[tamirdresher]

What

• Restores the hosted gh-aw E2E, which was silently skipped after the transfer. Its guard now checks the repository ID (1151205052) instead of the owner name.
• Makes github/squad/workflows the canonical gh-aw package identity. Existing bradygaster/squad/workflows installs keep verifying (exact allowlist) so they can move, with a notice that says to move them. Mixed identities or duplicate ownership records fail with guidance.
• Points uses: at github/squad/.github/actions/squad-init (same pinned SHA 5c662ba…) and passes it repository: 'github/squad'. That pinned revision still downloads releases from bradygaster/squad by default. The action's own default in this repository also becomes github/squad. The squad-init example in docs/.../features/standalone-install.md and the usage comment in action.yml also pass repository: github/squad. A test fails if any squad-init example in the repository's Markdown or YAML files lacks it.
• Every runnable gh aw add block (3 in the enlistment skill and its 4 mirrors, 3 in the gh-aw guide, 1 in README.md) first reads workflows/squad-workflows.manifest.json at the chosen revision. It stops unless the manifest declares github/squad/workflows. .github/agents.md and workflows/README.md state the same rule.
• Regenerated the package through squad-install-verifier --write-source.

Working as agentic-workflows-dev (Agentic Workflows Engineer).

Why

After the move, github.repository == 'bradygaster/squad' is never true, so the hosted E2E stopped running without any error. The verifier enforced only bradygaster/squad/workflows, so a consumer who installed github/squad/workflows@<sha> failed --verify-install. Old-path references can't rely on a redirect either. Since 2026-11-07, bradygaster/squad has been a fork of github/squad with no releases. The pinned squad-init action's release downloads from that path return 404, and anything new published there is controlled by the fork's owner.

Closes #2403

How

Identity

• Don't install bradygaster/squad/workflows anymore. Pinned revisions still resolve, now through the bradygaster/squad fork, which shares this repository's commits. But their activation downloads the Squad CLI from that fork, which has no releases. Every install hint and STOP message (skill and mirrors, guide, README.md, .github/agents.md, workflows/README.md) now points to a revision that declares github/squad/workflows. A contract test fails if a legacy-install fallback comes back. gh-aw records the identity exactly as typed (.github/aw/packages/github-squad-workflows-23a7638f599e.json for the new one).
• The verifier accepts only the exact identities github/squad/workflows (canonical) and bradygaster/squad/workflows (legacy). Case variants, other owners, and wildcards are rejected. Verification also fails whenever more than one Squad ownership record exists: legacy and canonical together, a duplicate of either identity at another path, or a case variant (for example, after reinstalling GitHub/Squad/workflows as github/squad/workflows). The error lists every record and gives one rule: after reinstalling as github/squad/workflows, delete every listed record except .github/aw/packages/github-squad-workflows-23a7638f599e.json. --verify-staged-install fails while any such record is still in the index, which covers a deletion made only in the working tree. The step-7 staging gate allows deleting exactly those records, judged by their HEAD content, and never the canonical one.
• github/squad/workflows verifies only at revisions whose workflows/squad-workflows.manifest.json declares it. For an older revision, the check says to use a revision that declares github/squad/workflows or to ask the Squad maintainers. If the manifest can't be read, it gives a separate hint.

Release downloads

• workflows/shared/squad.md passes repository: 'github/squad' to squad-init@5c662ba…. The four package workflows, their compiled locks, and the integrity manifest are regenerated. CLI downloads no longer depend on the pinned action's default or on who controls the old path.

Upgrading

• Run gh aw add "github/squad/workflows@SHA" --force, then remove .github/aw/packages/bradygaster-squad-workflows-3632054824e8.json. If the forced reinstall fails, the upgrade block stops before it removes anything (the skill, its mirrors and the guide). The recovery and legacy-move commands the verifier prints are one && chain for the same reason.
• Every block that reads the manifest first checks that SQUAD_SHA is a 40-character commit SHA. A branch name such as dev stops before the API call, the reinstall, or any cleanup.
• The printed recovery chain runs --materialize-runtime before gh aw compile --strict. That repairs a stale or missing materialized file such as .github/workflows/shared/squad.md, which gh aw add --force doesn't rewrite.
• If both ownership records exist, the verifier fails and says to reinstall as github/squad/workflows, then delete the legacy record.
• Until the upgrade is committed, gh-aw v0.91.5 compares safe updates against the locks committed at HEAD. A strict compile therefore reports four extra warnings, one each for squad, squad-implement-worker, squad-deps-worker and squad-retro. Each lists only the squad-init owner change: github/squad/.github/actions/squad-init added, bradygaster/squad/.github/actions/squad-init removed. Step 5 of the skill and the guide's warning gate allow exactly those four during this migration (summary 6 warnings). Any other warning, change, duplicate or summary still stops.
• Rollback is forward-fix only.

Review

• architect rejected the first round because the docs didn't say which revisions the new identity works at. That's fixed, and the follow-up review approved.
• Copilot's review found two upgrade gaps: a failed reinstall still deleted the legacy record, and the committed legacy locks add four warnings. Both are fixed in the second commit.
• Copilot's next review found four more gaps, all fixed in the third commit:
  • the pinned action's default release repository;
  • no SHA check before the manifest call, in the guide's Upgrading block and the README block;
  • a case-variant record beside the exact one;
  • the recovery chain skipping --materialize-runtime.
• Copilot's fourth review found two more, fixed in the fourth commit:
  • the install-time fallback to the legacy identity, whose revisions download from the fork;
  • staged verification missing a case-variant record that was deleted only from the working tree.
• Copilot's fifth review found two more, fixed in the fifth commit:
  • the standalone-install.md squad-init example, which didn't pass repository;
  • a verifier message that recommended reinstalling as the legacy identity when a legacy record sat beside a case variant.
• Copilot's sixth review found that the cleanup advice omitted the case variant when all three kinds of record coexisted, and gave non-native duplicates the wrong path. The sixth commit replaces the per-case advice with the single rule above, and the staging gate and staged check now follow the same rule.

After merge

• Optional: bump the squad-init pin to a commit with the new default. It isn't required, because the shared workflow passes repository explicitly.
• Run the identity check against the merge SHA before announcing it.

Size (>20 files): 34 files:

• 7 source files, counting the canonical skill
• 4 mirrors of that skill, kept identical by the sync script and its tests
• 5 regenerated workflows/package files and the manifest
• 11 test files and fixtures
• 5 docs files
• a changeset

Three of the docs files (README.md, gh-aw.md, standalone-install.md) carry only their gh-aw hunks, plus the squad-init example's repository line in standalone-install.md. Their link fixes were merged in #2411, and that PR's docs-site guard passes on this branch.

Validation: these suites need gh-aw v0.91.5 and jq. They ran in an LF clone of this branch, with a checksum-verified gh-aw v0.91.5 binary (SQUAD_GH_AW_BIN) and jq 1.7.1:

Command	Result
node workflows/shared/squad-install-verifier.mjs --check-source --root .	✅ manifest and digests are current
npm run gh-aw:integrity:check	✅ manifest and digests are current
npx vitest run --testTimeout=120000 --hookTimeout=120000 test/gh-aw-implement-workflow.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-verify-resource.test.ts test/gh-aw-install-staging.test.ts test/gh-aw-quality.test.ts test/gh-aw-enlistment-skill.test.ts test/gh-aw-hosted-e2e.test.ts test/squad-cli-latest.test.ts test/template-sync.test.ts	1185 passed, 6 failed: 5 timeouts while running in parallel, 1 symlink test (see below)
Rerun of the 5 timed-out tests with no parallel load	✅ 4 passed. "bounds staged reads" passes once its in-test 30 s limit is raised (Windows file I/O); the limit wasn't changed in this PR
rejects symlinked manifest leaves and runtime parents	⚠️ EPERM: this Windows machine can't create symlinks. Needs Linux CI
Red proofs	✅ 21 in the first round and 16 after the architect revision. Each one turns a test red

Validation of the review fixes (branch rebased on dev, LF clone, gh-aw v0.91.5, jq 1.7.1):

Command	Result
End-to-end reproduction: install bradygaster/squad/workflows@bf8136f6, commit it, then upgrade to github/squad/workflows with the real gh-aw v0.91.5	Strict compile 8 succeeded, 6 warnings; --approve 2 warnings; strict again 6; after commit 2. The extra four are exactly the squad-init owner change listed above
npm run gh-aw:integrity:check	✅ manifest and digests are current
vitest run --testTimeout=300000 test/template-sync.test.ts test/repo-links.test.ts test/gh-aw-enlistment-skill.test.ts	✅ 3 files, 611 passed
vitest run --testTimeout=300000 test/gh-aw-install-staging.test.ts -t "printed|recovery|legacy"	✅ 8 passed: the printed-command, recovery and legacy-move tests. The filter skips the other 20; CI runs the whole file
Red proof: the new tests against the first commit	✅ gh-aw-enlistment-skill: 56 failed, 134 passed, e.g. "gh-aw.md upgrade block with gh aw add … --force exiting 1 must keep .github/aw/packages/bradygaster-squad-workflows-3632054824e8.json …" and "undocumented warning: .github/workflows/squad-deps-worker.md … expected summary 2 warnings, found 6". The printed-command tests in gh-aw-install-staging: 5 failed, 2 passed, e.g. "files left by the printed recovery commands with gh aw add exiting 1 … expected []"
Mutations that widen the allowlist or change the compiler output	✅ rejected by the tests

Validation of the third-round fixes (c1fca3d5 on dev 9c6fb7c6, LF clone, gh-aw v0.91.5, jq 1.7.1):

Command	Result
npm run gh-aw:integrity:check	✅ manifest and digests are current
vitest run test/squad-cli-latest.test.ts test/docs-site-location.test.ts test/ci/docs-quality.test.ts test/template-sync.test.ts test/repo-links.test.ts test/gh-aw-hosted-e2e.test.ts	✅ 6 files, 643 passed
vitest run test/gh-aw-enlistment-skill.test.ts	✅ 210 passed, including the real-compiler migration with committed legacy locks
vitest run test/gh-aw-install-staging.test.ts -t "printed|recovery|legacy|materialized"	✅ 10 passed
vitest run test/gh-aw-quality.test.ts -t "case-variant|shell input security"	✅ 15 passed, including the compiled repository: github/squad check
node --test docs/tests/astro-features.test.mjs	✅ 27/27
Whole files: gh-aw-install-staging 29/30 and gh-aw-quality 376/378	⚠️ No new failures. The previous commit fails the same tests: Windows timeouts (they pass in isolation) and the symlink test (EPERM)
Migration reproduction: install the legacy package, then upgrade to this branch, before and after this commit	✅ Same strict-compile warnings and counts. The compiled locks differ only by repository: github/squad in the four package locks, plus the regenerated hashes
Red proof: the new tests against the previous commit	✅ Each fails with its fix reverted. Examples: workflows/shared/squad.md must pass repository to squad-init@5c662ba… (received bradygaster/squad); the guide and README blocks calling the contents API with ref=dev; and Installed digest mismatch for .github/workflows/shared/squad.md after the old recovery chain

Validation of the fourth-round fixes (d7dd834c on dev 9c6fb7c6, LF clone, gh-aw v0.91.5, jq 1.7.1):

Command	Result
npm run gh-aw:integrity:check	✅ manifest and digests are current
vitest run test/squad-cli-latest.test.ts test/docs-site-location.test.ts test/ci/docs-quality.test.ts test/template-sync.test.ts test/repo-links.test.ts test/gh-aw-hosted-e2e.test.ts test/gh-aw-enlistment-skill.test.ts	✅ 7 files, 877 passed
vitest run test/gh-aw-install-staging.test.ts -t "printed|recovery|legacy|materialized|case-variant|staged"	✅ 16 passed. ⚠️ "bounds staged reads" times out on Windows (30 s test and 10 s hook limits), as before. It passes with the limit raised (117 s) and in Linux CI
vitest run test/gh-aw-quality.test.ts -t "case-variant|shell input security|legacy|notice"	✅ 22 passed. Whole file: 377/378, the same as the previous commit (the Windows symlink test, EPERM)
node --test docs/tests/astro-features.test.mjs	✅ 27/27
ESLint on the verifier and both changed test files, plus markdownlint and cspell on the guide and README	✅ clean
Red proof: the new tests against the previous commit	✅ 24 enlistment failures, each naming the fallback's file:line, such as SKILL.md:276: legacy install command, gh-aw.md:2636: stay on a legacy revision, README.md:634, .github/agents.md:59 and workflows/README.md:14. Also: the step-7 gate STOPs on the case-variant record's deletion, and --verify-staged-install with …9361b4232957.json (GitHub/Squad/workflows) deleted only from the working tree…: expected 0 to be 1. Five more mutants prove the exact-allowance tests

Validation of the fifth-round fixes (8cba4d9d on dev 9c6fb7c6, LF clone, gh-aw v0.91.5, jq 1.7.1):

Command	Result
npm run gh-aw:integrity:check	✅ manifest and digests are current
vitest run test/squad-cli-latest.test.ts test/docs-site-location.test.ts test/ci/docs-quality.test.ts test/template-sync.test.ts test/repo-links.test.ts test/gh-aw-hosted-e2e.test.ts test/gh-aw-enlistment-skill.test.ts	✅ 7 files, 878 passed
vitest run test/gh-aw-quality.test.ts -t "ownership|case-variant|case-only|notice|identity records|shell input security"	✅ 26 passed. The same filter on the previous commit runs 25 tests; the extra one is the new legacy case
vitest run test/gh-aw-install-staging.test.ts -t "printed|recovery|legacy|materialized|case-variant"	✅ 11 passed
node --test docs/tests/astro-features.test.mjs	✅ 27/27
ESLint on the changed JS/TS files, plus markdownlint and cspell on standalone-install.md	✅ clean
Red proof: the new tests against the previous commit	✅ Each fails with its fix reverted. The examples test lists .github/actions/squad-init/action.yml:12: repository not passed and …/standalone-install.md:134: repository not passed. The legacy-pair test receives "After reinstalling as bradygaster/squad/workflows, delete …", and the both-records test receives the old "Keep only the record whose identity matches…" guidance

Validation of the sixth-round fix (a83f38db on dev 9c6fb7c6, LF clone, gh-aw v0.91.5, jq 1.7.1):

Command	Result
npm run gh-aw:integrity:check	✅ manifest and digests are current
vitest run test/squad-cli-latest.test.ts test/docs-site-location.test.ts test/ci/docs-quality.test.ts test/template-sync.test.ts test/repo-links.test.ts test/gh-aw-hosted-e2e.test.ts test/gh-aw-enlistment-skill.test.ts	✅ 7 files, 883 passed (5 new gate cases)
vitest run test/gh-aw-quality.test.ts -t "ownership|case-variant|case-only|notice|identity records|shell input security"	✅ 30 passed. The 26 that ran on the previous commit still pass; 4 are new
vitest run test/gh-aw-install-staging.test.ts -t "printed|recovery|legacy|materialized|case-variant"	✅ 12 passed (1 new)
node --test docs/tests/astro-features.test.mjs	✅ 27/27
ESLint on the verifier and 3 test files; markdownlint and cspell on the guide, skill and changeset	✅ clean
Red proof: the new tests against the previous commit	✅ 9 enlistment, 8 quality and 1 staging failures, each naming its inputs. For example, the triple test reports that the error must list all three records, the canonical, legacy and case-variant one. Seven more mutants each turn their guard red, for instance dropping the legacy identity from the gate, dropping the canonical-record exclusion, or limiting the staged check to case variants again

The other repo-move PRs are #2406, #2407, #2405, and #2404 (issues).

---

⚠️ Quick Check

• If SDK/CLI source files changed: completed the applicable Changeset step below (npx changeset add / .changeset/*.md, direct CHANGELOG.md entry for maintainers, or skip-changelog label for no user-facing changes)

PR Readiness Checklist

The PR readiness bot will validate these automatically after push.
Check each item before requesting review. See CONTRIBUTING.md for full details.

Branch & Commit

• Branch created from dev (not main)
• Branch is up to date with dev (git fetch upstream && git rebase upstream/dev)
• Verified diff contains only intended changes (git diff --cached --stat)
• PR is not in draft mode (mark ready when checks pass)
• Commit history is clean (squash fixups before review)

Build & Test

• npm run build passes: no package source changes (build verified on the combined repo-move tree)
• npm test passes (all tests green): targeted suites above; the full suite runs in CI
• npm run lint passes (type check clean)
• npm run lint:eslint passes
• For migration PRs (>20 files): include test output summary in PR description

Changeset

• Changeset added via npx changeset add (if packages/squad-sdk/src/ or packages/squad-cli/src/ changed): .changeset/repo-move-github-squad-gh-aw-identity.md (covers the shipped skill template)
• Or direct CHANGELOG.md entry (maintainers only — write-protected for external contributors)
• Or skip-changelog label applied (if no user-facing changes)

Docs

• README section updated (if new feature/module)
• Docs feature page (if new user-facing capability): gh-aw guide install and upgrade sections

Exports

• package.json subpath exports updated (if new module): N/A

---

Breaking Changes

None for existing installs: the bradygaster/squad/workflows identity still verifies so those installs can move, and the verifier prints a notice that says to move them. Installing under the legacy identity is no longer suggested, because those revisions download the Squad CLI from the bradygaster/squad fork, which has no releases. New installs use github/squad/workflows, and the upgrade path is documented.

Waivers

None.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit a83f38d

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	6 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	Changeset file found
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	4 active Copilot thread(s) resolved (7 outdated skipped)
❌	CI passing	9 check(s) failing: docs-quality, test, Policy Gates, samples-build, sdk-exports-validation, Changeset Drift, gh-aw strict compile, Shebang EOL, changes

Files Changed (34 files, +3158 −283)

File	+/−
.changeset/repo-move-github-squad-gh-aw-identity.md	+6 −0
.github/actions/squad-init/action.yml	+3 −2
.github/agents.md	+10 −1
.github/workflows/squad-gh-aw-hosted-e2e.yml	+3 −1
.squad-templates/skills/gh-aw-enlistment/SKILL.md	+171 −14
README.md	+26 −1
docs/src/content/docs/features/standalone-install.md	+3 −2
docs/src/content/docs/guide/gh-aw.md	+195 −19
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md	+171 −14
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md	+171 −14
scripts/gh-aw-hosted-e2e.mjs	+11 −7
templates/skills/gh-aw-enlistment/SKILL.md	+171 −14
test/fixtures/squad-init-approved.json	+1 −1
test/gh-aw-enlistment-skill.test.ts	+970 −19
test/gh-aw-hosted-e2e.test.ts	+101 −6
test/gh-aw-implement-workflow.test.ts	+3 −2
test/gh-aw-install-staging.test.ts	+243 −13
test/gh-aw-quality.test.ts	+306 −20
test/gh-aw-review-workflow.test.ts	+17 −4
test/gh-aw-verify-resource.test.ts	+22 −4
test/helpers/gh-aw-install-fixture.ts	+12 −6
test/helpers/refresh-squad-init-fixture.mjs	+2 −2
test/squad-cli-latest.test.ts	+90 −12
workflows/README.md	+14 −1
workflows/package/squad-bootstrap.md	+1 −1
workflows/package/squad-deps-worker.md	+2 −1
workflows/package/squad-implement-worker.md	+2 −1
workflows/package/squad-retro.md	+2 −1
workflows/package/squad.md	+2 −1
workflows/shared/squad-install-verifier.mjs	+208 −40
workflows/shared/squad.md	+6 −3
workflows/skills/gh-aw-enlistment/SKILL.md	+171 −14
workflows/squad-bootstrap.md	+1 −1
workflows/squad-workflows.manifest.json	+41 −41

Total: +3158 −283

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[Copilot]

🟡 Changes recommended

The upgrade flow can delete legacy verification metadata after a failed reinstall, and its warning limit blocks valid migrations with committed legacy locks.

2 open issues

• Preserve legacy ownership metadata when forced reinstall fails · New
• Allow expected action-replacement warnings during legacy lock migration · New

What changed in this PR

Updates Squad’s gh-aw distribution for the move to github/squad, restoring hosted end-to-end coverage and migrating package identity while retaining legacy-install compatibility.

Changes:

• Restores hosted E2E execution using the immutable repository ID and updated trusted-source identity.
• Adds canonical and legacy package verification, ownership-migration checks, and regenerated integrity digests.
• Updates action references, installation guides, shipped skills, and regression coverage.

File	Description
workflows/​squad-workflows.manifest.json	Updates canonical package identity and integrity digests.
workflows/​squad-bootstrap.md	Refreshes the verifier integrity digest.
workflows/​skills/​gh-aw-enlistment/​SKILL.md	Updates distributed installation and migration guidance.
workflows/​shared/​squad.md	Points the pinned squad-init action at the new owner.
workflows/​shared/​squad-install-verifier.mjs	Adds legacy identity compatibility and migration checks.
workflows/​README.md	Documents identity support by revision and migration cleanup.
workflows/​package/​squad.md	Regenerates the squad-init action reference.
workflows/​package/​squad-retro.md	Regenerates the squad-init action reference.
workflows/​package/​squad-implement-worker.md	Regenerates the squad-init action reference.
workflows/​package/​squad-deps-worker.md	Regenerates the squad-init action reference.
workflows/​package/​squad-bootstrap.md	Refreshes the generated verifier digest.
test/​squad-cli-latest.test.ts	Updates action-reference and fixture-source expectations.
test/​helpers/​refresh-squad-init-fixture.mjs	Retrieves pinned fixtures from the new repository.
test/​helpers/​gh-aw-install-fixture.ts	Supports fixtures for either package identity.
test/​gh-aw-verify-resource.test.ts	Covers legacy installs and cross-identity rejection.
test/​gh-aw-review-workflow.test.ts	Checks canonical identity across installation surfaces.
test/​gh-aw-quality.test.ts	Covers identity normalization, ownership, and integrity checks.
test/​gh-aw-install-staging.test.ts	Covers ownership staging, migration residue, and notices.
test/​gh-aw-implement-workflow.test.ts	Updates documented installation expectations.
test/​gh-aw-hosted-e2e.test.ts	Covers repository-ID guards and updated source identity.
test/​gh-aw-enlistment-skill.test.ts	Covers identity gates and migration instructions.
test/​fixtures/​squad-init-approved.json	Updates source metadata; pinned action bytes remain unchanged.
templates/​skills/​gh-aw-enlistment/​SKILL.md	Synchronizes the root skill mirror.
scripts/​gh-aw-hosted-e2e.mjs	Updates trusted identity and requires canonical hosted installs.
README.md	Adds a manifest identity check before installation.
packages/​squad-sdk/​templates/​skills/​gh-aw-enlistment/​SKILL.md	Synchronizes the SDK skill mirror.
packages/​squad-cli/​templates/​skills/​gh-aw-enlistment/​SKILL.md	Synchronizes the CLI skill mirror.
docs/​src/​content/​docs/​guide/​gh-aw.md	Documents revision checks, migration, and lock normalization.
docs/​src/​content/​docs/​features/​standalone-install.md	Updates the squad-init usage example.
.squad-templates/​skills/​gh-aw-enlistment/​SKILL.md	Updates canonical enlistment and upgrade instructions.
.github/​workflows/​squad-gh-aw-hosted-e2e.yml	Replaces the owner-name guard with the repository ID.
.github/​agents.md	Updates package references and revision requirements.
.github/​actions/​squad-init/​action.yml	Changes the default release repository and usage example.
.changeset/​repo-move-github-squad-gh-aw-identity.md	Records patch releases for the shipped skill updates.

_{Review effort: Max (auto)}

[github-actions]

🟠 Impact Analysis — PR #2410

Risk tier: 🟠 HIGH

📊 Summary

Metric	Count
Files changed	34
Files added	1
Files modified	33
Files deleted	0
Modules touched	8

🎯 Risk Factors

• 34 files changed (21-50 → HIGH)
• 8 modules touched (5-8 → HIGH)

📦 Modules Affected

ci-workflows (3 files)

• .github/actions/squad-init/action.yml
• .github/agents.md
• .github/workflows/squad-gh-aw-hosted-e2e.yml

docs (2 files)

• docs/src/content/docs/features/standalone-install.md
• docs/src/content/docs/guide/gh-aw.md

root (14 files)

• .changeset/repo-move-github-squad-gh-aw-identity.md
• README.md
• templates/skills/gh-aw-enlistment/SKILL.md
• workflows/README.md
• workflows/package/squad-bootstrap.md
• workflows/package/squad-deps-worker.md
• workflows/package/squad-implement-worker.md
• workflows/package/squad-retro.md
• workflows/package/squad.md
• workflows/shared/squad-install-verifier.mjs
• workflows/shared/squad.md
• workflows/skills/gh-aw-enlistment/SKILL.md
• workflows/squad-bootstrap.md
• workflows/squad-workflows.manifest.json

scripts (1 file)

• scripts/gh-aw-hosted-e2e.mjs

squad-cli (1 file)

• packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md

squad-sdk (1 file)

• packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md

templates (1 file)

• .squad-templates/skills/gh-aw-enlistment/SKILL.md

tests (11 files)

• test/fixtures/squad-init-approved.json
• test/gh-aw-enlistment-skill.test.ts
• test/gh-aw-hosted-e2e.test.ts
• test/gh-aw-implement-workflow.test.ts
• test/gh-aw-install-staging.test.ts
• test/gh-aw-quality.test.ts
• test/gh-aw-review-workflow.test.ts
• test/gh-aw-verify-resource.test.ts
• test/helpers/gh-aw-install-fixture.ts
• test/helpers/refresh-squad-init-fixture.mjs
• test/squad-cli-latest.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🏗️ Architectural Review

Authoritative evidence: scanners from the PR base commit, posted by the default-branch workflow_run reporter.
Results for head commit a83f38db2b22ebd32f0c0563882ce0d9ae3f4fa2.

⚠️ Architectural review: 1 warning(s).

Severity	Category	Finding	Files
🟡 warning	sweeping-refactor	This PR touches 34 files (34 modified/added, 0 deleted). Large PRs are harder to review — consider splitting if possible.	—

---

Automated architectural review — informational only.

[Copilot]

🟡 Changes recommended

The release action still defaults to the legacy repository, allowing its publisher to supply both executable archives and matching checksums if that repository path is reused.

4 open issues

• Set the action repository to github/squad · New
• Validate SQUAD_SHA before the manifest API call · New
• Reject duplicate case-variant ownership records · New
• Materialize runtime files during recovery · New

2 resolved since last review

• Preserve legacy ownership metadata when forced reinstall fails
• Allow expected action-replacement warnings during legacy lock migration

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

The legacy install fallback fetches both the CLI and checksum from a separately controlled fork, while staged verification can miss case-variant records that cause clean-checkout verification to fail.

2 open issues

• Legacy fallback trusts the separately controlled Squad fork · New
• Staged verification ignores unstaged case-variant deletions · New

4 resolved since last review

• Set the action repository to github/squad
• Materialize runtime files during recovery
• Reject duplicate case-variant ownership records
• Validate SQUAD_SHA before the manifest API call

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

The standalone-install example can run fork-controlled CLI releases in consumer CI with pre-migration pins, while the verifier still directs users to reinstall the retired package identity.

2 open issues

• Pin CLI downloads to the canonical repository for legacy revisions · New
• Recommend the canonical package for legacy and case-variant ownership conflicts · New

2 resolved since last review

• Legacy fallback trusts the separately controlled Squad fork
• Staged verification ignores unstaged case-variant deletions

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

The verifier’s cleanup guidance omits case-variant records and gives incorrect deletion paths for non-native duplicates, so following it can leave verification failing.

1 open issue

• Cleanup advice misses case-variant and non-native duplicate records · New

2 resolved since last review

• Pin CLI downloads to the canonical repository for legacy revisions
• Recommend the canonical package for legacy and case-variant ownership conflicts

_{Review effort: Max (auto)}

[Copilot]

🔵 Needs a closer look

The security-sensitive integrity and hosted-execution changes require maintainer-confirmed gh-aw v0.91.5 Linux validation and a real default-branch hosted E2E run, neither of which this snapshot review could verify.

No open issues 🎉

1 resolved since last review

• Cleanup advice misses case-variant and non-native duplicate records

_{Review effort: Max (auto)}