Objective

Resolve 7 compilation warnings where Claude engine workflows specify network.allowed restrictions that may not be enforced due to lack of firewall support.

Context

Part of discussion #3606 - Static Analysis Report findings. Claude engine does not support network firewalling, creating a security gap where intended network sandboxing may not be applied.

Security Impact

Network restrictions intended to sandbox workflow execution may not be enforced, potentially allowing unauthorized network access in these workflows.

Affected Workflows

7 workflows with firewall warnings:

1. audit-workflows.md
2. copilot-session-insights.md
3. daily-doc-updater.md
4. copilot-agent-analysis.md
5. prompt-clustering-analysis.md
6. unbloat-docs.md
7. blog-auditor.md

Approach

For each workflow, choose one of these solutions:

Option 1: Switch to Engine with Firewall Support

Change engine to one that supports network firewalling:

engine:
  id: copilot  # Supports network.firewall
network:
  firewall: true
  allowed:
    - "specific-domain.com"

Option 2: Remove Network Restrictions

If network restrictions aren't critical, remove them:

# Remove network.allowed configuration
# Document that workflow has unrestricted network access

Option 3: Document Security Posture

Keep current configuration but add explicit security documentation:

**Security Note**: This workflow uses Claude engine which does not enforce network firewalling. Network restrictions in configuration are documentation-only.

Files to Review

• .github/workflows/[workflow-name].md for each affected workflow
• Evaluate network access requirements per workflow
• Document security decisions

Acceptance Criteria

• Each of 7 workflows has been reviewed for network requirements
• Security approach documented for each workflow (switch engine, remove restrictions, or document)
• Run make recompile after changes
• Run gh aw compile --verbose - no firewall warnings remain OR warnings are documented as acceptable
• Security decisions documented in workflow comments or PR description
  Related to 🔍 Static Analysis Report - November 11, 2025 #3606

AI generated by Plan Command for discussion #3606