[bradygaster]

This is just asking for PR creation + review, not approval or publication yet — once it's reviewed/merged a human will run the actual publish per the repo's release process.

The lion's share of content for this PR is in the comment below. :)

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit a5b21a2

PR Scope: 📦🔧 Mixed (product + infrastructure)

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	4 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with main
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	CHANGELOG.md edit found
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	5 check(s) still running

Files Changed (24 files, +391 −887)

File	+/−
.copilot/skills/release-process/SKILL.md	+2 −2
.github/workflows/squad-cli-pin-drift.yml	+0 −163
.github/workflows/squad-npm-publish.yml	+0 −112
CHANGELOG.md	+13 −0
docs/src/content/docs/guide/gh-aw.md	+14 −9
package-lock.json	+5 −5
package.json	+1 −1
packages/squad-cli/package.json	+2 −2
packages/squad-cli/src/cli/commands/health.ts	+6 −0
packages/squad-sdk/package.json	+1 −1
scripts/bump-activation-pin.mjs	+0 −175
test/cli/health-command.test.ts	+27 −0
test/fixtures/squad-init-approved.json	+16 −0
test/gh-aw-quality.test.ts	+25 −22
test/helpers/refresh-squad-init-fixture.mjs	+31 −0
test/squad-cli-latest.test.ts	+219 −0
test/squad-cli-pin.test.ts	+0 −269
test/standalone-release-workflow.test.ts	+3 −13
workflows/package/squad-deps-worker.md	+2 −19
workflows/package/squad-implement-worker.md	+2 −19
workflows/package/squad-retro.md	+2 −19
workflows/package/squad.md	+2 −19
workflows/shared/squad.md	+5 −24
workflows/squad-workflows.manifest.json	+13 −13

Total: +391 −887

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[tamirdresher]

Release-prep validation for f85d443a (not an approval or publication receipt).

Current source: f85d443a46392666021738ed63b8248c04866daa; latest independently reviewed main base: 5c662ba015ec4f99befa51b0e8ca4f2148b0497f after #2164 merged. The PR diff remains seven files: approved #2165 health persistent-name fix and regression, plus 1.0.1 version/floor/changelog metadata. SDK source, NuGet source/version and all 58 historical main changesets remain unchanged. Only #2165's patch fragment was consumed.

Existing release/npm workflows require root, SDK and CLI lockstep versions. All three manifests and lockfile workspace entries are 1.0.1; CLI SDK floor is >=1.0.1. No dev promotion or NuGet republish.

Exact latest-head hosted evidence: Squad CI 37159603748 succeeded. npm run build, npm run lint, npm run lint:eslint and npm test passed: 326 files, 10,366 tests passed, 2 skipped, 47 todo. Health regression suite passed 55/55; real packaged CLI smoke passed 33/33. Required test and gh-aw strict compile, Policy Gates, Changeset Drift, exports and samples passed. Readiness run 37159602957 passed. Historical drift remains a warning, not a failing PR check; no skip labels or self-waivers.

Post-main local validation: SKIP_BUILD_BUMP=1 npm run build passed without version mutation. npm exec --no -- vitest run test/standalone-release-workflow.test.ts test/packaging-manifests.test.ts test/publish-policy.test.ts test/cli/health-command.test.ts --testTimeout=30000 --maxWorkers=1 passed 165/165. Real 1.0.1 SDK/CLI npm dry-pack metadata and required built-entry checks passed, and built CLI --version/--help passed.

Disclosed local constraints, not concealed: legacy version-stamping tests had two init assertions time out at the helper's 15-second limit; the exact two also fail on immutable published main dfe5367. Raw probes confirmed ETIMEDOUT/SIGTERM during unchanged starter-skill copies (individual copies 0.6-2.4 seconds locally). Local packaged smoke reached installation but synchronous temporary-directory cleanup prevented its final receipt; exact owned temporary paths were subsequently cleaned. Hosted canonical packaging smoke passed 33/33. Root-local Koffi wrapper/native mismatch is unchanged from main; no dependency workaround or test weakening was added.

Independent review of the CURRENT head is still required. A human reviewer has been requested; this comment is evidence, not an approving review. After normal human merge, verify main contains approved version 1.0.1. Main-push release is the existing path; a human-only manual trigger, if needed, is gh workflow run squad-release.yml --repo bradygaster/squad --ref main -f confirm_tag=v1.0.1.

.copilot/skills/release-process/SKILL.md:23 states: "Only a human executes those triggers; human approval alone does not authorize an agent to fire them." No agent publication dispatch has been executed. Verify actual npm versions/latest and standalone/Homebrew/WinGet receipts separately before claiming release. NuGet is untouched. This comment does not edit the human-authored PR body or waive any requirements.

[IEvangelist]

LGTM

[tamirdresher]

Combined 1.0.1 preparation — current-head CI and human review required

Combined head: a5b21a2274e1b85f041bb3f5ea5e573b40b85fad.
Main base: 5c662ba015ec4f99befa51b0e8ca4f2148b0497f; prior candidate head was f85d443a46392666021738ed63b8248c04866daa. Main and fork/PR heads were checked before integration and again immediately before the normal personal-feature-branch push.

Approved scope: exactly 24 main-relative files (the seven existing release/health files plus the 17 related #2167 source/workflow/test/generated-contract files). This follows the user's conditional inclusion decision and Brady's explicit 24-related-file scope approval at 2026-10-04 08:37:31Z. Scope approval is not a CI, current-head review, merge or publication waiver.

Integrated only the technical changes from 90c5396c, 2385cf75, 0e881f72 and 50e4b3ad, without merging dev history. The first application produced seven conflicts: docs/shared bootstrap were resolved surgically; four generated package workflows and the integrity manifest were regenerated from combined main canonical sources and main runtime bytes, not copied from dev. No conflicts remain. The only three deletions are the approved obsolete CLI-pin drift workflow, bump script and old pin test.

The action remains pinned to maintainer-approved immutable official revision 5c662ba015ec4f99befa51b0e8ca4f2148b0497f; the independently verified action/installer golden fixture and Bash regression are byte-equivalent to approved source head 50e4b3ad. Latest stable standalone selection, mandatory fail-closed checksum verification, immutable source/compiler-action pins and all tamper assertions remain intact.

Actual local validation:

• SKIP_BUILD_BUMP=1 npm run build: PASS for SDK and CLI. No candidate build waiver was used; preserved existing exact dependencies sufficed. No dependencies were installed/restored.
• npm test -- test/cli/health-command.test.ts test/squad-cli-latest.test.ts test/standalone-build.test.ts test/standalone-release-workflow.test.ts: 117 distinct cases passed across the initial run and bounded retry. Initial run passed 116 with one Windows Git-Bash launcher timeout; retrying that valid-install case passed.
• Selected test/gh-aw-quality.test.ts canonical integrity, shared health-before-dispatch and compiled latest-default contracts: 31 distinct cases passed across runs, including all canonical tamper negatives. Initial run passed 23; seven hit Windows elapsed-time budgets and one scratch export lacked an existing skill file. After copying the missing existing .github/skills inputs, rerunning only those eight cases passed 8/8 with bounded scratch-only Windows timing budgets. Repository assertions and repository timeout values were not changed or weakened. Native verification used the already installed gh-aw v0.89.22 binary.
• Executed all six actual pinned-action cases under Linux Bash via WSL: valid installation plus checksum-download failure, missing/duplicate/malformed checksum entries and archive mismatch: PASS. Failure cases preserve the installed CLI and do not extract archives.
• Existing integrity verifier writeSource / checkSource and independent test/helpers/gh-aw-install-fixture.ts compilation verified the combined-main contracts and immutable compiler-pin rejection. Both mutated-lock digests were recomputed from main: workflow e28d35cd3ae0b920479279c777b26c68a339163a6886794ba82c1c04e28e75d6; package 7077085c3f31824fbea10ad7e963e10e5cb67819523a1815b9795839fe97fb02. They match dev because the consumed content is equivalent, not because dev hashes were copied blindly. Only the four activation workflow entries and shared activation digest changed in the manifest.
• Whitespace/staging/deletion/scope guards passed. Owned scratch was cleaned; checkout is clean.

Release invariants preserved: #2165's health persistent-name fix remains unchanged; root/SDK/CLI versions and lock remain 1.0.1, CLI SDK floor remains >=1.0.1. SDK runtime source, independent NuGet package and historical changeset fragments are untouched. The 1.0.1 changelog now explicitly includes latest-stable installation and the bound checksum-installer repair.

Source-only CI 37189324797 was independently confirmed SUCCESS at exact source head 50e4b3ad0d6cb3c81fe2723336b8d9ffa5956346. It does not certify this new combined-main head. Require fresh CI on a5b21a22 and independent/current-head human review; the old approval on f85d443a does not cover this source expansion. No main/dev push, force/amend, PR approval/merge, tag, promotion, publication or recovery workflow dispatch was performed. #2167's formal human-review gate was not changed.

[tamirdresher]

Fresh combined-head CI receipt: Squad CI 37195077922 is COMPLETED / SUCCESS at exact head a5b21a2274e1b85f041bb3f5ea5e573b40b85fad. PR #2166 is open at that head, based on 5c662ba015ec4f99befa51b0e8ca4f2148b0497f; the local checkout is clean. Integration/build/regeneration/push are complete; no local validation command remains active.

Runtime side-experiment results are limited evidence, not blanket release approval: reported fresh preset init, health/status/doctor, state-preserving re-init/upgrade and 1.0.1 paths/stamps passed; the bounded live Copilot prompt produced no output/file and remains BLOCKED / inconclusive, not PASS or a proven regression. Corrected routing-health probes and exact published-1.0.0 baseline comparison remain pending with the separate experiment owner. The withdrawn cast-wizard negative probe is not a valid regression signal and causes no scope expansion.

Current-head independent/human review remains required; the prior f85 approval does not cover this combined source change. No merge, approval or publication/promotion/recovery dispatch has been performed.

[tamirdresher]

Real isolated CLI regression experiment completed against candidate 1.0.1, clean combined head a5b21a2 (CLI entry SHA-256 e5d255ad2c30bb58e4b14c7335e07f8cde32d0f8595c14f035d3ece9d09349b9). No production repository/state was modified by the experiment.

Passed: fresh default-preset initialization; real health JSON (squad-health/v1), status and doctor (10 passed, 0 failures/warnings); valid registered-member routing; unknown routing rejection with exit 1 and structured unknown agent diagnostic; restoration to a passing route; re-init/upgrade preservation of decisions, history and custom charters; version stamps and generated file paths.

Baseline comparison: the official published 1.0.0 Windows archive was checksum-verified and used to initialize another fresh squad. Both 1.0.0 and the candidate show five active registry members but zero generated capability counts. This is a pre-existing limitation, not a confirmed 1.0.1 regression; it was not silently fixed or swept into this release.

Coverage limitation: one actual bounded Copilot/Squad prompt was attempted for 300 seconds, but produced no output or generated-file evidence. Live execution remains inconclusive, not a pass and not proof of a new regression. No additional prompt was run and no authentication/gate was bypassed.

Overall: core CLI functional checks pass with no confirmed new regression in the covered scenarios, but live-model execution is not certified. Combined CI passed at this head: https://github.com/bradygaster/squad/actions/runs/37195077922 . Fresh independent human review, normal merge, and human-only publication triggers remain required. No 1.0.1 publication is claimed.

[tamirdresher]

@bradygaster — Pine has now approved the exact combined head a5b21a2274e1b85f041bb3f5ea5e573b40b85fad. GitHub reports this PR OPEN / APPROVED / CLEAN, with no failed or pending checks.

The next action is a normal human merge of this PR into main. No further code changes or scope approval are pending for this candidate. That main push should start the normal 1.0.1 release workflow. If it does not, first confirm merged main has root/SDK/CLI version 1.0.1, then a human may run:

gh workflow run squad-release.yml --repo bradygaster/squad --ref main -f confirm_tag=v1.0.1

We will verify actual npm CLI/SDK versions and latest tags, GitHub archives/checksums, Homebrew, and WinGet submission/catalog receipts after publication. No 1.0.1 release is published yet; current GitHub release, Homebrew, and upstream WinGet remain 1.0.0. The independent NuGet package stays 1.0.0.

The bounded real CLI checks pass; live Copilot execution remains explicitly inconclusive as recorded in the regression evidence, not certified. No review or publication gate is bypassed.

Sharing this here because the Teams connector is currently unavailable and chat monitoring cannot read/send until it returns.

[tamirdresher]

@bradygaster — 1.0.1 is partially published; the remaining channel recovery needs maintainer action.

Successful: stable/latest GitHub release and all six platform archives plus SHA256SUMS are uploaded:
https://github.com/bradygaster/squad/releases/tag/v1.0.1

Run: https://github.com/bradygaster/squad/actions/runs/37222633918

1. npm: SDK publishing was accepted (+ @bradygaster/squad-sdk@1.0.1; npm says processing may take a few minutes), but the 75-second version/latest verification window expired. CLI publication was skipped because the SDK job failed verification. This is not evidence that NPM_TOKEN is invalid; do not rotate it blindly. Retry the failed SDK job once registry processing settles so CLI can proceed.
2. Homebrew: preflight explicitly reports HOMEBREW_TAP_TOKEN cannot authenticate to GitHub — likely invalid, expired or revoked. Rotate it with the required Homebrew tap write access.
3. WinGet: preflight explicitly reports WINGET_CREATE_GITHUB_TOKEN cannot authenticate — likely invalid, expired or revoked. Rotate it with push access to the personal winget-pkgs fork and ability to open the upstream submission, including Microsoft organization SSO authorization if required.

A repository admin can replace these secrets safely at https://github.com/bradygaster/squad/settings/secrets/actions — please do not paste credential values into chat/comments. Use the least privileges required by the configured workflow.

After those credentials are fixed and npm processing has settled, a human should choose Re-run failed jobs on the existing run, or execute:

gh run rerun 37222633918 --repo bradygaster/squad --failed

Do not recreate the 1.0.1 tag/release or rerun successful bundle-upload jobs. We will verify CLI/SDK npm latest, the actual Homebrew cask commit, and the real WinGet PR/catalog receipt afterward. No all-channel completion claim yet; NuGet stays independently versioned at 1.0.0.

Teams tools are unavailable, so I am giving the exact recovery instructions here rather than claiming a Teams delivery.

[tamirdresher]

@bradygaster — great milestone: the WinGet 1.0.1 update is merged! 🎉

microsoft/winget-pkgs#446667 was merged by Microsoft’s policy bot at 2026-10-04T20:02:05Z. All three manifests are upstream. After refreshing the local WinGet source, the catalog still lists 1.0.0; 1.0.1 propagation is not yet confirmed, so I am not claiming searchable availability yet.

Already live:

• GitHub 1.0.1 and all six archives/checksums: https://github.com/bradygaster/squad/releases/tag/v1.0.1
• Homebrew 1.0.1: https://github.com/bradygaster/homebrew-squad/blob/main/Casks/squad.rb
• Verified Homebrew recovery commit: bradygaster/homebrew-squad@4291000

Remaining: npm SDK publishing was accepted but its post-publish verification timed out; CLI publication was skipped. Run https://github.com/bradygaster/squad/actions/runs/37222633918 is still failed at attempt 1. A human failed-job rerun is needed to finish npm; the invalid CI credentials for future Homebrew/WinGet automation also still need rotation. The independent NuGet package remains 1.0.0.

The merged WinGet PR no longer needs a description edit. We have not called all channels complete. Teams sending tools are currently unavailable, so this is the verified status shared here instead of a claimed Teams delivery.