[bradygaster]

What

Make the public Squad gh-aw quick start and every shipped enlistment mirror prove exactly v0.89.22, cleanly remove and reinstall the exact pin on mismatch, and stop before branch creation or repository artifact generation when the supported compiler cannot be verified. Add executable contract coverage for stderr version output, an existing v0.89.21 binary, exact-version success, and persistent mismatch, plus the updated integrity digest and patch changeset.

Why

gh extension install --force --pin v0.89.22 github/gh-aw can report success while retaining an older binary, and gh-aw v0.89.22 may write version output to stderr. The public setup path must fail closed instead of generating trusted repository files with an unproven compiler.

Closes #2129

How

• Capture gh aw --version with 2>&1 and compare the parsed version exactly to v0.89.22.
• On any mismatch, remove gh-aw, install only the exact v0.89.22 pin, and verify again.
• Exit before runtime repository discovery, branch creation, or gh aw add when the second verification fails.
• Keep the canonical guide and all five distributed skill copies byte-identical through the existing mirror contract, and refresh the package manifest digest.
• Validate with:
  • npm test -- --run test/gh-aw-enlistment-skill.test.ts test/gh-aw-install-staging.test.ts test/gh-aw-quality.test.ts test/gh-aw-bootstrap-workflow.test.ts test/gh-aw-review-guard.test.ts test/gh-aw-review-workflow.test.ts test/standalone-release-workflow.test.ts — passed, 640 tests.
  • npm test -- --run test/gh-aw-activation-label-provisioning.test.ts test/gh-aw-activation-summary-outcomes.test.ts test/gh-aw-activation-capacity.test.ts test/gh-aw-activate-fast-path-label-provisioning.test.ts test/gh-aw-activation-temporary-ids.test.ts test/gh-aw-security-scan.test.ts test/gh-aw-deps-worker-workflow.test.ts — passed, 151 tests, including real gh-aw compilation contracts.
  • npm run gh-aw:integrity:check — passed.
  • npm run lint — passed.
  • npm run build — passed.
  • npm run lint:eslint — passed with existing warnings.
  • ./node_modules/.bin/cspell --no-progress docs/src/content/docs/guide/gh-aw.md — passed.
  • npm run docs:build — passed after restoring docs dependencies through the required npm proxy.
  • Independent code review — no actionable findings.
• Full npm test completed 9,943 passing tests, 40 skipped, and 47 todo, but reported six unrelated worktree-sensitive failures plus local Aspire health and npm packaging environment failures. Repository-wide npm run lint:docs is also blocked by 18 pre-existing generated API-reference lint errors outside this diff.

---

⚠️ Quick Check

• If SDK/CLI source files changed: completed the applicable Changeset step below (npx changeset add / .changeset/*.md, direct CHANGELOG.md entry for maintainers, or skip-changelog label for no user-facing changes)

PR Readiness Checklist

The PR readiness bot will validate these automatically after push.
Check each item before requesting review. See CONTRIBUTING.md for full details.

Branch & Commit

• Branch created from dev (not main)
• Branch is up to date with dev (git fetch upstream && git rebase upstream/dev)
• Verified diff contains only intended changes (git diff --cached --stat)
• PR is not in draft mode (mark ready when checks pass)
• Commit history is clean (squash fixups before review)

Build & Test

• npm run build passes
• npm test passes (all tests green)
• npm run lint passes (type check clean)
• npm run lint:eslint passes
• For migration PRs (>20 files): include test output summary in PR description

Changeset

• Changeset added via npx changeset add (if packages/squad-sdk/src/ or packages/squad-cli/src/ changed)
• Or direct CHANGELOG.md entry (maintainers only — write-protected for external contributors)
• Or skip-changelog label applied (if no user-facing changes)

Docs

• README section updated (if new feature/module) — N/A; no README-facing surface changed.
• Docs feature page (if new user-facing capability)

Exports

• package.json subpath exports updated (if new module) — N/A; no exports changed.

---

Breaking Changes

None.

Waivers

Waiver requested: local full npm test green status. The focused gh-aw suites pass; remaining failures are unrelated worktree-sensitive tests and local Aspire/npm packaging environment failures. Hosted required checks must pass before merge.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 52fa2a3

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	Changeset file found
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (9 files, +290 −41)

File	+/−
.changeset/exact-gh-aw-enlistment-version.md	+8 −0
.squad-templates/skills/gh-aw-enlistment/SKILL.md	+30 −7
docs/src/content/docs/guide/gh-aw.md	+24 −3
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md	+30 −7
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md	+30 −7
templates/skills/gh-aw-enlistment/SKILL.md	+30 −7
test/gh-aw-enlistment-skill.test.ts	+107 −2
workflows/skills/gh-aw-enlistment/SKILL.md	+30 −7
workflows/squad-workflows.manifest.json	+1 −1

Total: +290 −41

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🟠 Impact Analysis — PR #2130

Risk tier: 🟠 HIGH

📊 Summary

Metric	Count
Files changed	9
Files added	1
Files modified	8
Files deleted	0
Modules touched	6

🎯 Risk Factors

• 9 files changed (6-20 → MEDIUM)
• 6 modules touched (5-8 → HIGH)

📦 Modules Affected

docs (1 file)

• docs/src/content/docs/guide/gh-aw.md

root (4 files)

• .changeset/exact-gh-aw-enlistment-version.md
• templates/skills/gh-aw-enlistment/SKILL.md
• workflows/skills/gh-aw-enlistment/SKILL.md
• workflows/squad-workflows.manifest.json

squad-cli (1 file)

• packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md

squad-sdk (1 file)

• packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md

templates (1 file)

• .squad-templates/skills/gh-aw-enlistment/SKILL.md

tests (1 file)

• test/gh-aw-enlistment-skill.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The implementation is coherent, but the incomplete full test run and requested waiver require final human review.

Review effort: Balanced
Findings: None

What changed in this PR

Adds fail-closed verification that gh-aw is exactly v0.89.22 before generating repository artifacts.

Changes:

• Reinstalls and rechecks gh-aw on version mismatch.
• Synchronizes all enlistment skill mirrors and integrity digest.
• Adds executable coverage for success, mismatch, stderr, and persistent failure paths.

File	Description
.changeset/​exact-gh-aw-enlistment-version.md	Records CLI and SDK patch changes.
.squad-templates/​skills/​gh-aw-enlistment/​SKILL.md	Updates the canonical enlistment gate.
docs/​src/​content/​docs/​guide/​gh-aw.md	Updates the public quick start.
packages/​squad-cli/​templates/​skills/​gh-aw-enlistment/​SKILL.md	Synchronizes the CLI template.
packages/​squad-sdk/​templates/​skills/​gh-aw-enlistment/​SKILL.md	Synchronizes the SDK template.
templates/​skills/​gh-aw-enlistment/​SKILL.md	Synchronizes the root template.
test/​gh-aw-enlistment-skill.test.ts	Adds executable version-gate contracts.
workflows/​skills/​gh-aw-enlistment/​SKILL.md	Synchronizes the workflow package skill.
workflows/​squad-workflows.manifest.json	Refreshes the verified skill digest.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[bradygaster]

Hosted merge blocker: the required test job failed twice solely because test/aspire-integration.test.ts could not observe http://localhost:18888 becoming healthy within 60 seconds. Each run completed 9,983 passing tests, 6 skipped, and 47 todo; all other hosted checks passed. Per the no-merge-on-failing-check requirement, this PR remains unmerged pending resolution of the Aspire runner health failure.