fix(compile): downgrade AWF for host access (#1526)

* Initial plan

* fix(compile): downgrade AWF for host access

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

Author: Copilot

src/compile/common.rs

@@ -1410,7 +1410,7 @@ pub fn generate_stage_prefix(name: &str) -> String {
 /// Version of the AWF (Agentic Workflow Firewall) binary to download from GitHub Releases.
 /// Update this when upgrading to a new AWF release.
 /// See: <https://github.com/github/gh-aw-firewall/releases>
-pub const AWF_VERSION: &str = "0.27.32";
+pub const AWF_VERSION: &str = "0.27.9";
 
 /// Prefix used to identify agentic pipeline YAML files generated by ado-aw.
 pub const HEADER_MARKER: &str = "# @ado-aw";

tests/compiler_tests.rs

@@ -191,6 +191,14 @@ fn test_compiled_output_no_unreplaced_markers() {
         compiled.contains("github.com/github/gh-aw-firewall/releases"),
         "Compiled output should reference GitHub Releases for AWF"
     );
+    assert!(
+        compiled.contains("AWF_VERSION=\"0.27.9\""),
+        "Compiled output should download the AWF version compatible with host-access"
+    );
+    assert!(
+        !compiled.contains("AWF_VERSION=\"0.27.32\""),
+        "Compiled output should not download AWF v0.27.32"
+    );
 
     // Verify MCPG references
     assert!(