Rolling upstream release action items — awf

This is the single canonical tracking issue for action items arising from
new releases of the awf dependency. The update-awf-version workflow appends
a new comment to this issue for each version bump going forward, so the most
recent activity lives in the comments below. This body is a consolidated
history of everything filed so far.

Latest pinned version covered: 0.28.23

Consolidated history (earliest → latest)

0.25.48 → 0.25.60 (was #851)

• OTel distributed tracing in api-proxy (v0.25.51): api-proxy now emits OTel traces; ado-aw could expose config to help consumers use this.
• ARC/DinD split-filesystem auto-detection (v0.25.52): AWF auto-detects DinD split filesystem via sentinel probe; ado-aw docs may need updating.
• Middle-power model fallback (v0.25.53): api-proxy supports model fallback when primary is unavailable; ado-aw could expose this.
• Anthropic WIF support (v0.25.58): api-proxy supports Anthropic WIF schema fields + OIDC validation.
• Pre-startup model validation via requestedModel config (v0.25.58): api-proxy validates requested model before startup; ado-aw may wish to populate this field.

0.25.48 → 0.25.63 (was #859)

• Security: proxy auth normalization hardened (v0.25.49): Prevents malformed Authorization headers from reaching the upstream API.
• Responses API cache reads in token usage rollups (v0.25.63): Fixes under-reporting of cached token reads; improves ado-aw audit accuracy.

0.25.65 → 0.25.66 (was #902)

• Azure/AWS/GCP OIDC support in Copilot adapter (v0.25.66): api-proxy supports cloud OIDC credential injection; ado-aw could expose via engine:/network: front-matter.
• Budget fields in token-usage.jsonl (v0.25.66): maxTurns and budget fields now persisted; ado-aw audit module could surface these in AuditData.

0.25.65 → 0.25.68 (was #930)

• GITHUB_COPILOT_INTEGRATION_ID forwarding fix (v0.25.67): AWF now correctly forwards it as COPILOT_INTEGRATION_ID to the api-proxy.
• PAT-safe integration ID + model name normalization (v0.25.68): Regression fix from v0.25.67; normalizes legacy CAPI model names.

0.25.65 → 0.27.0 (was #950)

• cli-proxy fail fast on DIFC unreachability (v0.25.66): CLI proxy now errors immediately rather than hanging; verify DIFC proxy config before upgrade.

0.25.65 → 0.27.1 (was #970)

• AI credits as OTEL span attributes (v0.27.1): AWF emits AI credit consumption as OTel spans; agent_stats.rs + audit could surface these.
• Redacted resolved config as audit artifact (v0.27.1): ado-aw audit could expose for configuration diagnostics.
• Opt-in diagnostics artifact for blocked LLM request bodies (v0.27.1): ado-aw could surface via ado-aw-debug: flag.

0.25.65 → 0.27.2 (was #983)

• Security: WIF/OIDC Anthropic auth regression (v0.27.2): ANTHROPIC_API_KEY leaked to agent container when Squid blocked OIDC exchange; fixed in 0.27.2.

0.25.65 → 0.27.3 (was #990)

• OTLP fan-out to multiple endpoints (v0.27.3): api-proxy can fan out telemetry to multiple OTLP endpoints simultaneously.

0.27.3 → 0.27.5 (was #1093)

• Security: HTTPS-only for bare API proxy targets (v0.27.5): Prevents over-broad HTTP allowlisting; verify no existing config relies on HTTP.
• allowedModels/disallowedModels in api-proxy (v0.27.5): Model allow/deny-list policy; ado-aw could expose as engine.allowed-models front-matter.
• COPILOT_INTEGRATION_ID forwarding from host env (v0.27.5): api-proxy forwards from host into sandbox; ensure ado-aw passes it through AWF invocation.
• GHES detection fix for Copilot auth prefix (v0.27.4): Fixes auth failures for non-standard GHES hostnames.

0.27.3 → 0.27.7 (was #1118)

• max-cache-misses guardrail (v0.27.6): Limits token spend when cache misses exceed threshold; useful for cost-sensitive pipelines.

0.27.3 → 0.27.9 (was #1184)

• Copilot Business endpoint auth prefix corrected (v0.27.9): Fixed wrong bearer prefix (should be token); Business-account pipelines may have been silently failing.

0.27.9 → 0.27.11 (was #1219)

• Portable self-hosted runner doctor agent (v0.27.11): New AWF diagnostic tool; ado-aw could reference in troubleshooting docs.
• Topology-attach ordering deadlock fix (v0.27.11): Starved cli-proxy health gate; MCPG-based pipelines (--topology-attach mcp-gateway) were directly affected.
• ARC/DinD chroot path fix (v0.27.10): /host/tmp/awf-runner-bin instead of /host/usr collision; update ARC/DinD docs if referencing /host/usr.

0.27.9 → 0.27.12 (was #1241)

• Security: June 2026 dependency refresh (v0.27.12): Routine security dep upgrades; upgrading recommended.
• OIDC config propagation fix (v0.27.12): apiProxy.auth OIDC fields were not propagated to all proxy layers; previously configured OIDC may have been silently ignored.

0.27.9 → 0.27.13 (was #1252)

• Security: ReDoS fix in postprocess script (v0.27.11): ReDoS vulnerability patched; no consumer action beyond upgrading.
• maxRuns counts only inference calls (v0.27.13): Semantics changed — no longer counts tool calls; re-evaluate any max-runs tuning based on total tool-call counts.
• HTTP 429 (not 403) when max turns exceeded (v0.27.13): Update any ado-aw code/docs that treat 403 as the max-turns-exceeded indicator.

0.27.9 → 0.27.15 (was #1260)

• Note: v0.27.14 was retracted; its changes are included in v0.27.15.
• Security: transitive linkify-it → v5.0.1 (v0.27.12): Part of June 2026 security refresh.

0.27.9 → 0.27.21 (was #1304)

• container.mounts in AWF config schema (v0.27.21): ado-aw could expose as front-matter field for custom sandbox mounts.
• Model-to-API endpoint mapping (v0.27.16): AWF maintains a model→endpoint map updated daily; relevant for ado-aw model validation allowlist.

0.27.32 → 0.28.5 (was #1990)

• Firecracker microVM backend removed (v0.28.1, "ci: disable Firecracker workflows and release artifacts") — AWF has dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.
• Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
• Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls, closing a potential egress-control bypass.
• fix: route CLI proxy through isolated egress relay (v0.28.2, #7338) — routes the CLI proxy through an isolated egress relay for DIFC credential isolation.
• fix(security): suppress non-reachable GO-2026-4337 in gosu binary (v0.27.43, #6645) and update brace-expansion to 5.0.8 (GHSA-mh99-v99m-4gvg) (v0.27.42, #6585) — routine dependency CVE remediations in the AWF toolchain.
• Support compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest instead of tag for stronger supply-chain guarantees.
• feat: support secret-backed OpenAI-compatible targets (v0.28.3, #7576) — new API-proxy target type; relevant if ado-aw ever wants to support OpenAI-compatible engine backends secured via secret-backed credentials.
• API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (v0.28.4, #7604) — improved cost/credit accounting when using Copilot's auto model selector, could inform ado-aw's engine cost-reporting/observability docs.
• Recover transient Cloud Hypervisor readiness failures (v0.28.5, #7611) and Fix Cloud Hypervisor API proxy readiness race (v0.28.3, #7582) — reliability fixes for the (preview) Cloud Hypervisor backend that ado-aw's OneBranch integration may rely on.

0.27.32 → 0.28.9 (was #2028)

• Firecracker support removed (#7362) — anyone relying on the Firecracker VM isolation backend for AWF will need to migrate to the supported sandboxing path before upgrading past this range.
• fix(security): update vulnerable deps in agent and api-proxy images (#6505) — patches known CVEs in the agent/api-proxy container images.
• chore(deps): safe patch updates incl. ajv 8.20.0 security fix (#6962) — bundled ajv security patch.
• Protect ANTHROPIC_AUTH_TOKEN in AWF credential isolation paths (#6410) — extends AWF's credential-isolation guarantees to Anthropic auth tokens.
• Exclude topology-attached MCP peers from agent proxy routing (#6189) — relevant to how ado-aw wires MCPG via --topology-attach; may simplify or change proxy routing assumptions in agentic_pipeline.rs.
• Auto-allow topology-attached container hostnames in Squid ACL (#6473) — reduces manual allowlist entries for topology-attached containers (e.g. MCPG), potentially letting ado-aw drop custom allowlist workarounds.
• Support COPILOT_MODEL=auto (#6474) — new dynamic model-selection env var AWF passes through; ado-aw's engine.rs model handling could expose this as a supported option.
• Route CLI proxy through isolated egress relay (#7338) — changes to how the wrapped az/CLI network egress is routed; worth double-checking az_wrapper.rs assumptions still hold.
• API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (#7604) — new usage/cost accounting surfaced by AWF that ado-aw's audit/otel tooling could ingest.
• Remove "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.

0.27.32 → 0.28.23 (was #2230) — canonical

• Firecracker microVM backend support was removed (v0.28.2) in favor of Cloud Hypervisor. ado-aw does not reference Firecracker or select a sandbox backend explicitly, so no action is required, but worth noting if any future AWF backend-selection flag is adopted.
• Legacy "bounded execution" was removed in favor of MCP enclaves (v0.28.0). ado-aw does not reference bounded-execution terminology or flags.
• fix(security): enforce TLS SNI allowlist (v0.28.23) — tightens AWF's own domain-filtering enforcement at the TLS layer.
• Hardened and documented the MCP gateway Authorization header contract against workspace credential exposure (v0.28.10) — relevant to ado-aw's MCPG integration; worth a spot-check that ado-aw's MCPG wiring doesn't rely on any now-tightened header behavior.
• Multiple CVE/dependency patch fixes across agent, api-proxy, and Squid images, plus GitHub Actions pinned to commit SHAs (v0.27.39, v0.27.42, v0.27.43, v0.28.16) — routine upstream hardening, no ado-aw code change needed.
• GCP Workload Identity Federation support for Gemini and Vertex API proxy adapters (v0.28.23) — could be surfaced if ado-aw adds Gemini/Vertex engine support in the future.
• Preserve explicit upstream proxy ports (v0.28.23) — may improve reliability for any future custom-port MCP/proxy configuration.

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 74.6 AIC · ⌖ 4.15 AIC · ⊞ 9.6K · ◷