🩺 Runner Doctor UpdateRunner doctor update: add PR #7728 citation to A21 (filesystem.allowWrite helper staging fix) #7759

Summary

• Scan window: updated ≥ 2026-08-24 in github/gh-aw-firewall
• Reviewed ~50 issues and ~50 PRs updated in the window (list_issues/list_pull_requests, since=2026-08-24)
• 1 genuinely new lesson found: a missing citation on an already-documented failure mode (A21)

Proposed knowledge-base changes

For .github/workflows/shared/self-hosted-failure-modes.md:

• A21 row — add PR Fix helper staging under filesystem allowWrite #7728 to the citations column. Fix helper staging under filesystem allowWrite #7728 ("Fix helper staging under filesystem allowWrite", merged 2026-08-25) is the PR that actually closed issue filesystem.allowWrite silently disables token protection and the gh proxy wrapper #7681 and completed the /tmp/awf-lib → /run/awf-lib migration described in the A21 "Fixed in AWF" text (the fix text already describes this migration, crediting only fix: preserve agent startup with restricted tmp #7679, but the code that ships it landed in Fix helper staging under filesystem allowWrite #7728, one day later). No wording changes needed — just append the citation.
  • Citations column changes from github/gh-aw-firewall#7678, github/gh-aw-firewall#7679, github/gh-aw-firewall#7681 to github/gh-aw-firewall#7678, github/gh-aw-firewall#7679, github/gh-aw-firewall#7681, github/gh-aw-firewall#7728.

No new failure modes were found. Reviewed and excluded as out-of-scope or non-lessons:

• fix: propagate config fields to all layers #7694 (config-consistency doc audit, no new field/behavior)
• Strip stale raw-network capabilities from agent images #7659 (strip stale cap_net_raw from agent images — hardening, not a runner-environment failure mode)
• Support compiler-authorized digest-pinned container image manifests #7601 (digest-pinned container.images manifest — general feature, not self-hosted-specific)
• feat: support filesystem allowWrite with Cloud Hypervisor #7669/Enforce filesystem allowWrite boundaries in AWF sandboxes #7634/feat: add Cloud Hypervisor filesystem write planner #7660/feat: stage host mount trees for virtiofsd exports #7661/fix: make Cloud Hypervisor writable overlays privately propagated #7672/docs: document .awf-home prerequisite for Cloud Hypervisor allowWrite #7670 (Cloud Hypervisor filesystem.allowWrite support — Cloud Hypervisor is out of scope for this catalog, which covers ARC/DinD/self-hosted/GHES/GHEC/gVisor/sbx)
• Run documentation and mapping workflows on Cloud Hypervisor #7643/[docs] sbx/gVisor: Sync sbx-integration.md main-action.ts wiring with SbxRuntimeBackend #7641/[docs] Weekly maintenance review: No updates needed (2026-08-22) #7645/[docs] auth: docs: document AI-credit accounting for Copilot auto dynamic selector #7620 (maintenance/docs recompiles and reconciliations, no new failure mode)
• Unclear location for agent temp files #7696 (/tmp/gh-aw writability confusion) — closed not_planned, points to a github/gh-aw discussion, not an AWF-side fix
• feat: add read-only GitHub CLI access to agent enclaves #7714/test: recompile enclave smoke with deferred startup #7758 (enclave CLI topology / smoke workflow) — new feature area, not yet a captured runner-environment failure mode

Proposed doctor changes

For .github/workflows/self-hosted-runner-doctor.md: none beyond the citation append above (the A21 error-string lookup entry and playbook text already correctly describe the /tmp/awf-lib → /run/awf-lib fix; only the citation list needs the additional PR number).

Proposed portable agent changes

For .github/agents/self-hosted-runner-doctor.md: mirror the identical citation append to keep the embedded copy in sync — same A21 table row and the corresponding playbook citation line (A21 / github/gh-aw-firewall#7678, github/gh-aw-firewall#7679, github/gh-aw-firewall#7681 → add , github/gh-aw-firewall#7728).

Source issues and PRs

• filesystem.allowWrite silently disables token protection and the gh proxy wrapper #7681 (filesystem.allowWrite silently disables token protection and the gh proxy wrapper)
• Fix helper staging under filesystem allowWrite #7728 (Fix helper staging under filesystem allowWrite — merged 2026-08-25, closes filesystem.allowWrite silently disables token protection and the gh proxy wrapper #7681)
• fix: preserve agent startup with restricted tmp #7679 (already cited in A21; cross-referenced for context)

Generated by Runner Doctor Updater · copilot · auto · 95.5 AIC · ⊞ 3.3K · ◷

• expires on Sep 25, 2026, 4:47 PM UTC