🩺 Runner Doctor UpdateD12: Copilot `model: auto` fails AI-credits guard under isolated agent runtimes (gVisor/sbx)

[github-actions]

Summary

• Scan window: since 2026-07-31 (UTC), repo github/gh-aw-firewall
• Reviewed several dozen issues/PRs matching non-hosted-runner signals (ARC/DinD/GHES/GHEC/musl/IPv6/proxy/GH_HOST/toolcache/gvisor/sbx); most were filtered by integrity policy or unrelated (CI bumps, etc.)
• 1 genuinely new, not-yet-captured lesson found: issue Model auto fails AI-credit pricing in isolated agent runtimes #6810 / PR fix(ai-credits): allow Copilot auto model through the AI-credits pre-flight guard #6811

Proposed knowledge-base changes

.github/workflows/shared/self-hosted-failure-modes.md

Add to Category D — Alternative runtimes and adjacent gaps, new row D12:

ID	Signal	Root cause	Fix / flag	Probe	Citations
D12	Copilot workflow with model: auto (or no explicit top-level model, gh-aw v0.84.1+ generates auto) fails before the agent starts under --container-runtime gvisor or sbx; harness logs awf-reflect: fetching (apiproxy/redacted) then request failed: fetch failed, followed by 400 400 400 Model "auto" has no AI credits pricing and no default pricing is configured`; retries fail identically with zero tokens consumed. Same workflow succeeds under the default (non-isolated) AWF runtime.	Isolated agent runtimes (gVisor, docker-sbx) cannot reach (apiproxy/redacted) which the harness normally uses to resolve autoto a concrete priced model before sending. Without that resolution, the API proxy'smaxAiCredits pre-flight guard (checkUnknownModelRejectioninguards/ai-credits-guard.js) had no pricing entry for the literal string autoand rejected every request with HTTP 400, even though the Copilot API itself resolvesauto` to a concrete model and prices it correctly from the response.	Fixed in AWF (PR #6811, merged 2026-08-01): checkUnknownModelRejection now early-returns (allows the request through) when provider === 'copilot' && model.toLowerCase() === 'auto'; credit accounting happens post-hoc from the response's resolved model field. Non-Copilot providers still reject an unresolved auto sentinel. Upgrade AWF to the version including #6811. Workaround (older AWF): pin a concrete priced model in workflow frontmatter (e.g. model: claude-sonnet-4.6) to avoid catalog-based auto resolution under isolated runtimes.	Confirm sandbox.agent.runtime: gvisor or sbx in resolved AWF config; check API proxy logs for 400 ... Model "auto" has no AI credits pricing alongside harness awf-reflect: request failed: fetch failed; confirm whether apiProxy.maxAiCredits is configured (guard only fires when enabled)	#6810, #6811

Error-string quick lookup addition

Observable	Likely mode
Model "auto" has no AI credits pricing and no default pricing is configured together with awf-reflect: request failed: fetch failed under --container-runtime gvisor or sbx	D12 (isolated runtime cannot reach /reflect to pre-resolve auto; AI-credits guard rejected the sentinel; fixed in #6811)

Proposed doctor changes

.github/workflows/self-hosted-runner-doctor.md: add D12 to the failure-mode catalog reference and the error-string lookup table (same rows as above), so the daily doctor run recognizes this signature for gVisor/sbx Copilot workflows using model: auto.

Proposed portable agent changes

.github/agents/self-hosted-runner-doctor.md: apply the identical D12 catalog row and error-string lookup entry to the embedded copy, keeping it in sync with the shared catalog and playbook file per the doctor's sync requirement.

Source issues and PRs

• Model auto fails AI-credit pricing in isolated agent runtimes #6810 (bug report: model: auto fails AI-credit pricing in isolated agent runtimes)
• fix(ai-credits): allow Copilot auto model through the AI-credits pre-flight guard #6811 (fix: allow Copilot auto model through the AI-credits pre-flight guard, merged 2026-08-01)

No open runner-doctor-labeled proposal duplicates this lesson (checked before filing).

Generated by Runner Doctor Updater · auto · 37 AIC · ⊞ 35.6K · ◷

• expires on Sep 1, 2026, 7:20 PM UTC