fix(gh-aw): replace reviewer App with native review authority - #2109

* deps: Bump devalue from 5.8.1 to 5.9.2 in /docs (#2055)

Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2.
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/devalue/compare/v5.8.1...v5.9.2)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.9.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com>

* deps: Bump the minor-patch group across 1 directory with 2 updates (#2058)

Bumps the minor-patch group with 2 updates in the /docs directory: [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro).


Updates `@astrojs/markdown-remark` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.3.1/packages/markdown/remark)

Updates `astro` from 7.3.1 to 7.3.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.3/packages/astro)

---
updated-dependencies:
- dependency-name: "@astrojs/markdown-remark"
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: astro
  dependency-version: 7.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com>

* deps: Bump the microsoft-packages group with 2 updates (#2059)

Bumps Microsoft.Agents.AI.GitHub.Copilot from 1.20.0 to 1.22.0
Bumps Microsoft.Extensions.AI from 10.9.0 to 10.10.0

---
updated-dependencies:
- dependency-name: Microsoft.Agents.AI.GitHub.Copilot
  dependency-version: 1.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: microsoft-packages
- dependency-name: Microsoft.Extensions.AI
  dependency-version: 10.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: microsoft-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com>

* deps: Bump GitHub.Copilot.SDK from 1.0.13 to 1.0.14 (#2060)

---
updated-dependencies:
- dependency-name: GitHub.Copilot.SDK
  dependency-version: 1.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com>

* deps: Bump the minor-patch group across 1 directory with 6 updates (#2062)

Bumps the minor-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.2.2` | `10.3.3` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.1` | `15.0.2` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.6.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@github/copilot-sdk](https://github.com/github/copilot-sdk) | `1.0.13` | `1.0.14` |



Updates `cspell` from 10.2.2 to 10.3.3
- [Release notes](https://github.com/streetsidesoftware/cspell/releases)
- [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md)
- [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.3.3/packages/cspell)

Updates `markdown-it` from 15.0.1 to 15.0.2
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](https://github.com/markdown-it/markdown-it/compare/15.0.1...15.0.2)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/node` from 26.5.0 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@github/copilot-sdk` from 1.0.13 to 1.0.14
- [Release notes](https://github.com/github/copilot-sdk/releases)
- [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/copilot-sdk/compare/v1.0.13...v1.0.14)

---
updated-dependencies:
- dependency-name: cspell
  dependency-version: 10.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: markdown-it
  dependency-version: 15.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@github/copilot-sdk"
  dependency-version: 1.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com>

* docs: require Issues before gh-aw install

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs: add gh-aw enlistment changeset

Add patch release metadata for the CLI and SDK templates changed by PR #2072.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs: fail closed when enabling Issues

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs: deduplicate gh-aw Issues changeset

Keep the fail-closed CLI and SDK release note from the review-fix commit as the single changeset for this documentation update.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Harden gh-aw workflow distribution integrity

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test: add hosted gh-aw bootstrap e2e harness

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test: align hosted e2e with bundle manifest

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test: consume native gh-aw bundle contract

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test: bind hosted e2e to resolved source

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: normalize generated workflow whitespace

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: harden native gh-aw package

Closes #2075

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: capture gh-aw version output

Closes #2075

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: use public registries for locked packages

Closes #2075

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: narrow native gh-aw hardening scope

Keep the revision focused on the seven reviewed blockers and generate resource-free package workflow sources so remote gh-aw v0.89.21 installs the exact 7/15/1 topology without duplicate resources.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: verify remote package ownership

Normalize gh-aw's immutable source annotation when checking installed workflow bytes and match v0.89.21's 23-entry ownership record while verifying the skill separately.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: accept pinned gh-aw source annotations

Normalize only the two immutable source annotations emitted by gh-aw v0.89.21 before comparing installed workflow bytes to canonical digests.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: normalize installer trailing newline

Allow gh-aw v0.89.21's downloaded workflow representation to omit the canonical source's single final newline while preserving exact content verification.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: restore stable workspace lock dependency

Remove the build-generated prerelease SDK dependency floor from package-lock.json so the stable workspace policy remains satisfied.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test: align native package expectations

Replace stale six-workflow, ambient-version, and top-level Markdown assumptions with the current nested seven-workflow package contract.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test: delegate native install proof to CI

Replace the duplicate ambient-compiler install test with assertions for the exact nested package and pinned v0.89.21 strict-compile job.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: harden package trust boundaries

Reject symlinked manifest/runtime paths and require explicit credential-bearing child processes, including separation of source-read and mutation tokens.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: bind hosted bootstrap evidence (Part of #2075)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: bind bootstrap outputs to run provenance

Part of #2075

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): protect dependency changelog

Closes #2091

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* ci: add repo-health PR-head shadow harness

Add a read-only pull_request shadow that exercises proposed scanners and the real reporter contract without mutating GitHub. Document the authoritative post-merge hostile-filename canary and label production comments by evidence level.

Closes #1800

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: align repo-health fixtures with git transport

Closes #1800

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: allow gh-aw cast genesis state

Closes #2067

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(repo-health): decode Git-quoted leakage paths

Closes #1800

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): fail closed on rejected squad commands

Closes #1824

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): route commands outside start position

Closes #1824

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test(gh-aw): include command router in CI topology

Closes #1824

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* chore(gh-aw): keep command fix within review scope

Closes #1824

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): enforce independent Squad review and gate epic relay

Closes #1734

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test(gh-aw): reconcile reviewed topology after final restack

Closes #1734

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): make review guard first-install safe

Closes #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): fail closed on missing installed review guard

Closes #2103

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): bind first-install review identity

Part of #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): verify clean-install package bytes

Bind reserved first-install identities to immutable canonical package content, exact installed ownership bytes, and normalized compiled lock digests. Add live-loader mutation coverage for source, lock, canonical-content, and fetch failures.\n\nRefs #2103\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): stabilize local install verification

Rebind local-package workflow sources before compilation and normalize only compiler-declared repository-scattered schedules in trusted lock digests.

Refs #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): make first install a human trust boundary

Part of #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): harden hosted strict compile fixture

Part of #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): bind review to automatic PR runs

Part of #2105

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): attest review from base context

Part of #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test(gh-aw): expose installed lock digest mismatch

Part of #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): dedicate review check identity

Part of #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* chore: record dedicated review app change

Part of #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): normalize compiler setup pin

Closes #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(ci): align gh-aw compiler pin

Closes #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test(ci): enforce structural gh-aw compiler pins

Closes #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test(ci): reject continued and dynamic compiler installers

Closes #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): replace reviewer App with native review authority (#2109)

Removes the dedicated reviewer App, private-key secret, environment, token minting, and custom Checks API publisher. Uses the base-controlled native GitHub Actions/gh-aw review job and exact-run relay binding, with context-only merge enforcement explicitly advisory unless source-bound policy is available.\n\nCloses #2103\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): verify native package source digest variants (#2111)

Supports both legitimate native installer provenance forms with complete source-selected digests and deterministic immutable gh-aw toolchain action pins. Integrity normalization and installed-byte verification remain unchanged.\n\nCloses #2103\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): submit bootstrap chunks without agent transcription (#2115)

* fix(gh-aw): submit bootstrap chunks without agent transcription

Closes #2112

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(ci): seed immutable actions in native workflow consumer

Closes #2112

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): preserve ownership staging with bounded index verification (#2116)

* fix(gh-aw): verify ownership metadata in staged installs

Handoff for independent revision: staged-tree enumeration still requires the reviewer-requested large-consumer correction before PR creation.

Closes #2113

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): bound staged install queries to required paths

Independently revise the rejected ownership staging handoff. Avoid recursive consumer-tree enumeration and preserve exact staged type and digest checks. Cover 20,000 unrelated tracked files, unchanged staging, bounded blob reads, index locks, and substituted directories.

Closes #2113

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs(changeset): record verified gh-aw ownership staging

Add the coordinator-authorized patch changeset for both template-shipping packages to satisfy the hosted changelog gate.

Closes #2113

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): correct exact enlistment compiler warning gate (#2118)

* fix(gh-aw): correct exact enlistment warning gate

Closes #2117

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs(gh-aw): retain bot-trigger explanation

Closes #2117

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Enforce coordinator scope and tracked behavior changes (#2110)

* fix: enforce coordinator scope boundaries

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: address scope control review

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): harden hosted canary contracts (#2120)

* fix(gh-aw): harden hosted canary contracts

Validate bootstrap output in isolation before trusted writes, authorize mutating command dispatches, and bind review relays to the latest exact base-controlled run attempt.

Closes #2103

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): close review authorization gaps

Closes #2103

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: ignore CommonMark tab-indented commands

Closes #2103

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): read committed cast registry from the checkout when validating an isolated bootstrap candidate

The materialize step copies the checkout into a .git-less candidate (#2120),
but committedRegistry() ran git rev-parse/ls-tree/show in that candidate, so
every bootstrap failed with 'registry base: committed HEAD is unavailable'.
Thread an optional gitRoot (default root) through validateBootstrapPayload ->
validateCastTree -> parseRegistry, and pass gitRoot: checkout from the
materializer. Adds a regression test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test(gh-aw): refresh pinned squad lock digests for the updated cast validator

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): require 0.89.22 for central ops

Closes octodemo/zava-social-cao-ops-20260929111840#18

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* feat(gh-aw): opt-in committed research scope for bootstrap

Adds .squad/research-scope.json (squad-research-scope/v1). When committed at HEAD, every bootstrap proposal must cite evidence under a declared root. Uncommitted scope files are ignored.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): preserve bootstrap candidate isolation

Validate candidate bytes from the isolated tree while resolving committed Cast provenance from the trusted checkout. Adds regression coverage for CAO integration issue octodemo/zava-social-cao-ops-20260929111840#26.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): preserve review provenance marker

Describe the implementation marker without a literal HTML comment so gh-aw retains the exact regex in compiled reviewer prompts. Adds compiled-artifact regression coverage for octodemo/zava-social-cao-ops-20260929111840#20.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): require exact enlistment compiler

Closes #2129

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): create bootstrap candidate payload parent

Part of #2128

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(test): raise Aspire dashboard health-check timeout to absorb CI runner contention (#2132)

* fix(test): pin Aspire dashboard image to verified-good 13.5.2 build

Root cause of the #2123/#2132 Aspire integration test CI failures was
NOT CPU contention: `mcr.microsoft.com/dotnet/aspire-dashboard:latest`
(and the major-version tag `:13`, confirmed to currently resolve to
the identical freshly-published `13.6.0` build/digest) is broken — the
container exits immediately (exitCode=145) because
/app/Aspire.Dashboard.dll is missing from the image, so the dashboard
health check can never succeed no matter the timeout.

Fix: pin docker pull/run to `:13.5.2`, a distinct ~3-week-older build
(different layer digests, verified via the MCR manifest API) that
predates the broken `13.6.0` release and does not exhibit the
missing-DLL problem.

Diagnostics hardening made while chasing this down (kept, as they are
independently valuable for any future flake in this suite):
- Removed --rm from the dashboard `docker run` so a crashed container
  survives long enough for failure-path `docker inspect`/`docker logs`
  diagnostics to run (relying on existing explicit removeContainer()
  cleanup instead).
- Captured container stderr in the `docker logs` diagnostics call
  (`2>&1`), since .NET unhandled-exception output goes to stderr and
  was previously silently dropped, hiding the real crash reason.
- Raised isDockerAvailable()'s `docker info` timeout from 5s to 20s to
  prevent false-skip of the whole Docker-dependent suite under CI CPU
  contention (which would otherwise look like a false pass).
- Raised the dashboard health-check timeout to 120s as defense-in-depth
  against genuine contention-induced slow starts, independent of the
  image-pinning fix above.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(test): widen beforeAll hook budget for diagnostics margin

Addresses reviewer feedback on PR #2132:
- The 240s beforeAll hook budget had zero margin above the bounded
  120s docker-pull timeout + 120s health-check timeout, so Vitest
  could abort the hook with a generic timeout before
  waitForHealthy's more informative crash diagnostics could be
  thrown. Widened to 300s (~60s margin for container startup,
  diagnostics collection, and Playwright browser launch).
- The --rm-vs-diagnostics concern on the same thread was already
  resolved in a prior commit (docker run no longer passes --rm);
  no further change needed there.

Also trims two overly verbose/speculative inline comments (image-pin
rationale, health-check rationale) down to the essential facts.

Closes #2133

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: brady gaster <bradygaster@github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test: harden Aspire dashboard startup (#2134)

Pin the dashboard fixture to the verified 13.5.2 manifest and diagnose startup exits immediately with bounded container state and logs. Add deterministic regression coverage for the missing-DLL exit and hung health-request paths.

Closes #2133

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* deps: Bump Microsoft.NET.Test.Sdk from 18.10.0 to 18.10.1 (#2073)

---
updated-dependencies:
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com>

* ci: Bump the github-actions group across 1 directory with 2 updates (#2087)

Bumps the github-actions group with 2 updates in the / directory: [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) and [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions).


Updates `github/gh-aw-actions/setup` from 0.89.17 to 0.90.0
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/gh-aw-actions/compare/f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0...a65c3ae1e11016c37f426bb3847a6f5e1a7d58df)

Updates `github/gh-aw-actions/setup-cli` from 0.89.17 to 0.90.0
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/gh-aw-actions/compare/f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0...a65c3ae1e11016c37f426bb3847a6f5e1a7d58df)

---
updated-dependencies:
- dependency-name: github/gh-aw-actions/setup
  dependency-version: 0.89.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/gh-aw-actions/setup-cli
  dependency-version: 0.89.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com>

* chore(deps): Bump @grpc/grpc-js in /samples/autonomous-pipeline (#2127)

Bumps [@grpc/grpc-js](https://github.com/grpc/grpc-node) from 1.14.3 to 1.14.5.
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.5)

---
updated-dependencies:
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com>

* deps: Bump fast-uri from 3.1.7 to 3.1.8 (#2126)

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to 3.1.8.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com>

* deps: Bump brace-expansion from 5.0.7 to 5.0.12 (#2125)

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.7 to 5.0.12.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.7...v5.0.12)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.12
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com>

* deps: Bump undici from 8.10.0 to 8.11.2 in /docs (#2097)

Bumps [undici](https://github.com/nodejs/undici) from 8.10.0 to 8.11.2.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.11.2)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 8.11.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com>

* deps: Bump astro in /docs in the astro-minor-patch group (#2086)

Bumps the astro-minor-patch group in /docs with 1 update: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro).


Updates `astro` from 7.3.3 to 7.3.5
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.5/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: astro-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com>

* deps: Bump ip-address from 10.4.0 to 10.7.2 (#2098)

Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.4.0 to 10.7.2.
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.4.0...v10.7.2)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.7.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com>

* deps: Bump js-yaml and markdownlint-cli2 (#2108)

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 5.4.1 and updates ancestor dependency [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2). These dependencies need to be updated together.


Updates `js-yaml` from 5.2.2 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/5.2.2...5.4.1)

Updates `markdownlint-cli2` from 0.23.2 to 0.23.3
- [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md)
- [Commits](https://github.com/DavidAnson/markdownlint-cli2/compare/v0.23.2...v0.23.3)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.4.1
  dependency-type: indirect
- dependency-name: markdownlint-cli2
  dependency-version: 0.23.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(gh-aw): relay normalized squad commands through dispatch (#2136)

* fix(gh-aw): relay normalized squad commands through dispatch

Fixes three command-routing defects reported against source SHA
261d140679b158888f1a3c4d9a5a3e74eb55b633
(octodemo/zava-social-backend-20261001184422#1):

1. The lifecycle-repair fallback in the shared squad.md coordinator only
   recognized exact, /squad-prefixed issue-comment bodies. A command
   normalized and relayed by squad-command-router.md via workflow_dispatch
   (e.g. the bare "activate" dispatch input for a /squad activate comment)
   skipped repair entirely. Repair gating and the effective command are now
   derived identically for both the issue_comment and workflow_dispatch
   event paths (CANONICAL_BY_BARE_COMMAND normalization).

2. squad-command-router.md omitted `roles: all`, so gh-aw's default
   write-role activation gate blocked the router from running at all for
   non-write actors -- including modes the router intentionally allows
   anyone to invoke. Added `roles: all`; the router's own in-script,
   per-command authorization for mutating modes is unchanged.

3. The router's relayed dispatch dropped originating comment provenance, so
   an embedded /squad approve-improvement could never supply a real
   approval_comment_id and was rejected outright. The router now forwards
   an aw_context pointer (item type/number + originating comment id)
   through the dispatch, and squad-improvement-gate.mjs's
   validateApprovalDispatchRelay re-fetches and validates that live comment,
   binding permission to its own author -- never the dispatch actor -- so
   approval binding is not weakened.

Package/lock/manifest regenerated via the standard
`node workflows/shared/squad-install-verifier.mjs --write-source` pipeline;
strict `gh aw compile --strict` passes with only the two documented
warnings. Added test/gh-aw-command-router-relay.test.ts (true end-to-end
router -> repair-job relay via real extracted step scripts, plus a
normalization mutation-kill test), and extended
test/gh-aw-command-parse.test.ts / test/gh-aw-improvement-worker.test.ts
with regression coverage for all three findings.

Local npm install is broken in this environment (missing transitive deps
such as fdir), so vitest/eslint cannot run locally; every new/changed
assertion was independently verified by direct Node/vm execution of the
real production modules and scripts, and by compiled-lock diffing. Hosted
CI at the PR head is the authoritative suite result.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): update compiled-digest golden hashes for relay fix

The roles: all / aw_context changes to squad.md and
squad-command-router.md legitimately alter the compiled squad.lock.yml
content. Update the three hardcoded golden SHA-256 digests in
test/gh-aw-quality.test.ts's canonical package integrity contract
suite to match, following the same pattern as commit b5455084.

Independently recomputed via direct execution of the real
compileWithPinnedActions/normalizeCompiledLock helpers (node
--experimental-strip-types, bypassing the broken local vitest
install) and confirmed to match hosted CI's reported values exactly.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): forward real item identity across the squad.md -> squad-improvement-worker relay hop

Fixes a downstream defect in the command-routing relay chain (flagged by
copilot-pull-request-reviewer[bot] against PR #2136, which fixed the three
originally-scoped findings from source SHA
261d140679b158888f1a3c4d9a5a3e74eb55b633,
octodemo/zava-social-backend-20261001184422#1).

Root cause: gh-aw's own dispatch_workflow safe-output engine
unconditionally overwrites any agent-supplied aw_context input with its
own buildAwContext() whenever a dispatch's target workflow declares an
aw_context workflow_dispatch input. buildAwContext() derives
item_type/item_number/comment_id solely from the CURRENT run's own event
payload -- never inherited across a hop. When a relayed (workflow_dispatch
-triggered) squad.md run dispatches to squad-improvement-worker via the
squad-approve-improvement skill, that dispatch goes through gh-aw's real
dispatch_workflow handler, so the engine always overwrites squad.md's
aw_context with its own context -- which, because squad.md's own run is a
workflow_dispatch event with no issue/comment payload, always carries empty
item_type/item_number/comment_id. collectImprovementContext's existing
strict exact-match check (correct for the native direct-comment path, where
the engine's own context genuinely is accurate) therefore always rejected
every relayed /squad approve-improvement, independent of any event_type
widening.

Fix (no gh-aw change; pure squad.md-side plumbing):
- squad-improvement-worker.md: declare a new, non-colliding
  squad_approval_relay workflow_dispatch input (distinct name from
  aw_context, so gh-aw's engine never auto-overwrites it) and wire a
  parallel SQUAD_IMPROVE_RELAY_CONTEXT env var at both existing call sites.
- squad.md: the squad-approve-improvement skill now always forwards
  squad_approval_relay: {event_type, item_type, item_number, comment_id}
  alongside the existing issue_number/approval_comment_id inputs, reusing
  the same already-resolved values.
- squad-improvement-gate.mjs: collectImprovementContext keeps the
  unconditional repo/workflow_id provenance check against the engine's own
  (always-accurate) context, then branches: native path (event_type ===
  issue_comment) validates item identity against the engine context
  unchanged; relayed path (any other event_type) validates with identical
  exact-match strictness against the new SQUAD_IMPROVE_RELAY_CONTEXT
  instead. No approval-binding check is weakened on either path; all
  unconditional live re-verification (comment/permission/revocation/
  revision/linked-PR checks) is untouched.

Regenerated workflows/package/*.md and workflows/squad-workflows.manifest.json
via `node workflows/shared/squad-install-verifier.mjs --write-source`.

Tests (test/gh-aw-improvement-worker.test.ts):
- Extends the skill-JSON-shape assertion for the new relay field.
- New describe block covering: relayed-path authorization success, repo/
  workflow_id forgery still rejected, mutation-kill coverage (tampered
  comment_id/item_number/item_type/event_type each independently rejected),
  malformed/missing relay context rejected (no silent fallback to the
  engine's empty item fields), native-path non-regression, source wiring
  assertions, and a compiled-artifact assertion (gh aw compile --strict)
  proving both the worker's lock.yml declares/wires the new input and
  squad.lock.yml's compiled dispatch step actually emits
  squad_approval_relay.

Verified locally: standalone Node execution of collectImprovementContext's
new branch logic (native path, relayed success, 4 mutation-kill cases, 3
malformed/missing-context cases, repo/workflow_id forgery); gh aw compile
--strict across all 8 installed workflows produces exactly the two
documented warnings (Compiled 8 workflows: 8 succeeded, 2 warnings);
per-workflow strict compiles of squad and squad-improvement-worker confirm
the new input/env/dispatch-field wiring in the generated lock.yml files.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test(gh-aw): update stale compiled-lock golden digests after relay-context fix

Updating workflows/squad.md's squad-approve-improvement dispatch payload
(and squad-improvement-worker.md's new input/env wiring) changes the
compiled squad.lock.yml / squad-improvement-worker.lock.yml content, which
shifts the normalized SHA-256 digests asserted by the canonical package
integrity contract tests in test/gh-aw-quality.test.ts (tamper-mutation
fixtures recomputed over the new baseline compiled output).

Re-derived both digest pairs from the actual compiled output (workflow and
package source bindings) and updated the three assertions that pinned the
stale values. No test logic changed; this is a golden-value refresh
consistent with the same pattern applied for the three originally-scoped
fixes earlier in this PR.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): bind router commands to text author (#2141)

Fixes octodemo/zava-social-queue-worker-20261001211503#1

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): harden GA-review-blocked source contract (9 findings)

Fixes 9 confirmed GH-AW GA review blockers as one coherent source-contract
hardening pass:

1. squad-improvement-gate.mjs: added regression/mutation test coverage for
   rejecting a content-only modification of an already-tracked executable
   (100755) Markdown improvement target (production ALLOWED_FILE_MODE guard
   was already correct; the defect was a test-coverage gap).
2. squad_approval_relay: unambiguous JSON-string contract end-to-end between
   squad.md and squad-improvement-worker.md/gate, preserving the distinct
   input name since gh-aw overwrites aw_context.
3. squad-review-guard.mjs: added regression tests confirming override
   candidates are authorized before cardinality/record validation, so
   malformed or unauthorized markers fail closed.
4. squad-planning-ontology.md: normalized `Result: ✅ PASS` to the exact
   `RESULT: PASS` string downstream parsers require.
5. squad-install-verifier.mjs: confirmed verifyInstalledBytes() normalizes
   only the one documented injected source: binding before hashing and
   fails on any other tamper; existing mutation-test table already covers
   this (no source change needed).
6. Numeric issue/comment IDs from issue_comment events are canonicalized to
   safe-integer strings before comparison against workflow_dispatch string
   inputs; invalid forms are rejected. Direct and relayed coverage added.
7. squad-command-router.md: block replay of bot-authored standalone /squad
   issue/comment command text while preserving trusted workflow_dispatch
   continuation and documented bot behavior, for created/edited events.
8. can_approve_pull_request_reviews: proved via gh-aw source this is a
   single combined toggle gating both GITHUB_TOKEN PR creation and PR-review
   approval (cannot be split via job permissions). Per least-privilege
   policy and the mandatory independent-human-approval requirement, flipped
   true->false across all public/enlistment/setup copies and added a
   fallback-to-issue mechanism (manual compare-URL link) to
   squad-bootstrap.md for when push succeeds but PR creation is blocked.
9. Eliminated unbounded mutable commits/dev channel resolution; GA install
   guidance now requires an explicit, pre-validated 40-character SQUAD_SHA,
   synced across public/enlistment docs and skill mirrors. Exact-SHA
   fixture testing is unaffected; no release is published.

Verification:
- All 28 gh-aw-prefixed test files pass (1849/1849 tests), including the
  previously-failing test/gh-aw-install-staging.test.ts (15/15) after
  regenerating workflows/squad-workflows.manifest.json via
  `npm run gh-aw:integrity:write` to pick up the item 8/9 SKILL.md edits.
- packages/squad-sdk and packages/squad-cli both build cleanly
  (tsc --noEmit reports zero warnings/errors for both).
- Real (non-mocked) `gh aw compile --strict` against the canonical
  workflows/*.md sources compiles all 8 workflows successfully and
  produces exactly the two documented/allowed warnings (pull_request_target
  advisory on squad-review.md; bot-trigger advisory on squad.md).
- Independent security review found no high-confidence issues.
- No package.json/package-lock.json drift anywhere in the tree.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): avoid false-positive security scan on bootstrap fallback marker

gh-aw's --strict compile security scanner flags any unclosed '<!--' token
because it scans forward to the nearest subsequent '-->' anywhere in the
file (a hidden-content/prompt-injection detection heuristic). The item-8
bootstrap PR-fallback marker intentionally stored only the opening '<!--'
as a module constant and appended the closing '-->' later via string
interpolation, which made the scanner capture ~240 lines of unrelated JS
as a single 'HTML comment' and reject it as suspicious content.

Fix: build the complete marker (open + close delimiters together) in a
single template literal inside bootstrapPrFallbackIssueMarker(), exactly
mirroring the existing (already-safe) BOOTSTRAP_ISSUE_MARKER shape. The
runtime marker text is byte-identical (verified via direct invocation);
only the constant's exported value lost its leading '<!-- ' (now built at
call time instead).

Regenerated the pinned SHA-256 digest for squad-bootstrap-validator.mjs
via 'npm run gh-aw:integrity:write' (workflows/squad-bootstrap.md,
workflows/package/squad-bootstrap.md, workflows/squad-workflows.manifest.json).

Verified:
- node workflows/shared/squad-install-verifier.mjs --check-source: current
- npx vitest run test/gh-aw-bootstrap-workflow.test.ts: 33/33 passed
- npx vitest run test/gh-aw-*.test.ts (28 files): 1849/1849 passed
- Real (non-mocked) 'gh aw compile --strict --no-check-update' against a
  scratch materialized .github/workflows/ tree: security scan passes,
  8/8 workflows compile, exactly 2 allowed warnings (pull_request_target
  advisory + slash_command/bots advisory) — matching CI's failing job.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): trusted signed-provenance fallback for manual bootstrap PR

Replace the dead-end manual-PR-fallback boundary flagged in Copilot
auto-review with a narrowly-scoped trusted path: the bootstrap
workflow now stamps a signed, machine-readable provenance line
(repo/run/base branch/head branch/head SHA/compare URL) into the
fallback issue body it files when GITHUB_TOKEN cannot open the Cast
PR itself. squad-review-guard validates a human-opened Cast PR
against that provenance record end-to-end (aggregate fields, compare
URL, run binding, issue-created-before-PR ordering) before granting
@squad/base-controlled-bootstrap / @squad/base-controlled-review
roles, with every other provenance/review/content/head check
unchanged and malformed/forged records still failing closed.

- workflows/shared/squad-bootstrap-validator.mjs: add
  buildBootstrapPrFallbackProvenanceLine/parseBootstrapPrFallbackProvenance/
  buildBootstrapPrFallbackCompareUrl; buildBootstrapPrFallbackIssueBody
  now requires a signed provenanceLine argument.
- workflows/shared/squad-review-guard.mjs: add
  validateBootstrapPrFallbackAttribution, wired ahead of the existing
  bot-authored bootstrap-PR path so a verified fallback PR is treated
  identically (including the bootstrap-run-success gate).
- workflows/squad-bootstrap.md (+ generated package copy): thread the
  signed provenance line into the fallback issue body.
- test/gh-aw-review-guard.test.ts: full new fallback-scenario suite
  (valid fallback incl. enforceReviewOutputs parity, run-success
  gating, unrelated/ambiguous-issue rejection, and a 15-case mutation
  table for forged/edited/malformed provenance) — mutation-verified by
  independently neutering each of the 4 requireThat checks in
  validateBootstrapPrFallbackAttribution.
- test/gh-aw-bootstrap-workflow.test.ts: update VM-sandboxed
  stateModule mock and fixtures for the new provenance-line export and
  strict 40-hex-char head-SHA validation.
- docs/src/content/docs/guide/gh-aw.md: document the new
  signed-provenance trust model and its exact matching requirements.
- workflows/squad-command-router.md (+ generated package copy),
  gh-aw-enlistment SKILL.md copies, scripts/gh-aw-hosted-e2e.mjs,
  test/gh-aw-hosted-e2e.test.ts, workflows/squad-workflows.manifest.json:
  carry-through updates for findings 7-9 (bot-authored command
  blocking, can_approve_pull_request_reviews=false default, explicit
  SHA-pinned enlistment) already validated earlier this PR; this
  commit regenerates the manifest/package artifacts to match.

Verified: npx vitest run test/gh-aw-*.test.ts (28 files, 1884 tests,
all passing); npm run lint (tsc --noEmit, both packages, clean); real
scratch-consumer gh aw compile --strict across all 8 package
workflows with exactly the 2 previously-allowed warnings preserved;
npm run gh-aw:integrity:write regenerated manifest/package artifacts
cleanly.

Addresses PR #2142 review finding Medium #3 (bootstrap PR fallback
cannot satisfy provenance checks), per coordinator-approved redesign.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs(changeset): note signed-provenance bootstrap-PR fallback redesign

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): harden bootstrap-PR-fallback trust and command-router bot block (8 review findings)

Addresses the 8 fresh Copilot auto-review findings from the review on
commit 9b45d116 (after the signed-provenance fallback redesign):

- squad-bootstrap-validator.mjs: filter fallback-issue dedupe/ambiguity
  candidates by bot-authorship + title + valid-provenance *before*
  counting/matching, closing a decoy-issue forgery/DoS gap.
- squad-review-guard.mjs: bind the fallback provenance path's cited
  bootstrap run to the exact base commit (run.head_sha === pr.base.sha),
  matching the bot-authored path's existing binding.
- scripts/gh-aw-hosted-e2e.mjs: validate the full signed provenance
  record (independently re-implemented, not imported) instead of a
  plain-text marker/compare-URL substring check, so the hosted E2E can
  no longer report success for a fallback issue production would reject.
- squad-command-router.md: add direct test coverage (user.type /
  payload.sender.type fixtures, previously never populated) proving the
  existing bot-authorship block is reachable and enforced for both
  created and edited events, with mutation-kill tests.
- Updated docs/src/content/docs/guide/gh-aw.md, .github/agents.md,
  README.md (removed a stale @dev-tracking note contradicting the
  explicit-SQUAD_SHA policy), and all 5 synchronized copies of
  skills/gh-aw-enlistment/SKILL.md to describe the fallback-issue-first
  Cast PR flow.

Verified: full test/gh-aw-*.test.ts suite (28 files, 1896 tests) passes;
npm run lint (tsc --noEmit, both packages) clean; a real scratch-consumer
`gh aw compile --strict` against workflows/package/*.md produces exactly
the two documented warnings. No stable release published.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs(gh-aw): close remaining stale automatic-Cast-PR passages (review threads 1-8)

Follow-up to f1084ec1: fixed two stale passages a second hosted-review
pass on the same commit flagged:
- skills/gh-aw-enlistment/SKILL.md anti-pattern list still said
  'automatic Cast PR' unconditionally.
- docs/src/content/docs/guide/gh-aw.md activation-canary/automatic-
  bootstrap checklist rows still described only the unconditional-
  automatic case, including research-proposals-issue creation timing.

Both now cover the manual-fallback path and its provenance
requirement. Regenerated workflows/squad-workflows.manifest.json via
npm run gh-aw:integrity:write (SKILL.md digest only).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): resolve fresh Copilot review findings on PR #2142 (7 fixes)

Fresh hosted Copilot review on commit 3bf5c01f surfaced 1 new Medium finding
plus 6 previously-missed findings. All 7 are fixed/tested:

- squad-bootstrap-validator.mjs: edited-fallback-issue dedupe bug (Medium) -
  findExistingBootstrapPrFallbackIssue now requires unedited created_at ===
  updated_at timestamps, mirroring validateBootstrapPrFallbackAttribution's
  review-time requirement exactly.
- gh-aw-hosted-e2e.mjs: selectBootstrapFallback now mirrors the same
  open-state and unedited-timestamp lifecycle checks production enforces.
- squad-review-guard.mjs: validateBootstrapPrFallbackAttribution tightened
  from `!== 'Bot'` to `=== 'User'` so non-Bot, non-User account types
  (Organization, Mannequin) can no longer pass fallback-PR authorship.
- squad-review-guard.mjs: assertClearingReview now caches collaborator
  permission lookups per login for the duration of one evaluation.
- squad-improvement-gate.mjs: added direct test coverage for sameNumericId's
  cross-type normalization and malformed/overflow rejection at the nested
  origin.item_number/relay.item_number level (production was already
  correct; this closed a test-only gap).
- squad-planning-ontology.md: added a regression test pinning the exact
  RESULT: <PASS | FAIL> template text (production doc was already correct;
  test-only gap).
- squad-bootstrap-validator.mjs: buildBootstrapPrFallbackIssueBody now tells
  the human to manually re-run the workflow if they want the linked
  research-proposals issue before merging the fallback-opened Cast PR, since
  no GitHub event re-triggers bootstrap until the next default-branch push.
  Proved via a scratch gh aw compile --strict run that adding a
  pull_request_target trigger instead would both require an unacceptable
  checkout: false security posture change and break the documented
  'exactly two compile warnings' contract - a missing instruction, not a
  missing trigger, was the actual defect.

Regenerated workflows/squad-workflows.manifest.json and the generated
workflows/package/squad-bootstrap.md copy via npm run gh-aw:integrity:write
to pick up the new source digests. Synced the 4 enlistment SKILL.md mirror
copies via npm run sync-templates.

All 28 gh-aw-*.test.ts files / 1919 tests pass. npm run lint clean. The
enlistment-skill compile-warning-allowlist contract (exactly two warnings)
remains intact.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): close bootstrap-fallback dedupe staleness, title-check, and notification gaps (review on 1a9c4081)

- squad-bootstrap-validator.mjs: add base_sha staleness binding to the
  fallback-issue provenance record so an old fallback issue is no longer
  silently reused once the default branch advances past it.
- squad-review-guard.mjs: require the canonical Cast-PR title on the
  fallback review path too, matching the bot-authored path.
- squad-bootstrap.md: reword the run-success notification to be accurate
  when only the fallback issue (not a Cast PR) exists.
- Regenerate workflows/package/squad-bootstrap.md and
  squad-workflows.manifest.json via npm run gh-aw:integrity:write.
- Update docs/src/content/docs/guide/gh-aw.md fallback-provenance section.
- Add regression + mutation coverage across
  gh-aw-bootstrap-workflow.test.ts, gh-aw-review-guard.test.ts, and
  gh-aw-hosted-e2e.test.ts (staleness, malformed-argument, title-rejection
  cases).

Validated: targeted test files (308/308), full gh-aw suite
(28 files / 1921 tests), npm run lint (tsc), npm run lint:eslint
(0 errors), npm run build.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): close workflow_dispatch fallback dead-end and E2E fallback-terminal gap

Fresh Copilot review on commit e024db94 surfaced two findings:

- High (workflows/squad-bootstrap.md): a workflow_dispatch run could open a
  bootstrap-PR-fallback issue that squad-review-guard.mjs's
  validateBootstrapPrFallbackAttribution can never authorize (it requires
  event === 'push'), and dedupe matching would keep reusing that permanently
  dead-end issue forever. Now fails closed with an actionable error instead.

- Medium (scripts/gh-aw-hosted-e2e.mjs): the hosted E2E's fallback outcome
  reported terminal success the moment bootstrap opened the fallback issue,
  without ever exercising the Cast-PR-fallback review/attribution path. The
  obvious fix (E2E opens the Cast PR itself with its own PAT) was rejected:
  that would substitute automation for the human-in-the-loop step
  can_approve_pull_request_reviews=false exists to require. Instead the
  fallback outcome is now non-terminal (awaiting_manual_pr); a new read-only
  selectManualFallbackCastPr independently re-derives production's
  authorization logic to observe (never create) a human-opened PR, and a new
  resume-fallback command + squad-gh-aw-hosted-e2e-resume dispatch trigger
  let a later run resume from the original run's persisted baseline identity
  to validate that PR through to the same base-controlled Squad Review
  canary the bot-authored path exercises.

Added regression/mutation coverage for both findings and regenerated the
installed package mirror/manifest digests via
`npm run gh-aw:integrity:write`.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs(gh-aw): document and prove resume-fallback token scoping

Addresses a sibling-session scope-gate follow-up on the resume-fallback job
added for the hosted-E2E Medium-finding redesign: audit confirmed the job's
`secrets.SQUAD_GH_AW_E2E_TOKEN` usage never creates, approves, or mutates the
Cast fallback pull request. It is reused (not removable) only because no
separate read-only PAT exists for the external target fixture repository and
`github.token` cannot reach a repository outside this one.

Documents each job's token scoping separately in the workflow comments, and
adds a transitive-call-graph test proving every function `resumeFallback` can
reach (`bootstrapOutputs`, the `githubAdapter` block,
`selectManualFallbackCastPr`, `waitForManualFallbackCastPr`,
`waitForBaseControlledReviewCanary`) issues only GET `gh api` calls -- no
`pr create`/`pr merge`/`pr review`/write `--method` call anywhere in that
reachable graph.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): remove cross-repo secret from bootstrap-PR fallback continuation

Architectural correction to the hosted-E2E fallback redesign: no credential
(PAT, GitHub App token, or repository/environment secret) may ever be used to
observe or validate the manually opened Cast PR, even read-only. A
workflow-held credential capable of reading that PR's state undermines the
can_approve_pull_request_reviews=false trust boundary, which exists
specifically so a human must act outside of any CI-held credential.

- Reverted .github/workflows/squad-gh-aw-hosted-e2e.yml to its pre-existing
  baseline: removes the resume-fallback job, its squad-gh-aw-hosted-e2e-resume
  dispatch trigger, and the action-gating added for it. File is now byte-
  identical to origin/dev (zero net diff).
- hosted()'s fallback branch no longer calls bootstrapOutputs()/
  selectManualFallbackCastPr()/waitForBaseControlledReviewCanary() inline and
  makes zero further GitHub API calls. It now parses the fallback issue's own
  already-fetched provenance body (parseBootstrapPrFallbackProvenance, a pure
  string-parsing function) and terminates immediately, non-terminally, at
  status: 'awaiting_manual_pr' with complete evidence (target, fallback issue,
  head/base branch+SHA, compare URL, next_step instructions).
- The target repository's own installed Squad Review workflow validates the
  human-opened PR locally, using that repository's own GITHUB_TOKEN/gh-aw
  authority -- no cross-repository read by this controller is needed.
- resumeFallback() is retained unchanged internally (still provably GET-only
  via the existing transitive call-graph test) but is now framed exclusively
  as a local, operator-run-only CLI command: never wired to any Actions job
  or repository_dispatch trigger, relying only on the operator's own
  `gh auth login` session, never a repository secret.
- Updated test/gh-aw-hosted-e2e.test.ts: workflow-topology test now asserts a
  single hosted-e2e job/dispatch type and explicit absence of any
  resume-fallback job; added a test asserting hosted()'s fallback branch
  writes complete evidence with none of the removed inline calls present;
  the dispatcher-wiring test now asserts resumeFallback's doc comment states
  it is operator-run-only/never-CI-wired/never-secret-backed and that the
  workflow file contains no reference to it. Removed the now-obsolete
  per-job token-scoping test (the job no longer exists). The existing
  transitive read-only call-graph proof for resumeFallback is unchanged.
- Updated .changeset/gh-aw-ga-review-hardening.md with a new section
  documenting this correction.

Validation:
- npx vitest run test/gh-aw-hosted-e2e.test.ts -> 139/139 pass
- npx vitest run test/gh-aw*.test.ts -> 28 files / 1938 tests pass
- npm run lint (tsc, both packages) -> clean
- npm run lint:eslint -> 0 errors (pre-existing warning baseline only)
- npm run build -> succeeds (prebuild version-bump side effects reverted)
- npm run gh-aw:integrity:check -> current (no canonical workflow source
  touched this round)
- Scratch-consumer gh-aw compile --strict (mirroring squad-ci.yml's
  gh-aw-compile job exactly): 8/8 workflows compile, exactly 2 documented
  warnings (pull_request_target advisory on squad-review.md; bots:/
  slash_command advisory on squad.md); all 8 compile individually with
  --strict; squad-install-verifier.mjs --verify-install --strict-compile
  passes.
- git diff origin/dev -- .github/workflows/squad-gh-aw-hosted-e2e.yml -> empty
  (file content is byte-identical to dev; this path no longer appears in the
  PR's net diff against dev)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): close base-sha drift, bootstrap-branch doc, and resume-fallback gaps from fresh review

Fixes 7 Copilot review findings on commit 140ce8eb:

- scripts/gh-aw-hosted-e2e.mjs: next_step instruction for resume-fallback
  was missing its three required CLI flags; now emits a complete
  gh run download + resume-fallback --target/--evidence-in/--evidence
  recipe with interpolated values.
- workflows/shared/squad-review-guard.mjs: the bootstrap-PR fallback
  review path bound to the live, mutable pr.base.sha, making manual
  recovery permanently unrecoverable after any further default-branch
  commit. Replaced with a GitHub Compare API ancestry check
  (identical/ahead) that also binds the response's own resolved
  base_commit/merge_base_commit SHAs back to the immutable
  provenance.base_sha, and fails closed on any compare API error.
  findExistingBootstrapPrFallbackIssue's baseSha is now optional for
  the review-path lookup (push-triggered dedupe caller is unchanged).
- skills/gh-aw-enlistment/SKILL.md (canonical + 4 synced mirrors):
  fixed the automated fallback explanation to name the real Cast
  fallback branch (squad/bootstrap-cast) instead of the unrelated
  human-run install branch (chore/squad-gh-aw-bootstrap).

Regenerated workflows/squad-workflows.manifest.json and the embedded
digest in workflows/squad-bootstrap.md / workflows/package/squad-bootstrap.md
via npm run gh-aw:integrity:write; confirmed clean via
npm run gh-aw:integrity:check.

Added regression + mutation test coverage for all three findings,
including four new binding-mutation tests proving a passing compare
status alone is insufficient without base_commit/merge_base_commit
SHA agreement.

Validation: full test/gh-aw*.test.ts suite (28 files, 1949 tests)
passes; npm run lint (tsc --noEmit, both packages) clean; npm run
build clean. Two pre-existing, unrelated failures (test/cli/copilot.test.ts,
test/acceptance/acceptance.test.ts, one case in test/cli/cast.test.ts)
reproduce identically on the pre-session tree via git stash and are
unaffected by this change.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(gh-aw): resolve fresh review findings on bb805b2c (ambiguous fallback matches, merge-trigger claim, open-PR filter)

- squad-bootstrap-validator.mjs: fix a regression this session's own prior
  fix introduced - when baseSha is omitted (review path), multiple genuine
  open fallback-issue matches (stale + fresh across base drift) no longer
  throw "Ambiguous"; they resolve deterministically to the newest match,
  unless they share the identical base_sha (a true unresolvable duplicate),
  which still fails closed regardless of caller.
- squad-bootstrap-validator.mjs + canonical SKILL.md (+4 mirrors): correct
  the false claim that merging a Cast PR automatically retriggers Squad
  Bootstrap - confirmed via squad-bootstrap.md's push trigger paths that
  it never does; manual workflow_dispatch is always required, before or
  after merge.
- gh-aw-hosted-e2e.mjs: selectManualFallbackCastPr now requires
  pr.state === 'open', excluding closed/merged look-alike PRs from the
  manual fallback candidate set.
- docs/guide/gh-aw.md: rewrite the fallb…