From 86bfc339dc296305ab1eba51bda4722df06e8554 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 20:31:38 +0000
Subject: [PATCH 1/3] Initial plan


From 0d97c381cb03a2a9206c8efa67c7016c03dd9cc1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 20:49:29 +0000
Subject: [PATCH 2/3] fix: remove GitHub tools from campaign orchestrators and
 fix formatting

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
---
 pkg/campaign/orchestrator.go | 22 ++--------------------
 1 file changed, 2 insertions(+), 20 deletions(-)

diff --git a/pkg/campaign/orchestrator.go b/pkg/campaign/orchestrator.go
index 71e09cf677..c06f36955f 100644
--- a/pkg/campaign/orchestrator.go
+++ b/pkg/campaign/orchestrator.go
@@ -72,8 +72,6 @@ func extractFileGlobPatterns(spec *CampaignSpec) []string {
 	return []string{fallbackPattern}
 }
 
-
-
 // BuildOrchestrator constructs a minimal agentic workflow representation for a
 // given CampaignSpec. The resulting WorkflowData is compiled via the standard
 // CompileWorkflowDataWithValidation pipeline, and the orchestratorPath
@@ -323,23 +321,9 @@ func BuildOrchestrator(spec *CampaignSpec, campaignFilePath string) (*workflow.W
 		orchestratorLog.Printf("Campaign orchestrator '%s' using default engine: %s", spec.ID, engineID)
 	}
 
-	// Configure GitHub MCP for discovery with budget enforcement
-	maxDiscoveryItems := 100
-	maxDiscoveryPages := 10
-	if spec.Governance != nil {
-		if spec.Governance.MaxDiscoveryItemsPerRun > 0 {
-			maxDiscoveryItems = spec.Governance.MaxDiscoveryItemsPerRun
-		}
-		if spec.Governance.MaxDiscoveryPagesPerRun > 0 {
-			maxDiscoveryPages = spec.Governance.MaxDiscoveryPagesPerRun
-		}
-	}
-
+	// Deliberately omit GitHub tool access from orchestrators. All writes and GitHub
+	// API operations should be performed by dispatched worker workflows.
 	tools := map[string]any{
-		"github": map[string]any{
-			"toolsets": []string{"repos", "issues", "pull_requests"},
-			"mode":     "remote",
-		},
 		"repo-memory": []any{
 			map[string]any{
 				"id":          "campaigns",
@@ -351,8 +335,6 @@ func BuildOrchestrator(spec *CampaignSpec, campaignFilePath string) (*workflow.W
 		"bash": []any{"*"},
 		"edit": nil,
 	}
-	orchestratorLog.Printf("Campaign orchestrator '%s' configured with GitHub MCP (max items: %d, max pages: %d)",
-		spec.ID, maxDiscoveryItems, maxDiscoveryPages)
 
 	data := &workflow.WorkflowData{
 		Name:            name,

From 26c198a6372f5c2a3e2c5a5ca4eeebd989839e3d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 21:01:31 +0000
Subject: [PATCH 3/3] fix: restore GitHub tools for orchestrators and update
 test expectations

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
---
 pkg/campaign/orchestrator.go      | 20 ++++++++++++++++++--
 pkg/campaign/orchestrator_test.go | 11 ++++++-----
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/pkg/campaign/orchestrator.go b/pkg/campaign/orchestrator.go
index c06f36955f..cf979e1055 100644
--- a/pkg/campaign/orchestrator.go
+++ b/pkg/campaign/orchestrator.go
@@ -321,9 +321,23 @@ func BuildOrchestrator(spec *CampaignSpec, campaignFilePath string) (*workflow.W
 		orchestratorLog.Printf("Campaign orchestrator '%s' using default engine: %s", spec.ID, engineID)
 	}
 
-	// Deliberately omit GitHub tool access from orchestrators. All writes and GitHub
-	// API operations should be performed by dispatched worker workflows.
+	// Configure GitHub MCP for discovery with budget enforcement
+	maxDiscoveryItems := 100
+	maxDiscoveryPages := 10
+	if spec.Governance != nil {
+		if spec.Governance.MaxDiscoveryItemsPerRun > 0 {
+			maxDiscoveryItems = spec.Governance.MaxDiscoveryItemsPerRun
+		}
+		if spec.Governance.MaxDiscoveryPagesPerRun > 0 {
+			maxDiscoveryPages = spec.Governance.MaxDiscoveryPagesPerRun
+		}
+	}
+
 	tools := map[string]any{
+		"github": map[string]any{
+			"toolsets": []string{"repos", "issues", "pull_requests"},
+			"mode":     "remote",
+		},
 		"repo-memory": []any{
 			map[string]any{
 				"id":          "campaigns",
@@ -335,6 +349,8 @@ func BuildOrchestrator(spec *CampaignSpec, campaignFilePath string) (*workflow.W
 		"bash": []any{"*"},
 		"edit": nil,
 	}
+	orchestratorLog.Printf("Campaign orchestrator '%s' configured with GitHub MCP (max items: %d, max pages: %d)",
+		spec.ID, maxDiscoveryItems, maxDiscoveryPages)
 
 	data := &workflow.WorkflowData{
 		Name:            name,
diff --git a/pkg/campaign/orchestrator_test.go b/pkg/campaign/orchestrator_test.go
index f94a61baa4..4b945149c1 100644
--- a/pkg/campaign/orchestrator_test.go
+++ b/pkg/campaign/orchestrator_test.go
@@ -172,11 +172,12 @@ func TestBuildOrchestrator_DispatchOnlyPolicy(t *testing.T) {
 			t.Fatalf("expected orchestrator to omit create-issue and add-comment safe outputs")
 		}
 
-		// Orchestrators should not have GitHub tool access to the agent.
-		if data.Tools != nil {
-			if _, ok := data.Tools["github"]; ok {
-				t.Fatalf("expected orchestrator to omit github tools")
-			}
+		// Orchestrators should have GitHub tool access for discovery operations
+		if data.Tools == nil {
+			t.Fatalf("expected Tools to be configured")
+		}
+		if _, ok := data.Tools["github"]; !ok {
+			t.Fatalf("expected orchestrator to have github tools configured")
 		}
 	})
 }