feat: add unified enclave foundation - #6986
Conversation
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.90% | 98.71% | 📉 -0.19% |
| Statements | 98.79% | 98.48% | 📉 -0.31% |
| Functions | 99.10% | 98.67% | 📉 -0.43% |
| Branches | 94.99% | 94.54% | 📉 -0.45% |
📁 Per-file Coverage Changes (2 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/commands/build-config.ts |
97.3% → 97.4% (+0.07%) | 97.3% → 97.4% (+0.07%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (4 files)
src/enclave/information-budget.ts: 100.0% linessrc/enclave/preflight.ts: 66.7% linessrc/parsers/enclave-parser.ts: 100.0% linessrc/types/enclave-options.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
There was a problem hiding this comment.
Pull request overview
Adds the configuration and shared-contract foundation for migrating legacy bounded execution to unified enclaves, without activating the new runtime.
Changes:
- Adds enclave configuration, schema, normalization, and preflight contracts.
- Introduces shared repository sensitivity and information-budget primitives.
- Documents the target architecture and migration sequence.
Show a summary per file
| File | Description |
|---|---|
src/types/wrapper-config.ts |
Adds enclave options to wrapper configuration. |
src/types/index.ts |
Exports enclave types and defaults. |
src/types/enclave-options.ts |
Defines unified enclave configuration. |
src/types/bounded-query-options.ts |
Reuses shared sensitivity definitions. |
src/schema.test.ts |
Updates schema property coverage. |
src/parsers/enclave-parser.ts |
Normalizes enclave configuration. |
src/parsers/enclave-parser.test.ts |
Tests normalization and schema constraints. |
src/enclave/preflight.ts |
Adds static enclave validation. |
src/enclave/preflight.test.ts |
Tests enclave preflight checks. |
src/enclave/information-budget.ts |
Implements the shared budget ledger. |
src/enclave/information-budget.test.ts |
Tests policy parity and shared balances. |
src/config-mapper.ts |
Maps trusted enclave configuration. |
src/config-file.ts |
Adds raw configuration and legacy conflict checks. |
src/config-file-mapping.test.ts |
Tests enclave mapping. |
src/commands/build-config.ts |
Builds normalized enclave configuration. |
src/commands/build-config.test.ts |
Tests configuration assembly. |
src/bounded-execution/repository-staging.ts |
Adds canonical repository keys and shared sensitivity. |
src/bounded-execution/index.ts |
Exports unified budget primitives. |
src/bounded-execution/finite-disclosure.ts |
Adds neutral compatibility aliases. |
src/awf-config-schema.json |
Adds the runtime enclave schema. |
docs/enclaves-architecture.md |
Documents architecture and migration. |
docs/awf-config.schema.json |
Adds the published enclave schema. |
docs/awf-config-spec.md |
Documents enclave configuration semantics. |
containers/bounded-query/bounded-execution/sensitivity-policy.js |
Updates shared-policy documentation. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 24/24 changed files
- Comments generated: 3
- Review effort level: Balanced
44e9992 to
6564a56
Compare
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.90% | 98.71% | 📉 -0.19% |
| Statements | 98.79% | 98.48% | 📉 -0.31% |
| Functions | 99.10% | 98.67% | 📉 -0.43% |
| Branches | 94.99% | 94.54% | 📉 -0.45% |
📁 Per-file Coverage Changes (2 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/commands/build-config.ts |
97.3% → 97.4% (+0.07%) | 97.3% → 97.4% (+0.07%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (4 files)
src/enclave/information-budget.ts: 100.0% linessrc/enclave/preflight.ts: 66.7% linessrc/parsers/enclave-parser.ts: 100.0% linessrc/types/enclave-options.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5da2e8c6-bddd-4f94-84c2-862ab467e4bf
6564a56 to
ed02417
Compare
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.90% | 98.71% | 📉 -0.19% |
| Statements | 98.79% | 98.48% | 📉 -0.31% |
| Functions | 99.10% | 98.67% | 📉 -0.43% |
| Branches | 94.99% | 94.54% | 📉 -0.45% |
📁 Per-file Coverage Changes (2 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/commands/build-config.ts |
97.3% → 97.4% (+0.07%) | 97.3% → 97.4% (+0.07%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (4 files)
src/enclave/information-budget.ts: 100.0% linessrc/enclave/preflight.ts: 66.7% linessrc/parsers/enclave-parser.ts: 100.0% linessrc/types/enclave-options.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.90% | 98.94% | 📈 +0.04% |
| Statements | 98.79% | 98.80% | ➡️ +0.01% |
| Functions | 99.10% | 98.67% | 📉 -0.43% |
| Branches | 94.99% | 95.06% | 📈 +0.07% |
📁 Per-file Coverage Changes (2 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/commands/build-config.ts |
97.3% → 97.4% (+0.07%) | 97.3% → 97.4% (+0.07%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (4 files)
src/enclave/information-budget.ts: 100.0% linessrc/enclave/preflight.ts: 100.0% linessrc/parsers/enclave-parser.ts: 100.0% linessrc/types/enclave-options.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed... |
|
❌ Contribution Check failed. Please review the logs for details. |
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤 |
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed... |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
✅ Smoke Claude passed |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✅ Security Guard completed successfully! Security review of PR #6986 complete: no security issues found. The PR updates comments in containers/bounded-query/bounded-execution/sensitivity-policy.js to reflect enclave refactoring, renaming references from BOUNDED_QUERY_SENSITIVITY_RUN_BITS to ENCLAVE_SENSITIVITY_RUN_BITS. This is a documentation-only change with no modifications to firewall rules, capabilities, ACLs, network policies, or credential handling. All security controls remain intact. |
|
🔌 Smoke Services is testing service connectivity for this pull request... |
|
✅ Build Test Suite completed successfully! |
|
✅ Smoke Gemini completed. All facets verified. 💎 |
Smoke Test: Claude Engine Validation
Overall result: PASS
|
Smoke Test: Copilot BYOK (Direct) Mode
Running in direct BYOK mode ( Overall: PASS ✅ cc @lpcox
|
|
Smoke Test: Copilot Engine — @lpcox
Overall: PASS
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com): allowed=200 Overall status: PASS cc @lpcox Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: API Proxy OpenTelemetry Tracing
Overall: ✅ All scenarios passed.
|
Smoke Test: Gemini Engine Validation
Overall Status: FAIL
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environment.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: Java initially failed with
|
|
Smoke Test: Docker Sbx — @lpcox
Recent merged PRs:
Overall: PASS
|
Summary
Stack layer 1 introduces the behavior-preserving foundation for migrating
boundedQueriesandboundedAgentsto AWF-owned MCP enclaves guarded bygh-aw-mcpg.enclavesconfiguration, normalization, build wiring, and preflight contractsStack
Layer 1 of the greenfield enclave migration. This PR targets
mainand does not start layer 2.Validation
tsc --noEmit -p tsconfig.check.jsontscFull dependency restoration, Ajv-backed schema tests, and ESLint were unavailable earlier because of session sandbox/network policy; the committed targeted suite and TypeScript validations pass.