[bradygaster]

Closes #1955

Problem

/squad plan activate silently skipped applying squad and squad:{agent} labels to issues on a fresh consumer repository when those labels didn't already exist, reporting a "prerequisite gap" instead of creating them. The workflow/docs promised labeled issues that never showed up.

Fix — workflows/squad.md, squad-plan-activate skill only

• Added a safe-outputs.add-labels block: allowed: [squad, "squad:*"], create-if-missing: true, max: 80, target: "*" — using gh-aw's supported primitive (no invented create-label primitive).
• Rewrote the Label Pre-flight prose and Step 2b/2c bullets so the main (read-only) agent still computes per-task roster labels and the @copilot/multi-owner/non-roster mapping exactly as before, but now emits them through add-labels for auto-provisioning instead of silently omitting missing labels.
• Extended the ATOMIC CONTRACT + added a label-color honesty line so reporting reflects labels actually applied (including any auto-created via create-if-missing) — rerun idempotency and honest reporting preserved.
• All writes remain in safe-output jobs; the main activation agent stays read-only. No permissions broadened beyond what add-labels requires.

Sequencing verified: declaring add-labels does not retroactively label issues created earlier in the same run by create-issue. Confirmed via manual gh aw compile in a scratch workspace, and the skill was written so label application is its own step after issue creation, using the created issue number.

Version bump (required)

create-if-missing on add-labels requires gh-aw ≥ v0.87.6; this repo was pinned to v0.86.2, which silently ignores the field. Bumped the pin to v0.87.10 in .github/workflows/squad-ci.yml (2 places) and docs/src/content/docs/guide/gh-aw.md.

Test fallout from the version bump (directly related, no behavior change to other workflows)

gh-aw v0.87.10 changed how compiled lock files serialize the safe-outputs config (both GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG used by squad.md, and GH_AW_SAFE_OUTPUTS_CONFIG used by every other workflow) to an escaped-JSON YAML string.

• Added test/helpers/gh-aw-lock.ts — shared extractSafeOutputsConfigJson() helper supporting both old (heredoc) and new (escaped env var) formats.
• Rewired test/gh-aw-deps-routing.test.ts, test/gh-aw-deps-worker-workflow.test.ts, test/gh-aw-implement-workflow.test.ts, test/gh-aw-review-workflow.test.ts to use it instead of duplicated heredoc-only extraction (test plumbing only, no production behavior touched).
• Updated 3 pre-existing tests in test/gh-aw-quality.test.ts that had encoded the old "prerequisite gap" omission as expected behavior, plus one de-escaping fix.
• Added test/gh-aw-activation-label-provisioning.test.ts — new dedicated test asserting the prose contract and real compiled-lock wiring of add_labels/create_if_missing, and that the agent job's permissions remain read-only.

Verification

• npx vitest run across the 6 directly affected test files: 247/247 passed.
• Full npm test: only the same 8 pre-existing, unrelated "externalized state" failures remain (confirmed identical on unmodified HEAD via git stash) — no gh-aw regressions.
• npm run build succeeds (its version-bump/CRLF template side effects reverted so they don't pollute this diff).
• Manual gh aw compile --strict --no-check-update --approve succeeds for all 4 workflows with only pre-existing warnings, no errors.
• No changeset required — this PR touches no packages/squad-cli/src/ or packages/squad-sdk/src/ files.

Known limitation (explicitly out of scope per #1955)

The parallel squad-plan-accept fast-path issue-creation logic is unchanged — separate code path, not covered by this fix.

[github-actions]

🟡 Impact Analysis — PR #1956

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	10
Files added	2
Files modified	8
Files deleted	0
Modules touched	4

🎯 Risk Factors

• 10 files changed (6-20 → MEDIUM)
• 4 modules touched (2-4 → MEDIUM)

📦 Modules Affected

ci-workflows (1 file)

• .github/workflows/squad-ci.yml

docs (1 file)

• docs/src/content/docs/guide/gh-aw.md

root (1 file)

• workflows/squad.md

tests (7 files)

• test/gh-aw-activation-label-provisioning.test.ts
• test/gh-aw-deps-routing.test.ts
• test/gh-aw-deps-worker-workflow.test.ts
• test/gh-aw-implement-workflow.test.ts
• test/gh-aw-quality.test.ts
• test/gh-aw-review-workflow.test.ts
• test/helpers/gh-aw-lock.ts

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 993d026

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	0 active Copilot thread(s) resolved (1 outdated skipped)
✅	CI passing	All checks passing

Files Changed (10 files, +436 −97)

File	+/−
.github/workflows/squad-ci.yml	+3 −3
docs/src/content/docs/guide/gh-aw.md	+1 −1
test/gh-aw-activation-label-provisioning.test.ts	+289 −0
test/gh-aw-deps-routing.test.ts	+4 −16
test/gh-aw-deps-worker-workflow.test.ts	+8 −26
test/gh-aw-implement-workflow.test.ts	+4 −15
test/gh-aw-quality.test.ts	+57 −18
test/gh-aw-review-workflow.test.ts	+4 −14
test/helpers/gh-aw-lock.ts	+34 −0
workflows/squad.md	+32 −4

Total: +436 −97

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🏗️ Architectural Review

⚠️ Architectural review: 1 info.

Severity	Category	Finding	Files
ℹ️ info	template-sync	Template files changed in .github/workflows/ but not in other template locations. If these templates should stay in sync, consider updating the others too.	Changed: .github/workflows/, Unchanged: templates/, .squad-templates/, packages/squad-cli/templates/

---

Automated architectural review — informational only.

[Copilot]

Copilot review overview

🟡 Changes recommended

A new test shells out to gh aw compile without --no-check-update, which is inconsistent with other compile-gate tests and can introduce avoidable flakiness.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	test/​gh-aw-activation-label-provisioning.test.ts — This test shells out to gh aw compile without --no-check-update, while other gh-aw compile…

What changed in this PR

This PR hardens the /squad plan activate workflow contract so fresh consumer repositories get squad and squad:{agent} labels applied reliably by auto-provisioning missing labels via gh-aw safe outputs, and updates the repo’s pinned gh-aw version plus tests to match the compiler’s new lock serialization.

Changes:

• Add add-labels safe-output with create-if-missing: true and update squad-plan-activate prose to apply labels post-issue-creation (idempotently).
• Bump pinned gh-aw version to v0.87.10 and update docs accordingly.
• Refactor gh-aw lock parsing in tests with a shared helper, update existing quality tests, and add a dedicated activation label provisioning contract test.

File	Description
workflows/​squad.md	Declares add-labels safe output and updates Plan Activate label pre-flight + step contracts to apply/provision labels via add_labels.
test/​helpers/​gh-aw-lock.ts	Adds helper to extract safe-outputs JSON from compiled lock files across gh-aw serialization formats.
test/​gh-aw-review-workflow.test.ts	Uses shared lock helper instead of heredoc-only extraction.
test/​gh-aw-quality.test.ts	Adds/updates assertions for add-labels and adjusts compiled-lock JSON matching for new escaping behavior.
test/​gh-aw-implement-workflow.test.ts	Uses shared lock helper instead of heredoc-only extraction.
test/​gh-aw-deps-worker-workflow.test.ts	Uses shared lock helper in both normal and mutation-proving compile paths.
test/​gh-aw-deps-routing.test.ts	Uses shared lock helper instead of heredoc-only extraction.
test/​gh-aw-activation-label-provisioning.test.ts	New contract test covering prose + compiled-lock wiring for add_labels/create_if_missing and permission boundaries.
docs/​src/​content/​docs/​guide/​gh-aw.md	Updates documentation to reflect gh-aw v0.87.10 pin guidance.
.github/​workflows/​squad-ci.yml	Bumps pinned gh-aw install steps to v0.87.10.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.