Broaden strict Copilot read allowlists for SPDD and Formal Spec workflows

.github/workflows/daily-formal-spec-verifier.md

@@ -41,13 +41,14 @@ tools:
     branch-name: memory/formal-spec-verifier
     file-glob: ["*.md", "*.json"]
     max-file-size: 65536
+  edit: null
   bash:
     - "find specs -type f -name \"*.md\" | sort"
     - "cat specs/*.md"
     - "find . -name \"*_test.go\" -path \"*/pkg/*\" | head -20"
     - "cat pkg/workflow/*.go | head -200"
     - "cat pkg/cli/*.go"
-    - "sed -n"
+    - "sed *"
 
 safe-outputs:
   mentions: false
@@ -123,6 +124,8 @@ If a note file exists for the selected spec, read it and use the prior predicate
 
 Read the selected spec file in full with `bash`.
 
+Use built-in file inspection tools only for read-only analysis when bash output is insufficient. Do not modify repository files.
+
 Extract:
 
 - **Purpose**: the system or component being specified.

.github/workflows/daily-spdd-spec-planner.md

@@ -34,13 +34,14 @@ tools:
     mode: gh-proxy
     toolsets: [default, repos, issues, pull_requests]
   cache-memory: true
+  edit: null
   bash:
     - "find specs docs scratchpad -type f -name \"*.md\""
     - "cat specs/*.md"
     - "cat docs/src/content/docs/reference/*specification*.md"
     - "cat scratchpad/*specification*.md"
     - "git log --oneline --since=\"14 days ago\" -- specs docs/src/content/docs/reference scratchpad"
-    - "sed -n"
+    - "sed *"
 
 steps:
   - name: Copy OpenSPDD prompts
@@ -89,6 +90,8 @@ Inspect specification files from:
 - `docs/src/content/docs/reference/*specification*.md`
 - `scratchpad/*specification*.md`
 
+Use the allowed shell commands above or built-in file inspection tools only for read-only analysis. Do not modify repository files.
+
 ### Daily Rotation
 
 Use cache-memory at `/tmp/gh-aw/cache-memory/spdd-daily/rotation.json` to rotate through spec files fairly:

pkg/workflow/prompts_test.go

@@ -348,6 +348,48 @@ func TestDailyFormalSpecVerifierDefinesDirectSafeOutputContract(t *testing.T) {
 	}
 }
 
+func TestDailyFormalSpecVerifierAllowsReadOnlyFileInspection(t *testing.T) {
+	repoRoot, err := findRepoRoot()
+	if err != nil {
+		t.Fatalf("Failed to find repo root: %v", err)
+	}
+
+	workflowFile := filepath.Join(repoRoot, ".github", "workflows", "daily-formal-spec-verifier.md")
+	content, err := os.ReadFile(workflowFile)
+	if err != nil {
+		t.Fatalf("Failed to read workflow file: %v", err)
+	}
+
+	workflow := string(content)
+	if !strings.Contains(workflow, "edit: null") {
+		t.Fatal("Expected daily-formal-spec-verifier workflow to enable built-in file inspection tools")
+	}
+	if !strings.Contains(workflow, `- "sed *"`) {
+		t.Fatal("Expected daily-formal-spec-verifier workflow to allow ranged sed reads")
+	}
+}
+
+func TestDailySPDDSpecPlannerAllowsReadOnlyFileInspection(t *testing.T) {
+	repoRoot, err := findRepoRoot()
+	if err != nil {
+		t.Fatalf("Failed to find repo root: %v", err)
+	}
+
+	workflowFile := filepath.Join(repoRoot, ".github", "workflows", "daily-spdd-spec-planner.md")
+	content, err := os.ReadFile(workflowFile)
+	if err != nil {
+		t.Fatalf("Failed to read workflow file: %v", err)
+	}
+
+	workflow := string(content)
+	if !strings.Contains(workflow, "edit: null") {
+		t.Fatal("Expected daily-spdd-spec-planner workflow to enable built-in file inspection tools")
+	}
+	if !strings.Contains(workflow, `- "sed *"`) {
+		t.Fatal("Expected daily-spdd-spec-planner workflow to allow ranged sed reads")
+	}
+}
+
 func TestDailyCacheStrategyAnalyzerUsesCodexCompatibleModelsForExperiment(t *testing.T) {
 	repoRoot, err := findRepoRoot()
 	if err != nil {