diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml
index 7dd7f6d9c85..ec39f200bde 100644
--- a/.github/workflows/daily-doc-healer.lock.yml
+++ b/.github/workflows/daily-doc-healer.lock.yml
@@ -24,10 +24,10 @@
 #
 # Resolved workflow manifest:
 #   Imports:
-#     - shared/mcp/qmd-docs.md
+#     - shared/qmd.md
 #     - shared/reporting.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"46a2f4db8761adcca73a3bb387f4fa328d14da038b17c0107fe4e361a72492f7","strict":true,"agent_id":"claude"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"21c1d84ca395bb35e23c479bfddfd547a485a544aeac3e0360a35f232fc0558c","strict":true,"agent_id":"claude"}
 
 name: "Daily Documentation Healer"
 "on":
@@ -138,21 +138,21 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_fa00afec7dfd63ed_EOF'
+          cat << 'GH_AW_PROMPT_1ab69342d96baba9_EOF'
           <system>
-          GH_AW_PROMPT_fa00afec7dfd63ed_EOF
+          GH_AW_PROMPT_1ab69342d96baba9_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/qmd_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_fa00afec7dfd63ed_EOF'
+          cat << 'GH_AW_PROMPT_1ab69342d96baba9_EOF'
           <safe-output-tools>
           Tools: create_issue, create_pull_request, missing_tool, missing_data, noop
-          GH_AW_PROMPT_fa00afec7dfd63ed_EOF
+          GH_AW_PROMPT_1ab69342d96baba9_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
-          cat << 'GH_AW_PROMPT_fa00afec7dfd63ed_EOF'
+          cat << 'GH_AW_PROMPT_1ab69342d96baba9_EOF'
           </safe-output-tools>
           <github-context>
           The following GitHub context information is available for this workflow:
@@ -182,20 +182,35 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_fa00afec7dfd63ed_EOF
+          GH_AW_PROMPT_1ab69342d96baba9_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_fa00afec7dfd63ed_EOF'
+          cat << 'GH_AW_PROMPT_1ab69342d96baba9_EOF'
           </system>
-          GH_AW_PROMPT_fa00afec7dfd63ed_EOF
-          cat << 'GH_AW_PROMPT_fa00afec7dfd63ed_EOF'
+          GH_AW_PROMPT_1ab69342d96baba9_EOF
+          cat << 'GH_AW_PROMPT_1ab69342d96baba9_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
+          
+          GH_AW_PROMPT_1ab69342d96baba9_EOF
+          cat << 'GH_AW_PROMPT_1ab69342d96baba9_EOF'
           {{#runtime-import .github/workflows/shared/reporting.md}}
-          GH_AW_PROMPT_fa00afec7dfd63ed_EOF
-          cat << 'GH_AW_PROMPT_fa00afec7dfd63ed_EOF'
-          {{#runtime-import .github/workflows/shared/mcp/qmd-docs.md}}
-          GH_AW_PROMPT_fa00afec7dfd63ed_EOF
-          cat << 'GH_AW_PROMPT_fa00afec7dfd63ed_EOF'
+          GH_AW_PROMPT_1ab69342d96baba9_EOF
+          cat << 'GH_AW_PROMPT_1ab69342d96baba9_EOF'
           {{#runtime-import .github/workflows/daily-doc-healer.md}}
-          GH_AW_PROMPT_fa00afec7dfd63ed_EOF
+          GH_AW_PROMPT_1ab69342d96baba9_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -391,12 +406,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_741ad043ecf32fad_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_32a6c560debc7157_EOF'
           {"create_issue":{"assignees":["copilot"],"expires":72,"labels":["documentation","automation"],"max":1,"title_prefix":"[doc-healer] "},"create_pull_request":{"expires":72,"labels":["documentation","automation"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"title_prefix":"[docs] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_741ad043ecf32fad_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_32a6c560debc7157_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_3d4db196f17404c9_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_eb7a2460b43524d7_EOF'
           {
             "description_suffixes": {
               "create_issue": " CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"[doc-healer] \". Labels [\"documentation\" \"automation\"] will be automatically added. Assignees [\"copilot\"] will be automatically assigned.",
@@ -405,8 +420,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_3d4db196f17404c9_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_557481661d5dc193_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_eb7a2460b43524d7_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_60a2ab9836ac2897_EOF'
           {
             "create_issue": {
               "defaultMax": 1,
@@ -535,7 +550,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_557481661d5dc193_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_60a2ab9836ac2897_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -636,7 +651,7 @@ jobs:
           export GH_AW_ENGINE="claude"
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
-          cat << GH_AW_MCP_CONFIG_d27a78d356980fc2_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_9095aa0893fa6ab9_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -687,7 +702,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_d27a78d356980fc2_EOF
+          GH_AW_MCP_CONFIG_9095aa0893fa6ab9_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/daily-doc-healer.md b/.github/workflows/daily-doc-healer.md
index 1d73f72884b..c11c79fbe2d 100644
--- a/.github/workflows/daily-doc-healer.md
+++ b/.github/workflows/daily-doc-healer.md
@@ -50,7 +50,17 @@ timeout-minutes: 45
 
 imports:
   - shared/reporting.md
-  - shared/mcp/qmd-docs.md
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: gh-aw
+          pattern: "**/*.{md,mdx}"
+          ignore:
+            - ".git/**"
+            - "node_modules/**"
+          context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index 659b106ad4f..8d093b4316a 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -24,9 +24,9 @@
 #
 # Resolved workflow manifest:
 #   Imports:
-#     - shared/mcp/qmd-docs.md
+#     - shared/qmd.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"2e85aa5613826b2672103b66edc567fe0836e6d8c03ebe30d78098ea4bce4e2e","strict":true,"agent_id":"claude"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"88b200afb8c3d05d3935cd585824da9b616b076aae8ff340da622283d5aaa40d","strict":true,"agent_id":"claude"}
 
 name: "Daily Documentation Updater"
 "on":
@@ -137,21 +137,21 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_6ca860255a86d635_EOF'
+          cat << 'GH_AW_PROMPT_7c8e92f9f038680c_EOF'
           <system>
-          GH_AW_PROMPT_6ca860255a86d635_EOF
+          GH_AW_PROMPT_7c8e92f9f038680c_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/qmd_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_6ca860255a86d635_EOF'
+          cat << 'GH_AW_PROMPT_7c8e92f9f038680c_EOF'
           <safe-output-tools>
           Tools: create_pull_request, missing_tool, missing_data, noop
-          GH_AW_PROMPT_6ca860255a86d635_EOF
+          GH_AW_PROMPT_7c8e92f9f038680c_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
-          cat << 'GH_AW_PROMPT_6ca860255a86d635_EOF'
+          cat << 'GH_AW_PROMPT_7c8e92f9f038680c_EOF'
           </safe-output-tools>
           <github-context>
           The following GitHub context information is available for this workflow:
@@ -181,17 +181,32 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_6ca860255a86d635_EOF
+          GH_AW_PROMPT_7c8e92f9f038680c_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_6ca860255a86d635_EOF'
+          cat << 'GH_AW_PROMPT_7c8e92f9f038680c_EOF'
           </system>
-          GH_AW_PROMPT_6ca860255a86d635_EOF
-          cat << 'GH_AW_PROMPT_6ca860255a86d635_EOF'
-          {{#runtime-import .github/workflows/shared/mcp/qmd-docs.md}}
-          GH_AW_PROMPT_6ca860255a86d635_EOF
-          cat << 'GH_AW_PROMPT_6ca860255a86d635_EOF'
+          GH_AW_PROMPT_7c8e92f9f038680c_EOF
+          cat << 'GH_AW_PROMPT_7c8e92f9f038680c_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
+          
+          GH_AW_PROMPT_7c8e92f9f038680c_EOF
+          cat << 'GH_AW_PROMPT_7c8e92f9f038680c_EOF'
           {{#runtime-import .github/workflows/daily-doc-updater.md}}
-          GH_AW_PROMPT_6ca860255a86d635_EOF
+          GH_AW_PROMPT_7c8e92f9f038680c_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -387,12 +402,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_f1f1b19267f1b168_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_f9c0d962123518e0_EOF'
           {"create_pull_request":{"auto_merge":true,"draft":false,"expires":24,"labels":["documentation","automation"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"reviewers":["copilot"],"title_prefix":"[docs] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_f1f1b19267f1b168_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_f9c0d962123518e0_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_773ee46666242836_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_b62a9a605741e82e_EOF'
           {
             "description_suffixes": {
               "create_pull_request": " CONSTRAINTS: Maximum 1 pull request(s) can be created. Title will be prefixed with \"[docs] \". Labels [\"documentation\" \"automation\"] will be automatically added. Reviewers [\"copilot\"] will be assigned."
@@ -400,8 +415,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_773ee46666242836_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_6a75ff61e12da4c2_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_b62a9a605741e82e_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_dfefa53943604a47_EOF'
           {
             "create_pull_request": {
               "defaultMax": 1,
@@ -497,7 +512,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_6a75ff61e12da4c2_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_dfefa53943604a47_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -598,7 +613,7 @@ jobs:
           export GH_AW_ENGINE="claude"
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
-          cat << GH_AW_MCP_CONFIG_26eb389993f41cec_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_637901581f415c13_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -649,7 +664,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_26eb389993f41cec_EOF
+          GH_AW_MCP_CONFIG_637901581f415c13_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/daily-doc-updater.md b/.github/workflows/daily-doc-updater.md
index 1ce87d2b947..c4c0d50071e 100644
--- a/.github/workflows/daily-doc-updater.md
+++ b/.github/workflows/daily-doc-updater.md
@@ -47,7 +47,17 @@ tools:
 timeout-minutes: 45
 
 imports:
-  - shared/mcp/qmd-docs.md
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: gh-aw
+          pattern: "**/*.{md,mdx}"
+          ignore:
+            - ".git/**"
+            - "node_modules/**"
+          context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
 
 ---
 
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index 14f8a545265..7e90d930974 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -22,7 +22,11 @@
 #
 # Daily status report for gh-aw project
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"a467e1cd0075ad1d90c4ddbdb710e3dd7c6ab4475ba536f33b50982fb30c9487","agent_id":"copilot"}
+# Resolved workflow manifest:
+#   Imports:
+#     - shared/qmd.md
+#
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"8682153746c090aaec7237aacf6980193955a73a1b46d513ba47fd15d29a5c08","agent_id":"copilot"}
 
 name: "Dev"
 "on":
@@ -186,15 +190,15 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_9b8cc72a91bffe5c_EOF'
+          cat << 'GH_AW_PROMPT_46b76a2545b1e821_EOF'
           <system>
-          GH_AW_PROMPT_9b8cc72a91bffe5c_EOF
+          GH_AW_PROMPT_46b76a2545b1e821_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/qmd_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_9b8cc72a91bffe5c_EOF'
+          cat << 'GH_AW_PROMPT_46b76a2545b1e821_EOF'
           <safe-output-tools>
           Tools: create_issue, missing_tool, missing_data, noop
           </safe-output-tools>
@@ -226,14 +230,32 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_9b8cc72a91bffe5c_EOF
+          GH_AW_PROMPT_46b76a2545b1e821_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_9b8cc72a91bffe5c_EOF'
+          cat << 'GH_AW_PROMPT_46b76a2545b1e821_EOF'
           </system>
-          GH_AW_PROMPT_9b8cc72a91bffe5c_EOF
-          cat << 'GH_AW_PROMPT_9b8cc72a91bffe5c_EOF'
+          GH_AW_PROMPT_46b76a2545b1e821_EOF
+          cat << 'GH_AW_PROMPT_46b76a2545b1e821_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
+          
+          GH_AW_PROMPT_46b76a2545b1e821_EOF
+          cat << 'GH_AW_PROMPT_46b76a2545b1e821_EOF'
           {{#runtime-import .github/workflows/dev.md}}
-          GH_AW_PROMPT_9b8cc72a91bffe5c_EOF
+          GH_AW_PROMPT_46b76a2545b1e821_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -409,12 +431,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_f090af5979db46c6_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_e49127de82ff6145_EOF'
           {"create_issue":{"expires":168,"max":1,"title_prefix":"[Daily Report] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_f090af5979db46c6_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_e49127de82ff6145_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_30040392c459ce98_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_144c55f7c8e70ef8_EOF'
           {
             "description_suffixes": {
               "create_issue": " CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"[Daily Report] \"."
@@ -422,8 +444,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_30040392c459ce98_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_0e0bcf623cb7e1e0_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_144c55f7c8e70ef8_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_9bf9ad3142339d44_EOF'
           {
             "create_issue": {
               "defaultMax": 1,
@@ -516,7 +538,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_0e0bcf623cb7e1e0_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_9bf9ad3142339d44_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -618,7 +640,7 @@ jobs:
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
           mkdir -p /home/runner/.copilot
-          cat << GH_AW_MCP_CONFIG_485f7902939ce499_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_7ca25f856be49606_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -670,7 +692,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_485f7902939ce499_EOF
+          GH_AW_MCP_CONFIG_7ca25f856be49606_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/dev.md b/.github/workflows/dev.md
index bba82b6df9e..c94900c6314 100644
--- a/.github/workflows/dev.md
+++ b/.github/workflows/dev.md
@@ -15,19 +15,20 @@ permissions:
   issues: read
   pull-requests: read
 
-tools:
-  qmd:
-    runs-on: aw-gpu-runner-T4
-    gpu: true
-    checkouts:
-      - name: docs
-        pattern: "docs/src/**/*.{md,mdx}"
-        context: "gh-aw project documentation"
-    searches:
-      - name: issues
-        type: issues
-        max: 500
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+imports:
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: docs
+          pattern: "docs/src/**/*.{md,mdx}"
+          context: "gh-aw project documentation"
+      searches:
+        - name: issues
+          type: issues
+          max: 500
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
 safe-outputs:
   create-issue:
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index daae4605319..ae9ab1fda73 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -24,12 +24,12 @@
 #
 # Resolved workflow manifest:
 #   Imports:
-#     - shared/mcp/qmd-docs.md
 #     - shared/mcp/serena-go.md
 #     - shared/mcp/serena.md
+#     - shared/qmd.md
 #     - shared/reporting.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"53b37729746a7d9dcabae428065d8cf9b72719da05ac547606213ba7a56108e3","strict":true,"agent_id":"claude"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"21095280de0511b25713cd14c2e499ae2a0fedcaa2bac964ba26d5efeda3c120","strict":true,"agent_id":"claude"}
 
 name: "Developer Documentation Consolidator"
 "on":
@@ -140,9 +140,9 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
+          cat << 'GH_AW_PROMPT_c1f28df1288fd87c_EOF'
           <system>
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
+          GH_AW_PROMPT_c1f28df1288fd87c_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
@@ -150,12 +150,12 @@ jobs:
           cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/repo_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
+          cat << 'GH_AW_PROMPT_c1f28df1288fd87c_EOF'
           <safe-output-tools>
           Tools: create_discussion, create_pull_request, missing_tool, missing_data, noop
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
+          GH_AW_PROMPT_c1f28df1288fd87c_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
+          cat << 'GH_AW_PROMPT_c1f28df1288fd87c_EOF'
           </safe-output-tools>
           <github-context>
           The following GitHub context information is available for this workflow:
@@ -185,12 +185,27 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
+          GH_AW_PROMPT_c1f28df1288fd87c_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
+          cat << 'GH_AW_PROMPT_c1f28df1288fd87c_EOF'
           </system>
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
+          GH_AW_PROMPT_c1f28df1288fd87c_EOF
+          cat << 'GH_AW_PROMPT_c1f28df1288fd87c_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
           ## Serena Code Analysis
           
           The Serena MCP server is configured for **["go"]** analysis in this workspace:
@@ -222,19 +237,16 @@ jobs:
           4. **Focus on the relevant language files** — ignore unrelated file types
           
           
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
+          GH_AW_PROMPT_c1f28df1288fd87c_EOF
+          cat << 'GH_AW_PROMPT_c1f28df1288fd87c_EOF'
           {{#runtime-import .github/workflows/shared/reporting.md}}
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
+          GH_AW_PROMPT_c1f28df1288fd87c_EOF
+          cat << 'GH_AW_PROMPT_c1f28df1288fd87c_EOF'
           {{#runtime-import .github/workflows/shared/mcp/serena-go.md}}
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
-          {{#runtime-import .github/workflows/shared/mcp/qmd-docs.md}}
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
-          cat << 'GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF'
+          GH_AW_PROMPT_c1f28df1288fd87c_EOF
+          cat << 'GH_AW_PROMPT_c1f28df1288fd87c_EOF'
           {{#runtime-import .github/workflows/developer-docs-consolidator.md}}
-          GH_AW_PROMPT_bdcc92b3fa4f82a5_EOF
+          GH_AW_PROMPT_c1f28df1288fd87c_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -454,12 +466,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_38785d45ee4b9450_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_6db779b042ba53a6_EOF'
           {"create_discussion":{"category":"audits","close_older_discussions":true,"expires":168,"fallback_to_issue":true,"max":1},"create_pull_request":{"draft":false,"expires":48,"labels":["documentation","automation"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"title_prefix":"[docs] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":100,"max_file_size":10240,"max_patch_size":10240}]}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_38785d45ee4b9450_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_6db779b042ba53a6_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_d50c0c7569e1056c_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_8ca7af9878a3013a_EOF'
           {
             "description_suffixes": {
               "create_discussion": " CONSTRAINTS: Maximum 1 discussion(s) can be created. Discussions will be created in category \"audits\".",
@@ -468,8 +480,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_d50c0c7569e1056c_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_35850464d31c5a13_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_8ca7af9878a3013a_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_e4e570be0dc5e476_EOF'
           {
             "create_discussion": {
               "defaultMax": 1,
@@ -591,7 +603,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_35850464d31c5a13_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_e4e570be0dc5e476_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -692,7 +704,7 @@ jobs:
           export GH_AW_ENGINE="claude"
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
-          cat << GH_AW_MCP_CONFIG_60450871e3bbdb16_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_efa2a6f3549045a5_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -769,7 +781,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_60450871e3bbdb16_EOF
+          GH_AW_MCP_CONFIG_efa2a6f3549045a5_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/developer-docs-consolidator.md b/.github/workflows/developer-docs-consolidator.md
index dfef6d17eaa..df4bf6d987f 100644
--- a/.github/workflows/developer-docs-consolidator.md
+++ b/.github/workflows/developer-docs-consolidator.md
@@ -54,7 +54,17 @@ timeout-minutes: 30
 imports:
   - shared/reporting.md
   - shared/mcp/serena-go.md
-  - shared/mcp/qmd-docs.md
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: gh-aw
+          pattern: "**/*.{md,mdx}"
+          ignore:
+            - ".git/**"
+            - "node_modules/**"
+          context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
 
 ---
 
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index 0f2bdfdbfbd..ab990660a8c 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -24,10 +24,10 @@
 #
 # Resolved workflow manifest:
 #   Imports:
-#     - shared/mcp/qmd-docs.md
+#     - shared/qmd.md
 #     - shared/reporting.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"b2d3e8c4c581b219bbc251129f0d2ff44c168cbe567111e5c60ee9ef6ace4f00","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"c48d75a4a5d0ceb2879de53d4fe0922b0664baa8b9ac7128b88b24d6ce8feb38","strict":true,"agent_id":"copilot"}
 
 name: "Dictation Prompt Generator"
 "on":
@@ -131,20 +131,20 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_05addaf1d85c9fcf_EOF'
+          cat << 'GH_AW_PROMPT_c224fe6ed8997872_EOF'
           <system>
-          GH_AW_PROMPT_05addaf1d85c9fcf_EOF
+          GH_AW_PROMPT_c224fe6ed8997872_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/qmd_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_05addaf1d85c9fcf_EOF'
+          cat << 'GH_AW_PROMPT_c224fe6ed8997872_EOF'
           <safe-output-tools>
           Tools: create_pull_request, missing_tool, missing_data, noop
-          GH_AW_PROMPT_05addaf1d85c9fcf_EOF
+          GH_AW_PROMPT_c224fe6ed8997872_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
-          cat << 'GH_AW_PROMPT_05addaf1d85c9fcf_EOF'
+          cat << 'GH_AW_PROMPT_c224fe6ed8997872_EOF'
           </safe-output-tools>
           <github-context>
           The following GitHub context information is available for this workflow:
@@ -174,20 +174,35 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_05addaf1d85c9fcf_EOF
+          GH_AW_PROMPT_c224fe6ed8997872_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_05addaf1d85c9fcf_EOF'
+          cat << 'GH_AW_PROMPT_c224fe6ed8997872_EOF'
           </system>
-          GH_AW_PROMPT_05addaf1d85c9fcf_EOF
-          cat << 'GH_AW_PROMPT_05addaf1d85c9fcf_EOF'
+          GH_AW_PROMPT_c224fe6ed8997872_EOF
+          cat << 'GH_AW_PROMPT_c224fe6ed8997872_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
+          
+          GH_AW_PROMPT_c224fe6ed8997872_EOF
+          cat << 'GH_AW_PROMPT_c224fe6ed8997872_EOF'
           {{#runtime-import .github/workflows/shared/reporting.md}}
-          GH_AW_PROMPT_05addaf1d85c9fcf_EOF
-          cat << 'GH_AW_PROMPT_05addaf1d85c9fcf_EOF'
-          {{#runtime-import .github/workflows/shared/mcp/qmd-docs.md}}
-          GH_AW_PROMPT_05addaf1d85c9fcf_EOF
-          cat << 'GH_AW_PROMPT_05addaf1d85c9fcf_EOF'
+          GH_AW_PROMPT_c224fe6ed8997872_EOF
+          cat << 'GH_AW_PROMPT_c224fe6ed8997872_EOF'
           {{#runtime-import .github/workflows/dictation-prompt.md}}
-          GH_AW_PROMPT_05addaf1d85c9fcf_EOF
+          GH_AW_PROMPT_c224fe6ed8997872_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -363,12 +378,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_b3ced67cf1d1e43a_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_d8487aa026e71957_EOF'
           {"create_pull_request":{"auto_merge":true,"draft":false,"expires":48,"labels":["documentation","automation"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"title_prefix":"[docs] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_b3ced67cf1d1e43a_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_d8487aa026e71957_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_dc26a5da677f9ee7_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_9e7420aa1d00a778_EOF'
           {
             "description_suffixes": {
               "create_pull_request": " CONSTRAINTS: Maximum 1 pull request(s) can be created. Title will be prefixed with \"[docs] \". Labels [\"documentation\" \"automation\"] will be automatically added."
@@ -376,8 +391,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_dc26a5da677f9ee7_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_a6edbe37ca831513_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_9e7420aa1d00a778_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_785e5230f8e4365d_EOF'
           {
             "create_pull_request": {
               "defaultMax": 1,
@@ -473,7 +488,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_a6edbe37ca831513_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_785e5230f8e4365d_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -575,7 +590,7 @@ jobs:
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
           mkdir -p /home/runner/.copilot
-          cat << GH_AW_MCP_CONFIG_a50fa04f7fda5074_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_118bcfe6f6a3f666_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -627,7 +642,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_a50fa04f7fda5074_EOF
+          GH_AW_MCP_CONFIG_118bcfe6f6a3f666_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/dictation-prompt.md b/.github/workflows/dictation-prompt.md
index b7394c13d4d..62719aec228 100644
--- a/.github/workflows/dictation-prompt.md
+++ b/.github/workflows/dictation-prompt.md
@@ -17,7 +17,17 @@ network: defaults
 
 imports:
   - shared/reporting.md
-  - shared/mcp/qmd-docs.md
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: gh-aw
+          pattern: "**/*.{md,mdx}"
+          ignore:
+            - ".git/**"
+            - "node_modules/**"
+          context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
 
 tools:
   edit:
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index 87ee224a18f..21c9bfca06e 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -26,11 +26,11 @@
 #   Imports:
 #     - ../agents/technical-doc-writer.agent.md
 #     - ../skills/documentation/SKILL.md
-#     - shared/mcp/qmd-docs.md
 #     - shared/mcp/serena-go.md
 #     - shared/mcp/serena.md
+#     - shared/qmd.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"eca7d351932b1292599e078d9d2ba0be9423450d6f00bd7dc0573f715e2b7f7b","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"b74cb3c536157c4794068da770c3cfd6ca30b5d0ffbfe95990b6147b6f97f982","strict":true,"agent_id":"copilot"}
 
 name: "Glossary Maintainer"
 "on":
@@ -140,9 +140,9 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
           <system>
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
@@ -150,12 +150,12 @@ jobs:
           cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/repo_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
           <safe-output-tools>
           Tools: create_pull_request, missing_tool, missing_data, noop
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
           </safe-output-tools>
           <github-context>
           The following GitHub context information is available for this workflow:
@@ -185,12 +185,27 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
           </system>
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
           ## Serena Code Analysis
           
           The Serena MCP server is configured for **["go"]** analysis in this workspace:
@@ -222,22 +237,19 @@ jobs:
           4. **Focus on the relevant language files** — ignore unrelated file types
           
           
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
           {{#runtime-import .github/skills/documentation/SKILL.md}}
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
           {{#runtime-import .github/agents/technical-doc-writer.agent.md}}
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
           {{#runtime-import .github/workflows/shared/mcp/serena-go.md}}
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
-          {{#runtime-import .github/workflows/shared/mcp/qmd-docs.md}}
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
-          cat << 'GH_AW_PROMPT_46ef56a9e5df78e3_EOF'
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
+          cat << 'GH_AW_PROMPT_cc96d40dc21595c5_EOF'
           {{#runtime-import .github/workflows/glossary-maintainer.md}}
-          GH_AW_PROMPT_46ef56a9e5df78e3_EOF
+          GH_AW_PROMPT_cc96d40dc21595c5_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -463,12 +475,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_de03f03deb126789_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_cf0d4c2f37289011_EOF'
           {"create_pull_request":{"draft":false,"expires":48,"labels":["documentation","glossary"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"title_prefix":"[docs] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":100,"max_file_size":10240,"max_patch_size":10240}]}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_de03f03deb126789_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_cf0d4c2f37289011_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_1e12d904f599aa11_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_f663e14d245bf92e_EOF'
           {
             "description_suffixes": {
               "create_pull_request": " CONSTRAINTS: Maximum 1 pull request(s) can be created. Title will be prefixed with \"[docs] \". Labels [\"documentation\" \"glossary\"] will be automatically added."
@@ -476,8 +488,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_1e12d904f599aa11_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_3cece48557b30fd7_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_f663e14d245bf92e_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_5fd7dbc2ba21ae1e_EOF'
           {
             "create_pull_request": {
               "defaultMax": 1,
@@ -573,7 +585,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_3cece48557b30fd7_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_5fd7dbc2ba21ae1e_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -675,7 +687,7 @@ jobs:
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
           mkdir -p /home/runner/.copilot
-          cat << GH_AW_MCP_CONFIG_61e9af9c2220cfb4_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_ec406c5debb4dfab_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -756,7 +768,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_61e9af9c2220cfb4_EOF
+          GH_AW_MCP_CONFIG_ec406c5debb4dfab_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/glossary-maintainer.md b/.github/workflows/glossary-maintainer.md
index ebc9d8c6396..dd1c60f64e8 100644
--- a/.github/workflows/glossary-maintainer.md
+++ b/.github/workflows/glossary-maintainer.md
@@ -26,7 +26,17 @@ imports:
   - ../skills/documentation/SKILL.md
   - ../agents/technical-doc-writer.agent.md
   - shared/mcp/serena-go.md
-  - shared/mcp/qmd-docs.md
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: gh-aw
+          pattern: "**/*.{md,mdx}"
+          ignore:
+            - ".git/**"
+            - "node_modules/**"
+          context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
 
 safe-outputs:
   create-pull-request:
diff --git a/.github/workflows/shared/mcp/qmd-docs.md b/.github/workflows/shared/mcp/qmd-docs.md
deleted file mode 100644
index 61c870c5cd9..00000000000
--- a/.github/workflows/shared/mcp/qmd-docs.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-# QMD Documentation Search
-# Local on-device search engine for the project documentation, agents, and workflow instructions
-#
-# Documentation: https://github.com/tobi/qmd
-#
-# Usage:
-#   imports:
-#     - shared/mcp/qmd-docs.md
-
-tools:
-  qmd:
-    runs-on: aw-gpu-runner-T4
-    gpu: true
-    checkouts:
-      - name: gh-aw
-        pattern: "**/*.{md,mdx}"
-        ignore:
-          - ".git/**"
-          - "node_modules/**"
-        context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
-
----
-
-<qmd>
-Use the `search` tool to find relevant documentation files with a natural language request — it queries a local vector database of project docs, agents, and workflow files. Read the returned file paths to get full content.
-
-**Always use `search` first** when you need to find, verify, or search documentation:
-- **Before using `find` or `bash` to list files** — use `search` to discover the most relevant docs for a topic
-- **Before writing new content** — search first to check whether documentation already exists
-- **When identifying relevant files** — use it to narrow down which documentation pages cover a feature or concept
-- **When understanding a term or concept** — query to find authoritative documentation describing it
-
-**Usage tips:**
-- Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
-- Always read the returned file paths to get the full content — `search` returns paths only, not content
-- Combine multiple targeted queries rather than one broad query for better coverage
-</qmd>
diff --git a/.github/workflows/shared/mcp/qmd.md b/.github/workflows/shared/mcp/qmd.md
deleted file mode 100644
index 437987b6adc..00000000000
--- a/.github/workflows/shared/mcp/qmd.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-# QMD Documentation Search
-# Local on-device search engine for the project documentation, agents, and workflow instructions
-#
-# Documentation: https://github.com/tobi/qmd
-#
-# Usage:
-#   imports:
-#     - shared/mcp/qmd.md
-
-tools:
-  qmd:
-    runs-on: aw-gpu-runner-T4
-    gpu: true
-    checkouts:
-      - name: gh-aw-docs
-        pattern: "docs/src/content/docs/**/*.mdx"
-        context: "gh-aw project documentation"
-      - name: gh-aw-workflows
-        pattern: ".github/**/*.md"
-        context: "gh-aw agent definitions and workflow authoring instructions"
-
----
-
-<qmd>
-Use the `search` tool to find relevant documentation files with a natural language request — it queries a local vector database of project docs, agents, and workflow files. Read the returned file paths to get full content.
-
-**Always use `search` first** when you need to find, verify, or search documentation:
-- **Before using `find` or `bash` to list files** — use `search` to discover the most relevant docs for a topic
-- **Before writing new content** — search first to check whether documentation already exists
-- **When identifying relevant files** — use it to narrow down which documentation pages cover a feature or concept
-- **When understanding a term or concept** — query to find authoritative documentation describing it
-
-**Usage tips:**
-- Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
-- Always read the returned file paths to get the full content — `search` returns paths only, not content
-- Combine multiple targeted queries rather than one broad query for better coverage
-</qmd>
diff --git a/.github/workflows/shared/qmd.md b/.github/workflows/shared/qmd.md
new file mode 100644
index 00000000000..8261da61f60
--- /dev/null
+++ b/.github/workflows/shared/qmd.md
@@ -0,0 +1,80 @@
+---
+# QMD Documentation Search
+# Local on-device vector search over documentation and other files.
+#
+# Documentation: https://github.com/tobi/qmd
+#
+# Usage:
+#   imports:
+#     - uses: shared/qmd.md
+#       with:
+#         checkouts:
+#           - name: docs
+#             pattern: "docs/**/*.md"
+#             context: "Project documentation"
+#         searches:
+#           - name: issues
+#             type: issues
+#             max: 500
+#             github-token: ${{ secrets.GITHUB_TOKEN }}
+#         cache-key: "qmd-index-${{ hashFiles('docs/**') }}"
+#         gpu: true
+#         runs-on: aw-gpu-runner-T4
+
+import-schema:
+  checkouts:
+    type: array
+    required: false
+    description: >
+      List of documentation collections to index. Each item may include:
+      name (string), pattern (glob string), ignore (string[]), context (string),
+      checkout (object with repository/ref/path/token options).
+  searches:
+    type: array
+    required: false
+    description: >
+      List of GitHub code or issue searches to add to the index. Each item may include:
+      name (string), type ("code"|"issues"), query (string), min (number),
+      max (number), github-token (string), github-app (object).
+  cache-key:
+    type: string
+    required: false
+    description: >
+      GitHub Actions cache key for the search index.
+      Omit for an ephemeral per-run index.
+      Use cache-key alone (without checkouts or searches) for read-only mode.
+  gpu:
+    type: boolean
+    required: false
+    description: >
+      Enable GPU acceleration for faster embedding generation. Default: false.
+  runs-on:
+    type: string
+    required: false
+    description: >
+      Runner image for the indexing job. Default: ubuntu-latest.
+
+tools:
+  qmd:
+    checkouts: ${{ github.aw.import-inputs.checkouts }}
+    searches: ${{ github.aw.import-inputs.searches }}
+    cache-key: ${{ github.aw.import-inputs.cache-key }}
+    gpu: ${{ github.aw.import-inputs.gpu }}
+    runs-on: ${{ github.aw.import-inputs.runs-on }}
+
+---
+
+<qmd>
+Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+
+**Always use `search` first** when you need to find, verify, or look up information:
+- **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+- **Before writing new content** — search first to check whether similar content already exists
+- **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+- **When understanding a term or concept** — query to find authoritative documentation
+
+**Usage tips:**
+- Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+- Always read the returned file paths to get the full content — `search` returns paths only, not content
+- Combine multiple targeted queries rather than one broad query for better coverage
+</qmd>
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index bce98c17e69..1dcf06c80aa 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -27,9 +27,10 @@
 #     - shared/gh.md
 #     - shared/mcp/serena-go.md
 #     - shared/mcp/serena.md
+#     - shared/qmd.md
 #     - shared/reporting.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"f44e72272050fdefc2eaef02af775f7d2b49c900c4c06d1907982cc7a01f4cef","agent_id":"codex"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"e6e1ff4a8216238feaa7ff40176c416d83e23d0afbc5eebcaf63742e6026c81d","agent_id":"codex"}
 
 name: "Smoke Codex"
 "on":
@@ -193,9 +194,9 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_874458f22920114c_EOF'
+          cat << 'GH_AW_PROMPT_bcd00b3112d5de54_EOF'
           <system>
-          GH_AW_PROMPT_874458f22920114c_EOF
+          GH_AW_PROMPT_bcd00b3112d5de54_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
@@ -203,7 +204,7 @@ jobs:
           cat "${RUNNER_TEMP}/gh-aw/prompts/qmd_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_874458f22920114c_EOF'
+          cat << 'GH_AW_PROMPT_bcd00b3112d5de54_EOF'
           <safe-output-tools>
           Tools: add_comment(max:2), create_issue, add_labels, remove_labels, unassign_from_user, hide_comment(max:5), missing_tool, missing_data, noop
           </safe-output-tools>
@@ -238,12 +239,27 @@ jobs:
             - **Note**: If a branch you need is not in the list above and is not listed as an additional fetched ref, it has NOT been checked out. For private repositories you cannot fetch it without proper authentication. If the branch is required and not available, exit with an error and ask the user to add it to the `fetch:` option of the `checkout:` configuration (e.g., `fetch: ["refs/pulls/open/*"]` for all open PR refs, or `fetch: ["main", "feature/my-branch"]` for specific branches).
           </github-context>
           
-          GH_AW_PROMPT_874458f22920114c_EOF
+          GH_AW_PROMPT_bcd00b3112d5de54_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_874458f22920114c_EOF'
+          cat << 'GH_AW_PROMPT_bcd00b3112d5de54_EOF'
           </system>
-          GH_AW_PROMPT_874458f22920114c_EOF
-          cat << 'GH_AW_PROMPT_874458f22920114c_EOF'
+          GH_AW_PROMPT_bcd00b3112d5de54_EOF
+          cat << 'GH_AW_PROMPT_bcd00b3112d5de54_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
           ## Serena Code Analysis
           
           The Serena MCP server is configured for **["go"]** analysis in this workspace:
@@ -275,19 +291,19 @@ jobs:
           4. **Focus on the relevant language files** — ignore unrelated file types
           
           
-          GH_AW_PROMPT_874458f22920114c_EOF
-          cat << 'GH_AW_PROMPT_874458f22920114c_EOF'
+          GH_AW_PROMPT_bcd00b3112d5de54_EOF
+          cat << 'GH_AW_PROMPT_bcd00b3112d5de54_EOF'
           {{#runtime-import .github/workflows/shared/gh.md}}
-          GH_AW_PROMPT_874458f22920114c_EOF
-          cat << 'GH_AW_PROMPT_874458f22920114c_EOF'
+          GH_AW_PROMPT_bcd00b3112d5de54_EOF
+          cat << 'GH_AW_PROMPT_bcd00b3112d5de54_EOF'
           {{#runtime-import .github/workflows/shared/reporting.md}}
-          GH_AW_PROMPT_874458f22920114c_EOF
-          cat << 'GH_AW_PROMPT_874458f22920114c_EOF'
+          GH_AW_PROMPT_bcd00b3112d5de54_EOF
+          cat << 'GH_AW_PROMPT_bcd00b3112d5de54_EOF'
           {{#runtime-import .github/workflows/shared/mcp/serena-go.md}}
-          GH_AW_PROMPT_874458f22920114c_EOF
-          cat << 'GH_AW_PROMPT_874458f22920114c_EOF'
+          GH_AW_PROMPT_bcd00b3112d5de54_EOF
+          cat << 'GH_AW_PROMPT_bcd00b3112d5de54_EOF'
           {{#runtime-import .github/workflows/smoke-codex.md}}
-          GH_AW_PROMPT_874458f22920114c_EOF
+          GH_AW_PROMPT_bcd00b3112d5de54_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -497,12 +513,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_615d15b4b2d7570c_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_128234e725279789_EOF'
           {"add_comment":{"hide_older_comments":true,"max":2},"add_labels":{"allowed":["smoke-codex"]},"create_issue":{"close_older_issues":true,"close_older_key":"smoke-codex","expires":2,"labels":["automation","testing"],"max":1},"hide_comment":{"max":5},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"remove_labels":{"allowed":["smoke"]},"unassign_from_user":{"allowed":["githubactionagent"],"max":1}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_615d15b4b2d7570c_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_128234e725279789_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_b4c7657d8a6271bc_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_123a825b588fc33d_EOF'
           {
             "description_suffixes": {
               "add_comment": " CONSTRAINTS: Maximum 2 comment(s) can be added.",
@@ -535,8 +551,8 @@ jobs:
               }
             ]
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_b4c7657d8a6271bc_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_6753d269a2ae138c_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_123a825b588fc33d_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_99ad56fd89415248_EOF'
           {
             "add_comment": {
               "defaultMax": 1,
@@ -732,7 +748,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_6753d269a2ae138c_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_99ad56fd89415248_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -775,7 +791,7 @@ jobs:
       - name: Setup MCP Scripts Config
         run: |
           mkdir -p ${RUNNER_TEMP}/gh-aw/mcp-scripts/logs
-          cat > ${RUNNER_TEMP}/gh-aw/mcp-scripts/tools.json << 'GH_AW_MCP_SCRIPTS_TOOLS_0b8dd47d724f414e_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/mcp-scripts/tools.json << 'GH_AW_MCP_SCRIPTS_TOOLS_3b25233441772a30_EOF'
           {
             "serverName": "mcpscripts",
             "version": "1.0.0",
@@ -805,8 +821,8 @@ jobs:
               }
             ]
           }
-          GH_AW_MCP_SCRIPTS_TOOLS_0b8dd47d724f414e_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/mcp-scripts/mcp-server.cjs << 'GH_AW_MCP_SCRIPTS_SERVER_c89b26d219d3c447_EOF'
+          GH_AW_MCP_SCRIPTS_TOOLS_3b25233441772a30_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/mcp-scripts/mcp-server.cjs << 'GH_AW_MCP_SCRIPTS_SERVER_13b9b1588014ee27_EOF'
             const path = require("path");
             const { startHttpServer } = require("./mcp_scripts_mcp_server_http.cjs");
             const configPath = path.join(__dirname, "tools.json");
@@ -820,12 +836,12 @@ jobs:
               console.error("Failed to start mcp-scripts HTTP server:", error);
               process.exit(1);
             });
-          GH_AW_MCP_SCRIPTS_SERVER_c89b26d219d3c447_EOF
+          GH_AW_MCP_SCRIPTS_SERVER_13b9b1588014ee27_EOF
           chmod +x ${RUNNER_TEMP}/gh-aw/mcp-scripts/mcp-server.cjs
           
       - name: Setup MCP Scripts Tool Files
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/mcp-scripts/gh.sh << 'GH_AW_MCP_SCRIPTS_SH_GH_c9a0a5f099e05dc5_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/mcp-scripts/gh.sh << 'GH_AW_MCP_SCRIPTS_SH_GH_330efa7e219eceeb_EOF'
           #!/bin/bash
           # Auto-generated mcp-script tool: gh
           # Execute any gh CLI command. This tool is accessible as 'mcpscripts-gh'. Provide the full command after 'gh' (e.g., args: 'pr list --limit 5'). The tool will run: gh <args>. Use single quotes ' for complex args to avoid shell interpretation issues.
@@ -836,7 +852,7 @@ jobs:
           echo "  token: ${GH_AW_GH_TOKEN:0:6}..."
           GH_TOKEN="$GH_AW_GH_TOKEN" gh $INPUT_ARGS
           
-          GH_AW_MCP_SCRIPTS_SH_GH_c9a0a5f099e05dc5_EOF
+          GH_AW_MCP_SCRIPTS_SH_GH_330efa7e219eceeb_EOF
           chmod +x ${RUNNER_TEMP}/gh-aw/mcp-scripts/gh.sh
           
       - name: Generate MCP Scripts Server Config
@@ -940,7 +956,7 @@ jobs:
           export GH_AW_ENGINE="codex"
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_MCP_SCRIPTS_PORT -e GH_AW_MCP_SCRIPTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GH_AW_GH_TOKEN -e GH_DEBUG -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
-          cat > /tmp/gh-aw/mcp-config/config.toml << GH_AW_MCP_CONFIG_472c3b5e0a01d67e_EOF
+          cat > /tmp/gh-aw/mcp-config/config.toml << GH_AW_MCP_CONFIG_4e7c1894ca6b987c_EOF
           [history]
           persistence = "none"
           
@@ -1030,10 +1046,10 @@ jobs:
           
           [mcp_servers.web-fetch."guard-policies".write-sink]
           accept = ["*"]
-          GH_AW_MCP_CONFIG_472c3b5e0a01d67e_EOF
+          GH_AW_MCP_CONFIG_4e7c1894ca6b987c_EOF
           
           # Generate JSON config for MCP gateway
-          cat << GH_AW_MCP_CONFIG_472c3b5e0a01d67e_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_4e7c1894ca6b987c_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -1158,7 +1174,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_472c3b5e0a01d67e_EOF
+          GH_AW_MCP_CONFIG_4e7c1894ca6b987c_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/smoke-codex.md b/.github/workflows/smoke-codex.md
index 55b82d739b3..50b4e4073ce 100644
--- a/.github/workflows/smoke-codex.md
+++ b/.github/workflows/smoke-codex.md
@@ -19,6 +19,17 @@ imports:
   - shared/gh.md
   - shared/reporting.md
   - shared/mcp/serena-go.md
+  - uses: shared/qmd.md
+    with:
+      checkouts:
+        - name: docs
+          pattern: "docs/src/**/*.{md,mdx}"
+          context: "gh-aw project documentation"
+      searches:
+        - name: issues
+          type: issues
+          max: 500
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 network:
   allowed:
     - defaults
@@ -32,16 +43,6 @@ tools:
   bash:
     - "*"
   web-fetch:
-  qmd:
-    checkouts:
-      - name: docs
-        pattern: "docs/src/**/*.{md,mdx}"
-        context: "gh-aw project documentation"
-    searches:
-      - name: issues
-        type: issues
-        max: 500
-        github-token: ${{ secrets.GITHUB_TOKEN }}
 runtimes:
   go:
     version: "1.25"
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 50f729aa9cd..316f4c48e11 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -26,9 +26,9 @@
 #   Imports:
 #     - ../agents/technical-doc-writer.agent.md
 #     - ../skills/documentation/SKILL.md
-#     - shared/mcp/qmd-docs.md
+#     - shared/qmd.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"9a2125b6b29c640be238a06857299a766c4894e2a4d01609b8f17aec6e4d3279","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"b34da9436d339882200efe7fdeb011781db57b32e4f262420101b111bdfdbfe4","strict":true,"agent_id":"copilot"}
 
 name: "Rebuild the documentation after making changes"
 "on":
@@ -141,9 +141,9 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_521a938985e48e73_EOF'
+          cat << 'GH_AW_PROMPT_12451cec570e87f7_EOF'
           <system>
-          GH_AW_PROMPT_521a938985e48e73_EOF
+          GH_AW_PROMPT_12451cec570e87f7_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
@@ -151,12 +151,12 @@ jobs:
           cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/repo_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_521a938985e48e73_EOF'
+          cat << 'GH_AW_PROMPT_12451cec570e87f7_EOF'
           <safe-output-tools>
           Tools: add_comment, create_pull_request, upload_asset, missing_tool, missing_data, noop
-          GH_AW_PROMPT_521a938985e48e73_EOF
+          GH_AW_PROMPT_12451cec570e87f7_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
-          cat << 'GH_AW_PROMPT_521a938985e48e73_EOF'
+          cat << 'GH_AW_PROMPT_12451cec570e87f7_EOF'
           
           upload_asset: provide a file path; returns a URL; assets are published after the workflow completes (safeoutputs).
           </safe-output-tools>
@@ -188,23 +188,38 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_521a938985e48e73_EOF
+          GH_AW_PROMPT_12451cec570e87f7_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_521a938985e48e73_EOF'
+          cat << 'GH_AW_PROMPT_12451cec570e87f7_EOF'
           </system>
-          GH_AW_PROMPT_521a938985e48e73_EOF
-          cat << 'GH_AW_PROMPT_521a938985e48e73_EOF'
+          GH_AW_PROMPT_12451cec570e87f7_EOF
+          cat << 'GH_AW_PROMPT_12451cec570e87f7_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
+          
+          GH_AW_PROMPT_12451cec570e87f7_EOF
+          cat << 'GH_AW_PROMPT_12451cec570e87f7_EOF'
           {{#runtime-import .github/skills/documentation/SKILL.md}}
-          GH_AW_PROMPT_521a938985e48e73_EOF
-          cat << 'GH_AW_PROMPT_521a938985e48e73_EOF'
+          GH_AW_PROMPT_12451cec570e87f7_EOF
+          cat << 'GH_AW_PROMPT_12451cec570e87f7_EOF'
           {{#runtime-import .github/agents/technical-doc-writer.agent.md}}
-          GH_AW_PROMPT_521a938985e48e73_EOF
-          cat << 'GH_AW_PROMPT_521a938985e48e73_EOF'
-          {{#runtime-import .github/workflows/shared/mcp/qmd-docs.md}}
-          GH_AW_PROMPT_521a938985e48e73_EOF
-          cat << 'GH_AW_PROMPT_521a938985e48e73_EOF'
+          GH_AW_PROMPT_12451cec570e87f7_EOF
+          cat << 'GH_AW_PROMPT_12451cec570e87f7_EOF'
           {{#runtime-import .github/workflows/technical-doc-writer.md}}
-          GH_AW_PROMPT_521a938985e48e73_EOF
+          GH_AW_PROMPT_12451cec570e87f7_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -446,12 +461,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_573ef24d5996fc45_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_bc26093b93d7778c_EOF'
           {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":48,"labels":["documentation"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"reviewers":["copilot"],"title_prefix":"[docs] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":100,"max_file_size":10240,"max_patch_size":10240}]},"upload_asset":{"allowed-exts":[".png",".jpg",".jpeg"],"branch":"assets/${{ github.workflow }}","max-size":10240}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_573ef24d5996fc45_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_bc26093b93d7778c_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_425813cd908ba89e_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_c1b4e76b275c9cb0_EOF'
           {
             "description_suffixes": {
               "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added.",
@@ -461,8 +476,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_425813cd908ba89e_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_51a7a6aaf3fcddc0_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_c1b4e76b275c9cb0_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_5e4d988570a1fb0f_EOF'
           {
             "add_comment": {
               "defaultMax": 1,
@@ -585,7 +600,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_51a7a6aaf3fcddc0_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_5e4d988570a1fb0f_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -690,7 +705,7 @@ jobs:
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
           mkdir -p /home/runner/.copilot
-          cat << GH_AW_MCP_CONFIG_9823d798dd8a0798_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_c61c89e07d6acef4_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -742,7 +757,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_9823d798dd8a0798_EOF
+          GH_AW_MCP_CONFIG_c61c89e07d6acef4_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/technical-doc-writer.md b/.github/workflows/technical-doc-writer.md
index 6cad9217fa1..d260f40d201 100644
--- a/.github/workflows/technical-doc-writer.md
+++ b/.github/workflows/technical-doc-writer.md
@@ -26,7 +26,17 @@ network:
 imports:
   - ../skills/documentation/SKILL.md
   - ../agents/technical-doc-writer.agent.md
-  - shared/mcp/qmd-docs.md
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: gh-aw
+          pattern: "**/*.{md,mdx}"
+          ignore:
+            - ".git/**"
+            - "node_modules/**"
+          context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
 
 safe-outputs:
   add-comment:
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index fa3d1b5c8cf..16fd04374f8 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -25,10 +25,10 @@
 # Resolved workflow manifest:
 #   Imports:
 #     - shared/docs-server-lifecycle.md
-#     - shared/mcp/qmd-docs.md
+#     - shared/qmd.md
 #     - shared/reporting.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"1d5cfd4f91bd8fcf04b0386757779cc674a35eb53bac2a45273366b85d389beb","strict":true,"agent_id":"claude"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"5cb1a238898220d72c422f335a9e11bf399825c79859fe9f982ec22cb15ac37e","strict":true,"agent_id":"claude"}
 
 name: "Documentation Unbloat"
 "on":
@@ -187,9 +187,9 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_2d537e0f4ae05d79_EOF'
+          cat << 'GH_AW_PROMPT_f614585bc9bb273b_EOF'
           <system>
-          GH_AW_PROMPT_2d537e0f4ae05d79_EOF
+          GH_AW_PROMPT_f614585bc9bb273b_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
@@ -197,12 +197,12 @@ jobs:
           cat "${RUNNER_TEMP}/gh-aw/prompts/qmd_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_2d537e0f4ae05d79_EOF'
+          cat << 'GH_AW_PROMPT_f614585bc9bb273b_EOF'
           <safe-output-tools>
           Tools: add_comment, create_pull_request, upload_asset, missing_tool, missing_data, noop
-          GH_AW_PROMPT_2d537e0f4ae05d79_EOF
+          GH_AW_PROMPT_f614585bc9bb273b_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
-          cat << 'GH_AW_PROMPT_2d537e0f4ae05d79_EOF'
+          cat << 'GH_AW_PROMPT_f614585bc9bb273b_EOF'
           
           upload_asset: provide a file path; returns a URL; assets are published after the workflow completes (safeoutputs).
           </safe-output-tools>
@@ -234,23 +234,38 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_2d537e0f4ae05d79_EOF
+          GH_AW_PROMPT_f614585bc9bb273b_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_2d537e0f4ae05d79_EOF'
+          cat << 'GH_AW_PROMPT_f614585bc9bb273b_EOF'
           </system>
-          GH_AW_PROMPT_2d537e0f4ae05d79_EOF
-          cat << 'GH_AW_PROMPT_2d537e0f4ae05d79_EOF'
+          GH_AW_PROMPT_f614585bc9bb273b_EOF
+          cat << 'GH_AW_PROMPT_f614585bc9bb273b_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
+          
+          GH_AW_PROMPT_f614585bc9bb273b_EOF
+          cat << 'GH_AW_PROMPT_f614585bc9bb273b_EOF'
           {{#runtime-import .github/workflows/shared/reporting.md}}
-          GH_AW_PROMPT_2d537e0f4ae05d79_EOF
-          cat << 'GH_AW_PROMPT_2d537e0f4ae05d79_EOF'
+          GH_AW_PROMPT_f614585bc9bb273b_EOF
+          cat << 'GH_AW_PROMPT_f614585bc9bb273b_EOF'
           {{#runtime-import .github/workflows/shared/docs-server-lifecycle.md}}
-          GH_AW_PROMPT_2d537e0f4ae05d79_EOF
-          cat << 'GH_AW_PROMPT_2d537e0f4ae05d79_EOF'
-          {{#runtime-import .github/workflows/shared/mcp/qmd-docs.md}}
-          GH_AW_PROMPT_2d537e0f4ae05d79_EOF
-          cat << 'GH_AW_PROMPT_2d537e0f4ae05d79_EOF'
+          GH_AW_PROMPT_f614585bc9bb273b_EOF
+          cat << 'GH_AW_PROMPT_f614585bc9bb273b_EOF'
           {{#runtime-import .github/workflows/unbloat-docs.md}}
-          GH_AW_PROMPT_2d537e0f4ae05d79_EOF
+          GH_AW_PROMPT_f614585bc9bb273b_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -466,12 +481,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_815bd590907de7b8_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_287bd171b304ae57_EOF'
           {"add_comment":{"max":1},"create_pull_request":{"auto_merge":true,"draft":true,"expires":48,"fallback_as_issue":false,"labels":["documentation","automation"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"reviewers":["copilot"],"title_prefix":"[docs] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"upload_asset":{"allowed-exts":[".png",".jpg",".jpeg"],"branch":"assets/${{ github.workflow }}","max-size":10240}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_815bd590907de7b8_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_287bd171b304ae57_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_6882e4174d89c62c_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_846d6c967a61486a_EOF'
           {
             "description_suffixes": {
               "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added.",
@@ -481,8 +496,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_6882e4174d89c62c_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_7e6df8d287392c6f_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_846d6c967a61486a_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_b3205209066e394e_EOF'
           {
             "add_comment": {
               "defaultMax": 1,
@@ -605,7 +620,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_7e6df8d287392c6f_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_b3205209066e394e_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -710,7 +725,7 @@ jobs:
           export GH_AW_ENGINE="claude"
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
-          cat << GH_AW_MCP_CONFIG_249bb59b60f3bd35_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_54a2d66abc8cd89a_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "github": {
@@ -787,7 +802,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_249bb59b60f3bd35_EOF
+          GH_AW_MCP_CONFIG_54a2d66abc8cd89a_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/unbloat-docs.md b/.github/workflows/unbloat-docs.md
index 8882002fb14..d2d9314e18a 100644
--- a/.github/workflows/unbloat-docs.md
+++ b/.github/workflows/unbloat-docs.md
@@ -30,7 +30,17 @@ engine:
 imports:
   - shared/reporting.md
   - shared/docs-server-lifecycle.md
-  - shared/mcp/qmd-docs.md
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: gh-aw
+          pattern: "**/*.{md,mdx}"
+          ignore:
+            - ".git/**"
+            - "node_modules/**"
+          context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
 
 # Network access for documentation best practices research
 network:
diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml
index a5b7bed795b..c44bae78962 100644
--- a/.github/workflows/weekly-blog-post-writer.lock.yml
+++ b/.github/workflows/weekly-blog-post-writer.lock.yml
@@ -24,9 +24,9 @@
 #
 # Resolved workflow manifest:
 #   Imports:
-#     - shared/mcp/qmd-docs.md
+#     - shared/qmd.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"1ec1bd56c492d19d31dccced2aeb83591f98989f6efecc30406af6397f392b38","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"1382061198922b86ee6101f998937e93453db0010cf0b123dc86e120e4e8a5c9","strict":true,"agent_id":"copilot"}
 
 name: "Weekly Blog Post Writer"
 "on":
@@ -138,9 +138,9 @@ jobs:
         run: |
           bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
           {
-          cat << 'GH_AW_PROMPT_39f33bfeb3836b36_EOF'
+          cat << 'GH_AW_PROMPT_93c675d2bfac4499_EOF'
           <system>
-          GH_AW_PROMPT_39f33bfeb3836b36_EOF
+          GH_AW_PROMPT_93c675d2bfac4499_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
@@ -148,12 +148,12 @@ jobs:
           cat "${RUNNER_TEMP}/gh-aw/prompts/agentic_workflows_guide.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/repo_memory_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_39f33bfeb3836b36_EOF'
+          cat << 'GH_AW_PROMPT_93c675d2bfac4499_EOF'
           <safe-output-tools>
           Tools: create_pull_request, missing_tool, missing_data, noop
-          GH_AW_PROMPT_39f33bfeb3836b36_EOF
+          GH_AW_PROMPT_93c675d2bfac4499_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
-          cat << 'GH_AW_PROMPT_39f33bfeb3836b36_EOF'
+          cat << 'GH_AW_PROMPT_93c675d2bfac4499_EOF'
           </safe-output-tools>
           <github-context>
           The following GitHub context information is available for this workflow:
@@ -183,17 +183,32 @@ jobs:
           {{/if}}
           </github-context>
           
-          GH_AW_PROMPT_39f33bfeb3836b36_EOF
+          GH_AW_PROMPT_93c675d2bfac4499_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_39f33bfeb3836b36_EOF'
+          cat << 'GH_AW_PROMPT_93c675d2bfac4499_EOF'
           </system>
-          GH_AW_PROMPT_39f33bfeb3836b36_EOF
-          cat << 'GH_AW_PROMPT_39f33bfeb3836b36_EOF'
-          {{#runtime-import .github/workflows/shared/mcp/qmd-docs.md}}
-          GH_AW_PROMPT_39f33bfeb3836b36_EOF
-          cat << 'GH_AW_PROMPT_39f33bfeb3836b36_EOF'
+          GH_AW_PROMPT_93c675d2bfac4499_EOF
+          cat << 'GH_AW_PROMPT_93c675d2bfac4499_EOF'
+          <qmd>
+          Use the `search` tool to find relevant documentation and content with a natural language request — it queries a local vector database built from the configured collections.
+          
+          **Always use `search` first** when you need to find, verify, or look up information:
+          - **Before using `find` or `bash` to list files** — use `search` to discover the most relevant content
+          - **Before writing new content** — search first to check whether similar content already exists
+          - **When identifying relevant files** — use it to narrow down which files cover a feature or concept
+          - **When understanding a term or concept** — query to find authoritative documentation
+          
+          **Usage tips:**
+          - Use descriptive, natural language queries: e.g., `"how to configure MCP servers"` or `"safe-outputs create-pull-request options"` or `"permissions frontmatter field"`
+          - Always read the returned file paths to get the full content — `search` returns paths only, not content
+          - Combine multiple targeted queries rather than one broad query for better coverage
+          </qmd>
+          
+          
+          GH_AW_PROMPT_93c675d2bfac4499_EOF
+          cat << 'GH_AW_PROMPT_93c675d2bfac4499_EOF'
           {{#runtime-import .github/workflows/weekly-blog-post-writer.md}}
-          GH_AW_PROMPT_39f33bfeb3836b36_EOF
+          GH_AW_PROMPT_93c675d2bfac4499_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -445,12 +460,12 @@ jobs:
           mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_ccf0e12a44583856_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_20a4730efab69306_EOF'
           {"create_pull_request":{"draft":false,"expires":168,"labels":["blog"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"reviewers":["copilot"],"title_prefix":"[blog] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":100,"max_file_size":10240,"max_patch_size":10240}]}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_ccf0e12a44583856_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_20a4730efab69306_EOF
       - name: Write Safe Outputs Tools
         run: |
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_d6db713d10f82f85_EOF'
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_7fed0e08654c8f17_EOF'
           {
             "description_suffixes": {
               "create_pull_request": " CONSTRAINTS: Maximum 1 pull request(s) can be created. Title will be prefixed with \"[blog] \". Labels [\"blog\"] will be automatically added. Reviewers [\"copilot\"] will be assigned."
@@ -458,8 +473,8 @@ jobs:
             "repo_params": {},
             "dynamic_tools": []
           }
-          GH_AW_SAFE_OUTPUTS_TOOLS_META_d6db713d10f82f85_EOF
-          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_b60742226662d97e_EOF'
+          GH_AW_SAFE_OUTPUTS_TOOLS_META_7fed0e08654c8f17_EOF
+          cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_82b7ae859a9b6242_EOF'
           {
             "create_pull_request": {
               "defaultMax": 1,
@@ -555,7 +570,7 @@ jobs:
               }
             }
           }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_b60742226662d97e_EOF
+          GH_AW_SAFE_OUTPUTS_VALIDATION_82b7ae859a9b6242_EOF
           node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
@@ -656,7 +671,7 @@ jobs:
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.8'
           
           mkdir -p /home/runner/.copilot
-          cat << GH_AW_MCP_CONFIG_764a956e95c9657e_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
+          cat << GH_AW_MCP_CONFIG_a9e9af59187f29fd_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
           {
             "mcpServers": {
               "agenticworkflows": {
@@ -731,7 +746,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_764a956e95c9657e_EOF
+          GH_AW_MCP_CONFIG_a9e9af59187f29fd_EOF
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/weekly-blog-post-writer.md b/.github/workflows/weekly-blog-post-writer.md
index 110dca4ece4..d9ea9259d25 100644
--- a/.github/workflows/weekly-blog-post-writer.md
+++ b/.github/workflows/weekly-blog-post-writer.md
@@ -30,7 +30,17 @@ tools:
     description: "Agent of the Week history – tracks which workflows have been featured so we rotate fairly"
 
 imports:
-  - shared/mcp/qmd-docs.md
+  - uses: shared/qmd.md
+    with:
+      runs-on: aw-gpu-runner-T4
+      gpu: true
+      checkouts:
+        - name: gh-aw
+          pattern: "**/*.{md,mdx}"
+          ignore:
+            - ".git/**"
+            - "node_modules/**"
+          context: "gh-aw project documentation, agent definitions, and workflow authoring instructions"
 
 safe-outputs:
   create-pull-request:
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index fa91da757e2..9cb5fa03599 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -166,6 +166,7 @@
                         },
                         {
                           "type": "array",
+                          "description": "Array value for import-schema parameters of type 'array'.",
                           "items": {
                             "oneOf": [
                               {
@@ -176,6 +177,11 @@
                               },
                               {
                                 "type": "boolean"
+                              },
+                              {
+                                "type": "object",
+                                "description": "Object element in an array import parameter.",
+                                "additionalProperties": true
                               }
                             ]
                           }
@@ -291,6 +297,7 @@
                             },
                             {
                               "type": "array",
+                              "description": "Array value for import-schema parameters of type 'array'.",
                               "items": {
                                 "oneOf": [
                                   {
@@ -301,6 +308,11 @@
                                   },
                                   {
                                     "type": "boolean"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "description": "Object element in an array import parameter.",
+                                    "additionalProperties": true
                                   }
                                 ]
                               }
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
index 3b21a9547cf..db7c45df8d4 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
@@ -54,7 +54,7 @@ jobs:
           GH_AW_INFO_STAGED: "false"
           GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
           GH_AW_INFO_FIREWALL_ENABLED: "true"
-          GH_AW_INFO_AWF_VERSION: "v0.26.0"
+          GH_AW_INFO_AWF_VERSION: "v0.25.3"
           GH_AW_INFO_AWMG_VERSION: ""
           GH_AW_INFO_FIREWALL_TYPE: "squid"
           GH_AW_COMPILED_STRICT: "true"
@@ -279,7 +279,7 @@ jobs:
       - name: Install GitHub Copilot CLI
         run: ${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh latest
       - name: Install AWF binary
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.26.0
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.3
       - name: Determine automatic lockdown mode for GitHub MCP Server
         id: determine-automatic-lockdown
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -291,7 +291,7 @@ jobs:
             const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
             await determineAutomaticLockdown(github, context, core);
       - name: Download container images
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.26.0 ghcr.io/github/gh-aw-firewall/api-proxy:0.26.0 ghcr.io/github/gh-aw-firewall/squid:0.26.0 ghcr.io/github/gh-aw-mcpg:v0.2.8 ghcr.io/github/github-mcp-server:v0.32.0
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.3 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.3 ghcr.io/github/gh-aw-firewall/squid:0.25.3 ghcr.io/github/gh-aw-mcpg:v0.2.8 ghcr.io/github/github-mcp-server:v0.32.0
       - name: Start MCP Gateway
         id: start-mcp-gateway
         env:
@@ -361,7 +361,7 @@ jobs:
           set -o pipefail
           touch /tmp/gh-aw/agent-step-summary.md
           # shellcheck disable=SC1003
-          sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --image-tag 0.26.0 --skip-pull --enable-api-proxy \
+          sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --image-tag 0.25.3 --skip-pull --enable-api-proxy \
             -- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-all-tools --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
           COPILOT_AGENT_RUNNER_TYPE: STANDALONE
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
index 398c0c028f6..bdc6e01ea5f 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
@@ -68,7 +68,7 @@ jobs:
           GH_AW_INFO_STAGED: "false"
           GH_AW_INFO_ALLOWED_DOMAINS: '["defaults","node","github","playwright"]'
           GH_AW_INFO_FIREWALL_ENABLED: "true"
-          GH_AW_INFO_AWF_VERSION: "v0.26.0"
+          GH_AW_INFO_AWF_VERSION: "v0.25.3"
           GH_AW_INFO_AWMG_VERSION: ""
           GH_AW_INFO_FIREWALL_TYPE: "squid"
           GH_AW_COMPILED_STRICT: "true"
@@ -405,7 +405,7 @@ jobs:
       - name: Install GitHub Copilot CLI
         run: ${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh latest
       - name: Install AWF binary
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.26.0
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.3
       - name: Determine automatic lockdown mode for GitHub MCP Server
         id: determine-automatic-lockdown
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -417,7 +417,7 @@ jobs:
             const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
             await determineAutomaticLockdown(github, context, core);
       - name: Download container images
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.26.0 ghcr.io/github/gh-aw-firewall/api-proxy:0.26.0 ghcr.io/github/gh-aw-firewall/squid:0.26.0 ghcr.io/github/gh-aw-mcpg:v0.2.8 ghcr.io/github/github-mcp-server:v0.32.0 ghcr.io/github/serena-mcp-server:latest mcr.microsoft.com/playwright/mcp
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.3 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.3 ghcr.io/github/gh-aw-firewall/squid:0.25.3 ghcr.io/github/gh-aw-mcpg:v0.2.8 ghcr.io/github/github-mcp-server:v0.32.0 ghcr.io/github/serena-mcp-server:latest mcr.microsoft.com/playwright/mcp
       - name: Install gh-aw extension
         env:
           GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
@@ -561,7 +561,7 @@ jobs:
           set -o pipefail
           touch /tmp/gh-aw/agent-step-summary.md
           # shellcheck disable=SC1003
-          sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --allow-domains '*.githubusercontent.com,*.jsr.io,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,cdn.jsdelivr.net,cdn.playwright.dev,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,docs.github.com,esm.sh,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,go.dev,golang.org,googleapis.deno.dev,googlechromelabs.github.io,goproxy.io,host.docker.internal,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,lfs.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pkg.go.dev,playwright.download.prss.microsoft.com,ppa.launchpad.net,proxy.golang.org,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,storage.googleapis.com,sum.golang.org,telemetry.enterprise.githubcopilot.com,telemetry.vercel.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --image-tag 0.26.0 --skip-pull --enable-api-proxy \
+          sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --allow-domains '*.githubusercontent.com,*.jsr.io,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,cdn.jsdelivr.net,cdn.playwright.dev,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,docs.github.com,esm.sh,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,go.dev,golang.org,googleapis.deno.dev,googlechromelabs.github.io,goproxy.io,host.docker.internal,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,lfs.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pkg.go.dev,playwright.download.prss.microsoft.com,ppa.launchpad.net,proxy.golang.org,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,storage.googleapis.com,sum.golang.org,telemetry.enterprise.githubcopilot.com,telemetry.vercel.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --image-tag 0.25.3 --skip-pull --enable-api-proxy \
             -- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-all-tools --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
           COPILOT_AGENT_RUNNER_TYPE: STANDALONE
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
index d2ca069ae98..49a30f99366 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
@@ -54,7 +54,7 @@ jobs:
           GH_AW_INFO_STAGED: "false"
           GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
           GH_AW_INFO_FIREWALL_ENABLED: "true"
-          GH_AW_INFO_AWF_VERSION: "v0.26.0"
+          GH_AW_INFO_AWF_VERSION: "v0.25.3"
           GH_AW_INFO_AWMG_VERSION: ""
           GH_AW_INFO_FIREWALL_TYPE: "squid"
           GH_AW_COMPILED_STRICT: "true"
@@ -282,7 +282,7 @@ jobs:
       - name: Install GitHub Copilot CLI
         run: ${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh latest
       - name: Install AWF binary
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.26.0
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.3
       - name: Determine automatic lockdown mode for GitHub MCP Server
         id: determine-automatic-lockdown
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -294,7 +294,7 @@ jobs:
             const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
             await determineAutomaticLockdown(github, context, core);
       - name: Download container images
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.26.0 ghcr.io/github/gh-aw-firewall/api-proxy:0.26.0 ghcr.io/github/gh-aw-firewall/squid:0.26.0 ghcr.io/github/gh-aw-mcpg:v0.2.8 ghcr.io/github/github-mcp-server:v0.32.0
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.3 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.3 ghcr.io/github/gh-aw-firewall/squid:0.25.3 ghcr.io/github/gh-aw-mcpg:v0.2.8 ghcr.io/github/github-mcp-server:v0.32.0
       - name: Start MCP Gateway
         id: start-mcp-gateway
         env:
@@ -364,7 +364,7 @@ jobs:
           set -o pipefail
           touch /tmp/gh-aw/agent-step-summary.md
           # shellcheck disable=SC1003
-          sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --image-tag 0.26.0 --skip-pull --enable-api-proxy \
+          sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --image-tag 0.25.3 --skip-pull --enable-api-proxy \
             -- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-all-tools --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
           COPILOT_AGENT_RUNNER_TYPE: STANDALONE
diff --git a/pkg/workflow/tools_parser.go b/pkg/workflow/tools_parser.go
index c74101a3b8e..a53efb7e04f 100644
--- a/pkg/workflow/tools_parser.go
+++ b/pkg/workflow/tools_parser.go
@@ -410,6 +410,14 @@ func parsePlaywrightTool(val any) *PlaywrightToolConfig {
 	return &PlaywrightToolConfig{}
 }
 
+// isUnexpandedImportInput reports whether s is an unexpanded import-schema placeholder
+// of the form "${{ github.aw.import-inputs.<key> }}" that was left as a literal string
+// because the caller did not supply the optional input. It returns false for any other
+// value, including legitimate GitHub Actions expressions like "${{ hashFiles('...') }}".
+func isUnexpandedImportInput(s string) bool {
+	return strings.Contains(s, "github.aw.import-inputs.")
+}
+
 // parseQmdTool converts raw qmd tool configuration to QmdToolConfig.
 // Supported fields:
 //
@@ -427,8 +435,11 @@ func parseQmdTool(val any) *QmdToolConfig {
 	if configMap, ok := val.(map[string]any); ok {
 		config := &QmdToolConfig{}
 
-		// Handle cache-key field
-		if cacheKey, ok := configMap["cache-key"].(string); ok && cacheKey != "" {
+		// Handle cache-key field. Skip values that are unexpanded import-schema placeholders
+		// (exactly "${{ github.aw.import-inputs.cache-key }}") left as literal strings when
+		// the caller does not supply the optional input. Legitimate GitHub Actions expressions
+		// such as "qmd-${{ hashFiles('docs/**') }}" are kept as-is.
+		if cacheKey, ok := configMap["cache-key"].(string); ok && cacheKey != "" && !isUnexpandedImportInput(cacheKey) {
 			config.CacheKey = cacheKey
 			toolsParserLog.Printf("qmd tool cache-key: %s", cacheKey)
 		}
@@ -441,9 +452,11 @@ func parseQmdTool(val any) *QmdToolConfig {
 			}
 		}
 
-		// Handle runs-on field (override runner image for the indexing job)
+		// Handle runs-on field (override runner image for the indexing job). Skip values that
+		// are unexpanded import-schema placeholders. Legitimate GitHub Actions expressions are
+		// kept as-is.
 		if runsOnVal, exists := configMap["runs-on"]; exists {
-			if runsOnStr, ok := runsOnVal.(string); ok && runsOnStr != "" {
+			if runsOnStr, ok := runsOnVal.(string); ok && runsOnStr != "" && !isUnexpandedImportInput(runsOnStr) {
 				config.RunsOn = runsOnStr
 				toolsParserLog.Printf("qmd tool runs-on: %s", runsOnStr)
 			}
