fix: address Copilot review feedback on PR #30

- Reformat 2026-04-16 KB headings to YYYY-MM-DD -- category -- Title convention
- Remove time-bounded "expires 2026-04-18" from KB source citation
- Sync 2026-04-16 KB entry to skills/gh-aw-report/knowledge-base.md mirror
- Sync Claude Code section to skills/gh-aw-report/references/gh-aw-architecture.md mirror
- Add "Sub-field of on:" to stale-check description in frontmatter-schema.md
- Rename Section 8 to "Pre-Steps, Steps & Post-Steps" to reflect added pre-steps content

Author: zircote

.claude/skills/gh-aw-report/knowledge-base.md

@@ -108,29 +108,29 @@ Workflow reruns capped at 50 (2026-04-10). OIDC for Dependabot/code scanning. Co
 
 ## [2026-04-16] Daily Intelligence Update
 
-### gh-aw CLI v0.68.3 — New Frontmatter Fields
+### 2026-04-16 -- feature -- gh-aw v0.68.3 New Frontmatter Fields
 - **`pre-steps:`** — Runs custom steps at job start, **before checkout**. Use for token minting or pre-checkout setup. Outputs accessible via `${{ steps.<id>.outputs.<name> }}` for use in `checkout.github-token` to avoid masked-value cross-job boundary issues. Same security restrictions as `steps:`.
 - **`run-install-scripts:`** — Boolean (default: `false`). Allows npm pre/post install scripts. Default adds `--ignore-scripts` to all npm install commands (supply chain protection). Setting `true` disables globally; per-runtime scope via `runtimes.node.run-install-scripts`. Compile-time warning (strict mode: error).
 - **`on.stale-check:`** — Boolean nested under `on:`, default `true`. When `false`, disables the frontmatter hash check in the activation job. Required for cross-repo org ruleset deployments.
-- Source: PR #26607 in github/gh-aw ("Sync github-agentic-workflows.md with v0.68.3", expires 2026-04-18)
+- Source: PR #26607 in github/gh-aw ("Sync github-agentic-workflows.md with v0.68.3")
 
-### gh-aw Security Fixes (active PRs 2026-04-16)
+### 2026-04-16 -- security -- gh-aw Security Fixes
 - **Steganographic injection**: PR #26596 strips markdown link title text to close injection channel
 - **XPIA @mentions**: PR #26589 sanitizes @mentions in `create_issue` body
 - **cache-memory sanitization**: PR #26587 adds pre-agent working-tree sanitization (neutralizes planted executables/disallowed files)
 - **Lock file integrity schema v4**: PR #26594 extends integrity check to detect post-compilation YAML tampering
 
-### GitHub MCP Server (as of 2026-04-16)
+### 2026-04-16 -- version -- GitHub MCP Server v0.33.0/v0.33.1
 - **v0.33.0** (2026-04-14): Granular PRs/issues toolsets, `resolve_review_thread` tool, `list_commits` path/since/until params, configurable server name/title via translation strings, OSS HTTP logging adapter
 - **v0.33.1** (2026-04-14): Hotfix release
 
-### Claude Code (as of 2026-04-16)
+### 2026-04-16 -- feature -- Claude Code Remote Tasks
 - **Remote Tasks** (launched March 20, 2026): Define GitHub repo + prompt + schedule → Claude runs autonomously on Anthropic cloud infrastructure. Supports cron scheduling.
 - **Remote Sessions**: Start task, close laptop, session continues on Anthropic infrastructure
 - **Open-sourced**: Agent layer at `anthropics/claude-code`
 - **v2.1.76** (March 14, 2026): Enhanced MCP elicitation support, improved tool discovery
 
-### GitHub Copilot (as of 2026-04-16)
+### 2026-04-16 -- feature -- Copilot Cloud Agent Per-Org Control
 - **Copilot cloud agent per-org control** (April 15, 2026): Can now be enabled for selected organizations via AI Controls page → "Agent" → "Copilot Cloud Agent"
 - **REST API version 2026-03-10**: Available with breaking changes to the REST API
 

skills/aw-author/references/frontmatter-schema.md

@@ -505,7 +505,7 @@ if: github.event.action == 'labeled' && contains(github.event.issue.labels.*.nam
 - **Type:** boolean
 - **Required:** no
 - **Default:** `true`
-- **Description:** Controls whether the activation job verifies that the frontmatter hash in the workflow matches its compiled `.lock.yml`.
+- **Description:** Sub-field of `on:`. Controls whether the activation job verifies that the frontmatter hash in the workflow matches its compiled `.lock.yml`.
 
 When `false`, disables the hash check step. This is needed when workflow files are managed outside the default repository context — for example, cross-repo org rulesets where the `.md` source and the compiled `.lock.yml` live in different repositories.
 
@@ -1582,7 +1582,7 @@ safe-outputs:
 
 ---
 
-## 8. Steps & Post-Steps
+## 8. Pre-Steps, Steps & Post-Steps
 
 ### `pre-steps` {#pre-steps}
 

skills/gh-aw-report/knowledge-base.md

@@ -104,5 +104,35 @@ US/EU data residency (2026-04-13). FedRAMP Moderate for US gov. `copilot --remot
 ### 2026-04-15 -- ecosystem -- GitHub Actions April changes
 Workflow reruns capped at 50 (2026-04-10). OIDC for Dependabot/code scanning. Code scanning→Issues linking. Async SBOM exports.
 
+---
+
+## [2026-04-16] Daily Intelligence Update
+
+### 2026-04-16 -- feature -- gh-aw v0.68.3 New Frontmatter Fields
+- **`pre-steps:`** — Runs custom steps at job start, **before checkout**. Use for token minting or pre-checkout setup. Outputs accessible via `${{ steps.<id>.outputs.<name> }}` for use in `checkout.github-token` to avoid masked-value cross-job boundary issues. Same security restrictions as `steps:`.
+- **`run-install-scripts:`** — Boolean (default: `false`). Allows npm pre/post install scripts. Default adds `--ignore-scripts` to all npm install commands (supply chain protection). Setting `true` disables globally; per-runtime scope via `runtimes.node.run-install-scripts`. Compile-time warning (strict mode: error).
+- **`on.stale-check:`** — Boolean nested under `on:`, default `true`. When `false`, disables the frontmatter hash check in the activation job. Required for cross-repo org ruleset deployments.
+- Source: PR #26607 in github/gh-aw ("Sync github-agentic-workflows.md with v0.68.3")
+
+### 2026-04-16 -- security -- gh-aw Security Fixes
+- **Steganographic injection**: PR #26596 strips markdown link title text to close injection channel
+- **XPIA @mentions**: PR #26589 sanitizes @mentions in `create_issue` body
+- **cache-memory sanitization**: PR #26587 adds pre-agent working-tree sanitization (neutralizes planted executables/disallowed files)
+- **Lock file integrity schema v4**: PR #26594 extends integrity check to detect post-compilation YAML tampering
+
+### 2026-04-16 -- version -- GitHub MCP Server v0.33.0/v0.33.1
+- **v0.33.0** (2026-04-14): Granular PRs/issues toolsets, `resolve_review_thread` tool, `list_commits` path/since/until params, configurable server name/title via translation strings, OSS HTTP logging adapter
+- **v0.33.1** (2026-04-14): Hotfix release
+
+### 2026-04-16 -- feature -- Claude Code Remote Tasks
+- **Remote Tasks** (launched March 20, 2026): Define GitHub repo + prompt + schedule → Claude runs autonomously on Anthropic cloud infrastructure. Supports cron scheduling.
+- **Remote Sessions**: Start task, close laptop, session continues on Anthropic infrastructure
+- **Open-sourced**: Agent layer at `anthropics/claude-code`
+- **v2.1.76** (March 14, 2026): Enhanced MCP elicitation support, improved tool discovery
+
+### 2026-04-16 -- feature -- Copilot Cloud Agent Per-Org Control
+- **Copilot cloud agent per-org control** (April 15, 2026): Can now be enabled for selected organizations via AI Controls page → "Agent" → "Copilot Cloud Agent"
+- **REST API version 2026-03-10**: Available with breaking changes to the REST API
+
 ---
 <!-- Append new entries above this line, newest first -->

skills/gh-aw-report/references/gh-aw-architecture.md

@@ -85,9 +85,12 @@ Stable architectural facts about the GitHub Agentic Workflows ecosystem. Used by
 - **MCP Gateway:** Centralized access management for MCP servers (v0.1.9 as of 2026-04-14)
 
 ### Claude Code
-- Anthropic's CLI agentic coding tool
-- Integrates with GitHub via MCP servers
-- Can run gh-aw workflows locally for testing
+- Anthropic's CLI agentic coding tool, integrates with GitHub via MCP servers
+- Can serve as the AI engine in gh-aw workflows (alternative to Copilot CLI)
+- **Open-sourced** (2026): Agent layer at `anthropics/claude-code`
+- **Remote Tasks** (launched March 20, 2026): Define a GitHub repo + prompt + cron schedule → Claude runs autonomously on Anthropic's cloud infrastructure; cron scheduling supported
+- **Remote Sessions**: Start a task locally, close laptop; session continues on Anthropic infrastructure
+- Directly comparable to gh-aw scheduled workflows for Claude-engine use cases — a native Anthropic alternative that does not require GitHub Actions
 
 ## Ecosystem Integrations