From 907563a72fc5018fa50967c25199519c6b4750b4 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 20:20:37 +0000
Subject: [PATCH] fix: add boundedAgents CLI mapping rows to config spec

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 docs/awf-config-spec.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/docs/awf-config-spec.md b/docs/awf-config-spec.md
index 3ae58b77f..ce415bd39 100644
--- a/docs/awf-config-spec.md
+++ b/docs/awf-config-spec.md
@@ -220,6 +220,21 @@ AWF settings MAY be supplied via config files, including stdin (`--config -`).
 - `boundedQueries.memoryLimit` → *(config-only; no CLI equivalent, see §14)*
 - `boundedQueries.interpreter` → *(config-only; no CLI equivalent, see §14)*
 - `boundedQueries.maxInvocations` → *(config-only; no CLI equivalent, see §14)*
+- `boundedAgents.enabled` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.privateRepos[]` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.runtime` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.profile` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.model` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.timeout` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.memoryLimit` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.cpuLimit` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.pidsLimit` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.tmpfsLimit` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.maxOutputBytes` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.maxTaskBytes` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.maxInvocations` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.maxModelRequests` → *(config-only; no CLI equivalent, see §15)*
+- `boundedAgents.maxModelTokens` → *(config-only; no CLI equivalent, see §15)*
 
 When `container.dockerHostPathPrefix` points at a daemon-visible shared `/tmp` path, the implementation stages the invoking CLI binary together with `/etc/passwd`, `/etc/group`, and the generated chroot `/etc/hosts` under that shared path so chroot mode can bootstrap on split-filesystem ARC/DinD hosts.