feat(routing): add the routing configuration surface and contracts - #8853
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit ae5f928 |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 93.28% | 93.13% | 📉 -0.15% |
| Statements | 91.94% | 91.72% | 📉 -0.22% |
| Functions | 92.00% | 91.83% | 📉 -0.17% |
| Branches | 85.64% | 85.27% | 📉 -0.37% |
📁 Per-file Coverage Changes (5 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/nvx/filesystem-builder.ts |
88.4% → 88.5% (+0.05%) | 87.5% → 87.6% (+0.05%) |
src/nvx/one-shot-adapter.ts |
80.1% → 80.4% (+0.30%) | 77.4% → 77.7% (+0.29%) |
src/nvx/cleanup-record.ts |
83.3% → 85.1% (+1.77%) | 82.5% → 84.4% (+1.82%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
src/commands/predownload.ts |
93.3% → 100.0% (+6.67%) | 91.3% → 100.0% (+8.70%) |
✨ New Files (1 files)
src/nvx/runtime-lifecycle.ts: 84.5% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Failure serialization may expose arbitrary exception details, and two closed response contracts lack regression coverage.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (2)
What changed in this PR
Adds the currently dormant task-level model-routing configuration and validation contracts without changing runtime topology.
Changes:
- Threads routing configuration and router images through host configuration.
- Adds strict API-proxy routing validators, failure records, and fixtures.
- Updates schemas, documentation, dependencies, and tests.
| File | Description |
|---|---|
src/types/container-image-options.ts |
Adds the router image role. |
src/types/api-proxy-routing-options.ts |
Defines routing option types. |
src/image-resolver.ts |
Resolves router images. |
src/image-resolver.test.ts |
Tests router resolution. |
src/config-mapper.ts |
Maps routing configuration. |
src/config-file.ts |
Types routing file configuration. |
src/config-file-validation.test.ts |
Tests routing validation. |
src/config-file-mapping.test.ts |
Tests routing mapping. |
src/commands/predownload.test.ts |
Tests router predownload behavior. |
src/commands/build-config.ts |
Carries routing into WrapperConfig. |
src/commands/build-config.test.ts |
Tests routing pass-through. |
src/awf-config-schema.json |
Adds generated routing schema. |
docs/awf-config.schema.json |
Adds canonical routing schema. |
docs/awf-config-spec.md |
Documents routing configuration. |
containers/api-proxy/routing-errors.test.js |
Tests failure records. |
containers/api-proxy/routing-errors.js |
Defines routing failures. |
containers/api-proxy/routing-contract.test.js |
Tests routing contracts. |
containers/api-proxy/routing-contract.js |
Implements AJV contracts. |
containers/api-proxy/routing-contract.d.ts |
Exposes conversation validation typing. |
containers/api-proxy/routing-config.test.js |
Tests environment parsing. |
containers/api-proxy/routing-config.js |
Parses routing configuration. |
containers/api-proxy/package.json |
Pins AJV 8.20.0. |
containers/api-proxy/package-lock.json |
Locks AJV dependencies. |
containers/api-proxy/fixtures/routing-corpus.js |
Loads routing fixtures. |
containers/api-proxy/fixtures/routing-contract/cases.json |
Records router corpus cases. |
Files not reviewed (1)
- containers/api-proxy/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| const detail = error && typeof error.message === 'string' | ||
| ? error.message | ||
| : 'Model routing failed'; | ||
| return Object.freeze({ | ||
| schema: 'awf-routing-failure/v1', | ||
| code, | ||
| detail: sanitizeFailureDetail(detail), |
| { goal: 'cost', mode: 'balanced' }, | ||
| { version: '9.9.9' }, | ||
| )).toThrow('The router version does not match the tested artifact'); | ||
| }); |
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Smoke Cloud Hypervisor reports failed. Cloud Hypervisor + Copilot failed.
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
❌ Security Guard failed. Please review the logs for details.
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
✅ Build Test Suite completed successfully!
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
📡 Smoke OTel Tracing reports failed. OTel tracing regression detected. Smoke Test: API Proxy OTEL Tracing — all scenarios pass. Overall: OTEL tracing integration for the api-proxy sidecar is working as designed. No issues filed. Not a PR-triggered run, so reporting via noop.
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
This comment has been minimized.
This comment has been minimized.
|
❌ Security Guard failed. Please review the logs for details.
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable: Overall: PASS
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: Cloud Hypervisor + Copilot
Result: ALL CHECKS PASSED Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot Engine — @lpcox
Overall: PASS
|
Smoke Test: Services Connectivity
Overall: PASS
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
Smoke Test: Copilot BYOK (Direct) Mode ✅
Overall: PASS Direct BYOK mode (COPILOT_PROVIDER_API_KEY) routing through api-proxy sidecar is operational.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes:
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch detected between host and chroot environment (host
|
|
Add NVX Phase 3b lifecycle foundations and KVM evidence workflow ✅ Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
📡 Smoke Test: API Proxy OpenTelemetry Tracing — Results
Overall: ✅ All 5 scenarios validated — no regressions detected.
|
PR #8853 added apiProxy.routing (ModelRoutingConfig) to the JSON schema, docs/awf-config-spec.md, TypeScript types (config-file.ts, config-mapper.ts, api-proxy-routing-options.ts), and build-config.ts, but never wired the resulting modelRouting config value to an env var for the api-proxy sidecar. Added AWF_MODEL_ROUTING wiring in buildModelPolicyEnv alongside the existing AWF_MODEL_FALLBACK pattern, updated the spec's CLI mapping table entry, and added a regression test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Summary
apiProxy.routingconfiguration surface and carry it through config parsing, mapping, andWrapperConfigrouterimage role with the published upstream fallbackajv8.20.0 in the API proxyThis PR intentionally does not stage routing input, register a router service, alter Compose topology, or import the new routing modules from the running API proxy. Configurations without
apiProxy.routingretain the existing runtime behavior.Closes #8851
Validation
npm --prefix containers/api-proxy test -- --runInBand --runTestsByPath routing-errors.test.js routing-config.test.js routing-contract.test.jsnpx jest --runInBand --runTestsByPath src/config-file-mapping.test.ts src/commands/build-config.test.ts src/image-resolver.test.ts src/config-file-validation.test.ts src/commands/predownload.test.tsnpm run generate:schemacmp docs/awf-config.schema.json src/awf-config-schema.jsonnpm run type-checknpm run lint(passes with existing warnings)npm run buildnpx jest --runInBand(376 suites, 6,051 passed, 4 skipped)npm --prefix containers/api-proxy test -- --runInBand(87 suites, 1,717 passed)npm --prefix containers/cli-proxy test -- --runInBand(1 suite, 78 passed)npx markdownlint-cli2 docs/awf-config-spec.mdThe repository-wide Markdown command also scans pre-existing archived files under
.github/aw/logsand reports existing violations there; the changed documentation passes directly.