v0.68.7

🌟 Release Highlights

This release delivers targeted bug fixes and internal reliability improvements, including a community-reported fix for on.roles configuration handling and a Codex runtime stability fix.

🐛 Bug Fixes & Improvements

• on.roles Single-String Support (#26789) — The compiler now accepts a single role string (e.g., roles: write) in addition to an array. Previously, using a string instead of an array produced a misleading compiler error with no clear guidance.
• Codex AWF Chroot Fix (#26787) — Fixed Codex agent failures in chroot environments by relocating runtime state to writable /tmp. Codex workflows on restricted filesystems should now run reliably.
• Failure Investigator Improvements (#26795) — Reduced issue churn in the aw-failure-investigator workflow by prioritizing closure and reusing parent issue tracking across runs.
• Firewall Update (#26798) — Default firewall version bumped to v0.25.23 with regenerated compiled artifacts.

✨ What's New

• Cross-Repo Compilation Compatibility Checks (#26802) — A new daily Claude workflow automatically discovers repositories using gh-aw, runs compilation checks against the latest build, and surfaces compatibility issues before they affect users.

🌍 Community Contributions

A huge thank you to the community members who reported issues that were resolved in this release!

@jeffhandley

• Misleading compiler error when 'roles' is set to a string instead of an array (direct issue)

---

For complete details, see CHANGELOG.

Generated by Release · ● 1.3M

---

What's Changed

• Reduce aw-failure-investigator issue churn by prioritizing closure and reusing parent tracking by @Copilot in #26795
• Allow on.roles single-string role values (not just all) by @Copilot in #26789
• Fix Codex AWF chroot failures by moving Codex runtime state to writable /tmp by @Copilot in #26787
• chore: bump default firewall version to v0.25.23 and regenerate compiled artifacts by @Copilot in #26798

Full Changelog: v0.68.6...v0.68.7