Squad — Accepted risk, as on Matt Pocock Skills Reviewer (#73836) and Ponytail Reviewer (#74201): routing classifies the rendered prompt, so PR text can at most influence which allowed Copilot model and effort are picked. It can't change tools, permissions or safe outputs, and the agent already receives the same text. Spend stays bounded by the AI-credit guards. Routing on a reduced task descriptor would be a compiler/AWF design change, outside this PR.

Squad — Accepted risk, as on Matt Pocock Skills Reviewer (#73836) and Ponytail Reviewer (#74201): routing classifies the rendered prompt, so PR text can at most influence which allowed Copilot model and effort are picked. It can't change tools, permissions or safe outputs, and the agent already receives the same text. Spend stays bounded by the AI-credit guards. Routing on a reduced task descriptor would be a compiler/AWF design change, outside this PR. #21008