Compile enclave GitHub access through shared multi-agent mcpg by Copilot · Pull Request #57973 · github/gh-aw

Copilot · 2026-09-02T14:59:41Z

Agent enclaves now use the compiler-owned mcpg gateway directly instead of a dedicated GitHub proxy. The compiler provisions isolated primary/enclave identities and constrains enclave GitHub access to issue reads over configured trusted repositories.

Shared gateway
- Emit gateway.agentIds and complete fail-closed gateway.agentPolicies.
- Preserve the primary agent’s existing MCP surface.
- Add the GitHub backend when required solely by an enclave.
Enclave isolation
- Generate and mask a distinct AWF_ENCLAVE_GITHUB_MCP_AGENT_ID.
- Hand it to AWF privately while excluding it from the primary agent environment.
- Restrict the enclave identity to github, list_issues, and issue_read, with an allow-only repository union.

{
  "agentIds": ["${MCP_GATEWAY_AGENT_ID}", "${AWF_ENCLAVE_GITHUB_MCP_AGENT_ID}"],
  "agentPolicies": {
    "${AWF_ENCLAVE_GITHUB_MCP_AGENT_ID}": {
      "servers": ["github"],
      "tools": { "github": ["list_issues", "issue_read"] },
      "allow-only": { "repos": ["octo-org/private-service"], "min-integrity": "unapproved" }
    }
  }
}

Lifecycle and compatibility
- Remove the dedicated enclave GitHub proxy scripts, policy/capability plumbing, and cleanup step.
- Pin mcpg v0.4.15 and regenerate workflow locks.
- Update schemas, fixtures, and enclave documentation for direct MCP access.

Fixes Compile enclaves through one multi-agent MCP gateway #57787

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

🟡 Changes recommended

Enclave-only image provisioning, primary-agent isolation, backend toolset compatibility, deterministic output, and a stale version test must be corrected.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Migrates enclave GitHub issue access from a dedicated proxy to isolated identities on the shared MCP gateway.

Changes:

Adds multi-agent gateway identities and repository/tool policies.
Removes the dedicated enclave GitHub proxy lifecycle.
Pins MCPG v0.4.15 and updates schemas, tests, docs, and generated workflows.

File summaries

File	Description
`schema-demos/schema-demo-enclaves.md`	Updates MCPG version.
`pkg/workflow/tools_types.go`	Adds multi-agent policy types.
`pkg/workflow/schemas/mcp-gateway-config.schema.json`	Adds agent policy schema.
`pkg/workflow/mcp_setup_generator.go`	Adds enclave-required GitHub backend.
`pkg/workflow/mcp_setup_gateway.go`	Generates and hands off enclave identity.
`pkg/workflow/mcp_renderer.go`	Renders multi-agent configuration.
`pkg/workflow/mcp_gateway_config.go`	Builds primary and enclave policies.
`pkg/workflow/github_token.go`	Removes proxy-specific token handling.
`pkg/workflow/github_token_test.go`	Removes obsolete token test.
`pkg/workflow/enclaves.go`	Defines enclave GitHub policy.
`pkg/workflow/enclave_github_proxy.go`	Removes dedicated proxy implementation.
`pkg/workflow/enclave_github_proxy_test.go`	Tests shared-gateway behavior.
`pkg/workflow/docker.go`	Collects enclave GitHub image.
`pkg/workflow/data/action_pins.json`	Updates MCPG image pin.
`pkg/workflow/compiler_yaml_ai_execution.go`	Removes proxy cleanup step.
`pkg/workflow/awf_env.go`	Excludes enclave identity from agent environment.
`pkg/constants/version_constants.go`	Raises MCPG defaults and minimums.
`pkg/actionpins/data/action_pins.json`	Updates packaged MCPG pin.
`docs/src/content/docs/reference/glossary.md`	Documents shared gateway isolation.
`docs/src/content/docs/experimental/enclaves.md`	Updates enclave architecture guidance.
`docs/public/schemas/mcp-gateway-config.schema.json`	Publishes agent policy schema.
`actions/setup/sh/stop_enclave_github_proxy.sh`	Removes obsolete cleanup script.
`actions/setup/sh/start_enclave_github_proxy.sh`	Removes obsolete startup script.
`.github/workflows/schema-feature-coverage.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/github-remote-mcp-auth-test.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/github-mcp-tools-report.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-trajectory-grader-implementer.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-team-status.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-spec-coverage-kiro.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-schema-audit-cursor.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-regression-audit-kiro.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-pr-review-cursor.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-max-ai-credits-test.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-github-docs-seo-optimizer.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/daily-byok-ollama-test.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/copilot-pr-merged-report.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/workflows/codex-github-remote-mcp-test.lock.yml`	Regenerates with MCPG v0.4.15.
`.github/aw/enclaves.md`	Updates internal enclave guidance.
`.github/aw/actions-lock.json`	Updates repository MCPG pin.
`.changeset/enclave-github-issues-profile.md`	Describes the shared-gateway migration.

Review details

Files reviewed: 70/324 changed files
Comments generated: 5
Review effort level: Balanced

@@ -185,15 +185,15 @@ const CopilotNoAskUserMinVersion Version = "1.0.19"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultMCPGatewayVersion Version = "v0.4.14"
+const DefaultMCPGatewayVersion Version = "v0.4.15"


@@ -206,6 +206,24 @@ func buildMCPGatewayConfig(workflowData *WorkflowData) *MCPGatewayRuntimeConfig
 		OTLPEndpoint: workflowData.OTLPEndpoint,
 		OTLPHeaders:  workflowData.OTLPHeaders,
 	}
+	if enclaveGitHubIssuesEnabled(workflowData) {
+		primaryServers := collectMCPTools(workflowData)
+		if _, hasGitHub := workflowData.Tools["github"]; !hasGitHub {


+	if enclaveGitHubIssuesEnabled(workflowData) && !slices.Contains(mcpTools, "github") {
+		mcpTools = append(mcpTools, "github")
+	}


+		}
+		config.AgentID = ""


Copilot · 2026-09-02T15:56:17Z

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Install development dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

lpcox · 2026-09-02T15:56:30Z

The shared-mcpg topology, distinct identities, exact enclave tool policy, repository union, identity masking/exclusion, and mcpg v0.4.15 pin align with the AWF runtime contract. I found two blockers before this is ready:

A compatible AWF release is not pinned. DefaultFirewallVersion remains v0.28.12 and AWFEnclaveGitHubIssuesMinVersion remains v0.28.9 (pkg/constants/version_constants.go:67,159). Connect agent enclaves directly to shared GitHub MCP gh-aw-firewall#7991 merged after v0.28.12 was published, so neither version contains the direct shared-mcpg handoff implemented by that PR. A new AWF release is needed, then both constants should identify a version containing Run format and lint checks on PR #7985 #7991.
An explicitly disabled or gh-proxy GitHub tool is exposed to the primary mcpg identity. In pkg/workflow/mcp_gateway_config.go:211, the primary-policy filter checks only whether the github key exists. collectMCPTools correctly skips tools.github: false and mode: gh-proxy, but enclave support then re-adds the GitHub backend. Because the key still exists, github remains in primaryServers, granting the primary identity GitHub MCP access despite the workflow configuration. The condition should test whether primary GitHub MCP mode is actually enabled, not merely whether the key exists.

One additional security-policy concern: pkg/workflow/enclaves.go:49 hardcodes min-integrity: unapproved, weakening the previous approved default. This should either retain/derive the intended integrity floor or document why issues-read-v1 intentionally permits unapproved sources.

lpcox · 2026-09-02T15:57:00Z

@copilot address feedback in comments and reviews

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-09-02T16:10:22Z

The shared-mcpg topology, distinct identities, exact enclave tool policy, repository union, identity masking/exclusion, and mcpg v0.4.15 pin align with the AWF runtime contract. I found two blockers b...

Addressed in 5281f35: the primary policy now excludes disabled/gh-proxy GitHub, shared backend requirements include enclave issue tools, image predownload works for enclave-only workflows, ordering is deterministic, the MCP version test is updated, and enclave access retains min-integrity approved. The AWF release blocker remains pending upstream: gh-aw-firewall's latest release is still v0.28.12, so I did not invent an unreleased version pin.

@copilot address feedback in comments and reviews

Addressed in 5281f35. Validation passes; the only unresolved item is the AWF version pin, which requires a gh-aw-firewall release containing #7991 before the constants can be updated safely.

Move the shared GitHub issues workflow fixture into the untagged enclave test file so integration-tagged compilation can resolve it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3dd3ea30-6e05-4f92-b03b-8d361ba5b5da

gh-aw-bot · 2026-09-02T16:51:49Z

@copilot The remaining blocker here is still the AWF release/version pin noted in review.

A collaborator review says the shared-mcpg handoff requires a gh-aw-firewall release newer than v0.28.12 before DefaultFirewallVersion and AWFEnclaveGitHubIssuesMinVersion can be updated safely.
Please either pin to the first released version that contains Connect agent enclaves directly to shared GitHub MCP gh-aw-firewall#7991 or narrow the feature so it does not claim support before that release exists.
After updating the branch, run the pr-finisher skill.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.1 AIC · ⌖ 8.7 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

github-actions · 2026-09-03T05:09:56Z

🎉 This pull request is included in a new release.

Release: v0.88.2

Initial plan

d53e34f

Copilot AI assigned Copilot and lpcox Sep 2, 2026

Copilot started work on behalf of lpcox September 2, 2026 14:59 View session

Copilot AI linked an issue Sep 2, 2026 that may be closed by this pull request

Compile enclaves through one multi-agent MCP gateway #57787

Closed

Compile enclave GitHub access through shared mcpg

4f441f7

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Implement multi-agent MCP gateway for compiling enclaves~~ Compile enclave GitHub access through shared multi-agent mcpg Sep 2, 2026

Copilot finished work on behalf of lpcox September 2, 2026 15:27

Copilot AI requested a review from lpcox September 2, 2026 15:27

lpcox marked this pull request as ready for review September 2, 2026 15:47

Copilot AI balanced review requested due to automatic review settings September 2, 2026 15:47

Copilot started reviewing on behalf of lpcox September 2, 2026 15:48 View session

Copilot AI reviewed Sep 2, 2026

View reviewed changes

Copilot started work on behalf of lpcox September 2, 2026 15:57 View session

github-actions Bot mentioned this pull request Sep 2, 2026

[pr-sous-chef] PR Sous Chef run report #57799

Closed

Fix shared enclave MCP policy compatibility

5281f35

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox September 2, 2026 16:11

Copilot started work on behalf of gh-aw-bot September 2, 2026 16:52 View session

lpcox merged commit c8a24ee into main Sep 2, 2026
34 of 35 checks passed

lpcox deleted the copilot/compile-enclaves-multi-agent-gateway branch September 2, 2026 16:59

Copilot stopped work on behalf of gh-aw-bot due to an error September 2, 2026 17:01
The session was cancelled by the user.

Copilot AI requested a review from gh-aw-bot September 2, 2026 17:01

This was referenced Sep 2, 2026

Validate merged shared-gateway enclave integration github/gh-aw-firewall#7988

Closed

fix(setup): validate plural gateway agent IDs #57996

Merged

lpcox mentioned this pull request Sep 2, 2026

fix(compiler): normalize gateway policy server IDs #58023

Merged

github-actions Bot mentioned this pull request Sep 3, 2026

Smoke Test: MAI-Code-1-Flash - 33697845057 #58062

Closed

lpcox mentioned this pull request Sep 3, 2026

Migrate agent enclaves from gh CLI proxy to GitHub MCP github/gh-aw-firewall#7989

Open

11 tasks

Navigation Menu

Uh oh!

Compile enclave GitHub access through shared multi-agent mcpg - #57973

Compile enclave GitHub access through shared multi-agent mcpg#57973
lpcox merged 4 commits into
mainfrom
copilot/compile-enclaves-multi-agent-gateway

Copilot AI commented Sep 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI commented Sep 2, 2026

Uh oh!

lpcox commented Sep 2, 2026

Uh oh!

lpcox commented Sep 2, 2026

Uh oh!

Copilot AI commented Sep 2, 2026 •

edited

Loading

Uh oh!

gh-aw-bot commented Sep 2, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Copilot AI commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI commented Sep 2, 2026

Uh oh!

lpcox commented Sep 2, 2026

Uh oh!

lpcox commented Sep 2, 2026

Uh oh!

Copilot AI commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-aw-bot commented Sep 2, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 2, 2026 •

edited

Loading

Copilot AI commented Sep 2, 2026 •

edited

Loading