[awf] model-validation: Resolve aliases and fail fast before AWF provider auth for retired models

[lpcox]

Problem

When engine.model: gpt-5-codex is set in a workflow, gh-aw passes the raw string as COPILOT_MODEL to the Copilot CLI without resolving the built-in alias or validating catalog availability. The workflow author sees an authentication-style BYOK error rather than a clear "model is retired/unavailable" failure, making the actionable fix invisible.

Context

Source issue: github/gh-aw#35032

gpt-5-codex is both a retired Copilot model (retired 2026-02-17) and a gh-aw built-in alias resolving to copilot/gpt-5*codex*. The ambiguity between alias and concrete model ID is the root of the confusing error.

Root Cause

• pkg/workflow/engine.go:285-289 copies engine.model as a raw string into EngineConfig.Model without alias resolution.
• pkg/workflow/model_alias_validation.go validates syntax only — it does not check catalog availability or retired status.
• pkg/workflow/copilot_engine_execution.go:424-436 passes the raw value directly to COPILOT_MODEL, bypassing the alias map emitted to AWF's apiProxy.models.

Proposed Solution

1. In copilot_engine_execution.go, resolve EngineConfig.Model through the merged alias map before setting COPILOT_MODEL; fall back to the raw value only if no alias entry matches.
2. Add a compile-time or startup validation step that checks whether the resolved model string is recognized; emit a specific engine.model error (not a provider auth error) for retired or unknown model strings.

Generated by Firewall Issue Dispatcher · 157.4 AIC · ⊞ 27.8K · ◷

[github-actions]

👋 Hello! I noticed this issue might be related to existing issues that were previously addressed:

• [awf] api-proxy: resolve model aliases before setting COPILOT_MODEL env var #4574 — [awf] api-proxy: resolve model aliases before setting COPILOT_MODEL env var (closed as completed 2026-06-09) — Describes the same root cause: COPILOT_MODEL set from raw engine.model without alias resolution via apiProxy.models, with the same gpt-5-codex example and same upstream source issue.
• [awf] API proxy: validate Copilot model before agent launch to prevent misleading auth errors #4566 — [awf] API proxy: validate Copilot model before agent launch to prevent misleading auth errors (closed as completed 2026-06-09) — Also describes engine.model: gpt-5-codex producing auth-style errors instead of a clear model-unavailable failure, with a proposed pre-flight validation step.

Both reference the same upstream issue (gh-aw#35032) and the same gpt-5-codex retired model scenario.

If the fixes from those issues didn't fully resolve the problem (e.g., a regression or a related but distinct code path), it would be helpful to note that here so reviewers know what's already been attempted. Otherwise, this issue may already be covered.

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #4726 · 81.4 AIC · ⊞ 32.9K · ◷