diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index 70adda7794..c1f7e372ae 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -562,17 +562,26 @@ jobs:
           # Auto-Assign Issue
           
           Find ONE open issue that:
-          - **Has no assignees** - When you retrieve issues from GitHub, explicitly check the `assignees` field. Skip any issue where `issue.assignees` is not empty or has length > 0.
+          - **Has no assignees** - This is CRITICAL. You MUST verify this in two places:
+            1. Use `no:assignee` in your search query
+            2. After retrieving the issue details, explicitly check that `issue.assignees` is an empty array or has length 0
+            3. **SKIP AND EXIT if `issue.assignees` is not empty** - DO NOT assign issues that already have assignees
           - Does not have label `ai-generated`
           - Does not have a `campaign:*` label (these are managed by campaign orchestrators)
           - Does not have labels: `no-bot`, `no-campaign`
           - Was not opened by `github-actions` or any bot
           
-          Pick the oldest unassigned issue.
+          **Verification Steps (REQUIRED):**
+          1. Search for issues using `no:assignee` filter
+          2. Pick the oldest unassigned issue from search results
+          3. Retrieve full issue details using `issue_read`
+          4. **VERIFY** that `issue.assignees` is empty (length === 0)
+          5. **IF assignees is NOT empty, EXIT WITHOUT ASSIGNING** - the issue was assigned by someone else
+          6. Only if `issue.assignees` is empty, proceed to list contributors and assign
           
           Then list the 5 most recent contributors from merged PRs. Pick one who seems relevant based on the issue type.
           
-          If you find a match:
+          If you find a match AND the issue has no assignees:
           1. Use `assign-to-user` to assign the issue
           2. Use `add-comment` with a short explanation (1-2 sentences)
           
diff --git a/.github/workflows/daily-assign-issue-to-user.md b/.github/workflows/daily-assign-issue-to-user.md
index f163b0123c..13df4dc7de 100644
--- a/.github/workflows/daily-assign-issue-to-user.md
+++ b/.github/workflows/daily-assign-issue-to-user.md
@@ -24,17 +24,26 @@ safe-outputs:
 # Auto-Assign Issue
 
 Find ONE open issue that:
-- **Has no assignees** - When you retrieve issues from GitHub, explicitly check the `assignees` field. Skip any issue where `issue.assignees` is not empty or has length > 0.
+- **Has no assignees** - This is CRITICAL. You MUST verify this in two places:
+  1. Use `no:assignee` in your search query
+  2. After retrieving the issue details, explicitly check that `issue.assignees` is an empty array or has length 0
+  3. **SKIP AND EXIT if `issue.assignees` is not empty** - DO NOT assign issues that already have assignees
 - Does not have label `ai-generated`
 - Does not have a `campaign:*` label (these are managed by campaign orchestrators)
 - Does not have labels: `no-bot`, `no-campaign`
 - Was not opened by `github-actions` or any bot
 
-Pick the oldest unassigned issue.
+**Verification Steps (REQUIRED):**
+1. Search for issues using `no:assignee` filter
+2. Pick the oldest unassigned issue from search results
+3. Retrieve full issue details using `issue_read`
+4. **VERIFY** that `issue.assignees` is empty (length === 0)
+5. **IF assignees is NOT empty, EXIT WITHOUT ASSIGNING** - the issue was assigned by someone else
+6. Only if `issue.assignees` is empty, proceed to list contributors and assign
 
 Then list the 5 most recent contributors from merged PRs. Pick one who seems relevant based on the issue type.
 
-If you find a match:
+If you find a match AND the issue has no assignees:
 1. Use `assign-to-user` to assign the issue
 2. Use `add-comment` with a short explanation (1-2 sentences)
 
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 438534f4ab..ea93b3bd28 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -335,7 +335,6 @@ jobs:
                   "maxLength": 256
                 },
                 "tool": {
-                  "required": true,
                   "type": "string",
                   "sanitize": true,
                   "maxLength": 128
diff --git a/.github/workflows/security-alert-burndown.lock.yml b/.github/workflows/security-alert-burndown.lock.yml
index aed2ba5275..d575904490 100644
--- a/.github/workflows/security-alert-burndown.lock.yml
+++ b/.github/workflows/security-alert-burndown.lock.yml
@@ -456,7 +456,6 @@ jobs:
                   "maxLength": 256
                 },
                 "tool": {
-                  "required": true,
                   "type": "string",
                   "sanitize": true,
                   "maxLength": 128