replace on the version number. SKILL.md body and pin-file prose contain historical proof-of-validation text (e.g. verified against agent-framework 1.3.0); those are records, not refresh targets. The gate will reject any SKILL.md body change without [skill-rewrite].

Acceptance criteria

• PR touches ONLY references/upstream-pin.md and SKILL.md (frontmatter only)
• metadata.version bumped PATCH only
• All pip specifiers stay ~=X.Y.Z (compatible release)
• CI gate automation-pr-gate.yml passes
• CI gate skill-validation.yml passes
• CI gate pin-validation.yml passes (re-runs validation.script on the runner — proof, not claim)

---

HIGH — 🔄 Refresh foundry-agt — upstream KI-001 closed

🔄 Refresh foundry-agt — upstream issue KI-001 CLOSED

• Workaround: PYTHONUTF8=1 mandatory on Windows for agt CLI Rich glyphs
• Upstream: This repo is missing a LICENSE file microsoft/agent-governance-toolkit#1
• Closed at: 2026-03-02T22:32:20Z

Re-run the pin file's validation.script without the workaround and confirm the skill still passes. If green:

1. Update the pin file's known_issues[].status to closed_upstream_fixed
2. Open a PR removing the workaround prose from SKILL.md
   (include [skill-rewrite] in the commit message — required by automation-pr-gate.yml)

If validation fails without the workaround → upstream marked the issue closed but the symptom persists. Comment here and leave status: open.

---

HIGH — 🔄 Refresh foundry-agt — upstream KI-002 closed

🔄 Refresh foundry-agt — upstream issue KI-002 CLOSED

• Workaround: Upstream Foundry deployment doc shows stale middleware kwargs
• Upstream: Adding Microsoft SECURITY.MD microsoft/agent-governance-toolkit#2
• Closed at: 2026-03-04T16:29:38Z

Re-run the pin file's validation.script without the workaround and confirm the skill still passes. If green:

1. Update the pin file's known_issues[].status to closed_upstream_fixed
2. Open a PR removing the workaround prose from SKILL.md
   (include [skill-rewrite] in the commit message — required by automation-pr-gate.yml)

If validation fails without the workaround → upstream marked the issue closed but the symptom persists. Comment here and leave status: open.

---

HIGH — 🔄 Refresh foundry-agt — upstream KI-003 closed

🔄 Refresh foundry-agt — upstream issue KI-003 CLOSED

• Workaround: agent_framework.Agent ctor takes client, not chat_client
• Upstream: This repo is missing important files microsoft/agent-governance-toolkit#3
• Closed at: 2026-03-02T22:32:20Z

Re-run the pin file's validation.script without the workaround and confirm the skill still passes. If green:

1. Update the pin file's known_issues[].status to closed_upstream_fixed
2. Open a PR removing the workaround prose from SKILL.md
   (include [skill-rewrite] in the commit message — required by automation-pr-gate.yml)

If validation fails without the workaround → upstream marked the issue closed but the symptom persists. Comment here and leave status: open.

---

MEDIUM — 🔄 Refresh foundry-agt — upstream SHA drift

🔄 Refresh foundry-agt — upstream SHA drift

Skill: skills/foundry-agt/
Pin file: skills/foundry-agt/references/upstream-pin.md
Automation tier: auto

Drift detected

• Upstream: microsoft/agent-governance-toolkit@main
• Pinned SHA: 8c4692cf0000000000000000000000000000000a
• Current SHA: 279db99f1909ae78b69851f6893a6a6b3b631461

Required action

1. Update upstream.pinned_sha in the pin file front-matter to 279db99f1909ae78b69851f6893a6a6b3b631461.
2. Run the Verification Checklist (§ 3 of the pin file). The machine-runnable script is in validation.script.
3. If pass → update last_validated to today, bump SKILL.md metadata.version PATCH, open PR.
4. If fail → comment on this issue with the failure mode; do NOT open a PR.

⚠️ Surgical edits only — no search-and-replace

Edit ONLY these fields, in these files:

• references/upstream-pin.md: upstream.pinned_sha, last_validated, validated_by (set to copilot-bot)
• SKILL.md: metadata.version (PATCH bump)

Do NOT run a global search-and-replace on the SHA or any version strings. SKILL.md body and pin-file prose contain historical proof-of-validation text (e.g. verified against <short-sha>); those are records, not refresh targets. The gate will reject any SKILL.md body change without [skill-rewrite].

Acceptance criteria

• PR touches ONLY references/upstream-pin.md and SKILL.md (frontmatter only)
• metadata.version bumped PATCH only
• CI gate automation-pr-gate.yml passes
• CI gate skill-validation.yml passes
• CI gate pin-validation.yml passes (re-runs validation.script on the runner — proof, not claim)

---

🤖 This issue is assigned to @Copilot. The coding agent will execute the Verification Checklist embedded in the pin file and open a PR. A human reviews + merges.

---

LOW — 🔄 Refresh foundry-agt — link rot (1 URL(s))

🔄 Refresh foundry-agt — link rot detected

• https://github.com/microsoft/agent-governance-toolkit/blob/main/docs/OWASP-COMPLIANCE.md — HTTP 404

Audit each URL: if upstream moved the doc, update the pin file's docs_to_revalidate[] AND the corresponding link in SKILL.md. Removing the URL altogether requires [skill-rewrite] commit-message opt-in.