fix(security): enforce TLS SNI allowlist by lpcox · Pull Request #8878 · github/gh-aw-firewall

lpcox · 2026-09-22T11:36:16Z

Summary

inspect the TLS ClientHello after an allowed CONNECT request and require the client-requested SNI to match the HTTPS allowlist
splice allowlisted TLS connections without decrypting application traffic, and terminate missing, blocked, or non-allowlisted SNI
preserve trusted AWF sidecar behavior and explicitly allowlisted IP destinations
generate an ephemeral listener certificate from the compose wrapper so the fix works with already-published Squid images
expose SNI enforcement in the policy manifest and document the corrected egress security model

Security context

This fixes the domain-fronting bypass reported in github/gh-aw#62547. Previously, Squid authorized an HTTPS tunnel solely from the plaintext CONNECT target. On shared CDN infrastructure, a client could CONNECT to an allowlisted hostname and then send a different TLS SNI inside the tunnel.

The default listener now uses Squid peek-and-splice:

authorize the CONNECT target through the existing HTTP access rules
peek at the ClientHello without decrypting application data
terminate blocked, missing, or non-allowlisted SNI
splice allowed traffic unchanged

Blocked-domain rules take precedence over parent-domain allow rules. Trusted API/CLI proxy sources and explicitly allowlisted IP destinations retain their existing behavior.

Validation

npm test -- --runInBand — 379 suites, 6,088 passed, 4 skipped
npm run type-check -- --pretty false
npm run lint -- --quiet
npx markdownlint-cli2 docs/egress-filtering.md docs/ssl-bump.md --no-globs
live Docker probe: normal https://nodejs.org succeeded; CONNECT to nodejs.org with TLS SNI example.com was terminated

A real integration regression reproducing the raw CONNECT/SNI attack is included. The local integration harness itself requires interactive sudo on this machine, so that test is intended to run in CI.

Compatibility

TLS clients connecting to normal hostname destinations must send SNI. This is intentional fail-closed behavior. Full security.sslBump content-inspection mode remains unchanged.

Validate TLS ClientHello SNI before splicing HTTPS connections. Preserve trusted sidecar and explicit IP behavior. Add regression coverage and document the default peek-and-splice enforcement model. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-09-22T11:36:54Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-8878 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit 71e4e24

Copilot

Copilot review overview

🟢 Approval recommended

The security fix is consistently integrated across configuration, startup, policy reporting, tests, and documentation with no unresolved defects found.

Review effort: Balanced
Findings: None

What changed in this PR

This PR hardens HTTPS egress filtering by validating TLS ClientHello SNI after CONNECT authorization, preventing domain-fronting bypasses while preserving trusted sidecar and allowlisted-IP behavior.

Changes:

Adds default Squid peek-and-splice SNI enforcement and ephemeral certificate generation.
Exposes enforcement in policy manifests and adds unit/integration coverage.
Updates egress and SSL Bump security documentation.

File	Description
`tests/integration/network-security.test.ts`	Adds a raw CONNECT/SNI domain-fronting regression test.
`src/types/policy.ts`	Adds the SNI guard manifest capability.
`src/squid/ssl-bump.ts`	Generates guard-only peek/splice/terminate rules.
`src/squid/ssl-bump.test.ts`	Tests SNI ACL and rule generation.
`src/squid/policy-manifest.ts`	Reports SNI enforcement as enabled.
`src/squid/config-sections.ts`	Enables the guard by default and supplies policy inputs.
`src/squid/config-sections.test.ts`	Tests default listeners, allow/block precedence, sidecars, and IPs.
`src/squid/config-generator.ts`	Propagates blocked domains into section generation.
`src/squid-config-ssl-bump.test.ts`	Updates generated-config expectations.
`src/services/squid-service.ts`	Generates the listener’s ephemeral certificate at startup.
`src/services/squid-service.test.ts`	Verifies certificate bootstrap command generation.
`src/logs/audit-enricher.test-utils.ts`	Updates manifest test fixtures.
`docs/ssl-bump.md`	Documents default SNI validation and splicing.
`docs/egress-filtering.md`	Documents the corrected domain-fronting threat model.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-22T14:19:21Z

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

example.com
github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "github.com"

See Network Configuration for more information.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-09-22T14:19:24Z

✅ Build Test Suite completed successfully!

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

api.nuget.org
bun.sh
dc.services.visualstudio.com
deno.land
dl.deno.land
github.com
releaseassets.githubusercontent.com
repo.maven.apache.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.nuget.org"
    - "bun.sh"
    - "dc.services.visualstudio.com"
    - "deno.land"
    - "dl.deno.land"
    - "github.com"
    - "releaseassets.githubusercontent.com"
    - "repo.maven.apache.org"

See Network Configuration for more information.

Generated by Build Test Suite for #8878

github-actions · 2026-09-22T14:19:28Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-22T14:19:34Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-22T14:19:35Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

o205451.ingest.us.sentry.io
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"
    - "registry.npmjs.org"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-22T14:19:51Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-22T14:19:56Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-22T14:19:57Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
accounts.google.com
api.github.com
clients2.google.com
collector.github.com
contentautofill.googleapis.com
github.com
github.githubassets.com
msfeed25.pkgs.visualstudio.com
update.googleapis.com
www.google.com
www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-22T14:19:57Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8878

github-actions · 2026-09-22T14:19:58Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-22T14:20:10Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-22T14:20:16Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-22T14:20:52Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-22T14:21:27Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

api.github.com
example.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-22T14:22:33Z

Smoke Test: Cloud Hypervisor + Copilot

Check	Result
1. List merged PRs (github MCP)	PASS
2. `curl https://github.com` → 200	PASS
3. Write/read temp file	PASS
4. `curl (example.com/redacted)` → blocked (000)	PASS

Overall: PASS ✅

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

example.com
github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "github.com"

See Network Configuration for more information.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:23:23Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
GitHub CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8878 · claude · haiku45 · 55.8 AIC · ⊞ 4.7K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:23:48Z

Smoke Test: Copilot BYOK (Direct) Mode ✅

Test Results:

✅ GitHub MCP: PRs feat(nvx): add internal Phase 3c lifecycle manager #8867, Correlate upstream 400s with request tool surface and negotiate MCP protocol version #8861 verified
✅ GitHub.com: HTTP 200
✅ File Read: /tmp/gh-aw/agent/smoke-test-copilot-byok.txt confirmed
✅ BYOK Inference: Running in direct mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Status: PASS

Running in direct BYOK mode with api-proxy sidecar routing to api.githubcopilot.com.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:23:57Z

📡 OTel Tracing Smoke Test Results

#	Scenario	Result
1	Module Loading (`otel.js`)	✅ Loaded successfully, `isEnabled: true`, exports: `startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, ...`
2	Test Suite (`otel` Jest)	✅ 3 suites / 68 tests passed, 0 failed
3	Env Var Forwarding	✅ `GITHUB_AW_OTEL_TRACE_ID`/`GITHUB_AW_OTEL_PARENT_SPAN_ID` found in `env-passthrough.ts`; `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, and trace context found in `api-proxy-env-config.ts`
4	Token Tracker Integration	✅ `onUsage` callback present in `token-tracker-http.js`
5	OTEL Diagnostics	⚠️ No `otel.jsonl` span file emitted this run (expected — no live OTLP export exercised in this smoke pass); `token-usage.jsonl`/`token-tracker-audit.jsonl` present

Summary: All functional/unit checks (1–4) pass cleanly. Scenario 5 shows no spans exported in this run, which is expected since no proxied LLM traffic occurred during validation — not a regression.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

o205451.ingest.us.sentry.io
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"
    - "registry.npmjs.org"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:24:06Z

Smoke test: services connectivity — PASS ✅

Redis PING: ✅ PONG
PostgreSQL pg_isready: ✅ accepting connections
PostgreSQL SELECT 1: ✅ 1

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:24:50Z

Smoke Test: Copilot Engine — PASS ✅

✅ GitHub MCP connectivity (PR feat(nvx): add internal Phase 3c lifecycle manager #8867, Correlate upstream 400s with request tool surface and negotiate MCP protocol version #8861 fetched)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test
✅ PR fix(security): enforce TLS SNI allowlist #8878 read via MCP

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:24:56Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version differs between host (v24.21.0) and chroot (v22.23.2). Python and Go match. smoke-chroot label not applied since not all tests passed.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:25:12Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run OK)	✅ PASS
.NET	json-parse	✅	N/A (run OK)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: The default Maven local repository at ~/.m2/repository could not be created because ~/.m2 was pre-existing and root-owned (permission denied), unrelated to firewall egress control. Worked around by passing -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo to mvn compile/mvn test for both Java projects; all Squid proxy settings in ~/.m2/settings.xml applied correctly and all network access, compiles, and tests succeeded.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

api.nuget.org
bun.sh
dc.services.visualstudio.com
deno.land
dl.deno.land
github.com
releaseassets.githubusercontent.com
repo.maven.apache.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.nuget.org"
    - "bun.sh"
    - "dc.services.visualstudio.com"
    - "deno.land"
    - "dl.deno.land"
    - "github.com"
    - "releaseassets.githubusercontent.com"
    - "repo.maven.apache.org"

See Network Configuration for more information.

Generated by Build Test Suite for #8878 · copilot · auto · 44.1 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:25:16Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable — allowed=200
✅ Blocked domain (example.com) denied — SSL/connection failure, denied=000

Overall: PASS

@lpcox

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

api.github.com
example.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-22T14:27:15Z

feat(nvx): add internal Phase 3c lifecycle manager
Correlate upstream 400s with request tool surface and negotiate MCP protocol version
Merged PR review: ✅
PR detail lookup: ✅
Playwright title check: ✅
File write/read: ✅
Latest discussion/comment: ✅
AWF build: ✅
Overall: PASS

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
accounts.google.com
api.github.com
clients2.google.com
collector.github.com
contentautofill.googleapis.com
github.com
github.githubassets.com
msfeed25.pkgs.visualstudio.com
update.googleapis.com
www.google.com
www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

Copilot AI balanced review requested due to automatic review settings September 22, 2026 11:36

Copilot started reviewing on behalf of lpcox September 22, 2026 11:36 View session

Copilot AI reviewed Sep 22, 2026

View reviewed changes

lpcox added the ready-for-aw label Sep 22, 2026

lpcox had a problem deploying to aoai-model September 22, 2026 14:20 — with GitHub Actions Failure

github-actions Bot added the smoke-cloud-hypervisor label Sep 22, 2026

github-actions Bot added smoke-claude smoke-copilot-byok labels Sep 22, 2026

lpcox deployed to aoai-model September 22, 2026 14:23 — with GitHub Actions Active

github-actions Bot added the smoke-services label Sep 22, 2026

github-actions Bot added the smoke-copilot label Sep 22, 2026

lpcox deployed to aoai-model September 22, 2026 14:25 — with GitHub Actions Active

github-actions Bot added the build-test label Sep 22, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 22, 2026

github-actions Bot added the smoke-codex label Sep 22, 2026

lpcox merged commit 7c56dd9 into main Sep 22, 2026
149 of 154 checks passed

lpcox deleted the enforce-tls-sni-allowlist branch September 22, 2026 14:50

This was referenced Sep 22, 2026

Fail Cloud Hypervisor preflight early when the trusted-artifact root is noexec #8866

Merged

fix: propagate config fields to all layers #8876

Merged

Refactor Cloud Hypervisor preflight into focused modules #8889

Merged

Conversation

lpcox commented Sep 22, 2026

Summary

Security context

Validation

Compatibility

Uh oh!

github-actions Bot commented Sep 22, 2026

Documentation Preview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026

Smoke Test: Cloud Hypervisor + Copilot

Uh oh!

github-actions Bot commented Sep 22, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 22, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅

Uh oh!

github-actions Bot commented Sep 22, 2026

📡 OTel Tracing Smoke Test Results

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Sep 22, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading