[CI Failure Doctor] codex/claude LLM gateway support mismatch breaks workflow tests

[github-actions]

🏥 CI Failure Investigation - Run #35585

Summary

Go unit tests fail in the test job because the SupportsLLMGateway flags for the built-in engines were inverted relative to the expectations encoded in strict_mode_llm_gateway_test.go.

Failure Details

• Run: 22009556291
• Commit: bdbae2b
• Trigger: push

Root Cause Analysis

The Codex engine declaration set supportsLLMGateway=false while the Claude engine declared supportsLLMGateway=true, but the strict-mode tests treat Codex as the only engine that supports the API proxy and expect Claude to behave like Copilot (LLM gateway unsupported). That mismatch causes multiple assertions in TestSupportsLLMGateway and TestValidateStrictFirewall_LLMGatewaySupport to fail before any specific test fails.

Failed Jobs and Errors

• test: go test ./pkg/workflow (fails early): TestSupportsLLMGateway reported "Engine 'codex': expected SupportsLLMGateway() = true, got false" and "Engine 'claude': expected SupportsLLMGateway() = false, got true"; the failure report identifies the strict firewall validation test as the first failing target because the support map is inverted.

Investigation Findings

• The strict-mode firewall rules rely on each engine's SupportsLLMGateway flag to decide whether to accept custom network domains or require sandbox.agent in strict mode.
• The registry uses the BaseEngine boolean values, so swapping supportsLLMGateway for Codex and Claude immediately satisfies all assertions.

Recommended Actions

• Swap supportsLLMGateway so Codex reports true and Claude reports false in their engine constructors (done in this run).
• Re-run the go test ./pkg/workflow suite once Go 1.25 becomes available in the environment to confirm no lingering failures.

Prevention Strategies

Ensure changes to engine capability declarations stay in sync with the strict-mode tests by adding a lint or CI check that validates the engine registry against the expected capability table whenever these constructors change.

AI Team Self-Improvement

When adding or modifying engine capability flags, double-check strict_mode_llm_gateway_test.go and related firewall validations to ensure the updated flags match the documented expectations for each engine.

Historical Context

No prior investigations matching this failure pattern are currently open; this was the first run (22009556291) reporting the mismatch.

🩺 Diagnosis provided by CI Failure Doctor

To install this workflow, run gh aw add githubnext/agentics/workflows/ci-doctor.md@ea350161ad5dcc9624cf510f134c6a9e39a6f94d. View source at https://github.com/githubnext/agentics/tree/ea350161ad5dcc9624cf510f134c6a9e39a6f94d/workflows/ci-doctor.md.

• expires on Feb 15, 2026, 2:47 AM UTC