docs: sync schemas and specs with source changes

[github-actions]

Summary

Adds reasoning_tokens to schemas/token-usage.schema.json.

Triggered by

Commit 58f77fd — fix: add Gemini usageMetadata support to token parsers (#6008)

What changed

token-parsers.js introduced buildGeminiUsage(), which maps Gemini's usageMetadata.thoughtsTokenCount → reasoning_tokens in the normalized usage object. The normalizeUsage() function already always emitted reasoning_tokens (from OpenAI o-series / Anthropic thinking blocks). However, the reasoning_tokens field was absent from schemas/token-usage.schema.json, so the schema did not document a field that is actively written to every token-usage.jsonl record.

Change made

Added reasoning_tokens property to schemas/token-usage.schema.json:

"reasoning_tokens": {
  "type": "integer",
  "minimum": 0,
  "description": "Number of reasoning/thinking tokens (OpenAI o-series, Anthropic thinking, Gemini thoughtsTokenCount). Zero when the model does not emit reasoning tokens."
}

No changes needed

• docs/awf-config.schema.json — src/cli.ts and src/config-file.ts changes are file refactors with no new CLI flags or config fields.
• schemas/audit.schema.json — src/squid-config.ts and src/logs/log-parser.ts changes are facade re-exports, no new log fields.
• schemas/README.md — schema structure unchanged.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Schema & Spec Sync · 134.3 AIC · ⌖ 8.64 AIC · ⊞ 5.7K · ◷

[lpcox]

@copilot merge main

[Copilot]

@copilot merge main

This branch is already up to date with main — it branches directly off 58f77fd (the current tip of main), so there's nothing to merge.

[Copilot]

Pull request overview

Updates the token-usage JSON schema so it accurately reflects fields that the api-proxy already emits, specifically documenting reasoning_tokens in token-usage.jsonl records.

Changes:

• Add reasoning_tokens to schemas/token-usage.schema.json with non-negative integer constraints and a clarifying description.

Show a summary per file

File	Description
schemas/token-usage.schema.json	Documents the reasoning_tokens field in the token usage schema to match actual normalized usage output (including Gemini’s thoughtsTokenCount).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Low

[github-actions]

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.92%	98.92%	➡️ +0.00%
Statements	98.87%	98.87%	➡️ +0.00%
Functions	99.44%	99.44%	➡️ +0.00%
Branches	95.39%	95.35%	📉 -0.04%

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

✅ Smoke Gemini completed. All facets verified. 💎

Smoke test completed. File writing and bash tool tests passed. Connectivity and GitHub MCP tests failed.

[github-actions]

✅ Build Test Suite completed successfully!

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

✅ Smoke Claude passed

[github-actions]

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

[github-actions]

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

[github-actions]

✅ Contribution Check completed successfully!

PR #6014 follows the applicable CONTRIBUTING.md guidelines; no contribution-guidelines comment needed.

[github-actions]

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

[github-actions]

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

🔌 Smoke Services — All services reachable! ✅

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

[github-actions]

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6014 · 35.1 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

• Redis PING: ❌ Network is unreachable
• PostgreSQL pg_isready: ❌ No response
• PostgreSQL SELECT 1: ❌ Network is unreachable

Overall: FAIL — host.docker.internal (172.17.0.1) is unreachable from this runner environment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Gemini Engine Validation

• PR Titles: fix: add Gemini usageMetadata support to token parsers #6008 fix: add Gemini usageMetadata support to token parsers ❌ (only 1 found, no MCP tools)
• Connectivity: ❌ (000, DNS SERVFAIL)
• File Writing: ✅
• Bash Tool: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test passed
✅ BYOK inference via api-proxy → api.githubcopilot.com
✅ MCP connectivity verified

Status: PASS
Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY via api-proxy sidecar)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot PAT Auth — PASS ✅

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	✅
File write/read	✅

Overall: PASS | Auth mode: PAT (COPILOT_GITHUB_TOKEN)
@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

[github-actions]

🔬 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅ MCP reachable
GitHub.com HTTP connectivity	❌ Pre-step data unavailable (template not substituted)
File write/read	❌ Pre-step data unavailable (template not substituted)

Overall: FAIL — workflow pre-step outputs (${{ steps.smoke-data.outputs.* }}) were not substituted into this step.

@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed — smoke-chroot label not applied.

Python and Node.js versions differ between host and chroot environments. Go matches.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
Module Loading	✅	otel.js loads successfully; exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled
Test Suite	✅	59 tests passed, 0 failed (otel.test.js + otel-fanout.test.js)
Env Var Forwarding	✅	api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, GITHUB_AW_OTEL_TRACE_ID, GITHUB_AW_OTEL_PARENT_SPAN_ID, OTEL_SERVICE_NAME
Token Tracker Integration	✅	onUsage callback present in token-tracker-http.js as OTEL hook point
OTEL Diagnostics	✅	FileSpanExporter graceful-degradation verified by tests; fan-out and single-endpoint export also tested

All scenarios pass. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6014 · 64.6 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

@lpcox

• GitHub MCP Testing: ✅
• GitHub.com Connectivity: ✅
• File Write/Read Test: ✅
• BYOK Inference Test: ✅
  Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
  Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}