Add explicit top-level ET budget control and ET-limit failure attribution

[Copilot]

New Feature

What does this feature do?

This adds a first-class effective-token (ET) budget control to workflows via top-level max-effective-tokens (default 10_000_000) and routes ET budget/rate-limit failures through conclusion reporting. Failures are now attributed to ET budget/rate-limit enforcement instead of run-count heuristics.

Why is this feature needed?

Run counts are an unreliable cost proxy; ET is the actual budget/control plane used by the firewall and the most accurate signal for post-run diagnosis.

Implementation details

• Frontmatter + compiler model

  • Added top-level max-effective-tokens parsing to workflow config handling.
  • Added schema support in main workflow schema at the top level.
  • Added default constant (10000000) and getter fallback behavior.
  • Supports integer and numeric-string forms.

• AWF enforcement path

  • Extended generated AWF config with apiProxy.maxEffectiveTokens.
  • Applied ET budget to both primary agent execution and detection execution paths (shared AWF config path).

• ET-limit/rate-limit detection

  • Added MCP gateway log pattern detection for ET budget/rate-limit failures.
  • Exposed effective_tokens_rate_limit_error as step output and agent job output.

• Conclusion failure attribution

  • Plumbed ET signals into failure handling (GH_AW_EFFECTIVE_TOKENS, GH_AW_MAX_EFFECTIVE_TOKENS, GH_AW_EFFECTIVE_TOKENS_RATE_LIMIT_ERROR).
  • Added ET-focused failure context in issue/comment templates and rendering path.

max-effective-tokens: 10000000
engine:
  id: copilot

Generated AWF config now includes:

{
  "apiProxy": {
    "enabled": true,
    "maxEffectiveTokens": 10000000
  }
}

[Copilot]

Pull request overview

Adds explicit Effective Token (ET) budget configuration (engine.max-effective-tokens, defaulting via a new constant) and propagates ET-budget / ET-related rate-limit signals into workflow outputs and conclusion failure attribution.

Changes:

• Parse and expose engine.max-effective-tokens, including a default fallback (DefaultMaxEffectiveTokens).
• Inject apiProxy.maxEffectiveTokens into generated AWF config and propagate ET usage + ET rate-limit detection signals to downstream jobs.
• Detect ET budget/rate-limit failures from MCP gateway logs and surface them in failure issue/comment templates.

Show a summary per file

File	Description
pkg/workflow/engine.go	Adds MaxEffectiveTokens to EngineConfig, parsing of max-effective-tokens, and a defaulting getter.
pkg/constants/constants.go	Introduces DefaultMaxEffectiveTokens default budget constant.
pkg/parser/schemas/main_workflow_schema.json	Adds schema support for engine.max-effective-tokens (int or numeric string).
pkg/workflow/awf_config.go	Adds apiProxy.maxEffectiveTokens to generated AWF config JSON using engine-config defaulting.
pkg/workflow/schemas/awf-config.schema.json	Extends AWF config schema to allow apiProxy.maxEffectiveTokens.
pkg/workflow/awf_config_test.go	Adds assertions/tests for default and overridden maxEffectiveTokens in AWF config JSON.
pkg/workflow/compiler_main_job.go	Exposes effective_tokens_rate_limit_error as an agent job output.
pkg/workflow/notify_comment.go	Passes ET usage / ET rate-limit flag and max ET budget into conclusion job env for attribution.
pkg/workflow/threat_detection.go	Ensures detection engine runs inherit MaxEffectiveTokens.
actions/setup/js/parse_mcp_gateway_log.cjs	Adds ET budget / rate-limit log detection and exports effective_tokens_rate_limit_error output.
actions/setup/js/parse_mcp_gateway_log.test.cjs	Adds unit tests for the new ET/rate-limit detection helper.
actions/setup/js/handle_agent_failure.cjs	Adds ET-focused failure context rendering and uses ET signals in failure attribution logic.
actions/setup/md/agent_failure_issue.md	Adds {effective_tokens_rate_limit_error_context} placeholder to failure issue template.
actions/setup/md/agent_failure_comment.md	Adds {effective_tokens_rate_limit_error_context} placeholder to failure comment template.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden	Updates golden workflow output + AWF config JSON to include ET budget and rate-limit output.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden	Updates golden workflow output + AWF config JSON to include ET budget and rate-limit output.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden	Updates golden workflow output + AWF config JSON to include ET budget and rate-limit output.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden	Updates golden workflow output + AWF config JSON to include ET budget and rate-limit output.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 19/19 changed files
• Comments generated: 2

[pelikhan]

@copilot move max-effective-tokens to top level property, not under engine.

[Copilot]

@copilot move max-effective-tokens to top level property, not under engine.

Done in 4f90913. max-effective-tokens is now a top-level frontmatter property (removed from engine), with parser/schema/tests updated accordingly.