[aw] Prevent Layout Specification Maintainer early termination from tool-denial guardrail

[Copilot]

The Layout Specification Maintainer workflow was repeatedly failing after hitting guard.tool_denials_exceeded (3/3), ending the agent session before it could emit results. The failures were caused by denied shell command patterns used by the workflow prompt path.

• Root cause addressed

  • Expanded the workflow bash allowlist to cover command forms observed in failing runs but not previously permitted.

• Workflow source update (.github/workflows/layout-spec-maintainer.md)

  • Added explicit allowlist entries for:
    • sed -n
    • git status --short
    • git checkout -b * && git add scratchpad/layout.md && git status --short

• Compiled output sync (.github/workflows/layout-spec-maintainer.lock.yml)

  • Recompiled lockfile so Copilot SDK tool permissions reflect the updated allowlist in runtime args.

tools:
  bash:
    - sed -n
    - git status --short
    - git checkout -b * && git add scratchpad/layout.md && git status --short

• Fixes [aw] Layout Specification Maintainer exceeded tool denial limit #49936

[Copilot]

Pull request overview

Updates the Layout Specification Maintainer’s shell permissions to reduce tool-denial terminations.

Changes:

• Adds allowlist entries for sed and Git status/checkout commands.
• Recompiles the generated workflow.

Show a summary per file

File	Description
.github/workflows/layout-spec-maintainer.md	Expands bash permissions.
.github/workflows/layout-spec-maintainer.lock.yml	Synchronizes compiled permissions.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Suppressed comments (1)

.github/workflows/layout-spec-maintainer.md:61

• This embedded * is preserved in the compiled shell(...) rule, while Copilot SDK rules containing spaces are exact full-command matches. A generated branch such as layout-spec-update-20260803 therefore cannot match this literal rule, so the observed checkout/add/status sequence can still be denied and contribute to the 3/3 termination. Split the sequence into separately permitted commands, or use another SDK-matchable scoped rule rather than an embedded glob.

  - git checkout -b * && git add scratchpad/layout.md && git status --short

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.84.4