Skip to content

fix(gh-aw): make Squad Review safe outputs first-install safe #2103

New issue
New issue
Closed
Closed
fix(gh-aw): make Squad Review safe outputs first-install safe#2103
#2120 (+3)
Labels
gh-awGitHub Agentic Workflows integrationsquadSquad triage inbox — Lead will assign to a membersquad:agentic-workflows-devAssigned to agentic-workflows-dev (Agentic Workflows Engineer)

Description

@bradygaster
bradygaster
opened on Sep 29, 2026

Problem

A clean private consumer install pinned to da7861de22483b83c0321ad534954e637a11dbdf exposes a first-install failure in the Squad Review workflow.

The review agent succeeds, but safe_outputs imports .squad-review-base/.github/workflows/shared/squad-review-guard.mjs from the base branch. On the installation PR, the untouched base branch intentionally does not contain Squad runtime files yet, so Node fails with ERR_MODULE_NOT_FOUND.

Reproduction evidence

Both fixtures were clean repositories with untouched default branches. Strict compilation and install verification succeeded; failure occurs only in review safe-output binding.

Required behavior

  • A first-install PR must not require the review guard to already exist on the base branch.
  • Existing base-controlled exact-head review enforcement must remain fail-closed for established installs.
  • The fix must preserve logical author/reviewer inequality, verdict/head binding, relay deduplication, and admin-override constraints.
  • Canonical workflow, packaged copy, lockfiles, manifest/hashes, tests, and install verifier expectations must remain synchronized.
  • Add a regression test that executes or realistically mutates the first-install missing-base-guard condition.

Acceptance evidence

  • Targeted and full gh-aw contract tests pass.
  • All eight workflows strict-compile in canonical and packaged layouts.
  • A new immutable SHA is installed in the clean backend/frontend fixtures.
  • The installation PR review no longer fails with ERR_MODULE_NOT_FOUND.
  • Fixture runs remain private and cleanup remains run-owned.

#2074/#2069 are orthogonal and must not gate this fix.

Activity

  1. bradygaster
    added
    squad:agentic-workflows-devAssigned to agentic-workflows-dev (Agentic Workflows Engineer)
    gh-awGitHub Agentic Workflows integration
    on Sep 29, 2026
  2. github-actions
    added
    squadSquad triage inbox — Lead will assign to a member
    on Sep 29, 2026

  3. bradygaster commented on Sep 29, 2026

    @bradygaster
    bradygaster
    on Sep 29, 2026
    CollaboratorAuthor

    Cross-fixture confirmation: backend head edd6fbf0 and frontend head 9a898b51 both completed the review agent and detection with correct SQUAD_REVIEW_HEAD, then failed identically in safe_outputs with ERR_MODULE_NOT_FOUND for .squad-review-base/.github/workflows/shared/squad-review-guard.mjs. This isolates the defect to unconditional trusted-base guard module loading on a clean first install, not agent output or head propagation.

  4. bradygaster
    added a commit that references this issue on Sep 29, 2026

    fix(gh-aw): fail closed on missing installed review guard

    fa940f4
  5. bradygaster
    closed this as completedin #2104on Sep 29, 2026
  6. bradygaster
    reopened this on Sep 29, 2026

  7. bradygaster commented on Sep 29, 2026

    @bradygaster
    bradygaster
    on Sep 29, 2026
    CollaboratorAuthor

    Reopened after #2104 merged because hosted acceptance remains: clean backend/frontend installation PRs must rerun at corrected SHA 60f2c45 and prove Squad Review safe_outputs no longer fails with ERR_MODULE_NOT_FOUND.

  8. bradygaster commented on Sep 29, 2026

    @bradygaster
    bradygaster
    on Sep 29, 2026
    CollaboratorAuthor

    Hosted reruns at corrected candidate 60f2c452f6284d442a5932843f3ee64bf86fb928 prove the prior ERR_MODULE_NOT_FOUND defect is fixed: first-install safe_outputs now loads the immutable workflow-source guard when the base guard and base manifest are absent.

    They also expose the next clean-install blocker. The guard requests committed .squad-review.json from the installation PR head; because a clean installation PR does not yet contain that file, GitHub returns 404 and committedJson propagates HttpError: Not Found. safe_outputs and the required Squad Review / review check therefore fail closed.

    Immutable evidence:

    Both installation PRs remain unmerged. A new source fix must define a provenance-bound clean-first-install policy for missing .squad-review.json, preserve fail-closed behavior for established installs, add compiled regressions, merge, and pass fresh hosted reruns before this issue can close.

  9. bradygaster commented on Sep 29, 2026

    @bradygaster
    bradygaster
    on Sep 29, 2026
    CollaboratorAuthor

    Third independent reproduction now confirms the same blocker with a correctly scoped 8/17/1 installation PR (no .vscode/settings.json):

    The workflow-source guard loads successfully, then deterministically fails on the missing clean-install .squad-review.json 404. All three fixture PRs remain open and unmerged.

  10. bradygaster
    added 5 commits that reference this issue on Sep 29, 2026

    fix(gh-aw): verify clean-install package bytes

    37c7882

    fix(gh-aw): stabilize local install verification

    0f3bad4

    fix(gh-aw): make first install a human trust boundary

    a5855f6

    fix(gh-aw): harden hosted strict compile fixture

    6fec38e

    fix(gh-aw): attest review from base context

    6c567c9

  11. 22 remaining items

  12. bradygaster
    added 3 commits that reference this issue on Sep 29, 2026

    fix(gh-aw): pin compiler action resolution for reproducible digests

    784553a

    test(gh-aw): inject unresolved action pins deterministically

    bcdc982

    fix(gh-aw): verify native package source digest variants (#2111)

    59bedd0
  13. bradygaster
    closed this as completedin #2111on Sep 29, 2026
  14. huangyingting
    added 2 commits that reference this issue on Sep 29, 2026

    fix(gh-aw): make review guard first-install safe

    1c42035

    fix(gh-aw): bind first-install review identity

    c52eb08
  15. bradygaster
    reopened this on Sep 29, 2026

  16. bradygaster commented on Sep 29, 2026

    @bradygaster
    bradygaster
    on Sep 29, 2026
    CollaboratorAuthor

    Reopened: final merged-SHA preflight passes; hosted bootstrap exposes two product blockers

    Final source 59bedd0ba58247bff2fbb7b5412be877b40d2e14 passes schema-v2 consumer preflight completely: 8 workflows / 17 runtime resources / 1 skill, both supported source provenance forms, all source-selected lock digests, and immutable gh-aw v0.89.21 setup/setup-cli pins.

    Fresh private hosted evidence used ordinary GitHub Actions only and zero reviewer credentials/secrets/environments:

    Two blockers remain:

    1. Backend repository .gitignore contains packages/, which also ignores .github/aw/packages/bradygaster-squad-workflows-*.json. Documented git add -- .github/aw silently omitted required ownership metadata, so hosted verification failed closed with Package ownership metadata is missing.
    2. Frontend and queue verified package/state/payload successfully, but the Copilot bootstrap agent spent the remaining 20-minute run manually extracting seven payload envelope chunks and timed out before invoking materialize_bootstrap.

    All temporary default-branch installations were reverted and each original fixture tree restored exactly. Fresh audit PRs remain open/unmerged. Preserved PRs #3/#3/#9 and Dependabot branches were untouched. No Cast PR, research issue, native review verdict, or downstream lifecycle evidence is claimed yet.

  17. bradygaster commented on Sep 29, 2026

    @bradygaster
    bradygaster
    on Sep 29, 2026
    CollaboratorAuthor

    Hosted acceptance remains blocked on two isolated defects found after the merged 59bedd0 consumer preflight passed:

    Both fixes are actively owned on separate branches. Keep this issue open until both merge and the backend/frontend/queue lifecycle evidence succeeds from one final immutable merged SHA. No new credential, App, token, secret, environment, external attestor, or external compute is authorized.

  18. bradygaster commented on Sep 30, 2026

    @bradygaster
    bradygaster
    on Sep 30, 2026
    CollaboratorAuthor

    Final immutable preflight and install-PR evidence (not hosted acceptance)

    Source: 93aec83accb44e08c39e4a799f13b55208215a13, including merged #2118. This supersedes the earlier f67bee5a preflight.

    Proven: trusted source preflight; schema-v2 8 workflows / 17 runtime resources / 1 skill; both workflow-level and package-root provenance strict compile and digest verification; immutable gh-aw v0.89.21 setup/setup-cli pin 924af5fdc64061cfbf66fb584c8b07e2ac230c60; exactly the two documented diagnostic headers and the 8-success/2-warning summary. Both provenance compiles emitted byte-identical diagnostics. All three real consumer installs passed strict install and staged-index verification with exactly 46 required paths and no optional editor/maintenance extras. Backend ownership JSON was included despite its broad packages/ ignore rule. Enlistment tests: 85 passed; native review workflow/control tests: 17 passed.

    Fixture Fresh open, unmerged audit PR Exact head Exact untouched base
    backend octodemo/zava-social-backend-template-20260928092124#9 8bb53644ba0729e084a6f3030cb4f5413f350cbd 8fcaef5532bbb0a7baa770c04fd6cd1065967aa7
    frontend octodemo/zava-social-frontend-template-20260928092124#8 b5f611a9db1dbd425544d21bf55c8c240e26b204 1213623adc5eaa8669d78bc994a8624f37d5d952
    queue octodemo/zava-social-queue-worker-template-20260928092124#14 1be606cf5095062faff701f0a77a5c417b928dea a96d37615a17a7265d16f9561fe0dc6e09efc538
    • backend: installed tree cd21b9fd9f0b597b497de00ac440aa492551caa8; 46-file inventory SHA-256 43c2151f781f90a068b4173060952e207bbdc712a86f93f7783144f2195e1a9a.
    • frontend: installed tree 8654bc9f6ccef2249b023a8230f259f8e707f267; 46-file inventory SHA-256 2c2c0fb5a8b221519d88735a278ccb79825534aafe318957efaee8b4a91c6424.
    • queue: installed tree c2d4a431edc8fe632ec937959c1f9e1ed2f97335; 46-file inventory SHA-256 08c1e379f1634cfc53407ddde4f0c99aca17a55d218a16dab7c0f7363f966fec.

    Checks and runs at capture

    Run links below identify exact run ID/attempt. All seven bootstrap jobs (pre_activation, activation, agent, safe_outputs, detection, Materialize validated Squad bootstrap, conclusion) were skipped, not passed. The separate copilot-pull-request-reviewer and github-advanced-security checks were still running; no completed review is claimed.

    Human boundary and preservation

    No fixture PR was merged, no default branch was pushed, and no alternate bootstrap trigger was used. The original default SHA/tree/settings, all pre-existing branches (including Dependabot), preserved evidence PRs, and existing issues were verified unchanged. Preserved PRs: octodemo/zava-social-backend-template-20260928092124#3 and octodemo/zava-social-backend-template-20260928092124#8; octodemo/zava-social-frontend-template-20260928092124#3 and octodemo/zava-social-frontend-template-20260928092124#7; octodemo/zava-social-queue-worker-template-20260928092124#9 and octodemo/zava-social-queue-worker-template-20260928092124#13. Only one fresh installation branch and PR per fixture was added. No PAT, dedicated App, private key, custom token, new secret, reviewer environment, or external service was introduced.

    Still unproven until an explicitly authorized human installation merge: hosted bootstrap ownership validation and deterministic materialization, Cast/research safe outputs, automatic native Squad Review review job and logical verdict, exact run/attempt relay and downstream cleanup, and queue negative/recovery/idempotency scenarios. Copilot PR review is not a substitute for that native Squad Review evidence. These install PRs do not establish end-to-end acceptance, and no acceptance issue is being closed or recommended for closure. Docs PR #2100 remains unchanged.

  19. bradygaster
    added 2 commits that reference this issue on Oct 1, 2026

    fix(gh-aw): close review authorization gaps

    c49a590

    fix: ignore CommonMark tab-indented commands

    d765962
  20. bradygaster
    closed this as completedin #2120on Oct 1, 2026
  21. cherie-q
    added a commit that references this issue on Oct 1, 2026

    fix(gh-aw): harden hosted canary contracts (github#2120)

    c497c9c
  22. bradygaster
    added a commit that references this issue on Oct 20, 2026

    chore(release): promote dev to main (v1.1.0) (#2241)

    c24da2a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    gh-awGitHub Agentic Workflows integrationsquadSquad triage inbox — Lead will assign to a membersquad:agentic-workflows-devAssigned to agentic-workflows-dev (Agentic Workflows Engineer)

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions