Merge branch 'main' into copilot/fix-retry-loop-token-drain

Author: github-actions[bot]

.changeset/patch-fix-aic-usage-cache.md

@@ -122,7 +122,7 @@ First-class output is a **metric** and an **interpretation**. Make KPI computati
 
 ### Cross-repo coordination
 
-- `safe-outputs.dispatch-workflow` is same-repo only.
+- `safe-outputs.dispatch-workflow` is same-repo by default; cross-repo dispatch needs `target-repo` plus an `allowed-repos` allowlist and a token with `actions: write` on the target.
 - For org-wide/multi-org, use a coordinator sending `repository_dispatch` to each target repo.
   - Requires PAT or GitHub App token with access to every dispatched repo.
   - Prefer fine-grained PAT scoped to specific repos with `Actions: Read & Write`.

.github/aw/campaign.md

@@ -68,9 +68,12 @@ description: Safe-output reference for workflow dispatch, code scanning, checks,
     dispatch-workflow:
       workflows: [workflow-name]          # Required: list of workflow names to allow
       max: 3                              # Optional: max dispatches (default: 1, max: 3)
+      target-repo: org/other-repo         # Optional: cross-repo dispatch target (owner/repo or expression)
+      allowed-repos: [org/*]              # Optional: allowlist for cross-repo dispatch targets
+      target-ref: main                    # Optional: ref to dispatch against (overrides caller's GITHUB_REF)
   ```
 
-  Triggers other agentic workflows in the same repository using workflow_dispatch. Agent output includes `workflow_name` (without .md extension) and optional `inputs` (key-value pairs). Not supported for cross-repository operations.
+  Triggers other agentic workflows using workflow_dispatch. Agent output includes `workflow_name` (without .md extension) and optional `inputs` (key-value pairs). Cross-repo dispatch is supported via `target-repo` plus an `allowed-repos` allowlist; cross-repo targets require a token with `actions: write` on the target repository.
 - `dispatch_repository:` - Dispatch `repository_dispatch` events to external repositories (experimental)
 
   ```yaml

.github/aw/safe-outputs-automation.md

@@ -125,7 +125,7 @@ description: Safe-output reference for issue, discussion, comment, and pull requ
       required-title-prefix: "[bot]" # Optional: issue/PR title must start with this prefix
       hide-older-comments: true       # Optional: minimize previous comments from same workflow
       allowed-reasons: [outdated]     # Optional: restrict hiding reasons (default: outdated)
-      discussions: true               # Optional: set false to exclude discussions:write permission (default: true)
+      discussions: true               # Optional: opt-in to discussions:write permission for discussion comments/replies (default: false)
       issues: true                    # Optional: set false to exclude issues:write permission (default: true)
       pull-requests: true             # Optional: set false to exclude pull-requests:write permission (default: true)
       footer: true                    # Optional: when false, omits visible footer but preserves XML markers (default: true)

.github/aw/safe-outputs-content.md

@@ -14,6 +14,7 @@ Apply these in order — each check can halve costs:
 - [ ] **gh-proxy**: Set `tools.github.mode: gh-proxy` — skips Docker MCP server startup and extra tool definitions
 - [ ] **cli-proxy**: Mount additional MCP servers as CLIs via `cli-proxy: true` — agent pipes output through `jq` before it enters context
 - [ ] **Sub-agents**: Delegate repetitive per-item tasks to `model: small` sub-agents (~10–20× cheaper)
+- [ ] **Sub-skills**: Keep the main prompt as a short execution plan; move detailed playbooks/output layouts into `## skill:` blocks the agent invokes only when needed
 - [ ] **Prompt size**: Strip redundant instructions, examples, and pleasantries from the prompt body
 - [ ] **Dynamic context**: Inject only required fields — `${{ github.event.issue.number }}` not the full event payload
 - [ ] **Pull context on demand**: query logs/data only after a hypothesis forms; avoid preloading large raw dumps into the initial prompt
@@ -264,6 +265,16 @@ Nothing else.
 
 **Why this saves tokens:** sub-agents run on the cheap `small` model; the main agent only reads compact `{"number":…, "category":…}` JSON; sub-agent dispatches can run in parallel.
 
+### Pair sub-agents with sub-skills (progressive disclosure)
+
+Use sub-skills as progressive disclosure for instruction-heavy tasks:
+
+- Keep the main prompt short and plan-like (what to do, in what order).
+- Put verbose instructions (report layout, rubric details, long formatting constraints) into `## skill:` blocks.
+- Invoke those skills only at the moment they are needed (for example, when producing final output), so early planning/execution turns stay lean.
+
+This pattern lowers ambient context and usually improves both latency and AIC by delaying expensive instruction payloads until the final phase.
+
 **Sub-agent model aliases:**
 
 | Alias | Use when |