Bump System.Security.Cryptography.ProtectedData from 8.0.0 to 10.0.3

---
updated-dependencies:
- dependency-name: System.Security.Cryptography.ProtectedData
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

docs/start/envlinux.md

@@ -28,8 +28,8 @@ Debian based OS (Debian, Ubuntu, Linux Mint)
 - liblttng-ust1 or liblttng-ust0
 - libkrb5-3
 - zlib1g
-- libssl1.1, libssl1.0.2 or libssl1.0.0
-- libicu63, libicu60, libicu57 or libicu55
+- libssl3t64, libssl3, libssl1.1, libssl1.0.2 or libssl1.0.0
+- libicu76, libicu75, ..., libicu66, libicu65, libicu63, libicu60, libicu57, libicu55, or libicu52
 
 Fedora based OS (Fedora, Red Hat Enterprise Linux, CentOS, Oracle Linux 7)
 

images/Dockerfile

@@ -21,7 +21,7 @@ RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-c
     && unzip ./runner-container-hooks.zip -d ./k8s \
     && rm runner-container-hooks.zip
 
-RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v0.8.0/actions-runner-hooks-k8s-0.8.0.zip \
+RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v0.8.1/actions-runner-hooks-k8s-0.8.1.zip \
     && unzip ./runner-container-hooks.zip -d ./k8s-novolume \
     && rm runner-container-hooks.zip
 

src/Misc/layoutbin/installdependencies.sh

@@ -102,7 +102,7 @@ then
             exit 1
         fi
 
-        apt_get_with_fallbacks libssl1.1$ libssl1.0.2$ libssl1.0.0$
+        apt_get_with_fallbacks libssl3t64$ libssl3$ libssl1.1$ libssl1.0.2$ libssl1.0.0$
         if [ $? -ne 0 ]
         then
             echo "'$apt_get' failed with exit code '$?'"

src/Runner.Common/Constants.cs

@@ -172,7 +172,6 @@ namespace GitHub.Runner.Common
                 public static readonly string SnapshotPreflightHostedRunnerCheck = "actions_snapshot_preflight_hosted_runner_check";
                 public static readonly string SnapshotPreflightImageGenPoolCheck = "actions_snapshot_preflight_image_gen_pool_check";
                 public static readonly string CompareWorkflowParser = "actions_runner_compare_workflow_parser";
-                public static readonly string CutoverWorkflowParser = "actions_runner_cutover_workflow_parser";
                 public static readonly string SetOrchestrationIdEnvForActions = "actions_set_orchestration_id_env_for_actions";
                 public static readonly string SendJobLevelAnnotations = "actions_send_job_level_annotations";
             }

src/Runner.Listener/JobDispatcher.cs

@@ -24,7 +24,7 @@ namespace GitHub.Runner.Listener
     public interface IJobDispatcher : IRunnerService
     {
         bool Busy { get; }
-        TaskCompletionSource<bool> RunOnceJobCompleted { get; }
+        TaskCompletionSource<TaskResult> RunOnceJobCompleted { get; }
         void Run(Pipelines.AgentJobRequestMessage message, bool runOnce = false);
         bool Cancel(JobCancelMessage message);
         Task WaitAsync(CancellationToken token);
@@ -56,7 +56,7 @@ namespace GitHub.Runner.Listener
         // timeout limit can be overwritten by environment GITHUB_ACTIONS_RUNNER_CHANNEL_TIMEOUT
         private TimeSpan _channelTimeout;
 
-        private TaskCompletionSource<bool> _runOnceJobCompleted = new();
+        private TaskCompletionSource<TaskResult> _runOnceJobCompleted = new();
 
         public event EventHandler<JobStatusEventArgs> JobStatus;
 
@@ -82,7 +82,7 @@ namespace GitHub.Runner.Listener
             Trace.Info($"Set runner/worker IPC timeout to {_channelTimeout.TotalSeconds} seconds.");
         }
 
-        public TaskCompletionSource<bool> RunOnceJobCompleted => _runOnceJobCompleted;
+        public TaskCompletionSource<TaskResult> RunOnceJobCompleted => _runOnceJobCompleted;
 
         public bool Busy { get; private set; }
 
@@ -340,18 +340,19 @@ namespace GitHub.Runner.Listener
 
         private async Task RunOnceAsync(Pipelines.AgentJobRequestMessage message, string orchestrationId, WorkerDispatcher previousJobDispatch, CancellationToken jobRequestCancellationToken, CancellationToken workerCancelTimeoutKillToken)
         {
+            var jobResult = TaskResult.Succeeded;
             try
             {
-                await RunAsync(message, orchestrationId, previousJobDispatch, jobRequestCancellationToken, workerCancelTimeoutKillToken);
+                jobResult = await RunAsync(message, orchestrationId, previousJobDispatch, jobRequestCancellationToken, workerCancelTimeoutKillToken);
             }
             finally
             {
                 Trace.Info("Fire signal for one time used runner.");
-                _runOnceJobCompleted.TrySetResult(true);
+                _runOnceJobCompleted.TrySetResult(jobResult);
             }
         }
 
-        private async Task RunAsync(Pipelines.AgentJobRequestMessage message, string orchestrationId, WorkerDispatcher previousJobDispatch, CancellationToken jobRequestCancellationToken, CancellationToken workerCancelTimeoutKillToken)
+        private async Task<TaskResult> RunAsync(Pipelines.AgentJobRequestMessage message, string orchestrationId, WorkerDispatcher previousJobDispatch, CancellationToken jobRequestCancellationToken, CancellationToken workerCancelTimeoutKillToken)
         {
             Busy = true;
             try
@@ -399,7 +400,7 @@ namespace GitHub.Runner.Listener
                     {
                         // renew job request task complete means we run out of retry for the first job request renew.
                         Trace.Info($"Unable to renew job request for job {message.JobId} for the first time, stop dispatching job to worker.");
-                        return;
+                        return TaskResult.Abandoned;
                     }
 
                     if (jobRequestCancellationToken.IsCancellationRequested)
@@ -412,7 +413,7 @@ namespace GitHub.Runner.Listener
 
                         // complete job request with result Cancelled
                         await CompleteJobRequestAsync(_poolId, message, systemConnection, lockToken, TaskResult.Canceled);
-                        return;
+                        return TaskResult.Canceled;
                     }
 
                     HostContext.WritePerfCounter($"JobRequestRenewed_{requestId.ToString()}");
@@ -523,7 +524,7 @@ namespace GitHub.Runner.Listener
                             await renewJobRequest;
 
                             // not finish the job request since the job haven't run on worker at all, we will not going to set a result to server.
-                            return;
+                            return TaskResult.Failed;
                         }
 
                         // we get first jobrequest renew succeed and start the worker process with the job message.
@@ -604,7 +605,7 @@ namespace GitHub.Runner.Listener
                                     Trace.Error(detailInfo);
                                 }
 
-                                return;
+                                return TaskResultUtil.TranslateFromReturnCode(returnCode);
                             }
                             else if (completedTask == renewJobRequest)
                             {
@@ -706,6 +707,8 @@ namespace GitHub.Runner.Listener
 
                             // complete job request
                             await CompleteJobRequestAsync(_poolId, message, systemConnection, lockToken, resultOnAbandonOrCancel);
+
+                            return resultOnAbandonOrCancel;
                         }
                         finally
                         {

src/Runner.Listener/Runner.cs

@@ -5,8 +5,8 @@ using System.IO;
 using System.Linq;
 using System.Reflection;
 using System.Runtime.CompilerServices;
-using System.Security.Cryptography;
 using System.Security.Claims;
+using System.Security.Cryptography;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -324,8 +324,11 @@ namespace GitHub.Runner.Listener
                         HostContext.EnableAuthMigration("EnableAuthMigrationByDefault");
                     }
 
+                    // hosted runner only run one job and would like to know the result of the job for telemetry and alerting on failure spike.
+                    var returnJobResultForHosted = StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_RETURN_JOB_RESULT_FOR_HOSTED"));
+
                     // Run the runner interactively or as service
-                    return await ExecuteRunnerAsync(settings, command.RunOnce || settings.Ephemeral);
+                    return await ExecuteRunnerAsync(settings, command.RunOnce || settings.Ephemeral || returnJobResultForHosted, returnJobResultForHosted);
                 }
                 else
                 {
@@ -401,17 +404,32 @@ namespace GitHub.Runner.Listener
         }
 
         //create worker manager, create message listener and start listening to the queue
-        private async Task<int> RunAsync(RunnerSettings settings, bool runOnce = false)
+        private async Task<int> RunAsync(RunnerSettings settings, bool runOnce = false, bool returnRunOnceJobResult = false)
         {
             try
             {
                 Trace.Info(nameof(RunAsync));
-                
+
+                // Validate directory permissions.
+                string workDirectory = HostContext.GetDirectory(WellKnownDirectory.Work);
+                Trace.Info($"Validating directory permissions for: '{workDirectory}'");
+                try
+                {
+                    Directory.CreateDirectory(workDirectory);
+                    IOUtil.ValidateExecutePermission(workDirectory);
+                }
+                catch (Exception ex)
+                {
+                    Trace.Error(ex);
+                    _term.WriteError($"Fail to create and validate runner's work directory '{workDirectory}'.");
+                    return Constants.Runner.ReturnCode.TerminatedError;
+                }
+
                 // First try using migrated settings if available
                 var configManager = HostContext.GetService<IConfigurationManager>();
                 RunnerSettings migratedSettings = null;
-                
-                try 
+
+                try
                 {
                     migratedSettings = configManager.LoadMigratedSettings();
                     Trace.Info("Loaded migrated settings from .runner_migrated file");
@@ -422,15 +440,15 @@ namespace GitHub.Runner.Listener
                     // If migrated settings file doesn't exist or can't be loaded, we'll use the provided settings
                     Trace.Info($"Failed to load migrated settings: {ex.Message}");
                 }
-                
+
                 bool usedMigratedSettings = false;
-                
+
                 if (migratedSettings != null)
                 {
                     // Try to create session with migrated settings first
                     Trace.Info("Attempting to create session using migrated settings");
                     _listener = GetMessageListener(migratedSettings, isMigratedSettings: true);
-                    
+
                     try
                     {
                         CreateSessionResult createSessionResult = await _listener.CreateSessionAsync(HostContext.RunnerShutdownToken);
@@ -450,7 +468,7 @@ namespace GitHub.Runner.Listener
                         Trace.Error($"Exception when creating session with migrated settings: {ex}");
                     }
                 }
-                
+
                 // If migrated settings weren't used or session creation failed, use original settings
                 if (!usedMigratedSettings)
                 {
@@ -503,7 +521,7 @@ namespace GitHub.Runner.Listener
                             restartSession = true;
                             break;
                         }
-                        
+
                         TaskAgentMessage message = null;
                         bool skipMessageDeletion = false;
                         try
@@ -565,6 +583,21 @@ namespace GitHub.Runner.Listener
                                         Trace.Info($"Ignore any exception after cancel message loop. {ex}");
                                     }
 
+                                    if (returnRunOnceJobResult)
+                                    {
+                                        try
+                                        {
+                                            var jobResult = await jobDispatcher.RunOnceJobCompleted.Task;
+                                            return TaskResultUtil.TranslateToReturnCode(jobResult);
+                                        }
+                                        catch (Exception ex)
+                                        {
+                                            Trace.Error("run once job finished with error.");
+                                            Trace.Error(ex);
+                                            return Constants.Runner.ReturnCode.TerminatedError;
+                                        }
+                                    }
+
                                     return Constants.Runner.ReturnCode.Success;
                                 }
                             }
@@ -851,15 +884,15 @@ namespace GitHub.Runner.Listener
             return Constants.Runner.ReturnCode.Success;
         }
 
-        private async Task<int> ExecuteRunnerAsync(RunnerSettings settings, bool runOnce)
+        private async Task<int> ExecuteRunnerAsync(RunnerSettings settings, bool runOnce, bool returnRunOnceJobResult)
         {
             int returnCode = Constants.Runner.ReturnCode.Success;
             bool restart = false;
             do
             {
                 restart = false;
-                returnCode = await RunAsync(settings, runOnce);
-                
+                returnCode = await RunAsync(settings, runOnce, returnRunOnceJobResult);
+
                 if (returnCode == Constants.Runner.ReturnCode.RunnerConfigurationRefreshed)
                 {
                     Trace.Info("Runner configuration was refreshed, restarting session...");

src/Runner.Worker/ActionCommandManager.cs

@@ -318,6 +318,17 @@ namespace GitHub.Runner.Worker
                 context.AddIssue(issue, ExecutionContextLogOptions.Default);
             }
 
+            if (!context.Global.HasDeprecatedSetOutput)
+            {
+                context.Global.HasDeprecatedSetOutput = true;
+                var telemetry = new JobTelemetry
+                {
+                    Type = JobTelemetryType.ActionCommand,
+                    Message = "DeprecatedCommand: set-output"
+                };
+                context.Global.JobTelemetry.Add(telemetry);
+            }
+
             if (!command.Properties.TryGetValue(SetOutputCommandProperties.Name, out string outputName) || string.IsNullOrEmpty(outputName))
             {
                 throw new Exception("Required field 'name' is missing in ##[set-output] command.");
@@ -353,6 +364,17 @@ namespace GitHub.Runner.Worker
                 context.AddIssue(issue, ExecutionContextLogOptions.Default);
             }
 
+            if (!context.Global.HasDeprecatedSaveState)
+            {
+                context.Global.HasDeprecatedSaveState = true;
+                var telemetry = new JobTelemetry
+                {
+                    Type = JobTelemetryType.ActionCommand,
+                    Message = "DeprecatedCommand: save-state"
+                };
+                context.Global.JobTelemetry.Add(telemetry);
+            }
+
             if (!command.Properties.TryGetValue(SaveStateCommandProperties.Name, out string stateName) || string.IsNullOrEmpty(stateName))
             {
                 throw new Exception("Required field 'name' is missing in ##[save-state] command.");

src/Runner.Worker/ActionManifestManagerWrapper.cs

@@ -40,7 +40,7 @@ namespace GitHub.Runner.Worker
 
         public ActionDefinitionData Load(IExecutionContext executionContext, string manifestFile)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 executionContext,
                 "Load",
                 () => _legacyManager.Load(executionContext, manifestFile),
@@ -53,7 +53,7 @@ namespace GitHub.Runner.Worker
             TemplateToken token,
             IDictionary<string, PipelineContextData> extraExpressionValues)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 executionContext,
                 "EvaluateCompositeOutputs",
                 () => _legacyManager.EvaluateCompositeOutputs(executionContext, token, extraExpressionValues),
@@ -66,7 +66,7 @@ namespace GitHub.Runner.Worker
             SequenceToken token,
             IDictionary<string, PipelineContextData> extraExpressionValues)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 executionContext,
                 "EvaluateContainerArguments",
                 () => _legacyManager.EvaluateContainerArguments(executionContext, token, extraExpressionValues),
@@ -79,7 +79,7 @@ namespace GitHub.Runner.Worker
             MappingToken token,
             IDictionary<string, PipelineContextData> extraExpressionValues)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 executionContext,
                 "EvaluateContainerEnvironment",
                 () => _legacyManager.EvaluateContainerEnvironment(executionContext, token, extraExpressionValues),
@@ -96,7 +96,7 @@ namespace GitHub.Runner.Worker
             string inputName,
             TemplateToken token)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 executionContext,
                 "EvaluateDefaultInput",
                 () => _legacyManager.EvaluateDefaultInput(executionContext, inputName, token),
@@ -166,9 +166,150 @@ namespace GitHub.Runner.Worker
                 return null;
             }
 
-            // Serialize new steps and deserialize to old steps
-            var json = StringUtil.ConvertToJson(newSteps, Newtonsoft.Json.Formatting.None);
-            return StringUtil.ConvertFromJson<List<GitHub.DistributedTask.Pipelines.ActionStep>>(json);
+            var result = new List<GitHub.DistributedTask.Pipelines.ActionStep>();
+            foreach (var step in newSteps)
+            {
+                var actionStep = new GitHub.DistributedTask.Pipelines.ActionStep
+                {
+                    ContextName = step.Id,
+                };
+
+                if (step is GitHub.Actions.WorkflowParser.RunStep runStep)
+                {
+                    actionStep.Condition = ExtractConditionString(runStep.If);
+                    actionStep.DisplayNameToken = ConvertToLegacyToken<TemplateToken>(runStep.Name);
+                    actionStep.ContinueOnError = ConvertToLegacyToken<TemplateToken>(runStep.ContinueOnError);
+                    actionStep.TimeoutInMinutes = ConvertToLegacyToken<TemplateToken>(runStep.TimeoutMinutes);
+                    actionStep.Environment = ConvertToLegacyToken<TemplateToken>(runStep.Env);
+                    actionStep.Reference = new GitHub.DistributedTask.Pipelines.ScriptReference();
+                    actionStep.Inputs = BuildRunStepInputs(runStep);
+                }
+                else if (step is GitHub.Actions.WorkflowParser.ActionStep usesStep)
+                {
+                    actionStep.Condition = ExtractConditionString(usesStep.If);
+                    actionStep.DisplayNameToken = ConvertToLegacyToken<TemplateToken>(usesStep.Name);
+                    actionStep.ContinueOnError = ConvertToLegacyToken<TemplateToken>(usesStep.ContinueOnError);
+                    actionStep.TimeoutInMinutes = ConvertToLegacyToken<TemplateToken>(usesStep.TimeoutMinutes);
+                    actionStep.Environment = ConvertToLegacyToken<TemplateToken>(usesStep.Env);
+                    actionStep.Reference = ParseActionReference(usesStep.Uses?.Value);
+                    actionStep.Inputs = ConvertToLegacyToken<MappingToken>(usesStep.With);
+                }
+
+                result.Add(actionStep);
+            }
+            return result;
+        }
+
+        private string ExtractConditionString(GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.BasicExpressionToken ifToken)
+        {
+            if (ifToken == null)
+            {
+                return null;
+            }
+
+            // The Expression property is internal, so we use ToString() which formats as "${{ expr }}"
+            // Then strip the delimiters to get just the expression
+            var str = ifToken.ToString();
+            if (str.StartsWith("${{") && str.EndsWith("}}"))
+            {
+                return str.Substring(3, str.Length - 5).Trim();
+            }
+            return str;
+        }
+
+        private MappingToken BuildRunStepInputs(GitHub.Actions.WorkflowParser.RunStep runStep)
+        {
+            var inputs = new MappingToken(null, null, null);
+
+            // script (from run)
+            if (runStep.Run != null)
+            {
+                inputs.Add(
+                    new StringToken(null, null, null, "script"),
+                    ConvertToLegacyToken<TemplateToken>(runStep.Run));
+            }
+
+            // shell
+            if (runStep.Shell != null)
+            {
+                inputs.Add(
+                    new StringToken(null, null, null, "shell"),
+                    ConvertToLegacyToken<TemplateToken>(runStep.Shell));
+            }
+
+            // working-directory
+            if (runStep.WorkingDirectory != null)
+            {
+                inputs.Add(
+                    new StringToken(null, null, null, "workingDirectory"),
+                    ConvertToLegacyToken<TemplateToken>(runStep.WorkingDirectory));
+            }
+
+            return inputs.Count > 0 ? inputs : null;
+        }
+
+        private GitHub.DistributedTask.Pipelines.ActionStepDefinitionReference ParseActionReference(string uses)
+        {
+            if (string.IsNullOrEmpty(uses))
+            {
+                return null;
+            }
+
+            // Docker reference: docker://image:tag
+            if (uses.StartsWith("docker://", StringComparison.OrdinalIgnoreCase))
+            {
+                return new GitHub.DistributedTask.Pipelines.ContainerRegistryReference
+                {
+                    Image = uses.Substring("docker://".Length)
+                };
+            }
+
+            // Local path reference: ./path/to/action
+            if (uses.StartsWith("./") || uses.StartsWith(".\\"))
+            {
+                return new GitHub.DistributedTask.Pipelines.RepositoryPathReference
+                {
+                    RepositoryType = "self",
+                    Path = uses
+                };
+            }
+
+            // Repository reference: owner/repo@ref or owner/repo/path@ref
+            var atIndex = uses.LastIndexOf('@');
+            string refPart = null;
+            string repoPart = uses;
+
+            if (atIndex > 0)
+            {
+                refPart = uses.Substring(atIndex + 1);
+                repoPart = uses.Substring(0, atIndex);
+            }
+
+            // Split by / to get owner/repo and optional path
+            var parts = repoPart.Split('/');
+            string name;
+            string path = null;
+
+            if (parts.Length >= 2)
+            {
+                name = $"{parts[0]}/{parts[1]}";
+                if (parts.Length > 2)
+                {
+                    path = string.Join("/", parts, 2, parts.Length - 2);
+                }
+            }
+            else
+            {
+                name = repoPart;
+            }
+
+            return new GitHub.DistributedTask.Pipelines.RepositoryPathReference
+            {
+                RepositoryType = "GitHub",
+                Name = name,
+                Ref = refPart,
+                Path = path
+            };
         }
 
         private T ConvertToLegacyToken<T>(GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.TemplateToken newToken) where T : TemplateToken
@@ -217,27 +358,13 @@ namespace GitHub.Runner.Worker
         }
 
         // Comparison helper methods
-        private TLegacy EvaluateWrapper<TLegacy, TNew>(
+        private TLegacy EvaluateAndCompare<TLegacy, TNew>(
             IExecutionContext context,
             string methodName,
             Func<TLegacy> legacyEvaluator,
             Func<TNew> newEvaluator,
             Func<TLegacy, TNew, bool> resultComparer)
         {
-            // Cutover: use only the new evaluator, convert result to legacy type
-            if ((context.Global.Variables.GetBoolean(Constants.Runner.Features.CutoverWorkflowParser) ?? false)
-                || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_CUTOVER_WORKFLOW_PARSER")))
-            {
-                var newResult = newEvaluator();
-                if (typeof(TLegacy) == typeof(TNew))
-                {
-                    return (TLegacy)(object)newResult;
-                }
-
-                var json = StringUtil.ConvertToJson(newResult, Newtonsoft.Json.Formatting.None);
-                return StringUtil.ConvertFromJson<TLegacy>(json);
-            }
-
             // Legacy only?
             if (!((context.Global.Variables.GetBoolean(Constants.Runner.Features.CompareWorkflowParser) ?? false)
                 || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_COMPARE_WORKFLOW_PARSER"))))
@@ -648,6 +775,14 @@ namespace GitHub.Runner.Worker
                 return false;
             }
 
+            // Check for known equivalent error patterns (e.g., JSON parse errors)
+            // where both parsers correctly reject invalid input but with different wording
+            if (PipelineTemplateEvaluatorWrapper.HasJsonExceptionType(legacyException) && PipelineTemplateEvaluatorWrapper.HasJsonExceptionType(newException))
+            {
+                trace.Info("CompareExceptions - both exceptions are JSON parse errors, treating as matched");
+                return true;
+            }
+
             // Compare exception messages recursively (including inner exceptions)
             var legacyMessages = GetExceptionMessages(legacyException);
             var newMessages = GetExceptionMessages(newException);
@@ -712,5 +847,6 @@ namespace GitHub.Runner.Worker
 
             return messages;
         }
+
     }
 }

src/Runner.Worker/ExecutionContext.cs

@@ -1416,8 +1416,7 @@ namespace GitHub.Runner.Worker
         public static IPipelineTemplateEvaluator ToPipelineTemplateEvaluator(this IExecutionContext context, ObjectTemplating.ITraceWriter traceWriter = null)
         {
             // Create wrapper?
-            if ((context.Global.Variables.GetBoolean(Constants.Runner.Features.CompareWorkflowParser) ?? false) || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_COMPARE_WORKFLOW_PARSER"))
-                || (context.Global.Variables.GetBoolean(Constants.Runner.Features.CutoverWorkflowParser) ?? false) || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_CUTOVER_WORKFLOW_PARSER")))
+            if ((context.Global.Variables.GetBoolean(Constants.Runner.Features.CompareWorkflowParser) ?? false) || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_COMPARE_WORKFLOW_PARSER")))
             {
                 return (context as ExecutionContext).ToPipelineTemplateEvaluatorInternal(traceWriter);
             }

src/Runner.Worker/GlobalContext.cs

@@ -31,5 +31,7 @@ namespace GitHub.Runner.Worker
         public JObject ContainerHookState { get; set; }
         public bool HasTemplateEvaluatorMismatch { get; set; }
         public bool HasActionManifestMismatch { get; set; }
+        public bool HasDeprecatedSetOutput { get; set; }
+        public bool HasDeprecatedSaveState { get; set; }
     }
 }

src/Runner.Worker/PipelineTemplateEvaluatorWrapper.cs

@@ -19,7 +19,6 @@ namespace GitHub.Runner.Worker
         private WorkflowTemplateEvaluator _newEvaluator;
         private IExecutionContext _context;
         private Tracing _trace;
-        private bool _cutover;
 
         public PipelineTemplateEvaluatorWrapper(
             IHostContext hostContext,
@@ -30,8 +29,6 @@ namespace GitHub.Runner.Worker
             ArgUtil.NotNull(context, nameof(context));
             _context = context;
             _trace = hostContext.GetTrace(nameof(PipelineTemplateEvaluatorWrapper));
-            _cutover = (context.Global.Variables.GetBoolean(Constants.Runner.Features.CutoverWorkflowParser) ?? false)
-                || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_CUTOVER_WORKFLOW_PARSER"));
 
             if (traceWriter == null)
             {
@@ -58,7 +55,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateStepContinueOnError",
                 () => _legacyEvaluator.EvaluateStepContinueOnError(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateStepContinueOnError(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -70,7 +67,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateStepDisplayName",
                 () => _legacyEvaluator.EvaluateStepDisplayName(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateStepName(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -83,7 +80,7 @@ namespace GitHub.Runner.Worker
             IList<IFunctionInfo> expressionFunctions,
             StringComparer keyComparer)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateStepEnvironment",
                 () => _legacyEvaluator.EvaluateStepEnvironment(token, contextData, expressionFunctions, keyComparer),
                 () => _newEvaluator.EvaluateStepEnvironment(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions), keyComparer),
@@ -96,7 +93,7 @@ namespace GitHub.Runner.Worker
             IList<IFunctionInfo> expressionFunctions,
             IEnumerable<KeyValuePair<string, object>> expressionState)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateStepIf",
                 () => _legacyEvaluator.EvaluateStepIf(token, contextData, expressionFunctions, expressionState),
                 () => _newEvaluator.EvaluateStepIf(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions), expressionState),
@@ -108,7 +105,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateStepInputs",
                 () => _legacyEvaluator.EvaluateStepInputs(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateStepInputs(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -120,7 +117,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateStepTimeout",
                 () => _legacyEvaluator.EvaluateStepTimeout(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateStepTimeout(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -132,7 +129,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateJobContainer",
                 () => _legacyEvaluator.EvaluateJobContainer(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateJobContainer(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -144,7 +141,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateJobOutput",
                 () => _legacyEvaluator.EvaluateJobOutput(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateJobOutputs(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -156,7 +153,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateEnvironmentUrl",
                 () => _legacyEvaluator.EvaluateEnvironmentUrl(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateJobEnvironmentUrl(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -168,7 +165,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateJobDefaultsRun",
                 () => _legacyEvaluator.EvaluateJobDefaultsRun(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateJobDefaultsRun(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -180,7 +177,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateJobServiceContainers",
                 () => _legacyEvaluator.EvaluateJobServiceContainers(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateJobServiceContainers(ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -192,7 +189,7 @@ namespace GitHub.Runner.Worker
             DictionaryContextData contextData,
             IList<IFunctionInfo> expressionFunctions)
         {
-            return EvaluateWrapper(
+            return EvaluateAndCompare(
                 "EvaluateJobSnapshotRequest",
                 () => _legacyEvaluator.EvaluateJobSnapshotRequest(token, contextData, expressionFunctions),
                 () => _newEvaluator.EvaluateSnapshot(string.Empty, ConvertToken(token), ConvertData(contextData), ConvertFunctions(expressionFunctions)),
@@ -219,24 +216,14 @@ namespace GitHub.Runner.Worker
             }
         }
 
-        private TLegacy EvaluateWrapper<TLegacy, TNew>(
+        internal TLegacy EvaluateAndCompare<TLegacy, TNew>(
             string methodName,
             Func<TLegacy> legacyEvaluator,
             Func<TNew> newEvaluator,
             Func<TLegacy, TNew, bool> resultComparer)
         {
-            // Cutover: use only the new evaluator, convert result to legacy type
-            if (_cutover)
-            {
-                var newResult = newEvaluator();
-                if (typeof(TLegacy) == typeof(TNew))
-                {
-                    return (TLegacy)(object)newResult;
-                }
-
-                var json = StringUtil.ConvertToJson(newResult, Newtonsoft.Json.Formatting.None);
-                return StringUtil.ConvertFromJson<TLegacy>(json);
-            }
+            // Capture cancellation state before evaluation
+            var cancellationRequestedBefore = _context.CancellationToken.IsCancellationRequested;
 
             // Legacy evaluator
             var legacyException = default(Exception);
@@ -269,14 +256,18 @@ namespace GitHub.Runner.Worker
                     newException = ex;
                 }
 
+                // Capture cancellation state after evaluation
+                var cancellationRequestedAfter = _context.CancellationToken.IsCancellationRequested;
+
                 // Compare results or exceptions
+                bool hasMismatch = false;
                 if (legacyException != null || newException != null)
                 {
                     // Either one or both threw exceptions - compare them
                     if (!CompareExceptions(legacyException, newException))
                     {
                         _trace.Info($"{methodName} exception mismatch");
-                        RecordMismatch($"{methodName}");
+                        hasMismatch = true;
                     }
                 }
                 else
@@ -285,6 +276,20 @@ namespace GitHub.Runner.Worker
                     if (!resultComparer(legacyResult, newResult))
                     {
                         _trace.Info($"{methodName} mismatch");
+                        hasMismatch = true;
+                    }
+                }
+
+                // Only record mismatch if it wasn't caused by a cancellation race condition
+                if (hasMismatch)
+                {
+                    if (!cancellationRequestedBefore && cancellationRequestedAfter)
+                    {
+                        // Cancellation state changed during evaluation window - skip recording
+                        _trace.Info($"{methodName} mismatch skipped due to cancellation race condition");
+                    }
+                    else
+                    {
                         RecordMismatch($"{methodName}");
                     }
                 }
@@ -628,6 +633,13 @@ namespace GitHub.Runner.Worker
                 return false;
             }
 
+            // Check for known equivalent error patterns (e.g., JSON parse errors)
+            // where both parsers correctly reject invalid input but with different wording
+            if (IsKnownEquivalentErrorPattern(legacyException, newException))
+            {
+                return true;
+            }
+
             // Compare exception messages recursively (including inner exceptions)
             var legacyMessages = GetExceptionMessages(legacyException);
             var newMessages = GetExceptionMessages(newException);
@@ -650,6 +662,67 @@ namespace GitHub.Runner.Worker
             return true;
         }
 
+        /// <summary>
+        /// Checks if two exceptions match a known pattern where both parsers correctly reject
+        /// invalid input but with different error messages (e.g., JSON parse errors from fromJSON).
+        /// </summary>
+        private bool IsKnownEquivalentErrorPattern(Exception legacyException, Exception newException)
+        {
+            // fromJSON('') - both parsers fail when parsing empty string as JSON
+            // The error messages differ but both indicate JSON parsing failure.
+            // Legacy throws raw JsonReaderException: "Error reading JToken from JsonReader..."
+            // New wraps it: "Error parsing fromJson" with inner JsonReaderException
+            // Both may be wrapped in TemplateValidationException: "The template is not valid..."
+            if (HasJsonExceptionType(legacyException) && HasJsonExceptionType(newException))
+            {
+                _trace.Info("CompareExceptions - both exceptions are JSON parse errors, treating as matched");
+                return true;
+            }
+
+            return false;
+        }
+
+        /// <summary>
+        /// Checks if the exception chain contains a JSON-related exception type.
+        /// </summary>
+        internal static bool HasJsonExceptionType(Exception ex)
+        {
+            var toProcess = new Queue<Exception>();
+            toProcess.Enqueue(ex);
+            int count = 0;
+
+            while (toProcess.Count > 0 && count < 50)
+            {
+                var current = toProcess.Dequeue();
+                if (current == null) continue;
+
+                count++;
+
+                if (current is Newtonsoft.Json.JsonReaderException ||
+                    current is System.Text.Json.JsonException)
+                {
+                    return true;
+                }
+
+                if (current is AggregateException aggregateEx)
+                {
+                    foreach (var innerEx in aggregateEx.InnerExceptions)
+                    {
+                        if (innerEx != null && count < 50)
+                        {
+                            toProcess.Enqueue(innerEx);
+                        }
+                    }
+                }
+                else if (current.InnerException != null)
+                {
+                    toProcess.Enqueue(current.InnerException);
+                }
+            }
+
+            return false;
+        }
+
         private IList<string> GetExceptionMessages(Exception ex)
         {
             var messages = new List<string>();

src/Sdk/Sdk.csproj

@@ -24,7 +24,7 @@
         <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
         <PackageReference Include="System.Security.Cryptography.Cng" Version="5.0.0" />
         <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.2" />
-        <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
+        <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.3" />
         <PackageReference Include="Minimatch" Version="2.0.0" />
         <PackageReference Include="YamlDotNet.Signed" Version="5.3.0" />
         <PackageReference Include="System.Net.Http" Version="4.3.4" />

src/Sdk/WorkflowParser/Conversion/WorkflowTemplateConverter.cs

@@ -1,4 +1,4 @@
-#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
+#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
 
 using System;
 using System.Collections.Generic;
@@ -43,7 +43,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
                     {
                         case WorkflowTemplateConstants.On:
                             var inputTypes = ConvertToOnWorkflowDispatchInputTypes(workflowPair.Value);
-                            foreach(var item in inputTypes)
+                            foreach (var item in inputTypes)
                             {
                                 result.InputTypes.TryAdd(item.Key, item.Value);
                             }
@@ -432,7 +432,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
                 context.Error(snapshotToken, $"job {WorkflowTemplateConstants.Snapshot} {WorkflowTemplateConstants.ImageName} is required.");
                 return null;
             }
-            
+
             return new Snapshot
             {
                 ImageName = imageName,
@@ -445,7 +445,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
         {
             var versionSegments = versionString.Split(".");
 
-            if (versionSegments.Length != 2 || 
+            if (versionSegments.Length != 2 ||
                 !versionSegments[1].Equals("*") ||
                 !Int32.TryParse(versionSegments[0], NumberStyles.None, CultureInfo.InvariantCulture, result: out int parsedMajor) ||
                 parsedMajor < 0)
@@ -1154,7 +1154,12 @@ namespace GitHub.Actions.WorkflowParser.Conversion
 
             if (String.IsNullOrEmpty(result.Image))
             {
-                context.Error(value, "Container image cannot be empty");
+                // Only error during early validation (parse time)
+                // At runtime (expression evaluation), empty image = no container
+                if (isEarlyValidation)
+                {
+                    context.Error(value, "Container image cannot be empty");
+                }
                 return null;
             }
 
@@ -1838,9 +1843,9 @@ namespace GitHub.Actions.WorkflowParser.Conversion
                     case "actions":
                         permissions.Actions = permissionLevel;
                         break;
-					case "artifact-metadata":
-						permissions.ArtifactMetadata = permissionLevel;
-						break;
+                    case "artifact-metadata":
+                        permissions.ArtifactMetadata = permissionLevel;
+                        break;
                     case "attestations":
                         permissions.Attestations = permissionLevel;
                         break;

src/Test/L0/Listener/JobDispatcherL0.cs

@@ -739,7 +739,8 @@ namespace GitHub.Runner.Common.Tests.Listener
                 Assert.True(jobDispatcher.RunOnceJobCompleted.Task.IsCompleted, "JobDispatcher should set task complete token for one time agent.");
                 if (jobDispatcher.RunOnceJobCompleted.Task.IsCompleted)
                 {
-                    Assert.True(await jobDispatcher.RunOnceJobCompleted.Task, "JobDispatcher should set task complete token to 'TRUE' for one time agent.");
+                    var result = await jobDispatcher.RunOnceJobCompleted.Task;
+                    Assert.Equal(TaskResult.Succeeded, result);
                 }
             }
         }

src/Test/L0/Listener/RunnerL0.cs

@@ -295,13 +295,13 @@ namespace GitHub.Runner.Common.Tests.Listener
                 _messageListener.Setup(x => x.DeleteMessageAsync(It.IsAny<TaskAgentMessage>()))
                     .Returns(Task.CompletedTask);
 
-                var runOnceJobCompleted = new TaskCompletionSource<bool>();
+                var runOnceJobCompleted = new TaskCompletionSource<TaskResult>();
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted)
                     .Returns(runOnceJobCompleted);
                 _jobDispatcher.Setup(x => x.Run(It.IsAny<Pipelines.AgentJobRequestMessage>(), It.IsAny<bool>()))
                     .Callback(() =>
                     {
-                        runOnceJobCompleted.TrySetResult(true);
+                        runOnceJobCompleted.TrySetResult(TaskResult.Succeeded);
                     });
                 _jobNotification.Setup(x => x.StartClient(It.IsAny<String>()))
                     .Callback(() =>
@@ -399,13 +399,13 @@ namespace GitHub.Runner.Common.Tests.Listener
                 _messageListener.Setup(x => x.DeleteMessageAsync(It.IsAny<TaskAgentMessage>()))
                     .Returns(Task.CompletedTask);
 
-                var runOnceJobCompleted = new TaskCompletionSource<bool>();
+                var runOnceJobCompleted = new TaskCompletionSource<TaskResult>();
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted)
                     .Returns(runOnceJobCompleted);
                 _jobDispatcher.Setup(x => x.Run(It.IsAny<Pipelines.AgentJobRequestMessage>(), It.IsAny<bool>()))
                     .Callback(() =>
                     {
-                        runOnceJobCompleted.TrySetResult(true);
+                        runOnceJobCompleted.TrySetResult(TaskResult.Succeeded);
                     });
                 _jobNotification.Setup(x => x.StartClient(It.IsAny<String>()))
                     .Callback(() =>
@@ -733,8 +733,8 @@ namespace GitHub.Runner.Common.Tests.Listener
 
                 _configStore.Setup(x => x.IsServiceConfigured()).Returns(false);
 
-                var completedTask = new TaskCompletionSource<bool>();
-                completedTask.SetResult(true);
+                var completedTask = new TaskCompletionSource<TaskResult>();
+                completedTask.SetResult(TaskResult.Succeeded);
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted).Returns(completedTask);
 
                 //Act
@@ -834,8 +834,8 @@ namespace GitHub.Runner.Common.Tests.Listener
 
                 _configStore.Setup(x => x.IsServiceConfigured()).Returns(false);
 
-                var completedTask = new TaskCompletionSource<bool>();
-                completedTask.SetResult(true);
+                var completedTask = new TaskCompletionSource<TaskResult>();
+                completedTask.SetResult(TaskResult.Succeeded);
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted).Returns(completedTask);
 
                 //Act
@@ -954,8 +954,8 @@ namespace GitHub.Runner.Common.Tests.Listener
 
                 _configStore.Setup(x => x.IsServiceConfigured()).Returns(false);
 
-                var completedTask = new TaskCompletionSource<bool>();
-                completedTask.SetResult(true);
+                var completedTask = new TaskCompletionSource<TaskResult>();
+                completedTask.SetResult(TaskResult.Succeeded);
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted).Returns(completedTask);
 
                 //Act

src/Test/L0/Worker/ActionCommandManagerL0.cs

@@ -457,6 +457,8 @@ namespace GitHub.Runner.Common.Tests.Worker
                 new SetEnvCommandExtension(),
                 new WarningCommandExtension(),
                 new AddMaskCommandExtension(),
+                new SetOutputCommandExtension(),
+                new SaveStateCommandExtension(),
             };
             foreach (var command in commands)
             {
@@ -499,5 +501,53 @@ namespace GitHub.Runner.Common.Tests.Worker
             };
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetOutputCommand_EmitsTelemetryOnce()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                _ec.Object.Global.JobTelemetry = new List<JobTelemetry>();
+                var reference = string.Empty;
+                _ec.Setup(x => x.SetOutput(It.IsAny<string>(), It.IsAny<string>(), out reference));
+
+                // First set-output should add telemetry
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "::set-output name=foo::bar", null));
+                Assert.Single(_ec.Object.Global.JobTelemetry);
+                Assert.Equal(JobTelemetryType.ActionCommand, _ec.Object.Global.JobTelemetry[0].Type);
+                Assert.Equal("DeprecatedCommand: set-output", _ec.Object.Global.JobTelemetry[0].Message);
+                Assert.True(_ec.Object.Global.HasDeprecatedSetOutput);
+
+                // Second set-output should not add another telemetry entry
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "::set-output name=foo2::bar2", null));
+                Assert.Single(_ec.Object.Global.JobTelemetry);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SaveStateCommand_EmitsTelemetryOnce()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                _ec.Object.Global.JobTelemetry = new List<JobTelemetry>();
+                _ec.Setup(x => x.IsEmbedded).Returns(false);
+                _ec.Setup(x => x.IntraActionState).Returns(new Dictionary<string, string>());
+
+                // First save-state should add telemetry
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "::save-state name=foo::bar", null));
+                Assert.Single(_ec.Object.Global.JobTelemetry);
+                Assert.Equal(JobTelemetryType.ActionCommand, _ec.Object.Global.JobTelemetry[0].Type);
+                Assert.Equal("DeprecatedCommand: save-state", _ec.Object.Global.JobTelemetry[0].Message);
+                Assert.True(_ec.Object.Global.HasDeprecatedSaveState);
+
+                // Second save-state should not add another telemetry entry
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "::save-state name=foo2::bar2", null));
+                Assert.Single(_ec.Object.Global.JobTelemetry);
+            }
+        }
+
     }
 }

src/Test/L0/Worker/ActionManifestParserComparisonL0.cs

@@ -222,132 +222,13 @@ namespace GitHub.Runner.Common.Tests.Worker
         [Fact]
         [Trait("Level", "L0")]
         [Trait("Category", "Worker")]
-        public void EvaluateWrapper_SkipsMismatchRecording_WhenCancellationOccursDuringEvaluation()
+        public void EvaluateDefaultInput_BothParsersAgree()
         {
             try
             {
-                // Arrange - Test that mismatches are not recorded when cancellation state changes during evaluation
                 Setup();
-
-                // Enable comparison feature
                 _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
 
-                // Create the wrapper
-                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
-
-                // Create a simple token for evaluation
-                var token = new StringToken(null, null, null, "test-value");
-                var contextData = new DictionaryContextData();
-                var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
-
-                // First evaluation without cancellation - should work normally
-                var result1 = wrapper.EvaluateStepDisplayName(token, contextData, expressionFunctions);
-                Assert.Equal("test-value", result1);
-                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
-
-                // Now simulate a scenario where cancellation occurs during evaluation
-                // Cancel the token before next evaluation
-                _ecTokenSource.Cancel();
-
-                // Evaluate again - even if there were a mismatch, it should be skipped due to cancellation
-                var result2 = wrapper.EvaluateStepDisplayName(token, contextData, expressionFunctions);
-                Assert.Equal("test-value", result2);
-
-                // Verify no mismatch was recorded (cancellation race detection should have prevented it)
-                // Note: In this test, both parsers return the same result, so there's no actual mismatch.
-                // The cancellation race detection is a safeguard for when results differ due to timing.
-                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
-            }
-            finally
-            {
-                Teardown();
-            }
-        }
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public void EvaluateWrapper_DoesNotRecordMismatch_WhenResultsMatch()
-        {
-            try
-            {
-                // Arrange - Test that no mismatch is recorded when both parsers return matching results
-                Setup();
-
-                // Enable comparison feature
-                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
-
-                // Create the wrapper
-                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
-
-                // Create a simple token for evaluation
-                var token = new StringToken(null, null, null, "test-value");
-                var contextData = new DictionaryContextData();
-                var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
-
-                // Evaluation without cancellation - should work normally and not record mismatch for matching results
-                var result = wrapper.EvaluateStepDisplayName(token, contextData, expressionFunctions);
-                Assert.Equal("test-value", result);
-
-                // Since both parsers return the same result, no mismatch should be recorded
-                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
-            }
-            finally
-            {
-                Teardown();
-            }
-        }
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public void CutoverFlag_UsesNewEvaluator_ForPipelineTemplateEvaluator()
-        {
-            try
-            {
-                // Arrange - Test that cutover flag causes the wrapper to use only the new evaluator
-                Setup();
-
-                // Enable cutover feature (not comparison)
-                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CutoverWorkflowParser, "true");
-
-                // Create the wrapper
-                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
-
-                // Create a simple token for evaluation
-                var token = new StringToken(null, null, null, "test-value");
-                var contextData = new DictionaryContextData();
-                var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
-
-                // Act - Evaluate in cutover mode
-                var result = wrapper.EvaluateStepDisplayName(token, contextData, expressionFunctions);
-
-                // Assert - Should get the correct result from the new evaluator
-                Assert.Equal("test-value", result);
-
-                // No mismatch should be recorded (comparison is skipped entirely in cutover mode)
-                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
-            }
-            finally
-            {
-                Teardown();
-            }
-        }
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public void CutoverFlag_UsesNewManager_ForActionManifestLoad()
-        {
-            try
-            {
-                // Arrange - Test that cutover flag causes the manifest wrapper to use only the new manager
-                Setup();
-
-                // Enable cutover feature (not comparison)
-                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CutoverWorkflowParser, "true");
-
-                // Register required services
                 var legacyManager = new ActionManifestManagerLegacy();
                 legacyManager.Initialize(_hc);
                 _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
@@ -359,16 +240,18 @@ namespace GitHub.Runner.Common.Tests.Worker
                 var wrapper = new ActionManifestManagerWrapper();
                 wrapper.Initialize(_hc);
 
-                var manifestPath = Path.Combine(TestUtil.GetTestDataPath(), "conditional_composite_action.yml");
+                _ec.Object.ExpressionValues["github"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["strategy"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["matrix"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["steps"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["job"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["runner"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["env"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionFunctions.Add(new LegacyExpressions.FunctionInfo<GitHub.Runner.Worker.Expressions.HashFilesFunction>("hashFiles", 1, 255));
 
-                // Act - Load through the wrapper in cutover mode
-                var result = wrapper.Load(_ec.Object, manifestPath);
+                var result = wrapper.EvaluateDefaultInput(_ec.Object, "testInput", new StringToken(null, null, null, "defaultValue"));
 
-                // Assert - Should get the correct result from the new manager
-                Assert.NotNull(result);
-                Assert.Equal(ActionExecutionType.Composite, result.Execution.ExecutionType);
-
-                // No mismatch should be recorded (comparison is skipped in cutover mode)
+                Assert.Equal("defaultValue", result);
                 Assert.False(_ec.Object.Global.HasActionManifestMismatch);
             }
             finally
@@ -380,30 +263,115 @@ namespace GitHub.Runner.Common.Tests.Worker
         [Fact]
         [Trait("Level", "L0")]
         [Trait("Category", "Worker")]
-        public void CutoverFlag_TakesPrecedence_OverCompareFlag()
+        public void EvaluateContainerArguments_BothParsersAgree()
         {
             try
             {
-                // Arrange - Test that cutover flag takes precedence over compare flag
                 Setup();
-
-                // Enable both flags
                 _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
-                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CutoverWorkflowParser, "true");
 
-                // Create the wrapper
-                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
 
-                var token = new StringToken(null, null, null, "test-value");
-                var contextData = new DictionaryContextData();
-                var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
 
-                // Act - Evaluate (cutover should take precedence, skipping comparison entirely)
-                var result = wrapper.EvaluateStepDisplayName(token, contextData, expressionFunctions);
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
 
-                // Assert - Should get correct result, no comparison mismatch recorded
-                Assert.Equal("test-value", result);
-                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+                var arguments = new SequenceToken(null, null, null);
+                arguments.Add(new StringToken(null, null, null, "arg1"));
+                arguments.Add(new StringToken(null, null, null, "arg2"));
+
+                var evaluateContext = new Dictionary<string, LegacyContextData.PipelineContextData>(StringComparer.OrdinalIgnoreCase);
+
+                var result = wrapper.EvaluateContainerArguments(_ec.Object, arguments, evaluateContext);
+
+                Assert.Equal(2, result.Count);
+                Assert.Equal("arg1", result[0]);
+                Assert.Equal("arg2", result[1]);
+                Assert.False(_ec.Object.Global.HasActionManifestMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateContainerEnvironment_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
+
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
+
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
+
+                var environment = new MappingToken(null, null, null);
+                environment.Add(new StringToken(null, null, null, "hello"), new StringToken(null, null, null, "world"));
+
+                var evaluateContext = new Dictionary<string, LegacyContextData.PipelineContextData>(StringComparer.OrdinalIgnoreCase);
+
+                var result = wrapper.EvaluateContainerEnvironment(_ec.Object, environment, evaluateContext);
+
+                Assert.Equal(1, result.Count);
+                Assert.Equal("world", result["hello"]);
+                Assert.False(_ec.Object.Global.HasActionManifestMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateCompositeOutputs_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
+
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
+
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
+
+                var outputDef = new MappingToken(null, null, null);
+                outputDef.Add(new StringToken(null, null, null, "description"), new StringToken(null, null, null, "test output"));
+                outputDef.Add(new StringToken(null, null, null, "value"), new StringToken(null, null, null, "value1"));
+
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "output1"), outputDef);
+
+                var evaluateContext = new Dictionary<string, LegacyContextData.PipelineContextData>(StringComparer.OrdinalIgnoreCase);
+
+                var result = wrapper.EvaluateCompositeOutputs(_ec.Object, token, evaluateContext);
+
+                Assert.NotNull(result);
+                Assert.False(_ec.Object.Global.HasActionManifestMismatch);
             }
             finally
             {

src/Test/L0/Worker/PipelineTemplateEvaluatorWrapperL0.cs

@@ -0,0 +1,550 @@
+using GitHub.DistributedTask.ObjectTemplating.Tokens;
+using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.DistributedTask.Pipelines.ObjectTemplating;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker;
+using LegacyContextData = GitHub.DistributedTask.Pipelines.ContextData;
+using LegacyExpressions = GitHub.DistributedTask.Expressions2;
+using Moq;
+using System;
+using System.Collections.Generic;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using Xunit;
+
+namespace GitHub.Runner.Common.Tests.Worker
+{
+    public sealed class PipelineTemplateEvaluatorWrapperL0
+    {
+        private CancellationTokenSource _ecTokenSource;
+        private Mock<IExecutionContext> _ec;
+        private TestHostContext _hc;
+
+        // -------------------------------------------------------------------
+        // EvaluateAndCompare core behavior
+        // -------------------------------------------------------------------
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_DoesNotRecordMismatch_WhenResultsMatch()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+
+                var token = new StringToken(null, null, null, "test-value");
+                var contextData = new DictionaryContextData();
+                var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepDisplayName(token, contextData, expressionFunctions);
+
+                Assert.Equal("test-value", result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_SkipsMismatchRecording_WhenCancellationOccursDuringEvaluation()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+
+                // Call EvaluateAndCompare directly: the new evaluator cancels the token
+                // and returns a different value, forcing hasMismatch = true.
+                // Because cancellation flipped during the evaluation window, the
+                // mismatch should be skipped.
+                var result = wrapper.EvaluateAndCompare<string, string>(
+                    "TestCancellationSkip",
+                    () => "legacy-value",
+                    () =>
+                    {
+                        _ecTokenSource.Cancel();
+                        return "different-value";
+                    },
+                    (legacy, @new) => string.Equals(legacy, @new, StringComparison.Ordinal));
+
+                Assert.Equal("legacy-value", result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_RecordsMismatch_WhenResultsDifferWithoutCancellation()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+
+                // Different results without cancellation — mismatch SHOULD be recorded.
+                var result = wrapper.EvaluateAndCompare<string, string>(
+                    "TestMismatchRecorded",
+                    () => "legacy-value",
+                    () => "different-value",
+                    (legacy, @new) => string.Equals(legacy, @new, StringComparison.Ordinal));
+
+                Assert.Equal("legacy-value", result);
+                Assert.True(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        // -------------------------------------------------------------------
+        // Smoke tests — both parsers agree, no mismatch recorded
+        // -------------------------------------------------------------------
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepContinueOnError_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new BooleanToken(null, null, null, true);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepContinueOnError(token, contextData, functions);
+
+                Assert.True(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepEnvironment_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "FOO"), new StringToken(null, null, null, "bar"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepEnvironment(token, contextData, functions, StringComparer.OrdinalIgnoreCase);
+
+                Assert.NotNull(result);
+                Assert.Equal("bar", result["FOO"]);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepIf_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new BasicExpressionToken(null, null, null, "true");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+                var expressionState = new List<KeyValuePair<string, object>>();
+
+                var result = wrapper.EvaluateStepIf(token, contextData, functions, expressionState);
+
+                Assert.True(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepInputs_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "input1"), new StringToken(null, null, null, "val1"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepInputs(token, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Equal("val1", result["input1"]);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepTimeout_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new NumberToken(null, null, null, 10);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepTimeout(token, contextData, functions);
+
+                Assert.Equal(10, result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobContainer_EmptyImage_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new StringToken(null, null, null, "");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobContainer(token, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobOutput_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "out1"), new StringToken(null, null, null, "val1"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobOutput(token, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Equal("val1", result["out1"]);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateEnvironmentUrl_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new StringToken(null, null, null, "https://example.com");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateEnvironmentUrl(token, contextData, functions);
+
+                Assert.NotNull(result);
+                var stringResult = result as StringToken;
+                Assert.NotNull(stringResult);
+                Assert.Equal("https://example.com", stringResult.Value);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobDefaultsRun_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "shell"), new StringToken(null, null, null, "bash"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobDefaultsRun(token, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Equal("bash", result["shell"]);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobServiceContainers_Null_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobServiceContainers(null, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobSnapshotRequest_Null_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobSnapshotRequest(null, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        // -------------------------------------------------------------------
+        // JSON parse error equivalence via EvaluateAndCompare
+        // -------------------------------------------------------------------
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_JsonReaderExceptions_TreatedAsEquivalent()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+
+                // Both throw JsonReaderException with different messages — should be treated as equivalent
+                var legacyEx = new Newtonsoft.Json.JsonReaderException("Error reading JToken from JsonReader. Path '', line 0, position 0.");
+                var newEx = new Newtonsoft.Json.JsonReaderException("Error parsing fromJson", new Newtonsoft.Json.JsonReaderException("Unexpected end"));
+
+                Assert.Throws<Newtonsoft.Json.JsonReaderException>(() =>
+                    wrapper.EvaluateAndCompare<string, string>(
+                        "TestJsonEquivalence",
+                        () => throw legacyEx,
+                        () => throw newEx,
+                        (a, b) => string.Equals(a, b, StringComparison.Ordinal)));
+
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_MixedJsonExceptionTypes_TreatedAsEquivalent()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+
+                // Legacy throws Newtonsoft JsonReaderException, new throws System.Text.Json.JsonException
+                var legacyEx = new Newtonsoft.Json.JsonReaderException("Error reading JToken");
+                var newEx = new System.Text.Json.JsonException("Error parsing fromJson");
+
+                Assert.Throws<Newtonsoft.Json.JsonReaderException>(() =>
+                    wrapper.EvaluateAndCompare<string, string>(
+                        "TestMixedJsonTypes",
+                        () => throw legacyEx,
+                        () => throw newEx,
+                        (a, b) => string.Equals(a, b, StringComparison.Ordinal)));
+
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_NonJsonExceptions_RecordsMismatch()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object);
+
+                // Both throw non-JSON exceptions with different messages — should record mismatch
+                var legacyEx = new InvalidOperationException("some error");
+                var newEx = new InvalidOperationException("different error");
+
+                Assert.Throws<InvalidOperationException>(() =>
+                    wrapper.EvaluateAndCompare<string, string>(
+                        "TestNonJsonMismatch",
+                        () => throw legacyEx,
+                        () => throw newEx,
+                        (a, b) => string.Equals(a, b, StringComparison.Ordinal)));
+
+                Assert.True(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        // -------------------------------------------------------------------
+        // Helpers
+        // -------------------------------------------------------------------
+
+        private void Setup([CallerMemberName] string name = "")
+        {
+            _ecTokenSource?.Dispose();
+            _ecTokenSource = new CancellationTokenSource();
+
+            _hc = new TestHostContext(this, name);
+
+            var expressionValues = new LegacyContextData.DictionaryContextData();
+            var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+
+            _ec = new Mock<IExecutionContext>();
+            _ec.Setup(x => x.Global)
+                .Returns(new GlobalContext
+                {
+                    FileTable = new List<String>(),
+                    Variables = new Variables(_hc, new Dictionary<string, VariableValue>()),
+                    WriteDebug = true,
+                });
+            _ec.Setup(x => x.CancellationToken).Returns(_ecTokenSource.Token);
+            _ec.Setup(x => x.ExpressionValues).Returns(expressionValues);
+            _ec.Setup(x => x.ExpressionFunctions).Returns(expressionFunctions);
+            _ec.Setup(x => x.Write(It.IsAny<string>(), It.IsAny<string>())).Callback((string tag, string message) => { _hc.GetTrace().Info($"{tag}{message}"); });
+            _ec.Setup(x => x.AddIssue(It.IsAny<Issue>(), It.IsAny<ExecutionContextLogOptions>())).Callback((Issue issue, ExecutionContextLogOptions logOptions) => { _hc.GetTrace().Info($"[{issue.Type}]{logOptions.LogMessageOverride ?? issue.Message}"); });
+        }
+
+        private void Teardown()
+        {
+            _hc?.Dispose();
+        }
+    }
+}