diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index 70ea41c0218..958ed0d94c4 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -20,6 +20,10 @@
 # For more information: https://github.com/githubnext/gh-aw/blob/main/.github/aw/github-agentic-workflows.md
 #
 # Analyzes and enhances Go logging practices across the codebase for improved debugging and observability
+#
+# Resolved workflow manifest:
+#   Imports:
+#     - shared/go-make.md
 
 name: "Go Logger Enhancement"
 "on":
@@ -401,9 +405,135 @@ jobs:
           
           bash /opt/gh-aw/actions/start_safe_outputs_server.sh
           
+      - name: Setup Safe Inputs Config
+        run: |
+          mkdir -p /opt/gh-aw/safe-inputs/logs
+          cat > /opt/gh-aw/safe-inputs/tools.json << 'EOF_TOOLS_JSON'
+          {
+            "serverName": "safeinputs",
+            "version": "1.0.0",
+            "logDir": "/opt/gh-aw/safe-inputs/logs",
+            "tools": [
+              {
+                "name": "go",
+                "description": "Execute any Go command. This tool is accessible as 'safeinputs-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.",
+                "inputSchema": {
+                  "properties": {
+                    "args": {
+                      "description": "Arguments to pass to go CLI (without the 'go' prefix). Examples: 'test ./...', 'build ./cmd/gh-aw', 'mod tidy', 'fmt ./...', 'vet ./...'",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "args"
+                  ],
+                  "type": "object"
+                },
+                "handler": "go.sh",
+                "timeout": 60
+              },
+              {
+                "name": "make",
+                "description": "Execute any Make target. This tool is accessible as 'safeinputs-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.",
+                "inputSchema": {
+                  "properties": {
+                    "args": {
+                      "description": "Arguments to pass to make (target names and options). Examples: 'build', 'test-unit', 'lint', 'recompile', 'agent-finish', 'fmt build test-unit'",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "args"
+                  ],
+                  "type": "object"
+                },
+                "handler": "make.sh",
+                "timeout": 60
+              }
+            ]
+          }
+          EOF_TOOLS_JSON
+          cat > /opt/gh-aw/safe-inputs/mcp-server.cjs << 'EOFSI'
+            const path = require("path");
+            const { startHttpServer } = require("./safe_inputs_mcp_server_http.cjs");
+            const configPath = path.join(__dirname, "tools.json");
+            const port = parseInt(process.env.GH_AW_SAFE_INPUTS_PORT || "3000", 10);
+            const apiKey = process.env.GH_AW_SAFE_INPUTS_API_KEY || "";
+            startHttpServer(configPath, {
+              port: port,
+              stateless: true,
+              logDir: "/opt/gh-aw/safe-inputs/logs"
+            }).catch(error => {
+              console.error("Failed to start safe-inputs HTTP server:", error);
+              process.exit(1);
+            });
+          EOFSI
+          chmod +x /opt/gh-aw/safe-inputs/mcp-server.cjs
+          
+      - name: Setup Safe Inputs Tool Files
+        run: |
+          cat > /opt/gh-aw/safe-inputs/go.sh << 'EOFSH_go'
+          #!/bin/bash
+          # Auto-generated safe-input tool: go
+          # Execute any Go command. This tool is accessible as 'safeinputs-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go <args>. Use single quotes ' for complex args to avoid shell interpretation issues.
+          
+          set -euo pipefail
+          
+          echo "go $INPUT_ARGS"
+          go $INPUT_ARGS
+          
+          
+          EOFSH_go
+          chmod +x /opt/gh-aw/safe-inputs/go.sh
+          cat > /opt/gh-aw/safe-inputs/make.sh << 'EOFSH_make'
+          #!/bin/bash
+          # Auto-generated safe-input tool: make
+          # Execute any Make target. This tool is accessible as 'safeinputs-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make <args>. Use single quotes ' for complex args to avoid shell interpretation issues.
+          
+          set -euo pipefail
+          
+          echo "make $INPUT_ARGS"
+          make $INPUT_ARGS
+          
+          EOFSH_make
+          chmod +x /opt/gh-aw/safe-inputs/make.sh
+          
+      - name: Generate Safe Inputs MCP Server Config
+        id: safe-inputs-config
+        run: |
+          # Generate a secure random API key (360 bits of entropy, 40+ chars)
+          API_KEY=""
+          API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
+          PORT=3000
+          
+          # Register API key as secret to mask it from logs
+          echo "::add-mask::${API_KEY}"
+          
+          # Set outputs for next steps
+          {
+            echo "safe_inputs_api_key=${API_KEY}"
+            echo "safe_inputs_port=${PORT}"
+          } >> "$GITHUB_OUTPUT"
+          
+          echo "Safe Inputs MCP server will run on port ${PORT}"
+          
+      - name: Start Safe Inputs MCP HTTP Server
+        id: safe-inputs-start
+        env:
+          GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-config.outputs.safe_inputs_port }}
+          GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-config.outputs.safe_inputs_api_key }}
+        run: |
+          # Environment variables are set above to prevent template injection
+          export GH_AW_SAFE_INPUTS_PORT
+          export GH_AW_SAFE_INPUTS_API_KEY
+          
+          bash /opt/gh-aw/actions/start_safe_inputs_server.sh
+          
       - name: Start MCP gateway
         id: start-mcp-gateway
         env:
+          GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-start.outputs.api_key }}
+          GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-start.outputs.port }}
           GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
           GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}
           GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}
@@ -423,7 +553,7 @@ jobs:
           # Register API key as secret to mask it from logs
           echo "::add-mask::${MCP_GATEWAY_API_KEY}"
           export GH_AW_ENGINE="claude"
-          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76'
+          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_INPUTS_PORT -e GH_AW_SAFE_INPUTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76'
           
           cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
           {
@@ -437,6 +567,13 @@ jobs:
                   "GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
                 }
               },
+              "safeinputs": {
+                "type": "http",
+                "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT",
+                "headers": {
+                  "Authorization": "$GH_AW_SAFE_INPUTS_API_KEY"
+                }
+              },
               "safeoutputs": {
                 "type": "http",
                 "url": "http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT",
@@ -589,10 +726,37 @@ jobs:
           </system>
           PROMPT_EOF
           cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
+          **IMPORTANT**: Always use the `safeinputs-go` and `safeinputs-make` tools for Go and Make commands instead of running them directly via bash. These safe-input tools provide consistent execution and proper logging.
+          
+          **Correct**:
+          ```
+          Use the safeinputs-go tool with args: "test ./..."
+          Use the safeinputs-make tool with args: "build"
+          Use the safeinputs-make tool with args: "lint"
+          Use the safeinputs-make tool with args: "test-unit"
+          ```
+          
+          **Incorrect**:
+          ```
+          Use the go safe-input tool with args: "test ./..."  ❌ (Wrong tool name - use safeinputs-go)
+          Run: go test ./...  ❌ (Use safeinputs-go instead)
+          Execute bash: make build  ❌ (Use safeinputs-make instead)
+          ```
+          
+          
+          
           # Go Logger Enhancement
           
           You are an AI agent that improves Go code by adding debug logging statements to help with troubleshooting and development.
           
+          ## Available Safe-Input Tools
+          
+          This workflow imports `shared/go-make.md` which provides:
+          - **safeinputs-go** - Execute Go commands (e.g., args: "test ./...", "build ./cmd/gh-aw")
+          - **safeinputs-make** - Execute Make targets (e.g., args: "build", "test-unit", "lint", "recompile")
+          
+          Use these tools for consistent execution instead of running commands directly via bash.
+          
           ## Efficiency First: Check Cache
           
           Before analyzing files:
@@ -744,12 +908,19 @@ jobs:
           After adding logging to the selected files, **validate your changes** before creating a PR:
           
           1. **Build the project to ensure no compilation errors:**
-             ```bash
-             make build
-             ```
+             Use the safeinputs-make tool with args: "build"
+             
              This will compile the Go code and catch any syntax errors or import issues.
           
-          2. **Test the workflow compilation with debug logging enabled:**
+          2. **Run unit tests to ensure nothing broke:**
+             Use the safeinputs-make tool with args: "test-unit"
+             
+             This validates that your changes don't break existing functionality.
+          
+          3. **Test the workflow compilation with debug logging enabled:**
+             Use the safeinputs-go tool with args: "run ./cmd/gh-aw compile dev"
+             
+             Or you can run it directly with bash if needed:
              ```bash
              DEBUG=* ./gh-aw compile dev
              ```
@@ -758,10 +929,8 @@ jobs:
              - The compile command works correctly
              - Debug logging from your changes appears in the output
           
-          3. **If needed, recompile workflows:**
-             ```bash
-             make recompile
-             ```
+          4. **If needed, recompile workflows:**
+             Use the safeinputs-make tool with args: "recompile"
           
           ### 6. Create Pull Request
           
@@ -1084,6 +1253,15 @@ jobs:
             setupGlobals(core, github, context, exec, io);
             const { main } = require('/opt/gh-aw/actions/parse_claude_log.cjs');
             await main();
+      - name: Parse safe-inputs logs for step summary
+        if: always()
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io);
+            const { main } = require('/opt/gh-aw/actions/parse_safe_inputs_logs.cjs');
+            await main();
       - name: Parse MCP gateway logs for step summary
         if: always()
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@@ -1119,6 +1297,7 @@ jobs:
             /tmp/gh-aw/aw-prompts/prompt.txt
             /tmp/gh-aw/aw_info.json
             /tmp/gh-aw/mcp-logs/
+            /tmp/gh-aw/safe-inputs/logs/
             /tmp/gh-aw/sandbox/firewall/logs/
             /tmp/gh-aw/agent-stdio.log
             /tmp/gh-aw/aw.patch
diff --git a/.github/workflows/go-logger.md b/.github/workflows/go-logger.md
index def38027138..25d1946ee9f 100644
--- a/.github/workflows/go-logger.md
+++ b/.github/workflows/go-logger.md
@@ -49,6 +49,9 @@ tools:
     - "./gh-aw compile *"
   cache-memory:
 
+imports:
+  - shared/go-make.md
+
 timeout-minutes: 15
 ---
 
@@ -56,6 +59,14 @@ timeout-minutes: 15
 
 You are an AI agent that improves Go code by adding debug logging statements to help with troubleshooting and development.
 
+## Available Safe-Input Tools
+
+This workflow imports `shared/go-make.md` which provides:
+- **safeinputs-go** - Execute Go commands (e.g., args: "test ./...", "build ./cmd/gh-aw")
+- **safeinputs-make** - Execute Make targets (e.g., args: "build", "test-unit", "lint", "recompile")
+
+Use these tools for consistent execution instead of running commands directly via bash.
+
 ## Efficiency First: Check Cache
 
 Before analyzing files:
@@ -207,12 +218,19 @@ For each file:
 After adding logging to the selected files, **validate your changes** before creating a PR:
 
 1. **Build the project to ensure no compilation errors:**
-   ```bash
-   make build
-   ```
+   Use the safeinputs-make tool with args: "build"
+   
    This will compile the Go code and catch any syntax errors or import issues.
 
-2. **Test the workflow compilation with debug logging enabled:**
+2. **Run unit tests to ensure nothing broke:**
+   Use the safeinputs-make tool with args: "test-unit"
+   
+   This validates that your changes don't break existing functionality.
+
+3. **Test the workflow compilation with debug logging enabled:**
+   Use the safeinputs-go tool with args: "run ./cmd/gh-aw compile dev"
+   
+   Or you can run it directly with bash if needed:
    ```bash
    DEBUG=* ./gh-aw compile dev
    ```
@@ -221,10 +239,8 @@ After adding logging to the selected files, **validate your changes** before cre
    - The compile command works correctly
    - Debug logging from your changes appears in the output
 
-3. **If needed, recompile workflows:**
-   ```bash
-   make recompile
-   ```
+4. **If needed, recompile workflows:**
+   Use the safeinputs-make tool with args: "recompile"
 
 ### 6. Create Pull Request
 
diff --git a/.github/workflows/shared/go-make.md b/.github/workflows/shared/go-make.md
new file mode 100644
index 00000000000..31ae1297001
--- /dev/null
+++ b/.github/workflows/shared/go-make.md
@@ -0,0 +1,113 @@
+---
+safe-inputs:
+  go:
+    description: "Execute any Go command. This tool is accessible as 'safeinputs-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go <args>. Use single quotes ' for complex args to avoid shell interpretation issues."
+    inputs:
+      args:
+        type: string
+        description: "Arguments to pass to go CLI (without the 'go' prefix). Examples: 'test ./...', 'build ./cmd/gh-aw', 'mod tidy', 'fmt ./...', 'vet ./...'"
+        required: true
+    run: |
+      echo "go $INPUT_ARGS"
+      go $INPUT_ARGS
+
+  make:
+    description: "Execute any Make target. This tool is accessible as 'safeinputs-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make <args>. Use single quotes ' for complex args to avoid shell interpretation issues."
+    inputs:
+      args:
+        type: string
+        description: "Arguments to pass to make (target names and options). Examples: 'build', 'test-unit', 'lint', 'recompile', 'agent-finish', 'fmt build test-unit'"
+        required: true
+    run: |
+      echo "make $INPUT_ARGS"
+      make $INPUT_ARGS
+---
+
+**IMPORTANT**: Always use the `safeinputs-go` and `safeinputs-make` tools for Go and Make commands instead of running them directly via bash. These safe-input tools provide consistent execution and proper logging.
+
+**Correct**:
+```
+Use the safeinputs-go tool with args: "test ./..."
+Use the safeinputs-make tool with args: "build"
+Use the safeinputs-make tool with args: "lint"
+Use the safeinputs-make tool with args: "test-unit"
+```
+
+**Incorrect**:
+```
+Use the go safe-input tool with args: "test ./..."  ❌ (Wrong tool name - use safeinputs-go)
+Run: go test ./...  ❌ (Use safeinputs-go instead)
+Execute bash: make build  ❌ (Use safeinputs-make instead)
+```
+
+<!--
+## safeinputs-go and safeinputs-make Tools
+
+Safe-input tools that wrap Go and Make commands for consistent execution in agentic workflows.
+
+### Usage
+
+```yaml
+imports:
+  - shared/go-make.md
+```
+
+### Invocation
+
+#### safeinputs-go
+
+The tool is accessible as `safeinputs-go` (or `safeinputs_go` after normalization). Provide go CLI arguments via the `args` parameter:
+
+```
+safeinputs-go with args: "test ./..."
+safeinputs-go with args: "build ./cmd/gh-aw"
+safeinputs-go with args: "mod tidy"
+safeinputs-go with args: "fmt ./..."
+safeinputs-go with args: "vet ./..."
+safeinputs-go with args: "test -v -run TestCompile ./pkg/cli"
+```
+
+The tool executes: `go <args>`
+
+#### safeinputs-make
+
+The tool is accessible as `safeinputs-make` (or `safeinputs_make` after normalization). Provide make target(s) via the `args` parameter:
+
+```
+safeinputs-make with args: "build"
+safeinputs-make with args: "test-unit"
+safeinputs-make with args: "lint"
+safeinputs-make with args: "recompile"
+safeinputs-make with args: "fmt lint build"
+safeinputs-make with args: "agent-finish"
+```
+
+The tool executes: `make <args>`
+
+### Common Make Targets
+
+From the gh-aw Makefile:
+
+- **build** - Build the gh-aw binary
+- **test** - Run all tests (unit + integration)
+- **test-unit** - Run unit tests only (~25s, fast feedback)
+- **test-integration-*** - Run specific integration test groups
+- **lint** - Run linters
+- **fmt** - Format code (Go, JavaScript, JSON)
+- **recompile** - Recompile all workflow lock files
+- **agent-finish** - Complete validation (fmt, lint, build, test, recompile)
+- **fix** - Run gh-aw fix on all workflows
+- **clean** - Remove build artifacts
+- **deps** - Install Go dependencies
+- **deps-dev** - Install development dependencies (linters)
+
+### Common Go Commands
+
+- **go test ./...** - Run all tests
+- **go test ./pkg/...** - Run tests in pkg directory
+- **go build ./cmd/gh-aw** - Build the main binary
+- **go mod tidy** - Clean up go.mod and go.sum
+- **go fmt ./...** - Format all Go code
+- **go vet ./...** - Run Go vet static analyzer
+- **go test -v -run TestName ./pkg/cli** - Run specific test
+-->
diff --git a/pkg/workflow/compiler_safe_outputs_env.go b/pkg/workflow/compiler_safe_outputs_env.go
index b67e554cfc2..343dcb9e159 100644
--- a/pkg/workflow/compiler_safe_outputs_env.go
+++ b/pkg/workflow/compiler_safe_outputs_env.go
@@ -1,7 +1,15 @@
 package workflow
 
+import (
+	"github.com/githubnext/gh-aw/pkg/logger"
+)
+
+var compilerSafeOutputsEnvLog = logger.New("workflow:compiler_safe_outputs_env")
+
 func (c *Compiler) addAllSafeOutputConfigEnvVars(steps *[]string, data *WorkflowData) {
+	compilerSafeOutputsEnvLog.Print("Adding safe output config environment variables")
 	if data.SafeOutputs == nil {
+		compilerSafeOutputsEnvLog.Print("No safe outputs configured, skipping env var addition")
 		return
 	}
 
@@ -11,10 +19,12 @@ func (c *Compiler) addAllSafeOutputConfigEnvVars(steps *[]string, data *Workflow
 	// Create Issue env vars - target-repo, allowed_labels and allowed_repos now in config object
 	if data.SafeOutputs.CreateIssues != nil {
 		cfg := data.SafeOutputs.CreateIssues
+		compilerSafeOutputsEnvLog.Print("Processing create-issue env vars")
 		// Add staged flag if needed (but not if target-repo is specified or we're in trial mode)
 		if !c.trialMode && data.SafeOutputs.Staged && !stagedFlagAdded && cfg.TargetRepoSlug == "" {
 			*steps = append(*steps, "          GH_AW_SAFE_OUTPUTS_STAGED: \"true\"\n")
 			stagedFlagAdded = true
+			compilerSafeOutputsEnvLog.Print("Added staged flag for create-issue")
 		}
 	}
 
diff --git a/pkg/workflow/compiler_safe_outputs_specialized.go b/pkg/workflow/compiler_safe_outputs_specialized.go
index f4743255a37..f8632bc7418 100644
--- a/pkg/workflow/compiler_safe_outputs_specialized.go
+++ b/pkg/workflow/compiler_safe_outputs_specialized.go
@@ -2,11 +2,16 @@ package workflow
 
 import (
 	"fmt"
+
+	"github.com/githubnext/gh-aw/pkg/logger"
 )
 
+var specializedOutputsLog = logger.New("workflow:compiler_safe_outputs_specialized")
+
 // buildAssignToAgentStepConfig builds the configuration for assigning to an agent
 func (c *Compiler) buildAssignToAgentStepConfig(data *WorkflowData, mainJobName string, threatDetectionEnabled bool) SafeOutputStepConfig {
 	cfg := data.SafeOutputs.AssignToAgent
+	specializedOutputsLog.Printf("Building assign-to-agent step config: max=%d, default_agent=%s", cfg.Max, cfg.DefaultAgent)
 
 	var customEnvVars []string
 	customEnvVars = append(customEnvVars, c.buildStepLevelSafeOutputEnvVars(data, "")...)
@@ -60,6 +65,7 @@ func (c *Compiler) buildAssignToAgentStepConfig(data *WorkflowData, mainJobName
 // buildCreateAgentTaskStepConfig builds the configuration for creating an agent session
 func (c *Compiler) buildCreateAgentSessionStepConfig(data *WorkflowData, mainJobName string, threatDetectionEnabled bool) SafeOutputStepConfig {
 	cfg := data.SafeOutputs.CreateAgentSessions
+	specializedOutputsLog.Print("Building create-agent-session step config")
 
 	var customEnvVars []string
 	customEnvVars = append(customEnvVars, c.buildStepLevelSafeOutputEnvVars(data, "")...)
@@ -80,6 +86,7 @@ func (c *Compiler) buildCreateAgentSessionStepConfig(data *WorkflowData, mainJob
 // buildCreateProjectStepConfig builds the configuration for creating a project
 func (c *Compiler) buildCreateProjectStepConfig(data *WorkflowData, mainJobName string, threatDetectionEnabled bool) SafeOutputStepConfig {
 	cfg := data.SafeOutputs.CreateProjects
+	specializedOutputsLog.Printf("Building create-project step config: target_owner=%s, title_prefix=%s", cfg.TargetOwner, cfg.TitlePrefix)
 
 	var customEnvVars []string
 	customEnvVars = append(customEnvVars, c.buildStepLevelSafeOutputEnvVars(data, "")...)
diff --git a/pkg/workflow/runtime_step_generator.go b/pkg/workflow/runtime_step_generator.go
index 86d90acd00d..3afcc5c679e 100644
--- a/pkg/workflow/runtime_step_generator.go
+++ b/pkg/workflow/runtime_step_generator.go
@@ -3,10 +3,15 @@ package workflow
 import (
 	"fmt"
 	"sort"
+
+	"github.com/githubnext/gh-aw/pkg/logger"
 )
 
+var runtimeStepGeneratorLog = logger.New("workflow:runtime_step_generator")
+
 // GenerateRuntimeSetupSteps creates GitHub Actions steps for runtime setup
 func GenerateRuntimeSetupSteps(requirements []RuntimeRequirement) []GitHubActionStep {
+	runtimeStepGeneratorLog.Printf("Generating runtime setup steps: requirement_count=%d", len(requirements))
 	runtimeSetupLog.Printf("Generating runtime setup steps for %d requirements", len(requirements))
 	var steps []GitHubActionStep
 
@@ -14,6 +19,7 @@ func GenerateRuntimeSetupSteps(requirements []RuntimeRequirement) []GitHubAction
 		steps = append(steps, generateSetupStep(&req))
 	}
 
+	runtimeStepGeneratorLog.Printf("Generated %d runtime setup steps", len(steps))
 	return steps
 }
 
@@ -22,6 +28,7 @@ func GenerateRuntimeSetupSteps(requirements []RuntimeRequirement) []GitHubAction
 // Language services are provided inside the container and do not require host installation.
 // This function is kept for backward compatibility but returns an empty slice.
 func GenerateSerenaLanguageServiceSteps(tools *ToolsConfig) []GitHubActionStep {
+	runtimeStepGeneratorLog.Print("Serena language services provided inside container, no installation steps needed")
 	runtimeSetupLog.Print("Serena language services are now provided inside the container - no installation steps needed")
 
 	// Return empty slice - no steps needed since Serena runs in a container
@@ -33,6 +40,7 @@ func GenerateSerenaLanguageServiceSteps(tools *ToolsConfig) []GitHubActionStep {
 func generateSetupStep(req *RuntimeRequirement) GitHubActionStep {
 	runtime := req.Runtime
 	version := req.Version
+	runtimeStepGeneratorLog.Printf("Generating setup step for runtime: %s, version=%s", runtime.ID, version)
 	runtimeSetupLog.Printf("Generating setup step for runtime: %s, version=%s", runtime.ID, version)
 	// Use default version if none specified
 	if version == "" {
diff --git a/pkg/workflow/safe_inputs_generator.go b/pkg/workflow/safe_inputs_generator.go
index ba842639b18..aa29ed78619 100644
--- a/pkg/workflow/safe_inputs_generator.go
+++ b/pkg/workflow/safe_inputs_generator.go
@@ -7,9 +7,12 @@ import (
 	"strings"
 
 	"github.com/githubnext/gh-aw/pkg/constants"
+	"github.com/githubnext/gh-aw/pkg/logger"
 	"github.com/githubnext/gh-aw/pkg/stringutil"
 )
 
+var safeInputsGeneratorLog = logger.New("workflow:safe_inputs_generator")
+
 // SafeInputsToolJSON represents a tool configuration for the tools.json file
 type SafeInputsToolJSON struct {
 	Name        string            `json:"name"`
@@ -30,7 +33,7 @@ type SafeInputsConfigJSON struct {
 
 // generateSafeInputsToolsConfig generates the tools.json configuration for the safe-inputs MCP server
 func generateSafeInputsToolsConfig(safeInputs *SafeInputsConfig) string {
-	safeInputsLog.Printf("Generating safe-inputs tools.json config: tool_count=%d", len(safeInputs.Tools))
+	safeInputsGeneratorLog.Printf("Generating safe-inputs tools.json config: tool_count=%d", len(safeInputs.Tools))
 
 	config := SafeInputsConfigJSON{
 		ServerName: "safeinputs",
@@ -129,17 +132,17 @@ func generateSafeInputsToolsConfig(safeInputs *SafeInputsConfig) string {
 
 	jsonBytes, err := json.MarshalIndent(config, "", "  ")
 	if err != nil {
-		safeInputsLog.Printf("Error marshaling tools config: %v", err)
+		safeInputsGeneratorLog.Printf("Error marshaling tools config: %v", err)
 		return "{}"
 	}
-	safeInputsLog.Printf("Generated tools.json config: size=%d bytes", len(jsonBytes))
+	safeInputsGeneratorLog.Printf("Generated tools.json config: size=%d bytes", len(jsonBytes))
 	return string(jsonBytes)
 }
 
 // generateSafeInputsMCPServerScript generates the entry point script for the safe-inputs MCP server
 // This script uses HTTP transport exclusively
 func generateSafeInputsMCPServerScript(safeInputs *SafeInputsConfig) string {
-	safeInputsLog.Print("Generating safe-inputs MCP server entry point script")
+	safeInputsGeneratorLog.Print("Generating safe-inputs MCP server entry point script")
 	var sb strings.Builder
 
 	// HTTP transport - server started in separate step
diff --git a/pkg/workflow/update_entity_helpers.go b/pkg/workflow/update_entity_helpers.go
index 1b1e309183c..8ba144ffb72 100644
--- a/pkg/workflow/update_entity_helpers.go
+++ b/pkg/workflow/update_entity_helpers.go
@@ -64,6 +64,8 @@ import (
 	"github.com/githubnext/gh-aw/pkg/logger"
 )
 
+var updateEntityHelpersLog = logger.New("workflow:update_entity_helpers")
+
 // UpdateEntityType represents the type of entity being updated
 type UpdateEntityType string
 
@@ -110,6 +112,7 @@ type UpdateEntityJobBuilder struct {
 // parseUpdateEntityConfig is a generic function to parse update entity configurations
 func (c *Compiler) parseUpdateEntityConfig(outputMap map[string]any, params UpdateEntityJobParams, logger *logger.Logger, parseSpecificFields func(map[string]any, *UpdateEntityConfig)) *UpdateEntityConfig {
 	if configData, exists := outputMap[params.ConfigKey]; exists {
+		updateEntityHelpersLog.Printf("Parsing %s configuration", params.ConfigKey)
 		logger.Printf("Parsing %s configuration", params.ConfigKey)
 		config := &UpdateEntityConfig{}
 
@@ -117,10 +120,12 @@ func (c *Compiler) parseUpdateEntityConfig(outputMap map[string]any, params Upda
 			// Parse target config (target, target-repo) with validation
 			targetConfig, isInvalid := ParseTargetConfig(configMap)
 			if isInvalid {
+				updateEntityHelpersLog.Printf("Invalid target-repo configuration for %s", params.ConfigKey)
 				logger.Print("Invalid target-repo configuration")
 				return nil
 			}
 			config.SafeOutputTargetConfig = targetConfig
+			updateEntityHelpersLog.Printf("Parsed target config for %s: target=%s", params.ConfigKey, targetConfig.Target)
 
 			// Parse type-specific fields if provided
 			if parseSpecificFields != nil {
