Skip to content

feat: add unified enclave foundation #6986

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 2 commits into from
Aug 7, 2026
Merged

feat: add unified enclave foundation #6986

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ed02417
Add unified enclave foundation
lpcox Aug 6, 2026
f9a9f2c
fix: enforce enclave startup validation
lpcox Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions containers/bounded-query/bounded-execution/sensitivity-policy.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,9 @@

/**
* Repository sensitivity categories and their fixed per-run information
* budgets — broker-side mirror of `BOUNDED_QUERY_SENSITIVITY_RUN_BITS` in
* `src/types/bounded-query-options.ts`. Kept in a tiny standalone module (not
* budgets — broker-side mirror of `ENCLAVE_SENSITIVITY_RUN_BITS` in
* `src/types/enclave-options.ts`. The bounded-query names below are compatibility
* aliases while legacy brokers remain live. Kept in a tiny standalone module (not
* `protocol.js`) because it is config/ledger data, not wire protocol.
*
* `null` means "unmetered": `public` still runs through the same finite
Expand Down
36 changes: 36 additions & 0 deletions docs/awf-config-spec.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2439,6 +2439,42 @@ can answer the question.
bounded queries; unlike a bounded query it does have a network interface, to
the API proxy only.

## 16. Unified Enclaves (Migration Foundation)

The optional `enclaves` object is the successor configuration model for bounded
private-repository execution. In this foundation release it is parsed,
normalized, and validated but does not create a runtime service or primary-agent
surface. See [Unified Enclave Architecture and Migration](enclaves-architecture.md)
for the target trust boundaries and rollout sequence.

`enclaves.privateRepos` is the single trusted repository list for every
executor. Each entry has the same `public`, `internal`, `confidential`, or
`sealed` sensitivity policy used by the legacy systems. The resulting
information budget is one per-repository, per-run balance shared by script and
agent executor invocations; an executor change never resets the balance.

`enclaves.executors.script` and `enclaves.executors.agent` are independently
enabled trusted definitions. Script defaults preserve the bounded-query limits
(`docker`, no network, `python3`, 30 seconds, 512 MiB, 32 invocations). Agent
defaults preserve the bounded-agent limits (`docker`, API-proxy-only network,
Copilot/OpenAI profile, 120 seconds, 512 MiB, 8 invocations, 8 model requests,
1024 completion tokens). Neither executor is enabled by omission.

Images, runtimes, interpreters, engines, provider profiles, models, networks,
timeouts, resource limits, and operational limits are trusted configuration.
Future invocation protocols MUST reject those controls, including unknown
aliases for them. An enabled agent executor requires a configured model.

When `enclaves.enabled` is `true`, at least one executor and one repository are
required. `boundedQueries.enabled` or `boundedAgents.enabled` MUST NOT also be
true. AWF rejects that mixed configuration before any legacy broker, enclave
server, repository staging, or primary agent starts. Disabled sections may
coexist because they do not activate a runtime.

The foundation does not combine the existing live broker ledgers. Shared-budget
runtime enforcement begins only when the AWF-owned enclave MCP server replaces
both direct brokers in a later migration layer.

## Normative References

- [RFC 2119](https://www.rfc-editor.org/rfc/rfc2119) — Key words for use in
Expand Down
307 changes: 307 additions & 0 deletions docs/awf-config.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1102,6 +1102,313 @@
"model"
]
}
},
"enclaves": {
"type": "object",
"description": "Unified private-repository enclave foundation. Repositories and sensitivities are shared by script and agent executors, and every invocation debits one per-repository information budget regardless of executor kind. This layer validates trusted configuration only; it does not expose an MCP server or a primary-agent surface.",
"additionalProperties": false,
"properties": {
"enabled": {
"type": "boolean",
"default": false,
"description": "Enable the unified enclave subsystem. Cannot be enabled with boundedQueries or boundedAgents."
},
"privateRepos": {
"type": "array",
"minItems": 1,
"description": "Private repositories shared by every configured enclave executor. Sensitivity fixes one shared per-run information budget for the repository across script and agent calls.",
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"repo",
"sensitivity"
],
"properties": {
"repo": {
"type": "string",
"maxLength": 140,
"pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/(?!\\.\\.?$)(?!.*\\.\\.)[A-Za-z0-9._-]{1,100}$"
},
"sensitivity": {
"type": "string",
"enum": [
"public",
"internal",
"confidential",
"sealed"
]
}
}
}
},
"executors": {
"type": "object",
"additionalProperties": false,
"description": "Trusted executor definitions. Images, runtimes, networks, models, timeouts, and resources are AWF configuration and must never be accepted from an invocation request.",
"properties": {
"script": {
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"type": "boolean",
"default": false
},
"runtime": {
"type": "string",
"enum": [
"docker",
"gvisor",
"sbx"
],
"default": "docker"
},
"image": {
"type": "string",
"minLength": 1,
"maxLength": 500,
"description": "Trusted image override. Omission uses AWF's pinned script-executor image."
},
"network": {
"const": "none",
"default": "none"
},
"interpreter": {
"const": "python3",
"default": "python3"
},
"timeout": {
"type": "integer",
"minimum": 1,
"maximum": 540,
"default": 30
},
"memoryLimit": {
"type": "string",
"pattern": "^[1-9][0-9]*[bkmgBKMG]$",
"default": "512m"
},
"cpuLimit": {
"type": "string",
"pattern": "^(?:[0-9]{1,2})(?:\\.[0-9]{1,3})?$",
"default": "1"
},
"pidsLimit": {
"type": "integer",
"minimum": 1,
"maximum": 4096,
"default": 128
},
"tmpfsLimit": {
"type": "string",
"pattern": "^[1-9][0-9]*[bkmgBKMG]$",
"default": "64m"
},
"maxOutputBytes": {
"type": "integer",
"minimum": 1,
"maximum": 8192,
"default": 8192
},
"maxScriptBytes": {
"type": "integer",
"minimum": 1,
"maximum": 65536,
"default": 65536
},
"maxInvocations": {
"type": "integer",
"minimum": 1,
"maximum": 10000,
"default": 32
}
}
},
"agent": {
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"type": "boolean",
"default": false
},
"runtime": {
"type": "string",
"enum": [
"docker",
"gvisor",
"sbx"
],
"default": "docker"
},
"image": {
"type": "string",
"minLength": 1,
"maxLength": 500,
"description": "Trusted image override. Omission uses AWF's pinned engine image."
},
"network": {
"const": "api-proxy-only",
"default": "api-proxy-only"
},
"engine": {
"type": "string",
"enum": [
"copilot",
"claude",
"codex",
"gemini"
],
"default": "copilot"
},
"profile": {
"type": "string",
"enum": [
"openai",
"anthropic"
],
"default": "openai"
},
"model": {
"type": "string",
"minLength": 1,
"maxLength": 200,
"pattern": "^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,199}$"
},
"timeout": {
"type": "integer",
"minimum": 1,
"maximum": 540,
"default": 120
},
"memoryLimit": {
"type": "string",
"pattern": "^[1-9][0-9]*[bkmgBKMG]$",
"default": "512m"
},
"cpuLimit": {
"type": "string",
"pattern": "^(?:[0-9]{1,2})(?:\\.[0-9]{1,3})?$",
"default": "1"
},
"pidsLimit": {
"type": "integer",
"minimum": 1,
"maximum": 4096,
"default": 128
},
"tmpfsLimit": {
"type": "string",
"pattern": "^[1-9][0-9]*[bkmgBKMG]$",
"default": "64m"
},
"maxOutputBytes": {
"type": "integer",
"minimum": 1,
"maximum": 8192,
"default": 8192
},
"maxTaskBytes": {
"type": "integer",
"minimum": 1,
"maximum": 65536,
"default": 4096
},
"maxInvocations": {
"type": "integer",
"minimum": 1,
"maximum": 1000,
"default": 8
},
"maxModelRequests": {
"type": "integer",
"minimum": 1,
"maximum": 64,
"default": 8
},
"maxModelTokens": {
"type": "integer",
"minimum": 1,
"maximum": 32768,
"default": 1024
}
},
"if": {
"properties": {
"enabled": {
"const": true
}
},
"required": [
"enabled"
]
},
"then": {
"required": [
"model"
]
}
}
}
}
},
"if": {
"properties": {
"enabled": {
"const": true
}
},
"required": [
"enabled"
]
},
"then": {
"required": [
"privateRepos",
"executors"
],
"properties": {
"executors": {
"anyOf": [
{
"required": [
"script"
],
"properties": {
"script": {
"required": [
"enabled"
],
"properties": {
"enabled": {
"const": true
}
}
}
}
},
{
"required": [
"agent"
],
"properties": {
"agent": {
"required": [
"enabled"
],
"properties": {
"enabled": {
"const": true
}
}
}
}
}
]
}
}
}
}
},
"$defs": {
Expand Down
Loading
Loading