Skip to content

feat: add unified enclave foundation - #6986

Merged
lpcox merged 2 commits into
mainfrom
lpcox-enclave-foundation
Aug 7, 2026
Merged

feat: add unified enclave foundation#6986
lpcox merged 2 commits into
mainfrom
lpcox-enclave-foundation

Conversation

@lpcox

@lpcox lpcox commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Summary

Stack layer 1 introduces the behavior-preserving foundation for migrating boundedQueries and boundedAgents to AWF-owned MCP enclaves guarded by gh-aw-mcpg.

  • adds strict unified enclaves configuration, normalization, build wiring, and preflight contracts
  • centralizes shared repository sensitivity and one cross-executor information-budget ledger model
  • exposes neutral finite-disclosure and staging compatibility primitives without changing legacy runtime behavior
  • documents target trust boundaries, readiness ordering, and the migration sequence
  • rejects configurations that enable unified enclaves together with either legacy subsystem

Stack

Layer 1 of the greenfield enclave migration. This PR targets main and does not start layer 2.

Validation

  • tsc --noEmit -p tsconfig.check.json
  • tsc
  • 130 targeted Jest tests covering enclave budgets/preflight, config mapping/building, and bounded-execution compatibility
  • generated schema copy and placement verification

Full dependency restoration, Ajv-backed schema tests, and ESLint were unavailable earlier because of session sandbox/network policy; the committed targeted suite and TypeScript validations pass.

Copilot AI balanced review requested due to automatic review settings August 6, 2026 14:33
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 0853786

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric Base PR Delta
Lines 98.90% 98.71% 📉 -0.19%
Statements 98.79% 98.48% 📉 -0.31%
Functions 99.10% 98.67% 📉 -0.43%
Branches 94.99% 94.54% 📉 -0.45%
📁 Per-file Coverage Changes (2 files)
File Lines (Before → After) Statements (Before → After)
src/commands/build-config.ts 97.3% → 97.4% (+0.07%) 97.3% → 97.4% (+0.07%)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)
✨ New Files (4 files)
  • src/enclave/information-budget.ts: 100.0% lines
  • src/enclave/preflight.ts: 66.7% lines
  • src/parsers/enclave-parser.ts: 100.0% lines
  • src/types/enclave-options.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds the configuration and shared-contract foundation for migrating legacy bounded execution to unified enclaves, without activating the new runtime.

Changes:

  • Adds enclave configuration, schema, normalization, and preflight contracts.
  • Introduces shared repository sensitivity and information-budget primitives.
  • Documents the target architecture and migration sequence.
Show a summary per file
File Description
src/types/wrapper-config.ts Adds enclave options to wrapper configuration.
src/types/index.ts Exports enclave types and defaults.
src/types/enclave-options.ts Defines unified enclave configuration.
src/types/bounded-query-options.ts Reuses shared sensitivity definitions.
src/schema.test.ts Updates schema property coverage.
src/parsers/enclave-parser.ts Normalizes enclave configuration.
src/parsers/enclave-parser.test.ts Tests normalization and schema constraints.
src/enclave/preflight.ts Adds static enclave validation.
src/enclave/preflight.test.ts Tests enclave preflight checks.
src/enclave/information-budget.ts Implements the shared budget ledger.
src/enclave/information-budget.test.ts Tests policy parity and shared balances.
src/config-mapper.ts Maps trusted enclave configuration.
src/config-file.ts Adds raw configuration and legacy conflict checks.
src/config-file-mapping.test.ts Tests enclave mapping.
src/commands/build-config.ts Builds normalized enclave configuration.
src/commands/build-config.test.ts Tests configuration assembly.
src/bounded-execution/repository-staging.ts Adds canonical repository keys and shared sensitivity.
src/bounded-execution/index.ts Exports unified budget primitives.
src/bounded-execution/finite-disclosure.ts Adds neutral compatibility aliases.
src/awf-config-schema.json Adds the runtime enclave schema.
docs/enclaves-architecture.md Documents architecture and migration.
docs/awf-config.schema.json Adds the published enclave schema.
docs/awf-config-spec.md Documents enclave configuration semantics.
containers/bounded-query/bounded-execution/sensitivity-policy.js Updates shared-policy documentation.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 24/24 changed files
  • Comments generated: 3
  • Review effort level: Balanced

Comment thread src/enclave/preflight.ts
Comment thread src/types/enclave-options.ts Outdated
Comment thread src/enclave/preflight.ts
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric Base PR Delta
Lines 98.90% 98.71% 📉 -0.19%
Statements 98.79% 98.48% 📉 -0.31%
Functions 99.10% 98.67% 📉 -0.43%
Branches 94.99% 94.54% 📉 -0.45%
📁 Per-file Coverage Changes (2 files)
File Lines (Before → After) Statements (Before → After)
src/commands/build-config.ts 97.3% → 97.4% (+0.07%) 97.3% → 97.4% (+0.07%)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)
✨ New Files (4 files)
  • src/enclave/information-budget.ts: 100.0% lines
  • src/enclave/preflight.ts: 66.7% lines
  • src/parsers/enclave-parser.ts: 100.0% lines
  • src/types/enclave-options.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 5da2e8c6-bddd-4f94-84c2-862ab467e4bf
@lpcox
lpcox force-pushed the lpcox-enclave-foundation branch from 6564a56 to ed02417 Compare August 7, 2026 01:42
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric Base PR Delta
Lines 98.90% 98.71% 📉 -0.19%
Statements 98.79% 98.48% 📉 -0.31%
Functions 99.10% 98.67% 📉 -0.43%
Branches 94.99% 94.54% 📉 -0.45%
📁 Per-file Coverage Changes (2 files)
File Lines (Before → After) Statements (Before → After)
src/commands/build-config.ts 97.3% → 97.4% (+0.07%) 97.3% → 97.4% (+0.07%)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)
✨ New Files (4 files)
  • src/enclave/information-budget.ts: 100.0% lines
  • src/enclave/preflight.ts: 66.7% lines
  • src/parsers/enclave-parser.ts: 100.0% lines
  • src/types/enclave-options.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

@lpcox lpcox changed the title Add unified enclave foundation feat: add unified enclave foundation Aug 7, 2026
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric Base PR Delta
Lines 98.90% 98.94% 📈 +0.04%
Statements 98.79% 98.80% ➡️ +0.01%
Functions 99.10% 98.67% 📉 -0.43%
Branches 94.99% 95.06% 📈 +0.07%
📁 Per-file Coverage Changes (2 files)
File Lines (Before → After) Statements (Before → After)
src/commands/build-config.ts 97.3% → 97.4% (+0.07%) 97.3% → 97.4% (+0.07%)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)
✨ New Files (4 files)
  • src/enclave/information-budget.ts: 100.0% lines
  • src/enclave/preflight.ts: 100.0% lines
  • src/parsers/enclave-parser.ts: 100.0% lines
  • src/types/enclave-options.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Contribution Check failed. Please review the logs for details.

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Claude passed

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Security Guard completed successfully!

Security review of PR #6986 complete: no security issues found. The PR updates comments in containers/bounded-query/bounded-execution/sensitivity-policy.js to reflect enclave refactoring, renaming references from BOUNDED_QUERY_SENSITIVITY_RUN_BITS to ENCLAVE_SENSITIVITY_RUN_BITS. This is a documentation-only change with no modifications to firewall rules, capabilities, ACLs, network policies, or credential handling. All security controls remain intact.

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

🔌 Smoke Services is testing service connectivity for this pull request...

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Build Test Suite completed successfully!

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Gemini completed. All facets verified. 💎

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Claude Engine Validation

Check Result
API status ✅ PASS
gh check ✅ PASS
File status ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #6986 · haiku45 · 60.4 AIC · ⊞ 3.6K ·
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot BYOK (Direct) Mode

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot Engine@lpcox

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com): allowed=200
✅ Blocked domain (example.com): 403 CONNECT tunnel failed → blocked

Overall status: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
Add label ready-for-aw to run again

@github-actions github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 7, 2026
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario Result
1. Module Loading otel.js loaded successfully, isEnabled()=true, exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled
2. Test Suite ✅ 3 suites / 68 tests passed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js)
3. Env Var Forwarding env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and trace context
4. Token Tracker Integration onUsage callback present in token-tracker-http.js (4 occurrences) as OTEL hook point
5. OTEL Diagnostics otel.jsonl contains exported spans (e.g. gh-aw.agent.setup) with valid traceId/spanId matching workflow trace context

Overall: ✅ All scenarios passed.

📡 OTel tracing validated by Smoke OTel Tracing
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Gemini Engine Validation

Overall Status: FAIL

💎 Faceted by Smoke Gemini
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Chroot Version Comparison Results

Runtime Host Version Chroot Version Match?
Python Python 3.12.13 Python 3.12.13 ✅ YES
Node.js v24.18.0 v22.23.2 ❌ NO
Go go1.22.12 go1.22.12 ✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environment. smoke-chroot label not applied since not all tests passed.

Tested by Smoke Chroot
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia 1/1 passed ✅ PASS
Bun hono 1/1 passed ✅ PASS
C++ fmt N/A ✅ PASS
C++ json N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world N/A ✅ PASS
.NET json-parse N/A ✅ PASS
Go color passed ✅ PASS
Go env passed ✅ PASS
Go uuid passed ✅ PASS
Java gson 1/1 passed ✅ PASS
Java caffeine 1/1 passed ✅ PASS
Node.js clsx passed ✅ PASS
Node.js execa passed ✅ PASS
Node.js p-limit passed ✅ PASS
Rust fd 0/0 (no tests) ✅ PASS
Rust zoxide 0/0 (no tests) ✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java initially failed with Could not create local repository at /home/runner/.m2/repository because ~/.m2 was pre-existing and owned by root in this sandbox (unrelated to the firewall/proxy). Worked around by pointing Maven at an alternate writable local repo (-Dmaven.repo.local); proxy settings (squid-proxy:3128) worked correctly once the repo path was writable.

Generated by Build Test Suite for #6986 · auto · 45.3 AIC · ⊞ 11.6K ·
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Docker Sbx@lpcox

  • ✅ GitHub MCP connectivity
  • ✅ GitHub.com connectivity (HTTP 200)
  • ✅ File write/read test

Recent merged PRs:

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
Add label ready-for-aw to run again

@lpcox
lpcox merged commit 2d300ea into main Aug 7, 2026
139 of 144 checks passed
@lpcox
lpcox deleted the lpcox-enclave-foundation branch August 7, 2026 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants