Skip to content

Recompile enclave smoke with gateway key handoff - #7763

Merged
lpcox merged 23 commits into
mainfrom
recompile-enclave-smoke-gateway-key
Aug 28, 2026
Merged

Recompile enclave smoke with gateway key handoff#7763
lpcox merged 23 commits into
mainfrom
recompile-enclave-smoke-gateway-key

Conversation

@lpcox

@lpcox lpcox commented Aug 26, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • recompile smoke-enclave-issues-read with a local gh-aw compiler built from 7b6edf0455200006ffb099af4a23dbacac3e8c6e
  • carry the masked MCP_GATEWAY_API_KEY through the compiler-owned host environment handoff so AWF can initialize enclaves
  • retain deferred awf-enclave startup and exclude the gateway key from the primary agent environment
  • apply the required smoke-workflow post-processing, including local AWF build execution

Validation

  • compiled 1 workflow with 0 warnings
  • compiler validation passed with --no-emit --validate --actionlint --shellcheck
  • generated workflow contains the masked key handoff, deferred-server classification, and primary-agent exclusion
  • repository pre-commit lint completed with warnings only; TypeScript build passed

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Copilot AI balanced review requested due to automatic review settings August 26, 2026 19:15

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Recompiles the enclave smoke workflow to preserve the gateway key for host-side AWF initialization without exposing it to the primary agent.

Changes:

  • Updates the gh-aw compiler/setup pin.
  • Adds masked gateway-key handoff and deferred enclave startup.
  • Applies local AWF build post-processing.
Show a summary per file
File Description
.github/workflows/smoke-enclave-issues-read.lock.yml Updates the generated smoke workflow and secure key handoff.
.github/aw/actions-lock.json Records the new setup action pin.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Balanced

@github-actions

Copy link
Copy Markdown
Contributor

✅ Coverage Check Passed

Overall Coverage

Metric Base PR Delta
Lines 93.76% 93.77% ➡️ +0.01%
Statements 92.61% 92.63% 📈 +0.02%
Functions 93.16% 93.16% ➡️ +0.00%
Branches 86.04% 86.05% ➡️ +0.01%
📁 Per-file Coverage Changes (1 files)
File Lines (Before → After) Statements (Before → After)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
@github-actions

Copy link
Copy Markdown
Contributor

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

lpcox added 20 commits August 27, 2026 06:54
Normalize immutable seed permissions so the fixed non-root enclave identity can traverse directories and read repository and Git metadata.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Mount the bounded /agent tmpfs with exec so Copilot can load its extracted native runtime while retaining nosuid and nodev protections and keeping /tmp noexec.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Raise the bounded agent tmpfs default to 256 MiB so Copilot can extract and memory-map its native runtime without SIGBUS. Script enclave limits remain unchanged.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Raise the Copilot enclave memory ceiling to leave headroom beyond its two bounded tmpfs mounts and record protected filesystem and cgroup snapshots around engine execution.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Give the Copilot enclave a bounded shared-memory segment sized like its other runtime tmpfs mounts and include shared-memory capacity in protected resource snapshots.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Run the pinned Copilot package on the same pinned Node Trixie image used to install and validate it, removing the Ubuntu 26.04 libc/runtime mismatch from enclave execution.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Temporarily run the nested Copilot enclave without a seccomp filter while retaining all other isolation controls, to determine whether the custom profile causes SIGBUS.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Mount an invocation-private, enclave-owned runtime directory at /agent instead of executing Copilot's extracted native runtime from tmpfs. Restore the mandatory seccomp profile and retain bounded tmpfs for /tmp and shared memory.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Raise the enclave per-file limit to 256 MiB so Copilot can extract and map its native runtime, and record only the largest extracted file size in protected diagnostics.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Increase the enclave gateway timeout and drain grace to 660 seconds so the maximum 600-second disclosure bucket has a full minute to return through mcpg.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Recompile the enclave Issues smoke against the gh-aw adapter that translates the 660-second gateway timeout into Copilot's 660000-millisecond client timeout.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Bump the smoke workflow to Copilot CLI 1.0.80, which preserves configured MCP timeouts after late tool-list changes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit a24f6a5

@lpcox
lpcox enabled auto-merge (squash) August 28, 2026 01:33
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Build Test Suite completed successfully!

Generated by Build Test Suite for #7763

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Contribution Check completed successfully!

Contribution check complete: the PR description is clear, references the workflow recompilation and validation performed, and the change is confined to generated workflow/config files in the expected repository areas. No additional contribution-guideline issues requiring a review comment were identified.

Generated by Contribution Check for #7763

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Security Guard completed successfully!

PR #7763 security review: No security-weakening changes detected. All 8 security-relevant files show zero textual changes (+0/-0), and other modified files are workflow lock files and documentation. No DROP/REJECT weakening, capability additions, ACL regressions, seccomp relaxations, DNS bypass, or input validation weakening observed.

Generated by Security Guard for #7763

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot BYOK (Direct) Mode — PASS ✅

  • ✅ GitHub MCP Testing — PR data retrieved
  • ✅ GitHub.com Connectivity — HTTP 200
  • ✅ File Write/Read Test — File verified
  • ✅ BYOK Inference Test — Direct mode via api-proxy → api.githubcopilot.com

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy sidecar.

🔑 BYOK report filed by Smoke Copilot BYOK
Add label ready-for-aw to run again

@github-actions github-actions Bot added smoke-copilot-byok smoke-copilot-network-isolation Copilot network-isolation egress smoke test labels Aug 28, 2026
@github-actions

Copy link
Copy Markdown
Contributor

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) reachable: allowed=200
✅ Non-allowed domain (example.com) blocked: CONNECT tunnel failed (403)

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot Engine@lpcox

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Claude Engine Validation

Check Status
API ✅ PASS
gh CLI ✅ PASS
File ✅ PASS

Overall result: ✅ PASS

Generated by Smoke Claude for #7763 · claude · haiku45 · 56 AIC · ⊞ 4.5K ·
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Docker Sbx Validation

PRs referenced: #7797, #7796

  • ✅ GitHub MCP connectivity
  • ✅ GitHub.com connectivity (HTTP 200)
  • ✅ File write/read test

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Chroot Version Comparison Results

Runtime Host Version Chroot Version Match?
Python Python 3.12.14 Python 3.12.14 ✅ YES
Node.js v24.19.0 v22.23.2 ❌ NO
Go go1.22.12 go1.22.12 ✅ YES

Overall: Not all tests passed — Node.js version differs between host and chroot environments (v24 vs v22). smoke-chroot label was not added.

Tested by Smoke Chroot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: GitHub Actions Services Connectivity

  • Redis: ❌ Could not connect to Redis at host.docker.internal:6379: Temporary failure in name resolution
  • PostgreSQL pg_isready: ❌ host.docker.internal:5432 - no response
  • PostgreSQL SELECT 1: ❌ could not translate host name "host.docker.internal" to address: Temporary failure in name resolution

Overall: FAILhost.docker.internal did not resolve from the AWF sandbox, so service containers on the host are unreachable.

🔌 Service connectivity validated by Smoke Services
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke test: FAIL

PR titles: unavailable (safeinputs-gh not exposed)
Merged PR review: ❌
safeinputs-gh PR query: ❌
Playwright GitHub title: ✅
Temp file write/read: ✅
AWF build (npm ci && npm run build): ✅
Discussion query/comment: ❌ (github-discussion-query unavailable; discussion comments disabled)
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: API Proxy OTel Tracing — Results

  • Module Loading: otel.js loads cleanly, exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, and internal helpers (_parseEndpoints, _buildResourceSpans, _FanOutSpanExporter, etc.).
  • Test Suite: otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js68/68 tests passed.
  • Env Var Forwarding: env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID/COPILOT_OTEL_FILE_EXPORTER_PATH to the agent; api-proxy-env-config.ts forwards OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, trace/span IDs, and OTEL_SERVICE_NAME to the api-proxy container.
  • Token Tracker Integration: onUsage callback present in token-tracker-http.js (line 348/406) as the OTEL hook point for normalized usage.
  • OTEL Diagnostics: /tmp/gh-aw/otel.jsonl contains an exported resourceSpans payload (span gh-aw.agent.setup, traceId 5f159b9ea6812edb5025c07459b8aa51) confirming successful export during this run.

Overall: all 5 scenarios passed.

📡 OTel tracing validated by Smoke OTel Tracing
Add label ready-for-aw to run again

@lpcox
lpcox deployed to aoai-model August 28, 2026 01:39 — with GitHub Actions Active
@github-actions

Copy link
Copy Markdown
Contributor

@lpcox

fix(cap-drop): filter container cap_drop against host capability bounding set: ✅
feat: bridge an external MCP gateway into Apple Container guests: ✅
GitHub.com connectivity: ✅
File I/O test: ✅
BYOK inference: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia 1/1 passed ✅ PASS
Bun hono 1/1 passed ✅ PASS
C++ fmt N/A ✅ PASS
C++ json N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world N/A (ran, "Hello, World!") ✅ PASS
.NET json-parse N/A (ran, output correct) ✅ PASS
Go color pass ✅ PASS
Go env pass ✅ PASS
Go uuid pass ✅ PASS
Java gson 1/1 passed ✅ PASS
Java caffeine 1/1 passed ✅ PASS
Node.js clsx pass ✅ PASS
Node.js execa pass ✅ PASS
Node.js p-limit pass ✅ PASS
Rust fd 1/1 passed ✅ PASS
Rust zoxide 1/1 passed ✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

  • Java required setting localRepository to a writable path in ~/.m2/settings.xml (default ~/.m2/repository was not writable in this environment); this is an environment/permissions detail unrelated to the firewall config, not a failure.
  • No clone failures across any ecosystem.

Generated by Build Test Suite for #7763 · copilot · auto · 56.8 AIC · ⊞ 12K ·
Add label ready-for-aw to run again

Keep the enclave agent on Ubuntu while copying the pinned Node runtime and Copilot installation from the validated build stage. This avoids importing the vulnerable Debian Trixie runtime package set.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6af8590d-0b84-411f-ba6e-19532a975cac
@lpcox
lpcox disabled auto-merge August 28, 2026 04:00
@lpcox
lpcox merged commit 1970c7a into main Aug 28, 2026
35 of 37 checks passed
@lpcox
lpcox deleted the recompile-enclave-smoke-gateway-key branch August 28, 2026 04:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants