Required updates for Watcher

The Watcher client records Copilot sessions and reviews tool calls by default. Existing user choices and administrator locks still apply.

From this release on, self-hosted Watcher requires PostgreSQL 17 or later.

Agent settings support per-agent choices and locks. Saved local choices apply across profiles; admin locks take priority.

Session summaries now come from the background-job worker. Most continue a Triage call's conversation instead of sending a separate summary request.

The default Triage monitor model changes from openai/gpt-5.6-luna to openai/gpt-6-luna.

What's new?

• Copilot uses your blocking review settings and appears in the Analyzer.
• Calls Watcher allows run without Copilot's own permission prompt, and Copilot deny rules do not apply to them.
• Per-agent commands enable or disable monitoring, subject to admin locks.
• Copilot's status line warns when Watcher is signed out. Setup adds it to Copilot's settings.json unless you already have a status line there.
• The client uploads Copilot's own session log, and failed uploads are retried in the background as for Claude Code and Codex.
• Diagnostics report unconfirmed final recordings.
• 1a. Watcher's background-job worker now runs in every self-hosted deployment, on Docker Compose and Helm, and it needs PostgreSQL 17 or later.
• 1b. On an older server the worker logs "Operation queue requires PostgreSQL 17 or later", exits and restarts, and the jobs it runs fail. Today those are the deep reviews requested with Generate report.
• agents.enabled accepts a mapping that changes only the named agents.
• The list form still works and is deprecated. Saving a list returns a warning in the Analyzer and the save still succeeds. watcher doctor warns about a list in a developer's own settings file.
• Saving a mapping that turns an agent off or locks one also returns a warning, because Watcher clients 0.42.0 and older ignore it.
• Clients older than this release ignore a mapping and monitor every supported agent until they are upgraded. They still apply the rest of the organization document. Two side effects last until they are upgraded:
  • A developer's own agent list still applies, unless the organization document sets agents.permission: locked (locks on individual agents inside the mapping do not count).
  • The client reports that part of the organization settings was not understood and that agents.enabled was ignored, as an error in watcher doctor, or on the local Watcher page of clients that have one.
• When agent settings cannot be read, Watcher still starts with a warning and leaves installed hook files unchanged. watcher hooks install still warns and installs hooks for every supported agent.
• 1a. A session gets its first summary at its first Triage call, then a refresh at any later Triage call once its latest summary is at least 15 minutes old.
• 1b. The summary re-sends the Triage call's request to the Triage model, with the summary task in place of the score request, so it reuses that call's cached prompt where the provider caches prompts and sends the provider no transcript content beyond what Triage sent. Without prompt caching the summary still works, and its input is billed at the full price. It describes the session up to the tool call awaiting permission.
• 1c. The scheduled pass no longer writes summaries itself; it queues jobs. When Triage stops, it summarizes from the last Triage call, if that came after the latest summary, within an hour of the call. A session no Triage call reached gets a fresh first summary 15 minutes after it starts, and a session idle for 12 hours whose summary misses its latest activity gets one fresh summary.
• Triage grades with openai/gpt-6-luna unless your deployment overrides the Triage model.
• Watcher Cloud needs no action.

Required upgrade steps

Copilot monitoring in the Watcher client

For self-hosted deployments and Watcher Cloud:

1. Update Watcher, with the server before clients. Copilot needs a server from this release or later. Cloud users only update the client.
2. Check watcher agents list and watcher doctor hooks. If your settings list agents explicitly, such as agents.enabled: [claude_code, codex], add copilot. Administrator locks still apply. Restart Copilot and verify a harmless file read in the Analyzer.

On an older server, Copilot uploads wait in the background retry queue, and Copilot calls that need grading get the grading-failure policy with a reason saying the server cannot read Copilot logs. Read the permission limits before using monitoring.

Watcher requires PostgreSQL 17 or later

These steps apply to self-hosted deployments. Watcher Cloud users do not need to change anything. No developer-machine changes are needed.

1. Check your database version with SHOW server_version_num;. 170000 or higher is PostgreSQL 17 or later. The bundled database already runs PostgreSQL 18. Databases created by the Watcher AWS Terraform module before PostgreSQL 17 became its default run PostgreSQL 16.
2. If yours is older than 17, follow Upgrade PostgreSQL before or right after updating.
3. Update with Update Watcher. A minute later, check that xylon-operation-worker is still running with no new restarts (docker compose ps xylon-operation-worker, or kubectl get pods -l app.kubernetes.io/component=operation-worker) and that its logs show no "Operation queue requires PostgreSQL 17" error.

Independent agent settings

For self-hosted deployments and Watcher Cloud using managed settings:

1. Update your clients before you save an organization mapping that turns an agent off. Until then, keep the agent list; editing it, for example to enabled: [claude_code] with agents.permission: locked, still works on every client. Cloud administrators do not update the hosted server.
2. Run watcher doctor settings and watcher doctor hooks on sample machines after the mapping reaches them.

Before rolling back to a list-only client, convert local choices to a legacy list and verify them. Otherwise the client can lose a saved disable.

Summaries are written by continuing Triage calls

These steps apply to self-hosted deployments. Watcher Cloud users do not need to change anything. No developer-machine changes are needed.

Use Update Watcher for the general update, backup and verification procedure. Summaries are written by the background-job worker, which every self-hosted deployment now runs.

1. On Docker Compose, make sure COMPOSE_PROFILES in .env includes async-grading: the scheduler queues the refreshes after Triage stops and first summaries for sessions without Triage calls. Installs created from a recent .env.example already have it.
2. Follow Verify an update. Start a session that makes a gated tool call, and check that it shows a summary in the Analyzer within a minute or two.

Triage now uses GPT-6 Luna

These steps apply to self-hosted deployments only.

1. Before upgrading, confirm that the OpenAI API key in .env can call gpt-6-luna. If your Triage model is overridden in server-config.yaml, no change is needed.
2. Follow Update Watcher for the rollout.
3. After upgrading, confirm that permission requests are graded and that no Triage grading errors appear in the API logs.