feat: support sbx bounded-query runtime

.github/aw/create-agentic-workflow.md

@@ -313,6 +313,7 @@ For cross-repository workflows, first determine whether the question is **finite
 - If the agent needs to answer a finite, pre-approved question about a private repository (e.g. "does this repo have open critical issues?", "what is the latest release version?"):
   - Use `tools.github.bounded-queries` with `private-repos` and `sandbox.agent.id: awf` (AWF v0.28.0+)
   - This is the preferred approach — no raw source code is exposed and no cross-repo token is needed
+  - Select `runtime: sbx` only when experimental, capability-gated execution is intended. Each query gets a separate sbx VM; AWF fails closed during host preflight and never falls back to Docker or gVisor.
 - If the answer is unbounded (e.g. arbitrary source-code extraction, full file contents), or if bounded queries are not appropriate:
   - enable the GitHub toolsets needed to read external repositories
   - configure cross-repo authentication in `safe-outputs:`

.github/aw/syntax-agentic.md

@@ -317,7 +317,7 @@ description: Agentic workflow specific frontmatter fields for GitHub Agentic Wor
   - **Strict mode**: `sandbox.agent` blocks without an explicit `id: awf` are rejected in strict mode. Any non-nil, non-disabled agent config without `id`/`type` defaults to AWF at runtime.
 
 - **`tools:`** - Tool configuration for the coding agent (`github`, `agentic-workflows`, `edit`, `web-fetch`, `web-search`, `bash`, `playwright`, custom MCP server names, plus `timeout`/`startup-timeout`/`cli-proxy`). See [syntax-tools-imports.md](syntax-tools-imports.md#tool-configuration) for the full schema (GitHub `mode`/`toolsets`/integrity fields, bash allowlist decision rule, Playwright CLI mode).
-  - **`tools.github.bounded-queries`** (object, AWF v0.28.0+) configures the AWF bounded-query subsystem for cross-repository private data access. When present, the agent may answer finite, pre-approved questions about the listed repositories using the generated `bounded-query` skill — without receiving raw source code. This is the preferred pattern for cross-repository workflows. Requires the AWF sandbox (`sandbox.agent.id: awf`). All optional fields use AWF defaults when omitted.
+  - **`tools.github.bounded-queries`** (object, AWF v0.28.0+) configures the AWF bounded-query subsystem for cross-repository private data access. When present, the agent may answer finite, pre-approved questions about the listed repositories using the generated `bounded-query` skill — without receiving raw source code. This is the preferred pattern for cross-repository workflows. Requires the AWF sandbox (`sandbox.agent.id: awf`). The query runtime is independent from `sandbox.agent.runtime`, and every query runs in a fresh backend-specific sandbox. All optional fields use AWF defaults when omitted.
 
     ```yaml
     tools:
@@ -328,7 +328,7 @@ description: Agentic workflow specific frontmatter fields for GitHub Agentic Wor
               sensitivity: public         # public | internal | confidential | sealed
             - repo: my-org/internal-service
               sensitivity: internal
-          runtime: docker         # optional; docker | gvisor; default: AWF default
+          runtime: docker         # optional; docker | gvisor | sbx; default: AWF default
           timeout: 30             # optional; seconds; default: AWF default
           memory-limit: 512m      # optional; e.g. 512m, 2g; default: AWF default
           interpreter: python3    # optional; default: AWF default
@@ -346,6 +346,8 @@ description: Agentic workflow specific frontmatter fields for GitHub Agentic Wor
 
     The staging credential used to access private repositories must remain host-side and is never written to the lock file or exposed to the agent. Use bounded queries when the question has a finite, bounded answer; prefer this over granting a cross-repository token or checking out the private repository into the primary workspace.
 
+    The `sbx` query runtime is experimental and capability-gated. AWF performs a fail-closed host preflight and does not fall back to Docker or gVisor. Docker Sandboxes v0.37.1 currently lacks mandatory per-VM network-none, PID, disk, file-size, and explicit guest mount-target controls, and no digest-pinned AWF Python-only template is available, so current hosts are rejected until those capabilities are present. This does not affect the independently selected primary agent sandbox.
+
 - **`safe-outputs:`** - Safe output processing configuration. See [safe-outputs.md](safe-outputs.md) for complete documentation of all output types: `create-issue`, `create-discussion`, `add-comment`, `create-pull-request`, `push-to-pull-request-branch`, `close-issue`, `close-discussion`, `update-issue`, `update-pull-request`, `add-labels`, `remove-labels`, `replace-label`, `dispatch-workflow`, `call-workflow`, `create-code-scanning-alert`, `upload-asset`, `upload-artifact`, `assign-to-agent`, `assign-to-user`, and more.
 
   **Key safe-outputs global fields** (detail in [safe-outputs-runtime.md](safe-outputs-runtime.md)): `github-token`, `github-app`, `staged` (preview mode, no API calls), `footer`, `threat-detection`, `runs-on` (default `ubuntu-slim`), `messages`, `env`, `max-patch-size` (KB, default `4096`).

docs/public/editor/autocomplete-data.json

@@ -1695,6 +1695,44 @@
               "type": "string",
               "desc": "Comma-separated list of GitHub MCP server feature flags to enable.",
               "leaf": true
+            },
+            "bounded-queries": {
+              "type": "object",
+              "desc": "AWF bounded-query configuration for finite private-repository questions. Every query runs in a fresh backend-specific sandbox independently from the primary agent sandbox.",
+              "children": {
+                "private-repos": {
+                  "type": "array",
+                  "desc": "Private repositories approved for bounded-query access, each with repo and sensitivity fields.",
+                  "array": true
+                },
+                "runtime": {
+                  "type": "string",
+                  "desc": "Isolated query backend. sbx is experimental, capability-gated, fail-closed, and never falls back to docker or gvisor.",
+                  "enum": ["docker", "gvisor", "sbx"],
+                  "leaf": true
+                },
+                "timeout": {
+                  "type": "integer",
+                  "desc": "Maximum execution time in seconds for one bounded-query invocation.",
+                  "leaf": true
+                },
+                "memory-limit": {
+                  "type": "string",
+                  "desc": "Memory limit for bounded-query execution, such as 512m or 2g.",
+                  "leaf": true
+                },
+                "interpreter": {
+                  "type": "string",
+                  "desc": "Script interpreter for bounded-query execution.",
+                  "enum": ["python3"],
+                  "leaf": true
+                },
+                "max-invocations": {
+                  "type": "integer",
+                  "desc": "Maximum number of bounded-query invocations allowed per run.",
+                  "leaf": true
+                }
+              }
             }
           }
         },

docs/src/content/docs/reference/frontmatter-full.md

@@ -381,6 +381,19 @@ on:
     # (optional)
     draft: true
 
+    # Maximum number of top stack layers to run on for stacked pull requests. Default
+    # is 1 (only the latest/top pull request in the stack). Set to -1 to disable stack
+    # protection and run on every pull request in the stack. Value 0 is not allowed.
+    # (optional)
+    # Accepted formats:
+
+    # Format 1: Disable stack protection; run on every pull request in the stack.
+    max-stack: 1
+
+    # Format 2: Run only on the top N pull requests in the stack. Default is 1 (only
+    # the latest/top pull request).
+    max-stack: 1
+
     # When true, allows workflow to run on pull requests from forked repositories.
     # Security consideration: fork PRs have limited permissions.
     # (optional)
@@ -745,6 +758,21 @@ on:
     types: []
       # Array of strings
 
+    # Maximum number of top stack layers to run on for stacked pull request review
+    # events. Default is 1 (only the latest/top pull request in the stack). Set to -1
+    # to disable stack protection and run on every pull request review in the stack.
+    # Value 0 is not allowed.
+    # (optional)
+    # Accepted formats:
+
+    # Format 1: Disable stack protection; run on every pull request review in the
+    # stack.
+    max-stack: 1
+
+    # Format 2: Run only on pull request reviews for the top N pull requests in the
+    # stack. Default is 1 (only the latest/top pull request).
+    max-stack: 1
+
   # Registry package event trigger that runs when a package is published or updated
   # (optional)
   registry_package:
@@ -3685,7 +3713,9 @@ tools:
     features: "example-value"
 
     # AWF bounded-query configuration for cross-repository private data access (AWF
-    # v0.28.0+). Requires the AWF sandbox (sandbox.agent.id: awf).
+    # v0.28.0+). Requires the AWF sandbox (sandbox.agent.id: awf). Query execution is
+    # independent from the primary agent sandbox, and every query runs in a fresh
+    # backend-specific sandbox.
     # (optional)
     bounded-queries:
       # List of private repositories the agent may query via bounded queries.
@@ -3697,8 +3727,12 @@ tools:
           # Confidentiality classification for this repository.
           sensitivity: "public"
 
-      # Container runtime used to execute bounded-query scripts. When omitted AWF uses
-      # its default.
+      # Isolated backend used to execute each bounded-query script. Accepted values are
+      # docker, gvisor, and sbx. The sbx backend is experimental and capability-gated:
+      # AWF performs a fail-closed host preflight and never falls back to docker or
+      # gvisor. Current Docker Sandboxes v0.37.1 hosts do not provide all mandatory
+      # controls, so AWF rejects them unless the required capabilities become available.
+      # When omitted AWF uses its default.
       # (optional)
       runtime: "docker"
 
@@ -16065,28 +16099,26 @@ safe-outputs:
     # repository slugs (e.g. '${{ inputs['allowed-repos'] }}')
     allowed-repos: "example-value"
 
-    # Git ref (branch, tag, or SHA) to use when dispatching the workflow. For
-    # workflow_call relay scenarios this is auto-injected by the compiler from
-    # needs.activation.outputs.target_ref. Overrides the caller's GITHUB_REF.
-    # (optional)
-    target-ref: "example-value"
-
-    # List of ref glob patterns the agent is allowed to supply via message.ref at
-    # runtime. Branch shorthand (e.g. 'feature/*') expands to refs/heads/feature/*,
-    # 'tags/v*' expands to refs/tags/v*; full refs/ patterns are used as-is. When
-    # omitted, per-call message.ref overrides are rejected.
-    # Supports arrays and GitHub Actions expressions resolving to a comma-separated list.
+    # List of allowed ref glob patterns for per-call dispatch_workflow message.ref
+    # overrides. Supports arrays and GitHub Actions expressions resolving to a
+    # comma-separated list (e.g. '${{ inputs['allowed-refs'] }}').
     # (optional)
     # Accepted formats:
 
     # Format 1: array
     allowed-refs: []
       # Array items: string
 
-    # Format 2: GitHub Actions expression resolving to a comma-separated list of
-    # ref glob patterns (e.g. '${{ inputs['allowed-refs'] }}')
+    # Format 2: GitHub Actions expression resolving to a comma-separated list of ref
+    # glob patterns (e.g. '${{ inputs['allowed-refs'] }}')
     allowed-refs: "example-value"
 
+    # Git ref (branch, tag, or SHA) to use when dispatching the workflow. For
+    # workflow_call relay scenarios this is auto-injected by the compiler from
+    # needs.activation.outputs.target_ref. Overrides the caller's GITHUB_REF.
+    # (optional)
+    target-ref: "example-value"
+
     # When true, emit step summary messages instead of making GitHub API calls for
     # this specific output type (preview mode)
     # (optional)

pkg/parser/frontmatter_merge_test.go

@@ -182,6 +182,55 @@ func TestMergeTools(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "main bounded-query runtime overrides imported runtime",
+			base: map[string]any{
+				"github": map[string]any{
+					"bounded-queries": map[string]any{
+						"runtime": "sbx",
+					},
+				},
+			},
+			additional: map[string]any{
+				"github": map[string]any{
+					"bounded-queries": map[string]any{
+						"runtime": "docker",
+					},
+				},
+			},
+			expected: map[string]any{
+				"github": map[string]any{
+					"bounded-queries": map[string]any{
+						"runtime": "sbx",
+					},
+				},
+			},
+		},
+		{
+			name: "imported bounded-query runtime fills missing main field",
+			base: map[string]any{
+				"github": map[string]any{
+					"bounded-queries": map[string]any{
+						"timeout": 30,
+					},
+				},
+			},
+			additional: map[string]any{
+				"github": map[string]any{
+					"bounded-queries": map[string]any{
+						"runtime": "sbx",
+					},
+				},
+			},
+			expected: map[string]any{
+				"github": map[string]any{
+					"bounded-queries": map[string]any{
+						"timeout": 30,
+						"runtime": "sbx",
+					},
+				},
+			},
+		},
 		{
 			// bash: true in main workflow (or parent import) must win over an import's
 			// specific bash command list, e.g. ["ls", "cat"]. Both are valid bash tool

pkg/parser/schemas/main_workflow_schema.json

@@ -4276,7 +4276,7 @@
                 },
                 "bounded-queries": {
                   "type": "object",
-                  "description": "AWF bounded-query configuration for cross-repository private data access (AWF v0.28.0+). Requires the AWF sandbox (sandbox.agent.id: awf).",
+                  "description": "AWF bounded-query configuration for cross-repository private data access (AWF v0.28.0+). Requires the AWF sandbox (sandbox.agent.id: awf). Query execution is independent from the primary agent sandbox, and every query runs in a fresh backend-specific sandbox.",
                   "additionalProperties": false,
                   "required": ["private-repos"],
                   "properties": {
@@ -4305,8 +4305,8 @@
                     },
                     "runtime": {
                       "type": "string",
-                      "description": "Container runtime used to execute bounded-query scripts. When omitted AWF uses its default.",
-                      "enum": ["docker", "gvisor"]
+                      "description": "Isolated backend used to execute each bounded-query script. Accepted values are docker, gvisor, and sbx. The sbx backend is experimental and capability-gated: AWF performs a fail-closed host preflight and never falls back to docker or gvisor. Current Docker Sandboxes v0.37.1 hosts do not provide all mandatory controls, so AWF rejects them unless the required capabilities become available. When omitted AWF uses its default.",
+                      "enum": ["docker", "gvisor", "sbx"]
                     },
                     "timeout": {
                       "type": "integer",

pkg/workflow/awf_config.go

@@ -197,9 +197,10 @@ type AWFBoundedQueriesConfig struct {
 	// PrivateRepos is the list of private repositories approved for bounded-query access.
 	PrivateRepos []*AWFBoundedQueryPrivateRepo `json:"privateRepos,omitempty"`
 
-	// Runtime is the container runtime for bounded-query script execution (e.g. "docker").
-	// Optional; when omitted AWF uses its default.
-	Runtime string `json:"runtime,omitempty"`
+	// Runtime is the isolated backend for each bounded-query invocation.
+	// Optional; when omitted AWF uses its default. The value is emitted verbatim and
+	// remains independent from the primary agent container runtime.
+	Runtime BoundedQueryRuntime `json:"runtime,omitempty"`
 
 	// Timeout is the maximum execution time in seconds for a single invocation.
 	// Optional; when omitted AWF uses its default.