Surface Cloud Hypervisor guest network init failures

[Copilot]

Cloud Hypervisor sandbox runs could spend the full engine timeout when guest networking never initialized, then report misleading engine-specific failures. The root failure is now detected and labeled at the sandbox boundary.

• Cloud Hypervisor preflight retry

  • Wraps Cloud Hypervisor AWF invocations with a bounded guest-connectivity retry.
  • Preserves the AWF exit status across tee log pipelines.

• Explicit failure signal

  • Emits a dedicated SANDBOX_NETWORK_INIT_FAILED Actions annotation when the guest connectivity probe fails after retry.
  • Surfaces captured guest network state lines for quick diagnosis.

::error title=SANDBOX_NETWORK_INIT_FAILED::SANDBOX_NETWORK_INIT_FAILED: Cloud Hypervisor guest networking did not initialize; guest connectivity probe failed after 2 attempt(s).
SANDBOX_NETWORK_INIT_FAILED guest network state:
guest network state: 1: lo: <LOOPBACK> ... state DOWN ...

• Failure reporting
  • Detects Cloud Hypervisor guest connectivity probe failures in agent-stdio.log.
  • Reports a sandbox network init failure instead of downstream Claude/Copilot-style engine errors.

• Fixes[aw-failures] [P0] Cloud Hypervisor guest network never comes up — full egress blackout kills sandbox runs across engines #53935

[pelikhan]

@lpcox

[github-actions]

PR Triage

• Category: bug
• Risk: medium
• Priority score: 30/100 (impact 15 + urgency 8 + quality 7)
• Recommended action: defer

Draft PR surfacing Cloud Hypervisor guest network init failures at the sandbox boundary. Still WIP; defer until out of draft.

Generated by 🔧 PR Triage Agent · auto · 44.3 AIC · ⌖ 2.78 AIC · ⊞ 8.3K · ◷

[github-actions]

PR Triage

Category: bug · Risk: medium · Score: 43/100 (impact 20 + urgency 15 + quality 8)
Recommended action:defer

Draft infra-visibility fix (surfaces failures, does not fix root cause); moderate value, not urgent.

Automated triage — see run report for full details.

Generated by 🔧 PR Triage Agent · auto · 90.2 AIC · ⌖ 2.82 AIC · ⊞ 8.3K · ◷

[github-actions]

PR Triage

• Category: bug
• Risk: medium
• Priority score: 43 / 100 (impact 20 + urgency 15 + quality 8)
• Recommended action:defer

Draft PR surfacing Cloud Hypervisor guest network init failures via a pre-flight check. Lower urgency until undrafted.

Automated triage by PR Triage Agent.

Generated by 🔧 PR Triage Agent · auto · 57.1 AIC · ⌖ 2.88 AIC · ⊞ 8.3K · ◷

[github-actions]

PR Triage

Category: bug | Risk: medium | Priority: low (score 37/100)
Score breakdown: impact 15 + urgency 12 + quality 10
Recommended action:defer
Draft fix surfacing Cloud Hypervisor guest network init failures at the sandbox boundary. No reviews yet; revisit after undraft and CI signal.

Generated by 🔧 PR Triage Agent · auto · 62.9 AIC · ⌖ 7.05 AIC · ⊞ 8.3K · ◷

[github-actions]

PR Triage

Category:bug · Risk:medium · Score: 35/100 · Action:defer

Draft, no CI results recorded yet.

_{Automated triage — see the triage report issue for full context.}

Generated by 🔧 PR Triage Agent · auto · 67 AIC · ⌖ 10.2 AIC · ⊞ 8.3K · ◷

[github-actions]

🔍 PR Triage

Category: bug · Risk: medium · Priority: medium · Score: 50/100
Breakdown: impact 22 · urgency 18 · quality 10

Recommended action:fast_track

Carry-over PR (prior run: fast_track candidate), still open. Contained fix (152+/10-, 4 files) surfacing Cloud Hypervisor guest network init failures. No CI data available via check-runs API — verify status before merge, but content is ready for expedited human review.

Generated by 🔧 PR Triage Agent · auto · 50 AIC · ⌖ 5.31 AIC · ⊞ 8.3K · ◷

[lpcox]

Closing because the underlying Cloud Hypervisor guest networking failures have been fixed in the merged gh-aw-firewall PRs:

• Fix Cloud Hypervisor guest network readiness race gh-aw-firewall#7555 — fixes the guest network readiness race
• Fix Cloud Hypervisor guest loopback networking gh-aw-firewall#7568 — configures guest IPv4 loopback networking