diff --git a/.github/workflows/avenger.lock.yml b/.github/workflows/avenger.lock.yml
index c0adf7c46da..8d4411d0417 100644
--- a/.github/workflows/avenger.lock.yml
+++ b/.github/workflows/avenger.lock.yml
@@ -2287,6 +2287,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml
index 7238d5b7938..d9f29ea2273 100644
--- a/.github/workflows/changeset.lock.yml
+++ b/.github/workflows/changeset.lock.yml
@@ -2326,6 +2326,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         env:
diff --git a/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml b/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml
index 8c0fd05d891..e4389a4b5ec 100644
--- a/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml
+++ b/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml
@@ -1750,6 +1750,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index f19c28ee436..facf239039f 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -2388,6 +2388,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index 222e8f9d58e..a0c6c3c64b9 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -2643,6 +2643,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index 9c8c5eaffc4..c7b7e85776d 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -2377,6 +2377,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index 8709fdbe4bb..5d1c31b806a 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -2254,6 +2254,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 0246b2766c0..eab67f87f27 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -2285,6 +2285,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         env:
diff --git a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
index 91de7e8f596..977ec614e08 100644
--- a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
+++ b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml
@@ -2537,6 +2537,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml
index cbd1da7d134..4cad269e01c 100644
--- a/.github/workflows/daily-architecture-diagram.lock.yml
+++ b/.github/workflows/daily-architecture-diagram.lock.yml
@@ -2506,6 +2506,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
index 05eb177ef2d..0d8b24c2db2 100644
--- a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
+++ b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
@@ -2344,6 +2344,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-caveman-optimizer.lock.yml b/.github/workflows/daily-caveman-optimizer.lock.yml
index 54cf5495c44..ebd0bec61e3 100644
--- a/.github/workflows/daily-caveman-optimizer.lock.yml
+++ b/.github/workflows/daily-caveman-optimizer.lock.yml
@@ -2414,6 +2414,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-code-debt-aider.lock.yml b/.github/workflows/daily-code-debt-aider.lock.yml
index 34de11a49b8..da29d25d0ec 100644
--- a/.github/workflows/daily-code-debt-aider.lock.yml
+++ b/.github/workflows/daily-code-debt-aider.lock.yml
@@ -1748,6 +1748,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-community-attribution.lock.yml b/.github/workflows/daily-community-attribution.lock.yml
index 1f86503ef0e..fb3724822af 100644
--- a/.github/workflows/daily-community-attribution.lock.yml
+++ b/.github/workflows/daily-community-attribution.lock.yml
@@ -2574,6 +2574,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
index 5321ae07fa1..ff136efa1b9 100644
--- a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
+++ b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml
@@ -2280,6 +2280,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml
index 875cef11a69..6089e7e496d 100644
--- a/.github/workflows/daily-doc-healer.lock.yml
+++ b/.github/workflows/daily-doc-healer.lock.yml
@@ -2525,6 +2525,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index 5723c807a57..a01ba61ac56 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -2306,6 +2306,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-documentation-diagram.lock.yml b/.github/workflows/daily-documentation-diagram.lock.yml
index e6431f5182e..76870fb65f1 100644
--- a/.github/workflows/daily-documentation-diagram.lock.yml
+++ b/.github/workflows/daily-documentation-diagram.lock.yml
@@ -2200,6 +2200,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
index 99ef047468e..1f524b48089 100644
--- a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
+++ b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
@@ -2203,6 +2203,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-go-test-parallelizer.lock.yml b/.github/workflows/daily-go-test-parallelizer.lock.yml
index 51d4ae1d5c2..e2d109a26ea 100644
--- a/.github/workflows/daily-go-test-parallelizer.lock.yml
+++ b/.github/workflows/daily-go-test-parallelizer.lock.yml
@@ -2251,6 +2251,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-go-test-stubs-aider.lock.yml b/.github/workflows/daily-go-test-stubs-aider.lock.yml
index 82ef27f547d..bf9e94c7cd2 100644
--- a/.github/workflows/daily-go-test-stubs-aider.lock.yml
+++ b/.github/workflows/daily-go-test-stubs-aider.lock.yml
@@ -1748,6 +1748,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
index 8ef1aa05ffe..f65bf71d57c 100644
--- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml
+++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
@@ -2119,6 +2119,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-safe-output-integrator.lock.yml b/.github/workflows/daily-safe-output-integrator.lock.yml
index d7ad6d4ba91..9ac50f79fcd 100644
--- a/.github/workflows/daily-safe-output-integrator.lock.yml
+++ b/.github/workflows/daily-safe-output-integrator.lock.yml
@@ -2204,6 +2204,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
index 246f07fd92d..b40df13878e 100644
--- a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
+++ b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml
@@ -2355,16 +2355,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true
-          fetch-depth: 0
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
-      - name: Fetch additional refs
-        if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') || (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
-        env:
-          GH_AW_FETCH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
-        run: |
-          header=$(printf "x-access-token:%s" "${GH_AW_FETCH_TOKEN}" | base64 -w 0)
-          git -c "http.extraheader=Authorization: Basic ${header}" fetch origin '+refs/heads/*:refs/remotes/origin/*'
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') || (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         env:
diff --git a/.github/workflows/daily-trajectory-grader-implementer.lock.yml b/.github/workflows/daily-trajectory-grader-implementer.lock.yml
index 8713f8c2fe8..d53da7840d4 100644
--- a/.github/workflows/daily-trajectory-grader-implementer.lock.yml
+++ b/.github/workflows/daily-trajectory-grader-implementer.lock.yml
@@ -1915,6 +1915,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index 87b058880ea..6a77afab73e 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -2166,6 +2166,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/daily-yamllint-fixer.lock.yml b/.github/workflows/daily-yamllint-fixer.lock.yml
index 7ea901581fe..2ddb961e8f8 100644
--- a/.github/workflows/daily-yamllint-fixer.lock.yml
+++ b/.github/workflows/daily-yamllint-fixer.lock.yml
@@ -2260,6 +2260,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index e060f7f1d48..a3fcf0d8f00 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -1950,6 +1950,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index b79449ab534..c5b83738765 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -2412,6 +2412,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/design-decision-gate.lock.yml b/.github/workflows/design-decision-gate.lock.yml
index f6b6581dd6d..a39637cc8cc 100644
--- a/.github/workflows/design-decision-gate.lock.yml
+++ b/.github/workflows/design-decision-gate.lock.yml
@@ -2384,6 +2384,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         env:
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index 9394ab3b918..3f26da0d9da 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -2490,6 +2490,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index 64c1e7cebfe..1df8b6a8cd7 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -2160,6 +2160,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/eslint-miner.lock.yml b/.github/workflows/eslint-miner.lock.yml
index 261bbe738a4..dc43d7607c0 100644
--- a/.github/workflows/eslint-miner.lock.yml
+++ b/.github/workflows/eslint-miner.lock.yml
@@ -2186,6 +2186,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/evoskill-evolver.lock.yml b/.github/workflows/evoskill-evolver.lock.yml
index 65b2c19c410..9f255efdfb0 100644
--- a/.github/workflows/evoskill-evolver.lock.yml
+++ b/.github/workflows/evoskill-evolver.lock.yml
@@ -2196,6 +2196,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index 9796abc562d..1c535a3f044 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -2166,6 +2166,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index cb09e7e94cb..e72a7dfe2fc 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -1948,6 +1948,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index 74f6d8a56bb..287e0262dfb 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -2455,7 +2455,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true
-          fetch-depth: 0
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
       - name: Configure Git credentials
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index 64dbc5791f8..41a0abf50b0 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -2284,6 +2284,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 65d4d715a05..1023430a4c0 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -2294,6 +2294,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index 62af02f001e..469396c045e 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -1928,6 +1928,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index 473cdaf034b..76784c13769 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -1880,6 +1880,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index 75741c56c6e..47ec978ad65 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -1875,6 +1875,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/linter-miner.lock.yml b/.github/workflows/linter-miner.lock.yml
index 9db0f56ea0e..47337673282 100644
--- a/.github/workflows/linter-miner.lock.yml
+++ b/.github/workflows/linter-miner.lock.yml
@@ -1958,6 +1958,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index 8d532bcaeba..29eec8a8e2a 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -1926,6 +1926,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         env:
diff --git a/.github/workflows/necromancer.lock.yml b/.github/workflows/necromancer.lock.yml
index a3a97ec51bd..f9cbe7ba76c 100644
--- a/.github/workflows/necromancer.lock.yml
+++ b/.github/workflows/necromancer.lock.yml
@@ -2371,6 +2371,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         env:
diff --git a/.github/workflows/pr-sous-chef.lock.yml b/.github/workflows/pr-sous-chef.lock.yml
index 83fd2faed22..5916dd1f2c6 100644
--- a/.github/workflows/pr-sous-chef.lock.yml
+++ b/.github/workflows/pr-sous-chef.lock.yml
@@ -2657,15 +2657,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true
-          fetch-depth: 0
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
-      - name: Fetch additional refs
-        if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
-        env:
-          GH_AW_FETCH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
-        run: |
-          header=$(printf "x-access-token:%s" "${GH_AW_FETCH_TOKEN}" | base64 -w 0)
-          git -c "http.extraheader=Authorization: Basic ${header}" fetch origin '+refs/pull/*/head:refs/remotes/origin/pull/*/head'
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         env:
diff --git a/.github/workflows/purelock.lock.yml b/.github/workflows/purelock.lock.yml
index 64c87a1dcaa..94d7541ced5 100644
--- a/.github/workflows/purelock.lock.yml
+++ b/.github/workflows/purelock.lock.yml
@@ -2499,6 +2499,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 84c8e1112f6..f75a0d29d3e 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -2139,6 +2139,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index 173459bf69f..7bad4aa6ccd 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -2459,6 +2459,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/ruflo-backed-task.lock.yml b/.github/workflows/ruflo-backed-task.lock.yml
index d2d8cc3d3ff..8dffe582be2 100644
--- a/.github/workflows/ruflo-backed-task.lock.yml
+++ b/.github/workflows/ruflo-backed-task.lock.yml
@@ -2089,6 +2089,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/schema-feature-coverage.lock.yml b/.github/workflows/schema-feature-coverage.lock.yml
index ca8d0e824c8..a0a43d8cd8f 100644
--- a/.github/workflows/schema-feature-coverage.lock.yml
+++ b/.github/workflows/schema-feature-coverage.lock.yml
@@ -1820,7 +1820,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true
-          fetch-depth: 1
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
index d9a345fbde0..2042fbc1d22 100644
--- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
@@ -2079,6 +2079,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_SIDE_REPO_PAT }}
+          sparse-checkout: .
       - name: Checkout github/gh-aw-side-repo into gh-aw-side-repo
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml
index 4cd1ab42ece..081fcf3d10a 100644
--- a/.github/workflows/smoke-multi-pr.lock.yml
+++ b/.github/workflows/smoke-multi-pr.lock.yml
@@ -2040,6 +2040,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index f5789932849..e6bf4b279e8 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -2794,6 +2794,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
index 95ebd309463..43f339b9085 100644
--- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
@@ -2096,6 +2096,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_SIDE_REPO_PAT }}
+          sparse-checkout: .
       - name: Checkout github/gh-aw-side-repo into gh-aw-side-repo
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/spec-enforcer.lock.yml b/.github/workflows/spec-enforcer.lock.yml
index f49b1a7140c..2aaf0f882c4 100644
--- a/.github/workflows/spec-enforcer.lock.yml
+++ b/.github/workflows/spec-enforcer.lock.yml
@@ -2171,6 +2171,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/spec-extractor.lock.yml b/.github/workflows/spec-extractor.lock.yml
index f98b49522cd..45dfffe32bc 100644
--- a/.github/workflows/spec-extractor.lock.yml
+++ b/.github/workflows/spec-extractor.lock.yml
@@ -1952,6 +1952,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/squad-implement-worker.lock.yml b/.github/workflows/squad-implement-worker.lock.yml
index b3b7d321f31..46be64b1c85 100644
--- a/.github/workflows/squad-implement-worker.lock.yml
+++ b/.github/workflows/squad-implement-worker.lock.yml
@@ -1992,6 +1992,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/squad.lock.yml b/.github/workflows/squad.lock.yml
index 7309842ea5d..a53cb8c9ce2 100644
--- a/.github/workflows/squad.lock.yml
+++ b/.github/workflows/squad.lock.yml
@@ -2564,6 +2564,7 @@ jobs:
         with:
           persist-credentials: true
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index a9e062e30ba..725ead09fe4 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -2462,6 +2462,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index 373555a35c9..4baebb765ae 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -2372,6 +2372,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') || (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')
         env:
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index d60d4c33042..d86f31ec8c4 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -1923,6 +1923,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index 863b1ebf9cf..c434196cf57 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -2340,6 +2340,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/update-astro.lock.yml b/.github/workflows/update-astro.lock.yml
index 0005141330d..01b556d7390 100644
--- a/.github/workflows/update-astro.lock.yml
+++ b/.github/workflows/update-astro.lock.yml
@@ -1952,6 +1952,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml
index c93babb6581..c7daf03c9a8 100644
--- a/.github/workflows/weekly-blog-post-writer.lock.yml
+++ b/.github/workflows/weekly-blog-post-writer.lock.yml
@@ -2574,6 +2574,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index c52adc96ee7..3ebb5474fdd 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -1891,6 +1891,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index 13787e90acf..9d273441ea3 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -1861,6 +1861,7 @@ jobs:
           persist-credentials: true
           ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}
           token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          sparse-checkout: .
       - name: Configure Git credentials
         if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
         env:
diff --git a/actions/setup/js/create_pull_request.cjs b/actions/setup/js/create_pull_request.cjs
index 81e1488e188..815525d291f 100644
--- a/actions/setup/js/create_pull_request.cjs
+++ b/actions/setup/js/create_pull_request.cjs
@@ -168,7 +168,10 @@ async function tryRecoverGitAmAddAddConflict(execApi) {
 
       core.debug(`Checking out patch version for add/add conflict file: ${file}`);
       await execApi.exec("git", ["checkout", "--theirs", "--", file]);
-      await execApi.exec("git", ["add", "--", file]);
+      // --sparse: the safe_outputs checkout is sparse by default (root files only), and a
+      // plain "git add" refuses to update index entries for paths outside the sparse-checkout
+      // cone. Nested conflict files would therefore stay unmerged and break "git am --continue".
+      await execApi.exec("git", ["add", "--sparse", "--", file]);
     }
     await execApi.exec("git", ["am", "--continue"]);
     core.info("Patch applied successfully after resolving add/add conflict(s)");
diff --git a/actions/setup/js/create_pull_request.test.cjs b/actions/setup/js/create_pull_request.test.cjs
index 11935477d90..ba3963a6bf2 100644
--- a/actions/setup/js/create_pull_request.test.cjs
+++ b/actions/setup/js/create_pull_request.test.cjs
@@ -3160,6 +3160,8 @@ describe("create_pull_request - patch apply fallback to original base commit", (
 
     expect(result.success).toBe(true);
     expect(global.exec.exec).toHaveBeenCalledWith("git", ["checkout", "--theirs", "--", conflictedPath]);
+    // Staged with --sparse so nested paths outside the safe_outputs sparse checkout cone resolve.
+    expect(global.exec.exec).toHaveBeenCalledWith("git", ["add", "--sparse", "--", conflictedPath]);
     expect(global.exec.exec).toHaveBeenCalledWith("git", ["am", "--continue"]);
     expect(global.core.debug).toHaveBeenCalledWith(expect.stringContaining("Add/add recovery probe unresolved files"));
   });
diff --git a/actions/setup/js/git_patch_integration.test.cjs b/actions/setup/js/git_patch_integration.test.cjs
index 5e5b5432327..15bbd798797 100644
--- a/actions/setup/js/git_patch_integration.test.cjs
+++ b/actions/setup/js/git_patch_integration.test.cjs
@@ -381,6 +381,108 @@ describe("git patch integration tests", () => {
     });
   });
 
+  // ──────────────────────────────────────────────────────
+  // Sparse Checkout (safe_outputs minimal checkout) Scenarios
+  // ──────────────────────────────────────────────────────
+
+  describe("root-only sparse checkout patch application", () => {
+    let sparseDir;
+
+    /**
+     * Clone repoDir into a root-only sparse working copy, mirroring the safe_outputs job's
+     * implicit checkout (`actions/checkout` with `sparse-checkout: .`).
+     */
+    function createRootOnlySparseClone() {
+      const cloneDir = fs.mkdtempSync(path.join(os.tmpdir(), "git-patch-sparse-"));
+      execGit(["clone", "--no-checkout", repoDir, cloneDir]);
+      execGit(["config", "user.name", "Test User"], { cwd: cloneDir });
+      execGit(["config", "user.email", "test@example.com"], { cwd: cloneDir });
+      execGit(["sparse-checkout", "set", "--cone", "."], { cwd: cloneDir });
+      execGit(["checkout", "main"], { cwd: cloneDir });
+      return cloneDir;
+    }
+
+    afterEach(() => {
+      cleanupTestRepo(sparseDir);
+      sparseDir = undefined;
+    });
+
+    it("should apply a patch touching nested paths that are not materialized", () => {
+      // Seed a nested file on main so the sparse clone has a non-materialized nested path.
+      fs.mkdirSync(path.join(repoDir, "pkg", "deep"), { recursive: true });
+      fs.writeFileSync(path.join(repoDir, "pkg", "deep", "nested.txt"), "original\n");
+      execGit(["add", "pkg/deep/nested.txt"], { cwd: repoDir });
+      execGit(["commit", "-m", "Add nested file"], { cwd: repoDir });
+
+      const baseCommit = execGit(["rev-parse", "HEAD"], { cwd: repoDir }).stdout.trim();
+
+      execGit(["checkout", "-b", "feature-nested"], { cwd: repoDir });
+      fs.writeFileSync(path.join(repoDir, "pkg", "deep", "nested.txt"), "updated\n");
+      fs.writeFileSync(path.join(repoDir, "pkg", "deep", "created.txt"), "brand new\n");
+      execGit(["add", "pkg"], { cwd: repoDir });
+      execGit(["commit", "-m", "Update nested files"], { cwd: repoDir });
+
+      const patchPath = path.join(patchDir, "nested.patch");
+      const patchResult = execGit(["format-patch", `${baseCommit}..feature-nested`, "--stdout"], { cwd: repoDir });
+      fs.writeFileSync(patchPath, patchResult.stdout);
+
+      execGit(["checkout", "main"], { cwd: repoDir });
+      sparseDir = createRootOnlySparseClone();
+
+      // The nested path is tracked but intentionally not present in the sparse working tree.
+      expect(fs.existsSync(path.join(sparseDir, "README.md"))).toBe(true);
+      expect(fs.existsSync(path.join(sparseDir, "pkg", "deep", "nested.txt"))).toBe(false);
+
+      const amResult = execGit(["am", "--3way", patchPath], { cwd: sparseDir, allowFailure: true });
+      expect(amResult.status).toBe(0);
+
+      expect(execGit(["show", "HEAD:pkg/deep/nested.txt"], { cwd: sparseDir }).stdout).toBe("updated\n");
+      expect(execGit(["show", "HEAD:pkg/deep/created.txt"], { cwd: sparseDir }).stdout).toBe("brand new\n");
+    });
+
+    it("should recover nested add/add conflicts with git add --sparse", () => {
+      const baseCommit = execGit(["rev-parse", "HEAD"], { cwd: repoDir }).stdout.trim();
+
+      execGit(["checkout", "-b", "feature-nested-add-add"], { cwd: repoDir });
+      fs.mkdirSync(path.join(repoDir, "docs", "deep"), { recursive: true });
+      fs.writeFileSync(path.join(repoDir, "docs", "deep", "conflict.md"), "Patch branch content\n");
+      execGit(["add", "docs/deep/conflict.md"], { cwd: repoDir });
+      execGit(["commit", "-m", "Patch adds nested conflict file"], { cwd: repoDir });
+
+      const patchPath = path.join(patchDir, "nested-add-add.patch");
+      const patchResult = execGit(["format-patch", `${baseCommit}..feature-nested-add-add`, "--stdout"], { cwd: repoDir });
+      fs.writeFileSync(patchPath, patchResult.stdout);
+
+      execGit(["checkout", "main"], { cwd: repoDir });
+      fs.mkdirSync(path.join(repoDir, "docs", "deep"), { recursive: true });
+      fs.writeFileSync(path.join(repoDir, "docs", "deep", "conflict.md"), "Main branch content\n");
+      execGit(["add", "docs/deep/conflict.md"], { cwd: repoDir });
+      execGit(["commit", "-m", "Main adds same nested file differently"], { cwd: repoDir });
+
+      sparseDir = createRootOnlySparseClone();
+
+      const amResult = execGit(["am", "--3way", patchPath], { cwd: sparseDir, allowFailure: true });
+      expect(amResult.status).not.toBe(0);
+
+      const statusPorcelain = execGit(["status", "--porcelain", "-z"], { cwd: sparseDir }).stdout.split("\0").filter(Boolean);
+      expect(statusPorcelain).toContain("AA docs/deep/conflict.md");
+
+      execGit(["checkout", "--theirs", "--", "docs/deep/conflict.md"], { cwd: sparseDir });
+
+      // A plain "git add" refuses to stage paths outside the sparse-checkout cone, which is
+      // why the handlers stage add/add resolutions with --sparse.
+      const plainAdd = execGit(["add", "--", "docs/deep/conflict.md"], { cwd: sparseDir, allowFailure: true });
+      expect(plainAdd.status).not.toBe(0);
+
+      execGit(["add", "--sparse", "--", "docs/deep/conflict.md"], { cwd: sparseDir });
+      execGit(["am", "--continue"], { cwd: sparseDir });
+
+      expect(execGit(["show", "HEAD:docs/deep/conflict.md"], { cwd: sparseDir }).stdout).toBe("Patch branch content\n");
+      const subject = execGit(["log", "-1", "--format=%s"], { cwd: sparseDir }).stdout.trim();
+      expect(subject).toBe("Patch adds nested conflict file");
+    });
+  });
+
   // ──────────────────────────────────────────────────────
   // Concurrent Push Scenarios
   // ──────────────────────────────────────────────────────
diff --git a/actions/setup/js/push_to_pull_request_branch.cjs b/actions/setup/js/push_to_pull_request_branch.cjs
index 436cf5d19b8..b263518683a 100644
--- a/actions/setup/js/push_to_pull_request_branch.cjs
+++ b/actions/setup/js/push_to_pull_request_branch.cjs
@@ -1209,7 +1209,10 @@ async function main(config = {}) {
                 core.warning(`Detected add/add conflict(s) for ${unresolvedFiles.join(", ")}; preferring patch version and continuing`);
                 for (const file of unresolvedFiles) {
                   await exec.exec("git", ["checkout", "--theirs", "--", file], baseGitOpts);
-                  await exec.exec("git", ["add", "--", file], baseGitOpts);
+                  // --sparse: the safe_outputs checkout is sparse by default (root files only),
+                  // and a plain "git add" refuses to update index entries for paths outside the
+                  // sparse-checkout cone, leaving nested conflict files unmerged.
+                  await exec.exec("git", ["add", "--sparse", "--", file], baseGitOpts);
                 }
                 await exec.exec("git", ["am", "--continue"], baseGitOpts);
                 core.info("Patch applied successfully after resolving add/add conflict(s)");
diff --git a/actions/setup/js/push_to_pull_request_branch.test.cjs b/actions/setup/js/push_to_pull_request_branch.test.cjs
index b2b81413740..a4f39fd90ce 100644
--- a/actions/setup/js/push_to_pull_request_branch.test.cjs
+++ b/actions/setup/js/push_to_pull_request_branch.test.cjs
@@ -1211,7 +1211,7 @@ index 0000000..abc1234
         mockExec.exec.mockRejectedValueOnce(new Error("Patch does not apply"));
 
         mockExec.exec.mockResolvedValueOnce(0); // git checkout --theirs -- docs/findings.md
-        mockExec.exec.mockResolvedValueOnce(0); // git add -- docs/findings.md
+        mockExec.exec.mockResolvedValueOnce(0); // git add --sparse -- docs/findings.md
         mockExec.exec.mockResolvedValueOnce(0); // git am --continue
 
         const module = await loadModule();
@@ -1221,7 +1221,7 @@ index 0000000..abc1234
         expect(result.success).toBe(true);
         expect(mockCore.info).toHaveBeenCalledWith("Patch applied successfully after resolving add/add conflict(s)");
         expect(mockExec.exec).toHaveBeenCalledWith("git", ["checkout", "--theirs", "--", "docs/findings.md"], expect.any(Object));
-        expect(mockExec.exec).toHaveBeenCalledWith("git", ["add", "--", "docs/findings.md"], expect.any(Object));
+        expect(mockExec.exec).toHaveBeenCalledWith("git", ["add", "--sparse", "--", "docs/findings.md"], expect.any(Object));
         expect(mockExec.exec).toHaveBeenCalledWith("git", ["am", "--continue"], expect.any(Object));
       } finally {
         pushSignedSpy.mockRestore();
diff --git a/docs/src/content/docs/reference/checkout.md b/docs/src/content/docs/reference/checkout.md
index 84df5de2e68..49046025631 100644
--- a/docs/src/content/docs/reference/checkout.md
+++ b/docs/src/content/docs/reference/checkout.md
@@ -114,6 +114,15 @@ Fetch everything the workflow needs at checkout time using `fetch-depth` and [`f
 `push-to-pull-request-branch` inspects the commit range `origin/<branch>..<branch>` in the agent's workspace to detect merge commits and select the appropriate transport. With the default shallow clone (`fetch-depth: 1`), `origin/<branch>` has no traversable ancestry, so `git rev-list` reports the entire local history as the range. On large monorepos (thousands of commits) this can falsely trigger bundle or rewrite paths. When the range is implausibly large in a shallow checkout, merge-commit detection returns false (with a warning) to avoid incorrect transport selection; if the range later reaches the signed-push linearization step, that step is refused with a clear error. Set `fetch-depth: 0` to ensure the correct range is visible.
 :::
 
+## Checkout in the safe_outputs Job
+
+Workflows that use the `create-pull-request` or `push-to-pull-request-branch` safe outputs get a second checkout in the `safe_outputs` job, where the generated patch is applied and pushed. That checkout is deliberately narrower than the agent's:
+
+- Without a root `checkout:` entry, it materializes repository-root files only (`sparse-checkout: .`). Git materializes the paths the patch touches on demand, so nested files still apply correctly.
+- With a root `checkout:` entry, your explicit settings (`sparse-checkout`, `submodules`, `lfs`, tokens, `ref`) are honored, but the agent-oriented history options `fetch-depth` and [`fetch:`](#fetching-additional-refs) are not replayed — the safe-output handlers fetch the branch, base, and commits they operate on themselves.
+
+The agent job always keeps the depth and refs you configured; only the `safe_outputs` job is narrowed. If the workflow declares custom safe-output `steps`, `actions`, or `scripts` — which may read arbitrary files or history from the working tree — the `safe_outputs` checkout matches the agent job's instead.
+
 ## Disabling Checkout (`checkout: false`)
 
 Set `checkout: false` to suppress both the default `actions/checkout` step and the PR-specific "Checkout PR branch" step entirely. Use this for workflows that access repositories through MCP servers or other mechanisms that do not require a local clone:
diff --git a/docs/src/content/docs/specs/checkout-behavior-specification.md b/docs/src/content/docs/specs/checkout-behavior-specification.md
index abc0c41c560..44398d3c752 100644
--- a/docs/src/content/docs/specs/checkout-behavior-specification.md
+++ b/docs/src/content/docs/specs/checkout-behavior-specification.md
@@ -108,7 +108,19 @@ Entries with the same `(repository, path, wiki)` key MUST merge with these rules
 - **Agent job** MUST generate default checkout plus additional checkouts from `CheckoutManager`, with `persist-credentials: false` by default.
 - **safe_outputs job** MUST reuse the same checkout generators but set keep-credentials mode for push/fetch use and inject a `Configure Git credentials` step.
 
-### 3.4 Checkout Manifest
+### 3.4 Minimal safe_outputs PR Checkout
+
+The safe_outputs PR handlers only need enough git state to apply a patch and push it: they fetch the specific branch, base, and commits they operate on at apply time using their retained credentials. The workspace-root checkout in the safe_outputs job MUST therefore be narrowed as follows:
+
+- When the workflow declares no root `checkout:` entry, the safe_outputs workspace-root checkout MUST emit `sparse-checkout: .` (repository-root files only). Git materializes the paths a patch touches on demand, and add/add conflict recovery MUST stage with `git add --sparse` so index updates outside the sparse cone are permitted.
+- When the workflow declares a root `checkout:` entry, the safe_outputs job MUST NOT replay its agent-oriented history extras: `fetch-depth` MUST be omitted and additional `fetch:` refs MUST NOT emit a follow-up fetch step. Other explicit settings (`sparse-checkout`, `submodules`, `lfs`, tokens, `ref`) MUST still be honored.
+- The agent job MUST retain its configured depth and `fetch:` refs; this narrowing applies only to the safe_outputs job.
+
+The narrowing MUST be disabled (the safe_outputs checkout matching the agent job's) when the workflow declares custom safe-output `steps`, `actions`, or `scripts`, since those may read arbitrary files or history from the working tree.
+
+Additional (cross-repo / subdirectory) checkouts in the safe_outputs job are unaffected by this narrowing.
+
+### 3.5 Checkout Manifest
 
 For non-default cross-repo checkouts, the compiler MUST emit a checkout manifest step.  
 Runtime lookup (`find_repo_checkout`) MUST prefer manifest paths and MUST reject manifest paths that are absolute or escape workspace roots (see §7 test T-CHK-014 for compliance test coverage of this requirement).
@@ -176,7 +188,7 @@ When safe_outputs checkout retention is enabled, checkouts without explicit entr
 ### 5.1 Shallow and Additional Fetch
 
 - Default shallow behavior MUST be `fetch-depth: 1` when unset.
-- Additional `fetch:` refs MUST emit a follow-up `git fetch` step per checkout entry.
+- Additional `fetch:` refs MUST emit a follow-up `git fetch` step per checkout entry, except on a narrowed safe_outputs workspace-root checkout (see §3.4).
 - Follow-up fetch MUST mirror effective depth (omit `--depth` only when effective depth is `0`).
 - Follow-up fetch MUST inject credentials via command-level `http.extraheader` and MUST NOT persist credentials to git config.
 
@@ -267,6 +279,7 @@ When `GH_AW_TARGET_REPO_SLUG` is set but equals `GITHUB_REPOSITORY`, the impleme
 - **T-CHK-013**: Checkout-manifest generation includes safe_outputs auth metadata without persisting resolved tokens
 - **T-CHK-014**: Checkout-manifest path resolution MUST reject paths that are absolute (e.g., `/etc/passwd`) or escape the workspace root (e.g., `../../sensitive`); rejected paths MUST produce an error and MUST NOT be used for checkout or file lookup
 - **T-CHK-015**: `push_to_pull_request_branch` uses side-repo checkout from `GH_AW_TARGET_REPO_SLUG` only when it differs from `GITHUB_REPOSITORY`; emits debug log and ignores it when they match
+- **T-CHK-016**: safe_outputs workspace-root checkout is narrowed — implicit checkouts emit `sparse-checkout: .`, explicit root checkouts drop `fetch-depth` and the additional `fetch:` step, and the narrowing is disabled when custom safe-output steps/actions/scripts are declared; nested-path patch application and `git add --sparse` conflict recovery succeed under a root-only sparse checkout
 
 ### 7.2 Compliance Checklist
 
@@ -282,6 +295,7 @@ When `GH_AW_TARGET_REPO_SLUG` is set but equals `GITHUB_REPOSITORY`, the impleme
 | Checkout-manifest generation requirements | T-CHK-013 | C1/C2 | Required |
 | Checkout-manifest path-escape rejection | T-CHK-014 | C2 | Required |
 | `push_to_pull_request_branch` side-repo cwd resolution | T-CHK-015 | C2 | Required |
+| Minimal safe_outputs PR checkout | T-CHK-016 | C1/C2 | Required |
 
 ### 7.3 Safeguards
 
@@ -289,7 +303,7 @@ The following MUST-level norms govern credential and token safety during checkou
 
 1. **Token write-to-disk prohibition**: `safe-outputs-github-app` minted tokens MUST NOT be written to disk at any point before the `safe_outputs` job begins its push/PR operations. Token values MUST be passed only as environment variables or via GitHub Actions secret interpolation at the step level. Any intermediate file, log entry, or env export that materializes the token value to disk MUST be treated as a security violation.
 
-2. **Manifest path rejection**: Checkout-manifest paths that are absolute or that escape the workspace root MUST be rejected before any file I/O is performed against them. The rejection MUST produce an actionable error message (see §3.4 and T-CHK-014).
+2. **Manifest path rejection**: Checkout-manifest paths that are absolute or that escape the workspace root MUST be rejected before any file I/O is performed against them. The rejection MUST produce an actionable error message (see §3.5 and T-CHK-014).
 
 3. **Credential cleanup**: When `force-clean-git-credentials: true` is active and `keep-credentials-for-push` is not, all credential-bearing git config sections MUST be removed from `.git/config` and `.git/modules/**/config` before the agent step completes.
 
@@ -325,6 +339,7 @@ The following MUST-level norms govern credential and token safety during checkou
 
 ### Version 1.1.0 (Working Draft)
 
+- Added §3.4: minimal safe_outputs PR checkout requirements (root-only sparse default for implicit checkouts, dropped `fetch-depth`/`fetch:` extras on explicit root checkouts, and the custom safe-output steps/actions/scripts opt-out). Noted the §5.1 fetch-step exception and added T-CHK-016.
 - Added §6.3: `push_to_pull_request_branch` side-repo checkout resolution requirements, covering `GH_AW_TARGET_REPO_SLUG` passthrough guard, debug-logging obligation, and `repo_cwd` scoping of all git operations.
 - Added T-CHK-015 to §7.1 and §7.2 compliance checklist.
 
diff --git a/pkg/workflow/checkout_manager.go b/pkg/workflow/checkout_manager.go
index ca05b6e2edc..b93b8a4ba9b 100644
--- a/pkg/workflow/checkout_manager.go
+++ b/pkg/workflow/checkout_manager.go
@@ -194,6 +194,13 @@ type CheckoutManager struct {
 	// defaultRefOverride forces the workspace-root checkout to a compiler-generated
 	// ref, such as the branch allocated by create-pull-request.steer.
 	defaultRefOverride string
+	// minimalDefaultCheckout narrows the workspace-root checkout to what a safe-output PR
+	// handler needs to apply and push a patch: an implicit checkout materializes root files
+	// only, and agent-oriented history extras (fetch-depth, additional fetch refs) declared
+	// for the agent job are not replayed. The handlers fetch the specific refs and commits
+	// they operate on with their retained credentials, the same way checkout_pr_branch.cjs
+	// fetches only the PR head it needs.
+	minimalDefaultCheckout bool
 }
 
 // SetDefaultRefOverride forces the default workspace checkout to use ref.
@@ -202,6 +209,14 @@ func (cm *CheckoutManager) SetDefaultRefOverride(ref string) {
 	cm.defaultRefOverride = ref
 }
 
+// SetMinimalDefaultCheckout narrows the workspace-root checkout to the git state a
+// safe-output PR handler needs. Callers must not enable it when a custom step may require
+// the full working tree or the agent's history.
+func (cm *CheckoutManager) SetMinimalDefaultCheckout(minimal bool) {
+	checkoutManagerLog.Printf("Setting minimal default checkout: %t", minimal)
+	cm.minimalDefaultCheckout = minimal
+}
+
 // NewCheckoutManager creates a new CheckoutManager pre-loaded with user-supplied
 // CheckoutConfig entries from the frontmatter.
 func NewCheckoutManager(userCheckouts []*CheckoutConfig) *CheckoutManager {
diff --git a/pkg/workflow/checkout_step_generator.go b/pkg/workflow/checkout_step_generator.go
index b54c3bc12c2..4fac3c88f94 100644
--- a/pkg/workflow/checkout_step_generator.go
+++ b/pkg/workflow/checkout_step_generator.go
@@ -459,7 +459,7 @@ func (cm *CheckoutManager) GenerateDefaultCheckoutStep(
 			fmt.Fprintf(&sb, "          token: %s\n", effectiveOverrideToken)
 			tokenEmitted = true
 		}
-		if override.fetchDepth != nil {
+		if override.fetchDepth != nil && !cm.minimalDefaultCheckout {
 			fmt.Fprintf(&sb, "          fetch-depth: %d\n", *override.fetchDepth)
 		}
 		if len(override.sparsePatterns) > 0 {
@@ -486,6 +486,9 @@ func (cm *CheckoutManager) GenerateDefaultCheckoutStep(
 	if !trialMode && !tokenEmitted && cm.keepCredentialsForPush && cm.pushToken != "" {
 		fmt.Fprintf(&sb, "          token: %s\n", cm.pushToken)
 	}
+	if override == nil && cm.minimalDefaultCheckout {
+		sb.WriteString("          sparse-checkout: .\n")
+	}
 
 	steps := []string{sb.String()}
 	if override != nil && len(override.sparsePatterns) > 0 {
@@ -498,7 +501,9 @@ func (cm *CheckoutManager) GenerateDefaultCheckoutStep(
 	// Emit a git fetch step if the user requested additional refs.
 	// In trial mode the fetch step is still emitted so the behaviour
 	// mirrors production as closely as possible.
-	if override != nil && len(override.fetchRefs) > 0 {
+	// Minimal (safe-output) checkouts skip it: the extra refs are fetched for the agent,
+	// while the PR handlers fetch the single ref they operate on at apply time.
+	if override != nil && len(override.fetchRefs) > 0 && !cm.minimalDefaultCheckout {
 		defaultIdx := 0
 		if idx, ok := cm.index[override.key]; ok {
 			defaultIdx = idx
diff --git a/pkg/workflow/compiler_safe_outputs_steps.go b/pkg/workflow/compiler_safe_outputs_steps.go
index bca6e554c7d..fe6894e5bf0 100644
--- a/pkg/workflow/compiler_safe_outputs_steps.go
+++ b/pkg/workflow/compiler_safe_outputs_steps.go
@@ -19,11 +19,21 @@ var consolidatedSafeOutputsStepsLog = logger.New("workflow:compiler_safe_outputs
 // The checkout steps are generated by the SAME CheckoutManager generators the agent job
 // uses (GenerateCheckoutAppTokenSteps, GenerateDefaultCheckoutStep,
 // GenerateAdditionalCheckoutSteps), so the safe_outputs job lays out every repository on
-// disk identically to the agent job. The only safe_outputs-specific differences are:
+// disk the same way the agent job does. The safe_outputs-specific differences are:
 //   - a per-step `if:` condition gating the steps on whether a create_pull_request /
-//     push_to_pull_request_branch output will actually be processed, and
+//     push_to_pull_request_branch output will actually be processed,
 //   - a trailing "Configure Git credentials" step that installs a push-capable token
-//     (the agent job never pushes, so it omits this).
+//     (the agent job never pushes, so it omits this), and
+//   - a minimal workspace-root checkout, because the handlers only need enough git state
+//     to apply a patch and push it. An implicit root checkout is limited to root files
+//     (`sparse-checkout: .`) — git materializes the paths a patch touches on demand, and
+//     add/add conflict recovery stages with `git add --sparse`. Agent-oriented history
+//     extras on an explicit root checkout (`fetch-depth`, additional `fetch:` refs) are
+//     not replayed either: the handlers fetch the single branch/PR ref they operate on at
+//     apply time, the same way checkout_pr_branch.cjs fetches only the PR head it needs.
+//     The minimal checkout is skipped entirely (agent-identical checkout kept) when the
+//     workflow declares custom safe-output steps/actions/scripts that may need the full
+//     working tree or history.
 //
 // Base-branch selection is intentionally NOT done here. The JS handler resolves the base
 // branch per target repository at apply time (it runs `git fetch origin <base>` and
@@ -45,6 +55,17 @@ func (c *Compiler) buildSharedPRCheckoutSteps(data *WorkflowData) []string {
 	// safe_outputs handler code (not the untrusted agent) is the only consumer.
 	checkoutMgr.SetKeepCredentialsForPush(true)
 
+	// The handlers only need enough git state to apply a patch and push it, so the
+	// workspace-root checkout is narrowed: an implicit checkout materializes root files
+	// only, and an explicit one drops the agent's fetch-depth / extra fetch refs. Opt out
+	// (keep the agent-identical checkout) when the workflow ships custom safe-output
+	// steps/actions/scripts that may read arbitrary files or history from the working tree.
+	if len(data.SafeOutputs.Steps) == 0 &&
+		len(data.SafeOutputs.Actions) == 0 &&
+		len(data.SafeOutputs.Scripts) == 0 {
+		checkoutMgr.SetMinimalDefaultCheckout(true)
+	}
+
 	// Persist the resolved PR push token (not just the default GITHUB_TOKEN) into
 	// .git/config so the retained credential matches the token the handlers use to
 	// fetch/push. This keeps a single, correct Authorization header on the wire and
@@ -70,7 +91,8 @@ func (c *Compiler) buildSharedPRCheckoutSteps(data *WorkflowData) []string {
 		steps = append(steps, checkoutMgr.GenerateSafeOutputCheckoutAppTokenSteps(c, resolveCheckoutPermissions(data))...)
 	}
 
-	// Default workspace checkout (identical to the agent job).
+	// Default workspace checkout (same generator as the agent job; root-only sparse by
+	// default, see the function doc comment).
 	steps = append(steps, injectStepCondition(
 		checkoutMgr.GenerateDefaultCheckoutStep(c.trialMode, c.trialLogicalRepoSlug, c.getActionPin),
 		condition,
diff --git a/pkg/workflow/compiler_safe_outputs_steps_test.go b/pkg/workflow/compiler_safe_outputs_steps_test.go
index 4313d57f918..cb0a1bbf713 100644
--- a/pkg/workflow/compiler_safe_outputs_steps_test.go
+++ b/pkg/workflow/compiler_safe_outputs_steps_test.go
@@ -33,6 +33,7 @@ func TestBuildSharedPRCheckoutSteps(t *testing.T) {
 				"uses: actions/checkout@",
 				// safe_outputs job retains credentials so the handlers can git fetch/push.
 				"persist-credentials: true",
+				"sparse-checkout: .",
 				"name: Configure Git credentials",
 				"configure_git_credentials.sh",
 				"GITHUB_REPOSITORY: ${{ github.repository }}",
@@ -48,15 +49,79 @@ func TestBuildSharedPRCheckoutSteps(t *testing.T) {
 			},
 		},
 		{
-			name: "uses custom default checkout fetch-depth",
+			name: "explicit root checkout drops agent-oriented history extras",
 			safeOutputs: &SafeOutputsConfig{
 				CreatePullRequests: &CreatePullRequestsConfig{},
 			},
 			checkoutConfigs: []*CheckoutConfig{
-				{FetchDepth: &fetchDepthZero},
+				{FetchDepth: &fetchDepthZero, Fetch: []string{"refs/pulls/open/*"}},
+			},
+			checkNotContains: []string{
+				// The agent needs the deep history and the extra refs; the PR handlers
+				// fetch the single ref they operate on at apply time.
+				"fetch-depth: 0",
+				"name: Fetch additional refs",
+				"refs/pulls/open/*",
+				// An explicit root checkout may materialize specific paths, so the
+				// root-only sparse default does not apply to it.
+				"sparse-checkout: .",
+			},
+		},
+		{
+			name: "custom safe-output steps keep agent-identical checkout",
+			safeOutputs: &SafeOutputsConfig{
+				CreatePullRequests: &CreatePullRequestsConfig{},
+				Steps: []any{
+					map[string]any{"run": "git status"},
+				},
+			},
+			checkoutConfigs: []*CheckoutConfig{
+				{FetchDepth: &fetchDepthZero, Fetch: []string{"refs/pulls/open/*"}},
 			},
 			checkContains: []string{
 				"fetch-depth: 0",
+				"name: Fetch additional refs",
+			},
+			checkNotContains: []string{
+				"sparse-checkout: .",
+			},
+		},
+		{
+			name: "custom safe-output actions keep agent-identical checkout",
+			safeOutputs: &SafeOutputsConfig{
+				CreatePullRequests: &CreatePullRequestsConfig{},
+				Actions: map[string]*SafeOutputActionConfig{
+					"custom-action": {},
+				},
+			},
+			checkoutConfigs: []*CheckoutConfig{
+				{FetchDepth: &fetchDepthZero, Fetch: []string{"refs/pulls/open/*"}},
+			},
+			checkContains: []string{
+				"fetch-depth: 0",
+				"name: Fetch additional refs",
+			},
+			checkNotContains: []string{
+				"sparse-checkout: .",
+			},
+		},
+		{
+			name: "custom safe-output scripts keep agent-identical checkout",
+			safeOutputs: &SafeOutputsConfig{
+				CreatePullRequests: &CreatePullRequestsConfig{},
+				Scripts: map[string]*SafeScriptConfig{
+					"custom-script": {},
+				},
+			},
+			checkoutConfigs: []*CheckoutConfig{
+				{FetchDepth: &fetchDepthZero, Fetch: []string{"refs/pulls/open/*"}},
+			},
+			checkContains: []string{
+				"fetch-depth: 0",
+				"name: Fetch additional refs",
+			},
+			checkNotContains: []string{
+				"sparse-checkout: .",
 			},
 		},
 		{