Merge branch 'main' into copilot/aw-fix-security-audit-failure

Author: github-actions[bot]

.github/aw/agent-runtime-instructions.md

@@ -5,22 +5,24 @@ disable-model-invocation: true
 
 # Agent Runtime Instructions
 
-Use these instructions when creating or updating workflows that mention Docker, gVisor, Docker sbx, ARC DinD, self-hosted runners, or `sandbox.agent.runtime-install`.
+Use these instructions when creating or updating workflows that mention Docker, gVisor, Docker sbx, Cloud Hypervisor, ARC DinD, self-hosted runners, or `sandbox.agent.runtime-install`.
 
 ## Runtime fields
 
 - Omit `sandbox.agent.runtime` for the default Docker agent runtime.
 - Set `sandbox.agent.runtime: gvisor` only when the runner has a local Docker daemon and can install or already has `runsc`.
 - Set `sandbox.agent.runtime: docker-sbx` only when the runner supports KVM-backed microVMs.
+- Set `sandbox.agent.runtime: cloud-hypervisor` only for the preview microVM runtime on a GitHub-hosted Ubuntu x86_64 runner with `/dev/kvm`; prefer `docker-sbx` or `gvisor` when those host constraints are not guaranteed.
 - Do not set `sandbox.agent.runtime: docker`; Docker is selected by omitting the field.
 - Do not set `sandbox.agent.runtime: sbx`; `sbx` is only a bounded-query runtime name.
 - Set `runner.topology: arc-dind` for ARC or equivalent Kubernetes runners that use a Docker-in-Docker sidecar. This is a runner topology, not an agent runtime.
 
 ## Compatibility
 
-- Do not combine `runner.topology: arc-dind` with `sandbox.agent.runtime: gvisor` or `sandbox.agent.runtime: docker-sbx`.
+- Do not combine `runner.topology: arc-dind` with `sandbox.agent.runtime: gvisor`, `sandbox.agent.runtime: docker-sbx`, or `sandbox.agent.runtime: cloud-hypervisor`.
 - ARC DinD workflows must be rootless: do not add `sudo`, `apt-get install`, or other host package bootstrap steps.
 - Docker sbx requires KVM and normally does not work on ARC DinD because the sbx daemon must run on the runner host.
+- Cloud Hypervisor requires `RUNNER_ENVIRONMENT=github-hosted`, Ubuntu Linux x86_64, and `/dev/kvm`; it is not supported on self-hosted or ARC DinD runners.
 
 ## `runtime-install`
 
@@ -43,6 +45,12 @@ Use these instructions when creating or updating workflows that mention Docker,
 - `DOCKER_USERNAME` and `DOCKER_PAT` remain required even with `runtime-install: false`, because compiled workflows refresh sbx credentials immediately before agent execution.
 - Do not use Docker sbx for workflows triggered from untrusted forks unless the trigger and credential model safely provide those secrets.
 
+## Cloud Hypervisor guidance (preview)
+
+- Preview scope is narrow: GitHub-hosted runners only, Ubuntu Linux x86_64 only, and `/dev/kvm` must be present.
+- The compiler emits host preflight and release-asset provisioning steps that download and checksum-verify the pinned Cloud Hypervisor binary, kernel, rootfs, and supervisor from the `gh-aw-firewall` release before AWF starts.
+- Do not recommend this runtime for self-hosted, non-Ubuntu, or non-x86_64 runners; use `docker-sbx` or `gvisor` instead.
+
 ## ARC DinD guidance
 
 - Use `runner.topology: arc-dind` when `DOCKER_HOST` points to a DinD sidecar such as `tcp://localhost:2375` or `tcp://dind:2375`.

.github/aw/enclaves.md

@@ -0,0 +1,50 @@
+---
+description: Private-repository enclaves (preview) — finite-disclosure access to approved private repos via the MCP gateway.
+---
+
+# Private Repository Enclaves
+
+Use these instructions when a workflow needs bounded, auditable access to a private repository other than the one the workflow runs in.
+
+## What it is
+
+- The top-level `enclaves:` array (1-2 entries) enables finite-disclosure access to approved private repositories through the compiler-launched MCP gateway.
+- Each entry is either a **script enclave** (`script:` + `repos:`) registering `enclave_run_script`, or an **agent enclave** (`agent:` + `repos:`) registering `enclave_run_agent`.
+- Omit `enclaves:` entirely to disable the feature — this is the default.
+- This is a preview feature gated on `github/gh-aw-firewall#6992`; an older pinned AWF version will not provide the enclave server.
+
+## Prerequisites
+
+- Enclaves require AWF network isolation. Set `sandbox.agent.sudo: false` (or use the `docker-sbx` runtime) so the compiler launches the MCP gateway in bridge mode and AWF can attach it to the isolated topology.
+- Each `repos:` entry needs `repo:` (`owner/name`) and `sensitivity:` (`public`, `internal`, `confidential`, or `sealed`).
+
+## Example
+
+```yaml
+sandbox:
+  agent:
+    id: awf
+    sudo: false
+enclaves:
+  - script:
+    repos:
+      - repo: octo-org/private-service
+        sensitivity: confidential
+    timeout: 45
+  - agent:
+      model: gpt-5
+    repos:
+      - repo: octo-org/private-service
+        sensitivity: confidential
+    timeout: 180
+```
+
+## Rules
+
+- Each enclave type (`script`, `agent`) can appear at most once.
+- If the same repository appears in both entries, its `sensitivity` must match — the information budget is shared across executor types.
+- AWF fixes the script enclave's network and interpreter, and the agent enclave's network, internally; do not attempt to override these in workflow frontmatter.
+- A fresh masked capability is generated per workflow run and passed only to the MCP gateway and AWF, never to the primary agent environment.
+- `timeout:` per enclave entry is capped at 540 seconds (AWF reserves the final 60 seconds of its 600-second finite-disclosure bucket for cleanup). The gateway itself enforces a 630-second tool timeout (600s AWF bucket + 30s transport allowance) — treat this as an enforcement bound, not a wall-clock guarantee.
+
+See also: [agent-runtime-instructions.md](agent-runtime-instructions.md) for `sandbox.agent` fields, and [network.md](network.md) for network isolation defaults.

.github/aw/github-agentic-workflows.md

@@ -171,6 +171,8 @@ mcp-servers:
 
 `auth.type: github-oidc` uses GitHub Actions OIDC tokens for secure server-to-server authentication without static credentials. The `audience` field defaults to the server URL when omitted.
 
+- `required:` - Whether a stdio or HTTP MCP server must pass its startup connectivity check (boolean, default: `true`). Set `false` for an optional server so a failed startup check only logs a warning and the workflow continues without it, instead of failing the run.
+
 ### Engine Network Permissions
 
 Control network access via the top-level `network:` field (defaults to `network: defaults` — basic infrastructure only). For workflows that build, test, or install packages, always add the language ecosystem alongside `defaults`:

.github/aw/syntax-tools-imports.md

@@ -34,6 +34,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/deployment-status.md`
 - `.github/aw/designer-mappings.md`
 - `.github/aw/designer.md`
+- `.github/aw/enclaves.md`
 - `.github/aw/evals.md`
 - `.github/aw/experiments.md`
 - `.github/aw/github-agentic-workflows.md`

.github/skills/agentic-workflows/SKILL.md

@@ -613,4 +613,6 @@ If you encounter a genuine error that prevents completion (e.g., data fetch fail
 
 ### Output Format
 
-Structure reports as: overview → key metrics/issues → collapsible detail → next actions.
+- Use `###` (h3) or lower for all report headers; never use `#` or `##` inside the report body.
+- Wrap long lists, tables, and detailed findings in `<details><summary><b>...</b></summary>...</details>` blocks to reduce scrolling.
+- Structure reports as: overview → key metrics/issues → collapsible detail → next actions.

.github/workflows/ai-moderator.lock.yml

@@ -615,4 +615,6 @@ before applying it, using a neutral gray color (e.g. `#808080`) and a short desc
 
 ### Output Format
 
-Structure reports as: overview → key metrics/issues → collapsible detail → next actions.
+- Use `###` (h3) or lower for all report headers; never use `#` or `##` inside the report body.
+- Wrap long lists, tables, and detailed findings in `<details><summary><b>...</b></summary>...</details>` blocks to reduce scrolling.
+- Structure reports as: overview → key metrics/issues → collapsible detail → next actions.