@@ -49,7 +49,7 @@ dispatch.
 
 3. **Reproduce one boundary.** Choose compilation/prompt/MCP/agent/safe outputs. Run the real component with existing edge test doubles, minimal inputs, output assertions, disposable files and a timeout. Mock missing context/APIs/credentials. Never contact production or disable the firewall; leave OIDC, approvals, hosted tokens and runners unverified.
 
-4. **Fix and gate.** Add a minimal fix/regression. Review the revised changes with the [agentic security-review instructions](debug-security-review.md), then compile current source with `--dry-run`: strict, staged, source validation, shellcheck and model checks, warnings as errors. Include emitted locks in the final security review before executing or uploading them. Docker-based checks are optional; Docker unavailability does not block the gate. When Docker is available, recommend `gh aw validate WORKFLOW` for source checks and `gh aw compile WORKFLOW --dry-run --zizmor --actionlint --poutine` for scanner checks. Run these scanners if possible; `validate` itself skips them. Unsupported `--dry-run`, missing required checks or failed compilation blocks live testing, not local diagnosis. Existing/generated locks need a successful gate for current hashes. Never downgrade required checks, suppress findings, substitute `strict: true`, use `--approve`, or commit to erase warnings.
+4. **Fix and gate.** Add a minimal fix/regression. Review the revised changes with the [agentic security-review instructions](debug-security-review.md), then compile current source with `--dry-run`: strict, staged, source validation, shellcheck and model checks, with differential scanner gating described below. Include emitted locks in the final security review before executing or uploading them. Docker-based checks are optional; Docker unavailability does not block the gate. When Docker is available, recommend `gh aw validate WORKFLOW` for source checks and `gh aw compile WORKFLOW --dry-run --zizmor --actionlint --poutine` for scanner checks. Run these scanners if possible; `validate` itself skips them. Unsupported `--dry-run`, missing required checks or failed compilation blocks live testing, not local diagnosis. Existing/generated locks need a successful gate for current hashes. Never downgrade required checks, add ad hoc suppressions beyond the documented dry-run filter, substitute `strict: true`, use `--approve`, or commit to erase warnings.
 
 5. **Constrain credentials.** Recommend, not require, a protected test environment and rotated, restricted development credentials. Inspect environments; provision only with authorization and revoke replaced credentials at their issuer. Never copy/rotate production secrets. Authorized repository/organization/enterprise shared secrets remain job-scoped, not automatically OS-exported; test environments do not isolate them. Keep production/dispatch credentials out of harnesses.
 
@@ -144,14 +144,23 @@ gh aw compile WORKFLOW --dry-run --zizmor --actionlint --poutine
 Docker-based scanners and `--validate-images` are opt-in, not dry-run gate
 requirements. Run zizmor, actionlint and poutine when possible; report unavailable
 checks as unverified, not passed. Without Docker, use a native `shellcheck` binary
-for the required run-step linting. Findings or failures from requested checks still
-fail the dry-run gate.
-
-With explicit user acceptance of experimental-feature notices, add
-`--allow-experimental`. Only built-in feature notices are acknowledged;
-their warning counts remain visible in the dry-run summary. Other warnings,
-security findings, and scanner failures remain fatal. This opt-in grants no
-live execution or policy-installation authorization.
+for the required run-step linting. Enabled scanners scan the existing on-disk locks
+before compilation and compare finding identities and occurrence counts against
+the emitted diagnostic locks using the same result filters. Only added
+medium-or-higher or unclassified findings fail. Low-severity/informational findings
+remain visible but nonblocking. Zizmor's `secrets-outside-env` is excluded from
+dry-run results because repository/organization secrets are common in agentic workflows;
+ordinary compilation is unchanged. With no existing lock, actionable findings
+are all added. The baseline is the pre-compilation on-disk state, not a Git diff;
+do not overwrite a baseline to conceal regressions. Execution/parsing failures
+in either scan remain fatal.
+
+Built-in experimental-feature notices are low-severity and nonblocking;
+`--allow-experimental` additionally records explicit acknowledgement.
+Their counts remain visible in the dry-run summary. Validation errors, unclassified
+compiler warnings, model-inventory failures, and scanner execution/parsing failures
+remain fatal. Neither this policy nor explicit acknowledgement grants live
+execution or policy-installation authorization.
 
 `validate` uses `--no-emit`, which skips zizmor, actionlint and poutine. Only the
 scanner-enabled compile command above runs them; a passing `validate` command
@@ -183,7 +192,11 @@ they report changed fields/keys and forced flags without configuration values.
 Compile text output reports excluded effects and scanner invocation coverage.
 `--json` adds a batch `workflow: "dry-run"` summary: `dry_run.gate` includes
 workflow and batch failures; scanner statuses distinguish `passed`, `failed`
-and `not_run`. Model inventory refresh/collection warnings fail the dry-run
+and `not_run`; each scanner's `differential` reports baseline, existing, added,
+and ignored low-severity counts. A passed scanner gate is not a claim of zero findings.
+The summary records `warning_baseline: "pre_compile_lock_files"`,
+`minimum_severity: "medium"`, `ignored_scanner_rules`, and
+`ignored_low_severity_warnings`. Model inventory refresh/collection warnings fail the dry-run
 gate. Check the exit status and all results; preflight failures may emit no
 summary. Passing coverage is not execution approval or per-image/script proof.
 
 
@@ -810,8 +810,8 @@ func configureCompileBuildFlags() {
 	compileCmd.Flags().Bool("no-emit", false, "Validate workflow without generating lock files")
 	compileCmd.Flags().Bool("purge", false, "Delete .lock.yml files that were not regenerated during compilation (only when no specific files are provided)")
 	compileCmd.Flags().Bool("strict", false, "Override frontmatter to enforce strict mode validation for all workflows (enforces action pinning, network config, safe-outputs, disallows write permissions and deprecated fields). Note: Workflows default to strict mode unless frontmatter sets strict: false")
-	compileCmd.Flags().Bool("dry-run", false, "Compile with strict validation, shellcheck, and model checks; Docker-based scanners are opt-in; report gate/scanner coverage; disable compiler-managed GitHub mutations, stage safe outputs, and record dry_run in aw_info.json; custom scripts and external MCP effects remain unverified; does not authorize execution, upload, or dispatch workflows")
-	compileCmd.Flags().Bool("allow-experimental", false, "Accept experimental-feature notices during dry-run compilation; notices remain visible and all other warnings and scanner failures remain fatal")
+	compileCmd.Flags().Bool("dry-run", false, "Compile with strict validation, shellcheck, and model checks; gate added medium-or-higher scanner findings against pre-compilation locks; ignore low severity and zizmor secrets-outside-env; Docker-based scanners are opt-in; report gate/scanner coverage; disable compiler-managed GitHub mutations, stage safe outputs, and record dry_run in aw_info.json; custom scripts and external MCP effects remain unverified; does not authorize execution, upload, or dispatch workflows")
+	compileCmd.Flags().Bool("allow-experimental", false, "Record explicit acceptance of nonblocking experimental-feature notices during dry-run compilation; validation errors, added actionable findings, and scanner failures remain fatal")
 	compileCmd.Flags().String("environment", "", "Override the environment on every generated job; fails for reusable-workflow caller jobs, which cannot declare an environment")
 	compileCmd.Flags().Bool("require-self-hosted-runners", false, "Fail compilation unless every generated workflow job selects a self-hosted runner")
 	compileCmd.Flags().Bool("trial", false, "Enable trial mode compilation (modifies workflows for trial execution)")
 
@@ -229,7 +229,7 @@ Pre-activation runs gating checks sequentially before any AI execution. Any fail
 | `gh aw compile my-workflow` | Compile specific workflow |
 | `gh aw compile --verbose` | Enable verbose output |
 | `gh aw compile --strict` | Enhanced security validation |
-| `gh aw compile my-workflow --dry-run` | Compile for development testing with staging, mandatory validation/shellcheck/model checks, and warnings as errors; Docker scanners are opt-in |
+| `gh aw compile my-workflow --dry-run` | Compile with staging and mandatory validation/shellcheck/model checks; gate added medium-or-higher scanner findings against pre-compilation locks; Docker scanners are opt-in |
 | `gh aw compile my-workflow --environment gh-aw-debug` | Replace the environment on every generated job |
 | `gh aw compile --no-emit` | Validate without generating files |
 | `gh aw compile --actionlint --zizmor --poutine --grant` | Run security scanners |
@@ -260,9 +260,22 @@ pyflakes from `PATH` when those integrations are enabled; it does not install th
 
 `--dry-run` enables `--strict`, `--staged`, `--validate`, `--shellcheck`,
 and `--models`. These settings are
-forced regardless of frontmatter; explicitly disabling a required flag is rejected. Compiler warnings,
-including safe-update warnings, and scanner failures cause a nonzero exit status
-and invalid JSON validation results. Missing required tools block compilation
+forced regardless of frontmatter; explicitly disabling a required flag is rejected.
+Enabled scanners first scan the existing lock files before compilation, then scan
+the emitted diagnostic locks with the same scanner configuration and result filters.
+Only added medium-or-higher findings, or added findings with unknown severity,
+fail the scanner gate. Matching uses finding identity and occurrence counts, not
+aggregate totals, and tolerates shifted YAML lines and steps with stable IDs/names.
+Low-severity and informational findings remain visible but do not fail the gate.
+Zizmor's `secrets-outside-env` rule is excluded in dry-run mode because repository
+and organization secrets are common in agentic workflows; ordinary compilation
+retains the rule. With no existing lock, every actionable finding is added.
+The baseline is the on-disk lock at invocation time, not a Git branch comparison;
+repeated dry runs compare against the locks left by the preceding invocation.
+
+Validation errors, unclassified compiler warnings (including safe-update warnings),
+and scanner execution/parsing failures remain fatal, including failures while
+collecting the baseline. Missing required tools block compilation
 rather than silently skipping checks. Model checking uses the observed active
 model inventory; development compilation fails if that inventory is unavailable
 and the workflow declares `models` policies or `engine.models`. It does not prove
@@ -271,12 +284,15 @@ Observed-inventory refresh and collection warnings are also reported: they fail
 the dry-run gate even when cached observations remain available. Ordinary
 `--models` compilation reports them as warnings instead.
 
-To acknowledge experimental-feature notices explicitly, add `--allow-experimental`
-to `--dry-run`. Notices remain visible and the JSON dry-run summary records
-`accepted_experimental_warnings`. This accepts only the compiler's built-in
-experimental-feature notices, not arbitrary warning text. Security, safe-update,
-schedule, model-inventory and other warnings, validation errors, and scanner
-failures still block the gate. Required checks and staging remain enabled.
+Built-in experimental-feature notices are low-severity and nonblocking.
+They remain visible and the JSON summary records `ignored_low_severity_warnings`.
+`--allow-experimental` additionally records explicit acknowledgement in
+`accepted_experimental_warnings`; it does not exempt arbitrary warning text.
+The summary identifies `warning_baseline`, `minimum_severity`, and
+`ignored_scanner_rules`; each scanner's `differential` reports baseline, existing,
+added, and low-severity ignored counts. A scanner status of `passed` means its
+differential gate passed, not that its output contained no findings.
+Required checks and staging remain enabled.
 
 Docker-based scanners and `--validate-images` remain opt-in. Docker unavailability
 does not block the dry-run gate; install native `shellcheck` for required run-step
@@ -286,7 +302,7 @@ is recommended for source checks, alongside
 checks. `validate` uses `--no-emit` and skips these scanners; its success does not
 establish scanner coverage. Run the scanner-enabled compile command when possible
 and report unavailable checks as unverified. Explicitly requested checks
-still fail the dry-run gate on findings or scanner failures.
+still fail the dry-run gate on added actionable findings or scanner failures.
 
 When optional CLI scanner preparation cannot find Docker on `PATH`, it prints one
 informational notice per process and does not retry image downloads. MCP
 
@@ -389,7 +389,7 @@ Unlike `gh aw upgrade`, `gh aw compile` does not run codemods unless you pass `-
 
 **Options:** `--action-mode`, `--action-tag`, `--actionlint`, `--actions-repo`, `--allow-action-refs`, `--allow-experimental`, `--approve`, `--dependabot`, `--dry-run`, `--dir/-d`, `--engine/-e`, `--environment`, `--fail-fast`, `--fix`, `--force/-f`, `--force-refresh-action-pins`, `--force-refresh-container-pins`, `--gh-aw-ref`, `--ghes`, `--grant`, `--grype`, `--json/-j`, `--logical-repo/-l`, `--models`, `--no-check-update`, `--no-emit`, `--poutine`, `--purge`, `--refresh-stop-time`, `--require-self-hosted-runners`, `--runner-guard`, `--schedule-seed`, `--shellcheck`, `--show-all`, `--staged`, `--stats`, `--strict`, `--syft`, `--trial`, `--validate`, `--validate-images`, `--watch/-w`, `--yamllint`, `--zizmor`
 
-**`--dry-run` flag:** Compile with strict source validation, staged safe outputs, shellcheck, model checks, and warnings as errors. Docker-based image validation and scanners are opt-in. Without Docker, required run-step linting uses native shellcheck. Missing required checks or model inventory block compilation. Compiler-managed GitHub mutations are disabled, including push jobs, memory/cache persistence, work-queue operations, reusable safe-output calls, reactions, comments/issues, label removal, and issue locking. Emitted locks remove `OTEL_*` and `GH_AW_OTLP_*` variables from workflow, job, step, container, and service environment mappings and disable automatic OTLP configuration and authentication. The runtime records `dry_run` in `aw_info.json` and warns that custom scripts/jobs, agent shell commands, external MCP servers, and custom credentials remain unverified. Explicitly disabling a required check is rejected; `--no-emit`, `--watch`, `--approve`, and `--allow-action-refs` are incompatible. This flag does not upload or execute workflows and is distinct from `--action-mode dev`. The compile MCP input is `dry_run`; `validate_images: true` opts into required image validation. See [Development Testing Mode](/gh-aw/reference/compilation-process/#development-testing-mode).
+**`--dry-run` flag:** Compile with strict source validation, staged safe outputs, shellcheck, and model checks. Scanner findings are compared against the existing on-disk locks before compilation: only added medium-or-higher or unclassified findings fail. Low-severity findings and zizmor's `secrets-outside-env` rule do not fail the dry-run gate. Docker-based image validation and scanners are opt-in. Without Docker, required run-step linting uses native shellcheck. Missing required checks or model inventory block compilation. Compiler-managed GitHub mutations are disabled, including push jobs, memory/cache persistence, work-queue operations, reusable safe-output calls, reactions, comments/issues, label removal, and issue locking. Emitted locks remove `OTEL_*` and `GH_AW_OTLP_*` variables from workflow, job, step, container, and service environment mappings and disable automatic OTLP configuration and authentication. The runtime records `dry_run` in `aw_info.json` and warns that custom scripts/jobs, agent shell commands, external MCP servers, and custom credentials remain unverified. Explicitly disabling a required check is rejected; `--no-emit`, `--watch`, `--approve`, and `--allow-action-refs` are incompatible. This flag does not upload or execute workflows and is distinct from `--action-mode dev`. The compile MCP input is `dry_run`; `validate_images: true` opts into required image validation. See [Development Testing Mode](/gh-aw/reference/compilation-process/#development-testing-mode).
 
 Dry-run locks also omit daily credit accounting, retain existing per-run caps or promote configured/imported daily limits, and add manual dispatch restricted to maintainer/admin actors without bot exemptions. `DEBUG=workflow:compiler_development,cli:compile_development` reports mutations without configuration values.
 
@@ -405,7 +405,7 @@ Dry-run locks also omit daily credit accounting, retain existing per-run caps or
 
 **JSON Output (`--json`):** Emits an array of `ValidationResult` objects. Each result includes a `labels` field listing all repository labels referenced in safe-outputs (`create-issue.labels`, `create-discussion.labels`, `create-pull-request.labels`, `add-labels.allowed`). Use `--json --no-emit` to collect label references without writing compiled files.
 
-With `--dry-run`, workflow warnings invalidate only the affected workflow. Add `--allow-experimental` to accept built-in experimental-feature notices while keeping them visible; all other warnings, validation errors, and scanner failures remain fatal. The JSON dry-run summary records `accepted_experimental_warnings`. Compiler/scanner diagnostics that cannot be attributed to one workflow appear as separate results with `scope: "batch"`; their `workflow` field identifies the diagnostic source rather than a workflow path. Any invalid result fails development compilation, even when individual workflows remain valid.
+With `--dry-run`, actionable workflow warnings invalidate only the affected workflow. Low-severity and built-in experimental-feature notices are nonblocking and remain visible; `--allow-experimental` additionally records explicit acknowledgement in `accepted_experimental_warnings`. Validation errors, unclassified compiler warnings, and scanner execution/parsing failures remain fatal. The JSON summary reports each scanner's baseline, existing, added, and ignored finding counts. Compiler/scanner diagnostics that cannot be attributed to one workflow appear as separate results with `scope: "batch"`; their `workflow` field identifies the diagnostic source rather than a workflow path. Any invalid result fails development compilation, even when individual workflows remain valid.
 
 **Dependabot Integration (`--dependabot`):** Generates dependency manifests and `.github/dependabot.yml` by analyzing runtime tools across all workflows. See [Dependabot Support reference](/gh-aw/reference/dependabot/).