fix(gh-aw): converge on 0.89.22 and restore bootstrap (#2122)

Closes octodemo/zava-social-cao-ops-20260929111840#18\nCloses octodemo/zava-social-cao-ops-20260929111840#26\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: bradygaster

.changeset/bright-gh-aw-central-ops.md

@@ -0,0 +1,6 @@
+---
+"@bradygaster/squad-cli": patch
+"@bradygaster/squad-sdk": patch
+---
+
+Require gh-aw v0.89.22 across the Squad workflow package, enlistment guidance, integrity contract, CI, and hosted E2E controller for central agentic ops compatibility. Validate isolated bootstrap candidates against the trusted checkout's Git history so materialization can create the Cast PR and research issue.

.github/workflows/squad-ci.yml

@@ -173,7 +173,7 @@ jobs:
         # than skipping — a skipped gate is indistinguishable from no gate. This
         # includes the shell input security contract gate (#1834) and the compile
         # contract (#1732).
-        run: gh extension install --pin v0.89.21 github/gh-aw
+        run: gh extension install --pin v0.89.22 github/gh-aw
         env:
           GH_TOKEN: ${{ github.token }}
       - name: Build
@@ -749,10 +749,10 @@ jobs:
           npm config set registry "https://packagefeedproxy.microsoft.io/npm/"
           npm ci --ignore-scripts
 
-      - name: Install gh-aw v0.89.21 (pinned)
+      - name: Install gh-aw v0.89.22 (pinned)
         run: |
-          gh extension install --force --pin v0.89.21 github/gh-aw
-          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.21
+          gh extension install --force --pin v0.89.22 github/gh-aw
+          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.22
         env:
           GH_TOKEN: ${{ github.token }}
 

.github/workflows/squad-gh-aw-hosted-e2e.yml

@@ -50,8 +50,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh extension install --force --pin v0.89.21 github/gh-aw
-          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.21
+          gh extension install --force --pin v0.89.22 github/gh-aw
+          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.22
 
       - name: Verify trusted default-branch controller
         env:

.squad-templates/skills/gh-aw-enlistment/SKILL.md

@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->

docs/src/content/docs/guide/gh-aw.md

@@ -31,8 +31,8 @@ set -euo pipefail
 gh auth status
 owner_repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
 default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')"
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # 2. Require GitHub Issues, then allow GitHub Actions to create pull requests
 issues_enabled="$(gh api "repos/${owner_repo}" --jq '.has_issues')"
@@ -341,7 +341,7 @@ gh aw compile --strict
 ```
 
 Run this exact command after any required first-install approval and before
-committing. With gh-aw v0.89.21, require exactly two warnings, one occurrence
+committing. With gh-aw v0.89.22, require exactly two warnings, one occurrence
 of each exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
@@ -1849,7 +1849,7 @@ prints the exact safe recovery commands.
 
 The schema-v2 integrity manifest records two complete compiled lock digests per
 workflow: `lock_sha256` for a per-workflow source annotation and
-`package_lock_sha256` for a package-root annotation. gh-aw v0.89.21 emits
+`package_lock_sha256` for a package-root annotation. gh-aw v0.89.22 emits
 `bradygaster/squad/workflows@SHA` for direct package includes, but can emit
 `bradygaster/squad/workflows/package/<workflow>.md@SHA` when installing dispatched
 dependencies. Fresh and forced installs can therefore contain different mixtures.
@@ -1859,7 +1859,7 @@ URLs, action pins, permissions and runtime bytes remain integrity-checked.
 No additional fields are removed during lock normalization.
 
 Manifest generation and installation test fixtures seed isolated compiler action
-locks with the immutable `setup` and `setup-cli` pins for gh-aw v0.89.21. Both
+locks with the immutable `setup` and `setup-cli` pins for gh-aw v0.89.22. Both
 source variants use the real strict compiler and validate its version and emitted
 action pins. This avoids a second network resolution returning a mutable version
 tag when credentials or the API are unavailable. Missing or altered pins fail

packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md

@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->

packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md

@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->

scripts/validate-gh-aw-cast.mjs

@@ -531,7 +531,7 @@ function committedRegistry(root, errors) {
   }
 }
 
-function parseRegistry(root, errors) {
+function parseRegistry(root, errors, gitRoot = root) {
   let registryRaw;
   let historyRaw;
   try {
@@ -543,7 +543,7 @@ function parseRegistry(root, errors) {
   }
   const registry = parseCastingPair(registryRaw, historyRaw, 'registry', errors);
   if (!registry) return [];
-  const base = committedRegistry(root, errors);
+  const base = committedRegistry(gitRoot, errors);
   if (base) {
     const baseRevision = base.schema === 'squad-agent-provenance/v1' ? base.revision : 0;
     if (registry.revision <= baseRevision) {
@@ -631,7 +631,7 @@ function validateCapabilities(coordinator, active, routingRows, errors) {
   }
 }
 
-export function validateCastTree({ root, payloadPath }) {
+export function validateCastTree({ root, payloadPath, gitRoot = root }) {
   const errors = [];
   let payloadValue;
   try {
@@ -660,7 +660,7 @@ export function validateCastTree({ root, payloadPath }) {
     if (!payload.includes(required)) errors.push(`payload: missing required path ${required}`);
   }
 
-  const active = parseRegistry(root, errors);
+  const active = parseRegistry(root, errors, gitRoot);
   const activeNames = new Set(active.map(({ name }) => name));
   const activeCharters = active.map(({ id }) => `.squad/agents/${id}/charter.md`);
   const expectedPayload = new Set([...CORE_PAYLOAD, ...activeCharters, ...REQUIRED_BUILTIN_CHARTERS]);

templates/skills/gh-aw-enlistment/SKILL.md

@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->

test/gh-aw-bootstrap-workflow.test.ts

@@ -11,7 +11,7 @@ import {
 } from 'node:fs';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, join, relative, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { parse } from 'yaml';
@@ -31,6 +31,7 @@ import {
   findBootstrapResearchArtifacts,
   isBootstrapResearchSeed,
   reconstructBootstrapPayload,
+  validateBootstrapPayload,
 } from '../workflows/shared/squad-bootstrap-validator.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
@@ -601,6 +602,27 @@ describe('automatic Squad bootstrap workflow', () => {
     const result = validateFixture(fixture);
     expect(result.status, result.stderr).toBe(0);
     expect(result.stdout).toBe('Squad bootstrap validation passed.\n');
+  });
+
+  it('validates an isolated candidate against the trusted checkout Git history', () => {
+    const fixture = createFixture();
+    const candidate = mkdtempSync(join(tmpdir(), 'gh-aw-bootstrap-candidate-'));
+    workspaces.push(candidate);
+    cpSync(fixture.root, candidate, {
+      recursive: true,
+      filter: source => relative(fixture.root, source).split('/')[0] !== '.git',
+    });
+    const options = {
+      root: candidate,
+      payloadPath: join(candidate, 'payload.json'),
+      repository: 'octo/example',
+      defaultBranch: 'main',
+      linkMode: 'placeholder',
+    };
+    expect(validateBootstrapPayload(options)).toContainEqual(
+      expect.stringContaining('registry base: committed HEAD is unavailable'),
+    );
+    expect(validateBootstrapPayload({ ...options, gitRoot: fixture.root })).toEqual([]);
 
     const resolved = {
       ...fixture.payload,
@@ -849,6 +871,7 @@ describe('automatic Squad bootstrap workflow', () => {
     expect(lock).not.toMatch(/"materialize-bootstrap":\{"inputs":\{"payload":/);
     expect(lock).toContain('reconstructBootstrapPayload(items[0])');
     expect(lock).toContain("mkdtempSync(join(tmpdir(), 'squad-bootstrap-candidate-'))");
+    expect(lock).toContain('gitRoot: checkout');
     expect(lock).toContain('Bootstrap payload path crosses a symbolic link');
     expect(lock.indexOf("validate(payload, 'placeholder')"))
       .toBeLessThan(lock.indexOf('safeTarget(checkout, file.path)'));