Migrate agentic workflows to Cloud Hypervisor

.github/workflows/ab-testing-advisor.md

@@ -35,7 +35,7 @@ description: Daily A/B testing advisor that picks a random agentic workflow with
 emoji: 🧪
 model: openai/gpt-5.4
 engine:
-  id: pi
+  id: codex
   model-provider: openai
 strict: true
 timeout-minutes: 30
@@ -45,7 +45,7 @@ tools:
   cache-memory: true
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets:
     - default
     - actions
@@ -54,7 +54,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 evals:
   - id: experiment_issue_created
     question: Did the agent create a GitHub issue with an A/B experiment campaign for a selected workflow?

.github/workflows/agent-job-health.md

@@ -23,7 +23,7 @@ max-daily-ai-credits: 10000
 tools:
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets: [default, actions, issues]
 timeout-minutes: 30
 strict: true
@@ -55,7 +55,7 @@ evals:
     question: Did the agent check every schedule-triggered workflow's most recent run against its expected cadence and report any blind spots?
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 
 ---
 

.github/workflows/agent-performance-analyzer.md

@@ -16,8 +16,10 @@ engine:
 max-tool-denials: 3
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 tools:
+  github:
+    mode: local
   cli-proxy: true
   bash: [":*"]
   repo-memory:

.github/workflows/agent-persona-explorer.md

@@ -6,7 +6,7 @@ on: daily
 max-daily-ai-credits: 10000
 model: openai/gpt-5.4
 engine:
-  id: pi
+  id: codex
   model-provider: openai
 permissions:
   contents: read
@@ -38,11 +38,11 @@ experiments:
 # Note: max-turns not available for default Copilot engine (Claude only)
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 tools:
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
   agentic-workflows:
   cache-memory: true
 safe-outputs:

.github/workflows/ai-moderator.md

@@ -44,7 +44,7 @@ tools:
     retention-days: 1
     allowed-extensions: [".json"]
   github:
-    mode: gh-proxy
+    mode: local
     read-only: true
     toolsets: [default]
     min-integrity: none
@@ -66,7 +66,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 pre-agent-steps:
   - name: Pre-fetch moderation context
     env:

.github/workflows/approach-validator.md

@@ -29,11 +29,11 @@ imports:
   - shared/graders.md
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 tools:
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets: [default, pull_requests, issues]
   bash:
     - "cat:*"

.github/workflows/archie.md

@@ -28,7 +28,7 @@ imports:
 tools:
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets:
       - default
   edit:
@@ -48,7 +48,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 evals:
   - id: mermaid_diagram_generated
     question: Did the agent generate a Mermaid diagram visualizing issue and pull request relationships?

.github/workflows/artifacts-summary.md

@@ -11,7 +11,7 @@ permissions:
   actions: read
   copilot-requests: write
 engine:
-  id: pi
+  id: codex
   model-provider: openai
 model: openai/gpt-5.4
 network:
@@ -21,13 +21,13 @@ network:
 sandbox:
   agent:
     id: awf
-    runtime: gvisor
+    runtime: cloud-hypervisor
 tools:
   cli-proxy: true
   edit:
   bash: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets: [actions, repos]
 safe-outputs:
   create-discussion:

.github/workflows/auto-triage-issues.md

@@ -18,7 +18,7 @@ permissions:
   copilot-requests: write
 model: openai/gpt-5.4
 engine:
-  id: pi
+  id: codex
   model-provider: openai
 strict: true
 network:
@@ -34,7 +34,7 @@ imports:
 tools:
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets:
       - issues
     min-integrity: approved
@@ -76,7 +76,7 @@ features:
   gh-aw-detection: true
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 evals:
   - id: labels-applied
     question: Did the agent apply at least one label to an unlabeled issue, or correctly call noop when no unlabeled issues were found?

.github/workflows/avenger.md

@@ -29,14 +29,14 @@ network:
 tools:
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets: [default]
   bash: ["*"]
   edit:
 sandbox:
   agent:
     id: awf
-    runtime: gvisor
+    runtime: cloud-hypervisor
     mounts:
       - "/usr/bin/make:/usr/bin/make:ro"
       - "/usr/local/bin/node:/usr/local/bin/node:ro"

.github/workflows/aw-failure-investigator.md

@@ -32,11 +32,11 @@ experiments:
     issue: 36105
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 tools:
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets: [actions, issues, pull_requests]
   bash: ["*"]
 cache:

.github/workflows/breaking-change-checker.md

@@ -34,11 +34,11 @@ experiments:
 tracker-id: breaking-change-checker
 sandbox:
   agent:
-    runtime: gvisor
+    runtime: cloud-hypervisor
 tools:
   cli-proxy: true
   github:
-    mode: gh-proxy
+    mode: local
     toolsets: [repos]
   bash:
     - "git diff:*"