Diagnose an AWF (Agentic Workflow Firewall) failure from an error, workflow run URL, or symptom. Covers auth (api-proxy, enterprise/BYOK Copilot, OIDC, mcpg), ARC/DinD and self-hosted runners, alternative runtimes (gVisor/Kata/chroot), Squid/DNS/egress denials, CI and gh-aw safe-output failures, and suspected security regressions. Routes to the canonical diagnosis registry in docs/diagnostics.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
Single entry point for diagnosing AWF failures. The canonical knowledge lives in the diagnosis registry — this skill only routes and reports.
Read the index — docs/diagnostics/README.md
for boundary routing and specialist references, and
docs/diagnostics/agent-playbook.md
for the report shape and safety rules.
Fingerprint the run: AWF version, runner type (GitHub-hosted /
self-hosted / ARC+DinD / GHES / GHEC), DOCKER_HOST, GITHUB_SERVER_URL,
container runtime, provider, auth mode. Use unknown where unverified.
Classify the failing boundary: runner, runtime, network, auth,
ci, security.
Load only matching records:
npx tsx scripts/diagnostics/cli.ts search "<redacted error string>" --boundary <boundary>
Without a clone, use the portable artifact
.github/agents/diagnose-awf.md (prefer a tag matching your AWF version).
Probe with the matched finding's read-only probe when the match is ambiguous — one probe at a time.
Report: observed symptom, matched finding ID and evidence, affected version/topology, safe next probe, fix/workaround, citations.
AUTH-001, AUTH-002AUTH-001, docs/auth-matrix.mdAUTH-003Check configuration presence/shape, route and health status, and redacted error classes only.
Authorization headers, environment
dumps, inference probes, or token exchanges.--env-all, disabling isolation, or broadening the domain
allowlist by default.SEC-001 and
the repository security review process..github/workflows/shared/self-hosted-failure-modes.md — full runner catalog.github/skills/debug-firewall/SKILL.md — Squid, iptables, container state.github/skills/awf-debug-tools/SKILL.md — log parsing helpers.github/skills/debugging-workflows/SKILL.md — GitHub Actions log retrievaldocs/auth-matrix.md, docs/compatibility.md, docs/troubleshooting.mdFollow docs/diagnostics/patterns.md.
Edit the canonical record, run npm run diagnostics:render, and open a reviewed
PR. Never edit generated artifacts or .lock.yml files by hand.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Decide and implement how to support a new LLM provider or agent engine in AWF - either as a proxied provider (api-proxy adapter) or a direct-API engine (domain allowlist only), e.g. Cursor, Aider, or any tool that calls its own endpoint.
The English summary is being prepared. Showing the original description.
Route gh-aw design, creation, diagnosis, patching, active debugging, and upgrade requests to the right strategies.
The English summary is being prepared. Showing the original description.
Practical Python scripts for debugging awf - parse logs, diagnose issues, inspect containers, test domains
The English summary is being prepared. Showing the original description.
Use the AWF (Agentic Workflow Firewall) to run commands with network isolation and domain whitelisting. Provides L7 HTTP/HTTPS egress control for AI agents.
The English summary is being prepared. Showing the original description.
Debug the AWF firewall by inspecting Docker containers (awf-squid, awf-agent), analyzing Squid access logs, checking iptables rules, and troubleshooting blocked domains or network issues.
The English summary is being prepared. Showing the original description.
Debug GitHub Actions workflows by downloading logs, analyzing summaries, and understanding how agentic workflows and the AWF firewall work together.
The English summary is being prepared. Showing the original description.