feat: add bounded agent sbx runtime matrix by lpcox · Pull Request #6874 · github/gh-aw-firewall

lpcox · 2026-08-03T03:51:52Z

Stack

refactor: establish reusable finite-disclosure foundation #6869 — bounded execution foundation (merged)
feat: add bounded agent enclaves #6872 — bounded-agent Docker/gVisor enclave
This PR — sbx backend contract, capability proof, and independent runtime matrix

Summary

adds a trusted-config-only bounded-agent SbxEnclaveRunner, fixed argument specification, deterministic lifecycle cleanup, narrow management environment, and exhaustive runner tests
adds host and broker capability probes for audited sbx 0.37.1; missing hard network, targeted read-only mount, PID, disk, file-size, and pinned-template invariants block before repository staging with no fallback
supports primary Docker, gVisor, and sbx independently from bounded-agent Docker, gVisor, and sbx
adds authenticated, host-gateway-only primary-sbx broker ingress with per-run query/probe capabilities, pre-agent reachability proof, and capability-file removal
adds narrow runtime telemetry, matrix reporting, docs, troubleshooting, and promotion criteria

Runtime matrix

The implementation handles all nine combinations independently. With required capabilities installed:

Primary	Docker enclave	gVisor enclave	sbx enclave
Docker	supported	supported	capability-blocked on audited sbx 0.37.1
gVisor	supported	supported	capability-blocked on audited sbx 0.37.1
sbx	supported after ingress proof	supported after ingress proof	capability-blocked on audited sbx 0.37.1

The validation host had Docker available, but not registered runsc or authenticated sbx, so its live reporter showed only Docker/Docker supported and explicitly blocked every unavailable combination. --require sbx/sbx exited 1 as designed.

Validation

npm run generate:schema
npm run type-check
npm run build
npm run lint -- --quiet
npm test -- --runInBand — 299 suites, 5,255 passed, 1 skipped
npm run test:integration -- --runInBand tests/integration/bounded-agent-enclave.test.ts — 10 passed
bounded-agent broker and enclave Docker image targets built successfully
node scripts/ci/report-bounded-agent-runtime-matrix.js
node scripts/ci/report-bounded-agent-runtime-matrix.js --require sbx/sbx — expected exit 1, explicit capability block

Security posture

This PR does not claim current sbx enclave support. The audited 0.37.1 CLI cannot prove API-proxy-only communication or the complete mount/resource contract. AWF therefore reports the concrete missing capabilities and aborts before staging, launching, mounting daemon sockets, or falling back to Docker/gVisor.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94

…o lpcox-bounded-agent-sbx-backend

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94

…o lpcox-bounded-agent-sbx-backend

github-actions · 2026-08-03T03:52:18Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 08c66be

Copilot

Pull request overview

Adds fail-closed bounded-agent sbx capability contracts and an independent primary/enclave runtime matrix, including authenticated primary-sbx broker ingress.

Changes:

Adds sbx capability probes, runner contracts, lifecycle telemetry, and matrix reporting.
Supports primary-sbx ingress via Unix sockets or capability-authenticated HTTP.
Updates configuration, tests, schemas, and documentation.

Show a summary per file

File	Description
`src/types/bounded-agent-options.ts`	Adds ingress transport state.
`src/services/bounded-agent-service.ts`	Wires broker ingress and backend metadata.
`src/services/bounded-agent-service.test.ts`	Updates sbx guard coverage.
`src/sbx-manager.ts`	Adds bounded-agent ingress proof.
`src/sbx-manager.test.ts`	Tests ingress probes and PATH wiring.
`src/compose-generator.ts`	Defines the agent ingress network.
`src/commands/main-action.ts`	Integrates primary-sbx broker ingress.
`src/commands/main-action.test.ts`	Tests capability injection and mounts.
`src/bounded-agent/workspace-artifacts.test.ts`	Tests authenticated wrapper behavior.
`src/bounded-agent/sbx-capability.ts`	Implements host capability inspection.
`src/bounded-agent/sbx-capability.test.ts`	Tests fail-closed capability reporting.
`src/bounded-agent/runtime-matrix.ts`	Models runtime combinations and telemetry.
`src/bounded-agent/runtime-matrix.test.ts`	Tests matrix and broker behavior.
`src/bounded-agent/preflight.ts`	Separates primary and enclave checks.
`src/bounded-agent/preflight.test.ts`	Covers capability-gated preflight.
`src/bounded-agent/paths.ts`	Adds capability-file paths.
`src/bounded-agent/manager.ts`	Selects ingress and creates capabilities.
`src/bounded-agent/ingress.ts`	Resolves authenticated host ingress.
`src/bounded-agent/ingress.test.ts`	Tests ingress resolution and cleanup.
`src/bounded-agent/broker.test.ts`	Adds sbx runner selection coverage.
`src/awf-config-schema.json`	Updates generated runtime description.
`scripts/ci/report-bounded-agent-runtime-matrix.test.ts`	Tests matrix reporting.
`scripts/ci/report-bounded-agent-runtime-matrix.js`	Reports live runtime capabilities.
`docs/bounded-agents.md`	Documents ingress and runtime matrix.
`docs/awf-config.schema.json`	Updates published schema description.
`docs/awf-config-spec.md`	Specifies matrix and promotion criteria.
`containers/bounded-agent/Dockerfile`	Validates new broker modules.
`containers/bounded-agent/broker/server.js`	Adds authenticated TCP ingress.
`containers/bounded-agent/broker/sbx-enclave-runner.js`	Adds sbx runner lifecycle.
`containers/bounded-agent/broker/sbx-enclave-runner-spec.js`	Defines fixed sbx arguments.
`containers/bounded-agent/broker/sbx-client.js`	Adds bounded sbx command execution.
`containers/bounded-agent/broker/sbx-capability-probe.js`	Implements broker-side probing.
`containers/bounded-agent/broker/runtime-telemetry.js`	Persists narrow telemetry.
`containers/bounded-agent/broker/enclave-runner.js`	Selects the sbx backend.
`containers/bounded-agent/broker/config.js`	Loads backend and ingress configuration.
`containers/bounded-agent/broker/broker.js`	Emits invocation telemetry.
`containers/agent/bounded-agent-wrapper.sh`	Supports authenticated HTTP transport.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 37/37 changed files
Comments generated: 7
Review effort level: Balanced

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94

github-actions · 2026-08-03T04:55:23Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

lpcox · 2026-08-03T05:31:39Z

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

* refactor: extract bounded execution foundation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d78e26c7-9fe6-4d34-a8bb-4afa87fc5f84 * feat: add bounded agent enclaves Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * chore: remove local dependency link Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * fix: avoid TOCTOU race in bounded-agent workspace-artifacts test * feat: add bounded agent sbx runtime matrix (#6874) * fix(ci): stabilize bounded-agent PR checks Consolidate agentic workflow context reads, make the AOAI Entra safe-output path deterministic, and restore coverage with fail-closed lifecycle tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * test(bounded-agent): cover integrated sbx paths Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * fix(bounded-agent): apply enclave hardening review Require the live smoke to read the mounted seed before finishing and scope sbx ingress probe failures to the calling subsystem. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * fix(ci): target docker-sbx smoke PR explicitly Pass the rendered pull request number to safe-output calls so Docker sbx runs do not depend on implicit event context. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * docs: stabilize Nmap firewall reference Replace the intermittently timing-out Nmap book page with a pinned official source permalink for the same cited passage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Copilot-Session: d78e26c7-9fe6-4d34-a8bb-4afa87fc5f84 Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421

lpcox added 4 commits August 2, 2026 20:40

feat: add bounded agent sbx runtime matrix

e693f99

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94

Merge remote-tracking branch 'origin/lpcox-bounded-agent-enclave' int…

0163a8f

…o lpcox-bounded-agent-sbx-backend

test: cover bounded agent sbx ingress wrapper

cbe0cdc

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94

Merge remote-tracking branch 'origin/lpcox-bounded-agent-enclave' int…

46d3201

…o lpcox-bounded-agent-sbx-backend

Copilot AI review requested due to automatic review settings August 3, 2026 03:51

Copilot started reviewing on behalf of lpcox August 3, 2026 03:52 View session

Copilot AI reviewed Aug 3, 2026

View reviewed changes

lpcox mentioned this pull request Aug 3, 2026

feat(bounded-agent): finish enclave hardening #6876

Merged

fix: address bounded agent sbx review feedback

0fd002e

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94

feat(bounded-agent): finish enclave hardening (#6876)

3f57089

lpcox merged commit 6f40635 into lpcox-bounded-agent-enclave Aug 3, 2026
6 checks passed

lpcox deleted the lpcox-bounded-agent-sbx-backend branch August 3, 2026 05:29

This was referenced Aug 3, 2026

[aw] No-Op Runs #6709

Open

feat: add bounded agent enclaves #6872

Merged

github-actions Bot mentioned this pull request Aug 3, 2026

fix: propagate boundedAgents config fields to CLI mapping spec #6903

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add bounded agent sbx runtime matrix - #6874

feat: add bounded agent sbx runtime matrix#6874
lpcox merged 6 commits into
lpcox-bounded-agent-enclavefrom
lpcox-bounded-agent-sbx-backend

lpcox commented Aug 3, 2026

Uh oh!

github-actions Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

Uh oh!

lpcox commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

lpcox commented Aug 3, 2026

Stack

Summary

Runtime matrix

Validation

Security posture

Uh oh!

github-actions Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

Uh oh!

lpcox commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 3, 2026 •

edited

Loading