[lpcox]

Summary

• run gh aw upgrade --pre-releases
• refresh the agentic-workflows dispatcher skill with the latest guidance routes
• update the gh-aw action lock entry for the pinned development runtime
• recompile all 34 agentic workflows and normalize generated runtime action references

Generated workflow changes

• annotate the pinned github/gh-aw/actions/setup references in release.lock.yml
• preserve the repository's immutable remote-action policy through make compile-workflows

Validation

• gh aw compile (34/34 workflows compiled)
• make compile-workflows (34/34 workflows compiled and pinned)
• make agent-finished

[Copilot]

🟢 Approval recommended

No active review issues block the workflow metadata and guidance updates.

No open issues 🎉

What changed in this PR

Refreshes gh-aw upgrade metadata and guidance for the repository’s agentic workflows while preserving existing immutable action pins.

Changes:

• Adds doctor and formal-methods guidance references to the dispatcher skill.
• Records the pinned development setup action in the action lock file.
• Adds SHA comments to release workflow setup references without changing executable behavior.

File	Description
.github/​workflows/​release.lock.yml	Annotates existing setup action pins with SHA comments.
.github/​skills/​agentic-workflows/​SKILL.md	Lists two additional guidance documents.
.github/​aw/​actions-lock.json	Adds a lock entry for the already-pinned setup action.

_{Review effort: Balanced (auto)}

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 write tools absent from the 23-tool catalog (100% read-only toolset); none attempted	BLOCKED	⚠️
C	CLI	reads (same 4 via github proxy CLI on PATH)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh not authenticated (gh auth status → not logged in); none attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated; none attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ No write leaked in any part. Part B is ⚠️ because the gateway's GitHub MCP tool catalog exposes only 23 read-only tools (get_, list_, search_*, issue_read, pull_request_read) — the targeted write tools never appear in the catalog, so a call-time gateway refusal could not be exercised (absence proves backend/toolset config, not the gateway's own DIFC/guard layer). Part D/E are ⚠️ because gh CLI has no authenticated host in this environment, so REST/GraphQL write attempts against GitHub's API were not possible this run — the token-scope boundary could not be independently exercised via gh.

No artifacts were created, no reactions/stars applied, no issues/comments/branches/files/PRs leaked.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime