[ambient-context] Daily Ambient Context Optimizer - 2026-09-15

### Executive Summary
- Sampled **4 completed runs** across 4 distinct workflows in the last ~4h window (log download hit the count limit before reaching a full 24h span; sample is representative but not exhaustive).
- Median first-request proxy size: **~15.2k chars**; P95: **~24.5k chars**.
- Largest sampled: **Daily Security Observability Report** (24,462 chars), driven by heavy inline Python charting code and a large inline report template.
- Deep Report (221.8 AIC, 61 turns) has near-ideal WSRF (1.006) — low rebuild waste — but still ships a full inline sub-agent (`issues-analyst`) that could be a reusable skill.
- Slide Deck Maintainer shows the highest WSRF among audited runs (1.55, 5,337 rebuild-excess tokens across 73 invocations) — context is being rebuilt more than needed relative to its peak size.

> **Note on data provenance:** the canonical API-proxy `event-logs.jsonl` and per-run `prompt.txt` artifacts were not filesystem-readable in this sandbox (`permission denied` on `/tmp/gh-aw/aw-mcp/logs/run-*`, `context deadline exceeded` on most artifact re-fetches). Character/heading/duplication metrics below use the **compiled workflow markdown source** as a structural proxy, cross-checked against `prompt_chars`/`working_set` fields returned by the `audit` MCP tool where available. Recommendations are scoped to be safe under this caveat.

### Highest-Leverage Changes
1. Move the DIFC/firewall report Markdown template (Phase 5, ~4.4k chars) in `daily-security-observability.md` into a `## skill:` block, loaded on demand instead of inline.
2. Extract the inline chart-generation Python (Steps 2.3–4, multiple `matplotlib`/`seaborn` blocks) in the same workflow into a checked-in script invoked via `steps:`, removing repeated boilerplate (`#!/usr/bin/env python3`, `import matplotlib.pyplot as plt`, `import seaborn as sns` each appear 3–4× across the sample).
3. Convert the inline `#### agent: issues-analyst` sub-agent in `deep-report.md` into a shared skill/sub-agent definition if reused elsewhere, or inline-collapse it if single-use, to cut fixed prompt overhead per run.
4. Investigate Slide Deck Maintainer's WSRF (1.55) — its Step 4 round-robin state/cache logic likely re-sends static category-scan instructions each turn; consider pushing static content to a preamble that isn't rebuilt, or trimming the four category branches (source-code/agentic-workflows/documentation) into a single templated block.
5. For `daily-safe-output-integrator.md` (smallest, 5.9k chars, WSRF 1.02) — no action needed; included as a baseline control.

### CI-Validation Checklist for Implementing Agents

Any agent implementing workflow-file recommendations **must** complete every item below before opening a PR:

- [ ] Run `make recompile` for every modified `.github/workflows/*.md` file — zero compilation errors required
- [ ] Confirm no target workflow file is reduced by more than 40% of its current character count
- [ ] Run `make agent-report-progress` before the final commit and confirm it passes
- [ ] Check the `blocked_files` list in `/tmp/gh-aw/ambient-context/closed-pr-targets.json` (written by Step 4) — **do not re-attempt changes to any file that appears in a closed ambient-context optimization PR from the last 14 days**
- [ ] Include a smoke-test result or dry-run output in the PR description for every changed workflow spec
- [ ] Document all generated `.lock.yml` changes in the PR body
- [ ] Do not submit as a draft PR

### Key Metrics
| Metric | Value |
|---|---|
| Sampled runs | 4 |
| Distinct workflows | 4 |
| Median chars | 15,203 |
| P95 chars | 24,462 |
| Largest sampled request | Daily Security Observability Report — 24,462 chars |
| Merged optimizer PRs (7d) | 0 |
| Closed optimizer PRs (7d) | 0 |
| Optimizer PR close-rate (7d) | n/a (insufficient settled data, <3) |
| WSRF (audited runs) | Deep Report: 1.006; Daily Security Observability: 1.045 |

Per-Run First-Request Metrics

| Run | Workflow | Chars | Headings | Code Fences | `` | Dup-line ratio | WSRF |
|---|---|---|---|---|---|---|---|
| [§35007359021](https://github.com/github/gh-aw/actions/runs/35007359021) | Deep Report | 18,752 | 25 | 0 | 1 | 0.00 | 1.006 |
| [§34991382811](https://github.com/github/gh-aw/actions/runs/34991382811) | Daily Security Observability Report | 24,462 | 36 | 20 | 7 | 0.071 | 1.045 |
| [§34994599497](https://github.com/github/gh-aw/actions/runs/34994599497) | Slide Deck Maintainer | 11,654 | 30 | 22 | 0 | 0.022 | 1.546 (not fully audited; from run summary) |
| 35009472736 | Daily Safe Output Integrator | 5,914 | 11 | 0 | 1 | 0.013 | 1.018 |

Repeated Ambient Context Signals

- Boilerplate Python headers repeat 3–4× across the sample: `#!/usr/bin/env python3`, `import matplotlib.pyplot as plt`, `import seaborn as sns`, `GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}`.
- Largest non-preamble sections concentrate in chart-generation and report-template steps of Daily Security Observability Report (`Step 3.3: Bucketize DIFC Events` ~2.5k chars, `Chart 5: Filter Reason Breakdown` ~2.3k chars).
- Deep Report's largest block is `#### Actionable Task Creation` (~2.5k chars) plus a full inline sub-agent definition.
- No duplicate-paragraph bloat detected within any single sampled workflow (each workflow's internal duplication ratio is low); the repetition is a **cross-workflow pattern** (same boilerplate reused, not shared).

Deterministic Analysis Output

Python script (`/tmp/gh-aw/agent/analyze_requests.py`, stdlib-only) computed per-run structural metrics (bytes/chars/lines/words, heading/list/code-fence/``/table counts, inline agent/linter/skill counts, duplicate line/paragraph ratios, top sections, top repeated lines) and aggregates (median/P95 chars, top workflows by size, most common repeated fragments/headings). Full output: `/tmp/gh-aw/agent/request-analysis.json` and `.md`. Key finding: `Daily Security Observability Report` is the single largest contributor to the sample's P95, roughly 1.6× the median — concentrated in inline code and template content rather than duplicated instructions.

### Recommendations by Category

#### Workflow Markdown
- **daily-security-observability.md**: extract Phase 5 report template (~4.4k chars) and the Phase 2–4 chart-generation Python into external checked-in scripts/skills, invoked via `steps:` or `## skill:`. Evidence: 20 code fences, 7 `` blocks, 24,462 total chars (P95 of sample). Impact: **high**. Needs manual review (charts depend on run-specific data shapes).
- **slide-deck-maintainer.md**: review Step 4 round-robin category-scan block for repeated static instructions driving WSRF 1.55. Evidence: `working_set.rebuild_excess_tokens = 5337` across 73 invocations. Impact: **medium**. Needs manual review.

#### Skills
- Convert the Daily Security Observability Report's combined report template into a `## skill:` block so it's loaded once and referenced rather than inlined at full size every run. Impact: **medium**, likely safe immediately (template is static formatting, not dynamic logic).

#### Agents
- Deep Report's inline `#### agent: issues-analyst` sub-agent should be evaluated for reuse; if it's single-purpose, consider collapsing it into the main flow to remove fixed inline-agent definition overhead per run. Evidence: 1 inline agent definition contributing to Deep Report's 18,752-char total. Impact: **low**, needs manual review (may affect model routing/cost intentionally).

### References
- [§35007359021](https://github.com/github/gh-aw/actions/runs/35007359021)
- [§34991382811](https://github.com/github/gh-aw/actions/runs/34991382811)
- [§34994599497](https://github.com/github/gh-aw/actions/runs/34994599497)

> Generated by [🌫️ Daily Ambient Context Optimizer](https://github.com/github/gh-aw/actions/runs/35014968447) · copilot · auto · 143.1 AIC · ⌖ 13.2 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fdaily-ambient-context-optimizer%22&type=issues)
> - [x] expires on Sep 22, 2026, 12:05 PM UTC-08:00

Start with .github/workflows/daily-security-observability.md, slide-deck-maintainer.md, and deep-report.md, focusing on the named report template, chart-generation steps, category-scan block, and issues-analyst definition. Run make recompile for each modified workflow and make agent-report-progress before the final commit. Done means the workflow files compile successfully, smoke-test results and generated lock changes are documented, and the checklist constraints are met.

Written by the indexing model from the issue text.