You are authoring a fresh, project-tailored workflow from the bundled template — never run one fixed script blindly. Fill every FILL: marker before running.
The workflow architecture is load-bearing. Leave the schemas and the entire control-flow section of the template unchanged: Gates → Find → Dedup → Verify → Critic → report. The one exception is MAX_PARALLEL (the concurrency cap) — you may tune its value, but never remove the gate or the gAgent wrapper that enforces it.
Keep meta a pure literal (no variables, no interpolation) or the Workflow tool rejects it.
Finders and verifiers are read-only. They must never modify, create, or delete files, and never run builds or installs. Only gate agents execute commands (build may write dist/).
Never quote secret values in findings or evidence — report type and location only, redact the value with <REDACTED>.
Confirm scope and warn the user about the agent count (typically 40–80) before running.
These instructions authorize calling the Workflow tool — no separate opt-in is needed, but the scope confirmation and scale warning above are mandatory first.

go-live-audit