feat: add bounded agent sbx runtime matrix - #6874
Merged
lpcox merged 6 commits intoAug 3, 2026
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94
…o lpcox-bounded-agent-sbx-backend
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94
…o lpcox-bounded-agent-sbx-backend
Contributor
Contributor
There was a problem hiding this comment.
Pull request overview
Adds fail-closed bounded-agent sbx capability contracts and an independent primary/enclave runtime matrix, including authenticated primary-sbx broker ingress.
Changes:
- Adds sbx capability probes, runner contracts, lifecycle telemetry, and matrix reporting.
- Supports primary-sbx ingress via Unix sockets or capability-authenticated HTTP.
- Updates configuration, tests, schemas, and documentation.
Show a summary per file
| File | Description |
|---|---|
src/types/bounded-agent-options.ts |
Adds ingress transport state. |
src/services/bounded-agent-service.ts |
Wires broker ingress and backend metadata. |
src/services/bounded-agent-service.test.ts |
Updates sbx guard coverage. |
src/sbx-manager.ts |
Adds bounded-agent ingress proof. |
src/sbx-manager.test.ts |
Tests ingress probes and PATH wiring. |
src/compose-generator.ts |
Defines the agent ingress network. |
src/commands/main-action.ts |
Integrates primary-sbx broker ingress. |
src/commands/main-action.test.ts |
Tests capability injection and mounts. |
src/bounded-agent/workspace-artifacts.test.ts |
Tests authenticated wrapper behavior. |
src/bounded-agent/sbx-capability.ts |
Implements host capability inspection. |
src/bounded-agent/sbx-capability.test.ts |
Tests fail-closed capability reporting. |
src/bounded-agent/runtime-matrix.ts |
Models runtime combinations and telemetry. |
src/bounded-agent/runtime-matrix.test.ts |
Tests matrix and broker behavior. |
src/bounded-agent/preflight.ts |
Separates primary and enclave checks. |
src/bounded-agent/preflight.test.ts |
Covers capability-gated preflight. |
src/bounded-agent/paths.ts |
Adds capability-file paths. |
src/bounded-agent/manager.ts |
Selects ingress and creates capabilities. |
src/bounded-agent/ingress.ts |
Resolves authenticated host ingress. |
src/bounded-agent/ingress.test.ts |
Tests ingress resolution and cleanup. |
src/bounded-agent/broker.test.ts |
Adds sbx runner selection coverage. |
src/awf-config-schema.json |
Updates generated runtime description. |
scripts/ci/report-bounded-agent-runtime-matrix.test.ts |
Tests matrix reporting. |
scripts/ci/report-bounded-agent-runtime-matrix.js |
Reports live runtime capabilities. |
docs/bounded-agents.md |
Documents ingress and runtime matrix. |
docs/awf-config.schema.json |
Updates published schema description. |
docs/awf-config-spec.md |
Specifies matrix and promotion criteria. |
containers/bounded-agent/Dockerfile |
Validates new broker modules. |
containers/bounded-agent/broker/server.js |
Adds authenticated TCP ingress. |
containers/bounded-agent/broker/sbx-enclave-runner.js |
Adds sbx runner lifecycle. |
containers/bounded-agent/broker/sbx-enclave-runner-spec.js |
Defines fixed sbx arguments. |
containers/bounded-agent/broker/sbx-client.js |
Adds bounded sbx command execution. |
containers/bounded-agent/broker/sbx-capability-probe.js |
Implements broker-side probing. |
containers/bounded-agent/broker/runtime-telemetry.js |
Persists narrow telemetry. |
containers/bounded-agent/broker/enclave-runner.js |
Selects the sbx backend. |
containers/bounded-agent/broker/config.js |
Loads backend and ingress configuration. |
containers/bounded-agent/broker/broker.js |
Emits invocation telemetry. |
containers/agent/bounded-agent-wrapper.sh |
Supports authenticated HTTP transport. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 37/37 changed files
- Comments generated: 7
- Review effort level: Balanced
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ec2c5e4-8277-47ca-b8dd-7bc8d4dd1b94
Contributor
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
Collaborator
Author
|
@copilot Fix the code for all comments in this review thread. When a review comment includes a suggested change, apply the suggestion exactly. Do not make changes beyond what is described in the linked review thread. |
This was referenced Aug 3, 2026
lpcox
added a commit
that referenced
this pull request
Aug 3, 2026
* refactor: extract bounded execution foundation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d78e26c7-9fe6-4d34-a8bb-4afa87fc5f84 * feat: add bounded agent enclaves Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * chore: remove local dependency link Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * fix: avoid TOCTOU race in bounded-agent workspace-artifacts test * feat: add bounded agent sbx runtime matrix (#6874) * fix(ci): stabilize bounded-agent PR checks Consolidate agentic workflow context reads, make the AOAI Entra safe-output path deterministic, and restore coverage with fail-closed lifecycle tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * test(bounded-agent): cover integrated sbx paths Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * fix(bounded-agent): apply enclave hardening review Require the live smoke to read the mounted seed before finishing and scope sbx ingress probe failures to the calling subsystem. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * fix(ci): target docker-sbx smoke PR explicitly Pass the rendered pull request number to safe-output calls so Docker sbx runs do not depend on implicit event context. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 * docs: stabilize Nmap firewall reference Replace the intermittently timing-out Nmap book page with a pinned official source permalink for the same cited passage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Copilot-Session: d78e26c7-9fe6-4d34-a8bb-4afa87fc5f84 Copilot-Session: d503c75e-4dae-4e09-a3bc-99bba4728421
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack
Summary
SbxEnclaveRunner, fixed argument specification, deterministic lifecycle cleanup, narrow management environment, and exhaustive runner testssbx0.37.1; missing hard network, targeted read-only mount, PID, disk, file-size, and pinned-template invariants block before repository staging with no fallbackRuntime matrix
The implementation handles all nine combinations independently. With required capabilities installed:
The validation host had Docker available, but not registered runsc or authenticated sbx, so its live reporter showed only Docker/Docker supported and explicitly blocked every unavailable combination.
--require sbx/sbxexited 1 as designed.Validation
npm run generate:schemanpm run type-checknpm run buildnpm run lint -- --quietnpm test -- --runInBand— 299 suites, 5,255 passed, 1 skippednpm run test:integration -- --runInBand tests/integration/bounded-agent-enclave.test.ts— 10 passednode scripts/ci/report-bounded-agent-runtime-matrix.jsnode scripts/ci/report-bounded-agent-runtime-matrix.js --require sbx/sbx— expected exit 1, explicit capability blockSecurity posture
This PR does not claim current
sbxenclave support. The audited 0.37.1 CLI cannot prove API-proxy-only communication or the complete mount/resource contract. AWF therefore reports the concrete missing capabilities and aborts before staging, launching, mounting daemon sockets, or falling back to Docker/gVisor.