Add git log to the Breaking Change Checker tool allowlist — its absence denies the one command the agent needs and aborts every run at the 5-denial guard.
The agent (and its explore subagent) can only detect breaking changes by reading recent history, but git log is not in the workflow's 23-entry allow-tool set. Five consecutive git log calls are denied, guard.tool_denials_exceeded fires at threshold 5, the SDK session stops early, and Execute GitHub Copilot CLI exits 1 (failureClass=permission_denied, not retried). This is deterministic and will recur on every scheduled run until the allowlist is fixed.
Affected workflow & run IDs
- Breaking Change Checker (
.github/workflows/breaking-change-checker.lock.yml), engine copilot, model copilot/claude-sonnet-4.6
Probable root cause
Every one of the 5 denials is a read-only git log variant issued through shell(git log ...). The compiled allowlist grants 23 tools but none match git log (nor the cd ... && git log compound form), so the permission layer rejects each call.
Evidence — tool-denial sequence (run 29843908934)
[copilot-sdk-driver] permission config: 23 allow-tool entries from GH_AW_COPILOT_SDK_SERVER_ARGS
[sdk-driver] tool denial 1/5: permission denied: shell(cd .../gh-aw && git log --since="24 hours ago" --oneline --name-only 2>/dev/null)
[sdk-driver] tool denial 2/5: permission denied: shell(cd .../gh-aw && git log --since="24 hours ago" --oneline --name-only)
{"type":"subagent.started","data":{"agentName":"explore"}}
[sdk-driver] tool denial 3/5: permission denied: shell(cd .../gh-aw && git log --since="24 hours ago" --oneline --name-only)
[sdk-driver] tool denial 4/5: permission denied: shell(cd .../gh-aw && git log --oneline -5 2>&1)
[sdk-driver] tool denial 5/5: permission denied: shell(cd .../gh-aw && git log --since="24 hours ago" --format="%H %s" 2>&1)
{"type":"guard.tool_denials_exceeded","data":{"denialCount":5,"threshold":5}}
[sdk-driver] error: max tool denials threshold reached (5/5); stopping SDK session early
[copilot-harness] attempt 1 failed: exitCode=1 failureClass=permission_denied
[copilot-harness] attempt 1: detected numerous permission-denied issues — not retrying
Proposed remediation
- Grant the read-only history command in the workflow's
tools: block, e.g. bash: ["git log:*"] (and/or add git log to the shell allowlist so the cd ... && git log compound form matches). This is read-only and low-risk.
- Alternatively/additionally, tune the agent prompt to call
git log from the repo root without the cd ... && wrapper so it matches a simpler allow pattern.
- Consider whether a 5-denial hard guard should abort a run when all denials are the same benign read-only command — a per-command dedup or a clearer "missing tool" surface would prevent silent hard-fails.
Success criteria / verification
- Re-run Breaking Change Checker: the agent's
git log calls succeed, guard.tool_denials_exceeded does not fire, and the agent job reaches completion with a real breaking-change report (non-zero turns, exit 0).
- No
failureClass=permission_denied on git log in the next scheduled run's logs.
Related
Subagent-spawn fragility appeared in a second run today — Daily Formal Spec Verifier §29846225728 died when its general-purpose subagent hit Error: No model available. Check policy enablement under GitHub Settings > Copilot (failureClass=partial_execution). That model/policy signature is already tracked by #46326 (subagent model failures) — no separate issue needed here. Tidy §29837885800 hit an HTTP 400 response error, already covered by the CAPI-400 family in #46846 / #46326.
Related to #46171
Generated by 🔍 [aw] Failure Investigator (6h) · age00 244.9 AIC · ⌖ 38.2 AIC · ⊞ 5.1K · ◷
Add
git logto the Breaking Change Checker tool allowlist — its absence denies the one command the agent needs and aborts every run at the 5-denial guard.The agent (and its
exploresubagent) can only detect breaking changes by reading recent history, butgit logis not in the workflow's 23-entry allow-tool set. Five consecutivegit logcalls are denied,guard.tool_denials_exceededfires at threshold 5, the SDK session stops early, andExecute GitHub Copilot CLIexits 1 (failureClass=permission_denied, not retried). This is deterministic and will recur on every scheduled run until the allowlist is fixed.Affected workflow & run IDs
.github/workflows/breaking-change-checker.lock.yml), enginecopilot, modelcopilot/claude-sonnet-4.6agentProbable root cause
Every one of the 5 denials is a read-only
git logvariant issued throughshell(git log ...). The compiled allowlist grants 23 tools but none matchgit log(nor thecd ... && git logcompound form), so the permission layer rejects each call.Evidence — tool-denial sequence (run 29843908934)
Proposed remediation
tools:block, e.g.bash: ["git log:*"](and/or addgit logto the shell allowlist so thecd ... && git logcompound form matches). This is read-only and low-risk.git logfrom the repo root without thecd ... &&wrapper so it matches a simpler allow pattern.Success criteria / verification
git logcalls succeed,guard.tool_denials_exceededdoes not fire, and theagentjob reaches completion with a real breaking-change report (non-zero turns, exit 0).failureClass=permission_deniedongit login the next scheduled run's logs.Related
Subagent-spawn fragility appeared in a second run today — Daily Formal Spec Verifier §29846225728 died when its
general-purposesubagent hitError: No model available. Check policy enablement under GitHub Settings > Copilot(failureClass=partial_execution). That model/policy signature is already tracked by #46326 (subagent model failures) — no separate issue needed here. Tidy §29837885800 hit an HTTP 400 response error, already covered by the CAPI-400 family in #46846 / #46326.Related to #46171