diff --git a/AGENTS.md b/AGENTS.md
index d4fee67a..1364845a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -95,6 +95,7 @@ fail-closed and only pauses when the agent actually proposed a reviewed output.
 │   │   │   └── integration_tests.rs # Import resolution + merge integration tests
 │   │   ├── extensions/   # CompilerExtension trait and infrastructure extensions
 │   │   │   ├── mod.rs    # Trait, Extension enum, collect_extensions(), re-exports
+│   │   │   ├── container_runtime.rs # Typed Docker runtime config helpers (Mount/Network/Tmpfs/AddHost/ContainerUser) shared by MCPG stdio server compilation, not a CompilerExtension impl itself
 │   │   │   ├── ado_aw_marker.rs # Always-on metadata marker extension (emits # ado-aw-metadata JSON)
 │   │   │   ├── github.rs # Always-on GitHub MCP extension
 │   │   │   ├── safe_outputs.rs # Always-on SafeOutputs MCP extension
diff --git a/docs/tools.md b/docs/tools.md
index cc3b607d..1355e829 100644
--- a/docs/tools.md
+++ b/docs/tools.md
@@ -161,10 +161,10 @@ subcommands. When configured, use `tools.azure-devops` for authenticated ADO
 reads. Do not run `az login` or inject Azure credentials into the Agent
 sandbox; use SafeOutputs or request a supported tool instead.
 
-A daily smoke pipeline at
-[`tests/safe-outputs/azure-cli.md`](../tests/safe-outputs/azure-cli.md)
-exercises binary/subcommand availability without claiming authenticated direct
-ADO access.
+Binary/subcommand availability is exercised without claiming authenticated
+direct ADO access; see [`tests/safe-outputs/`](../tests/safe-outputs/) and
+[`tests/smoke/`](../tests/smoke/) for the current smoke fixtures and lane
+model.
 
 ### GitHub CLI (`gh`)