Repository navigation
fix(gh-aw): enforce independent Squad review and gate epic relay - #2096
Merged
Merged
Conversation
Contributor
🏗️ Architectural Review
Automated architectural review — informational only. |
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 2 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | No Copilot review threads |
| ❌ | CI passing | 1 check(s) failing: test |
Files Changed (25 files, +1230 −148)
| File | +/− |
|---|---|
.github/agents.md |
+3 −3 |
.github/workflows/squad-ci.yml |
+1 −1 |
docs/src/content/docs/guide/gh-aw.md |
+104 −27 |
scripts/gh-aw-hosted-e2e.mjs |
+4 −4 |
test/gh-aw-hosted-e2e.test.ts |
+1 −1 |
test/gh-aw-implement-workflow.test.ts |
+63 −5 |
test/gh-aw-quality.test.ts |
+13 −2 |
test/gh-aw-review-guard.test.ts |
+371 −0 |
test/gh-aw-review-workflow.test.ts |
+63 −10 |
workflows/README.md |
+1 −1 |
workflows/aw.yml |
+2 −0 |
workflows/package/squad-bootstrap.md |
+1 −1 |
workflows/package/squad-deps-worker.md |
+3 −11 |
workflows/package/squad-implement-worker.md |
+54 −11 |
workflows/package/squad-retro.md |
+3 −11 |
workflows/package/squad-review.md |
+102 −10 |
workflows/package/squad.md |
+3 −11 |
workflows/shared/squad-install-verifier.mjs |
+2 −1 |
workflows/shared/squad-review-guard.mjs |
+253 −0 |
workflows/shared/squad.md |
+9 −11 |
workflows/skills/gh-aw-enlistment/SKILL.md |
+2 −2 |
workflows/squad-bootstrap.md |
+1 −1 |
workflows/squad-implement-worker.md |
+52 −0 |
workflows/squad-review.md |
+102 −15 |
workflows/squad-workflows.manifest.json |
+17 −9 |
Total: +1230 −148
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
8 tasks
Contributor
🟠 Impact Analysis — PR #2096Risk tier: 🟠 HIGH 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (2 files)
docs (1 file)
root (16 files)
scripts (1 file)
tests (5 files)
This report is generated automatically for every PR. See #733 for details. |
Contributor
There was a problem hiding this comment.
Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.
Note
This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.
This was referenced Sep 28, 2026
bradygaster
force-pushed
the
bradygaster-agentic-review-enforcement
branch
from
September 29, 2026 00:02
d7e498d to
b282987
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Enforces independent logical Squad review with the literal required check
Squad Review / review, and blocks epic continuation without a clearing verdict for the merged PR's reviewed head SHA. Working as agentic-workflows-dev (Agentic Workflows Engineer). Independent focused rereview: APPROVE after a separately owned CI-cardinality correction. Final CI conflict was also independently resolved by Release Engineer, respecting reviewer lockout.Why
Closes #1734. Implements the accepted enforcement-surface decision from #1729/#1828 without distinct GitHub accounts or Apps per agent and without depending on #2074/#2069. #1828 remains open for rejected-author revision lockout beyond independent review.
How
.squad-review.jsonbinds accountable author/reviewer canonical IDs to the committed base casting registry; equal, aliased, missing, inactive, or malformed identities fail closed.COMMENTreviews because GitHub forbids same-account self-approval/self-rejection. The check enforcesREQUEST_CHANGES; native human approval remains separate.inlined-imports: true; the always-running final job has the exact PR-only check name. Manual runs publishSquad Review / manual, never clearing evidence. Output and final gates re-fetch the live head. Empty historicalpull_requestsrun links use the fixed PR-number run title plus repository/path/event/head binding; supplied links must still match.Final restack: directly onto
dev7254141, after #2093 merged. Preserves the eight-workflow command-router topology, #2092 dependency CHANGELOG protection, #2095 genesis behavior, and #2094 repo-health shadow harness. Combined package: 8 workflows / 17 runtime resources / 1 skill / 26 ownership entries. Head:b2829873f9958b3c41eb5fd1f619f7a3f027ecde. Explicit lease-protected push; no Ralph heartbeat changes.25-file scope justification:
workflows/squad-review.md,workflows/squad-implement-worker.md,workflows/shared/squad-review-guard.mjstest/gh-aw-review-guard.test.ts,test/gh-aw-review-workflow.test.ts,test/gh-aw-implement-workflow.test.tsworkflows/shared/squad-install-verifier.mjs,workflows/aw.yml,workflows/squad-workflows.manifest.json,workflows/squad-bootstrap.mdscripts/gh-aw-hosted-e2e.mjs,test/gh-aw-hosted-e2e.test.ts,.github/workflows/squad-ci.yml,test/gh-aw-quality.test.tsworkflows/shared/squad.mdworkflows/package/squad.md,workflows/package/squad-bootstrap.md,workflows/package/squad-deps-worker.md,workflows/package/squad-implement-worker.md,workflows/package/squad-retro.md,workflows/package/squad-review.md.github/agents.md,docs/src/content/docs/guide/gh-aw.md,workflows/README.md,workflows/skills/gh-aw-enlistment/SKILL.mdNo SDK/CLI product source changed; no changeset required. This repository distributes rather than self-installs these workflows: emitted locks were compiled and inspected in isolated consumer layouts, not added as new repository workflows.
Final-restack validation:
always()final gate,[agent, safe_outputs]dependencies, awaited producer/final guards, and relay guards in both agent and safe-output jobs.squad-retroreferences to undeclaredgithub.event.inputs.issue_number. Reproduced on exactdev7254141; not introduced or suppressed here. Baseline also exhibits the multiline-if defect this PR fixes.npm run build,npm run lint, changed-test ESLint, package integrity, prompt interpolation (25 files), whitespace/stat/deletion checks pass. Build-version side effects restored; exactly 25 changed files, no deletions.Compiler safe-update review: clean consumer compilation reports existing
SQUAD_GITHUB_APP_PRIVATE_KEY,SQUAD_GITHUB_TOKEN, andbradygaster/squad/.github/actions/squad-initfrom the unchanged shared authentication/bootstrap contract. No new/removed secrets/actions or redirect changes are introduced by this PR. These remain the existing optional GitHub authentication and pinned Squad initialization surfaces, not new destinations. Fresh-layout approval warnings and absent-remote schedule warnings are disclosed; no production approval or credential configuration changed.Brady-only rollout: no rulesets changed and no live soak claimed. Install/merge the complete bundle, observe the actual PR check and its App ID, then require literal
Squad Review / reviewondevonly after the #1734 advisory-soak evidence gate; promote tomainafter soak. Keep native human approval independently required. Human/Copilot PRs also need committed logical attribution; forks are unsupported. Do not require the manual job or guess an App ID.PR Readiness Checklist
Branch & Commit
dev(notmain)devafter fix(gh-aw): fail closed on rejected /squad commands #2093 mergedgit diff --cached --stat)Build & Test
npm run buildpassesnpm testpasses (all tests green) — local full-repository suite not claimed; all 1,519 targeted tests pass and current-head CI is required before mergenpm run lintpasses (type check clean)npm run lint:eslintpasses — changed-test ESLint passes; whole-repository ESLint not claimedChangeset
npx changeset add— N/A; infrastructure onlyCHANGELOG.mdentry — N/Askip-changeloglabel applied — not usedDocs
Exports
Breaking Changes
Installing the new bundle changes review/relay from advisory to fail-closed enforcement. Existing PRs need
.squad-review.jsonwith distinct canonical active IDs; manual review and legacy head-marker-only reviews do not satisfy the gate. Ruleset activation is a separate administrator step after soak.Waivers
No test/build/security waiver granted or implied. The unchanged retro-only actionlint baseline is disclosed rather than hidden or relaxed. Changeset/export exemptions are structural (no product package source changes). Merge remains conditional on required current-head checks and GitHub protections.