[bradygaster]

What

Keep lifecycle Last command fields command-only, move attribution to Updated by, and validate the pinned adapter's serialized plan-comment metadata and matching structured-data envelope. Align canonical/generated instructions and documentation, with real pinned-adapter-to-compiled-writer regression coverage.

Why

Closes #2201. Two compatible outputs were rejected by the open-mode batch guard: lifecycle examples appended attribution after the closing command backtick, and the actual pinned add_comment transport added temporary_id plus a Structured data: suffix to valid Markdown/data input. Rejecting either item prevented the whole batch from publishing. Generic synthesized inputs reproduce both failures; no captured user payloads are used.

How

Working as agentic-workflows-dev (Agentic Workflows Engineer).

The lifecycle template repair remains intact. The follow-up at 91ab258d582ce784e6c9fa8cf426d9d22ce972c3 changes only serialized-output compatibility in the command contract: allow the pinned adapter's validated bare aw_ ID shape, independently validate the existing exact draft-data schema, then require one terminal JSON envelope semantically equal to that data. Duplicate JSON keys, unsupported fields, extra/mismatching envelopes, malformed metadata, and arbitrary JSON elsewhere remain rejected. The envelope and separate data are preserved for downstream planning readers. Raw Markdown-only inputs remain compatible.

Command/actor permissions, originating-issue targeting, roster/plan constraints, acceptance/activation restrictions, unsupported-action rejection, and lifecycle/research body protections remain in force. Metadata and markers grant no authority. Writers, credentials, permissions, rollout, and dispatch behavior are unchanged.

Regression tests execute actual pinned v0.91.5 MCP tool registration, request argument validation, handlers, NDJSON serialization, collector, compiled guard, and comment/lifecycle writers. Runtime pin: github/gh-aw-actions/setup@16b430146d5d5646eccef5a1ceb72152333b18b9. GitHub/filesystem I/O is isolated; the adapter and processor execute unchanged. Before repair, this path failed on unsupported mutation fields; deleting only temporary_id still failed the body-envelope prohibition. The repaired path passes and posts the preserved plan envelope. Negatives cover missing/malformed/tampered/mismatching/duplicate envelopes, wrong ID types/shapes, invalid state/command, foreign targets, and unauthorized actions.

Independent security review of the follow-up found no vulnerabilities. Coordinator review and focused validation completed before publication. Previous hosted CI/review on 26751dc6 does not validate the new head. Hosted Copilot review has been requested for 91ab258d; new-head Squad CI is pending.

Current-head local validation (checksum-verified isolated gh-aw v0.91.5; global compiler unchanged):

Command	Result
npm run gh-aw:integrity:write && npm run gh-aw:integrity:check	Passed; all eight workflows strict-compiled and canonical/package digests checked; follow-up changes only the command-contract runtime digest
npm test -- test/gh-aw-command-authorization.test.ts test/gh-aw-command-parse.test.ts test/gh-aw-command-router-relay.test.ts test/gh-aw-plan-lifecycle.test.ts test/gh-aw-lifecycle-upsert.test.ts test/gh-aw-activate-roster-binding.test.ts test/gh-aw-activation-artifact-integrity.test.ts	Passed: 476 tests in 7 files, including actual adapter/compiled-writer coverage
npx vitest run test/gh-aw*.test.ts --maxWorkers=4	Passed: 2,234 tests in 30 files
SKIP_BUILD_BUMP=1 npm run build	Passed; avoids unrelated version bump only
npm run lint	Passed
./node_modules/.bin/eslint test/gh-aw-command-authorization.test.ts test/helpers/gh-aw-diagnostic-runtime.ts	Passed
npx markdownlint-cli2 docs/src/content/docs/guide/gh-aw.md	Passed; repository configuration checked 184 Markdown files
git diff --check	Passed
npm test and npm test -- --maxWorkers=4	Not completed locally: unrelated CLI/linked-worktree environment failures and a Docker credential-helper hang; stopped without credential interaction

The broad gh-aw run used isolated SQUAD_GH_AW_BIN/gh aw tooling and a repo-local TMPDIR with GIT_CEILING_DIRECTORIES to prevent scratch Git discovery reaching the parent worktree. Full local suite assumptions differ; no unrelated product fixes were made. Full-suite/new-head hosted results remain outstanding. No local docs build was run.

---

⚠️ Quick Check

• If SDK/CLI source files changed: completed the applicable Changeset step below (npx changeset add / .changeset/*.md, direct CHANGELOG.md entry for maintainers, or skip-changelog label for no user-facing changes)

N/A: no SDK/CLI source changes.

PR Readiness Checklist

The PR readiness bot will validate these automatically after push.
Check each item before requesting review. See CONTRIBUTING.md for full details.

Branch & Commit

• Branch created from dev (not main)
• Branch is up to date with dev (git fetch upstream && git rebase upstream/dev)
• Verified diff contains only intended changes (git diff --cached --stat)
• PR is not in draft mode (mark ready when checks pass)
• Commit history is clean (squash fixups before review)

Fork origin/dev is the base. Two focused commits; no upstream publication or default-branch push.

Build & Test

• npm run build passes
• npm test passes (all tests green)
• npm run lint passes (type check clean)
• npm run lint:eslint passes
• For migration PRs (>20 files): include test output summary in PR description

Twelve cumulative files; not a migration. Old-head hosted results are not carried forward; new-head full CI is pending.

Changeset

• Changeset added via npx changeset add (if packages/squad-sdk/src/ or packages/squad-cli/src/ changed)
• Or direct CHANGELOG.md entry (maintainers only — write-protected for external contributors)
• Or skip-changelog label applied (if no user-facing changes)

N/A: no SDK/CLI source changes. No skip label applied.

Docs

• README section updated (if new feature/module)
• Docs feature page (if new user-facing capability)

No new feature/module/capability; existing guide and walkthrough corrected, including the tool-input/serialized-output distinction.

Exports

• package.json subpath exports updated (if new module)

N/A: no SDK changes or new modules.

---

Breaking Changes

None. Supported transport compatibility is repaired without expanding command authority.

Waivers

None granted or requested. New-head hosted CI/review remains pending. No merge or auto-merge; maintainer disposition remains required.

[github-actions]

🟡 Impact Analysis — PR #2202

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	12
Files added	0
Files modified	12
Files deleted	0
Modules touched	3

🎯 Risk Factors

• 12 files changed (6-20 → MEDIUM)
• 3 modules touched (2-4 → MEDIUM)

📦 Modules Affected

docs (2 files)

• docs/demo-agentic-sdlc-walkthrough.md
• docs/src/content/docs/guide/gh-aw.md

root (8 files)

• workflows/package/squad-deps-worker.md
• workflows/package/squad-implement-worker.md
• workflows/package/squad-retro.md
• workflows/package/squad.md
• workflows/shared/squad-command-contract.mjs
• workflows/shared/squad-planning-ontology.md
• workflows/shared/squad.md
• workflows/squad-workflows.manifest.json

tests (2 files)

• test/gh-aw-command-authorization.test.ts
• test/helpers/gh-aw-diagnostic-runtime.ts

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 91ab258

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	1 check(s) failing: test

Files Changed (12 files, +566 −65)

File	+/−
docs/demo-agentic-sdlc-walkthrough.md	+3 −1
docs/src/content/docs/guide/gh-aw.md	+32 −3
test/gh-aw-command-authorization.test.ts	+425 −14
test/helpers/gh-aw-diagnostic-runtime.ts	+31 −10
workflows/package/squad-deps-worker.md	+1 −1
workflows/package/squad-implement-worker.md	+1 −1
workflows/package/squad-retro.md	+1 −1
workflows/package/squad.md	+7 −2
workflows/shared/squad-command-contract.mjs	+35 −7
workflows/shared/squad-planning-ontology.md	+6 −1
workflows/shared/squad.md	+1 −1
workflows/squad-workflows.manifest.json	+23 −23

Total: +566 −65

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[Copilot]

🟢 Approval recommended

The canonical sources, generated artifacts, documentation, and mutation-backed regression coverage consistently enforce the existing strict contract.

0 open findings

What changed in this PR

Corrects lifecycle examples to satisfy the strict command-only contract while preserving existing validation and writer behavior.

Changes:

• Separates attribution into Updated by.
• Regenerates workflow packages and integrity hashes.
• Adds compiled guard, writer, and mutation regression coverage.

File	Description
workflows/​squad-workflows.manifest.json	Updates generated integrity digests.
workflows/​shared/​squad.md	Clarifies the safe-output contract.
workflows/​shared/​squad-planning-ontology.md	Corrects the canonical lifecycle example.
workflows/​package/​squad.md	Regenerates the primary workflow package.
workflows/​package/​squad-retro.md	Regenerates the retro package.
workflows/​package/​squad-implement-worker.md	Regenerates the implementation package.
workflows/​package/​squad-deps-worker.md	Regenerates the dependency package.
test/​gh-aw-command-authorization.test.ts	Adds template-derived and mutation tests.
docs/​src/​content/​docs/​guide/​gh-aw.md	Corrects and explains the lifecycle example.
docs/​demo-agentic-sdlc-walkthrough.md	Updates the terminal lifecycle walkthrough.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

It modifies a security-sensitive authorization boundary, and current-head CI remains in progress.

0 open findings

🧠 Review effort: Balanced

[bradygaster]

Current-head validation update for 91ab258d582ce784e6c9fa8cf426d9d22ce972c3:

Squad CI run 38184019699 passed. Full npm test: 331 files passed, 10,786 tests passed, 2 skipped, 47 todo. Hosted build, npm run lint, full npm run lint:eslint, strict gh-aw compilation, docs-quality, and the remaining applicable checks passed. An earlier same-head CI run was superseded/cancelled after PR metadata changed; its replacement succeeded. Scope Boundary was skipped by its normal condition.

The actual hosted Copilot review covered this exact commit and reported 0 findings, but its disposition is Needs a closer look, citing the authorization boundary and then-pending CI. It is a COMMENTED review, not an approval. Independent pre-publication security review found no vulnerabilities. No inline review threads or actionable failures remain; maintainer review of the trust-boundary change is still appropriate. GitHub currently reports CLEAN, which does not substitute for review approval.

This supersedes the pending-CI snapshot in the description; previous-head results were not used to establish current-head validation. No merge, auto-merge, deployment, or policy changes were performed.