Auto-detect wazero execution engine instead of forcing Compiler mode

[Copilot]

The go-fan review of tetratelabs/wazero flagged a portability gap: newGuardRuntimeConfig hard-codes wazero.NewRuntimeConfigCompiler(), but the Compiler (AOT) backend only supports amd64/arm64. On any other architecture (e.g. riscv64), WASM guard runtime creation fails or misbehaves instead of degrading gracefully.

Changes

• internal/guard/wasm_lifecycle.go: newGuardRuntimeConfig now builds from wazero.NewRuntimeConfig() instead of wazero.NewRuntimeConfigCompiler(). This lets wazero auto-select the Compiler engine where supported and transparently fall back to the Interpreter engine elsewhere, matching wazero's own recommended usage pattern.
• All other guard runtime settings are unchanged: memory limit cap, WithCloseOnContextDone, conditional DWARF debug info, and compilation cache wiring (opt-out, injected, or shared global cache).

// before
runtimeConfig := wazero.NewRuntimeConfigCompiler().
    WithCloseOnContextDone(true).
    ...

// after
runtimeConfig := wazero.NewRuntimeConfig().
    WithCloseOnContextDone(true).
    ...

This makes WASM guard support portable to any Go-supported architecture without silently failing on unsupported hosts.

• Fixes [go-fan] Go Module Review: tetratelabs/wazero #12214

[Copilot]

🟢 Approval recommended

The focused change matches wazero v1.12’s documented fallback behavior without altering other runtime settings.

Pull request overview

Updates WASM guard runtime creation to use wazero’s portable engine auto-detection.

Changes:

• Uses the compiler where supported and interpreter elsewhere.
• Preserves existing memory, debugging, cancellation, and cache settings.

File summaries

File	Description
internal/guard/wasm_lifecycle.go	Enables portable wazero engine selection and documents the rationale.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF (normal container isolation)

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	add_issue_comment (reaction)	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	star_repository	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	issue_write (create)	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	create_branch	unknown tool [-32602]	BLOCKED	⚠️
C	CLI	list_issues	data returned	ALLOWED	✅
C	CLI	get_file_contents	data returned	ALLOWED	✅
D	CLI REST	writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI GraphQL	mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All write tools absent from catalog — unknown tool [-32602] for add_issue_comment, star_repository, issue_write, create_branch. This confirms backend GITHUB_READ_ONLY=1 (write tools not registered), but does NOT independently confirm gateway-level DIFC/guard enforcement since write calls never reached a write-capable backend.

⚠️ Parts D & E: gh is not authenticated in this sandbox (gh auth status → "not logged into any GitHub hosts"). All REST/GraphQL write probes were skipped; they cannot confirm token-scope enforcement for this run. No writes were attempted.

No writes leaked. All reads succeeded.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor (runsc)

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	⚠️
C	CLI	reads (issues/PRs/file/commits via gateway bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B gap: All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the 23-tool gateway catalog (backend launched with GITHUB_READ_ONLY=1). Refusals returned Error[-32602]: unknown tool — this confirms backend read-only mode but does not independently confirm gateway-level DIFC enforcement. Result: INCONCLUSIVE per methodology.

⚠️ Parts D & E gap: gh CLI is not authenticated in this environment (GH_TOKEN not set). REST write and GraphQL mutation attempts could not be executed. Token-scope boundary not validated this run.

No writes succeeded. The read-only guarantee held; methodology gaps prevented full gateway-enforcement confirmation.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A.1	MCP	list_issues	3 issues returned	ALLOWED	✅
A.2	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A.3	MCP	get_file_contents (README.md)	file content returned	ALLOWED	✅
A.4	MCP	list_commits	3 commits returned	ALLOWED	✅
B.1	MCP	add_issue_comment (reaction)	tool absent from catalog	BLOCKED	⚠️
B.2	MCP	star_repository	tool absent from catalog	BLOCKED	⚠️
B.3	MCP	issue_write / create_issue	tool absent from catalog	BLOCKED	⚠️
B.4	MCP	add_issue_comment (body)	tool absent from catalog	BLOCKED	⚠️
B.5	MCP	create_branch	tool absent from catalog	BLOCKED	⚠️
B.6	MCP	create_or_update_file	tool absent from catalog	BLOCKED	⚠️
B.7	MCP	create_pull_request	tool absent from catalog	BLOCKED	⚠️
C.1	CLI	list_issues (github CLI)	data returned	ALLOWED	✅
C.2	CLI	get_file_contents (github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (401)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (401)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Methodology gaps:

• Part B (all): All 7 write tools absent from the MCP tool catalog — GITHUB_READ_ONLY=1 prevents backend from registering write tools. This is gh-aw framework defense-in-depth, NOT independent gateway/DIFC enforcement. No write tool was present in catalog AND refused by the gateway, so gateway-layer enforcement could not be confirmed independently.
• Part D/E: gh CLI token is invalid (Bad credentials / GH_TOKEN not set). REST and GraphQL write attempts returned 401. Cannot distinguish gateway-blocked writes from token-rejected writes. Authentication gap makes proxy-level enforcement unverifiable for this run.

No writes leaked. No FAIL conditions observed.

References: §33409463722

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime