[alexweininger]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Update the existing canvas-authoring external plugin listing from 0.1.1 to 0.1.2, pinned to production squash commit 1cf279cfdc7105517d24f34cab56583aed734e75 from microsoft/azure-dev-tools#37.

Only the version and source SHA change in plugins/external.json and the regenerated .github/plugin/marketplace.json; listing copy and unrelated entries are unchanged. The published package adds invocation-count telemetry through a canvas-less session extension.

• Release package
• Release README

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Validation:

• npm run plugin:generate-marketplace — passed; only the targeted marketplace entry changed.
• npm run plugin:validate — passed; all 106 local plugins and the external catalog are valid.
• npm run build — passed; generated output is up to date, with no additional changes.
• bash eng/fix-line-endings.sh — passed; no additional changes.
• git diff --check — passed.

npm start was not run separately (npm run build is its configured implementation). End-to-end plugin installation was not run locally; PR external-plugin quality gates provide the install smoke test and vally lint checks. This is an existing catalog update, not a new resource submission.

Gateway caveat: live collection is not claimed. The updated telemetry gateway deployment remains blocked at preflight on the undocumented Azure table schema key isTroubleshootingAllowed, pending service-owner clarification. This PR does not deploy Azure resources or change release refs.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 🛠️ Requires submitter fixes

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• plugins/external.json is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Plugin and extension validation	✅ Passed	Passed · logs
Plugin structure	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	✅ Passed	Passed · logs
Canvas/plugin smoke test	✅ Passed	Passed · logs

Action needed

• Address the changes requested by aaronpowell, then push an update.

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission; resolution of changes requested by aaronpowell
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 4bbef25 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

✅ External plugin PR checks passed

• Changed entries detected: 1
• Workflow state label: ready-for-review
• Full logs: Download quality gate artifact
• Status legend: ✅ pass · ⚠️ warning · 🛑 fail

Per-plugin quality summary

Plugin	spec compliance (non-blocking)	vally lint	install smoke test	version match	ref/sha consistency	canvas structure	overall	source tree
canvas-authoring	✅ pass	✅ pass	✅ pass	✅ pass	⚪ not_run	⚪ not_run	✅ pass	1cf279cfdc7105517d24f34cab56583aed734e75

Gate output details

canvas-authoring - spec compliance (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

canvas-authoring - vally lint (✅ pass)

✅ create-canvas-app (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

canvas-authoring - install smoke test (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-RQEzwm/copilot-home/.copilot/installed-plugins/external-plugin-intake/canvas-authoring/plugin.json.

canvas-authoring - version match (pass)

- 1cf279cfdc7105517d24f34cab56583aed734e75: matched version "0.1.2" at "plugins/canvas-authoring/plugin.json".

canvas-authoring - ref/sha consistency (not_run)

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

canvas-authoring - canvas structure (not_run)

Canvas structure gate skipped because plugin is not tagged with "canvas".

- canvas-authoring: spec=pass, vally-lint=pass, install-smoke=pass, version-match=pass, ref-sha-consistency=not_run, canvas-structure=not_run, overall=pass

[Copilot]

🔵 Needs a closer look

Organization SAML restrictions prevented verification of the pinned upstream package and its reported telemetry changes.

1 open issue

• Update catalog description and regenerate marketplace metadata · New

What changed in this PR

Updates the existing canvas-authoring external plugin listing to release 0.1.2, keeping the catalog and generated marketplace entry aligned.

Changes:

• Bumps the version from 0.1.1 to 0.1.2 and pins upstream commit 1cf279cfdc7105517d24f34cab56583aed734e75.
• Mirrors the version and source SHA in the generated marketplace.

File	Description
plugins/​external.json	Updates the canonical plugin version and pinned source SHA.
.github/​plugin/​marketplace.json	Synchronizes the generated marketplace entry.

_{Review effort: Max}

[aaronpowell]

Thanks @alexweininger for disclosing the telemetry. 1) external.json still says 'skill-only, not a canvas extension', but 0.1.2 adds an extension; please update the description and regenerate marketplace.json. 2) The README says 'pseudonymous account identifier', but the value sent is the numeric GitHub user ID; please state that plainly and document the endpoint.

[alexweininger]

Thanks for calling out both issues. We are including canvas-authoring in the shared telemetry opt-out correction: the public Usage data section will explicitly name the numeric GitHub user ID and ingestion endpoint, and document CANVAS_TELEMETRY_DISABLED=1 rather than relying on a test-mode flag.

We will also correct the catalog description to reflect the registered skill-telemetry extension and regenerate marketplace.json; installing the companion still does not itself open a canvas. We will verify that wording against the corrected package rather than retain the inaccurate skill-only/no-extension claim. A new upstream release and verified production squash pin are needed for the opt-out. This is an in-progress response, not a claim that either requested change is resolved or the package has been released.

[alexweininger]

The source correction is now in draft review: coreai-microsoft/canvases-cloud-foundation#448 covers the common skill-collector opt-out and an isolated fresh-export regression; coreai-microsoft/canvases-cloud-foundation#446 fixes the public description and Usage data notice. Canvas Authoring is a skill plugin with a background extension used for its skill-usage observer; it opens no canvas and registers no tools/canvases/hooks. The disclosure names the numeric GitHub ID, actual endpoint and startup opt-out rather than implying anonymous collection or an unverified retention promise.

These are source PRs, not a released replacement for the pinned plugin. Final combined qualification, required reviews and fresh production packaging are still pending. Canvas Authoring Awesome Copilot source.sha remains pending production squash merge; the catalog description and pin must be corrected against the verified release rather than presented as already fixed.

[aaronpowell]

Closing this as #5985 bumped the plugin to 0.1.3 which is past this release.