[Identity] Sync beta branch with main and start 1.28.0b1

.chronus/changes/agentserver-conversation-engine-20261015.md

@@ -0,0 +1,7 @@
+---
+changeKind: feature
+packages:
+  - azure-ai-agentserver-invocations
+---
+
+Added a standalone `/voice_conversation_engine` WebSocket route to `VoiceAgentServerHost`, reusing the typed Bridge event relay alongside its unchanged `/invocations_ws` route without new constructor options. Generic `InvocationAgentServerHost` raw WebSocket handlers are unchanged.

.chronus/changes/agentserver-user-barge-in-20261019.md

@@ -0,0 +1,7 @@
+---
+changeKind: feature
+packages:
+  - azure-ai-agentserver-invocations
+---
+
+Aligned the experimental Voice caller-interruption contract with `user.barge_in`, `UserBargeIn`, `UserBargeInCallback`, and `VoiceAgentServerHost.on_user_barge_in`. Playback snapshots and application-owned cancellation/history are preserved. Voice Live senders must use the same event contract. Generic raw WebSocket handlers are unchanged.

.chronus/changes/azure-identity-1-27-stable.md

@@ -0,0 +1,7 @@
+---
+changeKind: internal
+packages:
+  - sdk/identity/azure-identity
+---
+
+Prepare the 1.27.0 stable release metadata and document AKS identity binding configuration. The existing release entries remain in CHANGELOG.md.

.github/CODEOWNERS

@@ -752,10 +752,10 @@
 # ServiceOwners: @antcp @AzureAppServiceCLI
 
 # PRLabel: %Service Bus
-/sdk/servicebus/    @EldertGrootenboer @skarri-microsoft @j7nw4r @meetamitbhatia
+/sdk/servicebus/    @EldertGrootenboer @skarri-microsoft @j7nw4r @meetamitbhatia @pranz1996
 
 # ServiceLabel: %Service Bus
-# ServiceOwners: @EldertGrootenboer @skarri-microsoft @j7nw4r @meetamitbhatia
+# ServiceOwners: @EldertGrootenboer @skarri-microsoft @j7nw4r @meetamitbhatia @pranz1996
 
 # PRLabel: %Service Fabric
 /sdk/servicefabric/    @QingChenmsft @samedder
@@ -798,7 +798,7 @@
 # Management Libraries
 ####################
 
-/**/*mgmt*/                                                          @ChenxiJiang333 @msyyc
+/**/*mgmt*/                                                          @ChenxiJiang333 @msyyc @Azure/azure-arm-sdk-reviewers
 
 # ServiceLabel: %ARM %Service Attention
 # ServiceOwners:          @armleads-azure
@@ -859,10 +859,10 @@
 /eng/tools/emitter/                                                  @tadelesh @msyyc @iscai-msft @xirzec @lirenhe @ChenxiJiang333
 
 /pylintrc                                                            @JennyPng @l0lawrence @danieljurek @laiapat
-/sdk/**/ci.yml                                                       @JennyPng @l0lawrence @msyyc @xirzec @danieljurek
+/sdk/**/ci.yml                                                       @JennyPng @l0lawrence @msyyc @xirzec @danieljurek @Azure/azure-arm-sdk-reviewers
 
 # Add Johnathan Walker as code owner for Event Hubs SDK
 /sdk/eventhub/azure-eventhub/* @j7nw4r @meetamitbhatia @SwayGom @sagar0207
 
-# Add Johnathan Walker as code owner for Service Bus SDK
-/sdk/servicebus/azure-servicebus/* @j7nw4r @meetamitbhatia @SwayGom @sagar0207
+# Service Bus SDK team code owners
+/sdk/servicebus/azure-servicebus/* @j7nw4r @meetamitbhatia @SwayGom @sagar0207 @pranz1996 @EldertGrootenboer

.github/skills/azsdk-common-apiview-feedback-resolution/evals/eval.yaml

@@ -8,10 +8,10 @@ tags:
   area: azsdk-common-apiview-feedback-resolution
   type: ci-gate
 
-config:
+defaults:
   runs: 1
   timeout: "90s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:

.github/skills/azsdk-common-apiview-feedback-resolution/evals/trigger.eval.yaml

@@ -11,7 +11,7 @@ tags:
 defaults:
   runs: 1
   timeout: "90s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:

.github/skills/azsdk-common-generate-sdk-locally/evals/eval.yaml

@@ -8,10 +8,10 @@ tags:
   area: azsdk-common-generate-sdk-locally
   type: ci-gate
 
-config:
+defaults:
   runs: 1
   timeout: "90s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:

.github/skills/azsdk-common-generate-sdk-locally/evals/trigger.eval.yaml

@@ -20,6 +20,10 @@ scoring:
 stimuli:
   - name: trigger-generate-python-sdk-locally
     prompt: "Generate the Python SDK locally from my TypeSpec project at specification/compute/resource-manager/Microsoft.Compute/ComputeRP/tspconfig.yaml."
+    environment:
+      skills:
+        - ..
+        - ../../azsdk-common-sdk-breaking-change
     graders:
       - type: skill-invocation
         config:
@@ -28,7 +32,12 @@ stimuli:
   # Should NOT trigger
   - name: anti-trigger-mitigate-breaking-change
     prompt: "Fix the SDK breaking changes"
+    environment:
+      skills:
+        - ..
+        - ../../azsdk-common-sdk-breaking-change
     graders:
       - type: skill-invocation
         config:
+          required: ["azsdk-common-sdk-breaking-change"]
           disallowed: ["azsdk-common-generate-sdk-locally"]

.github/skills/azsdk-common-pipeline-analysis/evals/trigger.eval.yaml

@@ -11,7 +11,7 @@ tags:
 defaults:
   runs: 1
   timeout: "90s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:

.github/skills/azsdk-common-pipeline-fixer/evals/trigger.eval.yaml

@@ -11,11 +11,11 @@ tags:
 defaults:
   runs: 1
   # Stimuli with a resolvable build reference (URL or build ID) make the agent
-  # run the full analyze→fix→verify workflow (~90-180s under gpt-5.4),
+  # run the full analyze→fix→verify workflow (~90-180s under gpt-6.1-sol),
   # so the per-stimulus cap matches the Vally scenario evals (5m). Non-build-ref
   # routing prompts still complete in ~10-20s.
   timeout: "5m"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:

.github/skills/azsdk-common-prepare-release-plan/evals/eval.yaml

@@ -8,10 +8,10 @@ tags:
   area: azsdk-common-prepare-release-plan
   type: ci-gate
 
-config:
+defaults:
   runs: 1
   timeout: "90s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:

.github/skills/azsdk-common-prepare-release-plan/evals/schedule-risk.eval.yaml

@@ -11,7 +11,7 @@ tags:
 defaults:
   runs: 1
   timeout: "120s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:
@@ -58,14 +58,16 @@ stimuli:
         config:
           substring: "https://github.com/Azure/azure-rest-api-specs/pull/12345"
 
+  # The new target stays future-proof; the mock's older plan supplies the warning.
   - name: create-relays-past-due-guidance
     environment:
       skills:
         - ..
     prompt: |
       Create a public preview release plan for TypeSpec project
       specification/contosowidgetmanager/Contoso.WidgetManager with target
-      release month June 2026, spec PR
+      release month next calendar month (resolve to an explicit month and year
+      using the current date), spec PR
       https://github.com/Azure/azure-rest-api-specs/pull/38387, service tree ID
       a7f2b8e4-9c1d-4a3e-b6f9-2d8e5a7c3b1f, and product tree ID
       f1a8c5d2-6e4b-4f7a-9c2d-8b5e1f3a6c9e. Use the Azure SDK MCP tools.

.github/skills/azsdk-common-prepare-release-plan/evals/trigger.eval.yaml

@@ -11,7 +11,7 @@ tags:
 defaults:
   runs: 1
   timeout: "90s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:

.github/skills/azsdk-common-sdk-breaking-change/evals/trigger.eval.yaml

@@ -20,6 +20,9 @@ scoring:
 stimuli:
   - name: trigger-detect-sdk-breaking-changes-for-service
     prompt: "Detect and mitigate SDK breaking changes for the service webpubsub"
+    environment:
+      skills:
+        - ..
     graders:
       - type: skill-invocation
         config:

.github/skills/azsdk-common-sdk-release/evals/eval.yaml

@@ -8,10 +8,10 @@ tags:
   area: azsdk-common-sdk-release
   type: ci-gate
 
-config:
+defaults:
   runs: 1
   timeout: "90s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:
@@ -60,12 +60,16 @@ stimuli:
 
   - name: basic-trigger
     prompt: "I need to release a new version of my Azure SDK package. Walk me through the process."
+    environment:
+      skills:
+        - ..
     graders:
       - type: output-contains
         config:
           substring: "release"
-    constraints:
-      expect_skills: ["azsdk-common-sdk-release"]
+      - type: skill-invocation
+        config:
+          required: ["azsdk-common-sdk-release"]
 
   - name: anti-trigger
     prompt: "How do I write unit tests for my Azure SDK client?"

.github/skills/azsdk-common-sdk-release/evals/trigger.eval.yaml

@@ -11,7 +11,7 @@ tags:
 defaults:
   runs: 1
   timeout: "90s"
-  model: gpt-5.4
+  model: gpt-6.1-sol
   executor: copilot-sdk
 
 scoring:

.github/workflows/copilot-setup-steps.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: '3.10'
+          python-version: '3.11'
           cache: 'pip'
 
       - name: Create and activate virtual environment

.github/workflows/event-processor.yml

@@ -17,30 +17,24 @@ on:
 permissions: {}
 
 jobs:
-  # This event requires the Azure CLI to get the LABEL_SERVICE_API_KEY from the vault.
-  # Because the azure/login step adds time costly pre/post Az CLI commands to any every job
-  # it's used in, split this into its own job so only the event that needs the Az CLI pays
-  # the cost.
+  # Only newly opened issues need Azure login and secrets from Key Vault.
   event-handler-with-azure:
+    if: ${{ github.event_name == 'issues' && github.event.action == 'opened' }}
     permissions:
       issues: write
-      pull-requests: write
       # For OIDC auth
       id-token: write
-      contents: read
     name: Handle ${{ github.event_name }} ${{ github.event.action }} event with azure login
     runs-on: ubuntu-latest
     steps:
       - name: 'Az CLI login'
         uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
-        if: ${{ github.event_name == 'issues' && github.event.action == 'opened' }}
         with:
             client-id: e4cb9fd5-0875-4ca1-bc43-56196f5dfb8f
             tenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
             allow-no-subscriptions: true
 
       - name: 'Run Azure CLI commands'
-        if: ${{ github.event_name == 'issues' && github.event.action == 'opened' }}
         run: |
           LABEL_SERVICE_API_KEY=$(az keyvault secret show \
             --vault-name issue-labeler \
@@ -60,10 +54,6 @@ jobs:
           echo "::add-mask::$APP_CONFIG_ENDPOINT"
           echo "APP_CONFIG_ENDPOINT=$APP_CONFIG_ENDPOINT" >> "$GITHUB_ENV"
 
-      # To run github-event-processor built from source, for testing purposes, uncomment everything
-      # in between the Start/End-Build From Source comments and comment everything in between the
-      # Start/End-Install comments
-      # Start-Install
       - name: Install GitHub Event Processor
         run: >
           dotnet tool install
@@ -72,28 +62,6 @@ jobs:
           --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json
           --global
         shell: bash
-      # End-Install
-
-      # Testing checkout of sources from the Azure/azure-sdk-tools repository
-      # The ref: is the SHA from the pull request in that repository or the
-      # refs/pull/<PRNumber>/merge for the latest on any given PR. If the repository
-      # is a fork eg. <User>/azure-sdk-tools then the repository down below will
-      # need to point to that fork
-      # Start-Build
-      # - name: Checkout tools repo for GitHub Event Processor sources
-      #   uses: actions/checkout@v3
-      #   with:
-      #     repository: Azure/azure-sdk-tools
-      #     path: azure-sdk-tools
-      #     ref: <refs/pull/<PRNumber>/merge> or <sha>
-
-      # - name: Build and install GitHubEventProcessor from sources
-      #   run: |
-      #     dotnet pack
-      #     dotnet tool install --global --prerelease --add-source ../../../artifacts/packages/Debug Azure.Sdk.Tools.GitHubEventProcessor
-      #   shell: bash
-      #   working-directory: azure-sdk-tools/tools/github-event-processor/Azure.Sdk.Tools.GitHubEventProcessor
-      # End-Build
 
       - name: Process Action Event
         run: |
@@ -112,3 +80,35 @@ jobs:
         with:
           name: event
           path: ${{ github.event_path }}
+
+  event-handler:
+    if: ${{ !(github.event_name == 'issues' && github.event.action == 'opened') }}
+    permissions:
+      issues: write
+      # PR events can dismiss approvals after untrusted changes.
+      pull-requests: write
+    name: Handle ${{ github.event_name }} ${{ github.event.action }} event
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install GitHub Event Processor
+        run: >
+          dotnet tool install
+          Azure.Sdk.Tools.GitHubEventProcessor
+          --version 1.0.0-dev.20260403.1
+          --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json
+          --global
+        shell: bash
+
+      - name: Process Action Event
+        run: |
+          github-event-processor ${{ github.event_name }} ${{ github.event_path }}
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Archive github event data
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: event
+          path: ${{ github.event_path }}

common/smoketest/requirements_async.txt

@@ -1,3 +1,3 @@
-aiohttp==3.14.3
+aiohttp<4.0
 packaging==24.2
-pip==26.2.1
+pip==26.2.2

doc/eng_sys_checks.md

@@ -587,6 +587,8 @@ python scripts/devops_tasks/verify_autorest.py --service_directory <your_service
 
 The following checks run on a weekly cadence (not on every PR or nightly) via the `python-analyze-weekly` pipeline. They are exploratory/informational and use `continueOnError: true`, meaning failures are surfaced as warnings but do not block merges.
 
+Both the service-test and standalone templates restrict these checks to scheduled runs whose pipeline start time falls on Saturday or Sunday in UTC. A lightweight eligibility job evaluates that timestamp before the analysis job; weekday runs skip analysis, and manual and PR runs do not run these checks. Eligibility uses the pipeline start time, not the time the agent starts the job.
+
 ### Next-Generation Checks
 
 <a name="next-generation-checks"></a>

eng/apiview_reqs.txt

@@ -16,4 +16,4 @@ tomlkit==0.13.2
 typing_extensions==4.15.0
 wrapt==1.17.2
 apiview-stub-generator==0.3.31
-pip==24.0
+pip==26.2.2

eng/ci_tools.txt

@@ -7,10 +7,10 @@ pathlib2==2.3.7.post1
 doc-warden==0.7.2
 beautifulsoup4==4.13.3
 pkginfo==1.12.1.2
-pip==24.0
+pip==26.2.2
 typing-extensions==4.12.2
 pyproject-api==1.8.0
-cibuildwheel==2.23.3
+cibuildwheel
 importlib-metadata==8.5.0
 build==1.2.2.post1