[bradygaster]

Summary

• preserves the copy/paste GitHub.com Agents-tab pause/resume journey from pinned installation through the human installation and Cast merge gates
• reconciles the journey with the native review authority merged in fix(gh-aw): replace reviewer App with native review authority #2109 at 6ec06cc79230cf71d55b484457e8f11190e20a49
• removes the obsolete dedicated reviewer App, credentials, environment, token minting, custom Checks publisher, attestation, and integration-binding prerequisites
• records the reopened fix(gh-aw): make Squad Review safe outputs first-install safe #2103 manifest-integrity blocker without claiming fresh hosted success

Working as docs-devrel (Documentation & DevRel Engineer).

Current trust and evidence contract

• The installation PR remains an explicit human trust boundary; its PR-controlled workflow, comments, reviews, and same-name checks are not trusted authority.
• The first trusted automatic canary is the post-merge Cast PR reviewed by the base-controlled pull_request_target workflow with checkout: false and API-only inspection.
• Built-in gh-aw safe outputs publish a native COMMENT review carrying logical COMMENT or REQUEST_CHANGES; the reviewer never has APPROVE authority.
• The final native job is review, producing Squad Review / review. It uses if: always() and fails closed unless the agent, safe-output processing, and deterministic current-head verdict gate all succeed.
• The relay binds the exact trusted automatic repository, PR, base SHA, head SHA, workflow path, immutable workflow/base SHA, run ID, run attempt, native review job, and verdict. Missing, duplicate, stale, replayed, or mismatched evidence fails closed.
• /squad review is rerun guidance only; it does not dispatch reviewer authority.
• A context-only Squad Review / review required status is advisory because the shared GitHub Actions App and same workflow/job name do not prove workflow source. Authoritative merge enforcement requires a source-bound required-workflow or equivalent policy; otherwise retain an independent human approving review.
• No reviewer PAT, GitHub App, App ID/slug/owner, private key, secret, token, environment, custom Checks publisher, attestation schema, integration binding, hosted attestor, or external service is required. The obsolete dedicated reviewer environment has been deleted.

Evidence state

• Historical reviewed/merged source remains documented at a6385a7dfddc03cf797cadc0d3ccc095ce686b04 / 29e69f53abb7beb2fb8b8c4db55fbbeb4bf69f1a; this is not hosted-success evidence.
• Earlier hosted runs at da7861de22483b83c0321ad534954e637a11dbdf and 60f2c452f6284d442a5932843f3ee64bf86fb928 remain explicitly preserved as failed evidence.
• fix(gh-aw): replace reviewer App with native review authority #2109 merged the corrected native-review implementation at 6ec06cc79230cf71d55b484457e8f11190e20a49.
• fix(gh-aw): make Squad Review safe outputs first-install safe #2103 is reopened: fresh backend/frontend/queue installation preparation pinned to that SHA stopped before any fixture mutation because six normalized compiled lock digests in the manifest were stale. Example: squad-review.lock.yml expected 944dd438…; strict compilation produced c8a3666e….
• No fresh fixture branch, PR, or run was created or updated; existing fixture artifacts remain untouched. This PR does not claim fresh hosted success.

Validation

Passed on the reconciled branch:

• changed-file markdownlint-cli2 --no-globs
• changed-file cspell
• git diff --check
• npm run build
• npm run docs:build — 713 pages built; Pagefind indexed 710 pages
• npm test -- --run test/gh-aw-enlistment-skill.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-review-guard.test.ts — 166 tests

The docs build retains 31 pre-existing TypeDoc warnings and completes with zero errors.

Pending before ready

• Correct the six stale normalized compiled-lock manifest digests tracked by reopened fix(gh-aw): make Squad Review safe outputs first-install safe #2103 and merge the fix at a new immutable SHA
• Run and capture the backend clean-bootstrap fixture at that final merged SHA
• Run and capture the frontend full-lifecycle fixture at that final merged SHA
• Run and capture the queue-worker negative/recovery fixture at that final merged SHA
• Record the Cast canary's exact repository/PR/base/head/workflow/run/attempt/native-job/verdict binding
• Replace hosted-success placeholders only after all three reruns succeed

This PR intentionally remains draft. #2074 and #2069 remain orthogonal and outside this work.

Closes #2048

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit b42ad49

PR Scope: 🔧 Infrastructure

⚠️ 4 item(s) to address before review

Status	Check	Details
❌	Single commit	4 commits — consider squashing before review
❌	Not in draft	PR is still in draft — mark as ready for review when done
❌	Branch up to date	dev is 1 commit(s) ahead — rebase recommended
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (2 files, +363 −5)

File	+/−
.github/agents.md	+14 −2
docs/src/content/docs/guide/gh-aw.md	+349 −3

Total: +363 −5

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🟡 Impact Analysis — PR #2100

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	2
Files added	0
Files modified	2
Files deleted	0
Modules touched	2

🎯 Risk Factors

• 2 files changed (≤5 → LOW)
• 2 modules touched (2-4 → MEDIUM)

📦 Modules Affected

ci-workflows (1 file)

• .github/agents.md

docs (1 file)

• docs/src/content/docs/guide/gh-aw.md

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

👋 Friendly nudge — this PR has had no activity for 10 days.

What needs attention:

• 📝 Still in draft — mark as "Ready for review" when you're done, or close if abandoned.
• ⬇️ 93 commits behind dev. Rebase to pick up latest changes.

---

If this PR is abandoned, please close it. If it's blocked on something external, leave a comment so the team knows.
This is an automated check that runs on weekdays. It won't nudge the same PR more than once per week.

[github-actions]

👋 Friendly nudge — this PR has had no activity for 7 days.

What needs attention:

• 📝 Still in draft — mark as "Ready for review" when you're done, or close if abandoned.
• ⬇️ 118 commits behind dev. Rebase to pick up latest changes.

---

If this PR is abandoned, please close it. If it's blocked on something external, leave a comment so the team knows.
This is an automated check that runs on weekdays. It won't nudge the same PR more than once per week.

[github-actions]

👋 Friendly nudge — this PR has had no activity for 7 days.

What needs attention:

• 📝 Still in draft — mark as "Ready for review" when you're done, or close if abandoned.
• ⬇️ 162 commits behind dev. Rebase to pick up latest changes.

---

If this PR is abandoned, please close it. If it's blocked on something external, leave a comment so the team knows.
This is an automated check that runs on weekdays. It won't nudge the same PR more than once per week.

[github-actions]

👋 Friendly nudge — this PR has had no activity for 7 days.

What needs attention:

• 📝 Still in draft — mark as "Ready for review" when you're done, or close if abandoned.
• ⬇️ 177 commits behind dev. Rebase to pick up latest changes.

---

If this PR is abandoned, please close it. If it's blocked on something external, leave a comment so the team knows.
This is an automated check that runs on weekdays. It won't nudge the same PR more than once per week.