Bernstein — Multi-Agent Orchestration

Version updated for https://github.com/sipyourdrink-ltd/bernstein to version v3.18.1.

  • This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action automates the orchestration of multi-agent CLI tasks, ensuring deterministic execution by leveraging a robust framework designed to manage and schedule complex workflows efficiently. It provides capabilities for building and running agent-based environments, making it ideal for developers who need to orchestrate complex workflows involving multiple independent components or agents.

What’s Changed

A patch release, which is to say: the machine worked all night and somebody had to write down what it did.

The review loop became a product

bernstein review --pipeline --fix --until-checks-green --max-passes N now runs the whole contour inside the CLI: wait for checks to settle, review the diff, hand the verdict and the failing logs to a fix pass, review again. A spent budget exits needs-operator, not an approval. Every pass emits a signed receipt binding the reviewed diff hash to the ruleset digest, and review-receipt verify --chain rejects a pass whose diff moved under it (#4481). Plans render deterministically and carry a SHA-256 of the rendering, so approval binds to what the reviewer saw (#3839, #4473).

Attestation, minus the noise

An unresolved SLA breach is attested once — not once per supervisor tick, which at one tick a second had turned a single breach into thousands of identical receipts (#4579). The monitor itself now runs on every schedule run tick (#4538, #4583). Operator approvals and always-allow promotions land on the HMAC audit chain (#4536); pre-spawn pending approvals show up in GET /approvals instead of hiding (#4535); an approval PR that failed to open says so, rather than waiting forever in silence (#4582). artifact verify on a host with no audit key no longer mints one and calls every clean receipt TAMPERED — it names the missing key and fails honestly (#4581). A deliverable that is raw bytes can be anchored too: the blob artifact kind reaches every declaration surface (#4544), and SARIF findings reach the MCP schema (#4533).

Housekeeping with a spine

Execution tasks with no completion signals and no commits are rejected instead of counted as done (#4560). Three caller-less modules under core/tokens/ are gone, and a structural guard fails CI when the next one appears (#4525). One infrastructure flake no longer holds every merge in the repository (#4596); path-filtered workflows can’t wedge a PR as permanently pending (#4557); branch-protection drift opens a marker issue instead of drifting quietly (#4558). Ticket integrations honour Retry-After and trip a circuit breaker on 429s (#4534). And a config-level auth opt-out that one refactor quietly broke is honoured again, with the regression tests it should have had (#4602).

Contributors

  • Chirag Honnyal — empty-signal task rejection (#4564) and the path-filter CI guard (#4570).
  • jm27 — the artifact contract surfaced in the spawn prompt (#4575).
  • Louis20060723 — agents-md sync resolves the default branch from the repository, not the checkout (#4585).

What’s Changed

New Contributors

Full Changelog: https://github.com/sipyourdrink-ltd/bernstein/compare/v3.18.0...v3.18.1