From b9c68afeb80fecc4e21276c5a7dd5df3042a8e66 Mon Sep 17 00:00:00 2001
From: Brady Gaster <brady.gaster@gmail.com>
Date: Thu, 1 Oct 2026 02:33:46 -0700
Subject: [PATCH] fix(gh-aw): preserve review provenance marker

Describe the implementation marker without a literal HTML comment so gh-aw retains the exact regex in compiled reviewer prompts. Adds compiled-artifact regression coverage for octodemo/zava-social-cao-ops-20260929111840#20.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 test/gh-aw-review-workflow.test.ts      | 9 ++++++++-
 workflows/package/squad-review.md       | 5 +++--
 workflows/squad-review.md               | 5 +++--
 workflows/squad-workflows.manifest.json | 6 +++---
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/test/gh-aw-review-workflow.test.ts b/test/gh-aw-review-workflow.test.ts
index 7a05c834c..ebe430c6e 100644
--- a/test/gh-aw-review-workflow.test.ts
+++ b/test/gh-aw-review-workflow.test.ts
@@ -442,9 +442,11 @@ describe('gh-aw enforcing Squad reviewer', () => {
   });
 
   it('enforces attribution priority and refuses malformed or unattributed automatic provenance', () => {
+    expect(REVIEWER).toContain('Build its exact regular expression by concatenating');
     expect(REVIEWER).toContain(
-      '^<!-- squad:implement issue=([1-9][0-9]*) run=([1-9][0-9]*) -->$',
+      '`^<`, then\n`!-- squad:implement issue=([1-9][0-9]*) run=([1-9][0-9]*) --`, then `>$`',
     );
+    expect(REVIEWER).not.toContain('^<!-- squad:implement');
     expect(REVIEWER).toContain('require exactly one marker-like occurrence');
     expect(REVIEWER).toContain('^squad/implement-{captured-issue}-');
     assertReviewerContract(REVIEWER);
@@ -496,6 +498,11 @@ describe('gh-aw enforcing Squad reviewer', () => {
   it('strict-compiles to read-only agent permissions and an always-running final gate', () => {
     const { lock, safeOutputs } = compileReviewer();
     assertCompiledGate(lock);
+    expect(lock).toContain('Build its exact regular expression by concatenating');
+    expect(lock).toContain(
+      '`^<`, then\\n`!-- squad:implement issue=([1-9][0-9]*) run=([1-9][0-9]*) --`, then `>$`',
+    );
+    expect(lock).not.toContain('body line matching\\n`^$`');
     const agentJob = lock.match(/^  agent:\n([\s\S]*?)(?=^  [\w-]+:\n)/m)?.[1] ?? '';
     const permissionBlock = yamlBlock(agentJob, 'permissions');
     const workflow = parse(lock);
diff --git a/workflows/package/squad-review.md b/workflows/package/squad-review.md
index c4ab6dfc3..00b831465 100644
--- a/workflows/package/squad-review.md
+++ b/workflows/package/squad-review.md
@@ -205,8 +205,9 @@ priority evidence.
 | 4 | None of the above | Unattributed |
 
 The durable marker schema from the implement worker is exactly one standalone
-body line matching
-`^<!-- squad:implement issue=([1-9][0-9]*) run=([1-9][0-9]*) -->$`.
+body line. Build its exact regular expression by concatenating these three
+fragments with no added whitespace: `^<`, then
+`!-- squad:implement issue=([1-9][0-9]*) run=([1-9][0-9]*) --`, then `>$`.
 Normalize CRLF to LF before testing lines. Marker-like text means any occurrence
 of `squad:implement` anywhere in the body.
 
diff --git a/workflows/squad-review.md b/workflows/squad-review.md
index 63b0d00d0..17f66f513 100644
--- a/workflows/squad-review.md
+++ b/workflows/squad-review.md
@@ -195,8 +195,9 @@ priority evidence.
 | 4 | None of the above | Unattributed |
 
 The durable marker schema from the implement worker is exactly one standalone
-body line matching
-`^<!-- squad:implement issue=([1-9][0-9]*) run=([1-9][0-9]*) -->$`.
+body line. Build its exact regular expression by concatenating these three
+fragments with no added whitespace: `^<`, then
+`!-- squad:implement issue=([1-9][0-9]*) run=([1-9][0-9]*) --`, then `>$`.
 Normalize CRLF to LF before testing lines. Marker-like text means any occurrence
 of `squad:implement` anywhere in the body.
 
diff --git a/workflows/squad-workflows.manifest.json b/workflows/squad-workflows.manifest.json
index 18e8c369e..a29fdcf8d 100644
--- a/workflows/squad-workflows.manifest.json
+++ b/workflows/squad-workflows.manifest.json
@@ -32,9 +32,9 @@
       "source": "workflows/package/squad-review.md",
       "destination": ".github/workflows/squad-review.md",
       "lock": ".github/workflows/squad-review.lock.yml",
-      "source_sha256": "545ba959d0e4cfc0ba4cc507c2ed2c0d4b2044ca3b9e20a746c8b39cdc100bef",
-      "lock_sha256": "e8cd10cbef0db95cfe05d963eeb683b31a126eb129f1c5be512dd90ad16ca54f",
-      "package_lock_sha256": "928590c67e5636bf08374b62a05797a575990e71c5efd7745da6b73098297130"
+      "source_sha256": "a596d69081c6026f358f88352fb94b91bfc40335a68e94f7d73b7d20ce5e898f",
+      "lock_sha256": "d1d3ac5004188940f27015e696460294c370521bf34555783ebee9216cc5f907",
+      "package_lock_sha256": "a9d47ef3743e21083f7f63a3404d6dbb93003c6cc6c546613c1ff897dc38f44e"
     },
     {
       "name": "squad-deps-worker",