Align Copilot reflection metadata with routing eligibility by Copilot · Pull Request #9381 · github/gh-aw-firewall

Copilot · 2026-10-02T19:08:28Z

Copilot /reflect could mark routable models incomplete, while routing candidates could include models disabled in the model picker. This made the reflection catalogue disagree with the choices available to the router.

Shared eligibility: Use routing catalogue normalization and choice logic for /reflect completeness, including Copilot’s reasoning_effort field and models with no effort control.
Picker filtering: Preserve model_picker_enabled in runtime metadata and exclude disabled Copilot models, even when explicitly allowlisted.
Explain exclusions: Add candidate_metadata_reason for picker-disabled models.

{
  "model_id": "internal-model",
  "candidate_metadata_complete": false,
  "candidate_metadata_reason": "Model is not enabled in the Copilot model picker"
}

Fixes Model routing: /reflect marks every Copilot model incomplete, and the candidate pool includes non-picker models #9379

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

The real /reflect path still receives sanitized records without the routing metadata required by the new normalization.

Review effort: Balanced
Findings: 1

Open (1)

Reflect path omits private routing metadata · New

What changed in this PR

Aligns Copilot reflection metadata and routing eligibility, including picker-disabled model filtering.

Changes:

Preserves and applies Copilot model-picker eligibility.
Shares routing-choice logic with /reflect.
Adds exclusion metadata and tests.

File	Description
`docs/api-proxy-sidecar.md`	Documents exclusion reasons.
`containers/api-proxy/runtime-model-catalog.js`	Retains picker eligibility.
`containers/api-proxy/runtime-model-catalog.test.js`	Tests metadata normalization.
`containers/api-proxy/routing-catalogue.js`	Propagates picker eligibility.
`containers/api-proxy/routing-candidates.js`	Filters disabled models and shares choice logic.
`containers/api-proxy/routing-candidates.test.js`	Tests picker filtering.
`containers/api-proxy/management.js`	Derives reflection completeness from routing choices.
`containers/api-proxy/management.test.js`	Tests reflection-routing consistency.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

-      : (runtime?.capabilities?.supports?.reasoningEffort === false
-        ? []
-        : (maintained?.reasoningEfforts ?? null));
+    const normalized = normalizeModel(id, runtime, provider);


lpcox · 2026-10-02T19:53:45Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-02T19:59:08Z

@copilot address review feedback

Fixed in ba19f49. /reflect now uses private runtime metadata for routing eligibility while preserving the sanitized model_metadata response. The server-path regression test and full API-proxy suite pass.

github-actions · 2026-10-02T19:59:41Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-10-02T20:00:07Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-9381 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit 4dd0fdc

github-actions · 2026-10-02T20:03:41Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	92.07%	92.82%	📈 +0.75%
Statements	90.54%	91.29%	📈 +0.75%
Functions	88.88%	89.34%	📈 +0.46%
Branches	83.55%	84.71%	📈 +1.16%

📁 Per-file Coverage Changes (4 files)

File	Lines (Before → After)	Statements (Before → After)
`src/cloud-hypervisor/manager-stop.ts`	91.0% → 92.1% (+1.12%)	85.8% → 86.7% (+0.83%)
`src/cloud-hypervisor/manager.ts`	85.9% → 88.7% (+2.82%)	84.3% → 87.1% (+2.72%)
`src/log-directory-setup.ts`	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)
`src/cloud-hypervisor/host-enclave-executor.ts`	55.0% → 94.4% (+39.33%)	51.7% → 90.5% (+38.81%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-10-02T20:11:32Z

✅ Security Guard completed successfully!

Security review of PR #9381: No security issues found. The PR refactors model routing metadata handling in the API proxy sidecar, adding support for modelPickerEnabled field and consolidating routing logic into getModelRoutingChoices(). All changes maintain input validation rigor, preserve access control mechanisms, do not introduce new capabilities or expand firewall rules, and include safe fallback patterns. No secrets exposure, egress expansion, or ACL regression detected.

Generated by Security Guard for #9381

github-actions · 2026-10-02T20:11:32Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-10-02T20:11:34Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-10-02T20:11:35Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-10-02T20:11:35Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-02T20:11:37Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-10-02T20:11:37Z

Smoke Cloud Hypervisor reports failed. Cloud Hypervisor + Copilot failed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-10-02T20:11:37Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

Smoke test incomplete: required binaries gh, npm/node, and playwright-cli are unavailable on PATH, so no PR/discussion comment or build verification was possible.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-10-02T20:11:39Z

✅ Smoke Claude passed

Generated by Smoke Claude for #9381

github-actions · 2026-10-02T20:11:40Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-10-02T20:11:42Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-10-02T20:11:43Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-10-02T20:11:44Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-10-02T20:12:42Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9381

github-actions · 2026-10-02T20:14:48Z

Smoke Test: Claude Engine Validation

API status: ✅ PASS
GitHub check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9381 · claude · haiku45 · 49.8 AIC · ⊞ 6.2K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T20:14:58Z

Smoke Copilot: PASS

MCP: ✅ (latest merged: "docs: add A29 ARC/DinD token-usage diagnostics")
github.com: ✅ (HTTP 200)
File write/read: ✅
PR: "Align Copilot reflection metadata with routing eligibility" — author @Copilot, assignees @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T20:15:02Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): HTTP 200
✅ Blocked domain (example.com): blocked (curl failed with TLS cert error, "OK: example.com was blocked")
Overall: PASS

cc @lpcox

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T20:15:32Z

OTEL smoke test

✅ S1: otel.js loads; exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled
✅ S2: OTEL tests 68/68 pass (3 suites)
✅ S3: Env forwarding OK (GITHUB_AW_OTEL_TRACE_ID/PARENT_SPAN_ID in env-passthrough.ts; OTLP vars + trace context in api-proxy-env-config.ts)
✅ S4: onUsage callback present in token-tracker-http.js
⚠️ S5: Only 1 line in local otel.jsonl; no api-proxy span export evidence (not enabled in this run)

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T20:15:48Z

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub MCP — PR listing verified (2 recent merged PRs)
✅ github.com Connectivity — HTTP 200
✅ File Write/Read — /tmp/gh-aw/agent/smoke-test-copilot-byok.txt confirmed
✅ BYOK Inference — Direct BYOK mode via api-proxy → api.githubcopilot.com

Status: PASS — Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY)

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T20:16:01Z

Services smoke test:

Redis PING: ✅ PONG
pg_isready: ✅ accepting connections
psql SELECT 1: ✅ 1

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T20:17:19Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed. Node.js differs between host (v24) and chroot (v22), so the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T20:17:20Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	not run	❌ FAIL
Bun	hono	❌	not run	❌ FAIL
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	❌	not run	❌ FAIL
Deno	std	❌	not run	❌ FAIL
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 pkg ok	✅ PASS
Go	env	✅	1/1 pkg ok	✅ PASS
Go	uuid	✅	1/1 pkg ok	✅ PASS
Java	gson	❌	not run	❌ FAIL
Java	caffeine	❌	not run	❌ FAIL
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 5/8 ecosystems passed — FAIL

Failure details

Bun / Deno: the installer step (curl ... | bash / | sh) was denied by the sandbox with "Permission denied and could not request permission from user". Bun and Deno are not preinstalled, so the tests could not run.
Java: Maven failed with Could not create local repository at /home/runner/.m2/repository (LocalRepositoryNotAccessibleException). This is an environment limitation. Neither compile nor test ran.

All 8 repositories cloned successfully. The build-test label was not added because of the failures.

Generated by Build Test Suite for #9381 · copilot · auto · 24.4 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

Initial plan

1063f92

Copilot AI assigned Copilot and lpcox Oct 2, 2026

Copilot started work on behalf of lpcox October 2, 2026 19:09 View session

Copilot AI linked an issue Oct 2, 2026 that may be closed by this pull request

Model routing: /reflect marks every Copilot model incomplete, and the candidate pool includes non-picker models #9379

Closed

Copilot AI and others added 2 commits October 2, 2026 19:11

fix: normalize Copilot route eligibility

529e7fc

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: cover Copilot routing catalogue consistency

a4a51e1

Copilot AI changed the title ~~[WIP] Fix model routing issues in /reflect API~~ Align Copilot reflection metadata with routing eligibility Oct 2, 2026

Copilot finished work on behalf of lpcox October 2, 2026 19:17

Copilot AI requested a review from lpcox October 2, 2026 19:17

lpcox marked this pull request as ready for review October 2, 2026 19:34

Copilot AI balanced review requested due to automatic review settings October 2, 2026 19:34

Copilot started reviewing on behalf of lpcox October 2, 2026 19:35 View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

Comment thread containers/api-proxy/management.js

: (runtime?.capabilities?.supports?.reasoningEffort === false

? []

: (maintained?.reasoningEfforts ?? null));

const normalized = normalizeModel(id, runtime, provider);

Copilot started work on behalf of lpcox October 2, 2026 19:54 View session

fix: pass private runtime metadata to reflect routing

ba19f49

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 2, 2026 19:59

lpcox added the ready-for-aw label Oct 2, 2026

lpcox had a problem deploying to aoai-model October 2, 2026 20:11 — with GitHub Actions Failure

github-actions Bot added the smoke-claude label Oct 2, 2026

github-actions Bot added the smoke-copilot label Oct 2, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Oct 2, 2026

lpcox deployed to aoai-model October 2, 2026 20:15 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-byok label Oct 2, 2026

lpcox deployed to aoai-model October 2, 2026 20:15 — with GitHub Actions Active

github-actions Bot added the smoke-services label Oct 2, 2026

lpcox merged commit 77911db into main Oct 2, 2026
128 of 135 checks passed

lpcox deleted the copilot/fix-model-routing-inconsistencies branch October 2, 2026 20:39

Conversation

Copilot AI commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

lpcox commented Oct 2, 2026

Uh oh!

Copilot AI commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Oct 2, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Chroot Version Comparison

Copilot AI commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading