diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index 57d62a25608..97fa0272ce2 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"76db0a47ece17ae294ed314ec74d9fe46c55c1b5b0179c9ae04d7b6da5b49e07","body_hash":"0a85250e3ba307278b526b7978b9f3c6bb2bb37f47e76038509ebe4dd5afed7c","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.59","copilot-sdk":"1.0.0"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"661b7c3876eeebed5394a5c46311409e084df3c67f4d20c00758cbb6657b90e9","body_hash":"0a85250e3ba307278b526b7978b9f3c6bb2bb37f47e76038509ebe4dd5afed7c","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.59","copilot-sdk":"1.0.0"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/cache/save","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.65"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.65"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.65"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.65"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.23","digest":"sha256:0dd1bd91a41e24a3ccc31b1ec6cb61d36608997fabf91f2d643b64e3fc33180a","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.23@sha256:0dd1bd91a41e24a3ccc31b1ec6cb61d36608997fabf91f2d643b64e3fc33180a"},{"image":"ghcr.io/github/github-mcp-server:v1.1.2","digest":"sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c","pinned_image":"ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c"},{"image":"ghcr.io/github/serena-mcp-server:latest","digest":"sha256:bf343399e3725c45528f531a230f3a04521d4cdef29f9a5af6282ff0d3c393c5","pinned_image":"ghcr.io/github/serena-mcp-server:latest@sha256:bf343399e3725c45528f531a230f3a04521d4cdef29f9a5af6282ff0d3c393c5"},{"image":"node:lts-alpine","digest":"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14","pinned_image":"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14"}]}
 #    ___                   _   _      
 #   / _ \                 | | (_)     
@@ -895,46 +895,6 @@ jobs:
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
         # Copilot CLI tool arguments (sorted):
-        # --allow-tool github
-        # --allow-tool safeoutputs
-        # --allow-tool serena
-        # --allow-tool shell(bc)
-        # --allow-tool shell(cat /tmp/gh-aw/cache-memory/)
-        # --allow-tool shell(cat > /tmp/gh-aw/cache-memory/)
-        # --allow-tool shell(cat pkg/**/*.go)
-        # --allow-tool shell(cat)
-        # --allow-tool shell(date)
-        # --allow-tool shell(echo)
-        # --allow-tool shell(find pkg -name "*.go" ! -name "*_test.go" -type f)
-        # --allow-tool shell(find pkg -type f -name "*.go" ! -name "*_test.go")
-        # --allow-tool shell(find pkg/ -maxdepth 1 -ls)
-        # --allow-tool shell(find pkg/workflow -name "compiler*.go" ! -name "*_test.go" -type f)
-        # --allow-tool shell(find pkg/workflow/ -maxdepth 1 -ls)
-        # --allow-tool shell(gh:*)
-        # --allow-tool shell(git log --since="7 days ago" --format="%h %s" -- pkg/workflow/compiler*.go)
-        # --allow-tool shell(git log --since="7 days ago" --oneline --name-only -- pkg/workflow/compiler*.go)
-        # --allow-tool shell(git log -1 --format=%H --)
-        # --allow-tool shell(grep -r "func " pkg --include="*.go")
-        # --allow-tool shell(grep)
-        # --allow-tool shell(head -n * pkg/**/*.go)
-        # --allow-tool shell(head)
-        # --allow-tool shell(jq)
-        # --allow-tool shell(ls)
-        # --allow-tool shell(mkdir -p /tmp/gh-aw/cache-memory/compiler-quality)
-        # --allow-tool shell(mv /tmp/gh-aw/cache-memory/)
-        # --allow-tool shell(printf)
-        # --allow-tool shell(pwd)
-        # --allow-tool shell(safeoutputs:*)
-        # --allow-tool shell(serena:*)
-        # --allow-tool shell(sort)
-        # --allow-tool shell(tail)
-        # --allow-tool shell(uniq)
-        # --allow-tool shell(wc -l < pkg/workflow/)
-        # --allow-tool shell(wc -l pkg/**/*.go)
-        # --allow-tool shell(wc -l pkg/workflow/compiler*.go)
-        # --allow-tool shell(wc)
-        # --allow-tool shell(yq)
-        # --allow-tool write
         timeout-minutes: 30
         run: |
           set -o pipefail
@@ -975,7 +935,7 @@ jobs:
           COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'claude-sonnet-4.6' }}
           COPILOT_SDK_URI: http://127.0.0.1:3002
           GH_AW_COPILOT_SDK_DRIVER: 1
-          GH_AW_COPILOT_SDK_SERVER_ARGS: '["--headless","--no-auto-update","--port","3002","--add-dir","/tmp/gh-aw/","--log-level","all","--log-dir","/tmp/gh-aw/sandbox/agent/logs/","--disable-builtin-mcps","--no-ask-user","--allow-tool","github","--allow-tool","safeoutputs","--allow-tool","serena","--allow-tool","shell(bc)","--allow-tool","shell(cat /tmp/gh-aw/cache-memory/)","--allow-tool","shell(cat \u003e /tmp/gh-aw/cache-memory/)","--allow-tool","shell(cat pkg/**/*.go)","--allow-tool","shell(cat)","--allow-tool","shell(date)","--allow-tool","shell(echo)","--allow-tool","shell(find pkg -name \"*.go\" ! -name \"*_test.go\" -type f)","--allow-tool","shell(find pkg -type f -name \"*.go\" ! -name \"*_test.go\")","--allow-tool","shell(find pkg/ -maxdepth 1 -ls)","--allow-tool","shell(find pkg/workflow -name \"compiler*.go\" ! -name \"*_test.go\" -type f)","--allow-tool","shell(find pkg/workflow/ -maxdepth 1 -ls)","--allow-tool","shell(gh:*)","--allow-tool","shell(git log --since=\"7 days ago\" --format=\"%h %s\" -- pkg/workflow/compiler*.go)","--allow-tool","shell(git log --since=\"7 days ago\" --oneline --name-only -- pkg/workflow/compiler*.go)","--allow-tool","shell(git log -1 --format=%H --)","--allow-tool","shell(grep -r \"func \" pkg --include=\"*.go\")","--allow-tool","shell(grep)","--allow-tool","shell(head -n * pkg/**/*.go)","--allow-tool","shell(head)","--allow-tool","shell(jq)","--allow-tool","shell(ls)","--allow-tool","shell(mkdir -p /tmp/gh-aw/cache-memory/compiler-quality)","--allow-tool","shell(mv /tmp/gh-aw/cache-memory/)","--allow-tool","shell(printf)","--allow-tool","shell(pwd)","--allow-tool","shell(safeoutputs:*)","--allow-tool","shell(serena:*)","--allow-tool","shell(sort)","--allow-tool","shell(tail)","--allow-tool","shell(uniq)","--allow-tool","shell(wc -l \u003c pkg/workflow/)","--allow-tool","shell(wc -l pkg/**/*.go)","--allow-tool","shell(wc -l pkg/workflow/compiler*.go)","--allow-tool","shell(wc)","--allow-tool","shell(yq)","--allow-tool","write","--add-dir","/tmp/gh-aw/cache-memory/","--allow-all-paths"]'
+          GH_AW_COPILOT_SDK_SERVER_ARGS: '["--headless","--no-auto-update","--port","3002","--add-dir","/tmp/gh-aw/","--log-level","all","--log-dir","/tmp/gh-aw/sandbox/agent/logs/","--disable-builtin-mcps","--no-ask-user","--allow-all-tools","--add-dir","/tmp/gh-aw/cache-memory/","--allow-all-paths"]'
           GH_AW_MAX_TOOL_DENIALS: 5
           GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
           GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
diff --git a/.github/workflows/daily-compiler-quality.md b/.github/workflows/daily-compiler-quality.md
index 517d5e4ae13..96734378363 100644
--- a/.github/workflows/daily-compiler-quality.md
+++ b/.github/workflows/daily-compiler-quality.md
@@ -62,20 +62,7 @@ name: Daily Compiler Quality Check
 strict: true
 timeout-minutes: 30
 tools:
-  bash:
-  - find pkg/workflow -name "compiler*.go" ! -name "*_test.go" -type f
-  - wc -l pkg/workflow/compiler*.go
-  - wc -l < pkg/workflow/
-  - "git log --since=\"7 days ago\" --format=\"%h %s\" -- pkg/workflow/compiler*.go"
-  - "git log --since=\"7 days ago\" --oneline --name-only -- pkg/workflow/compiler*.go"
-  - git log -1 --format=%H --
-  - mkdir -p /tmp/gh-aw/cache-memory/compiler-quality
-  - cat /tmp/gh-aw/cache-memory/
-  - cat > /tmp/gh-aw/cache-memory/
-  - jq
-  - mv /tmp/gh-aw/cache-memory/
-  - echo
-  - bc
+  bash: true
   cache-memory: true
   cli-proxy: true
   github: