diff --git a/.github/workflows/daily-go-test-parallelizer.lock.yml b/.github/workflows/daily-go-test-parallelizer.lock.yml
index 4c29374cf79..3ed448649c4 100644
--- a/.github/workflows/daily-go-test-parallelizer.lock.yml
+++ b/.github/workflows/daily-go-test-parallelizer.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"fb814b7a3bec58862396fceb7952b2702cbdf09d69eef99608a9d78bd366ca3c","body_hash":"0f750b3d42cf4e2c3d3dde6ced872144a7f383b7ab86bab7d0632495039a7f51","strict":true,"agent_id":"codex","agent_model":"copilot/gpt-5.3-codex","engine_versions":{"codex":"0.154.0"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"fb814b7a3bec58862396fceb7952b2702cbdf09d69eef99608a9d78bd366ca3c","body_hash":"129e947e95086d879672f9b88b2a0782b459f8d7bca62604950ba25a2283b862","strict":true,"agent_id":"codex","agent_model":"copilot/gpt-5.3-codex","engine_versions":{"codex":"0.154.0"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_CI_TRIGGER_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20","digest":"sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20@sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20","digest":"sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20@sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.20","digest":"sha256:1f2d7e0791d0e522152f7479ed700476720effe3b7498b837259112049595d64","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.20@sha256:1f2d7e0791d0e522152f7479ed700476720effe3b7498b837259112049595d64"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20","digest":"sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20@sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.25","digest":"sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"},{"image":"ghcr.io/github/github-mcp-server:v1.12.2"}],"mcp_servers":[{"name":"safeoutputs","tools":["create_pull_request","missing_data","missing_tool","noop"]}]}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/daily-go-test-parallelizer.md b/.github/workflows/daily-go-test-parallelizer.md
index 9dc656c1f82..b0f255eb19e 100644
--- a/.github/workflows/daily-go-test-parallelizer.md
+++ b/.github/workflows/daily-go-test-parallelizer.md
@@ -100,7 +100,7 @@ After editing the selected batch:
 
 Always create `/tmp/gh-aw/cache-memory/go-test-parallelizer/` and write the last path from the selected batch to `state.json`, even when no edit is safe, so the next daily run advances round-robin.
 
-If validation succeeds with a change, create one draft pull request describing the safety analysis and test results. Otherwise use `noop` with the selected path and a short reason.
+Before stopping, call exactly one terminal safe-output tool: create one draft pull request when validation succeeds with a change, otherwise use `noop` with the selected path and a short reason.
 
 Do not parallelize tests that use or may conflict through:
 
diff --git a/pkg/workflow/prompts_test.go b/pkg/workflow/prompts_test.go
index e24ed9fe42f..aa47a77f60d 100644
--- a/pkg/workflow/prompts_test.go
+++ b/pkg/workflow/prompts_test.go
@@ -626,6 +626,9 @@ func TestDailyGoTestParallelizerUsesCodexCompatibleModel(t *testing.T) {
 	if !strings.Contains(workflow, "model: copilot/gpt-5.3-codex") {
 		t.Fatal("Expected daily-go-test-parallelizer workflow to use a Codex-compatible Copilot model")
 	}
+	if !strings.Contains(workflow, "Before stopping, call exactly one terminal safe-output tool") {
+		t.Fatal("Expected daily-go-test-parallelizer workflow to require a terminal safe output")
+	}
 }
 
 func TestDailyCLIPerformanceUsesCodexCompatibleModel(t *testing.T) {