Repository navigation
feat: bring agentic bootstrap upstream with gh-aw 1.x integrity support - #2413
bradygaster wants to merge 8 commits into
Conversation
Relates to bradygaster#1. Preserve canonical upstream references and the intended unpinned 1.x target without claiming an unsupported installation contract. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 8 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ❌ | Branch up to date | dev is 3 commit(s) ahead — rebase recommended |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | All 1 Copilot thread(s) resolved |
| ❌ | CI passing | 4 check(s) failing: test, test, test, Verify exact SHA and build evidence |
Files Changed (41 files, +775 −285)
| File | +/− |
|---|---|
.changeset/gh-aw-upstream-one.md |
+6 −0 |
.github/agents.md |
+1 −1 |
.github/workflows/squad-ci.yml |
+4 −4 |
.github/workflows/squad-gh-aw-hosted-e2e.yml |
+2 −2 |
.github/workflows/squad-release-verify.yml |
+2 −2 |
.squad-templates/skills/gh-aw-enlistment/SKILL.md |
+47 −24 |
agents-agentic-workflows.md |
+32 −0 |
cspell.json |
+1 −0 |
docs/src/content/docs/guide/gh-aw.md |
+114 −30 |
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md |
+47 −24 |
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md |
+47 −24 |
templates/skills/gh-aw-enlistment/SKILL.md |
+47 −24 |
test/gh-aw-activate-fast-path-label-provisioning.test.ts |
+3 −1 |
test/gh-aw-activation-capacity.test.ts |
+4 −2 |
test/gh-aw-activation-finalization.test.ts |
+17 −4 |
test/gh-aw-activation-label-provisioning.test.ts |
+1 −1 |
test/gh-aw-activation-temporary-ids.test.ts |
+4 −2 |
test/gh-aw-bootstrap-workflow.test.ts |
+2 −0 |
test/gh-aw-command-authorization.test.ts |
+30 −4 |
test/gh-aw-compiler-compatibility.test.ts |
+91 −0 |
test/gh-aw-deps-routing.test.ts |
+2 −0 |
test/gh-aw-deps-worker-workflow.test.ts |
+4 −0 |
test/gh-aw-enlistment-skill.test.ts |
+51 −21 |
test/gh-aw-implement-workflow.test.ts |
+4 −1 |
test/gh-aw-install-staging.test.ts |
+21 −0 |
test/gh-aw-quality.test.ts |
+24 −20 |
test/gh-aw-review-workflow.test.ts |
+4 −2 |
test/helpers/gh-aw-diagnostic-runtime.ts |
+18 −8 |
test/helpers/gh-aw-install-fixture.ts |
+10 −1 |
test/squad-cli-latest.test.ts |
+1 −0 |
workflows/aw.yml |
+1 −1 |
workflows/package/squad-bootstrap.md |
+1 −1 |
workflows/package/squad-review.md |
+1 −0 |
workflows/package/squad.md |
+7 −3 |
workflows/shared/squad-command-contract.mjs |
+2 −2 |
workflows/shared/squad-install-verifier.mjs |
+27 −9 |
workflows/skills/gh-aw-enlistment/SKILL.md |
+47 −24 |
workflows/squad-bootstrap.md |
+1 −1 |
workflows/squad-review.md |
+1 −0 |
workflows/squad-workflows.manifest.json |
+39 −39 |
workflows/squad.md |
+7 −3 |
Total: +775 −285
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Final cache supplement: read-only audit of candidate-specific npm content-addressed artifacts found 325 digest-verified locked tarballs, one missing locked tarball (hono@4.13.17), zero invalid tarballs, and 168 required entries without per-entry tarball integrity metadata. YAML/Vitest/Vite archives are verified cached; cached tools are not a complete project installation. The six matching / 488 uncovered figures above concern retained installed trees only. The required approved Hono artifact remains absent from the known retained trees and its exact cache key, while official connectivity fails. No artifact extraction, dependency substitution or clean-install/full-build claim was made. This exhausts the authorized final recovery alternative; candidate/worktree remain preserved and unpushed.
Refs #2413. Preserve immutable compiler actions, native ownership, full lock digests and unconditional final review enforcement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
bradygaster
changed the title
Refs #2413. Validate unsized attributed issue bodies before reservation, accept the pinned serialized-plan envelope, and preserve unapproved compiler auxiliary files. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Refs #2413. Add the compiler-generated filename term to the existing documentation dictionary. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
1 open issue
What changed in this PR
Migrates the Squad gh-aw package identity from the fork to github/squad, upgrades the pinned gh-aw toolchain to v1.0.1, and updates the workflow/runtime contracts, documentation, and tests to match the new compiler and install surfaces.
Changes:
- Bump pinned gh-aw and gh-aw-actions references from v0.91.5 to v1.0.1 across workflows, verifier, CI, and docs.
- Switch package/install identity from
bradygaster/squad/workflowstogithub/squad/workflows(including ownership paths/digests). - Update activation issue-body rendering to gh-aw v1.0.1 report rendering, and add/extend verification + compatibility tests.
| File | Description |
|---|---|
| workflows/squad.md | Update pinned gh-aw-actions setup version and adjust issue body rendering glue for v1.0.1. |
| workflows/squad-workflows.manifest.json | Update package identity, minimum gh-aw version, and digests/lock hashes for the new contract. |
| workflows/squad-review.md | Add new detection-gate: status-only metadata for the review job. |
| workflows/squad-bootstrap.md | Update embedded resource digest for the updated verifier runtime. |
| workflows/skills/gh-aw-enlistment/SKILL.md | Migrate install instructions to github/squad, shift to “stable 1.x” compiler family guidance, and update staging exclusions. |
| workflows/shared/squad.md | Use github/squad action namespace and pass repository to force canonical releases. |
| workflows/shared/squad-install-verifier.mjs | Update package constants to github/squad, bump min/version pins to v1.0.1, expand action pin contract, and update ownership validation. |
| workflows/shared/squad-command-contract.mjs | Update structured-data parsing regex for v1.0.1 report formatting. |
| workflows/package/squad.md | Mirror workflows/squad.md changes in the packaged source workflow. |
| workflows/package/squad-review.md | Mirror workflows/squad-review.md detection gate metadata. |
| workflows/package/squad-retro.md | Move standalone installer action reference to github/squad and pass repository. |
| workflows/package/squad-implement-worker.md | Move standalone installer action reference to github/squad and pass repository. |
| workflows/package/squad-deps-worker.md | Move standalone installer action reference to github/squad and pass repository. |
| workflows/package/squad-bootstrap.md | Update embedded resource digest for the updated verifier runtime. |
| workflows/aw.yml | Bump minimum gh-aw version required by the package manifest to v1.0.1. |
| workflows/README.md | Update installation command to new package identity (github/squad/workflows). |
| test/squad-cli-latest.test.ts | Assert the shared workflow uses github/squad action and sets repository. |
| test/helpers/gh-aw-install-fixture.ts | Update source annotations and installer strings to new github/squad + v1.0.1 contract. |
| test/helpers/gh-aw-diagnostic-runtime.ts | Update pinned runtime SHA and tighten sandbox allow/deny rules with better error attribution. |
| test/gh-aw-verify-resource.test.ts | Update mutation tests to reflect github/ owner in source binding checks. |
| test/gh-aw-review-workflow.test.ts | Update expected min-version and package install surfaces to github/squad. |
| test/gh-aw-quality.test.ts | Update pinned setup SHA, adjust compile-failure expectations, and expand pin/credential failure checks. |
| test/gh-aw-install-staging.test.ts | Add coverage that staging excludes auxiliary gh-aw outputs while preserving pre-existing files; update recovery command text. |
| test/gh-aw-implement-workflow.test.ts | Update expected install command and tighten assertions around if: expression shape. |
| test/gh-aw-hosted-e2e.test.ts | Update expected ownership path and trusted source identity to github. |
| test/gh-aw-enlistment-skill.test.ts | Update the enlistment skill contract tests for stable 1.x preflight behavior and new package identity. |
| test/gh-aw-compiler-compatibility.test.ts | New: explicit tests for the gh-aw 1.x upstream installation/ownership contract and pin mutation rejection. |
| test/gh-aw-command-authorization.test.ts | Extend sandbox IO forbiddance coverage and update report/handler expectations for v1.0.1 formatting. |
| test/gh-aw-activation-temporary-ids.test.ts | Update required compiler version strings to v1.0.1. |
| test/gh-aw-activation-label-provisioning.test.ts | Update required compiler version strings to v1.0.1. |
| test/gh-aw-activation-finalization.test.ts | Wire report AST module into the compiled fixture and adjust sizing logic to new renderer behavior. |
| test/gh-aw-activation-capacity.test.ts | Update required compiler version strings to v1.0.1. |
| test/gh-aw-activate-fast-path-label-provisioning.test.ts | Update required compiler version strings to v1.0.1. |
| templates/skills/gh-aw-enlistment/SKILL.md | Mirror enlistment skill updates in the template. |
| scripts/gh-aw-hosted-e2e.mjs | Update trusted source identity from bradygaster to github and docs references accordingly. |
| packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md | Mirror enlistment skill template updates for squad-sdk packaging. |
| packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md | Mirror enlistment skill template updates for squad-cli packaging. |
| docs/src/content/docs/guide/gh-aw.md | Update the guide for the new compiler contract (v1.0.1), new package identity, staging exclusions, and add a 1.x compatibility section. |
| cspell.json | Add agentics to dictionary. |
| agents-agentic-workflows.md | New: bootstrap prompt aligned to the new v1.0.1/github/squad contract and auxiliary-output handling. |
| README.md | Update install command to use github/squad/workflows. |
| .squad-templates/skills/gh-aw-enlistment/SKILL.md | Mirror enlistment skill changes in the .squad-templates copy. |
| .github/workflows/squad-standalone-release.yml | Update release automation URL references to the new github/squad repo. |
| .github/workflows/squad-release-verify.yml | Bump pinned gh-aw install in CI to v1.0.1. |
| .github/workflows/squad-gh-aw-hosted-e2e.yml | Update repo gate from fork to github/squad and bump gh-aw pin to v1.0.1. |
| .github/workflows/squad-ci.yml | Bump pinned gh-aw install steps in CI to v1.0.1. |
| .github/agents.md | Update installation command and narrative to v1.0.1 + github/squad. |
| .changeset/gh-aw-upstream-one.md | New changeset documenting the gh-aw 1.x + upstream github/squad migration for published packages. |
Review effort: Lite (auto)
Part of #2413. Preserve canonical identity and upstream fixes, seed canonical compiler pins in strict fixtures, fail early on incompatible 1.x output, and require explicit bootstrap trust/confirmation boundaries. Retain all finalization boundary assertions with a targeted real-runtime timeout. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c8c234f1-ee3b-49e1-9406-11d4a2238c23
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c8c234f1-ee3b-49e1-9406-11d4a2238c23
🟠 Impact Analysis — PR #2413Risk tier: 🟠 HIGH 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (4 files)
docs (1 file)
root (15 files)
squad-cli (1 file)
squad-sdk (1 file)
templates (1 file)
tests (18 files)
This report is generated automatically for every PR. See #733 for details. |
🏗️ Architectural Review
Automated architectural review — informational only. |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c8c234f1-ee3b-49e1-9406-11d4a2238c23
Final published-HEAD validation —
|
| Exact command | Result |
|---|---|
gh aw add github/squad/workflows@72111f4b83d89410ad421c5fa37321b8b785d0a0 |
Passed in a new consumer workspace. |
node .github/workflows/shared/squad-install-verifier.mjs --materialize-runtime |
Passed. |
gh aw compile --strict --no-check-update |
Passed: eight workflows, two documented trigger warnings. Canonical pins seeded through compileWithPinnedActions. |
node .github/workflows/shared/squad-install-verifier.mjs --verify-install --source-revision 72111f4b83d89410ad421c5fa37321b8b785d0a0 --strict-compile |
Passed. |
node .github/workflows/shared/squad-install-verifier.mjs --verify-staged-install --stage-ownership --source-revision 72111f4b83d89410ad421c5fa37321b8b785d0a0 |
Passed. |
SKIP_BUILD_BUMP=1 npm run build |
Passed on final HEAD before push. |
npm run gh-aw:integrity:check |
Passed on final HEAD. |
npm run lint |
Passed on final HEAD. |
npm test -- test/gh-aw-activation-temporary-ids.test.ts test/gh-aw-activation-capacity.test.ts test/gh-aw-activate-fast-path-label-provisioning.test.ts test/gh-aw-bootstrap-workflow.test.ts test/gh-aw-deps-routing.test.ts test/gh-aw-deps-worker-workflow.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-enlistment-skill.test.ts test/gh-aw-activation-finalization.test.ts test/gh-aw-compiler-compatibility.test.ts |
Passed on final HEAD: 893 tests, ten suites. |
Inspected all eight emitted source revisions and immutable setup pins, read-only model repository scopes (copilot-requests: write is the model-invocation permission), and exact Bootstrap conclusion permissions. Actual installed-byte mutation was rejected with a digest mismatch; restored original bytes and repeated strict native/staged verification successfully. Earlier real source mutation of the truncating formatter failed both oversized-body boundary tests as intended; all six original boundary cases remain.
Local full-suite disclosure: at 54b027c28b01fcebf73c135cc237b65c5c72bf27, npm test -- --maxWorkers=4 had 13,213 passes and two unchanged macOS external-state export-fixture failures (plus 35 expected failures, 158 skips, 46 todo). No full local-green claim or excluded state-plumbing modification. Subsequent integrations are independent upstream updates.
Completed published-HEAD evidence (unchanged public 72111f4b)
Squad CI 42670698493 failed one strict implement-worker mutation fixture, with 13,237 tests passed. Squad Release Verify 42670521577 failed 18 tests across five unseeded fixture suites, with 13,220 passed. Both diagnosed CTR-002 mutable action references. The cycle-1 terminal snapshot had 28 passing checks, two failures and two policy skips; no failure was waived. Subsequent metadata-only same-head CI reruns are not validation of the unpublished repair below.
Cycle 2 — bounded scope authorized, fix committed locally, external restore blocker
Requester explicitly authorized exactly the five additional fixture files / 23 total direct repair files. Scope authorization is no longer a blocker. Local commit 08ee51f567ed82e7a4c5a0d4b8c66f57f559a8f9 adds only eleven lines across the five authorized tests (five imports, six existing canonical pin-seed calls), preserving all strict checks and mutation assertions. It normally merges baseline dev b1f25353553c22d0bb8d42faae14ec321c50b6c7; fourteen consumed changeset deletions exactly match inherited dev. No authored deletion or broader repair.
Not pushed, not merged. Dependency restore prevents the mandatory local build gate:
| Exact command | Actual result |
|---|---|
npm ci --no-audit --no-fund |
Failed E404 for baseline-locked hono@4.13.17 in configured mirror. |
npm ci --registry=https://registry.npmjs.org --no-audit --no-fund |
Failed ENOTCONN retries, then npm exit-handler error. |
npm ci --offline --no-audit --no-fund |
Failed ENOTCACHED for locked zod-to-json-schema@3.25.2. |
npm view hono@4.13.17 dist --json --fetch-retries=0 |
Failed E404, no version in configured mirror. |
npm rebuild --offline --ignore-scripts |
Existing-tool rebuild returned success; complete dependency restore was not established. |
npm run gh-aw:integrity:check |
Blocked: missing yaml. |
npm run lint |
Exit 127: missing tsc. |
SKIP_BUILD_BUMP=1 npm run build |
Exit 127: missing tsc; cannot push past mandatory build gate. |
npm test -- test/gh-aw-activation-temporary-ids.test.ts test/gh-aw-activation-capacity.test.ts test/gh-aw-activate-fast-path-label-provisioning.test.ts test/gh-aw-bootstrap-workflow.test.ts test/gh-aw-deps-routing.test.ts test/gh-aw-deps-worker-workflow.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-enlistment-skill.test.ts test/gh-aw-activation-finalization.test.ts test/gh-aw-compiler-compatibility.test.ts test/gh-aw-activation-label-provisioning.test.ts test/gh-aw-activation-summary-outcomes.test.ts test/gh-aw-evidence-provider.test.ts test/gh-aw-implement-workflow.test.ts test/gh-aw-implementation-provenance.test.ts |
Exit 127: missing vitest; no cycle-2 focused-suite pass claimed. |
Bounded direct npm/Yarn TLS artifact probes also failed connectivity; the public Microsoft feed's direct artifact GET returned 404. The release engineer independently confirmed a clean current-dev restore also fails on this Hono artifact and has no working secure alternate route. The baseline changed Hono from published head's 4.13.7 to 4.13.17; this repair retains the baseline dependency/version/integrity unchanged. No lockfile weakening, package downgrade, unverified artifact substitution or security relaxation attempted.
Useful but limited validation: Node 24 executed the real canonical TypeScript fixture seeder using built-ins, then the private checksum-verified official v1.0.1 compiler strictly compiled all eight current source workflows in a new fixture. Actual emitted metadata/manifests show strict v1.0.1, 64 full 40-character action SHAs, and immutable setup pins. This is not a substitute for missing build/type/integrity/Vitest or new exact-published-HEAD native/staged/mutation/hosted evidence.
Public PR head remains 72111f4b83d89410ad421c5fa37321b8b785d0a0; candidate 08ee51f5 exists locally only. Final body correction may trigger another old-head metadata-only CI run. Four original review threads retain their substantive replies/resolution; no approval fabricated. No dependency landing hold requested during implementation/testing. Resume once approved locked artifacts/tooling can be restored; rerun real gates, refresh any advanced dev normally, fast-forward publish, perform fresh immutable-head consumer verification/full hosted CI, and only then coordinate a short landing window and merge with expected HEAD/protections.
Cycle 3 — final read-only dependency recovery audit
The requester authorized one final coordinated search for a complete retained installed dependency tree. Release engineer granted read-only access and confirmed the previous full dependabot-repair installation was erased by failed restores; only an eight-package tool-only tree remains. Owned gh-aw scratch/consumer/worktree descendants likewise contain no complete retained installation.
An exhaustive package-identity/version audit across both permitted partial trees and the tool donor checked all 494 required non-optional locked package entries, including nested workspace dependencies:
| Source | Matching candidate package versions | Other result |
|---|---|---|
| Own partial installed tree | 0 | All 494 absent. |
| Read-only dependency-worker partial tree | 0 | All 494 absent. |
| Read-only eight-package tool tree | 6 | Two version mismatches, 486 absent. |
| Combined retained installed payload | 6 | 488 required entries uncovered. |
The mismatches are @types/sql.js donor 1.4.10 versus required 1.4.11, and @types/emscripten donor 1.41.6 versus required 1.41.5. Missing critical tools/runtime include vitest@5.0.3, vite@8.3.2, yaml@2.9.1, and hono@4.13.17. Donor package identities/versions match its own adjacent lock, whose SHA256 snapshot remained stable throughout the audit; that does not make it compatible with the candidate.
Exactly one later official npm connectivity probe still failed with a disconnected socket. No blind retry loop. No incomplete or mismatched dependency tree was copied, installed or symlinked, and no donor files were edited. The absence of a complete compatible payload—not just the first missing package—is proven by the full inventory.
Final external blocker: mandatory build/type/tests/integrity cannot be validated from the available dependencies without accepting missing/different locked packages or bypassing the pre-push build gate. Neither is authorized. No clean npm-ci reproduction, reused-dependency build pass, fresh published-candidate validation or merge is claimed. Local commit 08ee51f567ed82e7a4c5a0d4b8c66f57f559a8f9 and its clean isolated worktree are preserved; public head remains 72111f4b83d89410ad421c5fa37321b8b785d0a0. No push, merge, landing hold or fourth cycle requested.
Final cache supplement: read-only audit of candidate-specific npm content-addressed artifacts found 325 digest-verified locked tarballs, one missing locked tarball (hono@4.13.17), zero invalid tarballs, and 168 required entries without per-entry tarball integrity metadata. YAML/Vitest/Vite archives are verified cached; cached tools are not a complete project installation. The six matching / 488 uncovered figures above concern retained installed trees only. The required approved Hono artifact remains absent from the known retained trees and its exact cache key, while official connectivity fails. No artifact extraction, dependency substitution or clean-install/full-build claim was made. This exhausts the authorized final recovery alternative; candidate/worktree remain preserved and unpushed.
…#2413) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c8c234f1-ee3b-49e1-9406-11d4a2238c23
What
Bring the bootstrap prompt upstream and migrate the native
github/squad/workflowspackage to the reviewed gh-aw v1.0.1 compiler/runtime contract. Published HEAD:72111f4b83d89410ad421c5fa37321b8b785d0a0. This PR is ready for review, not a draft.Why
Upstream replacement for bradygaster#1. Preserve the requested unpinned stable-major CLI installation policy without accepting unreviewed compiler output. No separate closing issue was supplied.
How
Working as agentic-workflows-dev (Agentic Workflows Engineer).
devnormally, preserving canonical-identity, hosted E2E, Windows/XDG, approved-SHA, Homebrew, and SDK-cap fixes. No rebase or force push. Remove duplicate action inputs introduced by automatic integration.All four existing review threads have substantive replies and are resolved. Resolution is not a fabricated approving review.
npx changeset add/.changeset/*.md, directCHANGELOG.mdentry for maintainers, orskip-changeloglabel for no user-facing changes).changeset/gh-aw-upstream-one.mdcovers the shipped SDK/CLI template changes; no new SDK/CLI source API.PR Readiness Checklist
Branch & Commit
dev(notmain)dev(git fetch upstream && git rebase upstream/dev)git diff --cached --stat)Actual integration used normal merges, not the template's rebase example. Integrated
dev:04afd7a9b9f9497fedbd2631ef7082766f1ac3b1. At 18:23:28 UTC on November 9, livedevwas302161286e23ad67895142276b8fa2ac5f27413eand GitHub reported this PR behind. Author history is preserved; any eventual landing uses the repository's allowed squash merge after another current-base validation. Staged stat/deletion checks passed; no deletions. The large inherited integration delta is distinct from the bounded fixture/preflight/prompt repairs.Build & Test
npm run buildpassesnpm testpasses (all tests green)npm run lintpasses (type check clean)npm run lint:eslintpassesLocal validation uses a private, checksum-verified official v1.0.1 binary through
SQUAD_GH_AW_BINplus a privategh awshim for direct callers. Global compiler installation was not changed.TMPDIRpoints inside the isolated session workspace.SKIP_BUILD_BUMP=1 npm run buildnpm run lintnpm run lint:eslintnpm run gh-aw:integrity:writenpm run gh-aw:integrity:checknpx --no-install markdownlint-cli2 agents-agentic-workflows.md docs/src/content/docs/guide/gh-aw.mdnpx --no-install cspell --no-progress --dot 'docs/src/content/**/*.md' README.mdnpm test -- test/gh-aw-activation-temporary-ids.test.ts test/gh-aw-activation-capacity.test.ts test/gh-aw-activate-fast-path-label-provisioning.test.ts test/gh-aw-bootstrap-workflow.test.ts test/gh-aw-deps-routing.test.ts test/gh-aw-deps-worker-workflow.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-enlistment-skill.test.ts test/gh-aw-activation-finalization.test.ts test/gh-aw-compiler-compatibility.test.tsnpm test -- test/gh-aw-activation-label-provisioning.test.ts test/gh-aw-activation-summary-outcomes.test.ts test/gh-aw-evidence-provider.test.ts test/gh-aw-implement-workflow.test.ts test/gh-aw-implementation-provenance.test.tsnpm test -- --maxWorkers=454b027c28b01fcebf73c135cc237b65c5c72bf27; subsequent integration changes only the upstream .NET project and independent GitHub Actions updates. Both failures are unchanged external-state export fixtures on macOS, with product/test bytes identical to dev. Not a full local-green claim.git diff origin/dev...HEAD --checkRealistic mutation evidence:
npm test -- test/gh-aw-activation-finalization.test.ts --testNamePattern='attributed-body bound' --reporter=verbose: both 65,537-unit cases fail as expected; all four smaller boundary cases pass. Restore source: the ten-suite run above passes..github/workflows/shared/squad.md: authenticated verification rejectsInstalled digest mismatch for .github/workflows/shared/squad.md. Restore exact bytes: staged verification passes.Fresh native consumer evidence against published immutable HEAD, without creating a remote consumer repository or changing remote settings/secrets:
gh aw add github/squad/workflows@72111f4b83d89410ad421c5fa37321b8b785d0a0node .github/workflows/shared/squad-install-verifier.mjs --materialize-runtimenode --input-type=module -e 'import {compileWithPinnedActions} from "./.github/workflows/shared/squad-install-verifier.mjs"; compileWithPinnedActions(process.cwd());'gh aw compile --strict --no-check-updatenode .github/workflows/shared/squad-install-verifier.mjs --verify-install --source-revision 72111f4b83d89410ad421c5fa37321b8b785d0a0 --strict-compilenode .github/workflows/shared/squad-install-verifier.mjs --verify-staged-install --stage-ownership --source-revision 72111f4b83d89410ad421c5fa37321b8b785d0a0All eight emitted locks were inspected: immutable compiler setup pins; model jobs have read-only repository scopes, with only
copilot-requests: writefor model invocation. Bootstrap conclusion permissions areactions: read,checks: read,issues: write,pull-requests: read. No security gate was removed.Landing blocked; not merged. Completed exact-HEAD Squad CI 42670698493 failed one strict implement-worker mutation fixture (13,237 tests passed). Squad Release Verify 42670521577 failed 18 tests across five additional standalone compiler fixture suites (13,220 passed). Both expose CTR-002 mutable action references in fixtures missing canonical pin seeding. Strict compilation, Windows release tests and the other executed checks passed; none waives these failures.
Cycle 2 explicitly authorized those five additional test files, totaling 23 direct repair files. The minimal fix is implemented and committed locally, not pushed, as
08ee51f567ed82e7a4c5a0d4b8c66f57f559a8f9: exactly five files / eleven inserted lines, adding canonical seeding at six fresh workspace-copy sites. It normally integrates devb1f25353553c22d0bb8d42faae14ec321c50b6c7; inherited release-preparation changes and consumed changesets are preserved. No broader repair was made.Current blocker is dependency restoration, not scope authorization. The configured registry mirror returns E404 for baseline-locked
hono@4.13.17; direct npm/Yarn registry connections fail, and cache-only restore lackszod-to-json-schema@3.25.2. The release engineer independently reported the same clean-dev restore failure. The incoming baseline changed Hono from the published head's 4.13.7 to 4.13.17; this repair does not alter that baseline dependency or lock integrity.npm ci --no-audit --no-fundnpm ci --registry=https://registry.npmjs.org --no-audit --no-fundnpm ci --offline --no-audit --no-fundnpm run gh-aw:integrity:checkyamlmodule unavailable after incomplete restore.npm run linttscunavailable.SKIP_BUILD_BUMP=1 npm run buildtscunavailable. Pre-push build gate is not bypassed.The combined fifteen-suite attempt also exits 127 because
vitestis unavailable; no cycle-2 focused-suite pass is claimed. Independently of npm tooling, Node 24 executed the real canonical fixture seeder and the private official v1.0.1 compiler strictly compiled all eight current source workflows. Their emitted metadata/manifests were inspected: strict v1.0.1, 64 full-SHA action entries and immutable setup pins. This does not substitute for the unavailable build/type/integrity/Vitest checks or new published-HEAD consumer/hosted validation. The published PR head is still72111f4b83d89410ad421c5fa37321b8b785d0a0; no push, merge, or admin bypass was attempted.Fresh hosted exact-HEAD validation is recorded in the persistent validation ledger, with actual completed results and the blocker:
npm test, build/type/lint and strict native-package compilation; the ledger links the terminal run (PR-body edits themselves rerun this workflow).The local full-test checkbox remains unchecked because of the two macOS fixtures above. Hosted results are reported separately, not conflated with local results. No test is skipped or accepted failing to manufacture a green result.
Hosted compilation is not a claim of hosted consumer activation. No hosted consumer activation/settings/secrets operation was performed.
Changeset
npx changeset add(ifpackages/squad-sdk/src/orpackages/squad-cli/src/changed)CHANGELOG.mdentry (maintainers only — write-protected for external contributors)skip-changeloglabel applied (if no user-facing changes)Patch changeset present in the existing Markdown format; no skip label or waiver.
Docs
README/guide/bootstrap prompt and five synchronized enlistment-skill copies updated. No new standalone module.
Exports
N/A: no new SDK module or export.
Breaking Changes
The workflow package requires canonical upstream ownership and the reviewed v1.0.1 compiler/action/digest contract. Existing installations must follow documented migration/ownership checks. No SDK/CLI public API break.
Waivers
None requested or approved. Merge remains gated on current required hosted checks and a fresh base/HEAD snapshot; no admin bypass.