[aw-failures] Read-tool permission scoping regression crashes read-only workflows on their own checkout root

[github-actions]

Problem statement

Fix the read-tool permission scoping bug — it silently denies a workflow's agent read access to its own checked-out working directory, trips the tool-denial threshold, and kills the run.

Two independently-scheduled workflows failed today with the identical signature: the agent tried to read/grep inside /home/runner/work/gh-aw/gh-aw (its own checkout) and was denied by workflow tool permissions, hit the denial cap, and aborted.

Affected workflows and run IDs

• Daily Testify Uber Super Expert — §30760639664 (2026-08-02T18:13:39Z, Copilot CLI engine)
• Linter Miner — §30759473080 (2026-08-02T17:42:26Z, same posture-degradation signature)
• Baseline comparator (success): §30570103985 (Daily Testify, 2026-07-30)

Evidence

Raw log + audit-diff evidence

Daily Testify Uber Super Expert (§30760639664) log tail:

[copilot-sdk-driver] permission denied by workflow tool permissions: read(/home/runner/work/gh-aw/gh-aw)
[copilot-sdk-driver] tool denial 3/3: permission denied: read(/home/runner/work/gh-aw/gh-aw)
{"type":"guard.tool_denials_exceeded","data":{"denialCount":3,"threshold":3,"reason":"permission denied: read(/home/runner/work/gh-aw/gh-aw)"}}
[copilot-sdk-driver] max tool denials threshold reached (3/3); stopping SDK session early
[copilot-harness] attempt 1 failed: exitCode=1 failureClass=permission_denied ... permissionDeniedCount=7 hasNumerousPermissionDenied=true

audit-diff (baseline §30570103985 vs failed §30760639664): posture flipped write_capable → read_only, turns dropped 1 → 0, GitHub Core API consumption dropped 77% (252 → 59 points) — consistent with the agent barely starting before being denied. No firewall/domain anomalies were found, ruling out a network/egress cause.

audit on Linter Miner (§30759473080) shows the same class of degradation vs its own baseline: posture write_capable → read_only, turns 3 → 0, 1 critical error, run failed with exit code 1 — same signature, different workflow, same time window.

Probable root cause

A regression in the tool-permission compiler/scoping layer (Copilot CLI driver / sdk-driver) is scoping the read permission too narrowly, excluding the workflow's own checkout directory (/home/runner/work/gh-aw/gh-aw) — the one path every workflow must be able to read. This is not workflow-specific: it hit two unrelated scheduled workflows within a ~30-minute window, and the same fallback ("stop after 3 denials") is what kills the session. This tracks the drop from write_capable to read_only posture seen in the audit-diff, and looks distinct from the existing Design Decision Gate permission issue in #49096 (that one is about shell-expanded file paths, not the base checkout root).

Proposed remediation

1. Always allowlist the workflow's own checkout root (GITHUB_WORKSPACE) for read in the tool-permission compiler, regardless of any narrower read() scoping computed elsewhere.
2. Add a regression test that spins up a read-only workflow and asserts a read($GITHUB_WORKSPACE) call is never denied.
3. Until fixed, treat denialCount>=3 with reason matching read($GITHUB_WORKSPACE) as a missing_tool/config bug class (not a retryable permission issue) so the harness surfaces it immediately instead of burning the full attempt duration (this run spent 19m30s before giving up).

Success criteria / verification

• Re-running Daily Testify Uber Super Expert and Linter Miner completes without a permission denied by workflow tool permissions: read($GITHUB_WORKSPACE) denial.
• New regression test passes in CI.
• No new occurrences of guard.tool_denials_exceeded referencing the workspace root across scheduled workflow runs for 7 days post-fix.
  Related to [aw-failures] [aw] Failure Investigator Report — 2026-08-02 (6h) #49835

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 129.2 AIC · ⌖ 36.9 AIC · ⊞ 5.3K · ◷

• expires on Aug 9, 2026, 11:22 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 1.37 AIC · ⌖ 5.81 AIC · ⊞ 9.7K · ◷