[docs] auth: README: correct API proxy sidecar status to always-enabled

[github-actions]

Caution

Protected files were modified in this change.
This pull request is in request-review mode and requires explicit human scrutiny before merge.

Protected files: README.md

Summary

• Scan window: since 2026-09-16 (repo: github/gh-aw-firewall).
• Sources reviewed: README.md, docs/auth-matrix.md, docs/authentication-architecture.md, docs/api-proxy-sidecar.md, docs/environment.md, docs/awf-config-spec.md, docs/github_actions.md, and current implementation (src/cli-options.ts, src/services/agent-environment/excluded-vars.ts, containers/api-proxy/management.js, containers/api-proxy/startup.js, containers/agent/api-proxy-health-check.sh, src/constants/placeholders.ts).
• Also confirmed fix: isolate Actions OIDC from agent container #6894 (isolate Actions OIDC from agent) and Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 (HTTP MCP GitHub OIDC boundary, resolved via Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054) remain resolved/merged — no doc changes needed there; a prior updater run (PR [docs] auth: Mark gh-aw#50053 MCP OIDC boundary work as resolved #7156) already reconciled that language.
• Corrected authentication path: README.md's "How it works" list still described the API proxy sidecar as optional, while src/cli-options.ts shows --enable-api-proxy is a deprecated no-op and --no-enable-api-proxy is rejected at runtime — the sidecar cannot be disabled. This matches the already-correct wording in docs/api-proxy-sidecar.md ("The API proxy sidecar is always enabled") and docs/awf-config-spec.md ("The API proxy sidecar is always started; there is no disabled mode.").
• No other stale, missing, or pending-vs-shipped claims were found in the reviewed files during this scan; Copilot fine-grained-PAT/GHEC auth-prefix behavior (PR Fix Copilot proxy auth and GHEC model discovery #8038) and OIDC exclusion behavior (excluded-vars.ts) both still match documented text and tests.

Documentation Changes

• README.md: Changed the API proxy sidecar bullet in "How it works" from *(optional)* to *(always enabled)*, aligning it with docs/api-proxy-sidecar.md, docs/awf-config-spec.md, and the current CLI implementation.

Validation

• Implementation checked: src/cli-options.ts (--enable-api-proxy deprecated/no-op, --no-enable-api-proxy rejected at runtime), src/services/agent-environment/excluded-vars.ts, containers/api-proxy/management.js, containers/api-proxy/startup.js, containers/agent/api-proxy-health-check.sh, src/constants/placeholders.ts, containers/api-proxy/copilot-auth.test.js, containers/api-proxy/copilot-adapter-enterprise.test.js, containers/api-proxy/copilot-byok.test.js.
• Repository history/context checked: searched merged PRs and issues since 2026-09-16 (no auth/api-proxy/OIDC-relevant merges in that window; recent work was Cloud Hypervisor enclave preview, CI fixes, and dependency bumps), confirmed no open [docs] auth: PRs exist to deduplicate against, and re-verified fix: isolate Actions OIDC from agent container #6894 and Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 status directly via the GitHub API.
• Markdown/link review: single-line prose change, no structural Markdown, links, tables, or code fences touched.
• Credential-leakage diff review: git diff scanned for token/key/JWT patterns and credential-bearing URLs — none found; the only change is the word "optional" → "always enabled".

Sources

• fix: isolate Actions OIDC from agent container #6894
• Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053
• Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054
• [docs] auth: Mark gh-aw#50053 MCP OIDC boundary work as resolved #7156
• Fix Copilot proxy auth and GHEC model discovery #8038
• https://github.com/github/gh-aw-firewall/blob/main/src/cli-options.ts
• https://github.com/github/gh-aw-firewall/blob/main/docs/api-proxy-sidecar.md
• https://github.com/github/gh-aw-firewall/blob/main/docs/awf-config-spec.md

Generated by Auth Doctor Updater · copilot · auto · 138.3 AIC · ⊞ 10.8K · ◷

[github-actions]

Protected files were modified in this pull request and require manual scrutiny before merge.

Please verify that each protected-file change is intentional, policy-compliant, and safe:

• Protected files: README.md

[github-actions]

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

1. Download the docs-preview-pr-8733 artifact from the workflow run
2. Unzip and open index.html in your browser

Built from commit ec76bf3

[lpcox]

@copilot rebase main and resolve conflicts

[Copilot]

@copilot rebase main and resolve conflicts

Merged main into this branch instead of rebasing — a rebase would require a force push, which I can't do. The merge applied cleanly with no conflicts, and the README change is intact.