DAILY BRIEFING/

Orchestration and trust.

GitHub updates Copilot's multi-model orchestration and introduces workflow dependency lockfiles. Try a practical audit of the actions your coding agents run.

Edition 02 · Coverage: 14–15 October 2026

01

Model radar

Details on the two latest updates. Open a radar item for its announcement.

02

Repositories to try

Open-source projects with a concrete reason to pay attention.

The license badges apply to the linked software. Model providers, commercial agents and hosted services may have separate access requirements and costs.

01
Workflow dependency audit

github/gh-actions-lock

14 Oct · Technical previewNew capabilityMIT

A GitHub CLI extension records exact commits for Actions workflow dependencies.

What’s new

Public-preview lockfiles let reviewed workflow references resolve to fixed commits even if tags move.

Why it matters

Reduce unexpected CI code changes; a pinned malicious dependency remains unsafe.

Try it

Install GitHub CLI and the extension in a disposable repository; no model API required.

03

Beyond the coding window

Context, execution and the infrastructure around agents.

GitHub / 14 Oct
Public preview

Actions dependency lockfiles

Workflow dependencies can be recorded as immutable commit pins.

What’s new

GitHub released lockfile tooling and policy controls, with availability subject to plan and rollout.

Why it matters

Makes agent-powered CI easier to audit and reproduce; still review the underlying dependencies.

The extension is a technical preview and its format and flags can change.

04

Research watch

Recent papers and publications, with their findings and limits.

No research paper is selected for this edition.

05

Put the announcements in context

Useful comparisons for deciding what to try.

A CLOSER LOOK

Google Gemini agent vs Claude Managed Agents

They overlap in hosted, long-running work. The product-scope distinction below is an editorial synthesis of their documented surfaces.

Google Gemini agent vs Claude Managed Agents
DimensionGoogle Gemini agentClaude Managed Agents
Best fitEnterprise work assistant across workplace apps, with app and API access.Developer service for building custom Claude-powered agents.
ModelsGemini and Claude orchestration; more model support is planned.Claude 4.5 and later; different supported Claude models per agent.
Long-running workCloud work, shared context and dynamically created helper agents.Persistent sessions and filesystem state; orchestration and shared memory.
ControlsWorkplace identity, authorization, gateway policy and audit logs.Tool permissions, credential vaults, network restrictions, budgets and events.
AvailabilityAnnounced 8 Oct; broad availability unverified in the primary announcement.Public beta; some capabilities remain restricted research previews.
THE DECISION LAYER

Microsoft-Decision-1, Jev and OpenAI Decisions

Three implementations of the same broad idea: return a bounded decision that software can use, such as a choice, a score or a probability.

01

TypeSafe Jev

Dedicated decision model with its own architecture, parallel sampler and training for calibrated decisions.

Primary source ↗
02

Microsoft-Decision-1

Separate Microsoft model post-trained from Qwen3.5-9B to score predefined choices; Foundry and OpenRouter access.

Primary source ↗
03

OpenAI Decisions API

Dedicated endpoint backed by GPT-6 Luna, accepting text and images and returning typed decisions; public beta.

Primary source ↗
06

Try today’s experiment

One practical experiment from today’s briefing.

TODAY’S LAB · 20–30 minutes after setup

Try github/gh-actions-lock: audit CI dependencies

Generate and inspect an Actions dependency lockfile in a disposable repository, then verify the recorded pins.

Why it helps Learn whether the CI actions an agent executes match the commits a reviewer approved.

Open the step-by-step guide
  1. 01

    Create a disposable personal repository with a simple Actions workflow.

  2. 02

    Install github/gh-actions-lock and generate a lockfile.

  3. 03

    Review action pins and run verification; record the result.

GitHub CLI, personal login, disposable repository; MIT extension. No model API or paid service required.

Documentation checked 15 October; commands, GitHub Actions and runtime enforcement NOT executed.

Get Agent Signal in your inbox

A short daily briefing on AI models, coding agents and research, with a link to the full report and one practical experiment.

Subscribe free →

Confirm your email to subscribe. Unsubscribe at any time.