[Workflow Health] P0: cloud-hypervisor EACCES sandbox failure — 44 open occurrences across 40+ workflows (predecessor #61528 aut #61952

Incident

The cloud-hypervisor sandbox EACCES regression first reported in #61528 (auto-closed by its
expires: 1d setting on 2026-09-18T04:46Z, not because it was fixed) is still active and has
grown from 30 to 44 open occurrences in the 24h since the last dashboard run.

Every affected job fails identically before the agent produces any output:

Error: Unable to execute "/run/awf-cloud-hypervisor/trusted-artifacts/run-<id>/cloud-hypervisor --version";
verify the trusted Cloud Hypervisor artifact exists, is executable, and is complete: code=EACCES

• Signature history: exited with code undefined (2026-09-15→17, tracked in [Workflow Health] P0: cloud-hypervisor "--version exited with code undefined" — 29 workflows affected across 3 engines #61528) →
  EACCES permission denied on the same trusted-artifact binary (first seen 2026-09-17T14:59Z,
  [aw] Breaking Change Checker failed #61627, still occurring as of 2026-09-19T03:48Z, [aw] jsweep - JavaScript Unbloater failed #61944).
• Scope: 44 open [aw] <workflow> failed issues created since 2026-09-17, spanning 40+
  distinct workflows across all three engines (copilot, codex, claude) — e.g. LintMonster
  ([aw] LintMonster failed #61933), Metrics Collector ([aw] Metrics Collector failed #61931), Daily Firewall Logs Collector and Reporter ([aw] Daily Firewall Logs Collector and Reporter failed #61925), Code
  Simplifier ([aw] Code Simplifier failed #61941), ESLint Monster ([aw] ESLint Monster failed #61856), several Smoke workflows, and many Daily-* agents.
• Not fixed by the AWF version bump: PR Bump gh-aw-firewall to v0.28.20 #61527 ("Bump gh-aw-firewall to v0.28.20", merged
  2026-09-17) is already reflected in constants.DefaultFirewallVersion = v0.28.20, yet the
  EACCES failures continue to occur after that merge (e.g. [aw] jsweep - JavaScript Unbloater failed #61944 at 2026-09-19T03:48Z), so the
  regression is not a stale-pin issue — the trusted-artifact permission/extraction step itself is
  broken for the currently pinned AWF release.
• Root cause hint: the error occurs specifically when invoking the trusted artifact copy of
  cloud-hypervisor (/run/awf-cloud-hypervisor/trusted-artifacts/run-*/cloud-hypervisor), not
  the original binary — suggesting the artifact-staging/verification step (chmod/exec bit,
  ownership, or mount options) that copies the trusted binary into place is not preserving the
  executable permission bit, or a sandbox mount is noexec for that path.

Impact

Every scheduled/triggered run of an affected workflow fails before the agent engine starts,
producing zero safe outputs and burning a full CI run. This is a cascading, ecosystem-wide P0 —
not a single-workflow defect.

Action requested

1. Reproduce the EACCES failure locally with the pinned v0.28.20 cloud-hypervisor sandbox and
   inspect the trusted-artifact staging step (permission bits, noexec mount flags, ownership) for
   the copied cloud-hypervisor binary.
2. Either fix the staging/permission step in the firewall/sandbox tooling, or temporarily disable
   cloud-hypervisor sandboxing for affected workflows until a fix lands, to stop the cascade.
3. Do not close this issue via expires: 1d (or similar short auto-expiry) until the fix is
   verified by at least one clean run of a previously-affected workflow — the predecessor ([Workflow Health] P0: cloud-hypervisor "--version exited with code undefined" — 29 workflows affected across 3 engines #61528)
   auto-expired without being fixed, which caused this exact incident to look "resolved" when it
   was not.

Do not re-file

Do NOT file new per-workflow issues for this signature — all 44 open occurrences (e.g. #61627,
#61770, #61815, #61817, #61823, #61826, #61831, #61832, #61849, #61850, #61852, #61856, #61858,
#61872, #61875, #61876, #61877, #61880, #61882, #61884, #61885, #61886, #61887, #61911, #61925,
#61926, #61927, #61928, #61930, #61931, #61932, #61933, #61937, #61939, #61941, #61942, #61944)
are the same root cause and should be consolidated under this tracker.

Filed by Workflow Health Manager, run 35421585500.

Generated by 🏥 Workflow Health Manager - Meta-Orchestrator · copilot · auto · 89.5 AIC · ⌖ 7.16 AIC · ⊞ 12.3K · ◷

• expires on Sep 19, 2026, 8:42 PM UTC-08:00