[q] Enforce safe-output fallback for Q when tool permissions are blocked

[Copilot]

The Q workflow was succeeding at the job level but producing no safe outputs, which triggered [aw] Q failed incidents. In the failing run, the agent encountered repeated non-interactive permission denials and exited with plain text instead of a safe-output action.

• Prompt contract hardening (.github/workflows/q.md)

  • Added a Safe Output Reliability section that explicitly requires:
    • stop retrying when repeated Permission denied and could not request permission from user errors occur
    • emit report_incomplete with blocked tool/command + exact error
    • always finish with a safe-output tool call (create-pull-request, add-comment, add-labels, noop, or report_incomplete)

• Compiled workflow update (.github/workflows/q.lock.yml)

  • Regenerated lockfile to carry the source prompt contract changes into runtime behavior.

### Safe Output Reliability
- If repeated tool calls fail with `Permission denied and could not request permission from user`, stop retrying blocked tools and call `report_incomplete` with the blocked tool/command and exact error text.
- Never finish with plain text only. Every run must end with at least one safe-output call (`create-pull-request`, `add-comment`, `add-labels`, `noop`, or `report_incomplete`).

[pelikhan]

@copilot delete test

[Copilot]

Done in dfbaf1f: I removed pkg/cli/q_workflow_contract_test.go from the PR.

[Copilot]

Pull request overview

Hardens the Q workflow’s prompt contract to ensure it always emits a safe-output action, even when tool permissions are repeatedly denied, and adds a regression test to prevent the contract from drifting.

Changes:

• Added “Safe Output Reliability” rules to .github/workflows/q.md, including a report_incomplete fallback on repeated permission denials and a “must end with safe output” requirement.
• Added a workflow contract test (pkg/cli/q_workflow_contract_test.go) asserting the presence of the new reliability language and safe-output expectations.
• Regenerated .github/workflows/q.lock.yml to propagate the updated prompt contract into the compiled workflow.

Show a summary per file

File	Description
pkg/cli/q_workflow_contract_test.go	Adds a contract test to guard Q’s prompt against missing safe-output fallback requirements.
.github/workflows/q.md	Documents explicit handling for repeated permission denials and mandates ending with a safe-output call.
.github/workflows/q.lock.yml	Updates compiled metadata/hash to reflect the prompt contract change at runtime.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0