docs: release notes blog #026 + fix duplicate ADO blog

docs/blog/026-whats-new-ado-comms-subsquads.md

@@ -0,0 +1,151 @@
+---
+title: "What's New: Azure DevOps Adapter, CommunicationAdapter, SubSquads, and Security Hardening"
+date: 2026-03-08
+author: "Tamir Dresher"
+wave: 7
+tags: [squad, azure-devops, enterprise, platform-adapter, communication, subsquads, security]
+status: published
+hero: "Squad goes enterprise with native Azure DevOps support, adds a CommunicationAdapter for platform-agnostic agent-human messaging, renames Workstreams to SubSquads, and ships critical security hardening across all platform adapters."
+---
+
+# What's New: Azure DevOps Adapter, CommunicationAdapter, SubSquads, and Security Hardening
+
+> ⚠️ **Experimental** — Squad is alpha software. APIs, commands, and behavior may change between releases.
+
+> _This batch adds first-class Azure DevOps support, a pluggable communication layer, the community-voted SubSquads rename, and security fixes that prevent shell injection, WIQL injection, and bearer token exposure. 5 PRs merged, 153 new tests, 4 issues closed._
+
+---
+
+## What Shipped
+
+### 1. Azure DevOps Platform Adapter — The Enterprise Feature
+
+Squad now works natively with Azure DevOps. When your git remote points to `dev.azure.com` or `*.visualstudio.com`, Squad auto-detects the platform and adapts everything.
+
+**PlatformAdapter interface** — unified API for GitHub, ADO, and Planner:
+
+```typescript
+interface PlatformAdapter {
+  listWorkItems(options): Promise<WorkItem[]>;
+  createWorkItem(options): Promise<WorkItem>;
+  createPullRequest(options): Promise<PullRequest>;
+  mergePullRequest(id): Promise<void>;
+  createBranch(name, fromBranch?): Promise<void>;
+  // ... addTag, removeTag, addComment
+}
+```
+
+Three adapters ship with the same interface:
+- **AzureDevOpsAdapter** — `az boards` CLI for work items, `az repos` for PRs
+- **GitHubAdapter** — `gh` CLI wrapper
+- **PlannerAdapter** — Microsoft Graph API for hybrid work-item tracking
+
+**Configurable work items** via `.squad/config.json`:
+
+```json
+{
+  "platform": "azure-devops",
+  "ado": {
+    "org": "my-org",
+    "project": "planning-project",
+    "defaultWorkItemType": "Scenario",
+    "areaPath": "MyProject\\Team Alpha",
+    "iterationPath": "MyProject\\Sprint 5"
+  }
+}
+```
+
+All fields are optional. Cross-project support means your work items can live in a completely different ADO org/project than your git repo.
+
+**Ralph on ADO** — the governance file (`squad.agent.md`) now includes a Platform Detection section, ADO WIQL commands for Ralph's scan cycle, and instructions to read `.squad/config.json` before any ADO command.
+
+**Docs:** [Enterprise Platforms Guide](../features/enterprise-platforms.md) | [Blog #025](025-squad-goes-enterprise-azure-devops.md)
+
+### 2. CommunicationAdapter — Agent-Human Messaging
+
+A new pluggable interface for agent-human communication. Scribe can post session summaries, Ralph can post board status, agents can escalate when blocked — all through a platform-appropriate channel.
+
+```typescript
+interface CommunicationAdapter {
+  postUpdate(options): Promise<{ id: string; url?: string }>;
+  pollForReplies(options): Promise<CommunicationReply[]>;
+  getNotificationUrl(threadId): string | undefined;
+}
+```
+
+Four adapters:
+
+| Adapter | Phone-capable | Setup |
+|---------|:---:|---|
+| **FileLog** | Via git | Zero-config fallback |
+| **GitHub Discussions** | ✅ Browser | Auto-detected |
+| **ADO Work Item Discussions** | ✅ ADO mobile | Auto-detected |
+| **Teams Webhook** | ✅ Teams mobile | Stubbed (Phase 2) |
+
+Factory auto-detects platform: `createCommunicationAdapter(repoRoot)`.
+
+### 3. SubSquads — The Community-Voted Rename
+
+Workstreams → SubSquads. The community decided.
+
+- CLI: `squad subsquads` (with `workstreams` and `streams` as deprecated aliases)
+- Types: `SubSquadDefinition`, `SubSquadConfig`, `ResolvedSubSquad`
+- Old names kept as `@deprecated` re-exports for backward compatibility
+- Config file stays at `.squad/streams.json` (file rename deferred)
+
+### 4. Security Hardening
+
+Every platform adapter went through a community-driven 5-model security review (thanks [@wiisaacs](https://github.com/wiisaacs)):
+
+| Fix | What it prevents |
+|-----|-----------------|
+| `execSync` → `execFileSync` | Shell injection via user input |
+| `escapeWiql()` helper | WIQL injection (SQL-style) in ADO queries |
+| `curl --config stdin` | Bearer token invisible to `ps aux` |
+| Case-insensitive detection | Mixed-case ADO URLs now detected correctly |
+| Cross-platform draft filter | `findstr` → JMESPath (macOS/Linux compat) |
+| PR status mapping | `active`→`open` for `gh` CLI compatibility |
+| `gh issue create` fix | No `--json` flag — parse URL from stdout |
+
+### 5. ESM Runtime Patch + Secret Guardrails (Brady)
+
+- Runtime `Module._resolveFilename` intercept for Node 24+ ESM compatibility
+- 5-layer secret defense architecture
+- `.squad/skills/secret-handling/SKILL.md` team reference
+- 59 TDD security hook tests
+- Charter hardening for Trejo (Git & Release) and Drucker (CI/CD)
+
+---
+
+## Quick Stats
+
+- ✅ 5 PRs merged (#191, #263, #268, #272, #266)
+- ✅ 153 new tests (92 platform + 15 comms + 46 SubSquads)
+- ✅ 59 security tests (Brady's sprint)
+- ✅ 4 issues closed (#240, #261, #271, #273)
+- ✅ Security review: 7 code fixes from 10 review comments
+- ✅ External integration testing: 10/13 ADO tests passed
+
+---
+
+## Breaking Changes
+
+None. All changes are additive. Repos without ADO remotes work exactly as before. Old `workstreams`/`streams` names still work as deprecated aliases.
+
+---
+
+## Contributors
+
+- **[@tamirdresher](https://github.com/tamirdresher)** — ADO adapter, CommunicationAdapter, SubSquads rename, security fixes, docs, blog
+- **[@wiisaacs](https://github.com/wiisaacs)** — 5-model security review with test validation
+- **[@dfberry](https://github.com/dfberry)** — CommunicationAdapter requirements, tiered deployment proposal
+- **[@bradygaster](https://github.com/bradygaster)** — ESM fix, secret guardrails sprint, SubSquads merge, architecture guidance
+
+---
+
+## What's Next
+
+- **Process template introspection** — auto-detect ADO work item types (#240)
+- **Teams webhook adapter** — full CommunicationAdapter implementation (#261)
+- **Pre-existing test stabilization** — fix 14 flaky/environment-dependent tests (#273)
+- **Persistent Ralph** — `squad watch` heartbeat improvements (#236)