diff --git a/.changeset/patch-goose-1-54.md b/.changeset/patch-goose-1-54.md
new file mode 100644
index 00000000000..e2813dd3e79
--- /dev/null
+++ b/.changeset/patch-goose-1-54.md
@@ -0,0 +1,8 @@
+---
+"gh-aw": patch
+---
+
+Upgrade the unsupported Goose sample to v1.54.0 with a verified Linux release
+checksum. Update the smoke verification and exercise authenticated native MCP,
+extension tool allowlists, provider routing, and structured usage with the
+current release. Isolate the local release test from ambient credentials.
diff --git a/.github/workflows/daily-team-evolution-insights.lock.yml b/.github/workflows/daily-team-evolution-insights.lock.yml
index 7cdee46c39e..829153434a5 100644
--- a/.github/workflows/daily-team-evolution-insights.lock.yml
+++ b/.github/workflows/daily-team-evolution-insights.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"89e73d3eac95f4e008e10409b19d99d32705f0c7158a11ca8a6b00a307a4a57e","body_hash":"bb8f20c79374a8994950dcb72956a1a2a809e3fa06d85832ec93a5b05d64a5f8","agent_id":"goose","agent_model":"copilot/auto","engine_versions":{"goose":"1.53.0"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c7dca77ff7fffa00eee8db7fdf98b1baceb83aef8cafa3f35c5bb16a667c334a","body_hash":"7ab599546ac5d44ace54689d83918d924357173f54d47eee573149a0e7924cba","agent_id":"goose","agent_model":"copilot/auto","engine_versions":{"goose":"1.54.0"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.59","digest":"sha256:63a1cba05e97ede7fc08cc8abb91167045c998d4415433e9c87377e9266ec291","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.59@sha256:63a1cba05e97ede7fc08cc8abb91167045c998d4415433e9c87377e9266ec291"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.59","digest":"sha256:f3d7842f34ff1778ac024a8918519b12436d6437b82d6d1d8cee1d01b2ac87e2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.59@sha256:f3d7842f34ff1778ac024a8918519b12436d6437b82d6d1d8cee1d01b2ac87e2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.59","digest":"sha256:e815a456d6050564666cb2a8bb04ff11a4babc2bfa746d611e895b87e59f9af0","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.59@sha256:e815a456d6050564666cb2a8bb04ff11a4babc2bfa746d611e895b87e59f9af0"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.33","digest":"sha256:2b278f891b4566d27494658b37f628810f93da4caf510e266892ca344e55f8e0","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.33@sha256:2b278f891b4566d27494658b37f628810f93da4caf510e266892ca344e55f8e0"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.2","digest":"sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.2@sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_discussion","get_discussion_comments","get_file_contents","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_discussion_categories","list_discussions","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["create_discussion","missing_data","missing_tool","noop","report_incomplete"]},{"name":"work-queue","tools":["work_queue_claim_finish","work_queue_dispatch_next","work_queue_explain","work_queue_read","work_queue_submit"]}],"threat_detection":{"mode":"enabled"}}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -141,7 +141,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily Team Evolution Insights"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-team-evolution-insights.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
@@ -152,8 +152,8 @@ jobs:
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_INFO_ENGINE_NAME: "Goose"
           GH_AW_INFO_MODEL: "copilot/auto"
-          GH_AW_INFO_VERSION: "1.53.0"
-          GH_AW_INFO_AGENT_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
+          GH_AW_INFO_AGENT_VERSION: "1.54.0"
           GH_AW_INFO_WORKFLOW_NAME: "Daily Team Evolution Insights"
           GH_AW_INFO_EXPERIMENTAL: "true"
           GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
@@ -456,7 +456,7 @@ jobs:
       GH_AW_ASSETS_ALLOWED_EXTS: ""
       GH_AW_ASSETS_BRANCH: ""
       GH_AW_ASSETS_MAX_SIZE_KB: 0
-      GH_AW_ENGINE_VERSION: "1.53.0"
+      GH_AW_ENGINE_VERSION: "1.54.0"
       GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
       GH_AW_PROJECT_UTC: "-08:00"
       GH_AW_PR_HEAD_BASE_BRANCH: ""
@@ -506,7 +506,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily Team Evolution Insights"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-team-evolution-insights.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Set runtime paths
@@ -966,6 +966,7 @@ jobs:
           const archive = join(installDir, "goose.tar.gz");
           const checksums = {
             "1.53.0": "deb2191a6b75acc0a20232fc5c52655ea2f9cc8fa2f5dffc8622e8d378a915dc",
+            "1.54.0": "ab396c95aebbd28b4d38c175234be8d4a3ea0c96e7ccb24c307e4618c9be57e1",
           };
           const fail = (result, action) => {
             if (result.error) throw result.error;
@@ -1136,7 +1137,7 @@ jobs:
         env:
           AWF_REFLECT_ENABLED: 1
           COPILOT_GITHUB_TOKEN: ${{ github.token }}
-          GH_AW_ENGINE_VERSION: 1.53.0
+          GH_AW_ENGINE_VERSION: 1.54.0
           GH_AW_LLM_PROVIDER: github
           GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
           GH_AW_MCP_CONFIG: .goose/mcp.json
@@ -1436,7 +1437,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily Team Evolution Insights"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-team-evolution-insights.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download agent output artifact
@@ -1571,7 +1572,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily Team Evolution Insights"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-team-evolution-insights.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download activation artifact
@@ -1855,7 +1856,7 @@ jobs:
       GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
       GH_AW_ENGINE_ID: "goose"
       GH_AW_ENGINE_MODEL: "copilot/auto"
-      GH_AW_ENGINE_VERSION: "1.53.0"
+      GH_AW_ENGINE_VERSION: "1.54.0"
       GH_AW_PROJECT_UTC: "-08:00"
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
       GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
@@ -1903,7 +1904,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily Team Evolution Insights"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-team-evolution-insights.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
diff --git a/.github/workflows/daily-token-consumption-report.lock.yml b/.github/workflows/daily-token-consumption-report.lock.yml
index 7fb75fa4d7b..47fa5c8c496 100644
--- a/.github/workflows/daily-token-consumption-report.lock.yml
+++ b/.github/workflows/daily-token-consumption-report.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"084dbfe8ae2479cb892c06f0a7ab8da34c47a7ff8e62ef0ef09661afc47962ef","body_hash":"cdcd8a26b395200ee8b1b94ebeada1043c8dc466a40992d1b53cb2aa4301cc14","strict":true,"agent_id":"goose","agent_model":"copilot/claude-sonnet-5","engine_versions":{"goose":"1.53.0"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"0ccfded6808f33c8308b2697dc2c77cfbc6f0375d4706652aba79797c5e78f36","body_hash":"7bc979c612dec3cd18ab6f71397c40755d81781b925073d45fa8edeba005f3f5","strict":true,"agent_id":"goose","agent_model":"copilot/claude-sonnet-5","engine_versions":{"goose":"1.54.0"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN","GRAFANA_SERVICE_ACCOUNT_TOKEN","GRAFANA_URL","SENTRY_ACCESS_TOKEN","SENTRY_OPENAI_API_KEY"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.59","digest":"sha256:63a1cba05e97ede7fc08cc8abb91167045c998d4415433e9c87377e9266ec291","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.59@sha256:63a1cba05e97ede7fc08cc8abb91167045c998d4415433e9c87377e9266ec291"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.59","digest":"sha256:f3d7842f34ff1778ac024a8918519b12436d6437b82d6d1d8cee1d01b2ac87e2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.59@sha256:f3d7842f34ff1778ac024a8918519b12436d6437b82d6d1d8cee1d01b2ac87e2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.59","digest":"sha256:e815a456d6050564666cb2a8bb04ff11a4babc2bfa746d611e895b87e59f9af0","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.59@sha256:e815a456d6050564666cb2a8bb04ff11a4babc2bfa746d611e895b87e59f9af0"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.33","digest":"sha256:2b278f891b4566d27494658b37f628810f93da4caf510e266892ca344e55f8e0","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.33@sha256:2b278f891b4566d27494658b37f628810f93da4caf510e266892ca344e55f8e0"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.2","digest":"sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.2@sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796"},{"image":"grafana/mcp-grafana:1.1.0-alpine","digest":"sha256:e0eb29cdf8effbbebf115ea99a5f654a44681dfd293661b0991498d651ca6cb4","pinned_image":"grafana/mcp-grafana:1.1.0-alpine@sha256:e0eb29cdf8effbbebf115ea99a5f654a44681dfd293661b0991498d651ca6cb4"},{"image":"node:lts-alpine","digest":"sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1","pinned_image":"node:lts-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"grafana","tools":["get_datasource","list_datasources","tempo_docs-traceql","tempo_get-attribute-names","tempo_get-attribute-values","tempo_get-trace","tempo_traceql-search"]},{"name":"safeoutputs","tools":["create_discussion","missing_data","missing_tool","noop","report_incomplete"]},{"name":"sentry","tools":["analyze_issue_with_seer","find_dsns","find_organizations","find_projects","find_releases","find_teams","get_doc","get_event_attachment","get_issue_details","get_trace_details","list_events","list_issue_events","search_docs","search_events","search_issues","whoami"]},{"name":"work-queue","tools":["work_queue_claim_finish","work_queue_dispatch_next","work_queue_explain","work_queue_read","work_queue_submit"]}],"threat_detection":{"mode":"enabled"}}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -149,7 +149,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily AIC Consumption Report (Sentry + Grafana OTel)"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-token-consumption-report.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
@@ -160,8 +160,8 @@ jobs:
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_INFO_ENGINE_NAME: "Goose"
           GH_AW_INFO_MODEL: "copilot/claude-sonnet-5"
-          GH_AW_INFO_VERSION: "1.53.0"
-          GH_AW_INFO_AGENT_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
+          GH_AW_INFO_AGENT_VERSION: "1.54.0"
           GH_AW_INFO_WORKFLOW_NAME: "Daily AIC Consumption Report (Sentry + Grafana OTel)"
           GH_AW_INFO_EXPERIMENTAL: "true"
           GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
@@ -461,7 +461,7 @@ jobs:
       GH_AW_ASSETS_ALLOWED_EXTS: ""
       GH_AW_ASSETS_BRANCH: ""
       GH_AW_ASSETS_MAX_SIZE_KB: 0
-      GH_AW_ENGINE_VERSION: "1.53.0"
+      GH_AW_ENGINE_VERSION: "1.54.0"
       GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
       GH_AW_PROJECT_UTC: "-08:00"
       GH_AW_PR_HEAD_BASE_BRANCH: ""
@@ -511,7 +511,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily AIC Consumption Report (Sentry + Grafana OTel)"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-token-consumption-report.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Set runtime paths
@@ -1052,6 +1052,7 @@ jobs:
           const archive = join(installDir, "goose.tar.gz");
           const checksums = {
             "1.53.0": "deb2191a6b75acc0a20232fc5c52655ea2f9cc8fa2f5dffc8622e8d378a915dc",
+            "1.54.0": "ab396c95aebbd28b4d38c175234be8d4a3ea0c96e7ccb24c307e4618c9be57e1",
           };
           const fail = (result, action) => {
             if (result.error) throw result.error;
@@ -1225,7 +1226,7 @@ jobs:
         env:
           AWF_REFLECT_ENABLED: 1
           COPILOT_GITHUB_TOKEN: ${{ github.token }}
-          GH_AW_ENGINE_VERSION: 1.53.0
+          GH_AW_ENGINE_VERSION: 1.54.0
           GH_AW_LLM_PROVIDER: github
           GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}
           GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
@@ -1533,7 +1534,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily AIC Consumption Report (Sentry + Grafana OTel)"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-token-consumption-report.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download agent output artifact
@@ -1677,7 +1678,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily AIC Consumption Report (Sentry + Grafana OTel)"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-token-consumption-report.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download activation artifact
@@ -1974,7 +1975,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily AIC Consumption Report (Sentry + Grafana OTel)"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-token-consumption-report.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download agent output artifact
@@ -2058,6 +2059,7 @@ jobs:
           const archive = join(installDir, "goose.tar.gz");
           const checksums = {
             "1.53.0": "deb2191a6b75acc0a20232fc5c52655ea2f9cc8fa2f5dffc8622e8d378a915dc",
+            "1.54.0": "ab396c95aebbd28b4d38c175234be8d4a3ea0c96e7ccb24c307e4618c9be57e1",
           };
           const fail = (result, action) => {
             if (result.error) throw result.error;
@@ -2234,7 +2236,7 @@ jobs:
         env:
           AWF_REFLECT_ENABLED: 1
           COPILOT_GITHUB_TOKEN: ${{ github.token }}
-          GH_AW_ENGINE_VERSION: 1.53.0
+          GH_AW_ENGINE_VERSION: 1.54.0
           GH_AW_LLM_PROVIDER: github
           GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_EVALS_MAX_AI_CREDITS || '400' }}
           GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
@@ -2377,7 +2379,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily AIC Consumption Report (Sentry + Grafana OTel)"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-token-consumption-report.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Checkout repository
@@ -2454,7 +2456,7 @@ jobs:
       GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
       GH_AW_ENGINE_ID: "goose"
       GH_AW_ENGINE_MODEL: "copilot/claude-sonnet-5"
-      GH_AW_ENGINE_VERSION: "1.53.0"
+      GH_AW_ENGINE_VERSION: "1.54.0"
       GH_AW_PROJECT_UTC: "-08:00"
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
       GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
@@ -2502,7 +2504,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Daily AIC Consumption Report (Sentry + Grafana OTel)"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-token-consumption-report.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
diff --git a/.github/workflows/engine-conformance-goose.lock.yml b/.github/workflows/engine-conformance-goose.lock.yml
index dd0b149d4cf..724bc0631b7 100644
--- a/.github/workflows/engine-conformance-goose.lock.yml
+++ b/.github/workflows/engine-conformance-goose.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"68b18b8924a1b1b59c2590431c8aa93e0016373896a30173fc5081be7437d3c9","body_hash":"8350a41d87b9f9894aa872eb0d8027a374470b9e7b51337b81eb546985825f03","strict":true,"agent_id":"goose","agent_model":"copilot/gpt-5.4","engine_versions":{"goose":"1.53.0"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"4ee075371ec1338969696f6725d9e20c753a58a407740414a17a96a1bbddbbef","body_hash":"87d7cb348eac8917efb2e6d4d631a8e936c3de6ba33f8d71338efbe4d3959620","strict":true,"agent_id":"goose","agent_model":"copilot/gpt-5.4","engine_versions":{"goose":"1.54.0"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.59","digest":"sha256:63a1cba05e97ede7fc08cc8abb91167045c998d4415433e9c87377e9266ec291","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.59@sha256:63a1cba05e97ede7fc08cc8abb91167045c998d4415433e9c87377e9266ec291"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.59","digest":"sha256:f3d7842f34ff1778ac024a8918519b12436d6437b82d6d1d8cee1d01b2ac87e2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.59@sha256:f3d7842f34ff1778ac024a8918519b12436d6437b82d6d1d8cee1d01b2ac87e2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.59","digest":"sha256:e815a456d6050564666cb2a8bb04ff11a4babc2bfa746d611e895b87e59f9af0","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.59@sha256:e815a456d6050564666cb2a8bb04ff11a4babc2bfa746d611e895b87e59f9af0"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.33","digest":"sha256:2b278f891b4566d27494658b37f628810f93da4caf510e266892ca344e55f8e0","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.33@sha256:2b278f891b4566d27494658b37f628810f93da4caf510e266892ca344e55f8e0"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"}],"mcp_servers":[{"name":"mcpscripts","tools":["conformance-challenge"]},{"name":"safeoutputs","tools":["create_issue","missing_data","missing_tool","noop","report_incomplete"]},{"name":"work-queue","tools":["work_queue_claim_finish","work_queue_dispatch_next","work_queue_explain","work_queue_read","work_queue_submit"]}],"threat_detection":{"mode":"disabled"}}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -137,7 +137,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Engine Conformance Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/engine-conformance-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
@@ -148,8 +148,8 @@ jobs:
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_INFO_ENGINE_NAME: "Goose"
           GH_AW_INFO_MODEL: "copilot/gpt-5.4"
-          GH_AW_INFO_VERSION: "1.53.0"
-          GH_AW_INFO_AGENT_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
+          GH_AW_INFO_AGENT_VERSION: "1.54.0"
           GH_AW_INFO_WORKFLOW_NAME: "Engine Conformance Goose"
           GH_AW_INFO_EXPERIMENTAL: "true"
           GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
@@ -400,7 +400,7 @@ jobs:
       GH_AW_ASSETS_ALLOWED_EXTS: ""
       GH_AW_ASSETS_BRANCH: ""
       GH_AW_ASSETS_MAX_SIZE_KB: 0
-      GH_AW_ENGINE_VERSION: "1.53.0"
+      GH_AW_ENGINE_VERSION: "1.54.0"
       GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
       GH_AW_PROJECT_UTC: "-08:00"
       GH_AW_PR_HEAD_BASE_BRANCH: ""
@@ -450,7 +450,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Engine Conformance Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/engine-conformance-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Set runtime paths
@@ -1000,6 +1000,7 @@ jobs:
           const archive = join(installDir, "goose.tar.gz");
           const checksums = {
             "1.53.0": "deb2191a6b75acc0a20232fc5c52655ea2f9cc8fa2f5dffc8622e8d378a915dc",
+            "1.54.0": "ab396c95aebbd28b4d38c175234be8d4a3ea0c96e7ccb24c307e4618c9be57e1",
           };
           const fail = (result, action) => {
             if (result.error) throw result.error;
@@ -1172,7 +1173,7 @@ jobs:
           CONFORMANCE_STATE: ${{ runner.temp }}/engine-conformance
           COPILOT_GITHUB_TOKEN: ${{ github.token }}
           ENGINE_CONFORMANCE_SENTINEL: conformance-goose
-          GH_AW_ENGINE_VERSION: 1.53.0
+          GH_AW_ENGINE_VERSION: 1.54.0
           GH_AW_LLM_PROVIDER: github
           GH_AW_MAX_TURNS: 30
           GH_AW_MCP_CONFIG: .goose/mcp.json
@@ -1462,7 +1463,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Engine Conformance Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/engine-conformance-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download agent output artifact
@@ -1547,7 +1548,7 @@ jobs:
       GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/engine-conformance-goose"
       GH_AW_ENGINE_ID: "goose"
       GH_AW_ENGINE_MODEL: "copilot/gpt-5.4"
-      GH_AW_ENGINE_VERSION: "1.53.0"
+      GH_AW_ENGINE_VERSION: "1.54.0"
       GH_AW_PROJECT_UTC: "-08:00"
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
       GH_AW_SAFE_OUTPUTS_STAGED: "true"
@@ -1595,7 +1596,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Engine Conformance Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/engine-conformance-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
diff --git a/.github/workflows/shared/goose.md b/.github/workflows/shared/goose.md
index db8b697aaaa..0659bf0f6c4 100644
--- a/.github/workflows/shared/goose.md
+++ b/.github/workflows/shared/goose.md
@@ -2,7 +2,7 @@
 engine:
   id: goose
   detection-engine: copilot
-  version: "1.53.0"
+  version: "1.54.0"
   display-name: Goose
   description: Goose CLI with headless execution and MCP support
   experimental: true
@@ -70,6 +70,7 @@ engine:
       const archive = join(installDir, "goose.tar.gz");
       const checksums = {
         "1.53.0": "deb2191a6b75acc0a20232fc5c52655ea2f9cc8fa2f5dffc8622e8d378a915dc",
+        "1.54.0": "ab396c95aebbd28b4d38c175234be8d4a3ea0c96e7ccb24c307e4618c9be57e1",
       };
       const fail = (result, action) => {
         if (result.error) throw result.error;
@@ -184,7 +185,7 @@ Shared engine definition for the [Goose](https://github.com/aaif-goose/goose)
 open-source AI agent. Import this file and set `engine: id: goose` to use it.
 
 This is an unsupported repository sample, pinned to
-[v1.53.0](https://github.com/aaif-goose/goose/releases/tag/v1.53.0).
+[v1.54.0](https://github.com/aaif-goose/goose/releases/tag/v1.54.0).
 The Linux x86-64 archive is SHA-256 verified before extraction; other versions
 require a reviewed checksum or a verified binary supplied through `engine.command`.
 
diff --git a/.github/workflows/smoke-goose.lock.yml b/.github/workflows/smoke-goose.lock.yml
index 63822e40320..80d3be4bb90 100644
--- a/.github/workflows/smoke-goose.lock.yml
+++ b/.github/workflows/smoke-goose.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c0592fc2447d0934e759d4e85d823ddcc209516e384b62e3bb0c57b618593148","body_hash":"0fe8105e590338478d935b863894d5b860ba242f6624e417764e2d573fc7cb03","strict":true,"agent_id":"goose","agent_model":"copilot/gpt-5.4","engine_versions":{"goose":"1.53.0"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"1ffc922cba48a50b4e2fd2924c46d866a40422cfa1a80695cf4e3bfef7d903fc","body_hash":"069eb33be12e373358d88c274d5223afea57f237a431b656761599c03b6d478c","strict":true,"agent_id":"goose","agent_model":"copilot/gpt-5.4","engine_versions":{"goose":"1.54.0"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.59","digest":"sha256:63a1cba05e97ede7fc08cc8abb91167045c998d4415433e9c87377e9266ec291","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.59@sha256:63a1cba05e97ede7fc08cc8abb91167045c998d4415433e9c87377e9266ec291"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.59","digest":"sha256:f3d7842f34ff1778ac024a8918519b12436d6437b82d6d1d8cee1d01b2ac87e2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.59@sha256:f3d7842f34ff1778ac024a8918519b12436d6437b82d6d1d8cee1d01b2ac87e2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.59","digest":"sha256:e815a456d6050564666cb2a8bb04ff11a4babc2bfa746d611e895b87e59f9af0","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.59@sha256:e815a456d6050564666cb2a8bb04ff11a4babc2bfa746d611e895b87e59f9af0"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.33","digest":"sha256:2b278f891b4566d27494658b37f628810f93da4caf510e266892ca344e55f8e0","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.33@sha256:2b278f891b4566d27494658b37f628810f93da4caf510e266892ca344e55f8e0"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.2","digest":"sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.2@sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796"}],"has_pull_request":true,"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","list_branches","list_commits","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_pull_requests","search_repositories"]},{"name":"mcpscripts","tools":["fetch-homepage"]},{"name":"safeoutputs","tools":["add_comment","add_labels","create_issue","missing_data","missing_tool","noop","report_incomplete"]}],"threat_detection":{"mode":"enabled"}}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -159,7 +159,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
@@ -170,8 +170,8 @@ jobs:
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_INFO_ENGINE_NAME: "Goose"
           GH_AW_INFO_MODEL: "copilot/gpt-5.4"
-          GH_AW_INFO_VERSION: "1.53.0"
-          GH_AW_INFO_AGENT_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
+          GH_AW_INFO_AGENT_VERSION: "1.54.0"
           GH_AW_INFO_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_INFO_EXPERIMENTAL: "true"
           GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
@@ -514,7 +514,7 @@ jobs:
       GH_AW_ASSETS_ALLOWED_EXTS: ""
       GH_AW_ASSETS_BRANCH: ""
       GH_AW_ASSETS_MAX_SIZE_KB: 0
-      GH_AW_ENGINE_VERSION: "1.53.0"
+      GH_AW_ENGINE_VERSION: "1.54.0"
       GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
       GH_AW_PROJECT_UTC: "-08:00"
       GH_AW_PR_HEAD_BASE_BRANCH: ""
@@ -562,7 +562,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Set runtime paths
@@ -1209,6 +1209,7 @@ jobs:
           const archive = join(installDir, "goose.tar.gz");
           const checksums = {
             "1.53.0": "deb2191a6b75acc0a20232fc5c52655ea2f9cc8fa2f5dffc8622e8d378a915dc",
+            "1.54.0": "ab396c95aebbd28b4d38c175234be8d4a3ea0c96e7ccb24c307e4618c9be57e1",
           };
           const fail = (result, action) => {
             if (result.error) throw result.error;
@@ -1379,7 +1380,7 @@ jobs:
         env:
           AWF_REFLECT_ENABLED: 1
           COPILOT_GITHUB_TOKEN: ${{ github.token }}
-          GH_AW_ENGINE_VERSION: 1.53.0
+          GH_AW_ENGINE_VERSION: 1.54.0
           GH_AW_LLM_PROVIDER: github
           GH_AW_MAX_TURNS: 30
           GH_AW_MCP_CONFIG: .goose/mcp.json
@@ -1583,7 +1584,7 @@ jobs:
         name: Assert Goose smoke evidence
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          script: "const assert = require(\"node:assert/strict\");\nconst fs = require(\"node:fs\");\nconst path = require(\"node:path\");\nconst read = file => {\n  const stat = fs.lstatSync(file);\n  assert.ok(stat.isFile() && !stat.isSymbolicLink(), \"Smoke evidence must be a regular file\");\n  assert.ok(stat.size <= 16384, \"Smoke evidence exceeds 16 KiB\");\n  return fs.readFileSync(file, \"utf8\");\n};\nassert.equal(process.env.SMOKE_EXECUTION, \"success\", \"Goose execution failed\");\nconst root = process.env.SMOKE_ROOT;\nconst run = process.env.SMOKE_RUN_ID;\nconst result = JSON.parse(read(path.join(root, `smoke-test-goose-${run}.json`)));\nassert.deepEqual(Object.keys(result).sort(), [\"bash\", \"build\", \"fileWrite\", \"pullRequests\", \"runtime\", \"webFetch\"]);\nfor (const key of [\"bash\", \"build\", \"fileWrite\", \"runtime\", \"webFetch\"]) {\n  assert.equal(result[key], true, `Goose smoke check ${key} did not pass`);\n}\nassert.equal(result.pullRequests.length, 2, \"Exactly two merged PRs are required\");\nassert.equal(new Set(result.pullRequests.map(pr => pr.number)).size, 2, \"PRs must be distinct\");\nfor (const pr of result.pullRequests) {\n  assert.deepEqual(Object.keys(pr).sort(), [\"number\", \"title\"]);\n  assert.ok(Number.isSafeInteger(pr.number) && pr.number > 0);\n  const { data } = await github.rest.pulls.get({ ...context.repo, pull_number: pr.number });\n  assert.ok(data.merged_at, `PR ${pr.number} is not merged`);\n  assert.equal(pr.title, data.title);\n}\nassert.deepEqual(JSON.parse(read(path.join(process.env.SMOKE_STATE, \"web-fetch.json\"))), { containsGitHub: true });\nassert.match(read(path.join(root, `smoke-test-goose-${run}.txt`)), /^Smoke test passed for Goose at .+\\n?$/);\nconst binary = fs.lstatSync(path.join(process.env.GITHUB_WORKSPACE, \"gh-aw\"));\nassert.ok(binary.isFile() && !binary.isSymbolicLink() && (binary.mode & 0o111) !== 0, \"gh-aw build output is missing\");\nconst log = fs.readFileSync(\"/tmp/gh-aw/agent-stdio.log\", \"utf8\");\nassert.ok(log.includes(\"[goose-harness] verified Goose 1.53.0\"), \"Pinned CLI verification is missing\");\nassert.ok(!log.includes(\"Failed to start extension\"), \"A Goose MCP extension failed to connect\");\nconst events = log.split(\"\\n\").filter(line => line.trim().startsWith(\"{\")).map(line => JSON.parse(line));\nassert.ok(events.some(event => event.type === \"complete\"), \"Goose did not finish a structured run\");\nconst requests = events.flatMap(event => event.message?.content || []).filter(item =>\n  item.type === \"toolRequest\" && item.toolCall?.status === \"success\" && item.toolCall.value.name.startsWith(\"github__\"));\nconst responses = events.flatMap(event => event.message?.content || []).filter(item =>\n  item.type === \"toolResponse\" && item.toolResult?.status === \"success\" && item.toolResult.value.isError !== true);\nassert.ok(requests.some(request => responses.some(response => response.id === request.id)), \"No successful native GitHub MCP round-trip\");\nconst session = fs.readFileSync(\"/tmp/gh-aw/agent-session.jsonl\", \"utf8\").trim().split(\"\\n\").map(line => JSON.parse(line));\nassert.ok(session.every(event => event.type.includes(\".\") && event.data && typeof event.data === \"object\"), \"Goose session contains non-canonical events\");\nassert.ok(session.some(event => event.type === \"session.init\" && event.data.sourceEngine === \"goose\"), \"Goose session initialization is missing\");\nassert.ok(session.some(event => event.type === \"assistant.message\" && typeof event.data.content === \"string\"), \"Goose assistant text is missing\");\nconst starts = session.filter(event => event.type === \"tool.execution_start\");\nconst completions = session.filter(event => event.type === \"tool.execution_complete\");\nassert.ok(starts.length > 0 && completions.length > 0, \"Goose tool events are missing\");\nassert.equal(new Set(starts.map(event => event.data.toolCallId)).size, starts.length, \"Goose tool starts are duplicated\");\nfor (const event of completions) {\n  assert.ok(starts.some(start => start.data.toolCallId === event.data.toolCallId), \"Goose tool completion has no matching start\");\n}\nconst native = events.findLast(event => event.type === \"complete\");\nconst parsed = session.findLast(event => event.type === \"session.result\").data;\nassert.equal(parsed.status, \"completed\", \"Goose session result is not complete\");\nfor (const key of [\"input_tokens\", \"output_tokens\", \"total_tokens\", \"cache_read_input_tokens\"]) {\n  if (native[key] !== undefined) assert.equal(parsed.usage[key], native[key], `Goose session ${key} differs from native usage`);\n}\nif (native.cache_write_input_tokens !== undefined) assert.equal(parsed.usage.cache_creation_input_tokens, native.cache_write_input_tokens);\nassert.equal(parsed.usage.input_tokens_include_cache, true);\nassert.ok(session.some(event => event.type === \"agent.execution\" && event.data.exitCode === 0), \"Goose execution result is missing\");\nawait core.summary.addHeading(\"Goose smoke: PASS\", 2).addRaw(\"All six checks passed with host-verified file, build, web-fetch, PR, native MCP, and canonical unified-session evidence.\\n\").write();"
+          script: "const assert = require(\"node:assert/strict\");\nconst fs = require(\"node:fs\");\nconst path = require(\"node:path\");\nconst read = file => {\n  const stat = fs.lstatSync(file);\n  assert.ok(stat.isFile() && !stat.isSymbolicLink(), \"Smoke evidence must be a regular file\");\n  assert.ok(stat.size <= 16384, \"Smoke evidence exceeds 16 KiB\");\n  return fs.readFileSync(file, \"utf8\");\n};\nassert.equal(process.env.SMOKE_EXECUTION, \"success\", \"Goose execution failed\");\nconst root = process.env.SMOKE_ROOT;\nconst run = process.env.SMOKE_RUN_ID;\nconst result = JSON.parse(read(path.join(root, `smoke-test-goose-${run}.json`)));\nassert.deepEqual(Object.keys(result).sort(), [\"bash\", \"build\", \"fileWrite\", \"pullRequests\", \"runtime\", \"webFetch\"]);\nfor (const key of [\"bash\", \"build\", \"fileWrite\", \"runtime\", \"webFetch\"]) {\n  assert.equal(result[key], true, `Goose smoke check ${key} did not pass`);\n}\nassert.equal(result.pullRequests.length, 2, \"Exactly two merged PRs are required\");\nassert.equal(new Set(result.pullRequests.map(pr => pr.number)).size, 2, \"PRs must be distinct\");\nfor (const pr of result.pullRequests) {\n  assert.deepEqual(Object.keys(pr).sort(), [\"number\", \"title\"]);\n  assert.ok(Number.isSafeInteger(pr.number) && pr.number > 0);\n  const { data } = await github.rest.pulls.get({ ...context.repo, pull_number: pr.number });\n  assert.ok(data.merged_at, `PR ${pr.number} is not merged`);\n  assert.equal(pr.title, data.title);\n}\nassert.deepEqual(JSON.parse(read(path.join(process.env.SMOKE_STATE, \"web-fetch.json\"))), { containsGitHub: true });\nassert.match(read(path.join(root, `smoke-test-goose-${run}.txt`)), /^Smoke test passed for Goose at .+\\n?$/);\nconst binary = fs.lstatSync(path.join(process.env.GITHUB_WORKSPACE, \"gh-aw\"));\nassert.ok(binary.isFile() && !binary.isSymbolicLink() && (binary.mode & 0o111) !== 0, \"gh-aw build output is missing\");\nconst log = fs.readFileSync(\"/tmp/gh-aw/agent-stdio.log\", \"utf8\");\nassert.ok(log.includes(\"[goose-harness] verified Goose 1.54.0\"), \"Pinned CLI verification is missing\");\nassert.ok(!log.includes(\"Failed to start extension\"), \"A Goose MCP extension failed to connect\");\nconst events = log.split(\"\\n\").filter(line => line.trim().startsWith(\"{\")).map(line => JSON.parse(line));\nassert.ok(events.some(event => event.type === \"complete\"), \"Goose did not finish a structured run\");\nconst requests = events.flatMap(event => event.message?.content || []).filter(item =>\n  item.type === \"toolRequest\" && item.toolCall?.status === \"success\" && item.toolCall.value.name.startsWith(\"github__\"));\nconst responses = events.flatMap(event => event.message?.content || []).filter(item =>\n  item.type === \"toolResponse\" && item.toolResult?.status === \"success\" && item.toolResult.value.isError !== true);\nassert.ok(requests.some(request => responses.some(response => response.id === request.id)), \"No successful native GitHub MCP round-trip\");\nconst session = fs.readFileSync(\"/tmp/gh-aw/agent-session.jsonl\", \"utf8\").trim().split(\"\\n\").map(line => JSON.parse(line));\nassert.ok(session.every(event => event.type.includes(\".\") && event.data && typeof event.data === \"object\"), \"Goose session contains non-canonical events\");\nassert.ok(session.some(event => event.type === \"session.init\" && event.data.sourceEngine === \"goose\"), \"Goose session initialization is missing\");\nassert.ok(session.some(event => event.type === \"assistant.message\" && typeof event.data.content === \"string\"), \"Goose assistant text is missing\");\nconst starts = session.filter(event => event.type === \"tool.execution_start\");\nconst completions = session.filter(event => event.type === \"tool.execution_complete\");\nassert.ok(starts.length > 0 && completions.length > 0, \"Goose tool events are missing\");\nassert.equal(new Set(starts.map(event => event.data.toolCallId)).size, starts.length, \"Goose tool starts are duplicated\");\nfor (const event of completions) {\n  assert.ok(starts.some(start => start.data.toolCallId === event.data.toolCallId), \"Goose tool completion has no matching start\");\n}\nconst native = events.findLast(event => event.type === \"complete\");\nconst parsed = session.findLast(event => event.type === \"session.result\").data;\nassert.equal(parsed.status, \"completed\", \"Goose session result is not complete\");\nfor (const key of [\"input_tokens\", \"output_tokens\", \"total_tokens\", \"cache_read_input_tokens\"]) {\n  if (native[key] !== undefined) assert.equal(parsed.usage[key], native[key], `Goose session ${key} differs from native usage`);\n}\nif (native.cache_write_input_tokens !== undefined) assert.equal(parsed.usage.cache_creation_input_tokens, native.cache_write_input_tokens);\nassert.equal(parsed.usage.input_tokens_include_cache, true);\nassert.ok(session.some(event => event.type === \"agent.execution\" && event.data.exitCode === 0), \"Goose execution result is missing\");\nawait core.summary.addHeading(\"Goose smoke: PASS\", 2).addRaw(\"All six checks passed with host-verified file, build, web-fetch, PR, native MCP, and canonical unified-session evidence.\\n\").write();"
 
       # Small dedicated copy of the agent output so safe-output processing
       # survives a failed or timed-out upload of the larger agent artifact
@@ -1770,7 +1771,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download agent output artifact
@@ -1818,7 +1819,7 @@ jobs:
           GH_AW_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/smoke-goose.md"
           GH_AW_ENGINE_ID: "goose"
-          GH_AW_ENGINE_VERSION: "1.53.0"
+          GH_AW_ENGINE_VERSION: "1.54.0"
           GH_AW_ENGINE_MODEL: "copilot/gpt-5.4"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
@@ -1864,7 +1865,7 @@ jobs:
           GH_AW_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/smoke-goose.md"
           GH_AW_ENGINE_ID: "goose"
-          GH_AW_ENGINE_VERSION: "1.53.0"
+          GH_AW_ENGINE_VERSION: "1.54.0"
           GH_AW_ENGINE_MODEL: "copilot/gpt-5.4"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
@@ -1884,7 +1885,7 @@ jobs:
           GH_AW_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/smoke-goose.md"
           GH_AW_ENGINE_ID: "goose"
-          GH_AW_ENGINE_VERSION: "1.53.0"
+          GH_AW_ENGINE_VERSION: "1.54.0"
           GH_AW_ENGINE_MODEL: "copilot/gpt-5.4"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
@@ -2124,7 +2125,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download activation artifact
@@ -2459,7 +2460,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Check command position
@@ -2514,7 +2515,7 @@ jobs:
       GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
       GH_AW_ENGINE_ID: "goose"
       GH_AW_ENGINE_MODEL: "copilot/gpt-5.4"
-      GH_AW_ENGINE_VERSION: "1.53.0"
+      GH_AW_ENGINE_VERSION: "1.54.0"
       GH_AW_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       GH_AW_PROJECT_UTC: "-08:00"
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
@@ -2563,7 +2564,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
@@ -2664,7 +2665,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Goose"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-goose.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.53.0"
+          GH_AW_INFO_VERSION: "1.54.0"
           GH_AW_INFO_ENGINE_ID: "goose"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Download cache-memory artifact (default)
diff --git a/.github/workflows/smoke-goose.md b/.github/workflows/smoke-goose.md
index 45a951cec7e..1a509b6c1c8 100644
--- a/.github/workflows/smoke-goose.md
+++ b/.github/workflows/smoke-goose.md
@@ -104,7 +104,7 @@ post-steps:
         const binary = fs.lstatSync(path.join(process.env.GITHUB_WORKSPACE, "gh-aw"));
         assert.ok(binary.isFile() && !binary.isSymbolicLink() && (binary.mode & 0o111) !== 0, "gh-aw build output is missing");
         const log = fs.readFileSync("/tmp/gh-aw/agent-stdio.log", "utf8");
-        assert.ok(log.includes("[goose-harness] verified Goose 1.53.0"), "Pinned CLI verification is missing");
+        assert.ok(log.includes("[goose-harness] verified Goose 1.54.0"), "Pinned CLI verification is missing");
         assert.ok(!log.includes("Failed to start extension"), "A Goose MCP extension failed to connect");
         const events = log.split("\n").filter(line => line.trim().startsWith("{")).map(line => JSON.parse(line));
         assert.ok(events.some(event => event.type === "complete"), "Goose did not finish a structured run");
diff --git a/pkg/workflow/goose_runtime_test.go b/pkg/workflow/goose_runtime_test.go
index 7f177ba63b1..c52c9527a47 100644
--- a/pkg/workflow/goose_runtime_test.go
+++ b/pkg/workflow/goose_runtime_test.go
@@ -5,6 +5,7 @@ package workflow
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -22,9 +23,10 @@ import (
 )
 
 func TestGooseReleaseRuntime(t *testing.T) {
+	// Native runtime coverage is opt-in; unit tests do not replace it or verify the supplied binary's checksum.
 	binary := os.Getenv("GH_AW_TEST_GOOSE_BINARY")
 	if binary == "" {
-		t.Skip("set GH_AW_TEST_GOOSE_BINARY to a verified Goose v1.53.0 binary")
+		t.Skip("set GH_AW_TEST_GOOSE_BINARY to a verified Goose v" + loadGooseSample(t).Version + " binary")
 	}
 	dir := t.TempDir()
 	var toolCalls, inferenceCalls atomic.Int32
@@ -38,21 +40,24 @@ exports.resolveOpenAICompatibleEndpointFromReflect = () => ({provider: "github",
 	prompt := filepath.Join(dir, "prompt.txt")
 	require.NoError(t, os.WriteFile(prompt, []byte("Call the probe echo tool once, then answer Done."), 0o600))
 	config := filepath.Join(dir, "mcp.json")
-	content, err := json.Marshal(map[string]any{"mcpServers": map[string]any{
-		"probe": map[string]any{"url": server.URL + "/mcp/probe", "headers": map[string]string{"Authorization": "Bearer test-only"}},
-	}})
+	servers := map[string]map[string]any{
+		"probe": {"url": server.URL + "/mcp/probe", "headers": map[string]string{"Authorization": "Bearer test-only"}},
+	}
+	servers["probe"]["tools"] = []string{"echo"}
+	content, err := json.Marshal(map[string]any{"mcpServers": servers})
 	require.NoError(t, err)
 	require.NoError(t, os.WriteFile(config, content, 0o600))
 	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
 	defer cancel()
 	cmd := exec.CommandContext(ctx, "node", harness, binary)
 	cmd.Dir = dir
-	cmd.Env = append(os.Environ(), "GH_AW_ENGINE_VERSION=1.53.0",
-		"GH_AW_MCP_CONFIG="+config, "GH_AW_PROMPT="+prompt,
+	cmd.Env = []string{"PATH=" + os.Getenv("PATH"), "HOME=" + dir, "TMPDIR=" + dir,
+		"GH_AW_ENGINE_VERSION=" + loadGooseSample(t).Version,
+		"GH_AW_MCP_CONFIG=" + config, "GH_AW_PROMPT=" + prompt,
 		"GOOSE_MODEL=copilot/test-model", "GOOSE_MODE=auto",
 		"GOOSE_DISABLE_SESSION_NAMING=true", "GH_AW_MAX_TURNS=3",
 		"OPENAI_API_KEY=test-only", "AWF_REFLECT_ENABLED=1",
-		"GH_AW_LLM_PROVIDER=github", "TEST_ENDPOINT="+server.URL)
+		"GH_AW_LLM_PROVIDER=github", "TEST_ENDPOINT=" + server.URL}
 	output, err := cmd.CombinedOutput()
 	require.NoError(t, err, "%s", output)
 	assert.NotContains(t, string(output), "Failed to start extension")
@@ -99,6 +104,10 @@ func gooseRuntimeHandler(t *testing.T, tools, inference *atomic.Int32) http.Hand
 		tools.Add(1)
 		return &mcp.CallToolResult{Content: []mcp.Content{&mcp.TextContent{Text: "probe passed"}}}, nil, nil
 	})
+	mcp.AddTool(server, &mcp.Tool{Name: "excluded", Description: "Tool excluded by the configured allowlist"}, func(_ context.Context, _ *mcp.CallToolRequest, _ struct{}) (*mcp.CallToolResult, any, error) {
+		t.Error("Goose called a tool outside the configured allowlist")
+		return nil, nil, errors.New("tool is not allowed")
+	})
 	handler := mcp.NewStreamableHTTPHandler(func(*http.Request) *mcp.Server { return server }, &mcp.StreamableHTTPOptions{JSONResponse: true, Stateless: true})
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/chat/completions" {
@@ -129,12 +138,13 @@ func gooseRuntimeCompletion(t *testing.T, w http.ResponseWriter, r *http.Request
 	assert.Equal(t, "test-model", request.Model)
 	message := map[string]any{"role": "assistant", "content": "Done"}
 	finish := "stop"
+	found := false
+	for _, tool := range request.Tools {
+		function := tool["function"].(map[string]any)
+		found = found || function["name"] == "probe__echo"
+		assert.NotEqual(t, "probe__excluded", function["name"], "upstream extension leases must preserve the configured tool allowlist")
+	}
 	if turn == 1 {
-		found := false
-		for _, tool := range request.Tools {
-			function := tool["function"].(map[string]any)
-			found = found || function["name"] == "probe__echo"
-		}
 		assert.True(t, found, "authenticated MCP tool must be advertised on the first model turn")
 		message = map[string]any{"role": "assistant", "content": nil, "tool_calls": []any{
 			map[string]any{"index": 0, "id": "probe-call", "type": "function", "function": map[string]string{"name": "probe__echo", "arguments": "{}"}},
@@ -165,6 +175,40 @@ func gooseRuntimeCompletion(t *testing.T, w http.ResponseWriter, r *http.Request
 	}
 }
 
+func TestGooseRuntimeCompletion(t *testing.T) {
+	for _, stream := range []bool{false, true} {
+		t.Run(fmt.Sprintf("stream=%t", stream), func(t *testing.T) {
+			for turn := int32(1); turn <= 2; turn++ {
+				body := fmt.Sprintf(`{"model":"test-model","stream":%t,"tools":[{"function":{"name":"probe__echo"}}]}`, stream)
+				request := httptest.NewRequest(http.MethodPost, "/chat/completions", strings.NewReader(body))
+				response := httptest.NewRecorder()
+				gooseRuntimeCompletion(t, response, request, turn)
+				require.Equal(t, http.StatusOK, response.Code)
+				data := response.Body.String()
+				if stream {
+					assert.Equal(t, "text/event-stream", response.Header().Get("Content-Type"))
+					require.Contains(t, data, "\n\ndata: [DONE]\n\n")
+					data = strings.TrimSuffix(strings.TrimPrefix(data, "data: "), "\n\ndata: [DONE]\n\n")
+				}
+				var completion struct {
+					Choices []struct {
+						FinishReason string `json:"finish_reason"`
+					} `json:"choices"`
+				}
+				require.NoError(t, json.Unmarshal([]byte(data), &completion))
+				require.Len(t, completion.Choices, 1)
+				if turn == 1 {
+					assert.Equal(t, "tool_calls", completion.Choices[0].FinishReason)
+					assert.Contains(t, data, "probe__echo")
+				} else {
+					assert.Equal(t, "stop", completion.Choices[0].FinishReason)
+					assert.Contains(t, data, "Done")
+				}
+			}
+		})
+	}
+}
+
 func TestGooseSmokeEvidenceContract(t *testing.T) {
 	source, err := os.ReadFile("../../.github/workflows/smoke-goose.md")
 	require.NoError(t, err)
diff --git a/pkg/workflow/goose_smoke_test.go b/pkg/workflow/goose_smoke_test.go
index 3c6b1169a85..0aab3e920cd 100644
--- a/pkg/workflow/goose_smoke_test.go
+++ b/pkg/workflow/goose_smoke_test.go
@@ -39,7 +39,7 @@ func writeGooseSmokeFixtures(t *testing.T, dir string) {
 		"smoke-test-goose-123.txt":  "Smoke test passed for Goose at test timestamp\n",
 		"web-fetch.json":            `{"containsGitHub":true}`,
 		"gh-aw":                     "test build output",
-		"agent-stdio.log": `[goose-harness] verified Goose 1.53.0
+		"agent-stdio.log": `[goose-harness] verified Goose 1.54.0
 {"type":"message","message":{"role":"assistant","content":[{"type":"toolRequest","id":"tool-1","toolCall":{"status":"success","value":{"name":"github__pull_request_read"}}}]}}
 {"type":"message","message":{"role":"user","content":[{"type":"toolResponse","id":"tool-1","toolResult":{"status":"success","value":{"content":[]}}}]}}
 {"type":"message","message":{"id":"text-1","role":"assistant","content":[{"type":"text","text":"Done."}]}}
@@ -75,12 +75,12 @@ func TestGooseSmokeCheckerRequiresOperationalEvidence(t *testing.T) {
 		{name: "missing build binary", file: "gh-aw", wantError: "ENOENT"},
 		{name: "missing unified session", file: "agent-session.jsonl", wantError: "ENOENT"},
 		{name: "legacy session events", file: "agent-session.jsonl", content: `{"type":"assistant","message":{"content":[{"type":"text","text":"Done."}]}}`, wantError: "Goose session contains non-canonical events"},
-		{name: "failed MCP", file: "agent-stdio.log", content: `[goose-harness] verified Goose 1.53.0
+		{name: "failed MCP", file: "agent-stdio.log", content: `[goose-harness] verified Goose 1.54.0
 {"type":"message","message":{"content":[{"type":"toolRequest","id":"tool-1","toolCall":{"status":"success","value":{"name":"github__pull_request_read"}}},{"type":"toolResponse","id":"tool-1","toolResult":{"status":"success","value":{"isError":true,"content":[]}}}]}}
 {"type":"complete"}
 `, wantError: "No successful native GitHub MCP round-trip"},
-		{name: "missing completion", file: "agent-stdio.log", content: "[goose-harness] verified Goose 1.53.0\n", wantError: "Goose did not finish a structured run"},
-		{name: "disconnected extension", file: "agent-stdio.log", content: "[goose-harness] verified Goose 1.53.0\nFailed to start extension 'github'\n", wantError: "A Goose MCP extension failed to connect"},
+		{name: "missing completion", file: "agent-stdio.log", content: "[goose-harness] verified Goose 1.54.0\n", wantError: "Goose did not finish a structured run"},
+		{name: "disconnected extension", file: "agent-stdio.log", content: "[goose-harness] verified Goose 1.54.0\nFailed to start extension 'github'\n", wantError: "A Goose MCP extension failed to connect"},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			dir := t.TempDir()
@@ -139,12 +139,12 @@ func TestGooseSmokeRuntimeProbeTrimsNativeVersionOutput(t *testing.T) {
 	probe, _, ok = strings.Cut(probe, "\n   JS\n")
 	require.True(t, ok)
 	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "goose"), []byte("#!/bin/sh\nprintf ' 1.53.0\\n'\n"), 0o700))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "goose"), []byte("#!/bin/sh\nprintf ' 1.54.0\\n'\n"), 0o700))
 	config := filepath.Join(dir, "config.json")
 	require.NoError(t, os.WriteFile(config, []byte(`{"extensions":{"github":{"type":"streamable_http","uri":"http://awmg-mcpg:8080/mcp/github","headers":{"Authorization":"Bearer test-only"}}}}`), 0o600))
 	cmd := exec.Command("node", "-e", probe)
 	cmd.Env = append(os.Environ(), "PATH="+dir+string(os.PathListSeparator)+os.Getenv("PATH"),
-		"GH_AW_ENGINE_VERSION=1.53.0", "GOOSE_PROVIDER=openai", "GOOSE_MODEL=gpt-5.4",
+		"GH_AW_ENGINE_VERSION=1.54.0", "GOOSE_PROVIDER=openai", "GOOSE_MODEL=gpt-5.4",
 		"OPENAI_HOST=http://test-proxy", "OPENAI_BASE_PATH=chat/completions",
 		"GH_AW_MAX_TURNS=30", "GOOSE_ADDITIONAL_CONFIG_FILES="+config)
 	output, err := cmd.CombinedOutput()
diff --git a/pkg/workflow/goose_workflow_test.go b/pkg/workflow/goose_workflow_test.go
index f8f0ffc181e..071d1d28982 100644
--- a/pkg/workflow/goose_workflow_test.go
+++ b/pkg/workflow/goose_workflow_test.go
@@ -31,7 +31,7 @@ func loadGooseSample(t *testing.T) *EngineDefinition {
 
 func TestGooseSampleExecution(t *testing.T) {
 	def := loadGooseSample(t)
-	require.Equal(t, "1.53.0", def.Version)
+	require.Equal(t, "1.54.0", def.Version)
 	engine, err := NewBehaviorDefinedEngine(def)
 	require.NoError(t, err)
 	assert.True(t, engine.GetCapabilities().MCP)
@@ -42,7 +42,7 @@ func TestGooseSampleExecution(t *testing.T) {
 		EngineConfig: &EngineConfig{ID: "goose", Version: def.Version, MaxTurns: "30"},
 	}, "/tmp/gh-aw/agent-stdio.log")
 	execution := strings.Join(steps[len(steps)-1], "\n")
-	assert.Contains(t, execution, "GH_AW_ENGINE_VERSION: 1.53.0")
+	assert.Contains(t, execution, "GH_AW_ENGINE_VERSION: 1.54.0")
 	assert.Contains(t, execution, "GH_AW_MAX_TURNS: 30")
 	assert.Contains(t, execution, "GOOSE_MODEL: copilot/auto")
 	assert.Contains(t, execution, "GH_AW_LLM_PROVIDER: github")
@@ -110,12 +110,13 @@ exports.resolveOpenAICompatibleEndpointFromReflect = () => ({provider: "github",
 	config := filepath.Join(dir, "mcp.json")
 	require.NoError(t, os.WriteFile(config, []byte(`{"mcpServers":{
 		"github":{"url":"http://awmg-mcpg:8080/mcp/github","headers":{"Authorization":"Bearer test-only"},"tools":["pull_request_read"]},
+		"probe":{"url":"http://awmg-mcpg:8080/mcp/probe","tools":["echo"]},
 		"local":{"command":"node","args":["a b","quote'","$(not-a-command)"],"env":{"TEST":"a b"}}
 	}}`), 0o600))
 	binary := filepath.Join(dir, "test-goose")
 	fixture := `#!/usr/bin/env node
 const fs = require("fs");
-if (process.argv.includes("--version")) { console.log("1.53.0"); process.exit(0); }
+if (process.argv.includes("--version")) { console.log("1.54.0"); process.exit(0); }
 const configPath = process.env.GOOSE_ADDITIONAL_CONFIG_FILES;
 fs.writeFileSync(process.env.TEST_OUTPUT, JSON.stringify({
 	args: process.argv.slice(2),
@@ -172,6 +173,9 @@ process.exit(Number(process.env.TEST_EXIT || 0));
 		assert.Equal(t, "http://awmg-mcpg:8080/mcp/github", http["uri"])
 		assert.Equal(t, map[string]any{"Authorization": "Bearer test-only"}, http["headers"])
 		assert.Equal(t, []any{"pull_request_read"}, http["available_tools"])
+		probe := extensions["probe"].(map[string]any)
+		assert.Equal(t, []any{"echo"}, probe["available_tools"])
+		assert.NotContains(t, probe["available_tools"], "excluded", "the runtime probe's excluded tool must not be available")
 		local := extensions["local"].(map[string]any)
 		assert.Equal(t, "stdio", local["type"])
 		assert.Equal(t, []any{"a b", "quote'", "$(not-a-command)"}, local["args"])