diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml
index 6decb3e3b..2b95e6978 100644
--- a/.github/workflows/duplicate-code-detector.lock.yml
+++ b/.github/workflows/duplicate-code-detector.lock.yml
@@ -457,9 +457,9 @@ jobs:
           echo '=== Container JS ===' >> /tmp/gh-aw/code-metrics.txt
           find containers -name '*.js' | xargs wc -l 2>/dev/null | sort -rn | head -20 >> /tmp/gh-aw/code-metrics.txt
       - name: Run jscpd
-        run: "jscpd src --min-lines 10 --min-tokens 50 --reporters json --output /tmp/gh-aw/jscpd-src 2>&1 | tail -20 > /tmp/gh-aw/jscpd-src.txt\njscpd containers --min-lines 10 --min-tokens 50 --reporters json --output /tmp/gh-aw/jscpd-containers 2>&1 | tail -20 >> /tmp/gh-aw/jscpd-src.txt\n# Summarize: keep only top 15 findings to limit context size\nif [ -f /tmp/gh-aw/jscpd-src/jscpd-report.json ]; then\n  jq '{\n    statistics: .statistics,\n    duplicates: (.duplicates | sort_by(-.lines) | .[0:15]\n      | map({lines, tokens, fragment,\n             firstFile: {name: .firstFile.name, start: .firstFile.start, end: .firstFile.end},\n             secondFile: {name: .secondFile.name, start: .secondFile.start, end: .secondFile.end}}))\n  }' /tmp/gh-aw/jscpd-src/jscpd-report.json > /tmp/gh-aw/jscpd-top.json\nfi\n"
+        run: "jscpd src --min-lines 10 --min-tokens 50 --reporters json --output /tmp/gh-aw/jscpd-src 2>&1 | tail -20 > /tmp/gh-aw/jscpd-src.txt\n# Summarize: keep only top 15 findings to limit context size\nif [ -f /tmp/gh-aw/jscpd-src/jscpd-report.json ]; then\n  jq '{\n    statistics: {total: .statistics.total, percentage: .statistics.percentage},\n    duplicates: (.duplicates | sort_by(-.lines) | .[0:15]\n      | map({lines, tokens,\n             firstFile: {name: .firstFile.name, start: .firstFile.start, end: .firstFile.end},\n             secondFile: {name: .secondFile.name, start: .secondFile.start, end: .secondFile.end}}))\n  }' /tmp/gh-aw/jscpd-src/jscpd-report.json > /tmp/gh-aw/jscpd-top.json\nfi\n"
       - name: Grep pattern analysis
-        run: "{\n  echo '=== Env-var patterns ==='\n  grep -rn 'process\\.env\\.' src/ --include='*.ts' | grep -v test | head -40\n  echo '=== Docker exec patterns ==='\n  grep -n 'execa\\|execaSync\\|docker.*run\\|docker.*exec' src/docker-manager.ts | head -30\n  echo '=== Provider adapter patterns ==='\n  for f in containers/api-proxy/providers/*.js; do\n    echo \"--- $f ---\"\n    grep -n '^function\\|^const.*=.*function\\|^module\\.exports' \"$f\" | head -10\n  done\n} > /tmp/gh-aw/grep-analysis.txt\n"
+        run: "{\n  echo '=== Env-var patterns ==='\n  grep -rn 'process\\.env\\.' src/ --include='*.ts' | grep -v test | head -20\n  echo '=== Docker exec patterns ==='\n  grep -n 'execa\\|execaSync\\|docker.*run\\|docker.*exec' src/docker-manager.ts | head -20\n  echo '=== Provider adapter patterns ==='\n  for f in containers/api-proxy/providers/*.js; do\n    echo \"--- $f ---\"\n    grep -n '^function\\|^const.*=.*function\\|^module\\.exports' \"$f\" | head -10\n  done\n} > /tmp/gh-aw/grep-analysis.txt\n"
       - env:
           EXPR_GITHUB_REPOSITORY: ${{ github.repository }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/duplicate-code-detector.md b/.github/workflows/duplicate-code-detector.md
index 109745993..0c097b0cf 100644
--- a/.github/workflows/duplicate-code-detector.md
+++ b/.github/workflows/duplicate-code-detector.md
@@ -55,13 +55,12 @@ steps:
   - name: Run jscpd
     run: |
       jscpd src --min-lines 10 --min-tokens 50 --reporters json --output /tmp/gh-aw/jscpd-src 2>&1 | tail -20 > /tmp/gh-aw/jscpd-src.txt
-      jscpd containers --min-lines 10 --min-tokens 50 --reporters json --output /tmp/gh-aw/jscpd-containers 2>&1 | tail -20 >> /tmp/gh-aw/jscpd-src.txt
       # Summarize: keep only top 15 findings to limit context size
       if [ -f /tmp/gh-aw/jscpd-src/jscpd-report.json ]; then
         jq '{
-          statistics: .statistics,
+          statistics: {total: .statistics.total, percentage: .statistics.percentage},
           duplicates: (.duplicates | sort_by(-.lines) | .[0:15]
-            | map({lines, tokens, fragment,
+            | map({lines, tokens,
                    firstFile: {name: .firstFile.name, start: .firstFile.start, end: .firstFile.end},
                    secondFile: {name: .secondFile.name, start: .secondFile.start, end: .secondFile.end}}))
         }' /tmp/gh-aw/jscpd-src/jscpd-report.json > /tmp/gh-aw/jscpd-top.json
@@ -71,9 +70,9 @@ steps:
     run: |
       {
         echo '=== Env-var patterns ==='
-        grep -rn 'process\.env\.' src/ --include='*.ts' | grep -v test | head -40
+        grep -rn 'process\.env\.' src/ --include='*.ts' | grep -v test | head -20
         echo '=== Docker exec patterns ==='
-        grep -n 'execa\|execaSync\|docker.*run\|docker.*exec' src/docker-manager.ts | head -30
+        grep -n 'execa\|execaSync\|docker.*run\|docker.*exec' src/docker-manager.ts | head -20
         echo '=== Provider adapter patterns ==='
         for f in containers/api-proxy/providers/*.js; do
           echo "--- $f ---"
@@ -119,10 +118,12 @@ The following data was gathered before this session:
 - **Grep patterns:** `cat /tmp/gh-aw/grep-analysis.txt`
 - **Existing issues:** `cat /tmp/gh-aw/existing-issues.json`
 
+When writing code evidence for issues, use `bash` to view specific file sections (e.g., `sed -n 'X,Yp' src/file.ts`).
+
 ## Scope Constraint
 
 Pre-computed analysis files are in `/tmp/gh-aw/`. Do NOT re-run discovery commands.
-Complete your analysis in ≤7 turns. File at most 3 issues per run.
+Complete your analysis in ≤4 turns. File at most 3 issues per run.
 
 ## Phase 5: Check for Existing Issues
 
diff --git a/.github/workflows/secret-digger-codex.lock.yml b/.github/workflows/secret-digger-codex.lock.yml
index 29d62a2ad..ad8eb3722 100644
--- a/.github/workflows/secret-digger-codex.lock.yml
+++ b/.github/workflows/secret-digger-codex.lock.yml
@@ -1620,7 +1620,6 @@ jobs:
           [model_providers.openai-proxy]
           name = "OpenAI AWF proxy"
           base_url = "http://172.30.0.30:10000"
-          env_key = "OPENAI_API_KEY"
           supports_websockets = false
           [shell_environment_policy]
           inherit = "core"
diff --git a/scripts/ci/duplicate-code-detector-workflow.test.ts b/scripts/ci/duplicate-code-detector-workflow.test.ts
index d95784f81..26306d9f1 100644
--- a/scripts/ci/duplicate-code-detector-workflow.test.ts
+++ b/scripts/ci/duplicate-code-detector-workflow.test.ts
@@ -20,7 +20,7 @@ describe('duplicate code detector workflow optimization config', () => {
     expect(source).not.toContain('Skip directly to Phase 5');
     expect(source).toContain('## Scope Constraint');
     expect(source).toContain('Do NOT re-run discovery commands.');
-    expect(source).toContain('Complete your analysis in ≤7 turns. File at most 3 issues per run.');
+    expect(source).toContain('Complete your analysis in ≤4 turns. File at most 3 issues per run.');
     expect(source).toContain('Do NOT call any GitHub MCP tools for this phase.');
     expect(source).toContain('existing-issues.json');
     expect(source).toContain('max: 3');