🩺 Runner Doctor UpdateRunner Doctor: A21 update — /tmp/awf-lib fix shipped in PR #7728 not yet cited

[github-actions]

Summary

• Scan window: updated:>=2026-08-23 in github/gh-aw-firewall
• Reviewed ~55 issues/PRs updated in the window (list_issues + list_pull_requests, pages 1–3)
• 1 genuine new lesson found (update to existing mode A21); everything else either already covered, unrelated (dependency bumps, doc-maintenance no-ops, Cloud Hypervisor work out of scope for this catalog), or not a runner-environment lesson (e.g. Unclear location for agent temp files #7696 "Unclear location for agent temp files" was closed not_planned and only links to an external discussion with no AWF-side root cause).

Proposed knowledge-base changes

File: .github/workflows/shared/self-hosted-failure-modes.md

Update row A21 (do not change its ID). The row currently attributes the full fix to PR #7679, but #7679 only relocated the init-signal (/tmp/awf-init → /run/awf-init) and added nested-mountpoint pre-creation. It explicitly did not fix the silent /tmp/awf-lib helper-staging degradation (one-shot token protection / gh proxy wrapper silently disabled under filesystem.allowWrite) — that gap was tracked separately in issue #7681 and fixed by PR #7728 ("Fix helper staging under filesystem allowWrite", merged 2026-08-25), which:

• Moves /tmp/awf-lib to /run/awf-lib for both chroot and non-chroot paths (covers the one-shot token library, Claude key helper, gh wrapper, CA bundles, runner shims)
• Makes startup fail closed instead of silently degrading: aborts if the one-shot token library cannot be staged, and aborts if CLI proxying is enabled but the gh wrapper cannot be installed
• Adds regression coverage asserting no /tmp/awf-lib references remain and that the token library exists at /run/awf-lib/one-shot-token.so under a narrowed /tmp

Proposed updated Fix / flag cell for A21:

Fixed in AWF (PR #7679, merged 2026-08-24): init-signal moved to /run/awf-init; a new planNestedMountpoints()/ensureNestedMountpoints() pass pre-creates mountpoints that would land inside read-only covers (or fails closed); isSharedDockerHostPathPrefix now treats only the literal /tmp prefix as shared for ARC/DinD detection; legacy /tmp/awf-init compatibility binds remain for older pinned agent images. Further fixed in AWF (PR #7728, merged 2026-08-25): /tmp/awf-lib helper staging (one-shot token protection library, Claude API key helper, gh CLI proxy wrapper, CA bundles, runner shims) also moved to /run/awf-lib, eliminating a previously silent security regression where filesystem.allowWrite narrowing /tmp to read-only caused token protection and the gh proxy wrapper to degrade with only a warning instead of failing. Startup now fails closed if the one-shot token library cannot be staged, or if CLI proxying is enabled but the gh wrapper cannot be installed. Upgrade AWF to include #7728.

Add github/gh-aw-firewall#7728 to the citation list (append after #7681).

Proposed updated Probe cell (append): ; inspect entrypoint logs for [entrypoint][WARN] Could not copy one-shot-token library to /tmp/awf-lib — its presence on a version including github/gh-aw-firewall#7728 indicates the fix did not apply (should not occur; startup should instead fail closed), while its presence on older AWF confirms the pre-#7728 silent-degradation mode

Proposed doctor changes

File: .github/workflows/self-hosted-runner-doctor.md

Update the A21 narrative entry (line ~163) to add the /tmp/awf-lib / PR #7728 clause described above, and extend its citation list to include github/gh-aw-firewall#7728.

Also consider adding an error-string quick-lookup row (if the doctor maintains one for A21) mapping:

[entrypoint][WARN] Could not copy one-shot-token library to /tmp/awf-lib followed by Token protection will be disabled → A21 (silent security-feature degradation under filesystem.allowWrite, fixed in #7728)

Proposed portable agent changes

File: .github/agents/self-hosted-runner-doctor.md

Mirror both edits above exactly (the embedded catalog table row at line ~257 and the narrative playbook entry at line ~134), so the portable, self-contained doctor agent stays in sync with the workflow/shared files.

Source issues and PRs

• filesystem.allowWrite silently disables token protection and the gh proxy wrapper #7681 (follow-up gap report: /tmp/awf-lib degrades token protection and gh wrapper silently, and /tmp/awf-runner-bin ARC/DinD staging mount issue)
• Fix helper staging under filesystem allowWrite #7728 (the actual fix: helper staging moved to /run/awf-lib, fail-closed behavior, regression coverage) — merged 2026-08-25, closes filesystem.allowWrite silently disables token protection and the gh proxy wrapper #7681
• Related/context (already cited in A21, no change needed): filesystem.allowWrite breaks agent startup: /tmp/awf-init mountpoint uncreatable when /tmp is narrowed to read-only #7678, fix: preserve agent startup with restricted tmp #7679

Generated by Runner Doctor Updater · copilot · auto · 126.6 AIC · ⊞ 46.5K · ◷

• expires on Sep 24, 2026, 4:44 PM UTC