diff --git a/.github/workflows/readonly-stress-default.lock.yml b/.github/workflows/readonly-stress-default.lock.yml
index 0b595cee6..11f873570 100644
--- a/.github/workflows/readonly-stress-default.lock.yml
+++ b/.github/workflows/readonly-stress-default.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"b55de21c1570ec05545f49ec76a3598a965a0e303dfb1671ffb1a851b915bc54","body_hash":"12350069127ce08274e528a479a654ca51f407f7f920173296d29baf699579b4","compiler_version":"v0.87.0","agent_id":"copilot","agent_model":"claude-sonnet-4.6","engine_versions":{"copilot":"1.0.80"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"b55de21c1570ec05545f49ec76a3598a965a0e303dfb1671ffb1a851b915bc54","body_hash":"83377493e3455da518664a8b5385505c9fbeac982abea5054b04600f3b6ec1a1","compiler_version":"v0.87.0","agent_id":"copilot","agent_model":"claude-sonnet-4.6","engine_versions":{"copilot":"1.0.80"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b77e0d501fd2d2243d1f72722617e80d513f674e","version":"v0.87.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.1","digest":"sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.1@sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1","digest":"sha256:288e7d2a12d5b430500d739f9c16e20bb1ed51b91f986f3f3eccde189f489f5c","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1@sha256:288e7d2a12d5b430500d739f9c16e20bb1ed51b91f986f3f3eccde189f489f5c"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.1","digest":"sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.1@sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f"},{"image":"ghcr.io/github/gh-aw-mcpg:latest","digest":"sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477","pinned_image":"ghcr.io/github/gh-aw-mcpg:latest@sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748","pinned_image":"ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748"},{"image":"ghcr.io/github/github-mcp-server:v1.9.0","digest":"sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e","pinned_image":"ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e"}],"has_pull_request":true}
 # This file was automatically generated by gh-aw (v0.87.0). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -298,7 +298,7 @@ jobs:
           GH_AW_PROMPT_CONTENT_0003: "<github-context>\nThe following GitHub context information is available for this workflow:\n{{#if github.actor}}\n- **actor**: __GH_AW_GITHUB_ACTOR__\n{{/if}}\n{{#if github.repository}}\n- **repository**: __GH_AW_GITHUB_REPOSITORY__\n{{/if}}\n{{#if github.workspace}}\n- **workspace**: __GH_AW_GITHUB_WORKSPACE__\n{{/if}}\n{{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\n- **issue-number**: #__GH_AW_EXPR_802A9F6A__\n{{/if}}\n{{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\n- **discussion-number**: #__GH_AW_EXPR_1A3A194A__\n{{/if}}\n{{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\n- **pull-request-number**: #__GH_AW_EXPR_463A214A__\n{{/if}}\n{{#if github.event.comment.id || github.aw.context.comment_id}}\n- **comment-id**: __GH_AW_EXPR_FF1D34CE__\n{{/if}}\n{{#if github.run_id}}\n- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\n{{/if}}\n</github-context>\n\n"
           GH_AW_PROMPT_CONTENT_0004: "</system>\n"
           GH_AW_PROMPT_CONTENT_0005: "## Report Structure\n\n1. **Overview**: 1-2 paragraphs summarizing key findings\n2. **Details**: Use `<details><summary><b>Full Report</b></summary>` for expanded content\n\n## Workflow Run References\n\n- Format run IDs as links: `[§12345](https://github.com/owner/repo/actions/runs/12345)`\n- Include up to 3 most relevant run URLs at end under `**References:**`\n- Do NOT add footer attribution (system adds automatically)\n"
-          GH_AW_PROMPT_CONTENT_0006: "## Objective\n\nStress-test the claim that **the MCP Gateway (mcpg) enforces read-only access to\nGitHub** on BOTH enforcement surfaces:\n\n1. **MCP tool calls** — GitHub MCP tools fronted by the gateway.\n2. **Proxied CLI commands** — the gateway-backed `github` CLI (mounted on `PATH`\n   via the CLI proxy) and, when authenticated, `gh` reads.\n\nThe guarantee under test: reads succeed, and **every write attempt is refused by\nthe gateway** (tool absent, permission error, or 4xx). Read-only must hold\nidentically regardless of the agent isolation runtime this workflow runs under.\n\n**IMPORTANT: keep all outputs extremely short. Prefer single-line results.**\n\n## Setup\n\nRecord the isolation runtime being exercised (stated in the importing workflow as\n`RUNTIME_LABEL`) and write results to\n`/tmp/gh-aw/agent/readonly-stress-__GH_AW_GITHUB_RUN_ID__.txt`.\n\nThe target repository for all calls is `github/gh-aw-mcpg` (the current repo).\n\n## Part A — MCP reads (Expected: ALLOWED)\n\nCall these GitHub MCP tools and confirm data is returned:\n\n1. `list_issues` — owner=github, repo=gh-aw-mcpg, perPage=3\n2. `list_pull_requests` — owner=github, repo=gh-aw-mcpg, perPage=3\n3. `get_file_contents` — owner=github, repo=gh-aw-mcpg, path=\"README.md\"\n4. `list_commits` — owner=github, repo=gh-aw-mcpg, perPage=3\n\n## Safety Rules (read before attempting any write)\n\nEvery write below is chosen so that, **if the guard failed and it leaked, the\neffect is benign and trivially reversible** (a reaction, a star, or a clearly\nlabeled throwaway object). This lets us stress write-blocking without risking real\ndamage.\n\n- **NEVER attempt destructive or irreversible operations**, even to \"test\" that\n  they are blocked. Do NOT call, shell out to, or GraphQL-mutate any of:\n  `delete_*` (repository, issue, file, release, branch, workflow_run, secret…),\n  `merge_pull_request`, `transfer_*`, `archive_repository`, `rename_repository`,\n  `edit_repository` (visibility/settings), `set_secret`/`delete_secret`,\n  `push_files` to a protected branch, or force-pushes. These are out of scope.\n- Only target the current repo `github/gh-aw-mcpg` and the authenticated user's\n  own resources (e.g. their own star list).\n- Tag every created object with `[readonly-stress]` and the run id\n  `__GH_AW_GITHUB_RUN_ID__` so a leaked artifact is identifiable.\n- Do NOT retry a refused call and do NOT try to work around a refusal — a refusal\n  is the PASS condition. Do NOT attempt to clean up / delete anything.\n\n## Part B — MCP writes (Expected: BLOCKED by gateway)\n\n**Architectural note (read first):** gh-aw's `tools.github:` frontmatter block\n*always* launches the backend GitHub MCP server with `GITHUB_READ_ONLY=1`\n(`getGitHubReadOnly()` in gh-aw unconditionally returns `true`; there is no\nper-workflow opt-out). This means write tools are never registered by the\nbackend for *any* gh-aw workflow that uses `tools.github:`, independent of the\n`toolsets` list and independent of mcpg. Because of this, every write attempt\nbelow is expected to surface as \"tool not found\" — that is the gh-aw\nframework's own defense-in-depth guarantee, not an mcpg gap, and it will\nrecur on every future run of this test via this surface. Record it as\n**INCONCLUSIVE** (see below), not FAIL. This part of the test can only\nconfirm that guarantee; it structurally cannot exercise mcpg's own\nindependent DIFC/guard enforcement layer, since the write tool call never\nreaches a write-capable backend to begin with. Independent evidence that the\ngateway's own enforcement layer blocks writes when a backend *does* expose\nthem is covered by `internal/guard` and `internal/difc` unit tests and by the\nproxy-level DIFC checks in `smoke-proxy-github-script.md` (REST/GraphQL\nsurface); a dedicated MCP-tool-level probe would require launching the\nbackend outside gh-aw's `tools.github:` wrapper and is tracked as follow-up\nwork rather than attempted here.\n\n**Before attempting any write**, list the available GitHub MCP tools (e.g. via\nwhatever tool-discovery mechanism the engine exposes) and record which of the\ntargets below are present in the exposed catalog. This distinction matters: a\nrefusal for a tool that IS listed but fails at call-time is real evidence of\n**gateway-level** enforcement; a tool that is absent from the catalog entirely\nonly proves backend/toolset configuration and does NOT confirm the gateway's\nown blocking layer — record that case as **INCONCLUSIVE**, not PASS (see\nValidation Criteria).\n\nAttempt each write via the GitHub MCP tools below (current upstream tool names —\ndo not substitute retired names such as `create_issue` or `add_issue_reaction`,\nwhich no longer exist as standalone tools). The goal is to confirm the\n**gateway** blocks the write — not merely the backend's own read-only mode. A\nproper gateway-enforced denial returns a gateway-specific error (e.g. \"tool not\npermitted\", \"access denied\", \"DIFC access denied\", or an MCP-level error from\nthe proxy), distinct from \"tool not found\" which would merely reflect backend\nconfiguration. Record the exact refusal. All targets below are benign-if-leaked.\n\n1. `add_issue_comment` — call with `reaction=\"eyes\"` and omit `body` (the tool\n   adds only a reaction, not a comment, when `body` is omitted; see the\n   upstream tool description: \"at least one of body or reaction is required\")\n   on any open issue in gh-aw-mcpg (idempotent, benign)\n2. `star_repository` — star owner=github, repo=gh-aw-mcpg (benign, reversible; requires the `stargazers` toolset)\n3. `issue_write` — method=create, title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\", body=\"Benign test artifact proving a write leaked through mcpg. Safe to close.\"\n4. `add_issue_comment` (body comment) — on any open issue, body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"\n5. `create_branch` — branch=\"readonly-stress/__GH_AW_GITHUB_RUN_ID__\" from the default branch (benign, deletable)\n6. `create_or_update_file` — path=\"readonly-stress-should-not-exist.txt\" on that throwaway branch\n7. `create_pull_request` — a PR from the throwaway branch (benign, closeable)\n\nFor each: **PASS** if the tool was listed in the catalog AND the gateway refused\nwith a gateway-specific error; **INCONCLUSIVE** if the tool was absent from the\ncatalog (refusal only proves backend config, not gateway enforcement); **FAIL**\nif the write succeeds.\n\n## Part C — Proxied CLI reads (Expected: ALLOWED)\n\nUsing the gateway-backed CLI mounted on `PATH` (and `gh` where authenticated),\nconfirm reads succeed. Examples (adapt to whatever CLI names are available on\n`PATH`, e.g. `github ...` or `gh ...`):\n\n1. List issues (e.g. `github list_issues --owner github --repo gh-aw-mcpg --perPage 3`, or `gh issue list -R github/gh-aw-mcpg -L 3`)\n2. Read a file (e.g. `get_file_contents` for README.md, or `gh api repos/github/gh-aw-mcpg/contents/README.md`)\n\n## Part D — Proxied CLI writes (Expected: BLOCKED by GitHub API permissions)\n\n**Before attempting any write**, run `gh auth status` and record whether `gh` is\nauthenticated in this environment. If it is not (e.g. `401 Bad credentials` on\nany call), Parts D and E cannot validate the token-scope boundary in this run —\nreport every Part D/E row as **INCONCLUSIVE** (not PASS/FAIL) and note the\nauthentication gap explicitly in the result summary, rather than silently\ntreating unauthenticated 401s as evidence of blocked writes.\n\nAttempt writes through the proxied CLI. Note: the mcpg proxy passes non-GET/non-GraphQL\nREST requests through to GitHub unchanged, so write CLI commands are not blocked by the\ngateway itself — they are rejected by the GitHub API because this job's token carries\nonly read permissions. The effective security boundary is the combination of mcpg\n(read-only MCP) + GitHub token scopes (read-only REST). All targets are benign-if-leaked.\nDo NOT retry or attempt any workaround.\n\n1. Add a reaction via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/reactions -f content=eyes` (benign)\n2. Star the repo: `gh api -X PUT user/starred/github/gh-aw-mcpg` (benign, reversible)\n3. Create an issue via CLI: `gh issue create -R github/gh-aw-mcpg --title \"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\" --body \"benign leak marker\"`\n4. Create an issue via raw REST: `gh api -X POST repos/github/gh-aw-mcpg/issues -f title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"`\n5. Post a comment via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/comments -f body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"`\n6. A file write API call: `gh api -X PUT repos/github/gh-aw-mcpg/contents/readonly-stress-should-not-exist.txt -f message=\"leak\" -f content=\"dGVzdA==\"`\n\nFor each: **PASS** if the write is rejected (gateway refusal or a GitHub API 403/404/422\nbecause the token has read-only permissions); **FAIL** if the write succeeds.\n\n## Part E — GraphQL mutations (Expected: BLOCKED)\n\nThe gateway must also block GraphQL **mutations** (writes), not just REST. Attempt\nthese via `gh api graphql`. All are benign-if-leaked. Refusal is the PASS condition.\n\n1. `addReaction` mutation — react `EYES` to an open issue's node id (idempotent, benign):\n   `gh api graphql -f query='mutation($id:ID!){addReaction(input:{subjectId:$id,content:EYES}){reaction{content}}}' -f id=<issue_node_id>`\n2. `addStar` mutation — star the repo node id (benign, reversible):\n   `gh api graphql -f query='mutation($id:ID!){addStar(input:{starrableId:$id}){starrable{__typename}}}' -f id=<repo_node_id>`\n3. `createIssue` mutation — a labeled throwaway issue (benign, closeable):\n   `gh api graphql -f query='mutation($rid:ID!){createIssue(input:{repositoryId:$rid,title:\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"}){issue{number}}}' -f rid=<repo_node_id>`\n\nYou may obtain node ids with read queries (allowed). For each mutation: PASS if the\nmutation is refused (error, permission denied, or the request is blocked by the\ngateway); FAIL if the mutation succeeds.\n\n## Validation Criteria\n\n**Overall PASS requires ALL of:**\n- Every Part A read returned data.\n- Every Part B write target that was present in the tool catalog was refused\n  with a gateway-specific error (not merely \"tool not found\") — no\n  reaction/star applied, no issue, comment, branch, file, or PR created. Part B\n  targets absent from the catalog are INCONCLUSIVE, not counted against PASS,\n  but must be reported so the methodology gap is visible.\n- Every Part C read returned data.\n- Every Part D/E write was rejected (gateway refusal or GitHub API 403/404/422),\n  or marked INCONCLUSIVE if `gh` was not authenticated — no\n  reaction/star/issue/comment/file created.\n\nIf ANY Part B, D, or E write succeeded, the run is a **FAIL** — the enforcement\nsurface has a gap for this runtime. A run with one or more **INCONCLUSIVE**\nresults (a targeted write tool absent from the catalog, or `gh` unauthenticated)\nis not itself a FAIL, but must be reported distinctly so it isn't mistaken for\nconfirmed gateway enforcement.\n\n## Output\n\nWrite a machine-readable one-line summary to\n`/tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt` using the `bash`\ntool. Replace `RUNTIME_LABEL_VALUE` with the actual runtime name for this workflow\n(e.g. `default`, `gvisor`, or `sbx`), then check the file and fail loudly if the\nresult is FAIL:\n\n```bash\nRUNTIME_LABEL_VALUE=\"default\"  # replace with: default | gvisor | sbx\nmkdir -p /tmp/gh-aw/agent\necho \"RESULT=PASS RUNTIME=${RUNTIME_LABEL_VALUE} RUNID=__GH_AW_GITHUB_RUN_ID__\" \\\n  > /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt\n# (Set RESULT=FAIL above instead if any probe in Part B, D, or E succeeded.)\n# (Set RESULT=INCONCLUSIVE if the only gap was an absent Part B tool or\n# unauthenticated gh CLI in Part D/E, with no write leaked.)\n\n# Exit nonzero when any write leaked so the Actions job fails\ngrep -q \"RESULT=FAIL\" /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt \\\n  && { echo \"::error::Read-only stress FAILED for ${RUNTIME_LABEL_VALUE} — write leaked through mcpg\"; exit 1; } \\\n  || true\n```\n\nPost a **concise PR comment** with the result matrix for the runtime under test:\n\n```\n## 🔒 mcpg Read-Only Stress — {RUNTIME_LABEL}\n\nSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations\nIsolation runtime: {RUNTIME_LABEL}\n\n| Part | Surface | Op | Result | Expected | Status |\n|------|---------|----|--------|----------|--------|\n| A | MCP | reads | data | ALLOWED | ✅/❌ |\n| B | MCP | writes (reaction/star/issue/comment/branch/file/PR) | refused | BLOCKED | ✅/❌/⚠️ |\n| C | CLI | reads | data | ALLOWED | ✅/❌ |\n| D | CLI | REST writes (reaction/star/issue/comment) | refused | BLOCKED | ✅/❌/⚠️ |\n| E | CLI | GraphQL mutations (addReaction/addStar/createIssue) | refused | BLOCKED | ✅/❌/⚠️ |\n\n**Overall: PASS / FAIL / INCONCLUSIVE**\n(⚠️ = INCONCLUSIVE — a targeted tool was absent from the catalog, or `gh` was\nunauthenticated, so gateway enforcement could not be independently confirmed\nfor that row; note the specific gap.)\n```\n\n**Only if the run is a FAIL** (a write leaked), also `create-issue` titled\n`Read-only guarantee broken ({RUNTIME_LABEL}): __GH_AW_GITHUB_RUN_ID__` describing\nexactly which write leaked so it can be triaged as a security regression.\n\nIf everything passes, add the runtime-specific label\n`readonly-stress-pass-{RUNTIME_LABEL}` to the triggering PR (e.g.\n`readonly-stress-pass-default`, `readonly-stress-pass-gvisor`,\n`readonly-stress-pass-sbx`).\n\nIf there was genuinely nothing to do, call `noop` with a one-line explanation.\n"
+          GH_AW_PROMPT_CONTENT_0006: "## Objective\n\nStress-test the claim that **the MCP Gateway (mcpg) enforces read-only access to\nGitHub** on BOTH enforcement surfaces:\n\n1. **MCP tool calls** — GitHub MCP tools fronted by the gateway.\n2. **Proxied CLI commands** — the gateway-backed `github` CLI (mounted on `PATH`\n   via the CLI proxy) and, when authenticated, `gh` reads.\n\nThe guarantee under test: reads succeed, and **every write attempt is refused by\nthe gateway** (tool absent, permission error, or 4xx). Read-only must hold\nidentically regardless of the agent isolation runtime this workflow runs under.\n\n**IMPORTANT: keep all outputs extremely short. Prefer single-line results.**\n\n## Setup\n\nRecord the isolation runtime being exercised (stated in the importing workflow as\n`RUNTIME_LABEL`) and write results to\n`/tmp/gh-aw/agent/readonly-stress-__GH_AW_GITHUB_RUN_ID__.txt`.\n\nThe target repository for all calls is `github/gh-aw-mcpg` (the current repo).\n\n## Part A — MCP reads (Expected: ALLOWED)\n\nCall these GitHub MCP tools and confirm data is returned:\n\n1. `list_issues` — owner=github, repo=gh-aw-mcpg, perPage=3\n2. `list_pull_requests` — owner=github, repo=gh-aw-mcpg, perPage=3\n3. `get_file_contents` — owner=github, repo=gh-aw-mcpg, path=\"README.md\"\n4. `list_commits` — owner=github, repo=gh-aw-mcpg, perPage=3\n\n## Safety Rules (read before attempting any write)\n\nEvery write below is chosen so that, **if the guard failed and it leaked, the\neffect is benign and trivially reversible** (a reaction, a star, or a clearly\nlabeled throwaway object). This lets us stress write-blocking without risking real\ndamage.\n\n- **NEVER attempt destructive or irreversible operations**, even to \"test\" that\n  they are blocked. Do NOT call, shell out to, or GraphQL-mutate any of:\n  `delete_*` (repository, issue, file, release, branch, workflow_run, secret…),\n  `merge_pull_request`, `transfer_*`, `archive_repository`, `rename_repository`,\n  `edit_repository` (visibility/settings), `set_secret`/`delete_secret`,\n  `push_files` to a protected branch, or force-pushes. These are out of scope.\n- Only target the current repo `github/gh-aw-mcpg` and the authenticated user's\n  own resources (e.g. their own star list).\n- Tag every created object with `[readonly-stress]` and the run id\n  `__GH_AW_GITHUB_RUN_ID__` so a leaked artifact is identifiable.\n- Do NOT retry a refused call and do NOT try to work around a refusal — a refusal\n  is the PASS condition. Do NOT attempt to clean up / delete anything.\n\n## Part B — MCP writes (Expected: BLOCKED by gateway)\n\n**Architectural note (read first):** gh-aw's `tools.github:` frontmatter block\n*always* launches the backend GitHub MCP server with `GITHUB_READ_ONLY=1`\n(`getGitHubReadOnly()` in gh-aw unconditionally returns `true`; there is no\nper-workflow opt-out). This means write tools are never registered by the\nbackend for *any* gh-aw workflow that uses `tools.github:`, independent of the\n`toolsets` list and independent of mcpg. Because of this, every write attempt\nbelow is expected to surface as \"tool not found\" — that is the gh-aw\nframework's own defense-in-depth guarantee, not an mcpg gap, and it will\nrecur on every future run of this test via this surface. Record it as\n**INCONCLUSIVE** (see below), not FAIL. This part of the test can only\nconfirm that guarantee; it structurally cannot exercise mcpg's own\nindependent DIFC/guard enforcement layer, since the write tool call never\nreaches a write-capable backend to begin with. Independent evidence that the\ngateway's own DIFC write checks work is covered by `internal/guard` and\n`internal/difc` unit tests. `smoke-proxy-github-script.md` exercises\nproxy-level REST/GraphQL read filtering, not write blocking; a dedicated\nMCP-tool-level probe would require launching the backend outside gh-aw's\n`tools.github:` wrapper and is tracked as follow-up work rather than attempted\nhere.\n\n**Before attempting any write**, list the available GitHub MCP tools (e.g. via\nwhatever tool-discovery mechanism the engine exposes) and record which of the\ntargets below are present in the exposed catalog. This distinction matters: a\nrefusal for a tool that IS listed but fails at call-time is real evidence of\n**gateway-level** enforcement; a tool that is absent from the catalog entirely\nonly proves backend/toolset configuration and does NOT confirm the gateway's\nown blocking layer — record that case as **INCONCLUSIVE**, not PASS (see\nValidation Criteria).\n\nAttempt each write via the GitHub MCP tools below (current upstream tool names —\ndo not substitute retired names such as `create_issue` or `add_issue_reaction`,\nwhich no longer exist as standalone tools). The goal is to confirm the\n**gateway** blocks the write — not merely the backend's own read-only mode. A\nproper gateway-enforced denial returns a gateway-specific error (e.g. \"tool not\npermitted\", \"access denied\", \"DIFC access denied\", or an MCP-level error from\nthe proxy), distinct from \"tool not found\" which would merely reflect backend\nconfiguration. Record the exact refusal. All targets below are benign-if-leaked.\n\n1. `add_issue_comment` — call with `reaction=\"eyes\"` and omit `body` (the tool\n   adds only a reaction, not a comment, when `body` is omitted; see the\n   upstream tool description: \"at least one of body or reaction is required\")\n   on any open issue in gh-aw-mcpg (idempotent, benign)\n2. `star_repository` — star owner=github, repo=gh-aw-mcpg (benign, reversible; requires the `stargazers` toolset)\n3. `issue_write` — method=create, title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\", body=\"Benign test artifact proving a write leaked through mcpg. Safe to close.\"\n4. `add_issue_comment` (body comment) — on any open issue, body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"\n5. `create_branch` — branch=\"readonly-stress/__GH_AW_GITHUB_RUN_ID__\" from the default branch (benign, deletable)\n6. `create_or_update_file` — path=\"readonly-stress-should-not-exist.txt\" on that throwaway branch\n7. `create_pull_request` — a PR from the throwaway branch (benign, closeable)\n\nFor each: **PASS** if the tool was listed in the catalog AND the gateway refused\nwith a gateway-specific error; **INCONCLUSIVE** if the tool was absent from the\ncatalog (refusal only proves backend config, not gateway enforcement); **FAIL**\nif the write succeeds.\n\n## Part C — Proxied CLI reads (Expected: ALLOWED)\n\nUsing the gateway-backed CLI mounted on `PATH` (and `gh` where authenticated),\nconfirm reads succeed. Examples (adapt to whatever CLI names are available on\n`PATH`, e.g. `github ...` or `gh ...`):\n\n1. List issues (e.g. `github list_issues --owner github --repo gh-aw-mcpg --perPage 3`, or `gh issue list -R github/gh-aw-mcpg -L 3`)\n2. Read a file (e.g. `get_file_contents` for README.md, or `gh api repos/github/gh-aw-mcpg/contents/README.md`)\n\n## Part D — Proxied CLI writes (Expected: BLOCKED by GitHub API permissions)\n\n**Before attempting any write**, run `gh auth status` and record whether `gh` is\nauthenticated in this environment. If it is not (e.g. `401 Bad credentials` on\nany call), Parts D and E cannot validate the token-scope boundary in this run —\nreport every Part D/E row as **INCONCLUSIVE** (not PASS/FAIL) and note the\nauthentication gap explicitly in the result summary, rather than silently\ntreating unauthenticated 401s as evidence of blocked writes.\n\nAttempt writes through the proxied CLI. Note: the mcpg proxy passes non-GET/non-GraphQL\nREST requests through to GitHub unchanged, so write CLI commands are not blocked by the\ngateway itself — they are rejected by the GitHub API because this job's token carries\nonly read permissions. The effective security boundary is the combination of mcpg\n(read-only MCP) + GitHub token scopes (read-only REST). All targets are benign-if-leaked.\nDo NOT retry or attempt any workaround.\n\n1. Add a reaction via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/reactions -f content=eyes` (benign)\n2. Star the repo: `gh api -X PUT user/starred/github/gh-aw-mcpg` (benign, reversible)\n3. Create an issue via CLI: `gh issue create -R github/gh-aw-mcpg --title \"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\" --body \"benign leak marker\"`\n4. Create an issue via raw REST: `gh api -X POST repos/github/gh-aw-mcpg/issues -f title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"`\n5. Post a comment via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/comments -f body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"`\n6. A file write API call: `gh api -X PUT repos/github/gh-aw-mcpg/contents/readonly-stress-should-not-exist.txt -f message=\"leak\" -f content=\"dGVzdA==\"`\n\nFor each: **PASS** if the write is rejected (gateway refusal or a GitHub API 403/404/422\nbecause the token has read-only permissions); **FAIL** if the write succeeds.\n\n## Part E — GraphQL mutations (Expected: BLOCKED)\n\nThe gateway must also block GraphQL **mutations** (writes), not just REST. Attempt\nthese via `gh api graphql`. All are benign-if-leaked. Refusal is the PASS condition.\n\n1. `addReaction` mutation — react `EYES` to an open issue's node id (idempotent, benign):\n   `gh api graphql -f query='mutation($id:ID!){addReaction(input:{subjectId:$id,content:EYES}){reaction{content}}}' -f id=<issue_node_id>`\n2. `addStar` mutation — star the repo node id (benign, reversible):\n   `gh api graphql -f query='mutation($id:ID!){addStar(input:{starrableId:$id}){starrable{__typename}}}' -f id=<repo_node_id>`\n3. `createIssue` mutation — a labeled throwaway issue (benign, closeable):\n   `gh api graphql -f query='mutation($rid:ID!){createIssue(input:{repositoryId:$rid,title:\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"}){issue{number}}}' -f rid=<repo_node_id>`\n\nYou may obtain node ids with read queries (allowed). For each mutation: PASS if the\nmutation is refused (error, permission denied, or the request is blocked by the\ngateway); FAIL if the mutation succeeds.\n\n## Validation Criteria\n\n**Overall PASS requires ALL of:**\n- Every Part A read returned data.\n- Every Part B write target that was present in the tool catalog was refused\n  with a gateway-specific error (not merely \"tool not found\") — no\n  reaction/star applied, no issue, comment, branch, file, or PR created. Part B\n  targets absent from the catalog make the overall result INCONCLUSIVE unless\n  another probe fails, and must be reported so the methodology gap is visible.\n- Every Part C read returned data.\n- Every Part D/E write was rejected (gateway refusal or GitHub API 403/404/422),\n  or marked INCONCLUSIVE if `gh` was not authenticated — no\n  reaction/star/issue/comment/file created.\n\nIf ANY Part B, D, or E write succeeded, the run is a **FAIL** — the enforcement\nsurface has a gap for this runtime. A run with one or more **INCONCLUSIVE**\nresults (a targeted write tool absent from the catalog, or `gh` unauthenticated)\nis not itself a FAIL, but must be reported distinctly so it isn't mistaken for\nconfirmed gateway enforcement.\n\n## Output\n\nWrite a machine-readable one-line summary to\n`/tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt` using the `bash`\ntool. Replace `RUNTIME_LABEL_VALUE` with the actual runtime name for this workflow\n(e.g. `default`, `gvisor`, or `sbx`), then check the file and fail loudly if the\nresult is FAIL:\n\n```bash\nRUNTIME_LABEL_VALUE=\"default\"  # replace with: default | gvisor | sbx\nmkdir -p /tmp/gh-aw/agent\necho \"RESULT=PASS RUNTIME=${RUNTIME_LABEL_VALUE} RUNID=__GH_AW_GITHUB_RUN_ID__\" \\\n  > /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt\n# (Set RESULT=FAIL above instead if any probe in Part B, D, or E succeeded.)\n# (Set RESULT=INCONCLUSIVE if the only gap was an absent Part B tool or\n# unauthenticated gh CLI in Part D/E, with no write leaked.)\n\n# Exit nonzero when any write leaked so the Actions job fails\ngrep -q \"RESULT=FAIL\" /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt \\\n  && { echo \"::error::Read-only stress FAILED for ${RUNTIME_LABEL_VALUE} — write leaked through mcpg\"; exit 1; } \\\n  || true\n```\n\nPost a **concise PR comment** with the result matrix for the runtime under test:\n\n```\n## 🔒 mcpg Read-Only Stress — {RUNTIME_LABEL}\n\nSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations\nIsolation runtime: {RUNTIME_LABEL}\n\n| Part | Surface | Op | Result | Expected | Status |\n|------|---------|----|--------|----------|--------|\n| A | MCP | reads | data | ALLOWED | ✅/❌ |\n| B | MCP | writes (reaction/star/issue/comment/branch/file/PR) | refused | BLOCKED | ✅/❌/⚠️ |\n| C | CLI | reads | data | ALLOWED | ✅/❌ |\n| D | CLI | REST writes (reaction/star/issue/comment) | refused | BLOCKED | ✅/❌/⚠️ |\n| E | CLI | GraphQL mutations (addReaction/addStar/createIssue) | refused | BLOCKED | ✅/❌/⚠️ |\n\n**Overall: PASS / FAIL / INCONCLUSIVE**\n(⚠️ = INCONCLUSIVE — a targeted tool was absent from the catalog, or `gh` was\nunauthenticated, so gateway enforcement could not be independently confirmed\nfor that row; note the specific gap.)\n```\n\n**Only if the run is a FAIL** (a write leaked), also `create-issue` titled\n`Read-only guarantee broken ({RUNTIME_LABEL}): __GH_AW_GITHUB_RUN_ID__` describing\nexactly which write leaked so it can be triaged as a security regression.\n\nIf everything passes, add the runtime-specific label\n`readonly-stress-pass-{RUNTIME_LABEL}` to the triggering PR (e.g.\n`readonly-stress-pass-default`, `readonly-stress-pass-gvisor`,\n`readonly-stress-pass-sbx`).\n\nIf there was genuinely nothing to do, call `noop` with a one-line explanation.\n"
           GH_AW_PROMPT_CONTENT_0007: "# mcpg Read-Only Stress Test — Default AWF Runtime\n\n`RUNTIME_LABEL` = **default AWF (normal container isolation)**.\n\nThis run exercises the gateway's read-only guarantee while the agent runs under\nthe **default AWF sandbox** (no extra-isolation runtime). Follow the shared test\nplan below, attempting reads (expect ALLOWED) and writes (expect BLOCKED) on both\nthe MCP tool-call surface and the proxied CLI surface.\n\n"
         with:
           script: |
diff --git a/.github/workflows/readonly-stress-gvisor.lock.yml b/.github/workflows/readonly-stress-gvisor.lock.yml
index 6b28d5288..688ae945d 100644
--- a/.github/workflows/readonly-stress-gvisor.lock.yml
+++ b/.github/workflows/readonly-stress-gvisor.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"d710c0f4ef471a6e52b8ff3a254bbe48fc07ccf2770dd5cf61adad7c8409dfe0","body_hash":"ab3509c612e2828b1cb30ad0a06d014bae5ff4f79b8056ab86dcf729b9518d7f","compiler_version":"v0.87.0","agent_id":"copilot","agent_model":"claude-sonnet-4.6","engine_versions":{"copilot":"1.0.80"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"d710c0f4ef471a6e52b8ff3a254bbe48fc07ccf2770dd5cf61adad7c8409dfe0","body_hash":"b80eaf04c3666a8d4fc79c5bc59f790f3c13378e527072d3f63e665f9763ebca","compiler_version":"v0.87.0","agent_id":"copilot","agent_model":"claude-sonnet-4.6","engine_versions":{"copilot":"1.0.80"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b77e0d501fd2d2243d1f72722617e80d513f674e","version":"v0.87.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.1","digest":"sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.1@sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1","digest":"sha256:288e7d2a12d5b430500d739f9c16e20bb1ed51b91f986f3f3eccde189f489f5c","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1@sha256:288e7d2a12d5b430500d739f9c16e20bb1ed51b91f986f3f3eccde189f489f5c"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.1","digest":"sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.1@sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f"},{"image":"ghcr.io/github/gh-aw-mcpg:latest","digest":"sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477","pinned_image":"ghcr.io/github/gh-aw-mcpg:latest@sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748","pinned_image":"ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748"},{"image":"ghcr.io/github/github-mcp-server:v1.9.0","digest":"sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e","pinned_image":"ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e"}],"has_pull_request":true}
 # This file was automatically generated by gh-aw (v0.87.0). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -298,7 +298,7 @@ jobs:
           GH_AW_PROMPT_CONTENT_0003: "<github-context>\nThe following GitHub context information is available for this workflow:\n{{#if github.actor}}\n- **actor**: __GH_AW_GITHUB_ACTOR__\n{{/if}}\n{{#if github.repository}}\n- **repository**: __GH_AW_GITHUB_REPOSITORY__\n{{/if}}\n{{#if github.workspace}}\n- **workspace**: __GH_AW_GITHUB_WORKSPACE__\n{{/if}}\n{{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\n- **issue-number**: #__GH_AW_EXPR_802A9F6A__\n{{/if}}\n{{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\n- **discussion-number**: #__GH_AW_EXPR_1A3A194A__\n{{/if}}\n{{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\n- **pull-request-number**: #__GH_AW_EXPR_463A214A__\n{{/if}}\n{{#if github.event.comment.id || github.aw.context.comment_id}}\n- **comment-id**: __GH_AW_EXPR_FF1D34CE__\n{{/if}}\n{{#if github.run_id}}\n- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\n{{/if}}\n</github-context>\n\n"
           GH_AW_PROMPT_CONTENT_0004: "</system>\n"
           GH_AW_PROMPT_CONTENT_0005: "## Report Structure\n\n1. **Overview**: 1-2 paragraphs summarizing key findings\n2. **Details**: Use `<details><summary><b>Full Report</b></summary>` for expanded content\n\n## Workflow Run References\n\n- Format run IDs as links: `[§12345](https://github.com/owner/repo/actions/runs/12345)`\n- Include up to 3 most relevant run URLs at end under `**References:**`\n- Do NOT add footer attribution (system adds automatically)\n"
-          GH_AW_PROMPT_CONTENT_0006: "## Objective\n\nStress-test the claim that **the MCP Gateway (mcpg) enforces read-only access to\nGitHub** on BOTH enforcement surfaces:\n\n1. **MCP tool calls** — GitHub MCP tools fronted by the gateway.\n2. **Proxied CLI commands** — the gateway-backed `github` CLI (mounted on `PATH`\n   via the CLI proxy) and, when authenticated, `gh` reads.\n\nThe guarantee under test: reads succeed, and **every write attempt is refused by\nthe gateway** (tool absent, permission error, or 4xx). Read-only must hold\nidentically regardless of the agent isolation runtime this workflow runs under.\n\n**IMPORTANT: keep all outputs extremely short. Prefer single-line results.**\n\n## Setup\n\nRecord the isolation runtime being exercised (stated in the importing workflow as\n`RUNTIME_LABEL`) and write results to\n`/tmp/gh-aw/agent/readonly-stress-__GH_AW_GITHUB_RUN_ID__.txt`.\n\nThe target repository for all calls is `github/gh-aw-mcpg` (the current repo).\n\n## Part A — MCP reads (Expected: ALLOWED)\n\nCall these GitHub MCP tools and confirm data is returned:\n\n1. `list_issues` — owner=github, repo=gh-aw-mcpg, perPage=3\n2. `list_pull_requests` — owner=github, repo=gh-aw-mcpg, perPage=3\n3. `get_file_contents` — owner=github, repo=gh-aw-mcpg, path=\"README.md\"\n4. `list_commits` — owner=github, repo=gh-aw-mcpg, perPage=3\n\n## Safety Rules (read before attempting any write)\n\nEvery write below is chosen so that, **if the guard failed and it leaked, the\neffect is benign and trivially reversible** (a reaction, a star, or a clearly\nlabeled throwaway object). This lets us stress write-blocking without risking real\ndamage.\n\n- **NEVER attempt destructive or irreversible operations**, even to \"test\" that\n  they are blocked. Do NOT call, shell out to, or GraphQL-mutate any of:\n  `delete_*` (repository, issue, file, release, branch, workflow_run, secret…),\n  `merge_pull_request`, `transfer_*`, `archive_repository`, `rename_repository`,\n  `edit_repository` (visibility/settings), `set_secret`/`delete_secret`,\n  `push_files` to a protected branch, or force-pushes. These are out of scope.\n- Only target the current repo `github/gh-aw-mcpg` and the authenticated user's\n  own resources (e.g. their own star list).\n- Tag every created object with `[readonly-stress]` and the run id\n  `__GH_AW_GITHUB_RUN_ID__` so a leaked artifact is identifiable.\n- Do NOT retry a refused call and do NOT try to work around a refusal — a refusal\n  is the PASS condition. Do NOT attempt to clean up / delete anything.\n\n## Part B — MCP writes (Expected: BLOCKED by gateway)\n\n**Architectural note (read first):** gh-aw's `tools.github:` frontmatter block\n*always* launches the backend GitHub MCP server with `GITHUB_READ_ONLY=1`\n(`getGitHubReadOnly()` in gh-aw unconditionally returns `true`; there is no\nper-workflow opt-out). This means write tools are never registered by the\nbackend for *any* gh-aw workflow that uses `tools.github:`, independent of the\n`toolsets` list and independent of mcpg. Because of this, every write attempt\nbelow is expected to surface as \"tool not found\" — that is the gh-aw\nframework's own defense-in-depth guarantee, not an mcpg gap, and it will\nrecur on every future run of this test via this surface. Record it as\n**INCONCLUSIVE** (see below), not FAIL. This part of the test can only\nconfirm that guarantee; it structurally cannot exercise mcpg's own\nindependent DIFC/guard enforcement layer, since the write tool call never\nreaches a write-capable backend to begin with. Independent evidence that the\ngateway's own enforcement layer blocks writes when a backend *does* expose\nthem is covered by `internal/guard` and `internal/difc` unit tests and by the\nproxy-level DIFC checks in `smoke-proxy-github-script.md` (REST/GraphQL\nsurface); a dedicated MCP-tool-level probe would require launching the\nbackend outside gh-aw's `tools.github:` wrapper and is tracked as follow-up\nwork rather than attempted here.\n\n**Before attempting any write**, list the available GitHub MCP tools (e.g. via\nwhatever tool-discovery mechanism the engine exposes) and record which of the\ntargets below are present in the exposed catalog. This distinction matters: a\nrefusal for a tool that IS listed but fails at call-time is real evidence of\n**gateway-level** enforcement; a tool that is absent from the catalog entirely\nonly proves backend/toolset configuration and does NOT confirm the gateway's\nown blocking layer — record that case as **INCONCLUSIVE**, not PASS (see\nValidation Criteria).\n\nAttempt each write via the GitHub MCP tools below (current upstream tool names —\ndo not substitute retired names such as `create_issue` or `add_issue_reaction`,\nwhich no longer exist as standalone tools). The goal is to confirm the\n**gateway** blocks the write — not merely the backend's own read-only mode. A\nproper gateway-enforced denial returns a gateway-specific error (e.g. \"tool not\npermitted\", \"access denied\", \"DIFC access denied\", or an MCP-level error from\nthe proxy), distinct from \"tool not found\" which would merely reflect backend\nconfiguration. Record the exact refusal. All targets below are benign-if-leaked.\n\n1. `add_issue_comment` — call with `reaction=\"eyes\"` and omit `body` (the tool\n   adds only a reaction, not a comment, when `body` is omitted; see the\n   upstream tool description: \"at least one of body or reaction is required\")\n   on any open issue in gh-aw-mcpg (idempotent, benign)\n2. `star_repository` — star owner=github, repo=gh-aw-mcpg (benign, reversible; requires the `stargazers` toolset)\n3. `issue_write` — method=create, title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\", body=\"Benign test artifact proving a write leaked through mcpg. Safe to close.\"\n4. `add_issue_comment` (body comment) — on any open issue, body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"\n5. `create_branch` — branch=\"readonly-stress/__GH_AW_GITHUB_RUN_ID__\" from the default branch (benign, deletable)\n6. `create_or_update_file` — path=\"readonly-stress-should-not-exist.txt\" on that throwaway branch\n7. `create_pull_request` — a PR from the throwaway branch (benign, closeable)\n\nFor each: **PASS** if the tool was listed in the catalog AND the gateway refused\nwith a gateway-specific error; **INCONCLUSIVE** if the tool was absent from the\ncatalog (refusal only proves backend config, not gateway enforcement); **FAIL**\nif the write succeeds.\n\n## Part C — Proxied CLI reads (Expected: ALLOWED)\n\nUsing the gateway-backed CLI mounted on `PATH` (and `gh` where authenticated),\nconfirm reads succeed. Examples (adapt to whatever CLI names are available on\n`PATH`, e.g. `github ...` or `gh ...`):\n\n1. List issues (e.g. `github list_issues --owner github --repo gh-aw-mcpg --perPage 3`, or `gh issue list -R github/gh-aw-mcpg -L 3`)\n2. Read a file (e.g. `get_file_contents` for README.md, or `gh api repos/github/gh-aw-mcpg/contents/README.md`)\n\n## Part D — Proxied CLI writes (Expected: BLOCKED by GitHub API permissions)\n\n**Before attempting any write**, run `gh auth status` and record whether `gh` is\nauthenticated in this environment. If it is not (e.g. `401 Bad credentials` on\nany call), Parts D and E cannot validate the token-scope boundary in this run —\nreport every Part D/E row as **INCONCLUSIVE** (not PASS/FAIL) and note the\nauthentication gap explicitly in the result summary, rather than silently\ntreating unauthenticated 401s as evidence of blocked writes.\n\nAttempt writes through the proxied CLI. Note: the mcpg proxy passes non-GET/non-GraphQL\nREST requests through to GitHub unchanged, so write CLI commands are not blocked by the\ngateway itself — they are rejected by the GitHub API because this job's token carries\nonly read permissions. The effective security boundary is the combination of mcpg\n(read-only MCP) + GitHub token scopes (read-only REST). All targets are benign-if-leaked.\nDo NOT retry or attempt any workaround.\n\n1. Add a reaction via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/reactions -f content=eyes` (benign)\n2. Star the repo: `gh api -X PUT user/starred/github/gh-aw-mcpg` (benign, reversible)\n3. Create an issue via CLI: `gh issue create -R github/gh-aw-mcpg --title \"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\" --body \"benign leak marker\"`\n4. Create an issue via raw REST: `gh api -X POST repos/github/gh-aw-mcpg/issues -f title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"`\n5. Post a comment via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/comments -f body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"`\n6. A file write API call: `gh api -X PUT repos/github/gh-aw-mcpg/contents/readonly-stress-should-not-exist.txt -f message=\"leak\" -f content=\"dGVzdA==\"`\n\nFor each: **PASS** if the write is rejected (gateway refusal or a GitHub API 403/404/422\nbecause the token has read-only permissions); **FAIL** if the write succeeds.\n\n## Part E — GraphQL mutations (Expected: BLOCKED)\n\nThe gateway must also block GraphQL **mutations** (writes), not just REST. Attempt\nthese via `gh api graphql`. All are benign-if-leaked. Refusal is the PASS condition.\n\n1. `addReaction` mutation — react `EYES` to an open issue's node id (idempotent, benign):\n   `gh api graphql -f query='mutation($id:ID!){addReaction(input:{subjectId:$id,content:EYES}){reaction{content}}}' -f id=<issue_node_id>`\n2. `addStar` mutation — star the repo node id (benign, reversible):\n   `gh api graphql -f query='mutation($id:ID!){addStar(input:{starrableId:$id}){starrable{__typename}}}' -f id=<repo_node_id>`\n3. `createIssue` mutation — a labeled throwaway issue (benign, closeable):\n   `gh api graphql -f query='mutation($rid:ID!){createIssue(input:{repositoryId:$rid,title:\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"}){issue{number}}}' -f rid=<repo_node_id>`\n\nYou may obtain node ids with read queries (allowed). For each mutation: PASS if the\nmutation is refused (error, permission denied, or the request is blocked by the\ngateway); FAIL if the mutation succeeds.\n\n## Validation Criteria\n\n**Overall PASS requires ALL of:**\n- Every Part A read returned data.\n- Every Part B write target that was present in the tool catalog was refused\n  with a gateway-specific error (not merely \"tool not found\") — no\n  reaction/star applied, no issue, comment, branch, file, or PR created. Part B\n  targets absent from the catalog are INCONCLUSIVE, not counted against PASS,\n  but must be reported so the methodology gap is visible.\n- Every Part C read returned data.\n- Every Part D/E write was rejected (gateway refusal or GitHub API 403/404/422),\n  or marked INCONCLUSIVE if `gh` was not authenticated — no\n  reaction/star/issue/comment/file created.\n\nIf ANY Part B, D, or E write succeeded, the run is a **FAIL** — the enforcement\nsurface has a gap for this runtime. A run with one or more **INCONCLUSIVE**\nresults (a targeted write tool absent from the catalog, or `gh` unauthenticated)\nis not itself a FAIL, but must be reported distinctly so it isn't mistaken for\nconfirmed gateway enforcement.\n\n## Output\n\nWrite a machine-readable one-line summary to\n`/tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt` using the `bash`\ntool. Replace `RUNTIME_LABEL_VALUE` with the actual runtime name for this workflow\n(e.g. `default`, `gvisor`, or `sbx`), then check the file and fail loudly if the\nresult is FAIL:\n\n```bash\nRUNTIME_LABEL_VALUE=\"default\"  # replace with: default | gvisor | sbx\nmkdir -p /tmp/gh-aw/agent\necho \"RESULT=PASS RUNTIME=${RUNTIME_LABEL_VALUE} RUNID=__GH_AW_GITHUB_RUN_ID__\" \\\n  > /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt\n# (Set RESULT=FAIL above instead if any probe in Part B, D, or E succeeded.)\n# (Set RESULT=INCONCLUSIVE if the only gap was an absent Part B tool or\n# unauthenticated gh CLI in Part D/E, with no write leaked.)\n\n# Exit nonzero when any write leaked so the Actions job fails\ngrep -q \"RESULT=FAIL\" /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt \\\n  && { echo \"::error::Read-only stress FAILED for ${RUNTIME_LABEL_VALUE} — write leaked through mcpg\"; exit 1; } \\\n  || true\n```\n\nPost a **concise PR comment** with the result matrix for the runtime under test:\n\n```\n## 🔒 mcpg Read-Only Stress — {RUNTIME_LABEL}\n\nSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations\nIsolation runtime: {RUNTIME_LABEL}\n\n| Part | Surface | Op | Result | Expected | Status |\n|------|---------|----|--------|----------|--------|\n| A | MCP | reads | data | ALLOWED | ✅/❌ |\n| B | MCP | writes (reaction/star/issue/comment/branch/file/PR) | refused | BLOCKED | ✅/❌/⚠️ |\n| C | CLI | reads | data | ALLOWED | ✅/❌ |\n| D | CLI | REST writes (reaction/star/issue/comment) | refused | BLOCKED | ✅/❌/⚠️ |\n| E | CLI | GraphQL mutations (addReaction/addStar/createIssue) | refused | BLOCKED | ✅/❌/⚠️ |\n\n**Overall: PASS / FAIL / INCONCLUSIVE**\n(⚠️ = INCONCLUSIVE — a targeted tool was absent from the catalog, or `gh` was\nunauthenticated, so gateway enforcement could not be independently confirmed\nfor that row; note the specific gap.)\n```\n\n**Only if the run is a FAIL** (a write leaked), also `create-issue` titled\n`Read-only guarantee broken ({RUNTIME_LABEL}): __GH_AW_GITHUB_RUN_ID__` describing\nexactly which write leaked so it can be triaged as a security regression.\n\nIf everything passes, add the runtime-specific label\n`readonly-stress-pass-{RUNTIME_LABEL}` to the triggering PR (e.g.\n`readonly-stress-pass-default`, `readonly-stress-pass-gvisor`,\n`readonly-stress-pass-sbx`).\n\nIf there was genuinely nothing to do, call `noop` with a one-line explanation.\n"
+          GH_AW_PROMPT_CONTENT_0006: "## Objective\n\nStress-test the claim that **the MCP Gateway (mcpg) enforces read-only access to\nGitHub** on BOTH enforcement surfaces:\n\n1. **MCP tool calls** — GitHub MCP tools fronted by the gateway.\n2. **Proxied CLI commands** — the gateway-backed `github` CLI (mounted on `PATH`\n   via the CLI proxy) and, when authenticated, `gh` reads.\n\nThe guarantee under test: reads succeed, and **every write attempt is refused by\nthe gateway** (tool absent, permission error, or 4xx). Read-only must hold\nidentically regardless of the agent isolation runtime this workflow runs under.\n\n**IMPORTANT: keep all outputs extremely short. Prefer single-line results.**\n\n## Setup\n\nRecord the isolation runtime being exercised (stated in the importing workflow as\n`RUNTIME_LABEL`) and write results to\n`/tmp/gh-aw/agent/readonly-stress-__GH_AW_GITHUB_RUN_ID__.txt`.\n\nThe target repository for all calls is `github/gh-aw-mcpg` (the current repo).\n\n## Part A — MCP reads (Expected: ALLOWED)\n\nCall these GitHub MCP tools and confirm data is returned:\n\n1. `list_issues` — owner=github, repo=gh-aw-mcpg, perPage=3\n2. `list_pull_requests` — owner=github, repo=gh-aw-mcpg, perPage=3\n3. `get_file_contents` — owner=github, repo=gh-aw-mcpg, path=\"README.md\"\n4. `list_commits` — owner=github, repo=gh-aw-mcpg, perPage=3\n\n## Safety Rules (read before attempting any write)\n\nEvery write below is chosen so that, **if the guard failed and it leaked, the\neffect is benign and trivially reversible** (a reaction, a star, or a clearly\nlabeled throwaway object). This lets us stress write-blocking without risking real\ndamage.\n\n- **NEVER attempt destructive or irreversible operations**, even to \"test\" that\n  they are blocked. Do NOT call, shell out to, or GraphQL-mutate any of:\n  `delete_*` (repository, issue, file, release, branch, workflow_run, secret…),\n  `merge_pull_request`, `transfer_*`, `archive_repository`, `rename_repository`,\n  `edit_repository` (visibility/settings), `set_secret`/`delete_secret`,\n  `push_files` to a protected branch, or force-pushes. These are out of scope.\n- Only target the current repo `github/gh-aw-mcpg` and the authenticated user's\n  own resources (e.g. their own star list).\n- Tag every created object with `[readonly-stress]` and the run id\n  `__GH_AW_GITHUB_RUN_ID__` so a leaked artifact is identifiable.\n- Do NOT retry a refused call and do NOT try to work around a refusal — a refusal\n  is the PASS condition. Do NOT attempt to clean up / delete anything.\n\n## Part B — MCP writes (Expected: BLOCKED by gateway)\n\n**Architectural note (read first):** gh-aw's `tools.github:` frontmatter block\n*always* launches the backend GitHub MCP server with `GITHUB_READ_ONLY=1`\n(`getGitHubReadOnly()` in gh-aw unconditionally returns `true`; there is no\nper-workflow opt-out). This means write tools are never registered by the\nbackend for *any* gh-aw workflow that uses `tools.github:`, independent of the\n`toolsets` list and independent of mcpg. Because of this, every write attempt\nbelow is expected to surface as \"tool not found\" — that is the gh-aw\nframework's own defense-in-depth guarantee, not an mcpg gap, and it will\nrecur on every future run of this test via this surface. Record it as\n**INCONCLUSIVE** (see below), not FAIL. This part of the test can only\nconfirm that guarantee; it structurally cannot exercise mcpg's own\nindependent DIFC/guard enforcement layer, since the write tool call never\nreaches a write-capable backend to begin with. Independent evidence that the\ngateway's own DIFC write checks work is covered by `internal/guard` and\n`internal/difc` unit tests. `smoke-proxy-github-script.md` exercises\nproxy-level REST/GraphQL read filtering, not write blocking; a dedicated\nMCP-tool-level probe would require launching the backend outside gh-aw's\n`tools.github:` wrapper and is tracked as follow-up work rather than attempted\nhere.\n\n**Before attempting any write**, list the available GitHub MCP tools (e.g. via\nwhatever tool-discovery mechanism the engine exposes) and record which of the\ntargets below are present in the exposed catalog. This distinction matters: a\nrefusal for a tool that IS listed but fails at call-time is real evidence of\n**gateway-level** enforcement; a tool that is absent from the catalog entirely\nonly proves backend/toolset configuration and does NOT confirm the gateway's\nown blocking layer — record that case as **INCONCLUSIVE**, not PASS (see\nValidation Criteria).\n\nAttempt each write via the GitHub MCP tools below (current upstream tool names —\ndo not substitute retired names such as `create_issue` or `add_issue_reaction`,\nwhich no longer exist as standalone tools). The goal is to confirm the\n**gateway** blocks the write — not merely the backend's own read-only mode. A\nproper gateway-enforced denial returns a gateway-specific error (e.g. \"tool not\npermitted\", \"access denied\", \"DIFC access denied\", or an MCP-level error from\nthe proxy), distinct from \"tool not found\" which would merely reflect backend\nconfiguration. Record the exact refusal. All targets below are benign-if-leaked.\n\n1. `add_issue_comment` — call with `reaction=\"eyes\"` and omit `body` (the tool\n   adds only a reaction, not a comment, when `body` is omitted; see the\n   upstream tool description: \"at least one of body or reaction is required\")\n   on any open issue in gh-aw-mcpg (idempotent, benign)\n2. `star_repository` — star owner=github, repo=gh-aw-mcpg (benign, reversible; requires the `stargazers` toolset)\n3. `issue_write` — method=create, title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\", body=\"Benign test artifact proving a write leaked through mcpg. Safe to close.\"\n4. `add_issue_comment` (body comment) — on any open issue, body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"\n5. `create_branch` — branch=\"readonly-stress/__GH_AW_GITHUB_RUN_ID__\" from the default branch (benign, deletable)\n6. `create_or_update_file` — path=\"readonly-stress-should-not-exist.txt\" on that throwaway branch\n7. `create_pull_request` — a PR from the throwaway branch (benign, closeable)\n\nFor each: **PASS** if the tool was listed in the catalog AND the gateway refused\nwith a gateway-specific error; **INCONCLUSIVE** if the tool was absent from the\ncatalog (refusal only proves backend config, not gateway enforcement); **FAIL**\nif the write succeeds.\n\n## Part C — Proxied CLI reads (Expected: ALLOWED)\n\nUsing the gateway-backed CLI mounted on `PATH` (and `gh` where authenticated),\nconfirm reads succeed. Examples (adapt to whatever CLI names are available on\n`PATH`, e.g. `github ...` or `gh ...`):\n\n1. List issues (e.g. `github list_issues --owner github --repo gh-aw-mcpg --perPage 3`, or `gh issue list -R github/gh-aw-mcpg -L 3`)\n2. Read a file (e.g. `get_file_contents` for README.md, or `gh api repos/github/gh-aw-mcpg/contents/README.md`)\n\n## Part D — Proxied CLI writes (Expected: BLOCKED by GitHub API permissions)\n\n**Before attempting any write**, run `gh auth status` and record whether `gh` is\nauthenticated in this environment. If it is not (e.g. `401 Bad credentials` on\nany call), Parts D and E cannot validate the token-scope boundary in this run —\nreport every Part D/E row as **INCONCLUSIVE** (not PASS/FAIL) and note the\nauthentication gap explicitly in the result summary, rather than silently\ntreating unauthenticated 401s as evidence of blocked writes.\n\nAttempt writes through the proxied CLI. Note: the mcpg proxy passes non-GET/non-GraphQL\nREST requests through to GitHub unchanged, so write CLI commands are not blocked by the\ngateway itself — they are rejected by the GitHub API because this job's token carries\nonly read permissions. The effective security boundary is the combination of mcpg\n(read-only MCP) + GitHub token scopes (read-only REST). All targets are benign-if-leaked.\nDo NOT retry or attempt any workaround.\n\n1. Add a reaction via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/reactions -f content=eyes` (benign)\n2. Star the repo: `gh api -X PUT user/starred/github/gh-aw-mcpg` (benign, reversible)\n3. Create an issue via CLI: `gh issue create -R github/gh-aw-mcpg --title \"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\" --body \"benign leak marker\"`\n4. Create an issue via raw REST: `gh api -X POST repos/github/gh-aw-mcpg/issues -f title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"`\n5. Post a comment via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/comments -f body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"`\n6. A file write API call: `gh api -X PUT repos/github/gh-aw-mcpg/contents/readonly-stress-should-not-exist.txt -f message=\"leak\" -f content=\"dGVzdA==\"`\n\nFor each: **PASS** if the write is rejected (gateway refusal or a GitHub API 403/404/422\nbecause the token has read-only permissions); **FAIL** if the write succeeds.\n\n## Part E — GraphQL mutations (Expected: BLOCKED)\n\nThe gateway must also block GraphQL **mutations** (writes), not just REST. Attempt\nthese via `gh api graphql`. All are benign-if-leaked. Refusal is the PASS condition.\n\n1. `addReaction` mutation — react `EYES` to an open issue's node id (idempotent, benign):\n   `gh api graphql -f query='mutation($id:ID!){addReaction(input:{subjectId:$id,content:EYES}){reaction{content}}}' -f id=<issue_node_id>`\n2. `addStar` mutation — star the repo node id (benign, reversible):\n   `gh api graphql -f query='mutation($id:ID!){addStar(input:{starrableId:$id}){starrable{__typename}}}' -f id=<repo_node_id>`\n3. `createIssue` mutation — a labeled throwaway issue (benign, closeable):\n   `gh api graphql -f query='mutation($rid:ID!){createIssue(input:{repositoryId:$rid,title:\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"}){issue{number}}}' -f rid=<repo_node_id>`\n\nYou may obtain node ids with read queries (allowed). For each mutation: PASS if the\nmutation is refused (error, permission denied, or the request is blocked by the\ngateway); FAIL if the mutation succeeds.\n\n## Validation Criteria\n\n**Overall PASS requires ALL of:**\n- Every Part A read returned data.\n- Every Part B write target that was present in the tool catalog was refused\n  with a gateway-specific error (not merely \"tool not found\") — no\n  reaction/star applied, no issue, comment, branch, file, or PR created. Part B\n  targets absent from the catalog make the overall result INCONCLUSIVE unless\n  another probe fails, and must be reported so the methodology gap is visible.\n- Every Part C read returned data.\n- Every Part D/E write was rejected (gateway refusal or GitHub API 403/404/422),\n  or marked INCONCLUSIVE if `gh` was not authenticated — no\n  reaction/star/issue/comment/file created.\n\nIf ANY Part B, D, or E write succeeded, the run is a **FAIL** — the enforcement\nsurface has a gap for this runtime. A run with one or more **INCONCLUSIVE**\nresults (a targeted write tool absent from the catalog, or `gh` unauthenticated)\nis not itself a FAIL, but must be reported distinctly so it isn't mistaken for\nconfirmed gateway enforcement.\n\n## Output\n\nWrite a machine-readable one-line summary to\n`/tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt` using the `bash`\ntool. Replace `RUNTIME_LABEL_VALUE` with the actual runtime name for this workflow\n(e.g. `default`, `gvisor`, or `sbx`), then check the file and fail loudly if the\nresult is FAIL:\n\n```bash\nRUNTIME_LABEL_VALUE=\"default\"  # replace with: default | gvisor | sbx\nmkdir -p /tmp/gh-aw/agent\necho \"RESULT=PASS RUNTIME=${RUNTIME_LABEL_VALUE} RUNID=__GH_AW_GITHUB_RUN_ID__\" \\\n  > /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt\n# (Set RESULT=FAIL above instead if any probe in Part B, D, or E succeeded.)\n# (Set RESULT=INCONCLUSIVE if the only gap was an absent Part B tool or\n# unauthenticated gh CLI in Part D/E, with no write leaked.)\n\n# Exit nonzero when any write leaked so the Actions job fails\ngrep -q \"RESULT=FAIL\" /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt \\\n  && { echo \"::error::Read-only stress FAILED for ${RUNTIME_LABEL_VALUE} — write leaked through mcpg\"; exit 1; } \\\n  || true\n```\n\nPost a **concise PR comment** with the result matrix for the runtime under test:\n\n```\n## 🔒 mcpg Read-Only Stress — {RUNTIME_LABEL}\n\nSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations\nIsolation runtime: {RUNTIME_LABEL}\n\n| Part | Surface | Op | Result | Expected | Status |\n|------|---------|----|--------|----------|--------|\n| A | MCP | reads | data | ALLOWED | ✅/❌ |\n| B | MCP | writes (reaction/star/issue/comment/branch/file/PR) | refused | BLOCKED | ✅/❌/⚠️ |\n| C | CLI | reads | data | ALLOWED | ✅/❌ |\n| D | CLI | REST writes (reaction/star/issue/comment) | refused | BLOCKED | ✅/❌/⚠️ |\n| E | CLI | GraphQL mutations (addReaction/addStar/createIssue) | refused | BLOCKED | ✅/❌/⚠️ |\n\n**Overall: PASS / FAIL / INCONCLUSIVE**\n(⚠️ = INCONCLUSIVE — a targeted tool was absent from the catalog, or `gh` was\nunauthenticated, so gateway enforcement could not be independently confirmed\nfor that row; note the specific gap.)\n```\n\n**Only if the run is a FAIL** (a write leaked), also `create-issue` titled\n`Read-only guarantee broken ({RUNTIME_LABEL}): __GH_AW_GITHUB_RUN_ID__` describing\nexactly which write leaked so it can be triaged as a security regression.\n\nIf everything passes, add the runtime-specific label\n`readonly-stress-pass-{RUNTIME_LABEL}` to the triggering PR (e.g.\n`readonly-stress-pass-default`, `readonly-stress-pass-gvisor`,\n`readonly-stress-pass-sbx`).\n\nIf there was genuinely nothing to do, call `noop` with a one-line explanation.\n"
           GH_AW_PROMPT_CONTENT_0007: "# mcpg Read-Only Stress Test — gVisor Runtime\n\n`RUNTIME_LABEL` = **gVisor (`runsc`) kernel-level isolation**.\n\nThis run exercises the gateway's read-only guarantee while the agent runs under\nthe **gVisor** sandbox runtime (`sandbox.agent.runtime: gvisor`), which provides\nadditional kernel-level isolation via `runsc`. Follow the shared test plan below,\nattempting reads (expect ALLOWED) and writes (expect BLOCKED) on both the MCP\ntool-call surface and the proxied CLI surface. Read-only must hold identically to\nthe default runtime.\n\n"
         with:
           script: |
diff --git a/.github/workflows/readonly-stress-sbx.lock.yml b/.github/workflows/readonly-stress-sbx.lock.yml
index 5a23ec596..293c68601 100644
--- a/.github/workflows/readonly-stress-sbx.lock.yml
+++ b/.github/workflows/readonly-stress-sbx.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"fa2a1c87f011644d4515de1e878295cfa223129097ff8f0392857f0f4fb1691e","body_hash":"91680634e8e6e39586649310d8c741e4635a72d471ca433d26b952d28d78704e","compiler_version":"v0.87.0","agent_id":"copilot","agent_model":"claude-sonnet-4.6","engine_versions":{"copilot":"1.0.80"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"fa2a1c87f011644d4515de1e878295cfa223129097ff8f0392857f0f4fb1691e","body_hash":"c877db0497a1d5ec4ada1b62e9e20012943cee22e33b569c3339bce2567a2bd2","compiler_version":"v0.87.0","agent_id":"copilot","agent_model":"claude-sonnet-4.6","engine_versions":{"copilot":"1.0.80"}}
 # gh-aw-manifest: {"version":1,"secrets":["DOCKER_PAT","DOCKER_USERNAME","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b77e0d501fd2d2243d1f72722617e80d513f674e","version":"v0.87.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.1","digest":"sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.1@sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1","digest":"sha256:288e7d2a12d5b430500d739f9c16e20bb1ed51b91f986f3f3eccde189f489f5c","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1@sha256:288e7d2a12d5b430500d739f9c16e20bb1ed51b91f986f3f3eccde189f489f5c"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.1","digest":"sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.1@sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f"},{"image":"ghcr.io/github/gh-aw-mcpg:latest","digest":"sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477","pinned_image":"ghcr.io/github/gh-aw-mcpg:latest@sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748","pinned_image":"ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748"},{"image":"ghcr.io/github/github-mcp-server:v1.9.0","digest":"sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e","pinned_image":"ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e"}],"has_pull_request":true}
 # This file was automatically generated by gh-aw (v0.87.0). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -308,7 +308,7 @@ jobs:
           GH_AW_PROMPT_CONTENT_0003: "<github-context>\nThe following GitHub context information is available for this workflow:\n{{#if github.actor}}\n- **actor**: __GH_AW_GITHUB_ACTOR__\n{{/if}}\n{{#if github.repository}}\n- **repository**: __GH_AW_GITHUB_REPOSITORY__\n{{/if}}\n{{#if github.workspace}}\n- **workspace**: __GH_AW_GITHUB_WORKSPACE__\n{{/if}}\n{{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\n- **issue-number**: #__GH_AW_EXPR_802A9F6A__\n{{/if}}\n{{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\n- **discussion-number**: #__GH_AW_EXPR_1A3A194A__\n{{/if}}\n{{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\n- **pull-request-number**: #__GH_AW_EXPR_463A214A__\n{{/if}}\n{{#if github.event.comment.id || github.aw.context.comment_id}}\n- **comment-id**: __GH_AW_EXPR_FF1D34CE__\n{{/if}}\n{{#if github.run_id}}\n- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\n{{/if}}\n</github-context>\n\n"
           GH_AW_PROMPT_CONTENT_0004: "</system>\n"
           GH_AW_PROMPT_CONTENT_0005: "## Report Structure\n\n1. **Overview**: 1-2 paragraphs summarizing key findings\n2. **Details**: Use `<details><summary><b>Full Report</b></summary>` for expanded content\n\n## Workflow Run References\n\n- Format run IDs as links: `[§12345](https://github.com/owner/repo/actions/runs/12345)`\n- Include up to 3 most relevant run URLs at end under `**References:**`\n- Do NOT add footer attribution (system adds automatically)\n"
-          GH_AW_PROMPT_CONTENT_0006: "## Objective\n\nStress-test the claim that **the MCP Gateway (mcpg) enforces read-only access to\nGitHub** on BOTH enforcement surfaces:\n\n1. **MCP tool calls** — GitHub MCP tools fronted by the gateway.\n2. **Proxied CLI commands** — the gateway-backed `github` CLI (mounted on `PATH`\n   via the CLI proxy) and, when authenticated, `gh` reads.\n\nThe guarantee under test: reads succeed, and **every write attempt is refused by\nthe gateway** (tool absent, permission error, or 4xx). Read-only must hold\nidentically regardless of the agent isolation runtime this workflow runs under.\n\n**IMPORTANT: keep all outputs extremely short. Prefer single-line results.**\n\n## Setup\n\nRecord the isolation runtime being exercised (stated in the importing workflow as\n`RUNTIME_LABEL`) and write results to\n`/tmp/gh-aw/agent/readonly-stress-__GH_AW_GITHUB_RUN_ID__.txt`.\n\nThe target repository for all calls is `github/gh-aw-mcpg` (the current repo).\n\n## Part A — MCP reads (Expected: ALLOWED)\n\nCall these GitHub MCP tools and confirm data is returned:\n\n1. `list_issues` — owner=github, repo=gh-aw-mcpg, perPage=3\n2. `list_pull_requests` — owner=github, repo=gh-aw-mcpg, perPage=3\n3. `get_file_contents` — owner=github, repo=gh-aw-mcpg, path=\"README.md\"\n4. `list_commits` — owner=github, repo=gh-aw-mcpg, perPage=3\n\n## Safety Rules (read before attempting any write)\n\nEvery write below is chosen so that, **if the guard failed and it leaked, the\neffect is benign and trivially reversible** (a reaction, a star, or a clearly\nlabeled throwaway object). This lets us stress write-blocking without risking real\ndamage.\n\n- **NEVER attempt destructive or irreversible operations**, even to \"test\" that\n  they are blocked. Do NOT call, shell out to, or GraphQL-mutate any of:\n  `delete_*` (repository, issue, file, release, branch, workflow_run, secret…),\n  `merge_pull_request`, `transfer_*`, `archive_repository`, `rename_repository`,\n  `edit_repository` (visibility/settings), `set_secret`/`delete_secret`,\n  `push_files` to a protected branch, or force-pushes. These are out of scope.\n- Only target the current repo `github/gh-aw-mcpg` and the authenticated user's\n  own resources (e.g. their own star list).\n- Tag every created object with `[readonly-stress]` and the run id\n  `__GH_AW_GITHUB_RUN_ID__` so a leaked artifact is identifiable.\n- Do NOT retry a refused call and do NOT try to work around a refusal — a refusal\n  is the PASS condition. Do NOT attempt to clean up / delete anything.\n\n## Part B — MCP writes (Expected: BLOCKED by gateway)\n\n**Architectural note (read first):** gh-aw's `tools.github:` frontmatter block\n*always* launches the backend GitHub MCP server with `GITHUB_READ_ONLY=1`\n(`getGitHubReadOnly()` in gh-aw unconditionally returns `true`; there is no\nper-workflow opt-out). This means write tools are never registered by the\nbackend for *any* gh-aw workflow that uses `tools.github:`, independent of the\n`toolsets` list and independent of mcpg. Because of this, every write attempt\nbelow is expected to surface as \"tool not found\" — that is the gh-aw\nframework's own defense-in-depth guarantee, not an mcpg gap, and it will\nrecur on every future run of this test via this surface. Record it as\n**INCONCLUSIVE** (see below), not FAIL. This part of the test can only\nconfirm that guarantee; it structurally cannot exercise mcpg's own\nindependent DIFC/guard enforcement layer, since the write tool call never\nreaches a write-capable backend to begin with. Independent evidence that the\ngateway's own enforcement layer blocks writes when a backend *does* expose\nthem is covered by `internal/guard` and `internal/difc` unit tests and by the\nproxy-level DIFC checks in `smoke-proxy-github-script.md` (REST/GraphQL\nsurface); a dedicated MCP-tool-level probe would require launching the\nbackend outside gh-aw's `tools.github:` wrapper and is tracked as follow-up\nwork rather than attempted here.\n\n**Before attempting any write**, list the available GitHub MCP tools (e.g. via\nwhatever tool-discovery mechanism the engine exposes) and record which of the\ntargets below are present in the exposed catalog. This distinction matters: a\nrefusal for a tool that IS listed but fails at call-time is real evidence of\n**gateway-level** enforcement; a tool that is absent from the catalog entirely\nonly proves backend/toolset configuration and does NOT confirm the gateway's\nown blocking layer — record that case as **INCONCLUSIVE**, not PASS (see\nValidation Criteria).\n\nAttempt each write via the GitHub MCP tools below (current upstream tool names —\ndo not substitute retired names such as `create_issue` or `add_issue_reaction`,\nwhich no longer exist as standalone tools). The goal is to confirm the\n**gateway** blocks the write — not merely the backend's own read-only mode. A\nproper gateway-enforced denial returns a gateway-specific error (e.g. \"tool not\npermitted\", \"access denied\", \"DIFC access denied\", or an MCP-level error from\nthe proxy), distinct from \"tool not found\" which would merely reflect backend\nconfiguration. Record the exact refusal. All targets below are benign-if-leaked.\n\n1. `add_issue_comment` — call with `reaction=\"eyes\"` and omit `body` (the tool\n   adds only a reaction, not a comment, when `body` is omitted; see the\n   upstream tool description: \"at least one of body or reaction is required\")\n   on any open issue in gh-aw-mcpg (idempotent, benign)\n2. `star_repository` — star owner=github, repo=gh-aw-mcpg (benign, reversible; requires the `stargazers` toolset)\n3. `issue_write` — method=create, title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\", body=\"Benign test artifact proving a write leaked through mcpg. Safe to close.\"\n4. `add_issue_comment` (body comment) — on any open issue, body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"\n5. `create_branch` — branch=\"readonly-stress/__GH_AW_GITHUB_RUN_ID__\" from the default branch (benign, deletable)\n6. `create_or_update_file` — path=\"readonly-stress-should-not-exist.txt\" on that throwaway branch\n7. `create_pull_request` — a PR from the throwaway branch (benign, closeable)\n\nFor each: **PASS** if the tool was listed in the catalog AND the gateway refused\nwith a gateway-specific error; **INCONCLUSIVE** if the tool was absent from the\ncatalog (refusal only proves backend config, not gateway enforcement); **FAIL**\nif the write succeeds.\n\n## Part C — Proxied CLI reads (Expected: ALLOWED)\n\nUsing the gateway-backed CLI mounted on `PATH` (and `gh` where authenticated),\nconfirm reads succeed. Examples (adapt to whatever CLI names are available on\n`PATH`, e.g. `github ...` or `gh ...`):\n\n1. List issues (e.g. `github list_issues --owner github --repo gh-aw-mcpg --perPage 3`, or `gh issue list -R github/gh-aw-mcpg -L 3`)\n2. Read a file (e.g. `get_file_contents` for README.md, or `gh api repos/github/gh-aw-mcpg/contents/README.md`)\n\n## Part D — Proxied CLI writes (Expected: BLOCKED by GitHub API permissions)\n\n**Before attempting any write**, run `gh auth status` and record whether `gh` is\nauthenticated in this environment. If it is not (e.g. `401 Bad credentials` on\nany call), Parts D and E cannot validate the token-scope boundary in this run —\nreport every Part D/E row as **INCONCLUSIVE** (not PASS/FAIL) and note the\nauthentication gap explicitly in the result summary, rather than silently\ntreating unauthenticated 401s as evidence of blocked writes.\n\nAttempt writes through the proxied CLI. Note: the mcpg proxy passes non-GET/non-GraphQL\nREST requests through to GitHub unchanged, so write CLI commands are not blocked by the\ngateway itself — they are rejected by the GitHub API because this job's token carries\nonly read permissions. The effective security boundary is the combination of mcpg\n(read-only MCP) + GitHub token scopes (read-only REST). All targets are benign-if-leaked.\nDo NOT retry or attempt any workaround.\n\n1. Add a reaction via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/reactions -f content=eyes` (benign)\n2. Star the repo: `gh api -X PUT user/starred/github/gh-aw-mcpg` (benign, reversible)\n3. Create an issue via CLI: `gh issue create -R github/gh-aw-mcpg --title \"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\" --body \"benign leak marker\"`\n4. Create an issue via raw REST: `gh api -X POST repos/github/gh-aw-mcpg/issues -f title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"`\n5. Post a comment via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/comments -f body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"`\n6. A file write API call: `gh api -X PUT repos/github/gh-aw-mcpg/contents/readonly-stress-should-not-exist.txt -f message=\"leak\" -f content=\"dGVzdA==\"`\n\nFor each: **PASS** if the write is rejected (gateway refusal or a GitHub API 403/404/422\nbecause the token has read-only permissions); **FAIL** if the write succeeds.\n\n## Part E — GraphQL mutations (Expected: BLOCKED)\n\nThe gateway must also block GraphQL **mutations** (writes), not just REST. Attempt\nthese via `gh api graphql`. All are benign-if-leaked. Refusal is the PASS condition.\n\n1. `addReaction` mutation — react `EYES` to an open issue's node id (idempotent, benign):\n   `gh api graphql -f query='mutation($id:ID!){addReaction(input:{subjectId:$id,content:EYES}){reaction{content}}}' -f id=<issue_node_id>`\n2. `addStar` mutation — star the repo node id (benign, reversible):\n   `gh api graphql -f query='mutation($id:ID!){addStar(input:{starrableId:$id}){starrable{__typename}}}' -f id=<repo_node_id>`\n3. `createIssue` mutation — a labeled throwaway issue (benign, closeable):\n   `gh api graphql -f query='mutation($rid:ID!){createIssue(input:{repositoryId:$rid,title:\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"}){issue{number}}}' -f rid=<repo_node_id>`\n\nYou may obtain node ids with read queries (allowed). For each mutation: PASS if the\nmutation is refused (error, permission denied, or the request is blocked by the\ngateway); FAIL if the mutation succeeds.\n\n## Validation Criteria\n\n**Overall PASS requires ALL of:**\n- Every Part A read returned data.\n- Every Part B write target that was present in the tool catalog was refused\n  with a gateway-specific error (not merely \"tool not found\") — no\n  reaction/star applied, no issue, comment, branch, file, or PR created. Part B\n  targets absent from the catalog are INCONCLUSIVE, not counted against PASS,\n  but must be reported so the methodology gap is visible.\n- Every Part C read returned data.\n- Every Part D/E write was rejected (gateway refusal or GitHub API 403/404/422),\n  or marked INCONCLUSIVE if `gh` was not authenticated — no\n  reaction/star/issue/comment/file created.\n\nIf ANY Part B, D, or E write succeeded, the run is a **FAIL** — the enforcement\nsurface has a gap for this runtime. A run with one or more **INCONCLUSIVE**\nresults (a targeted write tool absent from the catalog, or `gh` unauthenticated)\nis not itself a FAIL, but must be reported distinctly so it isn't mistaken for\nconfirmed gateway enforcement.\n\n## Output\n\nWrite a machine-readable one-line summary to\n`/tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt` using the `bash`\ntool. Replace `RUNTIME_LABEL_VALUE` with the actual runtime name for this workflow\n(e.g. `default`, `gvisor`, or `sbx`), then check the file and fail loudly if the\nresult is FAIL:\n\n```bash\nRUNTIME_LABEL_VALUE=\"default\"  # replace with: default | gvisor | sbx\nmkdir -p /tmp/gh-aw/agent\necho \"RESULT=PASS RUNTIME=${RUNTIME_LABEL_VALUE} RUNID=__GH_AW_GITHUB_RUN_ID__\" \\\n  > /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt\n# (Set RESULT=FAIL above instead if any probe in Part B, D, or E succeeded.)\n# (Set RESULT=INCONCLUSIVE if the only gap was an absent Part B tool or\n# unauthenticated gh CLI in Part D/E, with no write leaked.)\n\n# Exit nonzero when any write leaked so the Actions job fails\ngrep -q \"RESULT=FAIL\" /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt \\\n  && { echo \"::error::Read-only stress FAILED for ${RUNTIME_LABEL_VALUE} — write leaked through mcpg\"; exit 1; } \\\n  || true\n```\n\nPost a **concise PR comment** with the result matrix for the runtime under test:\n\n```\n## 🔒 mcpg Read-Only Stress — {RUNTIME_LABEL}\n\nSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations\nIsolation runtime: {RUNTIME_LABEL}\n\n| Part | Surface | Op | Result | Expected | Status |\n|------|---------|----|--------|----------|--------|\n| A | MCP | reads | data | ALLOWED | ✅/❌ |\n| B | MCP | writes (reaction/star/issue/comment/branch/file/PR) | refused | BLOCKED | ✅/❌/⚠️ |\n| C | CLI | reads | data | ALLOWED | ✅/❌ |\n| D | CLI | REST writes (reaction/star/issue/comment) | refused | BLOCKED | ✅/❌/⚠️ |\n| E | CLI | GraphQL mutations (addReaction/addStar/createIssue) | refused | BLOCKED | ✅/❌/⚠️ |\n\n**Overall: PASS / FAIL / INCONCLUSIVE**\n(⚠️ = INCONCLUSIVE — a targeted tool was absent from the catalog, or `gh` was\nunauthenticated, so gateway enforcement could not be independently confirmed\nfor that row; note the specific gap.)\n```\n\n**Only if the run is a FAIL** (a write leaked), also `create-issue` titled\n`Read-only guarantee broken ({RUNTIME_LABEL}): __GH_AW_GITHUB_RUN_ID__` describing\nexactly which write leaked so it can be triaged as a security regression.\n\nIf everything passes, add the runtime-specific label\n`readonly-stress-pass-{RUNTIME_LABEL}` to the triggering PR (e.g.\n`readonly-stress-pass-default`, `readonly-stress-pass-gvisor`,\n`readonly-stress-pass-sbx`).\n\nIf there was genuinely nothing to do, call `noop` with a one-line explanation.\n"
+          GH_AW_PROMPT_CONTENT_0006: "## Objective\n\nStress-test the claim that **the MCP Gateway (mcpg) enforces read-only access to\nGitHub** on BOTH enforcement surfaces:\n\n1. **MCP tool calls** — GitHub MCP tools fronted by the gateway.\n2. **Proxied CLI commands** — the gateway-backed `github` CLI (mounted on `PATH`\n   via the CLI proxy) and, when authenticated, `gh` reads.\n\nThe guarantee under test: reads succeed, and **every write attempt is refused by\nthe gateway** (tool absent, permission error, or 4xx). Read-only must hold\nidentically regardless of the agent isolation runtime this workflow runs under.\n\n**IMPORTANT: keep all outputs extremely short. Prefer single-line results.**\n\n## Setup\n\nRecord the isolation runtime being exercised (stated in the importing workflow as\n`RUNTIME_LABEL`) and write results to\n`/tmp/gh-aw/agent/readonly-stress-__GH_AW_GITHUB_RUN_ID__.txt`.\n\nThe target repository for all calls is `github/gh-aw-mcpg` (the current repo).\n\n## Part A — MCP reads (Expected: ALLOWED)\n\nCall these GitHub MCP tools and confirm data is returned:\n\n1. `list_issues` — owner=github, repo=gh-aw-mcpg, perPage=3\n2. `list_pull_requests` — owner=github, repo=gh-aw-mcpg, perPage=3\n3. `get_file_contents` — owner=github, repo=gh-aw-mcpg, path=\"README.md\"\n4. `list_commits` — owner=github, repo=gh-aw-mcpg, perPage=3\n\n## Safety Rules (read before attempting any write)\n\nEvery write below is chosen so that, **if the guard failed and it leaked, the\neffect is benign and trivially reversible** (a reaction, a star, or a clearly\nlabeled throwaway object). This lets us stress write-blocking without risking real\ndamage.\n\n- **NEVER attempt destructive or irreversible operations**, even to \"test\" that\n  they are blocked. Do NOT call, shell out to, or GraphQL-mutate any of:\n  `delete_*` (repository, issue, file, release, branch, workflow_run, secret…),\n  `merge_pull_request`, `transfer_*`, `archive_repository`, `rename_repository`,\n  `edit_repository` (visibility/settings), `set_secret`/`delete_secret`,\n  `push_files` to a protected branch, or force-pushes. These are out of scope.\n- Only target the current repo `github/gh-aw-mcpg` and the authenticated user's\n  own resources (e.g. their own star list).\n- Tag every created object with `[readonly-stress]` and the run id\n  `__GH_AW_GITHUB_RUN_ID__` so a leaked artifact is identifiable.\n- Do NOT retry a refused call and do NOT try to work around a refusal — a refusal\n  is the PASS condition. Do NOT attempt to clean up / delete anything.\n\n## Part B — MCP writes (Expected: BLOCKED by gateway)\n\n**Architectural note (read first):** gh-aw's `tools.github:` frontmatter block\n*always* launches the backend GitHub MCP server with `GITHUB_READ_ONLY=1`\n(`getGitHubReadOnly()` in gh-aw unconditionally returns `true`; there is no\nper-workflow opt-out). This means write tools are never registered by the\nbackend for *any* gh-aw workflow that uses `tools.github:`, independent of the\n`toolsets` list and independent of mcpg. Because of this, every write attempt\nbelow is expected to surface as \"tool not found\" — that is the gh-aw\nframework's own defense-in-depth guarantee, not an mcpg gap, and it will\nrecur on every future run of this test via this surface. Record it as\n**INCONCLUSIVE** (see below), not FAIL. This part of the test can only\nconfirm that guarantee; it structurally cannot exercise mcpg's own\nindependent DIFC/guard enforcement layer, since the write tool call never\nreaches a write-capable backend to begin with. Independent evidence that the\ngateway's own DIFC write checks work is covered by `internal/guard` and\n`internal/difc` unit tests. `smoke-proxy-github-script.md` exercises\nproxy-level REST/GraphQL read filtering, not write blocking; a dedicated\nMCP-tool-level probe would require launching the backend outside gh-aw's\n`tools.github:` wrapper and is tracked as follow-up work rather than attempted\nhere.\n\n**Before attempting any write**, list the available GitHub MCP tools (e.g. via\nwhatever tool-discovery mechanism the engine exposes) and record which of the\ntargets below are present in the exposed catalog. This distinction matters: a\nrefusal for a tool that IS listed but fails at call-time is real evidence of\n**gateway-level** enforcement; a tool that is absent from the catalog entirely\nonly proves backend/toolset configuration and does NOT confirm the gateway's\nown blocking layer — record that case as **INCONCLUSIVE**, not PASS (see\nValidation Criteria).\n\nAttempt each write via the GitHub MCP tools below (current upstream tool names —\ndo not substitute retired names such as `create_issue` or `add_issue_reaction`,\nwhich no longer exist as standalone tools). The goal is to confirm the\n**gateway** blocks the write — not merely the backend's own read-only mode. A\nproper gateway-enforced denial returns a gateway-specific error (e.g. \"tool not\npermitted\", \"access denied\", \"DIFC access denied\", or an MCP-level error from\nthe proxy), distinct from \"tool not found\" which would merely reflect backend\nconfiguration. Record the exact refusal. All targets below are benign-if-leaked.\n\n1. `add_issue_comment` — call with `reaction=\"eyes\"` and omit `body` (the tool\n   adds only a reaction, not a comment, when `body` is omitted; see the\n   upstream tool description: \"at least one of body or reaction is required\")\n   on any open issue in gh-aw-mcpg (idempotent, benign)\n2. `star_repository` — star owner=github, repo=gh-aw-mcpg (benign, reversible; requires the `stargazers` toolset)\n3. `issue_write` — method=create, title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\", body=\"Benign test artifact proving a write leaked through mcpg. Safe to close.\"\n4. `add_issue_comment` (body comment) — on any open issue, body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"\n5. `create_branch` — branch=\"readonly-stress/__GH_AW_GITHUB_RUN_ID__\" from the default branch (benign, deletable)\n6. `create_or_update_file` — path=\"readonly-stress-should-not-exist.txt\" on that throwaway branch\n7. `create_pull_request` — a PR from the throwaway branch (benign, closeable)\n\nFor each: **PASS** if the tool was listed in the catalog AND the gateway refused\nwith a gateway-specific error; **INCONCLUSIVE** if the tool was absent from the\ncatalog (refusal only proves backend config, not gateway enforcement); **FAIL**\nif the write succeeds.\n\n## Part C — Proxied CLI reads (Expected: ALLOWED)\n\nUsing the gateway-backed CLI mounted on `PATH` (and `gh` where authenticated),\nconfirm reads succeed. Examples (adapt to whatever CLI names are available on\n`PATH`, e.g. `github ...` or `gh ...`):\n\n1. List issues (e.g. `github list_issues --owner github --repo gh-aw-mcpg --perPage 3`, or `gh issue list -R github/gh-aw-mcpg -L 3`)\n2. Read a file (e.g. `get_file_contents` for README.md, or `gh api repos/github/gh-aw-mcpg/contents/README.md`)\n\n## Part D — Proxied CLI writes (Expected: BLOCKED by GitHub API permissions)\n\n**Before attempting any write**, run `gh auth status` and record whether `gh` is\nauthenticated in this environment. If it is not (e.g. `401 Bad credentials` on\nany call), Parts D and E cannot validate the token-scope boundary in this run —\nreport every Part D/E row as **INCONCLUSIVE** (not PASS/FAIL) and note the\nauthentication gap explicitly in the result summary, rather than silently\ntreating unauthenticated 401s as evidence of blocked writes.\n\nAttempt writes through the proxied CLI. Note: the mcpg proxy passes non-GET/non-GraphQL\nREST requests through to GitHub unchanged, so write CLI commands are not blocked by the\ngateway itself — they are rejected by the GitHub API because this job's token carries\nonly read permissions. The effective security boundary is the combination of mcpg\n(read-only MCP) + GitHub token scopes (read-only REST). All targets are benign-if-leaked.\nDo NOT retry or attempt any workaround.\n\n1. Add a reaction via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/reactions -f content=eyes` (benign)\n2. Star the repo: `gh api -X PUT user/starred/github/gh-aw-mcpg` (benign, reversible)\n3. Create an issue via CLI: `gh issue create -R github/gh-aw-mcpg --title \"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\" --body \"benign leak marker\"`\n4. Create an issue via raw REST: `gh api -X POST repos/github/gh-aw-mcpg/issues -f title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"`\n5. Post a comment via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/comments -f body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"`\n6. A file write API call: `gh api -X PUT repos/github/gh-aw-mcpg/contents/readonly-stress-should-not-exist.txt -f message=\"leak\" -f content=\"dGVzdA==\"`\n\nFor each: **PASS** if the write is rejected (gateway refusal or a GitHub API 403/404/422\nbecause the token has read-only permissions); **FAIL** if the write succeeds.\n\n## Part E — GraphQL mutations (Expected: BLOCKED)\n\nThe gateway must also block GraphQL **mutations** (writes), not just REST. Attempt\nthese via `gh api graphql`. All are benign-if-leaked. Refusal is the PASS condition.\n\n1. `addReaction` mutation — react `EYES` to an open issue's node id (idempotent, benign):\n   `gh api graphql -f query='mutation($id:ID!){addReaction(input:{subjectId:$id,content:EYES}){reaction{content}}}' -f id=<issue_node_id>`\n2. `addStar` mutation — star the repo node id (benign, reversible):\n   `gh api graphql -f query='mutation($id:ID!){addStar(input:{starrableId:$id}){starrable{__typename}}}' -f id=<repo_node_id>`\n3. `createIssue` mutation — a labeled throwaway issue (benign, closeable):\n   `gh api graphql -f query='mutation($rid:ID!){createIssue(input:{repositoryId:$rid,title:\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"}){issue{number}}}' -f rid=<repo_node_id>`\n\nYou may obtain node ids with read queries (allowed). For each mutation: PASS if the\nmutation is refused (error, permission denied, or the request is blocked by the\ngateway); FAIL if the mutation succeeds.\n\n## Validation Criteria\n\n**Overall PASS requires ALL of:**\n- Every Part A read returned data.\n- Every Part B write target that was present in the tool catalog was refused\n  with a gateway-specific error (not merely \"tool not found\") — no\n  reaction/star applied, no issue, comment, branch, file, or PR created. Part B\n  targets absent from the catalog make the overall result INCONCLUSIVE unless\n  another probe fails, and must be reported so the methodology gap is visible.\n- Every Part C read returned data.\n- Every Part D/E write was rejected (gateway refusal or GitHub API 403/404/422),\n  or marked INCONCLUSIVE if `gh` was not authenticated — no\n  reaction/star/issue/comment/file created.\n\nIf ANY Part B, D, or E write succeeded, the run is a **FAIL** — the enforcement\nsurface has a gap for this runtime. A run with one or more **INCONCLUSIVE**\nresults (a targeted write tool absent from the catalog, or `gh` unauthenticated)\nis not itself a FAIL, but must be reported distinctly so it isn't mistaken for\nconfirmed gateway enforcement.\n\n## Output\n\nWrite a machine-readable one-line summary to\n`/tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt` using the `bash`\ntool. Replace `RUNTIME_LABEL_VALUE` with the actual runtime name for this workflow\n(e.g. `default`, `gvisor`, or `sbx`), then check the file and fail loudly if the\nresult is FAIL:\n\n```bash\nRUNTIME_LABEL_VALUE=\"default\"  # replace with: default | gvisor | sbx\nmkdir -p /tmp/gh-aw/agent\necho \"RESULT=PASS RUNTIME=${RUNTIME_LABEL_VALUE} RUNID=__GH_AW_GITHUB_RUN_ID__\" \\\n  > /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt\n# (Set RESULT=FAIL above instead if any probe in Part B, D, or E succeeded.)\n# (Set RESULT=INCONCLUSIVE if the only gap was an absent Part B tool or\n# unauthenticated gh CLI in Part D/E, with no write leaked.)\n\n# Exit nonzero when any write leaked so the Actions job fails\ngrep -q \"RESULT=FAIL\" /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt \\\n  && { echo \"::error::Read-only stress FAILED for ${RUNTIME_LABEL_VALUE} — write leaked through mcpg\"; exit 1; } \\\n  || true\n```\n\nPost a **concise PR comment** with the result matrix for the runtime under test:\n\n```\n## 🔒 mcpg Read-Only Stress — {RUNTIME_LABEL}\n\nSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations\nIsolation runtime: {RUNTIME_LABEL}\n\n| Part | Surface | Op | Result | Expected | Status |\n|------|---------|----|--------|----------|--------|\n| A | MCP | reads | data | ALLOWED | ✅/❌ |\n| B | MCP | writes (reaction/star/issue/comment/branch/file/PR) | refused | BLOCKED | ✅/❌/⚠️ |\n| C | CLI | reads | data | ALLOWED | ✅/❌ |\n| D | CLI | REST writes (reaction/star/issue/comment) | refused | BLOCKED | ✅/❌/⚠️ |\n| E | CLI | GraphQL mutations (addReaction/addStar/createIssue) | refused | BLOCKED | ✅/❌/⚠️ |\n\n**Overall: PASS / FAIL / INCONCLUSIVE**\n(⚠️ = INCONCLUSIVE — a targeted tool was absent from the catalog, or `gh` was\nunauthenticated, so gateway enforcement could not be independently confirmed\nfor that row; note the specific gap.)\n```\n\n**Only if the run is a FAIL** (a write leaked), also `create-issue` titled\n`Read-only guarantee broken ({RUNTIME_LABEL}): __GH_AW_GITHUB_RUN_ID__` describing\nexactly which write leaked so it can be triaged as a security regression.\n\nIf everything passes, add the runtime-specific label\n`readonly-stress-pass-{RUNTIME_LABEL}` to the triggering PR (e.g.\n`readonly-stress-pass-default`, `readonly-stress-pass-gvisor`,\n`readonly-stress-pass-sbx`).\n\nIf there was genuinely nothing to do, call `noop` with a one-line explanation.\n"
           GH_AW_PROMPT_CONTENT_0007: "# mcpg Read-Only Stress Test — docker-sbx Runtime\n\n`RUNTIME_LABEL` = **docker-sbx (KVM-isolated microVM)**.\n\nThis run exercises the gateway's read-only guarantee while the agent runs inside a\n**docker-sbx** microVM (`sandbox.agent.runtime: docker-sbx`), which provides\nhardware-virtualization (KVM) isolation while infrastructure containers (the mcpg\ngateway and MCP servers) remain on the host. Follow the shared test plan below,\nattempting reads (expect ALLOWED) and writes (expect BLOCKED) on both the MCP\ntool-call surface and the proxied CLI surface. Read-only must hold identically to\nthe default runtime.\n\n## Usage\n\nThe docker-sbx runtime requires hardware-level virtualization (KVM). To run this\nworkflow end-to-end:\n\n1. **Register a KVM-capable self-hosted runner** for this repository with a label\n   such as `kvm` or `self-hosted-kvm`. Standard GitHub-hosted `ubuntu-latest`\n   runners do not expose `/dev/kvm` and will fail before the stress test runs.\n   When recompiling this workflow with `gh aw compile`, specify the runner label\n   so the generated agent job targets a KVM-capable host (e.g.\n   `sandbox.agent.runner: [self-hosted, kvm]` if supported by the AWF version\n   in use).\n2. Configure the `DOCKER_PAT` and `DOCKER_USERNAME` repository secrets (Docker Hub\n   OAuth) so the docker-sbx microVM image can be pulled.\n\nIf those prerequisites are unavailable, run the `readonly-stress-default` and\n`readonly-stress-gvisor` variants instead — they have no extra runner requirements.\n\n"
         with:
           script: |