[docs] auth: auth: correct stale task-level routing wiring status in awf-config-spec.md - #8993
Conversation
Section 13a said the routing candidate-pool foundation was present but not called by the running proxy. PR #8966 (merged) wired the routing controller and request enforcement into the live API proxy server: a routing session now starts after key validation/model discovery and screens every inference request against the selected model/effort. Clarify that host-side staging and validation of apiProxy.routing input (PR #8985) is still open, so the feature is not yet end-to-end functional despite the proxy-side wiring being shipped. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
ai-generated
documentation
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The documentation accurately reflects the implementation and linked pull request states.
Review effort: Balanced
Findings: None
What changed in this PR
Updates task-level model routing documentation to match current implementation status.
Changes:
- Documents active API-proxy routing enforcement from PR #8966.
- Clarifies that host-side routing remains incomplete pending PR #8985.
| File | Description |
|---|---|
docs/awf-config-spec.md |
Corrects routing status and current end-to-end limitation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
✅ Copilot review passed with no inline comments. @github-actions[bot] Add the |
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit 5480544 |
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "clients2.google.com"
- "github.com"
- "github.githubassets.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
🚀 Security Guard has started processing this pull request |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
🚀 Build Test Suite has started processing this pull request |
|
❌ Smoke Gemini reports failed. Facets need polishing... Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "play.googleapis.com"See Network Configuration for more information.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable: Overall: PASS
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
Smoke Test: Cloud Hypervisor + Copilot
All 4 checks: PASS Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot Engine — PASS
|
|
Smoke Test: Copilot BYOK (Direct) Mode — PASS ✅
Running in direct BYOK mode (
|
|
Smoke Test: Services Connectivity
Overall: PASS
|
Smoke Test: API Proxy OTEL Tracing — Results
Overall: ✅ Pass (4 fully verified, 1 expected-pending — no live proxied requests occurred in this run).
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version differs between host and chroot environment (v24.21.0 vs v22.23.2). The
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes:
Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
Summary
src/services/api-proxy-env-config.ts,src/services/credentials/*.ts,containers/api-proxy/{server-factory,startup,routing-runtime,routing-controller}.js; issues/PRs [awf] api-proxy: Gemini CLI 0.55.1 rejects placeholder API key with "Invalid auth method selected" (exit 41) #8913, Pin Gemini CLI auth type so api-proxy runs stop failing with exit 41 #8916, Add the routing decision controller and enforcement #8942, [docs] auth: auth: correct stale GCP OIDC agent-routing claim in auth-matrix.md #8953, Activate task-level model routing in the API proxy server #8966, Wire task-level model routing into the host workflow #8985, feat(routing): wire routing into the host workflow #8984, [Routing]: activate routing in the api proxy server #8957, feat(routing): build the routable model candidate pool #8872, [Routing]: add the router client and metered classifier path #8917, [Routing]: add the routing decision controller and enforcement #8941; fix: isolate Actions OIDC from agent container #6894 (closed, merged) and Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 (closed, resolved by Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054, merged) — both confirmed shipped on main with no stale doc claims found referencing them.docs/api-proxy-sidecar.md,docs/environment.md, anddocs/auth-matrix.md). The stale claim found is indocs/awf-config-spec.md§13a "Task-Level Model Routing", which affects the trust boundary of API-proxy request enforcement: it said the routing candidate pool "is present but is not called by the running proxy," but merged PR Activate task-level model routing in the API proxy server #8966 wired the routing controller and request-enforcement gate directly intocontainers/api-proxy/server-factory.js/startup.js— every inference request is now screened against a selected model before the adapter's enabled/auth check runs.AWF_ROUTING_CONFIGis set. However,AWF_ROUTING_CONFIGis still populated directly from the config file's host path (src/services/api-proxy-env-config.ts) with no host-side staging, validation, orselection.jsonreadiness gate — that host wiring is PR Wire task-level model routing into the host workflow #8985, still open (not yet merged). The doc now states both facts so a reader doesn't assume the feature is end-to-end functional.Documentation Changes
apiProxy.routingtoday does not yet produce a working end-to-end routed run.Validation
containers/api-proxy/server-factory.js(routing?.screenRequest()runs beforeadapter.isEnabled(); upgrade handler callsrouting.rejectUpgrade()),containers/api-proxy/startup.js(routing session starts aftervalidationand model discovery resolve, drains on shutdown, exits 78 on failedcompleteShutdown()),containers/api-proxy/routing-runtime.jsheader comment,src/services/api-proxy-env-config.ts:276(AWF_ROUTING_CONFIG: JSON.stringify(config.modelRouting)— direct passthrough, no staging), and confirmed viagrepthat nosrc/services/*routing*bootstrap*module exists onmainyet (that lands in open PR Wire task-level model routing into the host workflow #8985).[PR #8966](...)/[PR #8985](...)markdown links render correctly and match the repo's existing convention for citing merged/open PRs, and that no line exceeds reasonable wrap width.sk-,ghp_,gho_,Authorization:, bearer-shaped strings) — none present; only prose, PR URLs, and existing env-var/file names were added.Sources
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.