[pelikhan]

The Great Escapi was blocked by content filtering on its first model response, before any firewall checks ran. Its custom failure job nevertheless opened a firewall-test alert, incorrectly suggesting a protection failure. Failed run; related reports: #70432 and #70433.

Changes

• Replace the autonomous sandbox-escape mission and historical strategy memory with eight predefined, once-only compliance checks. Refusals stop execution rather than triggering retries or workarounds.
• Remove the custom failure-issue job and rely on framework runtime-failure reporting. Discussion results explicitly distinguish PASS, FAIL, INCONCLUSIVE, and NOT RUN; unexecuted checks cannot count as passing.
• Use positive-test destinations already allowed by the existing Node ecosystem. Distinguish demonstrated firewall rejection from DNS, TLS, and timeout failures, and stop masking localhost errors.
• Regenerate the normal workflow lock and add a static source-policy regression test.

Workflow identity and triggers, strict mode, Copilot SDK content filtering, AWF isolation, and the network allowlist are preserved. Removing the unused gh-proxy declaration restores the compiler's default read-only GitHub MCP configuration; its credential flow and access controls were included in the generated-lock review.

Validation

• make build, make fmt, and make recompile passed; all 344 workflows compiled.
• go test ./pkg/workflow -run '^TestFirewallComplianceWorkflowPolicy$' -count=1 passed without executing compliance commands.
• make agent-report-progress passed, including scoped linting, schema freshness, the impacted-unit fallback sample, and full workflow-lock drift checks.
• ./gh-aw compile firewall-escape --dry-run --zizmor --actionlint --poutine --schedule-seed github/gh-aw --json --no-check-update passed strict/schema/model checks, shellcheck, and differential scanners with no added actionable findings. Existing baseline findings remain. The normal lock was restored afterward.
• Source and generated-lock security reviews passed with no confirmed vulnerabilities.

No workflow was dispatched or rerun, and no compliance or escape-test commands were executed. Live recovery remains unverified.