Compile unified AWF enclaves through mcpg - #50920
Conversation
Compile AWF-owned script and agent enclaves through mcpg with run-scoped capability handoff, timeout derivation, network validation, schemas, tests, and documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.
Note
This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.
|
@copilot Please refresh this PR branch if needed and run the
|
PR finisher complete. Local validation passed ( |
|
Nice work on the enclave compiler integration! 🎯 This PR looks solid: ✅ Focused scope — all changes align with unified AWF enclave compilation through mcpg The PR properly addresses the AWF integration prerequisite per the firewall schema alignment, and the inline agentic workflow attribution is noted. Ready for review! 🚀
|
|
@copilot Please triage this PR and run the Refresh the branch if needed.
|
PR finisher complete.
Actions taken: Local validation confirmed green. No code changes needed. |
|
@copilot Please triage this PR and run the Refresh the branch if needed.
|
PR finisher complete (second pass, no changes needed).
Hand-off: A maintainer needs to approve the pending deployment gates (CGO/CWI/Doc Build) to unblock merge. |
|
@copilot Please triage this PR, refresh the branch if needed, and run the Branch refresh was requested. Copilot review appears to have errored earlier, so please re-check reviewer feedback state as part of triage. Run context: https://github.com/github/gh-aw/actions/runs/31146242452
|
Branch has been refreshed (merged with
Hand-off: A maintainer needs to approve the pending deployment gates (CGO/CWI/Doc Build) to unblock merge. |
PR finisher confirmed on HEAD
No code changes are needed. Remaining gates: maintainer approval and a CI re-trigger. |
|
@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, resolve any addressed unresolved review threads, refresh the branch if GitHub can update it cleanly, and run the No failed checks were listed in the compact candidate snapshot.
|
PR finisher confirmed on HEAD
No code changes are needed. Remaining gates: maintainer approval and a CI re-trigger. |
|
@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, re-check reviewer feedback state, refresh the branch if GitHub can update it cleanly, and run the The earlier copilot review errored and later passes reported no unresolved review threads; please confirm the maintainer-facing state on the current head.
|
PR finisher confirmed on HEAD
No code changes needed. Remaining gates: maintainer approval and a CI re-trigger. |
Move enclaves under sandbox as a discriminated executor array, preserve shared repository sensitivity, and emit the same shape to AWF. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 245af6c2-3f8d-47e0-b99a-e0144e107a0d
|
@copilot fix this failing ci check https://github.com/github/gh-aw/actions/runs/31433527915/job/93602888711?pr=50920 |
…go, compiler_validators.go, mcp_renderer.go Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Fixed in the latest commit. The |
|
@copilot merge main and recompile |
…-mcp # Conflicts: # pkg/workflow/mcp_setup_gateway.go Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done. Merged |
Move enclaves back to top-level frontmatter and represent executor types with keyed script and agent entries using repos. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 245af6c2-3f8d-47e0-b99a-e0144e107a0d
Floor mcpg enclave tool timeouts at 630 seconds so AWF can complete its maximum finite-disclosure timing bucket and cleanup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 245af6c2-3f8d-47e0-b99a-e0144e107a0d
Emit the confirmed fixed 630-second mcpg enforcement bound and test the 540-second executor cap. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 245af6c2-3f8d-47e0-b99a-e0144e107a0d
|
@copilot quick triage: current CI is failing on Failed checks:
Branch refresh was requested. Run: https://github.com/github/gh-aw/actions/runs/31452822169
|
…go; remove copyloopvar redundancies from merge Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Fixed both failures in the latest commit:
|
|
@copilot Please triage this PR again, refresh the branch if needed, and run the Run context: https://github.com/github/gh-aw/actions/runs/31463363568 Please include any current unresolved review feedback, branch-refresh status, and remaining merge blockers in your handoff.
|
PR finisher confirmed on HEAD
No code changes needed. Remaining gates: maintainer approval and a CI re-trigger. |
|
@copilot Quick triage nudge for this PR. The branch has already been refreshed for a follow-up pass. Please review the latest state, check for any unresolved review feedback or failing checks, and run the
|
PR finisher confirmed on HEAD
No code changes needed. Remaining gates: maintainer approval and CI re-trigger. |
|
@copilot Quick triage nudge for this PR. Please review the latest state, check for any unresolved review feedback or failing checks, refresh the branch if needed, and run the
|
PR finisher confirmed on HEAD
No code changes needed. Remaining gates: maintainer approval and CI re-trigger. |
|
@copilot Quick triage nudge for this PR. The branch refresh step was attempted but direct branch-update automation is unavailable in this environment. Please review the latest state, check for any unresolved review feedback or failing checks, and run the
|
PR finisher confirmed on HEAD
No code changes needed. Remaining gates: maintainer approval and CI re-trigger. |
Summary
This adds the gh-aw compiler side of unified AWF enclaves, replacing the legacy bounded executor shape with a single secure mcpg route:
enclavesas a keyed array containing at most onescriptand oneagententryrepos, timeout, and resource limits; keep agent-specific settings such asmodelunderagentscript/agentkeysawf-enclaveupstream, run identity label, 120-second connection timeout, and the fixed 630-second enclave tool timeoutExample
This produces the
awf-enclaveupstream athttp://awf-enclave-mcp:8080/mcp,connectTimeout: 120, andtoolTimeout: 630for every valid enclave configuration. The gateway enforcement bound covers AWF's maximum 600-second finite-disclosure timing bucket plus a 30-second transport allowance. Executor timeout is capped at 540 seconds because AWF reserves 60 seconds in the final bucket for post-execution processing and cleanup. The 630-second mcpg bound is not an absolute AWF wall-clock guarantee under pathological host cleanup or scheduler stalls; AWF returns a canonical error immediately when pre-bucket processing has already exceeded the final bucket.Firewall dependency
This is the gh-aw compiler prerequisite for github/gh-aw-firewall#6992. The matching keyed-array and timing-bound compatibility work is published as github/gh-aw-firewall#7232.
The AWF JSON handoff is:
{ "enclaves": [ { "script": {}, "repos": [{ "repo": "octo-org/private-service", "sensitivity": "confidential" }], "timeout": 45 }, { "agent": { "model": "gpt-5" }, "repos": [{ "repo": "octo-org/private-service", "sensitivity": "confidential" }], "timeout": 180 } ] }The firewall contract:
agent.model, accepts an emptyscriptobject, and enforces matching sensitivity when a repo occurs in both entries.none, script interpreterpython3, and agent networkapi-proxy-onlyinternally.Firewall final removal of
boundedQueries/boundedAgentswaits on this compiler PR and the aligned firewall contract.The integration targets mcpg
v0.4.8. Its HTTP transport connects lazily, does not cache failed connection attempts, and retries on later readiness requests, so mcpg may start before the AWF-owned enclave upstream without compiler-owned restart logic.Validation
make agent-report-progresstoolTimeout: 630)Run: https://github.com/github/gh-aw/actions/runs/31469629212> Generated by 👨🍳 PR Sous Chef · gpt54 · 9.98 AIC · ⌖ 5.15 AIC · ⊞ 8.5K · ◷
Run details: https://github.com/github/gh-aw/actions/runs/31471640850> Generated by 👨🍳 PR Sous Chef · gpt54 · 7.6 AIC · ⌖ 5.12 AIC · ⊞ 8.5K · ◷