Designer Drift AuditMissing mappings and outdated designer guidance #67100

1. Missing Trigger Mapping

• Source: .github/aw/triggers.md, “Standard GitHub Events”.
• Missing from: Both — SKILL.md (the supplied outline actually represents .github/aw/designer.md, using .github/aw/designer-mappings.md) and .github/agents/interactive-agent-designer.agent.md.
• Details: push appears in the reference but has no designer trigger-table row and is absent from the agent's trigger examples. The agent additionally omits slash_command, label_command, deployment_status, and workflow_run, without linking to the shared trigger mapping.
• Suggested fix: Add a push/branch-filter row and route the agent's workflow-configuration flow to the shared mapping and trigger reference.

2. Missing Safe Output Operations

• Source: .github/aw/safe-outputs.md → .github/aw/safe-outputs-automation.md; /tmp/gh-aw/data/all-safe-output-types.txt, checked against pkg/workflow/safe_output_handlers.go and pkg/workflow/safe_outputs_validation_config.go.
• Missing from: Both.
• Details: Shared mappings omit approve-workflow-run, call-workflow, ado-upload-workitem-attachment, and upload-code-coverage. The reference also documents dispatch-repository, which is absent from the mapping. The agent lists only three example outputs and provides no route to the complete mapping.
• Suggested fix: Add concrete intent-to-operation rows, distinguish reusable-workflow calls from workflow dispatch and repository dispatch, and link the agent to the shared output guidance.

3. Missing Ledger Tool Guidance

• Source: /tmp/gh-aw/data/all-safe-output-types.txt; pkg/workflow/safe_outputs_validation_config.go and pkg/workflow/safe_outputs_config_generation.go.
• Missing from: Both.
• Details: Registered ledger_append, ledger_request_compaction, and ledger_mutation have no designer guidance. These are not ordinary hyphenated safe-output declarations: the ledger runtime/configuration enables them. push_repo_memory is also absent by literal name, but the existing repo-memory mapping covers its purpose, so it is not counted as a separate missing capability.
• Suggested fix: Add a ledger/state-persistence route explaining the enabling configuration and distinguish agent-callable operations from runtime audit ingestion; do not mechanically invent safe-outputs keys from tool names.

4. Incomplete Network Mapping

• Source: .github/aw/network.md, “Ecosystem Identifiers” and “Engine Domain Sets”.
• Missing from: Both, at the explicit mapping level.
• Details: The shared mapping explicitly routes uncommon language/package ecosystems to the reference, which covers those cases through progressive disclosure. It does not explain the listed identifiers copilot-vendor, copilot, claude, codex, gemini, pi, pi-base, and threat-detection. The agent provides no ecosystem table or reference route at all. These identifiers remain discoverable through the skill's general network reference; this is a mapping gap, not proof that generation cannot support them.
• Suggested fix: Add an engine-domain-set reference row explaining automatic transport domains and when explicit selection is appropriate; route the agent to it. Preserve scoped network defaults.

5. Missing Agent Tool-Mode Guidance

• Source: .github/aw/syntax.md → .github/aw/syntax-tools-imports.md; .github/aw/token-optimization.md.
• Missing from: Agent file.
• Details: The agent does not describe tools.github.mode: gh-proxy, mode: local, or tools.cli-proxy: true, and has no link to their reference. Its optimization section also omits the documented DataOps and smaller-model sub-agent defaults. The shared designer mapping correctly covers all three supported modes; remote is explicitly discouraged by the reference and is not a missing supported mode.
• Suggested fix: Delegate workflow tool selection and optimization to the shared designer/reference guidance, including the preferred GitHub read mode and bounded data preparation.

6. Frontmatter Generation Coverage Gaps

• Source: .github/aw/syntax.md → .github/aw/syntax-core.md and .github/aw/syntax-agentic.md.
• Missing from: Both, with the template gap in SKILL.md/.github/aw/designer.md.
• Details: The generation template lacks optional branches for current cost/model controls (model, max-turns, max-ai-credits, max-turn-cache-misses, models, max-daily-ai-credits, user-rate-limit), runner/execution controls (runs-on, runs-on-slim, runner, timeout-minutes, concurrency), and reusable/setup configuration (imports, inlined-imports, import-schema, pre-steps, pre-agent-steps, post-steps). These fields are also absent from the agent's configuration guidance. Other schema fields absent from the template include strict, source, labels, metadata, experiments, mcp-servers, checkout, jobs, runtimes, observability, resources, env, secrets, github-app, excluded-env, if, run-name, name, environment, container, and services. The skill does discuss env/secrets and engine choice outside the skeleton; omission from the skeleton alone does not make generated workflows invalid. The supplied history cannot establish when these fields were introduced.
• Suggested fix: Add conditional generation/checklist routes for relevant schema fields, prioritizing budgets, reusable workflows, and setup ordering. Keep optional fields and defaults out of generated files unless needed; do not expand every skeleton into the entire schema.

7. Pattern Recommendations Disagree With Router

• Source: .github/aw/patterns.md.
• Missing from: Both; incorrect rows are in the skill's .github/aw/designer-mappings.md, while the agent has no named-pattern route.
• Details: CorrectionOps is mapped to retry-on-failure, but the router describes learning from trusted human corrections. DeterministicOps is mapped to “no LLM needed,” but the router specifies deterministic collection followed by agentic analysis. Orchestration is mapped to multiple sub-agents, while the router describes reusable-workflow/dispatch workers. SpecOps is mapped to writing a spec before implementation, while the router describes maintaining specs and propagating updates. TrialOps is mapped to A/B variants, while the router describes isolated trial repositories. The new “Git-backed Work Queue” route lacks a dedicated row; it is nevertheless reachable through the skill's patterns reference, so this is a discoverability gap rather than an unreachable pattern.
• Suggested fix: Align those five rows with the router, add a native Work/Claims queue row distinct from lightweight WorkQueueOps, and have the agent load the router for architecture requests.

8. Stale Agent Configuration and Write Guidance

• Source: .github/aw/syntax-agentic.md (cache-memory), .github/aw/syntax-tools-imports.md (read-only GitHub MCP), .github/aw/create-agentic-workflow.md (read-only permissions and safe outputs).
• Missing from: Agent file — updated guidance.
• Details: The agent lists cache-memory: alongside top-level frontmatter fields without saying it belongs under tools:. It recommends permissions: read-all rather than the reference's scoped read permissions, says to use safe outputs instead of writes “when possible,” and its example lists GitHub write tools add_issue_comment/update_issue although the reference says the GitHub MCP server always runs read-only.
• Suggested fix: Show tools.cache-memory, use scoped read permissions, require safe outputs for visible writes, and update the example to separate GitHub reads from configured safe-output operations.

9. Stale Safe Output Mapping Descriptions

• Source: .github/aw/safe-outputs-content.md (comment-memory), .github/aw/safe-outputs-automation.md (upload-asset, noop), .github/aw/create-agentic-workflow.md.
• Missing from: SKILL.md/shared mappings — corrected descriptions.
• Details: The mapping sends “upload release asset” to upload-asset, whereas the reference describes publishing files to an orphaned git branch for stable embeddable URLs. It places comment-memory in the safe-output table without the reference's explicit “configured under tools” qualification. It also says “noop is still called automatically,” conflating automatic tool enablement with the prompt's obligation to call it.
• Suggested fix: Describe upload-asset accurately, label memory configuration locations, and say that noop is auto-enabled but must be explicitly called when no action is needed.