[WIP] Support bounded agents in workflow frontmatter and generated AWF configuration

.github/aw/designer.md

@@ -213,7 +213,8 @@ For less common ecosystems (Swift, PHP, Dart, Haskell, Perl, fonts, Deno, Elixir
 | "run commands/tests" | `bash` tool (default unless restricted) |
 | "browse web pages/docs" | `web-fetch` and/or `web-search` |
 | "test UI flows" | `playwright` |
-| "finite question about private repo" | `tools.github.bounded-queries` (AWF v0.28.0+, preferred over cross-repo tokens) |
+| "deterministic finite question about private repo" | `tools.github.bounded-queries` (AWF v0.28.0+, preferred over cross-repo tokens) |
+| "finite private-repo question requiring judgment or multi-step inspection" | `tools.github.bounded-agents` (AWF v0.27.44+, fixed Copilot enclave) |
 
 ### Pattern Heuristics
 
@@ -272,7 +273,7 @@ Never suggest committing plaintext tokens.
 | "just respond to a comment" | no pre-fetch needed (event payload is enough) |
 | "process each item individually" | suggest sub-agent pattern with `model: small` |
 | "weekly digest", "compliance report", "license review", "policy audit" | pre-fetch with `gh` + `jq` into `/tmp/gh-aw/data/`; point prompt to those files |
-| "finite question about a private repo", "check if private repo has X" | `tools.github.bounded-queries` (preferred over cross-repo token/checkout) |
+| "finite question about a private repo", "check if private repo has X" | `tools.github.bounded-queries` for deterministic checks; `tools.github.bounded-agents` for judgment (preferred over cross-repo token/checkout) |
 
 ## Token Optimization Defaults
 

.github/aw/syntax-agentic.md

@@ -320,6 +320,7 @@ description: Agentic workflow specific frontmatter fields for GitHub Agentic Wor
 
 - **`tools:`** - Tool configuration for the coding agent (`github`, `agentic-workflows`, `edit`, `web-fetch`, `web-search`, `bash`, `playwright`, custom MCP server names, plus `timeout`/`startup-timeout`/`cli-proxy`). See [syntax-tools-imports.md](syntax-tools-imports.md#tool-configuration) for the full schema (GitHub `mode`/`toolsets`/integrity fields, bash allowlist decision rule, Playwright CLI mode).
   - **`tools.github.bounded-queries`** (object, AWF v0.28.0+) configures the AWF bounded-query subsystem for cross-repository private data access. When present, the agent may answer finite, pre-approved questions about the listed repositories using the generated `bounded-query` skill — without receiving raw source code. This is the preferred pattern for cross-repository workflows. Requires the AWF sandbox (`sandbox.agent.id: awf`). The query runtime is independent from `sandbox.agent.runtime`, and every query runs in a fresh backend-specific sandbox. All optional fields use AWF defaults when omitted.
+  - **`tools.github.bounded-agents`** (object, AWF v0.27.44+) configures fixed Copilot enclave requests for private-repository questions that require multi-step reading or judgment. Use `bounded-queries` for deterministic author-supplied Python; use bounded agents only when the answer has a finite schema. The caller cannot select its engine, model, runtime, route, or credentials, and never receives repository contents or transcripts.
 
     ```yaml
     tools:

docs/public/editor/autocomplete-data.json

@@ -1738,6 +1738,24 @@
                   "leaf": true
                 }
               }
+            },
+            "bounded-agents": {
+              "type": "object",
+              "desc": "AWF bounded-agent configuration for finite private-repository answers requiring multi-step judgment.",
+              "children": {
+                "private-repos": { "type": "array", "desc": "Approved private repositories.", "array": true },
+                "runtime": { "type": "string", "enum": ["docker", "gvisor"], "leaf": true },
+                "engine": { "type": "string", "enum": ["copilot"], "leaf": true },
+                "model": { "type": "string", "desc": "Fixed enclave model.", "leaf": true },
+                "timeout": { "type": "integer", "leaf": true },
+                "memory-limit": { "type": "string", "leaf": true },
+                "cpu-limit": { "type": "string", "leaf": true },
+                "pids-limit": { "type": "integer", "leaf": true },
+                "tmpfs-limit": { "type": "string", "leaf": true },
+                "max-output-bytes": { "type": "integer", "leaf": true },
+                "max-task-bytes": { "type": "integer", "leaf": true },
+                "max-invocations": { "type": "integer", "leaf": true }
+              }
             }
           }
         },

docs/src/content/docs/reference/frontmatter-full.md

@@ -120,6 +120,13 @@ resources: []
 # (optional)
 inlined-imports: true
 
+# Workspace-relative folders to bundle in the activation artifact and restore
+# before the agent runs. Useful for activation steps that generate reusable
+# prompt, skill, or agent context.
+# (optional)
+ambient-folders: []
+  # Array of strings
+
 # Workflow triggers that define when the agentic workflow should run. Supports
 # standard GitHub Actions trigger events plus special command triggers for
 # /commands (required)
@@ -1041,13 +1048,6 @@ on:
   # (optional)
   allow-bot-authored-trigger-comment: true
 
-  # Workspace-relative folders to bundle in the activation artifact and restore
-  # before the agent runs. Useful for activation steps that generate reusable
-  # prompt, skill, or agent context.
-  # (optional)
-  ambient-folders: []
-    # Array of strings
-
   # Environment name that requires manual approval before the workflow can run. Must
   # match a valid environment configured in the repository settings.
   # (optional)
@@ -1904,7 +1904,7 @@ experiments:
   # Storage backend for experiment state. 'repo' (default) persists state to a git
   # branch named 'experiments/{sanitizedWorkflowID}' (workflow ID lowercased with
   # hyphens removed, e.g. 'my-workflow' -> 'experiments/myworkflow') for durability
-  # across cache evictions. 'cache' uses GitHub Actions cache (legacy behavior).
+  # across cache evictions. 'cache' uses GitHub Actions cache (legacy behaviour).
   # Repo storage is recommended because experiment data is valuable and more durable
   # than cache.
   # (optional)
@@ -2776,6 +2776,11 @@ engine:
   # (optional)
   experimental: true
 
+  # Whether the engine supports MCP. When false, the compiler automatically enables
+  # gh-proxy and cli-proxy and rejects attempts to disable either proxy.
+  # (optional)
+  mcp: true
+
   # Runtime adapter identifier. Maps to the CodingAgentEngine registered in the
   # engine registry. Defaults to id when omitted.
   # (optional)
@@ -3024,6 +3029,14 @@ engine:
       # (optional)
       config-path: "example-value"
 
+      # JavaScript source of a Node.js script that converts the MCP gateway's raw output
+      # configuration into the format expected by this engine. When set, the script is
+      # written to ${RUNNER_TEMP}/gh-aw/actions/<engine-id>_mcp_config_adapter.cjs
+      # before the MCP gateway starts, and start_mcp_gateway.cjs executes it (instead of
+      # a built-in per-engine converter) once the gateway has produced its output.
+      # (optional)
+      config-adapter: "example-value"
+
     # JavaScript source of a Node.js harness that spawns the engine CLI. When set, the
     # script is written to ${RUNNER_TEMP}/gh-aw/actions/<engine-id>_harness.cjs before
     # execution and the engine is launched as: node <harness-path> <command-name>
@@ -3797,6 +3810,45 @@ tools:
       # (optional)
       max-invocations: 1
 
+    # (optional)
+    bounded-agents:
+      private-repos: []
+        # Array items:
+          repo: "example-value"
+
+          sensitivity: "public"
+
+      # (optional)
+      runtime: "docker"
+
+      engine: "copilot"
+
+      model: "example-value"
+
+      # (optional)
+      timeout: 1
+
+      # (optional)
+      memory-limit: "example-value"
+
+      # (optional)
+      cpu-limit: "example-value"
+
+      # (optional)
+      pids-limit: 1
+
+      # (optional)
+      tmpfs-limit: "example-value"
+
+      # (optional)
+      max-output-bytes: 1
+
+      # (optional)
+      max-task-bytes: 1
+
+      # (optional)
+      max-invocations: 1
+
   # Bash shell command execution tool. Supports wildcards: '*' (all commands),
   # 'command *' (command with any args, e.g., 'date *', 'echo *'). Default safe
   # commands: echo, ls, pwd, cat, head, tail, grep, wc, sort, uniq, date.
@@ -8668,7 +8720,7 @@ safe-outputs:
 
     # Controls protected-file protection. String form: request_review (default),
     # blocked, allowed, or fallback-to-issue — or a GitHub Actions expression for
-    # reusable workflows. Object form: { policy, exclude } to customize the
+    # reusable workflows. Object form: { policy, exclude } to customise the
     # protected-file set.
     # (optional)
     # Accepted formats:
@@ -8684,7 +8736,7 @@ safe-outputs:
 
     # Format 2: GitHub Actions expression that resolves to 'blocked', 'allowed',
     # 'fallback-to-issue', or 'request_review' at runtime. Use in reusable
-    # workflow_call workflows to parameterize the policy per caller.
+    # workflow_call workflows to parameterise the policy per caller.
     protected-files: "example-value"
 
     # Format 3: Object form for granular control over the protected-file set. Use the
@@ -8764,7 +8816,7 @@ safe-outputs:
     patch-format: "am"
 
     # Format 2: GitHub Actions expression that resolves to 'am' or 'bundle' at
-    # runtime. Use in reusable workflow_call workflows to parameterize the transport
+    # runtime. Use in reusable workflow_call workflows to parameterise the transport
     # format per caller.
     patch-format: "example-value"
 
@@ -15141,7 +15193,7 @@ safe-outputs:
 
     # Controls protected-file protection. String form: blocked (default), allowed, or
     # fallback-to-issue — or a GitHub Actions expression for reusable workflows.
-    # Object form: { policy, exclude } to customize the protected-file set.
+    # Object form: { policy, exclude } to customise the protected-file set.
     # (optional)
     # Accepted formats:
 
@@ -15154,7 +15206,7 @@ safe-outputs:
 
     # Format 2: GitHub Actions expression that resolves to 'blocked', 'allowed', or
     # 'fallback-to-issue' at runtime. Use in reusable workflow_call workflows to
-    # parameterize the policy per caller.
+    # parameterise the policy per caller.
     protected-files: "example-value"
 
     # Format 3: Object form for granular control over the protected-file set. Use the
@@ -15216,7 +15268,7 @@ safe-outputs:
     patch-format: "am"
 
     # Format 2: GitHub Actions expression that resolves to 'am' or 'bundle' at
-    # runtime. Use in reusable workflow_call workflows to parameterize the transport
+    # runtime. Use in reusable workflow_call workflows to parameterise the transport
     # format per caller.
     patch-format: "example-value"
 
@@ -18333,7 +18385,7 @@ safe-outputs:
     # Default values injected when the model omits a field
     # (optional)
     defaults:
-      # Behavior when no files match: 'error' (default) or 'ignore'
+      # Behaviour when no files match: 'error' (default) or 'ignore'
       # (optional)
       if-no-files: "error"
 
@@ -20004,6 +20056,24 @@ observability:
       # (optional)
       audience: "example-value"
 
+    # Exchange a GitHub Actions OIDC token for a cloud access token before OTLP
+    # export. Google Workload Identity Federation is currently supported.
+    # (optional)
+    workload-identity:
+      # Cloud workload identity provider.
+      provider: "google"
+
+      # Google Workload Identity Provider resource name (e.g.
+      # projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL/providers/PROVIDER).
+      # The GitHub OIDC audience (https://iam.googleapis.com/...) and Google STS
+      # audience (//iam.googleapis.com/...) are derived from it; either fully-qualified
+      # form is also accepted.
+      audience: "example-value"
+
+      # Optional Google service account email to impersonate after STS token exchange.
+      # (optional)
+      service-account: "example-value"
+
 # Rate limiting configuration to restrict how frequently users can trigger the
 # workflow. Helps prevent abuse and resource exhaustion from programmatically
 # triggered events.

pkg/constants/spec_test.go

@@ -384,6 +384,7 @@ func TestSpec_VersionConstraints_MinVersionValues(t *testing.T) {
 		{name: "CopilotNoAskUserMinVersion", constant: constants.CopilotNoAskUserMinVersion, expected: "1.0.19"},
 		// From spec: AWFBoundedQueriesMinVersion // "v0.28.0"
 		{name: "AWFBoundedQueriesMinVersion", constant: constants.AWFBoundedQueriesMinVersion, expected: "v0.28.0"},
+		{name: "AWFBoundedAgentsMinVersion", constant: constants.AWFBoundedAgentsMinVersion, expected: "v0.27.44"},
 	}
 
 	for _, tt := range tests {

pkg/constants/version_constants.go

@@ -64,7 +64,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.8.0"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultFirewallVersion Version = "v0.27.43"
+const DefaultFirewallVersion Version = "v0.27.44"
 
 // AWFExcludeEnvMinVersion is the minimum AWF version that supports the --exclude-env flag.
 // Workflows pinning an older AWF version must not emit --exclude-env flags or the run will fail.
@@ -127,6 +127,10 @@ const AWFAPIProxyProvidersMinVersion Version = "v0.27.43"
 // Workflows pinning an older AWF version must not emit this section.
 const AWFBoundedQueriesMinVersion Version = "v0.28.0"
 
+// AWFBoundedAgentsMinVersion is the minimum AWF version that supports
+// the boundedAgents section in awf-config.json.
+const AWFBoundedAgentsMinVersion Version = "v0.27.44"
+
 // DefaultGVisorVersion is the pinned gVisor release used by the compiler-generated
 // install step. A specific dated release name is used instead of "latest" to ensure
 // reproducible, verifiable installs. Each release provides SHA-512 files for
@@ -148,7 +152,7 @@ const CopilotNoAskUserMinVersion Version = "1.0.19"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultMCPGatewayVersion Version = "v0.4.7"
+const DefaultMCPGatewayVersion Version = "v0.4.8"
 
 // MCPGIntegrityReactionsMinVersion is the minimum MCPG version that supports
 // endorsement-reactions and disapproval-reactions in the allow-only policy.

pkg/parser/frontmatter_merge_test.go

@@ -231,6 +231,39 @@ func TestMergeTools(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "imported bounded-agent fields fill missing main fields",
+			base: map[string]any{
+				"github": map[string]any{
+					"bounded-agents": map[string]any{
+						"model": "gpt-4o-mini",
+					},
+				},
+			},
+			additional: map[string]any{
+				"github": map[string]any{
+					"bounded-agents": map[string]any{
+						"engine": "copilot",
+						"private-repos": []any{map[string]any{
+							"repo":        "my-org/internal-service",
+							"sensitivity": "internal",
+						}},
+					},
+				},
+			},
+			expected: map[string]any{
+				"github": map[string]any{
+					"bounded-agents": map[string]any{
+						"engine": "copilot",
+						"model":  "gpt-4o-mini",
+						"private-repos": []any{map[string]any{
+							"repo":        "my-org/internal-service",
+							"sensitivity": "internal",
+						}},
+					},
+				},
+			},
+		},
 		{
 			// bash: true in main workflow (or parent import) must win over an import's
 			// specific bash command list, e.g. ["ls", "cat"]. Both are valid bash tool

pkg/parser/schemas/main_workflow_schema.json

@@ -4360,6 +4360,34 @@
                       "maximum": 10000
                     }
                   }
+                },
+                "bounded-agents": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["private-repos", "engine", "model"],
+                  "properties": {
+                    "private-repos": {
+                      "type": "array",
+                      "minItems": 1,
+                      "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": ["repo", "sensitivity"],
+                        "properties": { "repo": { "type": "string", "pattern": "^[^/]+/[^/]+$" }, "sensitivity": { "type": "string", "enum": ["public", "internal", "confidential", "sealed"] } }
+                      }
+                    },
+                    "runtime": { "type": "string", "enum": ["docker", "gvisor"] },
+                    "engine": { "type": "string", "enum": ["copilot"] },
+                    "model": { "type": "string", "minLength": 1 },
+                    "timeout": { "type": "integer", "minimum": 1, "maximum": 540 },
+                    "memory-limit": { "type": "string", "pattern": "^[1-9][0-9]*[bkmgBKMG]$" },
+                    "cpu-limit": { "type": "string", "pattern": "^[1-9][0-9]*(\\.[0-9]+)?$" },
+                    "pids-limit": { "type": "integer", "minimum": 1 },
+                    "tmpfs-limit": { "type": "string", "pattern": "^[1-9][0-9]*[bkmgBKMG]$" },
+                    "max-output-bytes": { "type": "integer", "minimum": 1 },
+                    "max-task-bytes": { "type": "integer", "minimum": 1 },
+                    "max-invocations": { "type": "integer", "minimum": 1 }
+                  }
                 }
               },
               "additionalProperties": false,