fix(copilot): terminate requests on negotiated model scope denial

[luvs01]

Summary

Recheck GitHub Copilot Auto's negotiated provider/model against the request key's scope before changing the route or dispatching inference.

• Apply the check to initial negotiation, renewed sessions, and account changes.
• Treat scope denials as terminal local refusals across account/combo recovery and streaming continuations.
• Preserve the non-replayable response marker through body and account-lease finalization so response wrapping cannot turn a refusal into a retry.
• Cover allowed and denied selections, recovery paths, and terminal continuations; update the routing contract and user guide.

Verification

Current head: 61d5ce2137c1b0ee0f18724929b0b7fe02698791.

• Bun 1.4.3: bun test --isolate --timeout 60000 tests/providers/github-copilot/github-copilot-auto-runtime.test.ts — 68 passed, 0 failed.
• The new regression first reproduced a missing typed scope refusal after an initial successful response, a continuation 429, and OAuth account B negotiation. Before the fix it emitted the original rate-limit error; after the fix it emits model_not_allowed_for_key and sends no inference to the forbidden destination.
• bun run typecheck, bun run structure:check, and git diff --check passed.
• Current-head aggregate CI passed on 61d5ce213.
• A full local repository run was not repeated across the active worktrees. The focused runtime file covers the changed recovery branch; completed hosted CI supplies broader coverage.
• Review-thread inspection found no unresolved findings or outstanding change requests.

Checklist

• Scope is checked before inference dispatch.
• Refusal identity survives response and continuation boundaries.
• Regression coverage, documentation, and current-head CI evidence are recorded.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 63261153-7461-4c0c-a335-a47b171ee252

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[luvs01]

No description provided.

[luvs01]

No description provided.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

Closing duplicate tracking after preserving the complete change in independently verified integration commit f00eb618c46746478853a3dac89151ccacfbb05a based on development revision 6da2774369aa32552e318e333902499683d053bc. All 9 changed files match source HEAD 61d5ce2137c1b0ee0f18724929b0b7fe02698791 byte for byte. Pinned Bun 1.4.3 runtime coverage passed 68 tests with 930 assertions. Type, structure, materialized-file privacy and diff checks passed. Integration remains unmerged and requires its own CI and maintainer review. The source branch is retained.