[docs] auth: auth: document universal provider-prefix stripping shipped in PR #9005 by github-actions[bot] · Pull Request #9062 · github/gh-aw-firewall

github-actions · 2026-09-27T03:33:33Z

Summary

Scan window: since 2026-09-25 (UTC)
Sources reviewed: README.md, docs/auth-matrix.md, docs/authentication-architecture.md, docs/api-proxy-sidecar.md, docs/environment.md, docs/awf-config-spec.md, docs/github_actions.md; containers/api-proxy/model-body-rewriter.js, containers/api-proxy/model-utils.js (stripRedundantProviderPrefix), containers/api-proxy/body-handler.js; merged PRs Normalize OpenAI provider-prefixed models in api-proxy #9005, Share OIDC unavailable-response scaffold across provider adapters #9031, Gate task-level model routing behind experimental opt-in #9033, [docs] auth: auth: correct stale host-routing wiring status in awf-config-spec.md #9034; confirmed no currently-open [docs] auth: PR duplicates this finding.
Corrected authentication path: docs/authentication-architecture.md and docs/api-proxy-sidecar.md both described the LiteLLM-style <provider>/model prefix strip (e.g. copilot/auto → auto) as Copilot-specific. PR #9005 (merged 2026-09-26) made this stripping unconditional for every provider route — stripRedundantProviderPrefix() in containers/api-proxy/model-utils.js is generic (compares any <prefix>/ against the route's provider name), and stripRedundantModelPrefixInBody() is called from body-handler.js's transformRequestBody() for all writable-method requests regardless of provider. This means an OpenAI-bound request with "model": "openai/gpt-6-sol" (as sent by harnesses like Pi) is now normalized to gpt-6-sol before reaching OpenAI, avoiding the opaque upstream 400 that PR Normalize OpenAI provider-prefixed models in api-proxy #9005 fixed.
Current-main vs. pending: this is fully shipped on main with dedicated regression coverage (containers/api-proxy/model-body-rewriter-prefix.test.js includes an explicit openai/ prefix-stripping test). Also confirmed §13a task-level routing status (PRs Activate task-level model routing in the API proxy server #8966, Wire task-level model routing into the host workflow #8985, Gate task-level model routing behind experimental opt-in #9033, [docs] auth: auth: correct stale host-routing wiring status in awf-config-spec.md #9034) and the OIDC-scaffold refactor (Share OIDC unavailable-response scaffold across provider adapters #9031, internal-only, no doc-facing behavior change) required no further doc changes.

Documentation Changes

docs/authentication-architecture.md — Added a note after the existing Copilot-only prefix-stripping description clarifying that PR Normalize OpenAI provider-prefixed models in api-proxy #9005 made the strip unconditional for every provider, with the OpenAI openai/gpt-6-sol → gpt-6-sol example.
docs/api-proxy-sidecar.md — Added the matching note in the Codex (OpenAI) example section, cross-referencing PR Normalize OpenAI provider-prefixed models in api-proxy #9005 and the same generalization.

Validation

Implementation/tests checked: containers/api-proxy/model-utils.js (stripRedundantProviderPrefix, provider-agnostic comparison), containers/api-proxy/model-body-rewriter.js (stripRedundantModelPrefixInBody), containers/api-proxy/body-handler.js (transformRequestBody, unconditional call site with explanatory comment), containers/api-proxy/model-body-rewriter-prefix.test.js (existing openai/ prefix test, confirms shipped behavior).
Markdown/link review: new paragraphs use the same PR-link convention as surrounding text; no headings, tables, or code fences altered; both files' existing structure preserved.
Credential-leakage diff review: diff scanned for key/token/JWT/header/Bearer patterns — none present; only prose and one PR URL added per file.

Sources

Normalize OpenAI provider-prefixed models in api-proxy #9005 (merged — universal provider-prefix normalization + upstream error diagnostics)
Activate task-level model routing in the API proxy server #8966 (merged — proxy-side routing wiring, confirmed accurate, no change needed)
Wire task-level model routing into the host workflow #8985 (merged — host-side routing bootstrap, confirmed accurate, no change needed)
Gate task-level model routing behind experimental opt-in #9033 (merged — experimental.modelRouting gate, already correctly documented in awf-config-spec.md)
[docs] auth: auth: correct stale host-routing wiring status in awf-config-spec.md #9034 (merged — prior updater correction to §13a, confirmed still accurate)
Share OIDC unavailable-response scaffold across provider adapters #9031 (merged — OIDC scaffold dedup, internal refactor only, no doc claim affected)
fix: isolate Actions OIDC from agent container #6894 (closed/merged — Actions OIDC agent isolation, confirmed shipped, no stale claims found)
Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 (closed, resolved by Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054 — MCP OIDC boundary work, confirmed resolved)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Auth Doctor Updater · copilot · auto · 75.1 AIC · ⊞ 11.8K · ◷

…o all providers PR #9005 extended the redundant <provider>/ model-prefix strip (stripRedundantModelPrefixInBody / stripRedundantProviderPrefix) from Copilot-only to every provider route, so an OpenAI-bound LiteLLM-style openai/gpt-6-sol model ID is normalized before forwarding. Prior docs described this normalization as Copilot-specific. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Two documentation inaccuracies should be corrected before approval.

Review effort: Balanced
Findings: 2

Open (2)

Clarify that Copilot receives the stripped model name · New
Correct helper source file references · New

What changed in this PR

Documents universal provider-prefix normalization introduced by PR #9005.

Changes:

Clarifies OpenAI model normalization in two authentication guides.
Adds the openai/gpt-6-sol normalization example.

File	Description
`docs/authentication-architecture.md`	Documents provider-agnostic prefix stripping.
`docs/api-proxy-sidecar.md`	Adds OpenAI normalization guidance.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+Since [PR #9005](https://github.com/github/gh-aw-firewall/pull/9005), the
+redundant `<provider>/` prefix strip applied above is unconditional for every


+redundant-prefix stripping (`stripRedundantModelPrefixInBody` /
+`stripRedundantProviderPrefix` in `containers/api-proxy/model-utils.js`) is


lpcox · 2026-09-27T16:00:00Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-09-27T16:10:46Z

@copilot address review feedback

Addressed in 7b65b3b: updated the Copilot example to say the proxy strips copilot/ and forwards auto, and corrected the helper references to point stripRedundantModelPrefixInBody at model-body-rewriter.js and stripRedundantProviderPrefix at model-utils.js.

github-actions · 2026-09-27T16:16:23Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-27T16:16:47Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-9062 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit fc46a60

github-actions · 2026-09-27T17:35:42Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-27T17:35:42Z

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-09-27T17:35:42Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-27T17:35:43Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-27T17:35:43Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

clients2.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "clients2.google.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-27T17:35:43Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-27T17:35:43Z

✅ Smoke Claude passed

Generated by Smoke Claude for #9062

github-actions · 2026-09-27T17:35:44Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9062

github-actions · 2026-09-27T17:35:45Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-27T17:35:46Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-27T17:35:47Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-27T17:35:50Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-27T17:35:54Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-27T17:36:53Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-27T17:38:33Z

Smoke Test Results

GitHub list_pull_requests: PASS (PR Split model-resolver.test.js into three focused test files #9080)
curl github.com: FAIL (bash tool denied network command execution — could not verify)
Write/read temp file: PASS
curl example.com blocked check: FAIL (same bash permission denial — could not verify)

Note: bash tool blocked all curl invocations with "Permission denied and could not request permission from user", so network egress checks (#2, #4) could not be executed. Not all checks passed; skipping label.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:38:38Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) reachable — allowed=200
✅ Non-allowlisted domain (example.com) blocked — OK: example.com was blocked

Overall status: PASS

cc @lpcox

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:38:44Z

Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS

✅ GitHub MCP: PR Split model-resolver.test.js into three focused test files #9080, fix(api-proxy): skip Responses custom-tool translation on Chat Completions routes #9075 fetched
✅ GitHub.com: HTTP 200
✅ File I/O: smoke-test-copilot-byok.txt readable
✅ BYOK Inference: Direct BYOK mode active (COPILOT_PROVIDER_API_KEY) → api-proxy → api.githubcopilot.com

All tests passed.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:38:48Z

Smoke Test: Copilot Engine — @lpcox

✅ GitHub MCP connectivity (PR Split model-resolver.test.js into three focused test files #9080, fix(api-proxy): skip Responses custom-tool translation on Chat Completions routes #9075 fetched)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:39:26Z

Smoke Test: Services Connectivity

Redis PING: ✅ PONG
Postgres pg_isready: ✅ accepting connections
Postgres SELECT 1: ✅ 1

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:39:38Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
gh CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9062 · claude · haiku45 · 30 AIC · ⊞ 4.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:39:57Z

Smoke Test: API Proxy OpenTelemetry Tracing — Results

#	Scenario	Result
1	Module Loading	✅ `otel.js` loaded successfully, `isEnabled: true`, exports 14 functions (`startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`, plus internal test hooks)
2	Test Suite	✅ 3 suites, 68/68 tests passed (0 failed) — covers serialization, fan-out exporters, header parsing, span creation, gen_ai attributes, ProxyAwareOtlpExporter, FileSpanExporter
3	Env Var Forwarding	✅ `env-passthrough.ts` forwards `GITHUB_AW_OTEL_TRACE_ID` and `GITHUB_AW_OTEL_PARENT_SPAN_ID` to the agent; `api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, and both trace-context vars to api-proxy
4	Token Tracker Integration	✅ `onUsage` callback present in `token-tracker-http.js` as the OTEL hook point
5	OTEL Diagnostics	✅ 1 span exported to `otel.jsonl` (`gh-aw.agent.setup`, workflow-level instrumentation). No api-proxy LLM spans present, expected since this smoke test validates code/config paths rather than making live proxied LLM calls

Overall: ✅ All 5 scenarios passed. No unexpected failures detected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:41:16Z

Smoke Test

9080: Split model-resolver.test.js into three focused test files
9075: fix(api-proxy): skip Responses custom-tool translation on Chat Completions routes
GitHub merged PR review: ✅
PR detail lookup: ✅
Playwright title check: ✅
File write/read: ✅
Build (npm ci && npm run build): ✅
Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

clients2.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "clients2.google.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:41:23Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	pass	✅ PASS
Go	env	✅	pass	✅ PASS
Go	uuid	✅	pass	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	pass	✅ PASS
Node.js	execa	✅	pass	✅ PASS
Node.js	p-limit	✅	pass	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

Bun and Deno were installed via npm install -g bun/npm install -g deno (the official curl | bash installer scripts were blocked by sandbox policy); both installed fine and all tests passed.
Java Maven builds required using a writable local repo (-Dmaven.repo.local) because the pre-existing ~/.m2 directory in this environment was root-owned; this is an environment quirk unrelated to the firewall and once worked around, both projects compiled and tested successfully through the Squid proxy.

Generated by Build Test Suite for #9062 · copilot · auto · 45.4 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-27T17:42:00Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environment. Python and Go versions match; the smoke-chroot label was not added since not all tests passed.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions Bot added ai-generated documentation Improvements or additions to documentation labels Sep 27, 2026

github deleted a comment from manamansor Sep 27, 2026

lpcox requested a balanced review from Copilot September 27, 2026 15:45

Copilot started reviewing on behalf of lpcox September 27, 2026 15:46 View session

Copilot AI reviewed Sep 27, 2026

View reviewed changes

Copilot started work on behalf of lpcox September 27, 2026 16:09 View session

docs: address provider prefix review feedback

7b65b3b

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox September 27, 2026 16:11

Copilot AI requested a review from lpcox September 27, 2026 16:11

lpcox added the ready-for-aw label Sep 27, 2026

lpcox enabled auto-merge (squash) September 27, 2026 17:35

lpcox had a problem deploying to aoai-model September 27, 2026 17:35 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 27, 2026

github-actions Bot added smoke-copilot-byok smoke-copilot labels Sep 27, 2026

lpcox deployed to aoai-model September 27, 2026 17:39 — with GitHub Actions Active

github-actions Bot added the smoke-services label Sep 27, 2026

github-actions Bot added the smoke-claude label Sep 27, 2026

github-actions Bot added smoke-codex build-test labels Sep 27, 2026

lpcox disabled auto-merge September 27, 2026 22:59

lpcox merged commit e316798 into main Sep 27, 2026
121 of 125 checks passed

lpcox deleted the docs/openai-prefix-strip-shipped-20260927-a4536ceab6b62f6c branch September 27, 2026 22:59

		Since [PR #9005](https://github.com/github/gh-aw-firewall/pull/9005), the
		redundant `<provider>/` prefix strip applied above is unconditional for every

		redundant-prefix stripping (`stripRedundantModelPrefixInBody` /
		`stripRedundantProviderPrefix` in `containers/api-proxy/model-utils.js`) is

Conversation

github-actions Bot commented Sep 27, 2026

Summary

Documentation Changes

Validation

Sources

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

lpcox commented Sep 27, 2026

Uh oh!

Copilot AI commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 27, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 27, 2026

Smoke Test: API Proxy OpenTelemetry Tracing — Results

Uh oh!

github-actions Bot commented Sep 27, 2026

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading