Collapse sandbox security options into runtime profiles

.github/aw/agent-runtime-instructions.md

@@ -34,13 +34,13 @@ Use these instructions when creating or updating workflows that mention Docker,
 ## gVisor guidance
 
 - gVisor uses `runsc` for the agent container while AWF infrastructure containers continue to use Docker.
-- The generated gVisor installer may use `sudo`, but do not set `sandbox.agent.sudo: true` merely for gVisor.
+- The generated gVisor installer may use host `sudo`; the compiler derives that from `runtime: gvisor`. There is no `sandbox.agent.sudo` field.
 - Use gVisor when stronger kernel isolation is needed and the workload is compatible with gVisor syscall behavior.
 
 ## Docker sbx guidance
 
 - Docker sbx runs the agent in a KVM-backed microVM and requires a KVM-capable Linux runner.
-- With runtime installation enabled, set `sandbox.agent.sudo: true` because gh-aw installs `docker-sbx`, adjusts `/dev/kvm`, starts the sbx daemon, authenticates CLIs, pulls the template, and runs a smoke test.
+- With runtime installation enabled, gh-aw installs `docker-sbx`, adjusts `/dev/kvm`, starts the sbx daemon, authenticates CLIs, pulls the template, and runs a smoke test. The compiler derives the required host privileges from `runtime: docker-sbx`.
 - Docker sbx requires both `DOCKER_USERNAME` and `DOCKER_PAT` Actions secrets. `DOCKER_PAT` must be a Docker Hub personal access token that can authenticate Docker Hub pulls for the sandbox template.
 - `DOCKER_USERNAME` and `DOCKER_PAT` remain required even with `runtime-install: false`, because compiled workflows refresh sbx credentials immediately before agent execution.
 - Do not use Docker sbx for workflows triggered from untrusted forks unless the trigger and credential model safely provide those secrets.
@@ -50,7 +50,7 @@ Use these instructions when creating or updating workflows that mention Docker,
 - Preview scope is narrow: GitHub-hosted runners only, Ubuntu Linux x86_64 only, and `/dev/kvm` must be present.
 - The compiler emits host preflight and release-asset provisioning steps that download and checksum-verify the pinned Cloud Hypervisor binary, `virtiofsd`, kernel, rootfs, and supervisor from the `gh-aw-firewall` release before AWF starts, and grants only the runner user scoped read/write access to `/dev/kvm`.
 - AWF launches with the host privileges required to create the VM but keeps strict network isolation; the guest defaults to 2 vCPUs and 4096 MiB, and its trusted topology attachment is limited to the MCP gateway on TCP 8080 (no CLI proxy).
-- Not supported under Cloud Hypervisor: `tools.github.mode: gh-proxy`, the `integrity-reactions` feature, `sandbox.agent.legacy-security: enable`, `sandbox.agent.allow-host-ports`, and `enclaves:` configuration.
+- Not supported under Cloud Hypervisor: `tools.github.mode: gh-proxy`, the `integrity-reactions` feature, `sandbox.agent.allow-host-ports`, GitHub Actions `services:` with published ports, and `enclaves:` configuration.
 - Do not recommend this runtime for self-hosted, non-Ubuntu, or non-x86_64 runners; use `docker-sbx` or `gvisor` instead.
 
 ## ARC DinD guidance

.github/aw/enclaves.md

@@ -15,7 +15,7 @@ Use these instructions when a workflow needs bounded, auditable access to a priv
 
 ## Prerequisites
 
-- Enclaves require AWF network isolation. Set `sandbox.agent.sudo: false` (or use the `docker-sbx` runtime) so the compiler launches the MCP gateway in bridge mode and AWF can attach it to the isolated topology.
+- Enclaves require AWF network isolation, which every supported `sandbox.agent.runtime` profile provides, so the compiler launches the MCP gateway in bridge mode and AWF can attach it to the isolated topology.
 - Each `repos:` entry needs `repo:` (`owner/name`) and `sensitivity:` (`public`, `internal`, `confidential`, or `sealed`).
 
 ## Example
@@ -24,7 +24,6 @@ Use these instructions when a workflow needs bounded, auditable access to a priv
 sandbox:
  agent:
  id: awf
- sudo: false
 enclaves:
  - script:
  repos:

.github/aw/syntax-agentic.md

@@ -325,8 +325,7 @@ description: Agentic workflow specific frontmatter fields for GitHub Agentic Wor
  agent: false
  ```
 
- - **`sandbox.agent.sudo`** (boolean) controls whether AWF runs in root mode. Default is `false`: AWF runs rootless in network-isolation egress mode (`--network-isolation`), with MCP sidecars attached as bridge containers on the internal `awf-net` network. Set `sudo: true` for the legacy root mode; in strict mode explicit `sudo: true` is an error (warning otherwise).
- - **`sandbox.agent.runtime`** (string) selects an extra-isolation container runtime for the agent: `gvisor` (runs under gVisor's `runsc` for kernel-level isolation) or `docker-sbx` (Docker sbx microVM with KVM hypervisor-level isolation). Both are incompatible with `runner.topology: arc-dind`. gVisor's generated host installer uses `sudo`, but `sandbox.agent.sudo` should remain false. Docker sbx requires `sudo: true`, `DOCKER_PAT`/`DOCKER_USERNAME` secrets, and a KVM-capable runner when runtime installation is enabled.
+ - **`sandbox.agent.runtime`** (string) selects the sandbox security and topology profile: `docker` (default: rootless AWF with network isolation), `docker-sudo-iptables` (privileged AWF with legacy iptables networking and host/service access), `gvisor` (gVisor `runsc` kernel-level isolation), `docker-sbx` (KVM microVM), or `cloud-hypervisor` (preview KVM runtime). Omitting the field is equivalent to `docker`. gVisor and Docker sbx are incompatible with `runner.topology: arc-dind`; the compiler derives the privileged setup each runtime needs. Docker sbx also requires `DOCKER_PAT`/`DOCKER_USERNAME` secrets and a KVM-capable runner when runtime installation is enabled.
  - **`sandbox.agent.runtime-install`** (boolean) controls generated gVisor or Docker sbx provisioning and defaults to `true`. Set it to `false` only when the runner is pre-provisioned; Docker sbx credential refresh still runs. False wins when imported workflows merge this field. See [agent-runtime-instructions.md](agent-runtime-instructions.md) for requirements and troubleshooting.
  - **Strict mode**: `sandbox.agent` blocks without an explicit `id: awf` are rejected in strict mode. Any non-nil, non-disabled agent config without `id`/`type` defaults to AWF at runtime.
 

.github/workflows/ab-testing-advisor.md

@@ -54,7 +54,6 @@ features:
 sandbox:
  agent:
  runtime: gvisor
- sudo: false
 evals:
  - id: experiment_issue_created
  question: Did the agent create a GitHub issue with an A/B experiment campaign for a selected workflow?

.github/workflows/ace-editor.md

@@ -45,7 +45,6 @@ imports:
 sandbox:
  agent:
  runtime: gvisor
- sudo: false
 tools:
  cli-proxy: true
 evals:
@@ -55,4 +54,4 @@ evals:
  question: Was a comment posted to the pull request with the ACE editor link?
 ---
 
-Classic action that generates an ACE editor session link on pull request comment slash command.
+Classic action that generates an ACE editor session link on pull request comment slash command.