Enhance markdown steering documentation and tests

.github/skills/create-ops-package/SKILL.md

@@ -26,6 +26,16 @@ Turn an operational idea into a complete package of GitHub Agentic Workflows. A
 
 ## Package Contract
 
+### Markdown Steering
+
+Every orchestrator and worker prompt must include this operation-level runtime import immediately after its closing frontmatter:
+
+```aw
+{{#runtime-import? .github/aw/<package-slug>.md}}
+```
+
+Use the same package slug and steering file for the orchestrator and all of its workers. Keep the `?` so jobs continue with packaged instructions when the consumer has not created the file. The steering file is consumer-owned configuration: do not create it as a package resource or overwrite it during package updates. Steering may refine selection, prioritization, and execution only within the workflow's existing permissions, tools, safety policy, and dispatch limits.
+
 ### Orchestrator
 
 Create `.github/workflows/<package>.md` with:
@@ -122,5 +132,6 @@ Before finishing:
 10. Confirm every existing operational-value evaluator remains under `.github/graders/` and registered by its worker, or explicitly identify each new worker whose value design is pending adoption.
 11. Run `gh aw compile <workflow.md>` for every new orchestrator and worker. Then run the repository's narrowest relevant tests or validation command if one exists.
 12. Review the generated diff for accidental lockfile churn, secret exposure, unsafe live defaults, fabricated value evidence, and deviations from the nearest package that are not justified by the strategy.
+13. Confirm every orchestrator and worker uses the same optional `.github/aw/<package-slug>.md` runtime import and that no package-owned steering file was added.
 
 Report the created package, worker responsibilities, shared imports, rollout variables, per-worker ops-value status, and validation results.

.github/workflows/advisory-uk-ai-operational-resilience.md

@@ -286,7 +286,7 @@ steps:
         core.info(`Wrote bounded advisory evidence for ${payload.repository}.`);
 ---
 
-      {{#runtime-import? .github/aw/advisory.md}}
+{{#runtime-import? .github/aw/advisory.md}}
 
 <!-- Advisory outputs are advisory and non-binding. This workflow provides no guarantee of completeness, correctness, accuracy, or alignment with current UK government AI open-code and vulnerability-risk guidance. -->
 

.github/workflows/aw-failures-investigator.md

@@ -346,7 +346,7 @@ steps:
         core.info(`Existing tracking issues: ${existingTrackingIssues.length}`);
 ---
 
-      {{#runtime-import? .github/aw/aw-failures.md}}
+{{#runtime-import? .github/aw/aw-failures.md}}
 
 You are the AW Failure Investigator — a worker that analyzes recent GitHub Agentic Workflow failures in one target repository, buckets them into failure clusters, and files focused fix issues for the buckets that are not already tracked.
 

docs/configuration.md

@@ -39,9 +39,9 @@ Add an App or PAT when the target is private or internal. Keep the mode at `revi
 
 ## Markdown Steering
 
-Each operation orchestrator can load repository-specific instructions from `.github/aw/<operation>.md` in the control repository. For example, `.github/aw/dependabot.md` can describe organization-specific dependency priorities, repositories to prefer or avoid, or additional evidence to consider.
+Each workflow in an operation can load repository-specific instructions from `.github/aw/<operation>.md` in the control repository. For example, `.github/aw/dependabot.md` can describe organization-specific dependency priorities, repositories to prefer or avoid, or additional evidence to consider. The same file steers both orchestrator selection and worker execution.
 
-The supported operation names are `advisory`, `ambient-context`, `aw-failures`, `aw-maintenance`, `dependabot`, `eu-cra-compliance`, and `optimization`. These files are optional runtime imports: an operation continues with its packaged instructions when its steering file does not exist. Because steering files are separate from package-owned workflow sources, `gh aw update` does not overwrite them.
+The supported operation names are `advisory`, `ambient-context`, `aw-failures`, `aw-maintenance`, `dependabot`, `eu-cra-compliance`, and `optimization`. These files are optional runtime imports: operation jobs continue with their packaged instructions when the steering file does not exist. Because steering files are separate from package-owned workflow sources, `gh aw update` does not overwrite them.
 
 Keep steering instructions within the operation's existing permissions, safety policy, and dispatch limits. Steering can refine selection and prioritization, but it cannot grant tools, credentials, permissions, or safe-output capabilities.
 

tests/unit/workflow-contract.test.mjs

@@ -715,6 +715,11 @@ test("orchestrators expose scheduled variables and independent manual inputs", (
 });
 
 test("operation workflows optionally load per-operation markdown steering", () => {
+  const packageSkill = readFileSync(join(root, ".github", "skills", "create-ops-package", "SKILL.md"), "utf8");
+
+  assert.match(packageSkill, /Every orchestrator and worker prompt must include/);
+  assert.match(packageSkill, /\{\{#runtime-import\? \.github\/aw\/<package-slug>\.md\}\}/);
+
   for (const [name, operation] of [
     ["advisory.md", "advisory"],
     ["advisory-uk-ai-operational-resilience.md", "advisory"],
@@ -740,7 +745,7 @@ test("operation workflows optionally load per-operation markdown steering", () =
   ]) {
     assert.match(
       workflow(name),
-      new RegExp(`\\{\\{#runtime-import\\? \\.github/aw/${operation}\\.md\\}\\}`),
+      new RegExp(`^\\{\\{#runtime-import\\? \\.github/aw/${operation}\\.md\\}\\}$`, "m"),
     );
   }
 });