feat(workflows): add advisory Squad reviewer

[bradygaster]

Summary

• add an independent advisory squad-review workflow for recognized Squad/Copilot PRs
• relay /squad review from PR comments through the existing /squad router
• enforce durable-marker-first provenance, fork refusal, SHA deduplication, per-PR cancellation, and COMMENT/REQUEST_CHANGES-only verdicts
• add focused structural, compiled-contract, and mutation tests for the reviewer boundary

Authority boundary

The compiled agent job has contents, issues, and pull-requests read access only (plus copilot-requests: write). Configured safe outputs are limited to one PR comment, up to ten inline review comments, and one COMMENT or REQUEST_CHANGES verdict. There is no edit tool, dispatch output, issue creation, approval, remediation, ruleset, or required-check behavior.

Validation

• gh aw compile squad-review --strict --no-check-update (0 warnings)
• gh aw compile squad --strict --approve --no-check-update (compiled; existing slash-command/bot warning only)
• authority/provenance mutation harness: 9/9 mutants killed
• Node TypeScript syntax checks passed
• npm tests and targeted ESLint could not run locally because the mandated package proxy does not contain pinned vitest@4.1.11; manifests and lockfiles were left unchanged and PR CI is the validation path

Security review

No new secrets, actions, dependencies, or direct GitHub write permissions are introduced. The review workflow keeps fork protection and uses safe outputs for all writes. The router's existing shared imports reference SQUAD_GITHUB_TOKEN and SQUAD_GITHUB_APP_PRIVATE_KEY; this change does not add or alter those references.

Working as FIDO (Quality Owner).

Closes #1733

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 0d4abb0

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	3 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (4 files, +479 −7)

File	+/−
test/gh-aw-command-parse.test.ts	+1 −1
test/gh-aw-review-workflow.test.ts	+269 −0
workflows/squad-review.md	+167 −0
workflows/squad.md	+42 −6

Total: +479 −7

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🟡 Impact Analysis — PR #1871

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	4
Files added	2
Files modified	2
Files deleted	0
Modules touched	2

🎯 Risk Factors

• 4 files changed (≤5 → LOW)
• 2 modules touched (2-4 → MEDIUM)

📦 Modules Affected

root (2 files)

• workflows/squad-review.md
• workflows/squad.md

tests (2 files)

• test/gh-aw-command-parse.test.ts
• test/gh-aw-review-workflow.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[Copilot]

🟢 Approval recommended

The workflow isolation/authority boundary is explicitly constrained and reinforced with structural + compiled-contract + mutation tests covering the key invariants described in the linked acceptance criteria.

Pull request overview

Adds an independent, advisory-only “Squad Review” gh-aw workflow and wires /squad review into the existing /squad router as a relay, with explicit guardrails around provenance, fork refusal, SHA deduplication, cancellation, and constrained outputs/verdicts.

Changes:

• Extend the /squad router to recognize /squad review as an open (read-only) mode and dispatch the new reviewer workflow via typed dispatch-workflow.
• Introduce workflows/squad-review.md with a tight authority boundary (no edit/dispatch/issue creation; bounded comment + review outputs; COMMENT/REQUEST_CHANGES only).
• Add focused contract + compilation + mutation tests ensuring reviewer isolation and provenance/authority invariants remain enforced.

File summaries

File	Description
workflows/squad.md	Adds /squad review parsing + open-mode classification and a relay skill that dispatches the isolated reviewer workflow.
workflows/squad-review.md	New advisory reviewer workflow with strict provenance gates, fork refusal, SHA dedup, per-PR concurrency, and constrained safe outputs.
test/gh-aw-review-workflow.test.ts	New structural/compiled contract tests (including mutation harness) to keep reviewer authority bounded and provenance rules durable.
test/gh-aw-command-parse.test.ts	Updates open-mode allowlist coverage to include review in the router’s authorization classification tests.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.