Add sbx ingress for bounded-query broker by lpcox · Pull Request #6763 · github/gh-aw-firewall

lpcox · 2026-07-31T01:59:07Z

Summary

add a trusted ingress abstraction that preserves the bounded-query HTTP protocol across Compose Unix sockets and sbx primary agents
probe real sbx host Unix-socket passthrough first; fall back only to capability-authenticated HTTP on an ephemeral loopback port backed by a dedicated internal Docker network
expose only generated skill/wrapper artifacts and ingress to sbx while keeping seeds, work/control/audit state, seed map, Docker socket, and query-runner authority broker-private
retain Docker and gVisor as the only query runtimes for this layer
harden framing, deadlines, connection limits, one-shot readiness probing, cleanup, and canonical failure behavior

Threat model

The HTTP fallback keeps launch configuration entirely broker-owned. The agent supplies no runtime, image, command, mount, path, limit, or credential. The broker is not attached to awf-net, awf-ext, or an external route; only its fixed ingress port is published to host loopback. Separate 256-bit query/probe capabilities are generated under broker-private control state, never written to skill text or audit artifacts, and the on-disk capability file is removed after readiness. Unauthenticated requests return canonical bytes without consuming query budget.

Validation

TypeScript type-check and build pass
ESLint passes with no errors
235 focused bounded-query/sbx tests pass
full unit suite: 4,879 pass; one pre-existing macOS /var/tmp vs /private/var/tmp alias assertion fails in bounded-query/mount-policy.test.ts
standalone bundle builds and contains the embedded wrapper

Stack

Targets lpcox-refactor-query-runners (PR #6762). Layer 4 may add an sbx query runner behind the existing trusted QueryRunner selection boundary; it must not reuse primary-agent ingress capabilities or allow agent-controlled launch parameters.

Introduce trusted Docker and gVisor QueryRunner backends with centralized launch derivation and label-scoped lifecycle reconciliation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7cf71cc5-3209-47c7-8743-f903cbe4eff1

Add runtime-neutral broker ingress with executable sbx Unix socket probing and a capability-authenticated, internal-network HTTP fallback. Preserve Docker and gVisor query-runner authority and keep broker-private state isolated from primary agents. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

github-actions · 2026-07-31T01:59:30Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 921ca74

Copilot

Pull request overview

Adds trusted bounded-query ingress for sbx agents while retaining Docker/gVisor query execution.

Changes:

Adds Unix-socket probing with authenticated HTTP fallback.
Adds capability handling, generated wrapper artifacts, and broker hardening.
Expands tests and documentation for sbx ingress.

Show a summary per file

File	Description
`src/types/bounded-query-options.ts`	Defines trusted ingress transport state.
`src/services/optional-services.ts`	Starts the broker for sbx agents.
`src/services/bounded-query-service.ts`	Configures Unix or HTTP broker ingress.
`src/services/bounded-query-compose.test.ts`	Tests sbx broker composition.
`src/sbx-manager.ts`	Adds ingress probes and wrapper PATH support.
`src/sbx-manager.test.ts`	Tests socket probing and PATH changes.
`src/compose-generator.ts`	Adds the internal ingress network.
`src/commands/main-action.ts`	Integrates ingress into sbx startup.
`src/commands/main-action.test.ts`	Tests sbx capability and mount isolation.
`src/bounded-query/wrapper.test.ts`	Tests authenticated HTTP transport.
`src/bounded-query/wrapper-artifact.ts`	Materializes the agent wrapper.
`src/bounded-query/preflight.ts`	Allows sbx primary agents.
`src/bounded-query/preflight.test.ts`	Tests sbx preflight acceptance.
`src/bounded-query/paths.ts`	Adds wrapper and capability paths.
`src/bounded-query/paths.test.ts`	Tests the new paths.
`src/bounded-query/manager.ts`	Selects ingress and generates capabilities.
`src/bounded-query/manager.test.ts`	Tests ingress selection and artifacts.
`src/bounded-query/ingress.ts`	Resolves HTTP endpoints and capabilities.
`src/bounded-query/ingress.test.ts`	Tests secure ingress resolution.
`src/bounded-query/ingress-conformance.test.ts`	Verifies transport protocol parity.
`src/bounded-query/framing-deadline.test.ts`	Tests request-body deadlines.
`scripts/build-bundle.mjs`	Embeds the wrapper in standalone bundles.
`docs/sbx-integration.md`	Documents sbx ingress behavior.
`docs/bounded-queries.md`	Documents agent transport interfaces.
`docs/awf-config-spec.md`	Updates the bounded-query security contract.
`containers/bounded-query/broker/server.js`	Adds authenticated TCP ingress and limits.
`containers/bounded-query/broker/framing.js`	Adds body-read deadlines.
`containers/bounded-query/broker/config.js`	Loads TCP and capability configuration.
`containers/agent/bounded-query-wrapper.sh`	Supports Unix and authenticated HTTP requests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 29/29 changed files
Comments generated: 5
Review effort level: Balanced

lpcox · 2026-07-31T02:19:22Z

@copilot address review feedback

Reconcile bounded-query shutdown admission handling across Unix and sbx HTTP listeners. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

Copilot · 2026-07-31T02:32:31Z

@copilot address review feedback

Addressed in 0fcd49c and af99e22.

Preserve the concurrent sbx ingress fixes while retaining shutdown admission draining across both broker listeners. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

…d-sbx-broker-ingress

github-actions · 2026-07-31T02:33:48Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7cf71cc5-3209-47c7-8743-f903cbe4eff1

Bring in the GitHub CLI 2.97.0 pin, grouped package removal, and narrowed Grype ignores from the stacked base. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

Resolve the squashed bounded-query runner base against the Unix and sbx HTTP broker listeners while preserving shared shutdown admission draining. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

github-actions · 2026-07-31T03:20:07Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	99.14%	98.96%	📉 -0.18%
Statements	99.05%	98.87%	📉 -0.18%
Functions	99.29%	99.20%	📉 -0.09%
Branches	95.87%	95.24%	📉 -0.63%

📁 Per-file Coverage Changes (5 files)

File	Lines (Before → After)	Statements (Before → After)
`src/sbx-manager.ts`	96.6% → 93.3% (-3.29%)	96.1% → 92.8% (-3.34%)
`src/services/bounded-query-service.ts`	100.0% → 98.0% (-2.00%)	100.0% → 98.0% (-1.97%)
`src/commands/main-action.ts`	99.3% → 98.2% (-1.12%)	98.7% → 97.7% (-1.04%)
`src/services/optional-services.ts`	100.0% → 100.0% (+0.00%)	99.1% → 99.1% (+0.01%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/bounded-query/ingress.ts: 91.1% lines
src/bounded-query/wrapper-artifact.ts: 86.7% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Explicitly chmod the disposable Unix-socket probe directory so restrictive umasks cannot remove its execute bit. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

github-actions · 2026-07-31T03:41:34Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	99.14%	98.96%	📉 -0.18%
Statements	99.05%	98.87%	📉 -0.18%
Functions	99.29%	99.20%	📉 -0.09%
Branches	95.87%	95.24%	📉 -0.63%

📁 Per-file Coverage Changes (5 files)

File	Lines (Before → After)	Statements (Before → After)
`src/sbx-manager.ts`	96.6% → 93.4% (-3.26%)	96.1% → 92.8% (-3.30%)
`src/services/bounded-query-service.ts`	100.0% → 98.0% (-2.00%)	100.0% → 98.0% (-1.97%)
`src/commands/main-action.ts`	99.3% → 98.2% (-1.12%)	98.7% → 97.7% (-1.04%)
`src/services/optional-services.ts`	100.0% → 100.0% (+0.00%)	99.1% → 99.1% (+0.01%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/bounded-query/ingress.ts: 91.1% lines
src/bounded-query/wrapper-artifact.ts: 86.7% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-31T03:48:31Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-31T05:22:10Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-31T05:22:12Z

❌ Security Guard failed. Please review the logs for details.

github-actions · 2026-07-31T05:22:12Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-31T05:22:12Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-31T05:22:16Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-31T05:22:19Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-31T05:22:22Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-31T05:22:25Z

✅ Smoke Claude passed

github-actions · 2026-07-31T05:23:13Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	99.14%	98.92%	📉 -0.22%
Statements	99.05%	98.83%	📉 -0.22%
Functions	99.29%	99.20%	📉 -0.09%
Branches	95.87%	95.27%	📉 -0.60%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/bounded-query/preflight.ts`	100.0% → 96.5% (-3.48%)	100.0% → 96.6% (-3.42%)
`src/sbx-manager.ts`	96.6% → 93.4% (-3.26%)	96.1% → 92.8% (-3.30%)
`src/services/bounded-query-service.ts`	100.0% → 98.1% (-1.89%)	100.0% → 98.1% (-1.86%)
`src/commands/main-action.ts`	99.3% → 98.2% (-1.12%)	98.7% → 97.7% (-1.04%)
`src/services/optional-services.ts`	100.0% → 100.0% (+0.00%)	99.1% → 99.1% (+0.01%)
`src/artifact-preservation.ts`	96.2% → 96.3% (+0.07%)	96.2% → 96.3% (+0.07%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (3 files)

src/bounded-query/ingress.ts: 91.1% lines
src/bounded-query/runtime-matrix.ts: 100.0% lines
src/bounded-query/wrapper-artifact.ts: 86.7% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-31T05:25:28Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS ✅

Generated by Smoke Claude for #6763 · haiku45 · 54.8 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:25:50Z

Smoke Test Results:

Redis PING: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAIL — host.docker.internal cannot be resolved from the sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:25:51Z

Smoke Test Results

PR titles: ❌ (Could not retrieve)
GitHub connectivity: ❌ (HTTP 000/Code 7)
File writing: ✅
Bash tool: ✅

Overall status: FAIL

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:25:55Z

Smoke Test: Copilot Engine Validation

✅ GitHub MCP connectivity (PR Validate bounded-query sandbox runtime matrix #6780, feat: add fail-closed sbx bounded-query backend #6764 fetched)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

@lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:26:02Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: HTTP 200
✅ Non-allowed domain (example.com) blocked (403 via proxy)

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:26:04Z

Smoke Test Results: Copilot BYOK ✅

✅ GitHub MCP connectivity verified
✅ GitHub.com HTTP 200 ok
✅ File I/O working
✅ BYOK inference via api-proxy sidecar → api.githubcopilot.com

Status: PASS — Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY)

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:26:35Z

Smoke test results:

Validate bounded-query sandbox runtime matrix: ✅
feat: add fail-closed sbx bounded-query backend: ✅
GitHub reads: ✅
GitHub.com title check: ✅
File write/read: ✅
Discussion comment: ✅
npm ci && npm run build: ✅
Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:26:37Z

🔥 Smoke Test: API Proxy OpenTelemetry Tracing

✅ Module Loading — otel.js loads cleanly and exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus internal exporter/serialization helpers.
✅ Test Suite — 59/59 tests passed across otel.test.js + otel-fanout.test.js (span creation, gen_ai attributes, parent-trace propagation, OTLP export shaping, file/proxy-aware exporters).
✅ Env Var Forwarding — OTEL_SERVICE_NAME, OTEL_EXPORTER_OTLP_ENDPOINT, and OTEL_EXPORTER_OTLP_*_HEADERS are forwarded to the api-proxy container per api-proxy-env-config.ts/.test.ts.
✅ Token Tracker Integration — onUsage callback confirmed in token-tracker-http.js as the OTEL hook point for normalized usage.
✅ OTEL Diagnostics — /tmp/gh-aw/otel.jsonl contains a valid exported span (gh-aw.agent.setup) with resource attrs (service.name, run id, repo, sha) and trace/span/parent IDs.

All scenarios passed. No unexpected failures.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:26:41Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environment. The smoke-chroot label was not added since not all tests passed.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:27:31Z

@lpcox

✅ GitHub MCP connectivity (pre-fetched PR data validated)
✅ GitHub.com connectivity
✅ Agent file I/O test
✅ Direct BYOK inference test

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:27:58Z

@lpcox

MCP Testing: ✅
GitHub.com Connectivity: ✅
File read/write: ✅
BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall: PASS

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:28:04Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	0/0 (no tests defined)	✅ PASS
Rust	zoxide	✅	0/0 (no tests defined)	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java Maven builds initially failed with LocalRepositoryNotAccessibleException because /home/runner/.m2 is root-owned and not writable by the runner user in this environment; resolved by pointing localRepository to a writable path (/tmp/gh-aw/agent/m2repo) in settings.xml. This is an environment/permissions quirk unrelated to firewall behavior.

Generated by Build Test Suite for #6763 · aut00 · 52.6 AIC · ⊞ 11.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-31T05:28:22Z

Smoke Test: Docker Sbx — @lpcox

MCP connectivity: ✅ (PRs Validate bounded-query sandbox runtime matrix #6780, feat: add fail-closed sbx bounded-query backend #6764 fetched)
GitHub.com connectivity: ✅ (HTTP 200)
File write/read: ✅ (smoke-test-docker-sbx-30606588244.txt verified)

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

lpcox added 2 commits July 30, 2026 18:27

Copilot AI review requested due to automatic review settings July 31, 2026 01:59

Copilot started reviewing on behalf of lpcox July 31, 2026 01:59 View session

Copilot AI reviewed Jul 31, 2026

View reviewed changes

Comment thread src/sbx-manager.ts Outdated

Comment thread src/services/bounded-query-service.ts Outdated

Comment thread src/sbx-manager.ts Outdated

Comment thread src/commands/main-action.ts

Comment thread containers/bounded-query/broker/server.js

Copilot started work on behalf of lpcox July 31, 2026 02:19 View session

fix: freeze bounded-query admission on shutdown

97166cb

lpcox mentioned this pull request Jul 31, 2026

feat: add fail-closed sbx bounded-query backend #6764

Merged

Copilot AI and others added 3 commits July 31, 2026 02:28

fix: address bounded-query sbx ingress review feedback

0fcd49c

Merge lpcox-refactor-query-runners into lpcox-add-sbx-broker-ingress

a8444c0

Reconcile bounded-query shutdown admission handling across Unix and sbx HTTP listeners. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

fix: address remaining bounded-query ingress review feedback

af99e22

Copilot finished work on behalf of lpcox July 31, 2026 02:32

lpcox added 2 commits July 30, 2026 19:33

Merge remote ingress review fixes

948eb70

Preserve the concurrent sbx ingress fixes while retaining shutdown admission draining across both broker listeners. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

Merge commit 'af99e22458e1f613a775ada4373375bb07460d00' into lpcox-ad…

3c1ae56

…d-sbx-broker-ingress

fix: update agent GitHub CLI pin

440dc8d

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7cf71cc5-3209-47c7-8743-f903cbe4eff1

lpcox mentioned this pull request Jul 31, 2026

Validate bounded-query sandbox runtime matrix #6780

Merged

Merge latest bounded-query runner base

063bacf

Bring in the GitHub CLI 2.97.0 pin, grouped package removal, and narrowed Grype ignores from the stacked base. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

Base automatically changed from lpcox-refactor-query-runners to main July 31, 2026 03:12

lpcox added ready-for-aw and removed ready-for-aw labels Jul 31, 2026

fix: harden sbx probe temp permissions

83550b9

Explicitly chmod the disposable Unix-socket probe directory so restrictive umasks cannot remove its execute bit. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9c5d350f-25d9-4048-af90-419c1a387f5f

lpcox added the ready-for-aw label Jul 31, 2026

lpcox temporarily deployed to aoai-model July 31, 2026 05:22 — with GitHub Actions Inactive

lpcox temporarily deployed to aoai-model July 31, 2026 05:27 — with GitHub Actions Inactive

lpcox temporarily deployed to aoai-model July 31, 2026 05:28 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Jul 31, 2026

[aw] Security Guard failed #6788

Closed

lpcox merged commit f4ee66e into main Jul 31, 2026
138 of 141 checks passed

lpcox deleted the lpcox-add-sbx-broker-ingress branch July 31, 2026 05:35

This was referenced Jul 31, 2026

chore(deps): bump globals 17.7→17.8 and markdownlint-cli2 0.23.1→0.23.2 #6789

Merged

fix: propagate boundedAgents config fields to CLI mapping spec #6903

Merged

Uh oh!

Conversation

lpcox commented Jul 31, 2026

Summary

Threat model

Validation

Stack

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lpcox commented Jul 31, 2026

Uh oh!

Copilot AI commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 31, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 31, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading