chore(squad): merge decision inbox and summarize oversized agent histories

.squad/agents/retro/history.md

@@ -14,3 +14,40 @@ RETRO assigned:
 Pattern: Critical production bug identified. Race condition in history-shadow requires atomicity guarantees from StorageProvider abstraction (CONTROL/EECOM).
 
 📌 **Team update (2026-03-22T06:44:01Z):** Flight issued comprehensive triage. RETRO owns #479 mitigation strategy. Production bug severity high; blocks stable history-shadow operation. Depends on StorageProvider PRD completion (#481). Coordinated rollout required.
+
+---
+
+### Security scanner false-positive fix (2026-07-29T17:11:56+10:00)
+
+Diagnosed and fixed a false positive in `scripts/security-review.mjs` that was blocking PR #1558 (squad state-sync — Scribe memory consolidation).
+
+**Root cause:** The `unsafe-git` check (check #4) scanned ALL changed files in the PR diff with no file-type filter. When Scribe merged `.squad/decisions/inbox/` entries into `.squad/decisions.md`, a historical entry documenting the broad repo-root staging prohibition surfaced as new `+` lines. The scanner pattern-matched the literal string inside backtick prose and fired an error. The inbox was gitignored — that's why the same content never tripped the scanner before.
+
+**Fix:** Added `UNSAFE_GIT_EXCLUDED_PATHS` list to skip append-only log files: `.squad/decisions.md`, `.squad/agents/*/history.md`, `.squad/log/**`, `.squad/orchestration-log/**`. Instruction surfaces (copilot-instructions.md, charter files, team.md, routing.md) are deliberately kept in scope.
+
+**Verified locally:** (a) scanner returns zero findings on the state-sync PR diff; (b) a probe file `scripts/__scan-probe.sh` with bare repo-root staging and force-push commands was caught by two errors. Probe deleted after test.
+
+**Latent false positives found:**
+- `.github/copilot-instructions.md` line 21 contains broad staging / commit-all command examples in a prohibition list — would be flagged if that file changes. Kept in scope intentionally (instruction surface). Acceptable noise on future edits.
+- `.squad/agents/scribe/charter.md` has a scoped dot-prefixed add command — the regex `/git\s+add\s+\./` also matches scoped paths starting with `.`. Not fixed here; that's a pattern-precision issue separate from this scoping bug.
+- `.squad/templates/issue-lifecycle.md` has a repo-root staging example in a code fence. Kept in scope (template = instruction surface).
+- `.squad/log/` and `.squad/orchestration-log/` files have the patterns but are gitignored — will never appear in PR diffs. No action needed.
+
+Decision filed in inbox: `retro-scanner-log-exclusion.md`.
+
+---
+
+### PR #1559 — unsafe-git scanner: fix nested agent history exclusion (2026-07-29T19:25:08+10:00)
+
+Fixed a false-positive regression in PR #1559 (`squad/fix-security-scanner-prose-fp`). The original exclusion regex `/^\.squad\/agents\/[^\/]+\/history\.md$/` used `[^/]+` (exactly one path segment), which failed to exclude alumni paths such as `.squad/agents/_alumni/kobayashi/history.md`.
+
+**Fix:** Changed to `.+` — matches one or more characters including `/`, covering any nesting depth while still anchoring on the literal filename `history.md`. Charters and other instruction surfaces are unchanged (still scanned).
+
+**Verified:**
+- `.squad/agents/retro/history.md` → excluded ✅
+- `.squad/agents/_alumni/kobayashi/history.md` → excluded ✅ (was broken)
+- `.squad/agents/retro/charter.md` → still scanned ✅
+- Probe `scripts/__scan-probe.sh` (containing repo-root staging + force-push forms) → 2 errors detected ✅; probe deleted, no trace in commit.
+- PR #1558 diff (`squad/state-sync-2026-07-29`) — scanner returned no findings after fix.
+
+**Known follow-up (not fixed here):** `/git\s+add\s+\./` also matches safe scoped dot-prefixed add commands. Separate issue documented in PR body.

.squad/agents/scribe/history.md

@@ -2,3 +2,5 @@
 
 *Fresh start — Apollo 13 rebirth. Previous session logs archived.*
 
+
+📌 **Team update (2026-07-29T17:11:56+10:00 — Issue #1556 / PR #1557 memory merge):** Merged 6 inbox decisions, wrote 2 orchestration logs + 1 session log, appended cross-agent updates to fido and surgeon, summarized 6 oversized history files (eecom 33KB→5.7KB, pao 31KB→5.5KB, kobayashi-alumni 26KB→3.5KB, flight 23KB→5.7KB, fido 22KB→6KB, procedures 18KB→4KB). decisions.md 12151→16030 bytes (below 20KB threshold; no archival needed). Booster history.md excluded per coordinator instructions (committed, do not touch).

.squad/agents/surgeon/history.md

@@ -135,3 +135,5 @@ Prepared comprehensive release playbook and CI improvement plan for Brady's revi
 - Pre-release validation prevents 90% of publish issues
 - Culture: "If the same problem happens twice, the playbook failed"
 - Documentation must be user-first (Brady's perspective, not technical jargon)
+
+📌 **Team update (2026-07-29T17:11:56+10:00 — Issue #1556 / PR #1557):** A changeset `.changeset/fix-workflow-shellcheck-quoting.md` (patch, squad-cli + squad-sdk) landed in PR #1557. Separately, a new `squad-workflow-lint` job (`.github/workflows/squad-workflow-lint.yml`) runs actionlint 1.7.12 + shellcheck 0.10.0 on workflow templates — this is a distinct check, entirely independent of `changelog-gate`, which only enforces changeset/CHANGELOG requirements and has no role in linting. For future releases, be aware that PRs touching `.github/workflows/`, `.squad-templates/workflows/`, `templates/workflows/`, or either package's `templates/workflows/` will trigger this lint check. Whether `squad-workflow-lint` is configured as a required branch-protection gate has not been verified — confirm before treating it as a hard release blocker.

.squad/decisions.md

@@ -240,3 +240,51 @@ Triaged 14 untriaged issues (3 docs, 6 community features, 3 bugs, 2 questions).
 - #357, #336, #335, #334, #333, #332, #316 (A2A) — stays shelved per existing decision
 - #581 (ADO PRD) — P2, blocked until #341 (SDK-first parity) ships
 
+
+---
+
+### 2026-03-26: CI deletion guard and source tree canary
+
+**By:** Booster (CI/CD)
+**What:** Added two safety checks to squad-ci.yml: (1) source tree canary verifying critical files exist, (2) large deletion guard failing PRs that delete >50 files without 'large-deletion-approved' label. Branch protection on dev requested (may need manual setup).
+**Why:** Incident #631 — @copilot deleted 361 files on dev with no CI gate catching it.
+
+---
+
+### 2026-03-26: Copilot git safety rules
+
+**By:** RETRO (Security)
+**What:** Added mandatory Git Safety section to copilot-instructions.md: prohibits broad repo-root staging commands, requires feature branches and PRs, adds pre-push checklist, defines red-flag stop conditions.
+**Why:** Incident #631 — @copilot used destructive staging on an incomplete working tree, deleting 361 files.
+
+---
+
+### 2026-03-29: Versioning policy — no prerelease versions on dev/main
+
+**By:** Flight (Lead)
+**What:** (1) All packages use strict semver (MAJOR.MINOR.PATCH) — no prerelease suffixes on dev or main. (2) Prerelease versions (`-build.N`) are local-only, never committed. (3) SDK and CLI versions must stay in sync. (4) Surgeon owns version bumps. (5) CI gate `prerelease-version-guard` blocks PRs with prerelease versions; `skip-version-check` label is Surgeon-only.
+**Why:** PR #640 — prerelease `0.9.1-build.4` silently broke workspace resolution; PR #116 — Surgeon set wrong prerelease version on release branch. No documented policy caused both incidents. Full policy in `.squad/skills/versioning-policy/SKILL.md`.
+
+---
+
+### 2026-04-25: Release process skill update — v0.9.4 learnings
+
+**By:** Booster (CI/CD)
+**What:** Updated `.squad/skills/release-process/SKILL.md` and `.copilot/skills/release-process/SKILL.md` with v0.9.4 incident learnings: root package.json version drift (read by squad-release.yml, not sub-packages), CHANGELOG must include `## [$VERSION]` entry, lockfile integrity check must filter registry-only packages, GITHUB_TOKEN cannot trigger downstream workflows, prebuild bump breaks workspace linking.
+**Why:** v0.9.4 release was delayed by three distinct issues (PRs #1042, #1043, #1044). Documenting prevents recurrence.
+
+---
+
+### 2026-06-24: Restore always-on coordinator inline-dispatch gate
+
+**By:** Procedures (Prompt Engineer)
+**What:** Re-established a strong always-on dispatch gate in `.squad-templates/squad.agent.md`, synced to all 5 copies: (1) inline-dispatch gate — inline only in Direct Mode or when neither `task` nor `runSubagent` exists; (2) STOP gate before emitting domain artifacts without a spawn call; (3) VS Code `runSubagent` micro-playbook re-inlined. Changeset added. Regression test `test/coordinator-inline-dispatch-gate.test.ts` (8/8 pass).
+**Why:** Commit `afe78188` (#1035) moved the inline-dispatch gate to lazy-loaded reference files, causing the coordinator to execute domain work itself instead of dispatching. Reported by Matthew Wan; workaround by Dina Berry.
+
+---
+
+### 2026-07-29: Workflow templates linted via explicit actionlint file paths
+
+**By:** Booster (CI/CD)
+**What:** Templates under `packages/squad-cli/templates/workflows/` and `packages/squad-sdk/templates/workflows/` are now linted by actionlint via explicit file path arguments in the new `squad-workflow-lint.yml` CI job. SC2086 findings fixed across all `>> $GITHUB_OUTPUT` / `>> $GITHUB_STEP_SUMMARY` redirects in `.squad-templates/workflows/`, `templates/workflows/`, `.github/workflows/squad-heartbeat.yml`, `squad-repo-health.yml`, and `squad-ci.yml`. Actionlint pinned to tag `v1.7.12`; shellcheck 0.10.0 installed explicitly.
+**Why:** Downstream repos running actionlint in their CI saw SC2086 errors in files generated by `squad upgrade` because Squad's own CI did not lint templates. The fix must live in Squad's templates — `squad upgrade` overwrites any downstream patches on every run. PR #1557.