Move Copilot vendor API and telemetry domains out of engine defaults

[Copilot]

CopilotDefaultDomains unconditionally granted every Copilot workflow access to plan-specific inference hosts and a telemetry host, even though agents route inference through the AWF api-proxy. This moves those hosts behind an explicit opt-in.

Changes

• pkg/workflow/domains.go — CopilotDefaultDomains reduced to the shared gateway/GitHub transport baseline (api.github.com, api.githubcopilot.com, github.com, host.docker.internal, raw.githubusercontent.com). Dropped api.business/enterprise/individual.githubcopilot.com and telemetry.enterprise.githubcopilot.com.
• pkg/workflow/data/ecosystem_domains.json — new copilot-vendor ecosystem holding the four removed hosts; registered in ecosystemPriority and the GetAllowedDomains doc list.
• Docs — copilot-vendor added to the ecosystem tables in docs/.../reference/network.md and .github/aw/network.md.
• Tests — TestCopilotDefaultDomains updated; new TestCopilotVendorDomainsRequireOptIn asserts the vendor hosts are absent from Copilot/Pi defaults, present in copilot-vendor, and reachable through normal allow-list expansion.
• Regenerated — make recompile (lock files) and the smoke-copilot wasm golden fixture.

Workflows that genuinely need the plan-specific endpoints (e.g. enterprise accounts bypassing the proxy) opt in:

network:
  allowed: [defaults, copilot-vendor]

Note on api.githubcopilot.com

Kept in both Copilot and Pi defaults. It is the Copilot routing hub used as the api-proxy target (awf_config.go apiProxy copilot), i.e. the engine's inference endpoint — analogous to api.openai.com (Codex) and api.anthropic.com (Claude), which remain defaults. The issue's own table also leaves it in CopilotDefaultDomains; keeping it in PiDefaultDomains preserves consistency with getPiDefaultDomains(), which resolves the same host for the default provider. Worth confirming during review if the intent was to strip it from Pi as well.

• Fixes [domains-audit] Move Copilot/Pi vendor API and telemetry domains out of engine defaults #55356

---

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 12.4 AIC · ⌖ 10.3 AIC · ⊞ 6.2K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[gh-aw-bot]

@copilot this PR still needs forward progress. Please refresh the branch, resolve the remaining merge state, and then run the pr-finisher skill before handing back for review.

Run: https://github.com/github/gh-aw/actions/runs/32748984422

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 12.4 AIC · ⌖ 10.3 AIC · ⊞ 6.2K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Narrows Copilot’s default network access and introduces an explicit copilot-vendor opt-in ecosystem.

Changes:

• Removes plan-specific API and telemetry hosts from Copilot defaults.
• Adds documentation and regression coverage for the opt-in ecosystem.
• Updates generated workflow and WASM outputs.

Show a summary per file

File	Description
pkg/workflow/domains.go	Narrows defaults and registers the ecosystem.
pkg/workflow/domains_test.go	Tests vendor-domain opt-in behavior.
pkg/workflow/data/ecosystem_domains.json	Defines copilot-vendor.
docs/src/content/docs/reference/network.md	Documents the ecosystem.
.github/aw/network.md	Adds the ecosystem reference.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden	Updates Go-compiler golden output.
.github/workflows/unbloat-docs.lock.yml	Regenerates domain configuration.
.github/workflows/spec-enforcer.lock.yml	Regenerates domain configuration.
.github/workflows/smoke-ci.lock.yml	Regenerates domain configuration.
.github/workflows/schema-consistency-checker.lock.yml	Regenerates domain configuration.
.github/workflows/pr-sous-chef.lock.yml	Regenerates domain configuration.
.github/workflows/pr-code-quality-reviewer.lock.yml	Regenerates domain configuration.
.github/workflows/poem-bot.lock.yml	Regenerates domain configuration.
.github/workflows/lint-monster.lock.yml	Regenerates domain configuration.
.github/workflows/eslint-monster.lock.yml	Regenerates domain configuration.
.github/workflows/daily-news.lock.yml	Regenerates domain configuration.
.github/workflows/daily-hippo-learn.lock.yml	Regenerates domain configuration.
.github/workflows/daily-function-namer.lock.yml	Regenerates domain configuration.
.github/workflows/daily-doc-updater.lock.yml	Regenerates domain configuration.
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml	Regenerates domain configuration.
.github/workflows/commit-changes-analyzer.lock.yml	Regenerates domain configuration.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml	Regenerates domain configuration.
.github/workflows/auto-triage-issues.lock.yml	Regenerates domain configuration.
.github/workflows/agent-persona-explorer.lock.yml	Regenerates domain configuration.
.github/workflows/ab-testing-advisor.lock.yml	Regenerates domain configuration.

Review details

• Files reviewed: 30/206 changed files
• Comments generated: 3
• Review effort level: Balanced

[Copilot]

@copilot this PR still needs forward progress. Please refresh the branch, resolve the remaining merge state, and then run the pr-finisher skill before handing back for review.

Run: https://github.c...

Branch merged with origin/main, conflicts resolved, and lock files regenerated in 4e84503. Tests pass.

@copilot resolve the merge conflicts on this branch.

Merge conflicts resolved (all were in generated .lock.yml files) and lock files regenerated with make recompile in 4e84503.

[pelikhan]

/smoke-copilot

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this issue comment. Sources say the story is developing...

[github-actions]

Smoke Test Summary — Run 32755907509

PR: "Move Copilot vendor API and telemetry domains out of engine defaults"

✅ github tool (gh-proxy) · ✅ mcpscripts-gh · ❌ Serena find_symbol (no Go/Node) · ✅ Playwright · ✅ web-fetch · ✅ file+bash · ✅ discussion comment · ✅ build · ✅ artifact upload · ✅ discussion create · ✅ workflow dispatch · ✅ PR review tools · ✅ comment memory · ✅ sub-agent · ✅ check run · ✅ LSP TS (12 functions)

Overall status: FAIL (1 of 16 tests failed)

cc @pelikhan @Copilot

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · copilot · auto · 42.7 AIC · ⌖ 2.21 AIC · ⊞ 9.1K · ◷
_{Comment /smoke-copilot to run again
Add label smoke to run again}

[github-actions]

Comment Memory

Code compiles at dawn
Copilot tests run in loops
Green checks light the way

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · copilot · auto · 42.7 AIC · ⌖ 2.21 AIC · ⊞ 9.1K · ◷
_{Comment /smoke-copilot to run again
Add label smoke to run again}

[github-actions]

Automated smoke-test review (test #12).

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · copilot · auto · 42.7 AIC · ⌖ 2.21 AIC · ⊞ 9.1K
_{Comment /smoke-copilot to run again
Add label smoke to run again}

Comments that could not be inline-anchored

.github/aw/network.md:1

Smoke test: automated inline review comment (test #12).

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.5