fix(portfolio-analyst): add max-turns and max-ai-credits to prevent turn runaway

[Copilot]

The Workflow Portfolio Analyst ran for 95 turns (~10× the 9-turn baseline) and exhausted the 1 000 AIC daily provider cap, costing $10.18 with zero writes before terminating on a 403.

Changes

• portfolio-analyst.md: adds two frontmatter guardrails:

  max-turns: 20       # ~2× the 9-turn baseline; fails fast before runaway
  max-ai-credits: 250 # per-run AIC ceiling (~10.7 AIC/turn × 20 turns);
                      # prevents a single run from draining the 1 000 AIC daily cap

• portfolio-analyst.lock.yml: recompiled — propagates --max-turns 20, GH_AW_MAX_TURNS, GH_AW_MAX_AI_CREDITS: "250", and maxRuns/maxAiCredits into the AWF proxy config so both the Claude engine and the API proxy enforce the limits independently.

[github-actions]

Hey @Copilot 👋 — great catch on the portfolio-analyst turn runaway. Adding max-turns: 20 and max-ai-credits: 250 directly addresses the root cause (95 turns, $10.18, zero writes, 403 termination), and the body explains the incident and rationale clearly.

One gap before this lands:

• Lock file consistency — the .lock.yml is a compiled artifact of the .md source. The diff does not include evidence that gh aw compile was re-run and the lock file round-trips cleanly. A hand-edited or stale lock file could diverge silently. Confirming the compiled output matches the committed lock would close this.

If you'd like a hand, here's a prompt you can assign to your coding agent:

Verify that `.github/workflows/portfolio-analyst.lock.yml` is consistent with `.github/workflows/portfolio-analyst.md` after the max-turns/max-ai-credits additions.

1. Run `gh aw compile .github/workflows/portfolio-analyst.md` from the repo root.
2. Diff the freshly compiled output against the committed `.github/workflows/portfolio-analyst.lock.yml`.
3. If they differ, replace the committed lock file with the recompiled version and update the PR branch.
4. Confirm that `GH_AW_MAX_TURNS`, `GH_AW_MAX_AI_CREDITS: "250"`, and `maxRuns`/`maxAiCredits` all appear in the recompiled lock, matching the values in the `.md` frontmatter.

Generated by ✅ Contribution Check · 145 AIC · ⌖ 12.8 AIC · ⊞ 5.9K · ◷

[Copilot]

Pull request overview

This pull request adds explicit per-run guardrails to the Workflow Portfolio Analyst agentic workflow to prevent excessive turn count and AI Credit (AIC) spend from runaway runs, aligning the workflow’s runtime behavior with cost-control expectations for the gh-aw compiled/locked execution path.

Changes:

• Added max-turns: 20 and max-ai-credits: 250 to portfolio-analyst.md frontmatter.
• Recompiled portfolio-analyst.lock.yml to enforce those limits in both the Claude harness (--max-turns 20) and the AWF API proxy config (maxRuns: 20, maxAiCredits: 250), and to surface the budget value in failure handling via GH_AW_MAX_AI_CREDITS.

Show a summary per file

File	Description
.github/workflows/portfolio-analyst.md	Adds per-run turn and AIC caps in frontmatter to prevent runaway execution.
.github/workflows/portfolio-analyst.lock.yml	Recompiled lock workflow to propagate/enforce the new caps in the AWF config and Claude invocation.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0