[bradygaster]

Implements #1824

Working as agentic-workflows-dev (Agentic Workflows Engineer).

Summary

• centralize issue-body, conversation-comment, and workflow_dispatch parsing in one deterministic runtime module
• keep the existing start-position slash-command path, and add a complementary workflow for commands found later in bodies/comments or malformed prefixes
• reject unknown commands and malformed arguments with a comment quoting the rejected command, then fail the responsible workflow run
• preserve no-invocation events as side-effect-free non-events and keep valid commands/relays working

Validation

• npx vitest run test/gh-aw-command-parse.test.ts test/gh-aw-quality.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-bootstrap-workflow.test.ts test/gh-aw-enlistment-skill.test.ts test/gh-aw-hosted-e2e.test.ts test/gh-aw-retro-workflow.test.ts test/gh-aw-security-scan.test.ts — 654 passed
• npx eslint test/gh-aw-command-parse.test.ts test/gh-aw-quality.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-enlistment-skill.test.ts test/gh-aw-hosted-e2e.test.ts test/gh-aw-implement-workflow.test.ts test/gh-aw-security-scan.test.ts scripts/gh-aw-hosted-e2e.mjs — passed
• npm run gh-aw:integrity:check — passed
• SKIP_BUILD_BUMP=1 npm run build — passed
• clean native package install plus strict compilation of all eight workflows — passed
• compiled artifact inspection confirmed the shared committed parser, start-path rejection guard, complementary issue/comment trigger, explanatory rejection comment, core.setFailed, trusted workflow-SHA checkout, and dispatch to squad.lock.yml

Compile security review

The clean installed-layout compile reported the package's existing restricted secrets (SQUAD_GITHUB_APP_PRIVATE_KEY, SQUAD_GITHUB_TOKEN) and existing pinned bradygaster/squad/.github/actions/squad-init action because the evidence workspace had no prior gh-aw manifest. This PR adds or changes none of those entries; they remain SHA-pinned/unchanged.

No changeset is required: this changes gh-aw workflow/runtime resources, package validation, install guidance, and tests—not packages/squad-cli/src/ or packages/squad-sdk/src/.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit ae29f0a

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	4 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (19 files, +882 −925)

File	+/−
.github/workflows/squad-ci.yml	+5 −5
scripts/gh-aw-hosted-e2e.mjs	+4 −4
test/gh-aw-command-parse.test.ts	+194 −540
test/gh-aw-hosted-e2e.test.ts	+2 −2
test/gh-aw-quality.test.ts	+35 −45
test/gh-aw-retro-workflow.test.ts	+1 −1
test/gh-aw-review-workflow.test.ts	+2 −2
test/gh-aw-security-scan.test.ts	+1 −1
workflows/aw.yml	+4 −0
workflows/package/squad-bootstrap.md	+1 −1
workflows/package/squad-command-router.md	+102 −0
workflows/package/squad.md	+84 −157
workflows/shared/squad-command-contract.mjs	+235 −0
workflows/shared/squad-install-verifier.mjs	+7 −2
workflows/skills/gh-aw-enlistment/SKILL.md	+3 −3
workflows/squad-bootstrap.md	+1 −1
workflows/squad-command-router.md	+97 −0
workflows/squad-workflows.manifest.json	+19 −4
workflows/squad.md	+85 −157

Total: +882 −925

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🟡 Impact Analysis — PR #2093

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	19
Files added	3
Files modified	16
Files deleted	0
Modules touched	4

🎯 Risk Factors

• 19 files changed (6-20 → MEDIUM)
• 4 modules touched (2-4 → MEDIUM)

📦 Modules Affected

ci-workflows (1 file)

• .github/workflows/squad-ci.yml

root (11 files)

• workflows/aw.yml
• workflows/package/squad-bootstrap.md
• workflows/package/squad-command-router.md
• workflows/package/squad.md
• workflows/shared/squad-command-contract.mjs
• workflows/shared/squad-install-verifier.mjs
• workflows/skills/gh-aw-enlistment/SKILL.md
• workflows/squad-bootstrap.md
• workflows/squad-command-router.md
• workflows/squad-workflows.manifest.json
• workflows/squad.md

scripts (1 file)

• scripts/gh-aw-hosted-e2e.mjs

tests (6 files)

• test/gh-aw-command-parse.test.ts
• test/gh-aw-hosted-e2e.test.ts
• test/gh-aw-quality.test.ts
• test/gh-aw-retro-workflow.test.ts
• test/gh-aw-review-workflow.test.ts
• test/gh-aw-security-scan.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🏗️ Architectural Review

Authoritative evidence: base-controlled pull_request_target reporter.

⚠️ Architectural review: 1 info.

Severity	Category	Finding	Files
ℹ️ info	template-sync	Template files changed in .github/workflows/ but not in other template locations. If these templates should stay in sync, consider updating the others too.	Changed: .github/workflows/, Unchanged: templates/, .squad-templates/, packages/squad-cli/templates/

---

Automated architectural review — informational only.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.