From 1eda2ee4d0148826c06311ec7a5d87992c1ec775 Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Sat, 14 Mar 2026 18:28:17 +0000
Subject: [PATCH 1/4] Initial plan


From 309220f6a6b6615342b4ef92ce5b5553d6fce2b7 Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Sat, 14 Mar 2026 18:35:39 +0000
Subject: [PATCH 2/4] Add GHES-specific Copilot error detection

- Create detect_ghes_copilot_errors.sh script to detect common GHES errors
- Add actionable error message templates for each GHES error type
- Integrate GHES error detection into Copilot engine workflow generation
- Add error outputs to agent job and pass to conclusion job
- Update failure message templates to include GHES error context
- Support detection of: token exchange 403, model loading 400, firewall blocks, gh CLI misconfiguration

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 actions/setup/js/handle_agent_failure.cjs     | 55 +++++++++++++++++
 actions/setup/md/agent_failure_comment.md     |  2 +-
 actions/setup/md/agent_failure_issue.md       |  6 +-
 actions/setup/md/ghes_firewall_block_error.md | 25 ++++++++
 actions/setup/md/ghes_gh_cli_error.md         | 25 ++++++++
 actions/setup/md/ghes_model_loading_error.md  | 18 ++++++
 actions/setup/md/ghes_token_exchange_error.md | 17 ++++++
 .../setup/sh/detect_ghes_copilot_errors.sh    | 60 +++++++++++++++++++
 pkg/workflow/compiler_main_job.go             |  8 +++
 pkg/workflow/compiler_yaml_main_job.go        |  8 +++
 pkg/workflow/copilot_engine_execution.go      | 15 +++++
 pkg/workflow/notify_comment.go                |  7 +++
 12 files changed, 242 insertions(+), 4 deletions(-)
 create mode 100644 actions/setup/md/ghes_firewall_block_error.md
 create mode 100644 actions/setup/md/ghes_gh_cli_error.md
 create mode 100644 actions/setup/md/ghes_model_loading_error.md
 create mode 100644 actions/setup/md/ghes_token_exchange_error.md
 create mode 100644 actions/setup/sh/detect_ghes_copilot_errors.sh

diff --git a/actions/setup/js/handle_agent_failure.cjs b/actions/setup/js/handle_agent_failure.cjs
index c693a2c7014..871de216963 100644
--- a/actions/setup/js/handle_agent_failure.cjs
+++ b/actions/setup/js/handle_agent_failure.cjs
@@ -634,6 +634,45 @@ function buildInferenceAccessErrorContext(hasInferenceAccessError) {
   return "\n" + template;
 }
 
+/**
+ * Build a context string when GHES-specific Copilot errors are detected.
+ * @param {Object} ghesErrors - Object containing GHES error flags
+ * @param {boolean} ghesErrors.tokenExchange403 - Whether a token exchange 403 error was detected
+ * @param {boolean} ghesErrors.modelLoading400 - Whether a model loading 400 error was detected
+ * @param {boolean} ghesErrors.firewallBlock - Whether a firewall block was detected
+ * @param {boolean} ghesErrors.ghCliMisconfigured - Whether gh CLI misconfiguration was detected
+ * @returns {string} Formatted context string, or empty string if no errors
+ */
+function buildGHESErrorContext(ghesErrors) {
+  const errorMessages = [];
+
+  if (ghesErrors.tokenExchange403) {
+    const templatePath = "/opt/gh-aw/prompts/ghes_token_exchange_error.md";
+    const template = fs.readFileSync(templatePath, "utf8");
+    errorMessages.push(template);
+  }
+
+  if (ghesErrors.modelLoading400) {
+    const templatePath = "/opt/gh-aw/prompts/ghes_model_loading_error.md";
+    const template = fs.readFileSync(templatePath, "utf8");
+    errorMessages.push(template);
+  }
+
+  if (ghesErrors.firewallBlock) {
+    const templatePath = "/opt/gh-aw/prompts/ghes_firewall_block_error.md";
+    const template = fs.readFileSync(templatePath, "utf8");
+    errorMessages.push(template);
+  }
+
+  if (ghesErrors.ghCliMisconfigured) {
+    const templatePath = "/opt/gh-aw/prompts/ghes_gh_cli_error.md";
+    const template = fs.readFileSync(templatePath, "utf8");
+    errorMessages.push(template);
+  }
+
+  return errorMessages.length > 0 ? "\n" + errorMessages.join("\n\n") : "";
+}
+
 /**
  * Handle agent job failure by creating or updating a failure tracking issue
  * This script is called from the conclusion job when the agent job has failed
@@ -661,6 +700,14 @@ async function main() {
     const pushRepoMemoryResult = process.env.GH_AW_PUSH_REPO_MEMORY_RESULT || "";
     const reportFailureAsIssue = process.env.GH_AW_FAILURE_REPORT_AS_ISSUE !== "false"; // Default to true
 
+    // GHES-specific Copilot error flags
+    const ghesErrors = {
+      tokenExchange403: process.env.GH_AW_GHES_TOKEN_EXCHANGE_403 === "true",
+      modelLoading400: process.env.GH_AW_GHES_MODEL_LOADING_400 === "true",
+      firewallBlock: process.env.GH_AW_GHES_FIREWALL_BLOCK === "true",
+      ghCliMisconfigured: process.env.GH_AW_GHES_GH_CLI_MISCONFIGURED === "true",
+    };
+
     // Collect repo-memory validation errors from all memory configurations
     const repoMemoryValidationErrors = [];
     const repoMemoryPatchSizeExceededIDs = [];
@@ -887,6 +934,9 @@ async function main() {
         // Build inference access error context
         const inferenceAccessErrorContext = buildInferenceAccessErrorContext(inferenceAccessError);
 
+        // Build GHES-specific error context
+        const ghesErrorContext = buildGHESErrorContext(ghesErrors);
+
         // Create template context
         const templateContext = {
           run_url: runUrl,
@@ -909,6 +959,7 @@ async function main() {
           timeout_context: timeoutContext,
           fork_context: forkContext,
           inference_access_error_context: inferenceAccessErrorContext,
+          ghes_error_context: ghesErrorContext,
         };
 
         // Render the comment template
@@ -1011,6 +1062,9 @@ async function main() {
         // Build inference access error context
         const inferenceAccessErrorContext = buildInferenceAccessErrorContext(inferenceAccessError);
 
+        // Build GHES-specific error context
+        const ghesErrorContext = buildGHESErrorContext(ghesErrors);
+
         // Create template context with sanitized workflow name
         const templateContext = {
           workflow_name: sanitizedWorkflowName,
@@ -1034,6 +1088,7 @@ async function main() {
           timeout_context: timeoutContext,
           fork_context: forkContext,
           inference_access_error_context: inferenceAccessErrorContext,
+          ghes_error_context: ghesErrorContext,
         };
 
         // Render the issue template
diff --git a/actions/setup/md/agent_failure_comment.md b/actions/setup/md/agent_failure_comment.md
index 1f491da4d79..627cc715c44 100644
--- a/actions/setup/md/agent_failure_comment.md
+++ b/actions/setup/md/agent_failure_comment.md
@@ -1,3 +1,3 @@
 Agent job [{run_id}]({run_url}) failed.
 
-{secret_verification_context}{inference_access_error_context}{assignment_errors_context}{create_discussion_errors_context}{code_push_failure_context}{repo_memory_validation_context}{push_repo_memory_failure_context}{missing_data_context}{missing_safe_outputs_context}{timeout_context}{fork_context}
+{secret_verification_context}{inference_access_error_context}{ghes_error_context}{assignment_errors_context}{create_discussion_errors_context}{code_push_failure_context}{repo_memory_validation_context}{push_repo_memory_failure_context}{missing_data_context}{missing_safe_outputs_context}{timeout_context}{fork_context}
diff --git a/actions/setup/md/agent_failure_issue.md b/actions/setup/md/agent_failure_issue.md
index 1837481a6fb..4d1ab8669d5 100644
--- a/actions/setup/md/agent_failure_issue.md
+++ b/actions/setup/md/agent_failure_issue.md
@@ -1,10 +1,10 @@
 ### Workflow Failure
 
-**Workflow:** [{workflow_name}]({workflow_source_url})  
-**Branch:** {branch}  
+**Workflow:** [{workflow_name}]({workflow_source_url})
+**Branch:** {branch}
 **Run:** {run_url}{pull_request_info}
 
-{secret_verification_context}{inference_access_error_context}{assignment_errors_context}{create_discussion_errors_context}{code_push_failure_context}{repo_memory_validation_context}{push_repo_memory_failure_context}{missing_data_context}{missing_safe_outputs_context}{timeout_context}{fork_context}
+{secret_verification_context}{inference_access_error_context}{ghes_error_context}{assignment_errors_context}{create_discussion_errors_context}{code_push_failure_context}{repo_memory_validation_context}{push_repo_memory_failure_context}{missing_data_context}{missing_safe_outputs_context}{timeout_context}{fork_context}
 
 ### Action Required
 
diff --git a/actions/setup/md/ghes_firewall_block_error.md b/actions/setup/md/ghes_firewall_block_error.md
new file mode 100644
index 00000000000..fff04883fe5
--- /dev/null
+++ b/actions/setup/md/ghes_firewall_block_error.md
@@ -0,0 +1,25 @@
+
+**🔥 GHES API Domain Blocked by Firewall**: The workflow firewall is blocking access to your GHES API domain, preventing the Copilot CLI from communicating with the server.
+
+**Common causes:**
+- GHES API domain `api.<your-ghes-host>` is not in the firewall allowed domains list
+- Network restrictions prevent access to the GHES instance
+- Incorrect firewall configuration in the workflow
+
+**Resolution steps:**
+1. Add your GHES API domain to the workflow's network.allowed list:
+   ```yaml
+   network:
+     allowed:
+       - api.your-ghes-host.com
+   ```
+
+2. Alternatively, configure the engine API target:
+   ```yaml
+   engine:
+     api-target: https://api.your-ghes-host.com
+   ```
+
+3. Ensure your GHES instance is reachable from GitHub Actions runners
+
+**Note:** The GHES API domain follows the pattern `api.<ghes-hostname>`. For example, if your GHES instance is at `github.company.com`, the API domain is `api.github.company.com`.
diff --git a/actions/setup/md/ghes_gh_cli_error.md b/actions/setup/md/ghes_gh_cli_error.md
new file mode 100644
index 00000000000..a20b526ab12
--- /dev/null
+++ b/actions/setup/md/ghes_gh_cli_error.md
@@ -0,0 +1,25 @@
+
+**🔧 gh CLI Misconfigured for GHES**: The gh CLI is targeting github.com instead of your GHES instance, causing repository resolution errors.
+
+**Common causes:**
+- `GH_HOST` environment variable not set to your GHES hostname
+- gh CLI not properly authenticated for GHES
+- Workflow using github.com credentials instead of GHES credentials
+
+**Resolution steps:**
+1. Ensure the `GH_HOST` environment variable is set in your workflow:
+   ```yaml
+   env:
+     GH_HOST: github.company.com
+   ```
+
+2. Verify that the GitHub token is valid for your GHES instance (not a github.com token)
+
+3. Check that repository references use the correct hostname format
+
+**Example error:**
+```
+Could not resolve to a Repository with the name 'owner/repo'
+```
+
+This error occurs when gh CLI commands try to resolve repositories on github.com when they should be querying your GHES instance.
diff --git a/actions/setup/md/ghes_model_loading_error.md b/actions/setup/md/ghes_model_loading_error.md
new file mode 100644
index 00000000000..52333908951
--- /dev/null
+++ b/actions/setup/md/ghes_model_loading_error.md
@@ -0,0 +1,18 @@
+
+**⚠️ Copilot Model Loading Failed (GHES)**: The Copilot CLI received a 400 error when attempting to load available models. On GHES, this often indicates an API proxy routing issue.
+
+**Common causes:**
+- GHES API proxy is routing requests to the wrong endpoint
+- Copilot API endpoints not properly configured on GHES
+- Upstream Copilot service connectivity issues from GHES
+
+**Resolution steps:**
+1. Verify that the GHES API proxy is correctly configured for Copilot endpoints
+2. Check GHES admin logs for API routing errors
+3. Ensure GitHub Connect is properly configured and active
+4. Test Copilot API connectivity from the GHES instance
+
+**Known issues:**
+- See [github/gh-aw-firewall#1300](https://github.com/github/gh-aw-firewall/issues/1300) for API proxy routing issues
+
+**Note:** A 400 error during model loading may mask a deeper 403 authorization error. Check the token exchange status first.
diff --git a/actions/setup/md/ghes_token_exchange_error.md b/actions/setup/md/ghes_token_exchange_error.md
new file mode 100644
index 00000000000..09e6fa3a93f
--- /dev/null
+++ b/actions/setup/md/ghes_token_exchange_error.md
@@ -0,0 +1,17 @@
+
+**🔑 Copilot Token Exchange Failed (GHES)**: The Copilot CLI received a 403 error when attempting to exchange your GitHub token for a Copilot access token. This typically means Copilot is not licensed for your GitHub Enterprise Server instance.
+
+**Common causes:**
+- Copilot is not enabled at the enterprise level on GHES
+- Copilot seat not assigned to the token owner
+- GitHub Connect not configured between GHES and GitHub.com
+
+**Resolution steps:**
+1. Ask your GHES site administrator to verify that GitHub Connect is enabled
+2. Ensure Copilot is enabled at the enterprise level in GHES admin settings
+3. Verify that the token owner has been assigned a Copilot seat
+4. Check the GHES admin logs for token exchange errors
+
+**Documentation:**
+- [GHES Copilot setup guide](https://docs.github.com/en/enterprise-server/admin/copilot/managing-github-copilot-in-your-enterprise)
+- [GitHub Connect configuration](https://docs.github.com/en/enterprise-server/admin/configuration/configuring-github-connect)
diff --git a/actions/setup/sh/detect_ghes_copilot_errors.sh b/actions/setup/sh/detect_ghes_copilot_errors.sh
new file mode 100644
index 00000000000..8c38ce5d488
--- /dev/null
+++ b/actions/setup/sh/detect_ghes_copilot_errors.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+#
+# detect_ghes_copilot_errors.sh - Detect GHES-specific Copilot errors
+#
+# Checks the agent stdio log for known error patterns specific to GitHub Enterprise Server (GHES)
+# that indicate licensing, firewall, or configuration issues with Copilot on GHES.
+#
+# Sets GitHub Actions output variables:
+#   ghes_token_exchange_403=true    if 403 on /copilot_internal/v2/token detected
+#   ghes_model_loading_400=true     if 400 on model loading detected
+#   ghes_firewall_block=true        if GHES API domain is blocked by firewall
+#   ghes_gh_cli_misconfigured=true  if gh CLI resolution errors detected
+#
+# Exit codes:
+#   0 - Always succeeds (uses continue-on-error in the workflow step)
+
+set -euo pipefail
+
+LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+
+# Initialize all outputs to false
+echo "ghes_token_exchange_403=false" >> "$GITHUB_OUTPUT"
+echo "ghes_model_loading_400=false" >> "$GITHUB_OUTPUT"
+echo "ghes_firewall_block=false" >> "$GITHUB_OUTPUT"
+echo "ghes_gh_cli_misconfigured=false" >> "$GITHUB_OUTPUT"
+
+if [ ! -f "$LOG_FILE" ]; then
+  echo "Log file not found: $LOG_FILE"
+  exit 0
+fi
+
+# Check for 403 on Copilot token exchange endpoint
+# Pattern: "403" + "copilot_internal/v2/token" or "Copilot token exchange failed"
+if grep -qE "(403.*copilot_internal/v2/token|Copilot token exchange failed.*403)" "$LOG_FILE"; then
+  echo "Detected GHES Copilot token exchange 403 error"
+  echo "ghes_token_exchange_403=true" >> "$GITHUB_OUTPUT"
+fi
+
+# Check for 400 on model loading
+# Pattern: "400" + "model" or "Error loading models" + "400 Bad Request"
+if grep -qE "(Error loading models.*400|400 Bad Request.*model|Failed to list models.*400)" "$LOG_FILE"; then
+  echo "Detected GHES Copilot model loading 400 error"
+  echo "ghes_model_loading_400=true" >> "$GITHUB_OUTPUT"
+fi
+
+# Check for firewall blocking GHES API domain
+# Pattern: "blocked" + "api." or "firewall" + "api." + hostname
+if grep -qE "(blocked.*api\.|firewall.*api\.[^/]+|api\.[^/]+.*not.*allowed|api\.[^/]+.*firewall)" "$LOG_FILE"; then
+  echo "Detected GHES API domain blocked by firewall"
+  echo "ghes_firewall_block=true" >> "$GITHUB_OUTPUT"
+fi
+
+# Check for gh CLI misconfiguration (targeting github.com instead of GHES)
+# Pattern: "Could not resolve to a Repository" or "gh.*github.com" when GHES is expected
+if grep -qE "(Could not resolve to a Repository|gh.*targeting.*github\.com|GH_HOST.*not set)" "$LOG_FILE"; then
+  echo "Detected gh CLI misconfiguration (targeting github.com instead of GHES)"
+  echo "ghes_gh_cli_misconfigured=true" >> "$GITHUB_OUTPUT"
+fi
+
+echo "GHES error detection complete"
diff --git a/pkg/workflow/compiler_main_job.go b/pkg/workflow/compiler_main_job.go
index 11d72efa9a5..bb3bacfd6dd 100644
--- a/pkg/workflow/compiler_main_job.go
+++ b/pkg/workflow/compiler_main_job.go
@@ -171,6 +171,14 @@ func (c *Compiler) buildMainJob(data *WorkflowData, activationJobCreated bool) (
 		if _, ok := engine.(*CopilotEngine); ok {
 			outputs["inference_access_error"] = "${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}"
 			compilerMainJobLog.Print("Added inference_access_error output (Copilot engine)")
+
+			// Add GHES-specific error outputs for Copilot engine
+			// These outputs are set by the detect-ghes-errors step when GHES-specific errors are detected
+			outputs["ghes_token_exchange_403"] = "${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}"
+			outputs["ghes_model_loading_400"] = "${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}"
+			outputs["ghes_firewall_block"] = "${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}"
+			outputs["ghes_gh_cli_misconfigured"] = "${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}"
+			compilerMainJobLog.Print("Added GHES error outputs (Copilot engine)")
 		}
 	}
 
diff --git a/pkg/workflow/compiler_yaml_main_job.go b/pkg/workflow/compiler_yaml_main_job.go
index 48fdbe037aa..34d596280a3 100644
--- a/pkg/workflow/compiler_yaml_main_job.go
+++ b/pkg/workflow/compiler_yaml_main_job.go
@@ -323,6 +323,14 @@ func (c *Compiler) generateMainJobSteps(yaml *strings.Builder, data *WorkflowDat
 		for _, line := range detectionStep {
 			yaml.WriteString(line + "\n")
 		}
+
+		// Add GHES-specific error detection step for Copilot engine
+		// This step detects GHES-specific errors like token exchange failures, model loading errors,
+		// firewall blocks, and gh CLI misconfiguration
+		ghesDetectionStep := generateGHESErrorDetectionStep()
+		for _, line := range ghesDetectionStep {
+			yaml.WriteString(line + "\n")
+		}
 	}
 
 	// Mark that we've completed agent execution - step order validation starts from here
diff --git a/pkg/workflow/copilot_engine_execution.go b/pkg/workflow/copilot_engine_execution.go
index ceeeb0d406e..328b910c40c 100644
--- a/pkg/workflow/copilot_engine_execution.go
+++ b/pkg/workflow/copilot_engine_execution.go
@@ -409,6 +409,21 @@ func generateInferenceAccessErrorDetectionStep() GitHubActionStep {
 	return GitHubActionStep(step)
 }
 
+// generateGHESErrorDetectionStep generates a step that detects GHES-specific Copilot errors.
+// This includes token exchange failures, model loading errors, firewall blocks, and gh CLI misconfiguration.
+// The step always runs and checks the agent stdio log for known GHES error patterns.
+func generateGHESErrorDetectionStep() GitHubActionStep {
+	var step []string
+
+	step = append(step, "      - name: Detect GHES-specific Copilot errors")
+	step = append(step, "        id: detect-ghes-errors")
+	step = append(step, "        if: always()")
+	step = append(step, "        continue-on-error: true")
+	step = append(step, "        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh")
+
+	return GitHubActionStep(step)
+}
+
 // extractAddDirPaths extracts all directory paths from copilot args that follow --add-dir flags
 func extractAddDirPaths(args []string) []string {
 	var dirs []string
diff --git a/pkg/workflow/notify_comment.go b/pkg/workflow/notify_comment.go
index e850f56acd3..b484bf2ff0f 100644
--- a/pkg/workflow/notify_comment.go
+++ b/pkg/workflow/notify_comment.go
@@ -154,6 +154,13 @@ func (c *Compiler) buildConclusionJob(data *WorkflowData, mainJobName string, sa
 	// This detects when the Copilot CLI fails due to the token lacking inference access
 	if _, ok := engine.(*CopilotEngine); ok {
 		agentFailureEnvVars = append(agentFailureEnvVars, fmt.Sprintf("          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.%s.outputs.inference_access_error }}\n", mainJobName))
+
+		// Pass GHES-specific error outputs for Copilot engine
+		// These detect GHES-specific failures like token exchange errors, model loading errors, etc.
+		agentFailureEnvVars = append(agentFailureEnvVars, fmt.Sprintf("          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.%s.outputs.ghes_token_exchange_403 }}\n", mainJobName))
+		agentFailureEnvVars = append(agentFailureEnvVars, fmt.Sprintf("          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.%s.outputs.ghes_model_loading_400 }}\n", mainJobName))
+		agentFailureEnvVars = append(agentFailureEnvVars, fmt.Sprintf("          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.%s.outputs.ghes_firewall_block }}\n", mainJobName))
+		agentFailureEnvVars = append(agentFailureEnvVars, fmt.Sprintf("          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.%s.outputs.ghes_gh_cli_misconfigured }}\n", mainJobName))
 	}
 
 	// Pass assignment error outputs from safe_outputs job if assign-to-agent is configured

From f3b8b5c6037837d3a6a3e7b016d6961b69df6dca Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Sat, 14 Mar 2026 18:42:22 +0000
Subject: [PATCH 3/4] Add tests and update golden files for GHES error
 detection

- Add comprehensive tests for GHES error detection in workflow compilation
- Update golden test files to include new GHES error outputs
- Verify tests pass for Copilot engine workflows

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/workflows/ace-editor.lock.yml         |   9 +
 .../agent-performance-analyzer.lock.yml       |  13 ++
 .../workflows/agent-persona-explorer.lock.yml |  13 ++
 .github/workflows/archie.lock.yml             |  13 ++
 .github/workflows/artifacts-summary.lock.yml  |  13 ++
 .github/workflows/auto-triage-issues.lock.yml |  13 ++
 .github/workflows/bot-detection.lock.yml      |  13 ++
 .github/workflows/brave.lock.yml              |  13 ++
 .../breaking-change-checker.lock.yml          |  13 ++
 .../workflows/chroma-issue-indexer.lock.yml   |   9 +
 .github/workflows/ci-coach.lock.yml           |  13 ++
 .github/workflows/ci-doctor.lock.yml          |  13 ++
 .../cli-consistency-checker.lock.yml          |  13 ++
 .../workflows/code-scanning-fixer.lock.yml    |  13 ++
 .github/workflows/code-simplifier.lock.yml    |  13 ++
 .../constraint-solving-potd.lock.yml          |  13 ++
 .github/workflows/contribution-check.lock.yml |  13 ++
 .../copilot-cli-deep-research.lock.yml        |  13 ++
 .../copilot-pr-merged-report.lock.yml         |  13 ++
 .../copilot-pr-nlp-analysis.lock.yml          |  13 ++
 .../copilot-pr-prompt-analysis.lock.yml       |  13 ++
 .github/workflows/craft.lock.yml              |  13 ++
 .../daily-architecture-diagram.lock.yml       |  13 ++
 .../daily-assign-issue-to-user.lock.yml       |  13 ++
 .../workflows/daily-cli-performance.lock.yml  |  13 ++
 .../workflows/daily-cli-tools-tester.lock.yml |  13 ++
 pkg/workflow/ghes_copilot_errors_test.go      | 169 ++++++++++++++++++
 .../basic-copilot.golden                      |   9 +
 .../smoke-copilot.golden                      |   9 +
 .../with-imports.golden                       |   9 +
 30 files changed, 526 insertions(+)
 create mode 100644 pkg/workflow/ghes_copilot_errors_test.go

diff --git a/.github/workflows/ace-editor.lock.yml b/.github/workflows/ace-editor.lock.yml
index c8d14faf792..e7680c405f1 100644
--- a/.github/workflows/ace-editor.lock.yml
+++ b/.github/workflows/ace-editor.lock.yml
@@ -275,6 +275,10 @@ jobs:
     env:
       GH_AW_WORKFLOW_ID_SANITIZED: aceeditor
     outputs:
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -413,6 +417,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index 1dcd097499e..a96bed787dc 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -276,6 +276,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -938,6 +942,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1283,6 +1292,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "agent-performance-analyzer"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index 4b31404d536..c3adfeef100 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -274,6 +274,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -783,6 +787,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1125,6 +1134,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index f245f0fc75c..88ff11073a1 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -323,6 +323,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -759,6 +763,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1095,6 +1104,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "archie"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📊 *Diagram rendered by [{workflow_name}]({run_url})*{history_link}\",\"footerWorkflowRecompile\":\"\\u003e 🔧 *Workflow sync report by [{workflow_name}]({run_url}) for {repository}*\",\"footerWorkflowRecompileComment\":\"\\u003e 🔄 *Update from [{workflow_name}]({run_url}) for {repository}*\",\"runStarted\":\"📐 [{workflow_name}]({run_url}) is analyzing the architecture for this {event_type}...\",\"runSuccess\":\"🎨 [{workflow_name}]({run_url}) has completed the architecture visualization. ✅\",\"runFailure\":\"📐 [{workflow_name}]({run_url}) encountered an issue and could not complete the architecture diagram. Check the [run logs]({run_url}) for details.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index 09a6af2dd8d..4b14a404d87 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -260,6 +260,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -693,6 +697,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1027,6 +1036,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "artifacts-summary"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index a058b13a88c..bd866469bd3 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -273,6 +273,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -770,6 +774,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1105,6 +1114,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "auto-triage-issues"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/bot-detection.lock.yml b/.github/workflows/bot-detection.lock.yml
index 299e13ab6e2..190c942caf8 100644
--- a/.github/workflows/bot-detection.lock.yml
+++ b/.github/workflows/bot-detection.lock.yml
@@ -274,6 +274,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: botdetection
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -854,6 +858,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1064,6 +1073,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index 9adf3350e72..769bbccacdd 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -307,6 +307,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -746,6 +750,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1083,6 +1092,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "brave"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🦁 *Search results brought to you by [{workflow_name}]({run_url})*{history_link}\",\"footerWorkflowRecompile\":\"\\u003e 🔄 *Maintenance report by [{workflow_name}]({run_url}) for {repository}*\",\"runStarted\":\"🔍 Brave Search activated! [{workflow_name}]({run_url}) is venturing into the web on this {event_type}...\",\"runSuccess\":\"🦁 Mission accomplished! [{workflow_name}]({run_url}) has returned with the findings. Knowledge acquired! 🏆\",\"runFailure\":\"🔍 Search interrupted! [{workflow_name}]({run_url}) {status}. The web remains unexplored...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index 154441459c3..67fb9150c02 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -266,6 +266,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -741,6 +745,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1077,6 +1086,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "breaking-change-checker"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e ⚠️ *Compatibility report by [{workflow_name}]({run_url})*{history_link}\",\"footerWorkflowRecompile\":\"\\u003e 🛠️ *Workflow maintenance by [{workflow_name}]({run_url}) for {repository}*\",\"runStarted\":\"🔬 Breaking Change Checker online! [{workflow_name}]({run_url}) is analyzing API compatibility on this {event_type}...\",\"runSuccess\":\"✅ Analysis complete! [{workflow_name}]({run_url}) has reviewed all changes. Compatibility verdict delivered! 📋\",\"runFailure\":\"🔬 Analysis interrupted! [{workflow_name}]({run_url}) {status}. Compatibility status unknown...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/chroma-issue-indexer.lock.yml b/.github/workflows/chroma-issue-indexer.lock.yml
index 039f1f3ae4e..92430feb152 100644
--- a/.github/workflows/chroma-issue-indexer.lock.yml
+++ b/.github/workflows/chroma-issue-indexer.lock.yml
@@ -250,6 +250,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: chromaissueindexer
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -437,6 +441,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index 23b5918871d..3a83261c4d7 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -283,6 +283,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -790,6 +794,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1135,6 +1144,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "ci-coach"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 65b86e70288..ca1cdf88247 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -303,6 +303,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -955,6 +959,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1304,6 +1313,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🩺 *Diagnosis provided by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🏥 CI Doctor reporting for duty! [{workflow_name}]({run_url}) is examining the patient on this {event_type}...\",\"runSuccess\":\"🩺 Examination complete! [{workflow_name}]({run_url}) has delivered the diagnosis. Prescription issued! 💊\",\"runFailure\":\"🏥 Medical emergency! [{workflow_name}]({run_url}) {status}. Doctor needs assistance...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index e88147ebc84..4484d9ff72a 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -251,6 +251,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -706,6 +710,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1039,6 +1048,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "cli-consistency-checker"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index ba74d9457b3..4654372e8d0 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -271,6 +271,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -813,6 +817,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1165,6 +1174,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "code-scanning-fixer"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index 01bfb0f22bb..c7f1934c502 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -275,6 +275,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -732,6 +736,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1071,6 +1080,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/constraint-solving-potd.lock.yml b/.github/workflows/constraint-solving-potd.lock.yml
index 29d87c7c872..3962812de1a 100644
--- a/.github/workflows/constraint-solving-potd.lock.yml
+++ b/.github/workflows/constraint-solving-potd.lock.yml
@@ -258,6 +258,10 @@ jobs:
     outputs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -686,6 +690,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1028,6 +1037,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "constraint-solving-potd"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml
index c1df4427c5c..22cd7f998d7 100644
--- a/.github/workflows/contribution-check.lock.yml
+++ b/.github/workflows/contribution-check.lock.yml
@@ -261,6 +261,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -806,6 +810,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1142,6 +1151,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml
index 1adbf0aed29..c7cd57c208e 100644
--- a/.github/workflows/copilot-cli-deep-research.lock.yml
+++ b/.github/workflows/copilot-cli-deep-research.lock.yml
@@ -275,6 +275,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -755,6 +759,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1099,6 +1108,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "copilot-cli-deep-research"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index 8c4241a701d..7e3a0aeab9a 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -281,6 +281,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -846,6 +850,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1197,6 +1206,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "copilot-pr-merged-report"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index 2c928d62a14..d667251aa04 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -297,6 +297,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -842,6 +846,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1203,6 +1212,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "copilot-pr-nlp-analysis"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index ac58288b95c..0ad83ab9cfa 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -292,6 +292,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -768,6 +772,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1119,6 +1128,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "copilot-pr-prompt-analysis"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 1a1d8943bce..1bd0faf69a6 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -300,6 +300,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -789,6 +793,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1126,6 +1135,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "craft"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e ⚒️ *Crafted with care by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🛠️ Master Crafter at work! [{workflow_name}]({run_url}) is forging a new workflow on this {event_type}...\",\"runSuccess\":\"⚒️ Masterpiece complete! [{workflow_name}]({run_url}) has crafted your workflow. May it serve you well! 🎖️\",\"runFailure\":\"🛠️ Forge cooling down! [{workflow_name}]({run_url}) {status}. The anvil awaits another attempt...\"}"
diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml
index b7706d6db70..8ba855a8d51 100644
--- a/.github/workflows/daily-architecture-diagram.lock.yml
+++ b/.github/workflows/daily-architecture-diagram.lock.yml
@@ -266,6 +266,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -816,6 +820,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1158,6 +1167,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-architecture-diagram"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index a52ad07e870..b5ab82c0317 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -248,6 +248,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -737,6 +741,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1072,6 +1081,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-assign-issue-to-user"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index 9b1f67a9ca8..3be73bd264a 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -280,6 +280,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -949,6 +953,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1307,6 +1316,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-cli-performance"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml
index 6e38c343278..fd00a5899fe 100644
--- a/.github/workflows/daily-cli-tools-tester.lock.yml
+++ b/.github/workflows/daily-cli-tools-tester.lock.yml
@@ -264,6 +264,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -785,6 +789,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1119,6 +1128,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "60"
diff --git a/pkg/workflow/ghes_copilot_errors_test.go b/pkg/workflow/ghes_copilot_errors_test.go
new file mode 100644
index 00000000000..ca3abc5fca9
--- /dev/null
+++ b/pkg/workflow/ghes_copilot_errors_test.go
@@ -0,0 +1,169 @@
+//go:build !integration
+
+package workflow
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/github/gh-aw/pkg/stringutil"
+	"github.com/github/gh-aw/pkg/testutil"
+)
+
+// TestGHESErrorDetectionStep tests that a Copilot engine workflow includes
+// the detect-ghes-errors step in the agent job.
+func TestGHESErrorDetectionStep(t *testing.T) {
+	testDir := testutil.TempDir(t, "test-ghes-error-*")
+	workflowFile := filepath.Join(testDir, "test-workflow.md")
+
+	workflow := `---
+on: workflow_dispatch
+engine: copilot
+---
+
+Test workflow`
+
+	if err := os.WriteFile(workflowFile, []byte(workflow), 0644); err != nil {
+		t.Fatalf("Failed to write test workflow: %v", err)
+	}
+
+	compiler := NewCompiler()
+	if err := compiler.CompileWorkflow(workflowFile); err != nil {
+		t.Fatalf("Failed to compile workflow: %v", err)
+	}
+
+	// Read the generated lock file
+	lockFile := stringutil.MarkdownToLockFile(workflowFile)
+	lockContent, err := os.ReadFile(lockFile)
+	if err != nil {
+		t.Fatalf("Failed to read lock file: %v", err)
+	}
+
+	lockStr := string(lockContent)
+
+	// Check that agent job has detect-ghes-errors step
+	if !strings.Contains(lockStr, "id: detect-ghes-errors") {
+		t.Error("Expected agent job to have detect-ghes-errors step")
+	}
+
+	// Check that the detection step calls the shell script
+	if !strings.Contains(lockStr, "bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh") {
+		t.Error("Expected detect-ghes-errors step to call detect_ghes_copilot_errors.sh")
+	}
+
+	// Check that the agent job exposes all GHES error outputs
+	ghesOutputs := []string{
+		"ghes_token_exchange_403:",
+		"ghes_model_loading_400:",
+		"ghes_firewall_block:",
+		"ghes_gh_cli_misconfigured:",
+	}
+
+	for _, output := range ghesOutputs {
+		if !strings.Contains(lockStr, output) {
+			t.Errorf("Expected agent job to have %s output", output)
+		}
+	}
+}
+
+// TestGHESErrorsInConclusionJob tests that the conclusion job receives the GHES error
+// env vars when the Copilot engine is used.
+func TestGHESErrorsInConclusionJob(t *testing.T) {
+	testDir := testutil.TempDir(t, "test-ghes-error-conclusion-*")
+	workflowFile := filepath.Join(testDir, "test-workflow.md")
+
+	workflow := `---
+on: workflow_dispatch
+engine: copilot
+safe-outputs:
+  add-comment:
+    max: 5
+---
+
+Test workflow`
+
+	if err := os.WriteFile(workflowFile, []byte(workflow), 0644); err != nil {
+		t.Fatalf("Failed to write test workflow: %v", err)
+	}
+
+	compiler := NewCompiler()
+	if err := compiler.CompileWorkflow(workflowFile); err != nil {
+		t.Fatalf("Failed to compile workflow: %v", err)
+	}
+
+	// Read the generated lock file
+	lockFile := stringutil.MarkdownToLockFile(workflowFile)
+	lockContent, err := os.ReadFile(lockFile)
+	if err != nil {
+		t.Fatalf("Failed to read lock file: %v", err)
+	}
+
+	lockStr := string(lockContent)
+
+	// Check that conclusion job receives all GHES error outputs from agent job
+	ghesEnvVars := []string{
+		"GH_AW_GHES_TOKEN_EXCHANGE_403:",
+		"GH_AW_GHES_MODEL_LOADING_400:",
+		"GH_AW_GHES_FIREWALL_BLOCK:",
+		"GH_AW_GHES_GH_CLI_MISCONFIGURED:",
+	}
+
+	for _, envVar := range ghesEnvVars {
+		if !strings.Contains(lockStr, envVar) {
+			t.Errorf("Expected conclusion job to receive %s from agent job", envVar)
+		}
+	}
+}
+
+// TestGHESErrorsNotInNonCopilotEngine tests that non-Copilot engines
+// do NOT include the detect-ghes-errors step.
+func TestGHESErrorsNotInNonCopilotEngine(t *testing.T) {
+	testDir := testutil.TempDir(t, "test-ghes-error-claude-*")
+	workflowFile := filepath.Join(testDir, "test-workflow.md")
+
+	workflow := `---
+on: workflow_dispatch
+engine: claude
+---
+
+Test workflow`
+
+	if err := os.WriteFile(workflowFile, []byte(workflow), 0644); err != nil {
+		t.Fatalf("Failed to write test workflow: %v", err)
+	}
+
+	compiler := NewCompiler()
+	if err := compiler.CompileWorkflow(workflowFile); err != nil {
+		t.Fatalf("Failed to compile workflow: %v", err)
+	}
+
+	// Read the generated lock file
+	lockFile := stringutil.MarkdownToLockFile(workflowFile)
+	lockContent, err := os.ReadFile(lockFile)
+	if err != nil {
+		t.Fatalf("Failed to read lock file: %v", err)
+	}
+
+	lockStr := string(lockContent)
+
+	// Check that non-Copilot engines do NOT have the detect-ghes-errors step
+	if strings.Contains(lockStr, "id: detect-ghes-errors") {
+		t.Error("Expected non-Copilot engine to NOT have detect-ghes-errors step")
+	}
+
+	// Check that non-Copilot engines do NOT have the GHES error outputs
+	ghesOutputs := []string{
+		"ghes_token_exchange_403:",
+		"ghes_model_loading_400:",
+		"ghes_firewall_block:",
+		"ghes_gh_cli_misconfigured:",
+	}
+
+	for _, output := range ghesOutputs {
+		if strings.Contains(lockStr, output) {
+			t.Errorf("Expected non-Copilot engine to NOT have %s output", output)
+		}
+	}
+}
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
index 0689af9e6b6..20d7ef7a5ad 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
@@ -212,6 +212,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: basiccopilot
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -364,6 +368,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
index 602158a39b6..b6657a88001 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
@@ -300,6 +300,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: smokecopilot
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -542,6 +546,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
index df886e62182..c8db4eedabd 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
@@ -215,6 +215,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: withimports
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -367,6 +371,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}

From 8a960c1cf078dfb10be4b3f3535abcd727670d48 Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Sat, 14 Mar 2026 19:06:47 +0000
Subject: [PATCH 4/4] Update PR title and description with GHES error detection
 details

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/workflows/daily-compiler-quality.lock.yml   | 13 +++++++++++++
 .../workflows/daily-copilot-token-report.lock.yml   | 13 +++++++++++++
 .github/workflows/daily-file-diet.lock.yml          | 13 +++++++++++++
 .github/workflows/daily-firewall-report.lock.yml    | 13 +++++++++++++
 .../workflows/daily-malicious-code-scan.lock.yml    | 13 +++++++++++++
 .../daily-mcp-concurrency-analysis.lock.yml         | 13 +++++++++++++
 .github/workflows/daily-news.lock.yml               | 13 +++++++++++++
 .../workflows/daily-performance-summary.lock.yml    | 13 +++++++++++++
 .github/workflows/daily-regulatory.lock.yml         | 13 +++++++++++++
 .github/workflows/daily-repo-chronicle.lock.yml     | 13 +++++++++++++
 .github/workflows/daily-secrets-analysis.lock.yml   | 13 +++++++++++++
 .github/workflows/daily-semgrep-scan.lock.yml       | 13 +++++++++++++
 .../workflows/daily-syntax-error-quality.lock.yml   | 13 +++++++++++++
 .github/workflows/daily-team-status.lock.yml        | 13 +++++++++++++
 .../daily-testify-uber-super-expert.lock.yml        | 13 +++++++++++++
 .github/workflows/daily-workflow-updater.lock.yml   | 13 +++++++++++++
 .github/workflows/dead-code-remover.lock.yml        | 13 +++++++++++++
 .github/workflows/delight.lock.yml                  | 13 +++++++++++++
 .github/workflows/dependabot-burner.lock.yml        | 13 +++++++++++++
 .github/workflows/dependabot-go-checker.lock.yml    | 13 +++++++++++++
 .github/workflows/dev-hawk.lock.yml                 | 13 +++++++++++++
 .github/workflows/dev.lock.yml                      | 13 +++++++++++++
 .github/workflows/dictation-prompt.lock.yml         | 13 +++++++++++++
 .github/workflows/discussion-task-miner.lock.yml    | 13 +++++++++++++
 .github/workflows/docs-noob-tester.lock.yml         | 13 +++++++++++++
 .github/workflows/draft-pr-cleanup.lock.yml         | 13 +++++++++++++
 .../workflows/example-permissions-warning.lock.yml  |  9 +++++++++
 .github/workflows/firewall-escape.lock.yml          | 13 +++++++++++++
 .github/workflows/firewall.lock.yml                 |  9 +++++++++
 .github/workflows/functional-pragmatist.lock.yml    | 13 +++++++++++++
 .../workflows/github-remote-mcp-auth-test.lock.yml  | 13 +++++++++++++
 .github/workflows/glossary-maintainer.lock.yml      | 13 +++++++++++++
 .github/workflows/gpclean.lock.yml                  | 13 +++++++++++++
 .github/workflows/grumpy-reviewer.lock.yml          | 13 +++++++++++++
 .github/workflows/hourly-ci-cleaner.lock.yml        | 13 +++++++++++++
 .github/workflows/issue-monster.lock.yml            | 13 +++++++++++++
 .github/workflows/issue-triage-agent.lock.yml       | 13 +++++++++++++
 .github/workflows/jsweep.lock.yml                   | 13 +++++++++++++
 .github/workflows/layout-spec-maintainer.lock.yml   | 13 +++++++++++++
 .github/workflows/mcp-inspector.lock.yml            | 13 +++++++++++++
 .github/workflows/mergefest.lock.yml                | 13 +++++++++++++
 .github/workflows/metrics-collector.lock.yml        |  9 +++++++++
 .github/workflows/notion-issue-summary.lock.yml     | 13 +++++++++++++
 .github/workflows/org-health-report.lock.yml        | 13 +++++++++++++
 .github/workflows/pdf-summary.lock.yml              | 13 +++++++++++++
 .github/workflows/plan.lock.yml                     | 13 +++++++++++++
 .github/workflows/poem-bot.lock.yml                 | 13 +++++++++++++
 .github/workflows/portfolio-analyst.lock.yml        | 13 +++++++++++++
 .github/workflows/pr-nitpick-reviewer.lock.yml      | 13 +++++++++++++
 .github/workflows/pr-triage-agent.lock.yml          | 13 +++++++++++++
 .github/workflows/python-data-charts.lock.yml       | 13 +++++++++++++
 .github/workflows/q.lock.yml                        | 13 +++++++++++++
 .github/workflows/refiner.lock.yml                  | 13 +++++++++++++
 .github/workflows/release.lock.yml                  | 13 +++++++++++++
 .github/workflows/repo-audit-analyzer.lock.yml      | 13 +++++++++++++
 .github/workflows/repo-tree-map.lock.yml            | 13 +++++++++++++
 .../workflows/repository-quality-improver.lock.yml  | 13 +++++++++++++
 .github/workflows/research.lock.yml                 | 13 +++++++++++++
 .github/workflows/security-compliance.lock.yml      | 13 +++++++++++++
 .github/workflows/security-review.lock.yml          | 13 +++++++++++++
 .github/workflows/slide-deck-maintainer.lock.yml    | 13 +++++++++++++
 .github/workflows/smoke-copilot-arm.lock.yml        | 13 +++++++++++++
 .github/workflows/smoke-copilot.lock.yml            | 13 +++++++++++++
 .../workflows/smoke-create-cross-repo-pr.lock.yml   | 13 +++++++++++++
 .github/workflows/smoke-multi-pr.lock.yml           | 13 +++++++++++++
 .github/workflows/smoke-project.lock.yml            | 13 +++++++++++++
 .github/workflows/smoke-temporary-id.lock.yml       | 13 +++++++++++++
 .github/workflows/smoke-test-tools.lock.yml         | 13 +++++++++++++
 .../workflows/smoke-update-cross-repo-pr.lock.yml   | 13 +++++++++++++
 .../smoke-workflow-call-with-inputs.lock.yml        | 13 +++++++++++++
 .github/workflows/smoke-workflow-call.lock.yml      | 13 +++++++++++++
 .github/workflows/stale-repo-identifier.lock.yml    | 13 +++++++++++++
 .github/workflows/sub-issue-closer.lock.yml         | 13 +++++++++++++
 .github/workflows/super-linter.lock.yml             | 13 +++++++++++++
 .github/workflows/technical-doc-writer.lock.yml     | 13 +++++++++++++
 .github/workflows/terminal-stylist.lock.yml         | 13 +++++++++++++
 .github/workflows/test-dispatcher.lock.yml          | 13 +++++++++++++
 .github/workflows/test-project-url-default.lock.yml | 13 +++++++++++++
 .github/workflows/test-workflow.lock.yml            |  9 +++++++++
 .github/workflows/tidy.lock.yml                     | 13 +++++++++++++
 .github/workflows/ubuntu-image-analyzer.lock.yml    | 13 +++++++++++++
 .github/workflows/video-analyzer.lock.yml           | 13 +++++++++++++
 .../workflows/weekly-editors-health-check.lock.yml  | 13 +++++++++++++
 .github/workflows/weekly-issue-summary.lock.yml     | 13 +++++++++++++
 .../weekly-safe-outputs-spec-review.lock.yml        | 13 +++++++++++++
 .github/workflows/workflow-generator.lock.yml       | 13 +++++++++++++
 .github/workflows/workflow-health-manager.lock.yml  | 13 +++++++++++++
 .github/workflows/workflow-normalizer.lock.yml      | 13 +++++++++++++
 .github/workflows/workflow-skill-extractor.lock.yml | 13 +++++++++++++
 89 files changed, 1141 insertions(+)

diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index 6d812cc2f92..f1f28591ac1 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -269,6 +269,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -741,6 +745,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1085,6 +1094,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-compiler-quality"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index e9796e295b8..2f8ba3cf8a5 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -285,6 +285,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -850,6 +854,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1214,6 +1223,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-copilot-token-report"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index c2a76601ef7..41aca6ed7cd 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -274,6 +274,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -759,6 +763,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1095,6 +1104,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-file-diet"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index f62b96f7dfc..8d1ba200a4e 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -277,6 +277,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -849,6 +853,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1204,6 +1213,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index 304b1d7d885..71d7c3e979b 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -255,6 +255,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: dailymaliciouscodescan
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -729,6 +733,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -940,6 +949,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-malicious-code-scan"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "15"
diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
index abdcf0b01b1..49ed794be0a 100644
--- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
+++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
@@ -268,6 +268,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -803,6 +807,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1146,6 +1155,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-mcp-concurrency-analysis"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "45"
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index 4f23a209bf8..05c90f1566e 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -296,6 +296,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -910,6 +914,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1275,6 +1284,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-news"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index d233b61ca76..ae0afea05a0 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -282,6 +282,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -1323,6 +1327,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1688,6 +1697,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml
index e67062d700d..86c836e8c4b 100644
--- a/.github/workflows/daily-regulatory.lock.yml
+++ b/.github/workflows/daily-regulatory.lock.yml
@@ -269,6 +269,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -1237,6 +1241,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1585,6 +1594,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index f9ce1a5cbb1..e82270bf6c8 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -274,6 +274,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -780,6 +784,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1134,6 +1143,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-repo-chronicle"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml
index f14d6f2f225..7d2871d51dc 100644
--- a/.github/workflows/daily-secrets-analysis.lock.yml
+++ b/.github/workflows/daily-secrets-analysis.lock.yml
@@ -259,6 +259,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -761,6 +765,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1098,6 +1107,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-secrets-analysis"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml
index 3a42e2bf9fe..bea118c9f86 100644
--- a/.github/workflows/daily-semgrep-scan.lock.yml
+++ b/.github/workflows/daily-semgrep-scan.lock.yml
@@ -262,6 +262,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -748,6 +752,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1082,6 +1091,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml
index 31f6d4ccb0c..39a433cab80 100644
--- a/.github/workflows/daily-syntax-error-quality.lock.yml
+++ b/.github/workflows/daily-syntax-error-quality.lock.yml
@@ -258,6 +258,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -735,6 +739,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1071,6 +1080,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-syntax-error-quality"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 90755f51a51..778111b775b 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -272,6 +272,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -726,6 +730,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1069,6 +1078,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index bedd9e7fab7..3bc2491ef8e 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -289,6 +289,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -798,6 +802,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1144,6 +1153,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-testify-uber-super-expert"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index 492f5228d6f..68a8ee80b7d 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -252,6 +252,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -710,6 +714,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1048,6 +1057,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-workflow-updater"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index 79412e3237f..af102457b01 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -277,6 +277,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -756,6 +760,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1098,6 +1107,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "dead-code-remover"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index e273b80ae0e..d2b1e17d2d9 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -277,6 +277,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -843,6 +847,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1190,6 +1199,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "delight"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📊 *User experience analysis by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"📊 Delight Agent starting! [{workflow_name}]({run_url}) is analyzing user-facing aspects for improvement opportunities...\",\"runSuccess\":\"✅ Analysis complete! [{workflow_name}]({run_url}) has identified targeted improvements for user experience.\",\"runFailure\":\"⚠️ Analysis interrupted! [{workflow_name}]({run_url}) {status}. Please review the logs...\"}"
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index ad79af431d5..4825b140d6a 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -264,6 +264,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -718,6 +722,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1052,6 +1061,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index 3bd21f3967c..7b1015890a2 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -263,6 +263,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -767,6 +771,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1101,6 +1110,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index f727dcfc3ac..f3b3771a56b 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -286,6 +286,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -797,6 +801,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1132,6 +1141,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "dev-hawk"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🦅 *Observed from above by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🦅 Dev Hawk circles the sky! [{workflow_name}]({run_url}) is monitoring this {event_type} from above...\",\"runSuccess\":\"🦅 Hawk eyes report! [{workflow_name}]({run_url}) has completed reconnaissance. Intel delivered! 🎯\",\"runFailure\":\"🦅 Hawk down! [{workflow_name}]({run_url}) {status}. The skies grow quiet...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index 00add6b6b6a..41252a303d5 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -248,6 +248,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -703,6 +707,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1036,6 +1045,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "dev"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "30"
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index e498647e7ec..91506b0b211 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -262,6 +262,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -846,6 +850,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1191,6 +1200,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "dictation-prompt"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
index 21151d07ada..7b7ff3e5989 100644
--- a/.github/workflows/discussion-task-miner.lock.yml
+++ b/.github/workflows/discussion-task-miner.lock.yml
@@ -278,6 +278,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -826,6 +830,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1174,6 +1183,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "discussion-task-miner"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔍 *Task mining by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔍 Discussion Task Miner starting! [{workflow_name}]({run_url}) is scanning discussions for code quality improvements...\",\"runSuccess\":\"✅ Task mining complete! [{workflow_name}]({run_url}) has identified actionable code quality tasks. 📊\",\"runFailure\":\"⚠️ Task mining interrupted! [{workflow_name}]({run_url}) {status}. Please review the logs...\"}"
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index d7ea75309fd..4b24f432332 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -265,6 +265,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -746,6 +750,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1090,6 +1099,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "docs-noob-tester"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml
index 451f9e71b88..6ccc6ce9aed 100644
--- a/.github/workflows/draft-pr-cleanup.lock.yml
+++ b/.github/workflows/draft-pr-cleanup.lock.yml
@@ -250,6 +250,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -792,6 +796,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1127,6 +1136,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "draft-pr-cleanup"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"runStarted\":\"🧹 Starting draft PR cleanup... [{workflow_name}]({run_url}) is reviewing draft PRs for staleness\",\"runSuccess\":\"✅ Draft PR cleanup complete! [{workflow_name}]({run_url}) has reviewed and processed stale drafts.\",\"runFailure\":\"❌ Draft PR cleanup failed! [{workflow_name}]({run_url}) {status}. Some draft PRs may not be processed.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml
index 28e28c6e82f..88edab42f79 100644
--- a/.github/workflows/example-permissions-warning.lock.yml
+++ b/.github/workflows/example-permissions-warning.lock.yml
@@ -234,6 +234,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: examplepermissionswarning
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -386,6 +390,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index d84bd94ac9b..c7471aeb17f 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -295,6 +295,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -763,6 +767,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1117,6 +1126,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "firewall-escape"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml
index e82cb923827..4365d9db8ae 100644
--- a/.github/workflows/firewall.lock.yml
+++ b/.github/workflows/firewall.lock.yml
@@ -236,6 +236,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: firewall
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -388,6 +392,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index b882ac07cfc..23af4f7e4eb 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -265,6 +265,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -722,6 +726,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1061,6 +1070,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml
index 70e32d48eac..08606234210 100644
--- a/.github/workflows/github-remote-mcp-auth-test.lock.yml
+++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml
@@ -260,6 +260,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -701,6 +705,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1036,6 +1045,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index 230ac87413f..3cc6cd8b4a4 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -297,6 +297,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -963,6 +967,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1326,6 +1335,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml
index e846a6b041f..7e6f4b91bf6 100644
--- a/.github/workflows/gpclean.lock.yml
+++ b/.github/workflows/gpclean.lock.yml
@@ -269,6 +269,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -739,6 +743,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1080,6 +1089,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "30"
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index 49d838f730e..1c513e85552 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -315,6 +315,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -822,6 +826,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1164,6 +1173,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 😤 *Reluctantly reviewed by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"😤 *sigh* [{workflow_name}]({run_url}) is begrudgingly looking at this {event_type}... This better be worth my time.\",\"runSuccess\":\"😤 Fine. [{workflow_name}]({run_url}) finished the review. It wasn't completely terrible. I guess. 🙄\",\"runFailure\":\"😤 Great. [{workflow_name}]({run_url}) {status}. As if my day couldn't get any worse...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 83b13e34296..923eef3a9d4 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -282,6 +282,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -772,6 +776,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1160,6 +1169,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index b0a0c06180d..ca89da54d6d 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -289,6 +289,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -770,6 +774,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1106,6 +1115,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_ASSIGNMENT_ERRORS: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_errors }}
           GH_AW_ASSIGNMENT_ERROR_COUNT: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🍪 *Om nom nom by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🍪 ISSUE! ISSUE! [{workflow_name}]({run_url}) hungry for issues on this {event_type}! Om nom nom...\",\"runSuccess\":\"🍪 YUMMY! [{workflow_name}]({run_url}) ate the issues! That was DELICIOUS! Me want MORE! 😋\",\"runFailure\":\"🍪 Aww... [{workflow_name}]({run_url}) {status}. No cookie for monster today... 😢\"}"
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 076412694b2..4e162c086f0 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -261,6 +261,10 @@ jobs:
     outputs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -711,6 +715,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1046,6 +1055,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "issue-triage-agent"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "5"
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index 9217156a890..d4476747c4b 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -267,6 +267,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -751,6 +755,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1097,6 +1106,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index f5478f9801a..23417963a5f 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -258,6 +258,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -751,6 +755,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1090,6 +1099,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 0eaf608e316..870360a2ba6 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -329,6 +329,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -1087,6 +1091,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1443,6 +1452,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index 04d49795f3c..592a6c1a0b9 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -301,6 +301,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -771,6 +775,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1107,6 +1116,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml
index a18906ede36..b3cfec7bc8b 100644
--- a/.github/workflows/metrics-collector.lock.yml
+++ b/.github/workflows/metrics-collector.lock.yml
@@ -260,6 +260,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: metricscollector
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -489,6 +493,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
index 48fbb5836ef..583573d49b9 100644
--- a/.github/workflows/notion-issue-summary.lock.yml
+++ b/.github/workflows/notion-issue-summary.lock.yml
@@ -263,6 +263,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: notionissuesummary
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -666,6 +670,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -875,6 +884,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "5"
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index 281b157f834..ff5744a7633 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -283,6 +283,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -779,6 +783,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1131,6 +1140,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index aa62402cbfe..00f818aa0c4 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -347,6 +347,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -851,6 +855,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1195,6 +1204,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📄 *Summary compiled by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"📖 Page by page! [{workflow_name}]({run_url}) is reading through this {event_type}...\",\"runSuccess\":\"📚 TL;DR ready! [{workflow_name}]({run_url}) has distilled the essence. Knowledge condensed! ✨\",\"runFailure\":\"📖 Reading interrupted! [{workflow_name}]({run_url}) {status}. The document remains unsummarized...\"}"
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index 86fcb48520c..4ddaa5cebd1 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -308,6 +308,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -819,6 +823,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1155,6 +1164,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index 5179520898e..9bd024ed131 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -336,6 +336,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -1526,6 +1530,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1884,6 +1893,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index f6021201a19..40c3ba9b839 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -280,6 +280,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -860,6 +864,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1215,6 +1224,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index 96f1b2e73ef..ac97dc59a48 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -345,6 +345,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -923,6 +927,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1267,6 +1276,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔍 *Meticulously inspected by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔬 Adjusting monocle... [{workflow_name}]({run_url}) is scrutinizing every pixel of this {event_type}...\",\"runSuccess\":\"🔍 Nitpicks catalogued! [{workflow_name}]({run_url}) has documented all the tiny details. Perfection awaits! ✅\",\"runFailure\":\"🔬 Lens cracked! [{workflow_name}]({run_url}) {status}. Some nitpicks remain undetected...\"}"
diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml
index 827eadc2a5b..9bbd1c228c3 100644
--- a/.github/workflows/pr-triage-agent.lock.yml
+++ b/.github/workflows/pr-triage-agent.lock.yml
@@ -272,6 +272,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -843,6 +847,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1189,6 +1198,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"runStarted\":\"🔍 Starting PR triage analysis... [{workflow_name}]({run_url}) is categorizing and prioritizing agent-created PRs\",\"runSuccess\":\"✅ PR triage complete! [{workflow_name}]({run_url}) has analyzed and categorized PRs. Check the issue for detailed report.\",\"runFailure\":\"❌ PR triage failed! [{workflow_name}]({run_url}) {status}. Some PRs may not be triaged.\"}"
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index f4e64536967..fd645bd113e 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -276,6 +276,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -848,6 +852,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1200,6 +1209,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 95c2dca273f..33a15bb284c 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -364,6 +364,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -961,6 +965,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1306,6 +1315,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🎩 *Equipped by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔧 Pay attention, 007! [{workflow_name}]({run_url}) is preparing your gadgets for this {event_type}...\",\"runSuccess\":\"🎩 Mission equipment ready! [{workflow_name}]({run_url}) has optimized your workflow. Use wisely, 007! 🔫\",\"runFailure\":\"🔧 Technical difficulties! [{workflow_name}]({run_url}) {status}. Even Q Branch has bad days...\"}"
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index ec239586b5f..599a3d39e97 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -291,6 +291,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -792,6 +796,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1129,6 +1138,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"runStarted\":\"🔍 Starting code refinement... [{workflow_name}]({run_url}) is analyzing PR #${{ github.event.pull_request.number }} for style alignment and security issues\",\"runSuccess\":\"✅ Refinement complete! [{workflow_name}]({run_url}) has created a PR with improvements for PR #${{ github.event.pull_request.number }}\",\"runFailure\":\"❌ Refinement failed! [{workflow_name}]({run_url}) {status} while processing PR #${{ github.event.pull_request.number }}\"}"
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 17c7d98b3eb..f5026c836c8 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -271,6 +271,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -715,6 +719,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1048,6 +1057,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index dcc8abdff1e..37be6a39155 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -274,6 +274,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -717,6 +721,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1062,6 +1071,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index e47097adb82..db9973e4f34 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -261,6 +261,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -693,6 +697,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1028,6 +1037,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index efd8895ec4c..8b38411cdae 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -273,6 +273,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -724,6 +728,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1066,6 +1075,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index 2b5112892d4..296d9bc5dc4 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -271,6 +271,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -718,6 +722,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1054,6 +1063,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index 5d75d6dd117..f7173737faf 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -299,6 +299,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -778,6 +782,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1122,6 +1131,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index 214813fbbf6..232e577a7e1 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -316,6 +316,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -901,6 +905,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1243,6 +1252,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔒 *Security review by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔍 [{workflow_name}]({run_url}) is analyzing this {event_type} for security implications...\",\"runSuccess\":\"🔒 [{workflow_name}]({run_url}) completed the security review.\",\"runFailure\":\"⚠️ [{workflow_name}]({run_url}) {status} during security review.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index 3d89614265f..2c562cbf1c0 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -292,6 +292,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -818,6 +822,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1164,6 +1173,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index 46b8847fbcd..1e79fc36b90 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -335,6 +335,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -1790,6 +1794,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -2145,6 +2154,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📰 *BREAKING: Report filed by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"📰 BREAKING: [{workflow_name}]({run_url}) is now investigating this {event_type}. Sources say the story is developing...\",\"runSuccess\":\"📰 VERDICT: [{workflow_name}]({run_url}) has concluded. All systems operational. This is a developing story. 🎤\",\"runFailure\":\"📰 DEVELOPING STORY: [{workflow_name}]({run_url}) reports {status}. Our correspondents are investigating the incident...\"}"
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 034247e3e18..3a1028e52d9 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -338,6 +338,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -1905,6 +1909,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -2260,6 +2269,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📰 *BREAKING: Report filed by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"📰 BREAKING: [{workflow_name}]({run_url}) is now investigating this {event_type}. Sources say the story is developing...\",\"runSuccess\":\"📰 VERDICT: [{workflow_name}]({run_url}) has concluded. All systems operational. This is a developing story. 🎤\",\"runFailure\":\"📰 DEVELOPING STORY: [{workflow_name}]({run_url}) reports {status}. Our correspondents are investigating the incident...\"}"
diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
index f0e778044e2..a9d01aac185 100644
--- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
@@ -299,6 +299,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -901,6 +905,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1238,6 +1247,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-create-cross-repo-pr"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔬 *Cross-repo smoke test by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is testing cross-repo PR creation in githubnext/gh-aw-side-repo...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) successfully created a cross-repo PR in githubnext/gh-aw-side-repo!\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) failed to create a cross-repo PR: {status}\"}"
diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml
index 5728d2c4cd2..2cf00d182c5 100644
--- a/.github/workflows/smoke-multi-pr.lock.yml
+++ b/.github/workflows/smoke-multi-pr.lock.yml
@@ -308,6 +308,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -845,6 +849,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1182,6 +1191,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Multi PR smoke test by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"🧪 [{workflow_name}]({run_url}) is now testing multiple PR creation...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) successfully created multiple PRs.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) failed to create multiple PRs. Check the logs.\"}"
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index c5f540f81d2..ecdba50b1cc 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -307,6 +307,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -1278,6 +1282,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1615,6 +1624,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Project smoke test report by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"🧪 [{workflow_name}]({run_url}) is now testing project operations...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) completed successfully. All project operations validated.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) encountered failures. Check the logs for details.\"}"
diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml
index bba49018736..0858781f57c 100644
--- a/.github/workflows/smoke-temporary-id.lock.yml
+++ b/.github/workflows/smoke-temporary-id.lock.yml
@@ -303,6 +303,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -866,6 +870,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1202,6 +1211,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Temporary ID smoke test by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"🧪 [{workflow_name}]({run_url}) is now testing temporary ID functionality...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) completed successfully. Temporary ID validation passed.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) encountered failures. Check the logs for details.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index b3d168f823f..b3ce684e26c 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -292,6 +292,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -744,6 +748,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1080,6 +1089,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔧 *Tool validation by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔧 Starting tool validation... [{workflow_name}]({run_url}) is checking the agent container tools...\",\"runSuccess\":\"✅ All tools validated successfully! [{workflow_name}]({run_url}) confirms agent container is ready.\",\"runFailure\":\"❌ Tool validation failed! [{workflow_name}]({run_url}) detected missing tools: {status}\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
index 8c8b853513a..09824e01077 100644
--- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
@@ -306,6 +306,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -896,6 +900,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1240,6 +1249,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-update-cross-repo-pr"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📜 *Cross-repo PR update smoke test by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"📜 [{workflow_name}]({run_url}) is adding the next Odyssey line to githubnext/gh-aw-side-repo PR #1...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) successfully updated the cross-repo PR with a new Odyssey line!\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) failed to update the cross-repo PR: {status}\"}"
diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
index 1b27ae14bfc..a5c6477abef 100644
--- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
+++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
@@ -308,6 +308,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -778,6 +782,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1112,6 +1121,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "5"
diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml
index 3be5bf258f5..297528fc149 100644
--- a/.github/workflows/smoke-workflow-call.lock.yml
+++ b/.github/workflows/smoke-workflow-call.lock.yml
@@ -288,6 +288,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -735,6 +739,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1071,6 +1080,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔁 *workflow_call smoke test by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"🔁 [{workflow_name}]({run_url}) is validating workflow_call checkout...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) successfully validated workflow_call checkout.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) failed to validate workflow_call checkout. Check the logs.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index 62f5a870a78..e1d629761aa 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -300,6 +300,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -852,6 +856,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1203,6 +1212,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔍 *Analysis by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔍 Stale Repository Identifier starting! [{workflow_name}]({run_url}) is analyzing repository activity...\",\"runSuccess\":\"✅ Analysis complete! [{workflow_name}]({run_url}) has finished analyzing stale repositories.\",\"runFailure\":\"⚠️ Analysis interrupted! [{workflow_name}]({run_url}) {status}.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index 0410dafc48a..a3350d768c8 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -254,6 +254,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -807,6 +811,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1143,6 +1152,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "15"
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 01b6fd04f32..6a5c7958dab 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -277,6 +277,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -747,6 +751,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1088,6 +1097,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "15"
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 58ca9ce57b5..91c11eba967 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -299,6 +299,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -1033,6 +1037,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1407,6 +1416,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📝 *Documentation by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"✍️ The Technical Writer begins! [{workflow_name}]({run_url}) is documenting this {event_type}...\",\"runSuccess\":\"📝 Documentation complete! [{workflow_name}]({run_url}) has written the docs. Clear as crystal! ✨\",\"runFailure\":\"✍️ Writer's block! [{workflow_name}]({run_url}) {status}. The page remains blank...\"}"
diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml
index 496a57b5c50..4afa71c5c22 100644
--- a/.github/workflows/terminal-stylist.lock.yml
+++ b/.github/workflows/terminal-stylist.lock.yml
@@ -265,6 +265,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -705,6 +709,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1040,6 +1049,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/test-dispatcher.lock.yml b/.github/workflows/test-dispatcher.lock.yml
index 6b9957cdcbd..10916cd3946 100644
--- a/.github/workflows/test-dispatcher.lock.yml
+++ b/.github/workflows/test-dispatcher.lock.yml
@@ -247,6 +247,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -637,6 +641,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -970,6 +979,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/test-project-url-default.lock.yml b/.github/workflows/test-project-url-default.lock.yml
index ce593ca16a0..5ff924356a2 100644
--- a/.github/workflows/test-project-url-default.lock.yml
+++ b/.github/workflows/test-project-url-default.lock.yml
@@ -246,6 +246,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -896,6 +900,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1229,6 +1238,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/test-workflow.lock.yml b/.github/workflows/test-workflow.lock.yml
index 9a8b018b040..72059d91c5b 100644
--- a/.github/workflows/test-workflow.lock.yml
+++ b/.github/workflows/test-workflow.lock.yml
@@ -236,6 +236,10 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: testworkflow
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
@@ -388,6 +392,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index 07515647e7b..3187f4d6602 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -312,6 +312,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -864,6 +868,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1203,6 +1212,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index 4c8a18c16c4..e2c2be82cef 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -271,6 +271,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -754,6 +758,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1093,6 +1102,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index 70eece39d23..18a239e7b23 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -267,6 +267,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -746,6 +750,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1080,6 +1089,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "15"
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index 68c586532f8..4d2a9690dc5 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -261,6 +261,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -792,6 +796,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1141,6 +1150,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index 0b071a19fac..c75d885c85c 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -279,6 +279,10 @@ jobs:
     outputs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -759,6 +763,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1113,6 +1122,10 @@ jobs:
           GH_AW_WORKFLOW_ID: "weekly-issue-summary"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index 30aac251f6a..49b103b028f 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -259,6 +259,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -705,6 +709,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1044,6 +1053,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index 4ec29e443b6..2d3ef6fc459 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -298,6 +298,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -850,6 +854,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1185,6 +1194,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_ASSIGNMENT_ERRORS: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_errors }}
           GH_AW_ASSIGNMENT_ERROR_COUNT: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index a056af7d8a5..3f9e16acab2 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -280,6 +280,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -940,6 +944,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1286,6 +1295,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_PUSH_REPO_MEMORY_RESULT: ${{ needs.push_repo_memory.result }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index 19e18808f36..b5c5fc5238f 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -263,6 +263,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -784,6 +788,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1121,6 +1130,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_TIMEOUT_MINUTES: "30"
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index 86f0636946c..2a781b5968e 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -262,6 +262,10 @@ jobs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
+      ghes_firewall_block: ${{ steps.detect-ghes-errors.outputs.ghes_firewall_block || 'false' }}
+      ghes_gh_cli_misconfigured: ${{ steps.detect-ghes-errors.outputs.ghes_gh_cli_misconfigured || 'false' }}
+      ghes_model_loading_400: ${{ steps.detect-ghes-errors.outputs.ghes_model_loading_400 || 'false' }}
+      ghes_token_exchange_403: ${{ steps.detect-ghes-errors.outputs.ghes_token_exchange_403 || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
@@ -796,6 +800,11 @@ jobs:
         if: always()
         continue-on-error: true
         run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
+      - name: Detect GHES-specific Copilot errors
+        id: detect-ghes-errors
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_ghes_copilot_errors.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1131,6 +1140,10 @@ jobs:
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_GHES_TOKEN_EXCHANGE_403: ${{ needs.agent.outputs.ghes_token_exchange_403 }}
+          GH_AW_GHES_MODEL_LOADING_400: ${{ needs.agent.outputs.ghes_model_loading_400 }}
+          GH_AW_GHES_FIREWALL_BLOCK: ${{ needs.agent.outputs.ghes_firewall_block }}
+          GH_AW_GHES_GH_CLI_MISCONFIGURED: ${{ needs.agent.outputs.ghes_gh_cli_misconfigured }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"