Add security architecture slide to slides/index.md

[Copilot]

The main slides deck (slides/index.md) lacked a security architecture slide, while the docs slides (docs/slides/index.md) already had comprehensive coverage.

Changes

• slides/index.md: Added a "Security Architecture" slide after "Security by Default", featuring:
  • Mermaid flowchart TB diagram of the Action Job VM showing isolated sandboxes (Agent, MCP Server, Skill) with Proxy/Firewall layers and central MCP Gateway routing
  • Three-bullet summary of the key security principles: container isolation, per-layer proxy/firewall, and MCP Gateway as the auditable control plane
• Added Mermaid script initialization to slides/index.md to enable diagram rendering at runtime

Warning

Custom agent used: technical-doc-writer
AI technical documentation writer for GitHub Actions library using GitHub Docs voice

Original prompt

Add slide on security architecture

Custom agent used: technical-doc-writer
AI technical documentation writer for GitHub Actions library using GitHub Docs voice

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@copilot use mermaid

[pelikhan]

@copilot use mermaid

[Copilot]

@copilot use mermaid

Done in c46575f. Replaced the ASCII diagram with a Mermaid flowchart TB using the <pre class="mermaid"> pattern (same as docs/slides/index.md). Also added the mermaid.min.js script initialization to slides/index.md so Mermaid renders at runtime.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry.astro.build
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR adds a security architecture slide to the main slides deck (slides/index.md) that was previously only available in the comprehensive docs slides. The new slide features a Mermaid flowchart diagram illustrating the multi-layered defense architecture with isolated sandboxes and proxy/firewall controls.

Changes:

• Added a "Security Architecture" slide after "Security by Default" in slides/index.md with a Mermaid diagram and three security principle bullets
• Added Mermaid script initialization to enable diagram rendering in the slides
• Added four new workflow entries to the agent factory status documentation table

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
slides/index.md	Added security architecture slide with Mermaid diagram showing multi-layered defense and initialized Mermaid rendering script
docs/src/content/docs/agent-factory-status.mdx	Added four new workflow entries (Daily Rendering Scripts Verifier, Smoke Agent, Smoke Copilot ARM64, Smoke Multi PR)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The HTML <br/> tag in the Gateway label should use HTML entity encoding to match the pattern used in docs/slides/index.md (line 406). The tag should be encoded as <br/> instead of <br/> to ensure consistent rendering across different Marp processors and prevent potential HTML injection issues in the diagram.

Suggested change

	Gateway["Gateway<br/>(mcpg)"]
	Gateway["Gateway&lt;br/&gt;(mcpg)"]

[Copilot]

These workflow entries appear to be unrelated to the stated purpose of this PR, which is to add a security architecture slide to the main slides deck. The PR description mentions adding a security architecture slide and Mermaid script initialization, but does not mention updating the agent factory status table. Consider moving these changes to a separate PR to maintain a clear separation of concerns.