[aw-failures] [aw] Copilot-BYOK auth rejected by api-proxy — Codex 404 (Ponytail Reviewer, Issue Monster) + Claude 401 (Smoke Claude on Copilo

[github-actions]

Problem statement

Any workflow whose agent engine authenticates via a Copilot-brokered credential — model: copilot/* on the Codex engine, or ANTHROPIC_API_KEY: ${{ secrets.COPILOT_GITHUB_TOKEN }} on the Claude engine — is rejected by the sandboxed api-proxy sidecar (172.30.0.30) instead of being routed correctly. This is 100% reproducible for the affected workflows and has no existing tracking coverage.

Affected workflows / run IDs

• Ponytail Reviewer (Codex, model: copilot/mai-code-1-flash-picker): §32727091257, §32726474623
• Issue Monster (Codex, model: copilot/mai-code-1-flash-picker): §32726112053, §32723471004, §32720767366
• Smoke Claude on Copilot (Claude, ANTHROPIC_API_KEY: secrets.COPILOT_GITHUB_TOKEN): §32726702179, §32721064657, plus 8 more failures going back to 2026-07-16 (0% pass rate in the last 10 runs — this side is chronic, not new).

Probable root cause

The api-proxy sidecar validates provider credentials against OPENAI_API_KEY/COPILOT_PROVIDER_API_KEY/OIDC for the OpenAI route and a native Anthropic token for the Anthropic route. It has no accepted path for the Copilot-brokered substitutes these workflows actually use (COPILOT_DUMMY_BYOK for Codex, COPILOT_GITHUB_TOKEN reused as ANTHROPIC_API_KEY for Claude):

• Codex side: POST (172.30.0.30/redacted) → 404 "OpenAI proxy not configured (no OPENAI_API_KEY/COPILOT_PROVIDER_API_KEY or OIDC auth)". Confirmed via harness log: CODEX_API_KEY=set (length=31) OPENAI_API_KEY=not set. The compiled .lock.ymlfor both affected workflows intentionally excludesOPENAI_API_KEY from the sandbox (--exclude-env OPENAI_API_KEY`), since they don't use it — they rely entirely on Copilot's BYOK routing.
• Claude side: awf-reflect: models fetch returned 401 for (apiproxy/redacted) followed by {"error":"authentication_failed","result":"Not logged in · Please run /login"}. Firewall log confirms the network path is healthy (api.anthropic.com | 8 allowed | 0 blocked`) — this is a credential-rejection problem at the proxy, not an egress issue.
• audit-diff (base §32720355441 success @ 11:08:56Z vs. compare §32726474623 failure @ 12:19:17Z) shows the Codex-side break is a genuine regression introduced between those two timestamps today — downstream telemetry (Sentry/Grafana/ab.chatgpt.com) that only fires after a successful model turn disappears entirely in the failing run.
• Direct-API-key Codex workflows (e.g. AI Moderator, which sets a real OPENAI_API_KEY and never hits this error) are unaffected — this isolates the fault to the Copilot-token routing path in api-proxy, not the Codex/Claude engines generally.

Proposed remediation

1. Add an accepted credential path in api-proxy for Copilot-brokered tokens on both the openai (10000) and anthropic (10001) provider routes, so model: copilot/* and ANTHROPIC_API_KEY: secrets.COPILOT_GITHUB_TOKEN configurations authenticate successfully instead of 404/401ing.
2. Add a regression test/smoke check that exercises the Copilot-BYOK path against api-proxy specifically (the existing Smoke Claude on Copilot check has apparently been failing 100% of the time for ≥5 weeks without being caught/fixed).

Success criteria

• Ponytail Reviewer and Issue Monster complete a full Codex turn (non-404) against `(172.30.0.30/redacted)
• Smoke Claude on Copilot passes at least once against `(172.30.0.30/redacted) (currently 0/10 over the last 5 weeks).
• No new Copilot-BYOK 404/401 failures across a subsequent 6h window.

Generated by 🔍 [aw] Failure Investigator (6h) · claude · agent · 254.6 AIC · ⌖ 10.4 AIC · ⊞ 6.4K · ◷

• expires on Aug 31, 2026, 5:29 AM UTC-08:00

---

Blast radius update — 2026-08-24 19:02 UTC

This bug is still live 5+ hours after being filed. audit-diff between an early cited failure (§32727091257) and the latest failure in this window (§32759371974) shows zero firewall drift and zero token usage in either run — identical unresolved signature, not a new regression.

4 more workflows confirmed via config grep (model: copilot/mai-code-1-flash-picker) are hitting the same failure and are not yet named above:

• Weekly Issue Summary — §32742530451
• Repository Tree Map Generator — §32748593617
• Daily Repository Chronicle — §32745212320
• Daily CLI Performance — §32742464892

Also note: this issue and #55412 look like near-duplicate P0s opened 2 seconds apart describing the same root cause — worth consolidating into one.

Generated by 🔍 [aw] Failure Investigator (6h) · claude · agent · 161.3 AIC · ⌖ 8.19 AIC · ⊞ 6.4K · ◷

[github-actions]

This issue was automatically closed because it expired on 2026-08-31T13:29:01.311Z.

Closed by Workflow