[bradygaster]

Summary

• declare the complete transitive shared/*.mjs resource set on the dispatcher so the documented dispatcher-first gh aw add command installs every worker runtime guard
• remove dispatch-workflow authority from the advisory reviewer
• require live write, maintain, or admin permission before deterministic lifecycle repair can write terminal state
• update the published gh-aw setup guide and enlistment skill mirrors with runtime-module verification
• add clean-install source/lock closure coverage with per-module deletion mutations

Root cause

With gh-aw v0.89.2, installing squad.md first recursively installs the dependent workflows but copies only the root workflow's declared resources. The explicit worker entries are then skipped as duplicates, so resources declared only by those workers never reach the target repository even though strict compilation succeeds.

Validation

• remote gh aw add of all six workflows from immutable commit 9cc0e91daa86a039d7351bb4d1e76a5470fa244a
• all four runtime modules present in the clean target
• gh aw compile --strict: 6/6 successful
• compiled-expression scan: clean
• compiled reviewer dispatch handler: absent
• compiled lifecycle collaborator-permission gate: present
• clean-install closure and mutation coverage: passing
• focused gh-aw quality/reviewer/enlistment/retro/worker suites: 623 passing assertions across the executed suites
• npm run build: passing
• actionlint produces the same seven pre-existing generated-output findings as origin/dev; no new actionlint class or count

Follow-up to merged #2037.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit c6024e5

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	9 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	Changeset file found
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	All 1 Copilot thread(s) resolved
✅	CI passing	All checks passing

Files Changed (14 files, +354 −54)

File	+/−
.changeset/gh-aw-runtime-resource-closure.md	+8 −0
.squad-templates/skills/gh-aw-enlistment/SKILL.md	+10 −0
docs/src/content/docs/guide/gh-aw.md	+50 −16
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md	+10 −0
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md	+10 −0
templates/skills/gh-aw-enlistment/SKILL.md	+10 −0
test/gh-aw-enlistment-skill.test.ts	+27 −0
test/gh-aw-lifecycle-upsert.test.ts	+53 −1
test/gh-aw-quality.test.ts	+143 −5
test/gh-aw-retro-workflow.test.ts	+2 −1
test/gh-aw-review-workflow.test.ts	+6 −7
workflows/shared/squad.md	+21 −0
workflows/squad-review.md	+1 −24
workflows/squad.md	+3 −0

Total: +354 −54

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🟠 Impact Analysis — PR #2038

Risk tier: 🟠 HIGH

📊 Summary

Metric	Count
Files changed	14
Files added	1
Files modified	13
Files deleted	0
Modules touched	6

🎯 Risk Factors

• 14 files changed (6-20 → MEDIUM)
• 6 modules touched (5-8 → HIGH)

📦 Modules Affected

docs (1 file)

• docs/src/content/docs/guide/gh-aw.md

root (5 files)

• .changeset/gh-aw-runtime-resource-closure.md
• templates/skills/gh-aw-enlistment/SKILL.md
• workflows/shared/squad.md
• workflows/squad-review.md
• workflows/squad.md

squad-cli (1 file)

• packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md

squad-sdk (1 file)

• packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md

templates (1 file)

• .squad-templates/skills/gh-aw-enlistment/SKILL.md

tests (5 files)

• test/gh-aw-enlistment-skill.test.ts
• test/gh-aw-lifecycle-upsert.test.ts
• test/gh-aw-quality.test.ts
• test/gh-aw-retro-workflow.test.ts
• test/gh-aw-review-workflow.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved documentation verification gaps and missing execution-level authorization coverage remain.

Get a fresh assessment by requesting another Copilot review.

Review tier: Lite
Findings: 1

Open findings (1)

• Runtime-module verification does not fail the setup · New

What changed in this PR

This PR hardens gh-aw runtime installation and lifecycle authorization.

Changes:

• Declares all shared runtime modules on the dispatcher.
• Removes reviewer dispatch authority and gates lifecycle repair by repository permissions.
• Updates tests, documentation, skill mirrors, and the package changeset.

Open review findings:

• docs/src/content/docs/guide/gh-aw.md:65 — nit (3 votes): module checks are not fail-fast; the same issue appears at line 257.
• docs/src/content/docs/guide/gh-aw.md:182 — nit (1 vote): upgrade instructions refresh only one runtime module.
• test/gh-aw-quality.test.ts:499 — moderate (1 vote): authorization tests lack execution-level write-suppression coverage.
• workflows/shared/squad.md:358 — moderate (1 vote): permission-gate coverage is text-only.

File	Description
workflows/​squad.md	Adds shared runtime resources.
workflows/​squad-review.md	Removes reviewer dispatch authority.
workflows/​shared/​squad.md	Gates lifecycle repair permissions.
test/​gh-aw-review-workflow.test.ts	Tests reviewer restrictions.
test/​gh-aw-retro-workflow.test.ts	Updates retro integration assertions.
test/​gh-aw-quality.test.ts	Adds authorization and closure tests.
test/​gh-aw-enlistment-skill.test.ts	Verifies runtime-module guidance.
templates/​skills/​gh-aw-enlistment/​SKILL.md	Updates template guidance.
packages/​squad-sdk/​templates/​skills/​gh-aw-enlistment/​SKILL.md	Updates SDK guidance.
packages/​squad-cli/​templates/​skills/​gh-aw-enlistment/​SKILL.md	Updates CLI guidance.
docs/​src/​content/​docs/​guide/​gh-aw.md	Documents runtime resources and checks.
.squad-templates/​skills/​gh-aw-enlistment/​SKILL.md	Updates canonical skill guidance.
.changeset/​gh-aw-runtime-resource-closure.md	Adds the package changeset.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.