Skip to content

Release 2.0.13 (2026-05-15)

Bug fixes

  • add explicit credential selection via GH_TOKEN injection Replace partition-based account discovery with key-lookup: find the one account ending in -vergil, derive the human name by stripping the suffix, ignore all other accounts. This fixes discovery failures when multiple non-vergil accounts (e.g. -mimir, -agent) are logged into gh auth.

Add GH_TOKEN injection to github.py so all gh subprocess calls use the human account token explicitly, rather than relying on the active gh auth account. Covers _run_with_retry, _checks_registered, and delete_if_exists.

Chores

  • bump version to 2.0.13

Features

  • move deny rules to project-level settings and deploy to vergil-tooling

Refactoring

  • replace -agent convention with -vergil across tooling, specs, and config Rename the agent account suffix from -agent to -vergil in vrg-gh account discovery, vergil.toml co-author entry, org governance spec, and credential management spec. Add the Vergil/Mimir identity design spec and implementation plan. The _get_token workaround (#799) is intentionally left in place until the new -vergil account is confirmed unflagged by GitHub.