diff --git a/.github/skills/developer/SKILL.md b/.github/skills/developer/SKILL.md
index 3b2892bbd3c..97d2d2f4975 100644
--- a/.github/skills/developer/SKILL.md
+++ b/.github/skills/developer/SKILL.md
@@ -32,19 +32,29 @@ Use this section for the detailed day-to-day command flow that was intentionally
 
 ### Validation checkpoints
 
-1. **After first significant code edit**
+Run validation in tiers — catch compile errors early, defer slow tests to the final pass only.
+
+1. **After each significant code edit** (fast, <5s — catch compile errors immediately)
    ```bash
    make build && make fmt
    ```
-2. **Before `report_progress`**
+2. **Before every intermediate `report_progress` call** (fast, <30s — no tests)
+   ```bash
+   make agent-report-progress-no-test
+   ```
+3. **Before the FINAL `report_progress` call** (slower, once per session — includes test-unit)
    ```bash
    make agent-report-progress
    ```
-3. **Before final handoff when time allows**
+4. **Before final handoff when time allows**
    ```bash
    make agent-finish
    ```
 
+> **Key rule:** Run `test-unit` only before the **final** `report_progress` call, not before intermediate saves. Each unnecessary invocation adds 120+ seconds to total validation time.
+
+> **Timeout budget:** `make test-unit` is expected to take up to 120 seconds. If it exceeds that, use `make test-impacted-go` to run only tests for packages affected by the current branch's changes.
+
 ### Change-type command matrix
 
 - Go file changes: `make fmt`
diff --git a/.github/workflows/smoke-call-workflow.lock.yml b/.github/workflows/smoke-call-workflow.lock.yml
index eacad788ec7..15a3ed21b8c 100644
--- a/.github/workflows/smoke-call-workflow.lock.yml
+++ b/.github/workflows/smoke-call-workflow.lock.yml
@@ -619,11 +619,6 @@ jobs:
                   "inputSchema": {
                     "additionalProperties": false,
                     "properties": {
-                      "aw_context": {
-                        "default": "",
-                        "description": "Agent caller context (used internally by Agentic Workflows).",
-                        "type": "string"
-                      },
                       "payload": {
                         "description": "Input parameter 'payload' for workflow smoke-workflow-call",
                         "type": "string"
@@ -1109,25 +1104,15 @@ jobs:
     needs: safe_outputs
     if: needs.safe_outputs.outputs.call_workflow_name == 'smoke-workflow-call'
     # Imported from called workflow "smoke-workflow-call" because GitHub requires the caller job to grant permissions requested by reusable workflow jobs.
-    # Review the called workflow's job-level permissions in ./.github/workflows/smoke-workflow-call.lock.yml.
+    # Review the called workflow's frontmatter permissions in ./.github/workflows/smoke-workflow-call.md.
     permissions:
-      actions: read
       contents: read
-      issues: write
-      pull-requests: write
+      pull-requests: read
     uses: ./.github/workflows/smoke-workflow-call.lock.yml
     with:
-      aw_context: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).aw_context }}
       payload: ${{ needs.safe_outputs.outputs.call_workflow_payload }}
       task-description: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload)['task-description'] }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-      GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
-      GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
-      GH_AW_OTEL_GRAFANA_AUTHORIZATION: ${{ secrets.GH_AW_OTEL_GRAFANA_AUTHORIZATION }}
-      GH_AW_OTEL_GRAFANA_ENDPOINT: ${{ secrets.GH_AW_OTEL_GRAFANA_ENDPOINT }}
-      GH_AW_OTEL_SENTRY_AUTHORIZATION: ${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }}
-      GH_AW_OTEL_SENTRY_ENDPOINT: ${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }}
+    secrets: inherit
 
   conclusion:
     needs:
diff --git a/AGENTS.md b/AGENTS.md
index 164ed0d19a8..41463da2d02 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -22,7 +22,8 @@ Everything else should be loaded **lazily** through skills only when needed.
 ## Critical Rules (Always Applicable)
 
 1. If you changed files, use `report_progress` to commit and push.
-2. Before `report_progress`, run `make agent-report-progress` and ensure it passes.
+2. Before **intermediate** `report_progress` calls, run `make agent-report-progress-no-test` (fast, no tests). Before the **final** `report_progress`, run `make agent-report-progress` (includes `test-unit`).
+   - Run `test-unit` only once per PR — at the final push, not on every intermediate save.
 3. After Go changes, run `make fmt`.
 4. After workflow markdown changes (`.md` under `.github/workflows/`), run `make recompile`.
 5. Do not add `.lock.yml` files to `.gitignore`.
diff --git a/Makefile b/Makefile
index a195fe99380..d1ef62a770f 100644
--- a/Makefile
+++ b/Makefile
@@ -1170,12 +1170,19 @@ sbom:
 agent-finish: deps-dev fmt lint build build-wasm test-all validate-otel-contract fix recompile dependabot generate-schema-docs generate-agent-factory security-scan
 	@echo "Agent finished tasks successfully."
 
-# Lightweight pre-PR gate — run before every report_progress / create_pull_request call.
+# Fast pre-PR gate — run before every intermediate report_progress call.
+# Skips test-unit for speed; use agent-report-progress for the final report_progress call.
+# stale-lock guard (fast, no binary) + build + fmt + lint + workflow drift check.
+.PHONY: agent-report-progress-no-test
+agent-report-progress-no-test: check-stale-lock-files build fmt lint check-workflow-drift
+	@echo "Pre-PR validation passed (zero lint errors, lock files in sync). Safe to call report_progress."
+
+# Full pre-PR gate with tests — run once before the final report_progress call.
 # Includes formatting + lint validation to prevent lint-fix PR churn:
 # stale-lock guard (fast, no binary) + build + fmt + lint + test-unit + workflow drift check.
 .PHONY: agent-report-progress
 agent-report-progress: check-stale-lock-files build fmt lint test-unit check-workflow-drift
-	@echo "Pre-PR validation passed (zero lint errors, lock files in sync). Safe to call report_progress."
+	@echo "Pre-PR validation passed (zero lint errors, lock files in sync, tests pass). Safe to call report_progress."
 
 # Extended pre-PR gate with lock-file-only linting.
 .PHONY: agent-report-progress-lint
@@ -1268,8 +1275,9 @@ help:
 	@echo "  preview-docs     - Preview built documentation with Astro"
 	@echo "  clean-docs       - Clean documentation artifacts (dist, node_modules, .astro)"
 
-	@echo "  agent-finish            - Complete validation sequence (build, test, fix, recompile, fmt, lint, security-scan)"
-	@echo "  agent-report-progress   - Lightweight pre-PR gate: check-stale-lock-files + build + fmt + lint + test-unit + check-workflow-drift"
-	@echo "  agent-report-progress-lint - Pre-PR gate + gh aw lint lock-file check"
+	@echo "  agent-finish                - Complete validation sequence (build, test, fix, recompile, fmt, lint, security-scan)"
+	@echo "  agent-report-progress-no-test - Fast pre-PR gate (no test-unit): check-stale-lock-files + build + fmt + lint + check-workflow-drift"
+	@echo "  agent-report-progress       - Full pre-PR gate (final save only): same as above + test-unit"
+	@echo "  agent-report-progress-lint  - Full pre-PR gate + gh aw lint lock-file check"
 	@echo "  sbom             - Generate SBOM in SPDX and CycloneDX formats (requires syft)"
 	@echo "  help             - Show this help message"