hve-squad

The support policy identifies the latest release as supported, while installation guidance explains selecting a published version and reinstalling the package. Release changes are recorded in CHANGELOG.md: https://github.com/Peter-N91/hve-squad/blob/main/SECURITY.md and https://peter-n91.github.io/hve-squad/getting-started.html.

Some of the issues can be labeled to squad/auto and have the squad itself handle them. The history of the squad member will be saved under .copilot-tracking

The security policy documents private reporting, the information needed, acknowledgement within 5 business days, a status update within 10 business days, and coordinated publication after a fix is available: https://github.com/Peter-N91/hve-squad/blob/main/SECURITY.md.

This project does not compile native binaries. It distributes agent assets and interpreted scripts and generates a static documentation site and plugin tree: https://github.com/Peter-N91/hve-squad/blob/main/package.json.

The project distributes interpreted source and agent assets rather than stripped native binaries; the plugin generator copies source assets without a debug-symbol stripping step: https://github.com/Peter-N91/hve-squad/blob/main/scripts/Build-SquadPlugin.ps1.

The documentation pipeline is an explicit sequential npm script, and the plugin is generated by one PowerShell script rather than recursively invoking interdependent subdirectory builds: https://github.com/Peter-N91/hve-squad/blob/main/package.json and https://github.com/Peter-N91/hve-squad/blob/main/scripts/Build-SquadPlugin.ps1.

APM installs agent assets into a selected consumer repository and Copilot plugins use host-managed plugin locations. There is no native system-prefix installation or applicable DESTDIR-style convention: https://peter-n91.github.io/hve-squad/getting-started.html.

The repository documents standard APM/PowerShell setup and the pinned Pester installation and test commands; the documentation environment uses npm ci and npm scripts: https://github.com/Peter-N91/hve-squad/blob/main/CONTRIBUTING.md and https://github.com/Peter-N91/hve-squad/blob/main/site/CONTRIBUTING.txt.

Machine-readable dependencies are declared in apm.yml, package.json/package-lock.json, and GitHub Actions workflow uses entries: https://github.com/Peter-N91/hve-squad/blob/main/apm.yml and https://github.com/Peter-N91/hve-squad/blob/main/package-lock.json.

Upstream assets are identifiable by repository paths and commit pins, with a documented regeneration process and guarded sync workflow; npm dependencies have a lockfile and Actions updates use Dependabot: https://github.com/Peter-N91/hve-squad/blob/main/CONTRIBUTING.md and https://github.com/Peter-N91/hve-squad/blob/main/.github/dependabot.yml.

CONTRIBUTING.md explicitly states that major new functionality must come with tests and explains case declaration and implementation in the automated suite; the PR template repeats the requirement: https://github.com/Peter-N91/hve-squad/blob/main/CONTRIBUTING.md#automated-tests.

The policy is documented in the instructions for change proposals in two places. CONTRIBUTING.md carries an "Automated tests" section stating that major new functionality must come with tests, naming the exemptions (documentation, wording fixes, behavior-preserving refactors) and the maintainer waiver for behavior that cannot be asserted without a live model run. It also explains the three test tiers, how to run each locally, and the required Pester version. The pull request template at .github/pull_request_template.md is injected into every pull request description and includes a Tests checklist asking the contributor to confirm that a case was added or extended, that it was declared in tests/squad-behavior-contract.md with a citation to the source file stating the rule, and that apm run test passed locally. Contributors therefore see the policy both before and during change proposal.

The project enables strict checking wherever it is practical. PSScriptAnalyzer runs with IncludeDefaultRules = $true and reports at all three severities (Error, Warning, Information) rather than errors alone, so nothing is filtered out before a human sees it. Only two rules are excluded repository-wide, each with a written justification in PSScriptAnalyzerSettings.psd1, and individual false positives are marked at the call site rather than by broadening those exclusions. Every script and module additionally runs under Set-StrictMode -Version Latest, PowerShell's strictest language mode, which turns references to uninitialized variables, non-existent properties, and malformed method calls into terminating errors, combined with $ErrorActionPreference = 'Stop' so no error is silently swallowed. Three further analysers run at their default full rule sets on every pull request: CodeQL for Python, Zizmor for GitHub Actions workflows, and Checkov for infrastructure-as-code, with Checkov configured as blocking and accepted findings requiring a justified inline checkov:skip.

The design applies fail-closed dispatch and artifact barriers, centralized state writing, explicit human gates for impactful actions, and scoped workflow permissions. These are documented design controls, not a claim that an LLM host is a security sandbox: https://github.com/Peter-N91/hve-squad/blob/main/squad-src/.github/instructions/squad/squad-floor.instructions.md and https://github.com/Peter-N91/hve-squad/blob/main/squad-src/.github/skills/squad/references/gates-and-modes.md.

Project-authored repository and API operations use HTTPS by default through Git and PowerShell; no plaintext transport is enabled by default in those scripts: https://github.com/Peter-N91/hve-squad/blob/main/scripts/Update-ApmDependencies.ps1 and https://github.com/Peter-N91/hve-squad/blob/main/scripts/Test-HveCorePin.ps1.

The supported PowerShell 7/.NET and Git HTTPS clients support TLS 1.2 or later, with the TLS implementation delegated to the maintained host clients rather than project-authored cryptography: https://github.com/Peter-N91/hve-squad/blob/main/README.md#quick-start and https://github.com/Peter-N91/hve-squad/blob/main/scripts/Test-HveCorePin.ps1.

HTTPS operations use Git and PowerShell's default certificate validation. The authored network scripts do not disable certificate verification or pass SkipCertificateCheck: https://github.com/Peter-N91/hve-squad/blob/main/scripts/Test-HveCorePin.ps1 and https://github.com/Peter-N91/hve-squad/blob/main/scripts/Update-ApmDependencies.ps1.

Git and PowerShell HTTPS clients perform the validated TLS handshake before sending HTTP request headers; the project does not override certificate validation: https://github.com/Peter-N91/hve-squad/blob/main/scripts/Test-HveCorePin.ps1.

Three of the four static analysis tools are purpose-built vulnerability scanners rather than general-purpose quality linters. Zizmor exists specifically to find security vulnerabilities in GitHub Actions workflows, covering template injection, credential persistence, artifact poisoning, and excessive token permissions, which is the dominant vulnerability class for a project whose executable surface is largely CI automation. CodeQL applies semantic queries mapped to CWE categories such as injection, path traversal, and unsafe deserialization against the Python surface. Checkov scans infrastructure-as-code and workflow definitions for security misconfiguration and runs in blocking mode, with any accepted finding requiring a justified inline checkov:skip annotation. PSScriptAnalyzer additionally carries security-specific rules including PSAvoidUsingPlainTextForPassword, PSAvoidUsingConvertToSecureStringWithPlainText, PSAvoidUsingInvokeExpression, and PSUsePSCredentialType. All four publish SARIF to the GitHub Security tab under distinct categories. These tools find real issues rather than hypothetical ones: Zizmor currently reports an open artipacked finding against a workflow that persists a repository push token into the git configuration for the remainder of a job, which is being tracked for remediation.

The project produces no software written in a memory-unsafe language. Its output is a package of markdown assets (agents, prompts, instructions, and skills) together with PowerShell 7 build scripts, Pester test suites, and YAML workflow definitions. There is no C, C++, or unsafe Rust in the repository and nothing is compiled to native code, so there is no memory-safety surface for a sanitizer or memory-error detector to examine. PowerShell runs on the .NET managed runtime, which provides memory safety by construction.