From 26f4010ae1d1aa95880c63d3e7044c6294d48011 Mon Sep 17 00:00:00 2001
From: Brady Gaster <brady.gaster@gmail.com>
Date: Thu, 1 Oct 2026 02:14:28 -0700
Subject: [PATCH 1/2] fix(gh-aw): require 0.89.22 for central ops

Closes octodemo/zava-social-cao-ops-20260929111840#18

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .changeset/bright-gh-aw-central-ops.md        |  6 +++
 .github/workflows/squad-ci.yml                |  8 ++--
 .github/workflows/squad-gh-aw-hosted-e2e.yml  |  4 +-
 .../skills/gh-aw-enlistment/SKILL.md          |  8 ++--
 docs/src/content/docs/guide/gh-aw.md          | 10 ++---
 .../skills/gh-aw-enlistment/SKILL.md          |  8 ++--
 .../skills/gh-aw-enlistment/SKILL.md          |  8 ++--
 templates/skills/gh-aw-enlistment/SKILL.md    |  8 ++--
 test/gh-aw-enlistment-skill.test.ts           |  2 +-
 test/gh-aw-quality.test.ts                    |  8 ++--
 test/gh-aw-review-workflow.test.ts            |  4 +-
 test/helpers/gh-aw-install-fixture.ts         |  2 +-
 workflows/aw.yml                              |  2 +-
 workflows/package/squad-bootstrap.md          |  2 +-
 workflows/shared/squad-install-verifier.mjs   | 12 +++---
 workflows/skills/gh-aw-enlistment/SKILL.md    |  8 ++--
 workflows/squad-bootstrap.md                  |  2 +-
 workflows/squad-workflows.manifest.json       | 40 +++++++++----------
 18 files changed, 74 insertions(+), 68 deletions(-)
 create mode 100644 .changeset/bright-gh-aw-central-ops.md

diff --git a/.changeset/bright-gh-aw-central-ops.md b/.changeset/bright-gh-aw-central-ops.md
new file mode 100644
index 000000000..4b13e05be
--- /dev/null
+++ b/.changeset/bright-gh-aw-central-ops.md
@@ -0,0 +1,6 @@
+---
+"@bradygaster/squad-cli": patch
+"@bradygaster/squad-sdk": patch
+---
+
+Require gh-aw v0.89.22 across the Squad workflow package, enlistment guidance, integrity contract, CI, and hosted E2E controller for central agentic ops compatibility.
diff --git a/.github/workflows/squad-ci.yml b/.github/workflows/squad-ci.yml
index c395bbc05..dcf619f0a 100644
--- a/.github/workflows/squad-ci.yml
+++ b/.github/workflows/squad-ci.yml
@@ -173,7 +173,7 @@ jobs:
         # than skipping — a skipped gate is indistinguishable from no gate. This
         # includes the shell input security contract gate (#1834) and the compile
         # contract (#1732).
-        run: gh extension install --pin v0.89.21 github/gh-aw
+        run: gh extension install --pin v0.89.22 github/gh-aw
         env:
           GH_TOKEN: ${{ github.token }}
       - name: Build
@@ -749,10 +749,10 @@ jobs:
           npm config set registry "https://packagefeedproxy.microsoft.io/npm/"
           npm ci --ignore-scripts
 
-      - name: Install gh-aw v0.89.21 (pinned)
+      - name: Install gh-aw v0.89.22 (pinned)
         run: |
-          gh extension install --force --pin v0.89.21 github/gh-aw
-          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.21
+          gh extension install --force --pin v0.89.22 github/gh-aw
+          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.22
         env:
           GH_TOKEN: ${{ github.token }}
 
diff --git a/.github/workflows/squad-gh-aw-hosted-e2e.yml b/.github/workflows/squad-gh-aw-hosted-e2e.yml
index 267509a33..646c2f07d 100644
--- a/.github/workflows/squad-gh-aw-hosted-e2e.yml
+++ b/.github/workflows/squad-gh-aw-hosted-e2e.yml
@@ -50,8 +50,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh extension install --force --pin v0.89.21 github/gh-aw
-          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.21
+          gh extension install --force --pin v0.89.22 github/gh-aw
+          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.22
 
       - name: Verify trusted default-branch controller
         env:
diff --git a/.squad-templates/skills/gh-aw-enlistment/SKILL.md b/.squad-templates/skills/gh-aw-enlistment/SKILL.md
index 7ac923375..f6ac0e9fe 100644
--- a/.squad-templates/skills/gh-aw-enlistment/SKILL.md
+++ b/.squad-templates/skills/gh-aw-enlistment/SKILL.md
@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
diff --git a/docs/src/content/docs/guide/gh-aw.md b/docs/src/content/docs/guide/gh-aw.md
index da32234dd..a478eff7b 100644
--- a/docs/src/content/docs/guide/gh-aw.md
+++ b/docs/src/content/docs/guide/gh-aw.md
@@ -31,8 +31,8 @@ set -euo pipefail
 gh auth status
 owner_repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
 default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')"
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # 2. Require GitHub Issues, then allow GitHub Actions to create pull requests
 issues_enabled="$(gh api "repos/${owner_repo}" --jq '.has_issues')"
@@ -341,7 +341,7 @@ gh aw compile --strict
 ```
 
 Run this exact command after any required first-install approval and before
-committing. With gh-aw v0.89.21, require exactly two warnings, one occurrence
+committing. With gh-aw v0.89.22, require exactly two warnings, one occurrence
 of each exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
@@ -1849,7 +1849,7 @@ prints the exact safe recovery commands.
 
 The schema-v2 integrity manifest records two complete compiled lock digests per
 workflow: `lock_sha256` for a per-workflow source annotation and
-`package_lock_sha256` for a package-root annotation. gh-aw v0.89.21 emits
+`package_lock_sha256` for a package-root annotation. gh-aw v0.89.22 emits
 `bradygaster/squad/workflows@SHA` for direct package includes, but can emit
 `bradygaster/squad/workflows/package/<workflow>.md@SHA` when installing dispatched
 dependencies. Fresh and forced installs can therefore contain different mixtures.
@@ -1859,7 +1859,7 @@ URLs, action pins, permissions and runtime bytes remain integrity-checked.
 No additional fields are removed during lock normalization.
 
 Manifest generation and installation test fixtures seed isolated compiler action
-locks with the immutable `setup` and `setup-cli` pins for gh-aw v0.89.21. Both
+locks with the immutable `setup` and `setup-cli` pins for gh-aw v0.89.22. Both
 source variants use the real strict compiler and validate its version and emitted
 action pins. This avoids a second network resolution returning a mutable version
 tag when credentials or the API are unavailable. Missing or altered pins fail
diff --git a/packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md b/packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md
index 7ac923375..f6ac0e9fe 100644
--- a/packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md
+++ b/packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md
@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
diff --git a/packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md b/packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md
index 7ac923375..f6ac0e9fe 100644
--- a/packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md
+++ b/packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md
@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
diff --git a/templates/skills/gh-aw-enlistment/SKILL.md b/templates/skills/gh-aw-enlistment/SKILL.md
index 7ac923375..f6ac0e9fe 100644
--- a/templates/skills/gh-aw-enlistment/SKILL.md
+++ b/templates/skills/gh-aw-enlistment/SKILL.md
@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
diff --git a/test/gh-aw-enlistment-skill.test.ts b/test/gh-aw-enlistment-skill.test.ts
index db6e81571..d824ce114 100644
--- a/test/gh-aw-enlistment-skill.test.ts
+++ b/test/gh-aw-enlistment-skill.test.ts
@@ -277,7 +277,7 @@ describe('gh-aw-enlistment skill', () => {
     });
 
     it('pins and verifies the package-capable gh-aw compiler', () => {
-      expect(content).toContain('gh extension install --force --pin v0.89.21 github/gh-aw');
+      expect(content).toContain('gh extension install --force --pin v0.89.22 github/gh-aw');
       expect(content).toContain('gh aw --version');
       expect(content).toContain('PowerShell');
     });
diff --git a/test/gh-aw-quality.test.ts b/test/gh-aw-quality.test.ts
index daa4dff6d..4bbc097c1 100644
--- a/test/gh-aw-quality.test.ts
+++ b/test/gh-aw-quality.test.ts
@@ -3829,7 +3829,7 @@ describe('gh-aw: canonical package integrity contract', () => {
       package: PACKAGE_NAME,
       source: `${PACKAGE_NAME}@${revision}`,
       resolvedCommit: revision,
-      installer: 'gh-aw v0.89.21 test',
+      installer: 'gh-aw v0.89.22 test',
       files: owned,
     }, null, 2)}\n`);
     return root;
@@ -3961,8 +3961,8 @@ describe('gh-aw: canonical package integrity contract', () => {
       expect(mutable).not.toContain(actionReference);
       expect(createHash('sha256').update(normalizeCompiledLock(mutable, revisionA)).digest('hex'))
         .toBe(sourceBinding === 'workflow'
-          ? '8456d8129241269c107cdf4b16ae079e89a98ef944152df36f53ec0decf3f30d'
-          : 'bac4d8b90269d827fc9e626dd02c1b536bccde7105e9037971740054cda4c19b');
+          ? '0914fadb4a0f37867840b9394c60f3cd40fb3072dd003518a17efb23718dd632'
+          : 'cac9dea1082405512f66b8efcdb14b554c71e5adc75da158ecc12a0458c7fe52');
       expect(() => validateCompilerActionPins(mutable)).toThrow(/invalid immutable action pin/);
       writeFileSync(lockPath, mutable);
       expect(verifyInstall(root).failures.join('\n'))
@@ -4016,7 +4016,7 @@ describe('gh-aw: canonical package integrity contract', () => {
     compile();
     const unpinned = readText(lockPath);
     expect(createHash('sha256').update(normalizeCompiledLock(unpinned, revisionA)).digest('hex'))
-      .toBe('bac4d8b90269d827fc9e626dd02c1b536bccde7105e9037971740054cda4c19b');
+      .toBe('cac9dea1082405512f66b8efcdb14b554c71e5adc75da158ecc12a0458c7fe52');
     expect(verifyInstall(root).failures.join('\n')).toContain('Installed digest mismatch');
 
     const seedPins = () => spawnSync(process.execPath, ['--input-type=module', '-e', seed!], {
diff --git a/test/gh-aw-review-workflow.test.ts b/test/gh-aw-review-workflow.test.ts
index 496654fe0..7a05c834c 100644
--- a/test/gh-aw-review-workflow.test.ts
+++ b/test/gh-aw-review-workflow.test.ts
@@ -378,12 +378,12 @@ describe('gh-aw enforcing Squad reviewer', () => {
 
   it('declares the complete native package for the pinned compiler job', () => {
     const manifest = read('workflows/aw.yml');
-    expect(manifest).toContain('min-version: v0.89.21');
+    expect(manifest).toContain('min-version: v0.89.22');
     expect(manifest.match(/destination: \.github\/workflows\/squad(?:-[\w-]+)?\.md/g)).toHaveLength(8);
     expect(manifest.match(/source: package\/squad(?:-[\w-]+)?\.md/g)).toHaveLength(8);
     expect(manifest).toContain('  - skills/gh-aw-enlistment');
     expect(read('.github/workflows/squad-ci.yml')).toContain(
-      'gh extension install --force --pin v0.89.21 github/gh-aw',
+      'gh extension install --force --pin v0.89.22 github/gh-aw',
     );
   });
 
diff --git a/test/helpers/gh-aw-install-fixture.ts b/test/helpers/gh-aw-install-fixture.ts
index 95810e531..49880b3f7 100644
--- a/test/helpers/gh-aw-install-fixture.ts
+++ b/test/helpers/gh-aw-install-fixture.ts
@@ -167,7 +167,7 @@ export function createFirstInstallFixture(
         package: PACKAGE_NAME,
         source: `${PACKAGE_NAME}@${revision}`,
         resolvedCommit: revision,
-        installer: 'gh-aw v0.89.21 test',
+        installer: 'gh-aw v0.89.22 test',
         files,
       },
       consumerFiles,
diff --git a/workflows/aw.yml b/workflows/aw.yml
index 1df1c71ca..ede8c37d8 100644
--- a/workflows/aw.yml
+++ b/workflows/aw.yml
@@ -1,5 +1,5 @@
 manifest-version: "1"
-min-version: v0.89.21
+min-version: v0.89.22
 name: Squad Agentic Workflows
 emoji: "🤖"
 description: Complete, integrity-checked Squad workflow bundle for issue-driven planning and implementation.
diff --git a/workflows/package/squad-bootstrap.md b/workflows/package/squad-bootstrap.md
index e112632c3..4990f4782 100644
--- a/workflows/package/squad-bootstrap.md
+++ b/workflows/package/squad-bootstrap.md
@@ -152,7 +152,7 @@ pre-agent-steps:
         node --check "$path" >/dev/null
       }
       # BEGIN GENERATED RESOURCE DIGESTS
-      check_hash "$install_verifier" "40753edd5995c5f7ba058f57fbcc5aff0ccf3341c721b764fa0cf1dc70eba3f1"
+      check_hash "$install_verifier" "cf474be9b04d339f7e7a18c65e776b8a53e84bea5b4b85abfe65ed11f7b782ce"
       check_hash "$cast_validator" "0988e04aeef316f4d7a0107c902bbbcf6538b8899b9fffba5f62150717967685"
       check_hash "$bootstrap_validator" "4fc1bcc79b887bb4f2f78e7eef8693d5c1eaf817d8715ce3c92169934aa225b7"
       # END GENERATED RESOURCE DIGESTS
diff --git a/workflows/shared/squad-install-verifier.mjs b/workflows/shared/squad-install-verifier.mjs
index 63a62f9b0..34d952d10 100644
--- a/workflows/shared/squad-install-verifier.mjs
+++ b/workflows/shared/squad-install-verifier.mjs
@@ -22,7 +22,7 @@ export const PACKAGE_NAME = 'bradygaster/squad/workflows';
 export const PACKAGE_MANIFEST = 'workflows/aw.yml';
 export const CONTRACT_SOURCE = 'workflows/squad-workflows.manifest.json';
 export const CONTRACT_DESTINATION = '.github/aw/squad-workflows.manifest.json';
-export const MIN_GH_AW_VERSION = 'v0.89.21';
+export const MIN_GH_AW_VERSION = 'v0.89.22';
 export const OWNERSHIP_ENTRY_COUNT = 26;
 export const OWNERSHIP_DESTINATION =
   '.github/aw/packages/bradygaster-squad-workflows-3632054824e8.json';
@@ -33,8 +33,8 @@ export const TRIGGER_PROBE_DESTINATION =
 const SHA256_PATTERN = /^[0-9a-f]{64}$/;
 const REVISION_PATTERN = /^[0-9a-f]{40}$/;
 const LOCK_REVISION_PLACEHOLDER = 'f'.repeat(40);
-const COMPILER_ACTION_VERSION = 'v0.89.21';
-const COMPILER_ACTION_SHA = '924af5fdc64061cfbf66fb584c8b07e2ac230c60';
+const COMPILER_ACTION_VERSION = 'v0.89.22';
+const COMPILER_ACTION_SHA = '2fbab69bfca02bebd76cd0fc43f2d12acfed994f';
 const COMPILER_ACTION_REPOS = ['github/gh-aw-actions/setup', 'github/gh-aw-actions/setup-cli'];
 
 function deepFreeze(value) {
@@ -680,8 +680,8 @@ function verifyOwnership(root, contract, expectedRevision) {
   if (record.source !== `${PACKAGE_NAME}@${record.resolvedCommit}`) {
     throw new Error(`Package ownership source must be ${PACKAGE_NAME}@${record.resolvedCommit}.`);
   }
-  if (typeof record.installer !== 'string' || !/^gh-aw v0\.89\.21(?:\b|$)/.test(record.installer)) {
-    throw new Error('Package ownership installer must be gh-aw v0.89.21.');
+  if (typeof record.installer !== 'string' || !/^gh-aw v0\.89\.22(?:\b|$)/.test(record.installer)) {
+    throw new Error('Package ownership installer must be gh-aw v0.89.22.');
   }
   assertArray(record.files, OWNERSHIP_ENTRY_COUNT, 'Package ownership files');
   const expected = expectedOwnership(contract);
@@ -988,7 +988,7 @@ export function writeLocalTestOwnership(root, revision) {
     package: PACKAGE_NAME,
     source: `${PACKAGE_NAME}@${revision}`,
     resolvedCommit: revision,
-    installer: 'gh-aw v0.89.21 local package contract test',
+    installer: 'gh-aw v0.89.22 local package contract test',
     files,
   }));
 }
diff --git a/workflows/skills/gh-aw-enlistment/SKILL.md b/workflows/skills/gh-aw-enlistment/SKILL.md
index 7ac923375..f6ac0e9fe 100644
--- a/workflows/skills/gh-aw-enlistment/SKILL.md
+++ b/workflows/skills/gh-aw-enlistment/SKILL.md
@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
diff --git a/workflows/squad-bootstrap.md b/workflows/squad-bootstrap.md
index 3bc3e9f54..214e740d8 100644
--- a/workflows/squad-bootstrap.md
+++ b/workflows/squad-bootstrap.md
@@ -159,7 +159,7 @@ pre-agent-steps:
         node --check "$path" >/dev/null
       }
       # BEGIN GENERATED RESOURCE DIGESTS
-      check_hash "$install_verifier" "40753edd5995c5f7ba058f57fbcc5aff0ccf3341c721b764fa0cf1dc70eba3f1"
+      check_hash "$install_verifier" "cf474be9b04d339f7e7a18c65e776b8a53e84bea5b4b85abfe65ed11f7b782ce"
       check_hash "$cast_validator" "0988e04aeef316f4d7a0107c902bbbcf6538b8899b9fffba5f62150717967685"
       check_hash "$bootstrap_validator" "4fc1bcc79b887bb4f2f78e7eef8693d5c1eaf817d8715ce3c92169934aa225b7"
       # END GENERATED RESOURCE DIGESTS
diff --git a/workflows/squad-workflows.manifest.json b/workflows/squad-workflows.manifest.json
index f347970b8..8b06c42ee 100644
--- a/workflows/squad-workflows.manifest.json
+++ b/workflows/squad-workflows.manifest.json
@@ -2,7 +2,7 @@
   "schema_version": 2,
   "package": "bradygaster/squad/workflows",
   "manifest": "workflows/aw.yml",
-  "minimum_gh_aw_version": "v0.89.21",
+  "minimum_gh_aw_version": "v0.89.22",
   "revision_policy": {
     "kind": "immutable-git-commit",
     "pattern": "^[0-9a-f]{40}$",
@@ -15,8 +15,8 @@
       "destination": ".github/workflows/squad.md",
       "lock": ".github/workflows/squad.lock.yml",
       "source_sha256": "0f292c576983ac99dace0661e34f900ddd91fcd50f28ff6726eff78704e283f2",
-      "lock_sha256": "32df53558611b35f809ea40a0de0b1b33e4f4dda955400b5387e77f96cb25277",
-      "package_lock_sha256": "a3336602334921327ca585f2321f84547ac2fde94f22178e25dcb029dd1370e6"
+      "lock_sha256": "4fde07528253a2dd0f3aef6fda7bcda6773464d8268f91a4b30c122b8f4ebdad",
+      "package_lock_sha256": "13ce3b90940c358105e2caeeab925570c0f13a522cefc0f35d23b2d81ef81b0d"
     },
     {
       "name": "squad-implement-worker",
@@ -24,8 +24,8 @@
       "destination": ".github/workflows/squad-implement-worker.md",
       "lock": ".github/workflows/squad-implement-worker.lock.yml",
       "source_sha256": "049eabecb2bab774e389fc62c6bde9308f3fb1a923325401cbecc95d63fc2757",
-      "lock_sha256": "d52ab5f6064c62c2951bebe18446b977678ed4d927a8acb64b02303607210fc3",
-      "package_lock_sha256": "6e7883e0e5b5be35a5a3d463dd1a8a3a2c6da6a010e00ea1e16d719718ce4123"
+      "lock_sha256": "2d4113d7f4383289ce7a2e39510c19728ece0efaa51e904feb2b18f6cc377bad",
+      "package_lock_sha256": "687922b8e2c945d7273f75b8faa2252a218e643f6b3e110d286c4a68712577f2"
     },
     {
       "name": "squad-review",
@@ -33,8 +33,8 @@
       "destination": ".github/workflows/squad-review.md",
       "lock": ".github/workflows/squad-review.lock.yml",
       "source_sha256": "545ba959d0e4cfc0ba4cc507c2ed2c0d4b2044ca3b9e20a746c8b39cdc100bef",
-      "lock_sha256": "944dd43831110142a9bb9832ff38d5eb4c0e4df14347781c869fbbccfc0d901f",
-      "package_lock_sha256": "c8a3666ef09a340e9f9c06899b49b95c256979ff6c5c99d671e069b7bcfe3b13"
+      "lock_sha256": "e8cd10cbef0db95cfe05d963eeb683b31a126eb129f1c5be512dd90ad16ca54f",
+      "package_lock_sha256": "928590c67e5636bf08374b62a05797a575990e71c5efd7745da6b73098297130"
     },
     {
       "name": "squad-deps-worker",
@@ -42,8 +42,8 @@
       "destination": ".github/workflows/squad-deps-worker.md",
       "lock": ".github/workflows/squad-deps-worker.lock.yml",
       "source_sha256": "37c4ba60b85c5fc07bef322bbfd0f713472924d55cff9481ae76af7ec0c91fac",
-      "lock_sha256": "d5a8c0b1eb7933bb4bb74499fd9de872b6d55045665f918c831658f8baa20f71",
-      "package_lock_sha256": "98ab08bc22051ef37070dda04e96b4ada333b093696d94e932ac8bdb5860f44d"
+      "lock_sha256": "17ba7712c13826d764149171d4f8144a02d4192f41f65a2a44ed9374f28b4ff5",
+      "package_lock_sha256": "34f62358d3557e8830891df656bdec7d32163d9b9dea692370fe1e6b031da59f"
     },
     {
       "name": "squad-retro",
@@ -51,8 +51,8 @@
       "destination": ".github/workflows/squad-retro.md",
       "lock": ".github/workflows/squad-retro.lock.yml",
       "source_sha256": "92bcfa39cc5fd3087b11612125e314959237c5b79460825453d1e493727a2562",
-      "lock_sha256": "00771decb93b93d04ea9c9e6173c2338eef615e49df0a8ca12729680fa15fc52",
-      "package_lock_sha256": "f9373648d67ce3ef43b941d58cc8ef5d9de1296e85be509e4e0ac0d8788d7b1b"
+      "lock_sha256": "4585bf60fdaa362bfca4edc2cb0c077c5cb17febd7d4a532eafa1a4941b61506",
+      "package_lock_sha256": "d06662da4e437b0697b8ce374b272e4a955d8ab5c077df9e722982c0b8205242"
     },
     {
       "name": "squad-improvement-worker",
@@ -60,17 +60,17 @@
       "destination": ".github/workflows/squad-improvement-worker.md",
       "lock": ".github/workflows/squad-improvement-worker.lock.yml",
       "source_sha256": "01c89f8890f02c0ca884513aa10225787feaf3606ab604d5c0e85fbbccdb6c95",
-      "lock_sha256": "880b7673b022d6155870d87b70e6d6a2489eb7eefec64fcf3515041d5ca5c42e",
-      "package_lock_sha256": "c4d2153cb66bc18e4445d31aad19331adaa06788810a51182558510e1867d263"
+      "lock_sha256": "d5389a54f3c99f8fb01223dc04ea66bb59c32769d1d45b730a35275905c26829",
+      "package_lock_sha256": "3ea27b34eba4685735b3ff9d26175c49d1fc290ef94b947420f2c0378014cf03"
     },
     {
       "name": "squad-bootstrap",
       "source": "workflows/package/squad-bootstrap.md",
       "destination": ".github/workflows/squad-bootstrap.md",
       "lock": ".github/workflows/squad-bootstrap.lock.yml",
-      "source_sha256": "ca2981acbdee8ce1d4ce705b9132e3777ceb63574dd884d6c75af8a8dfe16240",
-      "lock_sha256": "fd1562548a1aace9c57bdf315266da413575ea07da1d4b64c4f6446afc6aefc5",
-      "package_lock_sha256": "8aa7f287d51079746d997e5c5f17e5807efd1dd53de1c403982fcd10de23dfc0"
+      "source_sha256": "9ebc7297c684a591e0c2144d952736077f7bfae1d39974b1d02a1ea624a964c6",
+      "lock_sha256": "2d4cae423240f98791cd983de7029a693f8c6fb8be3fbed2694833ce4c031631",
+      "package_lock_sha256": "1df0be116f7553b122be483cafc1463d3894eeb0ab50327532d4982757d646ea"
     },
     {
       "name": "squad-command-router",
@@ -78,8 +78,8 @@
       "destination": ".github/workflows/squad-command-router.md",
       "lock": ".github/workflows/squad-command-router.lock.yml",
       "source_sha256": "c7e281a1d110f77f54a6f0a5257ecf8edd6f336bc894278d82efff604b03db79",
-      "lock_sha256": "cf1a52369304bb360e210e27a18253f769bd0fcd586220974316f704c69cd130",
-      "package_lock_sha256": "9074ef0d7ebf05ccc84a94fc5460fe2c7a8d1b11f4c28882ced3fd4bad23dd8d"
+      "lock_sha256": "8c380ff780d28750c37cde51bf4dacc840bcfdf5c59f991e4b61a19f24652890",
+      "package_lock_sha256": "b5253772c9e2eb562e0cabac1b9133a63c46d94c446d541de498fbbba9f0134e"
     }
   ],
   "shared_runtime": [
@@ -97,7 +97,7 @@
       "package_destination": ".github/workflows/shared/squad-install-verifier.mjs",
       "destination": ".github/workflows/shared/squad-install-verifier.mjs",
       "ownership": "manifest",
-      "sha256": "40753edd5995c5f7ba058f57fbcc5aff0ccf3341c721b764fa0cf1dc70eba3f1"
+      "sha256": "cf474be9b04d339f7e7a18c65e776b8a53e84bea5b4b85abfe65ed11f7b782ce"
     },
     {
       "path": "shared/squad-command-contract.mjs",
@@ -225,7 +225,7 @@
       "name": "gh-aw-enlistment",
       "source": "workflows/skills/gh-aw-enlistment/SKILL.md",
       "destination": ".github/skills/gh-aw-enlistment/SKILL.md",
-      "sha256": "ea71807972e64343a5d10f1353125b0918461c75a319ca759cd80c81cf339ae6"
+      "sha256": "40bb309ee82f5eccda89b5a264d8c55db010fb97df0f23fa9f738341def0d414"
     }
   ],
   "bootstrap": {

From b545508462ce671015d156173aa62e01ce1a4759 Mon Sep 17 00:00:00 2001
From: Brady Gaster <brady.gaster@gmail.com>
Date: Thu, 1 Oct 2026 02:20:42 -0700
Subject: [PATCH 2/2] fix(gh-aw): preserve bootstrap candidate isolation

Validate candidate bytes from the isolated tree while resolving committed Cast provenance from the trusted checkout. Adds regression coverage for CAO integration issue octodemo/zava-social-cao-ops-20260929111840#26.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .changeset/bright-gh-aw-central-ops.md        |  2 +-
 scripts/validate-gh-aw-cast.mjs               |  8 +++---
 test/gh-aw-bootstrap-workflow.test.ts         | 25 ++++++++++++++++++-
 test/gh-aw-quality.test.ts                    |  6 ++---
 workflows/package/squad-bootstrap.md          |  5 ++--
 workflows/package/squad.md                    |  2 +-
 .../shared/squad-bootstrap-validator.mjs      |  3 ++-
 workflows/shared/squad-cast-validator.mjs     |  8 +++---
 workflows/squad-bootstrap.md                  |  5 ++--
 workflows/squad-workflows.manifest.json       | 16 ++++++------
 workflows/squad.md                            |  2 +-
 11 files changed, 54 insertions(+), 28 deletions(-)

diff --git a/.changeset/bright-gh-aw-central-ops.md b/.changeset/bright-gh-aw-central-ops.md
index 4b13e05be..38591be23 100644
--- a/.changeset/bright-gh-aw-central-ops.md
+++ b/.changeset/bright-gh-aw-central-ops.md
@@ -3,4 +3,4 @@
 "@bradygaster/squad-sdk": patch
 ---
 
-Require gh-aw v0.89.22 across the Squad workflow package, enlistment guidance, integrity contract, CI, and hosted E2E controller for central agentic ops compatibility.
+Require gh-aw v0.89.22 across the Squad workflow package, enlistment guidance, integrity contract, CI, and hosted E2E controller for central agentic ops compatibility. Validate isolated bootstrap candidates against the trusted checkout's Git history so materialization can create the Cast PR and research issue.
diff --git a/scripts/validate-gh-aw-cast.mjs b/scripts/validate-gh-aw-cast.mjs
index 0f6c3a326..eeee7b3c6 100644
--- a/scripts/validate-gh-aw-cast.mjs
+++ b/scripts/validate-gh-aw-cast.mjs
@@ -531,7 +531,7 @@ function committedRegistry(root, errors) {
   }
 }
 
-function parseRegistry(root, errors) {
+function parseRegistry(root, errors, gitRoot = root) {
   let registryRaw;
   let historyRaw;
   try {
@@ -543,7 +543,7 @@ function parseRegistry(root, errors) {
   }
   const registry = parseCastingPair(registryRaw, historyRaw, 'registry', errors);
   if (!registry) return [];
-  const base = committedRegistry(root, errors);
+  const base = committedRegistry(gitRoot, errors);
   if (base) {
     const baseRevision = base.schema === 'squad-agent-provenance/v1' ? base.revision : 0;
     if (registry.revision <= baseRevision) {
@@ -631,7 +631,7 @@ function validateCapabilities(coordinator, active, routingRows, errors) {
   }
 }
 
-export function validateCastTree({ root, payloadPath }) {
+export function validateCastTree({ root, payloadPath, gitRoot = root }) {
   const errors = [];
   let payloadValue;
   try {
@@ -660,7 +660,7 @@ export function validateCastTree({ root, payloadPath }) {
     if (!payload.includes(required)) errors.push(`payload: missing required path ${required}`);
   }
 
-  const active = parseRegistry(root, errors);
+  const active = parseRegistry(root, errors, gitRoot);
   const activeNames = new Set(active.map(({ name }) => name));
   const activeCharters = active.map(({ id }) => `.squad/agents/${id}/charter.md`);
   const expectedPayload = new Set([...CORE_PAYLOAD, ...activeCharters, ...REQUIRED_BUILTIN_CHARTERS]);
diff --git a/test/gh-aw-bootstrap-workflow.test.ts b/test/gh-aw-bootstrap-workflow.test.ts
index b88472327..248416283 100644
--- a/test/gh-aw-bootstrap-workflow.test.ts
+++ b/test/gh-aw-bootstrap-workflow.test.ts
@@ -11,7 +11,7 @@ import {
 } from 'node:fs';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, join, relative, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { parse } from 'yaml';
@@ -31,6 +31,7 @@ import {
   findBootstrapResearchArtifacts,
   isBootstrapResearchSeed,
   reconstructBootstrapPayload,
+  validateBootstrapPayload,
 } from '../workflows/shared/squad-bootstrap-validator.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
@@ -601,6 +602,27 @@ describe('automatic Squad bootstrap workflow', () => {
     const result = validateFixture(fixture);
     expect(result.status, result.stderr).toBe(0);
     expect(result.stdout).toBe('Squad bootstrap validation passed.\n');
+  });
+
+  it('validates an isolated candidate against the trusted checkout Git history', () => {
+    const fixture = createFixture();
+    const candidate = mkdtempSync(join(tmpdir(), 'gh-aw-bootstrap-candidate-'));
+    workspaces.push(candidate);
+    cpSync(fixture.root, candidate, {
+      recursive: true,
+      filter: source => relative(fixture.root, source).split('/')[0] !== '.git',
+    });
+    const options = {
+      root: candidate,
+      payloadPath: join(candidate, 'payload.json'),
+      repository: 'octo/example',
+      defaultBranch: 'main',
+      linkMode: 'placeholder',
+    };
+    expect(validateBootstrapPayload(options)).toContainEqual(
+      expect.stringContaining('registry base: committed HEAD is unavailable'),
+    );
+    expect(validateBootstrapPayload({ ...options, gitRoot: fixture.root })).toEqual([]);
 
     const resolved = {
       ...fixture.payload,
@@ -849,6 +871,7 @@ describe('automatic Squad bootstrap workflow', () => {
     expect(lock).not.toMatch(/"materialize-bootstrap":\{"inputs":\{"payload":/);
     expect(lock).toContain('reconstructBootstrapPayload(items[0])');
     expect(lock).toContain("mkdtempSync(join(tmpdir(), 'squad-bootstrap-candidate-'))");
+    expect(lock).toContain('gitRoot: checkout');
     expect(lock).toContain('Bootstrap payload path crosses a symbolic link');
     expect(lock.indexOf("validate(payload, 'placeholder')"))
       .toBeLessThan(lock.indexOf('safeTarget(checkout, file.path)'));
diff --git a/test/gh-aw-quality.test.ts b/test/gh-aw-quality.test.ts
index 4bbc097c1..b1e8c791e 100644
--- a/test/gh-aw-quality.test.ts
+++ b/test/gh-aw-quality.test.ts
@@ -3961,8 +3961,8 @@ describe('gh-aw: canonical package integrity contract', () => {
       expect(mutable).not.toContain(actionReference);
       expect(createHash('sha256').update(normalizeCompiledLock(mutable, revisionA)).digest('hex'))
         .toBe(sourceBinding === 'workflow'
-          ? '0914fadb4a0f37867840b9394c60f3cd40fb3072dd003518a17efb23718dd632'
-          : 'cac9dea1082405512f66b8efcdb14b554c71e5adc75da158ecc12a0458c7fe52');
+          ? 'a3290dad380577fd6d64c92169b9d74a7f5248851b110d8eafc6260b34f772d9'
+          : 'fd7c735e2de5088954e8d0d647a15e5f95ed5850947f201c1a4ce17433d66632');
       expect(() => validateCompilerActionPins(mutable)).toThrow(/invalid immutable action pin/);
       writeFileSync(lockPath, mutable);
       expect(verifyInstall(root).failures.join('\n'))
@@ -4016,7 +4016,7 @@ describe('gh-aw: canonical package integrity contract', () => {
     compile();
     const unpinned = readText(lockPath);
     expect(createHash('sha256').update(normalizeCompiledLock(unpinned, revisionA)).digest('hex'))
-      .toBe('cac9dea1082405512f66b8efcdb14b554c71e5adc75da158ecc12a0458c7fe52');
+      .toBe('fd7c735e2de5088954e8d0d647a15e5f95ed5850947f201c1a4ce17433d66632');
     expect(verifyInstall(root).failures.join('\n')).toContain('Installed digest mismatch');
 
     const seedPins = () => spawnSync(process.execPath, ['--input-type=module', '-e', seed!], {
diff --git a/workflows/package/squad-bootstrap.md b/workflows/package/squad-bootstrap.md
index 4990f4782..3efb5b0fc 100644
--- a/workflows/package/squad-bootstrap.md
+++ b/workflows/package/squad-bootstrap.md
@@ -153,8 +153,8 @@ pre-agent-steps:
       }
       # BEGIN GENERATED RESOURCE DIGESTS
       check_hash "$install_verifier" "cf474be9b04d339f7e7a18c65e776b8a53e84bea5b4b85abfe65ed11f7b782ce"
-      check_hash "$cast_validator" "0988e04aeef316f4d7a0107c902bbbcf6538b8899b9fffba5f62150717967685"
-      check_hash "$bootstrap_validator" "4fc1bcc79b887bb4f2f78e7eef8693d5c1eaf817d8715ce3c92169934aa225b7"
+      check_hash "$cast_validator" "c6d0b92aac71dc6f6d5727cac418a323b0bc9c12047400faa12d96150d548ada"
+      check_hash "$bootstrap_validator" "6f2ff60104a238c7c171031e737fd8dcb57dd3eeffccbf8c0aeaad016d85ee4e"
       # END GENERATED RESOURCE DIGESTS
       node "$bootstrap_validator" \
         --encode-payload "${GITHUB_WORKSPACE:?}/.github/workflows/squad-bootstrap-payload.json" \
@@ -316,6 +316,7 @@ safe-outputs:
                 writeFileSync(candidatePayloadPath, `${JSON.stringify(candidatePayload)}\n`);
                 const errors = validatorModule.validateBootstrapPayload({
                   root: candidate,
+                  gitRoot: checkout,
                   payloadPath: candidatePayloadPath,
                   repository: context.repo.owner + '/' + context.repo.repo,
                   defaultBranch: process.env.SQUAD_BOOTSTRAP_DEFAULT_BRANCH,
diff --git a/workflows/package/squad.md b/workflows/package/squad.md
index f38dbe3d7..91bed0441 100644
--- a/workflows/package/squad.md
+++ b/workflows/package/squad.md
@@ -840,7 +840,7 @@ pre-agent-steps:
       validator_script="$(cd "$(dirname "$validator_script")" && pwd -P)/$(basename "$validator_script")"
 
       # BEGIN GENERATED RESOURCE DIGEST
-      validator_expected_sha256="0988e04aeef316f4d7a0107c902bbbcf6538b8899b9fffba5f62150717967685"
+      validator_expected_sha256="c6d0b92aac71dc6f6d5727cac418a323b0bc9c12047400faa12d96150d548ada"
       # END GENERATED RESOURCE DIGEST
       : > "$stderr_file"
       validator_actual_sha256="$(
diff --git a/workflows/shared/squad-bootstrap-validator.mjs b/workflows/shared/squad-bootstrap-validator.mjs
index 6f04b8d27..aa7dfc797 100644
--- a/workflows/shared/squad-bootstrap-validator.mjs
+++ b/workflows/shared/squad-bootstrap-validator.mjs
@@ -532,6 +532,7 @@ export function createBootstrapResearchComment(issueBodyText, issueNumber) {
 
 export function validateBootstrapPayload({
   root,
+  gitRoot = root,
   payloadPath,
   repository,
   defaultBranch,
@@ -588,7 +589,7 @@ export function validateBootstrapPayload({
   try {
     const castPayloadPath = join(tempDir, 'cast-paths.json');
     writeFileSync(castPayloadPath, `${JSON.stringify(castPaths)}\n`);
-    errors.push(...validateCastTree({ root, payloadPath: castPayloadPath }));
+    errors.push(...validateCastTree({ root, gitRoot, payloadPath: castPayloadPath }));
   } finally {
     rmSync(tempDir, { recursive: true, force: true });
   }
diff --git a/workflows/shared/squad-cast-validator.mjs b/workflows/shared/squad-cast-validator.mjs
index 0f6c3a326..eeee7b3c6 100644
--- a/workflows/shared/squad-cast-validator.mjs
+++ b/workflows/shared/squad-cast-validator.mjs
@@ -531,7 +531,7 @@ function committedRegistry(root, errors) {
   }
 }
 
-function parseRegistry(root, errors) {
+function parseRegistry(root, errors, gitRoot = root) {
   let registryRaw;
   let historyRaw;
   try {
@@ -543,7 +543,7 @@ function parseRegistry(root, errors) {
   }
   const registry = parseCastingPair(registryRaw, historyRaw, 'registry', errors);
   if (!registry) return [];
-  const base = committedRegistry(root, errors);
+  const base = committedRegistry(gitRoot, errors);
   if (base) {
     const baseRevision = base.schema === 'squad-agent-provenance/v1' ? base.revision : 0;
     if (registry.revision <= baseRevision) {
@@ -631,7 +631,7 @@ function validateCapabilities(coordinator, active, routingRows, errors) {
   }
 }
 
-export function validateCastTree({ root, payloadPath }) {
+export function validateCastTree({ root, payloadPath, gitRoot = root }) {
   const errors = [];
   let payloadValue;
   try {
@@ -660,7 +660,7 @@ export function validateCastTree({ root, payloadPath }) {
     if (!payload.includes(required)) errors.push(`payload: missing required path ${required}`);
   }
 
-  const active = parseRegistry(root, errors);
+  const active = parseRegistry(root, errors, gitRoot);
   const activeNames = new Set(active.map(({ name }) => name));
   const activeCharters = active.map(({ id }) => `.squad/agents/${id}/charter.md`);
   const expectedPayload = new Set([...CORE_PAYLOAD, ...activeCharters, ...REQUIRED_BUILTIN_CHARTERS]);
diff --git a/workflows/squad-bootstrap.md b/workflows/squad-bootstrap.md
index 214e740d8..8143736be 100644
--- a/workflows/squad-bootstrap.md
+++ b/workflows/squad-bootstrap.md
@@ -160,8 +160,8 @@ pre-agent-steps:
       }
       # BEGIN GENERATED RESOURCE DIGESTS
       check_hash "$install_verifier" "cf474be9b04d339f7e7a18c65e776b8a53e84bea5b4b85abfe65ed11f7b782ce"
-      check_hash "$cast_validator" "0988e04aeef316f4d7a0107c902bbbcf6538b8899b9fffba5f62150717967685"
-      check_hash "$bootstrap_validator" "4fc1bcc79b887bb4f2f78e7eef8693d5c1eaf817d8715ce3c92169934aa225b7"
+      check_hash "$cast_validator" "c6d0b92aac71dc6f6d5727cac418a323b0bc9c12047400faa12d96150d548ada"
+      check_hash "$bootstrap_validator" "6f2ff60104a238c7c171031e737fd8dcb57dd3eeffccbf8c0aeaad016d85ee4e"
       # END GENERATED RESOURCE DIGESTS
       node "$bootstrap_validator" \
         --encode-payload "${GITHUB_WORKSPACE:?}/.github/workflows/squad-bootstrap-payload.json" \
@@ -307,6 +307,7 @@ safe-outputs:
                 writeFileSync(candidatePayloadPath, `${JSON.stringify(candidatePayload)}\n`);
                 const errors = validatorModule.validateBootstrapPayload({
                   root: candidate,
+                  gitRoot: checkout,
                   payloadPath: candidatePayloadPath,
                   repository: context.repo.owner + '/' + context.repo.repo,
                   defaultBranch: process.env.SQUAD_BOOTSTRAP_DEFAULT_BRANCH,
diff --git a/workflows/squad-workflows.manifest.json b/workflows/squad-workflows.manifest.json
index 8b06c42ee..18e8c369e 100644
--- a/workflows/squad-workflows.manifest.json
+++ b/workflows/squad-workflows.manifest.json
@@ -14,9 +14,9 @@
       "source": "workflows/package/squad.md",
       "destination": ".github/workflows/squad.md",
       "lock": ".github/workflows/squad.lock.yml",
-      "source_sha256": "0f292c576983ac99dace0661e34f900ddd91fcd50f28ff6726eff78704e283f2",
-      "lock_sha256": "4fde07528253a2dd0f3aef6fda7bcda6773464d8268f91a4b30c122b8f4ebdad",
-      "package_lock_sha256": "13ce3b90940c358105e2caeeab925570c0f13a522cefc0f35d23b2d81ef81b0d"
+      "source_sha256": "f86eb83a75c6de63edf520bf21ca2b50fcb9c6e7c5a60ecbd92a527a108a19af",
+      "lock_sha256": "b11d0ef4a4cc067f71d6e4fae218fa7689609b1c689effc72cd689b1e363c4bc",
+      "package_lock_sha256": "e2129810e4a6ae01a0802cd22cd8c80e81fb3e6722ed1dcd2ba0a62ad48d5c49"
     },
     {
       "name": "squad-implement-worker",
@@ -68,9 +68,9 @@
       "source": "workflows/package/squad-bootstrap.md",
       "destination": ".github/workflows/squad-bootstrap.md",
       "lock": ".github/workflows/squad-bootstrap.lock.yml",
-      "source_sha256": "9ebc7297c684a591e0c2144d952736077f7bfae1d39974b1d02a1ea624a964c6",
-      "lock_sha256": "2d4cae423240f98791cd983de7029a693f8c6fb8be3fbed2694833ce4c031631",
-      "package_lock_sha256": "1df0be116f7553b122be483cafc1463d3894eeb0ab50327532d4982757d646ea"
+      "source_sha256": "9cccdec152866720f99452b77fc0407b6a308e86e22f4091b50d844eb40b4fa7",
+      "lock_sha256": "96a02f7d5837e9753eacae9fbf99658fedf96f33f40ce164e5da9fbb8a283058",
+      "package_lock_sha256": "33bc16d47c98b27de5fb3a9931437a43d6e8dcde60b1b15ba29214b42256a235"
     },
     {
       "name": "squad-command-router",
@@ -113,7 +113,7 @@
       "package_destination": ".github/workflows/shared/squad-cast-validator.mjs",
       "destination": ".github/workflows/shared/squad-cast-validator.mjs",
       "ownership": "manifest",
-      "sha256": "0988e04aeef316f4d7a0107c902bbbcf6538b8899b9fffba5f62150717967685"
+      "sha256": "c6d0b92aac71dc6f6d5727cac418a323b0bc9c12047400faa12d96150d548ada"
     },
     {
       "path": "shared/squad-bootstrap-validator.mjs",
@@ -121,7 +121,7 @@
       "package_destination": ".github/workflows/shared/squad-bootstrap-validator.mjs",
       "destination": ".github/workflows/shared/squad-bootstrap-validator.mjs",
       "ownership": "manifest",
-      "sha256": "4fc1bcc79b887bb4f2f78e7eef8693d5c1eaf817d8715ce3c92169934aa225b7"
+      "sha256": "6f2ff60104a238c7c171031e737fd8dcb57dd3eeffccbf8c0aeaad016d85ee4e"
     },
     {
       "path": "shared/squad-improvement-gate.mjs",
diff --git a/workflows/squad.md b/workflows/squad.md
index d7ab39723..284b4b267 100644
--- a/workflows/squad.md
+++ b/workflows/squad.md
@@ -152,7 +152,7 @@ pre-agent-steps:
       validator_script="$(cd "$(dirname "$validator_script")" && pwd -P)/$(basename "$validator_script")"
 
       # BEGIN GENERATED RESOURCE DIGEST
-      validator_expected_sha256="0988e04aeef316f4d7a0107c902bbbcf6538b8899b9fffba5f62150717967685"
+      validator_expected_sha256="c6d0b92aac71dc6f6d5727cac418a323b0bc9c12047400faa12d96150d548ada"
       # END GENERATED RESOURCE DIGEST
       : > "$stderr_file"
       validator_actual_sha256="$(