Adopt Cloud Hypervisor for 58 agentic workflows

.github/workflows/ace-editor.md

@@ -44,7 +44,7 @@ imports:
   - shared/otlp.md
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 tools:
   cli-proxy: true
 evals:

.github/workflows/ai-moderator.md

@@ -65,7 +65,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 pre-agent-steps:
   - name: Pre-fetch moderation context
     env:

.github/workflows/codex-github-remote-mcp-test.md

@@ -21,6 +21,9 @@ strict: true
 
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Codex GitHub Remote MCP Test

.github/workflows/constraint-solving-potd.md

@@ -40,6 +40,9 @@ evals:
     question: Does the agent output include a clear problem statement with constraints?
   - id: solution-provided
     question: Does the agent output include a solution or answer to the problem?
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Constraint Solving — Problem of the Day

.github/workflows/copilot-pr-nlp-analysis.md

@@ -29,6 +29,7 @@ network:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 imports:
   - uses: shared/daily-audit-base.md

.github/workflows/copilot-pr-prompt-analysis.md

@@ -30,6 +30,7 @@ network:
 
 sandbox:
   agent:  # Firewall enabled (migrated from network.firewall)
+    runtime: cloud-hypervisor
     id: awf
 imports:
   - uses: shared/daily-audit-base.md

.github/workflows/daily-byok-ollama-test.md

@@ -188,7 +188,7 @@ features:
 sandbox:
   agent:
     id: awf
-    runtime: docker-sbx
+    runtime: cloud-hypervisor
 models:
   default-ai-credits-pricing:
     input: 0.000001

.github/workflows/daily-max-ai-credits-test.md

@@ -18,6 +18,7 @@ engine:
 strict: true
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 timeout-minutes: 5
 network: {}

.github/workflows/daily-model-inventory.md

@@ -340,6 +340,7 @@ steps:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 tools:
   cli-proxy: true

.github/workflows/daily-pr-review-cursor.md

@@ -11,6 +11,7 @@ permissions:
   pull-requests: read
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 tracker-id: daily-pr-review-cursor
 engine:

.github/workflows/daily-regression-audit-kiro.md

@@ -14,6 +14,7 @@ permissions:
   pull-requests: read
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 tracker-id: daily-regression-audit-kiro
 engine:

.github/workflows/daily-regulatory.md

@@ -43,6 +43,9 @@ evals:
     question: Did the agent cross-check other daily report agents' outputs for consistency and anomalies?
   - id: regulatory_report_created_or_noop
     question: Was a regulatory report created with findings, or was noop used when all outputs were consistent?
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/daily-safe-output-optimizer.md

@@ -15,6 +15,7 @@ permissions:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 engine:
   id: claude

.github/workflows/daily-schema-audit-cursor.md

@@ -13,6 +13,7 @@ permissions:
   pull-requests: read
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 tracker-id: daily-schema-audit-cursor
 engine:

.github/workflows/daily-spec-coverage-kiro.md

@@ -11,6 +11,7 @@ permissions:
   pull-requests: read
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 tracker-id: daily-spec-coverage-kiro
 engine:

.github/workflows/daily-syntax-error-quality.md

@@ -20,6 +20,7 @@ permissions:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 tracker-id: daily-syntax-error-quality
 engine:

.github/workflows/dependabot-go-checker.md

@@ -76,6 +76,9 @@ evals:
     question: Was an issue created for dependency updates, or was noop used when no actionable updates were found?
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Dependabot Dependency Checker

.github/workflows/detection-analysis-report.md

@@ -40,6 +40,9 @@ evals:
     question: Did the agent analyze detection jobs for workflow misconfiguration and performance differences?
   - id: detection_report_created
     question: Did the agent create a report with evidence-backed detection findings or recommendations?
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Detection Analysis Report

.github/workflows/docs-noob-tester.md

@@ -117,6 +117,9 @@ evals:
     question: Does the agent output identify at least one confusing, broken, or unclear step in the documentation?
   - id: user-perspective-maintained
     question: Does the agent output reflect the perspective of a new user rather than an expert reviewer?
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Documentation Noob Testing

.github/workflows/example-failure-category-filter.md

@@ -19,6 +19,9 @@ safe-outputs:
   create-issue:
 imports:
   - shared/reporting.md
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Example: Failure Category Filtering

.github/workflows/example-permissions-warning.md

@@ -19,6 +19,9 @@ tools:
     toolsets: [repos, issues, pull_requests]
 strict: false
 
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Example: Properly Provisioned Permissions

.github/workflows/firewall.md

@@ -21,6 +21,7 @@ network:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 imports:
   - shared/otlp.md

.github/workflows/functional-pragmatist.md

@@ -50,6 +50,9 @@ evals:
     question: Did the agent analyze the codebase for pragmatic functional programming improvements?
   - id: refactoring_pr_created_or_noop
     question: Did the agent create a focused refactoring pull request, or report that no suitable change was found?
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Functional and Immutability Enhancer 🔄

.github/workflows/github-mcp-structural-analysis.md

@@ -37,6 +37,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # GitHub MCP Structural Analysis

.github/workflows/github-mcp-tools-report.md

@@ -36,6 +36,9 @@ imports:
       title-prefix: "[mcp-tools-report] "
 
   - shared/otlp.md
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # GitHub MCP Remote Server Tools Report Generator

.github/workflows/github-remote-mcp-auth-test.md

@@ -32,6 +32,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # GitHub Remote MCP Authentication Test

.github/workflows/go-pattern-detector.md

@@ -71,6 +71,9 @@ tools:
   cli-proxy: true
 
 
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Go Code Pattern Detector

.github/workflows/gpclean.md

@@ -95,6 +95,9 @@ evals:
   - id: tool_verbosity_goal_met
     question: Does the agent output show that the objective for experiment tool_verbosity was successfully completed?
 
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 {{#if experiments.tool_verbosity == 'minimal_toolset' }}

.github/workflows/lockfile-stats.md

@@ -23,6 +23,9 @@ imports:
       expires: 1d
 
   - shared/otlp.md
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Lockfile Statistics Analysis Agent

.github/workflows/pdf-summary.md

@@ -59,6 +59,9 @@ safe-outputs:
 timeout-minutes: 15
 strict: true
 
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Resource Summarizer Agent

.github/workflows/release.md

@@ -982,6 +982,9 @@ evals:
   - id: community-attribution
     question: Does the agent output include attribution to community contributors in the release highlights?
 
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Release Highlights Generator

.github/workflows/repo-audit-analyzer.md

@@ -47,6 +47,9 @@ evals:
     question: Does the agent output include at least one actionable recommendation for improving repository productivity using agentic workflows?
   - id: evidence-cited
     question: Does the agent output cite specific repository characteristics or existing workflows as evidence supporting its recommendations?
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Repository Audit & Agentic Workflow Opportunity Analyzer

.github/workflows/research.md

@@ -24,6 +24,7 @@ network:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 imports:
   - shared/mcp/tavily.md

.github/workflows/safe-output-health.md

@@ -31,6 +31,9 @@ imports:
   - ../skills/jqschema/SKILL.md
 
   - shared/otlp.md
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Safe Output Health Monitor

.github/workflows/sighthound-security-scan.md

@@ -146,6 +146,9 @@ safe-outputs:
   noop:
 imports:
   - shared/reporting.md
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Sighthound Security Scan Triage

.github/workflows/slide-deck-maintainer.md

@@ -96,6 +96,9 @@ steps:
       cd docs || exit 1
       npm ci
 
+sandbox:
+  agent:
+    runtime: cloud-hypervisor
 ---
 
 # Slide Deck Maintenance Agent

.github/workflows/smoke-agent-all-none.md

@@ -19,6 +19,7 @@ permissions:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 name: "Smoke Agent: all/none"
 engine: claude

.github/workflows/smoke-agent-public-approved.md

@@ -19,6 +19,7 @@ permissions:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 name: "Smoke Agent: public/approved"
 engine: claude

.github/workflows/smoke-agent-public-none.md

@@ -19,6 +19,7 @@ permissions:
 
 sandbox:
   agent:
+    runtime: cloud-hypervisor
     id: awf
 name: "Smoke Agent: public/none"
 engine: claude