[bradygaster]

Summary

• replace the oversized single bootstrap safe-output string with a deterministic fixed-field Base64 envelope
• verify chunk order, bounds, encoding, byte length, and SHA-256 before parsing or materializing the shared Cast/research payload
• add realistic 34,843-byte regression coverage plus fail-closed corruption and boundary mutations
• add the required CLI/SDK patch changeset

Refs #2009.

Transport contract

• decoded chunk size: 6,000 bytes
• fixed chunk slots: 16 (payload_chunk_00 through payload_chunk_15)
• maximum total payload: 96,000 UTF-8 bytes
• chunk field format: NN:<canonical-base64>
• maximum encoded chunk field: 8,003 bytes, below gh-aw's 10,240-byte per-string limit
• integrity metadata: canonical byte length, lowercase SHA-256, encoding, and chunk count

The model still produces one validated payload containing both Cast and research content. Chunking occurs only after semantic validation, so the two outputs cannot drift.

Validation

• bootstrap + gh-aw quality tests: 215 passed
• bootstrap workflow regression suite: 11 passed
• changed test ESLint: passed
• TypeScript lint/type-check: passed
• npm run build: passed
• strict live-source compile twice: passed with identical lock SHA-256 84fabe365527e7f99da13b76407fed6023829c477d94be88839ca4fecc4d0471
• generated safe-output schema: 20 string inputs, 4 required metadata fields, 16 optional chunks, no legacy payload; serialized config is 2,277 bytes
• escaped-expression scan: clean
• actionlint baseline/current comparison: both clean
• full suite: 9,051 passed, 23 skipped, 47 todo; 18 unrelated pre-existing/environment-sensitive failures remain outside this change

Design note

repo-memory was evaluated and rejected for this same-run transport because it adds a persistent branch mutation, artifact download choreography, stale-memory exposure, cleanup requirements, and race/idempotency complexity. Fixed safe-output chunks are the smallest bounded change and are validated directly by gh-aw's per-string guard.

[github-actions]

🟡 Impact Analysis — PR #2043

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	5
Files added	1
Files modified	4
Files deleted	0
Modules touched	3

🎯 Risk Factors

• 5 files changed (≤5 → LOW)
• 3 modules touched (2-4 → MEDIUM)

📦 Modules Affected

docs (1 file)

• docs/src/content/docs/guide/gh-aw.md

root (3 files)

• .changeset/fix-bootstrap-payload-transport.md
• workflows/shared/squad-bootstrap-validator.mjs
• workflows/squad-bootstrap.md

tests (1 file)

• test/gh-aw-bootstrap-workflow.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 9f9f3d2

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	4 commits — consider squashing before review
✅	Not in draft	Ready for review
❌	Branch up to date	dev is 1 commit(s) ahead — rebase recommended
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	Changeset file found
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	All 1 Copilot thread(s) resolved
✅	CI passing	All checks passing

Files Changed (5 files, +378 −10)

File	+/−
.changeset/fix-bootstrap-payload-transport.md	+7 −0
docs/src/content/docs/guide/gh-aw.md	+9 −0
test/gh-aw-bootstrap-workflow.test.ts	+152 −0
workflows/shared/squad-bootstrap-validator.mjs	+149 −1
workflows/squad-bootstrap.md	+61 −9

Total: +378 −10

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[Copilot]

Copilot review overview

🟡 Changes recommended

Three unresolved findings remain, including one critical integrity-pin test gap.

Get a fresh assessment by requesting another Copilot review.

Review tier: Lite
Findings: 1

Open findings (1)

• Add a test for the pinned bootstrap validator digest · New

What changed in this PR

This PR replaces the oversized bootstrap payload with bounded, integrity-checked Base64 chunks.

Changes:

• Adds deterministic chunk encoding and reconstruction.
• Updates workflow safe outputs and validation.
• Adds regression coverage and a CLI/SDK changeset.

File	Summary and final review comment
workflows/​squad-bootstrap.md	Defines chunked transport and materialization. Critical (1 vote): add a test verifying the validator’s SHA-256 integrity pin.
workflows/​shared/​squad-bootstrap-validator.mjs	Implements encoding and validation. Moderate (1 vote): add multibyte and boundary-spanning UTF-8 coverage.
test/​gh-aw-bootstrap-workflow.test.ts	Adds transport and corruption coverage. Moderate (1 vote): parse the emitted schema and verify chunk, metadata, and legacy-input contracts.
.changeset/​fix-bootstrap-payload-transport.md	Records the required package patch releases.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.