agentnetwork: tighten comment blocks to <=250 chars

Condense the comments added in this change so each block stays within 250
characters (and well under 140 per line), keeping the essential rationale.
No behaviour change.

proxy/internal/middleware/builtin/llm_guardrail/factory.go

@@ -13,17 +13,10 @@ import (
 // runtime path consumes the normalised allowlists; raw config is not
 // retained beyond construction.
 type Config struct {
-	// ProviderAllowlists maps a resolved provider id (the value llm_router
-	// stamps as KeyLLMResolvedProviderID) to that provider's model allowlist. A
-	// provider present here is restricted to the listed models; a provider
-	// absent is unrestricted. The synthesiser only lists a provider when EVERY
-	// policy authorising it enables an allowlist, so a provider reachable by any
-	// un-guardrailed policy is intentionally absent (unrestricted) here and the
-	// precise per-policy/group decision is left to management. Keeping the gate
-	// per-provider — rather than one account-wide union — is what stops a model
-	// allowlisted for one provider from leaking onto another and stops an
-	// un-guardrailed policy's traffic from being blocked by an unrelated
-	// policy's allowlist.
+	// ProviderAllowlists maps a resolved provider id (KeyLLMResolvedProviderID) to
+	// its model allowlist. A provider present is restricted to those models; one
+	// absent is unrestricted. Kept per-provider so one provider's list can't leak
+	// onto another.
 	ProviderAllowlists map[string][]string `json:"provider_allowlists,omitempty"`
 	PromptCapture      PromptCapture       `json:"prompt_capture"`
 }
@@ -65,11 +58,10 @@ func isEmptyJSON(raw []byte) bool {
 	return false
 }
 
-// normaliseConfig lowercases and trims allowlist entries so the runtime
-// match is case-insensitive. Empty entries are dropped. A provider whose
-// entries all drop out keeps an empty (non-nil) list — an allowlist that
-// permits nothing — which is the intended "deny every model" for that
-// provider, distinct from the provider being absent (unrestricted).
+// normaliseConfig lowercases and trims allowlist entries for case-insensitive
+// matching; empty entries drop. A provider whose entries all drop keeps an empty
+// (non-nil) list — "deny every model" — distinct from an absent provider
+// (unrestricted).
 func normaliseConfig(cfg Config) Config {
 	if len(cfg.ProviderAllowlists) == 0 {
 		cfg.ProviderAllowlists = nil

proxy/internal/middleware/builtin/llm_guardrail/middleware.go

@@ -111,20 +111,16 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 // is a no-op.
 func (m *Middleware) Close() error { return nil }
 
-// evaluateAllowlist returns a deny Output when the allowlist for the request's
-// resolved provider rejects the model. A nil return means the request should
-// proceed. The allowlist is scoped to the provider llm_router resolved: a
-// provider absent from the config is unrestricted, so an un-guardrailed policy's
-// traffic is never caught by an unrelated provider's allowlist.
+// evaluateAllowlist denies when the resolved provider's allowlist rejects the
+// model; nil means proceed. Scoped to the provider llm_router resolved, so an
+// unrestricted provider (absent from config) is never caught by another's list.
 func (m *Middleware) evaluateAllowlist(providerID, model string, modelPresent bool) *middleware.Output {
 	if len(m.cfg.ProviderAllowlists) == 0 {
 		return nil
 	}
-	// Restrictions exist for this account but the resolved provider is unknown,
-	// so we cannot tell whether this request is bound for a restricted provider.
-	// Fail closed rather than wave it through. In practice llm_router always
-	// stamps the resolved provider before the guardrail runs (or denies first),
-	// so this is a defensive guard, not the common path.
+	// Restrictions exist but the resolved provider is unknown, so we can't tell
+	// if this request targets a restricted provider — fail closed. llm_router
+	// normally stamps the provider first, so this is a defensive guard.
 	if providerID == "" {
 		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
@@ -135,10 +131,8 @@ func (m *Middleware) evaluateAllowlist(providerID, model string, modelPresent bo
 		return nil
 	}
 	// Fail closed: with an allowlist in effect for this provider, a request whose
-	// model the upstream parser could not extract (absent or empty) must be
-	// denied rather than allowed. This is what enforces the allowlist for
-	// URL/path-routed providers (Bedrock, Vertex, ...) whose model lives outside
-	// the JSON body.
+	// model the parser couldn't extract (absent/empty) is denied. This enforces
+	// the allowlist for path-routed providers (Bedrock, Vertex) with no body model.
 	if !modelPresent || normaliseModel(model) == "" {
 		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}

proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go

@@ -164,10 +164,9 @@ func TestAllowlistEmptyListAllowsMissingModel(t *testing.T) {
 }
 
 func TestUnrestrictedProviderAllowsAnyModel(t *testing.T) {
-	// testProvider is restricted, but the request resolved to otherProvider,
-	// which carries no allowlist. Its traffic must not be caught by the other
-	// provider's restriction — this is the cross-provider-leak / false-deny
-	// guard. Management owns any per-policy/group decision for otherProvider.
+	// The request resolved to otherProvider, which has no allowlist, so its
+	// traffic must not be caught by testProvider's restriction — the
+	// cross-provider-leak / false-deny guard.
 	mw := New(providerCfg("gpt-4o"))
 	out, err := mw.Invoke(context.Background(), newInputProvider(otherProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},