Document SDK heredoc permission blocker and stop on denial

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 2 people

.github/workflows/rig-skill-integration.lock.yml

@@ -80,6 +80,8 @@ typechecking, directory creation, or other bootstrap commands for this fixture.
 Inherit `COPILOT_SDK_URI` and `COPILOT_CONNECTION_TOKEN`; do not inspect or print
 them, start a second server, or use `--server`. If the Node launch fails, report
 its exact command and error and stop without retrying model calls.
+If that launch is denied, do not repeat or reformulate the Bash command:
+call `report_incomplete` immediately. The one-invocation limit includes denials.
 
 The scenario makes exactly three Rig model calls: clarity, safety, and feasibility
 judgments of the same harmless dummy request. TypeScript owns orchestration and
@@ -124,6 +126,8 @@ After the Node launch succeeds, read the result JSON using a file-reading tool
 and call `noop` with a brief summary of the three judgments and majority verdict.
 Do not invoke Bash again to read or validate the result: the post-step owns
 validation. Success requires no repository write. If the launcher,
-SDK, schema validation, or expected verdict fails, report the exact error and
-stop. Do not fabricate results, modify the fixture, or retry model calls. The
+SDK, schema validation, or expected verdict fails, report the exact error with
+`report_incomplete` and stop. Never call `noop` on failure. A rejected standalone Node heredoc
+is a permission-parser failure, not evidence that Node or the SDK is missing.
+Do not fabricate results, modify the fixture, or retry model calls. The
 post-step fails the workflow when the result file is missing or invalid.

.github/workflows/rig-skill-integration.md

@@ -72,6 +72,15 @@ disallowed preparation command. Inherit SDK environment variables without
 runs, remove that command and use the permitted standalone Node launch; do not
 claim that Bash is unavailable. If the launcher itself fails, report its exact
 error and respect the workflow's retry policy.
+
+GitHub Agentic Workflows v0.91.1's Copilot SDK permission parser treats heredoc
+body lines as shell commands. It can therefore reject a valid standalone
+`node` launch despite `bash: ["node"]`. If this happens, report the exact denial
+as a workflow permission-parser limitation, not a missing Node runtime or SDK.
+Do not broaden the shell allowlist or encode the program to evade enforcement.
+The workflow host needs a heredoc-aware permission parser before this inline
+launch pattern can run in that SDK driver.
+
 This reduces tool configuration, not sandbox permissions: allowing arbitrary
 Node code still permits filesystem and subprocess operations. Add commands
 required by the program's own tool calls separately.

skills/rig/runtime.md

@@ -85,6 +85,8 @@ describe("Rig skill agentic workflow", () => {
     expect(markdown).toContain("already exists, and Node.js and SDK dependencies are already provisioned");
     expect(markdown).toContain("Do not use Python");
     expect(markdown).toContain("Do not invoke Bash again");
+    expect(markdown).toContain("Never call `noop` on failure");
+    expect(markdown).toContain("The one-invocation limit includes denials");
   });
 
   it("runs the actual workflow fence with exactly three small SDK calls", async () => {

src/rig-skill-workflow.test.ts

@@ -41,6 +41,8 @@ it("requires direct Node launch without shell preparation", () => {
   const runtime = readFileSync(resolve(skillRoot, "runtime.md"), "utf8");
   expect(runtime).toContain("`/tmp/gh-aw/agent` is already provisioned");
   expect(runtime).toContain("prevalidated fixture, skip lint and typecheck");
+  expect(runtime).toContain("permission parser treats heredoc");
+  expect(runtime).toContain("Do not broaden the shell allowlist");
 });
 
 it("exposes the same public modules from the standalone skill and repository", () => {