sync: merge upstream squad/dev (28 commits) with crew rebrand retained by david-driscoll · Pull Request #2 · Blacklite/crew

david-driscoll · 2026-07-31T19:14:08Z

Merges upstream/dev (bradygaster/squad) into crew — 28 new upstream commits since the last sync point (eaf3cca), with all incoming content rebranded squad→crew.

Notable upstream changes brought in

Three-state coordinator canary + HEAD canary (fix: three-state coordinator canary + HEAD canary (Closes #1461) bradygaster/squad#1517) — new CREW_COORDINATOR_CANARY_HEAD_b7d2 token near the top of the coordinator, three-state truncation check in copilot-instructions, new scripts/size-regression-guard.mjs, size-budget CI, and canary docs.
Category-based cost policy + live model catalog refresh (feat(models): category-based cost policy + live catalog/pricing refresh (#1080/#1183) bradygaster/squad#1445) — new crew models CLI command, CostPolicyConfig in the SDK config schema, model-selector policy plumbing, and two new test suites.
WorkItem.body hydration; two-pass scan routed through adapter (feat(platform): hydrate WorkItem.body; route two-pass scan through adapter bradygaster/squad#1414).
Decision inbox consolidation + agent history summarization (chore(squad): merge decision inbox and summarize oversized agent histories bradygaster/squad#1558) — inbox entries folded into .crew/decisions.md, oversized agent histories trimmed.
CI hardening (fix(ci): quote GITHUB_OUTPUT/STEP_SUMMARY redirects (SC2086) + add actionlint/shellcheck gate for workflow templates bradygaster/squad#1557) — SC2086 quoting of $GITHUB_OUTPUT redirects, actionlint gate (crew-workflow-lint.yml, renamed from upstream's squad-workflow-lint.yml), plus a security-scanner fix (fix(security): stop unsafe-git scanner flagging prose in append-only squad logs bradygaster/squad#1559).
Dependency bumps — GitHub.Copilot.SDK 1.0.8, Microsoft.Extensions.AI 10.8.1, MCP SDK 1.30, ink/react/@types bumps, and the usual dependabot batch across samples and docs.

How conflicts were resolved

Git rename detection mapped most packages/squad-* → packages/crew-* changes automatically; the remaining 27 conflicts were resolved by taking upstream's semantic change and applying the established squad→crew rename map (@bradygaster/squad-* → @blacklite/crew-*, .squad → .crew, SQUAD_* tokens → CREW_*, identifiers Squad* → Crew*).
Crew-specific elements retained throughout: @blacklite package names, dual-harness (harness?: 'copilot' | 'claude') config, .crew/ state layout, crew-branded canary tokens, and the "fork of Squad" package description.
Upstream files that arrived squad-named were renamed (squad-workflow-lint.yml → crew-workflow-lint.yml) or their changes ported into the crew counterparts (copilot-instructions ×4 copies, crew.agent.md templates ×5 copies including the HEAD canary insert).
.crew state files (agent histories, decisions) took upstream's consolidation with content rebranded.
Lockfiles regenerated with npm install --package-lock-only against the merged package.jsons; scripts/sync-templates.mjs --sync and sync-skill-templates.mjs run to keep template copies canonical.

Verification

check-crew-leakage.mjs clean; no squad-named files remain tracked; only intentional squad mention left is the "fork of Squad" package description.
crew-sdk and crew-cli both build clean (tsc).
Targeted merge-affected suites pass (config-schema, lifecycle, models-refresh, model-selector-policy, template-sync — 347 tests).
Full vitest run: 7278 passed; the 6 failures are the pre-existing macOS-only externalized-state tests ([External State] squad export does not resolve externalized state bradygaster/squad#1396–[External State] squad cast does not follow externalized state for agent discovery bradygaster/squad#1399), identical on the un-merged baseline.

🤖 Generated with Claude Code

…radygaster#1474) Bumps [esbuild](https://github.com/evanw/esbuild) to 0.28.1 and updates ancestor dependency [tsx](https://github.com/privatenumber/tsx). These dependencies need to be updated together. Updates `esbuild` from 0.27.4 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.4...v0.28.1) Updates `tsx` from 4.21.0 to 4.23.1 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.23.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: indirect - dependency-name: tsx dependency-version: 4.23.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#1510) --- updated-dependencies: - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.8.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…er#1516) Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 7.5.4 to 7.6.5. - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.5/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.6.5) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 7.6.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 5.2.2 and updates ancestor dependency [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2). These dependencies need to be updated together. Updates `js-yaml` from 5.2.0 to 5.2.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.2.0...5.2.2) Updates `markdownlint-cli2` from 0.23.0 to 0.23.2 - [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md) - [Commits](DavidAnson/markdownlint-cli2@v0.23.0...v0.23.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.2 dependency-type: indirect - dependency-name: markdownlint-cli2 dependency-version: 0.23.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#1461) (bradygaster#1517) * fix: add three-state coordinator canary Add a HEAD canary near the start of the coordinator prompt while retaining the EOF canary. Update the Canary Check to skip non-coordinator agents, accept fully loaded coordinators, and halt only on positive truncation detection. Closes bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * feat: add report-only two-tier size-regression guard Adds scripts/size-regression-guard.mjs (report-only, exits 0): Tier-1 artifact byte/token ceiling and Tier-2 governance-golden regression (head+eof canaries, dispatch-STOP gate, STATE_BACKEND, reviewer-lockout, mention-guard), plus a local-estimate-only net-resident dimension and a reviewed-override budget file (.github/size-budget.json). Includes --backtest mode and a report-only CI workflow. Part of bradygaster#1461; adds to PR bradygaster#1517. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * fix: version canary golden applicability Refs bradygaster#1461 bradygaster#1498 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * fix: separate size fence from reduction target Refs bradygaster#1461 bradygaster#1498 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * chore(canary): normalize line endings on template mirrors Reverts spurious LF->CRLF churn on workflow-wiring mirror files introduced by the sync-templates run in 197b19a. Content-identical; restores mirror parity with LF canonicals so template-sync check mode passes and the PR delta reflects only intended changes. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): reclassify dual canary as two-state payload-integrity detector Records the peer-agreed reclassification: the dual markers detect payload integrity (loaded vs truncated) within an independently-known Squad session only; "no markers" is externally unobservable and is NOT a success state. Documents the owning runtime surface for cases 3/4 (host-level untruncatable pre-ingestion identity beacon) and adds the payload-removal test requirement. squad.agent.md artifact sha256 unchanged (525a919f...). Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): require selection-time identity beacon Clarifies that the runtime beacon must be captured when the host resolves the custom agent selection, before any .agent.md file read or prompt assembly. Documents that packages/squad-cli only installs and passes through --agent selection while Copilot CLI owns the resolver/read path, and adds the four-fixture runtime acceptance matrix. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): define host-owned identity state machine Defines the runtime identity beacon as an explicit host-owned state machine with separate selection, payload-read, and prompt-attach fields. Adds the decision function and four-fixture acceptance test requiring raw selection records and status transitions. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): add assembled prompt integrity state Extends the host-owned coordinator identity state machine with attach_integrity computed on the assembled artifact. Documents the refined decision function, frozen transition invariants, and ordered event-sequence acceptance requirements for assembly-time truncation. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): separate read truncation from attach clipping Clarifies payload_read_status=TRUNCATED as read-dimension only and maps attach clipping to LOADED plus ATTACHED_PARTIAL. Updates the state machine and matrix to fail closed: only selected+LOADED+ATTACHED_FULL+INTACT succeeds; absent or partial evidence becomes UNKNOWN/halt. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): require trusted expected sha provenance Clarifies that attach integrity can only compare against an expected SHA from a trusted host-side registry keyed by agent and client version. Adds selection-record version keys and distinguishes host-computed attached_sha from trusted-registry expected_sha. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): split transport and release integrity axes Restructures the host-owned runtime beacon into orthogonal transport and release verdicts. Transport integrity is the fail-closed enforcement axis, while release integrity reports verified, mismatched, or unregistered artifacts without false-halting healthy local or fresh artifacts. Adds six acceptance fixtures and the Caveman telemetry join protocol. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): distinguish corrupt halt from unknown halt Splits transport halt outcomes into HALT_CORRUPT for proven read/assembly loss and UNKNOWN_HALT for insufficient evidence. Keeps release mismatch and unregistered-local outcomes distinct so telemetry can measure corruption, missing evidence, and false-halt risk separately. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * docs(canary): add inventory drift envelope dimension Adds host tool inventory to the preregistered execution envelope. Defines per-turn inventory snapshots, manifest hashing provenance, inventory_drift outcomes, variant/quarantine rules, and telemetry-join invalidation semantics orthogonal to artifact integrity. Refs bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 * ci(size-report): pin actions to immutable SHAs Replace mutable actions/checkout@v4 and actions/setup-node@v4 with immutable commit SHAs matching the repo-wide convention: actions/checkout@9c091bb #v7 actions/setup-node@48b55a0 #v6 Closes bradygaster#1461 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a05b5960-2854-438d-976d-2bc01816ee70 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09d05820-0b7e-482b-b942-c86b1225dcf9 Copilot-Session: a05b5960-2854-438d-976d-2bc01816ee70

…sh (bradygaster#1080/bradygaster#1183) (bradygaster#1445) * feat(models): add category-based cost policy with docs-YAML pricing enrichment Introduce an opt-in GitHub billing cost-ceiling policy (lightweight/versatile/ powerful) as a separate axis from the quality ModelTier. Resolution is finalized against the effective policy: implicit over-ceiling picks are downgraded deterministically, explicit overrides are honored with a loud warning, and the outcome is surfaced via the event bus + logs instead of being swallowed (the defect that stalled the prior attempt). When no in-ceiling model exists the policy fails closed and loud; unknown/out-of-catalog IDs pass through unchanged. Wire the policy end-to-end through AgentLifecycleManager.spawnAgent and add a squad models refresh diagnostic that reconciles the committed seed catalog against live sources: the canonical Copilot models API (optional, via gh auth token) with a graceful auth-free fallback to the public github/docs pricing YAML, writing to the gitignored local cache. On the authenticated happy path, refresh also fetches the docs YAML and enriches the API-discovered catalog with pricing (and releaseStatus) joined by model id. The API stays authoritative for id/category/reachability; docs only supplies pricing for ids the API already returned (no ids added). Enrichment is best-effort and fail-open, keeping source: 'api'. DOCS_NAME_TO_ID is keyed by lowercased spaced display names and trailing footnote markers are stripped so all 13 seed ids join their pricing when present. Pricing remains diagnostic-only and is not wired into policy enforcement. Refs bradygaster#1080 Refs bradygaster#1183 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(models-refresh): add gpt-5.6-luna/sol/terra to DOCS_NAME_TO_ID for pricing enrichment DOCS_NAME_TO_ID had no entries for the three new gpt-5.6 models, so the docs YAML pricing join silently skipped them (unmatched names are intentionally skipped by design). The display names 'GPT-5.6 Luna/Sol/Terra' (proper-noun word suffixes) do not follow the same pattern as 'GPT-5.5'/'GPT-5.4 mini', so adding them requires explicit map entries. Added entries: 'gpt-5.6 luna' -> 'gpt-5.6-luna' 'gpt-5.6 sol' -> 'gpt-5.6-sol' 'gpt-5.6 terra'-> 'gpt-5.6-terra' TDD: new parseDocsYaml test in test/models-refresh.test.ts exercises the full two-row YAML fixture (Default + Long context rows) for all three IDs and asserts correct id mapping, githubCategory, pricing, and releaseStatus. RED -> GREEN. Verified live: squad models refresh now enriches all three with pricing and releaseStatus from the docs YAML. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(models-refresh): replace DOCS_NAME_TO_ID allow-list with algorithmic normalization + unpriced warning PROBLEM: DOCS_NAME_TO_ID was a 16-entry hand-maintained allow-list that required per-model edits for every new catalog entry. Silent skip (if (!id) continue) meant brand-new models from the API would silently get no pricing without any signal. SOLUTION: - Export normalizeDisplayName(name): strips footnote markers [^...], strips parentheticals (...), lowercases, collapses whitespace to hyphens. Handles all current docs display names algorithmically with zero overrides needed: 'GPT-5.6 Luna' -> 'gpt-5.6-luna' 'Claude Sonnet 5[^promo]' -> 'claude-sonnet-5' 'Claude Opus 4.8 (fast)' -> 'claude-opus-4.8' 'Gemini 2.5 Pro' -> 'gemini-2.5-pro' - Replace DOCS_NAME_TO_ID with empty DOCS_NAME_OVERRIDES escape hatch (zero current entries; mechanism retained for genuine edge cases). - docs-fallback path now filters by seedIdSet so extra docs rows (Fable 5, Kimi, etc.) remain harmlessly ignored — catalog-driven behavior preserved. - Add unpricedIds: string[] to RefreshResult: catalog models discovered from API/docs but with no pricing. Printed as a loud warning in refresh output. New/unpriced models are visible signal, not silent drift. TDD: 4 new normalizeDisplayName unit tests + 3 unpricedIds tests -> RED then GREEN. 21/21 models-refresh tests pass. 178/178 targeted tests pass. Full suite: same 5 pre-existing EBUSY failures as baseline, no regressions. Live: gpt-5.6-luna/sol/terra all enrich with pricing; warning correctly surfaces gemini-3.1-pro-preview and mai-code-1-flash-picker as not-yet-in-docs models. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(models-refresh): keep parenthetical words in normalized id to prevent SKU collision REGRESSION introduced in previous commit: normalizeDisplayName stripped entire parenthetical groups (e.g. '(fast mode) (preview)'), so 'Claude Opus 4.8' and 'Claude Opus 4.8 (fast mode) (preview)' both normalized to 'claude-opus-4.8'. Last-wins in the enrichment Map picked the fast-mode row (/\) instead of the real model row (/\). ROOT INSIGHT: a parenthetical qualifier denotes a DIFFERENT product SKU. Stripping it causes a pricing collision. Correct fix: strip the '(' and ')' chars but KEEP the words inside, so the fast-mode row normalizes to 'claude-opus-4.8-fast-mode-preview' — a non-catalog id that enrichWithPricing ignores, leaving the base-model pricing intact. Footnote stripping ([^...]) is kept: footnotes are promo markers on the SAME model ('Claude Sonnet 5[^promo]' -> 'claude-sonnet-5'), not distinct SKUs. Scan confirmed: only ONE parenthetical row in the live docs YAML ('Claude Opus 4.8 (fast mode) (preview)'). All other models are unaffected. Live: claude-opus-4.8 = \.00/\.00 (correct), all 16 models enriched, no unpriced warning. TDD: updated normalizeDisplayName unit test (parens-kept behavior) + 2 new collision-protection tests (parseDocsYaml + enrichWithPricing). RED -> GREEN. 180/180 targeted tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(models-refresh): address Copilot reviewer comments 1+2 — Default-tier pricing, suppress spurious unpriced warning Comment 1 (parseDocsYaml): skip `tier: Long context` rows so enrichWithPricing always attaches the Default-tier (base) price per model, not the higher Long-context threshold price. Two-row models (gpt-5.5, gpt-5.4, gpt-5.6-*) now correctly show their Default-tier pricing. Comment 2 (unpricedIds): track whether docs enrichment actually produced any priced result (enrichmentRan); only compute/emit unpricedIds when enrichmentRan is true. Suppresses the misleading "all models unpriced" warning when the docs YAML fetch itself fails — distinguishes enrichment failure from genuinely new unpriced models. Tests: 4 new RED-first tests (Default-tier-wins, enrichWithPricing Default price, docs-fetch-throws suppression, empty-yaml suppression) → 27/27 GREEN. Refs bradygaster#1080 / bradygaster#1183 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ygaster#1553) Bumps [picomatch](https://github.com/micromatch/picomatch) from 4.0.3 to 4.0.5. - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) --- updated-dependencies: - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [@grpc/grpc-js](https://github.com/grpc/grpc-node) from 1.14.3 to 1.14.4. - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4) --- updated-dependencies: - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [@protobufjs/utf8](https://github.com/protobufjs/protobuf.js) from 1.1.0 to 1.1.2. - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@pool-v1.1.0...path-v1.1.2) --- updated-dependencies: - dependency-name: "@protobufjs/utf8" dependency-version: 1.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…aster#1549) Bumps [@grpc/grpc-js](https://github.com/grpc/grpc-node) from 1.14.3 to 1.14.4. - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4) --- updated-dependencies: - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…r#1548) Bumps [@github/copilot](https://github.com/github/copilot-cli) and [@github/copilot-sdk](https://github.com/github/copilot-sdk). These dependencies needed to be updated together. Updates `@github/copilot` from 0.0.414 to 1.0.75 - [Release notes](https://github.com/github/copilot-cli/releases) - [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md) - [Commits](github/copilot-cli@v0.0.414...v1.0.75) Updates `@github/copilot-sdk` from 0.1.26 to 0.1.32 - [Release notes](https://github.com/github/copilot-sdk/releases) - [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/copilot-sdk/commits/v0.1.32) --- updated-dependencies: - dependency-name: "@github/copilot" dependency-version: 1.0.75 dependency-type: indirect - dependency-name: "@github/copilot-sdk" dependency-version: 0.1.32 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ter#1546) Bumps [picomatch](https://github.com/micromatch/picomatch) from 4.0.3 to 4.0.5. - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) --- updated-dependencies: - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ter (bradygaster#1545) Bumps [ws](https://github.com/websockets/ws) from 8.19.0 to 8.21.1. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.19.0...8.21.1) --- updated-dependencies: - dependency-name: ws dependency-version: 8.21.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…radygaster#1544) Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.9 to 5.10.1. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.5.9...v5.10.1) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.10.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…bradygaster#1542) Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.4 to 1.3.0. - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-builder@v1.1.4...v1.3.0) --- updated-dependencies: - dependency-name: fast-xml-builder dependency-version: 1.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Removes [uuid](https://github.com/uuidjs/uuid). It's no longer used after updating ancestor dependency [@azure/msal-node](https://github.com/AzureAD/microsoft-authentication-library-for-js). These dependencies need to be updated together. Removes `uuid` Updates `@azure/msal-node` from 5.1.1 to 5.4.2 - [Release notes](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases) - [Commits](AzureAD/microsoft-authentication-library-for-js@msal-node-v5.1.1...msal-node-v5.4.2) --- updated-dependencies: - dependency-name: uuid dependency-version: dependency-type: indirect - dependency-name: "@azure/msal-node" dependency-version: 5.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.16 to 8.5.23. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.16...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…radygaster#1536) Bumps the github-actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-dotnet](https://github.com/actions/setup-dotnet) and [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-dotnet` from 5.4.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@26b0ec1...a98b568) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-dotnet dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

--- updated-dependencies: - dependency-name: GitHub.Copilot.SDK dependency-version: 1.0.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps Microsoft.Extensions.AI from 10.7.0 to 10.8.1 --- updated-dependencies: - dependency-name: Microsoft.Extensions.AI dependency-version: 10.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft-packages ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…aster#1532) Bumps the minor-patch group in /docs with 1 update: [@playwright/test](https://github.com/microsoft/playwright). Updates `@playwright/test` from 1.61.1 to 1.62.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.62.0) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.62.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#1531) Bumps the astro-minor-patch group in /docs with 1 update: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `astro` from 7.1.1 to 7.1.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: astro-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…apter (bradygaster#1414) * feat(platform): hydrate body via getWorkItem; route two-pass through adapter WorkItem gains optional body (GitHub + ADO); watch two-pass uses adapter.getWorkItem instead of gh issue view, so it works on ADO too. * perf(watch): skip redundant getWorkItem in two-pass when body already hydrated ADO listWorkItems populates body, so re-fetching each actionable item was wasteful. Reuse the existing body when present. --------- Co-authored-by: OrenMaoz <ormaoz@microsoft.com>

…squad Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.23. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…radygaster#1554) Bumps the minor-patch group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@opentelemetry/context-async-hooks](https://github.com/open-telemetry/opentelemetry-js) | `2.9.0` | `2.10.0` | | [@opentelemetry/sdk-metrics](https://github.com/open-telemetry/opentelemetry-js) | `2.9.0` | `2.10.0` | | [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.9.0` | `2.10.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.0` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.63.0` | `8.65.0` | | [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.8.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` | | [ink](https://github.com/vadimdemedes/ink) | `7.1.0` | `7.1.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` | | [@github/copilot-sdk](https://github.com/github/copilot-sdk) | `1.0.6` | `1.0.8` | | [@opentelemetry/exporter-metrics-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` | | [@opentelemetry/exporter-trace-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` | | [ws](https://github.com/websockets/ws) | `8.21.0` | `8.21.1` | Updates `@opentelemetry/context-async-hooks` from 2.9.0 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0) Updates `@opentelemetry/sdk-metrics` from 2.9.0 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0) Updates `@opentelemetry/sdk-trace-base` from 2.9.0 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0) Updates `@playwright/test` from 1.61.1 to 1.62.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.62.0) Updates `@typescript-eslint/eslint-plugin` from 8.63.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.63.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser) Updates `eslint` from 10.7.0 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.7.0...v10.8.0) Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0) Updates `ink` from 7.1.0 to 7.1.1 - [Release notes](https://github.com/vadimdemedes/ink/releases) - [Commits](vadimdemedes/ink@v7.1.0...v7.1.1) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/node` from 26.1.1 to 26.1.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@github/copilot-sdk` from 1.0.6 to 1.0.8 - [Release notes](https://github.com/github/copilot-sdk/releases) - [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md) - [Commits](github/copilot-sdk@v1.0.6...v1.0.8) Updates `@opentelemetry/exporter-metrics-otlp-grpc` from 0.220.0 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0) Updates `@opentelemetry/exporter-trace-otlp-grpc` from 0.220.0 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0) Updates `@opentelemetry/resources` from 2.9.0 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0) Updates `@opentelemetry/sdk-node` from 0.220.0 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0) Updates `@opentelemetry/sdk-trace-node` from 2.9.0 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0) Updates `ws` from 8.21.0 to 8.21.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.0...8.21.1) --- updated-dependencies: - dependency-name: "@github/copilot-sdk" dependency-version: 1.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/context-async-hooks" dependency-version: 2.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/exporter-metrics-otlp-grpc" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/exporter-trace-otlp-grpc" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/resources" dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/sdk-metrics" dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/sdk-trace-node" dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@playwright/test" dependency-version: 1.62.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@types/node" dependency-version: 26.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@typescript-eslint/parser" dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: ink dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: ws dependency-version: 8.21.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…tionlint gate (bradygaster#1557) `squad upgrade` regenerates the squad-* workflows in downstream repos from Squad's bundled templates. Those templates redirect to unquoted $GITHUB_OUTPUT in run: blocks, so any downstream repo running actionlint + shellcheck in CI fails with SC2086 ("double quote to prevent globbing and word splitting"). Because the files are regenerated wholesale, downstream fixes are reverted on every upgrade — so the fix has to live in the templates, and Squad's own CI has to lint them. SC2086 fixes (unquoted >> $GITHUB_* redirects): - .squad-templates/workflows/squad-heartbeat.yml (canonical source) - templates/workflows/squad-heartbeat.yml (root mirror) - packages/squad-cli/templates/workflows/squad-heartbeat.yml - packages/squad-sdk/templates/workflows/squad-heartbeat.yml - .github/workflows/squad-heartbeat.yml (2 occurrences) - .github/workflows/squad-repo-health.yml (10 across 4 run: blocks) - .github/workflows/squad-ci.yml (13 $GITHUB_STEP_SUMMARY across 5 gates) Purely additive quoting; no behaviour change. New CI gate — .github/workflows/squad-workflow-lint.yml: actionlint 1.7.12 + shellcheck 0.10.0, linting all five workflow/template directories including the .squad-templates/ canonical source and the templates/ root mirror. Linting only the packages/* mirrors would let a canonical-only edit ship unlinted, since this job does not run the template sync. The actionlint installer is fetched from the v1.7.12 tag rather than main to avoid a moving-ref RCE surface, and shellcheck 0.10.0 is installed explicitly because ubuntu-latest ships 0.9.0. Installer hardening (PR review follow-up): - curl -sL -> curl -fsSL: hard-fail on non-200 so a 404 does not feed error HTML into bash. Applies to both actionlint and shellcheck downloads. - bash <(curl ...) -> download-then-run: write installer to a named file before executing so the script is inspectable on failure. - set -euo pipefail added to install step (shell: bash): ensures curl failure in the curl | tar pipeline is not masked by tar's exit status. - Convention matches squad-agents-ai-release.yml (shell: bash + set -euo pipefail at top of run block). Also: - .github/actionlint.yaml suppresses SC2129 (style-only "group your redirects" suggestion) with documented rationale. This is a rule-scoped ignore, not the file-scoped exclusion the issue complains about. - size-regression-report.yml: removed dead `status=$?` (SC2034) — the value was never read and the step exits 0 unconditionally. Verified by live regression probe on CI: reintroducing the unquoted redirect reproduced the exact finding from the issue — packages/squad-cli/templates/workflows/squad-heartbeat.yml:32:9: SC2086:info:2:29: Double quote to prevent globbing and word splitting — confirming the gate fires and that the SC2129 ignore does not over-suppress. All 44 template files across the four directories lint clean. Part 1 of 2. The actions/checkout v7 -> v4 clobbering on upgrade is deferred to a follow-up PR. Refs bradygaster#1556 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…git scanner (bradygaster#1559) The unsafe-git check in security-review.mjs scanned ALL changed files with no file-type filter. When Scribe merged .squad/decisions/inbox/ into decisions.md, the historical entry documenting the prohibition on git add . became new diff lines — and the scanner flagged the very rule it was documenting. Root cause: .squad/decisions/inbox/ is gitignored, so inbox entries never appeared in PR diffs. Once merged into decisions.md, those lines surface as +lines in any PR that touches decisions.md. Fix: add UNSAFE_GIT_EXCLUDED_PATHS to skip append-only memory/log files. Original exclusion regex used `[^/]+` (exactly one path segment), which failed to match nested alumni paths such as: .squad/agents/_alumni/kobayashi/history.md The `_alumni/` subdirectory is the documented layout for retired agents (see "Removing Team Members" flow), so this was a real false-positive, not a hypothetical one. PR bradygaster#1558 touches that exact path. Corrected regex: `/^\.squad\/agents\/.+\/history\.md$/` `.+` matches one or more characters including `/`, covering any nesting depth while still anchoring on the literal filename `history.md`. Excluded paths: - .squad/decisions.md (Scribe-managed append-only decision log) - .squad/agents/**/history.md (per-agent append-only memory, any depth) - .squad/log/** (gitignored runtime logs, listed for completeness) - .squad/orchestration-log/** (gitignored, same) Instruction surfaces intentionally kept in scope: - .github/copilot-instructions.md - .squad/agents/*/charter.md (all depths — a malicious PR could plant unsafe git guidance in a charter; these MUST remain scannable) - .squad/team.md, .squad/routing.md, squad.agent.md Verified locally: (a) Exclusions work: .squad/decisions.md → excluded .squad/agents/retro/history.md → excluded .squad/agents/_alumni/kobayashi/history.md → excluded (was broken) .squad/agents/_alumni/deep/nested/history.md → excluded (any depth) (b) Charters still scanned: .squad/agents/retro/charter.md → NOT excluded (scanned) .squad/agents/scribe/charter.md → NOT excluded (scanned) (c) Probe detection: scripts/__scan-probe.sh with `git add .` and `git push --force` → 2 errors detected; probe deleted, no trace in commit. (d) PR bradygaster#1558 (squad/state-sync-2026-07-29): node scripts/security-review.mjs origin/dev FETCH_HEAD → no findings (alumni history correctly excluded) Known follow-up (not fixed here): /git\s+add\s+\./ also matches the safe scoped form `git add .squad/`. Separate pattern-precision issue documented in PR body. Refs bradygaster#1556 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…ories (bradygaster#1558) * chore(squad): merge decision inbox and summarize oversized agent histories Scribe maintenance pass produced during the issue bradygaster#1556 work. Split out of PR bradygaster#1557 so that PR stays scoped to the shellcheck/actionlint gate. No product code, no workflows, no templates — .squad/ team state only. Decision inbox merged into decisions.md (6 entries), inbox cleared: - booster-ci-deletion-guard - retro-copilot-git-safety - flight-versioning-policy - booster-release-skill-v094 - procedures-fix-coordinator-inline-dispatch-gate - booster-workflow-template-linting (new) decisions.md 12151 -> 16030 bytes; still under the 20KB archival threshold, so no entries were archived. Agent histories summarized (all were over the 15KB threshold): eecom 33933 -> 5770, pao 30999 -> 5556, _alumni/kobayashi 26305 -> 3489, flight 23236 -> 5661, fido 22844 -> 6007, procedures 18945 -> 4082 This accounts for the ~1700 deleted lines — compaction of team memory, not lost work; prior content remains in git history. Cross-agent updates appended to fido (new CI quality gate) and surgeon (changeset landed; new lint job affects release gating), plus a RETRO history entry covering the security-scanner scoping fix in PR bradygaster#1559. Blocked on bradygaster#1559: the unsafe-git scanner flags decisions.md prose that documents the `git add .` prohibition. That fix cannot ship here because squad-repo-health.yml uses pull_request_target and checks out the base branch for trusted scripts, so CI always runs the dev copy of security-review.mjs. Refs bradygaster#1556 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: resolve security review permissions check failure Sanitize new decision/history prose so the unsafe-git scanner no longer matches literal forbidden command strings in PR bradygaster#1558. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <Copilot@users.noreply.github.com>

…7-31 # Conflicts: # .crew-templates/workflows/crew-heartbeat.yml # .crew/agents/_alumni/kobayashi/history.md # .crew/decisions/inbox/booster-release-skill-v094.md # .crew/decisions/inbox/flight-versioning-policy.md # .crew/decisions/inbox/procedures-fix-coordinator-inline-dispatch-gate.md # .crew/decisions/inbox/retro-copilot-git-safety.md # .github/workflows/crew-heartbeat.yml # .squad-templates/copilot-instructions.md # .squad/agents/flight/history.md # Directory.Build.props # package-lock.json # packages/crew-cli/package.json # packages/crew-cli/src/cli/commands/models.ts # packages/crew-cli/templates/workflows/crew-heartbeat.yml # packages/crew-sdk/src/config/schema.ts # packages/crew-sdk/templates/workflows/crew-heartbeat.yml # packages/squad-cli/templates/copilot-instructions.md # packages/squad-sdk/templates/copilot-instructions.md # samples/hello-crew/package-lock.json # samples/hook-governance/package-lock.json # samples/storage-provider-azure/package-lock.json # src/Crew.Agents.AI/Crew.Agents.AI.csproj # templates/copilot-instructions.md # templates/squad.agent.md.template # templates/workflows/crew-heartbeat.yml # test/config-schema.test.ts # test/lifecycle.test.ts

github-actions · 2026-07-31T19:14:20Z

⚠️ Crew File Leakage Detected

The following .crew/ files were modified in this PR:

.crew/agents/_alumni/kobayashi/history.md
.crew/agents/booster/history.md
.crew/agents/eecom/history.md
.crew/agents/fido/history.md
.crew/agents/flight/history.md
.crew/agents/pao/history.md
.crew/agents/procedures/history.md
.crew/agents/retro/history.md
.crew/agents/scribe/history.md
.crew/agents/surgeon/history.md
.crew/decisions.md

These files affect team routing, agent charters, and decisions.
If intentional, ensure approval from the team lead.

github-actions · 2026-07-31T19:14:22Z

🏗️ Architectural Review

⚠️ Architectural review: 1 warning(s).

Severity	Category	Finding	Files
🟡 warning	sweeping-refactor	This PR touches 91 files (87 modified/added, 4 deleted). Large PRs are harder to review — consider splitting if possible.	—

Automated architectural review — informational only.

github-actions · 2026-07-31T19:14:24Z

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit a59fdd4

PR Scope: 📦🔧 Mixed (product + infrastructure)

⚠️ 4 item(s) to address before review

Status	Check	Details
❌	Single commit	29 commits — consider squashing before review
✅	Not in draft	Ready for review
❌	Branch up to date	dev is 2 commit(s) ahead — rebase recommended
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	Changeset file found
✅	Scope clean	⚠️ PR includes 15 .crew/ file(s) — ensure these are intentional
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	2 check(s) failing: Policy Gates, samples-build

Files Changed (91 files, +7040 −6847)

File	+/−
`.changeset/canary-false-positives.md`	+6 −0
`.changeset/feat-cost-policy-1080.md`	+27 −0
`.changeset/fix-workflow-shellcheck-quoting.md`	+21 −0
`.changeset/forge-two-pass-adapter.md`	+8 −0
`.crew-templates/copilot-instructions.md`	+7 −3
`.crew-templates/crew.agent.md`	+2 −0
`.crew-templates/workflows/crew-heartbeat.yml`	+2 −2
`.crew/agents/_alumni/kobayashi/history.md`	+17 −434
`.crew/agents/booster/history.md`	+69 −0
`.crew/agents/eecom/history.md`	+26 −314
`.crew/agents/fido/history.md`	+12 −189
`.crew/agents/flight/history.md`	+19 −173
`.crew/agents/pao/history.md`	+22 −273
`.crew/agents/procedures/history.md`	+14 −197
`.crew/agents/retro/history.md`	+37 −0
`.crew/agents/scribe/history.md`	+2 −0
`.crew/agents/surgeon/history.md`	+2 −0
`.crew/decisions.md`	+48 −0
`.crew/decisions/inbox/booster-release-skill-v094.md`	+0 −35
`.crew/decisions/inbox/flight-versioning-policy.md`	+0 −32
`.crew/decisions/inbox/procedures-fix-coordinator-inline-dispatch-gate.md`	+0 −45
`.crew/decisions/inbox/retro-copilot-git-safety.md`	+0 −4
`.github/actionlint.yaml`	+18 −0
`.github/agents/crew.agent.md`	+2 −0
`.github/size-budget.json`	+10 −0
`.github/workflows/crew-agents-ai-ci.yml`	+2 −2
`.github/workflows/crew-agents-ai-release.yml`	+2 −2
`.github/workflows/crew-ci.yml`	+26 −26
`.github/workflows/crew-docs-links.yml`	+1 −1
`.github/workflows/crew-docs.yml`	+2 −2
`.github/workflows/crew-heartbeat.yml`	+3 −3
`.github/workflows/crew-impact.yml`	+2 −2
`.github/workflows/crew-insider-publish.yml`	+2 −2
`.github/workflows/crew-issue-assign.yml`	+1 −1
`.github/workflows/crew-label-enforce.yml`	+1 −1
`.github/workflows/crew-npm-publish.yml`	+9 −9
`.github/workflows/crew-pr-readiness.yml`	+1 −1
`.github/workflows/crew-preview.yml`	+2 −2
`.github/workflows/crew-promote.yml`	+2 −2
`.github/workflows/crew-release.yml`	+2 −2
`.github/workflows/crew-repo-health.yml`	+22 −22
`.github/workflows/crew-scope-check.yml`	+1 −1
`.github/workflows/crew-triage.yml`	+1 −1
`.github/workflows/crew-version-promote.yml`	+1 −1
`.github/workflows/crew-workflow-lint.yml`	+94 −0
`.github/workflows/size-regression-report.yml`	+43 −0
`.github/workflows/sync-crew-labels.yml`	+1 −1
`Directory.Build.props`	+1 −1
`docs/canary-identity-matrix.md`	+80 −0
`docs/open-issue-runtime-identity-beacon.md`	+166 −0
...	+41 more files

Total: +7040 −6847

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

github-actions · 2026-07-31T19:14:28Z

🔴 Impact Analysis — PR #2

Risk tier: 🔴 CRITICAL

📊 Summary

Metric	Count
Files changed	91
Files added	14
Files modified	73
Files deleted	4
Modules touched	9
Critical files	6

🎯 Risk Factors

91 files changed (>50 → CRITICAL)
9 modules touched (>8 → CRITICAL)
4 file(s) deleted
Critical files touched: docs/package.json, package.json, packages/crew-cli/package.json, packages/crew-sdk/package.json, packages/crew-sdk/src/agents/index.ts, samples/storage-provider-azure/package.json

📦 Modules Affected

ci-workflows (25 files)

.github/actionlint.yaml
.github/agents/crew.agent.md
.github/size-budget.json
.github/workflows/crew-agents-ai-ci.yml
.github/workflows/crew-agents-ai-release.yml
.github/workflows/crew-ci.yml
.github/workflows/crew-docs-links.yml
.github/workflows/crew-docs.yml
.github/workflows/crew-heartbeat.yml
.github/workflows/crew-impact.yml
.github/workflows/crew-insider-publish.yml
.github/workflows/crew-issue-assign.yml
.github/workflows/crew-label-enforce.yml
.github/workflows/crew-npm-publish.yml
.github/workflows/crew-pr-readiness.yml
.github/workflows/crew-preview.yml
.github/workflows/crew-promote.yml
.github/workflows/crew-release.yml
.github/workflows/crew-repo-health.yml
.github/workflows/crew-scope-check.yml
.github/workflows/crew-triage.yml
.github/workflows/crew-version-promote.yml
.github/workflows/crew-workflow-lint.yml
.github/workflows/size-regression-report.yml
.github/workflows/sync-crew-labels.yml

crew-cli (7 files)

packages/crew-cli/package.json
packages/crew-cli/src/cli-entry.ts
packages/crew-cli/src/cli/commands/models.ts
packages/crew-cli/src/cli/commands/watch/capabilities/two-pass.ts
packages/crew-cli/templates/copilot-instructions.md
packages/crew-cli/templates/crew.agent.md.template
packages/crew-cli/templates/workflows/crew-heartbeat.yml

crew-sdk (13 files)

packages/crew-sdk/package.json
packages/crew-sdk/src/agents/index.ts
packages/crew-sdk/src/agents/lifecycle.ts
packages/crew-sdk/src/agents/model-selector.ts
packages/crew-sdk/src/config/models.ts
packages/crew-sdk/src/config/schema.ts
packages/crew-sdk/src/platform/azure-devops.ts
packages/crew-sdk/src/platform/github.ts
packages/crew-sdk/src/platform/types.ts
packages/crew-sdk/src/runtime/config.ts
packages/crew-sdk/templates/copilot-instructions.md
packages/crew-sdk/templates/crew.agent.md.template
packages/crew-sdk/templates/workflows/crew-heartbeat.yml

crew-state (15 files)

.crew/agents/_alumni/kobayashi/history.md
.crew/agents/booster/history.md
.crew/agents/eecom/history.md
.crew/agents/fido/history.md
.crew/agents/flight/history.md
.crew/agents/pao/history.md
.crew/agents/procedures/history.md
.crew/agents/retro/history.md
.crew/agents/scribe/history.md
.crew/agents/surgeon/history.md
.crew/decisions.md
.crew/decisions/inbox/booster-release-skill-v094.md
.crew/decisions/inbox/flight-versioning-policy.md
.crew/decisions/inbox/procedures-fix-coordinator-inline-dispatch-gate.md
.crew/decisions/inbox/retro-copilot-git-safety.md

docs (4 files)

docs/canary-identity-matrix.md
docs/open-issue-runtime-identity-beacon.md
docs/package-lock.json
docs/package.json

root (17 files)

.changeset/canary-false-positives.md
.changeset/feat-cost-policy-1080.md
.changeset/fix-workflow-shellcheck-quoting.md
.changeset/forge-two-pass-adapter.md
Directory.Build.props
package-lock.json
package.json
samples/autonomous-pipeline/package-lock.json
samples/cost-aware-router/package-lock.json
samples/hello-crew/package-lock.json
samples/hook-governance/package-lock.json
samples/storage-provider-azure/package-lock.json
samples/storage-provider-azure/package.json
src/Crew.Agents.AI/Crew.Agents.AI.csproj
templates/copilot-instructions.md
templates/crew.agent.md.template
templates/workflows/crew-heartbeat.yml

scripts (2 files)

scripts/security-review.mjs
scripts/size-regression-guard.mjs

templates (3 files)

.crew-templates/copilot-instructions.md
.crew-templates/crew.agent.md
.crew-templates/workflows/crew-heartbeat.yml

tests (5 files)

test/Crew.Agents.AI.Tests/Crew.Agents.AI.Tests.csproj
test/config-schema.test.ts
test/lifecycle.test.ts
test/model-selector-policy.test.ts
test/models-refresh.test.ts

⚠️ Critical Files

docs/package.json
package.json
packages/crew-cli/package.json
packages/crew-sdk/package.json
packages/crew-sdk/src/agents/index.ts
samples/storage-provider-azure/package.json

This report is generated automatically for every PR. See #733 for details.

github-actions · 2026-07-31T19:14:30Z

🔒 Security Review

🔒 Security review: 5 info.

Severity	Category	Finding	Location
ℹ️ info	new-dependency	2 new/changed dependency version(s) in docs/package.json. Verify these packages are trusted and necessary.	`docs/package.json:20`
ℹ️ info	new-dependency	7 new/changed dependency version(s) in package.json. Verify these packages are trusted and necessary.	`package.json:43`
ℹ️ info	new-dependency	4 new/changed dependency version(s) in packages/crew-cli/package.json. Verify these packages are trusted and necessary.	`packages/crew-cli/package.json:199`
ℹ️ info	new-dependency	8 new/changed dependency version(s) in packages/crew-sdk/package.json. Verify these packages are trusted and necessary.	`packages/crew-sdk/package.json:240`
ℹ️ info	new-dependency	1 new/changed dependency version(s) in samples/storage-provider-azure/package.json. Verify these packages are trusted and necessary.	`samples/storage-provider-azure/package.json:24`

Automated security review — informational only.

dependabot Bot and others added 29 commits July 27, 2026 13:56

david-driscoll merged commit 8a70672 into dev Aug 1, 2026
18 of 20 checks passed

david-driscoll deleted the sync/upstream-2026-07-31 branch August 1, 2026 01:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

sync: merge upstream squad/dev (28 commits) with crew rebrand retained - #2

sync: merge upstream squad/dev (28 commits) with crew rebrand retained#2
david-driscoll merged 29 commits into
devfrom
sync/upstream-2026-07-31

david-driscoll commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

david-driscoll commented Jul 31, 2026

Notable upstream changes brought in

How conflicts were resolved

Verification

Uh oh!

github-actions Bot commented Jul 31, 2026

⚠️ Crew File Leakage Detected

Uh oh!

github-actions Bot commented Jul 31, 2026

🏗️ Architectural Review

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛫 PR Readiness Check

⚠️ 4 item(s) to address before review

Files Changed (91 files, +7040 −6847)

Uh oh!

github-actions Bot commented Jul 31, 2026

🔴 Impact Analysis — PR #2

📊 Summary

🎯 Risk Factors

📦 Modules Affected

⚠️ Critical Files

Uh oh!

github-actions Bot commented Jul 31, 2026

🔒 Security Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Jul 31, 2026 •

edited

Loading