[docs] Update glossary - weekly full scan

docs/src/content/docs/reference/glossary.md

@@ -59,6 +59,10 @@ A transparent proxy service that enables unified HTTP access to multiple MCP ser
 
 A frontmatter field that passes additional GitHub bot identity strings to the [MCP Gateway](#mcp-gateway). The gateway merges these with its built-in trusted identity list to determine which bot identities are permitted. This field is additive — it can only extend the gateway's internal list, not remove built-in entries. Configured under `sandbox.mcp:` and compiled into the `trustedBots` array in the generated gateway configuration. Example entries: `github-actions[bot]`, `copilot-swe-agent[bot]`. See [MCP Gateway Reference](/gh-aw/reference/mcp-gateway/).
 
+### MCP Gateway Environment Injection
+
+The mechanism that transports `sandbox.mcp.env` custom environment variable values from workflow frontmatter into the MCP Gateway's Docker container. Values are routed through compiler-controlled, indexed transport variables (`GH_AW_MCP_GATEWAY_ENV_0`, `GH_AW_MCP_GATEWAY_ENV_1`, …) and a companion manifest variable (`GH_AW_MCP_GATEWAY_CUSTOM_ENV_NAMES`), rather than being interpolated directly into the generated shell script or Docker command string. A JavaScript launcher (`start_mcp_gateway.cjs`) reads the manifest and reconstructs atomic `-e NAME=VALUE` Docker arguments at runtime. Both the Go compiler and the JS launcher validate variable names against `^[A-Z_][A-Z0-9_]*$`, preventing shell metacharacters or dangerous names (such as `BASH_ENV`) in custom values from being sourced or interpreted before the gateway process starts. See [MCP Gateway Reference](/gh-aw/reference/mcp-gateway/).
+
 ### MCP Server
 
 A service that implements the Model Context Protocol to provide specific capabilities to AI agents. Examples include the GitHub MCP server (for GitHub API operations), Playwright MCP server (for browser automation), or custom MCP servers for specialized tools. See [Playwright Reference](/gh-aw/reference/playwright/) for browser automation configuration.
@@ -293,6 +297,10 @@ safe-outputs:
 
 See [Safe Outputs Reference](/gh-aw/reference/safe-outputs/).
 
+### Action-Failure Issue Expiry (`action_failure_issue_expires`)
+
+An `aw.json` governance setting, in hours, for the expiration of failure issues opened by the conclusion job (including grouped parent issues when `group-reports: true`). Setting `action_failure_issue_expires` explicitly is treated as opt-in: it causes `agentics-maintenance.yml` to be generated, if not already generated by another expiring safe output, so the scheduled `close-expired-entities` job can enforce the expiration. If left unset and no other workflow output requires scheduled maintenance, the implicit 168-hour (7-day) default is not written into failure issues, since no scheduled job exists to close them, and failure issues are created without an expiration marker. See [Ephemerals Reference](/gh-aw/reference/ephemerals/).
+
 ### Upload Assets
 
 A safe output capability for uploading generated files (screenshots, charts, reports) to an orphaned git branch for persistent storage. The AI calls the `upload_asset` tool to register files, which are committed to a dedicated assets branch by a separate permission-controlled job. Assets are accessible via GitHub raw URLs. Commonly used for visual testing artifacts, data visualizations, and generated documentation.
@@ -663,6 +671,10 @@ description: Summarizes file contents briefly
 You are a file summarization assistant.
 ```
 
+### End Marker (`## end agent:`, `## end skill:`)
+
+Optional explicit syntax that closes an inline sub-agent or inline skill block at a precise point, instead of relying on the implicit boundary of the next `##` heading or end of file. Written as `` ## end agent: `name` `` or `` ## end skill: `name` ``, matching the opening heading's name. Recommended when a block's body legitimately needs `##`-level headings of its own, or when content follows the block in the same file. When a sub-agent or skill block is brought in via [Runtime Import](#runtime-import-runtime-import) and has no explicit end marker, the import resolver automatically inserts one at the implicit boundary, making every runtime import import-safe by default. See [Inline Sub-Agents Reference](/gh-aw/reference/inline-sub-agents/).
+
 ### Inline Engine Definition
 
 An engine configuration format that specifies a runtime adapter and optional provider settings directly in workflow frontmatter, without requiring a named catalog entry. Uses a `runtime` object (with `id` and optional `version`) to identify the adapter and an optional `provider` object for model selection, authentication, and request shaping. Useful for connecting to self-hosted or third-party AI backends.
@@ -719,6 +731,10 @@ See [AI Engines Reference](/gh-aw/reference/engines/).
 
 A declarative configuration block inside an engine definition file (a built-in definition under `pkg/workflow/data/engines/<id>.md`, or a shared workflow imported from a repository) that describes how the compiler should generate install, config, execution, and MCP steps for a CLI-style engine. Defining behaviors in frontmatter avoids bespoke Go wrapper code — the runtime reads the fields and generates the corresponding workflow steps automatically. Key sub-fields include `installation` (package manager, binary name, version), `config-file` (path, content, merge strategy), `execution` (command name, args, model env var, MCP config env var), `manifest` (protected files and path prefixes), and `capabilities`. Engines that use `engine.behaviors` inherit shared step generation logic via `behavior_defined_engine.go`. See [AI Engines Reference](/gh-aw/reference/engines/).
 
+### Log-Parser (`log-parser`)
+
+An `EngineBehaviorDefinition` field that accepts an inline JavaScript snippet containing a `parseLog(logContent)` function, enabling behavior-defined engines to produce step summaries and normalized log events without a bespoke Go log parser. At compile time, the snippet is materialized to a runtime script file with a stable ID (`<engine-id>_log_parser`). The raw `parseLog` function is auto-wrapped by `createEngineLogParser` from `log_parser_shared.cjs`, so engine authors provide only the parsing logic and inherit file reading, event enrichment, and step-summary generation; the function must return `{ markdown, logEntries, mcpFailures, maxTurnsHit }`. See [AI Engines Reference](/gh-aw/reference/engines/).
+
 ```aw wrap
 engine:
   id: my-agent
@@ -1089,6 +1105,10 @@ Markdown files with YAML frontmatter stored in `.github/skills/` for repository-
 
 A frontmatter field that declares skills to install in the activation job before the agent runs. Entries can be local development paths (for example, `skills/name` or `.github/skills/name`) or external skill specs (for example, `owner/repo` or `owner/repo/path@sha`) pointing to a `.github/skills/` skill directory. Local paths install via `gh skill install ... --from-local`, while static external references must be pinned to a full 40-character lowercase commit SHA. When a skill fails to install, the failure is captured in the agent failure context and surfaces in failure issue/comment reports. Requires a recent version of the `gh` CLI. See [Skill Install Failure](#skill-install-failure) for error handling.
 
+### Non-SHA Refs (Skills)
+
+Branch or tag names (as opposed to a full 40-character lowercase commit SHA) supplied as the `<ref>` in a skill reference (`owner/repo@<ref>`, `owner/repo/skill/path@<ref>`). At compile time, `gh aw` resolves a non-SHA ref and rewrites the reference to the matching commit SHA in the generated lock file, so the installed skill is pinned even though the source workflow specifies a mutable ref. If resolution fails (for example, no network access or authentication), the compiler keeps the original unpinned ref and emits a warning. Omitting the ref entirely (`owner/repo@`) installs from the repository's default branch, is never pinned, and always triggers a compiler warning. See [Frontmatter Reference](/gh-aw/reference/frontmatter/#frontmatter-skills-skills).
+
 ### Skill Install Failure
 
 A failure category reported when one or more frontmatter skills could not be installed before the agent ran. Triggered by invalid skill references, inaccessible repositories, insufficient token permissions, or unsupported `gh` CLI versions. When skill install failures occur, they are captured by the `collect-skill-install-failures` activation step and included in the agent failure issue or comment via the `{skill_install_failure_context}` template. Resolve by verifying the skill reference format (local path such as `skills/name` or external reference such as `owner/repo` / `owner/repo/skill/path@sha`), confirming the token has read access to external skill repositories when applicable, and ensuring a recent `gh` CLI version is available. See [Safe Outputs Reference](/gh-aw/reference/safe-outputs/).
@@ -1121,7 +1141,7 @@ An interactive web-based editor for authoring, compiling, and previewing agentic
 
 ### Audit (`gh aw audit`)
 
-A CLI command that downloads workflow run artifacts and logs, analyzes MCP tool usage and network behavior, and generates a structured Markdown or JSON report. The report covers failure analysis, tool usage, MCP server status, firewall activity, token/cost metrics, behavior fingerprint, and safe-output summary. Accepts a numeric run ID or any GitHub Actions run or job URL. See [Audit Commands](/gh-aw/reference/audit/).
+A CLI command that downloads workflow run artifacts and logs, analyzes MCP tool usage and network behavior, and generates a structured Markdown or JSON report. The report covers failure analysis, tool usage, MCP server status, firewall activity, token/cost metrics, behavior fingerprint, and safe-output summary. Accepts a numeric run ID or any GitHub Actions run or job URL. Both `gh aw audit` and `gh aw logs` accept a `--runtime` flag (for example, `--runtime gvisor` or `--runtime docker-sbx`) that filters results to runs whose [`sandbox.agent.runtime`](#sandboxagentruntime) matches the given value, using the value persisted in each run's `aw_info.json`. See [Audit Commands](/gh-aw/reference/audit/).
 
 ### Audit Diff (multi-run mode)