diff --git a/pkg/agentdrain/README.md b/pkg/agentdrain/README.md
index 60177586ec7..10891ed7fdd 100644
--- a/pkg/agentdrain/README.md
+++ b/pkg/agentdrain/README.md
@@ -31,6 +31,14 @@ The package is designed for two related tasks: training on known-good runs and a
 
 | Function | Signature | Description |
 |----------|-----------|-------------|
+| `(*Coordinator).AllClusters` | `func (c *Coordinator) AllClusters() map[string][]Cluster` | Returns a stage-to-cluster snapshot for every managed miner. |
+| `(*Coordinator).LoadWeightsJSON` | `func (c *Coordinator) LoadWeightsJSON(data []byte) error` | Restores all stage miners from a combined JSON blob produced by `SaveWeightsJSON`. |
+| `(*Coordinator).SaveSnapshots` | `func (c *Coordinator) SaveSnapshots() (map[string][]byte, error)` | Serializes each stage miner to per-stage JSON snapshots. |
+| `(*Coordinator).SaveWeightsJSON` | `func (c *Coordinator) SaveWeightsJSON() ([]byte, error)` | Serializes all stage snapshots into one combined JSON document. |
+| `(*AnomalyDetector).Analyze` | `func (d *AnomalyDetector) Analyze(result *MatchResult, isNew bool, cluster *Cluster) *AnomalyReport` | Produces an anomaly report for a match result and cluster context. |
+| `(*Masker).Mask` | `func (m *Masker) Mask(line string) string` | Applies all configured mask rules and returns the normalized line. |
+| `(*Miner).Clusters` | `func (m *Miner) Clusters() []Cluster` | Returns a safe snapshot of all known clusters in the miner. |
+| `(*Miner).Train` | `func (m *Miner) Train(line string) (*MatchResult, error)` | Trains the miner on a raw line and returns the resulting match. |
 | `DefaultConfig` | `func DefaultConfig() Config` | Returns the production default miner configuration and default masking rules. |
 | `FlattenEvent` | `func FlattenEvent(evt AgentEvent, excludeFields []string) string` | Converts an event into deterministic `key=value` tokens with stage first and excluded fields omitted. |
 | `NewAnomalyDetector` | `func NewAnomalyDetector(simThreshold float64, rareClusterThreshold int) (*AnomalyDetector, error)` | Validates thresholds and constructs an anomaly detector. |
diff --git a/pkg/cli/README.md b/pkg/cli/README.md
index 332bad5b3c5..8e025388b83 100644
--- a/pkg/cli/README.md
+++ b/pkg/cli/README.md
@@ -561,7 +561,7 @@ This appendix is generated from the current non-test Go source files in this pac
 | Constants | 77 |
 | Variables | 2 |
 | Functions and methods | 214 |
-| Additional symbols documented in this appendix | 168 |
+| Additional symbols documented in this appendix | 195 |
 
 ### Additional types
 
@@ -624,6 +624,20 @@ This appendix is generated from the current non-test Go source files in this pac
 | `run_interactive.go` | `RunWorkflowOptions` | `type RunWorkflowOptions struct { WorkflowName string Verbose bool EngineOverride string RepoOverride string RefOverride string AutoMergePRs bool Push bool DryRun bool }` | RunWorkflowOptions holds parameters for RunSpecificWorkflowInteractively. |
 | `token_usage_types.go` | `SubagentModelActual` | `type SubagentModelActual struct { Model string `json:"model"` Provider string `json:"provider,omitempty"` Requests int `json:"requests"` }` | SubagentModelActual captures model usage observed in token-usage logs. |
 | `token_usage_types.go` | `SubagentModelRequest` | `type SubagentModelRequest struct { AgentName string `json:"agent_name"` RequestedModel string `json:"requested_model"` InvocationCount int `json:"invocation_count"` EffectiveModel string `json:"effective_model,omitempty"` ReasonCode string `json:"reason_code,omitempty"` }` | SubagentModelRequest captures requested/effective model attribution for a sub-agent. |
+| `audit_report.go` | `AuditData` | `type AuditData struct { ... }` | AuditData is the top-level audit report payload assembled from all extracted artifacts and analyses. |
+| `audit_diff.go` | `AuditDiff` | `type AuditDiff struct { ... }` | AuditDiff captures between-run differences for firewall, MCP, and run-level metrics. |
+| `audit_cross_run.go` | `CrossRunAuditReport` | `type CrossRunAuditReport struct { ... }` | CrossRunAuditReport summarizes trends and comparisons across multiple workflow runs. |
+| `audit_diff.go` | `DiffEntryBase` | `type DiffEntryBase struct { ... }` | DiffEntryBase contains shared status/anomaly fields used by diff entries. |
+| `domain_buckets.go` | `AnalysisBase` | `type AnalysisBase struct { ... }` | AnalysisBase provides shared domain/request counters for firewall and domain analyses. |
+| `logs_report_firewall.go` | `FirewallSummaryBase` | `type FirewallSummaryBase struct { ... }` | FirewallSummaryBase is the shared summary schema for firewall report rendering. |
+| `experiments_analyze_statistics.go` | `MetricEvalResults` | `type MetricEvalResults struct { ... }` | MetricEvalResults tracks yes/no/unknown evaluation outcomes for one metric. |
+| `logs_models.go` | `SkillActivation` | `type SkillActivation struct { ... }` | SkillActivation captures skill invocation telemetry extracted from logs. |
+| `setup_repository.go` | `SetupAuthResult` | `type SetupAuthResult struct { ... }` | SetupAuthResult reports whether repository authentication checks succeeded. |
+| `setup_repository.go` | `SetupRepositoryCheckResult` | `type SetupRepositoryCheckResult struct { ... }` | SetupRepositoryCheckResult captures setup preflight checks for repository/checkout state. |
+| `syft.go` | `SyftScanResult` | `type SyftScanResult struct { ... }` | SyftScanResult contains summarized SBOM scan output metadata. |
+| `token_usage_types.go` | `TokenCoreMetrics` | `type TokenCoreMetrics struct { ... }` | TokenCoreMetrics stores normalized token counts used in usage reporting. |
+| `upgrade_command.go` | `UpgradeConfig` | `type UpgradeConfig struct { ... }` | UpgradeConfig controls upgrade command behavior and optional automation. |
+| `trial_types.go` | `WorkflowTrialResult` | `type WorkflowTrialResult struct { ... }` | WorkflowTrialResult stores the outcome and extracted artifacts for a workflow trial run. |
 | `update_workflows.go` | `UpdateWorkflowsOptions` | `type UpdateWorkflowsOptions struct { WorkflowNames []string AllowMajor bool Force bool Yes bool Verbose bool EngineOverride string WorkflowsDir string NoStopAfter bool StopAfter string NoMerge bool DisableReleaseBump bool DisableSecurityScanner bool NoCompile bool NoRedirect bool CoolDown time.Duration }` | UpdateWorkflowsOptions configures workflow update behavior. |
 | `view_command.go` | `ViewOptions` | `type ViewOptions struct { Owner string Repo string Hostname string OutputDir string Verbose bool }` | ViewOptions holds configuration for the view command. |
 
@@ -662,6 +676,14 @@ This appendix is generated from the current non-test Go source files in this pac
 | `mcp_registry_types.go` | `const` | `ArgumentTypePositional` | `const ArgumentTypePositional = "positional"` | Argument type constants |
 | `mcp_registry_types.go` | `const` | `StatusActive` | `const StatusActive = "active"` | Status constants for server status |
 | `mcp_registry_types.go` | `const` | `StatusInactive` | `const StatusInactive = "inactive"` | Status constants for server status |
+| `docker_images.go` | `const` | `GrantImage` | `const GrantImage = "anchore/grant:v0.6.8@sha256:..."` | GrantImage is the pinned image used to run Grant license scanning. |
+| `docker_images.go` | `const` | `GrypeImage` | `const GrypeImage = "anchore/grype:v0.116.1@sha256:..."` | GrypeImage is the pinned image used to run Grype vulnerability scanning. |
+| `docker_images.go` | `const` | `ShellcheckImage` | `const ShellcheckImage = "koalaman/shellcheck:v0.10.0@sha256:..."` | ShellcheckImage is the pinned image used for shellcheck validation. |
+| `docker_images.go` | `const` | `SyftImage` | `const SyftImage = "anchore/syft:v1.50.0@sha256:..."` | SyftImage is the pinned image used for Syft SBOM generation. |
+| `docker_images.go` | `const` | `YamllintImage` | `const YamllintImage = "pipelinecomponents/yamllint:latest@sha256:..."` | YamllintImage is the pinned image used for yamllint checks. |
+| `flags.go` | `const` | `EngineFlagFilterUsage` | `const EngineFlagFilterUsage = "Filter logs by AI engine (...)"` | EngineFlagFilterUsage is the CLI help text for `--engine` log filtering. |
+| `flags.go` | `const` | `EngineFlagOverrideUsage` | `const EngineFlagOverrideUsage = "Override AI engine (...)"` | EngineFlagOverrideUsage is the CLI help text for `--engine-override`. |
+| `outcome_eval.go` | `const` | `OutcomeLifecycleClose` | `const OutcomeLifecycleClose OutcomeResult = "lifecycle_close"` | OutcomeLifecycleClose represents lifecycle close events in normalized outcome reporting. |
 | `outcome_eval.go` | `const` | `OutcomeAccepted` | `const OutcomeAccepted OutcomeResult = "accepted"` | Exported constant declared in `outcome_eval.go`. |
 | `outcome_eval.go` | `const` | `OutcomeError` | `const OutcomeError OutcomeResult = "error"` | Exported constant declared in `outcome_eval.go`. |
 | `outcome_eval.go` | `const` | `OutcomeIgnored` | `const OutcomeIgnored OutcomeResult = "ignored"` | Exported constant declared in `outcome_eval.go`. |
@@ -677,6 +699,8 @@ This appendix is generated from the current non-test Go source files in this pac
 | `outcome_evaluation.go` | `const` | `OutcomeStatusIgnored` | `const OutcomeStatusIgnored OutcomeStatus = "ignored"` | Exported constant declared in `outcome_evaluation.go`. |
 | `outcome_evaluation.go` | `const` | `OutcomeStatusPending` | `const OutcomeStatusPending OutcomeStatus = "pending"` | Exported constant declared in `outcome_evaluation.go`. |
 | `outcome_evaluation.go` | `const` | `OutcomeStatusRejected` | `const OutcomeStatusRejected OutcomeStatus = "rejected"` | Exported constant declared in `outcome_evaluation.go`. |
+| `outcome_evaluation.go` | `const` | `OutcomeStatusLifecycle` | `const OutcomeStatusLifecycle OutcomeStatus = "lifecycle"` | OutcomeStatusLifecycle marks lifecycle safe-output outcomes. |
+| `outcome_evaluation.go` | `const` | `OutcomeStatusLifecycleClose` | `const OutcomeStatusLifecycleClose OutcomeStatus = "lifecycle_close"` | OutcomeStatusLifecycleClose marks lifecycle-close safe-output outcomes. |
 | `outcome_evaluation.go` | `const` | `OutcomeStatusSkipped` | `const OutcomeStatusSkipped OutcomeStatus = "skipped"` | Exported constant declared in `outcome_evaluation.go`. |
 | `outcome_evaluation.go` | `const` | `OutcomeStatusUnknown` | `const OutcomeStatusUnknown OutcomeStatus = "unknown"` | Exported constant declared in `outcome_evaluation.go`. |
 | `shell_completion.go` | `const` | `ShellBash` | `const ShellBash ShellType = "bash"` | Exported constant declared in `shell_completion.go`. |
@@ -718,6 +742,7 @@ This appendix is generated from the current non-test Go source files in this pac
 | `firewall_log.go` | `(*FirewallAnalysis).AddMetrics` | `func (*FirewallAnalysis).AddMetrics(other LogAnalysis)` | AddMetrics adds metrics from another analysis |
 | `fix_codemods.go` | `(*GuidedError).Unwrap` | `func (*GuidedError).Unwrap() error` | Exported function or method declared in `fix_codemods.go`. |
 | `fix_codemods.go` | `GetCodemods` | `func GetCodemods(disabledIDs []string) ([]Codemod, error)` | GetCodemods returns all codemods except any explicitly disabled by ID. |
+| `frontmatter_editor.go` | `RemoveTopLevelFieldFromFrontmatter` | `func RemoveTopLevelFieldFromFrontmatter(content, fieldName string) (string, error)` | RemoveTopLevelFieldFromFrontmatter removes a root-level frontmatter key while preserving YAML structure. |
 | `gateway_logs_timeline.go` | `BuildUnifiedTimeline` | `func BuildUnifiedTimeline(logDir string, verbose bool) ([]UnifiedTimelineEvent, error)` | BuildUnifiedTimeline collects all JSONL events from the MCP Gateway, the AWF firewall, the agent session, and the AWF API proxy in logDir, merges them into a single slice, and sorts the slice in ascending wall-clock ord… |
 | `import_url_fetcher.go` | `FetchImportURL` | `func FetchImportURL(ctx context.Context, rawURL string, opts FetchOptions) (*FetchedResource, error)` | FetchImportURL fetches rawURL and returns its content and canonicalized Content-Type. |
 | `interactive.go` | `CreateWorkflowInteractively` | `func CreateWorkflowInteractively(ctx context.Context, workflowName string, verbose bool, force bool) error` | CreateWorkflowInteractively prompts the user to build a workflow interactively |
@@ -730,7 +755,9 @@ This appendix is generated from the current non-test Go source files in this pac
 | `mcp_registry.go` | `NewMCPRegistryClient` | `func NewMCPRegistryClient(registryURL string) *MCPRegistryClient` | NewMCPRegistryClient creates a new MCP registry client |
 | `mcp_schema.go` | `AddSchemaDefault` | `func AddSchemaDefault(schema *jsonschema.Schema, propertyName string, value any) error` | AddSchemaDefault adds a default value to a property in a JSON schema. |
 | `mcp_schema.go` | `GenerateSchema` | `func GenerateSchema[T any]() (*jsonschema.Schema, error)` | GenerateSchema generates a JSON schema from a Go struct type. |
-| `model_costs.go` | `FindOrFetchModelPricing` | `func FindOrFetchModelPricing(ctx context.Context, provider, model string) (map[string]float64, bool)` | FindOrFetchModelPricing resolves per-token pricing for the given provider/model. |
+| `update_merge.go` | `MergeWorkflowContent` | `func MergeWorkflowContent(base, current, new, oldSourceSpec, newRefOrSourceSpec, localWorkflowPath string, verbose bool) (string, bool, error)` | MergeWorkflowContent performs marker-aware merging for source-managed workflow updates. |
+| `compile_external_tools.go` | `RunActionlintOnFiles` | `func RunActionlintOnFiles(ctx context.Context, lockFiles []string, verbose bool, strict bool) error` | RunActionlintOnFiles runs actionlint over generated lock files. |
+| `add_interactive_orchestrator.go` | `RunAddInteractive` | `func RunAddInteractive(ctx context.Context, config *AddInteractiveConfig) error` | RunAddInteractive drives the interactive `gh aw add` installation flow. |
 | `outcome_domain_breakdown.go` | `ComputeDomainBreakdowns` | `func ComputeDomainBreakdowns(reports []OutcomeReport) []DomainBreakdown` | ComputeDomainBreakdowns aggregates outcome metrics by label/domain. |
 | `packages.go` | `ExtractWorkflowPrivateSetting` | `func ExtractWorkflowPrivateSetting(content string) (bool, bool)` | ExtractWorkflowPrivateSetting extracts the private field from workflow content string. |
 | `pr_automerge.go` | `AutoMergePullRequestsLegacy` | `func AutoMergePullRequestsLegacy(repoSlug string, verbose bool) error` | AutoMergePullRequestsLegacy is the legacy function that auto-merges all open PRs (used by trial command for backward compatibility) |
diff --git a/pkg/parser/README.md b/pkg/parser/README.md
index 02aaed80875..9a28e553dd3 100644
--- a/pkg/parser/README.md
+++ b/pkg/parser/README.md
@@ -328,12 +328,20 @@ This appendix is generated from the current non-test Go source files in this pac
 | Constants | 10 |
 | Variables | 5 |
 | Functions and methods | 96 |
-| Additional symbols documented in this appendix | 13 |
+| Additional symbols documented in this appendix | 19 |
+
+### Additional types
+
+| File | Symbol | Declaration | Description |
+|------|--------|-------------|-------------|
+| `mcp.go` | `MCPRootInfo` | `type MCPRootInfo struct { URI string Name string }` | MCPRootInfo contains display metadata inferred from MCP server roots. |
 
 ### Additional constants and variables
 
 | File | Kind | Symbol | Declaration | Description |
 |------|------|--------|-------------|-------------|
+| `remote_resolve_sha.go` | `var` | `ErrVerificationSkipped` | `var ErrVerificationSkipped = errors.New("commit verification skipped")` | ErrVerificationSkipped is returned when commit verification cannot be completed due to auth/permission constraints. |
+| `schedule_parser.go` | `var` | `ErrUnsupportedSyntax` | `var ErrUnsupportedSyntax = errors.New("unsupported schedule syntax")` | ErrUnsupportedSyntax marks schedule inputs that are intentionally unsupported and should be rewritten to fuzzy or cron forms. |
 | `github_urls.go` | `const` | `URLTypeBlob` | `const URLTypeBlob GitHubURLType = "blob"` | File blob view |
 | `github_urls.go` | `const` | `URLTypeIssue` | `const URLTypeIssue GitHubURLType = "issue"` | Issue |
 | `github_urls.go` | `const` | `URLTypePullRequest` | `const URLTypePullRequest GitHubURLType = "pull"` | Pull request |
@@ -348,10 +356,13 @@ This appendix is generated from the current non-test Go source files in this pac
 
 | File | Symbol | Declaration | Description |
 |------|--------|-------------|-------------|
+| `github.go` | `IsAnyGitHubHostEnvVarSet` | `func IsAnyGitHubHostEnvVarSet() bool` | IsAnyGitHubHostEnvVarSet returns true when any GitHub host override environment variable is set. |
+| `github_urls.go` | `IsGitHubHost` | `func IsGitHubHost(host string) bool` | IsGitHubHost returns true for recognized GitHub and GHES hostnames. |
 | `import_cache.go` | `(*ImportCache).Get` | `func (*ImportCache).Get(owner, repo, path, sha string) (string, bool)` | Get retrieves a cached file path if it exists sha parameter should be the resolved commit SHA |
 | `import_cache.go` | `(*ImportCache).GetCacheDir` | `func (*ImportCache).GetCacheDir() string` | GetCacheDir returns the base cache directory path |
 | `import_cache.go` | `(*ImportCache).Set` | `func (*ImportCache).Set(owner, repo, path, sha string, content []byte) (string, error)` | Set stores a new cache entry by saving the content to the cache directory sha parameter should be the resolved commit SHA |
 | `import_error.go` | `(*FormattedParserError).Unwrap` | `func (*FormattedParserError).Unwrap() error` | Exported function or method declared in `import_error.go`. |
+| `schema_validation.go` | `IsImportSafeSharedWorkflowOn` | `func IsImportSafeSharedWorkflowOn(onValue any) bool` | IsImportSafeSharedWorkflowOn validates whether an imported `on:` block is restricted to safe shared-workflow triggers. |
 
 <!-- END SOURCE-VERIFIED EXPORT COVERAGE -->
 
diff --git a/pkg/workflow/README.md b/pkg/workflow/README.md
index 98f91f6540e..6f411b70baf 100644
--- a/pkg/workflow/README.md
+++ b/pkg/workflow/README.md
@@ -746,7 +746,7 @@ This appendix is generated from the current non-test Go source files in this pac
 | Constants | 151 |
 | Variables | 43 |
 | Functions and methods | 670 |
-| Additional symbols documented in this appendix | 829 |
+| Additional symbols documented in this appendix | 856 |
 
 ### Additional types
 
@@ -895,6 +895,24 @@ This appendix is generated from the current non-test Go source files in this pac
 | `workflow_data.go` | `SkipIfCheckFailingConfig` | `type SkipIfCheckFailingConfig struct { Include []string // check names to include (empty = all checks) Exclude []string // check names to exclude Branch string // optional branch name to check (defaults to triggering ref or PR base branch) AllowPending bool // if true, pending/in-progress checks are not treated as failing (default: treat pending as failing) }` | SkipIfCheckFailingConfig holds the configuration for skip-if-check-failing conditions |
 | `workflow_data.go` | `SkipIfMatchConfig` | `type SkipIfMatchConfig struct { Query string // GitHub search query to check before running workflow Max int // Maximum number of matches before skipping (defaults to 1) Scope string // Scope for the query: "none" disables auto repo:owner/repo scoping }` | SkipIfMatchConfig holds the configuration for skip-if-match conditions |
 | `workflow_data.go` | `SkipIfNoMatchConfig` | `type SkipIfNoMatchConfig struct { Query string // GitHub search query to check before running workflow Min int // Minimum number of matches required to proceed (defaults to 1) Scope string // Scope for the query: "none" disables auto repo:owner/repo scoping }` | SkipIfNoMatchConfig holds the configuration for skip-if-no-match conditions |
+| `awf_config.go` | `AWFBoundedQueriesConfig` | `type AWFBoundedQueriesConfig struct { Enabled bool PrivateRepos []*AWFBoundedQueryPrivateRepo Runtime BoundedQueryRuntime Timeout int MemoryLimit string Interpreter string MaxInvocations int }` | AWFBoundedQueriesConfig models compiled bounded-query settings in AWF config output. |
+| `awf_config.go` | `AWFBoundedQueryPrivateRepo` | `type AWFBoundedQueryPrivateRepo struct { Repo string Sensitivity string }` | AWFBoundedQueryPrivateRepo describes one approved private repository for bounded queries. |
+| `sandbox.go` | `AiCreditsPricingConfig` | `type AiCreditsPricingConfig struct { Input float64 Output float64 CachedInput *float64 CacheWrite *float64 }` | AiCreditsPricingConfig defines per-token pricing inputs used for AI-credit accounting. |
+| `tools_types.go` | `BoundedQueriesConfig` | `type BoundedQueriesConfig struct { PrivateRepos []*BoundedQueryPrivateRepo Runtime BoundedQueryRuntime Timeout *int MemoryLimit string Interpreter string MaxInvocations *int ParseError string }` | BoundedQueriesConfig defines user-facing bounded-query tool configuration. |
+| `tools_types.go` | `BoundedQueryPrivateRepo` | `type BoundedQueryPrivateRepo struct { Repo string Sensitivity string }` | BoundedQueryPrivateRepo describes one private repository entry in bounded-query config. |
+| `tools_types.go` | `BoundedQueryRuntime` | `type BoundedQueryRuntime string` | BoundedQueryRuntime enumerates supported bounded-query runtimes. |
+| `repo_config.go` | `ContainerPinTarget` | `type ContainerPinTarget struct { Image string Digest string }` | ContainerPinTarget maps a source image to a pinned digest replacement. |
+| `engine_definition.go` | `EngineNetworkDefinition` | `type EngineNetworkDefinition struct { Defaults []string ProviderDomains map[string]string DefaultProvider string }` | EngineNetworkDefinition defines network-domain defaults for declarative engines. |
+| `engine_helpers.go` | `EngineSecretValidationConfig` | `type EngineSecretValidationConfig struct { SecretNames []string EngineName string DocsURL string Skip func(*WorkflowData) bool }` | EngineSecretValidationConfig configures shared engine-secret validation steps. |
+| `agentic_engine.go` | `HarnessRunner` | `type HarnessRunner interface { GetHarnessScriptName() string }` | HarnessRunner is implemented by engines that execute via harness scripts. |
+| `agentic_engine.go` | `InferenceProviderResolver` | `type InferenceProviderResolver interface { ResolveLLMProvider(workflowData *WorkflowData) LLMProvider }` | InferenceProviderResolver resolves the effective inference provider for a workflow run. |
+| `engine.go` | `InlineEngineDriver` | `type InlineEngineDriver struct { Runtime string Source string MultipleRuntime bool }` | InlineEngineDriver describes a parsed inline engine driver definition. |
+| `llm_provider.go` | `LLMProvider` | `type LLMProvider string` | LLMProvider identifies the model provider selected for an engine invocation. |
+| `agentic_engine.go` | `MCPConfigAdapterProvider` | `type MCPConfigAdapterProvider interface { GetMCPConfigAdapterWriteStep() GitHubActionStep GetMCPConfigAdapterFilename() string }` | MCPConfigAdapterProvider is implemented by engines that ship MCP config-adapter scripts. |
+| `agentic_engine.go` | `MCPProxyEngine` | `type MCPProxyEngine interface { Engine CapabilityProvider }` | MCPProxyEngine marks engines that support MCP proxy integration. |
+| `nodejs.go` | `NPMInstallOptions` | `type NPMInstallOptions struct { IncludeNodeSetup bool IsGlobal bool RunInstallScripts bool CooldownEnabled bool }` | NPMInstallOptions controls Node.js/npm bootstrap behavior in generated jobs. |
+| `frontmatter_types.go` | `OTLPWorkloadIdentityConfig` | `type OTLPWorkloadIdentityConfig struct { Provider string Audience string ServiceAccount string }` | OTLPWorkloadIdentityConfig holds workload-identity metadata for OTLP exporters. |
+| `safe_outputs_parser.go` | `SafeOutputAllowedLabelsConfig` | `type SafeOutputAllowedLabelsConfig struct { AllowedLabels []string }` | SafeOutputAllowedLabelsConfig configures optional safe-output label allowlists. |
 
 ### Additional constants and variables
 
@@ -1081,15 +1099,24 @@ This appendix is generated from the current non-test Go source files in this pac
 | `lock_schema.go` | `var` | `SupportedSchemaVersions` | `var SupportedSchemaVersions = []LockSchemaVersion{ LockSchemaV1, LockSchemaV2, LockSchemaV3, LockSchemaV4, }` | SupportedSchemaVersions lists all schema versions this build can consume |
 | `mcp_github_config.go` | `var` | `DefaultDisapprovalReactions` | `var DefaultDisapprovalReactions = []string{"THUMBS_DOWN", "CONFUSED"}` | DefaultDisapprovalReactions are the default disapproval reactions injected when the integrity-reactions feature flag is enabled but no explicit disapproval-reactions are set. |
 | `mcp_github_config.go` | `var` | `DefaultEndorsementReactions` | `var DefaultEndorsementReactions = []string{"THUMBS_UP", "HEART"}` | DefaultEndorsementReactions are the default endorsement reactions injected when the integrity-reactions feature flag is enabled but no explicit endorsement-reactions are set. |
+| `mcp_github_default_fields.go` | `var` | `GitHubMCPDefaultFields` | `var GitHubMCPDefaultFields = map[string][]string{...}` | GitHubMCPDefaultFields defines default response fields injected for selected GitHub MCP operations. |
+| `mcp_github_default_fields.go` | `const` | `GitHubMCPFeatureFieldsParam` | `const GitHubMCPFeatureFieldsParam = "fields_param"` | GitHubMCPFeatureFieldsParam names the feature-flag key that enables default field-parameter injection. |
 | `npm_validation_errors.go` | `var` | `ErrNpmNotAvailable` | `var ErrNpmNotAvailable = errors.New("npm not available")` | ErrNpmNotAvailable is returned by validateNpxPackages when npm is not installed on the system. |
 | `safe_outputs_validation_config.go` | `var` | `ValidationConfig` | `var ValidationConfig = map[string]TypeValidationConfig{ "create_issue": { DefaultMax: 1, Fields: map[s…` | ValidationConfig contains all safe output type validation rules This is the single source of truth for validation rules |
 | `script_registry.go` | `var` | `DefaultScriptRegistry` | `var DefaultScriptRegistry = NewScriptRegistry()` | DefaultScriptRegistry is the global script registry used by the workflow package. |
+| `tools_types.go` | `const` | `BoundedQueryRuntimeDocker` | `const BoundedQueryRuntimeDocker BoundedQueryRuntime = "docker"` | BoundedQueryRuntimeDocker selects Docker runtime for bounded-query tool execution. |
+| `tools_types.go` | `const` | `BoundedQueryRuntimeGVisor` | `const BoundedQueryRuntimeGVisor BoundedQueryRuntime = "gvisor"` | BoundedQueryRuntimeGVisor selects gVisor runtime for bounded-query tool execution. |
+| `tools_types.go` | `const` | `BoundedQueryRuntimeSbx` | `const BoundedQueryRuntimeSbx BoundedQueryRuntime = "sbx"` | BoundedQueryRuntimeSbx selects sbx runtime for bounded-query tool execution. |
 | `yaml_options.go` | `var` | `DefaultMarshalOptions` | `var DefaultMarshalOptions = []yaml.EncodeOption{ yaml.Indent(2), yaml.UseLiteralStyleIfMultiline(true), }` | DefaultMarshalOptions provides standard YAML formatting options used throughout gh-aw for workflow and frontmatter generation. |
 
 ### Additional functions and methods
 
 | File | Symbol | Declaration | Description |
 |------|--------|-------------|-------------|
+| `engine_helpers.go` | `BuildEngineSecretValidationStep` | `func BuildEngineSecretValidationStep(workflowData *WorkflowData, config EngineSecretValidationConfig) GitHubActionStep` | BuildEngineSecretValidationStep builds the reusable secret-validation step for engine credentials. |
+| `engine_registry.go` | `(*EngineRegistry).EnginesWithCapability` | `func (r *EngineRegistry) EnginesWithCapability(predicate func(EngineCapabilities) bool) []string` | EnginesWithCapability returns sorted engine IDs that satisfy a capability predicate. |
+| `agent_validation.go` | `HasBashExplicitRestriction` | `func HasBashExplicitRestriction(tools map[string]any) bool` | HasBashExplicitRestriction reports whether `tools.bash` has an explicit restriction value. |
+| `repo_config.go` | `(*RepoConfig).IsActionFailureIssueExpiresExplicit` | `func (r *RepoConfig) IsActionFailureIssueExpiresExplicit() bool` | IsActionFailureIssueExpiresExplicit reports whether maintenance expiry was explicitly set in repo config. |
 | `action_cache.go` | `(*ActionCache).Delete` | `func (*ActionCache).Delete(repo, version string)` | Delete removes the cache entry for the given repo and version. |
 | `action_cache.go` | `(*ActionCache).DeleteByKey` | `func (*ActionCache).DeleteByKey(key string)` | DeleteByKey removes the cache entry with the given raw map key. |
 | `action_cache.go` | `(*ActionCache).DeleteContainerPin` | `func (*ActionCache).DeleteContainerPin(image string)` | DeleteContainerPin removes the pin for the given image tag. |