[optimization:skills-curator] gh-aw-firewall: fold two procedure sections of AGENTS.md into existing skill/doc pointers (~19.5% context cut)

`AGENTS.md` in `github/gh-aw-firewall` is 5,859 estimated tokens (23,436 bytes) and is entirely always-loaded ambient context — no skill body loads unless invoked. Two of its sections are full step-by-step procedures duplicated by skills the repo already maintains: "Debugging GitHub Actions Failures" (4 numbered steps, 1,904 chars) and "Logging Implementation" (2 sub-procedures with numbered steps, 3,648 chars, and near-total content overlap with `docs/logging_quickref.md`). Replacing both with one-line pointers removes ~1,388 tokens while adding back ~181 tokens of pointer text and skill-metadata, a net ~19.5% cut to always-loaded context — well over the 10% bar for action.

**Action:** Assign this issue to a Copilot coding agent to apply the change set below, then a maintainer should review the resulting PR diff and confirm the estimated-token math holds.

Agent prompt

```
Repository: github/gh-aw-firewall

Files you may create or edit — touch nothing else:
- AGENTS.md (edit only)
- .github/skills/debugging-workflows/SKILL.md (edit only, optional: add a short pointer to scripts/download-latest-artifact.sh if not already covered)

Do not edit any other file, and do not touch .claude/skills/* or the other .github/skills/* directories.

Before applying each change below, re-read the current AGENTS.md and the named skill file and verify the cited evidence still holds (section still exists, still has the described numbered-step count, still duplicates the named skill/doc). Skip any instruction whose evidence no longer holds, and say so explicitly in the PR description rather than padding the diff.

Change 1 — Extract "Debugging GitHub Actions Failures" (AGENTS.md, currently under "## Development Workflow", 4 numbered steps, ~1,904 chars):
- Verify: .github/skills/debugging-workflows/SKILL.md exists and documents debugging GitHub Actions workflow failures.
- If .github/skills/debugging-workflows/SKILL.md does not already state the "reproduce locally first, then update the action" procedure and the scripts/download-latest-artifact.sh usage (with its RUN_ID/WORKFLOW_FILE/ARTIFACT_NAME parameters and the "Pool overlaps" worked example), add a short "Debugging CI Failures Locally" subsection to that skill containing this procedure, so the knowledge is not lost.
- Replace the "### Debugging GitHub Actions Failures" section in AGENTS.md with a single pointer paragraph (not a full section), e.g.:

"### Debugging GitHub Actions Failures

Always reproduce CI failures locally before touching workflow files — see the `debugging-workflows` skill (`.github/skills/debugging-workflows/SKILL.md`) for the full procedure and `scripts/download-latest-artifact.sh` usage."

- The pointer must still tell a reader, without opening the skill: reproduce locally first, and where the download script lives.

Change 2 — Extract "Logging Implementation" (AGENTS.md, currently a top-level "## Logging Implementation" section with "Overview", "Key Files", "Squid Log Format", "iptables Logging", "Testing Logging", "Important Notes", "Log Analysis Commands", "Commands", "Output Formats", "Key Files", "Data Structures", "GitHub Actions Usage" subsections, ~3,648 chars):
- Verify: docs/logging_quickref.md exists and covers the Squid log format, decision codes, iptables logging, and the `awf logs` / `awf logs stats` / `awf logs summary` commands.
- Replace the entire "## Logging Implementation" section (through its last subsection, currently ending before "## " or end of file) with a single pointer paragraph, e.g.:

"## Logging Implementation

Squid (L7 HTTP/HTTPS) and iptables (L3/L4) traffic logs, log formats, decision codes, and the `awf logs`/`logs stats`/`logs summary` commands are documented in [docs/logging_quickref.md](docs/logging_quickref.md). Key implementation files: `src/squid-config.ts` (Squid config generation), `containers/agent/setup-iptables.sh` (iptables LOG rules), `src/logs/log-aggregator.ts` and `src/logs/stats-formatter.ts` (stats commands)."

- Do not touch docs/logging_quickref.md itself — it is already the single source of truth for this content; only AGENTS.md changes.

General requirements:
- Do not delete or retitle any skill; do not touch .claude/skills/* (some .github/skills/* entries are symlinks into .claude/skills/* — leave those symlinks alone).
- After applying both changes, AGENTS.md's estimated token count (bytes/4) must be at least 10% smaller than its current ~5,859 estimated tokens. If verification forced you to skip Change 1 or Change 2, recompute and state explicitly whether the 10% bar is still met; do not claim success if it is not.
- Open a pull request whose description lists, for each of the two changes: whether it was applied or skipped, the evidence checked, and the resulting AGENTS.md token estimate before/after.
```

Skill inventory

| Skill | Description chars | Size (bytes) | Days since last change | Referenced in tracked files |
|---|---|---|---|---|
| `.claude/skills/awf-debug-tools` (symlinked to `.github/skills/awf-debug-tools`) | 106 | 10,059 | 244 | 3 |
| `.claude/skills/awf-skill` | 156 | 9,838 | 215 | 1 |
| `.claude/skills/debug-firewall` (symlinked to `.github/skills/debug-firewall`) | 187 | 4,362 | 243 | 5 |
| `.claude/skills/recompile-workflows` | 153 | 2,276 | 189 | 1 |
| `.github/skills/add-llm-provider` | 237 | 5,546 | 15 | 0 |
| `.github/skills/agentic-workflows` | 79 | 4,881 | 13 | 85 |
| `.github/skills/debugging-workflows` | 148 | 11,509 | 253 | 0 |
| `.github/skills/pr-finisher` | 178 | 10,531 | 80 | 0 |

`AGENTS.md`: 23,436 bytes / 411 lines / ~5,859 estimated tokens. Procedure-shaped sections identified by numbered steps: "Debugging GitHub Actions Failures" (4 steps), "Core Components" (5 steps, kept — it's a facts-oriented architecture list, not a task procedure), "Exit Code Handling" (4 steps, kept — short, 253 chars, propagation mechanics a reader needs inline), "Overview"/"iptables Logging" under Logging Implementation (2 steps each, folded into the Logging Implementation extraction).

No skill in this repository qualifies as "probably unused" by the staleness+low-reference heuristic strongly enough to propose retirement in this pass — `debugging-workflows` (253 days, 0 tracked-file references) is the closest candidate, but it is the extraction target for Change 1 above and referencing it there raises its use, so retirement is not proposed. Repository data cannot prove invocation counts either way; that determination is left to the maintainer.

Estimated gain

- Always-loaded tokens today: `AGENTS.md` (5,859) + all skill `name`+`description` tokens (341, from 1,364 chars across 8 skills) = **6,200 tokens**.
- Tokens removed: two `AGENTS.md` sections, 1,904 + 3,648 = 5,552 chars → **1,388 tokens**.
- Tokens added back: pointer paragraphs, 267 + 456 = 723 chars → **181 tokens** (no skill descriptions are rewritten in this change set, so no metadata tokens are added).
- Net: 1,388 − 181 = **1,207 tokens removed**.
- Gain: 1,207 / 6,200 = **19.5%** — above the 10% publication bar.

Proposed changes

1. **`AGENTS.md` § "Debugging GitHub Actions Failures"** — action: `extract`. Evidence: 4 numbered steps, 1,904 chars, a fully general reproduce-locally-before-CI procedure with no repo-specific facts that a routine task needs inline. Replace with the pointer text shown in the agent prompt above, pointing at `.github/skills/debugging-workflows/SKILL.md`.
2. **`AGENTS.md` § "Logging Implementation"** (all subsections) — action: `extract`/`merge`. Evidence: 3,648 chars of Squid log format, decision codes, and `awf logs` command documentation that already exists near-verbatim in `docs/logging_quickref.md` (same decision codes, same `awf logs stats`/`summary` command list, same log format description). Replace with the pointer text shown above; do not create a new skill since the procedure already lives in `docs/logging_quickref.md`.

No description-sharpening or retirement changes are included in this change set — see the inventory note above on why `debugging-workflows` retirement is not proposed, and no skill description here is vague enough by itself to justify a standalone rewrite once the two extractions above already clear the 10% gate.

### Verification

A reviewer can confirm the result by: (1) computing `wc -c AGENTS.md` after the change and checking the estimated-token figure (bytes/4) is at least 10% below 5,859 (i.e., at or below ~5,273 tokens); (2) confirming the "Debugging GitHub Actions Failures" procedure now exists in exactly one place — `.github/skills/debugging-workflows/SKILL.md` — and the "Logging Implementation" procedure exists in exactly one place — `docs/logging_quickref.md`; (3) confirming both AGENTS.md pointer paragraphs correctly name where the moved content now lives; (4) confirming no skill's `name`/`description` frontmatter was deleted and no `.claude/skills/*` or non-listed `.github/skills/*` file was touched.

### Control Plane

- Correlation ID: `35121692608-322`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/35121692608

> Generated by [:toolbox: AW Optimization / Skills](https://github.com/githubnext/gh-aw-cao/actions/runs/35122473881) · copilot · auto · 129.7 AIC · ⌖ 9.51 AIC · ⊞ 14.1K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Foptimization-skills-curator%22&type=issues)
> - [x] expires on Oct 16, 2026, 4:47 PM UTC

Start by rereading AGENTS.md, .github/skills/debugging-workflows/SKILL.md, and docs/logging_quickref.md, verifying that the cited sections and duplicated content still exist. Apply only the listed edits, then run wc -c AGENTS.md and review the diff; done means both pointers are present, the 10% token reduction is met, and no unlisted files or symlinks were touched.

Written by the indexing model from the issue text.