@@ -0,0 +1,62 @@
+# Profile: Kong Event Gateway (`event-gateway`)
+
+- Product name in headings: `Kong Event Gateway`
+- Output file: `docs/release-changelog/event-gateway/{VERSION}.md` (e.g. `event-gateway/1.3.md`)
+- Typical release branch: `release/event-gateway-{VERSION}`, diffed against `origin/main`.
+
+## Path filters
+
+Keep only these paths (after the baseline exclusions):
+
+```
+app/event-gateway/
+app/_event_gateway_policies/
+app/_how-tos/event-gateway/
+app/_references/event-gateway/
+app/_landing_pages/event-gateway.yaml
+```
+
+Also keep other pages that changed only if their frontmatter has `event-gateway` under `products` or `tags`, or the diff clearly adds Event Gateway content (e.g. `app/kongctl/supported-resources.md`, `app/gateway/plugins/expressions.md`). Files that only changed incidentally (shared how-to test tooling, other products' pages) are left out. Skip `app/_data/`, except the bootstrap schema (see Special pages).
+
+## URL derivation (when `permalink` is missing)
+
+- `app/_how-tos/event-gateway/foo.md` -> has an explicit `permalink` of the form `/event-gateway/foo/`. Event Gateway how-tos are NOT under `/how-to/`. Always read the `permalink`.
+- `app/_event_gateway_policies/foo/index.md` -> `/event-gateway/policies/foo/`
+- `app/_event_gateway_policies/foo/index.md` reference tab -> `/event-gateway/policies/foo/reference/` (do not list separately, it is the same page)
+- `app/_event_gateway_policies/foo/examples/bar.yml` -> `/event-gateway/policies/foo/examples/bar/`
+- `app/event-gateway/foo.md` -> `/event-gateway/foo/`
+- `app/event-gateway/entities/foo.md` -> `/event-gateway/entities/foo/`
+- `app/_references/event-gateway/{VERSION}/headers.md` -> `/event-gateway/headers/`
+- `app/_references/event-gateway/{VERSION}/metrics.md` -> `/event-gateway/metrics/` (older versions: `/event-gateway/metrics/{VERSION}/`)
+- `app/_landing_pages/event-gateway.yaml` -> `/event-gateway/`
+
+Policy example `.yml` files have no frontmatter. Read `title` and `description` from the top-level YAML. Policy `index.md` files use `name` as the display name.
+
+## Special pages
+
+Handle these before grouping. They are not placed by the grouping rules.
+
+- **Breaking changes**: `app/event-gateway/breaking-changes.md` goes under `## Changes`, only if it changed.
+- **Auto-generated references**: `app/_references/event-gateway/{VERSION}/headers.md` and `metrics.md` are auto-generated. On a new release they appear as new files. Do not list them individually.
+- **Configuration reference**: `app/_data/event-gateway-bootstrap-schema/{VERSION}.json` renders into `/event-gateway/configuration/`. Check for this file in the diff even though the baseline filter drops `.json`. Do not list the file itself. If `app/event-gateway/configuration.md` was also edited, list it under References with an annotation. Otherwise it appears only on the collapsed line.
+
+Collapse the auto-generated pages into one line at the bottom of the output:
+
+```
+_Auto-generated references updated: [Event Gateway configuration reference](URL), [Event Gateway headers](URL), [Event Gateway metrics](URL)_
+```
+
+Include only the pages that actually changed.
+
+## Grouping rules
+
+Group by capability, not by file type. Group policies with their related how-tos and examples. Use only groups that have content:
+
+- **Policies, one group per category**: use the policy `categories` frontmatter value as the group heading, with the display name from `app/_data/event_gateway_policy_categories.yml` (Security, Traffic Control, Transformations, Data Quality). Each policy goes under its category. Examples go under their policy. Guides that centre on a policy go under that policy's category. Within a category, use a bold sub-heading per policy or policy family (e.g. **Mask Fields policies:**). Categories with no changes are omitted. Read `categories` from each policy `index.md`, do not guess.
+- **Authentication and authorization**: mTLS, SASL, Kong Identity, SNI routing how-tos (ACLs and `tls-server` are policies, so they go under their policy category)
+- **Entities**: `app/event-gateway/entities/`
+- **Observability**: OpenTelemetry how-tos
+- **Getting started and deployment**: get started, image signature verification, quickstart-style how-tos
+- **References**: every remaining page under `app/event-gateway/*.md` (for example expressions, architecture, upgrade, known limitations, version support policy, changelog)
+
+If a policy has both new `index.md` and new examples, list the policy page first, then its examples as sub-bullets.
@@ -0,0 +1,43 @@
+# Profile: Kong Gateway (`gateway`)
+
+- Product name in headings: `Kong Gateway`
+- Output file: `docs/release-changelog/gateway/{VERSION}.md` (e.g. `gateway/3.16.md`)
+
+## Path filters
+
+Include everything under `app/` that passes the baseline exclusions, except any path matched by the **Path filters** of another profile in `products/`.
+
+## URL derivation (when `permalink` is missing)
+
+- `app/_how-tos/*/foo.md` -> `/how-to/foo/` (the product subdir is NOT in the URL)
+- `app/_kong_plugins/foo/index.md` -> `/plugins/foo/`
+- `app/_kong_plugins/foo/examples/bar.md` or `.yaml` -> `/plugins/foo/examples/bar/`
+- `app/_gateway_entities/foo.md` -> `/gateway/entities/foo/`
+- `app/gateway/foo.md` -> `/gateway/foo/`
+- `app/ai-gateway/foo.md` -> `/ai-gateway/foo/`
+- `app/mesh/foo.md` -> `/mesh/foo/`
+- `app/kic/foo.md` -> `/kic/foo/`
+- `app/_landing_pages/foo.yaml` -> `/foo/` (derived from the file path; the page declares no `permalink`)
+- `app/_references/foo.md` -> read the `permalink` field
+
+## Special pages
+
+Handle these before grouping. They are not placed by the grouping rules.
+
+- **Breaking changes**: `gateway/breaking-changes*` goes under `## Changes`, always last.
+- **Auto-generated references**: files under `app/_references/gateway/pdk/` or `app/_references/gateway/cli/` are auto-generated version bumps. Do not list them individually. Collapse to:
+
+```
+_Auto-generated references updated: [Gateway CLI Reference](URL), [PDK Reference](URL)_
+```
+
+- **Bulk include changes**: when one `_includes` partial touches 5+ plugin pages (for example all logging plugins after a change to `log-custom-fields-by-lua.md`), collapse them into one line such as `**Logging plugins** (updated for custom log fields): [File Log](URL), [HTTP Log](URL), ...`.
+
+## Grouping rules
+
+- **AI Gateway**: `ai-gateway/` files, `_kong_plugins/ai-*/`, AI how-tos. Sub-group by feature (A2A, providers, guardrails, semantic, MCP, partials).
+- **Kong Gateway**: `gateway/` pages, entities, non-AI plugins, gateway how-tos.
+- **OIDC plugin**: always under Kong Gateway, not AI Gateway. Files: `_kong_plugins/openid-connect/`, OIDC how-tos.
+- **MCP**: MCP plugin docs and how-tos.
+- **Observability**: `observability/` pages.
+- **Konnect**: `catalog/`, Dev Portal, and Konnect-specific content.
@@ -112,6 +112,7 @@ camelCase
 CDNs
 ce
 cef
+cel
 cerebras
 certificate_admin
 charset
@@ -212,6 +213,9 @@ dereferenced
 dereferencing
 deserialization
 deserialize
+deserializer
+deserializing
+deserializes
 deserialized
 destructuring
 dev
@@ -412,6 +416,7 @@ JMeter
 journald
 jq
 jQuery
+js
 json
 JSONObject
 JSONObjects
@@ -582,6 +587,8 @@ Nullsoft
 nunjucks
 noname
 nonamesecurity
+nonce
+nonces
 nopp
 nopped
 nopping
@@ -825,6 +832,7 @@ svg
 svgs
 swaggerhub
 switchyard
+syntaxes
 syscall
 syslog
 systemd
@@ -868,8 +876,11 @@ tooltip
 tproxy
 traceable
 Traefik
+transcode
+transcodes
 transcoded
 transcoder
+transcoding
 transpile
 transpiled
 trendai
 
@@ -9,8 +9,8 @@ on:
       konnect_domain:
         description: "Set to konghq.tech to run against .tech"
         required: false
-      konnect_event_gateway_min_version:
-        description: 'Minimum Konnect Event Gateway version for the get.konghq.com/ai quickstart (e.g. 2.2)'
+      konnect_ai_gateway_min_version:
+        description: 'Minimum AI Gateway version for the get.konghq.com/ai quickstart (e.g. 2.2)'
         required: false
   schedule:
     - cron: '0 0 * * MON'
@@ -71,11 +71,11 @@ jobs:
       - name: Pre-pull AI Gateway quickstart dependencies
         run: docker pull ghcr.io/jqlang/jq:latest
 
-      - name: Set Event Gateway min version
-        if: ${{ inputs.konnect_event_gateway_min_version != '' }}
+      - name: Set AI Gateway min version
+        if: ${{ inputs.konnect_ai_gateway_min_version != '' }}
         env:
-          MIN_VERSION: ${{ inputs.konnect_event_gateway_min_version }}
-        run: echo "KONNECT_EVENT_GATEWAY_MIN_VERSION=$MIN_VERSION" >> $GITHUB_ENV
+          MIN_VERSION: ${{ inputs.konnect_ai_gateway_min_version }}
+        run: echo "KONNECT_AI_GATEWAY_MIN_VERSION=$MIN_VERSION" >> $GITHUB_ENV
 
       - name: Run tests
         working-directory: tools/automated-tests
 
@@ -2,11 +2,18 @@ name: Event Gateway Automated Tests
 on:
   workflow_dispatch:
     inputs:
+      event_gateway_image:
+        description: 'Docker Image for Tests'
+        required: true
+        default: 'kong-event-gateway:latest'
       konnect_domain:
         description: "Set to konghq.tech to run against .tech"
         required: false
+      konnect_event_gateway_min_version:
+        description: 'Minimum Konnect Event Gateway version for the get.konghq.com/event-gateway quickstart (e.g. 1.3)'
+        required: false
   schedule:
-  - cron: '0 0 1 * *'
+  - cron: '0 0 * * WED'
 
 concurrency:
   cancel-in-progress: true
@@ -55,13 +62,27 @@ jobs:
         with:
           op-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
+      - name: Set Event Gateway Image and Tag
+        run: |
+          INPUT_IMAGE="${{ inputs.event_gateway_image }}"
+          echo "KONG_IMAGE_NAME=${INPUT_IMAGE%:*}" >> $GITHUB_ENV
+          echo "KONG_IMAGE_TAG=${INPUT_IMAGE##*:}" >> $GITHUB_ENV
+
+      - name: Set Event Gateway min version
+        if: ${{ inputs.konnect_event_gateway_min_version != '' }}
+        env:
+          MIN_VERSION: ${{ inputs.konnect_event_gateway_min_version }}
+        run: echo "KONNECT_EVENT_GATEWAY_MIN_VERSION=$MIN_VERSION" >> $GITHUB_ENV
+
       - name: Run tests
         working-directory: tools/automated-tests
         shell: bash
         env:
           KONG_LICENSE_DATA: ${{ steps.getLicense.outputs.license }}
           DEPLOYMENT_MODEL: konnect
           PRODUCTS: event-gateway
+          KONG_IMAGE_TAG: ${{ env.KONG_IMAGE_TAG }}
+          KONG_IMAGE_NAME: ${{ env.KONG_IMAGE_NAME }}
           KONNECT_DOMAIN: ${{ env.KONNECT_DOMAIN }}
           TESTS_KONNECT_TOKEN: ${{ inputs.konnect_domain != '' && secrets.KONNECT_TOKEN_TECH || secrets.KONNECT_TOKEN }}
         run: |
@@ -76,4 +97,4 @@ jobs:
         uses: './.github/reusable-steps/notify-slack'
         with:
           webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
-          status: ${{ job.status }}
+          status: ${{ job.status }}
@@ -0,0 +1,68 @@
+name: Validate Event Gateway Policy Examples
+on:
+  pull_request:
+    types: [synchronize, ready_for_review, opened, labeled]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+
+jobs:
+  check:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+      - name: Check if manual review has been performed
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        id: labels
+        with:
+          result-encoding: string
+          script: |
+            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
+              ...context.repo,
+              issue_number: context.issue.number
+            });
+            return labels.map(l => l.name).includes('ci:manual-approve:egw-policies')
+    outputs:
+      result: ${{ steps.labels.outputs.result }}
+  validate:
+    needs: check
+    if: always() && needs.check.outputs.result != 'true'
+    name: Validate Event Gateway policy examples against schemas
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 2
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@2bb135777322059ee3a3c9239999b159ff49febc
+        with:
+          files: |
+            app/_event_gateway_policies/*/examples/**
+            app/_event_gateway_policies/*/index.md
+            api-specs/konnect/event-gateway/**
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        if: steps.changed-files.outputs.any_changed == 'true' || github.event_name == 'workflow_dispatch'
+        with:
+          node-version: "24"
+      - name: Install dependencies
+        if: steps.changed-files.outputs.any_changed == 'true' || github.event_name == 'workflow_dispatch'
+        working-directory: tools/event-gateway-policy-examples-validator
+        run: npm ci
+      - name: Run validation
+        if: steps.changed-files.outputs.any_changed == 'true' || github.event_name == 'workflow_dispatch'
+        working-directory: tools/event-gateway-policy-examples-validator
+        run: npm run validate