[bradygaster]

Summary

• prefer the review guard committed on the PR base for established installations
• fall back to the immutable github.workflow_sha guard only when the base path is absent on a first-install PR
• preserve fail-closed behavior when an established base guard exists but is invalid
• execute the emitted safe_outputs loader against both hosted fixture head SHAs and regenerate the packaged workflow manifest hash

Hosted reproduction evidence

• Backend install PR: https://github.com/octodemo/zava-social-backend-template-20260928092124/pull/1
• Backend failed run: https://github.com/octodemo/zava-social-backend-template-20260928092124/actions/runs/36502122445
• Backend head: edd6fbf0f84334ff086ed2bc8bbfed5503fdd56f
• Frontend install PR: https://github.com/octodemo/zava-social-frontend-template-20260928092124/pull/1
• Frontend failed run: https://github.com/octodemo/zava-social-frontend-template-20260928092124/actions/runs/36502078635
• Frontend head: 9a898b5182ca432b62bef26dbf1f9022dd1d256b
• Broken source pin: bradygaster@da7861d

Validation

• npm test -- --run test/gh-aw-review-workflow.test.ts test/gh-aw-review-guard.test.ts test/gh-aw-quality.test.ts — 313 passed
• canonical strict compile — 8/8 workflows
• packaged strict compile — 8/8 workflows
• npm run gh-aw:integrity:check — passed
• npm run build — passed
• npm run lint — passed
• npm run lint:eslint -- --quiet — passed
• isolated full suite — 9,657 passed; four existing external-state tests fail independently of this diff (test/cli/cast.test.ts, two cases in test/cli/copilot.test.ts, test/cli/rc.test.ts)

Closes #2103

[github-actions]

🟡 Impact Analysis — PR #2104

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	4
Files added	0
Files modified	4
Files deleted	0
Modules touched	2

🎯 Risk Factors

• 4 files changed (≤5 → LOW)
• 2 modules touched (2-4 → MEDIUM)

📦 Modules Affected

root (3 files)

• workflows/package/squad-review.md
• workflows/squad-review.md
• workflows/squad-workflows.manifest.json

tests (1 file)

• test/gh-aw-review-workflow.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit fa940f4

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	0 active Copilot thread(s) resolved (1 outdated skipped)
✅	CI passing	All checks passing

Files Changed (4 files, +232 −15)

File	+/−
test/gh-aw-review-workflow.test.ts	+133 −2
workflows/package/squad-review.md	+49 −6
workflows/squad-review.md	+49 −6
workflows/squad-workflows.manifest.json	+1 −1

Total: +232 −15

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[Copilot]

Copilot review overview

🟡 Changes recommended

The fallback does not distinguish a genuine first install from an established installation with a missing base guard.

Review effort: Balanced
Findings: 1

Open (1)

• Restrict missing base guard fallback to uninstalled bases · New

What changed in this PR

Adds first-install fallback loading for Squad Review guards while retaining base-branch preference.

Changes:

• Adds immutable workflow-SHA guard checkouts and fallback loading.
• Tests fallback, base precedence, and invalid-base failure.
• Regenerates packaged workflow and manifest digest.

File	Description
workflows/​squad-review.md	Defines guard fallback behavior.
workflows/​package/​squad-review.md	Regenerates packaged workflow.
test/​gh-aw-review-workflow.test.ts	Adds compiled-loader regression coverage.
workflows/​squad-workflows.manifest.json	Updates packaged workflow hash.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.