fix(workflows): make backlog grooming resilient to malformed model output

.github/agents/agentic-workflows.agent.md

@@ -30,7 +30,7 @@ Workflows may optionally include:
 - Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
 - Workflow lock files: `.github/workflows/*.lock.yml`
 - Shared components: `.github/workflows/shared/*.md`
-- Configuration: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/github-agentic-workflows.md
+- Configuration: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/github-agentic-workflows.md
 
 ## Problems This Solves
 
@@ -52,7 +52,7 @@ When you interact with this agent, it will:
 ### Create New Workflow
 **Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/create-agentic-workflow.md
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/create-agentic-workflow.md
 
 **Use cases**:
 - "Create a workflow that triages issues"
@@ -62,7 +62,7 @@ When you interact with this agent, it will:
 ### Update Existing Workflow  
 **Load when**: User wants to modify, improve, or refactor an existing workflow
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/update-agentic-workflow.md
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/update-agentic-workflow.md
 
 **Use cases**:
 - "Add web-fetch tool to the issue-classifier workflow"
@@ -72,7 +72,7 @@ When you interact with this agent, it will:
 ### Debug Workflow  
 **Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/debug-agentic-workflow.md
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/debug-agentic-workflow.md
 
 **Use cases**:
 - "Why is this workflow failing?"
@@ -82,7 +82,7 @@ When you interact with this agent, it will:
 ### Upgrade Agentic Workflows
 **Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/upgrade-agentic-workflows.md
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/upgrade-agentic-workflows.md
 
 **Use cases**:
 - "Upgrade all workflows to the latest version"
@@ -92,7 +92,7 @@ When you interact with this agent, it will:
 ### Create a Report-Generating Workflow
 **Load when**: The workflow being created or updated produces reports — recurring status updates, audit summaries, analyses, or any structured output posted as a GitHub issue, discussion, or comment
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/report.md
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/report.md
 
 **Use cases**:
 - "Create a weekly CI health report"
@@ -102,7 +102,7 @@ When you interact with this agent, it will:
 ### Create Shared Agentic Workflow
 **Load when**: User wants to create a reusable workflow component or wrap an MCP server
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/create-shared-agentic-workflow.md
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/create-shared-agentic-workflow.md
 
 **Use cases**:
 - "Create a shared component for Notion integration"
@@ -112,7 +112,7 @@ When you interact with this agent, it will:
 ### Fix Dependabot PRs
 **Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`)
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/dependabot.md
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/dependabot.md
 
 **Use cases**:
 - "Fix the open Dependabot PRs for npm dependencies"
@@ -122,7 +122,7 @@ When you interact with this agent, it will:
 ### Analyze Test Coverage
 **Load when**: The workflow reads, analyzes, or reports test coverage — whether triggered by a PR, a schedule, or a slash command. Always consult this prompt before designing the coverage data strategy.
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/test-coverage.md
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/test-coverage.md
 
 **Use cases**:
 - "Create a workflow that comments coverage on PRs"
@@ -133,23 +133,28 @@ When you interact with this agent, it will:
 
 When a user interacts with you:
 
-1. **Identify the task type** from the user's request
-2. **Load the appropriate prompt** from the GitHub repository URLs listed above
-3. **Follow the loaded prompt's instructions** exactly
-4. **If uncertain**, ask clarifying questions to determine the right prompt
+1. **Verify the tool version** with `gh aw --version`. Use the v0.86.2 references in this agent when the installed version matches. If it does not match, report the mismatch before applying version-specific guidance.
+2. **Identify the task type** from the user's request.
+3. **Load the appropriate prompt** from the GitHub repository URLs listed above.
+4. **Edit canonical sources** in `.github/workflows/*.md`. Never hand-edit a generated `.lock.yml` file. Compile each changed workflow with `gh aw compile <workflow-name>` and validate the generated lock.
+5. **Preserve safe-output boundaries** whenever a created, updated, or debugged workflow declares or uses safe outputs. Keep permissions minimal, verify declared schemas and call limits, and inspect trusted post-processing rather than relying on prompt wording alone.
+6. **Audit runtime behavior** with `gh aw audit <run-id-or-url> --parse` when run evidence is available. Check safe-output calls, artifacts, and logs before concluding that a workflow contract passed. When run evidence is unavailable, report that runtime behavior is not validated and do not claim a runtime pass.
+7. **Confirm risky actions** immediately before any destructive, hard-to-reverse, shared-system, or externally visible action. Read-only inspection, local drafting, compilation, and validation do not require confirmation.
+8. **Follow the loaded prompt's instructions** exactly.
+9. **If uncertain**, ask clarifying questions to determine the right prompt.
 
 ## Quick Reference
 
 ```bash
 # Initialize repository for agentic workflows
 gh aw init
 
-# Generate the lock file for a workflow
-gh aw compile [workflow-name]
+# Generate and validate the lock file for a workflow
+gh aw compile [workflow-name] --validate
 
 # Debug workflow runs
 gh aw logs [workflow-name]
-gh aw audit <run-id>
+gh aw audit <run-id-or-url> --parse
 
 # Upgrade workflows
 gh aw fix --write
@@ -169,7 +174,7 @@ gh aw compile --validate
 
 ## Important Notes
 
-- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.63.1/.github/aw/github-agentic-workflows.md for complete documentation
+- Reference the v0.86.2 instructions at https://github.com/github/gh-aw/blob/v0.86.2/.github/aw/github-agentic-workflows.md for complete documentation
 - Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
 - Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
 - **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF

.github/agents/backlog-grooming.agent.md

@@ -37,8 +37,11 @@ structured JSON for deterministic validation and immutable result publication.
   with cited paths, issue or pull-request numbers, commits, or releases.
 * Include one result row for every selected issue, including no-change and
   deferred outcomes.
-* Record the stop reason and set the report cursor to the last assessed issue,
-  or retain the caller-supplied previous cursor when no issue was assessed.
+* Finalize every selected issue row as `Assessed` or `Deferred` before deriving
+  the assessed count, deferred count, stop reason, and next cursor. Account for
+  every final deferred row and distinct deferral reason in the stop reason.
+* Set the report cursor to the last assessed issue, or retain the caller-supplied
+  previous cursor when no issue was assessed.
 * Keep sensitive issue details out of the report.
 
 ## Stop Rules
@@ -81,7 +84,8 @@ state.
    implementation, supersession, duplication, or intentional-removal evidence.
    Follow explicit links between issues, pull requests, and commits.
    For `Superseded`, record both the original surface's delivery lineage and its
-   removal or replacement lineage when both are available.
+  removal or replacement lineage. Select `Superseded` only when both lineage
+  arrays can contain non-empty, distinct evidence; otherwise use `Uncertain`.
 6. Inspect relevant commits or releases when pull-request or issue linkage does
    not establish the current state. Use `Uncertain` when required repository
    evidence is unavailable, conflicting, or too weak to support a disposition.
@@ -90,7 +94,9 @@ state.
    corroborate the extracted acceptance signals.
 7. Assess possible overlap and apply exactly one qualitative similarity outcome
    plus one repository-grounded disposition to every deeply assessed issue.
-8. Record deferred issues, stop reason, and the next cursor.
+8. Finalize every selected issue row as `Assessed` or `Deferred`. Preserve a
+  non-empty reason on every deferred row; the isolated result job derives all
+  structural run state from the validated final rows and trusted caller input.
 9. Render the compact report and request one validated shard result after
    every successful assessment. Request `noop` only when the assessment cannot
    complete according to the calling workflow.
@@ -102,21 +108,12 @@ shared policy. Include the run timestamp, total open inventory, assessed count,
 priority cohort count, round-robin cohort count, deferred count, stop reason,
 and next cursor in a short labeled run summary before the issue index.
 
-For shard-result publication, encode the same report as JSON with exactly `run`
-and `issues` and use this exact schema:
+For shard-result publication, encode the final rows as JSON with exactly
+`issues` and use this exact schema. Do not include the display summary or a
+`run` object in the publication input:
 
 ```json
 {
-  "run": {
-    "timestamp": "RFC 3339 timestamp",
-    "total_open_inventory": 0,
-    "assessed": 0,
-    "priority_cohort": 0,
-    "round_robin_cohort": 0,
-    "deferred": 0,
-    "stop_reason": "non-empty text",
-    "next_cursor": 0
-  },
   "issues": [
     {
       "issue": 1,
@@ -140,7 +137,7 @@ and `issues` and use this exact schema:
 }
 ```
 
-Use integers without `#` or prose for `issue`, `next_cursor`, and every count.
+Use an integer without `#` or prose for `issue`.
 Use exactly `Match`, `Similar`, `Distinct`, or `Uncertain` for
 `similarity_outcome`; put compared issue numbers in the finding rather than the
 enum value. Use exactly `Still needed`, `Likely completed`, `Superseded`,

.github/instructions/project-planning/github-backlog-grooming.instructions.md

@@ -107,9 +107,10 @@ Assign exactly one repository-grounded disposition:
    establishes how it was delivered.
 * `Superseded`: current repository evidence shows the named surface was removed,
    replaced, or intentionally abandoned, and identifies the replacement or
-   decision history. When repository history contains both, cite the original
-   surface's delivery issue or pull request and the later removal or replacement
-   issue or pull request so the evidence chain establishes both states.
+   decision history. Select `Superseded` only when repository history establishes
+   both states: cite the original surface's delivery issue or pull request and
+   the later removal or replacement issue or pull request. If either state cannot
+   be established with distinct evidence, use `Uncertain`.
 * `Possible duplicate`: the similarity outcome is `Match` or `Similar`, another
    open or closed issue requests the same outcome, and repository history does
    not establish a distinct remaining need. Treat this as a maintainer decision,
@@ -128,9 +129,11 @@ maintainer actions.
 
 ## Advisory Report
 
-Start with a short summary that states the assessment scope, inventory count,
-assessed count, deferred count, and stop reason. Follow it with this compact
-issue index:
+Finalize one row for every selected issue as `Assessed` or `Deferred` before
+deriving the summary. Calculate the assessed and deferred counts from those
+final statuses. Derive the stop reason from the complete set of final deferred
+rows and account for every distinct deferral reason without requiring an
+issue-by-issue list. Follow the summary with this compact issue index:
 
 | Issue | Similarity | Disposition | Status | Recommended next step |
 |-------|------------|-------------|--------|-----------------------|

.github/workflows/README.md

@@ -2,7 +2,7 @@
 title: GitHub Actions Workflows
 description: Modular CI/CD workflow architecture for validation, security scanning, and automated maintenance
 author: HVE Core Team
-ms.date: 2026-09-04
+ms.date: 2026-09-10
 ms.topic: reference
 keywords:
   - github actions
@@ -240,8 +240,8 @@ protocol; operators leave the continuation fields at their defaults when
 initiating a sweep. The coordinator passes only artifact identities, digests,
 run identities, the sweep identity, and the next wave number between runs.
 Candidate issue IDs remain inside retained artifacts. Production executes
-`scripts/security/Invoke-BacklogGroomWaveValidator.ps1` before checkpoint
-creation.
+`scripts/agentic-workflows/backlog-grooming/Invoke-BacklogGroomWaveValidator.ps1`
+before checkpoint creation.
 
 ### Production inputs