[aw-failures] Design Decision Gate exhausts LLM invocation cap after permission-denied retries on shell-expanded file paths

[github-actions]

Problem

Stop the harness from denying its own documented jq -Rs "$FILE" safe-outputs pattern — it turns one blocked comment into a full invocation-cap failure. Design Decision Gate ran PR #49066's ADR gate, tried to post the required comment, and got denied 5 different ways before burning out.

Affected Workflows and Run IDs

• Design Decision Gate 🏗️ — §30520617010 (2026-07-30 06:45 UTC, PR stringsconcatloop: detect x = x + y accumulator pattern alongside += #49066)
• Comparator (same workflow, succeeded): §30520438606

Probable Root Cause

Fix the sandbox's path-expansion check — it blocks the exact pattern the system prompt tells agents to use. The agent tried, in order:

1. printf '%s' '...' | safeoutputs add_comment --pull_request_number 49066 --body -
2. cat > /tmp/gh-aw/agent/comment.json << 'ENDJSON' ... | safeoutputs add_comment .
3. jq -Rs --argjson pr 49066 '{...}' /tmp/gh-aw/agent/comment-body.md | safeoutputs add_comment .
4. jq -Rs --argjson pr 49066 '{...}' /tmp/gh-aw/agent/comment-body.md > .../comment-payload.json
5. FILE=/tmp/gh-aw/agent/comment-body.md && jq -Rs --argjson pr 49066 '{...}' "$FILE"

Every variant that referenced the file via a shell variable or heredoc path was rejected with Shell expansion syntax in paths requires manual approval. This is the same jq -Rs idiom the harness's own reporting instructions recommend for injecting file content into safe-output fields — the permission policy and the documented workflow contradict each other.

Each denied attempt still consumed one of the harness's 20 LLM invocations per run. After the 5th denial the agent had also begun hitting Anthropic API 429s; it stacked 10 consecutive rate-limit backoffs (582ms → 39880ms, ~2 min total) before the harness gave up with Maximum LLM invocations exceeded (20 / 20). audit-diff against the nearest successful run of the same workflow shows zero firewall/MCP/domain drift, ruling out a sandbox network regression — this is a harness-side permission-policy/invocation-budget interaction, not a tooling or network issue.

Specific Proposed Remediation

1. Allow the $VAR/heredoc-to-file jq -Rs pattern when the variable is locally assigned in the same command (not sourced from untrusted external content) — this is the exact pattern the harness tells agents to use for safe-outputs body injection.
2. Detect repeated identical-intent denials (same target file/tool, different shell syntax) and short-circuit after 2 attempts with a clearer error, instead of letting the agent burn its full invocation budget rediscovering the same block 5 times.
3. Separately: investigate why this run's API calls stacked 10 consecutive 429s — check whether concurrent workflow runs in this window were saturating a shared rate-limit pool.

Success Criteria / Verification

• Re-run Design Decision Gate (or a synthetic repro) using the documented jq -Rs --arg ... "$FILE" pattern and confirm it is not denied.
• Confirm a denied safe-outputs write attempt no longer costs more than 1–2 invocations before the agent either succeeds via an approved path or reports missing_tool/missing_data cleanly.
• No recurrence of Maximum LLM invocations exceeded tied to this pattern across the next 6h investigation window.
  Related to [aw-failures] [aw] Failure Investigator Report — 2026-07-30 (6h) #49095

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 91.7 AIC · ⌖ 22.4 AIC · ⊞ 6.8K · ◷

• expires on Aug 5, 2026, 11:49 PM UTC-08:00

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 4.89 AIC · ⊞ 9.9K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 5.52 AIC · ⊞ 9.9K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 5.15 AIC · ⊞ 9.9K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 4.57 AIC · ⊞ 9.9K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 6.02 AIC · ⊞ 9.9K · ◷