feat: add bounded agent enclaves

.github/aw/actions-lock.json

@@ -74,6 +74,11 @@
       "repo": "github/gh-aw-actions/setup",
       "version": "v0.84.2",
       "sha": "fd783ac87efde5e0c0e05d593f1906ea25b5d92e"
+    },
+    "github/gh-aw-actions/setup@v0.84.3": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.84.3",
+      "sha": "c863074b673419603d146aab585e2986ef08deec"
     }
   },
   "containers": {

.github/workflows/contribution-check.md

@@ -86,6 +86,27 @@ steps:
       PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.item_number }}
       GH_REPO: ${{ github.repository }}
 
+  - name: Assemble contribution review context
+    run: |
+      CONTEXT_DIR=/tmp/gh-aw/contribution-check-context
+      mkdir -p "$CONTEXT_DIR"
+      test -f "$CONTEXT_DIR/pr-meta.md" \
+        || echo "(no pull request metadata for this trigger)" > "$CONTEXT_DIR/pr-meta.md"
+      test -f "$CONTEXT_DIR/contributing.md" \
+        || echo "(CONTRIBUTING.md not found)" > "$CONTEXT_DIR/contributing.md"
+      test -f "$CONTEXT_DIR/pr-files.md" \
+        || echo "(no pull request diff for this trigger)" > "$CONTEXT_DIR/pr-files.md"
+      {
+        echo "# PR metadata"
+        cat "$CONTEXT_DIR/pr-meta.md"
+        echo
+        echo "# CONTRIBUTING.md"
+        cat "$CONTEXT_DIR/contributing.md"
+        echo
+        echo "# Changed files"
+        cat "$CONTEXT_DIR/pr-files.md"
+      } > "$CONTEXT_DIR/review-context.md"
+
 ---
 
 # Contribution Check
@@ -96,12 +117,9 @@ You are a contribution guidelines reviewer for the `gh-aw-firewall` (AWF) reposi
 
 Review PR #${{ github.event.pull_request.number || github.event.inputs.item_number }} in repository ${{ github.repository }}.
 
-Read the following pre-fetched context files before proceeding:
-- `/tmp/gh-aw/contribution-check-context/pr-meta.md` — PR metadata (title, author, base/head branch, description)
-- `/tmp/gh-aw/contribution-check-context/pr-files.md` — Changed files with diffs
-- `/tmp/gh-aw/contribution-check-context/contributing.md` — CONTRIBUTING.md content
+Read `/tmp/gh-aw/contribution-check-context/review-context.md` once. It contains the PR metadata, CONTRIBUTING.md, and changed-file patches in that order.
 
-**Use ONLY the pre-fetched data in these context files.** Do NOT call `gh pr diff`, `gh pr view`, `gh api`, `git diff`, `git log`, or `git show`. Do not read other files from the checkout. After reading the three context files, your only tool calls should be `add_comment` (at most one) or `noop` — do not call any other tools.
+**Use ONLY that pre-fetched context file.** Do NOT call `gh pr diff`, `gh pr view`, `gh api`, `git diff`, `git log`, or `git show`. Do not read other files from the checkout. Read the context in one tool call; your only subsequent tool call must be `add_comment` (at most one) or `noop`.
 
 ## Review Checklist
 

.github/workflows/release.yml

@@ -448,6 +448,110 @@ jobs:
             --type spdxjson \
             ghcr.io/${{ github.repository }}/bounded-query-broker@${{ steps.build_bounded_query_broker.outputs.digest }}
 
+  # Build the minimal bounded-agent enclave and its trusted broker from separate
+  # Dockerfile targets. The build context is ./containers (not
+  # ./containers/bounded-agent) because the broker reuses the shared
+  # bounded-execution foundation and sandbox seccomp profile that live under
+  # containers/bounded-query.
+  build-bounded-agent:
+    name: Build Bounded Agent Image
+    runs-on: ubuntu-latest
+    needs: bump-version
+    outputs:
+      enclave_digest: ${{ steps.build_bounded_agent.outputs.digest }}
+      broker_digest: ${{ steps.build_bounded_agent_broker.outputs.digest }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+        with:
+          ref: ${{ needs.bump-version.outputs.version }}
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+        with:
+          platforms: arm64
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
+
+      - name: Build and push Bounded Agent image
+        id: build_bounded_agent
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        with:
+          context: ./containers
+          file: ./containers/bounded-agent/Dockerfile
+          target: enclave
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ghcr.io/${{ github.repository }}/bounded-agent:${{ needs.bump-version.outputs.version_number }}
+            ghcr.io/${{ github.repository }}/bounded-agent:latest
+          cache-from: type=gha,scope=bounded-agent
+          cache-to: type=gha,mode=max,scope=bounded-agent
+
+      - name: Sign Bounded Agent image with cosign
+        run: |
+          cosign sign --yes \
+            ghcr.io/${{ github.repository }}/bounded-agent@${{ steps.build_bounded_agent.outputs.digest }}
+
+      - name: Generate SBOM for Bounded Agent image
+        uses: anchore/sbom-action@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
+        with:
+          image: ghcr.io/${{ github.repository }}/bounded-agent@${{ steps.build_bounded_agent.outputs.digest }}
+          format: spdx-json
+          output-file: bounded-agent-sbom.spdx.json
+
+      - name: Attest SBOM for Bounded Agent image
+        run: |
+          cosign attest --yes \
+            --predicate bounded-agent-sbom.spdx.json \
+            --type spdxjson \
+            ghcr.io/${{ github.repository }}/bounded-agent@${{ steps.build_bounded_agent.outputs.digest }}
+
+      - name: Build and push Bounded Agent Broker image
+        id: build_bounded_agent_broker
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        with:
+          context: ./containers
+          file: ./containers/bounded-agent/Dockerfile
+          target: broker
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ghcr.io/${{ github.repository }}/bounded-agent-broker:${{ needs.bump-version.outputs.version_number }}
+            ghcr.io/${{ github.repository }}/bounded-agent-broker:latest
+          cache-from: type=gha,scope=bounded-agent-broker
+          cache-to: type=gha,mode=max,scope=bounded-agent-broker
+
+      - name: Sign Bounded Agent Broker image with cosign
+        run: |
+          cosign sign --yes \
+            ghcr.io/${{ github.repository }}/bounded-agent-broker@${{ steps.build_bounded_agent_broker.outputs.digest }}
+
+      - name: Generate SBOM for Bounded Agent Broker image
+        uses: anchore/sbom-action@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
+        with:
+          image: ghcr.io/${{ github.repository }}/bounded-agent-broker@${{ steps.build_bounded_agent_broker.outputs.digest }}
+          format: spdx-json
+          output-file: bounded-agent-broker-sbom.spdx.json
+
+      - name: Attest SBOM for Bounded Agent Broker image
+        run: |
+          cosign attest --yes \
+            --predicate bounded-agent-broker-sbom.spdx.json \
+            --type spdxjson \
+            ghcr.io/${{ github.repository }}/bounded-agent-broker@${{ steps.build_bounded_agent_broker.outputs.digest }}
+
   # Build agent-act image with catthehacker/ubuntu:act-24.04 base for GitHub Actions parity
   # amd64-only: catthehacker/ubuntu:act-24.04 does not publish arm64 manifests
   build-agent-act:
@@ -684,7 +788,7 @@ jobs:
   release:
     name: Create Release
     runs-on: ubuntu-latest
-    needs: [bump-version, build-squid, build-agent, build-api-proxy, build-cli-proxy, build-agent-act, build-build-tools, build-bounded-query, build-gh-aw-node]
+    needs: [bump-version, build-squid, build-agent, build-api-proxy, build-cli-proxy, build-agent-act, build-build-tools, build-bounded-query, build-bounded-agent, build-gh-aw-node]
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
@@ -786,6 +890,8 @@ jobs:
             "ghcr.io/${{ github.repository }}/cli-proxy@${{ needs['build-cli-proxy'].outputs.digest }}" \
             "ghcr.io/${{ github.repository }}/bounded-query@${{ needs['build-bounded-query'].outputs.query_digest }}" \
             "ghcr.io/${{ github.repository }}/bounded-query-broker@${{ needs['build-bounded-query'].outputs.broker_digest }}" \
+            "ghcr.io/${{ github.repository }}/bounded-agent@${{ needs['build-bounded-agent'].outputs.enclave_digest }}" \
+            "ghcr.io/${{ github.repository }}/bounded-agent-broker@${{ needs['build-bounded-agent'].outputs.broker_digest }}" \
             "ghcr.io/${{ github.repository }}/gh-aw-node@${{ needs['build-gh-aw-node'].outputs.digest }}" \
             > release/containers.txt
           echo "Generated containers.txt:"