feat: add enclave agent executor - #6990
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5da2e8c6-bddd-4f94-84c2-862ab467e4bf
Implement stack layer 2 with an AWF-owned authenticated MCP server, unified script ledger, hardened enclave runner, lifecycle wiring, release images, and tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add the prompt-driven enclave_run_agent tool to the unified private MCP server, sharing the script executor ledger and hardened lifecycle while preserving legacy bounded executors. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7e34b0de-383c-4832-9cb7-14432b920ace
There was a problem hiding this comment.
Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.
Note
This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.
afb1c01 to
a60f5bd
Compare
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.64% | 98.62% | 📉 -0.02% |
| Statements | 98.50% | 98.46% | 📉 -0.04% |
| Functions | 98.52% | 98.36% | 📉 -0.16% |
| Branches | 94.52% | 94.46% | 📉 -0.06% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/enclave/manager.ts |
82.4% → 80.2% (-2.24%) | 81.3% → 79.2% (-2.05%) |
src/enclave/preflight.ts |
100.0% → 98.8% (-1.18%) | 100.0% → 98.9% (-1.06%) |
src/artifact-preservation.ts |
92.4% → 91.5% (-0.91%) | 92.5% → 91.5% (-0.91%) |
src/services/optional-services.ts |
100.0% → 100.0% (+0.00%) | 98.5% → 97.8% (-0.63%) |
src/compose-generator.ts |
98.5% → 98.6% (+0.09%) | 98.5% → 98.6% (+0.09%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
src/services/enclave-mcp-service.ts |
85.3% → 97.6% (+12.32%) | 85.3% → 95.5% (+10.21%) |
✨ New Files (1 files)
src/enclave/network.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5da2e8c6-bddd-4f94-84c2-862ab467e4bf
Implement stack layer 2 with an AWF-owned authenticated MCP server, unified script ledger, hardened enclave runner, lifecycle wiring, release images, and tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add the prompt-driven enclave_run_agent tool to the unified private MCP server, sharing the script executor ledger and hardened lifecycle while preserving legacy bounded executors. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7e34b0de-383c-4832-9cb7-14432b920ace
a60f5bd to
24cd7de
Compare
There was a problem hiding this comment.
Review details
Suppressed comments (2)
src/enclave/preflight.ts:37
- A provider base URL alone is not a usable Copilot route. The dedicated proxy removes OIDC state, and its Copilot adapter requires
COPILOT_GITHUB_TOKENorCOPILOT_PROVIDER_API_KEY; with onlycopilotProviderBaseUrl, preflight succeeds but every enclave call fails. Require a nonblank credential here instead.
containers/bounded-query/enclave-mcp/Dockerfile:24 - Use the repository's security-patched Node base. The other current Node services pin
node:22.23.2-alpine3.24(for examplecontainers/bounded-query/Dockerfile:39andcontainers/api-proxy/Dockerfile:3), andcontainers/gh-aw-node/Dockerfile:9-24documents the libcrypto/libssl and bundled-undici fixes supplied by 22.23.2. Pinning this Docker-socket-owning server to 22.23.1 regresses that baseline.
FROM node:22.23.1-alpine3.24 AS enclave-mcp-server
- Files reviewed: 38/38 changed files
- Comments generated: 1
- Review effort level: Balanced
…clave-agent-executor
Reject Docker socket exposure for every enclave executor, require a Copilot credential, use the patched Node image, and fix the enclave repository type lint error. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7e34b0de-383c-4832-9cb7-14432b920ace
Resolve overlapping enclave stack changes against current main while preserving the shared ledger, hardened agent executor, and upstream timing fixes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7e34b0de-383c-4832-9cb7-14432b920ace
Upgrade js-yaml to the available patched release. Keep the fallback logging unit test hermetic by injecting its model refresh dependency. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7e34b0de-383c-4832-9cb7-14432b920ace
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.64% | 98.61% | 📉 -0.03% |
| Statements | 98.50% | 98.45% | 📉 -0.05% |
| Functions | 98.52% | 98.36% | 📉 -0.16% |
| Branches | 94.52% | 94.45% | 📉 -0.07% |
📁 Per-file Coverage Changes (8 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/enclave/manager.ts |
82.4% → 80.2% (-2.24%) | 81.3% → 79.2% (-2.05%) |
src/rules.ts |
98.1% → 96.2% (-1.89%) | 98.2% → 96.4% (-1.82%) |
src/enclave/preflight.ts |
100.0% → 98.8% (-1.18%) | 100.0% → 98.9% (-1.06%) |
src/artifact-preservation.ts |
92.4% → 91.5% (-0.91%) | 92.5% → 91.5% (-0.91%) |
src/services/optional-services.ts |
100.0% → 100.0% (+0.00%) | 98.5% → 97.8% (-0.63%) |
src/compose-generator.ts |
98.5% → 98.6% (+0.09%) | 98.5% → 98.6% (+0.09%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
src/services/enclave-mcp-service.ts |
85.3% → 97.6% (+12.32%) | 85.3% → 95.5% (+10.21%) |
✨ New Files (1 files)
src/enclave/network.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
❌ Security Guard failed. Please review the logs for details. |
|
❌ Contribution Check failed. Please review the logs for details. |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
🔌 Smoke Services — All services reachable! ✅ |
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed to deliver outputs. AOAI BYOK (api-key) mode investigation needed... |
|
❌ Smoke Claude failed to deliver outputs |
|
Build Test Failed Build Test Suite - See logs for details |
|
🛡️ Smoke Copilot Network Isolation reports failed to deliver outputs while checking network isolation. Investigate the egress model. |
|
📰 DEVELOPING STORY: Smoke Docker Sbx reports failed to deliver outputs. Our correspondents are investigating the incident... |
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
Smoke Test: Copilot Engine — @lpcox
Overall: PASS
|
|
Smoke Test: GHA Services Connectivity — FAIL
Overall: FAIL —
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable: Overall status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: Copilot BYOK ✅ PASSDirect BYOK mode (COPILOT_PROVIDER_API_KEY via api-proxy sidecar)
All checks passed. Running in direct BYOK mode.
|
📡 OTel Tracing Smoke Test Results
Overall: ✅ All scenarios passed or expected-pending. No regressions detected in OTel tracing integration.
|
Smoke Test Results
Overall status: FAIL
|
|
Smoke Test: Copilot BYOK Direct (Azure OpenAI Foundry)
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
|
Smoke Test ResultsRecent PRs:
GitHub MCP: ✅ Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra Overall: PASS Thanks @lpcox
|
Smoke Test
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Chroot Version Comparison
Overall: FAILED - Node.js version mismatch between host (v24.18.0) and chroot (v22.23.2) environments.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS All 18 projects across 8 ecosystems built/installed and tested successfully through the AWF firewall (proxy-aware toolchains correctly routed through Squid). Note: Java required setting a writable
|
|
Smoke Test: Docker Sbx — @lpcox
Overall: PASS
|
Summary
Stack layer 3 of the greenfield MCP-based enclave migration.
enclave_run_agent({ privateRepo, schema, prompt })to the same private authenticated enclave MCP server asenclave_run_scriptboundedQueriesandboundedAgentsbehavior and their fail-closed conflict with unified enclavesgh-aw-mcpgor expose it to the primary agent; layer 4 owns that integrationStack
lpcox-enclave-mcp-scriptSecurity properties
Caller-controlled agent arguments are exactly
privateRepo,schema, andprompt; additional properties are rejected. Runtime, engine, model, provider/profile, endpoints, mounts, network, tools, credentials, resource limits, system prompts, and messages remain trusted configuration.Each invocation gets a fresh single-use enclave with an immutable read-only seed, read-only root, bounded tmpfs, fixed non-root identity, dropped capabilities, no-new-privileges, seccomp, and memory/CPU/PID/file-size/timeout bounds. The enclave joins only a dedicated internal network whose sole peer is the private dedicated API proxy. The MCP server remains networkless.
Repository-derived content reaches the configured model provider through the dedicated API proxy. Credentials remain only in that proxy and never enter MCP-server, enclave, or primary-agent state.
Validation
/var/tmpcreation--noEmit: cleannpm cicould not use the configured package feed because it lacks lockedtypescript-eslint@8.66.0; validation used isolated temporary tooling without modifying dependency manifests.