diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 9840a38941a..b670dfbb32e 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -1,5 +1,6 @@
 # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2d6e82aec6fea9061e1ef1cbb085324e6ed6c079230d70bbbb96611bb18cf7cf","body_hash":"646353d7bb4e5523bc85349c2cce38188190095a303f83cc95961ff145a47043","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.70"}}
-# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"anchore/sbom-action","sha":"e22c389904149dbc22b58101806040fa8d37a610","version":"v0.24.0"},{"repo":"docker/build-push-action","sha":"53b7df96c91f9c12dcc8a07bcb9ccacbed38856a","version":"v7.3.0"},{"repo":"docker/login-action","sha":"af1e73f918a031802d376d3c8bbc3fe56130a9b0","version":"v4.4.0"},{"repo":"docker/metadata-action","sha":"dc802804100637a589fabce1cb79ff13a1411302","version":"v6.2.0"},{"repo":"docker/setup-buildx-action","sha":"bb05f3f5519dd87d3ba754cc423b652a5edd6d2c","version":"v4.2.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}# This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"anchore/sbom-action","sha":"e22c389904149dbc22b58101806040fa8d37a610","version":"v0.24.0"},{"repo":"docker/build-push-action","sha":"53b7df96c91f9c12dcc8a07bcb9ccacbed38856a","version":"v7.3.0"},{"repo":"docker/login-action","sha":"af1e73f918a031802d376d3c8bbc3fe56130a9b0","version":"v4.4.0"},{"repo":"docker/metadata-action","sha":"dc802804100637a589fabce1cb79ff13a1411302","version":"v6.2.0"},{"repo":"docker/setup-buildx-action","sha":"bb05f3f5519dd87d3ba754cc423b652a5edd6d2c","version":"v4.2.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}
+# This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
 #    ___                   _   _
 #   / _ \                 | | (_)
diff --git a/pkg/cli/doctor_command.go b/pkg/cli/doctor_command.go
index 24e0a52b114..db4789add0b 100644
--- a/pkg/cli/doctor_command.go
+++ b/pkg/cli/doctor_command.go
@@ -3,9 +3,12 @@ package cli
 import (
 	"errors"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/spf13/cobra"
 )
 
+var doctorCommandLog = logger.New("cli:doctor_command")
+
 var runDoctorSetupAuth = RunSetupAuth
 var runDoctorSetupRepositoryCheck = RunSetupRepositoryCheck
 
@@ -35,9 +38,11 @@ repository exists, resolves the owner type, and inspects checkout state.`,
 					return errors.New("--dir and --require-owner-type require --repo")
 				}
 
+				doctorCommandLog.Print("Running authentication diagnostics (no --repo provided)")
 				return runDoctorSetupAuth(SetupAuthOptions{Ctx: cmd.Context(), JSON: jsonOutput})
 			}
 
+			doctorCommandLog.Printf("Running repository diagnostics for %q (require-owner-type=%q)", repo, requireOwnerType)
 			return runDoctorSetupRepositoryCheck(SetupRepositoryCheckOptions{
 				Ctx:              cmd.Context(),
 				Repo:             repo,
diff --git a/pkg/workflow/compiler_yaml_normalize.go b/pkg/workflow/compiler_yaml_normalize.go
index 171061db704..5f80a60daba 100644
--- a/pkg/workflow/compiler_yaml_normalize.go
+++ b/pkg/workflow/compiler_yaml_normalize.go
@@ -1,6 +1,12 @@
 package workflow
 
-import "strings"
+import (
+	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
+)
+
+var compilerYAMLNormalizeLog = logger.New("workflow:compiler_yaml_normalize")
 
 // maxConsecutiveBlankLines is the largest run of blank lines allowed in the
 // normalized YAML. yamllint's empty-lines rule flags more than two consecutive
@@ -22,6 +28,7 @@ const maxConsecutiveBlankLines = 2
 // This implementation avoids strings.Split/strings.Join to reduce allocations: it scans
 // the input byte-by-byte and builds the result with a single pre-allocated strings.Builder.
 func normalizeBlankLines(yamlContent string) string {
+	compilerYAMLNormalizeLog.Printf("Normalizing blank lines in %d bytes of YAML", len(yamlContent))
 	var b strings.Builder
 	b.Grow(len(yamlContent))
 
@@ -118,11 +125,13 @@ func normalizeBlankLines(yamlContent string) string {
 	// the original strings.TrimRight(…, "\n") + "\n" behaviour for that case.
 	// NOTE: b.String()[:0] must NOT be used here; the early return is intentional.
 	if lastNonBlankEnd == 0 {
+		compilerYAMLNormalizeLog.Print("Input contained no non-blank lines, returning single newline")
 		return "\n"
 	}
 	// Slice the builder string to drop trailing blank lines. b.String() copies
 	// the builder's internal buffer into a new string once; the slice avoids a
 	// second copy that a separate strings.Builder trim would incur.
+	compilerYAMLNormalizeLog.Printf("Normalized YAML to %d bytes", lastNonBlankEnd)
 	return b.String()[:lastNonBlankEnd]
 }
 
diff --git a/pkg/workflow/compiler_yaml_policy.go b/pkg/workflow/compiler_yaml_policy.go
index 41a44b193da..4bee0b2dcc2 100644
--- a/pkg/workflow/compiler_yaml_policy.go
+++ b/pkg/workflow/compiler_yaml_policy.go
@@ -1,5 +1,9 @@
 package workflow
 
+import "github.com/github/gh-aw/pkg/logger"
+
+var compilerYAMLPolicyLog = logger.New("workflow:compiler_yaml_policy")
+
 // effectiveStrictMode computes the effective strict mode for a workflow.
 // Priority: CLI flag (c.strictMode) > frontmatter strict field > default (true).
 // This should be used when emitting metadata/env vars to correctly reflect the
@@ -7,14 +11,17 @@ package workflow
 func (c *Compiler) effectiveStrictMode(frontmatter map[string]any) bool {
 	if c.strictMode {
 		// CLI flag takes precedence
+		compilerYAMLPolicyLog.Print("Strict mode enabled by CLI flag")
 		return true
 	}
 	if strictVal, exists := frontmatter["strict"]; exists {
 		if strictBool, ok := strictVal.(bool); ok {
+			compilerYAMLPolicyLog.Printf("Strict mode resolved from frontmatter strict field: %v", strictBool)
 			return strictBool
 		}
 	}
 	// Default: strict mode is on when no explicit setting
+	compilerYAMLPolicyLog.Print("Strict mode defaulting to true (no explicit setting)")
 	return true
 }
 
@@ -25,6 +32,7 @@ func (c *Compiler) effectiveStrictMode(frontmatter map[string]any) bool {
 // to approve all changes.
 func (c *Compiler) effectiveSafeUpdate(data *WorkflowData) bool {
 	if c.approve {
+		compilerYAMLPolicyLog.Print("Safe update disabled: --approve flag set")
 		return false
 	}
 	return c.effectiveStrictMode(data.RawFrontmatter)
diff --git a/pkg/workflow/frontmatter_trigger_helpers.go b/pkg/workflow/frontmatter_trigger_helpers.go
index 56efd4b678d..991c9edf70e 100644
--- a/pkg/workflow/frontmatter_trigger_helpers.go
+++ b/pkg/workflow/frontmatter_trigger_helpers.go
@@ -4,8 +4,12 @@ import (
 	"fmt"
 	"slices"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
+var frontmatterTriggerLog = logger.New("workflow:frontmatter_trigger_helpers")
+
 // extractOnTriggerValue returns the raw value for on.<trigger> when the frontmatter
 // contains an "on" map with that trigger configured.
 func extractOnTriggerValue(frontmatter map[string]any, trigger string) (any, bool) {
@@ -76,8 +80,10 @@ func extractDeploymentStatusStateCondition(frontmatter map[string]any) (string,
 		return "", nil
 	}
 
+	frontmatterTriggerLog.Printf("Building deployment_status state condition from %d state value(s)", len(states))
 	for _, s := range states {
 		if !isValidDeploymentStatusState(s) {
+			frontmatterTriggerLog.Printf("Rejecting invalid on.deployment_status.state value %q", s)
 			return "", fmt.Errorf("invalid on.deployment_status.state value %q: must be one of %s",
 				s, strings.Join(validDeploymentStatusStates, ", "))
 		}
@@ -134,8 +140,10 @@ func extractWorkflowRunConclusionCondition(frontmatter map[string]any) (string,
 		return "", nil
 	}
 
+	frontmatterTriggerLog.Printf("Building workflow_run conclusion condition from %d conclusion value(s)", len(conclusions))
 	for _, c := range conclusions {
 		if !isValidWorkflowRunConclusion(c) {
+			frontmatterTriggerLog.Printf("Rejecting invalid on.workflow_run.conclusion value %q", c)
 			return "", fmt.Errorf("invalid on.workflow_run.conclusion value %q: must be one of %s",
 				c, strings.Join(validWorkflowRunConclusions, ", "))
 		}
