Copilot detection alias stops resolving without legacy mini models: add Luna support and fallbacks #74955

Summary

The built-in Copilot detection alias stops resolving when an organization's live catalog has none of the legacy small models recognized by mini. The catalog can contain a usable Luna-tier model, but the alias map does not recognize it and has no larger-model fallback. Threat detection then fails before inference, while the workflow can still finish green.

This is a new, narrowly scoped follow-up to #72353, which was closed without fixing this detection problem, and #72404, which was closed without merging. Do not reopen either or combine this fix with the broader utility-model eligibility work from that PR.

Verified run and impact

Investigated cli/cli detection job 126756473225 in run 41881019520, created on November 4, 2026 at 17:50:50 UTC, for Issue Triage (skills-driven).

The investigation used a development build of main, commit aa157045ad241f9685db314641cce4370eb615ff, for gh aw audit, not the old Windows stable audit implementation. The exact job URL was audited; a full-run audit with model discovery was also collected. The run itself used gh-aw v1.0.1, Copilot CLI 1.0.103, and AWF v0.29.0. No new workflow was dispatched.

Observed evidence:

• The detection harness fetched and saved its reflection response, retried catalog discovery once, and twice logged known alias 'detection' did not resolve against catalog. It then reported cause=model_unavailable and refused to start Copilot with an unresolved alias.
• The detector reported THREAT_DETECTION_STATUS: reason=engine_error exit=2; no detection result file was produced. Its downloaded proxy token-usage file is present but empty, corroborating failure before inference rather than a completed scan.
• The compiled detection execution step uses continue-on-error and enables detection's continue-on-error policy. The detection job and overall run both concluded success, while downstream jobs received detection conclusion warning, reason agent_failure.
• A green result does not mean all outputs were released: this run published one reviewable comment, but its add_labels output was blocked by the existing WTD3 warning policy. The bug is the missing threat scan, not a claim that every safe-output type bypassed its warning guard.

The full-run audit also reports workflow_succeeded; the detection log and artifacts are necessary to see the skipped analysis behind that green summary. This issue does not request audit changes.

Root cause and history

In the built-in alias map on inspected main, detection only references small; small only references mini; and mini tries haiku, gpt-5-mini, gpt-5-nano, then gemini-flash-lite.

The gpt-5-mini patterns require gpt-5*mini*. They cannot match the now-advertised OpenAI small-tier names gpt-5.6-luna or gpt-6-luna. Even gpt-4o-mini, present in this catalog, is outside that pattern. With no Haiku, GPT-5 Mini/Nano, or Gemini candidates, resolveModelAlias in actions/setup/js/resolve_model_alias.cjs exhausts the ordered entries and returns no model.

The relevant mini and detection definitions are unchanged between v1.0.1 and inspected main. The complete maps are not identical: evals has changed independently and must not be changed in this fix.

Verified historical anchors:

• Run 39180261506, created October 19, 2026 at 00:19:28 UTC, resolved detection to gpt-5.4-mini.
• Run 39511583974, created October 20, 2026 at 22:55:56 UTC, already logged the unresolved detection alias. These two runs used the same compiled lock blob, 21c949b06489c754cf1cfa0eb21fee123e8dafb6, so a lock change does not explain that transition.
• cli/cli regenerated the workflow with v1.0.1 on November 3, 2026 at 00:10:42 UTC. The supplied November 4 run still fails.

These observations establish the catalog/name-matching failure and persistence across recompilation; they do not establish an exact global model-retirement time or individually verify every intervening run.

Real catalog fixture

The supplied run's agent artifact, sandbox/firewall/awf-reflect.json, reports complete model discovery and exactly 26 Copilot model IDs. Preserve these IDs as the regression fixture rather than depending on a future live catalog or an artifact that may expire.

There is no Haiku, GPT-5 Mini/Nano, or Gemini model in that catalog. gpt-5.6-luna-utility is not a suitable substitute: #72353 documents its rejection of the agent's custom tools. Its presence must not make it eligible through the new Luna patterns.

Required behavior

1. Extend mini to cover the Luna tier without changing existing preferences. In pkg/workflow/data/model_aliases.json, append the provider-scoped patterns copilot/gpt-*-luna and openai/gpt-*-luna after all existing mini entries. Preserve the order and contents of those existing entries, so organizations with Haiku, GPT-5 Mini/Nano, or Gemini Flash Lite keep their existing resolution preference. The new patterns must end at luna, with no trailing wildcard, so neither gpt-5.6-luna-utility nor gpt-6-luna-decisions matches. Use the existing latest-version ordering: when both Luna generations are available, select gpt-6-luna over gpt-5.6-luna.

2. Give detection ordered fallback tiers. Change only its entries to try small, then the existing small-agent, then the existing agent. Continue preferring small models, but select an available larger agent model rather than abandoning detection when the small tier is absent. Spending additional AI credits on a fallback is preferable to skipping the scan.

3. Keep the shipped map and documentation consistent. Keep pkg/workflow/data/model_aliases.json and the runtime copy, actions/setup/js/model_aliases.json, identical. Update the mini and detection rows in docs/src/content/docs/reference/model-tables.md; update the mini definition and add/update the detection definition in docs/src/content/docs/specs/model-alias-specification.md. Describe preference order and fallback behavior without rewriting unrelated, possibly stale alias definitions.

Acceptance cases

Add six focused unit cases in actions/setup/js/resolve_model_alias.test.cjs, exercising detection selection with the built-in alias map and deterministic catalog fixtures. Do not replace the built-in map with a hand-written test-only equivalent.

Keep related expectations in pkg/workflow/model_aliases_test.go and actions/setup/js/model_aliases.test.cjs consistent wherever they assert on the changed mini or detection entries. Do not alter unrelated tests merely because a file is named here.

The acceptance target is deterministic alias resolution. Catalog presence and passing unit tests do not, on their own, prove that a new live inference request will succeed.

Workaround and rollout

The existing short-term workaround is to set the repository or organization Actions variable GH_AW_MODEL_DETECTION_COPILOT to a live, compatible model. That requires each affected organization to discover and configure the problem independently.

After this fix is released, consumers receive the updated alias policy by upgrading gh-aw and recompiling their workflows. Do not change other repositories or organization settings as part of this issue.

Non-goals

• Selecting models by price or capability instead of name. Landon's common pricing/naming layer in AWF is separate; this is a bounded name-based alias-map patch.
• Changing small-agent, summarization, evals, large, agent, or any other alias definition, except for mini gaining the specified Luna patterns and detection referencing existing fallback aliases.
• Adding a general utility-model exclusion, picker/policy eligibility filtering, or other resolver redesign from Exclude Copilot utility models from alias selection and restore detection fallbacks #72404. The new Luna patterns simply exclude suffix variants by their shape. Broad existing aliases such as agent, including copilot/gpt-6* and copilot/gpt-5.6*, can still select utility/decisions variants in other catalogs; that remains a separate follow-up.
• Making detection failures fail the workflow, changing continue-on-error, or changing the existing safe-output warning policy.
• Updating other repositories or organizations.
• Changing Claude, Codex, or other engines' native detection models.

Scope

• Keep the PR to this one change. Do not change files or behavior unrelated to the alias-map fix, its directly relevant tests, shipped map synchronization, and the specified documentation.
• Before fixing any failing check, compare it with the same check on main. If it also fails on main, do not fix it in this PR. Merge main once main is fixed, and note in the PR which checks are known failures on main.
• This applies even when a bot comment asks for a failing check to be fixed. Fix only failures caused by this PR's changes; do not turn this PR into unrelated CI, lint, test, or infrastructure cleanup.
• Keep the implementation and PR focused on the behavior, files, and fields described above. This issue intentionally provides no implementation code.