Repository navigation
Isolate Squad product assets from team state - #2015
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
🔴 Impact Analysis — PR #2015Risk tier: 🔴 CRITICAL 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (8 files)
root (67 files)
scripts (4 files)
squad-cli (38 files)
squad-sdk (35 files)
templates (59 files)
tests (13 files)
|
Contributor
🏗️ Architectural Review
Automated architectural review — informational only. |
Contributor
🛫 PR Readiness Check
PR Scope: 📦🔧 Mixed (product + infrastructure)
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 12 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | 1 active Copilot thread(s) resolved (4 outdated skipped) |
| ✅ | CI passing | All checks passing |
Files Changed (224 files, +17020 −1662)
| File | +/− |
|---|---|
.changeset/identity-neutral-squad-templates.md |
+10 −0 |
.dockerignore |
+1 −1 |
.github/PR_REQUIREMENTS.md |
+15 −11 |
.github/PULL_REQUEST_TEMPLATE.md |
+1 −1 |
.github/agents/squad.agent.md |
+10 −10 |
.github/dependabot.yml |
+7 −7 |
.github/instructions/squad-routing-guard.instructions.md |
+20 −21 |
.github/workflows/squad-ci.yml |
+7 −2 |
.github/workflows/squad-heartbeat.yml |
+3 −3 |
.github/workflows/squad-triage.yml |
+129 −51 |
.squad-templates/machine-capabilities.md |
+1 −1 |
.squad-templates/model-selection-reference.md |
+4 −4 |
.squad-templates/notes-protocol.md |
+4 −7 |
.squad-templates/ralph-triage.js |
+83 −97 |
.squad-templates/skills/agent-collaboration/SKILL.md |
+42 −0 |
.squad-templates/skills/agent-conduct/SKILL.md |
+24 −0 |
.squad-templates/skills/architectural-proposals/SKILL.md |
+151 −0 |
.squad-templates/skills/ci-validation-gates/SKILL.md |
+84 −0 |
.squad-templates/skills/cli-wiring/SKILL.md |
+47 −0 |
.squad-templates/skills/client-compatibility/SKILL.md |
+89 −0 |
.squad-templates/skills/coordinator-init-mode/SKILL.md |
+99 −0 |
.squad-templates/skills/coordinator-response-mode/SKILL.md |
+97 −0 |
.squad-templates/skills/coordinator-source-of-truth/SKILL.md |
+45 −0 |
.squad-templates/skills/cross-machine-coordination/SKILL.md |
+442 −0 |
.squad-templates/skills/cross-squad-communication/SKILL.md |
+399 −0 |
.squad-templates/skills/cross-squad/SKILL.md |
+174 −0 |
.squad-templates/skills/distributed-mesh/SKILL.md |
+287 −0 |
.squad-templates/skills/distributed-mesh/mesh.json.example |
+30 −0 |
.squad-templates/skills/distributed-mesh/sync-mesh.ps1 |
+111 −0 |
.squad-templates/skills/distributed-mesh/sync-mesh.sh |
+104 −0 |
.squad-templates/skills/docs-standards/SKILL.md |
+71 −0 |
.squad-templates/skills/e2e-template-testing/SKILL.md |
+6 −5 |
.squad-templates/skills/economy-mode/SKILL.md |
+115 −0 |
.squad-templates/skills/error-recovery/SKILL.md |
+99 −0 |
.squad-templates/skills/external-comms/SKILL.md |
+329 −0 |
.squad-templates/skills/fact-checking/SKILL.md |
+61 −0 |
.squad-templates/skills/gh-auth-isolation/SKILL.md |
+183 −0 |
.squad-templates/skills/gh-aw-enlistment/SKILL.md |
+346 −0 |
.squad-templates/skills/git-workflow/SKILL.md |
+207 −0 |
.squad-templates/skills/github-multi-account/SKILL.md |
+95 −0 |
.squad-templates/skills/history-hygiene/SKILL.md |
+36 −0 |
.squad-templates/skills/humanizer/SKILL.md |
+105 −0 |
.squad-templates/skills/init-mode/SKILL.md |
+104 −0 |
.squad-templates/skills/iterative-retrieval/SKILL.md |
+165 −0 |
.squad-templates/skills/model-selection/SKILL.md |
+125 −0 |
.squad-templates/skills/notification-routing/SKILL.md |
+105 −0 |
.squad-templates/skills/personal-squad/SKILL.md |
+66 −0 |
.squad-templates/skills/pr-review-response/SKILL.md |
+268 −0 |
.squad-templates/skills/pr-screenshots/SKILL.md |
+149 −0 |
.squad-templates/skills/project-conventions/SKILL.md |
+56 −0 |
| ... | +174 more files |
Total: +17020 −1662
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Unresolved routing, generated-source, protocol, changeset, and regression-coverage issues block approval.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Lite
Findings: 1
New issues introduced by this change (5)
| Severity | Finding |
|---|---|
 |
.squad-templates/workflows/squad-triage.yml — The PR changes governed template/scaffolding paths, but the description marks the changeset step… |
 |
packages/squad-sdk/templates/skills/external-comms/SKILL.md — The shipped skill changes rename the review commands to comms, but… |
|
packages/squad-sdk/templates/skills/versioning-policy/SKILL.md — These package files are generated mirrors, but scripts/sync-skill-templates.mjs copies… |
|
test/recast-identity-neutrality.test.ts — The template scan omits the i flag used by the policy scan, so a lower-cased or differently cased… |
|
test/recast-identity-neutrality.test.ts — This regression test only checks that helper names exist and three old source fragments are absent;… |
What changed in this PR
This pull request decouples Squad governance, triage, and shipped templates from cast-specific names by using current team and routing metadata.
Changes:
- Adds routing-table-driven triage with Lead fallback.
- Generalizes governance, spawn, and skill templates.
- Removes the obsolete Dependabot label and adds identity-neutrality tests.
| File | Summary |
|---|---|
test/recast-identity-neutrality.test.ts |
Adds identity-neutrality and routing regression tests. |
templates/workflows/squad-triage.yml |
Updates reusable triage workflow routing. |
templates/spawn-reference.md |
Generalizes spawn examples. |
templates/skills/e2e-template-testing/SKILL.md |
Generalizes E2E guidance. |
packages/squad-sdk/templates/workflows/squad-triage.yml |
Updates the SDK triage template. |
packages/squad-sdk/templates/spawn-reference.md |
Generalizes SDK spawn examples. |
packages/squad-sdk/templates/skills/versioning-policy/SKILL.md |
Generalizes SDK versioning guidance. |
packages/squad-sdk/templates/skills/retro-enforcement/SKILL.md |
Generalizes SDK retrospective guidance. |
packages/squad-sdk/templates/skills/humanizer/SKILL.md |
Generalizes SDK humanizer guidance. |
packages/squad-sdk/templates/skills/external-comms/SKILL.md |
Generalizes SDK communications guidance. |
packages/squad-sdk/templates/skills/e2e-template-testing/SKILL.md |
Generalizes SDK E2E guidance. |
packages/squad-sdk/templates/skills/docs-standards/SKILL.md |
Generalizes SDK documentation guidance. |
packages/squad-sdk/templates/skills/agent-conduct/SKILL.md |
Generalizes SDK agent conduct guidance. |
packages/squad-cli/templates/workflows/squad-triage.yml |
Updates the CLI triage template. |
packages/squad-cli/templates/spawn-reference.md |
Generalizes CLI spawn examples. |
packages/squad-cli/templates/skills/versioning-policy/SKILL.md |
Generalizes CLI versioning guidance. |
packages/squad-cli/templates/skills/retro-enforcement/SKILL.md |
Generalizes CLI retrospective guidance. |
packages/squad-cli/templates/skills/humanizer/SKILL.md |
Generalizes CLI humanizer guidance. |
packages/squad-cli/templates/skills/external-comms/SKILL.md |
Generalizes CLI communications guidance. |
packages/squad-cli/templates/skills/e2e-template-testing/SKILL.md |
Generalizes CLI E2E guidance. |
packages/squad-cli/templates/skills/docs-standards/SKILL.md |
Generalizes CLI documentation guidance. |
packages/squad-cli/templates/skills/agent-conduct/SKILL.md |
Generalizes CLI agent conduct guidance. |
.squad-templates/workflows/squad-triage.yml |
Updates the canonical triage workflow. |
.squad-templates/spawn-reference.md |
Generalizes canonical spawn examples. |
.squad-templates/skills/e2e-template-testing/SKILL.md |
Generalizes canonical E2E guidance. |
.github/workflows/squad-triage.yml |
Updates active repository triage. |
.github/PULL_REQUEST_TEMPLATE.md |
Makes waiver guidance role-based. |
.github/PR_REQUIREMENTS.md |
Makes review ownership role-based. |
.github/instructions/squad-routing-guard.instructions.md |
Makes routing guidance metadata-driven. |
.github/dependabot.yml |
Removes the obsolete Dependabot label. |
Suppressed comments (9)
.github/workflows/squad-triage.yml:142
- The active workflow has the same table-shape assumption: a valid
routing.mdrow without a final|is parsed with missing columns, so routing silently falls back to Lead. Keep this copy in sync with the canonical parser while accepting optional trailing pipes.
function tableCells(line) {
return line.split('|').slice(1, -1).map(cell => cell.trim());
}
.github/workflows/squad-triage.yml:169
- The active workflow repeats the same substring-based destination lookup, so overlapping member names in a recast can produce multiple rules and an arbitrary assignment. Use exact normalized destination tokens rather than
includeshere as well as in the canonical template.
const destinations = members.filter(member =>
routeCell.toLowerCase().includes(member.name.toLowerCase())
);
.github/workflows/squad-triage.yml:247
- The new route path still relies on
lead, which is selected above by matchinglead,architect, orcoordinatorin the role text. After a re-cast, an Architect/Coordinator listed before the actual Lead would receive unmatched issues and be shown as the triage authority; resolve the fallback from the exact Lead role (or an explicit role owner) instead of this broad heuristic.
if (scoredRoutes.length > 0) {
const best = scoredRoutes[0];
assignedMember = best.rule.member;
triageReason = `Matched routing rule "${best.rule.workType}"`;
.squad-templates/workflows/squad-triage.yml:109
tableCellsonly works when every Markdown row has a trailing|. A valid two-columnrouting.mdwritten without that optional final pipe leavesrouteIndexat-1, so no routing rules are loaded and every issue falls back to Lead. Normalize an optional trailing empty cell instead; the SDK parser already accepts both table forms.
function tableCells(line) {
return line.split('|').slice(1, -1).map(cell => cell.trim());
}
.squad-templates/workflows/squad-triage.yml:136
- Destination matching uses substring search, so a recast with names such as
AnnandAnnamakes a route toAnnamatch both members and can assign the issue to the wrong one. Parse the route cell's delimited destinations and compare normalized names exactly (while stripping the display emoji).
const destinations = members.filter(member =>
routeCell.toLowerCase().includes(member.name.toLowerCase())
);
packages/squad-cli/templates/skills/external-comms/SKILL.md:6
- These edits are being made only in package mirrors, but
external-comms,humanizer, andversioning-policyare generated from.squad/skillsbyscripts/sync-skill-templates.mjs, which copies into both package trees. The canonical sources still contain PAO/Surgeon text, so the next sync or release regeneration will overwrite this neutral version and reintroduce the cast-specific names; update the canonical sources first and regenerate both mirrors.
description: "Workflow for scanning, drafting, and presenting community responses with a human review gate"
domain: "community, communication, workflow"
confidence: "low"
source: "manual (external communications workflow)"
packages/squad-cli/templates/skills/external-comms/SKILL.md:144
- The renamed
comms approve/comms resumetokens are part of the documented review protocol, but.squad/comms/tests/tone-validation-spec.md:57,61,153still defines and validatespao approve/pao resume. Consumers and repository checks therefore disagree about the command API; update the canonical skill and validation spec together, or retain the established tokens.
- `comms approve 1 3` — approve drafts 1 and 3
- `comms edit 2` — edit draft 2
- `comms skip` — skip all
packages/squad-sdk/templates/skills/external-comms/SKILL.md:6
- This is the second generated mirror of
external-comms, but the canonical.squad/skills/external-comms/SKILL.mdstill contains the old PAO text.scripts/sync-skill-templates.mjswill copy that stale source over both package trees on the next sync, undoing this change; update the canonical source and regenerate the mirrors.
description: "Workflow for scanning, drafting, and presenting community responses with a human review gate"
domain: "community, communication, workflow"
confidence: "low"
source: "manual (external communications workflow)"
packages/squad-sdk/templates/skills/humanizer/SKILL.md:6
- These skill files are generated mirrors:
scripts/sync-skill-templates.mjscopies.squad/skills/humanizer/SKILL.mdinto both package template trees. That canonical source still contains the PAO/RFC text, so running the sync will overwrite this neutralized copy; update the canonical skill and regenerate the mirrors instead.
source: "manual (external communications workflow)"
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
@copilot want to make sure you see no concerns with this and that we're moving in a direction in which our CI and our rules aren't reliant - at all - on the structure of the squad being used to work on Squad. |
Contributor
The direction is right, but I can’t say there are no concerns yet. The current routing scorer drops meaningful short terms such as |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
🔒 Security Review🔒 Security review: 27 error(s).
Automated security review — informational only. |
bradygaster
changed the title
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
Security follow-up:
The updated scanner reports zero findings across |
Collaborator
Author
|
@copilot can I get one more review on the update, and on this as a step in the direction of the product being decoupled from the squad. |
Contributor
The product/team-state boundary is now materially stronger: canonical skills, sync inputs, build behavior, routing fixtures, Docker context, and changeset policy are decoupled from live |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
Follow-up on the latest Copilot review:
|
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
tamirdresher
left a comment
tamirdresher
left a comment
Collaborator
There was a problem hiding this comment.
I like the direction here. I found three things I'd fix before merging.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
tamirdresher
approved these changes
Sep 10, 2026
tamirdresher
added a commit
to tamirdresher/squad
that referenced
this pull request
Oct 2, 2026
…All artifact - test/e2e-runbook-hygiene.test.ts: deliberately deleted from dev in PR github#2015 (Isolate Squad product assets from team state) because it read live .squad state. It survived only on main (added at v0.13.0, no promotion since), so the dev-vs-main merge resurrected it. Removing it to match dev's documented, traceable intent — not a blanket ours/theirs choice. - test/template-sync.test.ts: the 3-way merge auto-combined non-overlapping hunks from dev (simplified describe block, no beforeAll) and main (legacy describe-scoped beforeAll retained for historical defence-in-depth) into semantically broken code referencing an unimported beforeAll. Replaced with dev's complete, authoritative file content (byte-identical to origin/dev). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Establishes a hard boundary between Squad product assets and this repository's live
.squad/team state. Deleting or re-casting the working team no longer changes package templates, build inputs, required changelog policy, or test outcomes.Why
The repository is preparing for a full team re-cast. Live team names, skills, routing data, and historical examples had become implicit product inputs, which made re-casting risky and allowed stale team-derived files to remain in published template trees.
How
.squad-templates/skills/the complete product-owned canonical skill set and synchronizes exact file sets into root, CLI, and SDK mirrors.prebuild; the mutating maintenance command now requires explicit--syncopt-in..squad/state from Docker build context and product changeset policy.Primaryrouting headers, and Lead-then-Architect fallback.squad.config.tscast snapshot and stale destination-only skill artifacts.npx changeset add/.changeset/*.md, directCHANGELOG.mdentry for maintainers, orskip-changeloglabel for no user-facing changes)PR Readiness Checklist
Branch & Commit
dev(notmain)dev(git fetch upstream && git rebase upstream/dev)git diff --cached --stat)Build & Test
npm run buildpassesnpm testpasses (all tests green)npm run lintpasses (type check clean)npm run lint:eslintpassesThe complete CI suite passes, including tests, policy gates, SDK exports, sample builds, strict gh-aw compilation, workflow/template linting, architectural review, file-leakage checks, and security review. Dependency-free validation also confirms all 54 canonical skill files and their exact mirror file sets, canonical/legacy/preset routing formats, explicit sync-command guards, Docker exclusion, zero net
.squad/changes, and a clean full-PR security scan.Changeset
npx changeset add(ifpackages/squad-sdk/src/orpackages/squad-cli/src/changed)CHANGELOG.mdentry (maintainers only - write-protected for external contributors)skip-changeloglabel applied (if no user-facing changes)The changeset covers the CLI and SDK template, routing, and build-isolation updates.
Docs
Exports
Breaking Changes
None.
Waivers
None.