Boise-State-Development · colinmxs · May 14, 2026 · Mar 25, 2026 · Mar 25, 2026 · Mar 25, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,4 +1,8 @@
 version: 2
+# Version-update PRs are disabled across all ecosystems
+# (open-pull-requests-limit: 0). We handle dependency upgrades manually on a
+# weekly cadence. Security updates are unaffected and will still be raised by
+# Dependabot when a CVE is published against a dependency.
 updates:
   # ── Python backend ──
   - package-ecosystem: "pip"
@@ -9,7 +13,7 @@ updates:
       day: "monday"
       time: "09:00"
       timezone: "America/Boise"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     versioning-strategy: "increase-if-necessary"
     commit-message:
       prefix: "chore(deps)"
@@ -33,7 +37,7 @@ updates:
       day: "monday"
       time: "09:00"
       timezone: "America/Boise"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     versioning-strategy: "increase-if-necessary"
     commit-message:
       prefix: "chore(deps)"
@@ -58,7 +62,7 @@ updates:
       day: "monday"
       time: "09:00"
       timezone: "America/Boise"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 0
     versioning-strategy: "increase-if-necessary"
     commit-message:
       prefix: "chore(deps)"
@@ -83,7 +87,7 @@ updates:
       day: "monday"
       time: "09:00"
       timezone: "America/Boise"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "chore(deps)"
       include: "scope"

diff --git a/.github/workflows/nightly-deploy-pipeline.yml b/.github/workflows/nightly-deploy-pipeline.yml
@@ -431,6 +431,7 @@ jobs:
       CDK_VPC_CIDR: ${{ vars.CDK_VPC_CIDR }}
       CDK_DOMAIN_NAME: ""
       CDK_HOSTED_ZONE_DOMAIN: ""
+      CDK_CERTIFICATE_ARN: ${{ vars.CDK_CERTIFICATE_ARN }}
       CDK_FRONTEND_CERTIFICATE_ARN: ""
       CDK_FRONTEND_BUCKET_NAME: ""
       CDK_FRONTEND_CLOUDFRONT_PRICE_CLASS: ""

diff --git a/.gitignore b/.gitignore
@@ -126,3 +126,11 @@ coverage/
 
 # Local dev scripts
 start.sh
+refresh-aws-sso.ps1
+start.ps1
+test-api-key.py
+.kiro/steering/github.md
+backend/start_app_api.ps1
+backend/start_inference_api.ps1
+scripts/stack-bootstrap/install.sh
+test-accounts
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,46 @@ All notable changes to this project are documented in this file. Format follows
 
 For narrative release notes written for operators and product owners, see [RELEASE_NOTES.md](RELEASE_NOTES.md).
 
+## [1.0.0-beta.26] - 2026-05-13
+
+Small focused release. Multi-sheet XLSX support for the spreadsheet analysis tool, async refactor of the spreadsheet file-lookup path, user default model preference applied at chat time, nightly E2E pipeline restored, and upstream contribution governance (PRs restricted to collaborators, Dependabot version-update PRs disabled).
+
+### 🚀 Added
+
+- Multi-sheet XLSX support in the `analyze_spreadsheet` tool. Each sheet converts to its own deterministic CSV (`stem.sheetname.csv`) with a primary alias (`stem.csv`) for the first sheet. Defensive caps via env vars `MAX_SHEETS_TO_CONVERT` and `MAX_ROWS_PER_SHEET` prevent latency blowout and context-window exhaustion on pathological workbooks. Skipped/truncated sheets are surfaced to the model with markdown footers documenting per-sheet conversion status
+- `_sanitize_sheet_name()` produces filesystem-safe deterministic CSV filenames; `_parse_sheet_inventory()` extracts structured sheet metadata from bootstrap stdout without `eval`-style evaluation; `_safe_int()` for defensive integer parsing; `_format_sheet_note()` for the per-call markdown footer
+
+### ✨ Improved
+
+- `analyze_spreadsheet`, `list_spreadsheets`, `_find_file`, `_get_kb_files`, and `_get_session_files` are now `async def`. Every DynamoDB call is offloaded via `asyncio.to_thread` so the event loop keeps scheduling other coroutines for the full round-trip duration
+- `inference_api/chat/routes.py::_build_tabular_inventory` is now `async` and awaits the file-operation calls directly, replacing the nested `asyncio.run` + thread pool executor pattern that could deadlock under concurrent chat load. Closes the regression introduced in #260
+- `analyze_tool` code generation stashes the filename as a `_FNAME` variable inside the generated snippet to prevent f-string interpolation conflicts when filenames contain quotes or special characters (`repr()` indirection in `_build_preview_code`)
+- `_clean_stderr` now respects the `MAX_ERROR_CHARS` budget strictly, accounting for ellipsis length
+
+### 🐛 Fixed
+
+- User-saved default model preference (`defaultModelId` in user settings) is now applied at chat time when the request doesn't specify a `model_id`. Previously the persisted preference was silently ignored and chat fell back to the hardcoded factory default. RBAC is re-checked on the resolved default to prevent access to permissions that have since been revoked. A missing user-settings table now surfaces as `503` instead of silently dropping the user choice. Fixes #161
+- Nightly E2E pipeline failures from cookie/JWT validation against the dynamic CloudFront URL, missing CDK certificate ARN in the nightly job, agent test timeouts on multi-tool turns, and cross-region Bedrock model routing flakes (switched the suite from global to US-region model IDs) (#290)
+
+### 📚 Docs
+
+- `backend/src/.env.example` — BFF cookie encryption documentation updated to reflect the beta.25 shift from direct KMS cookie encryption to Secrets Manager-mediated approach. Documents the new `BFF_COOKIE_DATA_KEY_SECRET_ARN` variable, the SHA-256 cross-task derivation, and the SSM parameter path with example ARN format
+
+### 🔧 CI/CD
+
+- Nightly E2E pipeline restored after multi-attempt fix (#290): CloudFront URL handling, CDK certificate ARN wiring, agent test timeout bumps, US-region Bedrock model IDs, rebase on develop to pick up #248
+
+### 🛡️ Governance
+
+- **CONTRIBUTING.md** documents that pull requests are restricted to approved collaborators (GitHub "Collaborators only" setting). Issues remain open to everyone; maintainers triage and either implement upstream or coordinate next steps with the reporter. Adds collaborator checklist (link tracking issue, single logical change per PR, DCO sign-off, green CI, respect backend import boundaries enforced by `backend/tests/architecture/test_import_boundaries.py`) (#293)
+- **`.github/dependabot.yml`** — `open-pull-requests-limit: 0` across all four ecosystems (pip, frontend npm, infrastructure npm, github-actions). Disables scheduled version-update PRs; security updates are unaffected and will still be raised when a CVE is published. Existing groups, labels, schedules retained for easy reversal (#293)
+
+### 🧪 Test Coverage
+
+- `backend/tests/agents/builtin_tools/spreadsheet_analysis/` — 2,800+ lines of new tests across 8 files. Notable: `test_analyze_tool_integration.py` (779 lines, multi-sheet XLSX + CSV workflows end-to-end), `test_sheet_inventory.py` (307 lines, parser robustness against malformed bootstrap output), `test_clean_stderr.py` (202 lines, strict error-char budget), `test_build_preview_code.py` (127 lines, filename escaping), plus `test_helpers.py`, `test_find_file.py`, `test_list_spreadsheets.py`, `test_strip_first_row.py`
+- `frontend/ai.client/src/app/session/services/model/model.service.spec.ts` (56 lines) — default-model resolution flow
+- `frontend/ai.client/src/app/settings/pages/chat-preferences/chat-preferences-settings.page.spec.ts` (101 lines) — Chat Preferences settings UI
+
 ## [1.0.0-beta.25] - 2026-05-11
 
 Production-readiness fix for the BFF Token Handler shipped in beta.24. Fixes three production-breaking bugs introduced by beta.24: event-loop-blocking sync boto3 on every cookie-bearing request, per-process AES-256 keys that can't round-trip cookies across ECS tasks, and an in-process-only refresh lock that races Cognito rotation across replicas. Also ships PDF thumbnails, rich attachment previews, spreadsheet analysis tools, centralized 401 handling, and a `SKIP_AUTH` local-dev bypass.

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,5 +1,39 @@
 # Contributing to AgentCore Public Stack
 
+## Contribution Policy
+
+AgentCore Public Stack is maintained by Boise State University as a reference
+implementation for academic and public-sector AgentCore deployments. It is
+source-available under the PolyForm Noncommercial License 1.0.0 (see
+[`LICENSE`](./LICENSE)).
+
+### Pull requests are restricted to approved collaborators
+
+To keep the reference architecture coherent and to let downstream deployments
+stay in sync with a single, well-known upstream, this repository uses GitHub's
+**"Collaborators only"** pull request setting. Only users with Write access or
+higher can open a pull request.
+
+### Reporting issues and proposing changes
+
+If you are deploying this stack and find a bug, regression, or documentation
+gap, please open a GitHub issue — issues are open to everyone. A maintainer
+will triage the report, and if the change belongs upstream we will either
+implement it or coordinate with the reporter on next steps.
+
+### For collaborators
+
+- Link the tracking issue in the PR description so changes stay discoverable.
+- Keep each PR focused on a single logical change.
+- Sign off your commits with `git commit -s` (Developer Certificate of Origin).
+- Make sure CI is green before requesting review.
+- Respect the backend import boundaries enforced by
+  `backend/tests/architecture/test_import_boundaries.py` — `app_api`,
+  `inference_api`, and `agents/` are independent consumers of `apis.shared`
+  and must not import from each other.
+
+---
+
 ## Prerequisites
 
 - **Node.js** 20+ (for frontend and infrastructure)

diff --git a/README.md b/README.md
@@ -8,7 +8,7 @@
 **An open-source, production-ready Generative AI platform for institutions**
 *Built by Boise State University, designed for everyone.*
 
-[![Release](https://img.shields.io/badge/Release-v1.0.0--beta.25-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
+[![Release](https://img.shields.io/badge/Release-v1.0.0--beta.26-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
 [![Nightly](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml/badge.svg)](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml)
 
 ![Python](https://img.shields.io/badge/Python-3.13+-3776AB?style=flat&logo=python&logoColor=white)
@@ -260,7 +260,7 @@ agentcore-public-stack/
 
 See [RELEASE_NOTES.md](RELEASE_NOTES.md) for the full changelog, including new features, bug fixes, platform upgrades, and deployment notes for each release.
 
-**Current release:** v1.0.0-beta.25
+**Current release:** v1.0.0-beta.26
 
 ---