No gh-aw change: Anthropic proxy fix requires gh-aw-firewall

[Copilot]

Daily AgentRx Trace Optimizer fails after the Anthropic api-proxy reports a misleading healthy state, then exhausts Claude CLI retries on upstream connection refusal.

• Root cause

  • Validation and health behavior lives in github/gh-aw-firewall, not this repository.
  • Available v0.28.1 still treats Anthropic HTTP 400 as valid and exposes health before successful upstream connectivity.

• Required upstream change

  • Require a successful authenticated Anthropic connectivity probe before reporting proxy health.
  • Treat non-2xx probe responses and network failures as unhealthy.
  • Release the firewall fix; then bump DefaultFirewallVersion in gh-aw and regenerate workflow locks.

// Current upstream behavior that must change
if (status === 400) {
  keyValidationResults[provider] = { status: 'valid' };
}

• Fixes [aw-failures] [P1] Anthropic proxy connection-refused/retry-exhaustion now hitting 3 workflows after ~10 retries #52459

[github-actions]

Thanks for documenting this blocking dependency! 👍

This PR clearly explains that the Anthropic proxy connectivity fix must be released from github/gh-aw-firewall first, then DefaultFirewallVersion can be bumped here. The root cause analysis is solid:

• ✅ Identifies that validation logic lives in gh-aw-firewall (not here)
• ✅ Points to the specific bug (HTTP 400 treated as valid without upstream probe)
• ✅ Lists concrete requirements for the firewall release
• ✅ References the affected issue ([aw-failures] [P1] Anthropic proxy connection-refused/retry-exhaustion now hitting 3 workflows after ~10 retries #52459) and workflow

This looks ready as an internal handoff document for the core team. No changes needed.

Generated by ✅ Contribution Check · auto · 53.9 AIC · ⌖ 3.24 AIC · ⊞ 8.8K · ◷