bradygaster · Nov 8, 2026 · Nov 8, 2026 · Nov 8, 2026 · Nov 8, 2026
@@ -0,0 +1,6 @@
+---
+"@bradygaster/squad-sdk": patch
+"@bradygaster/squad-cli": patch
+---
+
+Update the Squad agentic-workflow enlistment skill to install the canonical github/squad package with stable gh-aw 1.x, without pinning the CLI installation to an exact patch release. Preserve immutable compiler-action pins and full installation/staging verification; the package currently validates gh-aw v1.0.1 output.
@@ -49,11 +49,11 @@ The quick start installs this workflow set:
 
 ```bash
 SQUAD_SHA="<40-character-commit-sha>"  # explicit, maintainer-approved; never `commits/dev`
-gh aw add "bradygaster/squad/workflows@${SQUAD_SHA}"
+gh aw add "github/squad/workflows@${SQUAD_SHA}"
 rm -f .github/skills/agentic-workflows/SKILL.md
 ```
 
-The removal is intentional: gh-aw v0.91.5 generates that generic tool-owned
+The removal is intentional: gh-aw v1.0.1 generates that generic tool-owned
 router, which loads mutable prompts from the current `github/gh-aw` repository.
 It is not Squad-owned or bound to `SQUAD_SHA`. Keep the exact
 `.github/skills/gh-aw-enlistment/SKILL.md` installed by Squad.

@@ -176,7 +176,7 @@ jobs:
         # than skipping — a skipped gate is indistinguishable from no gate. This
         # includes the shell input security contract gate (#1834) and the compile
         # contract (#1732).
-        run: gh extension install --pin v0.91.5 github/gh-aw
+        run: gh extension install --pin v1.0.1 github/gh-aw
         env:
           GH_TOKEN: ${{ github.token }}
       - name: Build
@@ -658,10 +658,10 @@ jobs:
       - name: Install verifier dependencies
         run: npm ci --ignore-scripts --registry=https://registry.npmjs.org/
 
-      - name: Install gh-aw v0.91.5 (pinned)
+      - name: Install gh-aw v1.0.1 (pinned)
         run: |
-          gh extension install --force --pin v0.91.5 github/gh-aw
-          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.91.5
+          gh extension install --force --pin v1.0.1 github/gh-aw
+          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v1.0.1
         env:
           GH_TOKEN: ${{ github.token }}
 

@@ -24,7 +24,7 @@ jobs:
   hosted-e2e:
     name: Install, merge, bootstrap, and probe
     if: >-
-      github.repository == 'bradygaster/squad'
+      github.repository == 'github/squad'
       && github.ref_name == github.event.repository.default_branch
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -50,8 +50,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh extension install --force --pin v0.91.5 github/gh-aw
-          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.91.5
+          gh extension install --force --pin v1.0.1 github/gh-aw
+          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v1.0.1
 
       - name: Verify trusted default-branch controller
         env:

@@ -203,8 +203,8 @@ jobs:
       - name: Check extracted release scripts and workflow policy
         run: node scripts/release/check-release-scripts.mjs
 
-      - name: Install gh-aw v0.91.5 (pinned; required by fail-closed test gates)
-        run: gh extension install --force --pin v0.91.5 github/gh-aw
+      - name: Install gh-aw v1.0.1 (pinned; required by fail-closed test gates)
+        run: gh extension install --force --pin v1.0.1 github/gh-aw
         env:
           GH_TOKEN: ${{ github.token }}
 

@@ -1082,7 +1082,7 @@ jobs:
               --base master \
               --head "tamirdresher:${BRANCH}" \
               --title "New version: ${PACKAGE_IDENTIFIER} version ${VERSION}" \
-              --body "Automated manifest update for [Squad ${TAG}](https://github.com/bradygaster/squad/releases/tag/${TAG}), using the release run's packaging-manifests artifact.")"
+              --body "Automated manifest update for [Squad ${TAG}](https://github.com/github/squad/releases/tag/${TAG}), using the release run's packaging-manifests artifact.")"
             pr_status="Opened"
           else
             pr_status="Reused"

@@ -25,7 +25,7 @@ bootstrap pull request** — never an auto-merge.
 This skill **operationalizes** the supported bootstrap path. It does not summarize
 it: each step below is a gate with explicit success evidence and **STOP conditions**.
 The authoritative source is `docs/src/content/docs/guide/gh-aw.md` (mirrored at
-`https://bradygaster.github.io/squad/docs/guide/gh-aw/`). If that guide and this
+`https://github.github.com/squad/guide/gh-aw/`). If that guide and this
 skill ever disagree, the guide wins — re-read it before proceeding.
 
 GitHub Issues are a hard prerequisite: `/squad` commands arrive as issue
@@ -54,25 +54,24 @@ condition and wait for a human decision — do not work around it.
 # gh is authenticated
 gh auth status
 
-# Prove the exact package-capable compiler version before creating artifacts
+# Require stable gh-aw 1.x without pinning the CLI installation to a patch
 # gh-aw-exact-version-start
-required_gh_aw_version="v0.91.5"
 gh_aw_version_output="$(gh aw --version 2>&1)" || gh_aw_version_output=""
 gh_aw_version="$(printf '%s\n' "${gh_aw_version_output}" | awk 'END {print $NF}')"
 
-if [ "${gh_aw_version}" != "${required_gh_aw_version}" ]; then
-  echo "Installing exact supported gh-aw ${required_gh_aw_version}."
+if [ -z "${gh_aw_version}" ] || [[ "${gh_aw_version}" =~ ^v0\. ]]; then
+  echo "Installing the current stable gh-aw release."
   gh extension remove gh-aw >/dev/null 2>&1 || true
-  gh extension install --pin "${required_gh_aw_version}" github/gh-aw
+  gh extension install github/gh-aw
   gh_aw_version_output="$(gh aw --version 2>&1)" || {
     echo "STOP: gh-aw version could not be verified after clean installation." >&2
     exit 1
   }
   gh_aw_version="$(printf '%s\n' "${gh_aw_version_output}" | awk 'END {print $NF}')"
 fi
 
-test "${gh_aw_version}" = "${required_gh_aw_version}" || {
-  echo "STOP: required gh-aw v0.91.5, but found ${gh_aw_version:-unavailable} after clean installation." >&2
+[[ "${gh_aw_version}" =~ ^v1\.[0-9]+\.[0-9]+$ ]] || {
+  echo "STOP: stable gh-aw 1.x is required, but found ${gh_aw_version:-unavailable}." >&2
   exit 1
 }
 # gh-aw-exact-version-end
@@ -87,21 +86,27 @@ git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> capture both output streams from `gh aw --version`. On any mismatch, remove
-> `github/gh-aw`, cleanly install the exact `v0.91.5` pin, and verify both
-> streams again. Stop before branch creation or file generation unless that
-> second check proves exactly `v0.91.5`; never select a newer release.
+> capture both output streams from `gh aw --version`. If absent or 0.x, cleanly
+> install the current stable `github/gh-aw` release without `--pin` and verify
+> both streams again. Stop unless the result is a stable 1.x release; never
+> downgrade a newer major version automatically. The current package validates
+> v1.0.1 compiler bytes and immutable action pins. Other 1.x releases require
+> a maintainer-reviewed package update, not a consumer-side digest refresh.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
   identity for this repo (see the `gh-auth-isolation` skill to operate as a
   specific account without switching the global default).
 - **STOP** if `owner_repo` or `default_branch` cannot be resolved.
-- **STOP** if exact gh-aw `v0.91.5` cannot be proven after the clean pinned
-  reinstall. Do not create a branch or generate repository files.
+- **STOP** if stable gh-aw 1.x cannot be proven after installation, or the
+  package's published compiler contract does not cover the installed release.
+  Do not create a branch or generate repository files.
 - **STOP** if the working tree has unrelated uncommitted changes you cannot
   account for — the bootstrap must land as an isolated, reviewable change.
 - Confirm Copilot is enabled for the repository where checkable; the activation
   run and the requested `@copilot` review both depend on it.
+- Before installation, record whether `.vscode/settings.json` and
+  `.github/workflows/agentics-maintenance.yml` already exist. Preserve pre-existing
+  files; stop and report their diff if gh-aw changes them.
 
 ### 1. Require GitHub Issues, then allow Actions-created PRs with a read-only token
 
@@ -193,13 +198,13 @@ published release guidance, then set it once:
   echo "STOP: SQUAD_SHA must be the exact 40-character commit SHA, not a branch name or shortened hash." >&2
   exit 1
 }
-gh aw add "bradygaster/squad/workflows@${SQUAD_SHA}"
+gh aw add "github/squad/workflows@${SQUAD_SHA}"
 rm -f .github/skills/agentic-workflows/SKILL.md
 ```
 
 The nested `workflows/aw.yml` is the only supported distribution registration.
 It isolates package auto-discovery from unrelated repository skills and agents,
-and installs exactly eight workflows, seventeen runtime resources, and one
+and installs exactly eight workflows, twenty-one runtime resources, and one
 `gh-aw-enlistment` skill at the same resolved revision:
 
 - `squad.md` + `squad.lock.yml`
@@ -217,7 +222,7 @@ governance-scoped retrospective proposal (see the gh-aw guide's retrospective
 auto-implementation section); installing it alongside the other seven keeps the
 full stack consistent and avoids a second bootstrap pass later.
 
-gh-aw v0.91.5 also materializes
+gh-aw v1.0.1 also materializes
 `.github/skills/agentic-workflows/SKILL.md`. That generic tool-owned router is
 not part of the Squad package and directs agents to mutable prompts from the
 current `github/gh-aw` repository rather than the pinned Squad revision. Remove
@@ -247,7 +252,7 @@ On a clean repo, `gh aw add` reports these expected safe updates and **nothing e
 
 <!-- allowlist-start -->
 - Restricted secrets: **`SQUAD_GITHUB_APP_PRIVATE_KEY`** and **`SQUAD_GITHUB_TOKEN`**
-- Action: **`bradygaster/squad/.github/actions/squad-init`**
+- Action: **`github/squad/.github/actions/squad-init`**
 <!-- allowlist-end -->
 
 > **These are referenced names, not prerequisites.** `gh aw add` lists the secrets
@@ -285,7 +290,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.91.5, require exactly two warnings, one occurrence of each
+- With gh-aw v1.0.1, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
@@ -335,15 +340,22 @@ If `.github/aw/logs/` lacks a `.gitignore`, add one there:
 !.gitignore
 ```
 
-`gh aw add` may also create `.vscode/settings.json` (enables Copilot for Markdown
-workflow files). This is an **optional editor setting** — the stage command below
-intentionally leaves it untracked. Delete it if unwanted, or stage it explicitly
-if your team wants to share it. Decide deliberately; do not stage it by accident.
+gh-aw v1.0.1 may generate two auxiliary outputs: `.vscode/settings.json`
+(optional Markdown editor settings) and `.github/workflows/agentics-maintenance.yml`
+(the compiler's maintenance workflow). Neither is authenticated by Squad's
+package manifest. Leave both outside the bootstrap PR by default; the staging
+commands below exclude them. Review and stage an auxiliary file by its exact
+path only after explicit approval.
+
+Only remove an unwanted auxiliary file if it was absent before installation
+and was created by this invocation. Never delete or overwrite pre-existing
+editor settings or maintenance workflows. Known, newly generated auxiliary
+files left untracked are expected output, not an unrelated-change failure.
 
 Stage **only** the documented generated surfaces, then verify the staged set:
 
 ```bash
-git add -- .gitattributes .github/aw/ .github/workflows/ .github/skills/
+git add -- .gitattributes .github/aw/ .github/workflows/ .github/skills/ ':(exclude).github/workflows/agentics-maintenance.yml'
 node .github/workflows/shared/squad-install-verifier.mjs \
   --verify-staged-install --stage-ownership --source-revision "${SQUAD_SHA}" || exit 1
 git diff --cached --stat
@@ -498,7 +510,7 @@ git switch -c chore/squad-gh-aw-bootstrap
   echo "STOP: SQUAD_SHA must be an explicit, maintainer-approved 40-character lowercase hex commit SHA." >&2
   exit 1
 }
-gh aw add "bradygaster/squad/workflows@${SQUAD_SHA}"
+gh aw add "github/squad/workflows@${SQUAD_SHA}"
 rm -f .github/skills/agentic-workflows/SKILL.md
 
 # Safe-update report shows ONLY the two documented secrets + squad-init → approve once
@@ -508,7 +520,7 @@ gh aw compile --strict           # final, no --approve; exactly the two document
 node .github/workflows/shared/squad-install-verifier.mjs \
   --verify-install --source-revision "${SQUAD_SHA}" --strict-compile
 
-git add -- .gitattributes .github/aw/ .github/workflows/ .github/skills/
+git add -- .gitattributes .github/aw/ .github/workflows/ .github/skills/ ':(exclude).github/workflows/agentics-maintenance.yml'
 node .github/workflows/shared/squad-install-verifier.mjs \
   --verify-staged-install --stage-ownership --source-revision "${SQUAD_SHA}" || exit 1
 git commit -m "ci: add Squad agentic workflow"
@@ -566,7 +578,7 @@ gh pr merge --squash                # auto-merge before human review. NEVER.
   `.github/skills/agentic-workflows/SKILL.md`; keep the exact Squad-owned
   `.github/skills/gh-aw-enlistment/SKILL.md`.
 - ❌ **Approving unknown safe updates.** Approve ONLY `SQUAD_GITHUB_APP_PRIVATE_KEY`,
-  `SQUAD_GITHUB_TOKEN`, and `bradygaster/squad/.github/actions/squad-init`. Anything
+  `SQUAD_GITHUB_TOKEN`, and `github/squad/.github/actions/squad-init`. Anything
   else is a STOP.
 - ❌ **Treating `--approve` as the final compile.** Always finish with a plain
   `gh aw compile --strict` (no `--approve`).

@@ -600,7 +600,7 @@ test "$(gh api "repos/${owner_repo}" --jq '.has_issues')" = "true" || {
 }
 
 SQUAD_SHA="<40-character-commit-sha>"  # explicit, maintainer-approved; never `commits/dev`
-gh aw add "bradygaster/squad/workflows@${SQUAD_SHA}"
+gh aw add "github/squad/workflows@${SQUAD_SHA}"
 rm -f .github/skills/agentic-workflows/SKILL.md
 git add -- \
   .github/aw/ \

@@ -0,0 +1,31 @@
+# Squad agentic workflows bootstrap prompt
+
+**Compiler contract:** Install stable gh-aw 1.x without an exact CLI patch-version installation lock. The package currently validates v1.0.1 output with immutable compiler-action pins and complete-lock digests; newer compiler releases require a reviewed package update. Use a published immutable Squad revision carrying this contract, not an older upstream revision. See [compiler compatibility](https://github.com/github/squad/blob/dev/docs/src/content/docs/guide/gh-aw.md#gh-aw-1x-compatibility).
+
+```text
+Bootstrap this repository with GitHub's Squad agentic workflows from `github/squad`. Inspect the repo first, make only the necessary changes, validate them, and open a PR for human review if your tools permit it. Do not merge.
+
+Before editing:
+- Check the default branch, working tree, authentication, and existing `.github/aw/`, `.github/workflows/`, and `.github/skills/` files.
+- Record whether `.vscode/settings.json` and `.github/workflows/agentics-maintenance.yml` already exist. Never delete or overwrite pre-existing settings or maintenance workflows; stop and report their diff if gh-aw changes them.
+- If an installation is already present, or files conflict and you can't verify their ownership, stop and report the paths; don't overwrite them.
+- Check `gh aw --version` against current official stable 1.x releases. Do not install an exact patch version or downgrade to 0.x to bypass a failed prerequisite.
+- Obtain an approved, immutable 40-character lowercase `SQUAD_SHA` from published guidance or a maintainer. Never guess or use a moving branch.
+- Require published compatibility evidence for that revision, `github/squad/workflows` ownership, and the installed 1.x compiler. This package validates v1.0.1 compilation with immutable action pins and complete compiled-lock digests. Stop if the selected revision's contract does not cover the installed compiler. Do not rewrite ownership, regenerate trusted digests in the consumer repo, or weaken the verifier.
+- Check that Issues are enabled and Actions permissions match the documented Profile A (`default_workflow_permissions=read`, `can_approve_pull_request_reviews=false`). Don't change settings without explicit authorization.
+
+Only after every prerequisite passes, install on `chore/squad-gh-aw-bootstrap`, without overwriting existing work:
+`gh aw add "github/squad/workflows@${SQUAD_SHA}"`
+
+Do not run generic `gh aw init` or create Squad files by hand. If the install generates `.github/skills/agentic-workflows/SKILL.md`, remove only that tool-generated file as the guide directs. Don't create the optional secrets. If a first-install safe-update approval is required, compare its exact secret/action list with the approved revision's published guidance: `SQUAD_GITHUB_APP_PRIVATE_KEY`, `SQUAD_GITHUB_TOKEN`, and `github/squad/.github/actions/squad-init`. Stop on any mismatch; do not approve or substitute an action.
+
+Run and require success:
+1. `node .github/workflows/shared/squad-install-verifier.mjs --materialize-runtime`
+2. `gh aw compile --strict --no-check-update`
+3. `node .github/workflows/shared/squad-install-verifier.mjs --verify-install --source-revision "${SQUAD_SHA}" --strict-compile`
+4. Stage only newly installed/materialized changed/owned paths within `.gitattributes`, `.github/aw/`, `.github/workflows/`, and `.github/skills/`; never stage whole directories containing unrelated files. Leave `.vscode/settings.json` and `.github/workflows/agentics-maintenance.yml` outside the PR unless explicitly approved: they are tool-generated auxiliary outputs, not Squad-manifest-authenticated files. Only remove either file if it was absent beforehand and this invocation created it. Review the staged diff, then run `node .github/workflows/shared/squad-install-verifier.mjs --verify-staged-install --stage-ownership --source-revision "${SQUAD_SHA}"`.
+
+Confirm eight workflows and their generated lockfiles are present and review the compiled artifacts. Require the approved revision's documented warning policy: one `pull_request_target` warning for `squad-review.md` and one combined `slash_command`/`bots` warning for `squad.md` under the current v1.0.1 contract. Known, newly generated auxiliary files left untracked are expected output, not an unrelated-change failure. Stop on any undocumented warning, error, unexpected deletion, or other unrelated change. Review the staged diff before committing.
+
+Open a PR against the default branch captured during inspection only after all checks pass. If you can't verify a prerequisite, validate the install, push, or create the PR, report the exact blocker instead of claiming success. Report the PR URL and validation results if created; leave merge and post-merge activation to a human.
+```
@@ -18,6 +18,7 @@
     "ADO",
     "AKIA",
     "affordances",
+    "agentics",
     "kiro",
     "resumability",
     "amolchanov",