Enforce maintainer authorization deterministically for direct /squad commands #2185

Summary

The Squad dispatcher permits direct slash-command invocations with roles: all, but its trusted safe-output guard validates command syntax without checking the triggering actor's repository permissions. Authorization for mutating commands on this path is enforced through agent instructions rather than deterministic runtime code.

The separate command router performs a deterministic permission check, but canonical /squad comments can trigger the dispatcher directly without passing through that router.

Affected revision and discovery

Observed while installing the complete native Squad v1.0.1 workflow package at immutable revision 37b418ade9b96f4fd5b15db40538fd9502a545c6, compiled with gh aw v0.89.22.

• Consumer installation PR: Add Squad 2.0 preview team bradygaster/eShop#1
• Original Copilot review finding: Add Squad 2.0 preview team bradygaster/eShop#1 (comment)
• That review thread was accidentally marked resolved; no corrective code change has been made.

The package passed its documented strict compilation and integrity verification. Those checks establish package consistency, not authorization correctness. The finding has been confirmed by source inspection; no live unauthorized mutation was attempted.

Evidence

• workflows/package/squad.md (installed as .github/workflows/squad.md) declares roles: all and direct slash-command triggers for issues and comments.
• Its trusted safe-output step, Reject unknown or malformed Squad commands, invokes enforceSquadCommandContract with payload, eventName, and createComment, but no permission resolver or authorization check.
• workflows/shared/squad-command-contract.mjs defines commandRequiresAuthorization and isAuthorizedPermission, but enforceSquadCommandContract returns immediately for any result whose status is not rejected, including accepted mutating commands. It does not use those authorization helpers.
• The dispatcher's Step AG-2: Resolve actor permission is part of the agent's instructions. An agent that ignores or is induced to bypass those instructions is not blocked by the syntax-only guard.
• workflows/package/squad-command-router.md checks collaborator permissions for both the event actor and command author, but this protects the router path, not every direct dispatcher invocation.

Expected behavior

Trusted workflow/runtime code must fail closed on unauthorized mutating commands, independent of the agent's behavior. A valid command string alone must never authorize privileged safe outputs.

Potential impact

A noncompliant or prompt-injected agent could emit maintainer-only mutations for an unprivileged commenter through the direct dispatcher path. Available outputs include issue/PR creation and worker dispatch. Disabling Actions PR creation under the recommended Profile A does not establish authorization for other write operations.

Requested fix

Implement a trusted pre-agent and/or safe-output authorization boundary covering all direct dispatcher entry points and relevant mutating outputs. Resolve permissions from trusted event identity and the repository API; require write, maintain, or admin for privileged commands, and fail closed when identity or permission resolution is missing or fails.

Preserve the explicitly supported open modes (status, review, research, and plan) without allowing an open-mode invocation to emit unrelated privileged outputs. Account explicitly for edited command text, actor versus author identity, and legitimate platform-authorized dispatch/worker continuations rather than broadly exempting bots or unknown events.

Acceptance criteria

• Direct mutating /squad invocations from read-only, triage, or non-collaborator users cannot cause privileged outputs even if the agent emits them.
• Missing actor identity and permission API failures deny privileged execution.
• Authorized write/maintain/admin invocations continue to work.
• Explicit open modes retain their intended behavior and cannot be used to bypass the output authorization boundary.
• Router and direct dispatcher paths have consistent authorization, including relevant edited-event identity handling.
• Legitimate authenticated dispatch and worker continuation paths remain functional with explicit tests.
• Add deterministic regression tests using mocked event payloads, permission responses, and agent outputs; no live unauthorized write is needed.
• Regenerate the canonical/package workflow surfaces, integrity manifest, and affected fixtures as required; validate strict compilation and the complete consumer installation.
• Publish an approved immutable package revision consumers can install as a coherent update. Do not require consumers to hand-edit integrity-pinned runtime files.

The eShop installation PR remains open and unmerged pending human review.