diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml
index 3323acb6068..00ce050e4cd 100644
--- a/.github/workflows/contribution-check.lock.yml
+++ b/.github/workflows/contribution-check.lock.yml
@@ -21,7 +21,7 @@
 # For more information: https://github.github.com/gh-aw/introduction/overview/
 #
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"a483a637eae7d8a0f5a045245c6f5d72ec408dd470865a2cd889122b1ac18680","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"f065feb7ad239a734f6def6a44417a260407d25d6d0fb58e829e44ca32ef065c","strict":true,"agent_id":"copilot"}
 
 name: "Contribution Check"
 "on":
diff --git a/.github/workflows/contribution-check.md b/.github/workflows/contribution-check.md
index 09da9119f85..d0133c81299 100644
--- a/.github/workflows/contribution-check.md
+++ b/.github/workflows/contribution-check.md
@@ -15,7 +15,7 @@ env:
 tools:
   github:
     toolsets: [default]
-    repos: all
+    allowed-repos: all
     min-integrity: none
 safe-outputs:
   create-issue:
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index 2d02c715e3b..30751e894ea 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -22,7 +22,7 @@
 #
 # Generates project plans and task breakdowns when invoked with /plan command in issues or PRs
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"84959bfbc2abf6ea65661e0164519d62d375c38bff49f43d702c29cc56f98af0","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"2ef6d836d569a09b7c2504cf554ca69cee43f7433fc3aa8ebc52dd31170815bd","strict":true,"agent_id":"copilot"}
 
 name: "Plan Command"
 "on":
diff --git a/.github/workflows/plan.md b/.github/workflows/plan.md
index 4ae7615277b..72f33079672 100644
--- a/.github/workflows/plan.md
+++ b/.github/workflows/plan.md
@@ -14,7 +14,7 @@ engine: copilot
 tools:
   github:
     toolsets: [default, discussions]
-    repos: all
+    allowed-repos: all
     min-integrity: none
 safe-outputs:
   create-issue:
@@ -140,4 +140,4 @@ Review instructions in `.github/instructions/*.instructions.md` if you need guid
 
 ```json
 {"noop": {"message": "No action needed: [brief explanation of what was analyzed and why]"}}
-```
+```
\ No newline at end of file
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index 1a18dbda2a3..3315121413d 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -32,7 +32,7 @@
 #     - shared/mcp/tavily.md
 #     - shared/reporting.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"1257d91a7cbfe146dbfc43fb7b731d709fe84bfc4622da42ad1cf548a7f04428","strict":true,"agent_id":"claude"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"d7458e2989c491a13fe05cbc974ba27fdbe84ba4c087d2f27c84ce54abb9771e","strict":true,"agent_id":"claude"}
 
 name: "Scout"
 "on":
diff --git a/.github/workflows/scout.md b/.github/workflows/scout.md
index 5e63626e253..0e0cf3b0eb6 100644
--- a/.github/workflows/scout.md
+++ b/.github/workflows/scout.md
@@ -35,7 +35,7 @@ tools:
   edit:
   cache-memory: true
   github:
-    repos: all
+    allowed-repos: all
     min-integrity: none
 safe-outputs:
   add-comment:
@@ -222,4 +222,4 @@ Remember: Your goal is to provide valuable, actionable intelligence that helps r
 
 ```json
 {"noop": {"message": "No action needed: [brief explanation of what was analyzed and why]"}}
-```
+```
\ No newline at end of file
diff --git a/.github/workflows/smoke-agent-all-merged.lock.yml b/.github/workflows/smoke-agent-all-merged.lock.yml
index 541d2d19fc8..381e1bc33ae 100644
--- a/.github/workflows/smoke-agent-all-merged.lock.yml
+++ b/.github/workflows/smoke-agent-all-merged.lock.yml
@@ -22,7 +22,7 @@
 #
 # Guard policy smoke test: repos=all, min-integrity=merged (most restrictive)
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"e3acfb90c523ed41aff2574700873d4ff6fca754fce908743a5b8157de83596a","strict":true,"agent_id":"codex"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"bbd91d7cb3316403403189cfafb70b4578c3f66fcdd53247a3eeb1798d0f9da5","strict":true,"agent_id":"codex"}
 
 name: "Smoke Agent: all/merged"
 "on":
diff --git a/.github/workflows/smoke-agent-all-merged.md b/.github/workflows/smoke-agent-all-merged.md
index f9993df7607..f578888c3ac 100644
--- a/.github/workflows/smoke-agent-all-merged.md
+++ b/.github/workflows/smoke-agent-all-merged.md
@@ -16,7 +16,7 @@ strict: true
 tools:
   github:
     mode: local
-    repos: "all"
+    allowed-repos: "all"
     min-integrity: merged
 network:
   allowed:
@@ -86,4 +86,4 @@ Use the `add_comment` safe-output tool to post a summary to the current PR:
 }
 ```
 
-If there is no PR context, use the `noop` tool to report the results summary.
+If there is no PR context, use the `noop` tool to report the results summary.
\ No newline at end of file
diff --git a/.github/workflows/smoke-agent-all-none.lock.yml b/.github/workflows/smoke-agent-all-none.lock.yml
index 6df5e3ec6b8..8adbcaf4428 100644
--- a/.github/workflows/smoke-agent-all-none.lock.yml
+++ b/.github/workflows/smoke-agent-all-none.lock.yml
@@ -22,7 +22,7 @@
 #
 # Guard policy smoke test: repos=all, min-integrity=none (most permissive)
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"8456baa1448783534cbadceb33b0a2573cad268e2f9770dbd94a5f8ffa6c5359","strict":true,"agent_id":"codex"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"3f9db3848c2cb24db426b7476702b3fa72282f69fbf94e1d4aa1bce7f415d7b6","strict":true,"agent_id":"codex"}
 
 name: "Smoke Agent: all/none"
 "on":
diff --git a/.github/workflows/smoke-agent-all-none.md b/.github/workflows/smoke-agent-all-none.md
index a0cc9ae773b..12387a49304 100644
--- a/.github/workflows/smoke-agent-all-none.md
+++ b/.github/workflows/smoke-agent-all-none.md
@@ -16,7 +16,7 @@ strict: true
 tools:
   github:
     mode: local
-    repos: "all"
+    allowed-repos: "all"
     min-integrity: none
 network:
   allowed:
@@ -81,4 +81,4 @@ Use the `add_comment` safe-output tool to post a summary to the current PR:
 }
 ```
 
-If there is no PR context, use the `noop` tool to report the results summary.
+If there is no PR context, use the `noop` tool to report the results summary.
\ No newline at end of file
diff --git a/.github/workflows/smoke-agent-public-approved.lock.yml b/.github/workflows/smoke-agent-public-approved.lock.yml
index ff4e6f7b48d..efda9275505 100644
--- a/.github/workflows/smoke-agent-public-approved.lock.yml
+++ b/.github/workflows/smoke-agent-public-approved.lock.yml
@@ -22,7 +22,7 @@
 #
 # Smoke test that validates assign-to-agent with the agentic-workflows custom agent
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"3c97796557487cb3f9dfd02804b2c10932fddb5dd95d7c884c33a25e1a9c75d0","strict":true,"agent_id":"codex"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"b296c7080d74ff7c1c70b05e62cca6a69f09f1c5b8533830087549df0c544ede","strict":true,"agent_id":"codex"}
 
 name: "Smoke Agent: public/approved"
 "on":
diff --git a/.github/workflows/smoke-agent-public-approved.md b/.github/workflows/smoke-agent-public-approved.md
index 3698a4bb6b3..755ce051435 100644
--- a/.github/workflows/smoke-agent-public-approved.md
+++ b/.github/workflows/smoke-agent-public-approved.md
@@ -16,7 +16,7 @@ strict: true
 tools:
   github:
     mode: local
-    repos: "public"
+    allowed-repos: "public"
     min-integrity: approved
 network:
   allowed:
@@ -60,4 +60,4 @@ This workflow validates that `assign-to-agent` works correctly with the `agentic
 
 3. **Report**: Add a brief comment to the current pull request confirming the issue number that was assigned and which agent was used.
 
-If no Smoke* issue is found, use the `noop` tool to report that no matching issue was found.
+If no Smoke* issue is found, use the `noop` tool to report that no matching issue was found.
\ No newline at end of file
diff --git a/.github/workflows/smoke-agent-public-none.lock.yml b/.github/workflows/smoke-agent-public-none.lock.yml
index c1c85e08baf..cde89220b0b 100644
--- a/.github/workflows/smoke-agent-public-none.lock.yml
+++ b/.github/workflows/smoke-agent-public-none.lock.yml
@@ -22,7 +22,7 @@
 #
 # Guard policy smoke test: repos=public, min-integrity=none
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"71e286872bc099c4788ba9b318a7ca0a6dd7ce4b1388d03cb2e864cb6f648740","strict":true,"agent_id":"codex"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"f3c995f72a3cf4a61b6b081604a1fee2aff6acd11db9ef49dd1bfa29f853f732","strict":true,"agent_id":"codex"}
 
 name: "Smoke Agent: public/none"
 "on":
diff --git a/.github/workflows/smoke-agent-public-none.md b/.github/workflows/smoke-agent-public-none.md
index 93165819da5..aef7bf4b88a 100644
--- a/.github/workflows/smoke-agent-public-none.md
+++ b/.github/workflows/smoke-agent-public-none.md
@@ -16,7 +16,7 @@ strict: true
 tools:
   github:
     mode: local
-    repos: "public"
+    allowed-repos: "public"
     min-integrity: none
 network:
   allowed:
@@ -87,4 +87,4 @@ Use the `add_comment` safe-output tool to post a summary to the current PR:
 }
 ```
 
-If there is no PR context, use the `noop` tool to report the results summary.
+If there is no PR context, use the `noop` tool to report the results summary.
\ No newline at end of file
diff --git a/.github/workflows/smoke-agent-scoped-approved.lock.yml b/.github/workflows/smoke-agent-scoped-approved.lock.yml
index 3b04bd7ee90..cef06b2cc03 100644
--- a/.github/workflows/smoke-agent-scoped-approved.lock.yml
+++ b/.github/workflows/smoke-agent-scoped-approved.lock.yml
@@ -22,7 +22,7 @@
 #
 # Guard policy smoke test: repos=[github/gh-aw, github/*], min-integrity=approved (scoped patterns)
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"8f173dceb0dfef5029dd1b3c2e82e0d19fd91482af0ea15994137ec59dd51a4c","strict":true,"agent_id":"codex"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"fe705cd419bc0e39aebc9e24a7e1c5b32df8da50c57e3f732d17dfe79f636697","strict":true,"agent_id":"codex"}
 
 name: "Smoke Agent: scoped/approved"
 "on":
diff --git a/.github/workflows/smoke-agent-scoped-approved.md b/.github/workflows/smoke-agent-scoped-approved.md
index 73332c3b717..7ac0773a0f1 100644
--- a/.github/workflows/smoke-agent-scoped-approved.md
+++ b/.github/workflows/smoke-agent-scoped-approved.md
@@ -16,7 +16,7 @@ strict: true
 tools:
   github:
     mode: local
-    repos:
+    allowed-repos:
       - "github/gh-aw"
       - "github/*"
     min-integrity: approved
@@ -88,4 +88,4 @@ Use the `add_comment` safe-output tool to post a summary to the current PR:
 }
 ```
 
-If there is no PR context, use the `noop` tool to report the results summary.
+If there is no PR context, use the `noop` tool to report the results summary.
\ No newline at end of file
diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml
index d58f68bcdd5..2b2165441b5 100644
--- a/.github/workflows/weekly-blog-post-writer.lock.yml
+++ b/.github/workflows/weekly-blog-post-writer.lock.yml
@@ -26,7 +26,7 @@
 #   Imports:
 #     - shared/mcp/qmd-docs.md
 #
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"5facce64914a7d06bb8d04f2a39910364eb7c2fc900ebe24f55cafe987360607","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"d3616bebf0ca05293c233c906b37d0bc28fbdbd038a6a39e1bf2750cb4742515","strict":true,"agent_id":"copilot"}
 
 name: "Weekly Blog Post Writer"
 "on":
diff --git a/.github/workflows/weekly-blog-post-writer.md b/.github/workflows/weekly-blog-post-writer.md
index b30555ed860..110dca4ece4 100644
--- a/.github/workflows/weekly-blog-post-writer.md
+++ b/.github/workflows/weekly-blog-post-writer.md
@@ -19,7 +19,7 @@ tools:
   bash: ["*"]
   github:
     lockdown: false
-    repos:
+    allowed-repos:
       - github/gh-aw
     min-integrity: approved
     toolsets:
@@ -368,4 +368,4 @@ You have successfully completed this task when:
 - ✅ All version/PR/commit references link to GitHub URLs
 - ✅ The Agent of the Week section is present with real log-based anecdotes
 - ✅ A pull request has been opened with the `blog` label, OR
-- ✅ A `noop` call explains why no blog post was needed this week
+- ✅ A `noop` call explains why no blog post was needed this week
\ No newline at end of file