github · pelikhan · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026
diff --git a/.changeset/restore-sandbox-agent-false.md b/.changeset/restore-sandbox-agent-false.md
diff --git a/.github/aw/syntax-agentic.md b/.github/aw/syntax-agentic.md
@@ -61,7 +61,7 @@ description: Agentic workflow specific frontmatter fields for GitHub Agentic Wor
     - `difc-proxy: true` - Enable DIFC (Data Integrity and Flow Control) proxy injection. When set alongside `tools.github.min-integrity`, injects proxy steps around the agent for full network-boundary integrity enforcement.
     - `cli-proxy: true` - Enable AWF CLI proxy sidecar for secure read-only `gh` CLI access without exposing `GITHUB_TOKEN` (requires AWF v0.26.0+). Prerequisite for `integrity-reactions`; the compiler enables it automatically when `integrity-reactions: true` is set.
     - `integrity-reactions: true` - Enable reaction-based integrity promotion/demotion. Maintainers can use 👍/❤️ reactions to promote content to `approved` and 👎/😕 to demote it to `none`. Compiler automatically enables `cli-proxy`. Requires `tools.github.min-integrity` to be set and MCPG >= v0.2.18. Defaults: endorsement reactions THUMBS_UP/HEART, disapproval reactions THUMBS_DOWN/CONFUSED, endorser-min-integrity: approved, disapproval-integrity: none.
-    - `dangerously-disable-sandbox-agent: "<justification>"` - Required when `sandbox.agent: false` is set. Must be a plain string justification (minimum 20 characters; expressions are not allowed) that explains why disabling the sandbox is safe for this workflow.
+    - `dangerously-disable-sandbox-agent: true` - Required when `sandbox.agent: false` is set. This opt-out is rejected in strict mode.
 
 - **`experiments:`** - A/B testing experiments for balanced variant selection (object)
   - Maps experiment names to variant lists (bare array) or full config objects
@@ -329,13 +329,14 @@ description: Agentic workflow specific frontmatter fields for GitHub Agentic Wor
 
   - When `engine.env` sets `OPENAI_BASE_URL` or `ANTHROPIC_BASE_URL` (custom provider endpoints, e.g. OpenRouter), `model-fallback` is disabled automatically so provider-specific model slugs pass through verbatim; set it explicitly to override.
 
-  - To disable the agent firewall while keeping MCP gateway enabled, you must provide the dangerous-disable justification feature:
+  - To disable the agent firewall while keeping MCP gateway enabled, set `strict: false` and enable the dangerous sandbox opt-out:
 
     ```yaml
     features:
-      dangerously-disable-sandbox-agent: "controlled environment with no internet access"
+      dangerously-disable-sandbox-agent: true
     sandbox:
       agent: false
+    strict: false
     ```
 
   - **`sandbox.agent.runtime`** (string) selects the sandbox security and topology profile: `docker` (default: rootless AWF with network isolation), `docker-sudo-iptables` (privileged AWF with legacy iptables networking and host/service access), `gvisor` (gVisor `runsc` kernel-level isolation), `docker-sbx` (KVM microVM), or `cloud-hypervisor` (preview KVM runtime). Omitting the field is equivalent to `docker`. gVisor and Docker sbx are incompatible with `runner.topology: arc-dind`; the compiler derives the privileged setup each runtime needs. Docker sbx also requires `DOCKER_PAT`/`DOCKER_USERNAME` secrets and a KVM-capable runner when runtime installation is enabled.

diff --git a/.github/aw/upgrade-agentic-workflows.md b/.github/aw/upgrade-agentic-workflows.md
@@ -102,12 +102,13 @@ Before attempting to compile, apply automatic codemods:
 
    This will automatically update workflow files with changes like:
    - Replacing 'timeout_minutes' with 'timeout-minutes'
-   - Replacing `network.firewall: false` with:
+   - Replacing `network.firewall: false` with `sandbox.agent: false`. To keep the sandbox disabled, explicitly add:
      ```yaml
      features:
-       dangerously-disable-sandbox-agent: "controlled environment with no internet access"
+       dangerously-disable-sandbox-agent: true
      sandbox:
        agent: false
+     strict: false
      ```
    - Removing deprecated 'mcp-scripts.mode' field
 

diff --git a/docs/adr/29483-automate-removal-of-deprecated-sandbox-keys-via-codemods.md b/docs/adr/29483-automate-removal-of-deprecated-sandbox-keys-via-codemods.md
@@ -1,9 +1,13 @@
 # ADR-29483: Automate Removal of Deprecated Sandbox Keys via Codemods
 
 **Date**: 2026-05-01
-**Status**: Draft
+**Status**: Superseded
 **Deciders**: Unknown
 
+> Superseded by the restored non-strict opt-out policy: `sandbox.agent: false` is
+> supported when `features.dangerously-disable-sandbox-agent: true` is set, and
+> the removal codemod is no longer registered.
+
 ---
 
 ## Part 1 — Narrative (Human-Friendly)

diff --git a/docs/adr/38325-require-operator-justification-for-disabling-agent-sandbox.md b/docs/adr/38325-require-operator-justification-for-disabling-agent-sandbox.md
@@ -1,7 +1,11 @@
 # ADR-38325: Require Operator-Authored Justification to Disable the Agent Sandbox
 
 **Date**: 2026-06-10
-**Status**: Draft
+**Status**: Superseded
+
+> Superseded by the restored non-strict opt-out policy: `sandbox.agent: false` now
+> requires `features.dangerously-disable-sandbox-agent: true`, while strict mode
+> continues to reject the configuration.
 
 ## Context
 

diff --git a/docs/src/content/docs/reference/gh-aw-as-mcp-server.md b/docs/src/content/docs/reference/gh-aw-as-mcp-server.md
@@ -129,7 +129,7 @@ For `audit`, each run identifier may be a numeric run ID, a run URL, a job URL,
 
 For `checks`, normalized states are `success`, `failed`, `pending`, `no_checks`, and `policy_blocked`. Use `required_state` as the authoritative CI verdict when optional third-party deployments are present.
 
-Available `fix` codemods: `timeout-minutes-migration`, `network-firewall-migration`, `sandbox-agent-false-removal`, `mcp-scripts-mode-removal`, `steps-run-secrets-to-env`.
+Available `fix` codemods include `timeout-minutes-migration`, `network-firewall-migration`, `mcp-scripts-mode-removal`, and `steps-run-secrets-to-env`.
 
 ## Using GH-AW as an MCP from an Agentic Workflow
 

diff --git a/docs/src/content/docs/reference/sandbox.md b/docs/src/content/docs/reference/sandbox.md
@@ -22,9 +22,9 @@ Configure the coding agent sandbox type to control how the AI engine is isolated
 sandbox:
   agent: awf
 
-# Disable coding agent sandbox - requires an operator-authored justification
+# Disable coding agent sandbox - requires an explicit feature flag
 features:
-  dangerously-disable-sandbox-agent: "controlled environment with no internet access"
+  dangerously-disable-sandbox-agent: true
 sandbox:
   agent: false
 
@@ -37,23 +37,20 @@ If `sandbox` is not specified in your workflow, it defaults to `sandbox.agent: a
 
 **Disabling Coding Agent Sandbox**
 
-Setting `sandbox.agent: false` is deprecated and will be removed in a future release. It disables the agent firewall while keeping the MCP gateway enabled, removing a trust boundary, and should only be used when strictly necessary.
+Setting `sandbox.agent: false` disables the agent firewall while keeping the MCP gateway enabled. This removes a trust boundary and is only supported when `strict: false`.
 
-To disable the agent sandbox, you **must** add `features.dangerously-disable-sandbox-agent` with a literal justification string of at least 20 characters. The justification must explain why the trust boundary is being removed and is stored for diagnostics and audit. The following values are rejected by the compiler:
-
-- Boolean `true` — no longer accepted as a legacy shorthand
-- Expressions such as `${{ inputs.reason }}` — must be a static literal
-- Strings shorter than 20 characters after trimming whitespace
+To disable the agent sandbox, you **must** set `features.dangerously-disable-sandbox-agent: true`. Missing, false, and non-boolean values are rejected by the compiler.
 
 ```yaml wrap
 features:
-  dangerously-disable-sandbox-agent: "controlled environment with no internet access"
+  dangerously-disable-sandbox-agent: true
 sandbox:
   agent: false
+strict: false
 ```
 
 > [!WARNING]
-> Disabling the agent sandbox removes a security trust boundary. The `dangerously-disable-sandbox-agent` value is a permanent, reviewable record of why this workflow runs without the agent firewall. Write a reason that will be meaningful to future reviewers.
+> Disabling the agent sandbox removes a security trust boundary and is always rejected in strict mode. Only use this opt-out in controlled environments where the agent can be trusted with direct network access.
 
 ### Runtime Profiles
 

diff --git a/pkg/cli/codemod_network_firewall_test.go b/pkg/cli/codemod_network_firewall_test.go
@@ -85,7 +85,7 @@ permissions:
 	assert.NotContains(t, result, "firewall:", "Should remove firewall field")
 	assert.Contains(t, result, "sandbox:", "Should add sandbox block")
 	assert.Contains(t, result, "agent: false", "Should convert firewall false to sandbox.agent: false")
-	assert.NotContains(t, result, "dangerously-disable-sandbox-agent", "Codemod must not silently invent a justification; operator must provide one")
+	assert.NotContains(t, result, "dangerously-disable-sandbox-agent", "Codemod must not silently enable the sandbox opt-out; operator must provide it")
 }
 
 func TestNetworkFirewallCodemod_NoNetworkField(t *testing.T) {
@@ -216,10 +216,10 @@ sandbox:
 	assert.Contains(t, result, "sandbox:", "Should preserve existing sandbox block")
 	assert.Contains(t, result, "mcp: true", "Should preserve existing sandbox settings")
 	assert.Contains(t, result, "agent: false", "Should migrate firewall false to sandbox.agent: false")
-	assert.NotContains(t, result, "dangerously-disable-sandbox-agent", "Codemod must not silently invent a justification; operator must provide one")
+	assert.NotContains(t, result, "dangerously-disable-sandbox-agent", "Codemod must not silently enable the sandbox opt-out; operator must provide it")
 }
 
-func TestNetworkFirewallCodemod_PreservesExistingSandboxDisableJustification(t *testing.T) {
+func TestNetworkFirewallCodemod_PreservesExistingSandboxDisableFeature(t *testing.T) {
 	t.Parallel()
 	codemod := getNetworkFirewallCodemod()
 
@@ -228,7 +228,7 @@ on: workflow_dispatch
 network:
   firewall: false
 features:
-  dangerously-disable-sandbox-agent: "already documented justification string with enough detail"
+  dangerously-disable-sandbox-agent: true
 sandbox:
   mcp: true
 ---
@@ -241,7 +241,7 @@ sandbox:
 			"firewall": false,
 		},
 		"features": map[string]any{
-			"dangerously-disable-sandbox-agent": "already documented justification string with enough detail",
+			"dangerously-disable-sandbox-agent": true,
 		},
 		"sandbox": map[string]any{
 			"mcp": true,
@@ -252,8 +252,7 @@ sandbox:
 
 	require.NoError(t, err)
 	assert.True(t, applied)
-	assert.Contains(t, result, `dangerously-disable-sandbox-agent: "already documented justification string with enough detail"`)
-	assert.NotContains(t, result, "migrated from deprecated", "Should not overwrite existing justification with a generic one")
+	assert.Contains(t, result, "dangerously-disable-sandbox-agent: true")
 }
 
 func TestNetworkFirewallCodemod_MigratesFirewallVersionIntoExistingSandbox(t *testing.T) {

diff --git a/pkg/cli/codemod_sandbox_agent_false_removal.go b/pkg/cli/codemod_sandbox_agent_false_removal.go