Skip to content

fix(gh-aw): remove mutable generated router - #2148

Merged
bradygaster merged 3 commits into
devfrom
bradygaster-remove-mutable-gh-aw-scaffold
Oct 2, 2026
Merged

bradygaster merged 3 commits into
devfrom
bradygaster-remove-mutable-gh-aw-scaffold

Conversation

@bradygaster

@bradygaster bradygaster commented Oct 2, 2026 •

Copy link
Copy Markdown
Collaborator

What

Removes gh-aw v0.89.22's generated .github/skills/agentic-workflows/SKILL.md and updates Squad enlistment so consumer installs delete and reject that unowned mutable router while preserving the exact Squad-owned gh-aw-enlistment skill.

Why

A clean hosted fixture found that the generated router loads mutable prompt files from the current github/gh-aw repository, so future workflow-authoring behavior was not bound to the pinned Squad SHA or compiler version. Source finding: octodemo/zava-social-queue-worker-20261002092250#1, review comment 4164580830.

How

  • Delete only the generic agentic-workflows router; retain agentics-maintenance.yml because it provides configured safe-output expiration maintenance.
  • Make final installation verification fail when the router exists.
  • Make staged verification inspect the exact router path and accept only an explicitly staged deletion while continuing to require the exact Squad-owned skill.
  • Update canonical enlistment docs, mirrors, hosted E2E, and clean-consumer CI.
  • Add clean-install, staged deletion, mutation, source-tree absence, routing-independence, and maintenance-retention regressions.

Repository independence conclusion: no repository routing or authoring contract depends on the deleted router. .squad/routing.md assigns gh-aw work directly to agentic-workflows-dev; the tracked agentic-workflow-designer and gh-aw-reliability skills provide owned design and validation surfaces. Retaining a rewritten or pinned generic router would make Squad own a fork of the upstream gh-aw prompt router and corpus, creating vendor drift; removal is the narrower and safer boundary.


⚠️ Quick Check

  • No SDK/CLI source files changed; a patch changeset is included for the shipped template updates.

PR Readiness Checklist

The PR readiness bot will validate these automatically after push.
Check each item before requesting review. See CONTRIBUTING.md for full details.

Branch & Commit

  • Branch created from dev (not main)
  • Branch is up to date with the session's dev base
  • Verified diff contains only intended changes (git diff --cached --stat)
  • PR is not in draft mode
  • Commit history is clean

Build & Test

  • npm run build -w packages/squad-sdk passes
  • npm run build -w packages/squad-cli passes
  • GitHub test check passes on exact head
  • npm run lint passes
  • npm run lint:eslint passes
  • node node_modules/vitest/vitest.mjs run test/gh-aw-*.test.ts passes: 28 files, 1,956 tests
  • Targeted regression suite passes: 4 files, 598 tests
  • Clean consumer strict compile passes with exactly 8 succeeded and the 2 documented warnings
  • node workflows/shared/squad-install-verifier.mjs --check-source passes
  • Independent security review: APPROVE; explicitly confirmed no contract depends on the router, removal avoids vendor drift, and agentics-maintenance.yml remains
  • Exact-head Copilot review on 68b0a473fdd47f8f559cf80d44ffbcd30fa5a226: approval recommended, findings none

Changeset

  • Changeset added in .changeset/remove-mutable-gh-aw-router.md
  • Direct CHANGELOG.md entry — N/A
  • skip-changelog label — N/A

Docs

  • README section updated
  • Existing gh-aw guide and canonical enlistment skill updated; no new feature page needed

Exports

  • N/A — no SDK modules or exports changed

Breaking Changes

None.

Waivers

None.

Copilot AI balanced review requested due to automatic review settings October 2, 2026 11:40
@github-actions

github-actions Bot commented Oct 2, 2026 •

Copy link
Copy Markdown
Contributor

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 43601b4

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status Check Details
❌ Single commit 3 commits — consider squashing before review
✅ Not in draft Ready for review
✅ Branch up to date Up to date with dev
❌ Copilot review No Copilot review yet — it may still be processing
✅ Changeset present Changeset file found
✅ Scope clean No .squad/ or docs/proposals/ files
✅ No merge conflicts No merge conflicts
✅ Copilot threads resolved All 1 Copilot thread(s) resolved
✅ CI passing All checks passing

Files Changed (20 files, +337 −131)

File +/−
.changeset/remove-mutable-gh-aw-router.md +6 −0
.github/agents.md +13 −0
.github/skills/agentic-workflows/SKILL.md +0 −98
.github/workflows/squad-ci.yml +1 −0
.squad-templates/skills/gh-aw-enlistment/SKILL.md +26 −3
README.md +6 −1
docs/src/content/docs/guide/gh-aw.md +30 −7
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md +26 −3
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md +26 −3
scripts/gh-aw-hosted-e2e.mjs +1 −0
templates/skills/gh-aw-enlistment/SKILL.md +26 −3
test/gh-aw-enlistment-skill.test.ts +28 −0
test/gh-aw-hosted-e2e.test.ts +3 −1
test/gh-aw-install-staging.test.ts +69 −1
test/gh-aw-quality.test.ts +20 −0
workflows/package/squad-bootstrap.md +1 −1
workflows/shared/squad-install-verifier.mjs +23 −1
workflows/skills/gh-aw-enlistment/SKILL.md +26 −3
workflows/squad-bootstrap.md +1 −1
workflows/squad-workflows.manifest.json +5 −5

Total: +337 −131


This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

🟠 Impact Analysis — PR #2148

Risk tier: 🟠 HIGH

📊 Summary

Metric Count
Files changed 20
Files added 1
Files modified 18
Files deleted 1
Modules touched 8

🎯 Risk Factors

  • 20 files changed (6-20 → MEDIUM)
  • 8 modules touched (5-8 → HIGH)
  • 1 file(s) deleted

📦 Modules Affected

ci-workflows (3 files)
  • .github/agents.md
  • .github/skills/agentic-workflows/SKILL.md
  • .github/workflows/squad-ci.yml
docs (1 file)
  • docs/src/content/docs/guide/gh-aw.md
root (8 files)
  • .changeset/remove-mutable-gh-aw-router.md
  • README.md
  • templates/skills/gh-aw-enlistment/SKILL.md
  • workflows/package/squad-bootstrap.md
  • workflows/shared/squad-install-verifier.mjs
  • workflows/skills/gh-aw-enlistment/SKILL.md
  • workflows/squad-bootstrap.md
  • workflows/squad-workflows.manifest.json
scripts (1 file)
  • scripts/gh-aw-hosted-e2e.mjs
squad-cli (1 file)
  • packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md
squad-sdk (1 file)
  • packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md
templates (1 file)
  • .squad-templates/skills/gh-aw-enlistment/SKILL.md
tests (4 files)
  • test/gh-aw-enlistment-skill.test.ts
  • test/gh-aw-hosted-e2e.test.ts
  • test/gh-aw-install-staging.test.ts
  • test/gh-aw-quality.test.ts

This report is generated automatically for every PR. See #733 for details.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The verifier, staged-index gate, synchronized artifacts, documentation, and focused regressions consistently enforce the intended removal.

Review effort: Balanced
Findings: None

What changed in this PR

Removes gh-aw’s mutable generated router while preserving Squad-owned enlistment and maintenance resources.

Changes:

  • Rejects the router in installed and staged trees.
  • Removes it from install workflows and documentation.
  • Adds regressions and synchronizes generated artifacts/templates.
File Description
workflows/​squad-workflows.manifest.json Refreshes integrity digests.
workflows/​squad-bootstrap.md Updates verifier digest.
workflows/​package/​squad-bootstrap.md Updates generated verifier digest.
workflows/​shared/​squad-install-verifier.mjs Rejects router in working and staged trees.
workflows/​skills/​gh-aw-enlistment/​SKILL.md Documents removal and staged-deletion rules.
.squad-templates/​skills/​gh-aw-enlistment/​SKILL.md Updates canonical skill template.
templates/​skills/​gh-aw-enlistment/​SKILL.md Synchronizes root template.
packages/​squad-cli/​templates/​skills/​gh-aw-enlistment/​SKILL.md Synchronizes CLI template.
packages/​squad-sdk/​templates/​skills/​gh-aw-enlistment/​SKILL.md Synchronizes SDK template.
.github/​skills/​agentic-workflows/​SKILL.md Deletes the mutable router.
.github/​workflows/​squad-ci.yml Removes router in clean-consumer CI.
scripts/​gh-aw-hosted-e2e.mjs Removes router during hosted installation.
test/​gh-aw-install-staging.test.ts Tests install and staged-tree rejection.
test/​gh-aw-hosted-e2e.test.ts Checks hosted removal ordering.
test/​gh-aw-enlistment-skill.test.ts Tests skill and guide instructions.
test/​gh-aw-quality.test.ts Checks router absence and maintenance retention.
README.md Updates installation guidance.
.github/​agents.md Explains intentional router removal.
docs/​src/​content/​docs/​guide/​gh-aw.md Updates install, upgrade, and verification guidance.
.changeset/​remove-mutable-gh-aw-router.md Records CLI and SDK patch changes.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The focused security fix is consistently propagated, integrity-bound, and covered by realistic installation and staging regressions.

Review effort: Balanced
Findings: None

bradygaster and others added 2 commits October 2, 2026 05:33
Reject gh-aw's unowned mutable agentic-workflows skill in final and staged installation verification while preserving the exact Squad enlistment skill.

Finding: octodemo/zava-social-queue-worker-20261002092250#1 comment 4164580830

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Document and enforce that repository routing uses the owned agentic-workflows specialist, designer, and reliability skill without the mutable gh-aw router.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@bradygaster
bradygaster force-pushed the bradygaster-remove-mutable-gh-aw-scaffold branch from 68b0a47 to ba2e2e7 Compare October 2, 2026 12:58
@bradygaster
bradygaster requested a balanced review from Copilot October 2, 2026 13:00

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The verifier’s printed recovery procedure recreates the forbidden router without removing it.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The cleanup is consistently enforced, documented, mirrored, and covered by realistic installation and staging regressions.

Review effort: Balanced
Findings: None

Resolved since last review (1)

@bradygaster
bradygaster merged commit 2b0ac27 into dev Oct 2, 2026
20 checks passed
@bradygaster
bradygaster deleted the bradygaster-remove-mutable-gh-aw-scaffold branch October 3, 2026 00:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants