@@ -108,13 +108,17 @@ The detector reads the verdict exclusively from the out-of-band result sink. The
 │   ├── prompt-template.txt       # optional, pre-expansion
 │   └── prompt-import-tree.json   # optional, runtime-import provenance
 ├── agent_output.json             # required
-├── aw_info.json                  # optional, activation metadata
+├── aw_info.json                  # optional, bounded untrusted activation context
 ├── aw-*.patch                    # optional, git format-patch
 ├── aw-*.bundle                   # optional, git bundles
-├── experiments/                  # optional
-└── comment-memory/*.md           # optional
+├── experiments/                  # optional, inventoried only
+└── comment-memory/*.md           # optional, inventoried only
 ```
 
+All files are recursively inventoried in the JSONL run log and Actions step
+summary. The prompt consumes only an allowlisted, size-bounded subset of
+`aw_info.json`; unknown fields are ignored and all included values are untrusted.
+
 ## Detection Flow
 
 - `pkg/detector/detector.go` (`BuildPrompt`) renders `prompts/threat_detection.md` with placeholders substituted from artifacts and `BuildPromptAnalysis` (untrusted-input breakdown).
 
@@ -89,9 +89,14 @@ The detector operates on an artifacts directory. The current expected shape is d
 
 - `aw-prompts/prompt.txt`
 - `agent_output.json`
+- optional `aw_info.json` (bounded allowlisted fields are consumed as untrusted context)
 - optional `aw-*.patch`
 - optional `aw-*.bundle`
-- optional `comment-memory/*.md`
+- optional `experiments/*` (inventoried only)
+- optional `comment-memory/*.md` (inventoried only)
+
+Every non-directory entry is recursively inventoried with its size and consumed
+status for the run log and GitHub Actions step summary.
 
 When changing artifact handling, review:
 
 
@@ -234,14 +234,20 @@ removing quarantine.
 │   ├── prompt-template.txt # Pre-expansion prompt template (optional)
 │   └── prompt-import-tree.json # Runtime-import provenance (optional)
 ├── agent_output.json       # Agent structured output
-├── aw_info.json            # Activation metadata (optional)
+├── aw_info.json            # Bounded activation context (optional, consumed as untrusted)
 ├── aw-*.patch              # Git format-patch files (optional)
 ├── aw-*.bundle             # Git bundle files (optional)
-├── experiments/            # Experiment assignment/state files (optional)
-└── comment-memory/         # Agent comment memory (optional)
+├── experiments/            # Experiment assignment/state files (optional, inventoried only)
+└── comment-memory/         # Agent comment memory (optional, inventoried only)
     └── *.md
 ```
 
+Every file below the artifacts directory is recorded with its size and consumed
+status in the JSONL `artifacts_loaded` event and, when `GITHUB_STEP_SUMMARY` is
+set, in the Actions step summary. Only an allowlisted, size-bounded subset of
+`aw_info.json` is added to the detection prompt, and all of its values are
+explicitly treated as untrusted runtime data.
+
 ### Output (JSON)
 
 ```json
 
@@ -40,8 +40,15 @@ func findRecord(records []map[string]any, event string) map[string]any {
 
 func TestRunWritesJSONLLog(t *testing.T) {
 	artifactsDir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(artifactsDir, "experiments"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(artifactsDir, "experiments", "assignment.json"), []byte("{}"), 0o600); err != nil {
+		t.Fatal(err)
+	}
 	outputPath := filepath.Join(t.TempDir(), "result.json")
 	logPath := filepath.Join(t.TempDir(), "run.jsonl")
+	summaryPath := filepath.Join(t.TempDir(), "summary.md")
 	copilotMarker := filepath.Join(t.TempDir(), "copilot-called")
 	sinkJSON := `{"prompt_injection":true,"secret_leak":false,"malicious_patch":false,"reasons":["agentic detection"]}`
 	fakeBinDir := writeFakeCopilotWithSink(t, copilotMarker, sinkJSON, 0)
@@ -52,7 +59,8 @@ func TestRunWritesJSONLLog(t *testing.T) {
 		"-log-file", logPath,
 		artifactsDir,
 	}, map[string]string{
-		"PATH": fakeBinDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+		"PATH":                fakeBinDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+		"GITHUB_STEP_SUMMARY": summaryPath,
 	})
 
 	if code != exitThreat {
@@ -71,6 +79,30 @@ func TestRunWritesJSONLLog(t *testing.T) {
 		t.Errorf("run_start engine = %v, want copilot", start["engine"])
 	}
 
+	loaded := findRecord(records, "artifacts_loaded")
+	if loaded == nil {
+		t.Fatalf("missing artifacts_loaded record: %#v", records)
+	}
+	inventory, ok := loaded["inventory"].([]any)
+	if !ok || len(inventory) != 1 {
+		t.Fatalf("artifacts_loaded inventory = %#v, want one entry", loaded["inventory"])
+	}
+	entry, ok := inventory[0].(map[string]any)
+	if !ok {
+		t.Fatalf("inventory entry = %#v", inventory[0])
+	}
+	if entry["path"] != "experiments/assignment.json" || entry["consumed"] != false {
+		t.Errorf("inventory entry = %#v, want unconsumed experiment", entry)
+	}
+
+	summary, err := os.ReadFile(summaryPath)
+	if err != nil {
+		t.Fatalf("reading step summary: %v", err)
+	}
+	if !strings.Contains(string(summary), "| <code>experiments/assignment.json</code> | 2 | file | No |") {
+		t.Errorf("step summary missing experiment inventory:\n%s", summary)
+	}
+
 	verdict := findRecord(records, "verdict")
 	if verdict == nil {
 		t.Fatalf("missing verdict record: %#v", records)
@@ -259,3 +291,31 @@ func TestRunRejectsUnopenableLogFile(t *testing.T) {
 		t.Fatalf("stderr missing config_error status, got:\n%s", stderr)
 	}
 }
+
+func TestRunRejectsUnwritableStepSummary(t *testing.T) {
+	artifactsDir := t.TempDir()
+	logPath := filepath.Join(t.TempDir(), "run.jsonl")
+	summaryPath := filepath.Join(t.TempDir(), "missing-dir", "summary.md")
+
+	code, stderr := runWithTestArgsCapture(t, []string{
+		"threat-detect",
+		"-log-file", logPath,
+		artifactsDir,
+	}, map[string]string{
+		"GITHUB_STEP_SUMMARY": summaryPath,
+	})
+
+	if code != exitError {
+		t.Fatalf("run() exit code = %d, want %d", code, exitError)
+	}
+	if !strings.Contains(stderr, "Error writing artifact inventory summary") {
+		t.Fatalf("stderr missing summary error, got:\n%s", stderr)
+	}
+	if !strings.Contains(stderr, "reason=config_error") {
+		t.Fatalf("stderr missing config_error status, got:\n%s", stderr)
+	}
+	records := readJSONLRecords(t, logPath)
+	if findRecord(records, "artifact_inventory_summary_failed") == nil {
+		t.Fatalf("missing artifact_inventory_summary_failed record: %#v", records)
+	}
+}
@@ -30,6 +30,7 @@ import (
 	"github.com/github/gh-aw-threat-detection/pkg/detector"
 	"github.com/github/gh-aw-threat-detection/pkg/engine"
 	"github.com/github/gh-aw-threat-detection/pkg/runlog"
+	"github.com/github/gh-aw-threat-detection/pkg/stepsummary"
 )
 
 const (
@@ -207,7 +208,16 @@ func run() (code int) {
 		reason = reasonConfigError
 		return exitError
 	}
-	logger.Info("artifacts_loaded", map[string]any{"artifacts_dir": artifactsDir})
+	logger.Info("artifacts_loaded", map[string]any{
+		"artifacts_dir": artifactsDir,
+		"inventory":     arts.Inventory,
+	})
+	if err := stepsummary.WriteArtifactInventory(os.Getenv("GITHUB_STEP_SUMMARY"), arts.Inventory); err != nil {
+		fmt.Fprintf(os.Stderr, "Error writing artifact inventory summary: %v\n", err)
+		logger.Error("artifact_inventory_summary_failed", map[string]any{"error": err.Error()})
+		reason = reasonConfigError
+		return exitError
+	}
 	for _, w := range arts.Warnings {
 		fmt.Fprintf(os.Stderr, "::warning::%s\n", escapeWorkflowData(w))
 		logger.Info("artifacts_warning", map[string]any{"warning": w})