Repoint the Smoke Claude engine off claude-opus-4-8 (or get that model allow-listed) — it is now a deterministic 403 that keeps the Claude smoke canary red on every run.
Parent: #46171
Problem statement
The claude engine terminates on the first API request with a non-retryable 403 model_policy_violation; claude-opus-4-8 is explicitly disallowed by the account model policy, so the smoke canary never does any work (0 turns, 0 tokens).
403 {"error":{"type":"model_policy_violation","message":"Model 'claude-opus-4-8' is not permitted: it is explicitly disallowed by the model policy.","model":"claude-opus-4-8","reason":"disallowed"}}
The claude-harness classifies it isAuthenticationFailedError=true and does not retry (first-attempt auth failure is non-retryable), so the Execute Claude Code CLI step exits 1.
Affected workflows & run IDs
Probable root cause
The smoke workflow / engine default resolves to claude-opus-4-8[1m], but the API key's model policy explicitly disallows claude-opus-4-8. Either the policy changed (opus removed from the allow-list) or the smoke config was never pinned to a policy-permitted model.
Proposed remediation
- Pin Smoke Claude to a model the account policy permits (e.g. a currently-allowed Sonnet/Haiku tier) instead of
claude-opus-4-8, or add claude-opus-4-8 to the account model allow-list if it is meant to be available.
- Surface
model_policy_violation distinctly in the harness so it is not silently bucketed as a generic auth failure.
Success criteria / verification
Generated by 🔍 [aw] Failure Investigator (6h) · 136.1 AIC · ⌖ 36.6 AIC · ⊞ 5.2K · ◷
Repoint the Smoke Claude engine off
claude-opus-4-8(or get that model allow-listed) — it is now a deterministic 403 that keeps the Claude smoke canary red on every run.Parent: #46171
Problem statement
The
claudeengine terminates on the first API request with a non-retryable 403model_policy_violation;claude-opus-4-8is explicitly disallowed by the account model policy, so the smoke canary never does any work (0 turns, 0 tokens).The claude-harness classifies it
isAuthenticationFailedError=trueand does not retry (first-attempt auth failure is non-retryable), so theExecute Claude Code CLIstep exits 1.Affected workflows & run IDs
.github/workflows/smoke-claude.lock.yml)Probable root cause
The smoke workflow / engine default resolves to
claude-opus-4-8[1m], but the API key's model policy explicitly disallowsclaude-opus-4-8. Either the policy changed (opus removed from the allow-list) or the smoke config was never pinned to a policy-permitted model.Proposed remediation
claude-opus-4-8, or addclaude-opus-4-8to the account model allow-list if it is meant to be available.model_policy_violationdistinctly in the harness so it is not silently bucketed as a generic auth failure.Success criteria / verification
Execute Claude Code CLIstep.model_policy_violationfor the configured model across 3 consecutive scheduled runs.Related to [aw-failures] [aw] Failure Investigator (6h) - Issue Group #46171