Repository navigation
feat(gh-aw): opt-in CAO research wave evidence gate - #2226
Merged
Merged
Conversation
Add a trusted, opt-in CAO evidence provider hook. Without a .squad/cao-evidence-provider.json descriptor, Squad behaves exactly as before. - research: hash-pinned runtime collects run-bound evidence pre-agent (App auth only in native v1; PAT fails as unsupported), native validation, immutable artifact retention, publication gate, deterministic provenance writer - triage/plan modes: restore referenced wave artifact, validate natively and via CAO --validate-bundle before the agent; failure blocks publication - manifest capability marker evidence_provider_schema; regenerated package copies, aw.yml, manifest and digests via native integrity tooling Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c26cd4b2-4915-4ada-991d-29493af6106d
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 2 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ❌ | Copilot threads resolved | 1 unresolved Copilot thread(s) — fix and resolve before merging |
| ✅ | CI passing | All checks passing |
Files Changed (22 files, +1552 −51)
| File | +/− |
|---|---|
.github/workflows/squad-ci.yml |
+1 −1 |
docs/src/content/docs/guide/gh-aw.md |
+6 −5 |
scripts/gh-aw-hosted-e2e.mjs |
+4 −4 |
test/gh-aw-evidence-provider.test.ts |
+462 −0 |
test/gh-aw-hosted-e2e.test.ts |
+1 −1 |
test/gh-aw-implement-workflow.test.ts |
+1 −1 |
test/gh-aw-lifecycle-upsert.test.ts |
+10 −1 |
test/gh-aw-quality.test.ts |
+4 −2 |
workflows/README.md |
+76 −0 |
workflows/aw.yml |
+2 −0 |
workflows/package/squad-bootstrap.md |
+1 −1 |
workflows/package/squad-deps-worker.md |
+44 −1 |
workflows/package/squad-implement-worker.md |
+44 −1 |
workflows/package/squad-retro.md |
+44 −1 |
workflows/package/squad.md |
+162 −1 |
workflows/shared/squad-evidence-provider.mjs |
+481 −0 |
workflows/shared/squad-install-verifier.mjs |
+8 −1 |
workflows/shared/squad-planning-ontology.md |
+10 −0 |
workflows/shared/squad.md |
+44 −1 |
workflows/squad-bootstrap.md |
+1 −1 |
workflows/squad-workflows.manifest.json |
+37 −28 |
workflows/squad.md |
+109 −0 |
Total: +1552 −51
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
🟠 Impact Analysis — PR #2226Risk tier: 🟠 HIGH 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (1 file)
docs (1 file)
root (14 files)
scripts (1 file)
tests (5 files)
This report is generated automatically for every PR. See #733 for details. |
Contributor
🏗️ Architectural Review
Automated architectural review — informational only. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Source-path validation rejects valid filenames, restoration checks the wrong run attempt, and existing research-writer fixtures lack the required checkout.
3 open findings
What changed in this PR
Adds opt-in CAO evidence collection and validation to Squad’s research and planning workflows, preserving behavior when no provider is installed.
Changes:
- Collects run-bound evidence and restores it for downstream planning.
- Gates publication and adds trusted evidence provenance.
- Updates package metadata, documentation, and tests.
| File | Description |
|---|---|
| workflows/squad.md | Adds evidence preparation and publication gates. |
| workflows/squad-workflows.manifest.json | Registers provider capability and updated digests. |
| workflows/squad-bootstrap.md | Updates verifier digest. |
| workflows/shared/squad.md | Adds evidence validation and research provenance. |
| workflows/shared/squad-planning-ontology.md | Documents downstream evidence lineage. |
| workflows/shared/squad-install-verifier.mjs | Extends integrity and ownership contracts. |
| workflows/shared/squad-evidence-provider.mjs | Implements provider validation, collection, and restoration. |
| workflows/README.md | Documents opt-in setup and evidence constraints. |
| workflows/package/squad.md | Regenerates packaged evidence gates. |
| workflows/package/squad-retro.md | Regenerates shared research writer. |
| workflows/package/squad-implement-worker.md | Regenerates shared research writer. |
| workflows/package/squad-deps-worker.md | Regenerates shared research writer. |
| workflows/package/squad-bootstrap.md | Updates packaged verifier digest. |
| workflows/aw.yml | Registers evidence runtime resource. |
| test/gh-aw-quality.test.ts | Updates resource contract assertions. |
| test/gh-aw-implement-workflow.test.ts | Updates documented resource count assertion. |
| test/gh-aw-hosted-e2e.test.ts | Updates expected package topology. |
| test/gh-aw-evidence-provider.test.ts | Adds evidence validation and workflow-contract tests. |
| scripts/gh-aw-hosted-e2e.mjs | Updates topology checks. |
| docs/src/content/docs/guide/gh-aw.md | Updates installation resource inventory. |
| .github/workflows/squad-ci.yml | Updates installed resource count check. |
Review effort: Balanced
| const paths = new Set(); | ||
| for (const file of repository.files) { | ||
| keys(file, ['path', 'truncated'], 'source file'); | ||
| safeRelative(file.path); |
Comment on lines
+94
to
+96
| const root = join(process.env.GITHUB_WORKSPACE, '.squad-evidence-trusted-base'); | ||
| const evidence = await import(pathToFileURL(join(root, | ||
| '.github/workflows/shared/squad-evidence-provider.mjs')).href); |
Comment on lines
+457
to
+459
| const { data: run } = await github.rest.actions.getWorkflowRun({ | ||
| owner, repo, run_id: reference.run_id, | ||
| }); |
This was referenced Oct 14, 2026
Restore the trusted checkout in legacy research writer fixtures without changing no-provider publication. Validate descriptive source paths separately from extracted bundle paths so spaces and bracketed route names are accepted. Restore the referenced successful workflow attempt rather than the latest rerun, retaining exact producer identity and all bundle validation gates. Add direct path and retry regressions and regenerate the runtime digest. Closes #2226 review findings. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c26cd4b2-4915-4ada-991d-29493af6106d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/squad research.Validation
gh-aw:integrity:checkpassed.Pairs with CAO commit
1d34979a1in bradygaster/gh-aw-cao. CAO onboarding requires this capability marker in Squaddev.