Observed failure

The gh-aw Copilot smoke run 39529502581 reached Playwright browser launch, then failed with an ABI mismatch in a library staged by AWF:

<launching> /opt/google/chrome/chrome ...
[pid=2127][err] /opt/google/chrome/chrome: /lib/x86_64-linux-gnu/libm.so.6: version `GLIBC_2.43' not found (required by /run/awf-lib/browser-libs/usr/lib/x86_64-linux-gnu/libasound.so.2)

The full browser error is in the run's agent artifact, in sandbox/agent/logs/copilot-session-state/*/events.jsonl, for tool.execution_complete with tool call ID toolu_01UZMV1rC2EgEQ84G2LMkAtj.

Downstream report: github/gh-aw#70743 (link).

Environment and exact attempt

• AWF agent: ghcr.io/github/gh-aw-firewall/agent:0.28.70@sha256:b15ab48cbbab02904eb9bbd359a398db59690eebbea1e6934d47ed2bb407dd34, confirmed by sandbox/firewall/audit/image-manifest.json.
• The v0.28.70 agent Dockerfile uses Ubuntu 26.04 and installs/stages Chromium runtime libraries through browser-libs.manifest.
• gh-aw revision: 0f545effccafbad491589bad0bc62ccbdc47f57e, branch copilot/g-1-g-5-g-6-g-9-g-12-complete-routing-analytics.
• Browser installation completed before agent execution (Chromium v1247 / Chrome for Testing 155.0.8059.12), but the actual runtime attempt used system Chrome at /opt/google/chrome/chrome.
• Attempted command:

playwright-cli open http://host.docker.internal:4173/ && playwright-cli eval document.title; playwright-cli close

The shell wrapper ultimately reported success because its final close command completed; the browser error above is the evidence of launch failure, not the wrapper exit status.

Likely boundary to fix

AWF's copy_browser_libs() staging mechanism exposes image-built browser libraries under /run/awf-lib/browser-libs via the runtime library search path. The observed failure shows the injected libasound.so.2 requiring a newer GLIBC symbol than the active chroot's libm.so.6 supplies. Please make staged browser dependencies ABI-compatible with the runtime's loader/libc rather than mixing newer image libraries with an older runtime.

This is an evidence-backed diagnosis, not a completed local reproduction; the exact runtime GLIBC version has not been established. No workflow was dispatched for this investigation.

Expected behavior and regression coverage

An otherwise provisioned browser should launch under AWF without injected dependencies introducing unavailable GLIBC symbols. Add coverage that launches a browser inside the real chroot/library-staging topology against supported runner libc versions; an install-only or agent-image-only test will not exercise this boundary. Preserve firewall/proxy enforcement and narrow permissions; do not resolve this by disabling isolation, bypassing the proxy, or granting broader tools/URLs.

Separate failure in the same report

The report also says bash commands were denied, but all three recorded permission requests were URL approvals for https://github.com, denied by the unattended approval fallback; local date and cat succeeded. Those URL approvals are tracked by github/gh-aw#70697 (link) and are independent of this browser ABI failure. The smoke revision did not contain that PR's URL-approval changes. There is no evidence here of a model failure or a need to widen shell permissions.