docs: production security hardening — threat model, prompt injection defense, and credential hygiene

.squad/decisions.md

@@ -235,10 +235,84 @@ Triaged 14 untriaged issues (3 docs, 6 community features, 3 bugs, 2 questions).
 - **Joniba contributions:** Consistently high-quality, matches team standards (wiring guide is excellent).
 - **Diberry contributions:** MSFT-level quality, merge-ready on delivery.
 
-## Deferred
-
-- #357, #336, #335, #334, #333, #332, #316 (A2A) — stays shelved per existing decision
-- #581 (ADO PRD) — P2, blocked until #341 (SDK-first parity) ships
+## Deferred
+
+- #357, #336, #335, #334, #333, #332, #316 (A2A) — stays shelved per existing decision
+- #581 (ADO PRD) — P2, blocked until #341 (SDK-first parity) ships
+
+---
+
+### 2026-03-26: CI deletion guard and source tree canary
+**By:** Booster (CI/CD)
+**What:** Added two safety checks to squad-ci.yml: (1) source tree canary verifying critical files exist, (2) large deletion guard failing PRs that delete >50 files without 'large-deletion-approved' label. Branch protection on dev requested (may need manual setup).
+**Why:** Incident #631 — @copilot deleted 361 files on dev with no CI gate catching it.
+
+### 2026-03-26: Copilot git safety rules
+**By:** RETRO (Security)
+**What:** Added mandatory Git Safety section to copilot-instructions.md: prohibits `git add .`, requires feature branches and PRs, adds pre-push checklist, defines red-flag stop conditions.
+**Why:** Incident #631 — @copilot used destructive staging on an incomplete working tree, deleting 361 files.
+
+### 2026-03-29: Versioning Policy — No Prerelease Versions on dev/main
+**By:** Flight (Lead)
+**Confidence:** Medium (confirmed by PR #640 incident, PR #116 prerelease leak, CI gate implementation)
+
+**Decision:**
+1. All packages use strict semver (`MAJOR.MINOR.PATCH`). No prerelease suffixes on `dev` or `main`.
+2. Prerelease versions are ephemeral. `bump-build.mjs` creates `-build.N` for local testing only — never committed.
+3. SDK and CLI versions must stay in sync. Divergence silently breaks npm workspace resolution.
+4. Surgeon owns version bumps. Other agents must not modify `version` fields in `package.json` unless fixing a prerelease leak.
+5. CI enforcement via `prerelease-version-guard` blocks PRs with prerelease versions. `skip-version-check` label is Surgeon-only.
+
+**Why:** The repo had no documented versioning policy. PR #640 prerelease version `0.9.1-build.4` silently broke workspace resolution. The semver range `>=0.9.0` does not match prerelease versions, causing npm to install a stale registry package. PR #116 Surgeon set versions to `0.9.1-build.1` instead of `0.9.1` on a release branch due to lack of guidance.
+
+**Impact:** All agents must follow the versioning policy when touching `package.json`. Surgeon charter should reference `.squad/skills/versioning-policy/SKILL.md` for release procedures. CI pipeline enforces the policy via automated gate.
+
+### 2026-04-25: Release Process Skill Update — v0.9.4 Learnings
+**By:** Booster (CI/CD Engineer)
+**Status:** Implemented
+**Requested by:** Brady
+
+**Summary:** Updated both release-process skill files with critical learnings from the v0.9.4 release session. The v0.9.4 release was delayed by three distinct issues, each fixed by a separate PR.
+
+**Files Updated:**
+1. `.squad/skills/release-process/SKILL.md` (team-level skill)
+2. `.copilot/skills/release-process/SKILL.md` (copilot-level skill)
+3. `.squad/agents/booster/history.md` (learnings log)
+
+**Known Gotchas (Root Cause, Fix PR, Skill Section):**
+- Root package.json version drift: squad-release.yml reads from root, not sub-packages (#1043)
+- CHANGELOG missing `## [$VERSION]`: Workflow validates version entry exists (#1042)
+- Lockfile integrity check rejects workspace packages: Check didn't filter for registry-only packages (#1044)
+- GITHUB_TOKEN can't trigger downstream workflows: GitHub security feature prevents event propagation (design decision)
+- Prebuild bump breaks workspace linking: bump-build.mjs mutates versions breaking exact match
+
+**Rationale:** These are high-impact, recurring failure modes. Documenting them in the skill files ensures every agent (human or AI) working on releases has the knowledge to avoid repeating v0.9.4 delays. The GITHUB_TOKEN limitation in particular is non-obvious and would catch any future release.
+
+### 2026-06-24: Restore always-on coordinator inline-dispatch gate (v0.10.0 regression)
+**By:** Procedures (Prompt Engineer)
+**Requested by:** Tamir Dresher
+**Branch:** squad/fix-coordinator-inline-dispatch-gate (worktree)
+**Status:** Proposed — applied in working tree, awaiting Lead (Flight) review; NOT committed.
+
+**Context:** Matthew Wan reported the main Squad coordinator "does a lot of work on its own instead of using his roster of agents." Worked in v0.9.4, broke in v0.10.0. Commit `afe78188` (#1035, "context overflow sentinel + coordinator size reduction") cut the coordinator template and moved the concrete inline-dispatch gate out of the always-on prompt into lazy-loaded reference files. The leftover inline guidance was too soft.
+
+**Decision:** Re-establish a strong, always-on dispatch gate without breaking legitimate Direct/Lightweight response modes. Three minimal edits (~14 lines) to the canonical template `.squad-templates/squad.agent.md`:
+1. Inline-dispatch gate: inline permitted ONLY in Direct Mode, or when NEITHER `task` NOR `runSubagent` exists; otherwise MUST dispatch.
+2. STOP gate: about to emit a domain artifact with no spawn call this turn → STOP and dispatch (exceptions: Direct Mode / no spawn tool).
+3. VS Code `runSubagent` micro-playbook re-inlined (~5 lines) so how-to-dispatch is always-on.
+
+**Synced Copies (canonical first):**
+1. `.squad-templates/squad.agent.md` (canonical)
+2. `templates/squad.agent.md.template`
+3. `.github/agents/squad.agent.md`
+4. `packages/squad-cli/templates/squad.agent.md.template`
+5. `packages/squad-sdk/templates/squad.agent.md.template`
+
+**Validation:** Regression test `test/coordinator-inline-dispatch-gate.test.ts` is RED before (8/8 fail), GREEN after (8/8 pass). Full `npm run test` passes deterministic checks. `npm run lint` clean.
+
+**Changeset:** Required. Added `.changeset/fix-coordinator-inline-dispatch-gate.md` (patch, squad-cli + squad-sdk).
+
+**Rollout:** Existing installs require `squad upgrade` to pick up the regenerated coordinator agent.
 
 
 ---

.squad/log/2026-07-24T09-20-10-pr-merge-strategy.md

@@ -0,0 +1,50 @@
+# Session Log: Locked PR Strategy
+
+**Date:** 2026-07-24  
+**Session Time:** 2026-07-24T09:20:10.011Z  
+**Requested by:** Brady Gaster  
+**Agents:** Flight (mission lead), FIDO (QA/CI), RETRO (security), Surgeon (sequencing), Coordinator (orchestration)
+
+## Summary
+
+Four-agent stack completed end-to-end audit of 17 open PRs. Disposition locked and prioritized by merge feasibility, security posture, and conflict resolution.
+
+## PR Disposition (Locked)
+
+### Merge Now (5 PRs)
+- #1511, #1474, #1504, #1510, #1516
+
+No conflicts, all tests pass, security clean. Safe for immediate merge in parallel.
+
+### Close as TS7 (3 PRs)
+- #1503, #1506, #1472
+
+Duplicates or superseded by other work. No merge impact.
+
+### Fix Then Merge Chain (2 PRs, Sequential)
+- **#1517 → #1525** (ordered pair)
+
+#1517 must merge first. #1525 depends on #1517's changes.
+
+### Owner Update Required (3 PRs)
+- #1445, #1485, #1414
+
+Need author re-baseline or response before merge. Blocked pending communication.
+
+### Mitigate (3 PRs)
+- #1426, #1391, #1392
+
+Security findings require custom merge strategy or post-merge mitigation. Not mergeable as-is.
+
+### Park (1 PR)
+- #1529
+
+Blocked by external dependency or strategic hold. Deferred.
+
+## Total Accounting
+
+17 PRs across 6 disposition buckets. All PRs classified and sequenced.
+
+## Coordination
+
+Coordinator posted concise HTML plan to Brady/Tamir Teams chat (message id 1784911185870).

.squad/orchestration-log/2026-07-24T09-20-10.011-00-00-FIDO.md

@@ -0,0 +1,23 @@
+# FIDO Orchestration Log
+
+**Session:** 2026-07-24T09:20:10.011Z  
+**Agent:** FIDO (Quality & CI Owner)  
+**Status:** Completed
+
+## Task
+
+Quality and CI/test audit of all 17 open PRs. Identify blockers, test failures, lint issues, and merge readiness.
+
+## Outcome
+
+✅ Completed
+
+Audit findings integrated into Flight's locked disposition plan. Key assessments:
+- Test coverage matrix for all PRs
+- CI/lint pass/fail status
+- Merge dependency analysis
+- Release readiness checks
+
+## Coordination
+
+Results fed to Flight for sequencing. Findings inform Surgeon's conflict graph.

.squad/orchestration-log/2026-07-24T09-20-10.011-00-00-Flight.md

@@ -0,0 +1,27 @@
+# Flight Orchestration Log
+
+**Session:** 2026-07-24T09:20:10.011Z  
+**Agent:** Flight (Mission Lead)  
+**Status:** Completed
+
+## Task
+
+Initial triage and disposition stack of 17 open PRs. Deep sequential review with locked disposition plan.
+
+## Outcome
+
+✅ Completed
+
+Disposition locked and prioritized:
+- **Merge now:** #1511, #1474, #1504, #1510, #1516 (5 PRs)
+- **Close as TS7:** #1503, #1506, #1472 (3 PRs)
+- **Fix then merge:** #1517 → #1525 chain (2 PRs, sequential)
+- **Owner update required:** #1445, #1485, #1414 (3 PRs)
+- **Mitigate:** #1426, #1391, #1392 (3 PRs)
+- **Park:** #1529 (1 PR)
+
+Total: 17 PRs accounted for.
+
+## Coordination
+
+Final strategy posted to Brady/Tamir Teams chat (message id 1784911185870) by Coordinator.

.squad/orchestration-log/2026-07-24T09-20-10.011-00-00-RETRO.md

@@ -0,0 +1,25 @@
+# RETRO Orchestration Log
+
+**Session:** 2026-07-24T09:20:10.011Z  
+**Agent:** RETRO (Security & Trust Boundary Auditor)  
+**Status:** Completed
+
+## Task
+
+Security and trust-boundary audit of all 17 open PRs. Identify vault exposure, secret leakage, permission escalation, and boundary violations.
+
+## Outcome
+
+✅ Completed
+
+Security audit findings integrated into disposition plan. Key assessments:
+- Credential/secret exposure scan
+- Permission boundary analysis
+- Hook-based enforcement verification
+- Trust-boundary integrity checks
+
+Results categorized by severity (blocking, mitigate, parked) and inform final merge strategy.
+
+## Coordination
+
+Findings incorporated into Coordinator's locked strategy. Mitigate (#1426, #1391, #1392) and park (#1529) decisions reflect security posture.

.squad/orchestration-log/2026-07-24T09-20-10.011-00-00-Surgeon.md

@@ -0,0 +1,25 @@
+# Surgeon Orchestration Log
+
+**Session:** 2026-07-24T09:20:10.011Z  
+**Agent:** Surgeon (Merge Sequencer & Conflict Resolution)  
+**Status:** Completed
+
+## Task
+
+Conflict graph analysis and merge sequencing for all 17 open PRs. Identify file conflicts, dependency chains, and safe merge order.
+
+## Outcome
+
+✅ Completed
+
+Sequencing locked:
+1. **No-conflict set (merge parallel):** #1511, #1474, #1504, #1510, #1516
+2. **TS7 closures (no merge impact):** #1503, #1506, #1472
+3. **Sequential pair (ordered):** #1517 → #1525 (direct dependency)
+4. **Owner updates (re-baselined):** #1445, #1485, #1414
+5. **Mitigated (custom merge strategy):** #1426, #1391, #1392
+6. **Parked (blocked):** #1529
+
+## Coordination
+
+Sequencing validated against Flight's disposition. No merge conflicts or logical dependencies block the locked strategy.