fix: remove sandbox.mcp.version from strict-mode workflows

[lpcox]

Removes sandbox.mcp.version from 4 strict-mode workflows where it was incorrectly added (causes compilation error):

• smoke-services.md
• smoke-gemini.md
• smoke-opencode.md
• update-release-notes.md

Only sandbox.agent.version is needed — mcpg version uses the compiler default in strict mode.

[github-actions]

🔥 Smoke Test Results

Test	Status
GitHub MCP (list PRs)	✅
GitHub.com connectivity	✅
File write/read	✅

PR: fix: remove sandbox.mcp.version from strict-mode workflows
Author: @lpcox | Reviewers: @Mossaka, @Copilot

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke Test Results
✅ GitHub MCP: Retrieved last 2 merged PRs (#2271, #2268)
✅ Playwright: Verified github.com page title contains "GitHub"
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-claude-25060888239.txt
✅ Bash Tool: Verified file creation

Overall Status: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

Smoke Test: Copilot BYOK (Offline) Mode — PASS ✅

Test	Result
GitHub MCP connectivity	✅ PR list returned (latest merged: #2271)
GitHub.com HTTP	✅ (pre-step validated)
File write/read	✅ /tmp/gh-aw/agent/smoke-test-copilot-byok-25060888287.txt confirmed
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.
PR author: @lpcox — no assignees.

Overall: PASS

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

PRs: fix: remove sandbox.mcp.version from strict-mode workflows; chore: upgrade to firewall v0.25.29 and mcpg v0.3.1
GitHub merged-PR review/query: ❌
Playwright title check: ✅
Tavily search: ❌
Temp file write + cat: ✅
Discussion comment: ❌
npm ci && npm run build: ✅
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[Copilot]

Pull request overview

Removes the sandbox.mcp.version frontmatter key from strict-mode agentic workflow sources where it is not supported, relying instead on the strict-mode compiler default MCP gateway version.

Changes:

• Deleted sandbox.mcp.version from 4 strict-mode workflow source files.
• Leaves sandbox.agent.version intact so the agent image remains explicitly pinned.

Show a summary per file

File	Description
.github/workflows/update-release-notes.md	Drops sandbox.mcp.version from a strict-mode workflow source to fix strict compilation.
.github/workflows/smoke-services.md	Drops sandbox.mcp.version from strict-mode smoke workflow source.
.github/workflows/smoke-opencode.md	Drops sandbox.mcp.version from strict-mode smoke workflow source.
.github/workflows/smoke-gemini.md	Drops sandbox.mcp.version from strict-mode smoke workflow source.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 4

[Copilot]

This workflow’s frontmatter changed, but the corresponding generated lock file (smoke-opencode.lock.yml) isn’t updated in this PR. Please re-run gh aw compile for this .md and commit the regenerated .lock.yml so the frontmatter_hash / strict compilation output stays in sync.

[Copilot]

This workflow’s frontmatter changed, but the corresponding generated lock file (smoke-gemini.lock.yml) isn’t updated in this PR. Please re-run gh aw compile for this .md and commit the regenerated .lock.yml so the frontmatter_hash / strict compilation output stays in sync.

[Copilot]

This workflow’s frontmatter changed, but the corresponding generated lock file (update-release-notes.lock.yml) isn’t updated in this PR. Please re-run gh aw compile for this .md and commit the regenerated .lock.yml so the frontmatter_hash / strict compilation output stays in sync.

[Copilot]

This workflow’s frontmatter changed, but the corresponding generated lock file (smoke-services.lock.yml) isn’t updated in this PR. Please re-run gh aw compile for this .md and commit the regenerated .lock.yml so the frontmatter_hash / strict compilation output stays in sync.

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2273 · ● 620.4K · ◷

[github-actions]

Smoke Test: Gemini Engine Validation

• PR Titles: chore: upgrade to firewall v0.25.29 and mcpg v0.3.1
• GitHub MCP Testing: ✅
• GitHub.com Connectivity: ✅
• File Write/Read Test: ✅

Overall status: PASS

cc: @lpcox

💎 Faceted by Smoke Gemini

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ Timeout — no response
PostgreSQL pg_isready	❌ No response on port 5432
PostgreSQL SELECT 1	❌ Not attempted (pg_isready failed)

Overall: FAIL — host.docker.internal is not reachable from this environment. Service containers appear unreachable.

🔌 Service connectivity validated by Smoke Services