Skip to content

fix: propagate boundedAgents config fields to CLI mapping spec - #6903

Merged
lpcox merged 1 commit into
mainfrom
fix/config-audit-bounded-agents-cli-mapping-0304a9cc329450e8
Aug 3, 2026
Merged

fix: propagate boundedAgents config fields to CLI mapping spec#6903
lpcox merged 1 commit into
mainfrom
fix/config-audit-bounded-agents-cli-mapping-0304a9cc329450e8

Conversation

@github-actions

@github-actions github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Summary

Config-consistency audit of recently merged PRs found one gap: the boundedAgents configuration section (introduced in PR #6872, refined in #6874) is fully wired in the JSON Schema (src/awf-config-schema.json / docs/awf-config.schema.json, kept identical) and in src/config-file.ts (AwfFileConfig.boundedAgents), but Section 5 (CLI Mapping) of docs/awf-config-spec.md had no rows for any boundedAgents.* field — unlike its sibling boundedQueries, which has a full set of mapping rows.

Fix

Added 16 rows to Section 5 documenting each boundedAgents.* field as config-only (no CLI flag), consistent with the existing boundedQueries.* rows and cross-referencing §15 where the feature is fully documented.

Layer Status before Status after
JSON Schema (src + docs) ✅ present, identical ✅ unchanged
TypeScript (config-file.ts) ✅ present ✅ unchanged
Spec §15 prose ✅ present ✅ unchanged
Spec §5 CLI mapping table ❌ missing all boundedAgents.* rows ✅ added

PRs reviewed (no other gaps found)

PR Title Result
#6894, #6889 OIDC isolation / auth docs spec-only, no schema fields
#6876 bounded-agent enclave hardening spec-only
#6874 bounded-agent sbx runtime matrix schema/types consistent
#6872 bounded-agent enclaves gap found & fixed
#6869 finite-disclosure foundation refactor types-only refactor
#6780, #6764, #6763, #6758 bounded-query sbx/ingress schema/types/config-file consistent
#6736 bounded-query naming refactor rename, consistent
#6728 sealed-probe budgets schema/types/config-file consistent
#6705 DNS type-only fix no config field
#6695 api-proxy model pricing overlays schema/spec/config-file/env-wiring all consistent
#6689 policy type-only fix no config field

Verification checklist

  • tsc --noEmit (docs-only change; no TS files touched)
  • config-file-mapping tests (unaffected, no code changes)
  • schema validation tests (unaffected, no schema changes)
  • diff src/awf-config-schema.json docs/awf-config.schema.json confirmed identical (verified before and after this change)

Generated by Config Consistency Auditor · auto · 79.9 AIC · ⊞ 9.1K ·

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox
lpcox marked this pull request as ready for review August 3, 2026 22:29
Copilot AI review requested due to automatic review settings August 3, 2026 22:29

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Documents all boundedAgents settings as config-only fields in the CLI mapping specification.

Changes:

  • Adds mapping entries for all 15 boundedAgents fields.
  • Cross-references the bounded-agent specification in §15.
Show a summary per file
File Description
docs/awf-config-spec.md Adds boundedAgents.* entries to the CLI mapping table.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/1 changed files
  • Comments generated: 0
  • Review effort level: Balanced

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 432db25

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Gemini completed. All facets verified. 💎

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Build Test Suite completed successfully!

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

🔌 Smoke Services — All services reachable! ✅

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Contribution Check completed successfully!

No contribution-guidelines issues found for PR #6903. The change is docs-only, matches the existing config-only mapping pattern, and the PR description clearly explains the gap and fix. No additional tests or file-organization changes were needed.

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

🚀 Security Guard has started processing this pull request

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Claude passed

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

✅ GitHub MCP: PR #6898, #6894 retrieved
✅ HTTP Connectivity: 200 to github.com
✅ File Write/Read: Verified
✅ BYOK Inference: Direct mode active via api-proxy → api.githubcopilot.com

Status: All tests passed. Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY).


cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Test: Claude Engine Validation

Check Result
API status ✅ PASS
gh check ✅ PASS
File status ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #6903 · haiku45 · 55.7 AIC · ⊞ 3.6K ·
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: CONNECT tunnel failed, response 403

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Test: Copilot Engine@lpcox

  • ✅ MCP connectivity (github-list_pull_requests)
  • ✅ GitHub.com connectivity (HTTP 200)
  • ✅ File write/read test

Recent PRs checked: #6898 (Auth Doctor Updater), #6894 (isolate Actions OIDC)

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
Add label ready-for-aw to run again

@github-actions github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 3, 2026
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Test: Services Connectivity

  • Redis PING: ❌
  • pg_isready: ❌
  • psql SELECT 1: ❌

Overall: FAILhost.docker.internal DNS resolution failed from AWF sandbox.

🔌 Service connectivity validated by Smoke Services
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

📡 OTel Tracing Smoke Test Results

  • Scenario 1 — Module Loading: otel.js loads successfully, isEnabled() returns true; exports include startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus exporter internals (_ProxyAwareOtlpExporter, _FileSpanExporter, _FanOutSpanExporter, _parseEndpoints, _parseOtlpHeaders, _buildResourceSpans).
  • Scenario 2 — Test Suite: otel.test.js + otel-fanout.test.js59/59 tests passed, 0 failures.
  • Scenario 3 — Env Var Forwarding: env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards those plus GH_AW_OTLP_ENDPOINTS and OTEL_EXPORTER_OTLP_ENDPOINT to the api-proxy sidecar.
  • Scenario 4 — Token Tracker Integration: token-tracker-http.js contains the onUsage callback hook (4 references) used to attach gen_ai.usage.* attributes to spans.
  • Scenario 5 — OTEL Diagnostics: Workflow-level trace export (/tmp/gh-aw/otel.jsonl) contains valid resource spans with gen_ai.system and run/workflow attributes. No api-proxy-local otel.jsonl file was present in this run's log dir (api-proxy exports directly via OTLP HTTP rather than to a local file sink when configured with a real endpoint) — expected, not a regression. token-usage.jsonl and token-tracker-audit.jsonl were populated normally.

Overall: All scenarios pass. No regressions detected in OTEL tracing integration.

📡 OTel tracing validated by Smoke OTel Tracing
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Chroot Version Comparison Results

Runtime Host Version Chroot Version Match?
Python 3.12.13 3.12.13 YES
Node.js v24.18.0 v22.23.1 NO
Go go1.22.12 go1.22.12 YES

Overall: FAILED - Node.js version differs between host and chroot environments (smoke-chroot label not added).

Tested by Smoke Chroot
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke test summary

  • Current PR: fix: propagate boundedAgents config fields to CLI mapping spec
  • Merged PRs: feat: add Auth Doctor Updater workflow; docs: update authentication and API proxy guidance
  • GitHub PR query: ✅
  • Playwright title: ✅
  • File write/read: ✅
  • Discussion comment: ✅
  • Build: ✅
  • Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

${{ steps.smoke-data.outputs.SMOKE_PR_DATA }}

✅ GitHub MCP connectivity
✅ GitHub.com connectivity
✅ File write/read test
✅ BYOK inference test

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS

cc @lpcox

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

feat: add Auth Doctor Updater workflow — ✅
fix: isolate Actions OIDC from agent container — ✅
GitHub MCP connectivity — ✅
GitHub.com connectivity — ✅
File write/read — ✅
BYOK inference — ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall: PASS
cc @lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Test: Docker Sbx Validation

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia 1/1 passed ✅ PASS
Bun hono 1/1 passed ✅ PASS
C++ fmt N/A ✅ PASS
C++ json N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world N/A ✅ PASS
.NET json-parse N/A ✅ PASS
Go color 1/1 passed ✅ PASS
Go env 1/1 passed ✅ PASS
Go uuid 1/1 passed ✅ PASS
Java gson 1/1 passed ✅ PASS
Java caffeine 1/1 passed ✅ PASS
Node.js clsx passed ✅ PASS
Node.js execa passed ✅ PASS
Node.js p-limit passed ✅ PASS
Rust fd 1/1 passed ✅ PASS
Rust zoxide 1/1 passed ✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

  • .NET hello-world prints "Hello, World!"; json-parse correctly parses/serializes JSON.
  • Maven required -Dmaven.repo.local override (default ~/.m2/repository was root-owned/non-writable in this environment); build/test succeeded otherwise via the configured Squid proxy settings.

Generated by Build Test Suite for #6903 · auto · 73.1 AIC · ⊞ 11.5K ·
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Gemini Smoke Test Results

  • GitHub MCP Testing: ❌ (Filtered by secrecy policy)
  • GitHub.com Connectivity: ❌ (Status 000)
  • File Writing Testing: ✅
  • Bash Tool Testing: ✅

Overall status: FAIL

💎 Faceted by Smoke Gemini
Add label ready-for-aw to run again

@lpcox
lpcox merged commit 61d5f65 into main Aug 3, 2026
131 checks passed
@lpcox
lpcox deleted the fix/config-audit-bounded-agents-cli-mapping-0304a9cc329450e8 branch August 3, 2026 23:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants