[docs] auth: auth: correct stale host-routing wiring status in awf-config-spec.md

[github-actions]

Summary

• Scan window: since 2026-09-24 (UTC)
• Sources reviewed: README.md, docs/auth-matrix.md, docs/authentication-architecture.md, docs/api-proxy-sidecar.md, docs/environment.md, docs/awf-config-spec.md, docs/github_actions.md; src/services/api-proxy-env-config.ts, src/cli-workflow.ts, src/routing/bootstrap.ts; PRs Activate task-level model routing in the API proxy server #8966 (merged, proxy-side routing wiring), Wire task-level model routing into the host workflow #8985 (merged 2026-09-25, host-side routing bootstrap), Gate task-level model routing behind experimental opt-in #9033 (open — gates routing behind experimental.modelRouting, not yet shipped); issue fix: isolate Actions OIDC from agent container #6894 (closed, merged) and Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 (closed, resolved by Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054, merged) — both confirmed shipped, no stale doc claims found referencing them. Also confirmed prior updater PRs [docs] auth: auth: correct stale GCP OIDC agent-routing claim in auth-matrix.md #8953 and [docs] auth: auth: correct stale task-level routing wiring status in awf-config-spec.md #8993 already landed their corrections and remain accurate.
• Corrected authentication path: §13a "Task-Level Model Routing" in docs/awf-config-spec.md still described the host workflow as not yet staging or validating apiProxy.routing input, citing PR Wire task-level model routing into the host workflow #8985 as "open, not yet merged." That PR merged on 2026-09-25 and its host routing bootstrap (src/routing/bootstrap.ts: private per-run routing directory, host-mode rejection, digest-pin enforcement, selection.json wait-for-ready, exit code 78 on failure) is fully wired into src/cli-workflow.ts (prepareRouting, waitForRoutingSelection, verifyRoutingCompletion). The doc's "does not yet produce a working end-to-end routed run" caveat is no longer accurate.
• Current-main vs. pending: both proxy-side (Activate task-level model routing in the API proxy server #8966) and host-side (Wire task-level model routing into the host workflow #8985) routing wiring are shipped on main. PR Gate task-level model routing behind experimental opt-in #9033 (gating routing behind an experimental.modelRouting opt-in) is still open and unmerged — it was not referenced by the existing doc text and does not need a caveat added, since the corrected text describes only shipped behavior.

Documentation Changes

• docs/awf-config-spec.md (§13a) — Replaced the "host workflow does not yet stage or validate" paragraph (which cited PR Wire task-level model routing into the host workflow #8985 as open) with an accurate description: the host now stages the trusted conversation into a private per-run routing directory, rejects unsupported host modes (non-Linux, non-runc, disabled API proxy, DinD/split filesystems, Docker-socket exposure, unpinned router image), and waits for selection.json before starting the agent; a routing failure from either side surfaces as host exit code 78.

Validation

• Implementation/tests checked: src/routing/bootstrap.ts (stageRoutingConversation, RoutingFailureExitError with exitCode = 78, ROUTING_SELECTION_TIMEOUT_MS, digest-pin check via isDigestPinnedImageReference), src/cli-workflow.ts (dependencies.prepareRouting, waitForRoutingSelection, verifyRoutingCompletion all invoked in the run flow), src/services/api-proxy-env-config.ts (buildModelRoutingEnv now requires config.modelRoutingBootstrap and throws MODEL_ROUTING_NOT_STAGED_MESSAGE if routing is configured without host staging having run).
• Markdown/link review: diff limited to one paragraph in §13a; verified the [PR #8966](...) / [PR #8985](...) links render correctly and match the file's existing convention for citing merged PRs; surrounding code fence and table were left untouched.
• Credential-leakage diff review: diff scanned for key/token/JWT/header patterns (sk-, ghp_, gho_, Authorization:, bearer-shaped strings) — none present; only prose and existing PR URLs were changed.

Sources

• Wire task-level model routing into the host workflow #8985 (merged — host-side routing bootstrap wiring)
• Activate task-level model routing in the API proxy server #8966 (merged — proxy-side routing wiring, already correctly documented)
• Gate task-level model routing behind experimental opt-in #9033 (open — experimental gate for routing, not yet merged; not referenced by this correction)
• [docs] auth: auth: correct stale task-level routing wiring status in awf-config-spec.md #8993 (merged — prior correction to this same section, superseded by this change)
• [docs] auth: auth: correct stale GCP OIDC agent-routing claim in auth-matrix.md #8953 (merged — GCP WIF agent-routing caution in auth-matrix.md, confirmed still accurate)
• fix: isolate Actions OIDC from agent container #6894 (merged — Actions OIDC agent isolation)
• Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 (closed, resolved by Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054, merged)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Auth Doctor Updater · copilot · auto · 82.5 AIC · ⊞ 11.8K · ◷

[Copilot]

Copilot review overview

🟡 Changes recommended

The unsupported-configuration list omits the rejected --keep-containers option.

Review effort: Balanced
Findings: 1

Open (1)

• Document --keep-containers as unsupported by routed workflow · New

What changed in this PR

Updates the model-routing specification to reflect shipped host-side routing support.

Changes:

• Documents routing input staging, validation, readiness waiting, and exit code 78.
• Updates PR #8985’s status from pending to shipped.

File	Description
docs/​awf-config-spec.md	Corrects task-level routing workflow documentation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

1. Download the docs-preview-pr-9034 artifact from the workflow run
2. Unzip and open index.html in your browser

Built from commit bd0a4e9

[lpcox]

@copilot merge main and resolve conflicts

[Copilot]

@copilot merge main and resolve conflicts

Merged current main and resolved the docs/awf-config-spec.md conflict in merge commit 2ade06a. The build and all 6,348 tests pass.