Wire task-level model routing into the host workflow - #8985
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Routing error propagation and keep-container cleanup are incorrect, and the required real-container integration coverage is absent.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (4)
What changed in this PR
Wires task-level model routing into the host workflow with private staging, isolated router infrastructure, and fail-closed lifecycle checks.
Changes:
- Adds routing bootstrap, validation, result polling, and cleanup.
- Adds the isolated router service and API-proxy routing mounts/network.
- Updates workflow ordering and focused unit tests.
| File | Description |
|---|---|
src/types/index.ts |
Exports routing bootstrap state. |
src/types/api-proxy-routing-options.ts |
Defines internal routing state. |
src/services/router-service.ts |
Defines the router sidecar. |
src/services/optional-services.ts |
Adds router assembly. |
src/services/api-proxy-service-config.ts |
Adds routing mounts and networking. |
src/services/api-proxy-env-config.ts |
Emits staged routing configuration. |
src/services/api-proxy-env-config.test.ts |
Tests routing environment generation. |
src/services/agent-environment/excluded-vars.ts |
Blocks routing configuration passthrough. |
src/services/agent-environment-options.test.ts |
Tests routing variable exclusion. |
src/routing/bootstrap.ts |
Implements host routing lifecycle. |
src/routing/bootstrap.test.ts |
Tests staging and result validation. |
src/image-tag.ts |
Adds router image digest handling. |
src/image-resolver.ts |
Exposes digest-reference validation. |
src/container-lifecycle.ts |
Includes router conflict cleanup. |
src/constants.ts |
Defines the router container name. |
src/compose-generator.ts |
Adds the private routing network. |
src/compose-generator.test.ts |
Tests routed Compose output. |
src/commands/main-action.ts |
Wires routing dependencies and exit codes. |
src/cli-workflow.ts |
Adds routing startup and completion gates. |
src/cli-workflow.test.ts |
Tests routing workflow order. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| throw new Error('Model routing is enabled but no selection wait implementation was provided'); | ||
| } | ||
| logger.info('Waiting for model routing selection...'); | ||
| await dependencies.waitForRoutingSelection(routingState); |
| if (config.modelRouting) { | ||
| if (!dependencies.verifyRoutingCompletion) { | ||
| throw new Error('Model routing is enabled but no completion verification implementation was provided'); | ||
| } | ||
| try { | ||
| await dependencies.verifyRoutingCompletion(routingState); |
| prepareRouting: async (routingConfig) => stageRoutingConversation(routingConfig), | ||
| waitForRoutingSelection, | ||
| verifyRoutingCompletion: async (routingState) => verifyRoutingCompletion(routingState), | ||
| cleanupRouting: async (routingConfig) => cleanupRoutingState(routingConfig), |
| healthcheck: { | ||
| test: ['CMD', 'curl', '-fsS', `http://localhost:${ROUTER_PORT}/healthz`], | ||
| interval: '2s', | ||
| timeout: '3s', | ||
| retries: 15, | ||
| start_period: '10s', |
Section 13a said the routing candidate-pool foundation was present but not called by the running proxy. PR #8966 (merged) wired the routing controller and request enforcement into the live API proxy server: a routing session now starts after key validation/model discovery and screens every inference request against the selected model/effort. Clarify that host-side staging and validation of apiProxy.routing input (PR #8985) is still open, so the feature is not yet end-to-end functional despite the proxy-side wiring being shipped. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
@copilot address review feedback |
|
✅ Copilot review passed with no inline comments. @copilot Add the |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "msfeed25.pkgs.visualstudio.com"See Network Configuration for more information.
|
|
✅ Build Test Suite completed successfully! Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com): Overall: PASS Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS✅ MCP connectivity verified Mode: Direct BYOK (
|
Cloud Hypervisor + Copilot Smoke Test
All checks passed. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot Engine —
Overall: PASS
|
|
Smoke Test Results:
Overall: PASS
|
Gemini Engine Validation Smoke Test Results
Overall Status: PASS Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"
- "play.googleapis.com"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host (
|
|
Reviewed PR titles:
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "msfeed25.pkgs.visualstudio.com"See Network Configuration for more information.
|
📡 OTel Tracing Smoke Test Results
Overall: ✅ All 5 scenarios passed. No regressions detected in OTEL tracing integration for the api-proxy sidecar. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"
- "registry.npmjs.org"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes:
Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
Section 13a said the routing candidate-pool foundation was present but not called by the running proxy. PR #8966 (merged) wired the routing controller and request enforcement into the live API proxy server: a routing session now starts after key validation/model discovery and screens every inference request against the selected model/effort. Clarify that host-side staging and validation of apiProxy.routing input (PR #8985) is still open, so the feature is not yet end-to-end functional despite the proxy-side wiring being shipped. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
PR #8985 (host-side routing bootstrap) merged 2026-09-25 and is fully wired into src/cli-workflow.ts and src/routing/bootstrap.ts on main. The spec still described host staging/validation as not-yet-merged; update it to reflect that both the proxy-side (PR #8966) and host-side (PR #8985) halves of task-level routing are shipped. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>



Task-level routing existed inside the API proxy, but the host workflow never staged the routing input, launched the router, or waited for a trusted selection before starting the agent. This wires the host side so routed runs fail closed instead of silently running unrouted.
Host routing bootstrap
78.Compose/runtime wiring
awf-routingnetwork shared only byapi-proxyand the router.api-proxy.API-proxy routing env
AWF_ROUTING_CONFIGout of model policy env generation.{ "objective": { "goal": "cost", "mode": "balanced" }, "task": { "conversationFile": "/run/awf-routing/input/conversation.json" } }Workflow ordering
selection.json, then starts the agent.Coverage