Rename frontmatter sandbox.agent.network-isolation → sandbox.agent.default-route

.github/workflows/ab-testing-advisor.md

@@ -74,6 +74,9 @@ tools:
 tracker-id: ab-testing-advisor
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/ai-moderator.md

@@ -59,6 +59,9 @@ safe-outputs:
 checkout: false
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # AI Moderator

.github/workflows/archie.md

@@ -45,6 +45,9 @@ safe-outputs:
 timeout-minutes: 10
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Archie - Mermaid Diagram Generator

.github/workflows/auto-triage-issues.md

@@ -61,6 +61,9 @@ safe-outputs:
 timeout-minutes: 15
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Auto-Triage Issues Agent 🏷️

.github/workflows/blog-auditor.md

@@ -60,6 +60,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 # Blog Auditor
 

.github/workflows/changeset.md

@@ -53,6 +53,9 @@ imports:
 
 
   - shared/otlp.md
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Changeset Generator

.github/workflows/cli-consistency-checker.md

@@ -74,6 +74,9 @@ safe-outputs:
 timeout-minutes: 20
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # CLI Consistency Checker

.github/workflows/code-scanning-fixer.md

@@ -44,6 +44,9 @@ safe-outputs:
 timeout-minutes: 20
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Code Scanning Alert Fixer Agent

.github/workflows/constraint-solving-potd.md

@@ -33,6 +33,9 @@ safe-outputs:
     expires: 7d
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Constraint Solving — Problem of the Day

.github/workflows/copilot-opt.md

@@ -51,6 +51,9 @@ imports:
 timeout-minutes: 30
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 {{#runtime-import? .github/shared-instructions.md}}
 

.github/workflows/copilot-pr-prompt-analysis.md

@@ -28,7 +28,9 @@ network:
     - node
 
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:  # Firewall enabled (migrated from network.firewall)
+    id: awf
+    sudo: false
 imports:
   - uses: shared/daily-audit-base.md
     with:

.github/workflows/daily-agent-of-the-day-blog-writer.md

@@ -23,7 +23,9 @@ network:
   allowed:
     - defaults
 sandbox:
-  agent: awf
+  agent:
+    id: awf
+    sudo: false
 tools:
   cli-proxy: true
   agentic-workflows:

.github/workflows/daily-astrostylelite-markdown-spellcheck.md

@@ -282,6 +282,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Daily AstroStyleLite Markdown Spellcheck

.github/workflows/daily-byok-ollama-test.md

@@ -59,6 +59,9 @@ safe-outputs:
     run-failure: "❌ [{workflow_name}]({run_url}) — BYOK endpoint test failed: {status}"
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Daily BYOK Endpoint Test

.github/workflows/daily-cli-performance.md

@@ -75,6 +75,9 @@ jobs:
       has_changes: ${{ steps.changes.outputs.has_changes }}
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/daily-compiler-quality.md

@@ -95,6 +95,9 @@ tools:
 tracker-id: daily-compiler-quality
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/daily-doc-healer.md

@@ -76,6 +76,9 @@ tools:
 tracker-id: daily-doc-healer
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 {{#runtime-import? .github/shared-instructions.md}}
 

.github/workflows/daily-file-diet.md

@@ -46,6 +46,9 @@ tools:
 tracker-id: daily-file-diet
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/daily-geo-optimizer.md

@@ -110,6 +110,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/daily-malicious-code-scan.md

@@ -33,6 +33,9 @@ tools:
   cli-proxy: true
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/daily-model-resolution.md

@@ -37,6 +37,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/daily-observability-report.md

@@ -32,6 +32,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 {{#runtime-import? .github/shared-instructions.md}}
 

.github/workflows/daily-rendering-scripts-verifier.md

@@ -59,6 +59,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Daily Rendering Scripts Verifier

.github/workflows/daily-safe-outputs-conformance.md

@@ -33,6 +33,9 @@ imports:
 
 
   - shared/otlp.md
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Daily Safe Outputs Conformance Checker

.github/workflows/daily-security-observability.md

@@ -139,6 +139,9 @@ imports:
 
 
   - shared/otlp.md
+sandbox:
+  agent:
+    sudo: false
 ---
 {{#runtime-import? .github/shared-instructions.md}}
 

.github/workflows/daily-skill-optimizer.md

@@ -151,6 +151,9 @@ tools:
 
 imports:
   - shared/otlp.md
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Daily Skill Optimizer Improvements

.github/workflows/daily-testify-uber-super-expert.md

@@ -54,6 +54,9 @@ tools:
 tracker-id: daily-testify-uber-super-expert
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 {{#runtime-import? .github/shared-instructions.md}}

.github/workflows/dead-code-remover.md

@@ -45,6 +45,9 @@ steps:
   - name: Install deadcode analyzer
     run: go install golang.org/x/tools/cmd/deadcode@latest
 
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Dead Code Removal Agent

.github/workflows/deployment-incident-monitor.md

@@ -30,6 +30,9 @@ safe-outputs:
   noop:
 timeout-minutes: 10
 
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Deployment Incident Monitor

.github/workflows/dev.md

@@ -34,6 +34,9 @@ tools:
     mode: gh-proxy
   cli-proxy: true
 
+sandbox:
+  agent:
+    sudo: false
 ---
 
 <!--

.github/workflows/discussion-task-miner.md

@@ -60,6 +60,9 @@ tools:
     - default
     - discussions
 tracker-id: discussion-task-miner
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Discussion Task Miner - Code Quality Improvement Agent