[lpcox]

Summary

Repair confirmed Docker enclave smoke compatibility defects without waiting for #10353 or changing the enclave runtime:

• Build smoke: raise Copilot CLI 1.0.34 to 1.0.80, above the generated installer's minimum 1.0.35.
• Static Issues smoke: restore the last-green flat-response GitHub MCP server, v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6, consistently in manifest, download and runtime configuration.
• Pin its gateway to v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2, containing the digest-reference schema fix from github/gh-aw-mcpg#15212.
• Keep that implementation pin in the existing static-only postprocessor rather than compiler-disallowed sandbox.mcp.version. Strict dry-run preflight now passes; normal runtime behavior is unchanged. Generated manifest/download/launch/version metadata and cache references remain consistent.
• Clarify numeric issue_number arguments and cover old/new schemas, malformed digests, v2-envelope rejection contracts, image consistency, static-only patching and idempotence.

Primary tools.github: false / network.allowed: [], enclave approved integrity, github/gh-aw repository restriction, two-tool allowlist, finite disclosure, credential exclusions and redaction remain intact. Dynamic workflow unchanged.

Failure evidence

• Build run 39426892145: installer rejects CLI 1.0.34.
• Static run 39424798992: v2 issue_read response envelope is filtered as issue:github/gh-aw#unknown; last-green run 38400460722 used the restored immutable v1.12.2 image with flat issue/comments responses.
• PR-branch run 39507331375: initial patch introduced a startup regression because mcpg v0.4.15 rejects the new @sha256 runtime reference. Gateway v0.4.36 addresses that exact schema defect without stripping the digest or relaxing policy.

Workflow validation and dispatch

• Four focused Jest suites: 142 passed, one existing privileged Linux mount test skipped. Concurrent branch regression coverage was preserved through a non-destructive merge.
• Actual downloaded upstream stdio-server schemas reproduce v0.4.15 rejection and v0.4.36 acceptance of the emitted immutable GitHub image. These checks and synthetic response-contract tests do not establish live gateway/guard behavior.
• Type-check, build, normal compilation/ShellCheck and mandatory postprocessing passed.
• Strict gh aw compile smoke-enclave-issues-read --dry-run passed source validation, model checks and ShellCheck with no warnings. Diagnostic lock preserved separately; normal generated workflow behavior restored. Optional Docker scanners were not run.
• One read-only security reviewer traced normal credential flows, reporting destinations/redaction, immutable dependencies, primary/enclave controls and finite disclosure. All ten safety questions passed with no confirmed vulnerabilities or unresolved review blockers for the exact workflow revision and authorized one-run dispatch.
• User-authorized static rerun: 39512394668, verified workflow_dispatch on lpcox-docker-enclave-smoke-fixes at ccd9dc230dd114240a32dbd8df18351c1c35fa99. In progress when verified; success remains unverified. This predates the dependency-only commit below. No dynamic run or dispatch retry.

Dependency audit repair

Dependency audit run 39509964735 failed both high/critical gates. User-requested commit 000143245111547c30ba5a764777c906829314e8 repairs the affected trees without audit suppression:

• Root: npm updates only the compatible transitive markdown-it lock 14.3.2 → 14.3.3, fixing GHSA-vfgh-jcmw-g37q and GHSA-gfr2-rv44-r23c without changing the direct markdownlint CLI version or root manifest.
• Docs: existing Vite override 8.0.16 → 8.1.6, the first patched release in the 8.x range. Its bundled launch-editor 2.14.2 fixes GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw and GHSA-587h-7wmj-h5pm. Npm updates the required Rolldown platform packages 1.0.3 → 1.1.5 and associated OXC types; Astro remains 7.3.2.
• Final root and docs npm audit --package-lock-only --audit-level=high --json each exit 0, reporting zero vulnerabilities at every severity.
• Root build/type-check, README markdownlint, and patched parser rendering checks pass. Docs npm ci --ignore-scripts and full astro check && astro build pass; Astro check reports zero errors/warnings/hints. Build has nonfatal chunk-size and missing i18n/404 content notices.
• No audit workflow changes, new suppressions, extra dispatches or merge. No manually chosen package integrity/version values; locks are npm-generated.

Explicitly unresolved

Dynamic run 39426069533 remains unexplained: sanitized metadata establishes Copilot exit 1 after about 92 seconds and wrapper exit=24, successful preflight and no OOM or invocation timeout. Stderr/diagnostics remain intentionally redacted. No speculative model, network, budget or runtime fix is included.

Missing terminal safe outputs and audit/token records are downstream symptoms. This PR does not claim all three smokes are green.

Authored-source security overview

Source	Change	Security impact
Build smoke	Supported CLI pin.	Existing installer minimum and sandbox/tool restrictions unchanged.
Static smoke	Move implementation pin out of frontmatter into static-only postprocessing.	Strict validation works; effective immutable image, runtime permissions and isolation unchanged.
Static guidance	Explain compatibility pin ownership and numeric issue arguments.	No new credentials, destinations, tool authority or disclosure allowance.

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.39%	93.40%	📈 +0.01%
Statements	91.83%	91.84%	📈 +0.01%
Functions	90.98%	90.98%	➡️ +0.00%
Branches	85.85%	85.86%	📈 +0.01%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/nvx/one-shot-adapter.ts	82.9% → 83.4% (+0.56%)	80.2% → 80.7% (+0.52%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

🟡 Changes recommended

The digest-qualified runtime container reference fails the pinned gateway’s schema validation, preventing startup.

1 open issue

• Digest-qualified runtime container rejected by gateway schema · New

What changed in this PR

Updates Docker enclave smoke compatibility without changing the enclave runtime or isolation policies.

Changes:

• Raises the build smoke’s Copilot CLI pin to 1.0.80.
• Restores the static Issues server pin and clarifies numeric tool arguments.
• Adds compatibility, image-consistency, and postprocessor regression checks.

File	Description
scripts/​ci/​smoke-enclave-workflow.test.ts	Adds compatibility and pinning checks.
scripts/​ci/​apply-general-workflow-patches.ts	Restores the static Issues server image.
.github/​workflows/​smoke-enclave-issues-read.md	Explains compatibility and numeric arguments.
.github/​workflows/​smoke-enclave-issues-read.lock.yml	Updates generated server references.
.github/​workflows/​smoke-enclave-build-test.md	Raises the Copilot CLI version.
.github/​workflows/​smoke-enclave-build-test.lock.yml	Synchronizes generated CLI references.

_{Review effort: Max}

[github-actions]

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed in 95ab665. The workflow now pins mcpg v0.4.36, whose schema accepts digest-qualified stdio images; I removed the stale tag-only rewrite and added regression coverage ensuring the runtime, download, and manifest remain digest-pinned.

[github-actions]

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

1. Download the docs-preview-pr-10361 artifact from the workflow run
2. Unzip and open index.html in your browser

Built from commit fbc2a5d