[bradygaster]

Summary

• harden the published Squad GH-AW bootstrap, compilation, Cast handoff, and recovery guidance
• preserve committed .squad state during activation and require standalone-compatible Cast routing
• bind fast-path plan owners to the certified active roster and preserve accepted owner/dependency values
• make flat-plan activation create exactly the planned child tasks, with an explicit body-reference fallback when native dependency edges are unavailable
• keep Cast notifications deterministic and permit generated agent definitions through the narrow safe-output allowlist

Consumer validation

A fresh private consumer repository completed the published flow through implementation readiness: bootstrap, Cast, status, research, plan, first acceptance, and idempotent repeat acceptance. The run stopped before /squad implement.

The validation reproduced and drove fixes for committed-state loss, standalone routing incompatibility, invalid support-role routes, roster binding, Cast output allowlisting, flat-plan hierarchy, and dependency-summary accuracy. Public-safe evidence is recorded on #1903.

Validation

• npm test -- test/gh-aw-quality.test.ts test/gh-aw-plan-lifecycle.test.ts test/standalone-release-workflow.test.ts — 223 passed
• npm run build — passed
• gh-aw strict compilation in consumer layout — 4 workflows compiled; known slash-command/bot trigger warning only

Security review

No new secret references, action dependencies, workflow permissions, or redirect changes. Direct write-API fallback is explicitly forbidden; mutations remain gated by approved safe-output capabilities.

Closes #1903

[github-actions]

🟡 Impact Analysis — PR #1905

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	6
Files added	0
Files modified	6
Files deleted	0
Modules touched	3

🎯 Risk Factors

• 6 files changed (6-20 → MEDIUM)
• 3 modules touched (2-4 → MEDIUM)

📦 Modules Affected

docs (1 file)

• docs/src/content/docs/guide/gh-aw.md

root (2 files)

• workflows/shared/squad.md
• workflows/squad.md

tests (3 files)

• test/gh-aw-plan-lifecycle.test.ts
• test/gh-aw-quality.test.ts
• test/standalone-release-workflow.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 9024878

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	11 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (6 files, +361 −74)

File	+/−
docs/src/content/docs/guide/gh-aw.md	+159 −36
test/gh-aw-plan-lifecycle.test.ts	+55 −5
test/gh-aw-quality.test.ts	+57 −11
test/standalone-release-workflow.test.ts	+32 −0
workflows/shared/squad.md	+7 −6
workflows/squad.md	+51 −16

Total: +361 −74

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[Copilot]

🟢 Approval recommended

Changes are consistent with the stated consumer validation flow and are backed by targeted regression tests covering the updated contracts and documentation.

Pull request overview

This PR hardens the published Squad GH-AW (GitHub Agentic Workflows) consumer lifecycle by tightening the workflow contracts and updating the public setup guide so a clean consumer repo can bootstrap, strictly compile, review via PR, and proceed through Cast/plan acceptance more deterministically and safely.

Changes:

• Adds a deterministic, post-PR-creation notification path via safe-outputs.messages and expands Cast PR allowlisting to permit generated .github/agents/*.agent.md.
• Updates the shared bootstrap to preserve committed .squad/ state during activation (via ambient-folders) and shifts activation customization from pre-steps to steps (post-checkout).
• Updates the GH-AW guide + tests to require strict compilation before the bootstrap PR and to document the 4-workflow install surface, recovery cues, and the npm-free v0.13.1 activation boundary.

File summaries

File	Description
workflows/squad.md	Extends safe-outputs (messages + broader agent allowlist) and tightens Cast/plan-accept routing, owner binding, flat-plan hierarchy, and dependency preservation guidance.
workflows/shared/squad.md	Preserves committed .squad/ during activation and moves activation logic into jobs.activation.steps (post-checkout).
docs/src/content/docs/guide/gh-aw.md	Rewrites quick start into a strict, reviewable bootstrap PR flow and documents activation/cast persistence and recovery expectations.
test/standalone-release-workflow.test.ts	Adds regression assertions that the published GH-AW guide contains the strict bootstrap + activation boundary documentation.
test/gh-aw-quality.test.ts	Updates safe-output validation for the new messages block and adds contracts for PR notification + routing-table format + activation-step ordering/checkout boundary.
test/gh-aw-plan-lifecycle.test.ts	Adds/updates plan lifecycle tests enforcing certified roster binding, frozen owner/depends-on preservation, flat-plan issue creation, and dependency reporting guarantees.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[bradygaster]

Copilot review follow-up: the review recommended approval and generated no inline comments, so no thread replies were required. The sole CI failure was the exact safe-update documentation contract; commit 90248789 restored that wording. All checks now pass.