[docs-linker] workshop docs: add gh-aw doc links

workshop/side-quest-16-03-token-exfiltration.md

@@ -6,8 +6,8 @@
 
 ## 📋 Before You Start
 
-- You have a basic agentic workflow from [Build Your Daily Status Workflow](07-your-first-workflow.md) or equivalent.
-- You understand `safe-outputs` and `permissions` frontmatter from [Write Your First Agentic Workflow](07-your-first-workflow.md).
+- You have a basic [agentic workflow](https://github.github.com/gh-aw/introduction/overview/#what-are-agentic-workflows) from [Build Your Daily Status Workflow](07-your-first-workflow.md) or equivalent.
+- You understand `safe-outputs` and `permissions` [frontmatter](https://github.github.com/gh-aw/reference/frontmatter/) from [Write Your First Agentic Workflow](07-your-first-workflow.md).
 - You have started [Connect a Live Data Source to Your Workflow](16-connect-data-source.md).
 
 When your agent reads live repository content — issue bodies, PR descriptions, commit messages, file contents — it reads text written by other people. Some of that text might try to act like an instruction aimed at your secrets.

workshop/side-quest-16-04-deterministic-vs-agentic-data-ops.md

@@ -1,6 +1,6 @@
 <!-- page-journey: all -->
 <!-- page-adventure: side-quest -->
-# Side Quest: Deterministic vs Agentic Data Ops
+# Side Quest: [Deterministic](https://github.github.com/gh-aw/patterns/deterministic-ops/) vs [Agentic](https://github.github.com/gh-aw/introduction/overview/#what-are-agentic-workflows) Data Ops
 
 > _Optional: use this guide when you are unsure which parts of a data workflow should stay deterministic and which parts should be agentic, then return to [Step 16](16-connect-data-source.md)._
 

workshop/side-quest-16-05-long-lived-credentials.md

@@ -28,9 +28,9 @@ For a scheduled, unattended agentic workflow that runs every day, this distincti
 
 ## Why unattended workflows amplify the risk
 
-Classic CI/CD scripts are narrow and deterministic: they run a fixed set of commands. If a PAT leaks from a classic pipeline, the attacker gains whatever those specific commands needed.
+Classic CI/CD scripts are narrow and [deterministic](https://github.github.com/gh-aw/patterns/deterministic-ops/): they run a fixed set of commands. If a PAT leaks from a classic pipeline, the attacker gains whatever those specific commands needed.
 
-An agentic workflow is broader. The agent decides at runtime which tools to call. If a wide-scoped PAT leaks, it can happen through:
+An [agentic workflow](https://github.github.com/gh-aw/introduction/overview/#what-are-agentic-workflows) is broader. The agent decides at runtime which tools to call. If a wide-scoped PAT leaks, it can happen through:
 
 - A compromised dependency
 - A crafted issue or PR body that tricks the agent into printing it
@@ -42,7 +42,7 @@ Unattended workflows run without a human watching every log. The window between
 
 ---
 
-## How gh-aw limits the blast radius
+## How gh-aw limits the [blast radius](https://github.github.com/gh-aw/introduction/architecture/#threat-model)
 
 gh-aw gives you three design features that reduce long-lived credential risk:
 

workshop/side-quest-17-01-mcp-concepts.md

@@ -9,7 +9,7 @@
 - You have completed [Give Your Agent More Tools with MCP](17-add-mcp-tools.md).
 - You have a workflow YAML file open in your editor.
 
-By default, a gh-aw agent reads your task brief and produces text. **MCP (Model Context Protocol)** breaks that boundary — it lets the agent call structured tools at runtime and incorporate real data into its output.
+By default, a gh-aw agent reads your [task brief](https://github.github.com/gh-aw/reference/markdown/) and produces text. **MCP ([Model Context Protocol](https://github.github.com/gh-aw/reference/mcp-gateway/))** breaks that boundary — it lets the agent call structured tools at runtime and incorporate real data into its output.
 
 ---
 
@@ -91,7 +91,7 @@ gh aw validate
 
 ---
 
-## How [toolsets](https://github.github.com/gh-aw/reference/github-tools/#github-toolsets) work
+## How [toolsets](https://github.github.com/gh-aw/reference/github-tools/#github-[toolsets](https://github.github.com/gh-aw/reference/github-tools/#github-toolsets)) work
 
 A toolset is a named subset of the tools a server provides. Toolsets let you grant the agent access to only the tools it needs — reducing the surface area for unintended behavior.
 
@@ -139,11 +139,11 @@ If the agent makes a tool call you didn't expect, revisit your task brief. Addin
 
 Because MCP tool servers receive and return data at runtime, a few security concepts apply specifically to this environment. You will encounter them in the [Supply Chain Attacks via MCP](side-quest-17-05-supply-chain-mcp.md) side quest.
 
-**Supply chain attack through MCP** — occurs when a tool server your agent trusts returns manipulated data instead of the real thing. Rather than compromising your workflow file directly, an attacker targets the tool server, so the same workflow file can produce harmful results.
+**[Supply chain](https://github.github.com/gh-aw/introduction/architecture/#threat-model) attack through MCP** — occurs when a tool server your agent trusts returns manipulated data instead of the real thing. Rather than compromising your workflow file directly, an attacker targets the tool server, so the same workflow file can produce harmful results.
 
 **Poisoned payload** — the manipulated data a compromised tool server returns. It may be fabricated data (such as fake issue lists) or embedded instructions that redirect the agent to take unintended actions.
 
-**Blast radius** — the scope of damage a successful attack can cause. For MCP-based agents, the blast radius is larger than a traditional dependency vulnerability because the payload is interpreted by an AI model that may act on embedded instructions.
+**[Blast radius](https://github.github.com/gh-aw/introduction/architecture/#threat-model)** — the scope of damage a successful attack can cause. For MCP-based agents, the blast radius is larger than a traditional dependency vulnerability because the payload is interpreted by an AI model that may act on embedded instructions.
 
 ---
 

workshop/side-quest-17-02-security-architecture.md

@@ -2,12 +2,12 @@
 <!-- page-adventure: side-quest -->
 # Side Quest: Agentic Workflow Security Architecture (Explain Like You're 5)
 
-> _Optional: work through this visual primer if you want an intuitive mental model for why gh-aw uses a sandbox, where the agent runs, and what outputs are considered safe._
+> _Optional: work through this visual primer if you want an intuitive mental model for why gh-aw uses a [sandbox](https://github.github.com/gh-aw/reference/sandbox/), where the agent runs, and what outputs are considered safe._
 
 ## 📋 Before You Start
 
 - You understand the basics of agentic workflows from [What Are Agentic Workflows?](05-agentic-workflows-intro.md).
-- You have a workflow with `permissions` and `tools` frontmatter from [Write Your First Agentic Workflow](07-your-first-workflow.md).
+- You have a workflow with `permissions` and `tools` [frontmatter](https://github.github.com/gh-aw/reference/frontmatter/) from [Write Your First Agentic Workflow](07-your-first-workflow.md).
 - You have started or are about to start [Give Your Agent More Tools with MCP](17-add-mcp-tools.md).
 
 Think of your workflow like a smart helper in a playroom.
@@ -102,7 +102,7 @@ network:
 - [ ] You can explain why sandbox boundaries reduce risk in agentic workflows
 - [ ] You can describe where the agent runs during a workshop workflow execution
 - [ ] You can list what makes an output safe vs. unsafe
-- [ ] You can explain how permissions, tools, and task brief work together as a security architecture
+- [ ] You can explain how permissions, tools, and [task brief](https://github.github.com/gh-aw/reference/markdown/) work together as a security architecture
 
 ---
 

workshop/side-quest-17-03-prompt-injection.md

@@ -1,6 +1,6 @@
 <!-- page-journey: all -->
 <!-- page-adventure: side-quest -->
-# Side Quest: Prompt Injection Attacks in Agentic Workflows
+# Side Quest: [Prompt Injection](https://github.github.com/gh-aw/introduction/architecture/#threat-model) Attacks in Agentic Workflows
 
 > _Optional: work through this security primer to understand how malicious content in repository data can try to redirect your agent — and why gh-aw's design limits the damage._
 
@@ -32,7 +32,7 @@ A poorly designed agent might treat that title as a new instruction and attempt
 
 gh-aw has three layers that limit the impact of a prompt injection attempt.
 
-### The task brief is the primary instruction source
+### The [task brief](https://github.github.com/gh-aw/reference/markdown/) is the primary instruction source
 
 In gh-aw, the workflow's Markdown task brief is compiled into the agent's instruction context before any repository data is fetched. Repository data (issue bodies, commit messages, file contents) arrives as **tool call results** — structured context, not system-level instructions.
 
@@ -113,7 +113,7 @@ Prompt injection is a reminder that **repository data is user-controlled input**
 
 - Data from issues, PRs, and commits can contain adversarial content.
 - The agent's task brief is your control surface — keep it precise.
-- Defence in depth (minimal permissions, narrow safe-outputs, human review) limits the blast radius of a successful injection.
+- Defence in depth (minimal permissions, narrow safe-outputs, human review) limits the [blast radius](https://github.github.com/gh-aw/introduction/architecture/#threat-model) of a successful injection.
 
 ---
 

workshop/side-quest-17-04-permission-escalation.md

@@ -1,6 +1,6 @@
 <!-- page-journey: all -->
 <!-- page-adventure: side-quest -->
-# Side Quest: Permission Escalation in Agentic Workflows
+# Side Quest: Permission Escalation in [Agentic Workflows](https://github.github.com/gh-aw/introduction/overview/#what-are-agentic-workflows)
 
 > _Optional: work through this security primer to see how an over-scoped workflow can give a misdirected agent more authority than your task needs._
 
@@ -20,7 +20,7 @@ Permission escalation means the agent ends up with **more authority than the tas
 
 Picture a workflow with one job: read open issues, read recent commits, and write a daily summary.
 
-Now picture that same workflow allowing the agent to open a pull request touching any file. A malicious issue body or a prompt injection could push the agent to edit `README.md` or change workflow files. You never asked for that.
+Now picture that same workflow allowing the agent to open a pull request touching any file. A malicious issue body or a [prompt injection](https://github.github.com/gh-aw/introduction/architecture/#threat-model) could push the agent to edit `README.md` or change workflow files. You never asked for that.
 
 That is the problem. The workflow author requested one level of authority. The configuration exposed a wider one.
 
@@ -131,7 +131,7 @@ Write your prediction here, then save and run the workflow to check it:
 | Add `safe-outputs` only when the task needs a write action | Prevents accidental write paths in read-only workflows |
 | Use `allowed-files` to scope writes to one part of the repo | Stops a narrow task from spilling into unrelated files |
 | Add `protected-files` for high-risk paths | Forces human review before sensitive files change |
-| Treat task brief and capability scoping as one design problem | A clear brief helps, but boundaries must hold when the brief is ignored |
+| Treat [task brief](https://github.github.com/gh-aw/reference/markdown/) and capability scoping as one design problem | A clear brief helps, but boundaries must hold when the brief is ignored |
 
 ---
 

workshop/side-quest-17-05-supply-chain-mcp.md

@@ -1,6 +1,6 @@
 <!-- page-journey: all -->
 <!-- page-adventure: side-quest -->
-# Side Quest: Supply Chain Attacks via MCP Tool Servers
+# Side Quest: [Supply Chain](https://github.github.com/gh-aw/introduction/architecture/#threat-model) Attacks via MCP Tool Servers
 
 > _A compromised MCP tool server can feed poisoned data back to your agent. Your job is to spot the [trust boundary](side-quest-17-02-security-architecture.md) early and keep the workflow's write surface narrow._
 
@@ -15,13 +15,13 @@ A supply chain attack through [MCP](https://github.github.com/gh-aw/guides/mcps/
 
 ## Attack surface at a glance
 
-Use this table as a quick threat model when you add or review an MCP server.
+Use this table as a quick [threat model](https://github.github.com/gh-aw/introduction/architecture/#threat-model) when you add or review an MCP server.
 
 | Attack type | How it works | Detection signal |
 | --- | --- | --- |
 | Typosquatted package | A package name looks familiar, but the publisher or package is not the one you meant to install. | The name is close to a trusted tool, but the publisher is unfamiliar. |
 | Compromised server or image | A real server or container starts returning altered results after the publisher account or registry is compromised. | The config uses a mutable tag such as `latest`, or a remote endpoint with no version pin. |
-| Tool poisoning | The server exposes more tools than your task needs, so a bad response has more ways to steer the agent. | The tool list is broad, vague, or includes an "everything" style toolset. |
+| Tool poisoning | The server exposes more tools than your task needs, so a bad response has more ways to steer the agent. | The tool list is broad, vague, or includes an "everything" style [toolset](https://github.github.com/gh-aw/reference/github-tools/#github-toolsets). |
 | [Output injection](side-quest-17-06-output-injection.md) | The server returns normal-looking data with hidden instructions mixed into the result. | Tool output suddenly contains directives such as "ignore previous instructions" or asks for extra actions. |
 
 ## ✏️ Exercise: Inspect This `.mcp.json`
@@ -65,7 +65,7 @@ Adopt these habits when you work with MCP servers:
 2. **Restrict permissions and outputs.** Keep `permissions:` minimal and declare only the write surfaces you actually need in `safe-outputs`.
 3. **Audit tool names before you add them.** Confirm the publisher, verify the expected server name, and keep the tool list narrow.
 
-gh-aw helps by making you declare `tools:` explicitly, limit network destinations with `network.allowed`, and narrow what the workflow can write with `permissions:` and `safe-outputs`.
+gh-aw helps by making you declare `tools:` explicitly, limit [network](https://github.github.com/gh-aw/reference/network/) destinations with `network.allowed`, and narrow what the workflow can write with `permissions:` and `safe-outputs`.
 
 ## ✅ Checkpoint
 

workshop/side-quest-17-06-output-injection.md

@@ -7,7 +7,7 @@
 ## 📋 Before You Start
 
 - You have completed [Side Quest: Supply Chain Attacks via MCP Tool Servers](side-quest-17-05-supply-chain-mcp.md) or you are already familiar with `safe-outputs` guardrails.
-- You have a practice repository with at least one agentic workflow so you can inspect its `safe-outputs:` and `permissions:` blocks.
+- You have a practice repository with at least one [agentic workflow](https://github.github.com/gh-aw/introduction/overview/#what-are-agentic-workflows) so you can inspect its `safe-outputs:` and `permissions:` blocks.
 
 ## The Attack
 

workshop/side-quest-17-07-repo-poisoning.md

@@ -38,7 +38,7 @@ If the workflow has `contents: write` and no file restrictions, the agent may fa
 
 ## Why This Matters for Agentic Workflows
 
-Classic CI/CD runs deterministic scripts. An agentic workflow reads freeform repository content — issue bodies, PR descriptions, file text — and decides at runtime what to do. That reasoning loop makes it vulnerable to **content-driven manipulation**: the attack payload lives in repository data, not in workflow code.
+Classic CI/CD runs [deterministic](https://github.github.com/gh-aw/patterns/deterministic-ops/) scripts. An [agentic workflow](https://github.github.com/gh-aw/introduction/overview/#what-are-agentic-workflows) reads freeform repository content — issue bodies, PR descriptions, file text — and decides at runtime what to do. That reasoning loop makes it vulnerable to **content-driven manipulation**: the attack payload lives in repository data, not in workflow code.
 
 Write access magnifies every read. If the agent can commit directly, a successful content injection skips human review entirely. The poisoned file lands on the default branch before anyone notices.
 
@@ -124,7 +124,7 @@ Even if an attacker crafts a payload that reaches a file write, their exfiltrati
 
 ---
 
-## ✏️ Exercise: Spot the Dangerous Frontmatter
+## ✏️ Exercise: Spot the Dangerous [Frontmatter](https://github.github.com/gh-aw/reference/frontmatter/)
 
 Read this workflow frontmatter and identify every configuration that makes repository poisoning possible: