feat: support sbx bounded-query runtime

[lpcox]

Summary

• accept tools.github.bounded-queries.runtime: sbx and emit the exact AWF boundedQueries.runtime: "sbx" contract
• keep bounded-query runtime independent from sandbox.agent.runtime, with table-driven coverage for all nine Docker/gVisor/sbx combinations and no fallback
• document and warn that sbx query execution is experimental, uses a fresh VM per query, and is capability-gated by AWF's fail-closed host preflight
• update frontmatter/AWF schemas, autocomplete/reference artifacts, import-merge behavior, version gates, and invalid-value diagnostics

Dependency order

This compiler slice depends on the gh-aw-firewall bounded-query stack (#6762, #6763, #6764, and the final matrix PR) merging and shipping in AWF v0.28.0+ before runtime use. Current Docker Sandboxes v0.37.1 hosts remain unsupported by AWF preflight because mandatory isolation controls and a digest-pinned Python-only template are unavailable; neither gh-aw nor AWF rewrites or falls back to Docker/gVisor.

Validation

• make build && make build-wasm
• make golint
• go test ./pkg/parser ./pkg/workflow -count=1
• JSON/schema and generated-reference checks

The full pre-PR gate reached lint-cjs but the configured Microsoft npm proxy returned 404 for vite-8.1.0.tgz. make test-all also encountered unrelated existing/environment-sensitive failures outside the changed parser/workflow packages.

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.52 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Run: https://github.com/github/gh-aw/actions/runs/30606477668

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.91 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.69 AIC · ⊞ 5.7K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Run: https://github.com/github/gh-aw/actions/runs/30623846078

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.37 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Run: https://github.com/github/gh-aw/actions/runs/30627168508

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.8 AIC · ⊞ 5.7K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 16.7 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 6.21 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 6.38 AIC · ⊞ 5.7K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.19 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.88 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.29 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Run details: https://github.com/github/gh-aw/actions/runs/30678610470

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 18.9 AIC · ⊞ 5.7K · ◷
_{Comment /souschef to run again}

---

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

run_url: https://github.com/github/gh-aw/actions/runs/30683195966

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 20 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 20.6 AIC · ⌖ 7.02 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

---

Run URL: https://github.com/github/gh-aw/actions/runs/30719603092

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 4.21 AIC · ⌖ 6.88 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Adds experimental sbx support for bounded-query execution while keeping it independent from the primary agent sandbox.

Changes:

• Extends parsing, validation, schemas, and AWF configuration with sbx.
• Adds runtime-matrix, version-gate, merge, and compilation tests.
• Documents capability gating, fail-closed behavior, and lack of fallback.

Show a summary per file

File	Description
pkg/workflow/tools_types.go	Defines bounded-query runtime constants.
pkg/workflow/tools_parser.go	Parses the runtime type.
pkg/workflow/schemas/awf-config.schema.json	Adds sbx to the AWF contract.
pkg/workflow/sandbox_validation.go	Validates sbx and updates diagnostics.
pkg/workflow/compiler_validators.go	Emits the experimental-runtime warning.
pkg/workflow/bounded_queries_test.go	Updates parsing and JSON tests.
pkg/workflow/bounded_queries_runtime_test.go	Adds runtime matrix and compilation tests.
pkg/workflow/awf_config.go	Emits the typed runtime verbatim.
pkg/parser/schemas/main_workflow_schema.json	Adds frontmatter schema support.
pkg/parser/frontmatter_merge_test.go	Tests imported runtime merging.
docs/src/content/docs/reference/frontmatter-full.md	Regenerates frontmatter reference documentation.
docs/public/editor/autocomplete-data.json	Adds bounded-query autocomplete metadata.
.github/aw/syntax-agentic.md	Documents syntax and isolation behavior.
.github/aw/create-agentic-workflow.md	Adds workflow-authoring guidance.
.changeset/minor-add-sbx-bounded-query-runtime.md	Records the minor feature.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 15/15 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

The thread concerns were addressed in commit 618a592. TestSbxBoundedQueryFrontmatterCompilation now:

1. Runs the full compiler (compiler.CompileWorkflow) rather than the direct helper, so the warning path is exercised.
2. Captures stderr via captureStderrOutput and asserts "runtime: sbx is experimental" is emitted.
3. Asserts the exact double-quote–escaped AWF JSON fragments (\"runtime\":\"sbx\" and \"boundedQueries\":{\"enabled\":true) in the lock file, not the loose "sbx" substring that could match the heading.

This thread is also marked outdated by GitHub since the code at lines 161-174 was rewritten in the same commit.

[gh-aw-bot]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

@copilot please run the pr-finisher skill on this PR, fix the failing lint-go check (https://github.com/github/gh-aw/actions/runs/30600323549/job/91061347407), and then rerun the relevant checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.52 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

[!WARNING]
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding....

Fixed the lint-go failure in commit fix: remove unnecessary type conversions flagged by unconvert linter. The unconvert linter flagged 4 unnecessary conversions (all in files changed by this PR) — because BoundedQueryRuntime is a type alias (= string), the string() and BoundedQueryRuntime() casts were identity no-ops:

• bounded_queries_runtime_test.go:36 — string(queryRuntime) → queryRuntime
• bounded_queries_runtime_test.go:105 — string(runtime) → runtime
• sandbox_validation.go:345 — string(bq.Runtime) → bq.Runtime
• tools_parser.go:465 — BoundedQueryRuntime(runtime) → runtime

make golint now passes with 0 issues; pkg/workflow and pkg/parser tests all pass. CI needs a human re-trigger to confirm.

[pelikhan]

@copilot resolve the merge conflicts in this pull request

[gh-aw-bot]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

@copilot this PR needs maintainer follow-up. Please run the pr-finisher skill, bring the branch up to date, address any remaining review feedback, and rerun checks once ready. The PR is currently dirty and may need branch reconciliation before checks can pass.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.91 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved. All 183 conflicts were in .lock.yml files — the 98b3a9c commit on main normalized GH_AW_COMPILED_VERSION to dev for non-release builds, which conflicted with the version embedded in the branch's lock files. Merged origin/main, kept main's lock files, recompiled all 266 workflows (266/266 succeeded), confirmed make golint → 0 issues and all pkg/workflow + pkg/parser tests pass.

[pelikhan]

/review

[github-actions]

⚠️ PR Code Quality Reviewer failed during code quality review.

[pelikhan]

@copilot rename to "tools.micro-vms"?

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 90/100 — Excellent

Analyzed 3 test(s): 3 design, 0 implementation, 0 violation(s).

📊 Metrics (3 tests)

Metric	Value
Analyzed	3 (Go: 3, JS: 0)
✅ Design	3 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	2 (67%)
Duplicate clusters	0
Inflation	No
🚨 Violations	0

Test	File	Classification	Issues
TestBoundedQueryRuntimeMatrix	bounded_queries_runtime_test.go:17	design_test, behavioral_contract, high_value	None
TestBoundedQueryRuntimeVersionGate	bounded_queries_runtime_test.go:99	design_test, behavioral_contract, high_value	None
TestSbxBoundedQueryFrontmatterCompilation	bounded_queries_runtime_test.go:133	design_test, behavioral_contract, high_value	None

Modified tests in bounded_queries_test.go and frontmatter_merge_test.go add sbx runtime cases to existing table-driven suites.

Verdict

✅ passed. 0% implementation tests (threshold: 30%). All 3 new tests enforce behavioral contracts: the runtime matrix test validates 3×3 agent/query runtime combinations with proper JSON output assertions; the version gate test enforces the minimum-version error path; the frontmatter compilation test does end-to-end compile verification. Build tags present on all new files. No mock library violations.

🧪 Test quality analysis by Test Quality Sentinel · sonnet46 · 50.1 AIC · ⊞ 8.4K · ◷
_{Comment /review to run again}

[github-actions]

✅ Test Quality Sentinel: 90/100. 0% implementation tests (threshold: 30%). All 3 new tests are behavioral contracts with proper build tags and no mock library violations.

[Copilot]

[!WARNING]
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding....

Addressed the review feedback in the latest commit. TestSbxBoundedQueryFrontmatterCompilation now:

1. Captures compilation stderr via captureStderrOutput and asserts the experimental-sbx warning ("runtime: sbx is experimental") is emitted by the compiler warning path.
2. Asserts the exact AWF JSON contract — checks for \"runtime\":\"sbx\" and \"boundedQueries\":{\"enabled\":true in the lock file's embedded printf payload (double-quote–escaped, as produced by shellEscapeArgWithVarsPreserved), rather than the loose "sbx" substring that could match the heading.
3. Removes the direct usesSbxBoundedQueryRuntime helper call that bypassed the compiler, replacing it with the full compilation + lock-file inspection path.

[Copilot]

[!WARNING]
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding....

Branch is already up to date with origin/main (merge base = d2f373c). make golint passes with 0 issues.

Review thread (#discussion_r3687749528) — Marked outdated by GitHub; concerns were addressed in 618a592. A maintainer must click "Resolve conversation" to close it.

Rename question — Still awaiting @pelikhan's clarification. No code change will be made until the intended scope is confirmed (asked in a previous reply).

[gh-aw-bot]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

@copilot please run make merge-main to resolve conflicts and continue with the pr-finisher skill. The branch still needs maintainer follow-up on the unresolved review thread and the open clarification about whether sbx should be renamed to tools.micro-vms. If the branch is already current after make merge-main, confirm that state, keep the clarification request focused, and rerun the relevant checks once ready. Run details: https://github.com/github/gh-aw/actions/runs/30680808859

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 6.35 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

[Copilot]

[!WARNING]
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding....

Merged latest main (b5ab73e). make agent-report-progress-no-test passes: 0 lint errors, 266/266 workflows compiled, lock files in sync.

Review thread (#discussion_r3687749528) — Marked outdated by GitHub; concerns were addressed in 618a592. A maintainer must click "Resolve conversation" to close it.

Rename question — Still awaiting @pelikhan's clarification. No code change will be made until the intended scope is confirmed.

[gh-aw-bot]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

@copilot please run the pr-finisher skill and keep the maintainer follow-up focused.

Current context:

• a reviewer thread already has a reply but remains unresolved
• the open maintainer question about whether sbx should be renamed to tools.micro-vms is still blocking further code changes
• no failed checks are listed in the compact candidate data

Please confirm branch freshness, identify any unresolved review thread IDs that are ready to resolve, and summarize exactly what clarification or maintainer action is still needed before handoff.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 20 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

[Copilot]

[!WARNING]
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding....

Branch freshness — ✅ Current with main. HEAD 79bbcd5 includes main through a9137e1 (the latest commit). No conflicts.

Local validation — ✅ make agent-report-progress-no-test passes: 0 lint errors, 266/266 workflows compiled, lock files in sync.

---

Unresolved review thread ready for maintainer resolution:

Thread ID	File	Status
PRRT_kwDOPc1QR86VTfUy (discussion_r3687749528)	pkg/workflow/bounded_queries_runtime_test.go	Outdated · Copilot replied (r3689611237) · awaiting maintainer click "Resolve conversation"

The reply (r3689611237) is substantive: it confirms all three concerns (end-to-end compiler path, stderr capture + warning assertion, exact AWF JSON fragment) were addressed in commit 618a592. The thread is marked outdated by GitHub because the code at the reviewed lines was rewritten. The agent cannot programmatically resolve review threads; a maintainer must click "Resolve conversation" in the GitHub UI.

---

Remaining maintainer action before handoff:

1. Resolve the thread above — click "Resolve conversation" on discussion_r3687749528. No code change needed.

2. Clarify the tools.micro-vms rename scope — @pelikhan asked rename to "tools.micro-vms"? but the question is ambiguous. No code change will be made until one of these is confirmed:

   • A — rename only the runtime value (runtime: sbx → runtime: micro-vms)
   • B — restructure the section (tools.github.bounded-queries → tools.micro-vms.bounded-queries)
   • C — new sibling key alongside the existing bounded-queries block

3. Re-trigger CI — a copilot check was running at triage time (started 04:12 UTC). CI does not re-run after agent pushes; a maintainer must re-trigger (close/reopen PR, workflow_dispatch, or a new push) once (1) and (2) are resolved.

---

Summary:

• ✅ Reviews — thread PRRT_kwDOPc1QR86VTfUy has a complete Copilot reply; resolution requires a maintainer click
• ✅ Checks (local) — 0 lint errors, 266/266 compiled, lock files in sync
• ❓ Checks (CI) — stale after agent push; needs human re-trigger. Prior failures (lint-go) were fixed in committed code.
• ✅ Mergeable — branch is current, no conflicts; mergeStateStatus: unstable reflects the in-progress check, not a conflict

Actions taken this run: none (branch already current, local validation already green, no new addressable review feedback).
Still needed: maintainer to (1) resolve the outdated thread, (2) confirm tools.micro-vms rename scope or close the question, (3) re-trigger CI.

[pelikhan]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved. The only conflict was in the auto-generated docs/src/content/docs/reference/frontmatter-full.md — both branches had added content. Resolved by regenerating the file from the merged schema (make generate-schema-docs), then recompiling all 266 workflows. Pushed as merge commit Merge branch 'main' into lpcox-add-sbx-query-runtime.

[gh-aw-bot]

@copilot quick triage for this PR:

• Merge conflicts are blocking merge. Please run make merge-main, resolve the conflicts cleanly, rerun any impacted validation, and summarize the conflict resolution in your reply.
• After conflicts are resolved, run the pr-finisher skill and summarize remaining maintainer-facing blockers before handoff.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 20.6 AIC · ⌖ 7.02 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot quick triage for this PR:

• Merge conflicts are blocking merge. Please run make merge-main, resolve the conflicts cleanly, rerun any impacted validation, and summarize the conflict resoluti...

Resolved. One conflict in .github/workflows/daily-byok-ollama-test.lock.yml — main added "detection" and "evals" model aliases that weren't in the branch. Since lock files are auto-generated, accepted main's version and recompiled all 268 workflows (268/268 succeeded, lock files in sync).

Remaining maintainer blockers:

1. Resolve review thread — discussion_r3687749528 is outdated and has a complete reply. A maintainer must click "Resolve conversation" in the GitHub UI.

2. Clarify tools.micro-vms rename scope — @pelikhan asked rename to "tools.micro-vms"? but intent is ambiguous. No code change will be made until confirmed:

   • A — rename only the runtime value (runtime: sbx → runtime: micro-vms)
   • B — restructure the section key (tools.github.bounded-queries → tools.micro-vms.bounded-queries)
   • C — add a new sibling tools.micro-vms key alongside the existing block

3. Re-trigger CI after (1) and (2) are resolved.

[gh-aw-bot]

@copilot
Please investigate this PR and move it toward merge readiness.
Please refresh the branch if needed, address any unresolved review feedback, and run the pr-finisher skill.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 4.21 AIC · ⌖ 6.88 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot
Please investigate this PR and move it toward merge readiness.
Please refresh the branch if needed, address any unresolved review feedback, and run the pr-finisher skill....

Branch is current with main (HEAD 1688fb6). Local validation is green:

• make fmt — ✅ no changes
• make lint — ✅ 0 errors (164 existing warnings, pre-existing and unrelated to this PR)
• go test ./pkg/parser ./pkg/workflow — ✅ both packages pass

---

• ✅ Reviews — The only unresolved review thread (PRRT_kwDOPc1QR86VTfUy, discussion_r3687749528) was substantively answered in a prior Copilot session (r3689611237) and is marked outdated by GitHub. The agent cannot programmatically resolve review threads — a maintainer must click "Resolve conversation" in the UI.
• ✅ Checks (local) — All make targets pass on the current HEAD.
• ❓ Checks (CI) — Stale after agent push; needs human re-trigger. The "copilot" check shown as in_progress is this session; dependabot check succeeded.
• ✅ Mergeable — Not CONFLICTING, not BEHIND. mergeable_state: unstable reflects the in-progress CI check, not a structural issue.

Still needed before merge:

1. @pelikhan — clarify (or close) the tools.micro-vms rename question (comment 5139692206). A prior Copilot reply asked which of three options was intended (A: rename the sbx value to micro-vms; B: restructure the section key; C: add a sibling key). No answer has been provided. No code change will be made until confirmed.
2. Maintainer — resolve the outdated review thread via the GitHub UI.
3. CI re-trigger — close/reopen the PR, push, or use workflow_dispatch to get a fresh green run.