fix(test): raise Aspire dashboard health-check timeout to absorb CI runner contention by bradygaster · Pull Request #2132 · github/squad

bradygaster · 2026-10-01T16:01:40Z

What

Pins the test/aspire-integration.test.ts Aspire dashboard Docker image from the floating :latest tag to the verified-good patch tag mcr.microsoft.com/dotnet/aspire-dashboard:13.5.2, and adds docker inspect/docker logs diagnostics plus timeout headroom for future triage.

Why

Separate, scoped CI-reliability fix spun out of the investigation into a reproducible failure blocking #2123. Two independent test job runs on #2123 failed solely in aspire-integration.test.ts's beforeAll with a "dashboard not healthy within 60000ms" timeout (e.g. run 36884246606 / job 110450721729). #2123's diff does not touch this test.

Root cause (confirmed via live CI + MCR registry forensics, superseding an earlier CPU-contention hypothesis that did not hold up):

With better failure diagnostics (see "How" below), CI logs showed the dashboard container was not slow — it was crashing immediately: exited (exitCode=145), with stderr showing /app/Aspire.Dashboard.dll does not exist / No .NET SDKs were found. No timeout, however large, could fix a container that crashes on start.
Compared the pulled image's digest across runs: mcr.microsoft.com/dotnet/aspire-dashboard:latest and the major-version tag :13 currently resolve to the identical digest (sha256:239e58494bd6...) — i.e. :13 is also a floating tag, not a safe pin as initially assumed.
Fetched manifests directly from MCR's registry API (/v2/dotnet/aspire-dashboard/manifests/<tag>, no local Docker needed) for several tags. 13.6.0-amd64 (what :latest/:13 currently point to) has a created timestamp of 2026-10-01T08:36:26Z — hours before the failing CI runs — and shares :latest's broken digest/layers. 13.5.2-amd64 has completely different layer digests and a created timestamp of 2026-09-12, three weeks earlier.
Conclusion: the newest upstream release (13.6.0, currently aliased by both :latest and :13) appears to have a packaging defect where the compiled dashboard DLL is missing from the published image. 13.5.2 is a distinct, older, unaffected build.
Verified the fix works: re-ran CI pinned to :13.5.2 — docker pull resolved a different digest (sha256:0ef531119b80...), and test/aspire-integration.test.ts's all 5 tests (including both Aspire-dashboard tests) passed in ~16s. See the test job on this PR's own CI run for the full log.

This cross-branch, cross-PR reproduction of the identical crash — with no change to the test file on #2123 — rules out a #2123-specific regression; it was a transient breakage in Microsoft's published Aspire dashboard image, not a flaky/contended test.

How

Added a DASHBOARD_IMAGE constant pinned to mcr.microsoft.com/dotnet/aspire-dashboard:13.5.2 (replacing two hardcoded :latest references) used by both the docker pull and docker run calls.
Removed --rm from the dashboard docker run so a crashed container survives long enough for failure-path docker inspect/docker logs diagnostics to run (relying on the suite's existing explicit removeContainer() cleanup instead of --rm).
Captured container stderr in the docker logs diagnostics call (2>&1) — .NET unhandled-exception output goes to stderr and was previously silently dropped, which is what hid the real crash reason behind an apparent plain timeout.
Raised isDockerAvailable()'s docker info timeout from 5s to 20s in test/helpers/skip-guards.ts to prevent a false "Docker unavailable, skip suite" under CI CPU contention (which would otherwise look like a false pass).
Raised the dashboard health-check timeout to 120s (and the beforeAll hook budget to 300s, widened further after review feedback to leave margin above the bounded pull/health-check phases for diagnostics and browser launch) as defense-in-depth for genuine slow-start scenarios, independent of the image-pinning fix above.
No assertions or skip conditions were changed; the test's actual behavior/coverage is unchanged.

This is a standalone CI-reliability workstream; tracked by #2133 (Closes #2133). Does not modify #2123.

⚠️ Quick Check

No SDK/CLI source files changed (test-only change) — changeset not required.

PR Readiness Checklist

Branch & Commit

Branch created from dev (not main)
Branch is up to date with dev
Verified diff contains only intended changes (git diff origin/dev...HEAD --stat → 2 files: test/aspire-integration.test.ts, test/helpers/skip-guards.ts)
PR is not in draft mode
Commit history: 2 commits (image-pin + diagnostics fix, then a follow-up addressing review feedback and adding the issue reference below)

Build & Test

npm run build passes
npm test passes — does NOT pass cleanly in this local sandbox, for reasons unrelated to this change. Latest local run: Test Files 32 failed | 288 passed | 1 skipped (321), Tests 381 failed | 9572 passed | 31 skipped | 47 todo. All local failures are pre-existing Windows-only issues (e.g. test/scripts/check-squad-leakage.test.ts / repo-health-comment-transport.test.ts writing fixture filenames with characters Windows rejects), reproducible on dev with this change reverted. test/aspire-integration.test.ts itself reports as skipped locally (dockerSkipReason() guard trips because this sandbox's Docker daemon backend isn't actually running), so the Docker/dashboard code path this PR touches was not exercised locally. It was validated instead on this PR's own CI test job (ubuntu-latest, real Docker daemon): pulled :13.5.2 (digest sha256:0ef531119b80..., distinct from the broken sha256:239e58494bd6...), and all 5 tests in aspire-integration.test.ts passed in ~16s — see that job's log for the full transcript.
npm run lint passes (type check clean)
npm run lint:eslint passes (0 errors; pre-existing warnings elsewhere in the repo, none introduced by this change)
For migration PRs (>20 files): N/A — 2 files changed

Changeset

N/A — only test/aspire-integration.test.ts and test/helpers/skip-guards.ts changed, no packages/squad-sdk/src/ or packages/squad-cli/src/ changes.

Docs

N/A — no user-facing change.

Exports

N/A — no new modules.

Breaking Changes

None.

Waivers

Waived (requested): npm test passes locally — reason: this sandbox has no running Docker daemon backend, so the Aspire suite skips via its existing guard rather than exercising the changed code path; the ~381 unrelated local failures are pre-existing Windows-filename-character issues in two unrelated test files, confirmed present on dev independent of this change. The real CI test job (ubuntu-latest, real Docker) was used as the pass/fail signal instead, and is now green with the Aspire suite genuinely exercised (pull + container start + health check + 5 passing tests). Approved by: pending reviewer/Lead sign-off.
Resolved: commit/PR issue reference — a tracking issue, #2133, was filed for this fix instead of waiving the policy. The follow-up commit references Closes #2133. No waiver needed for this item anymore.

github-actions · 2026-10-01T16:01:53Z

🟢 Impact Analysis — PR #2132

Risk tier: 🟢 LOW

📊 Summary

Metric	Count
Files changed	2
Files added	0
Files modified	2
Files deleted	0
Modules touched	1

🎯 Risk Factors

2 files changed (≤5 → LOW)
1 module(s) touched (≤1 → LOW)

📦 Modules Affected

tests (2 files)

test/aspire-integration.test.ts
test/helpers/skip-guards.ts

This report is generated automatically for every PR. See #733 for details.

github-actions · 2026-10-01T16:02:01Z

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit e3a087b

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	0 active Copilot thread(s) resolved (2 outdated skipped)
❌	CI passing	9 check(s) failing: samples-build, sdk-exports-validation, Policy Gates, docs-quality, test, gh-aw strict compile, Shebang EOL, changes, Changeset Drift

Files Changed (2 files, +49 −11)

File	+/−
`test/aspire-integration.test.ts`	+41 −10
`test/helpers/skip-guards.ts`	+8 −1

Total: +49 −11

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

Copilot

Copilot review overview

🟡 Changes recommended

Auto-removal prevents crash diagnostics, and the hook timeout does not leave the documented overhead.

Review effort: Balanced
Findings: 2

Open (2)

--rm deletes crashed container before diagnostics run · New
Hook budget is too short for bounded startup phases · New

What changed in this PR

Raises Aspire dashboard startup timeouts and adds failure diagnostics for CI contention.

Changes:

Doubles the health-check timeout.
Adds container state and log diagnostics.
Extends the setup hook budget.

File	Description
`test/aspire-integration.test.ts`	Adjusts Aspire integration-test startup handling and diagnostics.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Root cause of the #2123/#2132 Aspire integration test CI failures was NOT CPU contention: the `:latest` tag for mcr.microsoft.com/dotnet/aspire-dashboard was transiently broken upstream. The pulled image container exited immediately (exitCode=145) because /app/Aspire.Dashboard.dll was missing from the image, so the dashboard health check could never succeed no matter the timeout. Fix: pin docker pull/run to the documented stable tag `:13` instead of the floating `:latest`, avoiding exposure to in-flight/incomplete upstream builds. Diagnostics hardening made while chasing this down (kept, as they are independently valuable for any future flake in this suite): - Removed --rm from the dashboard `docker run` so a crashed container survives long enough for failure-path `docker inspect`/`docker logs` diagnostics to run (relying on existing explicit removeContainer() cleanup instead). - Captured container stderr in the `docker logs` diagnostics call (`2>&1`), since .NET unhandled-exception output goes to stderr and was previously silently dropped, hiding the real crash reason. - Raised isDockerAvailable()'s `docker info` timeout from 5s to 20s to prevent false-skip of the whole Docker-dependent suite under CI CPU contention (which would otherwise look like a false pass). - Raised the dashboard health-check timeout to 120s as defense-in-depth against genuine contention-induced slow starts, independent of the image-pinning fix above. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Root cause of the #2123/#2132 Aspire integration test CI failures was NOT CPU contention: `mcr.microsoft.com/dotnet/aspire-dashboard:latest` (and the major-version tag `:13`, confirmed to currently resolve to the identical freshly-published `13.6.0` build/digest) is broken — the container exits immediately (exitCode=145) because /app/Aspire.Dashboard.dll is missing from the image, so the dashboard health check can never succeed no matter the timeout. Fix: pin docker pull/run to `:13.5.2`, a distinct ~3-week-older build (different layer digests, verified via the MCR manifest API) that predates the broken `13.6.0` release and does not exhibit the missing-DLL problem. Diagnostics hardening made while chasing this down (kept, as they are independently valuable for any future flake in this suite): - Removed --rm from the dashboard `docker run` so a crashed container survives long enough for failure-path `docker inspect`/`docker logs` diagnostics to run (relying on existing explicit removeContainer() cleanup instead). - Captured container stderr in the `docker logs` diagnostics call (`2>&1`), since .NET unhandled-exception output goes to stderr and was previously silently dropped, hiding the real crash reason. - Raised isDockerAvailable()'s `docker info` timeout from 5s to 20s to prevent false-skip of the whole Docker-dependent suite under CI CPU contention (which would otherwise look like a false pass). - Raised the dashboard health-check timeout to 120s as defense-in-depth against genuine contention-induced slow starts, independent of the image-pinning fix above. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Addresses reviewer feedback on PR #2132: - The 240s beforeAll hook budget had zero margin above the bounded 120s docker-pull timeout + 120s health-check timeout, so Vitest could abort the hook with a generic timeout before waitForHealthy's more informative crash diagnostics could be thrown. Widened to 300s (~60s margin for container startup, diagnostics collection, and Playwright browser launch). - The --rm-vs-diagnostics concern on the same thread was already resolved in a prior commit (docker run no longer passes --rm); no further change needed there. Also trims two overly verbose/speculative inline comments (image-pin rationale, health-check rationale) down to the essential facts. Closes #2133

…es reviewer feedback on PR #2132: - The 240s beforeAll hook budget had zero margin above the bounded 120s docker-pull timeout + 120s health-check timeout, so Vitest could abort the hook with a generic timeout before waitForHealthy's more informative crash diagnostics could be thrown. Widened to 300s (~60s margin for container startup, diagnostics collection, and Playwright browser launch). - The --rm-vs-diagnostics concern on the same thread was already resolved in a prior commit (docker run no longer passes --rm); no further change needed there. Also trims two overly verbose/speculative inline comments (image-pin rationale, health-check rationale) down to the essential facts. Closes #2133 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Addresses reviewer feedback on PR #2132: - The 240s beforeAll hook budget had zero margin above the bounded 120s docker-pull timeout + 120s health-check timeout, so Vitest could abort the hook with a generic timeout before waitForHealthy's more informative crash diagnostics could be thrown. Widened to 300s (~60s margin for container startup, diagnostics collection, and Playwright browser launch). - The --rm-vs-diagnostics concern on the same thread was already resolved in a prior commit (docker run no longer passes --rm); no further change needed there. Also trims two overly verbose/speculative inline comments (image-pin rationale, health-check rationale) down to the essential facts. Closes #2133 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* deps: Bump devalue from 5.8.1 to 5.9.2 in /docs (#2055) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](https://github.com/sveltejs/devalue/compare/v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com> * deps: Bump the minor-patch group across 1 directory with 2 updates (#2058) Bumps the minor-patch group with 2 updates in the /docs directory: [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `@astrojs/markdown-remark` from 7.3.0 to 7.3.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.3.1/packages/markdown/remark) Updates `astro` from 7.3.1 to 7.3.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.3/packages/astro) --- updated-dependencies: - dependency-name: "@astrojs/markdown-remark" dependency-version: 7.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: astro dependency-version: 7.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com> * deps: Bump the microsoft-packages group with 2 updates (#2059) Bumps Microsoft.Agents.AI.GitHub.Copilot from 1.20.0 to 1.22.0 Bumps Microsoft.Extensions.AI from 10.9.0 to 10.10.0 --- updated-dependencies: - dependency-name: Microsoft.Agents.AI.GitHub.Copilot dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft-packages - dependency-name: Microsoft.Extensions.AI dependency-version: 10.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft-packages ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com> * deps: Bump GitHub.Copilot.SDK from 1.0.13 to 1.0.14 (#2060) --- updated-dependencies: - dependency-name: GitHub.Copilot.SDK dependency-version: 1.0.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com> * deps: Bump the minor-patch group across 1 directory with 6 updates (#2062) Bumps the minor-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.2.2` | `10.3.3` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.1` | `15.0.2` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.6.1` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [@github/copilot-sdk](https://github.com/github/copilot-sdk) | `1.0.13` | `1.0.14` | Updates `cspell` from 10.2.2 to 10.3.3 - [Release notes](https://github.com/streetsidesoftware/cspell/releases) - [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md) - [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.3.3/packages/cspell) Updates `markdown-it` from 15.0.1 to 15.0.2 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](https://github.com/markdown-it/markdown-it/compare/15.0.1...15.0.2) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/node` from 26.5.0 to 26.6.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@github/copilot-sdk` from 1.0.13 to 1.0.14 - [Release notes](https://github.com/github/copilot-sdk/releases) - [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/copilot-sdk/compare/v1.0.13...v1.0.14) --- updated-dependencies: - dependency-name: cspell dependency-version: 10.3.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: markdown-it dependency-version: 15.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@types/node" dependency-version: 26.6.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@github/copilot-sdk" dependency-version: 1.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com> * docs: require Issues before gh-aw install Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: add gh-aw enlistment changeset Add patch release metadata for the CLI and SDK templates changed by PR #2072. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: fail closed when enabling Issues Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: deduplicate gh-aw Issues changeset Keep the fail-closed CLI and SDK release note from the review-fix commit as the single changeset for this documentation update. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden gh-aw workflow distribution integrity Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: add hosted gh-aw bootstrap e2e harness Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: align hosted e2e with bundle manifest Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: consume native gh-aw bundle contract Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: bind hosted e2e to resolved source Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: normalize generated workflow whitespace Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: harden native gh-aw package Closes #2075 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: capture gh-aw version output Closes #2075 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: use public registries for locked packages Closes #2075 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: narrow native gh-aw hardening scope Keep the revision focused on the seven reviewed blockers and generate resource-free package workflow sources so remote gh-aw v0.89.21 installs the exact 7/15/1 topology without duplicate resources.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: verify remote package ownership Normalize gh-aw's immutable source annotation when checking installed workflow bytes and match v0.89.21's 23-entry ownership record while verifying the skill separately.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: accept pinned gh-aw source annotations Normalize only the two immutable source annotations emitted by gh-aw v0.89.21 before comparing installed workflow bytes to canonical digests.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: normalize installer trailing newline Allow gh-aw v0.89.21's downloaded workflow representation to omit the canonical source's single final newline while preserving exact content verification.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: restore stable workspace lock dependency Remove the build-generated prerelease SDK dependency floor from package-lock.json so the stable workspace policy remains satisfied.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: align native package expectations Replace stale six-workflow, ambient-version, and top-level Markdown assumptions with the current nested seven-workflow package contract.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: delegate native install proof to CI Replace the duplicate ambient-compiler install test with assertions for the exact nested package and pinned v0.89.21 strict-compile job.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: harden package trust boundaries Reject symlinked manifest/runtime paths and require explicit credential-bearing child processes, including separation of source-read and mutation tokens.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: bind hosted bootstrap evidence (Part of #2075) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: bind bootstrap outputs to run provenance Part of #2075 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): protect dependency changelog Closes #2091 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * ci: add repo-health PR-head shadow harness Add a read-only pull_request shadow that exercises proposed scanners and the real reporter contract without mutating GitHub. Document the authoritative post-merge hostile-filename canary and label production comments by evidence level. Closes #1800 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: align repo-health fixtures with git transport Closes #1800 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: allow gh-aw cast genesis state Closes #2067 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(repo-health): decode Git-quoted leakage paths Closes #1800 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): fail closed on rejected squad commands Closes #1824 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): route commands outside start position Closes #1824 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test(gh-aw): include command router in CI topology Closes #1824 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(gh-aw): keep command fix within review scope Closes #1824 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): enforce independent Squad review and gate epic relay Closes #1734 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test(gh-aw): reconcile reviewed topology after final restack Closes #1734 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): make review guard first-install safe Closes #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): fail closed on missing installed review guard Closes #2103 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): bind first-install review identity Part of #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): verify clean-install package bytes Bind reserved first-install identities to immutable canonical package content, exact installed ownership bytes, and normalized compiled lock digests. Add live-loader mutation coverage for source, lock, canonical-content, and fetch failures.\n\nRefs #2103\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): stabilize local install verification Rebind local-package workflow sources before compilation and normalize only compiler-declared repository-scattered schedules in trusted lock digests. Refs #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): make first install a human trust boundary Part of #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): harden hosted strict compile fixture Part of #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): bind review to automatic PR runs Part of #2105 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): attest review from base context Part of #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test(gh-aw): expose installed lock digest mismatch Part of #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): dedicate review check identity Part of #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: record dedicated review app change Part of #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): normalize compiler setup pin Closes #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(ci): align gh-aw compiler pin Closes #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test(ci): enforce structural gh-aw compiler pins Closes #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test(ci): reject continued and dynamic compiler installers Closes #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): replace reviewer App with native review authority (#2109) Removes the dedicated reviewer App, private-key secret, environment, token minting, and custom Checks API publisher. Uses the base-controlled native GitHub Actions/gh-aw review job and exact-run relay binding, with context-only merge enforcement explicitly advisory unless source-bound policy is available.\n\nCloses #2103\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): verify native package source digest variants (#2111) Supports both legitimate native installer provenance forms with complete source-selected digests and deterministic immutable gh-aw toolchain action pins. Integrity normalization and installed-byte verification remain unchanged.\n\nCloses #2103\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): submit bootstrap chunks without agent transcription (#2115) * fix(gh-aw): submit bootstrap chunks without agent transcription Closes #2112 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(ci): seed immutable actions in native workflow consumer Closes #2112 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): preserve ownership staging with bounded index verification (#2116) * fix(gh-aw): verify ownership metadata in staged installs Handoff for independent revision: staged-tree enumeration still requires the reviewer-requested large-consumer correction before PR creation. Closes #2113 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): bound staged install queries to required paths Independently revise the rejected ownership staging handoff. Avoid recursive consumer-tree enumeration and preserve exact staged type and digest checks. Cover 20,000 unrelated tracked files, unchanged staging, bounded blob reads, index locks, and substituted directories. Closes #2113 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs(changeset): record verified gh-aw ownership staging Add the coordinator-authorized patch changeset for both template-shipping packages to satisfy the hosted changelog gate. Closes #2113 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): correct exact enlistment compiler warning gate (#2118) * fix(gh-aw): correct exact enlistment warning gate Closes #2117 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs(gh-aw): retain bot-trigger explanation Closes #2117 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Enforce coordinator scope and tracked behavior changes (#2110) * fix: enforce coordinator scope boundaries Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: address scope control review Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): harden hosted canary contracts (#2120) * fix(gh-aw): harden hosted canary contracts Validate bootstrap output in isolation before trusted writes, authorize mutating command dispatches, and bind review relays to the latest exact base-controlled run attempt. Closes #2103 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): close review authorization gaps Closes #2103 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: ignore CommonMark tab-indented commands Closes #2103 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): read committed cast registry from the checkout when validating an isolated bootstrap candidate The materialize step copies the checkout into a .git-less candidate (#2120), but committedRegistry() ran git rev-parse/ls-tree/show in that candidate, so every bootstrap failed with 'registry base: committed HEAD is unavailable'. Thread an optional gitRoot (default root) through validateBootstrapPayload -> validateCastTree -> parseRegistry, and pass gitRoot: checkout from the materializer. Adds a regression test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test(gh-aw): refresh pinned squad lock digests for the updated cast validator Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): require 0.89.22 for central ops Closes octodemo/zava-social-cao-ops-20260929111840#18 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * feat(gh-aw): opt-in committed research scope for bootstrap Adds .squad/research-scope.json (squad-research-scope/v1). When committed at HEAD, every bootstrap proposal must cite evidence under a declared root. Uncommitted scope files are ignored. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): preserve bootstrap candidate isolation Validate candidate bytes from the isolated tree while resolving committed Cast provenance from the trusted checkout. Adds regression coverage for CAO integration issue octodemo/zava-social-cao-ops-20260929111840#26. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): preserve review provenance marker Describe the implementation marker without a literal HTML comment so gh-aw retains the exact regex in compiled reviewer prompts. Adds compiled-artifact regression coverage for octodemo/zava-social-cao-ops-20260929111840#20. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): require exact enlistment compiler Closes #2129 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): create bootstrap candidate payload parent Part of #2128 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(test): raise Aspire dashboard health-check timeout to absorb CI runner contention (#2132) * fix(test): pin Aspire dashboard image to verified-good 13.5.2 build Root cause of the #2123/#2132 Aspire integration test CI failures was NOT CPU contention: `mcr.microsoft.com/dotnet/aspire-dashboard:latest` (and the major-version tag `:13`, confirmed to currently resolve to the identical freshly-published `13.6.0` build/digest) is broken — the container exits immediately (exitCode=145) because /app/Aspire.Dashboard.dll is missing from the image, so the dashboard health check can never succeed no matter the timeout. Fix: pin docker pull/run to `:13.5.2`, a distinct ~3-week-older build (different layer digests, verified via the MCR manifest API) that predates the broken `13.6.0` release and does not exhibit the missing-DLL problem. Diagnostics hardening made while chasing this down (kept, as they are independently valuable for any future flake in this suite): - Removed --rm from the dashboard `docker run` so a crashed container survives long enough for failure-path `docker inspect`/`docker logs` diagnostics to run (relying on existing explicit removeContainer() cleanup instead). - Captured container stderr in the `docker logs` diagnostics call (`2>&1`), since .NET unhandled-exception output goes to stderr and was previously silently dropped, hiding the real crash reason. - Raised isDockerAvailable()'s `docker info` timeout from 5s to 20s to prevent false-skip of the whole Docker-dependent suite under CI CPU contention (which would otherwise look like a false pass). - Raised the dashboard health-check timeout to 120s as defense-in-depth against genuine contention-induced slow starts, independent of the image-pinning fix above. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(test): widen beforeAll hook budget for diagnostics margin Addresses reviewer feedback on PR #2132: - The 240s beforeAll hook budget had zero margin above the bounded 120s docker-pull timeout + 120s health-check timeout, so Vitest could abort the hook with a generic timeout before waitForHealthy's more informative crash diagnostics could be thrown. Widened to 300s (~60s margin for container startup, diagnostics collection, and Playwright browser launch). - The --rm-vs-diagnostics concern on the same thread was already resolved in a prior commit (docker run no longer passes --rm); no further change needed there. Also trims two overly verbose/speculative inline comments (image-pin rationale, health-check rationale) down to the essential facts. Closes #2133 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: brady gaster <bradygaster@github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: harden Aspire dashboard startup (#2134) Pin the dashboard fixture to the verified 13.5.2 manifest and diagnose startup exits immediately with bounded container state and logs. Add deterministic regression coverage for the missing-DLL exit and hung health-request paths. Closes #2133 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * deps: Bump Microsoft.NET.Test.Sdk from 18.10.0 to 18.10.1 (#2073) --- updated-dependencies: - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft-packages ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> * ci: Bump the github-actions group across 1 directory with 2 updates (#2087) Bumps the github-actions group with 2 updates in the / directory: [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) and [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions). Updates `github/gh-aw-actions/setup` from 0.89.17 to 0.90.0 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0...a65c3ae1e11016c37f426bb3847a6f5e1a7d58df) Updates `github/gh-aw-actions/setup-cli` from 0.89.17 to 0.90.0 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0...a65c3ae1e11016c37f426bb3847a6f5e1a7d58df) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.89.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.89.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> * chore(deps): Bump @grpc/grpc-js in /samples/autonomous-pipeline (#2127) Bumps [@grpc/grpc-js](https://github.com/grpc/grpc-node) from 1.14.3 to 1.14.5. - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.5) --- updated-dependencies: - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> * deps: Bump fast-uri from 3.1.7 to 3.1.8 (#2126) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to 3.1.8. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> * deps: Bump brace-expansion from 5.0.7 to 5.0.12 (#2125) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.7 to 5.0.12. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.7...v5.0.12) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> * deps: Bump undici from 8.10.0 to 8.11.2 in /docs (#2097) Bumps [undici](https://github.com/nodejs/undici) from 8.10.0 to 8.11.2. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.11.2) --- updated-dependencies: - dependency-name: undici dependency-version: 8.11.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> * deps: Bump astro in /docs in the astro-minor-patch group (#2086) Bumps the astro-minor-patch group in /docs with 1 update: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `astro` from 7.3.3 to 7.3.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.5/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: astro-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> * deps: Bump ip-address from 10.4.0 to 10.7.2 (#2098) Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.4.0 to 10.7.2. - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](https://github.com/beaugunderson/ip-address/compare/v10.4.0...v10.7.2) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.7.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> * deps: Bump js-yaml and markdownlint-cli2 (#2108) Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 5.4.1 and updates ancestor dependency [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2). These dependencies need to be updated together. Updates `js-yaml` from 5.2.2 to 5.4.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.2...5.4.1) Updates `markdownlint-cli2` from 0.23.2 to 0.23.3 - [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md) - [Commits](https://github.com/DavidAnson/markdownlint-cli2/compare/v0.23.2...v0.23.3) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.4.1 dependency-type: indirect - dependency-name: markdownlint-cli2 dependency-version: 0.23.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(gh-aw): relay normalized squad commands through dispatch (#2136) * fix(gh-aw): relay normalized squad commands through dispatch Fixes three command-routing defects reported against source SHA 261d140679b158888f1a3c4d9a5a3e74eb55b633 (octodemo/zava-social-backend-20261001184422#1): 1. The lifecycle-repair fallback in the shared squad.md coordinator only recognized exact, /squad-prefixed issue-comment bodies. A command normalized and relayed by squad-command-router.md via workflow_dispatch (e.g. the bare "activate" dispatch input for a /squad activate comment) skipped repair entirely. Repair gating and the effective command are now derived identically for both the issue_comment and workflow_dispatch event paths (CANONICAL_BY_BARE_COMMAND normalization). 2. squad-command-router.md omitted `roles: all`, so gh-aw's default write-role activation gate blocked the router from running at all for non-write actors -- including modes the router intentionally allows anyone to invoke. Added `roles: all`; the router's own in-script, per-command authorization for mutating modes is unchanged. 3. The router's relayed dispatch dropped originating comment provenance, so an embedded /squad approve-improvement could never supply a real approval_comment_id and was rejected outright. The router now forwards an aw_context pointer (item type/number + originating comment id) through the dispatch, and squad-improvement-gate.mjs's validateApprovalDispatchRelay re-fetches and validates that live comment, binding permission to its own author -- never the dispatch actor -- so approval binding is not weakened. Package/lock/manifest regenerated via the standard `node workflows/shared/squad-install-verifier.mjs --write-source` pipeline; strict `gh aw compile --strict` passes with only the two documented warnings. Added test/gh-aw-command-router-relay.test.ts (true end-to-end router -> repair-job relay via real extracted step scripts, plus a normalization mutation-kill test), and extended test/gh-aw-command-parse.test.ts / test/gh-aw-improvement-worker.test.ts with regression coverage for all three findings. Local npm install is broken in this environment (missing transitive deps such as fdir), so vitest/eslint cannot run locally; every new/changed assertion was independently verified by direct Node/vm execution of the real production modules and scripts, and by compiled-lock diffing. Hosted CI at the PR head is the authoritative suite result. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): update compiled-digest golden hashes for relay fix The roles: all / aw_context changes to squad.md and squad-command-router.md legitimately alter the compiled squad.lock.yml content. Update the three hardcoded golden SHA-256 digests in test/gh-aw-quality.test.ts's canonical package integrity contract suite to match, following the same pattern as commit b5455084. Independently recomputed via direct execution of the real compileWithPinnedActions/normalizeCompiledLock helpers (node --experimental-strip-types, bypassing the broken local vitest install) and confirmed to match hosted CI's reported values exactly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): forward real item identity across the squad.md -> squad-improvement-worker relay hop Fixes a downstream defect in the command-routing relay chain (flagged by copilot-pull-request-reviewer[bot] against PR #2136, which fixed the three originally-scoped findings from source SHA 261d140679b158888f1a3c4d9a5a3e74eb55b633, octodemo/zava-social-backend-20261001184422#1). Root cause: gh-aw's own dispatch_workflow safe-output engine unconditionally overwrites any agent-supplied aw_context input with its own buildAwContext() whenever a dispatch's target workflow declares an aw_context workflow_dispatch input. buildAwContext() derives item_type/item_number/comment_id solely from the CURRENT run's own event payload -- never inherited across a hop. When a relayed (workflow_dispatch -triggered) squad.md run dispatches to squad-improvement-worker via the squad-approve-improvement skill, that dispatch goes through gh-aw's real dispatch_workflow handler, so the engine always overwrites squad.md's aw_context with its own context -- which, because squad.md's own run is a workflow_dispatch event with no issue/comment payload, always carries empty item_type/item_number/comment_id. collectImprovementContext's existing strict exact-match check (correct for the native direct-comment path, where the engine's own context genuinely is accurate) therefore always rejected every relayed /squad approve-improvement, independent of any event_type widening. Fix (no gh-aw change; pure squad.md-side plumbing): - squad-improvement-worker.md: declare a new, non-colliding squad_approval_relay workflow_dispatch input (distinct name from aw_context, so gh-aw's engine never auto-overwrites it) and wire a parallel SQUAD_IMPROVE_RELAY_CONTEXT env var at both existing call sites. - squad.md: the squad-approve-improvement skill now always forwards squad_approval_relay: {event_type, item_type, item_number, comment_id} alongside the existing issue_number/approval_comment_id inputs, reusing the same already-resolved values. - squad-improvement-gate.mjs: collectImprovementContext keeps the unconditional repo/workflow_id provenance check against the engine's own (always-accurate) context, then branches: native path (event_type === issue_comment) validates item identity against the engine context unchanged; relayed path (any other event_type) validates with identical exact-match strictness against the new SQUAD_IMPROVE_RELAY_CONTEXT instead. No approval-binding check is weakened on either path; all unconditional live re-verification (comment/permission/revocation/ revision/linked-PR checks) is untouched. Regenerated workflows/package/*.md and workflows/squad-workflows.manifest.json via `node workflows/shared/squad-install-verifier.mjs --write-source`. Tests (test/gh-aw-improvement-worker.test.ts): - Extends the skill-JSON-shape assertion for the new relay field. - New describe block covering: relayed-path authorization success, repo/ workflow_id forgery still rejected, mutation-kill coverage (tampered comment_id/item_number/item_type/event_type each independently rejected), malformed/missing relay context rejected (no silent fallback to the engine's empty item fields), native-path non-regression, source wiring assertions, and a compiled-artifact assertion (gh aw compile --strict) proving both the worker's lock.yml declares/wires the new input and squad.lock.yml's compiled dispatch step actually emits squad_approval_relay. Verified locally: standalone Node execution of collectImprovementContext's new branch logic (native path, relayed success, 4 mutation-kill cases, 3 malformed/missing-context cases, repo/workflow_id forgery); gh aw compile --strict across all 8 installed workflows produces exactly the two documented warnings (Compiled 8 workflows: 8 succeeded, 2 warnings); per-workflow strict compiles of squad and squad-improvement-worker confirm the new input/env/dispatch-field wiring in the generated lock.yml files. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test(gh-aw): update stale compiled-lock golden digests after relay-context fix Updating workflows/squad.md's squad-approve-improvement dispatch payload (and squad-improvement-worker.md's new input/env wiring) changes the compiled squad.lock.yml / squad-improvement-worker.lock.yml content, which shifts the normalized SHA-256 digests asserted by the canonical package integrity contract tests in test/gh-aw-quality.test.ts (tamper-mutation fixtures recomputed over the new baseline compiled output). Re-derived both digest pairs from the actual compiled output (workflow and package source bindings) and updated the three assertions that pinned the stale values. No test logic changed; this is a golden-value refresh consistent with the same pattern applied for the three originally-scoped fixes earlier in this PR. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): bind router commands to text author (#2141) Fixes octodemo/zava-social-queue-worker-20261001211503#1 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): harden GA-review-blocked source contract (9 findings) Fixes 9 confirmed GH-AW GA review blockers as one coherent source-contract hardening pass: 1. squad-improvement-gate.mjs: added regression/mutation test coverage for rejecting a content-only modification of an already-tracked executable (100755) Markdown improvement target (production ALLOWED_FILE_MODE guard was already correct; the defect was a test-coverage gap). 2. squad_approval_relay: unambiguous JSON-string contract end-to-end between squad.md and squad-improvement-worker.md/gate, preserving the distinct input name since gh-aw overwrites aw_context. 3. squad-review-guard.mjs: added regression tests confirming override candidates are authorized before cardinality/record validation, so malformed or unauthorized markers fail closed. 4. squad-planning-ontology.md: normalized `Result: ✅ PASS` to the exact `RESULT: PASS` string downstream parsers require. 5. squad-install-verifier.mjs: confirmed verifyInstalledBytes() normalizes only the one documented injected source: binding before hashing and fails on any other tamper; existing mutation-test table already covers this (no source change needed). 6. Numeric issue/comment IDs from issue_comment events are canonicalized to safe-integer strings before comparison against workflow_dispatch string inputs; invalid forms are rejected. Direct and relayed coverage added. 7. squad-command-router.md: block replay of bot-authored standalone /squad issue/comment command text while preserving trusted workflow_dispatch continuation and documented bot behavior, for created/edited events. 8. can_approve_pull_request_reviews: proved via gh-aw source this is a single combined toggle gating both GITHUB_TOKEN PR creation and PR-review approval (cannot be split via job permissions). Per least-privilege policy and the mandatory independent-human-approval requirement, flipped true->false across all public/enlistment/setup copies and added a fallback-to-issue mechanism (manual compare-URL link) to squad-bootstrap.md for when push succeeds but PR creation is blocked. 9. Eliminated unbounded mutable commits/dev channel resolution; GA install guidance now requires an explicit, pre-validated 40-character SQUAD_SHA, synced across public/enlistment docs and skill mirrors. Exact-SHA fixture testing is unaffected; no release is published. Verification: - All 28 gh-aw-prefixed test files pass (1849/1849 tests), including the previously-failing test/gh-aw-install-staging.test.ts (15/15) after regenerating workflows/squad-workflows.manifest.json via `npm run gh-aw:integrity:write` to pick up the item 8/9 SKILL.md edits. - packages/squad-sdk and packages/squad-cli both build cleanly (tsc --noEmit reports zero warnings/errors for both). - Real (non-mocked) `gh aw compile --strict` against the canonical workflows/*.md sources compiles all 8 workflows successfully and produces exactly the two documented/allowed warnings (pull_request_target advisory on squad-review.md; bot-trigger advisory on squad.md). - Independent security review found no high-confidence issues. - No package.json/package-lock.json drift anywhere in the tree. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): avoid false-positive security scan on bootstrap fallback marker gh-aw's --strict compile security scanner flags any unclosed '' anywhere in the file (a hidden-content/prompt-injection detection heuristic). The item-8 bootstrap PR-fallback marker intentionally stored only the opening '' later via string interpolation, which made the scanner capture ~240 lines of unrelated JS as a single 'HTML comment' and reject it as suspicious content. Fix: build the complete marker (open + close delimiters together) in a single template literal inside bootstrapPrFallbackIssueMarker(), exactly mirroring the existing (already-safe) BOOTSTRAP_ISSUE_MARKER shape. The runtime marker text is byte-identical (verified via direct invocation); only the constant's exported value lost its leading '<!-- ' (now built at call time instead). Regenerated the pinned SHA-256 digest for squad-bootstrap-validator.mjs via 'npm run gh-aw:integrity:write' (workflows/squad-bootstrap.md, workflows/package/squad-bootstrap.md, workflows/squad-workflows.manifest.json). Verified: - node workflows/shared/squad-install-verifier.mjs --check-source: current - npx vitest run test/gh-aw-bootstrap-workflow.test.ts: 33/33 passed - npx vitest run test/gh-aw-*.test.ts (28 files): 1849/1849 passed - Real (non-mocked) 'gh aw compile --strict --no-check-update' against a scratch materialized .github/workflows/ tree: security scan passes, 8/8 workflows compile, exactly 2 allowed warnings (pull_request_target advisory + slash_command/bots advisory) — matching CI's failing job. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): trusted signed-provenance fallback for manual bootstrap PR Replace the dead-end manual-PR-fallback boundary flagged in Copilot auto-review with a narrowly-scoped trusted path: the bootstrap workflow now stamps a signed, machine-readable provenance line (repo/run/base branch/head branch/head SHA/compare URL) into the fallback issue body it files when GITHUB_TOKEN cannot open the Cast PR itself. squad-review-guard validates a human-opened Cast PR against that provenance record end-to-end (aggregate fields, compare URL, run binding, issue-created-before-PR ordering) before granting @squad/base-controlled-bootstrap / @squad/base-controlled-review roles, with every other provenance/review/content/head check unchanged and malformed/forged records still failing closed. - workflows/shared/squad-bootstrap-validator.mjs: add buildBootstrapPrFallbackProvenanceLine/parseBootstrapPrFallbackProvenance/ buildBootstrapPrFallbackCompareUrl; buildBootstrapPrFallbackIssueBody now requires a signed provenanceLine argument. - workflows/shared/squad-review-guard.mjs: add validateBootstrapPrFallbackAttribution, wired ahead of the existing bot-authored bootstrap-PR path so a verified fallback PR is treated identically (including the bootstrap-run-success gate). - workflows/squad-bootstrap.md (+ generated package copy): thread the signed provenance line into the fallback issue body. - test/gh-aw-review-guard.test.ts: full new fallback-scenario suite (valid fallback incl. enforceReviewOutputs parity, run-success gating, unrelated/ambiguous-issue rejection, and a 15-case mutation table for forged/edited/malformed provenance) — mutation-verified by independently neutering each of the 4 requireThat checks in validateBootstrapPrFallbackAttribution. - test/gh-aw-bootstrap-workflow.test.ts: update VM-sandboxed stateModule mock and fixtures for the new provenance-line export and strict 40-hex-char head-SHA validation. - docs/src/content/docs/guide/gh-aw.md: document the new signed-provenance trust model and its exact matching requirements. - workflows/squad-command-router.md (+ generated package copy), gh-aw-enlistment SKILL.md copies, scripts/gh-aw-hosted-e2e.mjs, test/gh-aw-hosted-e2e.test.ts, workflows/squad-workflows.manifest.json: carry-through updates for findings 7-9 (bot-authored command blocking, can_approve_pull_request_reviews=false default, explicit SHA-pinned enlistment) already validated earlier this PR; this commit regenerates the manifest/package artifacts to match. Verified: npx vitest run test/gh-aw-*.test.ts (28 files, 1884 tests, all passing); npm run lint (tsc --noEmit, both packages, clean); real scratch-consumer gh aw compile --strict across all 8 package workflows with exactly the 2 previously-allowed warnings preserved; npm run gh-aw:integrity:write regenerated manifest/package artifacts cleanly. Addresses PR #2142 review finding Medium #3 (bootstrap PR fallback cannot satisfy provenance checks), per coordinator-approved redesign. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs(changeset): note signed-provenance bootstrap-PR fallback redesign Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): harden bootstrap-PR-fallback trust and command-router bot block (8 review findings) Addresses the 8 fresh Copilot auto-review findings from the review on commit 9b45d116 (after the signed-provenance fallback redesign): - squad-bootstrap-validator.mjs: filter fallback-issue dedupe/ambiguity candidates by bot-authorship + title + valid-provenance *before* counting/matching, closing a decoy-issue forgery/DoS gap. - squad-review-guard.mjs: bind the fallback provenance path's cited bootstrap run to the exact base commit (run.head_sha === pr.base.sha), matching the bot-authored path's existing binding. - scripts/gh-aw-hosted-e2e.mjs: validate the full signed provenance record (independently re-implemented, not imported) instead of a plain-text marker/compare-URL substring check, so the hosted E2E can no longer report success for a fallback issue production would reject. - squad-command-router.md: add direct test coverage (user.type / payload.sender.type fixtures, previously never populated) proving the existing bot-authorship block is reachable and enforced for both created and edited events, with mutation-kill tests. - Updated docs/src/content/docs/guide/gh-aw.md, .github/agents.md, README.md (removed a stale @dev-tracking note contradicting the explicit-SQUAD_SHA policy), and all 5 synchronized copies of skills/gh-aw-enlistment/SKILL.md to describe the fallback-issue-first Cast PR flow. Verified: full test/gh-aw-*.test.ts suite (28 files, 1896 tests) passes; npm run lint (tsc --noEmit, both packages) clean; a real scratch-consumer `gh aw compile --strict` against workflows/package/*.md produces exactly the two documented warnings. No stable release published. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs(gh-aw): close remaining stale automatic-Cast-PR passages (review threads 1-8) Follow-up to f1084ec1: fixed two stale passages a second hosted-review pass on the same commit flagged: - skills/gh-aw-enlistment/SKILL.md anti-pattern list still said 'automatic Cast PR' unconditionally. - docs/src/content/docs/guide/gh-aw.md activation-canary/automatic- bootstrap checklist rows still described only the unconditional- automatic case, including research-proposals-issue creation timing. Both now cover the manual-fallback path and its provenance requirement. Regenerated workflows/squad-workflows.manifest.json via npm run gh-aw:integrity:write (SKILL.md digest only). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): resolve fresh Copilot review findings on PR #2142 (7 fixes) Fresh hosted Copilot review on commit 3bf5c01f surfaced 1 new Medium finding plus 6 previously-missed findings. All 7 are fixed/tested: - squad-bootstrap-validator.mjs: edited-fallback-issue dedupe bug (Medium) - findExistingBootstrapPrFallbackIssue now requires unedited created_at === updated_at timestamps, mirroring validateBootstrapPrFallbackAttribution's review-time requirement exactly. - gh-aw-hosted-e2e.mjs: selectBootstrapFallback now mirrors the same open-state and unedited-timestamp lifecycle checks production enforces. - squad-review-guard.mjs: validateBootstrapPrFallbackAttribution tightened from `!== 'Bot'` to `=== 'User'` so non-Bot, non-User account types (Organization, Mannequin) can no longer pass fallback-PR authorship. - squad-review-guard.mjs: assertClearingReview now caches collaborator permission lookups per login for the duration of one evaluation. - squad-improvement-gate.mjs: added direct test coverage for sameNumericId's cross-type normalization and malformed/overflow rejection at the nested origin.item_number/relay.item_number level (production was already correct; this closed a test-only gap). - squad-planning-ontology.md: added a regression test pinning the exact RESULT: <PASS | FAIL> template text (production doc was already correct; test-only gap). - squad-bootstrap-validator.mjs: buildBootstrapPrFallbackIssueBody now tells the human to manually re-run the workflow if they want the linked research-proposals issue before merging the fallback-opened Cast PR, since no GitHub event re-triggers bootstrap until the next default-branch push. Proved via a scratch gh aw compile --strict run that adding a pull_request_target trigger instead would both require an unacceptable checkout: false security posture change and break the documented 'exactly two compile warnings' contract - a missing instruction, not a missing trigger, was the actual defect. Regenerated workflows/squad-workflows.manifest.json and the generated workflows/package/squad-bootstrap.md copy via npm run gh-aw:integrity:write to pick up the new source digests. Synced the 4 enlistment SKILL.md mirror copies via npm run sync-templates. All 28 gh-aw-*.test.ts files / 1919 tests pass. npm run lint clean. The enlistment-skill compile-warning-allowlist contract (exactly two warnings) remains intact. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): close bootstrap-fallback dedupe staleness, title-check, and notification gaps (review on 1a9c4081) - squad-bootstrap-validator.mjs: add base_sha staleness binding to the fallback-issue provenance record so an old fallback issue is no longer silently reused once the default branch advances past it. - squad-review-guard.mjs: require the canonical Cast-PR title on the fallback review path too, matching the bot-authored path. - squad-bootstrap.md: reword the run-success notification to be accurate when only the fallback issue (not a Cast PR) exists. - Regenerate workflows/package/squad-bootstrap.md and squad-workflows.manifest.json via npm run gh-aw:integrity:write. - Update docs/src/content/docs/guide/gh-aw.md fallback-provenance section. - Add regression + mutation coverage across gh-aw-bootstrap-workflow.test.ts, gh-aw-review-guard.test.ts, and gh-aw-hosted-e2e.test.ts (staleness, malformed-argument, title-rejection cases). Validated: targeted test files (308/308), full gh-aw suite (28 files / 1921 tests), npm run lint (tsc), npm run lint:eslint (0 errors), npm run build. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): close workflow_dispatch fallback dead-end and E2E fallback-terminal gap Fresh Copilot review on commit e024db94 surfaced two findings: - High (workflows/squad-bootstrap.md): a workflow_dispatch run could open a bootstrap-PR-fallback issue that squad-review-guard.mjs's validateBootstrapPrFallbackAttribution can never authorize (it requires event === 'push'), and dedupe matching would keep reusing that permanently dead-end issue forever. Now fails closed with an actionable error instead. - Medium (scripts/gh-aw-hosted-e2e.mjs): the hosted E2E's fallback outcome reported terminal success the moment bootstrap opened the fallback issue, without ever exercising the Cast-PR-fallback review/attribution path. The obvious fix (E2E opens the Cast PR itself with its own PAT) was rejected: that would substitute automation for the human-in-the-loop step can_approve_pull_request_reviews=false exists to require. Instead the fallback outcome is now non-terminal (awaiting_manual_pr); a new read-only selectManualFallbackCastPr independently re-derives production's authorization logic to observe (never create) a human-opened PR, and a new resume-fallback command + squad-gh-aw-hosted-e2e-resume dispatch trigger let a later run resume from the original run's persisted baseline identity to validate that PR through to the same base-controlled Squad Review canary the bot-authored path exercises. Added regression/mutation coverage for both findings and regenerated the installed package mirror/manifest digests via `npm run gh-aw:integrity:write`. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs(gh-aw): document and prove resume-fallback token scoping Addresses a sibling-session scope-gate follow-up on the resume-fallback job added for the hosted-E2E Medium-finding redesign: audit confirmed the job's `secrets.SQUAD_GH_AW_E2E_TOKEN` usage never creates, approves, or mutates the Cast fallback pull request. It is reused (not removable) only because no separate read-only PAT exists for the external target fixture repository and `github.token` cannot reach a repository outside this one. Documents each job's token scoping separately in the workflow comments, and adds a transitive-call-graph test proving every function `resumeFallback` can reach (`bootstrapOutputs`, the `githubAdapter` block, `selectManualFallbackCastPr`, `waitForManualFallbackCastPr`, `waitForBaseControlledReviewCanary`) issues only GET `gh api` calls -- no `pr create`/`pr merge`/`pr review`/write `--method` call anywhere in that reachable graph. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): remove cross-repo secret from bootstrap-PR fallback continuation Architectural correction to the hosted-E2E fallback redesign: no credential (PAT, GitHub App token, or repository/environment secret) may ever be used to observe or validate the manually opened Cast PR, even read-only. A workflow-held credential capable of reading that PR's state undermines the can_approve_pull_request_reviews=false trust boundary, which exists specifically so a human must act outside of any CI-held credential. - Reverted .github/workflows/squad-gh-aw-hosted-e2e.yml to its pre-existing baseline: removes the resume-fallback job, its squad-gh-aw-hosted-e2e-resume dispatch trigger, and the action-gating added for it. File is now byte- identical to origin/dev (zero net diff). - hosted()'s fallback branch no longer calls bootstrapOutputs()/ selectManualFallbackCastPr()/waitForBaseControlledReviewCanary() inline and makes zero further GitHub API calls. It now parses the fallback issue's own already-fetched provenance body (parseBootstrapPrFallbackProvenance, a pure string-parsing function) and terminates immediately, non-terminally, at status: 'awaiting_manual_pr' with complete evidence (target, fallback issue, head/base branch+SHA, compare URL, next_step instructions). - The target repository's own installed Squad Review workflow validates the human-opened PR locally, using that repository's own GITHUB_TOKEN/gh-aw authority -- no cross-repository read by this controller is needed. - resumeFallback() is retained unchanged internally (still provably GET-only via the existing transitive call-graph test) but is now framed exclusively as a local, operator-run-only CLI command: never wired to any Actions job or repository_dispatch trigger, relying only on the operator's own `gh auth login` session, never a repository secret. - Updated test/gh-aw-hosted-e2e.test.ts: workflow-topology test now asserts a single hosted-e2e job/dispatch type and explicit absence of any resume-fallback job; added a test asserting hosted()'s fallback branch writes complete evidence with none of the removed inline calls present; the dispatcher-wiring test now asserts resumeFallback's doc comment states it is operator-run-only/never-CI-wired/never-secret-backed and that the workflow file contains no reference to it. Removed the now-obsolete per-job token-scoping test (the job no longer exists). The existing transitive read-only call-graph proof for resumeFallback is unchanged. - Updated .changeset/gh-aw-ga-review-hardening.md with a new section documenting this correction. Validation: - npx vitest run test/gh-aw-hosted-e2e.test.ts -> 139/139 pass - npx vitest run test/gh-aw*.test.ts -> 28 files / 1938 tests pass - npm run lint (tsc, both packages) -> clean - npm run lint:eslint -> 0 errors (pre-existing warning baseline only) - npm run build -> succeeds (prebuild version-bump side effects reverted) - npm run gh-aw:integrity:check -> current (no canonical workflow source touched this round) - Scratch-consumer gh-aw compile --strict (mirroring squad-ci.yml's gh-aw-compile job exactly): 8/8 workflows compile, exactly 2 documented warnings (pull_request_target advisory on squad-review.md; bots:/ slash_command advisory on squad.md); all 8 compile individually with --strict; squad-install-verifier.mjs --verify-install --strict-compile passes. - git diff origin/dev -- .github/workflows/squad-gh-aw-hosted-e2e.yml -> empty (file content is byte-identical to dev; this path no longer appears in the PR's net diff against dev) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): close base-sha drift, bootstrap-branch doc, and resume-fallback gaps from fresh review Fixes 7 Copilot review findings on commit 140ce8eb: - scripts/gh-aw-hosted-e2e.mjs: next_step instruction for resume-fallback was missing its three required CLI flags; now emits a complete gh run download + resume-fallback --target/--evidence-in/--evidence recipe with interpolated values. - workflows/shared/squad-review-guard.mjs: the bootstrap-PR fallback review path bound to the live, mutable pr.base.sha, making manual recovery permanently unrecoverable after any further default-branch commit. Replaced with a GitHub Compare API ancestry check (identical/ahead) that also binds the response's own resolved base_commit/merge_base_commit SHAs back to the immutable provenance.base_sha, and fails closed on any compare API error. findExistingBootstrapPrFallbackIssue's baseSha is now optional for the review-path lookup (push-triggered dedupe caller is unchanged). - skills/gh-aw-enlistment/SKILL.md (canonical + 4 synced mirrors): fixed the automated fallback explanation to name the real Cast fallback branch (squad/bootstrap-cast) instead of the unrelated human-run install branch (chore/squad-gh-aw-bootstrap). Regenerated workflows/squad-workflows.manifest.json and the embedded digest in workflows/squad-bootstrap.md / workflows/package/squad-bootstrap.md via npm run gh-aw:integrity:write; confirmed clean via npm run gh-aw:integrity:check. Added regression + mutation test coverage for all three findings, including four new binding-mutation tests proving a passing compare status alone is insufficient without base_commit/merge_base_commit SHA agreement. Validation: full test/gh-aw*.test.ts suite (28 files, 1949 tests) passes; npm run lint (tsc --noEmit, both packages) clean; npm run build clean. Two pre-existing, unrelated failures (test/cli/copilot.test.ts, test/acceptance/acceptance.test.ts, one case in test/cli/cast.test.ts) reproduce identically on the pre-session tree via git stash and are unaffected by this change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(gh-aw): resolve fresh review findings on bb805b2c (ambiguous fallback matches, merge-trigger claim, open-PR filter) - squad-bootstrap-validator.mjs: fix a regression this session's own prior fix introduced - when baseSha is omitted (review path), multiple genuine open fallback-issue matches (stale + fresh across base drift) no longer throw "Ambiguous"; they resolve deterministically to the newest match, unless they share the identical base_sha (a true unresolvable duplicate), which still fails closed regardless of caller. - squad-bootstrap-validator.mjs + canonical SKILL.md (+4 mirrors): correct the false claim that merging a Cast PR automatically retriggers Squad Bootstrap - confirmed via squad-bootstrap.md's push trigger paths that it never does; manual workflow_dispatch is always required, before or after merge. - gh-aw-hosted-e2e.mjs: selectManualFallbackCastPr now requires pr.state === 'open', excluding closed/merged look-alike PRs from the manual fallback candidate set. - docs/guide/gh-aw.md: rewrite the fallb…

Copilot AI balanced review requested due to automatic review settings October 1, 2026 16:01

bradygaster requested a review from tamirdresher as a code owner October 1, 2026 16:01

Copilot started reviewing on behalf of bradygaster October 1, 2026 16:02

View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Comment thread test/aspire-integration.test.ts Resolved

Comment thread test/aspire-integration.test.ts Resolved

bradygaster force-pushed the bradygaster-aspire-ci-reliability branch 3 times, most recently from f6e5766 to 2903b17 Compare October 1, 2026 16:36

bradygaster force-pushed the bradygaster-aspire-ci-reliability branch from 2903b17 to 7da72f9 Compare October 1, 2026 16:46

bradygaster force-pushed the bradygaster-aspire-ci-reliability branch from 7da72f9 to 374269e Compare October 1, 2026 16:55

bradygaster mentioned this pull request Oct 1, 2026

Pin Aspire dashboard integration-test image to a verified build #2133

Closed

bradygaster force-pushed the bradygaster-aspire-ci-reliability branch from 010bd78 to 1c36619 Compare October 1, 2026 17:09

bradygaster force-pushed the bradygaster-aspire-ci-reliability branch from 1c36619 to e3a087b Compare October 1, 2026 17:09

bradygaster merged commit d1b3fe4 into dev Oct 1, 2026
16 of 26 checks passed

bradygaster deleted the bradygaster-aspire-ci-reliability branch October 1, 2026 17:19

This was referenced Oct 1, 2026

feat(gh-aw): opt-in committed research scope for bootstrap #2123

Merged

test: make Aspire dashboard fixture deterministic #2134

Merged

Navigation Menu

Repository navigation

fix(test): raise Aspire dashboard health-check timeout to absorb CI runner contention - #2132

fix(test): raise Aspire dashboard health-check timeout to absorb CI runner contention#2132
bradygaster merged 2 commits into
devfrom
bradygaster-aspire-ci-reliability

bradygaster commented Oct 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

bradygaster commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

How

⚠️ Quick Check

PR Readiness Checklist

Branch & Commit

Build & Test

Changeset

Docs

Exports

Breaking Changes

Waivers

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Impact Analysis — PR #2132

📊 Summary

🎯 Risk Factors

📦 Modules Affected

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛫 PR Readiness Check

⚠️ 3 item(s) to address before review

Files Changed (2 files, +49 −11)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bradygaster commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading