Skip to content

docs(runner-doctor): add PR #7728 citation to A21 across mirrored catalogs - #7765

Merged
lpcox merged 10 commits into
mainfrom
copilot/update-a21-citation
Aug 28, 2026
Merged

docs(runner-doctor): add PR #7728 citation to A21 across mirrored catalogs#7765
lpcox merged 10 commits into
mainfrom
copilot/update-a21-citation

Conversation

Copilot AI commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Runner Doctor identified a documentation gap: A21 already described the /tmp/awf-lib/run/awf-lib migration, but citations did not include the PR that landed the shipping fix. This updates A21 references to include github/gh-aw-firewall#7728 and keeps mirrored doctor sources aligned.

  • A21 citation update (shared catalog)

    • Appended github/gh-aw-firewall#7728 to the A21 citations column in:
      • .github/workflows/shared/self-hosted-failure-modes.md
  • A21 citation update (workflow and portable doctor copies)

    • Appended the same PR citation in:
      • .github/workflows/self-hosted-runner-doctor.md
      • .github/agents/self-hosted-runner-doctor.md
    • Includes both the A21 playbook citation line and the A21 table row where applicable.
  • Alignment guardrail update

    • Updated scripts/ci/self-hosted-runner-doctor-workflow.test.ts string expectations so the sync test enforces the new citation set across all mirrored sources.
A21 / github/gh-aw-firewall#7678, github/gh-aw-firewall#7679, github/gh-aw-firewall#7681, github/gh-aw-firewall#7728 — ...

Copilot AI changed the title [WIP] Update A21 citation to include PR #7728 docs(runner-doctor): add PR #7728 citation to A21 across mirrored catalogs Aug 26, 2026
Copilot AI requested a review from lpcox August 26, 2026 19:22
@lpcox
lpcox marked this pull request as ready for review August 27, 2026 15:46
Copilot AI balanced review requested due to automatic review settings August 27, 2026 15:46

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds PR #7728 to A21 citations across the synchronized Runner Doctor catalogs.

Changes:

  • Updates all mirrored A21 references.
  • Extends alignment-test expectations.
Show a summary per file
File Description
.github/workflows/shared/self-hosted-failure-modes.md Updates the canonical A21 citation.
.github/workflows/self-hosted-runner-doctor.md Updates the workflow playbook citation.
.github/agents/self-hosted-runner-doctor.md Synchronizes portable-agent references.
scripts/ci/self-hosted-runner-doctor-workflow.test.ts Enforces citation alignment.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  • Files reviewed: 4/4 changed files
  • Comments generated: 0
  • Review effort level: Balanced

@github-actions

Copy link
Copy Markdown
Contributor

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric Base PR Delta
Lines 93.76% 93.85% 📈 +0.09%
Statements 92.61% 92.68% 📈 +0.07%
Functions 93.16% 93.14% 📉 -0.02%
Branches 86.04% 86.10% 📈 +0.06%
📁 Per-file Coverage Changes (4 files)
File Lines (Before → After) Statements (Before → After)
src/cloud-hypervisor/manager.ts 89.5% → 88.9% (-0.63%) 88.2% → 87.5% (-0.73%)
src/cloud-hypervisor-runtime-backend.ts 96.6% → 96.3% (-0.33%) 94.3% → 93.4% (-0.87%)
src/cloud-hypervisor/preflight.ts 95.8% → 96.2% (+0.34%) 95.3% → 95.7% (+0.40%)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)
✨ New Files (4 files)
  • src/cloud-hypervisor/backend-utils.ts: 100.0% lines
  • src/cloud-hypervisor/guest-environment-builder.ts: 96.0% lines
  • src/cloud-hypervisor/manager-start.ts: 98.2% lines
  • src/cloud-hypervisor/manager-stop.ts: 94.6% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

@lpcox

lpcox commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator

@copilot rebase to main

Copilot AI and others added 8 commits August 27, 2026 21:14
…#7757)

* Initial plan

* chore(deps): update safe patch dependencies

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
* feat: add protected enclave entry diagnostics

Add bounded progress and preflight events, preserve safe launch errors, and keep private inputs out of protected session metadata. Cover launch failures, timeout cleanup, redaction, milestones, and audit mapping.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* ci: compile workflows with enclave-compatible gh-aw

Build the exact gh-aw revision used by the agent-enclave workflow so supply-chain compilation recognizes its GitHub capability configuration.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60

* Fix enclave MCP image CVE scan

Upgrade Alpine runtime packages before installing docker-cli so the enclave MCP server picks up patched OpenSSL packages. Remove the obsolete version-scoped CVE exception.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60

* Upgrade Alpine packages across scanned images

Apply current Alpine security updates to every affected image stage so the blocking Grype gate sees patched OpenSSL 3.5.8 packages consistently.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
* feat: add protected enclave entry diagnostics

Add bounded progress and preflight events, preserve safe launch errors, and keep private inputs out of protected session metadata. Cover launch failures, timeout cleanup, redaction, milestones, and audit mapping.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* ci: compile workflows with enclave-compatible gh-aw

Build the exact gh-aw revision used by the agent-enclave workflow so supply-chain compilation recognizes its GitHub capability configuration.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60

* Fix enclave MCP image CVE scan

Upgrade Alpine runtime packages before installing docker-cli so the enclave MCP server picks up patched OpenSSL packages. Remove the obsolete version-scoped CVE exception.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60

* Upgrade Alpine packages across scanned images

Apply current Alpine security updates to every affected image stage so the blocking Grype gate sees patched OpenSSL 3.5.8 packages consistently.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60

* Fix enclave transcript bounds test buffer

Allow the Python harness JSON wrapper to exceed Node's default 1 MiB spawnSync buffer while continuing to assert the protected transcript itself stays within its 1 MiB limit.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60

* Recompile enclave Issues smoke workflow

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: e552ccd0-4793-480a-bcf9-da6172693e60
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
* docs: sync token-usage schema with AI credits pricing fields

Commit c8ebd20 (Add protected enclave entry diagnostics) introduced new
per-record AI credits pricing provenance fields in
containers/api-proxy/guards/ai-credits-guard.js and
containers/api-proxy/token-tracker-shared.js (mergeBudgetFields), which
are persisted into token-usage.jsonl records but were missing from
schemas/token-usage.schema.json:

- ai_credits_pricing_source
- ai_credits_pricing_tier
- ai_credits_accounting_policy
- ai_credits_fallback_pricing_used
- ai_credits_dynamic_selector
- ai_credits_pricing_observed_at
- ai_credits_pricing_api_version
- ai_credits_pricing_discount_percent

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
* Initial plan

* refactor: split cloud hypervisor backend helpers

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Initial plan

* refactor: split cloud hypervisor manager lifecycle

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI commented Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

@copilot rebase to main

Rebased onto main and pushed. The rebased tip is c100ea53.

@lpcox
lpcox enabled auto-merge (squash) August 28, 2026 01:34
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Contribution Check completed successfully!

PR review complete: no contribution-guidelines issues found in the provided context. The PR description is clear, references the related issue, updates mirrored documentation, and adds/updates the corresponding test expectations; no comment needed.

Generated by Contribution Check for #7765

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Security Guard completed successfully!

PR #7765 security review complete. 4 security-relevant files analyzed: agent-entrypoint.py (adds preflight checks and error handling), and 3 Dockerfiles (add apk upgrade for security patching). All changes strengthen security with no weakened controls, new capabilities, or regressive ACLs. No issues found.

Generated by Security Guard for #7765

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

📡 Smoke OTel Tracing reports failed. OTel tracing regression detected. ⚠️

OTEL smoke test results — all scenarios pass:
✅ Scenario 1 (Module Loading): otel.js loads successfully, exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus internal test hooks.
✅ Scenario 2 (Test Suite): 3 suites (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js) — 68/68 tests passed.
✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/PARENT_SPAN_ID to agent container; api-proxy-env-config.ts forwards OTEL_EXPORTER_OTLP_ENDPOINT/HEADERS and trace context to api-proxy container.
✅ Scenario 4 (Token Tracker Integration): onUsage callback present in token-tracker-http.js as the OTEL usage hook point (invoked after normalized usage extraction).
⚠️ Scenario 5 (OTEL Diagnostics): not independently verifiable from this sandbox context (no access to the post-step's collected diagnostics artifact); no evidence of failure found in code paths reviewed.
Overall: no unexpected failures detected.

📡 OTel tracing validated by Smoke OTel Tracing

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Smoke Claude passed

Generated by Smoke Claude for #7765

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot Engine@lpcox

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Claude Engine Validation

Check Result
API status ✅ PASS
gh check ✅ PASS
File status ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #7765 · claude · haiku45 · 32.5 AIC · ⊞ 4.5K ·
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot BYOK (Direct Mode) – PASS

  • ✅ MCP GitHub connectivity (2 merged PRs fetched)
  • ✅ HTTP connectivity (github.com: HTTP 200)
  • ✅ File write/read (smoke test artifact verified)
  • ✅ BYOK inference path active (agent → api-proxy sidecar → api.githubcopilot.com)

Running in direct BYOK mode via COPILOT_PROVIDER_API_KEY with api-proxy forwarding.

🔑 BYOK report filed by Smoke Copilot BYOK
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test Results

  • Redis PING: ❌ (Temporary failure in name resolution)
  • PostgreSQL pg_isready: ❌ (no response)
  • PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAILhost.docker.internal could not be resolved from the sandbox.

🔌 Service connectivity validated by Smoke Services
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: CONNECT tunnel 403

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
Add label ready-for-aw to run again

@github-actions github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 28, 2026
@lpcox
lpcox deployed to aoai-model August 28, 2026 01:39 — with GitHub Actions Active
@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Docker Sbx Validation

PRs checked: #7797 "refactor: split Cloud Hypervisor backend helpers", #7796 "Split Cloud Hypervisor manager lifecycle into focused modules"

  • ✅ GitHub MCP connectivity
  • ✅ GitHub.com connectivity (HTTP 200)
  • ✅ File write/read test

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
Add label ready-for-aw to run again

@lpcox
lpcox deployed to aoai-model August 28, 2026 01:40 — with GitHub Actions Active
@github-actions

Copy link
Copy Markdown
Contributor

Smoke test

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Chroot Version Comparison

Runtime Host Version Chroot Version Match?
Python Python 3.12.14 Python 3.12.14 ✅ YES
Node.js v24.19.0 v22.23.2 ❌ NO
Go go1.22.12 go1.22.12 ✅ YES

Result: Not all tests passed — Node.js version mismatch between host and chroot environments. smoke-chroot label not applied.

Tested by Smoke Chroot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

@Copilot @lpcox

MCP connectivity (merged PRs: fix(cap-drop): filter container cap_drop against host capability bounding set; feat: bridge an external MCP gateway into Apple Container guests): ✅
GitHub.com HTTP: ✅
File I/O: ✅
BYOK inference: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia 1/1 passed ✅ PASS
Bun hono 1/1 passed ✅ PASS
C++ fmt N/A ✅ PASS
C++ json N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world N/A ✅ PASS
.NET json-parse N/A ✅ PASS
Go color pass ✅ PASS
Go env pass ✅ PASS
Go uuid pass ✅ PASS
Java gson 1/1 passed ✅ PASS
Java caffeine 1/1 passed ✅ PASS
Node.js clsx pass ✅ PASS
Node.js execa pass ✅ PASS
Node.js p-limit pass ✅ PASS
Rust fd 1/1 passed ✅ PASS
Rust zoxide 1/1 passed ✅ PASS

Overall: 8/8 ecosystems passed — PASS

All 18 projects across Bun, C++, Deno, .NET, Go, Java, Node.js, and Rust cloned, built/installed, and passed their tests successfully. Java required a custom -Dmaven.repo.local path due to a read-only default ~/.m2 directory in this environment; this did not affect build/test correctness.

Generated by Build Test Suite for #7765 · copilot · auto · 34.3 AIC · ⊞ 12K ·
Add label ready-for-aw to run again

@lpcox
lpcox merged commit 7db98b1 into main Aug 28, 2026
159 of 166 checks passed
@lpcox
lpcox deleted the copilot/update-a21-citation branch August 28, 2026 01:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

🩺 Runner Doctor UpdateRunner doctor update: add PR #7728 citation to A21 (filesystem.allowWrite helper staging fix)

3 participants