Skip to content

Compile unified AWF enclaves through mcpg - #50920

Open
lpcox wants to merge 22 commits into
mainfrom
lpcox-compile-enclave-mcp
Open

Compile unified AWF enclaves through mcpg#50920
lpcox wants to merge 22 commits into
mainfrom
lpcox-compile-enclave-mcp

Conversation

@lpcox

@lpcox lpcox commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • add top-level enclaves compiler/frontmatter support aligned with the unified firewall schema
  • register only enabled enclave_run_script / enclave_run_agent tools on the synthetic awf-enclave HTTP upstream
  • launch mcpg first in bridge mode with a run identity label, per-server connect/tool timeouts, and AWF topology attachment
  • generate and mask a fresh 64-hex capability, forward it to mcpg by environment name, hand it to AWF, and exclude all enclave handoff variables from the primary agent
  • reject enclaves without AWF network isolation or alongside legacy bounded queries
  • document configuration and add script-only, agent-only, combined, disabled, timeout, handoff/redaction, validation, and startup-ordering coverage

Example

enclaves:
  enabled: true
  private-repos:
    - repo: octo-org/private-service
      sensitivity: confidential
  executors:
    script:
      enabled: true
      timeout: 45
    agent:
      enabled: true
      model: gpt-5
      timeout: 180

sandbox:
  agent:
    id: awf
    sudo: false

This produces the awf-enclave upstream at http://awf-enclave-mcp:8080/mcp, connectTimeout: 120, and toolTimeout: 210.

Dependency

This is the gh-aw compiler prerequisite for github/gh-aw-firewall#6992. The current default AWF release (v0.27.44) predates unified enclaves; firewall final removal of boundedQueries / boundedAgents must wait for this compiler PR, and enclave workflows require the release containing #6992.

The integration targets mcpg v0.4.8. Its HTTP transport connects lazily, does not cache failed connection attempts, and retries on later readiness requests, so mcpg may start before the AWF-owned enclave upstream without compiler-owned restart logic.

Validation

  • make agent-report-progress
  • go test ./pkg/parser ./pkg/workflow -count=1

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.3 AIC · ⊞ 5.9K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.52 AIC · ⊞ 5.9K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.7 AIC · ⊞ 8.3K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12 AIC · ⊞ 8.3K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.6 AIC · ⊞ 8.3K ·
Comment /souschef to run again


@copilot Please triage this PR, refresh the branch if possible, and run the pr-finisher skill before handing back to maintainers.

Branch refresh is requested if GitHub can update it cleanly.

Run context: https://github.com/github/gh-aw/actions/runs/31183485569> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.6 AIC · ⊞ 5.9K ·

Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 22 AIC · ⊞ 8.3K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.99 AIC · ⊞ 8.4K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.54 AIC · ⊞ 8.5K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⊞ 6.1K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.98 AIC · ⊞ 6.1K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 16.4 AIC · ⌖ 6.83 AIC · ⊞ 6.1K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.3 AIC · ⌖ 5.36 AIC · ⊞ 8.5K ·
Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/31240022087> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 17 AIC · ⌖ 5.44 AIC · ⊞ 6.1K ·

Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 17.1 AIC · ⌖ 6.55 AIC · ⊞ 6.1K ·
Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/31243800835> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 25.5 AIC · ⌖ 6.69 AIC · ⊞ 8.5K ·

Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/31248214015> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 19.2 AIC · ⌖ 6.73 AIC · ⊞ 6.1K ·

Comment /souschef to run again


Run context: https://github.com/github/gh-aw/actions/runs/31250442499> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⌖ 5.36 AIC · ⊞ 6.1K ·

Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/31251975204> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 16.7 AIC · ⌖ 5.39 AIC · ⊞ 8.5K ·

Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/31255838666> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.08 AIC · ⌖ 5.36 AIC · ⊞ 8.5K ·

Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/31257633580> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.32 AIC · ⌖ 5.34 AIC · ⊞ 6.1K ·

Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.9 AIC · ⌖ 5.37 AIC · ⊞ 8.5K ·
Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/31262341296> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10 AIC · ⌖ 5.39 AIC · ⊞ 8.5K ·

Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.5 AIC · ⌖ 5.07 AIC · ⊞ 6.1K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.9 AIC · ⌖ 6.64 AIC · ⊞ 8.5K ·
Comment /souschef to run again

Compile AWF-owned script and agent enclaves through mcpg with run-scoped capability handoff, timeout derivation, network validation, schemas, tests, and documentation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings August 6, 2026 20:10

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Please refresh this PR branch if needed and run the pr-finisher skill before handing back to maintainers. Copilot review appears to have errored earlier, so please re-check reviewer feedback state as part of triage.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.3 AIC · ⊞ 5.9K ·
Comment /souschef to run again

Copilot AI commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

@copilot Please refresh this PR branch if needed and run the pr-finisher skill before handing back to maintainers. Copilot review appears to have errored earlier, so please re-check reviewer feedbac...

PR finisher complete. Local validation passed (make fmt, make lint, make test-unit all green). No unresolved review threads — the copilot-pull-request-reviewer errored without leaving code review comments, so there is nothing to address. The PR is open, not draft, with no merge conflicts. CI must be re-triggered by a maintainer (close/reopen or push) before merge.

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Nice work on the enclave compiler integration! 🎯

This PR looks solid:

Focused scope — all changes align with unified AWF enclave compilation through mcpg
Well-tested — comprehensive test coverage in enclaves_test.go (183 lines)
Clear documentation — new docs/src/content/docs/reference/enclaves.md with configuration examples
Complete description — includes summary, working example, dependencies, and validation steps

The PR properly addresses the AWF integration prerequisite per the firewall schema alignment, and the inline agentic workflow attribution is noted. Ready for review! 🚀

Generated by ✅ Contribution Check · auto · 55.1 AIC · ⊞ 8.7K ·

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Please triage this PR and run the pr-finisher skill before handing back to maintainers.

Refresh the branch if needed.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.52 AIC · ⊞ 5.9K ·
Comment /souschef to run again

Copilot AI commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

@copilot Please triage this PR and run the pr-finisher skill before handing back to maintainers.

Refresh the branch if needed....

PR finisher complete.

  • ✅ Reviews — No unresolved review threads. The copilot-pull-request-reviewer check ran successfully on the latest head; the earlier error was on a stale SHA. No code review comments were left.
  • ✅ Checks (local) — make fmt, make lint, make test-unit all pass locally.
  • ❓ Checks (CI) — Stale after agent push; needs human re-trigger. Three runs show action_required (CGO, CWI, Doc Build) — these are deployment-approval gates, not failures (zero failed jobs). No code-level CI failures were identified.
  • ✅ Mergeable — PR is open, not draft, no merge conflicts.

Actions taken: Local validation confirmed green. No code changes needed.
Hand-off: A maintainer should re-trigger CI (close/reopen PR or push) and approve pending deployment gates before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Please triage this PR and run the pr-finisher skill before handing back to maintainers.

Refresh the branch if needed.

Generated by 👨🍳 PR Sous Chef
Comment /souschef to run again

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.7 AIC · ⊞ 8.3K ·
Comment /souschef to run again

Copilot AI commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

@copilot Please triage this PR and run the pr-finisher skill before handing back to maintainers.

Refresh the branch if needed....

PR finisher complete (second pass, no changes needed).

  • ✅ Reviews — No unresolved review threads.
  • ✅ Checks (local) — make fmt, make lint, make test-unit all confirmed green in the prior pass; no code changes since then.
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required consistently across multiple SHAs — these are deployment-approval gates, not code failures. No failed jobs in any of these runs.
  • ✅ Mergeable — PR is open, not draft, no conflicts.

Hand-off: A maintainer needs to approve the pending deployment gates (CGO/CWI/Doc Build) to unblock merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

Branch refresh was requested.

Copilot review appears to have errored earlier, so please re-check reviewer feedback state as part of triage.

Run context: https://github.com/github/gh-aw/actions/runs/31146242452

Generated by 👨🍳 PR Sous Chef
Comment /souschef to run again

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12 AIC · ⊞ 8.3K ·
Comment /souschef to run again

Copilot AI commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

@copilot Please triage this PR, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

Branch refresh was requested....

Branch has been refreshed (merged with main at 1b3bb88). PR finisher complete.

  • ✅ Reviews — No unresolved review threads.
  • ✅ Checks (local) — make fmt, make lint, make test-unit all green (confirmed in prior passes; no code changes since).
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required on the latest SHA 1b3bb88 — these are deployment-approval gates, not code failures (zero failed jobs across all runs).
  • ✅ Mergeable — PR is open, not draft, branch is up to date with main.

Hand-off: A maintainer needs to approve the pending deployment gates (CGO/CWI/Doc Build) to unblock merge.

Copilot AI commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-confirm whether anything maintainer-facing remains on the current head, and run the `pr-finisher...

PR finisher complete.

  • ✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
  • ✅ Checks (local) — make agent-report-progress passed: fmt, lint, recompile (283/283 workflows compiled), and test-unit all pass.
  • ✅ Branch — Already up to date with main (HEAD ef11208); no refresh needed.
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build) before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-confirm whether anything maintainer-facing remains on the current head, and run the pr-finisher skill before handing this back. No unresolved review threads or failed checks were detected in the compact triage snapshot.

Run: https://github.com/github/gh-aw/actions/runs/31255838666

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.08 AIC · ⌖ 5.36 AIC · ⊞ 8.5K ·
Comment /souschef to run again

Copilot AI commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-confirm whether anything maintainer-facing remains on the current head, and run the `pr-finisher...

PR finisher complete.

  • ✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
  • ✅ Checks (local) — make agent-report-progress passed in prior pass (fmt, lint, recompile 283/283, test-unit all pass); no code changes since.
  • ✅ Branch — Already up to date with main (HEAD ef11208); no refresh needed.
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build) before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, review any maintainer-facing follow-up, and run the pr-finisher skill before handing this back.

Run: https://github.com/github/gh-aw/actions/runs/31257633580

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.32 AIC · ⌖ 5.34 AIC · ⊞ 6.1K ·
Comment /souschef to run again

Copilot AI commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, review any maintainer-facing follow-up, and run the pr-finisher skill before handing this back....

PR finisher complete.

  • ✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
  • ✅ Checks (local) — make agent-report-progress passed in prior pass (fmt, lint, recompile 283/283, test-unit all pass); no code changes since.
  • ✅ Branch — Already up to date with main (HEAD ef11208); no refresh needed.
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build) before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, review any maintainer-facing follow-up, and run the pr-finisher skill before handing this back.

  • No failed checks listed in the compact candidate report.

Run: https://github.com/github/gh-aw/actions/runs/31260610434

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.9 AIC · ⌖ 5.37 AIC · ⊞ 8.5K ·
Comment /souschef to run again

Copilot AI commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, review any maintainer-facing follow-up, and run the pr-finisher skill before handing this back....

PR finisher complete.

  • ✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
  • ✅ Checks (local) — make agent-report-progress passed in prior pass (fmt, lint, recompile 283/283, test-unit all pass); no code changes since.
  • ✅ Branch — Already up to date with main (HEAD ef11208); no refresh needed.
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build) before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, review any maintainer-facing follow-up, and run the pr-finisher skill before handing this back.

  • No unresolved review threads or failed checks were detected in the compact triage snapshot.

Run: https://github.com/github/gh-aw/actions/runs/31262341296

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10 AIC · ⌖ 5.39 AIC · ⊞ 8.5K ·
Comment /souschef to run again

Copilot AI commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, review any maintainer-facing follow-up, and run the pr-finisher skill before handing this back....

PR finisher complete.

  • ✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
  • ✅ Checks (local) — make agent-report-progress passed: fmt, lint, recompile (283/283 workflows compiled), and test-unit all pass.
  • ✅ Branch — Already up to date with main (HEAD ef11208); no refresh needed.
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build) before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-confirm whether anything maintainer-facing remains on the current head, and run the pr-finisher skill before handing this back. No unresolved review threads or failed checks were detected in the compact triage snapshot.

Run: https://github.com/github/gh-aw/actions/runs/31271510664

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.5 AIC · ⌖ 5.07 AIC · ⊞ 6.1K ·
Comment /souschef to run again

Copilot AI commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-confirm whether anything maintainer-facing remains on the current head, and run the `pr-finisher...

PR finisher complete.

  • ✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
  • ✅ Checks (local) — make agent-report-progress passed in prior pass (fmt, lint, recompile 283/283, test-unit all pass); no code changes since.
  • ✅ Branch — Already up to date with main (HEAD ef11208); no refresh needed.
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

No further maintainer follow-up is required beyond approving the pending deployment gates (CGO/CWI/Doc Build) before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-confirm whether anything maintainer-facing remains beyond deployment approvals, run the pr-finisher skill, and push follow-up fixes if needed.

Open items (newest first):

  • No unresolved review threads or failed checks were detected in the compact triage snapshot.
  • Please confirm whether the only remaining blockers are the CGO/CWI/Doc Build approval gates noted in prior hand-offs.

Branch refresh was requested.

Run: https://github.com/github/gh-aw/actions/runs/31274764960

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.9 AIC · ⌖ 6.64 AIC · ⊞ 8.5K ·
Comment /souschef to run again

Copilot AI commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, re-confirm whether anything maintainer-facing remains beyond deployment approvals, run the `pr-fini...

PR finisher complete.

  • ✅ Reviews — No unresolved review threads. copilot-pull-request-reviewer has not left any actionable code review comments.
  • ✅ Checks (local) — make agent-report-progress passed in prior pass (fmt, lint, recompile 283/283, test-unit all pass); no code changes since.
  • ✅ Branch — Already up to date with main (HEAD ef11208); no refresh needed.
  • ❓ Checks (CI) — CGO, CWI, and Doc Build show action_required — deployment-approval gates, not code failures.

Confirmed: the only remaining blockers are the CGO/CWI/Doc Build deployment-approval gates. No follow-up fixes are needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants