Record resilient dependency recovery policy

Ensure Squad agents treat unavailable npm proxy artifacts as recoverable dependency-resolution work rather than terminal blockers.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: bradygaster

.squad/decisions.md

@@ -1525,3 +1525,46 @@ Prose is not worthless, and "never write prose requirements" would be wrong and
 - the reader is **not misled** into believing it is a guarantee.
 
 The failure is not prose — it is prose that *reads as enforcement*. Instance 2 is good practice; instances 1, 3, 4, 5 are the same words without the label. Apply the test above to every rule you write; if nothing turns red on violation, add the "(unenforced)" label and the gate issue, or build the observer.
+
+### 2026-09-08: npm proxy failures trigger recovery, not work stoppage
+**Date:** 2026-09-08
+**Raised by:** Brady Gaster
+**Status:** Decided
+
+#### Decision
+
+The required Microsoft npm proxy configuration is a prerequisite for npm commands,
+not evidence that every dependency is mirrored and not an exclusive-source mandate.
+Before every npm invocation, agents must run:
+
+```bash
+npm config set registry "https://packagefeedproxy.microsoft.io/npm/"
+```
+
+If a required artifact is unavailable, the task remains active. The implementation
+owner must continue independent work while Network investigates in parallel, using
+this ordered recovery strategy:
+
+1. Do not restore dependencies unless manifests changed or the required tool is
+   genuinely unavailable. Prefer verified existing `node_modules`, npm caches,
+   targeted tooling, or isolated/cloud validation.
+2. Inspect the exact dependency chain and proxy inventory. Select a compatible,
+   security-safe version or parent dependency upgrade when available.
+3. Use a tested package override or immutable upstream commit/release tarball when
+   permitted, recording integrity in the lockfile.
+4. Replace a dependency only when compatibility tests and security evidence support
+   the replacement.
+5. Continue every validation that does not depend on the missing artifact.
+
+Agents must not downgrade to a known-vulnerable version, conflate a baseline restore
+failure with a regression, or stop after the first registry error. A dependency
+problem may be reported as blocked only after the safe alternatives above have been
+attempted and the remaining action requires user-only credentials, permissions, or
+corporate mirror administration. The report must name the attempted alternatives
+and the exact external action still required.
+
+#### Consequence
+
+Fresh `npm ci` is not the universal definition of a valid workspace. Build and test
+gates still apply, but agents must satisfy them through an available reproducible
+environment rather than treating registry incompleteness as permission to stop.

.squad/team.md

@@ -84,3 +84,30 @@ When working on issues, follow the Squad branching model:
 - **Distribution:** npm (`npm install -g @bradygaster/squad-cli` for CLI, `npm install @bradygaster/squad-sdk` for SDK)
 - **Universe:** Apollo 13 / NASA Mission Control
 - **Created:** 2026-02-21
+
+## Dependency Recovery Directive
+
+The Microsoft npm proxy is a required configuration step, not an assumption that
+every locked artifact is available. Before every npm invocation, run:
+
+```bash
+npm config set registry "https://packagefeedproxy.microsoft.io/npm/"
+```
+
+A missing or stale proxy artifact is **not** a task blocker by itself. Agents must
+continue through this recovery order:
+
+1. Avoid a fresh restore when manifests are unchanged; use verified existing
+   `node_modules`, caches, targeted tools, or an isolated/cloud environment.
+2. Check proxy-available compatible versions and safe parent-dependency upgrades.
+3. Use a tested `overrides` entry or immutable upstream commit/release tarball when
+   policy permits, preserving integrity in the lockfile.
+4. Replace a dependency only with compatibility and security evidence.
+5. Run every unaffected validation while resolving the unavailable artifact.
+
+Never downgrade to a vulnerable version merely because the proxy carries it.
+Never classify an unrelated baseline restore failure as a change failure. Report
+`blocked` only after safe alternatives are exhausted and the remaining action
+requires user-only credentials, permissions, or corporate mirror administration.
+Network owns dependency recovery and works in parallel; the implementation owner
+continues all independent work.