Copilot writes Claude model versions with a dot (claude-haiku-4.5), but Anthropic uses a hyphen (claude-haiku-4-5). Claude Code doesn't recognise the Copilot id, so it falls back to guessed defaults, including reasoning effort high. Copilot rejects that effort for Haiku 4.5 with 400 invalid_reasoning_effort, which fails smoke-claude-on-copilot on every run. The other dotted models run on a guessed 200k-token context window.

Compiler (pkg/workflow)

• claude_copilot_model_overrides.go (new): a static list of the Copilot Claude ids in the catalog. From it, the compiler builds a fixed-order --settings JSON value that maps each Anthropic id to the Copilot id for the 11 dotted ids. Ids that already match (claude-sonnet-5, claude-opus-5, claude-fable-5, claude-sonnet-4) get no entry.
• claude_engine.go: when the resolved provider is GitHub (model-provider: github or a copilot/ prefix), --settings <map> is added to the Claude Code command. The map doesn't depend on the model, so fixed, run-time (ANTHROPIC_MODEL) and routed models all get it. The Anthropic provider's output is unchanged.
• Workflow-provided --settings (--settings X or --settings=X, in engine.args or safe-outputs.threat-detection.engine.args): it is kept as is, nothing is added, and compilation emits a warning (configured_model_validation.go).

claude ... --settings '{"modelOverrides":{"claude-fable-5-1":"claude-fable-5.1","claude-haiku-4-5":"claude-haiku-4.5",...}}' ...

Threat detection

• Default (Claude-on-Copilot workflow): still runs threat-detect --engine copilot, with no map.
• threat-detection.engine: {id: claude, model-provider: github}, inline path (features.gh-aw-detection: false): uses gh-aw's Claude command builder, so it gets --settings directly.
• Same engine, external threat-detect --engine claude path: threat-detect builds its own Claude Code arguments, so the detection step instead sets GH_AW_CLAUDE_SETTINGS. claude_harness.cjs appends it as --settings unless the arguments already have one. Covered from gh-aw only; github/gh-aw-threat-detection is unchanged. threat-detect launches Claude Code through the harness only when the harness file is present; without it, the map doesn't reach Claude Code.

Catalog drift guard

• models.json is embedded in pkg/cli and isn't reachable from pkg/workflow. pkg/cli/model_costs_claude_copilot_ids_test.go fails if the compiler's list drifts from the github-copilot Claude ids in models.json. models.json itself is unchanged.

Lock files and docs

• Recompiled the six Claude-on-Copilot smoke workflows (one-line agent-command change each).
• docs/.../engines/claude.md documents the map and how a workflow-provided --settings is handled.

Notes for reviewers

• Acceptance cases 1–2 need live runs: dispatch smoke-claude-on-copilot and smoke-claude-routed on this branch. smoke-claude-routed's allowed-models is intentionally left unchanged.
• These failures are unrelated to this change:
  • pkg/cli and actions/setup session-parser tests fail with Cannot find module './otlp_header_helpers.cjs'. Two of them were re-run without this change and fail the same way.
  • TestAgentExecutionNumericReaderParity also fails. It was not re-run without this change.

• Fixes Claude on Copilot: pass Claude Code a modelOverrides map for Copilot's dotted Claude model ids (smoke-claude-on-copilot 400 invalid_reasoning_effort) #68834