feat: integrate Firecracker primary-agent runtime preview by lpcox · Pull Request #7136 · github/gh-aw-firewall

lpcox · 2026-08-09T02:51:06Z

Stack

Layer 5/6, based exactly on lpcox-firecracker-guest-transport at 0347f8faa384818d9597d7e8dbebc16ad0b5d6f1.

Depends on #7135 and the lower Firecracker stack (#7129, #7133, #7134, #7135).

Summary

wires --container-runtime firecracker --firecracker-preview through the external runtime backend while Compose runs infrastructure only
discovers and revalidates the live internal AWF Docker bridge plus exact Squid/API-proxy endpoints before attaching the VM
assembles the sanitized guest environment through shared agent/API-proxy helpers without passing real provider secrets
launches the jailer, isolated network, checksummed workspace/rootfs/supervisor, and vsock guest supervisor in fail-closed order
probes supervisor, Squid, and API-proxy connectivity before executing the agent command
streams stdio over vsock, preserves exit/signal/timeout behavior, and cancels safely during cleanup
stops the VM before copy-back or credential/infrastructure teardown; recovery images remain authoritative on extraction failure
gives --keep-containers a safe Firecracker equivalent: quiesce/copy back first, then preserve jail, images, netns, and Compose infrastructure
rejects unsupported host access, DinD/split filesystems, extra mounts, remote Docker bridges, TTY, topology peers, and enclaves

Preview prerequisites

Linux x86_64/aarch64 with readable/writable KVM, a host-visible local Unix-socket Docker daemon, Firecracker/jailer v1.16.1, ip, nft, mke2fs, debugfs, e2fsck, and rsync. Kernel, rootfs, built AWF guest supervisor, Firecracker, and jailer must all be supplied with SHA-256 digests.

Validation

295 Jest suites / 4,581 tests
targeted Firecracker/runtime regression suite: 183 tests
TypeScript type-check
changed-file ESLint (0 errors; existing warnings only)
npm run build
guest supervisor go test ./...
guest supervisor reproducible Linux build plus checksum verification

Remaining layer 6 work

Broader KVM-backed CI, long-form operational/security documentation, release artifact workflow, rollout policy, and production enablement remain intentionally deferred to layer 6.

github-actions · 2026-08-09T02:51:29Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 01406f6

Copilot

Pull request overview

Integrates the Firecracker preview as an executable primary-agent runtime backed by Compose infrastructure and vsock transport.

Changes:

Adds runtime validation, artifact/tool preflight, and infrastructure discovery.
Implements VM execution, stdio forwarding, probing, cleanup, and preservation.
Adds supervisor configuration across CLI, schema, and documentation.

Show a summary per file

File	Description
`src/types/runtime-options.ts`	Adds supervisor artifact options.
`src/firecracker/runtime-validation.ts`	Validates Firecracker compatibility.
`src/firecracker/preflight.ts`	Checks artifacts and host tools.
`src/firecracker/preflight.test.ts`	Tests expanded preflight.
`src/firecracker/manager.ts`	Adds runtime controls and preservation.
`src/firecracker/manager.test.ts`	Tests preserved runtime state.
`src/firecracker/infrastructure.ts`	Discovers and validates Docker topology.
`src/firecracker/infrastructure.test.ts`	Tests topology validation.
`src/firecracker/config.test.ts`	Tests supervisor configuration.
`src/firecracker-runtime-backend.ts`	Implements Firecracker execution lifecycle.
`src/firecracker-runtime-backend.test.ts`	Tests backend execution and isolation.
`src/external-runtime-backend.ts`	Adds optional preservation lifecycle.
`src/external-runtime-backend.test.ts`	Updates preview-resolution tests.
`src/external-runtime-backend-resolver.ts`	Enforces preview opt-in.
`src/config-mapper.ts`	Maps supervisor settings.
`src/config-file.ts`	Extends file configuration typing.
`src/commands/validators/security-mode.ts`	Applies Firecracker topology security.
`src/commands/validators/config-assembly.ts`	Integrates runtime validation.
`src/commands/main-action.ts`	Coordinates preservation and cleanup.
`src/commands/build-config.ts`	Builds supervisor configuration.
`src/cli-options.ts`	Adds supervisor CLI flags.
`src/awf-config-schema.json`	Updates source schema.
`docs/awf-config.schema.json`	Updates published schema.
`docs/awf-config-spec.md`	Documents workload preview requirements.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 24/24 changed files
Comments generated: 5
Review effort level: Balanced

+    await this.dependencies.startInfrastructure(
+      workDir,
+      allowedDomains,
+      proxyLogsDir,
+      skipPull,
+      onNetworkReady,
+      onInfrastructureReady,
+    );


+    identity: () => ({
+      uid: Number(getSafeHostUid()),
+      gid: Number(getSafeHostGid()),
+    }),


+    const timeoutMs = agentTimeoutMinutes === undefined
+      ? undefined
+      : agentTimeoutMinutes * 60_000;


+    const onData = (chunk: Buffer | string): void => {
+      const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      void manager.writeStdin(data, requestId).catch((error) => {
+        this.dependencies.logger.warn(


+    const searchPath = process.env.PATH ?? '';
+    for (const directory of searchPath.split(path.delimiter)) {
+      if (!directory) continue;
+      try {
+        await fs.access(path.join(directory, tool), constants.X_OK);


github-actions · 2026-08-09T16:05:27Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-08-09T16:07:50Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.06%	92.23%	📉 -0.83%
Statements	91.94%	91.10%	📉 -0.84%
Functions	91.95%	90.46%	📉 -1.49%
Branches	84.70%	83.76%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	83.8% → 76.7% (-7.06%)	81.1% → 74.2% (-6.96%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	72.3% → 66.7% (-5.64%)	72.7% → 66.3% (-6.47%)
`src/commands/main-action.ts`	94.7% → 91.7% (-3.07%)	94.8% → 91.1% (-3.68%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T16:08:22Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.06%	92.23%	📉 -0.83%
Statements	91.94%	91.10%	📉 -0.84%
Functions	91.95%	90.46%	📉 -1.49%
Branches	84.70%	83.76%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	83.8% → 76.7% (-7.06%)	81.1% → 74.2% (-6.96%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	72.3% → 66.7% (-5.64%)	72.7% → 66.3% (-6.47%)
`src/commands/main-action.ts`	94.7% → 91.7% (-3.07%)	94.8% → 91.1% (-3.68%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T16:36:28Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.06%	92.23%	📉 -0.83%
Statements	91.94%	91.10%	📉 -0.84%
Functions	91.95%	90.46%	📉 -1.49%
Branches	84.70%	83.76%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	83.8% → 76.7% (-7.06%)	81.1% → 74.2% (-6.96%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	72.3% → 66.7% (-5.64%)	72.7% → 66.3% (-6.47%)
`src/commands/main-action.ts`	94.7% → 91.7% (-3.07%)	94.8% → 91.1% (-3.68%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T16:36:32Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.06%	92.23%	📉 -0.83%
Statements	91.94%	91.10%	📉 -0.84%
Functions	91.95%	90.46%	📉 -1.49%
Branches	84.70%	83.76%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	83.8% → 76.7% (-7.06%)	81.1% → 74.2% (-6.96%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	72.3% → 66.7% (-5.64%)	72.7% → 66.3% (-6.47%)
`src/commands/main-action.ts`	94.7% → 91.7% (-3.07%)	94.8% → 91.1% (-3.68%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T19:09:26Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.06%	92.26%	📉 -0.80%
Statements	91.93%	91.12%	📉 -0.81%
Functions	92.08%	90.67%	📉 -1.41%
Branches	84.78%	83.86%	📉 -0.92%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/manager.ts`	83.1% → 77.3% (-5.84%)	80.5% → 74.7% (-5.78%)
`src/firecracker/preflight.ts`	75.3% → 70.2% (-5.09%)	75.0% → 69.4% (-5.62%)
`src/commands/main-action.ts`	94.8% → 91.8% (-3.03%)	94.8% → 91.2% (-3.64%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T19:28:26Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.08%	92.26%	📉 -0.82%
Statements	91.95%	91.12%	📉 -0.83%
Functions	92.16%	90.67%	📉 -1.49%
Branches	84.80%	83.86%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	84.4% → 77.3% (-7.14%)	81.8% → 74.7% (-7.04%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	75.3% → 70.2% (-5.09%)	75.0% → 69.4% (-5.62%)
`src/commands/main-action.ts`	94.8% → 91.8% (-3.03%)	94.8% → 91.2% (-3.64%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T19:28:32Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.08%	92.26%	📉 -0.82%
Statements	91.95%	91.12%	📉 -0.83%
Functions	92.16%	90.67%	📉 -1.49%
Branches	84.80%	83.86%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	84.4% → 77.3% (-7.14%)	81.8% → 74.7% (-7.04%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	75.3% → 70.2% (-5.09%)	75.0% → 69.4% (-5.62%)
`src/commands/main-action.ts`	94.8% → 91.8% (-3.03%)	94.8% → 91.2% (-3.64%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T19:29:55Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.08%	92.26%	📉 -0.82%
Statements	91.95%	91.12%	📉 -0.83%
Functions	92.16%	90.67%	📉 -1.49%
Branches	84.80%	83.86%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	84.4% → 77.3% (-7.14%)	81.8% → 74.7% (-7.04%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	75.3% → 70.2% (-5.09%)	75.0% → 69.4% (-5.62%)
`src/commands/main-action.ts`	94.8% → 91.8% (-3.03%)	94.8% → 91.2% (-3.64%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T19:30:01Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.08%	92.26%	📉 -0.82%
Statements	91.95%	91.12%	📉 -0.83%
Functions	92.16%	90.67%	📉 -1.49%
Branches	84.80%	83.86%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	84.4% → 77.3% (-7.14%)	81.8% → 74.7% (-7.04%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	75.3% → 70.2% (-5.09%)	75.0% → 69.4% (-5.62%)
`src/commands/main-action.ts`	94.8% → 91.8% (-3.03%)	94.8% → 91.2% (-3.64%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T20:12:18Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.12%	92.30%	📉 -0.82%
Statements	92.00%	91.16%	📉 -0.84%
Functions	92.24%	90.74%	📉 -1.50%
Branches	84.84%	83.90%	📉 -0.94%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/config-assembly.ts`	100.0% → 69.7% (-30.31%)	100.0% → 69.7% (-30.31%)
`src/firecracker-runtime-backend.ts`	82.3% → 73.4% (-8.92%)	82.3% → 69.8% (-12.50%)
`src/firecracker/manager.ts`	85.1% → 77.8% (-7.22%)	83.0% → 75.8% (-7.19%)
`src/external-runtime-backend-resolver.ts`	100.0% → 93.8% (-6.25%)	100.0% → 93.8% (-6.25%)
`src/firecracker/preflight.ts`	75.3% → 70.2% (-5.09%)	75.0% → 69.4% (-5.62%)
`src/commands/main-action.ts`	94.8% → 91.8% (-3.03%)	94.8% → 91.2% (-3.64%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (2 files)

src/firecracker/infrastructure.ts: 74.6% lines
src/firecracker/runtime-validation.ts: 71.8% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-09T23:36:24Z

✅ Smoke Claude passed

Generated by Smoke Claude for #7136

github-actions · 2026-08-09T23:36:24Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-08-09T23:36:25Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-08-09T23:36:25Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-08-09T23:36:26Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-08-09T23:36:26Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-08-09T23:36:28Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-08-09T23:36:29Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-08-09T23:36:29Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-08-09T23:36:29Z

❌ Contribution Check failed. Please review the logs for details.

Generated by Contribution Check for #7136

github-actions · 2026-08-09T23:36:31Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

msfeed12.pkgs.visualstudio.com
msfeed17.pkgs.visualstudio.com
msfeed2.pkgs.visualstudio.com
msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed12.pkgs.visualstudio.com"
    - "msfeed17.pkgs.visualstudio.com"
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-08-09T23:36:31Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-08-09T23:36:34Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-08-09T23:36:35Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-08-09T23:37:52Z

@lpcox Network isolation egress smoke test results:

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) reachable — HTTP 200
✅ Blocked domain (example.com) denied — CONNECT tunnel failed, 403

Overall status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:38:03Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #7136 · haiku45 · 59.7 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:38:10Z

Smoke Test: Copilot BYOK (Direct) Mode

Recent merged PRs:

[docs] auth: Mark gh-aw#50053 MCP OIDC boundary work as resolved #7156: [docs] auth: Mark gh-aw#50053 MCP OIDC boundary work as resolved
Drive Google provider adapters (Gemini, Vertex) from declarative specs #7153: Drive Google provider adapters (Gemini, Vertex) from declarative specs
GitHub MCP connectivity: ✅
GitHub.com connectivity (HTTP 200): ✅
File write/read test: ✅
BYOK inference test (agent → api-proxy → api.githubcopilot.com): ✅

Note: Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:38:25Z

Smoke Test: Copilot Engine

✅ GitHub MCP: PR [docs] auth: Mark gh-aw#50053 MCP OIDC boundary work as resolved #7156 confirmed
✅ github.com connectivity (HTTP 200)
✅ File write/read test passed

Overall: PASS

PRs checked: #7156 [docs] auth: Mark gh-aw#50053 MCP OIDC boundary work as resolved, #7153 Drive Google provider adapters (Gemini, Vertex) from declarative specs

cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:38:35Z

Smoke Test Results: GitHub Actions Services Connectivity

Redis PING: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name "host.docker.internal")

Overall: FAIL — host.docker.internal did not resolve from the sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:40:04Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	YES
Node.js	v24.18.0	v22.23.2	NO
Go	go1.22.12	go1.22.12	YES

Overall: FAILED - Node.js version differs between host and chroot environments. smoke-chroot label not applied since not all versions matched.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:40:55Z

Smoke Test: API Proxy OTEL Tracing — Results

✅ Scenario 1 (Module Loading): otel.js loads successfully; isEnabled() → true; exports include startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled.
✅ Scenario 2 (Test Suite): npx jest --testPathPatterns=otel → 3 suites / 68 tests passed, 0 failed.
✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and both trace-context vars to api-proxy.
✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js contains the onUsage callback hook point for OTEL.
✅ Scenario 5 (OTEL Diagnostics): /tmp/gh-aw/otel.jsonl contains an exported span (gh-aw.agent.setup) with correct traceId/parentSpanId and workflow resource attributes, confirming OTLP export succeeded during this run.

Overall: All 5 scenarios passed. No issues found.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:41:20Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (ran ok)	✅ PASS
.NET	json-parse	✅	N/A (ran ok)	✅ PASS
Go	color	✅	pass	✅ PASS
Go	env	✅	pass	✅ PASS
Go	uuid	✅	pass	✅ PASS
Java	gson	✅	pass	✅ PASS
Java	caffeine	✅	pass	✅ PASS
Node.js	clsx	✅	pass	✅ PASS
Node.js	execa	✅	pass	✅ PASS
Node.js	p-limit	✅	pass	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java tests required -Dmaven.repo.local pointing to a writable directory since ~/.m2/repository was pre-existing and root-owned in this sandbox (unrelated to the firewall). Proxy settings in ~/.m2/settings.xml worked as expected.

Generated by Build Test Suite for #7136 · auto · 55.9 AIC · ⊞ 11.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:41:21Z

Smoke Test: Docker Sbx — PASS ✅

✅ GitHub MCP connectivity confirmed
✅ github.com connectivity (HTTP 200)
✅ File write/read test passed

PR #7156: Mark gh-aw#50053 MCP OIDC boundary work as resolved
PR #7153: Drive Google provider adapters (Gemini, Vertex) from declarative specs

Overall status: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T23:41:24Z

Smoke test on PR #7136
PRs reviewed: feat: add Firecracker guest execution transport; Enforce isolated networking for Firecracker
Merged PR review: ✅
safeinputs-gh PR query: ❌
Playwright GitHub title: ✅
Temp file write/read: ✅
Discussion query/comment: ❌
AWF build (npm ci && npm run build): ❌ (403 fetching yocto-queue-0.1.0.tgz)
Overall: FAIL

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

msfeed12.pkgs.visualstudio.com
msfeed17.pkgs.visualstudio.com
msfeed2.pkgs.visualstudio.com
msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed12.pkgs.visualstudio.com"
    - "msfeed17.pkgs.visualstudio.com"
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

Copilot AI balanced review requested due to automatic review settings August 9, 2026 02:51

Copilot started reviewing on behalf of lpcox August 9, 2026 02:51 View session

Copilot AI reviewed Aug 9, 2026

View reviewed changes

lpcox mentioned this pull request Aug 9, 2026

feat: complete Firecracker preview rollout coverage #7138

Open

lpcox force-pushed the lpcox-firecracker-runtime-integration branch from 7e92edc to 40bab00 Compare August 9, 2026 16:05

lpcox force-pushed the lpcox-firecracker-runtime-integration branch from 40bab00 to 68bcff3 Compare August 9, 2026 16:33

lpcox force-pushed the lpcox-firecracker-runtime-integration branch from 68bcff3 to d72644b Compare August 9, 2026 19:06

lpcox changed the title ~~Integrate Firecracker primary-agent runtime preview~~ feat: integrate Firecracker primary-agent runtime preview Aug 9, 2026

lpcox force-pushed the lpcox-firecracker-runtime-integration branch from d72644b to 27842a4 Compare August 9, 2026 19:25

lpcox force-pushed the lpcox-firecracker-runtime-integration branch from 27842a4 to 10ac870 Compare August 9, 2026 19:26

lpcox force-pushed the lpcox-firecracker-runtime-integration branch from 10ac870 to 064a910 Compare August 9, 2026 20:09

lpcox force-pushed the lpcox-firecracker-runtime-integration branch from 064a910 to 57e9624 Compare August 9, 2026 20:29

lpcox had a problem deploying to aoai-model August 9, 2026 23:36 — with GitHub Actions Failure

lpcox temporarily deployed to aoai-model August 9, 2026 23:38 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Aug 9, 2026

[aw] Smoke Gemini hit engine rate limit (HTTP 429) #7168

Open

lpcox merged commit 09fccf4 into main Aug 10, 2026
137 of 141 checks passed

lpcox deleted the lpcox-firecracker-runtime-integration branch August 10, 2026 00:05

Uh oh!

Conversation

lpcox commented Aug 9, 2026

Stack

Summary

Preview prerequisites

Validation

Remaining layer 6 work

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading