Fix AI Gateway model registration and runtime routing

[Paul Yuknewicz (paulyuk)]

Problem

• Fresh azd up fails ARM validation with Invalid field 'counterKey' specified for both registered models.
• After manually correcting that field, provisioning reaches postprovision but model inference returns HTTP 404 and agent services are skipped.

Root cause

Two AI Gateway control-plane contracts had changed or were missing from the sample:

1. Token-limit counterKey is represented as an array containing lowercase identity, not the older scalar Identity value.
2. A provider model registration does not by itself create the runtime /default/models/... route. Each model also requires a default-workspace alias at Microsoft.ApiManagement/service/workspaces/aliases that targets the provider model resource. The current AI Gateway portal creates this alias after importing a model; the sample Bicep did not.

Without the alias, the provider and model resources report Succeeded, but runtime inference returns 404 Resource not found indefinitely.

Fix

• Emit counterKey: ['identity'] in the token-limit policy.
• Provision a workspace alias for every Foundry provider model and point it at the corresponding catalog model resource.
• Keep the existing bounded route readiness probe and improve its terminal error text.
• Add focused compiled-Bicep assertions for both the counter-key shape and alias target.
• Document the alias/runtime routing requirement.

Validation

• bash tests/test-ai-gateway-model-registration.sh
• PYTHONPATH=. uv run --with pytest pytest -q — 11 passed, 3 subtests passed
• Bash syntax, PowerShell parser, and git diff --check
• azd provision -e aigw-quickstart-fix1 --no-prompt completed successfully from the updated Bicep
• Verified Bicep created aliases for gpt-latest and gpt-mini-latest
• Verified both gateway Chat Completions calls return HTTP 200

[Paul Yuknewicz (paulyuk)]

test verified. and caught cause when model alias not set:

Provisioning and deploying (azd up)
Packaging overlaps with provisioning for faster execution.

  You can view detailed progress in the Azure Portal:
  https://portal.azure.com/#view/HubsExtension/DeploymentDetailsBlade/~/overview/id/%2Fsubscriptions%2F<subscription-id>%2Fproviders%2FMicrosoft.Resources%2Fdeployments%2F<deployment-name>

  (✓) Done: Resource group: rg-<environment>-<suffix>-foundryagents (3.02s)
  (✓) Done: Resource group: rg-<environment>-<suffix>-foundrymodels (3.004s)
  (✓) Done: Resource group: rg-<environment>-<suffix>-gateway (3.004s)
  (✓) Done: Container Registry: acr<suffix> (23.689s)
  (✓) Done: Foundry: aiagents-<suffix> (23.365s)
  (✓) Done: Storage account: st<suffix> (24.122s)
  (✓) Done: Log Analytics workspace: aiagents-<suffix>-logs (24.379s)
  (✓) Done: Foundry: aimodels-<suffix> (22.245s)
  (✓) Done: Application Insights: aiagents-<suffix>-appinsights (27.567s)
  (✓) Done: Azure AI Services Model Deployment: aimodels-<suffix>/gpt-mini-latest (3.548s)
  (✓) Done: Foundry project: aiagents-<suffix>/proj-<suffix> (4.555s)
  (✓) Done: Azure AI Services Model Deployment: aimodels-<suffix>/gpt-latest (9.148s)
  (✓) Done: Foundry project connection: aiagents-<suffix>/proj-<suffix>/st<suffix> (4.253s)
  (✓) Done: Log Analytics workspace: aigw-<suffix>-logs (22.321s)
  (✓) Done: Application Insights: aigw-<suffix>-insights (24.087s)
  (✓) Done: Foundry project connection: aiagents-<suffix>/proj-<suffix>/acr<suffix>-conn (744ms)
  (✓) Done: Azure API Management: aigw-<suffix> (1m50.753s)

Finishing the Bicep-provisioned AI Gateway with the local GitHub MCP credential.
Warning: Using a broad, account-wide GitHub credential (OAuth or classic token). It works, but the postprovision hook stores it in the cloud AI Gateway ToolServer. For the least-privilege fix (GitHub portal and command-line steps), open IMPLEMENTATION_NOTES.md#tighten-the-github-credential-to-least-privilege
Continuing with the selected GitHub credential. See the warnings above to tighten it to least privilege.
Using the active GitHub CLI login for GitHub MCP.
Injecting the read-only GitHub MCP credential into the Bicep-provisioned ToolServer.
AI Gateway model route is ready.
Connecting Foundry Toolbox to the AI Gateway GitHub ToolServer.
Creating the Foundry Toolbox.
<timestamp> toolbox create: resolved project endpoint https://aiagents-<suffix>.services.ai.azure.com/api/projects/proj-<suffix> (source=flag)
AI Gateway setup complete. Bicep owns Azure resources; this hook injects the GitHub credential, connects Foundry Toolbox to AI Gateway, and saves the runtime key.

  Service                                       Status        Duration
  ────────────────────────────────────────────  ────────────  ──────────
  ● ai-project                                    Done
  ● simple-foundry-hosted-agent-python-aigateway  Done          1m58s
  ● daily-repo-digest                             Done          2m2s

- Agent playground (portal): <redacted-agent-playground-url>
- Agent endpoint (responses): https://aiagents-<suffix>.services.ai.azure.com/api/projects/proj-<suffix>/agents/simple-foundry-hosted-agent-python-aigateway/endpoint/protocols/openai/responses?api-version=v1

Next:
  azd ai agent show simple-foundry-hosted-agent-python-aigateway
  verify it's running

  see README.md
  find the sample-specific payload

  azd ai agent invoke simple-foundry-hosted-agent-python-aigateway '<payload>'
  test with the sample-specific payload

SUCCESS: Your application was provisioned and deployed to Azure in 7 minutes 31 seconds.
  Provisioning: 5 minutes 33 seconds
  Deploying:    2 minutes 2 seconds