[lpcox]

Summary

Upgraded the gh-aw extension to the latest pre-release, v0.87.0, and recompiled all 36 agentic workflows.

Changes

• Ran gh aw upgrade --pre-releases
• Confirmed v0.87.0 is the newest upstream pre-release
• Ran gh aw compile across all workflows
• Generated workflow output was already identical to main, so no file delta was produced
• Added an explicit upgrade commit to record the verified refresh

Validation

• All 36 workflows compiled successfully
• make agent-finished passed completely
• Go formatting, build, lint, Go tests, and 642 Rust guard tests passed

[Copilot]

Copilot wasn't able to review any files in this pull request.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues	3 issues returned	ALLOWED	✅
A2	MCP	list_pull_requests	data returned	ALLOWED	✅
A3	MCP	get_file_contents (README.md)	file content returned	ALLOWED	✅
A4	MCP	list_commits	data returned	ALLOWED	✅
B1	MCP	add_issue_comment	unknown tool [-32602]	BLOCKED	⚠️
B2	MCP	star_repository	unknown tool [-32602]	BLOCKED	⚠️
B3	MCP	issue_write	unknown tool [-32602]	BLOCKED	⚠️
B4	MCP	add_issue_comment (body)	unknown tool [-32602]	BLOCKED	⚠️
B5	MCP	create_branch	unknown tool [-32602]	BLOCKED	⚠️
B6	MCP	create_or_update_file	unknown tool [-32602]	BLOCKED	⚠️
B7	MCP	create_pull_request	unknown tool [-32602]	BLOCKED	⚠️
C1	CLI	list_issues (github CLI)	3 issues returned	ALLOWED	✅
C2	CLI	get_file_contents (github CLI)	file content returned	ALLOWED	✅
D	CLI	REST writes (6 ops)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (3 ops)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• Part B: All 7 write tools were absent from the tool catalog (23 read-only tools exposed). Every write attempt returned Error [-32602]: unknown tool. This confirms GITHUB_READ_ONLY=1 is enforced by the gh-aw framework — backend never registers write tools. This is INCONCLUSIVE (not PASS) per methodology: gateway-level enforcement was not independently exercised since no write-capable backend was present.
• Parts D/E: gh is not authenticated in this environment — all REST/GraphQL write probes are INCONCLUSIVE (not confirmed PASS). No writes were attempted or leaked.
• No write succeeded in any part. No reactions, stars, issues, comments, branches, files, or PRs were created.

References: §32130293954

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues	3 issues returned	ALLOWED	✅
A2	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A3	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A4	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from catalog ("unknown tool")	BLOCKED	⚠️
C1	CLI	github list_issues	3 issues returned	ALLOWED	✅
C2	CLI	github get_file_contents	content returned	ALLOWED	✅
D	CLI REST	writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI GraphQL	mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the MCP tool catalog — the backend runs with GITHUB_READ_ONLY=1 (gh-aw framework enforces this unconditionally), so write tools are never registered. Refusals reflect backend configuration, not independent mcpg/DIFC gateway enforcement. This is expected per the architectural note in the test plan.

⚠️ Parts D & E: gh CLI is not authenticated in this environment (gh auth status returns "not logged into any GitHub hosts"). The token-scope boundary cannot be validated this run. All D/E rows are INCONCLUSIVE, not PASS/FAIL.

No write succeeded. No FAIL conditions triggered.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_prs, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	401 Bad credentials	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	401 Bad credentials	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools absent from MCP catalog — backend launches with GITHUB_READ_ONLY=1 (gh-aw framework guarantee), so write tools are never registered. Refusal confirms backend config, not independent gateway DIFC enforcement. No write leaked.

⚠️ Parts D/E: gh CLI is unauthenticated (GH_TOKEN invalid, 401 Bad credentials) in this environment. All REST/GraphQL write attempts fail with auth error — token-scope boundary cannot be confirmed. No write leaked.

No writes succeeded. The read-only guarantee held for this runtime; methodology gaps prevent full gateway-layer confirmation.

References: §32130294104

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime