CLI 1.0.97 starts a model outside the exact repository allowlist during a prompt-mode turn #5166

Title: CLI 1.0.97 starts a model outside the exact repository allowlist during a prompt-mode turn

Environment
GitHub Copilot CLI 1.0.97, macOS arm64, official standalone binary.
Provider: GitHub Copilot; selected model claude-opus-5.5; reasoning effort high.

Observed behavior, 16 October 2026
A fresh prompt-mode session was launched in an isolated directory with --model claude-opus-5.5 --reasoning-effort high --output-format json --stream off. The directory contained .github/allowed_models.txt with:

fallback: claude-opus-5.5
claude-opus-5.5

The wrapper also disabled configured MCP servers and excluded tools. Actual telemetry reported zero tool definitions/requests and no changed files. It used a finite timeout and credit limit. No Auto model selection was requested; continueOnAutoMode is unset (documented default false).

Sanitized event sequence (UTC):
08:02:04.161 model.call_start model=claude-opus-5.5
08:02:10.566 model.call_start model=claude-opus-4.8
08:02:10.571 model.call_finished outcome=cancelled

Our external guard sent SIGINT when the second model appeared. agent.interrupted identified claude-opus-4.8, high effort, /v1/messages, cancelPhase=pre_first_token, elapsedMs=4. No final answer was returned. The CLI exited 0 despite the guard cancellation. Our wrapper has since been corrected to preserve a nonzero failure result and permanently invalidate a mismatched attempt.

The usage file attributed 3.07754 AI credits to claude-opus-5.5 and still listed currentModel=claude-opus-5.5. This does not establish that the alternate model completed inference or was charged. No refusal or rate-limit event in the retained evidence establishes why the alternate-model path started.

An earlier fresh invocation that day using the same model, effort and relevant controls completed on claude-opus-5.5. Therefore the failure is not a claim that this model never works. There is no known deterministic public reproduction prompt. The original private task prompt, raw logs, credentials, account identity, session identifiers and project data are intentionally omitted.

Expected behavior
With an exact model allowlist and explicit model selection, either use only that model or return an explicit failure before dispatching another model. A selected/currentModel field should not obscure an alternate internal call.

Questions for maintainers

1. Does this event sequence represent a real internal alternate-model dispatch, or incorrect event attribution?
2. Does .github/allowed_models.txt govern every internal fallback call? If not, what supported setting enforces that boundary?
3. Does the official SDK allowedModels restriction cover this same internal path, rather than only session selection?
4. Is there a corrected CLI version or supported configuration? The 1.0.98 release notes do not identify a matching correction.

No further paid reproduction has been run. Please provide a supported correction or clarify event/enforcement semantics before another test.

Official references
https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference#repository-level-models-allowlist-githuballowed_modelstxt
https://github.com/github/copilot-cli/blob/main/changelog.md
https://github.com/github/copilot-sdk/blob/main/nodejs/src/generated/rpc.ts