diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 742a125b032..3af44da06f2 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -34,12 +34,14 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/deployment-status.md`
 - `.github/aw/designer-mappings.md`
 - `.github/aw/designer.md`
+- `.github/aw/enclaves.md`
 - `.github/aw/evals.md`
 - `.github/aw/experiments.md`
 - `.github/aw/github-agentic-workflows.md`
 - `.github/aw/github-mcp-server-pagination.md`
 - `.github/aw/github-mcp-server.md`
 - `.github/aw/instructions.md`
+- `.github/aw/jobs.md`
 - `.github/aw/linter-workflows.md`
 - `.github/aw/llms.md`
 - `.github/aw/loop.md`
diff --git a/.github/workflows/agentic-auto-upgrade-pr.yml b/.github/workflows/agentic-auto-upgrade-pr.yml
new file mode 100644
index 00000000000..dd61d0be367
--- /dev/null
+++ b/.github/workflows/agentic-auto-upgrade-pr.yml
@@ -0,0 +1,138 @@
+name: Agentic Auto-Upgrade PR
+
+on:
+  schedule:
+    - cron: '17 4 * * 1' # Mondays at 04:17 UTC
+  workflow_dispatch:
+
+concurrency:
+  group: agentic-auto-upgrade-pr
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  upgrade:
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && !github.event.repository.fork
+    runs-on: ubuntu-latest
+    environment: copilot-pat-pool
+    steps:
+      - name: Checkout default branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Resolve latest stable gh-aw version
+        id: latest
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version=$(gh api repos/github/gh-aw/releases/latest --jq .tag_name)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Install latest stable gh-aw
+        uses: github/gh-aw-actions/setup-cli@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2
+        with:
+          version: ${{ steps.latest.outputs.version }}
+
+      - name: Upgrade workflows and update pull request
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          GH_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
+          GH_AW_VERSION: ${{ steps.latest.outputs.version }}
+          UPGRADE_BRANCH: automation/gh-aw-upgrade
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${GH_TOKEN:-}" ]]; then
+            echo "GH_AW_GITHUB_TOKEN must be a token that can update workflow files." >&2
+            exit 1
+          fi
+
+          gh aw upgrade
+          gh aw compile .github/workflows --validate
+
+          changed_files=$(
+            {
+              git diff --name-only
+              git ls-files --others --exclude-standard
+            } | sort -u
+          )
+          if [[ -z "$changed_files" ]]; then
+            echo "All agentic workflows already use $GH_AW_VERSION."
+            exit 0
+          fi
+
+          invalid_files=$(
+            while IFS= read -r file; do
+              case "$file" in
+                .github/agents/*|.github/aw/*|.github/skills/*|.github/workflows/*) ;;
+                *) echo "$file" ;;
+              esac
+            done <<< "$changed_files"
+          )
+          if [[ -n "$invalid_files" ]]; then
+            echo "gh aw upgrade changed files outside the approved .github paths:" >&2
+            echo "$invalid_files" >&2
+            exit 1
+          fi
+
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          git switch -c "$UPGRADE_BRANCH"
+          git add -A -- .github/agents .github/aw .github/skills .github/workflows
+          git commit -m "[ci] Upgrade gh-aw to $GH_AW_VERSION"
+
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          remote_sha=$(git ls-remote --heads origin "refs/heads/$UPGRADE_BRANCH" | cut -f1)
+          if [[ -n "$remote_sha" ]]; then
+            git push \
+              --force-with-lease="refs/heads/$UPGRADE_BRANCH:$remote_sha" \
+              origin "HEAD:refs/heads/$UPGRADE_BRANCH"
+          else
+            git push origin "HEAD:refs/heads/$UPGRADE_BRANCH"
+          fi
+
+          body_file="$RUNNER_TEMP/gh-aw-upgrade-pr.md"
+          {
+            echo "## Summary"
+            echo
+            echo "Upgrade agentic workflows to gh-aw $GH_AW_VERSION."
+            echo
+            echo "## Changed files"
+            echo
+            git show --pretty="" --name-only HEAD | sed 's/^/- `/' | sed 's/$/`/'
+            echo
+            echo "## Validation"
+            echo
+            echo "- \`gh aw upgrade\`"
+            echo "- \`gh aw compile .github/workflows --validate\`"
+          } > "$body_file"
+
+          owner="${GITHUB_REPOSITORY%%/*}"
+          pr_number=$(
+            gh api --method GET "repos/$GITHUB_REPOSITORY/pulls" \
+              -f state=open \
+              -f "head=$owner:$UPGRADE_BRANCH" \
+              --jq '.[0].number // empty'
+          )
+
+          request_file="$RUNNER_TEMP/gh-aw-upgrade-pr.json"
+          if [[ -n "$pr_number" ]]; then
+            jq -n \
+              --arg title "[ci] Upgrade gh-aw to $GH_AW_VERSION" \
+              --rawfile body "$body_file" \
+              '{title: $title, body: $body}' > "$request_file"
+            gh api --method PATCH "repos/$GITHUB_REPOSITORY/pulls/$pr_number" --input "$request_file"
+          else
+            jq -n \
+              --arg title "[ci] Upgrade gh-aw to $GH_AW_VERSION" \
+              --arg head "$UPGRADE_BRANCH" \
+              --arg base "$DEFAULT_BRANCH" \
+              --rawfile body "$body_file" \
+              '{title: $title, head: $head, base: $base, body: $body}' > "$request_file"
+            gh api --method POST "repos/$GITHUB_REPOSITORY/pulls" --input "$request_file"
+          fi
diff --git a/.github/workflows/skill-runner.lock.yml b/.github/workflows/skill-runner.lock.yml
index f80bea40330..7fb0486891d 100644
--- a/.github/workflows/skill-runner.lock.yml
+++ b/.github/workflows/skill-runner.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"e9c6519e2d8a56039f54c652a82a194740c225ce5451d31f160e14399b5f4445","body_hash":"edea8cf6a1918dd970de8697ffd104805081056d2e6dc79c9aec177b034184a7","compiler_version":"v0.86.2","strict":true,"agent_id":"copilot","agent_model":"gpt-5.6-sol","engine_versions":{"copilot":"1.0.79"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"995a062d1c892daaeeeb7f6098fbf38b2bd0aac8f7b6eab4718dd314648fb28b","body_hash":"edea8cf6a1918dd970de8697ffd104805081056d2e6dc79c9aec177b034184a7","compiler_version":"v0.86.2","strict":true,"agent_id":"copilot","agent_model":"gpt-5.6-sol","engine_versions":{"copilot":"1.0.79"}}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_PAT_0","COPILOT_PAT_1","COPILOT_PAT_2","COPILOT_PAT_3","COPILOT_PAT_4","COPILOT_PAT_5","COPILOT_PAT_6","COPILOT_PAT_7","COPILOT_PAT_8","COPILOT_PAT_9","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-dotnet","sha":"a98b56852c35b8e3190ac28c8c2271da59106c68","version":"v6.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"6aab9e5b5c91c615506061f09bedd81a23babe3c","version":"v0.86.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44","digest":"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44","digest":"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44","digest":"sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44@sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44","digest":"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.9","digest":"sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.9.0","digest":"sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e","pinned_image":"ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e"}],"has_pull_request":true}
 # This file was automatically generated by gh-aw (v0.86.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/skill-runner.md b/.github/workflows/skill-runner.md
index e29af6f5784..649c8ebd698 100644
--- a/.github/workflows/skill-runner.md
+++ b/.github/workflows/skill-runner.md
@@ -96,7 +96,7 @@ safe-outputs:
     - automated
     - skill-runner
     close-older-issues: true
-    expires: 30
+    expires: 30d
   missing-data:
     create-issue: false
   missing-tool:
diff --git a/.github/workflows/validate-pat-pool.yml b/.github/workflows/validate-pat-pool.yml
index 06a5c3d4afd..9d778af4b74 100644
--- a/.github/workflows/validate-pat-pool.yml
+++ b/.github/workflows/validate-pat-pool.yml
@@ -23,7 +23,7 @@ jobs:
         else echo "status=invalid" >> "$GITHUB_OUTPUT"; fi
     steps:
       - name: Setup gh-aw scripts
-        uses: github/gh-aw-actions/setup@ba6380cc6e5be5d21677bebe04d52fb48e3abec7 # v0.81.6
+        uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2
         with:
           destination: ${{ runner.temp }}/gh-aw/actions