Compile unified AWF enclaves through mcpg by lpcox · Pull Request #50920 · github/gh-aw

lpcox · 2026-08-06T20:10:15Z

Summary

add top-level enclaves compiler/frontmatter support aligned with the unified firewall schema
register only enabled enclave_run_script / enclave_run_agent tools on the synthetic awf-enclave HTTP upstream
launch mcpg first in bridge mode with a run identity label, per-server connect/tool timeouts, and AWF topology attachment
generate and mask a fresh 64-hex capability, forward it to mcpg by environment name, hand it to AWF, and exclude all enclave handoff variables from the primary agent
reject enclaves without AWF network isolation or alongside legacy bounded queries
document configuration and add script-only, agent-only, combined, disabled, timeout, handoff/redaction, validation, and startup-ordering coverage

Example

enclaves:
  enabled: true
  private-repos:
    - repo: octo-org/private-service
      sensitivity: confidential
  executors:
    script:
      enabled: true
      timeout: 45
    agent:
      enabled: true
      model: gpt-5
      timeout: 180

sandbox:
  agent:
    id: awf
    sudo: false

This produces the awf-enclave upstream at http://awf-enclave-mcp:8080/mcp, connectTimeout: 120, and toolTimeout: 210.

Dependency

This is the gh-aw compiler prerequisite for github/gh-aw-firewall#6992. The current default AWF release (v0.27.44) predates unified enclaves; firewall final removal of boundedQueries / boundedAgents must wait for this compiler PR, and enclave workflows require the release containing #6992.

The integration targets mcpg v0.4.8. Its HTTP transport connects lazily, does not cache failed connection attempts, and retries on later readiness requests, so mcpg may start before the AWF-owned enclave upstream without compiler-owned restart logic.

Validation

make agent-report-progress
go test ./pkg/parser ./pkg/workflow -count=1

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.3 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.52 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.7 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.6 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

@copilot Please triage this PR, refresh the branch if possible, and run the pr-finisher skill before handing back to maintainers.

Branch refresh is requested if GitHub can update it cleanly.

Run context: https://github.com/github/gh-aw/actions/runs/31183485569> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.6 AIC · ⊞ 5.9K · ◷

_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 22 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.99 AIC · ⊞ 8.4K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.54 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.98 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 16.4 AIC · ⌖ 6.83 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.3 AIC · ⌖ 5.36 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Compile AWF-owned script and agent enclaves through mcpg with run-scoped capability handoff, timeout derivation, network validation, schemas, tests, and documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

gh-aw-bot · 2026-08-06T22:12:16Z

@copilot Please refresh this PR branch if needed and run the pr-finisher skill before handing back to maintainers. Copilot review appears to have errored earlier, so please re-check reviewer feedback state as part of triage.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.3 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-06T22:25:24Z

@copilot Please refresh this PR branch if needed and run the pr-finisher skill before handing back to maintainers. Copilot review appears to have errored earlier, so please re-check reviewer feedbac...

PR finisher complete. Local validation passed (make fmt, make lint, make test-unit all green). No unresolved review threads — the copilot-pull-request-reviewer errored without leaving code review comments, so there is nothing to address. The PR is open, not draft, with no merge conflicts. CI must be re-triggered by a maintainer (close/reopen or push) before merge.

github-actions · 2026-08-06T22:47:10Z

Nice work on the enclave compiler integration! 🎯

This PR looks solid:

✅ Focused scope — all changes align with unified AWF enclave compilation through mcpg
✅ Well-tested — comprehensive test coverage in enclaves_test.go (183 lines)
✅ Clear documentation — new docs/src/content/docs/reference/enclaves.md with configuration examples
✅ Complete description — includes summary, working example, dependencies, and validation steps

The PR properly addresses the AWF integration prerequisite per the firewall schema alignment, and the inline agentic workflow attribution is noted. Ready for review! 🚀

Generated by ✅ Contribution Check · auto · 55.1 AIC · ⊞ 8.7K · ◷

gh-aw-bot · 2026-08-07T01:08:04Z

@copilot Please triage this PR and run the pr-finisher skill before handing back to maintainers.

Refresh the branch if needed.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.52 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-07T01:18:18Z

@copilot Please triage this PR and run the pr-finisher skill before handing back to maintainers.

Refresh the branch if needed....

PR finisher complete.

✅ Reviews — No unresolved review threads. The copilot-pull-request-reviewer check ran successfully on the latest head; the earlier error was on a stale SHA. No code review comments were left.
✅ Checks (local) — make fmt, make lint, make test-unit all pass locally.
❓ Checks (CI) — Stale after agent push; needs human re-trigger. Three runs show action_required (CGO, CWI, Doc Build) — these are deployment-approval gates, not failures (zero failed jobs). No code-level CI failures were identified.
✅ Mergeable — PR is open, not draft, no merge conflicts.

Actions taken: Local validation confirmed green. No code changes needed.
Hand-off: A maintainer should re-trigger CI (close/reopen PR or push) and approve pending deployment gates before merge.

gh-aw-bot · 2026-08-07T01:58:23Z

@copilot Please triage this PR and run the pr-finisher skill before handing back to maintainers.

Refresh the branch if needed.

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.7 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-07T02:03:02Z

@copilot Please triage this PR and run the pr-finisher skill before handing back to maintainers.

Refresh the branch if needed....

PR finisher complete (second pass, no changes needed).

✅ Reviews — No unresolved review threads.
✅ Checks (local) — make fmt, make lint, make test-unit all confirmed green in the prior pass; no code changes since then.
❓ Checks (CI) — CGO, CWI, and Doc Build show action_required consistently across multiple SHAs — these are deployment-approval gates, not code failures. No failed jobs in any of these runs.
✅ Mergeable — PR is open, not draft, no conflicts.

Hand-off: A maintainer needs to approve the pending deployment gates (CGO/CWI/Doc Build) to unblock merge.

gh-aw-bot · 2026-08-07T04:10:40Z

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

Branch refresh was requested.

Copilot review appears to have errored earlier, so please re-check reviewer feedback state as part of triage.

Run context: https://github.com/github/gh-aw/actions/runs/31146242452

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-07T04:15:19Z

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

Branch refresh was requested....

Branch has been refreshed (merged with main at 1b3bb88). PR finisher complete.

✅ Reviews — No unresolved review threads.
✅ Checks (local) — make fmt, make lint, make test-unit all green (confirmed in prior passes; no code changes since).
❓ Checks (CI) — CGO, CWI, and Doc Build show action_required on the latest SHA 1b3bb88 — these are deployment-approval gates, not code failures (zero failed jobs across all runs).
✅ Mergeable — PR is open, not draft, branch is up to date with main.

Hand-off: A maintainer needs to approve the pending deployment gates (CGO/CWI/Doc Build) to unblock merge.

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-07T20:59:15Z

@copilot This PR has merge conflicts. Please run make merge-main to resolve conflicts, then run the pr-finisher skill and push any resulting fixes.

Run: https://github.com/github/gh-aw/actions/ru...

Merge conflicts resolved in b55c1f9. The conflicts were in pkg/workflow/awf_env.go (enclave env-var exclusion block) and pkg/workflow/awf_feature_flags_test.go (import ordering). All checks pass: make fmt, make recompile, make test-unit.

gh-aw-bot · 2026-08-07T21:30:38Z

@copilot Quick triage nudge for this PR.

Please refresh the branch, address any remaining review feedback, run the pr-finisher skill, and push follow-up fixes.

no recorded failed checks in compact candidate data

Run: https://github.com/github/gh-aw/actions/runs/31219864512

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-07T21:39:44Z

@copilot Quick triage nudge for this PR.

Please refresh the branch, address any remaining review feedback, run the pr-finisher skill, and push follow-up fixes....

Branch is already up to date with main (HEAD d9d5c26). No unresolved review threads. make fmt, make lint, make recompile, and make test-unit all pass locally. A maintainer needs to approve the pending deployment gates (CGO/CWI/Doc Build) before merge.

gh-aw-bot · 2026-08-07T22:15:14Z

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address any remaining review feedback, run the pr-finisher skill, and push follow-up fixes.

Open review context (newest first):

Copilot review status Re-check reviewer feedback state because copilot-pull-request-reviewer previously errored and left no actionable code review comments.

Branch refresh was requested.

Run: https://github.com/github/gh-aw/actions/runs/31222749409

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.98 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-07T22:23:53Z

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address any remaining review feedback, run the pr-finisher skill, and push follow-up fixes....

Branch refreshed with main (HEAD 0dbd761). No unresolved review threads — copilot-pull-request-reviewer has not left any actionable code review comments. make fmt, make lint, make recompile, and make test-unit all pass. A maintainer needs to approve the pending deployment gates (CGO/CWI/Doc Build) before merge.

gh-aw-bot · 2026-08-08T01:51:47Z

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-check reviewer feedback state, and run the pr-finisher skill before handing back to maintainers.

Open items (newest first):

no recorded failed checks in compact candidate data
re-confirm whether any maintainer-facing follow-up remains beyond approvals / workflow gates

Branch refresh was requested.

Run: https://github.com/github/gh-aw/actions/runs/31233305116

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 16.4 AIC · ⌖ 6.83 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-08T02:00:30Z

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-check reviewer feedback state, and run the pr-finisher skill before handing back to maintainer...

Branch refreshed with main (HEAD c9612d3). No unresolved review threads — copilot-pull-request-reviewer has not left any actionable comments. make fmt, make lint, make recompile, and make test-unit all pass. No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build).

gh-aw-bot · 2026-08-08T02:37:18Z

@copilot Quick triage nudge for this PR.

Please re-check reviewer feedback state, confirm whether anything remains besides deployment approvals, and run the pr-finisher skill before handing back to maintainers.

Open items (newest first):

no recorded failed checks in compact candidate data
re-confirm whether any maintainer-facing follow-up remains beyond approvals / workflow gates

Run: https://github.com/github/gh-aw/actions/runs/31235166066

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.94 AIC · ⌖ 5.23 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-08T02:50:53Z

@copilot Quick triage nudge for this PR.

Please re-check reviewer feedback state, confirm whether anything remains besides deployment approvals, and run the pr-finisher skill before handing back to...

PR finisher complete.

✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
✅ Checks (local) — make fmt, make lint, make recompile (283/283 workflows compiled), and make test-unit-all all pass.
✅ Branch — Already up to date with main (HEAD c9612d3); no refresh needed.
❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build) before merge.

gh-aw-bot · 2026-08-08T03:57:13Z

@copilot Quick triage nudge for this PR.

Please re-check reviewer feedback state, confirm whether anything remains beyond deployment approvals, and run the pr-finisher skill before handing back to maintainers.

Open items (newest first):

no recorded failed checks in compact candidate data
re-confirm whether any maintainer-facing follow-up remains beyond approvals / workflow gates

Run: https://github.com/github/gh-aw/actions/runs/31238095490

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.3 AIC · ⌖ 5.36 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-08T04:10:28Z

@copilot Quick triage nudge for this PR.

Please re-check reviewer feedback state, confirm whether anything remains beyond deployment approvals, and run the pr-finisher skill before handing back to ...

PR finisher complete.

✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
✅ Checks (local) — make fmt, make lint, make recompile (283/283 workflows compiled), and make test-unit-all all pass.
✅ Branch — Refreshed with latest main (HEAD bf3b439).
❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build) before merge.

Add unified enclave MCP compiler support

abd3a3d

Compile AWF-owned script and agent enclaves through mcpg with run-scoped capability handoff, timeout derivation, network validation, schemas, tests, and documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings August 6, 2026 20:10

Copilot AI reviewed Aug 6, 2026

Copilot started reviewing on behalf of lpcox August 6, 2026 21:22 View session

github-actions Bot mentioned this pull request Aug 6, 2026

[pr-sous-chef] PR Sous Chef run report #50715

Closed

Copilot started work on behalf of gh-aw-bot August 6, 2026 22:12 View session

Copilot AI requested a review from gh-aw-bot August 6, 2026 22:25

Copilot finished work on behalf of gh-aw-bot August 6, 2026 22:25

lpcox mentioned this pull request Aug 6, 2026

refactor: remove legacy bounded execution in favor of MCP enclaves github/gh-aw-firewall#6994

Merged

github-actions Bot mentioned this pull request Aug 6, 2026

[Contribution Check Report] Contribution Check — 2026-08-06 #50732

Closed

pelikhan and others added 2 commits August 6, 2026 16:30

Merge branch 'main' into lpcox-compile-enclave-mcp

ac4ef20

Merge branch 'main' into lpcox-compile-enclave-mcp

a4cd10d

github-actions Bot mentioned this pull request Aug 7, 2026

[pr-sous-chef] PR Sous Chef run report #50950

Closed

Copilot started work on behalf of gh-aw-bot August 7, 2026 01:08 View session

github-actions Bot mentioned this pull request Aug 7, 2026

[Outcome Report] Workflow Health Report — 2026-08-07 #50955

Open

Copilot finished work on behalf of gh-aw-bot August 7, 2026 01:18

Merge branch 'main' into lpcox-compile-enclave-mcp

2d573f6

Copilot started work on behalf of gh-aw-bot August 7, 2026 01:59 View session

Copilot finished work on behalf of gh-aw-bot August 7, 2026 02:03

Merge branch 'main' into lpcox-compile-enclave-mcp

1b3bb88

Copilot started work on behalf of gh-aw-bot August 7, 2026 04:10 View session

Copilot finished work on behalf of gh-aw-bot August 7, 2026 20:49

Copilot started work on behalf of gh-aw-bot August 7, 2026 20:49 View session

Merge main into lpcox-compile-enclave-mcp, resolve awf_env.go conflicts

b55c1f9

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 7, 2026 20:59

Merge branch 'main' into lpcox-compile-enclave-mcp

d9d5c26

Copilot started work on behalf of gh-aw-bot August 7, 2026 21:30 View session

Copilot finished work on behalf of gh-aw-bot August 7, 2026 21:40

Merge branch 'main' into lpcox-compile-enclave-mcp

0dbd761

Copilot started work on behalf of gh-aw-bot August 7, 2026 22:15 View session

Copilot finished work on behalf of gh-aw-bot August 7, 2026 22:24

github-actions Bot mentioned this pull request Aug 8, 2026

[pr-sous-chef] PR Sous Chef run report (2026-08-08T00:07:20Z) #51239

Open

Merge branch 'main' into lpcox-compile-enclave-mcp

c9612d3

Copilot started work on behalf of gh-aw-bot August 8, 2026 01:52 View session

Copilot finished work on behalf of gh-aw-bot August 8, 2026 02:00

Copilot started work on behalf of gh-aw-bot August 8, 2026 02:37 View session

Copilot finished work on behalf of gh-aw-bot August 8, 2026 02:51

Merge branch 'main' into lpcox-compile-enclave-mcp

bf3b439

Copilot started work on behalf of gh-aw-bot August 8, 2026 03:57 View session

Copilot finished work on behalf of gh-aw-bot August 8, 2026 04:10

Uh oh!

Conversation

lpcox commented Aug 6, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Example

Dependency

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Aug 6, 2026

Uh oh!

Copilot AI commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

gh-aw-bot commented Aug 7, 2026

Uh oh!

Copilot AI commented Aug 7, 2026

Uh oh!

gh-aw-bot commented Aug 7, 2026

Uh oh!

Copilot AI commented Aug 7, 2026

Uh oh!

gh-aw-bot commented Aug 7, 2026

Uh oh!

Copilot AI commented Aug 7, 2026

Uh oh!

Copilot AI commented Aug 7, 2026

Uh oh!

gh-aw-bot commented Aug 7, 2026

Uh oh!

Copilot AI commented Aug 7, 2026

Uh oh!

gh-aw-bot commented Aug 7, 2026

Uh oh!

Copilot AI commented Aug 7, 2026

Uh oh!

gh-aw-bot commented Aug 8, 2026

Uh oh!

Copilot AI commented Aug 8, 2026

Uh oh!

gh-aw-bot commented Aug 8, 2026

Uh oh!

Copilot AI commented Aug 8, 2026

Uh oh!

gh-aw-bot commented Aug 8, 2026

Uh oh!

Copilot AI commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

lpcox commented Aug 6, 2026 •

edited by github-actions Bot

Loading