Fix cache-memory writes under Cloud Hypervisor sandboxing

[Copilot]

Cache-memory paths were granted through engine tools but omitted from filesystem.allowWrite, causing sandboxed writes to fail with EROFS. The default firewall version also lacked the restricted-/tmp startup fix required for end-to-end operation.

• Unify write permissions

  • Add each compiler-provisioned cache directory to Cloud Hypervisor’s filesystem.allowWrite.
  • Derive sandbox and engine paths from the canonical cacheMemoryDirFor helper.
  • Narrow Claude’s default /tmp access only when Cloud Hypervisor enforces the explicit policy.

• Preserve startup ordering

  • Ensure cache directories are created before AWF starts.

• Upgrade the firewall

  • Bump the default gh-aw-firewall version to v0.28.7.
  • Add verified container digests and regenerate workflow lock files.

Generated policy now includes cache storage:

{
  "filesystem": {
    "allowWrite": [
      "/tmp/gh-aw/agent",
      "/workspace",
      "/workspace/.awf-home",
      "/tmp/gh-aw/cache-memory"
    ]
  }
}

• Fixes Compiler grants engine write access to paths missing from sandbox filesystem.allowWrite (cache-memory silently fails with EROFS) #55424

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch PR file list

🧪 Test quality analysis by Test Quality Sentinel

[pelikhan]

/smoke-copilot

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #55427 does not have the 'implementation' label and has 67 new lines of code in business logic directories (threshold: 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

❌ Ponytail Reviewer failed. Please review the logs for details.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by Ponytail Reviewer for #55427

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[Copilot]

Pull request overview

Fixes cache-memory writes in Cloud Hypervisor sandboxes by aligning generated filesystem and engine permissions.

Changes:

• Adds cache-memory directories to filesystem.allowWrite with tests.
• Narrows Claude write permissions under Cloud Hypervisor.
• Upgrades gh-aw-firewall to v0.28.7 and regenerates pins/workflows.

Show a summary per file

File	Description
pkg/workflow/sandbox.go	Adds cache paths to sandbox write policy.
pkg/workflow/sandbox_test.go	Tests cache path policy generation.
pkg/workflow/compiler_orchestrator_workflow.go	Applies cache write paths during compilation.
pkg/workflow/cloud_hypervisor_test.go	Tests generated policy and startup ordering.
pkg/workflow/claude_tools.go	Aligns Claude permissions with sandbox paths.
pkg/workflow/claude_engine_tools_test.go	Tests narrowed Claude permissions.
pkg/constants/version_constants.go	Bumps default firewall to v0.28.7.
pkg/workflow/data/action_pins.json	Adds v0.28.7 image digests.
pkg/actionpins/data/action_pins.json	Adds matching action-pin data.
.github/aw/actions-lock.json	Records v0.28.7 container pins.
.github/workflows/smoke-ci.lock.yml	Regenerates workflow with v0.28.7.
.github/workflows/notion-issue-summary.lock.yml	Regenerates workflow with v0.28.7.
.github/workflows/hippo-embed.lock.yml	Regenerates workflow with v0.28.7.
.github/workflows/firewall.lock.yml	Regenerates workflow with v0.28.7.
.github/workflows/example-permissions-warning.lock.yml	Regenerates workflow with v0.28.7.
.github/workflows/daily-arxiv-researcher.lock.yml	Regenerates workflow with v0.28.7.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerates workflow with v0.28.7.
.changeset/patch-cache-memory-sandbox-write-access.md	Documents the patch release.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 20/303 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🧪 Agentic Commands has started processing this issue comment

[github-actions]

Comment Memory

reviewed_at: 2026-08-24T00:00:00Z
review_event: COMMENT
top_themes:
  - no actionable changed-line correctness issues found
  - change consistently threads cache-memory paths into cloud-hypervisor allowWrite
  - firewall default/version pin update appears aligned with existing version gates
files_reviewed:
  - .changeset/patch-cache-memory-sandbox-write-access.md
  - .github/aw/actions-lock.json
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · pi · gpt54 · 33.6 AIC · ⌖ 6.77 AIC · ⊞ 7K · ◷
_{Comment /review to run again}

[github-actions]

Verdict

Non-blocking: I don't see a changed-line correctness regression worth blocking here.

The patch does the right thing in the places that matter

• Cache-memory paths are now derived from the canonical helper before being threaded into Cloud Hypervisor filesystem.allowWrite, which closes the sandbox/engine permission mismatch the PR is fixing.
• The compiler path that extracts cache-memory config updates sandbox write permissions before workflow rendering, and the regression tests cover both ordering and the generated allowWrite payload.
• The default firewall bump to v0.28.7 matches the existing version gates and embedded image pins already present in-tree.

I checked for restore-only cache handling, startup ordering, and accidental broadening of Claude /tmp access under non-Cloud-Hypervisor runtimes, and none of those looked newly broken in the changed surface.

🔎 Code quality review by PR Code Quality Reviewer · pi · gpt54 · 33.6 AIC · ⌖ 6.77 AIC · ⊞ 7K
_{Comment /review to run again}

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — well-structured bug fix with solid test coverage. The PR has already merged; leaving observations for follow-up if needed.

📋 Key Themes & Findings

Positive Highlights

• ✅ Root cause correctly addressed: cacheMemoryDirFor now used as the canonical source for both engine tool grants and sandbox allowWrite, eliminating the divergence that caused EROFS.
• ✅ ensureCacheMemoryWritePaths is idempotent — the double-call in TestEnsureCacheMemoryWritePaths explicitly guards against duplicate path insertions.
• ✅ Startup ordering validated: TestCloudHypervisorCacheMemoryAllowWrite asserts createDirIdx < awfIdx, which is the right regression guard per /diagnosing-bugs.
• ✅ New TestClaudeEngineSandboxAllowWriteNarrowsDefaultTmpAccess directly covers the /tmp narrowing behaviour.

Observations (non-blocking, for follow-up)

1. [/tdd] TestClaudeEngineComputeAllowedToolsWithSandboxAllowWrite now covers a different code path

Adding Runtime: AgentRuntimeCloudHypervisor to the existing test silently flipped it from testing the append path (writablePaths = append(writablePaths, allowWrite...)) to the replace path (writablePaths = allowWrite). The append path for non-CloudHypervisor runtimes no longer has dedicated coverage. Consider splitting into two named sub-cases.

2. [/diagnosing-bugs] Empty allowWrite: [] under Cloud Hypervisor drops all write permissions

In appendSandboxWritableTools, when Runtime == AgentRuntimeCloudHypervisor and allowWrite is non-nil but empty, writablePaths is set to []string{} — Claude receives no write tools. This is a latent footgun if a workflow author explicitly sets filesystem.allowWrite: []. A guard or documentation note would prevent future confusion.

3. [/tdd] Integration test asserts exact JSON array order

TestCloudHypervisorCacheMemoryAllowWrite hard-codes the allowWrite array as a literal substring. If ensureDefaultAgentWritePath or ensureCacheMemoryWritePaths ever reorder insertions, the test will false-negative. Unmarshalling the lock YAML and asserting set membership would be more robust.

@copilot please address the review comments above.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet46 · 32.7 AIC · ⌖ 9.93 AIC · ⊞ 7.6K
_{Comment /matt to run again}