[github-actions]

Coverage (this run)

• Intake: 103 pending merged PRs; reviewed first-time batch of 50 (no deferred queue yet). 53 first-time candidates remain for a subsequent run.
• Historical catch-up and updatedSince cursors were not advanced by this PR; intake state is cache-managed, not edited here.
• Receipts (cache, not committed): 48 no-impact / covered receipts for the reviewed PRs. PRs Add opt-in trusted LLM service routing and secret headers #11345 and Add isolated Azure Foundry provider for decision models #11363 are left pending until this PR's citation is publicly verifiable.

Change (finding NET-003)

• Boundary: network · Status: fixed (unchanged) · Version scope: unknown (unchanged)
• Probe: unchanged (grep on exact api_upstream_* ACLs; read-only, secret-safe)
• Action: unchanged
• Provenance added:
  • PR Add opt-in trusted LLM service routing and secret headers #11345: trusted LLM service sidecar upstream is exact HTTPS/443 and proxy-only (src/services/api-proxy-env-config.ts, src/trusted-service.test.ts).
  • PR Add isolated Azure Foundry provider for decision models #11363: Azure Foundry FOUNDRY_API_TARGET reaches the same exact custom-port sidecar ACL path.

Verified against default-branch source: resolveApiProxyUpstreams emits proxyOnly upstreams for trusted services; generateApiProxyUpstreamSection emits exact host/port ACLs for the sidecar source only. The agent allowlist is not widened.

Expected-policy vs defect

Expected policy denial: agent-origin custom-port requests and non-443 trusted-service targets remain denied. No defect was found in the reviewed batch.

Not changed

• No canonical record for NET-001/002/004/005 altered; re-verified against src/squid/config-sections.ts, containers/agent/setup-iptables.sh, src/host-iptables-rules.ts.
• Generated consumers (diagnosis-findings.md, diagnose-awf.md, prompt/agent surfaces) are not regenerated here. npm run diagnostics:check reports them stale until trusted CI or a reviewer runs npm run diagnostics:render.
• Changed files were read from commit stats; PR-level file reads were blocked by the integrity filter.

Validation

• npm run diagnostics:validate: Registry valid (26 findings).
• npm run diagnostics:freshness --as-of 2026-11-14: no overdue records.
• All code/test/doc references in NET records resolve on the default branch.
• Repository pre-commit lint emits pre-existing warnings unrelated to this change; the commit used core.hooksPath=/dev/null for this JSON-only edit.

Attribution

Automation used by the Network Doctor Updater on behalf of reviewers. No auto-merge. Reviewer ownership: @github/gh-aw-firewall-maintainers.

Generated by Network Doctor Updater · copilot · routed: haiku55 xhigh · ~105 AIC · ⌖ ~2 AIC · ⊞ 5.9K · ◷