[bradygaster]

Summary

Adds the dedicated seventh Agentic Workflow that automatically bootstraps Squad after the installation workflow lands on the default branch.

• analyzes the repository under read-only permissions and produces one shared, validated Cast/research payload
• materializes at most one deterministic draft Cast PR and one [Research Proposals] Agent-discovered repo opportunities issue
• injects the real Cast PR URL before issue creation, with exact validation before both writes
• supports safe partial recovery, pagination, durable deduplication, human opt-out, and fail-closed ambiguity handling
• prevents the bot-created bootstrap issue body from dispatching while preserving human /squad issue comments
• updates the canonical and mirrored enlistment guidance, published docs, CI workflow counts, tests, and changeset from six workflows to seven

Dependency and landing order

#2040 supplied the dispatcher security gate and current workflow source required by this feature. It merged into dev first at 5521c46d. This PR was then restacked non-destructively by merging updated dev, and now targets dev directly. The final diff contains only the automatic bootstrap feature.

Security and output design

The analysis job has read-only repository permissions plus copilot-requests: write. GitHub mutations are isolated to the typed materializer. Repository content is treated only as untrusted evidence: branch, titles, allowed Cast paths, output shape, commands, and deduplication keys are fixed and validator-enforced.

The issue and PR come from the same payload. The writer creates or resolves squad/bootstrap-cast, obtains the real deterministic PR URL, replaces {{CAST_PR_URL}}, validates again in resolved-link mode, and only then creates or repairs the issue. Closed-unmerged PRs are treated as human opt-out; duplicate or ambiguous states fail closed.

Validation

• post-restack targeted gh-aw suite: 412 passed
• post-restack reviewer/bootstrap contract tests: 20 passed
• npm run lint: passed
• npm run build: passed
• gh aw compile --strict --approve: seven workflows compiled
• gh aw compile --strict: seven workflows compiled; only the existing dispatcher slash-command/bot warning remains
• emitted-expression scan: no escaped GitHub expressions
• actionlint comparison: bootstrap findings are limited to gh-aw generated/custom constructs already present in compiled workflows (ubuntu-slim, copilot-requests, and concurrency queue)
• clean temp installation exercise: seven source/lock pairs and five transitive runtime modules present
• final GitHub suite against dev: all applicable checks passed, including full test, docs quality, policy gates, strict compile, SDK exports, samples, changeset drift, readiness, and prompt-size checks
• final scope: exactly 20 feature files, no deletions

Demo

1. Install gh-aw and the seven Squad workflows, then merge the installation PR.
2. The Bootstrap workflow runs from the default-branch source/lock landing.
3. Review the draft [squad] Cast your Squad PR and the linked research-proposals issue.
4. Merge the Cast PR.
5. From the issue, run one or more focused /squad research ... commands, then /squad triage, /squad plan, and /squad activate.
6. Review the generated assignable implementation issues; the demo ends at the actionable backlog.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 5deda1a

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	3 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	Changeset file found
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (20 files, +1632 −131)

File	+/−
.changeset/automatic-squad-bootstrap.md	+8 −0
.github/agents.md	+7 −4
.github/workflows/squad-ci.yml	+20 −4
.squad-templates/skills/gh-aw-enlistment/SKILL.md	+28 −21
README.md	+3 −2
docs/src/content/docs/guide/gh-aw.md	+42 −27
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md	+28 −21
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md	+28 −21
templates/skills/gh-aw-enlistment/SKILL.md	+28 −21
test/gh-aw-bootstrap-workflow.test.ts	+458 −0
test/gh-aw-command-parse.test.ts	+35 −0
test/gh-aw-enlistment-skill.test.ts	+8 −4
test/gh-aw-implement-workflow.test.ts	+1 −0
test/gh-aw-quality.test.ts	+4 −1
test/gh-aw-review-workflow.test.ts	+6 −2
test/gh-aw-security-scan.test.ts	+3 −2
workflows/shared/squad-bootstrap-validator.mjs	+378 −0
workflows/shared/squad.md	+2 −1
workflows/squad-bootstrap.md	+539 −0
workflows/squad.md	+6 −0

Total: +1632 −131

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.