Merge branch 'main' into feat/migrate-detect-postgres

* [docs] Update agent-network docs for management-owned pricing

  The docs still described the retired proxy-side pricing: pricing.Loader,
  pricing_path, MiddlewareDataDir, embedded defaults_pricing.yaml, and the
  symlink-safe Unix loader. Rewrite them for the current design — management
  synthesizes the whole table and ships it in cost_meter's ConfigJSON, so the
  proxy carries no price list and has nothing to reload.

AGENTS.md

@@ -1,6 +1,6 @@
 # NetBird Agent Guidelines
 
-**NetBird** is an open-source connectivity platform: a WireGuard®-based overlay
+**NetBird** is an open source connectivity platform: a WireGuard®-based overlay
 network with a control plane. The **agent** (`client/`) runs on user machines as
 a privileged daemon and manages the WireGuard interface, routing, firewall, and
 DNS. **Management** (`management/`) is the control plane and REST/gRPC API,

CONTRIBUTING.md

@@ -479,7 +479,7 @@ go test -race ./client/internal/dns/...
 
 ## Checklist before submitting a PR
 
-As a critical network service and open-source project, we must enforce a few
+As a critical network service and open source project, we must enforce a few
 things before submitting a pull request. The
 [pull request template](/.github/pull_request_template.md) mirrors this list —
 fill it in rather than deleting it.

README.md

@@ -130,7 +130,7 @@ In November 2022, NetBird joined the [StartUpSecure program](https://www.forschu
 ![CISPA_Logo_BLACK_EN_RZ_RGB (1)](https://user-images.githubusercontent.com/700848/203091324-c6d311a0-22b5-4b05-a288-91cbc6cdcc46.png)
 
 ### Acknowledgements
-We build on open-source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
+We build on open source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
 
 ### Legal
 This repository is licensed under the BSD-3-Clause license, which applies to all parts of the repository except for the directories management/, signal/ and relay/.

SECURITY.md

@@ -14,7 +14,7 @@ Report security issues one of these two ways:
   on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
 - **Email** — `security@netbird.io`.
 
-If the finding affects NetBird Cloud or our hosted infrastructure rather than the open-source code, email us rather than
+If the finding affects NetBird Cloud or our hosted infrastructure rather than the open source code, email us rather than
 filing a repository report.
 
 ### What to include

agent-network/README.md

@@ -40,35 +40,6 @@ You can then use this private endpoint to configure your AI agents, whether that
 Full step-by-step setup:
 **https://docs.netbird.io/agent-network/quickstart**
 
-## Client settings that don't follow the endpoint
-
-Most of an agent's traffic follows the base URL you hand it, but a few
-client-side checks call their vendor directly and never reach the proxy. On a
-network that blocks direct egress they fail even though inference works, so
-they are worth setting once when you roll the endpoint out.
-
-For Claude Code:
-
-- **Fast mode** checks availability against `api.anthropic.com` rather than the
-  configured base URL. Set `CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK=1` when the
-  agent authenticates with `ANTHROPIC_AUTH_TOKEN` alone (the usual shape when
-  the proxy injects the real provider key) or when a TLS-inspecting proxy
-  answers the check itself. Set
-  `CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS=1` when the network refuses the
-  connection outright. Fast mode is an Anthropic-API feature, so it is
-  unavailable on a Bedrock- or Vertex-backed endpoint whatever you set.
-- **Model discovery** is off by default. Set
-  `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1` for the picker to list the
-  models your policies authorise; the proxy filters the response to that set.
-  The client gives discovery a three-second budget and treats any redirect as
-  a failure, so the endpoint must serve `/v1/models` directly.
-- **The WebFetch domain safety check** also calls `api.anthropic.com` directly
-  and is unaffected by the variables above.
-
-Allowing direct egress to `api.anthropic.com` covers the network cases but not
-the credential one, where the check reaches Anthropic and is rejected because
-the agent presents a proxy-issued key.
-
 ## Architecture 
 
 Agent Network is built on two existing NetBird capabilities:

docs/agent-networks/01-end-to-end-flows.md

@@ -115,7 +115,7 @@ sequenceDiagram
         Resp->>Resp: parse usage tokens, completion
         Note over Resp: capture_completion gates raw<br/>completion capture
         Resp->>Cost: tokens
-        Cost->>Cost: lookup pricing.yaml + compute cost
+        Cost->>Cost: lookup rates from config-delivered<br/>pricing table + compute cost
         Cost->>Rec: tokens + cost
         Rec->>MgmtGrpc: RecordLLMUsage(provider, model, prompt_t, completion_t, cost, groups, user)
         Rec-->>Log: emit access-log entry<br/>(if EnableLogCollection)

docs/agent-networks/modules/21-management-agentnetwork.md

@@ -15,6 +15,10 @@ Inside the package: `manager.go` is the CRUD + permissions-gated facade; `synthe
 | ---- | ---- |
 | `agentnetwork/manager.go` | Manager interface + CRUD + permission gates + bootstrap-settings + reconcile trigger |
 | `agentnetwork/synthesizer.go` | Settings/policy → wire-format synthesis; sole writer of the proxy middleware chain |
+| `agentnetwork/synthesizer_pricing.go` | `buildCostMeterConfigJSON` — default table + per-provider prices → `cost_meter` config |
+| `agentnetwork/pricing/defaults.go` | Default pricing table derived from the catalog + supplementals; `DefaultTable`, `LookupDefault`, wire `Entry` |
+| `agentnetwork/pricing/override.go` | `LoadFile`/`StartReloader` for `AgentNetwork.PricingDefaultsFile` (mtime poll, merge over compiled-in base) |
+| `agentnetwork/pricing/{exampleyaml,gen}.go` | Generates `defaults_llm_pricing.example.yaml` from the compiled-in table (golden-tested) |
 | `agentnetwork/policyselect.go` | Per-request policy attribution + account-budget ceiling (min-wins) |
 | `agentnetwork/reconcile.go` | Per-account synth diff vs in-memory cache → Create/Update/Delete |
 | `agentnetwork/catalog/catalog.go` | Static provider catalogue (auth headers, identity-injection shapes) |
@@ -48,6 +52,8 @@ flowchart TD
     I --> J[indexProviderGroups: providerID -> sorted source groups]
     J --> K[buildRouterConfigJSON drops orphan providers]
     J --> L[buildIdentityInjectConfigJSON per catalog entry]
+    J --> K2[buildCostMeterConfigJSON: default table + per-provider prices]
+    K2 --> P
     H --> M[mergeGuardrails: union allowlist, OR redact]
     M --> N[applyAccountCollectionControls account toggle = SOLE capture control]
     N --> O[marshalGuardrailConfig]
@@ -60,6 +66,84 @@ flowchart TD
     R --> T[accountManager.UpdateAccountPeers — fans synth ACLs into network map]
 ```
 
+### LLM pricing (management is the sole authority)
+
+**The proxy carries no price list.** Management synthesizes the entire pricing
+table and ships it inside `cost_meter`'s `ConfigJSON`, so a price change reaches
+the proxies as an ordinary mapping push — the chain rebuild installs a fresh
+table and there is nothing to reload on the proxy side.
+
+```mermaid
+flowchart TD
+    A[catalog.All — PricingSurfaces x Models] --> B[buildDefaultTable + supplementalDefaults]
+    B --> C{AgentNetwork.PricingDefaultsFile}
+    C -- absent --> D[compiled-in table serves]
+    C -- loaded --> E[LoadFile: merge file entries WHOLE over compiled base]
+    E --> F[mergedTable atomic.Pointer]
+    D --> G[DefaultTable]
+    F --> G
+    G --> H[buildCostMeterConfigJSON — pricing.defaults]
+    I[types.Provider.Models operator prices] --> J[normalizePricingModelID<br/>bedrock ARN/region/version, vertex @version]
+    J --> K[materializeEntry: default entry as base,<br/>operator input/output verbatim,<br/>cache pointers only when non-nil]
+    K --> L[pricing.providers keyed by provider record ID]
+    H --> M[cost_meter ConfigJSON]
+    L --> M
+    G --> N[GET /catalog — applyDefaultPricing prefills dashboard rows]
+    O[StartReloader: mtime poll every ReloadInterval 1m] --> E
+```
+
+**Two tiers, resolved per request on the proxy** (`synthesizer_pricing.go:22-35`):
+
+- `pricing.defaults` — surface (`openai`/`anthropic`/`bedrock`) → normalized model
+  id → rates. The **full** default table ships to every account: it is small
+  (~10 KB) and it is what keeps gateway-style providers (which enumerate no
+  models, so they claim every model) priced.
+- `pricing.providers` — provider **record** id → normalized model id → rates,
+  matched against the `llm.resolved_provider_id` the router stamps. Entries are
+  **fully materialized here**, at synth time: `materializeEntry` starts from the
+  default entry for that model so cache rates the operator didn't state are
+  inherited, overlays operator `input`/`output` verbatim (**including an explicit
+  0**, which prices a self-hosted or internal endpoint as free rather than
+  silently reverting to list price), and overlays cache-rate **pointers only when
+  non-nil** — `nil` means "inherit the default", an explicit `0` means "no
+  discount, bill this bucket at the input rate". The proxy therefore does two map
+  lookups and no merging.
+
+Same orphan rule as the router: a provider no enabled policy authorises is
+unreachable, so its prices aren't shipped. Model ids are normalized with the
+**same** functions the request parser uses (`NormalizeBedrockModel` /
+`NormalizeVertexModel`), which is what makes the per-record lookup key compare
+equal to the `llm.model` the proxy meters. Post-normalization duplicates resolve
+first-occurrence-wins, matching the routing dedup order.
+
+**`AgentNetwork.PricingDefaultsFile`** (`config.go:190-207`) lets an operator
+replace default rates without a rebuild. Schema is `surface → model → rates`
+(`input_per_1k`, `output_per_1k`, and optional `cached_input_per_1k` /
+`cache_read_per_1k` / `cache_creation_per_1k`). Semantics:
+
+- A **relative** path resolves against `<Datadir>`, so a bare filename lands
+  alongside the store. Empty config probes `<Datadir>/defaults_llm_pricing.yaml`.
+- An **explicitly configured** path is *required to load*: a typo or malformed
+  file fails startup, because the operator believes those rates are live. The
+  conventional probe is optional — an absent file just serves compiled-in
+  defaults, and the path stays watched in case it appears later.
+- File entries **replace** the compiled-in entry for the same (surface, model)
+  **whole** — they are not field-merged, so an entry must repeat the cache rates
+  it wants to keep. Everything the file doesn't mention keeps built-in rates.
+- Unknown YAML fields are rejected (`KnownFields(true)`) and every rate must be
+  finite and non-negative — the same constraints the HTTP API enforces on
+  operator per-provider prices.
+- Reload is an mtime poll (`ReloadInterval`, 1 min) and is **lenient at runtime**:
+  a parse error keeps the previous table, a deleted file reverts to compiled-in
+  defaults. A mid-edit save can never take pricing down.
+
+The live table feeds **both** consumers, which is what keeps them consistent: the
+synthesizer (what proxies actually bill with) and `GET /api/agent-network/catalog`
+via `applyDefaultPricing` (what the dashboard's model-row prices prefill with).
+`defaults_llm_pricing.example.yaml` is generated from the compiled-in table
+(`go generate ./management/internals/modules/agentnetwork/pricing`) and
+golden-tested, so operators start from a file matching the built-in rates exactly.
+
 ### Budget rule resolution (min-wins, group+user bound)
 
 ```mermaid
@@ -124,7 +208,7 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
   | on_request | 3 | `llm_identity_inject` | `{"providers":[{provider_id, header_pair?, json_metadata?, extra_headers?}]}` | **true** |
   | on_request | 4 | `llm_guardrail` | `{"provider_allowlists"?: {providerID: []model}, "prompt_capture":{enabled,redact_pii}}` | – |
   | on_response | 5 | `llm_limit_record` | `{}` (runs LAST at runtime) | – |
-  | on_response | 6 | `cost_meter` | `{}` | – |
+  | on_response | 6 | `cost_meter` | `{"pricing":{"defaults":{surface:{model:rates}},"providers"?:{providerRecordID:{model:rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}` | – |
   | on_response | 7 | `llm_response_parser` | `{"capture_completion": <bool>, "redact_pii"?: true}` | – |
 - **Synthesized service shape** (`synthesizer.go:739`): `Mode=HTTP`, `Private=true`, `Domain=<subdomain>.<cluster>`, `AccessGroups=unionSourceGroups(enabledPolicies)`, one `TargetTypeCluster` target with `Host=noop.invalid:443` (router rewrites per request), `Options.{DirectUpstream,AgentNetwork}=true`, `DisableAccessLog=!settings.EnableLogCollection`, `CaptureMax{Req,Resp}Bytes=1<<20`, `CaptureContentTypes=["application/json","text/event-stream"]`.
 
@@ -139,6 +223,12 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Orphan providers (no enabled policy authorises them) NEVER reach the router** (`synthesizer.go:351-357`); skipped from `identity_inject` for symmetry.
 - **Provider creation refuses empty `api_key`** (`manager.go:175`); **deletion refuses while any policy still references it** (`manager.go:265-273`).
 - **Session keypair stability across provider edits** (`manager.go:226-228`) — server-managed, copied through every `UpdateProvider`, never API-surfaced.
+- **Management is the sole pricing authority.** The proxy has no embedded price list, so an account whose `cost_meter` config carries no `pricing` block bills **nothing** (`cost.skipped=unknown_model`, $0) rather than falling back to stale built-ins. The top-level `pricing` wrapper is also the feature-detection signal in both directions: an old proxy ignores it as an unknown field, and a new proxy reads its absence as "old management".
+- **Per-provider prices are materialized at synth time, not merged on the proxy** (`synthesizer_pricing.go:114-131`). A per-record entry is always complete, so the proxy's lookup is per-record-then-defaults with no field-level fallback between tiers.
+- **An explicit operator price of `0` prices the model as free** — it must not be treated as "unset" and reverted to list price (`synthesizer_pricing.go:49-54`). Only *cache*-rate fields distinguish unset from zero, via `*float64`.
+- **Pricing model ids are normalized with the same functions the request parser uses** (`normalizePricingModelID`). If the two ever diverge, per-record prices silently stop matching and every request falls through to surface defaults.
+- **The default table's coverage is structural, not curated.** It is derived from the catalog via each provider's `PricingSurfaces`; `TestDefaultTable_CoversEveryCatalogModel` fails on an unpriced catalog model and `TestDefaultTable_NoConflictingContributions` fails if two providers contribute the same (surface, model) at different rates.
+- **A pricing-defaults file failure is fatal only at startup, and only for an explicitly configured path.** Runtime reload failures keep the previous table; a deleted file reverts to compiled-in defaults (`pricing/override.go:62-81, 113-148`).
 
 ## Things to scrutinize
 
@@ -176,10 +266,12 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Capture-pointer semantics (restated):** non-agent-network callers see no field → legacy nil-default emit, identical to pre-PR. Agent-network targets always carry an explicit `capture_*` value.
 - **`TestSynthesizeServices_HappyPath` was updated:** request-parser config moved from `{}` to `{"capture_prompt":false}` (`synthesizer_test.go:174`). External snapshot tests against synth output need updating.
 - **`MergedGuardrails` retains zeroed `TokenLimits`/`Budget`/`Retention`** even though `Policy.Limits` carries the real values now; `llm_limit_check` is the authoritative enforcement. Comment at `synthesizer.go:940-948` calls this out.
+- **`cost_meter`'s `pricing` block is version-skew-safe in both directions.** A proxy predating config-delivered pricing ignores the field as unknown JSON (it previously priced from its own embedded table, so it keeps billing — at its own rates, which is the skew to be aware of during a rolling upgrade). A current proxy paired with old management sees no `pricing` block, logs one warning at chain-build time, and records `cost.skipped=unknown_model` — token counting and cap enforcement are unaffected, only the USD annotation goes to $0.
 
 ### Performance
 
 - **`SynthesizeServices` runs on every controller tick / mutation reconcile.** Cost: 4 store reads + optional per-provider keypair backfill. Sort + index + merge are O(N log N) / O(P × G); dominant cost is JSON marshalling. No nested loops escape these dimensions.
+- **The full default pricing table is marshalled into every account's `cost_meter` config on every synth** (~10 KB serialized). This is a deliberate trade: it keeps gateway-style providers priced for every catalog model, and it is the largest single contributor to the synth JSON. `DefaultTable()` itself is a pointer load (or a `sync.Once`-built map) — the cost is the marshal, not the build.
 - **`reconcile.diffMappings` is O(N + M)** with N=M=1 per account today — effectively constant.
 - **`SynthesizeServicesForCluster`** (`synthesizer.go:71`) walks every account on a cluster; per-account failures are **swallowed** (`synthesizer.go:91-93`) so a single misconfigured account doesn't drop the cluster. Runs per proxy reconnect.
 
@@ -188,6 +280,7 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Activity codes:** `AgentNetwork{Provider,Policy,Guardrail,BudgetRule}{Created,Updated,Deleted}`; `AgentNetworkSettingsUpdated` with `log_collection/prompt_collection/redact_pii` payload (`manager.go:567-571`). **No activity code for `SelectPolicyForRequest` denies** — surfaced via proxy access log only (likely intentional given volume).
 - **Deny codes** namespaced: `llm_policy.{token,budget}_cap_exceeded`, `llm_account.{token,budget}_cap_exceeded` (`policyselect.go:18-26`).
 - **Reconcile failures are logged at warn and swallowed** (`reconcile.go:42-44`). Persistent synth failures (e.g. unknown catalog id) silently keep the proxy out of sync — consider a manager-level synth-health surface if this becomes a support burden.
+- **Pricing-file lifecycle logs at info** (load, reload, revert-to-built-ins) and **at warn** for a runtime reload failure; the mtime check itself is `Debugf`. There is no metric on reload failures, so an operator who breaks the file mid-flight keeps billing at the previous table with only a log line to show it (`pricing/override.go:113-148`).
 
 ## Test coverage
 
@@ -198,6 +291,9 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 | `synthesizer_guardrail_realstore_test.go` | `PromptCaptureAccountIsSoleControl`; `PromptCaptureFlowsWhenAccountOptsIn`; `AccountRedactWithoutGuardrailRedact`; `NoGuardrail_CaptureOff`. |
 | `synthesizer_log_collection_realstore_test.go` | `LogCollection{Off_SuppressesAccessLog,On_PermitsAccessLog}` — verifies `DisableAccessLog` propagation through `ToProtoMapping`. |
 | `synthesizer_parser_redact_realstore_test.go` | **Capture-pointer regression suite:** `ParserConfigsCarryRedactPii`; `ParserConfigsSuppressCaptureWhenLogCollectionOnly` (log=on/prompt=off ⇒ both capture flags false); `ParserConfigsOmitRedactPiiWhenOff`. |
+| `synthesizer_pricing_test.go` | `BuildCostMeterConfig_{BedrockModelNormalization,CacheRateNilVsZero,OrphanAndGatewayProviders}` — the per-record tier's three load-bearing rules: keys normalized like the parser's, `nil` cache pointer inherits vs explicit `0` bills at input rate, and orphan / gateway (empty `Models`) providers ship no per-record entry. |
+| `pricing/defaults_test.go` | `DefaultTable_{CoversEveryCatalogModel,NoConflictingContributions,AllRatesFiniteNonNegative,PinnedRates}`; `LookupDefault_SurfaceOrder`. Catalog-derived coverage + rate sanity are structural, not curated. |
+| `pricing/override_test.go` | `LoadFile_{MergesOverCompiledDefaults,MissingPath,RejectsInvalid}`; `Reload_LifeCycle` (mtime detect, parse error keeps previous, delete reverts to built-ins); `ExampleYAML_InSyncWithBuiltins` golden. |
 | `policyselect_test.go` | Mock-store: `NoApplicablePolicies`; `AllowWithLowestGroupAttribution`; `LargerPoolWinsAcrossUsageLevels`; `StaysOnLargerPoolAfterPartialDrain`; `FallsThroughToSmallerPoolWhenLargerExhausted`; `TiebreakBy{LargerGroupPool,CreatedAt}`; `DeniesWhenAllExhausted`; `UncappedPolicyAlwaysWinsAgainstCapped`; `DisabledPolicyIgnored`; `StoreErrorPropagates`; `RejectsEmptyAccount`; `SharesGroupCounterAcrossPolicies`; `AntiFallThroughOnLowestGroup`; `BudgetOnlyExhaustionDenies`; `BudgetTighterThanTokenWins`. |
 | `policyselect_realstore_test.go` | Real-sqlite regression guard: `NoApplicablePolicies`; `AllowAndLowestGroupAttribution`; `LargerPoolWins_FallsThroughWhenExhausted`; `BudgetCapDenies`; `GroupCounterSharedAcrossPolicies`; `DisabledPolicyIgnored`. |
 | `policyselect_account_realstore_test.go` | Account budget rules: `AccountCeilingBindsEvenWithUncappedPolicy` (min-wins); `AccountGroupCeiling`; `AccountTargetUsersBindsOnlyThatUser`; `AccountRuleRecordsToOwnWindow`. |

docs/agent-networks/modules/31-proxy-middleware-builtin.md

@@ -5,7 +5,7 @@ LLM request. The two highest-blast-radius areas are the **capture-pointer
 semantics** and the **limit_check ⇒ limit_record** record-once invariant.
 
 Sibling module: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — the SDK
-adapters + pricing catalog this chain delegates to.
+adapters + pricing table and cost formula this chain delegates to.
 
 ---
 
@@ -34,7 +34,7 @@ rewrites.
 | `llm_identity_inject` | OnRequest | `llm.{resolved_provider_id,authorising_groups}`, `Input.{UserEmail,UserID,UserGroups,UserGroupNames}` | none | header strip/inject + optional body rewrite |
 | `llm_guardrail` | OnRequest | `llm.{model,request_prompt_raw}` | `llm_policy.{decision,reason}`, `llm.request_prompt` | none (model allowlist deny) |
 | `llm_response_parser` | OnResponse | `llm.provider`, `Input.{RespHeaders,RespBody,Status}` | `llm.{input,output,total,cached_input,cache_creation}_tokens`, `llm.response_completion` | none |
-| `cost_meter` | OnResponse | `llm.{provider,model}`, token buckets | `cost.usd_total` or `cost.skipped` | pricing lookup |
+| `cost_meter` | OnResponse | `llm.{provider,model,resolved_provider_id}`, token buckets | `cost.usd_{input,cached_input,cache_creation,output,total,cache}` or `cost.skipped` | none (in-memory pricing lookup) |
 | `llm_limit_record` | OnResponse | `llm.{attribution_group_id,attribution_window_seconds,input_tokens,output_tokens}`, `cost.usd_total` | none | gRPC `RecordLLMUsage` |
 
 [all_test.go:26–40](../../../proxy/internal/middleware/builtin/all_test.go)
@@ -44,7 +44,7 @@ locks the ID set; adding or removing one is a conscious extension.
 
 | File | LOC | Notes |
 |---|---:|---|
-| `builtin.go` | 86 | Registry + `FactoryContext` (ctx, data dir, meter, logger, mgmt client) |
+| `builtin.go` | 90 | Registry + `FactoryContext` (ctx, meter, logger, mgmt client) |
 | `all_test.go` | 41 | Locks the 8-ID registry surface |
 | `agentnetwork_chain_integration_test.go` | 319 | Live sqlite + real gRPC bufconn; gate→recorder wire path |
 | `llm_request_parser/*` | 162 / 66 / 356 | Provider detection, body parse, prompt extraction with capture-pointer gating |
@@ -53,7 +53,7 @@ locks the ID set; adding or removing one is a conscious extension.
 | `llm_identity_inject/*` | 440 / 108 / 666 | HeaderPair (LiteLLM) + JSONMetadata (Portkey) + ExtraHeaders |
 | `llm_guardrail/*` | 176 / 82 / 75 / 219 / 217 | Model allowlist + optional prompt capture with PII redaction |
 | `llm_response_parser/*` | 258 / 222 / 43 / 433 / 169 / 111 | Buffered + SSE accumulation; AWS event-stream accumulator (`streaming_bedrock.go`) for Bedrock; capture-pointer gates completion emit |
-| `cost_meter/*` | 181 / 84 / 439 | Token → USD via `proxy/internal/llm/pricing` |
+| `cost_meter/*` | 236 / 98 / 586 | Token → USD via `proxy/internal/llm/pricing`; both pricing tiers arrive in the middleware config |
 | `llm_limit_record/*` | 144 / 35 / 191 | Post-flight `RecordLLMUsage` (5s, debug-on-error) |
 
 ## Per-middleware
@@ -168,12 +168,46 @@ token schema.
 
 ### cost_meter
 
-Reads `llm.provider` + `llm.model` + token buckets, looks up per-1k rate via
-`pricing.Loader`, emits `cost.usd_total` or a closed-set `cost.skipped`
-reason (`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
-`unknown_model`). Loader's hot-reload goroutine is bound to proxy-lifetime
-context via `startReloader`. **Key invariant:** provider-shape switch lives
-in `pricing.Table.Cost` (sibling doc) — `cost_meter` stays provider-agnostic.
+Reads `llm.provider` + `llm.model` + token buckets, looks up the per-1k rates,
+and emits the full `cost.usd_*` breakdown (four per-bucket values plus the
+`_total` and `_cache` aggregates) or a closed-set `cost.skipped` reason
+(`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
+`unknown_model`).
+
+**Management owns pricing.** The proxy carries no embedded price list: the whole
+table arrives in this middleware's `ConfigJSON` as
+`{pricing: {defaults, providers}}`, synthesized by management from the catalog
+plus the operator's stored per-provider prices
+([factory.go:13–34](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
+Both tiers are validated by `pricing.NewTable` / `pricing.NewEntries` at
+construction, so a non-finite or negative rate fails the chain build. A price
+change is an ordinary mapping push — the chain rebuild yields a fresh instance
+over a fresh immutable table, so there is no data dir, no pricing file, no
+reload goroutine, and nothing to invalidate.
+
+**Two-tier lookup**
+([middleware.go:165–183](../../../proxy/internal/middleware/builtin/cost_meter/middleware.go)):
+
+1. **Per-provider-record** — the operator's stored price for the route that
+   actually served the request, keyed by the `llm.resolved_provider_id` that
+   `llm_router` stamped on the allow path, then by normalized model id. Entries
+   arrive fully materialized (management folds default cache rates in at synth
+   time), so there is no merging here. Absent metadata — no router in the chain
+   — skips this tier.
+2. **Surface defaults** — the catalog-derived table keyed by `llm.provider`
+   (`openai`/`anthropic`/`bedrock`). This is also what prices gateway-style
+   providers, which enumerate no models and therefore get no per-record entry.
+
+**Backward compatibility:** a config with no `pricing` block means management
+predates config-delivered pricing. The factory logs one warning at build time
+and the instance records `cost.skipped=unknown_model` ($0) for every request
+rather than falling back to a stale built-in price list
+([factory.go:55–60](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
+
+**Key invariant:** the provider-shape switch lives in `pricing.EntryCosts`
+(sibling doc) and is selected by the **surface**, not by which tier the entry
+came from — `cost_meter` stays provider-agnostic, and a per-record override on
+an Anthropic route still bills its cache buckets additively.
 
 ### llm_limit_record
 
@@ -246,12 +280,14 @@ no mocks. Tests: `TestChain_AllowPath_StampsAttributionAndRecordsCounter`
 | `llm_identity_inject` | `{providers: [{provider_id, header_pair?|json_metadata?, extra_headers?}]}` |
 | `llm_guardrail` | `{provider_allowlists: {providerID: []string}, prompt_capture: {enabled, redact_pii}}` — allowlist keyed by resolved provider id; a provider absent from the map is unrestricted (fail-closed backstop; authoritative per-policy/group check is management's `CheckLLMPolicyLimits`) |
 | `llm_response_parser` | `{redact_pii?, capture_completion?: *bool}` |
-| `cost_meter` | `{pricing_path?}` (basename inside data-dir; defaults `pricing.yaml`) |
+| `cost_meter` | `{pricing: {defaults: {surface: {model: rates}}, providers: {providerRecordID: {model: rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}`. A missing `pricing` key means "management predates config-delivered pricing": every request records `cost.skipped=unknown_model` |
 | `llm_limit_record` | `{}` — same pattern as `llm_limit_check` |
 
 All factories accept empty / null / `{}` / whitespace as zero-value config;
 only structurally invalid JSON is rejected so misconfig surfaces at chain
-build time.
+build time. `cost_meter` adds a semantic check on top of that: a `pricing`
+block carrying a negative or non-finite rate fails the build too, rather than
+mispricing live traffic.
 
 ## Invariants
 
@@ -320,10 +356,11 @@ non-object `metadata` field
 — header path still attributes, but body-level tag-budget enforcement
 doesn't run for that request.
 
-**Concurrency.** `cost_meter` shares a `pricing.Loader` via
-`atomic.Pointer[Table]`; readers always see a consistent table. Every
-middleware is a stateless value receiver. Integration test uses real bufconn
-gRPC — race detector is the meaningful bar.
+**Concurrency.** `cost_meter`'s two pricing tables are built once from the
+middleware config and never mutated, so the lookup path needs no lock or atomic
+swap — a price change replaces the whole instance. Every middleware is
+otherwise a stateless value receiver. Integration test uses real bufconn gRPC —
+race detector is the meaningful bar.
 
 **Perf.** Hot path is `lookupKV` linear scan over <10 KVs; `cost_meter.Cost`
 is O(1); SSE accumulation is single-pass. No map allocation per call.
@@ -349,13 +386,13 @@ counter accuracy.
 | `llm_guardrail/redact_test.go` | 15 | Email, SSN, phone (E.164 + NA), bearer, IPv4; fixture-driven |
 | `llm_response_parser/middleware_test.go` | 18 | Buffered OAI+Anthro, capture-pointer, redact, truncation |
 | `llm_response_parser/streaming_test.go` | 7 | OAI usage frame, Anthro message_delta, truncated body best-effort |
-| `cost_meter/middleware_test.go` | 17 | Each skip reason, provider-shape, pricing loader integration |
+| `cost_meter/middleware_test.go` | 22 | Each skip reason, provider-shape formulas, config-delivered defaults, per-record-beats-defaults + miss-falls-back, per-record uses surface formula, nil-pricing skips everything, invalid-rate rejection |
 | `llm_limit_record/middleware_test.go` | 7 | Skip-on-no-signal, skip-on-missing-attribution, RPC failure swallowed |
 
 ## Cross-references
 
 - Sibling: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — SDK adapters
-  + SSE framer + pricing loader.
+  + SSE framer + pricing table and cost formula.
 - Path-routed providers (Vertex AI + Bedrock), `keyfile::` credential, GCP
   token minting, `/bedrock` prefix:
   [50-path-routed-providers.md](./50-path-routed-providers.md).

docs/agent-networks/modules/32-proxy-llm-parsers.md

@@ -9,7 +9,7 @@ pricing table's per-provider cost formula is the highest-leverage place a
 small bug would silently mis-bill operators.
 
 Sibling module: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
-— the 8 middlewares that consume this package's parsers + pricing loader.
+— the 8 middlewares that consume this package's parsers + pricing table.
 
 ---
 
@@ -24,8 +24,9 @@ proxy-framework dependencies:
 - `openai.go` / `anthropic.go` / `bedrock.go` — per-provider `Parser` impls.
 - `sse.go` — SSE scanner (`Scanner`, `Event`, `NewScanner`).
 - `errors.go` — sentinels callers branch on with `errors.Is`.
-- `pricing/` — embedded-default + hot-reload override table with
-  symlink-safe Unix loader (build-tagged stub elsewhere).
+- `pricing/` — immutable pricing table + the per-surface cost formula. The
+  rates themselves come from management inside `cost_meter`'s middleware
+  config; this package holds no price list and reads no files.
 - `fixtures/` — captured request/response/stream bodies the tests replay.
 
 The package carries zero proxy-framework dependencies so the same parsers can
@@ -47,12 +48,9 @@ be reused later by a WASM adapter
 | `sse_test.go` | 175 | 12 tests; fixture replay + multiline + size limits |
 | `parser_test.go` | 53 | `Parsers()`, `DetectParser`, provider enum values |
 | `errors.go` | 31 | 6 sentinels: `Err{Unknown,Unsupported}Provider/Model`, `Err{NotLLM,Malformed}Response`, `ErrStreamingUnsupported`, `ErrMalformedRequest` |
-| `pricing/pricing.go` | 421 | `Loader`, `Table`, `Entry`; embedded defaults + atomic swap + mtime reload |
-| `pricing/pricing_unix.go` | 69 | `O_NOFOLLOW` + fstat-from-FD + 1 MiB cap |
-| `pricing/pricing_other.go` | 21 | Stub returning "not supported on this platform" |
-| `pricing/pricing_test.go` | 432 | 21 tests — symlink rejection, reload race, path traversal, oversize |
-| `pricing/defaults_pricing.yaml` | 85 | go:embed source of truth |
-| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream + pricing starter |
+| `pricing/pricing.go` | 234 | `Table`, `Entry`, `EntryJSON`, `Costs`; `NewTable`/`NewEntries` validation + `EntryCosts` formula. No I/O, no reload, no embedded rates |
+| `pricing/pricing_test.go` | 177 | 10 tests — provider-shape formulas, cached clamp, rate fallback, nil-safety, rate validation |
+| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream |
 
 ## Request body → parser dispatch
 
@@ -188,9 +186,11 @@ response leg, covering both Bedrock body shapes:
   `totalTokens`). `firstNonZero` folds the two naming conventions into one
   `Usage`; when Converse omits `totalTokens` the parser sums the buckets.
 
-`ProviderName()` returns `"bedrock"` — its own `defaults_pricing.yaml` block,
-keyed by the **normalised** model id (region prefix + version suffix stripped by
-the request parser). `ParseResponse` returns `ErrStreamingUnsupported` for an
+`ProviderName()` returns `"bedrock"` — its own pricing surface in the table
+management ships, keyed by the **normalised** model id (region prefix + version
+suffix stripped by the request parser; management normalises its keys the same
+way at synth time so the two compare equal). `ParseResponse` returns
+`ErrStreamingUnsupported` for an
 AWS binary event-stream content-type (`application/vnd.amazon.eventstream`,
 `isAWSEventStream`) so the caller routes to the streaming accumulator instead.
 
@@ -205,11 +205,34 @@ response body. Streaming accumulators live in the middleware package
 ([llm_response_parser/streaming.go](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go))
 but use `llm.NewScanner` so the framing contract stays here.
 
-### Pricing catalog
+### Pricing table
 
-`Table.Cost`
-([pricing.go:129–174](../../../proxy/internal/llm/pricing/pricing.go))
-is the cost formula — most security-relevant math in this module:
+**Management is the sole pricing authority.** The proxy carries no embedded
+price list and reads no pricing file: the whole table arrives inside
+`cost_meter`'s `ConfigJSON` on the ordinary mapping push, and a price change
+is just another push — the chain rebuild constructs a fresh `Table`, so there
+is nothing to reload
+([pricing.go:1–7](../../../proxy/internal/llm/pricing/pricing.go)). The
+management side of the contract (catalog defaults, the operator's stored
+per-provider prices, and `AgentNetwork.PricingDefaultsFile`) is covered in the
+management-side module guide; `cost_meter`'s wire shape is in
+[31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md).
+
+`EntryJSON`
+([pricing.go:36–45](../../../proxy/internal/llm/pricing/pricing.go)) is the
+management→proxy contract — five USD-per-1k rates under `input_per_1k`,
+`output_per_1k`, `cached_input_per_1k`, `cache_read_per_1k`,
+`cache_creation_per_1k`. Management's `pricing.Entry` marshals the identical
+names, and `EntryJSON`/`Entry` are field-identical so `NewEntries` converts by
+direct struct conversion rather than field-by-field copying (a new rate can't
+be silently dropped in transit).
+
+`EntryCosts`
+([pricing.go:183–234](../../../proxy/internal/llm/pricing/pricing.go))
+is the cost formula — most security-relevant math in this module. The
+**surface** (the `llm.provider` value the request parser stamped) selects the
+formula, never the tier the entry came from: a per-provider-record override on
+an Anthropic route still bills its cache buckets additively.
 
 | Provider | Formula |
 |---|---|
@@ -218,7 +241,7 @@ is the cost formula — most security-relevant math in this module:
 | default | `inTokens × InputPer1K + outTokens × OutputPer1K` |
 
 `bedrock` shares the Anthropic additive-cache formula
-([pricing.go:172-174](../../../proxy/internal/llm/pricing/pricing.go)):
+([pricing.go:214–229](../../../proxy/internal/llm/pricing/pricing.go)):
 Anthropic-on-Bedrock reports the same additive cache buckets, while non-Anthropic
 Bedrock models (Nova, Llama) simply report zero in those buckets so cost reduces
 to `input + output`.
@@ -226,15 +249,12 @@ to `input + output`.
 Each per-bucket rate falls back to `InputPer1K` when zero — operators opt in
 to discounts by setting the field.
 
-`Loader`
-([pricing.go:212–268](../../../proxy/internal/llm/pricing/pricing.go))
-overlays an optional `pricing.yaml` from data-dir on top of the go:embed
-defaults. Atomic pointer swap means readers never observe a partial update.
-The mtime-poll reloader (30s default cadence) keeps the previous table on
-parse failure so cost annotation never goes blank during a botched edit.
-
-`defaults_pricing.yaml` is the source of truth for built-in pricing.
-Operator overrides only carry the entries they want to change.
+`Costs`
+([pricing.go:143–163](../../../proxy/internal/llm/pricing/pricing.go)) is the
+per-request split. The four per-bucket fields are the base; `TotalUSD` and
+`CacheUSD` are **derived** in `newCosts` so the aggregates can never drift from
+the breakdown. `InputUSD` is always the non-cached input bucket on both
+provider shapes, so input and cached-input never double-count.
 
 ## Public contracts
 
@@ -264,29 +284,38 @@ Order matters: `DetectFromURL` ties resolve by registration order.
 `ProviderBedrock = 3`. Numeric values are persisted in nothing today but treat
 them as wire-stable — new providers must take fresh numbers.
 
-**`Pricing` lookup**
-([pricing.go:129](../../../proxy/internal/llm/pricing/pricing.go)):
+**`Pricing` construction + lookup**
+([pricing.go:60–130](../../../proxy/internal/llm/pricing/pricing.go)):
 
 ```go
+func NewEntries(raw map[string]map[string]EntryJSON) (map[string]map[string]Entry, error)
+func NewTable(raw map[string]map[string]EntryJSON) (*Table, error)
+
+func (t *Table) Lookup(provider, model string) (Entry, bool)
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool)
+func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool)
+func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, cacheCreation int64) Costs
 ```
 
-Nil-safe: `t.Cost` on a nil receiver returns `(0, false)`
-([pricing.go:130–132](../../../proxy/internal/llm/pricing/pricing.go)).
-`ok=false` means provider or model is absent from the loaded table; the caller
-emits `cost.skipped=unknown_model`.
+`NewTable` is the surface-keyed defaults table; `NewEntries` returns the raw
+two-level map `cost_meter` uses for the per-provider-record tier (it looks up an
+`Entry` directly and calls `EntryCosts`, so it needs no `Table` wrapper). Both
+reject any non-finite or negative rate, so a corrupt config fails the chain
+build rather than mispricing silently. Nil input yields an empty,
+never-matching table.
+
+Nil-safe: `t.Cost`/`t.Lookup` on a nil receiver returns `ok=false`
+([pricing.go:96–99](../../../proxy/internal/llm/pricing/pricing.go)).
+`ok=false` means the surface or model is absent from the table management sent;
+the caller emits `cost.skipped=unknown_model`.
 
 ## Invariants
 
-1. **Cross-platform pricing build.** `pricing_unix.go` carries the only
-   functional `loadPricing` (uses `syscall.O_NOFOLLOW` and `f.Stat()` on an
-   open descriptor — both Unix-only). `pricing_other.go` is a build-tag
-   fallback that returns `"not supported on this platform"`
-   ([pricing_other.go:14–16](../../../proxy/internal/llm/pricing/pricing_other.go)).
-   The proxy is Linux-only in production today; a Windows port needs an
-   equivalent path-as-handle implementation. Reviewers building on Windows
-   should expect this surface to return an error at startup if an override
-   file is configured.
+1. **The pricing package is pure and platform-independent.** No file I/O, no
+   `//go:embed`, no goroutines, no build tags — the rates arrive as config, so
+   there is nothing platform-specific left to port. Anything reintroducing a
+   read-from-disk path here re-splits pricing authority between management and
+   the proxy, which is exactly what this design removed.
 
 2. **SSE scanner handles partial chunks.** A buffered prefix that doesn't end
    in `\n\n` still yields its accumulated event before `io.EOF`
@@ -298,38 +327,45 @@ emits `cost.skipped=unknown_model`.
    usage rather than aborting
    ([streaming.go:68–73, 144–150](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go)).
 
-3. **`defaults_pricing.yaml` is the source of truth.** Compiled into the
-   binary via `//go:embed`
-   ([pricing.go:29–30](../../../proxy/internal/llm/pricing/pricing.go)).
-   `DefaultTable()` parses once and panics on parse failure
-   ([pricing.go:42–49](../../../proxy/internal/llm/pricing/pricing.go))
-   — by design: a broken embedded YAML must not ship to production.
+3. **Management is the only source of rates.** `Table` has no constructor that
+   invents prices: the only way in is `NewTable`/`NewEntries` over the wire map
+   management sent. A missing or empty `pricing` block therefore means *no
+   prices at all* (`cost_meter` records `cost.skipped=unknown_model`, $0) —
+   never a stale built-in fallback that would silently bill list price.
 
-4. **Loader path validation.** `resolveMiddlewareDataPath`
-   ([pricing.go:370–394](../../../proxy/internal/llm/pricing/pricing.go))
-   rejects absolute paths, traversal segments, and basenames that fail
-   `basenameRegex = ^[a-zA-Z0-9._-]+$`. The resolved path must remain
-   inside `baseDir` even after `filepath.Clean`. Tests:
-   `TestNewLoader_PathValidation`, `TestNewLoader_PathValidation_Extended`,
-   `TestNewLoader_SymlinkOutsideBaseDirRejected`, `TestNewLoader_SymlinkRejected`.
+4. **Tables are immutable once built.** `Table.entries` is written only in
+   `NewEntries` and never mutated afterwards, and `cost_meter`'s `perRecord`
+   map is likewise build-time-only
+   ([pricing.go:47–52](../../../proxy/internal/llm/pricing/pricing.go)). This
+   is what makes the no-reload design safe: a price change arrives as a mapping
+   push that builds a new middleware instance over a new table, so concurrent
+   readers can't observe a half-updated price list and no atomic swap or lock
+   is needed on the hot path.
 
-5. **Unix loader symlink safety.** `O_NOFOLLOW` on open, `f.Stat()` on the
-   open descriptor (never re-stat by path), `info.Mode().IsRegular()` check,
-   `io.LimitReader(f, maxPricingBytes+1)` with a final size assertion
-   ([pricing_unix.go:25–57](../../../proxy/internal/llm/pricing/pricing_unix.go)).
-   A mid-read symlink swap is detected because the fstat is on the original
-   fd. Test: `TestNewLoader_RejectsOversizedFile_FixesM4`.
+5. **Rate validation happens at chain-build time, not per request.**
+   `NewEntries` rejects negative, NaN, and ±Inf rates field by field
+   ([pricing.go:60–83](../../../proxy/internal/llm/pricing/pricing.go)), naming
+   the offending surface/model/field in the error. Management enforces the same
+   constraints at its API boundary and in its YAML parser, so this is
+   defense-in-depth — but it means a corrupt push fails loudly at build instead
+   of producing negative costs on live traffic. Test:
+   `TestNewTable_ValidatesRates`.
 
-6. **`yaml.NewDecoder(...).KnownFields(true)`**
-   ([pricing.go:397–398](../../../proxy/internal/llm/pricing/pricing.go))
-   rejects YAML files that carry fields not in the schema. A typo in an
-   operator override file fails loud instead of silently zeroing rates.
+6. **New rates must be added to `Entry`, `EntryJSON`, *and* management's
+   `pricing.Entry` together.** `NewEntries` converts by direct struct
+   conversion `Entry(e)`
+   ([pricing.go:76–78](../../../proxy/internal/llm/pricing/pricing.go)), which
+   only compiles while the two structs stay field-identical — so the proxy half
+   is compiler-enforced. The management half is not: a rate added there but not
+   here unmarshals into nothing and prices that bucket at `InputPer1K`.
 
 ## Things to scrutinise
 
-**Correctness.** Verify OpenAI cached-prompt clamp at
-[pricing.go:147–149](../../../proxy/internal/llm/pricing/pricing.go)
-short-circuits before subtraction. `Anthropic.TotalTokens` sums all four
+**Correctness.** Verify the OpenAI cached-prompt clamp at
+[pricing.go:203–206](../../../proxy/internal/llm/pricing/pricing.go)
+short-circuits before subtraction. Negative token counts are clamped to zero up
+front ([pricing.go:186–197](../../../proxy/internal/llm/pricing/pricing.go)) so
+no formula can yield a negative cost. `Anthropic.TotalTokens` sums all four
 buckets (in + out + cache_read + cache_creation) — downstream dashboards
 need to know this differs from `input + output`.
 `OpenAIParser.ExtractPrompt` falls through `messages → input → prompt`; a
@@ -338,22 +374,27 @@ noting).
 
 **Security.** `Scanner.maxLine = 1 MiB`; a 2 MiB single-line `data:` event
 errors from `Scanner.Next` and both accumulators stop with partial usage.
-Pricing file 1 MiB cap is orders of magnitude larger than realistic. Confirm
-new schema additions are mirrored in both `pricingFile` and `Entry`;
-`KnownFields(true)` will reject silently-typo'd operator overrides
-otherwise.
+Pricing is no longer file-backed, so the loader's path-traversal / symlink /
+oversize surface is gone entirely — the config channel (an authenticated
+mapping push from management) is now the only way rates enter the proxy, and
+`NewEntries` is the validation boundary on it. A new rate added to management's
+`pricing.Entry` but not to `EntryJSON` here is the remaining silent-mispricing
+path (see invariant 6).
 
-**Concurrency.** `Loader.table` is `atomic.Pointer[Table]`; readers never
-block or see a torn table. `Loader.Reload` is one goroutine, cancelled via
-context (`TestLoader_ReloadBackgroundLoopCancellation`). `DefaultTable()`
-uses `sync.Once`. Per-call `Scanner` instances mean no shared state across
-concurrent response-parser calls.
+**Concurrency.** Nothing in this package is shared mutable state: tables are
+built once and never written again, so `cost_meter`'s hot path is lock-free by
+construction rather than by atomic swap. Per-call `Scanner` instances mean no
+shared state across concurrent response-parser calls.
 
-**Perf.** `Table.Cost` is two map lookups + multiplications, O(1).
-`Scanner.Next` is one `ReadString('\n')` per line. Pricing reload poll 30s.
+**Perf.** `Table.Cost` is two map lookups + multiplications, O(1); the
+per-provider-record tier adds at most one more lookup. `Scanner.Next` is one
+`ReadString('\n')` per line. No background goroutines and no per-request
+allocation of pricing state.
 
-**Observability.** Reload failures count via `metric.Int64Counter` keyed
-`plugin`; warning log rate-limited at 5 min so a broken file doesn't flood.
+**Observability.** A config carrying no `pricing` block logs one warning at
+chain-build time (`cost_meter` factory) and then records
+`cost.skipped=unknown_model` per request, so an old-management deployment is
+visible in both logs and the access log rather than quietly reporting $0.
 Parser errors return sentinels — middleware uses `errors.Is` to map to the
 right `cost.skipped` reason.
 
@@ -365,7 +406,7 @@ right `cost.skipped` reason.
 | `openai_test.go` | 11 | Chat Completions + Responses API + legacy `prompt`; cached-tokens subset for both naming conventions; fixture replays |
 | `anthropic_test.go` | 7 | Messages + legacy `/v1/complete`; streaming REJECTED on `ParseResponse` (must use scanner); fixture replays |
 | `sse_test.go` | 12 | Fixture replay both providers; multiline `data:`; CRLF; comment skip; trailing-event-without-blank-line; oversize rejection |
-| `pricing/pricing_test.go` | 21 | Provider-shape switch; cached-rate fallback; cached-clamp; symlink rejection (target outside basedir + symlink to file); path validation matrix; oversize rejection; reload-keeps-previous-on-parse-error; mtime change detection; goroutine cancellation |
+| `pricing/pricing_test.go` | 10 | Provider-shape switch (surface selects the formula); cached-rate + cache-read/creation fallback to `InputPer1K`; cached-clamp; negative-token clamp; nil-receiver safety; rate validation (negative / NaN / Inf rejected); nil + empty table |
 
 **Fixtures** ([proxy/internal/llm/fixtures/](../../../proxy/internal/llm/fixtures/)):
 `openai_chat_completion.json` (chat.completions with usage),
@@ -373,14 +414,15 @@ right `cost.skipped` reason.
 `openai_stream.txt` (3 deltas + usage + `[DONE]`),
 `anthropic_messages.json` (Messages API non-streaming),
 `anthropic_stream.txt` (full 7-event sequence: message_start →
-content_block_{start,delta×2,stop} → message_delta (usage) → message_stop),
-`pricing.yaml` (realistic-pricing starter for operator overrides).
+content_block_{start,delta×2,stop} → message_delta (usage) → message_stop).
+No pricing fixture: the table is config-delivered, so pricing tests construct
+it in-process from a wire-shape map.
 
 ## Cross-references
 
 - Sibling: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
   — the chain that calls `llm.Parsers()`, `llm.ParserByName`,
-  `llm.NewScanner`, `pricing.NewLoader`.
+  `llm.NewScanner`, `pricing.NewTable` / `pricing.NewEntries`.
 - Path-routed providers (Vertex AI + Bedrock), credential syntax, and the
   Bedrock AWS event-stream accumulator:
   [50-path-routed-providers.md](./50-path-routed-providers.md).

docs/agent-networks/modules/33-proxy-runtime.md

@@ -1,7 +1,7 @@
 # proxy/runtime — translate + serve + log
 
 > **Risk level:** High — every config push from management is translated here, and the chain runs on every HTTP request to a synth target.
-> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareDataDir`, `MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path.
+> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path. Middleware config is entirely wire-delivered — no proxy-side data dir is involved, including for LLM pricing, which management ships inside `cost_meter`'s config.
 
 ## Module boundary
 
@@ -114,8 +114,7 @@ At **request time** the access-log middleware stamps `CapturedData`; the auth ch
 
 ## Public contracts touched
 
-- `proxy.Server.MiddlewareDataDir` (string) — base dir for file-backed middleware config (server.go:238-241).
-- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:248-250).
+- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:249-253). There is no `MiddlewareDataDir`: no built-in middleware reads config from disk, so `builtin.FactoryContext` carries only the proxy-lifetime context, meter, logger, and management client.
 - `proxy/internal/proxy.WithMiddlewareManager(*middleware.Manager) Option` — new option on `NewReverseProxy`; nil keeps the fast path (reverseproxy.go:48-56).
 - `proxy/internal/proxy.PathTarget` adds `Middlewares`, `CaptureConfig`, `AgentNetwork`, `DisableAccessLog` (servicemapping.go:27-51), all zero-default.
 - `proxy/internal/proxy.CapturedData` adds `agentNetwork`, `suppressAccessLog`, `userGroupNames` behind `sync.RWMutex`; slices deep-copied (context.go:47-66, 183-258).

docs/agent-networks/modules/50-path-routed-providers.md

@@ -87,9 +87,9 @@ strips the `@version` suffix from the model, and maps the publisher to a parser
 surface via `vertexPublisherVendor`:
 
 - `anthropic` → `llm.provider="anthropic"` → metered through the Anthropic
-  parser, priced under the **`anthropic`** block in `defaults_pricing.yaml`
-  (the parser emits the standard Anthropic provider label, so Vertex Claude
-  reuses first-party Anthropic prices).
+  parser, priced under the **`anthropic`** surface of the pricing table
+  management ships (the parser emits the standard Anthropic provider label, so
+  Vertex Claude reuses first-party Anthropic prices).
 - `openai` → `llm.provider="openai"` (reserved; not in the catalog lineup
   today).
 - anything else (notably `google` / Gemini) → empty vendor → **no parser**.
@@ -104,8 +104,9 @@ is omitted from the catalog.
 
 > Caveat: cross-region inference profiles in `eu` / `apac` carry a ~10% price
 > premium that the base per-token rates do **not** model — cost annotations for
-> those regions read low. Operators who need exact regional billing override
-> the affected entries in `pricing.yaml`.
+> those regions read low. Operators who need exact regional billing set the
+> affected models' prices on the provider record, or replace the default entries
+> via management's `AgentNetwork.PricingDefaultsFile`.
 
 ## AWS Bedrock (`bedrock_api`)
 
@@ -211,15 +212,19 @@ so a model-listing call can't be rewritten onto an upstream that would 404 it.
 ## Catalog ↔ pricing cross-check
 
 Catalog prices and context windows are cross-checked against LiteLLM's
-`model_prices_and_context_window.json`. The proxy's embedded
-`defaults_pricing.yaml` covers **every metered first-party model** the catalog
-enumerates — guarded by
-`TestDefaultTable_FirstPartyModelCoverage`
-([pricing/defaults_coverage_test.go](../../../proxy/internal/llm/pricing/defaults_coverage_test.go)),
-which fails if a catalog model has no embedded price. Bedrock entries are keyed
-by the **normalised** id the request parser emits (region prefix + version
-suffix stripped). Vertex Claude carries no Bedrock-style prefix, so it prices
-straight off the `anthropic` block.
+`model_prices_and_context_window.json`. The **catalog is the source of default
+prices**: management's `pricing.DefaultTable` folds every catalog provider's
+models into the surfaces that provider declares (`PricingSurfaces`), so coverage
+is structural rather than maintained in a parallel file
+([pricing/defaults.go](../../../management/internals/modules/agentnetwork/pricing/defaults.go)).
+`TestDefaultTable_CoversEveryCatalogModel` fails if a catalog model ends up
+unpriced, and `TestDefaultTable_NoConflictingContributions` fails if two
+providers contribute the same (surface, model) at different rates. Bedrock
+entries are keyed by the **normalised** id the request parser emits (region
+prefix + version suffix stripped) — management applies the same normalisation to
+per-provider prices at synth time, so the two keys compare equal. Vertex Claude
+carries no Bedrock-style prefix, so it prices straight off the `anthropic`
+surface.
 
 ## Things to scrutinise
 
@@ -232,16 +237,17 @@ operator-misconfigured Vertex provider and unmetered Gemini traffic; verify
 publishers).
 
 **Correctness.** `normalizeBedrockModel` is the join between the wire id and the
-pricing key — a model that normalises to something not in `defaults_pricing.yaml`
-meters at `cost.skipped=unknown_model` rather than failing the request. The
+pricing key — a model that normalises to something absent from the shipped
+pricing table meters at `cost.skipped=unknown_model` rather than failing the
+request. The
 `/bedrock` prefix strip must run on both the parser side (so the model is
 extracted) and the router side (so the upstream path is native); a regression in
 either silently breaks the other.
 
 **Metering caveats.** eu/apac cross-region Bedrock + Vertex profiles carry a
-~10% premium not modelled by base pricing — flagged in both the catalog comment
-and `defaults_pricing.yaml`. Operators needing exact regional billing override
-the relevant entries.
+~10% premium not modelled by base pricing — flagged in the catalog comment.
+Operators needing exact regional billing set per-provider prices on the model
+rows (or replace the default entries via `AgentNetwork.PricingDefaultsFile`).
 
 ## Cross-references
 

e2e/agentnetwork/custom_pricing_test.go

@@ -23,10 +23,9 @@ import (
 // model the client asks for. The proxy prices off the REQUEST model, not the
 // upstream response model, so a made-up model id billed at operator rates lets
 // these tests assert exact costs without a real vendor key.
-// Sourced from the harness so the counts can't drift from the mock's config.
 const (
-	vllmPromptTokens     = harness.VLLMChatInputTokens
-	vllmCompletionTokens = harness.VLLMChatOutputTokens
+	vllmPromptTokens     = 11
+	vllmCompletionTokens = 2
 )
 
 // pricedEnv is a connected single-provider agent-network deployment pointed at
@@ -170,48 +169,23 @@ func chatOnce(t *testing.T, ctx context.Context, env pricedEnv, model, sessionID
 	return body
 }
 
-// accessLogIngestWindow is how long a single request's access-log row is given
-// to appear before the caller gives up on it.
-// accessLogIngestWindow bounds how long a row may take to appear after its
-// request returned. The proxy streams each entry to management with a 10s send
-// timeout of its own, so a request whose send hits one full timeout and is
-// retried has not yet missed anything real — 30s left barely three send
-// attempts of headroom and lost the race on a loaded runner.
-const accessLogIngestWindow = 60 * time.Second
-
-// lookupAccessLogBySession polls the access-log page for the row carrying
-// sessionID and reports whether it arrived within the window. It never fails
-// the test: callers that can recover — by firing a fresh request under a new
-// session — need to see the miss rather than die on it.
-func lookupAccessLogBySession(ctx context.Context, sessionID string, within time.Duration) (api.AgentNetworkAccessLog, bool) {
-	deadline := time.Now().Add(within)
-	for {
-		if logs, lerr := srv.ListAccessLogs(ctx); lerr == nil {
-			for _, r := range logs.Data {
-				if r.SessionId != nil && *r.SessionId == sessionID {
-					return r, true
-				}
-			}
-		}
-		if time.Now().After(deadline) {
-			return api.AgentNetworkAccessLog{}, false
-		}
-		select {
-		case <-ctx.Done():
-			return api.AgentNetworkAccessLog{}, false
-		case <-time.After(2 * time.Second):
-		}
-	}
-}
-
-// findAccessLogBySession polls the access-log page for the row carrying
-// sessionID, failing the test if it never lands. Use it for a request whose row
-// must exist; where a missing row is a recoverable race, use
-// lookupAccessLogBySession and retry.
+// findAccessLogBySession polls the access-log page for the row carrying sessionID.
 func findAccessLogBySession(t *testing.T, ctx context.Context, sessionID string) api.AgentNetworkAccessLog {
 	t.Helper()
-	row, ok := lookupAccessLogBySession(ctx, sessionID, accessLogIngestWindow)
-	require.True(t, ok, "session id %q must be recorded in an access-log row", sessionID)
+	var row api.AgentNetworkAccessLog
+	require.Eventually(t, func() bool {
+		logs, lerr := srv.ListAccessLogs(ctx)
+		if lerr != nil {
+			return false
+		}
+		for _, r := range logs.Data {
+			if r.SessionId != nil && *r.SessionId == sessionID {
+				row = r
+				return true
+			}
+		}
+		return false
+	}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row", sessionID)
 	return row
 }
 
@@ -345,11 +319,6 @@ func TestPriceChangeUpdatesRecordedCost(t *testing.T) {
 		outRateA    = 0.020
 		inRateB     = 0.050 // 5x / 4x the original, so a repriced row is unmistakable
 		outRateB    = 0.080
-		// Per-attempt ingest wait, shorter than the default so a request that
-		// produces no row costs one retry rather than most of the budget, and an
-		// overall deadline long enough to hold several attempts.
-		repriceIngestWindow = 20 * time.Second
-		repriceDeadline     = 180 * time.Second
 	)
 
 	env := provisionPricedProvider(t, ctx, "reprice", []api.AgentNetworkProviderModel{
@@ -384,15 +353,10 @@ func TestPriceChangeUpdatesRecordedCost(t *testing.T) {
 	// reading its cost, so an un-ingested row is never mistaken for "still rate A".
 	// The expected new input cost is unmistakably higher than rate A, so a
 	// lingering old-rate row can't satisfy the check.
-	//
-	// Every way an iteration can come up short — the request failing, its row not
-	// landing, or the row still carrying rate A — is a symptom of the same
-	// in-flight rebuild, so each one retries under a fresh session rather than
-	// ending the test. Only the outer deadline is fatal.
 	wantInputB := float64(vllmPromptTokens) / 1000 * inRateB
 	var repriced api.AgentNetworkAccessLog
 	var lastSession string
-	deadline := time.Now().Add(repriceDeadline)
+	deadline := time.Now().Add(90 * time.Second)
 	for time.Now().Before(deadline) {
 		lastSession = fmt.Sprintf("e2e-session-reprice-b-%d", time.Now().UnixNano())
 		code, _, cerr := env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, customModel, "Reply with exactly: pong", lastSession)
@@ -400,15 +364,7 @@ func TestPriceChangeUpdatesRecordedCost(t *testing.T) {
 			time.Sleep(5 * time.Second)
 			continue
 		}
-		row, ok := lookupAccessLogBySession(ctx, lastSession, repriceIngestWindow)
-		if !ok {
-			// No row for this request. The provider update rebuilds the proxy's
-			// middleware chain, and a request served mid-rebuild can complete
-			// without a resolved provider — 200 to the caller, nothing to
-			// attribute, so no row is ever written for it. Fire another one.
-			t.Logf("no access-log row for session %q within %s; retrying under a fresh session", lastSession, repriceIngestWindow)
-			continue
-		}
+		row := findAccessLogBySession(t, ctx, lastSession)
 		if inDelta(row.InputCostUsd, wantInputB, 1e-6) {
 			repriced = row
 			break
@@ -674,47 +630,3 @@ func inDelta(a, b, tol float64) bool {
 	}
 	return d <= tol
 }
-
-// TestCustomDatedModelKeepsItsOwnPrice covers the review fix that anchored the
-// release-date fallback to Claude ids. Pricing looks every model up through
-// that helper, so while it matched a bare trailing date any operator id ending
-// in eight digits inherited the rate of its undated sibling — a silent
-// mis-bill on models NetBird knows nothing about.
-func TestCustomDatedModelKeepsItsOwnPrice(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	const (
-		baseModel  = "internal-llm"
-		datedModel = "internal-llm-20250101"
-		baseIn     = 0.010
-		baseOut    = 0.020
-		// An order of magnitude apart, so a row billed at the wrong entry is
-		// unmistakable rather than a rounding argument.
-		datedIn  = 0.100
-		datedOut = 0.200
-	)
-
-	env := provisionPricedProvider(t, ctx, "customdated", []api.AgentNetworkProviderModel{
-		{Id: baseModel, InputPer1k: baseIn, OutputPer1k: baseOut},
-		{Id: datedModel, InputPer1k: datedIn, OutputPer1k: datedOut},
-	})
-
-	t.Run("the undated id bills at its own rate", func(t *testing.T) {
-		session := fmt.Sprintf("e2e-session-customdated-base-%d", time.Now().UnixNano())
-		chatOnce(t, ctx, env, baseModel, session)
-		assertOpenAICostAtRates(t, findAccessLogBySession(t, ctx, session), baseIn, baseOut)
-	})
-
-	t.Run("the dated id keeps its own rate", func(t *testing.T) {
-		session := fmt.Sprintf("e2e-session-customdated-dated-%d", time.Now().UnixNano())
-		chatOnce(t, ctx, env, datedModel, session)
-		row := findAccessLogBySession(t, ctx, session)
-		assertOpenAICostAtRates(t, row, datedIn, datedOut)
-
-		// Spelled out because it is the regression: inheriting the sibling's
-		// rate would bill this request at a tenth of its price.
-		assert.Greater(t, row.InputCostUsd, float64(vllmPromptTokens)/1000*baseIn*2,
-			"a custom dated id must not inherit the undated entry's rate")
-	})
-}

e2e/agentnetwork/discovery_live_test.go

@@ -1,400 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"sort"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// TestLiveModelDiscovery drives model discovery against the REAL vendor
-// endpoints — OpenAI, Anthropic, Bedrock and Vertex — rather than the mock.
-//
-// The mock upstream proves the filter's mechanics: it advertises ids we chose,
-// so a listing narrowing to the ones we authorised is arithmetic we already
-// controlled both sides of. What it cannot prove is that the filter survives
-// contact with a real catalogue — ids we never enumerated, dated builds whose
-// suffix the vendor picks, surfaces that answer a listing request with
-// something other than a listing. That is what this covers, and it is the part
-// a QA engineer would otherwise have to walk through by hand.
-//
-// One proxy serves every case. Each provider gets its own group, policy and
-// client, because a model-less request matches exactly ONE route
-// (matchModelless): with two providers authorised for the same caller, the
-// listing would go to whichever won the tiebreak and the other would go
-// untested. Group-scoping the caller makes each provider the only candidate
-// for its own client.
-func TestLiveModelDiscovery(t *testing.T) {
-	cases := liveDiscoveryCases()
-	if len(cases) == 0 {
-		t.Skip("no provider keys set; source ~/.llm-keys to run live model discovery")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
-	defer cancel()
-
-	t.Logf("[discovery] live matrix: %s", strings.Join(caseNames(cases), ", "))
-
-	// Provision every provider, group and policy before the proxy starts: the
-	// proxy takes a configuration snapshot at connect time and does not
-	// reconcile provider changes made afterwards.
-	keys := make(map[string]string, len(cases))
-	for i := range cases {
-		keys[cases[i].name] = provisionLiveDiscovery(t, ctx, &cases[i])
-	}
-
-	endpoint, firstIP, firstClient, px := connectClient(t, ctx, "disc-live", keys[cases[0].name])
-	clients := map[string]*harness.Client{cases[0].name: firstClient}
-	ips := map[string]string{cases[0].name: firstIP}
-	for _, tc := range cases[1:] {
-		cl := joinClient(t, ctx, px, endpoint, keys[tc.name])
-		ip, err := cl.ResolveProxyIP(ctx, endpoint)
-		require.NoError(t, err, "resolve endpoint from the %s client", tc.name)
-		clients[tc.name] = cl
-		ips[tc.name] = ip
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			runLiveDiscoveryCase(t, ctx, tc, clients[tc.name], endpoint, ips[tc.name])
-		})
-	}
-}
-
-// discoveryOutcome is what a discovery request must produce end to end. The
-// three are genuinely different contracts, not degrees of success: only the
-// first puts a bounded listing in front of the caller.
-type discoveryOutcome int
-
-const (
-	// outcomeFiltered: the proxy routes the request and bounds the response to
-	// what the caller may use.
-	outcomeFiltered discoveryOutcome = iota
-	// outcomeDenied: no provider of this shape can serve the surface, so the
-	// proxy refuses rather than rewriting the request onto an upstream that
-	// would 404 it. The caller gets a NetBird error, not a vendor one.
-	outcomeDenied
-	// outcomeUpstreamNoListing: the proxy routes the request to the configured
-	// upstream, and the vendor does not implement the endpoint there. Proxy
-	// side correct, product side a dead end — see the Bedrock case.
-	outcomeUpstreamNoListing
-)
-
-// liveDiscoveryCase is one provider's discovery surface and what the proxy
-// must make of it.
-type liveDiscoveryCase struct {
-	name      string
-	catalogID string
-	upstream  string
-	apiKey    string
-
-	// path is the discovery endpoint the client calls. Not every surface uses
-	// /v1/models: Bedrock lists inference profiles instead.
-	path string
-	// headers the vendor requires on a bare GET (Anthropic versions its API
-	// through a header, and rejects a request without one).
-	headers []string
-
-	// models the provider record enumerates. Empty models a gateway record,
-	// which enumerates nothing and claims everything.
-	models []string
-	// allowlist, when non-empty, is a guardrail narrowing the policy below the
-	// provider's own enumeration — the second of the two bounds discovery
-	// applies, and the only one a provider record alone cannot demonstrate.
-	allowlist []string
-
-	// outcome is what this surface must produce end to end.
-	outcome discoveryOutcome
-
-	// permitted is every id allowed to survive filtering, in the form the
-	// provider record registers it. A surviving id counts as permitted when it
-	// matches one of these outright or after Anthropic date-normalisation.
-	permitted []string
-	// wantHidden are ids the upstream is known to advertise and the bound must
-	// remove. Only set where we enumerate the model ourselves, so the
-	// expectation cannot rot when a vendor changes its catalogue.
-	wantHidden []string
-}
-
-// liveDiscoveryCases builds the matrix from whichever provider credentials are
-// present, mirroring availableProviders' env-var gating so a partial key set
-// still yields partial coverage.
-func liveDiscoveryCases() []liveDiscoveryCase {
-	var cases []liveDiscoveryCase
-
-	// OpenAI enumerates TWO real models and the policy permits one. That is
-	// the only case here where both bounds are observable at once: the
-	// upstream advertises dozens of ids, the provider record cuts them to two,
-	// and the guardrail cuts those to one.
-	if k := os.Getenv("OPENAI_TOKEN"); k != "" {
-		cases = append(cases, liveDiscoveryCase{
-			name: "openai", catalogID: "openai_api", upstream: "https://api.openai.com", apiKey: k,
-			path:       "/v1/models",
-			models:     []string{"gpt-4o-mini", "gpt-4o"},
-			allowlist:  []string{"gpt-4o-mini"},
-			outcome:    outcomeFiltered,
-			permitted:  []string{"gpt-4o-mini"},
-			wantHidden: []string{"gpt-4o"},
-		})
-	}
-
-	// Anthropic is the surface Claude Code actually calls. Its listing returns
-	// DATED build ids (claude-haiku-4-5-20251001) while the provider record
-	// registers the undated id, so this is the case that proves the filter's
-	// date-normalisation against ids the vendor chose rather than ids we wrote.
-	if k := os.Getenv("ANTHROPIC_TOKEN"); k != "" {
-		cases = append(cases, liveDiscoveryCase{
-			name: "anthropic", catalogID: "anthropic_api", upstream: "https://api.anthropic.com", apiKey: k,
-			path:      "/v1/models",
-			headers:   []string{"anthropic-version: 2023-06-01"},
-			models:    []string{"claude-haiku-4-5"},
-			outcome:   outcomeFiltered,
-			permitted: []string{"claude-haiku-4-5"},
-		})
-	}
-
-	// Bedrock lists inference profiles, not models: matchModelless routes
-	// /inference-profiles to a Bedrock route and refuses /v1/models for one.
-	//
-	// The request reaches AWS and AWS refuses it — bedrock-runtime answers
-	// <UnknownOperationException/>, because ListInferenceProfiles is a CONTROL
-	// PLANE operation served by bedrock.<region>.amazonaws.com, not the runtime
-	// host. A provider record carries one upstream and it has to be the runtime
-	// host for InvokeModel to work, so no Bedrock record can serve a listing as
-	// the model stands today.
-	//
-	// The mock upstream hides this entirely: it answers /inference-profiles on
-	// the same listener as everything else, so the routing test passes there
-	// while the real endpoint 404s. That is the whole reason this file exists,
-	// so the case is kept, asserting what actually happens.
-	if k := os.Getenv("AWS_BEARER_TOKEN_BEDROCK"); k != "" {
-		region := os.Getenv("AWS_REGION")
-		if region == "" {
-			region = "eu-central-1"
-		}
-		model := os.Getenv("AWS_BEDROCK_MODEL")
-		if model == "" {
-			model = "global.anthropic.claude-sonnet-4-6"
-		}
-		cases = append(cases, liveDiscoveryCase{
-			name: "bedrock", catalogID: "bedrock_api",
-			upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k,
-			path:    "/inference-profiles",
-			models:  []string{sharedllm.NormalizeAnthropicModel(strings.TrimPrefix(model, "global."))},
-			outcome: outcomeUpstreamNoListing,
-		})
-	}
-
-	// Vertex carries the model in the rawPredict path and serves no listing
-	// endpoint at all, so the proxy must refuse discovery rather than rewrite
-	// it onto an upstream that would 404.
-	if sa := os.Getenv("GOOGLE_VERTEX_SA_BASE64"); sa != "" {
-		if project := os.Getenv("GOOGLE_VERTEX_PROJECT"); project != "" {
-			region := os.Getenv("GOOGLE_VERTEX_REGION")
-			if region == "" {
-				region = "global"
-			}
-			host := "aiplatform.googleapis.com"
-			if region != "global" {
-				host = region + "-aiplatform.googleapis.com"
-			}
-			cases = append(cases, liveDiscoveryCase{
-				name: "vertex", catalogID: "vertex_ai_api", upstream: "https://" + host,
-				apiKey:  "keyfile::" + sa,
-				path:    "/v1/models",
-				outcome: outcomeDenied,
-			})
-		}
-	}
-
-	return cases
-}
-
-// provisionLiveDiscovery creates the group, provider, optional guardrail and
-// policy for one case, and returns the setup key a client joins that group
-// with. Scoping each provider to its own group is what keeps it the only
-// candidate for its own client's model-less request.
-func provisionLiveDiscovery(t *testing.T, ctx context.Context, tc *liveDiscoveryCase) string {
-	t.Helper()
-
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-disc-live-" + tc.name})
-	require.NoError(t, err, "create group for %s", tc.name)
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-disc-live-" + tc.name,
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key for %s", tc.name)
-	require.NotEmpty(t, sk.Key, "setup key plaintext for %s", tc.name)
-
-	req := api.AgentNetworkProviderRequest{
-		Name:        "e2e-disc-live-" + tc.name,
-		ProviderId:  tc.catalogID,
-		UpstreamUrl: tc.upstream,
-		ApiKey:      &tc.apiKey,
-		Enabled:     ptr(true),
-	}
-	if len(tc.models) > 0 {
-		models := make([]api.AgentNetworkProviderModel, 0, len(tc.models))
-		for _, id := range tc.models {
-			models = append(models, api.AgentNetworkProviderModel{Id: id, InputPer1k: 0.001, OutputPer1k: 0.002})
-		}
-		req.Models = &models
-	}
-	prov, err := srv.CreateProvider(ctx, req)
-	require.NoError(t, err, "create provider %s", tc.name)
-	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
-
-	polReq := api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-disc-live-" + tc.name,
-		Enabled:                ptr(true),
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: []string{prov.Id},
-	}
-	if len(tc.allowlist) > 0 {
-		var gr api.AgentNetworkGuardrailRequest
-		gr.Name = "e2e-disc-live-" + tc.name
-		gr.Checks.ModelAllowlist.Enabled = true
-		gr.Checks.ModelAllowlist.Models = tc.allowlist
-		g, gerr := srv.CreateGuardrail(ctx, gr)
-		require.NoError(t, gerr, "create guardrail for %s", tc.name)
-		t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
-		polReq.GuardrailIds = &[]string{g.Id}
-	}
-	pol, err := srv.CreatePolicy(ctx, polReq)
-	require.NoError(t, err, "create policy for %s", tc.name)
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	return sk.Key
-}
-
-// runLiveDiscoveryCase issues the discovery request and reports everything the
-// vendor said before asserting on any of it. The log is the point on the first
-// run: a live catalogue is the one input we do not control, so a failure has to
-// arrive with the response that caused it rather than just a count.
-func runLiveDiscoveryCase(t *testing.T, ctx context.Context, tc liveDiscoveryCase, cl *harness.Client, endpoint, proxyIP string) {
-	t.Helper()
-
-	// A single request is enough for the two non-listing outcomes, and retrying
-	// them would burn the retry window waiting for a status that is never
-	// coming.
-	if tc.outcome != outcomeFiltered {
-		code, body, err := cl.Get(ctx, endpoint, proxyIP, tc.path, tc.headers)
-		require.NoError(t, err, "request must reach the proxy")
-		t.Logf("[discovery] %s GET %s -> %d; body: %s", tc.name, tc.path, code, truncate(body, 2000))
-		assert.NotEqual(t, 200, code,
-			"%s serves no bounded listing, so a 200 here would mean the caller was handed a picker nothing narrows; body: %s",
-			tc.name, truncate(body, 2000))
-
-		// Which side refused is the whole distinction between these two
-		// outcomes, and a NetBird error is the thing that tells them apart: the
-		// middleware chain stamps its own name on anything it generates.
-		if tc.outcome == outcomeDenied {
-			assert.True(t, isProxyError(body),
-				"%s serves no listing endpoint at all, so the proxy must refuse the request itself rather than forward it to an upstream that would answer for us; body: %s",
-				tc.name, truncate(body, 2000))
-			return
-		}
-		assert.False(t, isProxyError(body),
-			"%s discovery must be routed to the configured upstream and refused by the vendor, not blocked by the proxy; body: %s",
-			tc.name, truncate(body, 2000))
-		return
-	}
-
-	code, body := callUntil(t, func() (int, string, error) {
-		return cl.Get(ctx, endpoint, proxyIP, tc.path, tc.headers)
-	}, 200)
-	t.Logf("[discovery] %s GET %s -> %d; body: %s", tc.name, tc.path, code, truncate(body, 4000))
-	require.Equal(t, 200, code, "%s discovery must be served; body: %s", tc.name, truncate(body, 2000))
-
-	ids, ok := listingIDs(body)
-	require.Truef(t, ok,
-		"%s answered discovery with something other than a {\"data\":[{\"id\":…}]} listing, which the filter forwards untouched — the caller would get an unbounded picker; body: %s",
-		tc.name, truncate(body, 2000))
-	sort.Strings(ids)
-	t.Logf("[discovery] %s: %d ids after filtering: %s", tc.name, len(ids), strings.Join(ids, ", "))
-
-	require.NotEmpty(t, ids, "%s filtered the listing down to nothing; the caller would see an empty picker", tc.name)
-
-	permitted := make(map[string]struct{}, len(tc.permitted)*2)
-	for _, id := range tc.permitted {
-		permitted[id] = struct{}{}
-		permitted[sharedllm.NormalizeAnthropicModel(id)] = struct{}{}
-	}
-	for _, id := range ids {
-		_, direct := permitted[id]
-		_, normalised := permitted[sharedllm.NormalizeAnthropicModel(id)]
-		assert.Truef(t, direct || normalised,
-			"%s offered %q, which no policy on this route permits — every entry the picker shows must be a request the guardrail would allow", tc.name, id)
-	}
-	for _, hidden := range tc.wantHidden {
-		assert.NotContainsf(t, ids, hidden,
-			"%s offered %q, which the provider enumerates but the policy does not permit", tc.name, hidden)
-	}
-}
-
-// isProxyError reports whether a response body was generated by the middleware
-// chain rather than forwarded from a vendor. Every chain-generated error names
-// the middleware that raised it, which no upstream's error body does — so this
-// separates "the proxy refused" from "the proxy routed it and the vendor
-// refused", the two failures that otherwise look alike from the client side.
-func isProxyError(body string) bool {
-	return strings.Contains(body, `"middleware":`)
-}
-
-// listingIDs pulls the model ids out of a listing response. ok is false when
-// the body is not the {"data":[{"id":…}]} shape the filter recognises.
-func listingIDs(body string) ([]string, bool) {
-	var doc struct {
-		Data []struct {
-			ID string `json:"id"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal([]byte(body), &doc); err != nil {
-		return nil, false
-	}
-	if doc.Data == nil {
-		return nil, false
-	}
-	ids := make([]string, 0, len(doc.Data))
-	for _, entry := range doc.Data {
-		ids = append(ids, entry.ID)
-	}
-	return ids, true
-}
-
-func caseNames(cases []liveDiscoveryCase) []string {
-	names := make([]string, 0, len(cases))
-	for _, c := range cases {
-		names = append(names, c.name)
-	}
-	return names
-}
-
-// truncate bounds a logged response body. A live catalogue can run to tens of
-// kilobytes, and the useful part is the front.
-func truncate(s string, limit int) string {
-	if len(s) <= limit {
-		return s
-	}
-	return s[:limit] + "… (" + strconv.Itoa(len(s)-limit) + " more bytes)"
-}

e2e/agentnetwork/discovery_multipolicy_test.go

@@ -1,168 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// TestDiscoveryBoundToCallersPolicies covers a model listing on a provider two
-// teams reach under different allowlists.
-//
-// Bounding the listing by the provider's enumerated models alone is not enough
-// once more than one policy is in play: the caller would be offered every model
-// any team may use, and each one outside their own policy is a request the
-// guardrail refuses a moment later — the empty-or-wrong picker this endpoint
-// exists to avoid, just moved one level up.
-//
-// The client joins the main group only. Both models are enumerated by the same
-// provider and both are advertised by the upstream, so a listing that leaked
-// the other team's model would visibly contain it.
-func TestDiscoveryBoundToCallersPolicies(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	vllm, err := harness.StartVLLM(ctx, srv)
-	require.NoError(t, err, "start mock upstream")
-	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
-
-	grpMain, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-disc-mp-main"})
-	require.NoError(t, err, "create main group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpMain.Id) })
-
-	grpOther, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-disc-mp-other"})
-	require.NoError(t, err, "create other group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpOther.Id) })
-
-	ephemeral := false
-	mkKey := func(name, groupID string) string {
-		sk, kerr := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-			Name:       name,
-			Type:       "reusable",
-			ExpiresIn:  86400,
-			UsageLimit: 0,
-			AutoGroups: []string{groupID},
-			Ephemeral:  &ephemeral,
-		})
-		require.NoError(t, kerr, "mint setup key %s", name)
-		require.NotEmpty(t, sk.Key, "setup key plaintext")
-		return sk.Key
-	}
-	// One client per group. The second is what makes the first assertion mean
-	// something: without a client that DOES see the other team's model, its
-	// absence from the main client's listing could equally be a policy that
-	// never propagated.
-	keyMain := mkKey("e2e-disc-mp-main-client", grpMain.Id)
-	keyOther := mkKey("e2e-disc-mp-other-client", grpOther.Id)
-
-	// One provider enumerating both models the upstream advertises, so the
-	// listing is narrowed by policy rather than by what the provider serves.
-	staticKey := "static-e2e-token"
-	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "e2e-disc-mp",
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &staticKey,
-		Enabled:     ptr(true),
-		Models: &[]api.AgentNetworkProviderModel{
-			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.001},
-			{Id: harness.VLLMUnlistedModel, InputPer1k: 0.001, OutputPer1k: 0.001},
-		},
-	})
-	require.NoError(t, err, "create provider")
-	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
-
-	mkGuardrail := func(name, model string) api.AgentNetworkGuardrail {
-		var gr api.AgentNetworkGuardrailRequest
-		gr.Name = name
-		gr.Checks.ModelAllowlist.Enabled = true
-		gr.Checks.ModelAllowlist.Models = []string{model}
-		g, gerr := srv.CreateGuardrail(ctx, gr)
-		require.NoError(t, gerr, "create guardrail %s", name)
-		t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
-		return g
-	}
-	gMain := mkGuardrail("e2e-disc-mp-main", harness.VLLMModel)
-	gOther := mkGuardrail("e2e-disc-mp-other", harness.VLLMUnlistedModel)
-
-	enabled := true
-	polMain, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-disc-mp-main",
-		Enabled:                &enabled,
-		SourceGroups:           []string{grpMain.Id},
-		DestinationProviderIds: []string{prov.Id},
-		GuardrailIds:           &[]string{gMain.Id},
-	})
-	require.NoError(t, err, "create main policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMain.Id) })
-
-	// The other team's policy, on the same provider, permitting the model the
-	// client must never be offered.
-	polOther, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-disc-mp-other",
-		Enabled:                &enabled,
-		SourceGroups:           []string{grpOther.Id},
-		DestinationProviderIds: []string{prov.Id},
-		GuardrailIds:           &[]string{gOther.Id},
-	})
-	require.NoError(t, err, "create other policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polOther.Id) })
-
-	endpoint, proxyIP, clMain, px := connectClient(t, ctx, "disc-mp", keyMain)
-	clOther := joinClient(t, ctx, px, endpoint, keyOther)
-
-	listing := func(t *testing.T, cl *harness.Client, ip string) string {
-		t.Helper()
-		code, body := callUntil(t, func() (int, string, error) {
-			return cl.Get(ctx, endpoint, ip, "/v1/models?limit=1000", nil)
-		}, 200)
-		require.Equal(t, 200, code, "discovery must be served; body: %s", body)
-		return body
-	}
-
-	otherIP, err := clOther.ResolveProxyIP(ctx, endpoint)
-	require.NoError(t, err, "resolve endpoint from the other client")
-
-	// The other team's client first: seeing its own model proves polOther is
-	// live, so the main client's listing is narrowed by policy scoping rather
-	// than by the other policy having failed to apply at all.
-	otherBody := listing(t, clOther, otherIP)
-	assert.Contains(t, otherBody, harness.VLLMUnlistedModel,
-		"the other group's policy must be in force, or this test proves nothing")
-	assert.NotContains(t, otherBody, harness.VLLMModel,
-		"and it must not be offered the main group's model either — isolation runs both ways")
-
-	mainBody := listing(t, clMain, proxyIP)
-	assert.Contains(t, mainBody, harness.VLLMModel,
-		"the model the caller's own policy permits must reach the picker")
-	assert.NotContains(t, mainBody, harness.VLLMUnlistedModel,
-		"a model only another group's policy permits must not be offered to this caller")
-}
-
-// joinClient starts a second tunnel client against an already-running proxy, so
-// a test can drive the same endpoint as two different group memberships without
-// paying for a second proxy.
-func joinClient(t *testing.T, ctx context.Context, px *harness.Proxy, endpoint, setupKey string) *harness.Client {
-	t.Helper()
-
-	cl, err := harness.StartClient(ctx, srv, setupKey)
-	require.NoError(t, err, "start second client")
-	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
-
-	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "second client must connect to management")
-	if _, err := cl.ResolveProxyIP(ctx, endpoint); err != nil {
-		t.Fatalf("second client could not resolve the endpoint: %v", err)
-	}
-	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
-		t.Fatalf("second client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
-	}
-	return cl
-}

e2e/agentnetwork/gateway_protocol_test.go

@@ -1,455 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// Models each catalog surface is registered with in the matrix below. They
-// differ per provider so the router's choice is unambiguous: a request that
-// lands on the wrong provider record fails the surface assertion instead of
-// passing by coincidence.
-const (
-	matrixAnthropicModel = "claude-sonnet-5"
-	matrixBedrockModel   = "anthropic.claude-sonnet-5"
-	// matrixBedrockPathModel is what a Bedrock SDK client puts in the URL: a
-	// cross-region inference profile with a release date and version suffix.
-	// The proxy must normalise it back to matrixBedrockModel to route and price.
-	matrixBedrockPathModel = "us.anthropic.claude-sonnet-5-20250101-v1:0"
-	// matrixVertexModel differs from the Anthropic record's model on purpose:
-	// a shared id would leave two routes claiming it and make which one serves
-	// /v1/messages depend on declaration order.
-	matrixVertexModel   = "claude-haiku-4-5"
-	matrixVertexProject = "e2e-project"
-	matrixVertexRegion  = "us-east5"
-)
-
-// gatewayEnv is a connected client plus a set of provider records, all pointed
-// at one mock upstream, so several wire shapes can be driven over a single
-// tunnel.
-type gatewayEnv struct {
-	endpoint string
-	proxyIP  string
-	client   *harness.Client
-	proxy    *harness.Proxy
-	vllm     *harness.VLLM
-	// providerIDs maps the catalog id to the created provider record id.
-	providerIDs map[string]string
-}
-
-// provisionGatewayMatrix brings up one mock upstream and one provider record
-// per catalog surface, all authorised for the same group by a single policy.
-// Sharing one proxy and client keeps the wire-shape cases to one tunnel setup;
-// each case still creates its own session id so its access-log row is findable.
-func provisionGatewayMatrix(t *testing.T, ctx context.Context) gatewayEnv {
-	t.Helper()
-
-	vllm, err := harness.StartVLLM(ctx, srv)
-	require.NoError(t, err, "start mock upstream")
-	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
-
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gw-matrix"})
-	require.NoError(t, err, "create group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-gw-matrix-client",
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key")
-	require.NotEmpty(t, sk.Key, "setup key plaintext")
-
-	// The mock ignores auth, so a dummy credential satisfies each catalog
-	// entry's auth template. Vertex is the exception: its api_key is a GCP
-	// service-account keyfile the proxy mints an OAuth token from, and a dummy
-	// one cannot mint. That is deliberate — the Vertex case below asserts on
-	// routing, which happens before the token mint.
-	dummyKey := "sk-gw-e2e"
-	dummyKeyfile := "keyfile::" + "e2e-not-a-real-service-account-key"
-
-	specs := []struct {
-		name      string
-		catalogID string
-		apiKey    string
-		models    []api.AgentNetworkProviderModel
-	}{
-		{
-			name: "openai", catalogID: "openai_api", apiKey: dummyKey,
-			models: []api.AgentNetworkProviderModel{{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002}},
-		},
-		{
-			name: "anthropic", catalogID: "anthropic_api", apiKey: dummyKey,
-			models: []api.AgentNetworkProviderModel{{Id: matrixAnthropicModel, InputPer1k: 0.003, OutputPer1k: 0.015}},
-		},
-		{
-			name: "bedrock", catalogID: "bedrock_api", apiKey: dummyKey,
-			models: []api.AgentNetworkProviderModel{{Id: matrixBedrockModel, InputPer1k: 0.003, OutputPer1k: 0.015}},
-		},
-		{
-			name: "vertex", catalogID: "vertex_ai_api", apiKey: dummyKeyfile,
-			models: []api.AgentNetworkProviderModel{{Id: matrixVertexModel, InputPer1k: 0.001, OutputPer1k: 0.005}},
-		},
-	}
-
-	providerIDs := make(map[string]string, len(specs))
-	ids := make([]string, 0, len(specs))
-	for _, spec := range specs {
-		key := spec.apiKey
-		models := spec.models
-		prov, perr := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-			Name:        "e2e-gw-" + spec.name,
-			ProviderId:  spec.catalogID,
-			UpstreamUrl: vllm.URL,
-			ApiKey:      &key,
-			Enabled:     ptr(true),
-			Models:      &models,
-		})
-		require.NoError(t, perr, "create %s provider", spec.name)
-		id := prov.Id
-		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
-		providerIDs[spec.catalogID] = id
-		ids = append(ids, id)
-	}
-
-	// Uncapped token limit: never blocks the handful of tokens driven here, but
-	// switches on usage metering so consumption and cost land in the row.
-	enabled := true
-	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-gw-matrix",
-		Enabled:                &enabled,
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: ids,
-		Limits: &api.AgentNetworkPolicyLimits{
-			TokenLimit: api.AgentNetworkPolicyTokenLimit{
-				Enabled:       true,
-				GroupCap:      10_000_000,
-				UserCap:       10_000_000,
-				WindowSeconds: 60,
-			},
-		},
-	})
-	require.NoError(t, err, "create policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gw-matrix", sk.Key)
-	return gatewayEnv{
-		endpoint:    endpoint,
-		proxyIP:     proxyIP,
-		client:      cl,
-		proxy:       px,
-		vllm:        vllm,
-		providerIDs: providerIDs,
-	}
-}
-
-// connectClient starts a proxy and a tunnel client for the shared account and
-// waits until the client can reach the proxy peer, returning the endpoint and
-// the proxy's tunnel IP to pin requests to.
-func connectClient(t *testing.T, ctx context.Context, name, setupKey string) (string, string, *harness.Client, *harness.Proxy) {
-	t.Helper()
-
-	settings, err := srv.GetSettings(ctx)
-	require.NoError(t, err, "read settings")
-	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
-
-	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-"+name+"-proxy")
-	require.NoError(t, err, "mint proxy token")
-	px, err := harness.StartProxy(ctx, srv, proxyToken)
-	require.NoError(t, err, "start proxy")
-	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
-
-	cl, err := harness.StartClient(ctx, srv, setupKey)
-	require.NoError(t, err, "start client")
-	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
-
-	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
-	// The probe resolves the endpoint and its first packet wakes the lazy proxy
-	// peer, so WaitProxyPeer then observes it connected.
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve endpoint to proxy IP")
-	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
-		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
-	}
-	return settings.Endpoint, proxyIP, cl, px
-}
-
-// callUntil retries an HTTP call through the tunnel until it returns one of the
-// wanted statuses or the deadline passes, absorbing the DNS and tunnel jitter
-// the first call through a fresh tunnel can hit. The last status and body are
-// returned either way so the caller can assert with real detail.
-func callUntil(t *testing.T, call func() (int, string, error), want ...int) (int, string) {
-	t.Helper()
-	wanted := make(map[int]struct{}, len(want))
-	for _, w := range want {
-		wanted[w] = struct{}{}
-	}
-
-	var code int
-	var body string
-	deadline := time.Now().Add(90 * time.Second)
-	for time.Now().Before(deadline) {
-		c, b, err := call()
-		if err == nil {
-			code, body = c, b
-			if _, ok := wanted[code]; ok {
-				return code, body
-			}
-		}
-		time.Sleep(5 * time.Second)
-	}
-	return code, body
-}
-
-// TestGatewayProtocolProviderMatrix drives one request per wire shape over a
-// single tunnel, with a provider record per catalog surface behind it. It is
-// the regression net for the routing and parser-selection changes: each case
-// asserts the surface the request was metered under and the token counts that
-// surface's own usage block carries, so a request parsed by the wrong provider's
-// parser meters zero and fails rather than passing on a coincidence.
-func TestGatewayProtocolProviderMatrix(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	env := provisionGatewayMatrix(t, ctx)
-	diag := func() string {
-		return fmt.Sprintf("\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
-			env.vllm.Logs(context.Background()), env.proxy.Logs(context.Background()))
-	}
-
-	t.Run("openai chat completions", func(t *testing.T) {
-		session := "e2e-gw-openai"
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, harness.VLLMModel, "ping", session)
-		}, 200)
-		require.Equal(t, 200, code, "openai chat must succeed; body: %s%s", body, diag())
-		require.Contains(t, body, "chat.completion", "body must be an OpenAI completion; got: %s", body)
-
-		row := findAccessLogBySession(t, ctx, session)
-		require.NotNil(t, row.Provider)
-		assert.Equal(t, "openai", *row.Provider, "the OpenAI chat path must meter under the openai surface")
-		assert.Equal(t, int64(harness.VLLMChatInputTokens), row.InputTokens, "OpenAI usage block must be read")
-		assert.Equal(t, int64(harness.VLLMChatOutputTokens), row.OutputTokens)
-	})
-
-	t.Run("anthropic messages", func(t *testing.T) {
-		session := "e2e-gw-anthropic"
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, matrixAnthropicModel, "ping", session)
-		}, 200)
-		require.Equal(t, 200, code, "anthropic messages must succeed; body: %s%s", body, diag())
-
-		row := findAccessLogBySession(t, ctx, session)
-		require.NotNil(t, row.Provider)
-		assert.Equal(t, "anthropic", *row.Provider, "the /v1/messages path must meter under the anthropic surface")
-		// These counts only appear if the Anthropic parser read the response:
-		// its usage fields are named differently from the OpenAI block.
-		assert.Equal(t, int64(harness.VLLMMessagesInputTokens), row.InputTokens,
-			"Anthropic input_tokens must be read; zero here means the wrong parser ran")
-		assert.Equal(t, int64(harness.VLLMMessagesOutputTokens), row.OutputTokens)
-		assert.Positive(t, row.CachedInputTokens, "the Anthropic cache-read bucket must be recorded")
-		assert.Positive(t, row.CostUsd, "a metered request must carry a cost")
-		require.NotNil(t, row.ResolvedProviderId)
-		assert.Equal(t, env.providerIDs["anthropic_api"], *row.ResolvedProviderId,
-			"a vendor-tagged request must not cross to another provider's record")
-	})
-
-	t.Run("bedrock invoke normalises the path model", func(t *testing.T) {
-		session := "e2e-gw-bedrock"
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Bedrock(ctx, env.endpoint, env.proxyIP, matrixBedrockPathModel, "ping", session)
-		}, 200)
-		require.Equal(t, 200, code, "bedrock invoke must succeed; body: %s%s", body, diag())
-
-		row := findAccessLogBySession(t, ctx, session)
-		require.NotNil(t, row.Provider)
-		assert.Equal(t, "bedrock", *row.Provider, "a native Bedrock path must meter under the bedrock surface")
-		require.NotNil(t, row.Model)
-		assert.Equal(t, matrixBedrockModel, *row.Model,
-			"the inference-profile prefix, release date and version suffix must be normalised away")
-		assert.Equal(t, int64(harness.VLLMMessagesInputTokens), row.InputTokens)
-	})
-
-	t.Run("anthropic token counting", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP, "/v1/messages/count_tokens",
-				fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":"ping"}]}`, matrixAnthropicModel),
-				[]string{"anthropic-version: 2023-06-01"})
-		}, 200)
-		assert.Equal(t, 200, code, "token counting must route rather than deny; body: %s%s", body, diag())
-	})
-
-	t.Run("bedrock token counting", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP,
-				"/model/"+matrixBedrockPathModel+"/count-tokens",
-				`{"input":{"converse":{"messages":[{"role":"user","content":[{"text":"ping"}]}]}}}`, nil)
-		}, 200)
-		assert.Equal(t, 200, code,
-			"the Bedrock count-tokens action must route; denying it pushes counting onto the billable inference path; body: %s%s",
-			body, diag())
-	})
-
-	t.Run("vertex token counting reaches its provider", func(t *testing.T) {
-		// The dummy service-account key cannot mint an OAuth token, so the
-		// request stops at the upstream credential. Both outcomes render as
-		// 403, so the deny code is what distinguishes them: upstream_auth_failed
-		// means the path resolved to the Vertex route and only the credential
-		// failed, while model_not_routable would mean the method segment was
-		// swallowed into the model id and no route ever claimed it.
-		path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s/count-tokens:rawPredict",
-			matrixVertexProject, matrixVertexRegion, matrixVertexModel)
-		_, body := callUntil(t, func() (int, string, error) {
-			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP, path,
-				`{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"ping"}]}`, nil)
-		}, 403)
-		assert.NotContains(t, body, "model_not_routable",
-			"the count-tokens method segment must not be parsed as part of the model id; body: %s%s", body, diag())
-		assert.Contains(t, body, "llm_policy.upstream_auth_failed",
-			"the request must reach the Vertex route and fail only at the credential; body: %s%s", body, diag())
-	})
-
-	t.Run("connection warming probe", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Get(ctx, env.endpoint, env.proxyIP, "/api/hello", nil)
-		}, 200)
-		assert.NotEqual(t, 403, code,
-			"the warm-up probe carries no model and must not be refused as unroutable; body: %s%s", body, diag())
-	})
-
-	t.Run("unknown model denies in the caller's error shape", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages,
-				"claude-not-a-real-model-9", "ping", "e2e-gw-unknown")
-		}, 403)
-		require.Equal(t, 403, code, "a model no provider claims must still be refused; body: %s%s", body, diag())
-
-		// The NetBird fields stay where they were for existing consumers.
-		assert.Contains(t, body, "llm_policy.model_not_routable", "the deny code must be preserved")
-		// And the vendor's own envelope rides alongside, so the client can show
-		// the reason instead of an unexplained API error.
-		assert.Contains(t, body, `"type":"error"`, "an Anthropic caller must get the Anthropic error envelope")
-		assert.Contains(t, body, "permission_error", "403 must map to the vendor's permission error type")
-	})
-}
-
-// TestModelDiscoveryWithModelAllowlist covers gateway model discovery on an
-// account that restricts models, which is the configuration that broke: the
-// listing carries no model, and the per-model allowlist fails closed on an
-// undetermined one, so discovery denied for exactly the accounts using the
-// feature. It also asserts the allowlist still refuses a model outside it, so
-// the exemption cannot be read as a way around the gate.
-func TestModelDiscoveryWithModelAllowlist(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	vllm, err := harness.StartVLLM(ctx, srv)
-	require.NoError(t, err, "start mock upstream")
-	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
-
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gw-discovery"})
-	require.NoError(t, err, "create group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-gw-discovery-client",
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key")
-	require.NotEmpty(t, sk.Key, "setup key plaintext")
-
-	// One provider enumerating a single model, while the upstream's own listing
-	// advertises two. The proxy must serve the shorter list.
-	dummyKey := "sk-discovery-e2e"
-	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "e2e-gw-discovery",
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &dummyKey,
-		Enabled:     ptr(true),
-		Models: &[]api.AgentNetworkProviderModel{
-			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
-		},
-	})
-	require.NoError(t, err, "create provider")
-	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
-
-	// The model allowlist is what makes this a regression test: without a
-	// guardrail enabled, discovery was never gated in the first place.
-	var gr api.AgentNetworkGuardrailRequest
-	gr.Name = "e2e-gw-discovery-allowlist"
-	gr.Checks.ModelAllowlist.Enabled = true
-	gr.Checks.ModelAllowlist.Models = []string{harness.VLLMModel}
-	guard, err := srv.CreateGuardrail(ctx, gr)
-	require.NoError(t, err, "create guardrail")
-	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
-
-	enabled := true
-	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-gw-discovery",
-		Enabled:                &enabled,
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: []string{prov.Id},
-		GuardrailIds:           &[]string{guard.Id},
-	})
-	require.NoError(t, err, "create policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gw-discovery", sk.Key)
-	diag := func() string {
-		return fmt.Sprintf("\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
-			vllm.Logs(context.Background()), px.Logs(context.Background()))
-	}
-
-	t.Run("listing is served and bounded by policy", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return cl.Get(ctx, endpoint, proxyIP, "/v1/models?limit=1000", nil)
-		}, 200)
-		require.Equal(t, 200, code,
-			"discovery must not be refused because the request carries no model; body: %s%s", body, diag())
-
-		assert.Contains(t, body, harness.VLLMModel, "the authorised model must reach the picker")
-		assert.NotContains(t, body, harness.VLLMUnlistedModel,
-			"a model the policy does not authorise must not be offered; body: %s", body)
-	})
-
-	t.Run("allowlist still refuses a model outside it", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return cl.Chat(ctx, endpoint, proxyIP, harness.WireChat,
-				harness.VLLMUnlistedModel, "ping", "e2e-gw-discovery-blocked")
-		}, 403)
-		require.Equal(t, 403, code,
-			"exempting model-less endpoints must not exempt inference; body: %s%s", body, diag())
-		assert.True(t,
-			strings.Contains(body, "llm_policy.model_blocked") || strings.Contains(body, "llm_policy.model_not_routable"),
-			"the refusal must name a model policy code; body: %s", body)
-	})
-
-	t.Run("allowlisted model still routes", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return cl.Chat(ctx, endpoint, proxyIP, harness.WireChat,
-				harness.VLLMModel, "ping", "e2e-gw-discovery-allowed")
-		}, 200)
-		require.Equal(t, 200, code, "the allowlisted model must still be served; body: %s%s", body, diag())
-	})
-}

e2e/agentnetwork/gateway_review_test.go

@@ -1,242 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// The cases in this file cover behaviour that arrived from code review, after
-// the gateway-protocol end-to-end tests were written. Each had unit coverage
-// only; none needed a new harness capability, which is why they belong here
-// rather than on a manual checklist.
-
-// TestNonInferenceEndpointsAreAuthorised covers the two review findings on the
-// endpoints that carry no body: the per-model lookup must be authorised
-// against the same allowlist that bounds the listing beside it, and only a read
-// method may claim the non-inference exemption that skips the token pre-flight.
-func TestNonInferenceEndpointsAreAuthorised(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	env := provisionDiscoveryProvider(t, ctx)
-
-	t.Run("lookup of an authorised model succeeds", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Get(ctx, env.endpoint, env.proxyIP, "/v1/models/"+harness.VLLMModel, nil)
-		}, 200)
-		assert.Equal(t, 200, code, "an allowlisted model must remain reachable; body: %s", body)
-	})
-
-	t.Run("lookup of an unauthorised model is refused", func(t *testing.T) {
-		code, body, err := env.client.Get(ctx, env.endpoint, env.proxyIP, "/v1/models/"+harness.VLLMUnlistedModel, nil)
-		require.NoError(t, err, "request must reach the proxy")
-		assert.Equal(t, 403, code,
-			"a model the policy does not authorise must not be confirmed by the detail lookup; body: %s", body)
-	})
-
-	// A write must not claim the exemption that lets the listing skip the token
-	// pre-flight. The body names no model on purpose: that is what a request
-	// probing for the exemption looks like, and it is the case the method gate
-	// exists to refuse. (A POST that does name a model is a different thing —
-	// it routes and meters as the inference request it is.)
-	for _, path := range []string{"/v1/models", "/v1/models/" + harness.VLLMModel, "/api/hello"} {
-		t.Run("write to "+path+" is refused", func(t *testing.T) {
-			code, body, err := env.client.PostJSON(ctx, env.endpoint, env.proxyIP, path,
-				`{"messages":[{"role":"user","content":"hi"}]}`, nil)
-			require.NoError(t, err, "request must reach the proxy")
-			assert.NotEqual(t, 200, code,
-				"a write to a non-inference path must not be served unmetered; body: %s", body)
-		})
-	}
-
-	// A request carrying the sub-agent attribution headers must still be served
-	// and metered normally. Asserting the ids themselves is not possible yet:
-	// the parser lifts them onto the request's metadata, but nothing persists
-	// them, so they have no queryable surface to check against.
-	t.Run("sub-agent headers do not disturb the request", func(t *testing.T) {
-		sessionID := fmt.Sprintf("e2e-session-agentid-%d", time.Now().UnixNano())
-		code, body, err := env.client.PostJSON(ctx, env.endpoint, env.proxyIP, "/v1/chat/completions",
-			fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":"Reply with exactly: pong"}]}`, harness.VLLMModel),
-			[]string{
-				"x-session-id: " + sessionID,
-				"x-claude-code-agent-id: agent-child-7",
-				"x-claude-code-parent-agent-id: agent-root-1",
-			})
-		require.NoError(t, err, "request must reach the proxy")
-		require.Equal(t, 200, code, "the request must succeed; body: %s", body)
-
-		row := findAccessLogBySession(t, ctx, sessionID)
-		assert.Positive(t, row.InputTokens, "the request must still be metered normally")
-	})
-}
-
-// TestDatedModelIdRouting covers both halves of the dated-id rule that review
-// tightened: a dated id still reaches an undated registration, but a route
-// pinned to one dated build must never serve a different one.
-func TestDatedModelIdRouting(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	const (
-		undated = "claude-sonnet-9"
-		datedA  = "claude-sonnet-9-20250101"
-		datedB  = "claude-sonnet-9-20250202"
-	)
-
-	t.Run("a dated id reaches its undated registration", func(t *testing.T) {
-		env := provisionModelProvider(t, ctx, "dated-undated", "anthropic_api", undated)
-
-		sessionID := fmt.Sprintf("e2e-session-dated-%d", time.Now().UnixNano())
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, datedA, "Reply with exactly: pong", sessionID)
-		}, 200)
-		require.Equal(t, 200, code, "a pinned release of a registered family must route; body: %s", body)
-
-		row := findAccessLogBySession(t, ctx, sessionID)
-		assert.Positive(t, row.InputTokens, "the dated request must price at the registered rate, not zero")
-	})
-
-	t.Run("a route pinned to one dated build refuses another", func(t *testing.T) {
-		env := provisionModelProvider(t, ctx, "dated-pinned", "anthropic_api", datedA)
-
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, datedA, "Reply with exactly: pong", "")
-		}, 200)
-		require.Equal(t, 200, code, "the exact dated id must still route; body: %s", body)
-
-		code, body, err := env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, datedB, "Reply with exactly: pong", "")
-		require.NoError(t, err, "request must reach the proxy")
-		assert.Equal(t, 403, code,
-			"a provider pinned to one dated build must not serve another; body: %s", body)
-	})
-}
-
-// TestBedrockInferenceProfilesReachTheUpstream covers the startup lookup a
-// Bedrock client makes. The proxy forwards it to the configured upstream rather
-// than denying it, so what comes back is the upstream's answer — never a
-// NetBird policy rejection.
-func TestBedrockInferenceProfilesReachTheUpstream(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	env := provisionModelProvider(t, ctx, "infprofiles", "bedrock_api", "anthropic.claude-sonnet-5")
-
-	code, body := callUntil(t, func() (int, string, error) {
-		return env.client.Get(ctx, env.endpoint, env.proxyIP, "/inference-profiles", nil)
-	}, 200)
-
-	assert.Equal(t, 200, code, "the lookup must reach the upstream; body: %s", body)
-	assert.NotContains(t, body, "llm_policy.",
-		"the proxy must not answer a control-plane lookup with a policy denial")
-	assert.Contains(t, body, "inferenceProfileSummaries",
-		"the upstream's own answer must come back untouched")
-}
-
-// provisionDiscoveryProvider brings up one mock-backed provider enumerating a
-// single model, with an allowlist guardrail in effect, plus a connected client.
-func provisionDiscoveryProvider(t *testing.T, ctx context.Context) pricedEnv {
-	t.Helper()
-	env := provisionModelProvider(t, ctx, "noninference", "openai_api", harness.VLLMModel)
-
-	var gr api.AgentNetworkGuardrailRequest
-	gr.Name = "e2e-noninference-allowlist-" + fmt.Sprint(time.Now().UnixNano())
-	gr.Checks.ModelAllowlist.Enabled = true
-	gr.Checks.ModelAllowlist.Models = []string{harness.VLLMModel}
-	guard, err := srv.CreateGuardrail(ctx, gr)
-	require.NoError(t, err, "create guardrail")
-	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
-
-	enabled := true
-	_, err = srv.UpdatePolicy(ctx, env.policyID, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-noninference",
-		Enabled:                &enabled,
-		SourceGroups:           []string{env.groupID},
-		DestinationProviderIds: []string{env.providerID},
-		GuardrailIds:           &[]string{guard.Id},
-	})
-	require.NoError(t, err, "attach guardrail to policy")
-	return env
-}
-
-// provisionModelProvider brings up the mock, one provider under the given
-// catalog id enumerating exactly one model, an authorising policy, and a
-// connected proxy + client.
-func provisionModelProvider(t *testing.T, ctx context.Context, name, catalogID, model string) pricedEnv {
-	t.Helper()
-
-	vllm, err := harness.StartVLLM(ctx, srv)
-	require.NoError(t, err, "start mock upstream")
-	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
-
-	suffix := strings.ToLower(name)
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gwr-" + suffix})
-	require.NoError(t, err, "create group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-gwr-" + suffix + "-client",
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key")
-	require.NotEmpty(t, sk.Key, "setup key plaintext")
-
-	dummyKey := "sk-gwr-e2e"
-	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "e2e-gwr-" + suffix,
-		ProviderId:  catalogID,
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &dummyKey,
-		Enabled:     ptr(true),
-		Models: &[]api.AgentNetworkProviderModel{
-			{Id: model, InputPer1k: 0.001, OutputPer1k: 0.002},
-		},
-	})
-	require.NoError(t, err, "create provider")
-	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
-
-	enabled := true
-	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-gwr-" + suffix,
-		Enabled:                &enabled,
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: []string{prov.Id},
-		Limits: &api.AgentNetworkPolicyLimits{
-			TokenLimit: api.AgentNetworkPolicyTokenLimit{
-				Enabled:       true,
-				GroupCap:      10_000_000,
-				UserCap:       10_000_000,
-				WindowSeconds: 60,
-			},
-		},
-	})
-	require.NoError(t, err, "create policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gwr-"+suffix, sk.Key)
-	return pricedEnv{
-		providerID: prov.Id,
-		groupID:    grp.Id,
-		policyID:   pol.Id,
-		upstream:   vllm.URL,
-		endpoint:   endpoint,
-		proxyIP:    proxyIP,
-		client:     cl,
-		proxy:      px,
-	}
-}

e2e/agentnetwork/streaming_test.go

@@ -1,199 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// streamedModel is priced high enough that a mis-metered request is obvious in
-// the recorded cost, and named so it cannot collide with another test's route.
-const streamedModel = "e2e-streamed-model"
-
-const (
-	streamInRate  = 0.010
-	streamOutRate = 0.020
-	// The cache-read bucket is priced separately from input, so a run that
-	// folded the two together fails the per-bucket assertions below.
-	streamCacheReadRate = 0.001
-)
-
-// TestStreamingResponseMetersInputTokens is the end-to-end guard for the
-// metering bug this endpoint's gateway-protocol work fixed.
-//
-// On a streamed answer the input-token count exists only in the opening
-// message_start event; every later frame reports output. A response read with
-// the wrong vendor's parser — the shape a gateway record produces when it names
-// one API surface and serves another — never looks at that event, so input
-// metered as zero and the bulk of the bill silently vanished. Nothing in the
-// suite sent stream: true before this test, so the whole branch went unrun.
-//
-// The provider points at the mock's streaming listener, which answers every
-// request as SSE with token counts that differ from the buffered surface. That
-// difference is the point: passing these assertions is only possible if the
-// stream accumulator ran.
-func TestStreamingResponseMetersInputTokens(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	env := provisionStreamingProvider(t, ctx, "anthropic_api")
-
-	sessionID := fmt.Sprintf("e2e-session-stream-%d", time.Now().UnixNano())
-	code, body := chatStreamUntil(t, ctx, env, harness.WireMessages, streamedModel, sessionID)
-	require.Equal(t, 200, code, "streamed chat must succeed; body: %s", body)
-	assert.Contains(t, body, "message_start",
-		"the client must receive the event stream itself, not a buffered rewrite of it")
-
-	row := findAccessLogBySession(t, ctx, sessionID)
-
-	assert.Equal(t, harness.VLLMStreamInputTokens, int(row.InputTokens),
-		"input tokens live in message_start; zero here is the bug this test exists for")
-	assert.Equal(t, harness.VLLMStreamOutputTokens, int(row.OutputTokens),
-		"output tokens ride message_delta and supersede the message_start seed")
-	assert.Equal(t, harness.VLLMStreamCacheReadTokens, int(row.CachedInputTokens),
-		"the Anthropic cache bucket rides message_start too, and only its own parser reads it")
-
-	// The Anthropic surface bills cache reads additively, so the input bucket
-	// prices the full input count rather than a remainder.
-	wantInput := float64(harness.VLLMStreamInputTokens) / 1000 * streamInRate
-	wantOutput := float64(harness.VLLMStreamOutputTokens) / 1000 * streamOutRate
-	assert.InDelta(t, wantInput, row.InputCostUsd, 1e-6, "input cost must price the streamed input tokens")
-	assert.InDelta(t, wantOutput, row.OutputCostUsd, 1e-6, "output cost must price the streamed output tokens")
-	assert.Greater(t, row.CostUsd, 0.0, "a streamed request must never record as free")
-}
-
-// TestStreamingOnGatewayTypedProvider drives the same streamed Anthropic call
-// through a provider record whose catalog id names the OpenAI surface — the
-// exact misconfiguration that hid the bug, since gateway records commonly pin
-// one parser while the upstream serves another shape entirely.
-//
-// The router must choose the parser from the request path rather than the
-// record's provider id, or the Anthropic usage block goes unread and input
-// meters at zero all over again.
-func TestStreamingOnGatewayTypedProvider(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	env := provisionStreamingProvider(t, ctx, "openai_api")
-
-	sessionID := fmt.Sprintf("e2e-session-stream-gw-%d", time.Now().UnixNano())
-	code, body := chatStreamUntil(t, ctx, env, harness.WireMessages, streamedModel, sessionID)
-	require.Equal(t, 200, code, "streamed chat through a gateway record must succeed; body: %s", body)
-
-	row := findAccessLogBySession(t, ctx, sessionID)
-
-	assert.Equal(t, harness.VLLMStreamInputTokens, int(row.InputTokens),
-		"a record typed openai_api must still read the Anthropic usage block it is actually serving")
-	assert.Equal(t, harness.VLLMStreamOutputTokens, int(row.OutputTokens),
-		"output tokens must survive the surface mismatch too")
-	assert.InDelta(t, float64(harness.VLLMStreamInputTokens)/1000*streamInRate, row.InputCostUsd, 1e-6,
-		"the request must be priced on the surface it spoke, not the one the record names")
-}
-
-// provisionStreamingProvider brings up the mock, one provider pointed at its
-// streaming listener under the given catalog id, a policy authorising it, and a
-// connected proxy + client.
-func provisionStreamingProvider(t *testing.T, ctx context.Context, catalogID string) pricedEnv {
-	t.Helper()
-
-	vllm, err := harness.StartVLLM(ctx, srv)
-	require.NoError(t, err, "start mock upstream")
-	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
-
-	name := "stream-" + catalogID
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-" + name})
-	require.NoError(t, err, "create group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-" + name + "-client",
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key")
-	require.NotEmpty(t, sk.Key, "setup key plaintext")
-
-	dummyKey := "sk-stream-e2e"
-	cacheRead := streamCacheReadRate
-	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        name,
-		ProviderId:  catalogID,
-		UpstreamUrl: vllm.StreamURL,
-		ApiKey:      &dummyKey,
-		Enabled:     ptr(true),
-		Models: &[]api.AgentNetworkProviderModel{{
-			Id:             streamedModel,
-			InputPer1k:     streamInRate,
-			OutputPer1k:    streamOutRate,
-			CacheReadPer1k: &cacheRead,
-		}},
-	})
-	require.NoError(t, err, "create provider")
-	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
-
-	enabled := true
-	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-" + name,
-		Enabled:                &enabled,
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: []string{prov.Id},
-		Limits: &api.AgentNetworkPolicyLimits{
-			TokenLimit: api.AgentNetworkPolicyTokenLimit{
-				Enabled:       true,
-				GroupCap:      10_000_000,
-				UserCap:       10_000_000,
-				WindowSeconds: 60,
-			},
-		},
-	})
-	require.NoError(t, err, "create policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	endpoint, proxyIP, cl, px := connectClient(t, ctx, name, sk.Key)
-	return pricedEnv{
-		providerID: prov.Id,
-		groupID:    grp.Id,
-		policyID:   pol.Id,
-		upstream:   vllm.StreamURL,
-		endpoint:   endpoint,
-		proxyIP:    proxyIP,
-		client:     cl,
-		proxy:      px,
-	}
-}
-
-// chatStreamUntil drives one streamed chat, retrying to absorb the tunnel and
-// DNS jitter a first call through a fresh peer can hit.
-func chatStreamUntil(t *testing.T, ctx context.Context, env pricedEnv, kind, model, sessionID string) (int, string) {
-	t.Helper()
-	var code int
-	var body string
-	deadline := time.Now().Add(90 * time.Second)
-	for time.Now().Before(deadline) {
-		c, b, cerr := env.client.ChatStream(ctx, env.endpoint, env.proxyIP, kind, model, "Reply with exactly: pong", sessionID)
-		if cerr == nil {
-			code, body = c, b
-			if code == 200 {
-				break
-			}
-		}
-		time.Sleep(5 * time.Second)
-	}
-	if code != 200 {
-		t.Logf("=== proxy logs ===\n%s", env.proxy.Logs(context.Background()))
-	}
-	return code, body
-}

e2e/harness/client.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
 	"os/exec"
 	"strconv"
 	"strings"
@@ -200,18 +199,12 @@ func (cl *Client) pollStatus(ctx context.Context, timeout time.Duration, want st
 const (
 	// curlExitCouldNotResolve is curl's exit code for a DNS resolution failure, distinct from connection-level failures.
 	curlExitCouldNotResolve = 6
-	// curlExitCouldNotConnect is curl's exit code for a connection that never
-	// established. The probe exists to WAKE the lazy proxy peer, so the first
-	// attempt legitimately arrives before WireGuard has brought the tunnel up
-	// and fails here — which is propagation, exactly like an early NXDOMAIN,
-	// and belongs inside the retry window rather than failing the test outright.
-	curlExitCouldNotConnect = 7
-	// endpointProbeRetryWindow bounds retries of the transient failures above: the synthesized zone and the tunnel both land a beat after management connects. Still failing after this window is a real failure.
-	endpointProbeRetryWindow   = 30 * time.Second
-	endpointProbeRetryInterval = 2 * time.Second
+	// dnsProbeRetryWindow bounds DNS-failure retries: the synthesized zone lands a beat after management connects, so early NXDOMAIN is propagation; a zone still absent after this window is a real failure.
+	dnsProbeRetryWindow   = 30 * time.Second
+	dnsProbeRetryInterval = 2 * time.Second
 )
 
-// ResolveProxyIP GETs https://<endpoint>/ from the client's netns: any HTTP status proves DNS + tunnel and wakes the lazy proxy peer; DNS and connect failures retry, within endpointProbeRetryWindow. Returns the connected IP for --resolve pinning.
+// ResolveProxyIP GETs https://<endpoint>/ from the client's netns: any HTTP status proves DNS + tunnel and wakes the lazy proxy peer; only DNS failures retry, within dnsProbeRetryWindow. Returns the connected IP for --resolve pinning.
 func (cl *Client) ResolveProxyIP(ctx context.Context, endpoint string) (string, error) {
 	args := []string{
 		"run", "--rm",
@@ -222,7 +215,7 @@ func (cl *Client) ResolveProxyIP(ctx context.Context, endpoint string) (string,
 		"-w", "%{remote_ip}",
 		"https://" + endpoint + "/",
 	}
-	deadline := time.Now().Add(endpointProbeRetryWindow)
+	deadline := time.Now().Add(dnsProbeRetryWindow)
 	for {
 		cmd := exec.CommandContext(ctx, "docker", args...)
 		var stdout, stderr strings.Builder
@@ -238,29 +231,21 @@ func (cl *Client) ResolveProxyIP(ctx context.Context, endpoint string) (string,
 		}
 
 		var exitErr *exec.ExitError
-		if !errors.As(err, &exitErr) || !isTransientProbeExit(exitErr.ExitCode()) {
+		if !errors.As(err, &exitErr) || exitErr.ExitCode() != curlExitCouldNotResolve {
 			return "", fmt.Errorf("no HTTP response from %s: %w (%s)", endpoint, err, strings.TrimSpace(stderr.String()))
 		}
-		probeErr := fmt.Errorf("endpoint %s not reachable yet: %s", endpoint, strings.TrimSpace(stderr.String()))
-		if time.Until(deadline) < endpointProbeRetryInterval {
-			return "", probeErr
+		dnsErr := fmt.Errorf("DNS resolution failed for %s: %s", endpoint, strings.TrimSpace(stderr.String()))
+		if time.Until(deadline) < dnsProbeRetryInterval {
+			return "", dnsErr
 		}
 		select {
 		case <-ctx.Done():
-			return "", fmt.Errorf("%w (%w)", probeErr, ctx.Err())
-		case <-time.After(endpointProbeRetryInterval):
+			return "", fmt.Errorf("%w (%w)", dnsErr, ctx.Err())
+		case <-time.After(dnsProbeRetryInterval):
 		}
 	}
 }
 
-// isTransientProbeExit reports whether a curl exit code describes a state the
-// endpoint is expected to pass THROUGH on its way up, rather than a settled
-// failure. Anything else — TLS refusal, a protocol error, a bad argument —
-// would still be failing after the retry window, so it fails immediately.
-func isTransientProbeExit(code int) bool {
-	return code == curlExitCouldNotResolve || code == curlExitCouldNotConnect
-}
-
 // Wire shapes for Chat.
 const (
 	// WireChat is the OpenAI-compatible /v1/chat/completions shape.
@@ -307,27 +292,6 @@ func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefi
 	return cl.post(ctx, endpoint, proxyIP, pathPrefix+path, body, withSessionID(headers, sessionID))
 }
 
-// ChatStream is Chat with "stream": true in the request body, so the proxy's
-// request parser marks the call as streaming and its response parser takes the
-// SSE accumulator rather than the buffered-body path. Pair it with a provider
-// pointed at VLLM.StreamURL, which answers every request as an event stream.
-func (cl *Client) ChatStream(ctx context.Context, endpoint, proxyIP, kind, model, prompt, sessionID string) (int, string, error) {
-	var path, body string
-	var headers []string
-	switch kind {
-	case WireMessages:
-		path = "/v1/messages"
-		headers = []string{"anthropic-version: 2023-06-01"}
-		body = fmt.Sprintf(`{"model":%q,"max_tokens":2048,"stream":true,"messages":[{"role":"user","content":%q}]}`, model, prompt)
-	default:
-		path = "/v1/chat/completions"
-		// include_usage is what makes a real OpenAI stream emit its final usage
-		// frame; without it the last chunk carries no tokens at all.
-		body = fmt.Sprintf(`{"model":%q,"stream":true,"stream_options":{"include_usage":true},"messages":[{"role":"user","content":%q}]}`, model, prompt)
-	}
-	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(headers, sessionID))
-}
-
 // Vertex issues an Anthropic-on-Vertex rawPredict POST over the tunnel. Unlike
 // Chat, the model is carried in the request path (project/region/model), so the
 // proxy routes by path and mints the service-account OAuth token; the body uses
@@ -358,29 +322,10 @@ func withSessionID(headers []string, sessionID string) []string {
 	return append(headers, "x-session-id: "+sessionID)
 }
 
-// Get issues a GET to the agent-network endpoint over the client's tunnel.
-// Model discovery and the connection-warming probe are read-only endpoints
-// that carry no body, so they can't go through the chat helpers.
-func (cl *Client) Get(ctx context.Context, endpoint, proxyIP, path string, extraHeaders []string) (int, string, error) {
-	return cl.do(ctx, http.MethodGet, endpoint, proxyIP, path, "", extraHeaders)
-}
-
-// PostJSON issues an arbitrary JSON POST over the client's tunnel, for wire
-// shapes the typed helpers don't cover (token counting, say).
-func (cl *Client) PostJSON(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
-	return cl.do(ctx, http.MethodPost, endpoint, proxyIP, path, body, extraHeaders)
-}
-
-// post issues a JSON POST. Retained as the shorthand the chat helpers use.
-func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
-	return cl.do(ctx, http.MethodPost, endpoint, proxyIP, path, body, extraHeaders)
-}
-
-// do runs curl in a throwaway container sharing the client's network
+// post runs curl in a throwaway container sharing the client's network
 // namespace so the request traverses the WireGuard tunnel, pinning the endpoint
-// to the proxy IP. It returns the HTTP status and response body. An empty body
-// sends no payload, which is what a GET needs.
-func (cl *Client) do(ctx context.Context, method, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
+// to the proxy IP. It returns the HTTP status and response body.
+func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
 	url := "https://" + endpoint + path
 	args := []string{
 		"run", "--rm",
@@ -389,15 +334,13 @@ func (cl *Client) do(ctx context.Context, method, endpoint, proxyIP, path, body
 		"-sk", "--connect-timeout", "5", "--max-time", "90",
 		"--resolve", endpoint + ":443:" + proxyIP,
 		"-o", "/dev/stderr", "-w", "%{http_code}",
-		"-X", method, url,
+		"-X", "POST", url,
 		"-H", "Content-Type: application/json",
 	}
 	for _, h := range extraHeaders {
 		args = append(args, "-H", h)
 	}
-	if body != "" {
-		args = append(args, "--data", body)
-	}
+	args = append(args, "--data", body)
 	cmd := exec.CommandContext(ctx, "docker", args...)
 	// -w writes the status code to stdout; -o /dev/stderr writes the body to
 	// stderr so we can capture both separately.

e2e/harness/vllm.go

@@ -18,63 +18,18 @@ const (
 	vllmImage = "nginx:alpine"
 	vllmAlias = "vllm"
 	vllmPort  = "8000/tcp"
-	// vllmStreamPort serves the same wire shapes as an SSE stream. See the
-	// nginx config for why streaming lives on its own listener.
-	vllmStreamPort = "8001/tcp"
 	// VLLMModel is the served model id the mock advertises and echoes back. It
 	// matches a real small model commonly served by vLLM so the provider's
 	// enumerated model and the client's request line up.
 	VLLMModel = "Qwen/Qwen2.5-0.5B-Instruct"
-	// VLLMUnlistedModel is a second id the mock's model listing advertises but
-	// no test provider enumerates, so a filtered listing is observably shorter
-	// than the upstream's own.
-	VLLMUnlistedModel = "Qwen/Qwen2.5-7B-Instruct"
-)
-
-// Token counts the mock reports per wire shape. Tests assert on these rather
-// than on "> 0" so a response parsed with the wrong provider's parser (which
-// would read a different field, or none) fails loudly instead of passing on
-// a coincidental non-zero.
-const (
-	// VLLMChatInputTokens / VLLMChatOutputTokens ride the OpenAI usage block.
-	VLLMChatInputTokens  = 11
-	VLLMChatOutputTokens = 2
-	// VLLMMessagesInputTokens / VLLMMessagesOutputTokens ride the Anthropic
-	// usage block, whose field names the OpenAI parser cannot read.
-	VLLMMessagesInputTokens  = 17
-	VLLMMessagesOutputTokens = 3
-)
-
-// Token counts the streaming surface reports. They differ from the
-// non-streaming ones on purpose: a test that asserts these numbers proves the
-// SSE accumulator ran, rather than a buffered JSON body having been parsed.
-//
-// Input and cache-read arrive on message_start; output arrives on
-// message_delta and supersedes the seed value message_start carries. Any
-// parser that cannot read message_start reports zero input tokens — which is
-// exactly the bug these counts exist to catch.
-const (
-	VLLMStreamInputTokens     = 29
-	VLLMStreamOutputTokens    = 5
-	VLLMStreamCacheReadTokens = 7
 )
 
 // vllmNginxConf emulates a vLLM OpenAI-compatible server over plain HTTP (vLLM's
-// default: no TLS, port 8000), and additionally answers the wire shapes the
-// other catalog surfaces speak so one mock can stand in for every provider the
-// proxy routes to. Running actual vLLM in CI is infeasible (GPU + multi-GB model
+// default: no TLS, port 8000). It answers /v1/models with a one-model list and
+// any chat/completions path with a canned OpenAI-shaped chat completion carrying
+// a non-zero usage block, so the proxy's OpenAI parser records real token
+// consumption. Running actual vLLM in CI is infeasible (GPU + multi-GB model
 // download), so this stands in for the wire contract the proxy depends on.
-//
-// Each shape answers with its own vendor's usage block, so a response parsed
-// under the wrong surface meters zero rather than passing by accident:
-//
-//   - /v1/chat/completions (and any unmatched path): OpenAI chat completion.
-//   - /v1/messages: Anthropic Messages, snake_case usage plus a cache bucket.
-//   - /model/{id}/invoke: Bedrock InvokeModel, which carries the Anthropic body.
-//   - the token-counting endpoints: a count, with no usage block at all.
-//
-// The model listing advertises two models so a policy that authorises one
-// produces an observably shorter list than the upstream's own.
 const vllmNginxConf = `pid /tmp/nginx.pid;
 events {}
 http {
@@ -82,75 +37,13 @@ http {
     listen 8000;
     location = /v1/models {
       default_type application/json;
-      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"},{"id":"Qwen/Qwen2.5-7B-Instruct","object":"model","owned_by":"vllm"}]}';
-    }
-    location = /v1/messages {
-      default_type application/json;
-      return 200 '{"id":"msg_e2e","type":"message","role":"assistant","model":"claude-sonnet-5","content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn","usage":{"input_tokens":17,"output_tokens":3,"cache_read_input_tokens":5}}';
-    }
-    location = /v1/messages/count_tokens {
-      default_type application/json;
-      return 200 '{"input_tokens":7}';
-    }
-    location ~ ^/model/.+/invoke$ {
-      default_type application/json;
-      return 200 '{"id":"msg_e2e_bedrock","type":"message","role":"assistant","content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn","usage":{"input_tokens":17,"output_tokens":3,"cache_read_input_tokens":5}}';
-    }
-    location ~ ^/model/.+/count-tokens$ {
-      default_type application/json;
-      return 200 '{"inputTokens":9}';
-    }
-    location = /api/hello {
-      return 200;
-    }
-    location = /inference-profiles {
-      default_type application/json;
-      return 200 '{"inferenceProfileSummaries":[{"inferenceProfileId":"us.anthropic.claude-sonnet-5","status":"ACTIVE"}]}';
+      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"}]}';
     }
     location / {
       default_type application/json;
       return 200 '{"id":"chatcmpl-e2e-vllm","object":"chat.completion","created":1700000000,"model":"Qwen/Qwen2.5-0.5B-Instruct","choices":[{"index":0,"message":{"role":"assistant","content":"pong"},"finish_reason":"stop"}],"usage":{"prompt_tokens":11,"completion_tokens":2,"total_tokens":13}}';
     }
   }
-
-  # The streaming surface, on its own port so the response content type is a
-  # property of the listener rather than of a per-request branch: nginx sets
-  # Content-Type from default_type, which cannot be varied inside an "if", and
-  # a second Content-Type via add_header would leave the proxy reading the
-  # wrong one. A provider record pointed at this port streams every answer.
-  #
-  # Input and cache-read tokens ride message_start, output rides message_delta
-  # — the split that makes a stream different from a buffered body, and the
-  # reason a parser that ignores message_start meters input as zero.
-  server {
-    listen 8001;
-    location = /v1/messages {
-      default_type text/event-stream;
-      return 200 'event: message_start
-data: {"type":"message_start","message":{"id":"msg_e2e_stream","type":"message","role":"assistant","model":"claude-sonnet-5","content":[],"usage":{"input_tokens":29,"output_tokens":1,"cache_read_input_tokens":7}}}
-
-event: content_block_delta
-data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"pong"}}
-
-event: message_delta
-data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":5}}
-
-event: message_stop
-data: {"type":"message_stop"}
-
-';
-    }
-    location / {
-      default_type text/event-stream;
-      return 200 'data: {"choices":[{"delta":{"content":"pong"}}]}
-
-data: {"choices":[],"usage":{"prompt_tokens":29,"completion_tokens":5,"total_tokens":34}}
-
-data: [DONE]
-
-';
-    }
-  }
 }
 `
 
@@ -162,10 +55,6 @@ type VLLM struct {
 	workDir   string
 	// URL is the upstream URL the vllm provider points at (http://<alias>:8000).
 	URL string
-	// StreamURL is the same mock's streaming listener. A provider pointed here
-	// answers every request as SSE, so the proxy's streaming accumulator runs
-	// instead of its buffered-body parser.
-	StreamURL string
 }
 
 // StartVLLM runs the mock vLLM server on the shared network over plain HTTP.
@@ -184,17 +73,14 @@ func StartVLLM(ctx context.Context, c *Combined) (*VLLM, error) {
 
 	req := testcontainers.ContainerRequest{
 		Image:          vllmImage,
-		ExposedPorts:   []string{vllmPort, vllmStreamPort},
+		ExposedPorts:   []string{vllmPort},
 		Networks:       []string{c.network.Name},
 		NetworkAliases: map[string][]string{c.network.Name: {vllmAlias}},
 		Cmd:            []string{"nginx", "-c", "/conf/nginx.conf", "-g", "daemon off;"},
 		HostConfigModifier: func(hc *container.HostConfig) {
 			hc.Binds = append(hc.Binds, workDir+":/conf:ro")
 		},
-		WaitingFor: wait.ForAll(
-			wait.ForListeningPort(vllmPort),
-			wait.ForListeningPort(vllmStreamPort),
-		).WithStartupTimeout(60 * time.Second),
+		WaitingFor: wait.ForListeningPort(vllmPort).WithStartupTimeout(60 * time.Second),
 	}
 
 	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
@@ -206,12 +92,7 @@ func StartVLLM(ctx context.Context, c *Combined) (*VLLM, error) {
 		return nil, fmt.Errorf("start vllm container: %w", err)
 	}
 
-	return &VLLM{
-		container: ctr,
-		workDir:   workDir,
-		URL:       "http://" + vllmAlias + ":8000",
-		StreamURL: "http://" + vllmAlias + ":8001",
-	}, nil
+	return &VLLM{container: ctr, workDir: workDir, URL: "http://" + vllmAlias + ":8000"}, nil
 }
 
 // Logs returns the vLLM container logs, for diagnostics on failure.

funding.json

@@ -6,7 +6,7 @@
     "name": "NetBird GmbH",
     "email": "hello@netbird.io",
     "phone": "",
-    "description": "NetBird GmbH is a Berlin-based software company specializing in the development of open-source network security solutions. Network security is utterly complex and expensive, accessible only to companies with multi-million dollar IT budgets. In contrast, there are millions of companies left behind. Our mission is to create an advanced network and cybersecurity platform that is both easy-to-use and affordable for teams of all sizes and budgets. By leveraging the open-source strategy and technological advancements, NetBird aims to set the industry standard for connecting and securing IT infrastructure.",
+    "description": "NetBird GmbH is a Berlin-based software company specializing in the development of open source network security solutions. Network security is utterly complex and expensive, accessible only to companies with multi-million dollar IT budgets. In contrast, there are millions of companies left behind. Our mission is to create an advanced network and cybersecurity platform that is both easy-to-use and affordable for teams of all sizes and budgets. By leveraging the open source strategy and technological advancements, NetBird aims to set the industry standard for connecting and securing IT infrastructure.",
     "webpageUrl": {
       "url": "https://github.com/netbirdio"
     }
@@ -15,7 +15,7 @@
     {
       "guid": "netbird",
       "name": "NetBird",
-      "description": "NetBird is a configuration-free peer-to-peer private network and a centralized access control system combined in a single open-source platform. It makes it easy to create secure WireGuard-based private networks for your organization or home.",
+      "description": "NetBird is a configuration-free peer-to-peer private network and a centralized access control system combined in a single open source platform. It makes it easy to create secure WireGuard-based private networks for your organization or home.",
       "webpageUrl": {
         "url": "https://github.com/netbirdio/netbird"
       },
@@ -59,7 +59,7 @@
         "guid": "support-yearly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - Yearly",
-        "description": "This will help us partially cover the yearly cost of maintaining the open-source NetBird project.",
+        "description": "This will help us partially cover the yearly cost of maintaining the open source NetBird project.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "yearly",
@@ -72,7 +72,7 @@
         "guid": "support-one-time-year",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - One Year",
-        "description": "This will help us partially cover the yearly cost of maintaining the open-source NetBird project.",
+        "description": "This will help us partially cover the yearly cost of maintaining the open source NetBird project.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "one-time",
@@ -85,7 +85,7 @@
         "guid": "support-one-time-monthly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - Monthly",
-        "description": "This will help us partially cover the monthly cost of maintaining the open-source NetBird project.",
+        "description": "This will help us partially cover the monthly cost of maintaining the open source NetBird project.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "monthly",
@@ -98,7 +98,7 @@
         "guid": "support-monthly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - One Month",
-        "description": "This will help us partially cover the monthly cost of maintaining the open-source NetBird project.",
+        "description": "This will help us partially cover the monthly cost of maintaining the open source NetBird project.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "monthly",

infrastructure_files/migrate-to-enterprise.sh

@@ -15,6 +15,12 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
+# Step 2 is skipped when the deployment already runs on Postgres
+# (server.store.engine: postgres in config.yaml). Nothing is provisioned or
+# migrated in that case and the store config is left exactly as the operator
+# wrote it — the enterprise image reads the same Postgres the community image
+# did. Such a deployment gets the image swap, and can still opt into step 3.
+#
 # If any step fails once the stack has been touched, the script rolls itself
 # back automatically: generated files are removed, the Postgres volume this run
 # created is dropped, and the original deployment is started again.
@@ -38,6 +44,18 @@ ENV_BACKUP=""
 PG_VOLUME_NAME=""
 BACKUP_DIR=""
 
+# Store state. STORE_ENGINE is what the deployment runs on today; when it is
+# already postgres, MIGRATE_POSTGRES stays "no" and nothing is provisioned.
+# POSTGRES_SERVICE is empty when Postgres lives outside this compose project.
+STORE_ENGINE=""
+EXISTING_POSTGRES="no"
+POSTGRES_DSN=""
+POSTGRES_SERVICE=""
+POSTGRES_DEPENDS_CONDITION="service_healthy"
+# Whether this run needs to generate config.yaml.enterprise at all. A pure
+# image swap does not.
+ENTERPRISE_CONFIG="no"
+
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -192,6 +210,85 @@ detect_exposed_address() {
   yq eval '.server.exposedAddress // ""' "$CONFIG_YAML_HOST"
 }
 
+# The engine is a config.yaml-only setting — there is no env override for it
+# (combined/cmd/root.go reads it from YAML and derives the env vars), so
+# config.yaml is authoritative. Absent means the sqlite default.
+detect_store_engine() {
+  local engine
+  engine=$(yq eval '.server.store.engine // ""' "$CONFIG_YAML_HOST")
+  if [[ -z "$engine" ]] || [[ "$engine" == "null" ]]; then
+    engine="sqlite"
+  fi
+  echo "$engine" | tr '[:upper:]' '[:lower:]'
+}
+
+detect_store_dsn() {
+  yq eval '.server.store.dsn // ""' "$CONFIG_YAML_HOST"
+}
+
+# config.yaml is where a combined deployment carries its DSN; this only covers
+# hand-rolled installs that keep it in the environment instead.
+detect_store_dsn_from_compose() {
+  # `compose config` re-escapes a literal $ as $$ on the way out, so undo that
+  # to get the value the container actually receives.
+  $DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval "
+    .services[\"$COMBINED_SERVICE\"].environment.NB_STORE_ENGINE_POSTGRES_DSN //
+    .services[\"$COMBINED_SERVICE\"].environment.NETBIRD_STORE_ENGINE_POSTGRES_DSN // \"\"
+  " - 2>/dev/null | sed 's/\$\$/$/g'
+}
+
+# Reads either DSN form: "host=db ..." or "postgres://user:pass@db:5432/name".
+dsn_host() {
+  local dsn="$1"
+  case "$dsn" in
+    *://*) printf '%s' "$dsn" | sed -n 's,^[a-zA-Z+]*://\([^/?]*\).*,\1,p' | sed -e 's,.*@,,' -e 's,:.*,,' ;;
+    *) printf '%s' "$dsn" | sed -n 's/.*[[:space:]]*host=\([^[:space:]]*\).*/\1/p' ;;
+  esac
+}
+
+# flow-enricher is its own container, so a loopback host or a socket path would
+# reach the enricher rather than Postgres. Only flag hosts we can positively
+# identify — an unparseable DSN must not leave the operator with no way forward.
+dsn_host_reachable() {
+  local dsn="$1"
+  case "$(dsn_host "$dsn")" in
+    localhost | 127.* | ::1 | 0.0.0.0 | /*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+# Names the compose service running this deployment's Postgres, for depends_on.
+# Empty means external — the DSN host matched no service. A DSN with no readable
+# host falls back to matching on image.
+detect_postgres_service() {
+  local host
+  host=$(dsn_host "$POSTGRES_DSN")
+  if [[ -n "$host" ]]; then
+    if [[ "$(host="$host" yq eval '.services | has(env(host))' "$COMPOSE_FILE" 2>/dev/null)" == "true" ]]; then
+      echo "$host"
+    fi
+    return
+  fi
+  yq eval '.services | to_entries | map(select(.value.image // "" | test("(^|/)(postgres|postgis|pgvector|timescaledb)(:|@|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
+}
+
+# depends_on: service_healthy is only legal if the service defines a healthcheck.
+detect_postgres_depends_condition() {
+  local tag
+  tag=$(yq eval ".services[\"$POSTGRES_SERVICE\"].healthcheck | tag" "$COMPOSE_FILE" 2>/dev/null)
+  if [[ "$tag" == "!!map" ]]; then
+    echo "service_healthy"
+  else
+    echo "service_started"
+  fi
+}
+
+env_value() {
+  local value="$1"
+  value=$(printf '%s' "$value" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\$/$$/g')
+  printf '"%s"' "$value"
+}
+
 detect_compose_network() {
   local tag
   tag=$(yq eval ".services[\"$COMBINED_SERVICE\"].networks | tag" "$COMPOSE_FILE" 2>/dev/null)
@@ -221,9 +318,6 @@ render_override() {
 # Remove this file (and config.yaml.enterprise if present) to revert.
 
 services:
-  ${DASHBOARD_SERVICE}:
-    image: \${NETBIRD_DASHBOARD_IMAGE:-ghcr.io/netbirdio/dashboard-cloud:latest}
-
   ${COMBINED_SERVICE}:
     image: \${NETBIRD_SERVER_IMAGE:-ghcr.io/netbirdio/netbird-server-cloud:latest}
     environment:
@@ -231,16 +325,30 @@ services:
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
 EOF
 
+  # An existing Postgres is already wired up by the operator's own compose file,
+  # so only a Postgres this run creates needs a depends_on.
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     cat <<EOF
     depends_on:
-      postgres:
-        condition: service_healthy
+      ${POSTGRES_SERVICE}:
+        condition: ${POSTGRES_DEPENDS_CONDITION}
+EOF
+  fi
+
+  # The server is only pointed at a different config file when this run
+  # generates one. A pure image swap leaves it on its original config.yaml.
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+    cat <<EOF
     volumes:
       - ./${ENTERPRISE_CONFIG_FILE}:/etc/netbird/config.yaml.enterprise:ro
     command: ["--config", "/etc/netbird/config.yaml.enterprise"]
+EOF
+  fi
 
-  postgres:
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    cat <<EOF
+
+  ${POSTGRES_SERVICE}:
     image: postgres:17
     container_name: netbird-postgres
     restart: unless-stopped
@@ -260,6 +368,14 @@ EOF
   fi
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
+    # Nothing to wait on when Postgres is managed outside this compose project.
+    local enricher_depends=""
+    if [[ -n "$POSTGRES_SERVICE" ]]; then
+      enricher_depends="
+      ${POSTGRES_SERVICE}:
+        condition: ${POSTGRES_DEPENDS_CONDITION}"
+    fi
+
     cat <<EOF
 
   nats:
@@ -276,9 +392,7 @@ EOF
     container_name: netbird-flow-enricher
     restart: unless-stopped
     networks: [${COMPOSE_NETWORK}]
-    depends_on:
-      postgres:
-        condition: service_healthy
+    depends_on:${enricher_depends}
       nats:
         condition: service_started
     environment:
@@ -286,10 +400,10 @@ EOF
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
       NB_DATADIR: /var/lib/netbird
       NB_MANAGEMENT_STORE_ENGINE: postgres
-      NB_MANAGEMENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
-      NB_STORE_ENGINE_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_MANAGEMENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
+      NB_STORE_ENGINE_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
       NB_TRAFFIC_EVENT_STORE_ENGINE: postgres
-      NB_TRAFFIC_EVENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_TRAFFIC_EVENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
       NB_MANAGEMENT_STORE_KEY: \${NETBIRD_ENCRYPTION_KEY}
       NB_FLOW_ADAPTER_TYPE: nats
       NB_FLOW_NATS_ENDPOINTS: nats://nats:4222
@@ -346,27 +460,41 @@ EOF
   fi
 }
 
-# Build config.yaml.enterprise by yq-editing the operator's existing
-# config.yaml. We don't touch the original file.
+# Build config.yaml.enterprise from the operator's existing config.yaml. We
+# don't touch the original file. Values go through strenv() so a DSN carrying
+# quotes, backslashes or $ cannot break out of the expression.
 render_enterprise_config() {
-  local pg_dsn="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+  {
+    echo "# Generated by migrate-to-enterprise.sh from ${CONFIG_YAML_HOST}."
+    echo "# The enterprise server is started with --config pointing at this file,"
+    echo "# so later edits to ${CONFIG_YAML_HOST} have no effect until copied here."
+    cat "$CONFIG_YAML_HOST"
+  } > "$ENTERPRISE_CONFIG_FILE"
 
-  yq eval "
-    .server.store.engine = \"postgres\" |
-    .server.store.dsn = \"$pg_dsn\" |
-    .server.activityStore.engine = \"postgres\" |
-    .server.activityStore.dsn = \"$pg_dsn\" |
-    .server.authStore.engine = \"postgres\" |
-    .server.authStore.dsn = \"$pg_dsn\"
-  " "$CONFIG_YAML_HOST" > "$ENTERPRISE_CONFIG_FILE"
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    # Fresh Postgres: point every store section at it. migrate-store carries the
+    # SQLite contents across.
+    POSTGRES_DSN="$POSTGRES_DSN" yq eval -i '
+      .server.store.engine = "postgres" |
+      .server.store.dsn = strenv(POSTGRES_DSN) |
+      .server.activityStore.engine = "postgres" |
+      .server.activityStore.dsn = strenv(POSTGRES_DSN) |
+      .server.authStore.engine = "postgres" |
+      .server.authStore.dsn = strenv(POSTGRES_DSN)
+    ' "$ENTERPRISE_CONFIG_FILE"
+  fi
+  # Otherwise the store config is the operator's and stays untouched.
+  # activityStore and authStore do not inherit from server.store — each falls
+  # back to its own SQLite file under dataDir — so repointing them at Postgres
+  # here would silently strand the existing audit log and the embedded IdP's
+  # users, with no migrate-store run to carry them over.
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
-    local flow_addr="${NETBIRD_DOMAIN}"
-    yq eval -i "
+    NETBIRD_DOMAIN="$NETBIRD_DOMAIN" yq eval -i '
       .server.trafficFlow.enabled = true |
-      .server.trafficFlow.address = \"$flow_addr\" |
-      .server.trafficFlow.interval = \"60s\"
-    " "$ENTERPRISE_CONFIG_FILE"
+      .server.trafficFlow.address = strenv(NETBIRD_DOMAIN) |
+      .server.trafficFlow.interval = "60s"
+    ' "$ENTERPRISE_CONFIG_FILE"
   fi
 }
 
@@ -633,6 +761,91 @@ on_exit() {
 # Main
 # ---------------------------------------------------------------------------
 
+# Already on Postgres: there is nothing to provision and nothing to migrate.
+# The enterprise image reads the very same store config the community image
+# did, so step 2 collapses to a no-op and the run is a plain image swap.
+configure_existing_postgres() {
+  EXISTING_POSTGRES="yes"
+  MIGRATE_POSTGRES="no"
+
+  # DSN first — detect_postgres_service prefers the host it names.
+  POSTGRES_DSN=$(detect_store_dsn)
+  if [[ -z "$POSTGRES_DSN" ]] || [[ "$POSTGRES_DSN" == "null" ]]; then
+    POSTGRES_DSN=$(detect_store_dsn_from_compose)
+  fi
+  if [[ "$POSTGRES_DSN" == "null" ]]; then
+    POSTGRES_DSN=""
+  fi
+
+  POSTGRES_SERVICE=$(detect_postgres_service)
+  if [[ -n "$POSTGRES_SERVICE" ]]; then
+    POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
+  fi
+
+  echo "Step 2: Postgres migration not needed — this deployment already runs on"
+  echo "        Postgres. Its store configuration is reused as-is and left"
+  echo "        untouched; no database is created and no data is moved."
+  if [[ -n "$POSTGRES_SERVICE" ]]; then
+    echo "        Postgres service: $POSTGRES_SERVICE (in $COMPOSE_FILE)"
+  else
+    echo "        Postgres service: managed outside $COMPOSE_FILE"
+  fi
+}
+
+configure_sqlite_store() {
+  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  # The override would otherwise merge into a service of the same name and
+  # quietly rewrite its image and credentials.
+  local existing
+  existing=$(yq eval '.services | has("postgres")' "$COMPOSE_FILE")
+  if [[ "$existing" == "true" ]]; then
+    echo "" > /dev/stderr
+    echo "$COMPOSE_FILE already defines a service named 'postgres', but config.yaml" > /dev/stderr
+    echo "still has server.store.engine: sqlite. This script would add its own" > /dev/stderr
+    echo "'postgres' service and Compose would merge the two." > /dev/stderr
+    echo "" > /dev/stderr
+    echo "Point server.store.engine at that Postgres yourself, or rename the service," > /dev/stderr
+    echo "then re-run." > /dev/stderr
+    exit 1
+  fi
+
+  echo ""
+  echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
+  echo "     will be backed up automatically. To fully revert later, restore"
+  echo "     that backup and delete docker-compose.override.yml +"
+  echo "     config.yaml.enterprise."
+  local confirm
+  confirm=$(read_yes_no "  Continue?" "y")
+  if [[ "$confirm" != "yes" ]]; then
+    MIGRATE_POSTGRES="no"
+    echo "  Skipping Postgres migration."
+    return 0
+  fi
+
+  POSTGRES_PASSWORD=$(rand_password)
+  POSTGRES_SERVICE="postgres"
+  POSTGRES_DEPENDS_CONDITION="service_healthy"
+  POSTGRES_DSN="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+}
+
+# mysql, or something this script has never seen. Swapping the images is still
+# valid; touching the store is not.
+configure_unsupported_store() {
+  MIGRATE_POSTGRES="no"
+  echo "  ⚠  server.store.engine is '$STORE_ENGINE'. This script only migrates"
+  echo "     SQLite to Postgres, and traffic flow requires Postgres, so both are"
+  echo "     unavailable here. The store configuration will be left untouched."
+  echo ""
+  local proceed
+  proceed=$(read_yes_no "Step 2 skipped. Continue with the image swap only?" "n")
+  if [[ "$proceed" != "yes" ]]; then
+    echo "Aborted."
+    exit 0
+  fi
+}
+
 init_migration() {
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
   check_yq
@@ -682,12 +895,15 @@ init_migration() {
     exit 1
   fi
 
+  STORE_ENGINE=$(detect_store_engine)
+
   echo "Detected existing deployment:"
   echo "  Combined service: $COMBINED_SERVICE"
   echo "  Dashboard:        $DASHBOARD_SERVICE"
   echo "  config.yaml:      $CONFIG_YAML_HOST"
   echo "  Data volume:      $DATA_VOLUME"
   echo "  Network:          $COMPOSE_NETWORK"
+  echo "  Store engine:     $STORE_ENGINE"
   echo ""
 
   require_eula_acceptance
@@ -706,28 +922,17 @@ init_migration() {
   echo "Step 1: Image swap (community → Enterprise). License key required."
   NB_LICENSE_KEY=$(read_secret "  License key")
 
-  # Step 2 — optional
+  # Step 2 — what this does depends on what the deployment already stores in.
   echo ""
-  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    echo ""
-    echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
-    echo "     will be backed up automatically. To fully revert later, restore"
-    echo "     that backup and delete docker-compose.override.yml +"
-    echo "     config.yaml.enterprise."
-    local confirm
-    confirm=$(read_yes_no "  Continue?" "y")
-    if [[ "$confirm" != "yes" ]]; then
-      MIGRATE_POSTGRES="no"
-      echo "  Skipping Postgres migration."
-    else
-      POSTGRES_PASSWORD=$(rand_password)
-    fi
-  fi
+  case "$STORE_ENGINE" in
+    postgres) configure_existing_postgres ;;
+    sqlite) configure_sqlite_store ;;
+    *) configure_unsupported_store ;;
+  esac
 
   # Step 3 — optional, only if Postgres is on (flow requires Postgres)
   echo ""
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$EXISTING_POSTGRES" == "yes" ]]; then
     ENABLE_FLOW=$(read_yes_no "Step 3: Enable traffic flow? (requires Postgres)" "n")
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
       # Auth secret MUST match server.authSecret from config.yaml
@@ -751,12 +956,43 @@ init_migration() {
         echo "Could not read server.store.encryptionKey from $CONFIG_YAML_HOST." > /dev/stderr
         exit 1
       fi
+
+      # flow-enricher talks to Postgres directly, so this is the one place an
+      # existing deployment's DSN is actually needed — and the one place a host
+      # that only works from inside the server container shows up.
+      while :; do
+        local dsn_problem=""
+        if [[ -z "$POSTGRES_DSN" ]]; then
+          dsn_problem="No DSN could be read from $CONFIG_YAML_HOST or from the $COMBINED_SERVICE environment."
+        elif ! dsn_host_reachable "$POSTGRES_DSN"; then
+          dsn_problem="Its host '$(dsn_host "$POSTGRES_DSN")' only resolves inside the server container."
+        fi
+        [[ -n "$dsn_problem" ]] || break
+
+        echo ""
+        echo "  The flow enricher reaches Postgres from a container of its own."
+        echo "  $dsn_problem"
+        echo "  Enter a DSN reachable from other containers, or press Ctrl-C to abort."
+        POSTGRES_DSN=$(read_required "  Postgres DSN (host=… user=… password=… dbname=… port=5432 sslmode=disable)")
+      done
+
+      # A DSN entered above names a different host, which decides what to wait on.
+      POSTGRES_SERVICE=$(detect_postgres_service)
+      if [[ -n "$POSTGRES_SERVICE" ]]; then
+        POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
+      fi
     fi
   else
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
 
+  # config.yaml.enterprise only exists to hold changes; without any there is
+  # nothing to generate and the server keeps running on its own config.yaml.
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$ENABLE_FLOW" == "yes" ]]; then
+    ENTERPRISE_CONFIG="yes"
+  fi
+
   check_data_directory
   check_stale_postgres_volume
 }
@@ -774,7 +1010,7 @@ apply_changes() {
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' "$OVERRIDE_FILE" && rm -f "$OVERRIDE_FILE.bak"
   fi
 
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
     echo "Writing $ENTERPRISE_CONFIG_FILE ..."
     install -m 600 /dev/null "$ENTERPRISE_CONFIG_FILE"
     render_enterprise_config
@@ -810,6 +1046,9 @@ apply_changes() {
       echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
     fi
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
+      # Own variable name rather than NB_STORE_ENGINE_POSTGRES_DSN so that a
+      # deployment already setting that one keeps its own value.
+      echo "NB_ENTERPRISE_POSTGRES_DSN=$(env_value "$POSTGRES_DSN")"
       echo "NB_FLOW_AUTH_SECRET=${NB_FLOW_AUTH_SECRET}"
       echo "NETBIRD_ENCRYPTION_KEY=${NETBIRD_ENCRYPTION_KEY}"
     fi
@@ -871,14 +1110,19 @@ print_summary() {
   echo " Summary"
   echo "──────────────────────────────────────────────────────────────────────"
   echo "  Images:           swapped to enterprise"
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "  Storage:          Postgres (data migrated from SQLite)"
-  [[ "$MIGRATE_POSTGRES" != "yes" ]] && echo "  Storage:          SQLite (unchanged)"
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    echo "  Storage:          Postgres (data migrated from SQLite)"
+  elif [[ "$EXISTING_POSTGRES" == "yes" ]]; then
+    echo "  Storage:          Postgres (pre-existing, configuration unchanged)"
+  else
+    echo "  Storage:          $STORE_ENGINE (unchanged)"
+  fi
   [[ "$ENABLE_FLOW" == "yes" ]] && echo "  Traffic flow:     enabled"
   [[ "$ENABLE_FLOW" != "yes" ]] && echo "  Traffic flow:     disabled"
   echo ""
   echo "  Generated files (next to your docker-compose.yml):"
   echo "    $OVERRIDE_FILE"
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
+  [[ "$ENTERPRISE_CONFIG" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
   [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
@@ -902,7 +1146,11 @@ print_summary() {
   else
     echo "  $DOCKER_COMPOSE_COMMAND down"
   fi
-  echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+    echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
+  else
+    echo "  rm -f $OVERRIDE_FILE"
+  fi
   if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
     echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
   elif [[ "$ENV_EXISTED" == "no" ]]; then

management/internals/modules/agentnetwork/catalog/catalog.go

@@ -113,61 +113,8 @@ type Provider struct {
 	// upstream provider + credentials on Portkey's hosted side).
 	ExtraHeaders []ExtraHeader
 	Models       []Model
-	// Discovery, when non-nil, describes how to ask this vendor which
-	// models the operator's own credential can actually reach, so the
-	// provider form can offer a live list instead of only the hand-curated
-	// Models above. Nil for entries with no listing endpoint (gateways
-	// vary too much) — those keep free-text entry.
-	Discovery *Discovery
 }
 
-// ListingShape names the response envelope a vendor returns its model
-// listing in. Every vendor invented its own, and none of them can be
-// guessed from the request, so the catalog states it.
-type ListingShape string
-
-const (
-	// ShapeOpenAIData is {"data":[{"id":…}]} — OpenAI, and Anthropic, which
-	// adopted the same envelope.
-	ShapeOpenAIData ListingShape = "openai_data"
-	// ShapeBedrockInferenceProfiles is
-	// {"inferenceProfileSummaries":[{"inferenceProfileId":…}]}. The ids carry
-	// the region prefix that makes them invocable, which is exactly what an
-	// operator cannot reconstruct by hand.
-	ShapeBedrockInferenceProfiles ListingShape = "bedrock_inference_profiles"
-	// ShapeVertexPublisherModels is {"publisherModels":[{"name":…}]}, where
-	// name is a resource path and the invocable id is its last segment joined
-	// to a separate versionId field.
-	ShapeVertexPublisherModels ListingShape = "vertex_publisher_models"
-)
-
-// Discovery describes one vendor's model-listing endpoint.
-//
-// Host is deliberately separate from the provider record's upstream URL:
-// Bedrock serves listings from the control plane (bedrock.<region>) while
-// inference must go to the runtime host (bedrock-runtime.<region>), so the
-// two cannot be the same value. Empty Host means "use the record's own
-// upstream", which is right for every vendor that serves both from one host.
-//
-// The regionPlaceholder in Host is substituted from the provider record's
-// region. Deriving the discovery host from the catalog rather than accepting
-// one from the caller is also what keeps this from being an open proxy: the
-// only hosts management will dial are the ones written here.
-type Discovery struct {
-	Host  string
-	Path  string
-	Query string
-	Shape ListingShape
-	// Headers are static headers the vendor requires beyond the credential
-	// (Anthropic versions its API through one and rejects a request without
-	// it). The auth header itself comes from AuthHeaderName/Template.
-	Headers map[string]string
-}
-
-// RegionPlaceholder is replaced in Discovery.Host by the provider record's
-// configured region.
-const RegionPlaceholder = "<region>"
-
 // ExtraHeader names a single optional per-provider routing/config
 // header. Catalog declares N of these per provider type; the operator
 // fills any subset on the provider record (see Provider.ExtraValues).
@@ -298,12 +245,8 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#10A37F",
-		Discovery: &Discovery{
-			Path:  "/v1/models",
-			Shape: ShapeOpenAIData,
-		},
-		ParserID:        "openai",
-		PricingSurfaces: []string{"openai"},
+		ParserID:           "openai",
+		PricingSurfaces:    []string{"openai"},
 		// Pricing + context windows cross-checked against LiteLLM's
 		// model_prices_and_context_window.json. Notable corrections from
 		// earlier values: o4-mini repriced from $4/$16 to $1.10/$4.40
@@ -341,18 +284,8 @@ var providers = []Provider{
 		AuthHeaderTemplate: "${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#D97757",
-		Discovery: &Discovery{
-			Path: "/v1/models",
-			// The default page is short and a picker wants the whole
-			// catalogue in one call.
-			Query: "limit=1000",
-			Shape: ShapeOpenAIData,
-			// Anthropic versions its API through a header and refuses a
-			// request that omits it, listing included.
-			Headers: map[string]string{"anthropic-version": "2023-06-01"},
-		},
-		ParserID:        "anthropic",
-		PricingSurfaces: []string{"anthropic"},
+		ParserID:           "anthropic",
+		PricingSurfaces:    []string{"anthropic"},
 		// Per Anthropic's current model lineup. Pricing in USD per 1k
 		// tokens. Context windows: 4.6+ family is 1M; Haiku 4.5 stays at
 		// 200K. claude-3-7-sonnet and claude-3-5-haiku retired
@@ -363,8 +296,6 @@ var providers = []Provider{
 		// account to be on >= 30-day data retention or all requests
 		// 400.
 		Models: []Model{
-			{ID: "claude-opus-5", Label: "Claude Opus 5", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-sonnet-5", Label: "Claude Sonnet 5", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
 			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
@@ -412,22 +343,6 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#FF9900",
-		// Listings come from the CONTROL PLANE, not the runtime host in
-		// DefaultHost above: ListInferenceProfiles is not an operation
-		// bedrock-runtime implements, and answers <UnknownOperationException/>
-		// there. Inference has to go to the runtime host, so the two hosts
-		// genuinely differ and Discovery.Host carries the difference.
-		//
-		// Inference profiles rather than foundation models because the profile
-		// id is the invocable one: it carries the region prefix (eu., us.,
-		// global.) that AWS requires and that cannot be derived from the
-		// configured region — an eu-central-1 account legitimately holds
-		// global.* profiles.
-		Discovery: &Discovery{
-			Host:  "bedrock." + RegionPlaceholder + ".amazonaws.com",
-			Path:  "/inference-profiles",
-			Shape: ShapeBedrockInferenceProfiles,
-		},
 		// ParserID stays empty (path-style dispatch via IsBedrockPathStyle);
 		// the request parser meters these under the "bedrock" surface.
 		PricingSurfaces: []string{"bedrock"},
@@ -440,8 +355,6 @@ var providers = []Provider{
 		// Llama 3.3 70B entry kept unchanged — LiteLLM tracks only
 		// per-region Llama 3 entries; standalone 3.3 not yet listed.
 		Models: []Model{
-			{ID: "anthropic.claude-opus-5", Label: "Claude Opus 5 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "anthropic.claude-sonnet-5", Label: "Claude Sonnet 5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
@@ -478,15 +391,6 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#4285F4",
-		// Only the v1beta1 publisher listing answers: the v1 form and the
-		// project-scoped form under BOTH versions return 404. That means the
-		// list is publisher-global — it cannot say which models this project
-		// has enabled — so it is offered as a suggestion beside the catalog
-		// rather than replacing it. See the discovery e2e for the probes.
-		Discovery: &Discovery{
-			Path:  "/v1beta1/publishers/anthropic/models",
-			Shape: ShapeVertexPublisherModels,
-		},
 		// ParserID stays empty (path-style dispatch via IsVertexPathStyle);
 		// Anthropic-on-Vertex requests are metered under the "anthropic"
 		// surface with the bare, unversioned model id.
@@ -502,8 +406,6 @@ var providers = []Provider{
 		// exists — the router denies unmeterable publishers rather than forward
 		// them uncounted.
 		Models: []Model{
-			{ID: "claude-opus-5", Label: "Claude Opus 5 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-sonnet-5", Label: "Claude Sonnet 5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
 			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},

management/internals/modules/agentnetwork/catalog/catalog_test.go

@@ -1,36 +0,0 @@
-package catalog
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestClaudeLineupSelectable pins the models Claude Code resolves to by
-// default. A model absent from the lineup can't be ticked on a provider
-// record, so llm_router denies it as not-routable and the operator has no
-// way to authorise the client's own default.
-func TestClaudeLineupSelectable(t *testing.T) {
-	for providerID, wanted := range map[string][]string{
-		"anthropic_api": {"claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"},
-		"bedrock_api":   {"anthropic.claude-opus-5", "anthropic.claude-sonnet-5", "anthropic.claude-haiku-4-5"},
-		"vertex_ai_api": {"claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"},
-	} {
-		provider, ok := Lookup(providerID)
-		require.True(t, ok, "catalog must define %s", providerID)
-
-		selectable := make(map[string]Model, len(provider.Models))
-		for _, m := range provider.Models {
-			selectable[m.ID] = m
-		}
-		for _, id := range wanted {
-			model, found := selectable[id]
-			require.True(t, found, "%s must offer %s", providerID, id)
-			assert.NotEmpty(t, model.Label, "%s/%s needs a label for the picker", providerID, id)
-			assert.Positive(t, model.InputPer1k, "%s/%s needs an input rate", providerID, id)
-			assert.Positive(t, model.OutputPer1k, "%s/%s needs an output rate", providerID, id)
-			assert.Positive(t, model.ContextWindow, "%s/%s needs a context window", providerID, id)
-		}
-	}
-}

management/internals/modules/agentnetwork/handlers/model_discovery_handler_test.go

@@ -1,137 +0,0 @@
-package handlers
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/auth"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// discoveryManagerStub records what the handler asked for and returns a canned
-// answer. The Manager interface is embedded rather than implemented: only the
-// one method is reachable from this handler, and a call to any other should
-// fail loudly rather than silently return a zero value.
-type discoveryManagerStub struct {
-	agentnetwork.Manager
-
-	gotReq      modeldiscovery.Request
-	gotRecordID string
-	models      []modeldiscovery.Model
-	err         error
-}
-
-func (s *discoveryManagerStub) DiscoverProviderModels(
-	_ context.Context, _, _ string, req modeldiscovery.Request, recordID string,
-) ([]modeldiscovery.Model, error) {
-	s.gotReq = req
-	s.gotRecordID = recordID
-	return s.models, s.err
-}
-
-// postDiscovery drives the handler with an authenticated request.
-func postDiscovery(t *testing.T, stub *discoveryManagerStub, body string) *httptest.ResponseRecorder {
-	t.Helper()
-	h := &handler{manager: stub}
-
-	req := httptest.NewRequest(http.MethodPost, "/agent-network/catalog/providers/models", strings.NewReader(body))
-	req = req.WithContext(nbcontext.SetUserAuthInContext(req.Context(), auth.UserAuth{
-		AccountId: "acc-1",
-		UserId:    "user-1",
-	}))
-
-	rec := httptest.NewRecorder()
-	h.discoverProviderModels(rec, req)
-	return rec
-}
-
-func TestDiscoverModelsReturnsTheVendorList(t *testing.T) {
-	stub := &discoveryManagerStub{models: []modeldiscovery.Model{
-		{ID: "eu.anthropic.claude-haiku-4-5-20251001-v1:0", Label: "EU Claude Haiku 4.5", PricingKnown: true},
-		{ID: "global.cohere.embed-v4:0", Label: "Global Cohere Embed v4"},
-	}}
-
-	rec := postDiscovery(t, stub, `{
-		"catalog_provider_id":"bedrock_api",
-		"upstream_url":"https://bedrock-runtime.eu-central-1.amazonaws.com",
-		"api_key":"aws-bearer"
-	}`)
-	require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
-
-	var out api.AgentNetworkModelDiscoveryResponse
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &out))
-	require.Len(t, out.Models, 2)
-
-	assert.Equal(t, "eu.anthropic.claude-haiku-4-5-20251001-v1:0", out.Models[0].Id)
-	assert.True(t, out.Models[0].PricingKnown)
-	// An unpriced model must say so rather than arriving indistinguishable
-	// from a priced one: registering it silently would meter at zero.
-	assert.False(t, out.Models[1].PricingKnown)
-
-	assert.Equal(t, "bedrock_api", stub.gotReq.CatalogID)
-	assert.Equal(t, "aws-bearer", stub.gotReq.APIKey)
-	assert.Empty(t, stub.gotRecordID)
-}
-
-func TestDiscoverModelsUsesAStoredRecordWithoutAKey(t *testing.T) {
-	stub := &discoveryManagerStub{}
-
-	rec := postDiscovery(t, stub, `{"catalog_provider_id":"openai_api","provider_id":"prov-42"}`)
-	require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
-
-	// The dashboard refreshes a saved provider's list without ever holding
-	// the credential, so the record id has to reach the manager.
-	assert.Equal(t, "prov-42", stub.gotRecordID)
-	assert.Empty(t, stub.gotReq.APIKey)
-}
-
-// TestDiscoverModelsRefusesMixedCredentials covers the case where a caller
-// names a saved provider AND supplies a key. Accepting it would run an
-// arbitrary credential under the identity of a record the caller may only be
-// permitted to read.
-func TestDiscoverModelsRefusesMixedCredentials(t *testing.T) {
-	stub := &discoveryManagerStub{}
-
-	rec := postDiscovery(t, stub, `{
-		"catalog_provider_id":"openai_api",
-		"provider_id":"prov-42",
-		"api_key":"sk-attacker"
-	}`)
-	assert.Equal(t, http.StatusBadRequest, rec.Code)
-	assert.Empty(t, stub.gotRecordID, "the request must be refused before it reaches the manager")
-}
-
-// TestDiscoverModelsReportsNoDiscoveryDistinctly matters because the caller
-// falls back to the catalog's own model list on this outcome. Collapsing it
-// into a generic 500 would turn "this provider has no listing endpoint" into
-// "something went wrong", and the form would show an error instead of a list.
-func TestDiscoverModelsReportsNoDiscoveryDistinctly(t *testing.T) {
-	stub := &discoveryManagerStub{err: modeldiscovery.ErrNoDiscovery}
-
-	rec := postDiscovery(t, stub, `{"catalog_provider_id":"litellm_proxy","upstream_url":"https://gw.example.com","api_key":"sk"}`)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code)
-}
-
-func TestDiscoverModelsRejectsMalformedRequests(t *testing.T) {
-	for name, body := range map[string]string{
-		"not json":              `{`,
-		"no catalog provider":   `{"api_key":"sk"}`,
-		"blank catalog provide": `{"catalog_provider_id":"   ","api_key":"sk"}`,
-	} {
-		t.Run(name, func(t *testing.T) {
-			stub := &discoveryManagerStub{}
-			rec := postDiscovery(t, stub, body)
-			assert.Equal(t, http.StatusBadRequest, rec.Code)
-		})
-	}
-}

management/internals/modules/agentnetwork/handlers/providers_handler.go

@@ -7,7 +7,6 @@ package handlers
 
 import (
 	"encoding/json"
-	"errors"
 	"math"
 	"net/http"
 	"net/url"
@@ -17,7 +16,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
@@ -34,7 +32,6 @@ type handler struct {
 func RegisterEndpoints(manager agentnetwork.Manager, router *mux.Router) {
 	h := &handler{manager: manager}
 	router.HandleFunc("/agent-network/catalog/providers", h.getCatalogProviders).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/catalog/providers/models", h.discoverProviderModels).Methods("POST", "OPTIONS")
 	router.HandleFunc("/agent-network/providers", h.getAllProviders).Methods("GET", "OPTIONS")
 	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST", "OPTIONS")
 	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET", "OPTIONS")
@@ -64,73 +61,6 @@ func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {
 	util.WriteJSONObject(r.Context(), w, out)
 }
 
-// discoverProviderModels asks the vendor which models the operator's own
-// credential can reach, so the provider form can offer a live list rather than
-// only the static catalog.
-func (h *handler) discoverProviderModels(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var body api.AgentNetworkModelDiscoveryRequest
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		util.WriteErrorResponse("invalid json", http.StatusBadRequest, w)
-		return
-	}
-	if strings.TrimSpace(body.CatalogProviderId) == "" {
-		util.WriteErrorResponse("catalog_provider_id is required", http.StatusBadRequest, w)
-		return
-	}
-
-	recordID := strValue(body.ProviderId)
-	req := modeldiscovery.Request{
-		CatalogID:   body.CatalogProviderId,
-		UpstreamURL: strValue(body.UpstreamUrl),
-		APIKey:      strValue(body.ApiKey),
-	}
-	// One source of credential or the other, never a mix: taking a key from
-	// the request while addressing a saved record would let a caller run an
-	// arbitrary credential against a provider they can only read.
-	if recordID != "" && req.APIKey != "" {
-		util.WriteErrorResponse("provide either provider_id or api_key, not both", http.StatusBadRequest, w)
-		return
-	}
-
-	models, err := h.manager.DiscoverProviderModels(r.Context(), userAuth.AccountId, userAuth.UserId, req, recordID)
-	if err != nil {
-		// A provider with no listing endpoint is a fact about the catalog
-		// entry, not a failure: the caller falls back to the catalog's own
-		// models, so it must be able to tell the two apart.
-		if errors.Is(err, modeldiscovery.ErrNoDiscovery) {
-			util.WriteErrorResponse(err.Error(), http.StatusUnprocessableEntity, w)
-			return
-		}
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := api.AgentNetworkModelDiscoveryResponse{Models: make([]api.AgentNetworkDiscoveredModel, 0, len(models))}
-	for _, m := range models {
-		entry := api.AgentNetworkDiscoveredModel{Id: m.ID, PricingKnown: m.PricingKnown}
-		if m.Label != "" {
-			label := m.Label
-			entry.Label = &label
-		}
-		out.Models = append(out.Models, entry)
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-// strValue reads an optional string field, treating absent as empty.
-func strValue(v *string) string {
-	if v == nil {
-		return ""
-	}
-	return strings.TrimSpace(*v)
-}
-
 // applyDefaultPricing overwrites the catalog response's model rates with
 // the LIVE default pricing table, which may differ from the compiled-in
 // catalog rates when the operator provides a defaults_llm_pricing.yaml.

management/internals/modules/agentnetwork/manager.go

@@ -13,7 +13,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/labelgen"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
@@ -51,7 +50,6 @@ type Manager interface {
 	CreateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
 	UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
 	DeleteProvider(ctx context.Context, accountID, userID, providerID string) error
-	DiscoverProviderModels(ctx context.Context, accountID, userID string, req modeldiscovery.Request, recordID string) ([]modeldiscovery.Model, error)
 
 	GetAllPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error)
 	GetPolicy(ctx context.Context, accountID, userID, policyID string) (*types.Policy, error)
@@ -125,11 +123,6 @@ type managerImpl struct {
 	permissionsManager permissions.Manager
 	proxyController    proxy.Controller
 
-	// modelDiscovery queries vendors for the models a credential can reach.
-	// A field rather than a package call so tests can drive it without
-	// reaching the network.
-	modelDiscovery *modeldiscovery.Client
-
 	// reconcileCache holds the last set of synthesised proxy mappings
 	// per account, each paired with the proxy that served it, so a change
 	// of serving proxy can be diffed without re-deriving it.
@@ -158,7 +151,6 @@ func NewManager(
 		accountManager:     accountManager,
 		permissionsManager: permissionsManager,
 		proxyController:    proxyController,
-		modelDiscovery:     &modeldiscovery.Client{},
 		reconcileCache:     make(map[string]map[string]syntheticMapping),
 		labelRng:           rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
@@ -178,37 +170,6 @@ func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, provid
 	return m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
 }
 
-// DiscoverProviderModels asks the vendor which models a credential can reach.
-//
-// recordID, when set, names an existing provider whose stored credential and
-// upstream are used instead of the ones in req — so the dashboard can refresh
-// the list without ever holding the key. Reading a stored credential is a read
-// of that provider, and is permission-checked as one.
-//
-// Gated on Create rather than Read: this spends the operator's credential
-// against a third party, which is not something a read-only role should be
-// able to make the server do.
-func (m *managerImpl) DiscoverProviderModels(ctx context.Context, accountID, userID string, req modeldiscovery.Request, recordID string) ([]modeldiscovery.Model, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Create); err != nil {
-		return nil, err
-	}
-
-	if recordID != "" {
-		record, err := m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, recordID)
-		if err != nil {
-			return nil, err
-		}
-		// The catalog id comes from the stored record too: letting the caller
-		// name a different one would run a provider's credential against
-		// whichever vendor endpoint they picked.
-		req.CatalogID = record.ProviderID
-		req.UpstreamURL = record.UpstreamURL
-		req.APIKey = record.APIKey
-	}
-
-	return m.modelDiscovery.Fetch(ctx, req)
-}
-
 // CreateProvider persists a new provider for the account. Providers have no
 // settings side effects: the account's endpoint is bootstrapped separately and
 // explicitly via CreateSettings, and every provider in the account routes
@@ -1056,10 +1017,6 @@ func (*mockManager) GetAllProviders(_ context.Context, _, _ string) ([]*types.Pr
 	return []*types.Provider{}, nil
 }
 
-func (*mockManager) DiscoverProviderModels(_ context.Context, _, _ string, _ modeldiscovery.Request, _ string) ([]modeldiscovery.Model, error) {
-	return nil, nil
-}
-
 func (*mockManager) GetProvider(_ context.Context, _, _, _ string) (*types.Provider, error) {
 	return &types.Provider{}, nil
 }

management/internals/modules/agentnetwork/modeldiscovery/discovery.go

@@ -1,358 +0,0 @@
-// Package modeldiscovery asks a vendor which models an operator's own
-// credential can reach, so the provider form can offer a live list instead of
-// only the catalog's hand-curated one.
-//
-// The catalog cannot know two things that matter. It goes stale — its entries
-// carry comments tracking which models a vendor retired on which date — and it
-// cannot see an account: which OpenAI models an org is entitled to, which
-// Bedrock inference profiles a given account and region hold, which Vertex
-// models a project has enabled. Those are exactly the facts an operator needs
-// when filling in a provider record, and only the vendor has them.
-//
-// The vendor is authoritative for the model ID. The catalog remains
-// authoritative for pricing, and a discovered model the catalog cannot price
-// is reported as such rather than silently registered at a rate of zero.
-package modeldiscovery
-
-import (
-	"context"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"strings"
-	"time"
-
-	"golang.org/x/oauth2/google"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-)
-
-const (
-	// fetchTimeout bounds one vendor call end to end. A listing is a single
-	// small GET; anything slower is a vendor problem and the operator is
-	// waiting on a form.
-	fetchTimeout = 8 * time.Second
-	// maxListingBytes bounds the response we will buffer. The largest real
-	// listing observed is Bedrock's foundation-model catalogue at ~70KB, so
-	// this is a wide margin over anything legitimate.
-	maxListingBytes = 2 << 20
-	// gcpScope matches the scope llm_router mints Vertex tokens under, so a
-	// credential that works for discovery works for inference too.
-	gcpScope = "https://www.googleapis.com/auth/cloud-platform"
-	// vertexKeyfilePrefix marks an api_key that is a base64 service-account
-	// JSON key rather than a bearer token.
-	vertexKeyfilePrefix = "keyfile::"
-)
-
-// ErrNoDiscovery is returned for a catalog entry that declares no listing
-// endpoint. Gateways vary too much to have one, and the caller should fall
-// back to the catalog list plus free-text entry rather than treating this as
-// a failure.
-var ErrNoDiscovery = errors.New("provider has no model-discovery endpoint")
-
-// Model is one discovered model.
-type Model struct {
-	// ID is the identifier to register on the provider record, in the form the
-	// vendor issues it. For Bedrock that is the region-prefixed inference
-	// profile id, which is the only form AWS accepts at invoke time.
-	ID string
-	// Label is the vendor's display name where it supplies one.
-	Label string
-	// PricingKnown reports whether the shipped pricing table can price this
-	// model. False means the operator must set rates, or the request would
-	// meter at zero.
-	PricingKnown bool
-}
-
-// Request identifies which vendor to ask and with what credential.
-type Request struct {
-	// CatalogID selects the catalog entry, which supplies the endpoint, the
-	// auth header and the response shape. The caller never supplies those.
-	CatalogID string
-	// UpstreamURL is the provider record's configured upstream. It is used
-	// only when the catalog entry declares no discovery host of its own.
-	UpstreamURL string
-	// Region substitutes the catalog host's <region> placeholder.
-	Region string
-	// APIKey is the operator's credential, exactly as stored on the record.
-	APIKey string
-}
-
-// Client fetches model listings. The zero value is usable; Resolver and
-// HTTPClient exist so tests can drive it against a local server.
-type Client struct {
-	HTTPClient *http.Client
-	// Resolver looks up the host for the SSRF check. Nil uses the default.
-	Resolver *net.Resolver
-	// AllowPrivateHosts disables the private-address guard. Only tests set it:
-	// their server is on loopback, which is precisely what the guard blocks.
-	AllowPrivateHosts bool
-}
-
-// Fetch returns the models the credential can reach.
-func (c *Client) Fetch(ctx context.Context, req Request) ([]Model, error) {
-	entry, ok := catalog.Lookup(req.CatalogID)
-	if !ok {
-		return nil, fmt.Errorf("unknown catalog provider %q", req.CatalogID)
-	}
-	if entry.Discovery == nil {
-		return nil, ErrNoDiscovery
-	}
-
-	endpoint, err := c.discoveryURL(entry, req)
-	if err != nil {
-		return nil, err
-	}
-
-	ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
-	defer cancel()
-
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
-	if err != nil {
-		return nil, fmt.Errorf("build discovery request: %w", err)
-	}
-	if err := applyAuth(httpReq, entry, req.APIKey); err != nil {
-		return nil, err
-	}
-	for name, value := range entry.Discovery.Headers {
-		httpReq.Header.Set(name, value)
-	}
-	httpReq.Header.Set("Accept", "application/json")
-
-	resp, err := c.httpClient().Do(httpReq)
-	if err != nil {
-		return nil, fmt.Errorf("reach %s: %w", entry.Name, err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxListingBytes))
-	if err != nil {
-		return nil, fmt.Errorf("read %s listing: %w", entry.Name, err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		// Surface the vendor's own status. An operator whose key lacks a scope
-		// needs to see 403 rather than a generic failure.
-		return nil, fmt.Errorf("%s returned %d for its model listing", entry.Name, resp.StatusCode)
-	}
-
-	ids, err := parseListing(entry.Discovery.Shape, body)
-	if err != nil {
-		return nil, err
-	}
-	return decorate(entry, ids), nil
-}
-
-// discoveryURL builds the listing URL and refuses one that does not point at a
-// public host.
-//
-// The path, query and (for Bedrock) the host all come from the catalog rather
-// than from the caller, so the only operator-controlled part is the host of an
-// entry whose listing lives on its own upstream. That still has to be checked:
-// management holds credentials for every provider, and an upstream pointed at
-// an internal address would turn this endpoint into a probe of the management
-// server's own network.
-func (c *Client) discoveryURL(entry catalog.Provider, req Request) (string, error) {
-	host := entry.Discovery.Host
-	if host == "" {
-		parsed, err := url.Parse(strings.TrimSpace(req.UpstreamURL))
-		if err != nil || parsed.Host == "" {
-			return "", fmt.Errorf("provider upstream %q is not a usable URL", req.UpstreamURL)
-		}
-		host = parsed.Host
-	}
-	if strings.Contains(host, catalog.RegionPlaceholder) {
-		region := strings.TrimSpace(req.Region)
-		if region == "" {
-			// A provider record carries no region field: the region lives
-			// inside the upstream host the operator already configured, so
-			// read it back out rather than asking them for it twice.
-			region = regionFromUpstream(entry, req.UpstreamURL)
-		}
-		if region == "" {
-			return "", fmt.Errorf("%s discovery needs a region, and none could be read from the provider upstream", entry.Name)
-		}
-		host = strings.ReplaceAll(host, catalog.RegionPlaceholder, region)
-	}
-
-	target := &url.URL{Scheme: "https", Host: host, Path: entry.Discovery.Path, RawQuery: entry.Discovery.Query}
-	if err := c.checkPublicHost(target.Hostname()); err != nil {
-		return "", err
-	}
-	return target.String(), nil
-}
-
-// regionFromUpstream recovers the region an operator embedded in the provider
-// upstream, by matching it against the catalog's own host template. Bedrock's
-// template is "bedrock-runtime.<region>.amazonaws.com" and Vertex's is
-// "<region>-aiplatform.googleapis.com", so the region is whatever sits between
-// the fixed halves. Returns empty when the upstream does not match the
-// template, which is the case for a custom or proxied endpoint.
-func regionFromUpstream(entry catalog.Provider, upstreamURL string) string {
-	prefix, suffix, found := strings.Cut(entry.DefaultHost, catalog.RegionPlaceholder)
-	if !found {
-		return ""
-	}
-	parsed, err := url.Parse(strings.TrimSpace(upstreamURL))
-	if err != nil {
-		return ""
-	}
-	host := parsed.Hostname()
-	if host == "" {
-		// A bare host with no scheme parses as a path, not a host.
-		host = strings.TrimSpace(upstreamURL)
-	}
-	if !strings.HasPrefix(host, prefix) || !strings.HasSuffix(host, suffix) {
-		return ""
-	}
-	region := host[len(prefix) : len(host)-len(suffix)]
-	if region == "" || strings.Contains(region, ".") {
-		return ""
-	}
-	return region
-}
-
-// checkPublicHost refuses hosts that resolve to an address the management
-// server should never be asked to reach on an operator's behalf.
-func (c *Client) checkPublicHost(host string) error {
-	if c.AllowPrivateHosts {
-		return nil
-	}
-	if host == "" {
-		return errors.New("discovery host is empty")
-	}
-	resolver := c.Resolver
-	if resolver == nil {
-		resolver = net.DefaultResolver
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), fetchTimeout)
-	defer cancel()
-
-	addrs, err := resolver.LookupNetIP(ctx, "ip", host)
-	if err != nil {
-		return fmt.Errorf("resolve discovery host %q: %w", host, err)
-	}
-	// Every address must be public: a name that resolves to one public and one
-	// loopback address is still a way to reach loopback.
-	for _, addr := range addrs {
-		if !isPublic(addr) {
-			return fmt.Errorf("discovery host %q resolves to a non-public address", host)
-		}
-	}
-	return nil
-}
-
-// isPublic reports whether an address is one we are willing to dial.
-func isPublic(addr netip.Addr) bool {
-	addr = addr.Unmap()
-	switch {
-	case !addr.IsValid(),
-		addr.IsLoopback(),
-		addr.IsPrivate(),
-		addr.IsLinkLocalUnicast(),
-		addr.IsLinkLocalMulticast(),
-		addr.IsInterfaceLocalMulticast(),
-		addr.IsMulticast(),
-		addr.IsUnspecified():
-		return false
-	}
-	// 100.64.0.0/10 (carrier NAT) is where NetBird's own overlay addresses
-	// live, so it is emphatically not somewhere to send a provider credential.
-	if addr.Is4() {
-		b := addr.As4()
-		if b[0] == 100 && b[1] >= 64 && b[1] <= 127 {
-			return false
-		}
-	}
-	return true
-}
-
-// applyAuth sets the credential header the catalog entry declares. A Vertex
-// service-account key is exchanged for an OAuth token first, the same way the
-// proxy does at request time.
-func applyAuth(req *http.Request, entry catalog.Provider, apiKey string) error {
-	key := strings.TrimSpace(apiKey)
-	if key == "" {
-		return fmt.Errorf("%s discovery needs an API key", entry.Name)
-	}
-	if rest, ok := strings.CutPrefix(key, vertexKeyfilePrefix); ok {
-		token, err := mintGCPToken(req.Context(), rest)
-		if err != nil {
-			return err
-		}
-		key = token
-	}
-	name := entry.AuthHeaderName
-	if name == "" {
-		name = "Authorization"
-	}
-	template := entry.AuthHeaderTemplate
-	if template == "" {
-		template = "${API_KEY}"
-	}
-	req.Header.Set(name, strings.ReplaceAll(template, "${API_KEY}", key))
-	return nil
-}
-
-// mintGCPToken exchanges a base64 service-account key for an access token.
-func mintGCPToken(ctx context.Context, saKeyB64 string) (string, error) {
-	jsonKey, err := base64.StdEncoding.DecodeString(strings.TrimSpace(saKeyB64))
-	if err != nil {
-		return "", fmt.Errorf("decode service-account key: %w", err)
-	}
-	conf, err := google.JWTConfigFromJSON(jsonKey, gcpScope)
-	if err != nil {
-		return "", fmt.Errorf("parse service-account key: %w", err)
-	}
-	tok, err := conf.TokenSource(ctx).Token()
-	if err != nil {
-		return "", fmt.Errorf("mint gcp token: %w", err)
-	}
-	return tok.AccessToken, nil
-}
-
-// decorate turns raw vendor ids into the models the caller renders, marking
-// each with whether the shipped pricing table can price it.
-func decorate(entry catalog.Provider, ids []listedModel) []Model {
-	priced := make(map[string]struct{}, len(entry.Models))
-	for _, m := range entry.Models {
-		priced[m.ID] = struct{}{}
-	}
-
-	out := make([]Model, 0, len(ids))
-	seen := make(map[string]struct{}, len(ids))
-	for _, listed := range ids {
-		if listed.id == "" {
-			continue
-		}
-		if _, dup := seen[listed.id]; dup {
-			continue
-		}
-		seen[listed.id] = struct{}{}
-
-		// The catalog keys pricing by the normalised id while the vendor
-		// issues the wire form, so normalise before asking whether we can
-		// price it — otherwise every Bedrock profile would report unpriced.
-		_, known := priced[normalizeForPricing(entry.ID, listed.id)]
-		out = append(out, Model{ID: listed.id, Label: listed.label, PricingKnown: known})
-	}
-	return out
-}
-
-func (c *Client) httpClient() *http.Client {
-	if c.HTTPClient != nil {
-		return c.HTTPClient
-	}
-	return &http.Client{
-		Timeout: fetchTimeout,
-		// A redirect is a way to move the request to a host the guard above
-		// never checked, so none are followed.
-		CheckRedirect: func(*http.Request, []*http.Request) error {
-			return http.ErrUseLastResponse
-		},
-	}
-}

management/internals/modules/agentnetwork/modeldiscovery/discovery_test.go

@@ -1,321 +0,0 @@
-package modeldiscovery
-
-import (
-	"context"
-	"io"
-	"net/http"
-	"net/netip"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-)
-
-// stubTransport answers every request with one canned response and records the
-// request it was given, so a test can assert on the URL and headers the client
-// built without a network round trip.
-type stubTransport struct {
-	status int
-	body   string
-	got    *http.Request
-}
-
-func (s *stubTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	s.got = req
-	status := s.status
-	if status == 0 {
-		status = http.StatusOK
-	}
-	return &http.Response{
-		StatusCode: status,
-		Body:       io.NopCloser(strings.NewReader(s.body)),
-		Header:     http.Header{"Content-Type": []string{"application/json"}},
-		Request:    req,
-	}, nil
-}
-
-// newStubClient returns a client that never leaves the process. The host guard
-// is disabled because it would otherwise resolve the vendor's real name, which
-// would make these tests depend on DNS.
-func newStubClient(status int, body string) (*Client, *stubTransport) {
-	tr := &stubTransport{status: status, body: body}
-	return &Client{
-		HTTPClient:        &http.Client{Transport: tr},
-		AllowPrivateHosts: true,
-	}, tr
-}
-
-// The payloads below are trimmed from what the vendors actually returned in
-// the discovery e2e, rather than invented, so a parser that only works against
-// an idealised shape fails here.
-
-const openAIListing = `{"object":"list","data":[
-  {"id":"gpt-4o-mini","object":"model","created":1721172741,"owned_by":"system"},
-  {"id":"gpt-4o","object":"model","created":1715367049,"owned_by":"system"}
-]}`
-
-const anthropicListing = `{"data":[
-  {"type":"model","id":"claude-haiku-4-5-20251001","display_name":"Claude Haiku 4.5"},
-  {"type":"model","id":"claude-sonnet-4-6","display_name":"Claude Sonnet 4.6"}
-],"has_more":false}`
-
-const bedrockListing = `{"inferenceProfileSummaries":[
-  {"inferenceProfileId":"eu.anthropic.claude-haiku-4-5-20251001-v1:0",
-   "inferenceProfileName":"EU Anthropic Claude Haiku 4.5","status":"ACTIVE","type":"SYSTEM_DEFINED"},
-  {"inferenceProfileId":"global.cohere.embed-v4:0",
-   "inferenceProfileName":"Global Cohere Embed v4","status":"ACTIVE","type":"SYSTEM_DEFINED"},
-  {"inferenceProfileId":"eu.meta.llama3-2-1b-instruct-v1:0",
-   "inferenceProfileName":"EU Meta Llama 3.2 1B","status":"INACTIVE","type":"SYSTEM_DEFINED"}
-]}`
-
-const vertexListing = `{"publisherModels":[
-  {"name":"publishers/anthropic/models/claude-3-opus","versionId":"20240229","launchStage":"GA"},
-  {"name":"publishers/anthropic/models/claude-sonnet-4-5","versionId":"20250929","launchStage":"GA"}
-]}`
-
-func TestFetchOpenAIListing(t *testing.T) {
-	cl, tr := newStubClient(http.StatusOK, openAIListing)
-
-	models, err := cl.Fetch(context.Background(), Request{
-		CatalogID:   "openai_api",
-		UpstreamURL: "https://api.openai.com",
-		APIKey:      "sk-test",
-	})
-	require.NoError(t, err)
-
-	assert.Equal(t, "https://api.openai.com/v1/models", tr.got.URL.String())
-	assert.Equal(t, "Bearer sk-test", tr.got.Header.Get("Authorization"),
-		"the credential must be injected through the catalog's auth template")
-	assert.Equal(t, []string{"gpt-4o-mini", "gpt-4o"}, ids(models))
-	for _, m := range models {
-		assert.True(t, m.PricingKnown, "both models are in the shipped catalog: %s", m.ID)
-	}
-}
-
-func TestFetchAnthropicSendsTheVersionHeader(t *testing.T) {
-	cl, tr := newStubClient(http.StatusOK, anthropicListing)
-
-	models, err := cl.Fetch(context.Background(), Request{
-		CatalogID:   "anthropic_api",
-		UpstreamURL: "https://api.anthropic.com",
-		APIKey:      "sk-ant-test",
-	})
-	require.NoError(t, err)
-
-	// Anthropic rejects a request without the version header, so a listing
-	// that reached us at all proves it was sent — but assert it, because the
-	// failure mode otherwise only shows up against the live API.
-	assert.Equal(t, "2023-06-01", tr.got.Header.Get("anthropic-version"))
-	assert.Equal(t, "sk-ant-test", tr.got.Header.Get("x-api-key"),
-		"Anthropic takes a bare key under its own header, not a Bearer token")
-	assert.Equal(t, "limit=1000", tr.got.URL.RawQuery)
-
-	assert.Equal(t, []string{"claude-haiku-4-5-20251001", "claude-sonnet-4-6"}, ids(models))
-	assert.Equal(t, "Claude Haiku 4.5", models[0].Label)
-}
-
-func TestFetchBedrockUsesTheControlPlaneAndKeepsWireIDs(t *testing.T) {
-	cl, tr := newStubClient(http.StatusOK, bedrockListing)
-
-	models, err := cl.Fetch(context.Background(), Request{
-		CatalogID: "bedrock_api",
-		// The record's upstream is the RUNTIME host, which does not serve
-		// listings. The catalog's own discovery host must win over it.
-		UpstreamURL: "https://bedrock-runtime.eu-central-1.amazonaws.com",
-		Region:      "eu-central-1",
-		APIKey:      "aws-bearer",
-	})
-	require.NoError(t, err)
-
-	assert.Equal(t, "https://bedrock.eu-central-1.amazonaws.com/inference-profiles",
-		tr.got.URL.String(), "listings come from the control plane, not the runtime host")
-
-	// Region-prefixed ids verbatim: the prefix is what makes them invocable
-	// and it cannot be reconstructed — global.* alongside eu.* is exactly the
-	// case that defeats deriving it from the configured region.
-	assert.Equal(t, []string{
-		"eu.anthropic.claude-haiku-4-5-20251001-v1:0",
-		"global.cohere.embed-v4:0",
-	}, ids(models), "an INACTIVE profile must not be offered")
-
-	assert.True(t, models[0].PricingKnown,
-		"the catalog prices anthropic.claude-haiku-4-5, which this id normalises to")
-	assert.False(t, models[1].PricingKnown,
-		"cohere embed is not in the shipped Bedrock catalog, so the operator must price it")
-}
-
-func TestFetchVertexJoinsNameAndVersion(t *testing.T) {
-	cl, _ := newStubClient(http.StatusOK, vertexListing)
-
-	models, err := cl.Fetch(context.Background(), Request{
-		CatalogID:   "vertex_ai_api",
-		UpstreamURL: "https://us-east5-aiplatform.googleapis.com",
-		Region:      "us-east5",
-		APIKey:      "ya29.test-token",
-	})
-	require.NoError(t, err)
-
-	// Vertex addresses a model as "<id>@<version>" on rawPredict, and splits
-	// those across two fields in the listing.
-	assert.Equal(t, []string{"claude-3-opus@20240229", "claude-sonnet-4-5@20250929"}, ids(models))
-	assert.Equal(t, "claude-3-opus", models[0].Label)
-}
-
-func TestFetchSurfacesTheVendorStatus(t *testing.T) {
-	cl, _ := newStubClient(http.StatusForbidden, `{"error":{"message":"no access"}}`)
-
-	_, err := cl.Fetch(context.Background(), Request{
-		CatalogID:   "openai_api",
-		UpstreamURL: "https://api.openai.com",
-		APIKey:      "sk-test",
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "403",
-		"an operator whose key lacks access needs to see which status the vendor returned")
-}
-
-func TestFetchRejectsAProviderWithoutDiscovery(t *testing.T) {
-	cl, _ := newStubClient(http.StatusOK, openAIListing)
-
-	_, err := cl.Fetch(context.Background(), Request{
-		CatalogID:   "litellm_proxy",
-		UpstreamURL: "https://gateway.example.com",
-		APIKey:      "sk-test",
-	})
-	assert.ErrorIs(t, err, ErrNoDiscovery,
-		"a gateway with no listing endpoint must be distinguishable from a failure, so the caller can fall back")
-}
-
-func TestFetchRequiresACredential(t *testing.T) {
-	cl, _ := newStubClient(http.StatusOK, openAIListing)
-
-	_, err := cl.Fetch(context.Background(), Request{
-		CatalogID:   "openai_api",
-		UpstreamURL: "https://api.openai.com",
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "API key")
-}
-
-func TestDiscoveryURLNeedsARegionWhenTheHostTemplatesOne(t *testing.T) {
-	cl, _ := newStubClient(http.StatusOK, bedrockListing)
-
-	// An upstream that matches no catalog template — a proxy in front of
-	// Bedrock, say — leaves nothing to read the region from. Refusing beats
-	// guessing: an unsubstituted placeholder would dial a host that does not
-	// exist, and a guessed region would dial the wrong account's endpoint.
-	_, err := cl.Fetch(context.Background(), Request{
-		CatalogID:   "bedrock_api",
-		UpstreamURL: "https://bedrock.internal-proxy.example.com",
-		APIKey:      "aws-bearer",
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "region")
-}
-
-// TestHostGuardRejectsNonPublicAddresses is the SSRF guard. Management holds a
-// credential for every provider, so an upstream pointed at an internal address
-// would turn discovery into a way to probe — and hand a token to — the
-// management server's own network.
-func TestHostGuardRejectsNonPublicAddresses(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		addr string
-		want bool
-	}{
-		{"loopback v4", "127.0.0.1", false},
-		{"loopback v6", "::1", false},
-		{"private 10/8", "10.0.0.5", false},
-		{"private 172.16/12", "172.16.4.1", false},
-		{"private 192.168/16", "192.168.1.1", false},
-		{"link-local", "169.254.169.254", false}, // cloud metadata
-		{"unspecified", "0.0.0.0", false},
-		{"multicast", "224.0.0.1", false},
-		{"netbird overlay 100.64/10", "100.90.1.2", false},
-		{"v4-mapped loopback", "::ffff:127.0.0.1", false},
-		{"public v4", "1.1.1.1", true},
-		{"public v6", "2606:4700:4700::1111", true},
-		{"just outside CGNAT", "100.128.0.1", true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			addr, err := netip.ParseAddr(tc.addr)
-			require.NoError(t, err)
-			assert.Equal(t, tc.want, isPublic(addr))
-		})
-	}
-}
-
-func TestHostGuardResolvesAndRejectsLocalhost(t *testing.T) {
-	cl := &Client{}
-	err := cl.checkPublicHost("localhost")
-	require.Error(t, err, "a name resolving to loopback must be refused, not just a literal address")
-	assert.Contains(t, err.Error(), "non-public")
-}
-
-// TestEveryDiscoveryEntryHasAParser keeps the catalog and the parser table from
-// drifting: adding a Discovery block with a shape nothing parses would fail
-// only at runtime, in front of an operator.
-func TestEveryDiscoveryEntryHasAParser(t *testing.T) {
-	for _, entry := range catalog.All() {
-		if entry.Discovery == nil {
-			continue
-		}
-		t.Run(entry.ID, func(t *testing.T) {
-			assert.NotEmpty(t, entry.Discovery.Path, "a discovery entry needs a path")
-			_, err := parseListing(entry.Discovery.Shape, []byte(`{}`))
-			assert.NoError(t, err, "shape %q has no parser", entry.Discovery.Shape)
-		})
-	}
-}
-
-func ids(models []Model) []string {
-	out := make([]string, 0, len(models))
-	for _, m := range models {
-		out = append(out, m.ID)
-	}
-	return out
-}
-
-// TestRegionIsReadBackFromTheUpstream covers the reason the API takes no
-// region field: a provider record has none, and the operator already encoded
-// it in the upstream host when they configured inference.
-func TestRegionIsReadBackFromTheUpstream(t *testing.T) {
-	cl, tr := newStubClient(http.StatusOK, bedrockListing)
-
-	_, err := cl.Fetch(context.Background(), Request{
-		CatalogID:   "bedrock_api",
-		UpstreamURL: "https://bedrock-runtime.us-west-2.amazonaws.com",
-		APIKey:      "aws-bearer",
-	})
-	require.NoError(t, err)
-	assert.Equal(t, "bedrock.us-west-2.amazonaws.com", tr.got.URL.Host)
-}
-
-func TestRegionFromUpstream(t *testing.T) {
-	bedrock, ok := catalog.Lookup("bedrock_api")
-	require.True(t, ok)
-	vertex, ok := catalog.Lookup("vertex_ai_api")
-	require.True(t, ok)
-
-	for _, tc := range []struct {
-		name     string
-		entry    catalog.Provider
-		upstream string
-		want     string
-	}{
-		{"bedrock runtime host", bedrock, "https://bedrock-runtime.eu-central-1.amazonaws.com", "eu-central-1"},
-		{"bedrock without scheme", bedrock, "bedrock-runtime.ap-south-1.amazonaws.com", "ap-south-1"},
-		{"vertex regional host", vertex, "https://us-east5-aiplatform.googleapis.com", "us-east5"},
-		// A proxied or self-hosted upstream matches no template, and guessing
-		// a region from it would build a URL pointing somewhere arbitrary.
-		{"unrelated upstream", bedrock, "https://llm.internal.example.com", ""},
-		{"vertex global host has no region segment", vertex, "https://aiplatform.googleapis.com", ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, regionFromUpstream(tc.entry, tc.upstream))
-		})
-	}
-}

management/internals/modules/agentnetwork/modeldiscovery/parse.go

@@ -1,134 +0,0 @@
-package modeldiscovery
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
-)
-
-// listedModel is one entry lifted out of a vendor listing before the catalog
-// is consulted about it.
-type listedModel struct {
-	id    string
-	label string
-}
-
-// parseListing extracts model ids from a vendor listing. Each vendor invented
-// its own envelope, and the shape is declared by the catalog rather than
-// sniffed, so a vendor that changes shape fails loudly instead of silently
-// returning nothing.
-func parseListing(shape catalog.ListingShape, body []byte) ([]listedModel, error) {
-	switch shape {
-	case catalog.ShapeOpenAIData:
-		return parseOpenAIData(body)
-	case catalog.ShapeBedrockInferenceProfiles:
-		return parseBedrockInferenceProfiles(body)
-	case catalog.ShapeVertexPublisherModels:
-		return parseVertexPublisherModels(body)
-	default:
-		return nil, fmt.Errorf("no parser for listing shape %q", shape)
-	}
-}
-
-// parseOpenAIData reads {"data":[{"id":…}]}, which OpenAI defined and
-// Anthropic adopted. Anthropic additionally supplies display_name.
-func parseOpenAIData(body []byte) ([]listedModel, error) {
-	var doc struct {
-		Data []struct {
-			ID          string `json:"id"`
-			DisplayName string `json:"display_name"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(body, &doc); err != nil {
-		return nil, fmt.Errorf("decode model listing: %w", err)
-	}
-	out := make([]listedModel, 0, len(doc.Data))
-	for _, entry := range doc.Data {
-		out = append(out, listedModel{id: entry.ID, label: entry.DisplayName})
-	}
-	return out, nil
-}
-
-// parseBedrockInferenceProfiles reads
-// {"inferenceProfileSummaries":[{"inferenceProfileId":…}]}.
-//
-// The profile id is taken verbatim because its region prefix (eu., us.,
-// global.) is what makes it invocable, and it is not derivable from the
-// configured region — an account in one region legitimately holds global.*
-// profiles alongside its regional ones.
-//
-// Only ACTIVE profiles are offered: AWS reports others, and registering one
-// would produce a model that routes inside NetBird and fails at AWS.
-func parseBedrockInferenceProfiles(body []byte) ([]listedModel, error) {
-	var doc struct {
-		Summaries []struct {
-			ID     string `json:"inferenceProfileId"`
-			Name   string `json:"inferenceProfileName"`
-			Status string `json:"status"`
-		} `json:"inferenceProfileSummaries"`
-	}
-	if err := json.Unmarshal(body, &doc); err != nil {
-		return nil, fmt.Errorf("decode inference-profile listing: %w", err)
-	}
-	out := make([]listedModel, 0, len(doc.Summaries))
-	for _, entry := range doc.Summaries {
-		if entry.Status != "" && !strings.EqualFold(entry.Status, "ACTIVE") {
-			continue
-		}
-		out = append(out, listedModel{id: entry.ID, label: entry.Name})
-	}
-	return out, nil
-}
-
-// parseVertexPublisherModels reads {"publisherModels":[{"name":…}]}, where
-// name is a resource path ("publishers/anthropic/models/claude-3-opus") and
-// the version lives in a separate field.
-//
-// Vertex addresses a model as "<id>@<version>" on the rawPredict path, so the
-// two are joined here: reporting the bare name would hand the operator an id
-// that looks usable and is not.
-func parseVertexPublisherModels(body []byte) ([]listedModel, error) {
-	var doc struct {
-		Models []struct {
-			Name      string `json:"name"`
-			VersionID string `json:"versionId"`
-		} `json:"publisherModels"`
-	}
-	if err := json.Unmarshal(body, &doc); err != nil {
-		return nil, fmt.Errorf("decode publisher-model listing: %w", err)
-	}
-	out := make([]listedModel, 0, len(doc.Models))
-	for _, entry := range doc.Models {
-		id := entry.Name
-		if slash := strings.LastIndex(id, "/"); slash >= 0 {
-			id = id[slash+1:]
-		}
-		if id == "" {
-			continue
-		}
-		label := id
-		if entry.VersionID != "" {
-			id += "@" + entry.VersionID
-		}
-		out = append(out, listedModel{id: id, label: label})
-	}
-	return out, nil
-}
-
-// normalizeForPricing maps a vendor's wire id onto the key the catalog prices
-// it under. It mirrors the synthesiser's normalizePricingModelID: the two must
-// agree, or a model reported here as priced would meter at the default rate
-// instead of the operator's.
-func normalizeForPricing(catalogProviderID, modelID string) string {
-	switch {
-	case catalog.IsBedrockPathStyle(catalogProviderID):
-		return sharedllm.NormalizeBedrockModel(modelID)
-	case catalog.IsVertexPathStyle(catalogProviderID):
-		return sharedllm.NormalizeVertexModel(modelID)
-	default:
-		return modelID
-	}
-}

management/internals/modules/agentnetwork/pricing/defaults.go

@@ -47,11 +47,17 @@ var supplementalDefaults = map[string]map[string]Entry{
 		"gpt-5-nano": {InputPer1k: 0.00005, OutputPer1k: 0.0004, CachedInputPer1k: 0.000005},
 	},
 	"anthropic": {
+		// claude-opus-5 is not yet in the catalog lineup but gateway /
+		// grandfathered traffic uses it; priced so it isn't skipped.
+		"claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
 		// "kimi-k3[1m]" is the 1M-context alias some Claude Code guides
 		// configure against Moonshot's Anthropic-compatible endpoint;
 		// priced identically to kimi-k3 so those requests aren't skipped.
 		"kimi-k3[1m]": {InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003},
 	},
+	"bedrock": {
+		"anthropic.claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
+	},
 }
 
 var (

management/internals/modules/agentnetwork/pricing/defaults_llm_pricing.example.yaml

@@ -82,11 +82,6 @@ anthropic:
     output_per_1k: 0.015
     cache_read_per_1k: 0.0003
     cache_creation_per_1k: 0.00375
-  claude-sonnet-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
   kimi-k3:
     input_per_1k: 0.003
     output_per_1k: 0.015
@@ -150,11 +145,6 @@ bedrock:
     output_per_1k: 0.015
     cache_read_per_1k: 0.0003
     cache_creation_per_1k: 0.00375
-  anthropic.claude-sonnet-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
   meta.llama3-3-70b-instruct:
     input_per_1k: 0.00072
     output_per_1k: 0.00072

management/internals/modules/agentnetwork/pricing/defaults_test.go

@@ -116,13 +116,11 @@ func TestDefaultTable_PinnedRates(t *testing.T) {
 	assert.InDelta(t, 0.010, fable.InputPer1k, 1e-9, "claude-fable-5 input")
 	assert.InDelta(t, 0.0125, fable.CacheCreationPer1k, 1e-9, "claude-fable-5 cache creation")
 
-	// Every id below must stay priced whichever source provides it: the
-	// catalog lineup for the current Claude 5 family, supplementalDefaults
-	// for the ids the dashboard deliberately doesn't offer.
+	// Supplementals present on their surfaces.
 	for surface, ids := range map[string][]string{
 		"openai":    {"gpt-5", "gpt-5-mini", "gpt-5-nano"},
-		"anthropic": {"claude-opus-5", "claude-sonnet-5", "kimi-k3[1m]", "kimi-k3"},
-		"bedrock":   {"anthropic.claude-opus-5", "anthropic.claude-sonnet-5"},
+		"anthropic": {"claude-opus-5", "kimi-k3[1m]", "kimi-k3"},
+		"bedrock":   {"anthropic.claude-opus-5"},
 	} {
 		for _, id := range ids {
 			_, ok := table[surface][id]

management/internals/modules/agentnetwork/synthesizer.go

@@ -211,19 +211,7 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 
 	groupIndex := indexProviderGroups(enabledPolicies)
 
-	// The proxy guardrail is a per-provider fail-closed backstop; the
-	// authoritative per-policy/group decision is management's
-	// SelectPolicyForRequest. A provider lands in that map only when every
-	// authorising policy restricts models.
-	providerAllowlists := buildProviderAllowlists(enabledPolicies, guardrailsByID)
-
-	// Discovery gets the finer view: per policy rather than flattened per
-	// provider, so a listing can be bounded to what the calling groups may
-	// actually use instead of the union across everyone who reaches the
-	// provider.
-	modelPolicies := buildModelPolicies(enabledPolicies, guardrailsByID)
-
-	routerCfgJSON, err := buildRouterConfigJSON(enabledProviders, groupIndex, modelPolicies)
+	routerCfgJSON, err := buildRouterConfigJSON(enabledProviders, groupIndex)
 	if err != nil {
 		return nil, err
 	}
@@ -240,6 +228,11 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 
 	mergedGuardrails := mergeGuardrails(enabledPolicies, guardrailsByID)
 	applyAccountCollectionControls(&mergedGuardrails, settings)
+	// The proxy guardrail is a per-provider fail-closed backstop; the
+	// authoritative per-policy/group decision is management's
+	// SelectPolicyForRequest. A provider lands in this map only when every
+	// authorising policy restricts models.
+	providerAllowlists := buildProviderAllowlists(enabledPolicies, guardrailsByID)
 	guardrailJSON, err := marshalGuardrailConfig(providerAllowlists, mergedGuardrails.PromptCapture)
 	if err != nil {
 		return nil, err
@@ -358,11 +351,6 @@ type routerProviderRoute struct {
 	AuthHeaderName  string   `json:"auth_header_name"`
 	AuthHeaderValue string   `json:"auth_header_value"`
 	AllowedGroupIDs []string `json:"allowed_group_ids,omitempty"`
-	// ModelPolicies is one entry per enabled policy authorising this provider,
-	// carrying that policy's source groups and the models it permits. The
-	// router bounds a model listing with it, so a provider two groups reach
-	// under different allowlists offers each only its own.
-	ModelPolicies []routerModelPolicy `json:"model_policies,omitempty"`
 	// Vertex marks a Google Vertex AI provider, whose requests carry the
 	// model in the URL path. The router selects it by path, bypassing the
 	// model/vendor table.
@@ -434,7 +422,7 @@ func indexProviderGroups(policies []*types.Policy) map[string][]string {
 // path-prefix tiebreak. Providers no enabled policy authorises
 // (orphans) are intentionally OMITTED so the router never observes a
 // route with an empty ACL.
-func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]string, modelPolicies map[string][]routerModelPolicy) ([]byte, error) {
+func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]string) ([]byte, error) {
 	cfg := routerConfig{Providers: make([]routerProviderRoute, 0, len(providers))}
 	for _, p := range providers {
 		groups, hasPolicy := groupIndex[p.ID]
@@ -461,7 +449,6 @@ func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]
 			AuthHeaderName:          headerName,
 			AuthHeaderValue:         headerValue,
 			AllowedGroupIDs:         groups,
-			ModelPolicies:           modelPolicies[p.ID],
 			Vertex:                  catalog.IsVertexPathStyle(p.ProviderID),
 			Bedrock:                 catalog.IsBedrockPathStyle(p.ProviderID),
 			GCPServiceAccountKeyB64: gcpSAKeyB64,
@@ -1111,46 +1098,3 @@ func mergeGuardrail(g *types.Guardrail, merged *MergedGuardrails) {
 		}
 	}
 }
-
-// routerModelPolicy mirrors the router's ModelPolicyRule: one authorising
-// policy's source groups plus the models it permits. Models is nil for a
-// policy that sets no model allowlist, which lifts the restriction for the
-// groups it binds — so nil and empty must survive the round trip distinctly.
-type routerModelPolicy struct {
-	GroupIDs []string `json:"group_ids"`
-	Models   []string `json:"models"`
-}
-
-// buildModelPolicies indexes, per provider, one rule for each enabled policy
-// authorising it: the policy's source groups and the models its guardrail
-// permits.
-//
-// This is deliberately finer than buildProviderAllowlists, which flattens the
-// same inputs into one list per provider for the proxy's fail-closed guardrail.
-// A flattened list cannot answer "what may THIS caller see", so a provider two
-// teams reach under different allowlists would offer each team the other's
-// models — a picker full of entries the next request refuses. Keeping the
-// source groups alongside the models lets the router answer it at request time,
-// where it knows the caller's groups.
-func buildModelPolicies(policies []*types.Policy, byID map[string]*types.Guardrail) map[string][]routerModelPolicy {
-	out := make(map[string][]routerModelPolicy)
-	for _, p := range policies {
-		if p == nil || len(p.SourceGroups) == 0 {
-			continue
-		}
-		restricted, models := policyModelAllowlist(p, byID)
-		rule := routerModelPolicy{GroupIDs: append([]string(nil), p.SourceGroups...)}
-		if restricted {
-			// Never nil when restricted: an allowlist permitting nothing must
-			// stay distinguishable from no allowlist at all.
-			rule.Models = append([]string{}, models...)
-		}
-		for _, providerID := range p.DestinationProviderIDs {
-			if providerID == "" {
-				continue
-			}
-			out[providerID] = append(out[providerID], rule)
-		}
-	}
-	return out
-}

management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go

@@ -4,7 +4,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 )
@@ -94,75 +93,3 @@ func TestBuildProviderAllowlists(t *testing.T) {
 			"an enabled-but-empty allowlist is restricted with an empty set, not unrestricted")
 	})
 }
-
-// policyForGroups builds an enabled policy binding the given source groups to
-// the given providers under an optional guardrail.
-func policyForGroups(id string, groups []string, guardrailIDs []string, providerIDs ...string) *types.Policy {
-	return &types.Policy{
-		ID:                     id,
-		Enabled:                true,
-		SourceGroups:           groups,
-		DestinationProviderIDs: providerIDs,
-		GuardrailIDs:           guardrailIDs,
-	}
-}
-
-// TestBuildModelPolicies covers the finer index discovery needs. Where
-// buildProviderAllowlists flattens every authorising policy into one list per
-// provider — enough for a fail-closed backstop, but blind to who is asking —
-// this keeps each policy's source groups beside its models so the router can
-// bound a listing to the calling groups.
-func TestBuildModelPolicies(t *testing.T) {
-	byID := map[string]*types.Guardrail{
-		"g-4o":       allowlistGuardrail("g-4o", "acc-1", "gpt-4o"),
-		"g-opus":     allowlistGuardrail("g-opus", "acc-1", "claude-opus-4"),
-		"g-disabled": {ID: "g-disabled", Checks: types.GuardrailChecks{ModelAllowlist: types.GuardrailModelAllowlist{Enabled: false, Models: []string{"gpt-4o"}}}},
-	}
-
-	t.Run("each policy keeps its own groups and models", func(t *testing.T) {
-		policies := []*types.Policy{
-			policyForGroups("p1", []string{"grp-eng"}, []string{"g-4o"}, "prov-x"),
-			policyForGroups("p2", []string{"grp-sales"}, []string{"g-opus"}, "prov-x"),
-		}
-		got := buildModelPolicies(policies, byID)
-		assert.Equal(t, []routerModelPolicy{
-			{GroupIDs: []string{"grp-eng"}, Models: []string{"gpt-4o"}},
-			{GroupIDs: []string{"grp-sales"}, Models: []string{"claude-opus-4"}},
-		}, got["prov-x"],
-			"the two policies must stay separable so neither group is offered the other's models")
-	})
-
-	t.Run("an unrestricted policy carries nil models", func(t *testing.T) {
-		policies := []*types.Policy{
-			policyForGroups("p1", []string{"grp-eng"}, []string{"g-4o"}, "prov-x"),
-			policyForGroups("p2", []string{"grp-admin"}, nil, "prov-x"),
-		}
-		got := buildModelPolicies(policies, byID)
-		assert.Nil(t, got["prov-x"][1].Models,
-			"no allowlist must reach the router as nil, which lifts the restriction for its groups")
-	})
-
-	t.Run("a disabled allowlist is not a restriction", func(t *testing.T) {
-		policies := []*types.Policy{policyForGroups("p1", []string{"grp-eng"}, []string{"g-disabled"}, "prov-x")}
-		got := buildModelPolicies(policies, byID)
-		assert.Nil(t, got["prov-x"][0].Models,
-			"a guardrail with the allowlist check off restricts nothing")
-	})
-
-	t.Run("an enabled allowlist with no models permits nothing", func(t *testing.T) {
-		byIDEmpty := map[string]*types.Guardrail{
-			"g-empty": {ID: "g-empty", Checks: types.GuardrailChecks{ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true}}},
-		}
-		policies := []*types.Policy{policyForGroups("p1", []string{"grp-eng"}, []string{"g-empty"}, "prov-x")}
-		got := buildModelPolicies(policies, byIDEmpty)
-		require.NotNil(t, got["prov-x"][0].Models,
-			"an empty allowlist must not arrive as nil — that would read as unrestricted")
-		assert.Empty(t, got["prov-x"][0].Models)
-	})
-
-	t.Run("a policy binding no groups is skipped", func(t *testing.T) {
-		policies := []*types.Policy{policyForGroups("p1", nil, []string{"g-4o"}, "prov-x")}
-		assert.Empty(t, buildModelPolicies(policies, byID),
-			"a policy with no source groups authorises nobody, so it bounds nobody's listing")
-	})
-}

proxy/internal/llm/model.go

@@ -13,14 +13,6 @@ func NormalizeBedrockModel(modelID string) string {
 	return sharedllm.NormalizeBedrockModel(modelID)
 }
 
-// NormalizeAnthropicModel strips the trailing "-YYYYMMDD" release-date suffix
-// from an Anthropic model id so a dated id a client pins matches the undated
-// one the operator registered. Thin delegate to shared/llm for the same
-// contract reason as the two below.
-func NormalizeAnthropicModel(modelID string) string {
-	return sharedllm.NormalizeAnthropicModel(modelID)
-}
-
 // NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
 // so it matches the catalog/pricing key. Thin delegate to shared/llm, kept
 // beside NormalizeBedrockModel for the same contract reason.

proxy/internal/llm/pricing/pricing.go

@@ -10,8 +10,6 @@ package pricing
 import (
 	"fmt"
 	"math"
-
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
 )
 
 // Entry is a single model's input and output pricing, expressed in USD per
@@ -94,10 +92,7 @@ func NewTable(raw map[string]map[string]EntryJSON) (*Table, error) {
 	return &Table{entries: entries}, nil
 }
 
-// Lookup returns the entry for the given provider surface and model. A
-// dated Anthropic id falls back to its undated form, so a client pinning
-// "claude-sonnet-4-5-20250929" bills at the registered "claude-sonnet-4-5"
-// rate instead of recording no cost at all.
+// Lookup returns the entry for the given provider surface and model.
 func (t *Table) Lookup(provider, model string) (Entry, bool) {
 	if t == nil {
 		return Entry{}, false
@@ -106,14 +101,7 @@ func (t *Table) Lookup(provider, model string) (Entry, bool) {
 	if !ok {
 		return Entry{}, false
 	}
-	if e, found := byModel[model]; found {
-		return e, true
-	}
-	undated := sharedllm.NormalizeAnthropicModel(model)
-	if undated == model {
-		return Entry{}, false
-	}
-	e, ok := byModel[undated]
+	e, ok := byModel[model]
 	return e, ok
 }
 

proxy/internal/llm/pricing/pricing_test.go

@@ -175,22 +175,3 @@ func TestNewTable_NilAndEmpty(t *testing.T) {
 	require.NoError(t, err)
 	assert.Empty(t, entries, "nil in, empty (never-matching) map out for the per-record map")
 }
-
-// TestLookup_DatedAnthropicIDFallsBackToUndated covers a client pinning a
-// release date on a model priced under its undated id. Without the
-// fallback the request records no cost at all.
-func TestLookup_DatedAnthropicIDFallsBackToUndated(t *testing.T) {
-	table, err := NewTable(map[string]map[string]EntryJSON{
-		"anthropic": {
-			"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015},
-		},
-	})
-	require.NoError(t, err, "table must build from a valid defaults map")
-
-	entry, ok := table.Lookup("anthropic", "claude-sonnet-4-5-20250929")
-	require.True(t, ok, "a dated id must resolve to the undated entry")
-	assert.InDelta(t, 0.003, entry.InputPer1K, 1e-9, "dated id must bill at the registered rate")
-
-	_, ok = table.Lookup("anthropic", "claude-sonnet-9-9-20250929")
-	assert.False(t, ok, "an unknown family must stay unpriced")
-}

proxy/internal/middleware/builtin/cost_meter/middleware.go

@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/netbirdio/netbird/proxy/internal/llm"
 	"github.com/netbirdio/netbird/proxy/internal/llm/pricing"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
@@ -176,28 +175,13 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 // Anthropic route still bills its cache buckets additively.
 func (m *Middleware) lookupCosts(md []middleware.KV, surface, model string, inTokens, outTokens, cachedTokens, cacheCreationTokens int64) (pricing.Costs, bool) {
 	if recordID := lookupKV(md, middleware.KeyLLMResolvedProviderID); recordID != "" {
-		if entry, ok := perRecordEntry(m.perRecord[recordID], model); ok {
+		if entry, ok := m.perRecord[recordID][model]; ok {
 			return pricing.EntryCosts(entry, surface, inTokens, outTokens, cachedTokens, cacheCreationTokens), true
 		}
 	}
 	return m.defaults.Costs(surface, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
 }
 
-// perRecordEntry resolves the operator's stored price for a model on one
-// provider record, falling back to the undated form of a dated Anthropic id
-// so a client that pins a release date still bills at the registered rate.
-func perRecordEntry(byModel map[string]pricing.Entry, model string) (pricing.Entry, bool) {
-	if entry, ok := byModel[model]; ok {
-		return entry, true
-	}
-	undated := llm.NormalizeAnthropicModel(model)
-	if undated == model {
-		return pricing.Entry{}, false
-	}
-	entry, ok := byModel[undated]
-	return entry, ok
-}
-
 // usd renders a cost as the fixed-precision string every cost.usd_* key
 // carries, so the per-bucket values and the aggregates round identically.
 //

proxy/internal/middleware/builtin/llm_guardrail/middleware.go

@@ -84,10 +84,8 @@ func (m *Middleware) MutationsSupported() bool { return false }
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	model, modelPresent := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 	providerID, _ := lookupMetadata(in.Metadata, middleware.KeyLLMResolvedProviderID)
-	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
-	nonInference, _ := lookupMetadata(in.Metadata, middleware.KeyLLMNonInference)
 
-	if denial := m.evaluateAllowlist(providerID, surface, model, modelPresent, nonInference == "true"); denial != nil {
+	if denial := m.evaluateAllowlist(providerID, model, modelPresent); denial != nil {
 		return denial, nil
 	}
 
@@ -116,7 +114,7 @@ func (m *Middleware) Close() error { return nil }
 // evaluateAllowlist denies when the resolved provider's allowlist rejects the
 // model; nil means proceed. Scoped to the provider llm_router resolved, so an
 // unrestricted provider (absent from config) is never caught by another's list.
-func (m *Middleware) evaluateAllowlist(providerID, surface, model string, modelPresent, nonInference bool) *middleware.Output {
+func (m *Middleware) evaluateAllowlist(providerID, model string, modelPresent bool) *middleware.Output {
 	if len(m.cfg.ProviderAllowlists) == 0 {
 		return nil
 	}
@@ -124,7 +122,7 @@ func (m *Middleware) evaluateAllowlist(providerID, surface, model string, modelP
 	// if this request targets a restricted provider — fail closed. llm_router
 	// normally stamps the provider first, so this is a defensive guard.
 	if providerID == "" {
-		return denyModel(surface, "", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
 	allowlist, restricted := m.cfg.ProviderAllowlists[providerID]
 	if !restricted {
@@ -135,29 +133,18 @@ func (m *Middleware) evaluateAllowlist(providerID, surface, model string, modelP
 	// Fail closed: with an allowlist in effect for this provider, a request whose
 	// model the parser couldn't extract (absent/empty) is denied. This enforces
 	// the allowlist for path-routed providers (Bedrock, Vertex) with no body model.
-	//
-	// The exception is a non-inference endpoint the router already authorised.
-	// The model listing and the connection-warming probe name no model
-	// anywhere — not in a body, not in the path — so failing closed here
-	// rejected model discovery for exactly the accounts that configured an
-	// allowlist, which is the outage this endpoint is meant to avoid. The
-	// per-model lookup does name one (the router stamps it from the path), so
-	// it still falls through to the allowlist check below.
 	if !modelPresent || normaliseModel(model) == "" {
-		if nonInference {
-			return nil
-		}
-		return denyModel(surface, "", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
 	if modelInAllowlist(allowlist, model) {
 		return nil
 	}
-	return denyModel(surface, model, denyCodeModel, denyMessageModel, denyReasonModel)
+	return denyModel(model, denyCodeModel, denyMessageModel, denyReasonModel)
 }
 
 // denyModel builds a 403 deny Output for a model-allowlist rejection. model is
 // included in the details only when non-empty.
-func denyModel(surface, model, code, message, reason string) *middleware.Output {
+func denyModel(model, code, message, reason string) *middleware.Output {
 	details := map[string]string{}
 	if model != "" {
 		details["model"] = model
@@ -169,7 +156,6 @@ func denyModel(surface, model, code, message, reason string) *middleware.Output
 			Code:    code,
 			Message: message,
 			Details: details,
-			Surface: surface,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},

proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go

@@ -343,52 +343,3 @@ func TestFactoryNormalisesAllowlist(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out2.Decision, "trimmed entry must still match")
 }
-
-// TestAllowlistSkipsNonInferenceWithoutModel covers the reported regression:
-// GET /v1/models carries no model anywhere, so the fail-closed rule above
-// denied model discovery for exactly the accounts that configured a provider
-// allowlist — the clients that read a 403 here render an empty model picker.
-// The router authorises those endpoints by path before the guardrail sees
-// them, so an absent model there is expected rather than undeterminable.
-func TestAllowlistSkipsNonInferenceWithoutModel(t *testing.T) {
-	mw := New(providerCfg("gpt-4o"))
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-		middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
-	))
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision,
-		"model discovery must not be refused because it names no model")
-}
-
-// TestAllowlistStillAppliesToNonInferenceWithModel pins that the exemption is
-// scoped to requests that genuinely name nothing. The per-model lookup
-// (GET /v1/models/{id}) is non-inference too, but the router stamps the model
-// from its path, so the allowlist must still decide it — otherwise the
-// exemption becomes a way to confirm a model the policy blocks.
-func TestAllowlistStillAppliesToNonInferenceWithModel(t *testing.T) {
-	mw := New(providerCfg("gpt-4o"))
-
-	t.Run("model in the allowlist", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-			middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
-			middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-		))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision,
-			"an allowlisted model must stay reachable")
-	})
-
-	t.Run("model outside the allowlist", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-			middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
-			middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-5"},
-		))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionDeny, out.Decision,
-			"non-inference must not become a way past the allowlist")
-		require.NotNil(t, out.DenyReason)
-		assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code,
-			"a named but blocked model is blocked, not unknown")
-	})
-}

proxy/internal/middleware/builtin/llm_identity_inject/middleware.go

@@ -217,32 +217,6 @@ func applyHeaderPair(rule *HeaderPairRule, in *middleware.Input) *middleware.Mut
 	return mutations
 }
 
-// bodyInjectableSurfaces are the request-body dialects that accept the
-// OpenAI-standard identity fields this middleware writes. A surface
-// outside this set gets header-only stamping: "user" and "metadata.tags"
-// are not part of the Anthropic Messages schema, which rejects unknown
-// top-level fields and permits only "user_id" under metadata, so writing
-// them into an Anthropic-shaped body turns a working request into a 400.
-// Claude Code speaks that shape through gateway records pinned to the
-// OpenAI parser, so the check keys on the detected surface rather than
-// on the provider record.
-var bodyInjectableSurfaces = map[string]struct{}{
-	"openai": {},
-	// An empty surface means no parser claimed the path (a custom gateway
-	// base). Those upstreams are OpenAI-compatible by convention, so keep
-	// the long-standing behaviour rather than silently dropping identity.
-	"": {},
-}
-
-// bodyAcceptsOpenAIIdentity reports whether the request body may carry the
-// OpenAI-standard identity fields, read from the surface llm_request_parser
-// resolved from the request path.
-func bodyAcceptsOpenAIIdentity(in *middleware.Input) bool {
-	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
-	_, ok := bodyInjectableSurfaces[surface]
-	return ok
-}
-
 // injectIntoBody parses the request body and writes the supplied
 // identity dimensions into it. Tags land at metadata.tags (creating
 // the metadata object when absent); the user identity lands at the
@@ -251,8 +225,6 @@ func bodyAcceptsOpenAIIdentity(in *middleware.Input) bool {
 // was written. Returns ok=false (no mutation) when:
 //
 //   - both inputs are empty (nothing to write);
-//   - the body speaks a dialect without these fields (see
-//     bodyInjectableSurfaces);
 //   - the body is empty or truncated (we don't have the full document
 //     to safely round-trip);
 //   - the body isn't a JSON object (skip silently — this middleware
@@ -273,9 +245,6 @@ func injectIntoBody(in *middleware.Input, tags []string, userID string) ([]byte,
 	if in == nil || len(in.Body) == 0 || in.BodyTruncated {
 		return nil, false
 	}
-	if !bodyAcceptsOpenAIIdentity(in) {
-		return nil, false
-	}
 	var doc map[string]any
 	if err := json.Unmarshal(in.Body, &doc); err != nil {
 		return nil, false

proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go

@@ -704,57 +704,3 @@ func TestInject_ExtraHeaders_EmptyValueSkipped(t *testing.T) {
 			"empty extra value must not be stamped")
 	}
 }
-
-// TestInject_AnthropicBodyIsNotRewritten pins the shape gate. Claude Code
-// reaches a LiteLLM record on /v1/messages, where "user" is not a
-// permitted top-level field and metadata accepts only "user_id", so
-// writing the OpenAI-standard fields would turn a working request into a
-// 400 naming a field the client never sent. Header stamping still runs, so
-// spend tracking and per-end-user budgets keep working.
-func TestInject_AnthropicBodyIsNotRewritten(t *testing.T) {
-	rule := liteLLMRuleWithBody()
-	rule.HeaderPair.EndUserIDInBody = true
-	mw := New(Config{Providers: []ProviderInjection{rule}})
-
-	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
-	in.UserEmail = "alice@example.com"
-	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-	in.Body = []byte(`{"model":"claude-sonnet-5","messages":[]}`)
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out.Mutations)
-	assert.Empty(t, out.Mutations.BodyReplace,
-		"an Anthropic-shaped body must reach the upstream unmodified")
-
-	var endUser string
-	for _, kv := range out.Mutations.HeadersAdd {
-		if kv.Key == "x-litellm-end-user-id" {
-			endUser = kv.Value
-		}
-	}
-	assert.Equal(t, "alice@example.com", endUser,
-		"header stamping must still carry identity when body inject is skipped")
-}
-
-// TestInject_OpenAIBodyStillRewritten guards the gate against
-// over-reaching: the OpenAI surface must keep its body-level identity,
-// which is the only path LiteLLM's tag-budget check reads.
-func TestInject_OpenAIBodyStillRewritten(t *testing.T) {
-	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
-
-	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
-	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "openai"})
-	in.Body = []byte(`{"model":"gpt-4o-mini","messages":[]}`)
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out.Mutations)
-	require.NotEmpty(t, out.Mutations.BodyReplace, "the OpenAI surface still gets body tags")
-
-	var doc map[string]any
-	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
-	meta, ok := doc["metadata"].(map[string]any)
-	require.True(t, ok, "metadata must be an object")
-	assert.NotEmpty(t, meta["tags"], "metadata.tags must still be written")
-}

proxy/internal/middleware/builtin/llm_limit_check/middleware.go

@@ -84,15 +84,6 @@ func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middlew
 		return allowNoAttribution(), nil
 	}
 
-	// Model-listing and other non-inference endpoints carry no model, and
-	// management's per-model allowlist fails closed on an empty one. The
-	// router has already authorised the route against the caller's groups
-	// and the request consumes no tokens, so gating it on a model that
-	// cannot exist would only break gateway model discovery.
-	if lookupKV(in.Metadata, middleware.KeyLLMNonInference) == "true" {
-		return allowNoAttribution(), nil
-	}
-
 	providerID := lookupKV(in.Metadata, middleware.KeyLLMResolvedProviderID)
 	if providerID == "" {
 		// llm_router didn't emit a resolved provider id — usually
@@ -126,7 +117,7 @@ func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middlew
 	}
 
 	if resp.GetDecision() == "deny" {
-		return denyFromManagement(resp, lookupKV(in.Metadata, middleware.KeyLLMProvider)), nil
+		return denyFromManagement(resp), nil
 	}
 	return allowFromManagement(resp), nil
 }
@@ -170,7 +161,7 @@ func allowFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.O
 // envelope. The deny code surfaces verbatim through the framework's
 // fixed JSON template; arbitrary middleware bytes can't reach the
 // wire.
-func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse, surface string) *middleware.Output {
+func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Output {
 	code := resp.GetDenyCode()
 	if code == "" {
 		code = "llm_policy.cap_exceeded"
@@ -185,7 +176,6 @@ func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse, surface string
 		DenyReason: &middleware.DenyReason{
 			Code:    code,
 			Message: denyMessageForCode(code),
-			Surface: surface,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},

proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go

@@ -224,35 +224,3 @@ func TestMetadataKeys_Allowlist(t *testing.T) {
 	}
 	assert.ElementsMatch(t, want, keys)
 }
-
-// TestInvoke_NonInferenceSkipsPreflight covers gateway model discovery:
-// GET /v1/models carries no model, and management's per-model allowlist
-// fails closed on an empty one, so a pre-flight would deny discovery for
-// exactly the accounts that use the model allowlist. The router marks the
-// request non-inference after authorising the route, and the gate must
-// then allow without calling management at all.
-func TestInvoke_NonInferenceSkipsPreflight(t *testing.T) {
-	mgmt := &fakeMgmt{
-		checkResp: &proto.CheckLLMPolicyLimitsResponse{
-			Decision: "deny",
-			DenyCode: "llm_policy.model_blocked",
-		},
-	}
-	m := New(mgmt, nil)
-
-	out := runInvoke(t, m, &middleware.Input{
-		AccountID:  "acc-1",
-		UserID:     "user-bob",
-		UserGroups: []string{"grp-engineers"},
-		Metadata: []middleware.KV{
-			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"},
-			{Key: middleware.KeyLLMNonInference, Value: "true"},
-		},
-	})
-
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "model-less endpoints must not be gated on a model")
-	assert.Nil(t, mgmt.checkReq, "no pre-flight may be sent for a non-inference request")
-
-	assert.Empty(t, lookupKV(out.Metadata, middleware.KeyLLMSelectedPolicyID),
-		"no policy is attributed when nothing was metered")
-}

proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go

@@ -1,13 +1,9 @@
 package llm_request_parser
 
 import (
-	"context"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
 func TestParseBedrockPath(t *testing.T) {
@@ -40,25 +36,3 @@ func TestParseBedrockPath(t *testing.T) {
 		}
 	}
 }
-
-// TestInvoke_BedrockCountTokens covers the dedicated token-counting
-// endpoint. Denying it does not break the client, it just pushes context
-// counting back onto the inference endpoint, which is billable.
-func TestInvoke_BedrockCountTokens(t *testing.T) {
-	mw := newMiddleware(t)
-
-	out, err := mw.Invoke(context.Background(), &middleware.Input{
-		URL:  "/model/us.anthropic.claude-sonnet-4-5-20250929-v1:0/count-tokens",
-		Body: []byte(`{"input":{"converse":{"messages":[]}}}`),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision)
-
-	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
-	require.True(t, ok, "count-tokens carries a model in the path and must emit it")
-	assert.Equal(t, "anthropic.claude-sonnet-4-5", model, "model must be normalized like any other action")
-
-	stream, _ := metaValue(t, out.Metadata, middleware.KeyLLMStream)
-	assert.Equal(t, "false", stream, "count-tokens never streams")
-}

proxy/internal/middleware/builtin/llm_request_parser/middleware.go

@@ -61,8 +61,6 @@ func (middlewareImpl) MetadataKeys() []string {
 		middleware.KeyLLMRequestPromptRaw,
 		middleware.KeyLLMCaptureTruncated,
 		middleware.KeyLLMSessionID,
-		middleware.KeyLLMAgentID,
-		middleware.KeyLLMParentAgentID,
 	}
 }
 
@@ -74,9 +72,9 @@ func (middlewareImpl) Close() error { return nil }
 
 // Invoke detects the LLM provider, parses request facts, and emits
 // metadata. Always returns DecisionAllow; never errors. Provider
-// selection prefers the request path, falling back to the configured
-// providerID (synthesiser-stamped on agent-network targets) so requests
-// routed to a custom upstream URL still resolve.
+// selection prefers the configured providerID (synthesiser-stamped on
+// agent-network targets) so requests routed to a custom upstream URL
+// still resolve. Falls back to URL sniffing when no providerID is set.
 func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	out := &middleware.Output{Decision: middleware.DecisionAllow}
 	if in == nil {
@@ -94,14 +92,9 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 		return m.invokeBedrock(in, br), nil
 	}
 
-	// A path that names an API surface wins over the configured providerID:
-	// a gateway record pinned to "openai" still serves Claude Code on
-	// /v1/messages, and reading that body with the OpenAI parser loses the
-	// Anthropic usage block and prices the request on the wrong surface.
-	// providerID stays the fallback for upstreams whose path says nothing.
-	parser, ok := llm.DetectParser(extractPath(in.URL))
+	parser, ok := llm.ParserByName(m.providerID)
 	if !ok {
-		parser, ok = llm.ParserByName(m.providerID)
+		parser, ok = llm.DetectParser(extractPath(in.URL))
 	}
 	if !ok {
 		return out, nil
@@ -123,9 +116,9 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 	}
 	appendSessionID := func(md []middleware.KV) []middleware.KV {
 		if sessionID != "" {
-			md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
+			return append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 		}
-		return appendAgentIDs(md, in.Headers)
+		return md
 	}
 
 	facts, err := parser.ParseRequest(in.Body)
@@ -167,41 +160,6 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 	return out, nil
 }
 
-// agentIDHeader and parentAgentIDHeader carry sub-agent attribution: a
-// coding agent that spawns helpers stamps the spawned agent's id, plus the
-// spawning agent's when that helper is itself nested. Both are opaque
-// identifiers rather than content, so they're emitted regardless of the
-// prompt-collection toggle, the same way the session id is.
-const (
-	agentIDHeader       = "x-claude-code-agent-id"
-	parentAgentIDHeader = "x-claude-code-parent-agent-id"
-)
-
-// appendAgentIDs stamps the sub-agent attribution headers onto the metadata
-// bag, skipping either one the request doesn't carry.
-func appendAgentIDs(md []middleware.KV, headers []middleware.KV) []middleware.KV {
-	for _, pair := range []struct{ key, header string }{
-		{middleware.KeyLLMAgentID, agentIDHeader},
-		{middleware.KeyLLMParentAgentID, parentAgentIDHeader},
-	} {
-		if v := headerValue(headers, pair.header); v != "" {
-			md = append(md, middleware.KV{Key: pair.key, Value: v})
-		}
-	}
-	return md
-}
-
-// headerValue returns the first non-empty value for the named header.
-// Headers arrive in canonical form, so the match is case-insensitive.
-func headerValue(headers []middleware.KV, want string) string {
-	for _, kv := range headers {
-		if strings.EqualFold(kv.Key, want) && kv.Value != "" {
-			return kv.Value
-		}
-	}
-	return ""
-}
-
 // sessionIDHeaders are request header names that may carry a client
 // session identifier, checked in order, case-insensitively. Matching is
 // against Go's canonical header form, so use the hyphenated names the
@@ -215,8 +173,10 @@ var sessionIDHeaders = []string{"x-claude-code-session-id", "session-id", "x-ses
 // canonical form, so the match is case-insensitive.
 func sessionIDFromHeaders(headers []middleware.KV) string {
 	for _, want := range sessionIDHeaders {
-		if v := headerValue(headers, want); v != "" {
-			return v
+		for _, kv := range headers {
+			if strings.EqualFold(kv.Key, want) && kv.Value != "" {
+				return kv.Value
+			}
 		}
 	}
 	return ""
@@ -292,12 +252,6 @@ func parseVertexPath(reqPath string) (vertexRequest, bool) {
 	if c := strings.LastIndex(rest, ":"); c >= 0 {
 		model, action = rest[:c], rest[c+1:]
 	}
-	// Token counting hangs off the model as its own path segment
-	// (".../models/{model}/count-tokens:rawPredict"), so anything past the
-	// first "/" belongs to the method rather than the model id.
-	if slash := strings.Index(model, "/"); slash >= 0 {
-		model = model[:slash]
-	}
 	model = llm.NormalizeVertexModel(model)
 	if model == "" {
 		return vertexRequest{}, false
@@ -344,7 +298,6 @@ func (m middlewareImpl) invokeVertex(in *middleware.Input, vx vertexRequest) *mi
 	if sessionID != "" {
 		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 	}
-	md = appendAgentIDs(md, in.Headers)
 
 	promptTruncated := false
 	if parser != nil && m.capturePrompt {
@@ -392,9 +345,7 @@ func trimBedrockNamespace(reqPath string) string {
 //
 //	/model/{modelId}/{action}
 //
-// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream,
-// count-tokens}. Token counting carries a model and no usage, so it routes
-// like any other action and meters to zero.
+// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream}.
 // The modelId may be URL-encoded and may carry a cross-region inference-profile
 // prefix and a version suffix; normalizeBedrockModel strips both so the model
 // matches catalog pricing.
@@ -418,7 +369,7 @@ func parseBedrockPath(reqPath string) (bedrockRequest, bool) {
 		return bedrockRequest{}, false
 	}
 	switch action {
-	case "invoke", "converse", "count-tokens":
+	case "invoke", "converse":
 		return bedrockRequest{model: model}, true
 	case "invoke-with-response-stream", "converse-stream":
 		return bedrockRequest{model: model, stream: true}, true
@@ -446,7 +397,6 @@ func (m middlewareImpl) invokeBedrock(in *middleware.Input, br bedrockRequest) *
 	if sessionID != "" {
 		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 	}
-	md = appendAgentIDs(md, in.Headers)
 
 	promptTruncated := false
 	if parser != nil && m.capturePrompt {

proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go

@@ -45,8 +45,6 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 		middleware.KeyLLMRequestPromptRaw,
 		middleware.KeyLLMCaptureTruncated,
 		middleware.KeyLLMSessionID,
-		middleware.KeyLLMAgentID,
-		middleware.KeyLLMParentAgentID,
 	}
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }
@@ -232,31 +230,6 @@ func TestInvoke_ProviderIDConfigBypassesURLSniff(t *testing.T) {
 	assert.Equal(t, "gpt-4o-mini", model)
 }
 
-func TestInvoke_PathSurfaceBeatsProviderIDConfig(t *testing.T) {
-	// Gateway records (LiteLLM, Portkey, OpenRouter) pin provider_id
-	// "openai", but the same record serves Claude Code on /v1/messages.
-	// Parsing that body as OpenAI reads no usage off the Anthropic
-	// response and prices the request on a surface where no claude-*
-	// model exists, so the path has to win.
-	mw, err := Factory{}.New([]byte(`{"provider_id":"openai"}`))
-	require.NoError(t, err, "factory must accept provider_id config")
-
-	out, err := mw.Invoke(context.Background(), &middleware.Input{
-		URL:  "/v1/messages",
-		Body: []byte(`{"model":"claude-sonnet-5","stream":true,"messages":[{"role":"user","content":"Hi"}]}`),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, out)
-
-	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
-	require.True(t, ok, "provider must be emitted")
-	assert.Equal(t, "anthropic", provider, "the /v1/messages path selects the Anthropic surface")
-
-	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
-	require.True(t, ok, "model must be extracted")
-	assert.Equal(t, "claude-sonnet-5", model)
-}
-
 func TestInvoke_UnknownProviderIDFallsBackToURL(t *testing.T) {
 	mw, err := Factory{}.New([]byte(`{"provider_id":"not-a-real-parser"}`))
 	require.NoError(t, err, "factory must accept any provider_id string")
@@ -443,81 +416,3 @@ func TestInvoke_NilInputAllows(t *testing.T) {
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "nil input still allows")
 	assert.Empty(t, out.Metadata, "nil input emits no metadata")
 }
-
-// TestParseVertexPath_CountTokensKeepsModel covers Vertex token counting,
-// where the method hangs off the model as its own path segment. Splitting
-// only on the final colon swallowed "/count-tokens" into the model id, so
-// the router saw a model no route could claim.
-func TestParseVertexPath_CountTokensKeepsModel(t *testing.T) {
-	cases := map[string]struct {
-		model  string
-		stream bool
-	}{
-		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5:rawPredict":                       {model: "claude-sonnet-5"},
-		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5:streamRawPredict":                 {model: "claude-sonnet-5", stream: true},
-		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5/count-tokens:rawPredict":          {model: "claude-sonnet-5"},
-		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5@20250929/count-tokens:rawPredict": {model: "claude-sonnet-5"},
-	}
-	for path, want := range cases {
-		vx, ok := parseVertexPath(path)
-		require.True(t, ok, "must parse %q", path)
-		assert.Equal(t, want.model, vx.model, "model for %q", path)
-		assert.Equal(t, want.stream, vx.stream, "stream flag for %q", path)
-		assert.Equal(t, "anthropic", vx.publisher, "publisher for %q", path)
-	}
-}
-
-// TestInvoke_EmitsAgentIDs covers sub-agent attribution: several agents run
-// in parallel inside one session, and without their ids every request in
-// the session attributes to the session alone.
-func TestInvoke_EmitsAgentIDs(t *testing.T) {
-	mw := newMiddleware(t)
-
-	t.Run("spawned agent", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), &middleware.Input{
-			URL:  "/v1/messages",
-			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
-			Headers: []middleware.KV{
-				{Key: "X-Claude-Code-Session-Id", Value: "sess-1"},
-				{Key: "X-Claude-Code-Agent-Id", Value: "agent-7"},
-			},
-		})
-		require.NoError(t, err)
-
-		agent, ok := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
-		require.True(t, ok, "the spawned agent's id must be emitted")
-		assert.Equal(t, "agent-7", agent)
-
-		_, ok = metaValue(t, out.Metadata, middleware.KeyLLMParentAgentID)
-		assert.False(t, ok, "a top-level agent has no parent to emit")
-	})
-
-	t.Run("nested agent", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), &middleware.Input{
-			URL:  "/v1/messages",
-			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
-			Headers: []middleware.KV{
-				{Key: "X-Claude-Code-Agent-Id", Value: "agent-9"},
-				{Key: "X-Claude-Code-Parent-Agent-Id", Value: "agent-7"},
-			},
-		})
-		require.NoError(t, err)
-
-		agent, _ := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
-		assert.Equal(t, "agent-9", agent)
-		parent, ok := metaValue(t, out.Metadata, middleware.KeyLLMParentAgentID)
-		require.True(t, ok, "a nested agent must carry the spawning agent's id")
-		assert.Equal(t, "agent-7", parent)
-	})
-
-	t.Run("absent on a plain request", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), &middleware.Input{
-			URL:  "/v1/messages",
-			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
-		})
-		require.NoError(t, err)
-
-		_, ok := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
-		assert.False(t, ok, "no key is emitted when the client sends no agent id")
-	})
-}

proxy/internal/middleware/builtin/llm_router/bedrock_route_test.go

@@ -1,13 +1,9 @@
 package llm_router
 
 import (
-	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
 // TestRouteClaimsModel_BedrockNormalizesCandidate guards the fix for the native
@@ -32,86 +28,3 @@ func TestRouteClaimsModel_BedrockNormalizesCandidate(t *testing.T) {
 	assert.False(t, routeClaimsModel(openai, "us.gpt-4o"),
 		"non-Bedrock routes must not strip a us. prefix")
 }
-
-// TestRouter_BedrockCountTokensRoutes pins that the token-counting action
-// reaches the Bedrock route instead of denying as not-routable.
-func TestRouter_BedrockCountTokensRoutes(t *testing.T) {
-	mw := New(Config{Providers: []ProviderRoute{{
-		ID:              "bedrock-prod",
-		Bedrock:         true,
-		Models:          []string{"anthropic.claude-sonnet-4-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
-	}}})
-
-	in := newInputWithModelAndURL("anthropic.claude-sonnet-4-5",
-		"/model/anthropic.claude-sonnet-4-5-20250929-v1:0/count-tokens")
-	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "bedrock"})
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "count-tokens must route, not deny")
-	require.NotNil(t, out.Mutations)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host)
-}
-
-// TestRouter_BedrockInferenceProfilesRoutes covers the startup lookups a
-// client makes to resolve a configured inference profile. They carry no
-// model, so before they were recognised they denied and wrote a policy
-// rejection into the access log on every session start.
-func TestRouter_BedrockInferenceProfilesRoutes(t *testing.T) {
-	bedrock := ProviderRoute{
-		ID:              "bedrock-prod",
-		Bedrock:         true,
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
-	}
-	openai := ProviderRoute{
-		ID:              "openai-prod",
-		Models:          []string{"gpt-4o"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.openai.com",
-	}
-	mw := New(Config{Providers: []ProviderRoute{openai, bedrock}})
-
-	for _, path := range []string{
-		"/inference-profiles?type=SYSTEM_DEFINED",
-		"/inference-profiles/us.anthropic.claude-sonnet-5",
-	} {
-		out, err := mw.Invoke(context.Background(), newModellessInput(path))
-		require.NoError(t, err)
-		require.NotNil(t, out)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision, "%s must route", path)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host,
-			"%s must reach the Bedrock provider, not the first authorised one", path)
-
-		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-		assert.Equal(t, "true", nonInference, "%s carries no model to gate on", path)
-	}
-}
-
-// TestRouter_BedrockNamespacedInferenceProfilesStripsPrefix pins that the
-// optional gateway namespace is removed before the request goes upstream.
-func TestRouter_BedrockNamespacedInferenceProfilesStripsPrefix(t *testing.T) {
-	mw := New(Config{Providers: []ProviderRoute{{
-		ID:              "bedrock-prod",
-		Bedrock:         true,
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
-	}}})
-
-	out, err := mw.Invoke(context.Background(), newModellessInput("/bedrock/inference-profiles"))
-	require.NoError(t, err)
-	require.NotNil(t, out.Mutations)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.Equal(t, "/bedrock", out.Mutations.RewriteUpstream.StripPathPrefix,
-		"the namespace prefix must not reach the real Bedrock endpoint")
-}

proxy/internal/middleware/builtin/llm_router/factory.go

@@ -44,12 +44,6 @@ type ProviderRoute struct {
 	AuthHeaderName  string   `json:"auth_header_name"`
 	AuthHeaderValue string   `json:"auth_header_value"`
 	AllowedGroupIDs []string `json:"allowed_group_ids"`
-	// ModelPolicies carries, per authorising policy, the source groups it
-	// binds and the models it permits. The router uses it to bound a model
-	// listing to what THIS caller may use: a provider reachable by two groups
-	// under different allowlists must not offer either group the other's
-	// models. Empty means no policy restricts models on this route.
-	ModelPolicies []ModelPolicyRule `json:"model_policies,omitempty"`
 	// Vertex marks a Google Vertex AI provider. Vertex requests carry the
 	// model in the URL path, so the router selects this route by path
 	// (isVertexPath) and bypasses the model/vendor table entirely.
@@ -71,18 +65,6 @@ type ProviderRoute struct {
 	SkipTLSVerify bool `json:"skip_tls_verify,omitempty"`
 }
 
-// ModelPolicyRule is one authorising policy's contribution to what a caller
-// may use on a route: the source groups it binds, and the models it permits.
-//
-// Models is nil when the policy sets no model allowlist — an unrestricted
-// policy, which lifts the restriction for the groups it binds. That is why
-// nil and empty must stay distinct: an empty list is a guardrail that permits
-// nothing, and collapsing the two would let a listing fail open.
-type ModelPolicyRule struct {
-	GroupIDs []string `json:"group_ids"`
-	Models   []string `json:"models"`
-}
-
 // Config is the on-wire configuration accepted by the factory. An
 // empty Providers slice yields a router that denies every request as
 // not-routable; the synthesiser is responsible for stamping the

proxy/internal/middleware/builtin/llm_router/middleware.go

@@ -109,10 +109,6 @@ func (m *Middleware) MetadataKeys() []string {
 		middleware.KeyLLMAuthorisingGroups,
 		middleware.KeyLLMPolicyDecision,
 		middleware.KeyLLMPolicyReason,
-		middleware.KeyLLMNonInference,
-		// Emitted only for the per-model lookup, whose model lives in the path
-		// rather than a body the parser could read.
-		middleware.KeyLLMModel,
 	}
 }
 
@@ -141,26 +137,29 @@ const (
 // known to a provider that no policy authorises for the caller deny
 // with no_authorised_provider.
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
-	reqPath := requestPath(in.URL)
-	// The caller's API dialect, used to mirror a denial in the vendor's own
-	// error shape so the client can explain it to the user.
-	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
-	model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
-
 	// Vertex AI carries the model in the URL path, not the body, and is
 	// selected by path rather than by the model/vendor table. Route it before
 	// the model lookup so a model the parser extracted from the path can't be
 	// claimed by a same-vendor direct provider (e.g. claude-* on api.anthropic.com).
+	reqPath := requestPath(in.URL)
 	if isVertexPath(reqPath) {
+		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 		// The request parser emits no llm.provider for a Vertex publisher it
 		// can't parse (e.g. google/gemini). Forwarding such a request would
 		// bypass token/budget metering, so deny it rather than serve it
 		// unmetered.
-		if surface == "" {
-			return denyUnmeterable(surface), nil
+		if vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider); vendor == "" {
+			return denyUnmeterable(), nil
 		}
 		route, outcome := m.matchVertex(reqPath, model, in.UserGroups)
-		return m.decide(route, outcome, surface, model, in.UserGroups, nil), nil
+		switch outcome {
+		case matchOutcomeFound:
+			return m.allowWithRoute(route, in.UserGroups), nil
+		case matchOutcomeUnauthorised:
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyUnknownModel(model), nil
+		}
 	}
 
 	// Bedrock likewise carries the model in the URL path (/model/{id}/{action}),
@@ -168,211 +167,52 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 	// before the model lookup; when the prefix is present, strip it from the
 	// forwarded path so the real Bedrock endpoint receives its native path.
 	if isBedrockPath(reqPath) {
+		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 		native, hadPrefix := splitBedrockNamespace(reqPath)
 		route, outcome := m.matchBedrock(native, model, in.UserGroups)
-		return m.decide(route, outcome, surface, model, in.UserGroups, func(out *middleware.Output) {
-			if hadPrefix {
-				stripBedrockNamespace(out)
+		switch outcome {
+		case matchOutcomeFound:
+			out := m.allowWithRoute(route, in.UserGroups)
+			if hadPrefix && out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
+				out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
 			}
-		}), nil
+			return out, nil
+		case matchOutcomeUnauthorised:
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyUnknownModel(model), nil
+		}
 	}
 
-	// GET /v1/models/{id} carries no body, so no model reaches the router in
-	// metadata — but the path names one, and answering it confirms a model
-	// exists and is reachable. Authorise it against the model table like any
-	// other per-model request, then mark it non-inference so it still skips
-	// the token pre-flight it would otherwise charge nothing against.
-	if detail, isDetail := modelDetailID(reqPath); isDetail && isNonInferenceMethod(in.Method) {
-		route, outcome := m.matchRoute(detail, surface, reqPath, in.UserGroups)
-		return m.decide(route, outcome, surface, detail, in.UserGroups, func(out *middleware.Output) {
-			markNonInference(out)
-			// The parser reads models from JSON bodies only, and this request
-			// has none, so stamp the one the path names. Without it the
-			// guardrail's own allowlist — a separate, possibly narrower list
-			// than the route's — never sees a model to check.
-			out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMModel, Value: detail})
-		}), nil
+	model, ok := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+	if !ok || model == "" {
+		// Non-inference endpoints (model listing) carry no model but still
+		// need rewriting from the synth placeholder to a real upstream;
+		// clients such as Codex call GET /v1/models at startup to enumerate
+		// availability and read a 403 as "model unavailable".
+		route, outcome := m.matchModelless(requestPath(in.URL), in.UserGroups)
+		switch outcome {
+		case matchOutcomeFound:
+			return m.allowWithRoute(route, in.UserGroups), nil
+		case matchOutcomeUnauthorised:
+			// A recognised model-less endpoint exists but no provider
+			// authorises the caller — deny as an authorisation failure
+			// rather than masking it as a missing model.
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyMissingModel(), nil
+		}
 	}
 
-	if model == "" {
-		return m.routeModelless(reqPath, surface, in.Method, in.UserGroups), nil
-	}
-
-	route, outcome := m.matchRoute(model, surface, reqPath, in.UserGroups)
-	return m.decide(route, outcome, surface, model, in.UserGroups, nil), nil
-}
-
-// decide turns a per-model match result into the middleware's decision. Every
-// surface that routes by model shares the same two denial arms — a model no
-// route claims is not routable, one that some route claims but none authorises
-// for this caller is an authorisation failure — so they live here once.
-// decorate, when non-nil, adjusts the allow with whatever that surface needs.
-func (m *Middleware) decide(
-	route ProviderRoute,
-	outcome matchOutcome,
-	surface, model string,
-	userGroups []string,
-	decorate func(*middleware.Output),
-) *middleware.Output {
+	vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	route, outcome := m.matchRoute(model, vendor, requestPath(in.URL), in.UserGroups)
 	switch outcome {
 	case matchOutcomeFound:
-		out := m.allowWithRoute(route, surface, userGroups)
-		if decorate != nil {
-			decorate(out)
-		}
-		return out
+		return m.allowWithRoute(route, in.UserGroups), nil
 	case matchOutcomeUnauthorised:
-		return denyNoAuthorisedRoute(surface, model)
+		return denyNoAuthorisedRoute(model), nil
 	default:
-		return denyUnknownModel(surface, model)
-	}
-}
-
-// routeModelless serves the endpoints that name no model at all: the model
-// listing, the connection-warming probe, and the Bedrock inference-profile
-// lookup. They still need rewriting from the synth placeholder to a real
-// upstream — clients such as Codex call GET /v1/models at startup to enumerate
-// availability and read a 403 as "model unavailable".
-func (m *Middleware) routeModelless(reqPath, surface, method string, userGroups []string) *middleware.Output {
-	route, outcome := m.matchModelless(reqPath, method, userGroups)
-	switch outcome {
-	case matchOutcomeFound:
-		out := m.allowWithRoute(route, surface, userGroups)
-		markNonInference(out)
-		if _, hadPrefix := splitBedrockNamespace(reqPath); hadPrefix {
-			stripBedrockNamespace(out)
-		}
-		// What the caller may actually use bounds what the picker may offer:
-		// every entry outside it is a request the chain will deny a moment
-		// later.
-		if reqPath == modelListingPath && out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
-			if models, bounded := discoverableModels(route, userGroups); bounded {
-				out.Mutations.RewriteUpstream.DiscoveryModels = models
-			}
-		}
-		return out
-	case matchOutcomeUnauthorised:
-		// A recognised model-less endpoint exists but no provider authorises
-		// the caller — deny as an authorisation failure rather than masking it
-		// as a missing model.
-		return denyNoAuthorisedRoute(surface, "")
-	default:
-		return denyMissingModel(surface)
-	}
-}
-
-// isNonInferenceMethod reports whether a request method is one the
-// non-inference endpoints actually use: the listing and the per-model lookup
-// are GET, the connection-warming probe is HEAD or GET. The method is the only
-// thing separating "GET /v1/models/{id}" from a POST to the same path carrying
-// an inference body, and the non-inference mark exempts a request from the
-// token pre-flight — so anything else falls through to normal per-model
-// routing, which denies when the request names no model.
-func isNonInferenceMethod(method string) bool {
-	return method == http.MethodGet || method == http.MethodHead
-}
-
-// discoverableModels returns the model ids a caller in userGroups may actually
-// use on this route, and whether the listing should be bounded to them at all.
-//
-// Two things narrow a listing, and both must apply or the picker offers models
-// the very next request refuses:
-//
-//   - the provider's own enumerated models, when it lists any (a gateway record
-//     enumerates nothing and claims everything);
-//   - the model allowlists of the policies that authorise THIS caller. A
-//     provider reachable by two groups under different allowlists must not
-//     offer either group the other's models, which is why the rules carry their
-//     source groups rather than arriving pre-flattened.
-//
-// A policy that sets no allowlist lifts the restriction for the groups it
-// binds, so a caller holding one unrestricted policy sees the provider's full
-// list. bounded is false when nothing narrows the listing — an unrestricted
-// caller on a route that enumerates nothing — in which case the upstream's own
-// answer passes through untouched.
-func discoverableModels(route ProviderRoute, userGroups []string) ([]string, bool) {
-	permitted, restricted := policyPermittedModels(route, userGroups)
-
-	switch {
-	case !restricted && len(route.Models) == 0:
-		return nil, false
-	case !restricted:
-		return append([]string(nil), route.Models...), true
-	case len(route.Models) == 0:
-		// A gateway record enumerates nothing, so the allowlist is the whole
-		// bound — previously such a record offered the upstream's entire
-		// catalogue however narrow the policy was.
-		return sortedModels(permitted), true
-	}
-
-	// Both bound: only what the provider serves and the policy permits.
-	intersection := make(map[string]struct{}, len(route.Models))
-	for _, m := range route.Models {
-		if _, ok := permitted[m]; ok {
-			intersection[m] = struct{}{}
-		}
-	}
-	return sortedModels(intersection), true
-}
-
-// policyPermittedModels folds the rules whose groups intersect the caller's
-// into the set of models they permit. restricted is false when the caller
-// holds at least one authorising policy that sets no allowlist, or when no
-// rule binds them at all.
-func policyPermittedModels(route ProviderRoute, userGroups []string) (map[string]struct{}, bool) {
-	permitted := make(map[string]struct{})
-	restricted := false
-	for _, rule := range route.ModelPolicies {
-		if !groupsIntersect(rule.GroupIDs, userGroups) {
-			continue
-		}
-		if rule.Models == nil {
-			// An unrestricted policy the caller holds lifts the restriction
-			// entirely, whatever the others say.
-			return nil, false
-		}
-		restricted = true
-		for _, m := range rule.Models {
-			permitted[m] = struct{}{}
-		}
-	}
-	return permitted, restricted
-}
-
-// groupsIntersect reports whether the two group-id sets share a member.
-func groupsIntersect(a, b []string) bool {
-	for _, x := range a {
-		for _, y := range b {
-			if x == y {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// sortedModels flattens a model set into a stable slice so the bound the proxy
-// applies — and any test asserting on it — does not depend on map order.
-func sortedModels(set map[string]struct{}) []string {
-	out := make([]string, 0, len(set))
-	for m := range set {
-		out = append(out, m)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// markNonInference tags an allow as a request that spends no tokens, so the
-// limit check skips the management pre-flight it would charge nothing against.
-func markNonInference(out *middleware.Output) {
-	out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"})
-}
-
-// stripBedrockNamespace tells the rewrite to drop the optional "/bedrock"
-// gateway namespace so the upstream receives its native Bedrock path.
-func stripBedrockNamespace(out *middleware.Output) {
-	if out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
-		out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
+		return denyUnknownModel(model), nil
 	}
 }
 
@@ -460,60 +300,12 @@ func (m *Middleware) matchRoute(model, vendor, reqPath string, userGroups []stri
 	return best, matchOutcomeFound
 }
 
-// connectionWarmPath is the probe Anthropic clients send before their first
-// inference request to open the upstream connection early. Forwarding it
-// warms the connection the request will actually use; denying it only fills
-// the access log with rejections at every session start.
-const connectionWarmPath = "/api/hello"
-
-// modelListingPath is the endpoint clients read at startup to populate
-// their model picker. Its response is a list the proxy can bound; the
-// per-model "/v1/models/{id}" lookup returns a single object and is left
-// alone.
-const modelListingPath = "/v1/models"
-
-// isModelLessPath reports whether reqPath is a known non-inference endpoint
-// that legitimately carries no model at all: the model listing and the
-// connection-warming probe. These must route to an upstream rather than
-// deny, so model enumeration works end to end. The per-model
-// "/v1/models/{id}" lookup is deliberately excluded — it names a model, so
-// it is authorised against the model table instead (see modelDetailID).
+// isModelLessPath reports whether reqPath is a known OpenAI-shaped
+// non-inference endpoint that legitimately carries no model in its
+// request (the model-listing endpoints). These must route to an upstream
+// rather than deny, so model enumeration works end to end.
 func isModelLessPath(reqPath string) bool {
-	return reqPath == modelListingPath || reqPath == connectionWarmPath
-}
-
-// modelDetailID returns the model id named by a "/v1/models/{id}" lookup.
-// reqPath comes from url.URL.Path, which is already percent-decoded, so an
-// id carrying a "/" (a self-hosted "Qwen/Qwen2.5-0.5B-Instruct" sent as
-// "Qwen%2FQwen2.5-...") arrives whole and everything after the prefix is the
-// id, separators included.
-func modelDetailID(reqPath string) (string, bool) {
-	if !strings.HasPrefix(reqPath, modelListingPath+"/") {
-		return "", false
-	}
-	id := strings.TrimPrefix(reqPath, modelListingPath+"/")
-	if id == "" {
-		return "", false
-	}
-	return id, true
-}
-
-// isBedrockModelLessPath reports whether reqPath is a Bedrock
-// inference-profile lookup, optionally behind the "/bedrock" gateway
-// namespace. Clients read these at startup to resolve a configured profile
-// to its underlying model. They carry no model of their own, so they route
-// by path to a Bedrock provider rather than through the model table.
-//
-// On native AWS these live on the control plane ("bedrock.<region>") while a
-// provider's upstream is normally the runtime host ("bedrock-runtime.<region>"),
-// so forwarding yields a 404 there. That is deliberate: a client has one base
-// URL, so pointing it straight at the runtime host 404s identically, and
-// forwarding keeps the proxy transparent instead of inventing a policy denial
-// the client would never otherwise see. Operators whose Bedrock upstream is a
-// gateway that does serve the lookup get a working answer.
-func isBedrockModelLessPath(reqPath string) bool {
-	native, _ := splitBedrockNamespace(reqPath)
-	return native == "/inference-profiles" || strings.HasPrefix(native, "/inference-profiles/")
+	return reqPath == "/v1/models" || strings.HasPrefix(reqPath, "/v1/models/")
 }
 
 // isVertexPath reports whether reqPath is a Google Vertex AI publisher
@@ -540,33 +332,20 @@ func splitBedrockNamespace(reqPath string) (string, bool) {
 	return reqPath, false
 }
 
-// bedrockActions are the runtime actions that follow the model id in a
-// Bedrock path. count-tokens is here so a client can price its context
-// against the dedicated endpoint; denying it pushes that work back onto
-// the inference endpoint, which bills for it.
-var bedrockActions = []string{
-	"/invoke",
-	"/invoke-with-response-stream",
-	"/converse",
-	"/converse-stream",
-	"/count-tokens",
-}
-
 // isBedrockPath reports whether reqPath is an AWS Bedrock runtime model
-// endpoint: /model/{modelId}/{action} — optionally behind a "/bedrock"
-// gateway-namespace prefix. The model lives in the path, so these requests
-// are routed by path to the Bedrock provider.
+// endpoint: /model/{modelId}/{action} where action is invoke,
+// invoke-with-response-stream, converse, or converse-stream — optionally behind
+// a "/bedrock" gateway-namespace prefix. The model lives in the path, so these
+// requests are routed by path to the Bedrock provider.
 func isBedrockPath(reqPath string) bool {
 	native, _ := splitBedrockNamespace(reqPath)
 	if !strings.HasPrefix(native, "/model/") {
 		return false
 	}
-	for _, action := range bedrockActions {
-		if strings.HasSuffix(native, action) {
-			return true
-		}
-	}
-	return false
+	return strings.HasSuffix(native, "/invoke") ||
+		strings.HasSuffix(native, "/invoke-with-response-stream") ||
+		strings.HasSuffix(native, "/converse") ||
+		strings.HasSuffix(native, "/converse-stream")
 }
 
 // matchVertex selects the Vertex provider authorised for the caller's groups
@@ -646,26 +425,19 @@ func (m *Middleware) matchPathRoute(reqPath, model string, userGroups []string,
 // declaration order), matchOutcomeUnauthorised when no provider authorises
 // the caller, or matchOutcomeUnknownModel when the path isn't a recognised
 // model-less endpoint.
-func (m *Middleware) matchModelless(reqPath, method string, userGroups []string) (ProviderRoute, matchOutcome) {
-	if !isNonInferenceMethod(method) {
+func (m *Middleware) matchModelless(reqPath string, userGroups []string) (ProviderRoute, matchOutcome) {
+	if !isModelLessPath(reqPath) {
 		return ProviderRoute{}, matchOutcomeUnknownModel
 	}
-	var eligible func(ProviderRoute) bool
-	switch {
-	case isBedrockModelLessPath(reqPath):
-		eligible = func(r ProviderRoute) bool { return r.Bedrock }
-	case isModelLessPath(reqPath):
+	var candidates []ProviderRoute
+	for _, route := range m.cfg.Providers {
 		// Vertex/Bedrock are path-routed and don't serve OpenAI-style
 		// model-listing endpoints; including them here could rewrite a
 		// GET /v1/models to an upstream that 404s it.
-		eligible = func(r ProviderRoute) bool { return !r.Vertex && !r.Bedrock }
-	default:
-		return ProviderRoute{}, matchOutcomeUnknownModel
-	}
-
-	var candidates []ProviderRoute
-	for _, route := range m.cfg.Providers {
-		if eligible(route) && routeAuthorisesGroups(route, userGroups) {
+		if route.Vertex || route.Bedrock {
+			continue
+		}
+		if routeAuthorisesGroups(route, userGroups) {
 			candidates = append(candidates, route)
 		}
 	}
@@ -792,16 +564,6 @@ func routeClaimsModel(route ProviderRoute, model string) bool {
 		if route.Bedrock && llm.NormalizeBedrockModel(candidate) == model {
 			return true
 		}
-		// A client may pin a dated Anthropic id ("claude-sonnet-4-5-20250929")
-		// where the operator registered the undated one. Only an undated
-		// registration absorbs a dated request: normalising both sides would
-		// let a route pinned to one dated release claim a different one, so an
-		// operator who deliberately pinned a build would silently serve
-		// another — and with several such routes, ordering would decide which.
-		if candidate == llm.NormalizeAnthropicModel(candidate) &&
-			candidate == llm.NormalizeAnthropicModel(model) {
-			return true
-		}
 	}
 	return false
 }
@@ -850,7 +612,7 @@ func requestPath(raw string) string {
 // provider id so identity-stamping middlewares (llm_identity_inject)
 // tag the request with ONLY the groups that authorised this specific
 // route — not every group the peer happens to be in.
-func (m *Middleware) allowWithRoute(route ProviderRoute, surface string, userGroups []string) *middleware.Output {
+func (m *Middleware) allowWithRoute(route ProviderRoute, userGroups []string) *middleware.Output {
 	rewrite := &middleware.UpstreamRewrite{
 		Scheme: route.UpstreamScheme,
 		Host:   route.UpstreamHost,
@@ -872,7 +634,7 @@ func (m *Middleware) allowWithRoute(route ProviderRoute, surface string, userGro
 		// request time (cached + auto-refreshed) instead of a static value.
 		bearer, err := m.gcpBearer(route.GCPServiceAccountKeyB64)
 		if err != nil {
-			return denyUpstreamAuth(surface)
+			return denyUpstreamAuth()
 		}
 		authValue = bearer
 	}
@@ -942,12 +704,11 @@ func (m *Middleware) gcpTokenSource(saKeyB64 string) (oauth2.TokenSource, error)
 // denyUpstreamAuth is returned when the router cannot obtain the upstream
 // credential (e.g. a malformed service-account key or an unreachable token
 // endpoint). It surfaces as a 502 — an upstream problem, not a policy denial.
-func denyUpstreamAuth(surface string) *middleware.Output {
+func denyUpstreamAuth() *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 502,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeUpstreamAuth,
 			Message: "could not obtain upstream credential",
 		},
@@ -961,12 +722,11 @@ func denyUpstreamAuth(surface string) *middleware.Output {
 // denyUnmeterable returns the deny envelope for a path-routed request whose
 // publisher has no parser surface, so its usage can't be metered. Serving it
 // would bypass token/budget caps, so it is rejected with a 403.
-func denyUnmeterable(surface string) *middleware.Output {
+func denyUnmeterable() *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeUnmeterable,
 			Message: "request publisher is not supported for metering",
 		},
@@ -979,12 +739,11 @@ func denyUnmeterable(surface string) *middleware.Output {
 
 // denyMissingModel returns the deny envelope for a request whose
 // envelope has no llm.model metadata.
-func denyMissingModel(surface string) *middleware.Output {
+func denyMissingModel() *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeNotRoutable,
 			Message: "missing llm.model on request envelope",
 		},
@@ -997,12 +756,11 @@ func denyMissingModel(surface string) *middleware.Output {
 
 // denyUnknownModel returns the deny envelope for a model that no
 // configured provider claims.
-func denyUnknownModel(surface, model string) *middleware.Output {
+func denyUnknownModel(model string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeNotRoutable,
 			Message: fmt.Sprintf("no provider configured for model %s", model),
 			Details: map[string]string{"model": model},
@@ -1017,12 +775,11 @@ func denyUnknownModel(surface, model string) *middleware.Output {
 // denyNoAuthorisedRoute returns the deny envelope for a model that one
 // or more providers claim, but where no policy authorises the caller's
 // groups for any of those providers.
-func denyNoAuthorisedRoute(surface, model string) *middleware.Output {
+func denyNoAuthorisedRoute(model string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeNoAuthorisedRoute,
 			Message: fmt.Sprintf("no policy authorises model %s for the caller's groups", model),
 			Details: map[string]string{"model": model},

proxy/internal/middleware/builtin/llm_router/middleware_test.go

@@ -2,7 +2,6 @@ package llm_router
 
 import (
 	"context"
-	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -61,8 +60,6 @@ func TestMiddlewareIdentity(t *testing.T) {
 		[]string{
 			middleware.KeyLLMResolvedProviderID,
 			middleware.KeyLLMAuthorisingGroups,
-			middleware.KeyLLMNonInference,
-			middleware.KeyLLMModel,
 			middleware.KeyLLMPolicyDecision,
 			middleware.KeyLLMPolicyReason,
 		},
@@ -174,12 +171,8 @@ func TestRouter_MissingModel(t *testing.T) {
 // from which a model could be parsed). UserGroups matches defaultTestGroup.
 func newModellessInput(reqURL string) *middleware.Input {
 	return &middleware.Input{
-		Slot: middleware.SlotOnRequest,
-		URL:  reqURL,
-		// The non-inference endpoints are read requests; the method is what
-		// separates them from an inference body posted to the same path, so
-		// state it rather than leaning on the zero value.
-		Method:     http.MethodGet,
+		Slot:       middleware.SlotOnRequest,
+		URL:        reqURL,
 		UserGroups: []string{defaultTestGroup},
 	}
 }
@@ -204,12 +197,6 @@ func TestRouter_ModelLessPath_RoutesToAuthorisedProvider(t *testing.T) {
 
 	provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
 	assert.Equal(t, "openai-prod", provider, "resolved provider must be the authorised route")
-
-	// The limits gate reads this to tell "no model applies here" from
-	// "the model could not be determined", which fails closed.
-	nonInference, ok := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-	require.True(t, ok, "model-less allow must mark the request non-inference")
-	assert.Equal(t, "true", nonInference)
 }
 
 func TestRouter_ModelLessPath_MultiProviderDeclarationOrder(t *testing.T) {
@@ -886,403 +873,3 @@ func TestRouter_EmptyModelsClaimsAnyModel(t *testing.T) {
 	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
 	assert.Equal(t, "litellm", resolved)
 }
-
-// TestRouter_DatedAnthropicModelRoutes covers a client pinning a release
-// date on a model the operator registered undated. Exact matches still win,
-// so an operator who registers both dated releases keeps them distinct.
-func TestRouter_DatedAnthropicModelRoutes(t *testing.T) {
-	mw := New(Config{Providers: []ProviderRoute{{
-		ID:              "anthropic-prod",
-		Vendor:          "anthropic",
-		Models:          []string{"claude-sonnet-4-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.anthropic.com",
-	}}})
-
-	in := newInputWithModelAndURL("claude-sonnet-4-5-20250929", "/v1/messages")
-	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "a dated id must route to the undated registration")
-	require.NotNil(t, out.Mutations)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
-}
-
-// TestRouter_ConnectionWarmProbeRoutes covers the HEAD /api/hello probe an
-// Anthropic client sends before its first request. Forwarding it warms the
-// connection that request will use; denying it only wrote a rejection into
-// the access log at every session start.
-func TestRouter_ConnectionWarmProbeRoutes(t *testing.T) {
-	mw := New(Config{Providers: []ProviderRoute{{
-		ID:              "anthropic-prod",
-		Vendor:          "anthropic",
-		Models:          []string{"claude-sonnet-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.anthropic.com",
-	}}})
-
-	in := newModellessInput("/api/hello")
-	in.Method = http.MethodHead
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "the warm-up probe must reach the upstream")
-	require.NotNil(t, out.Mutations)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
-
-	nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-	assert.Equal(t, "true", nonInference, "the probe carries no model to gate on")
-}
-
-// TestRouter_ModelListingCarriesAuthorisedModels pins the list the proxy
-// bounds the discovery response with. A catch-all route enumerates nothing,
-// so it must not bound the upstream's list at all.
-func TestRouter_ModelListingCarriesAuthorisedModels(t *testing.T) {
-	enumerated := ProviderRoute{
-		ID:              "anthropic-prod",
-		Models:          []string{"claude-sonnet-5", "claude-haiku-4-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.anthropic.com",
-	}
-
-	t.Run("enumerated route bounds the listing", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
-		require.NoError(t, err)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Equal(t, []string{"claude-sonnet-5", "claude-haiku-4-5"},
-			out.Mutations.RewriteUpstream.DiscoveryModels,
-			"the picker must be bounded by what the route authorises")
-	})
-
-	t.Run("catch-all route leaves the listing alone", func(t *testing.T) {
-		catchAll := enumerated
-		catchAll.Models = nil
-		mw := New(Config{Providers: []ProviderRoute{catchAll}})
-
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
-		require.NoError(t, err)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
-			"a route that claims every model cannot bound the upstream's list")
-	})
-
-	t.Run("per-model lookup is not a listing", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5"))
-		require.NoError(t, err)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
-			"the single-object lookup has no data array to filter")
-	})
-}
-
-// TestRouter_ModelDetailHonoursAllowlist pins that GET /v1/models/{id} is
-// authorised against the model table. It carries no body model, so treating
-// it as a model-less endpoint would let a caller confirm a model the route
-// does not list — the listing itself is bounded to the allowlist, so the
-// detail lookup must be too.
-func TestRouter_ModelDetailHonoursAllowlist(t *testing.T) {
-	enumerated := ProviderRoute{
-		ID:              "anthropic-prod",
-		Models:          []string{"claude-sonnet-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.anthropic.com",
-	}
-
-	t.Run("allowlisted model routes and skips metering", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5"))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
-
-		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-		assert.Equal(t, "true", nonInference, "a detail lookup spends no tokens")
-	})
-
-	t.Run("model outside the allowlist denies", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-opus-5"))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionDeny, out.Decision,
-			"a model no route lists must not be confirmed by the detail lookup")
-	})
-
-	t.Run("dated id matches its undated registration", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5-20250929"))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision,
-			"a pinned release of an allowlisted family stays reachable")
-	})
-
-	t.Run("catch-all route still answers every lookup", func(t *testing.T) {
-		catchAll := enumerated
-		catchAll.Models = nil
-		mw := New(Config{Providers: []ProviderRoute{catchAll}})
-
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/anything-at-all"))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision,
-			"a gateway that enumerates nothing cannot refuse a lookup")
-	})
-}
-
-// TestRouter_NonInferenceRequiresReadMethod pins that the non-inference mark —
-// which exempts a request from the token pre-flight — is reachable only by the
-// read methods these endpoints actually use. A POST to the same path could
-// carry an inference body, so it must not buy the exemption; it falls through
-// to normal per-model routing instead, which denies when no model is named.
-func TestRouter_NonInferenceRequiresReadMethod(t *testing.T) {
-	route := ProviderRoute{
-		ID:              "gateway",
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "gateway.example.com",
-	}
-
-	for _, path := range []string{"/v1/models", "/v1/models/claude-sonnet-5", "/api/hello"} {
-		t.Run("POST "+path, func(t *testing.T) {
-			mw := New(Config{Providers: []ProviderRoute{route}})
-
-			in := newModellessInput(path)
-			in.Method = http.MethodPost
-
-			out, err := mw.Invoke(context.Background(), in)
-			require.NoError(t, err)
-			assert.Equal(t, middleware.DecisionDeny, out.Decision,
-				"a write to a non-inference path must not route unmetered")
-
-			nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-			assert.NotEqual(t, "true", nonInference,
-				"only a read method may skip the token pre-flight")
-		})
-	}
-
-	t.Run("HEAD keeps the warm probe working", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{route}})
-
-		in := newModellessInput(connectionWarmPath)
-		in.Method = http.MethodHead
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision,
-			"the HEAD warm probe must still reach the upstream")
-
-		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-		assert.Equal(t, "true", nonInference,
-			"the HEAD warm probe carries no model to meter")
-	})
-}
-
-// TestRouter_PinnedDatedModelStaysDistinct pins that a route registered
-// against one dated Anthropic release does not claim another. Normalising
-// both sides of the comparison made every dated build of a family
-// interchangeable, so an operator who deliberately pinned a build would have
-// served a different one — and with several such routes, declaration or path
-// order would have decided which.
-func TestRouter_PinnedDatedModelStaysDistinct(t *testing.T) {
-	pinned := ProviderRoute{
-		ID:              "anthropic-pinned",
-		Vendor:          "anthropic",
-		Models:          []string{"claude-sonnet-4-5-20250101"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "pinned.example.com",
-	}
-
-	t.Run("a different dated release is not claimed", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{pinned}})
-		in := newInputWithModelAndURL("claude-sonnet-4-5-20250202", "/v1/messages")
-		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionDeny, out.Decision,
-			"a route pinned to one dated build must not serve another")
-	})
-
-	t.Run("its own dated release still routes", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{pinned}})
-		in := newInputWithModelAndURL("claude-sonnet-4-5-20250101", "/v1/messages")
-		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision, "the exact match must still route")
-	})
-
-	t.Run("two pinned builds each route to their own provider", func(t *testing.T) {
-		other := pinned
-		other.ID = "anthropic-pinned-newer"
-		other.Models = []string{"claude-sonnet-4-5-20250202"}
-		other.UpstreamHost = "newer.example.com"
-		mw := New(Config{Providers: []ProviderRoute{pinned, other}})
-
-		in := newInputWithModelAndURL("claude-sonnet-4-5-20250202", "/v1/messages")
-		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		require.Equal(t, middleware.DecisionAllow, out.Decision)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Equal(t, "newer.example.com", out.Mutations.RewriteUpstream.Host,
-			"declaration order must not decide between two deliberately pinned builds")
-	})
-}
-
-// TestRouter_DiscoveryBoundToCallersPolicies pins that a model listing is
-// bounded by the policies that authorise the caller, not by the union across
-// everyone who can reach the provider. Two teams sharing one provider record
-// under different allowlists is the case that makes the difference visible: a
-// flattened per-provider list would offer each team the other's models, and
-// every one of those entries is a request the guardrail then refuses.
-func TestRouter_DiscoveryBoundToCallersPolicies(t *testing.T) {
-	const (
-		eng   = "grp-eng"
-		sales = "grp-sales"
-	)
-	route := ProviderRoute{
-		ID:              "shared-gateway",
-		Models:          []string{"claude-sonnet-5", "claude-haiku-4-5", "gpt-4o"},
-		AllowedGroupIDs: []string{eng, sales},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "gateway.example.com",
-		ModelPolicies: []ModelPolicyRule{
-			{GroupIDs: []string{eng}, Models: []string{"claude-sonnet-5"}},
-			{GroupIDs: []string{sales}, Models: []string{"gpt-4o"}},
-		},
-	}
-
-	listingFor := func(t *testing.T, group string) []string {
-		t.Helper()
-		mw := New(Config{Providers: []ProviderRoute{route}})
-		in := newModellessInput(modelListingPath)
-		in.UserGroups = []string{group}
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		require.Equal(t, middleware.DecisionAllow, out.Decision)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		return out.Mutations.RewriteUpstream.DiscoveryModels
-	}
-
-	t.Run("each group sees only its own policy's models", func(t *testing.T) {
-		assert.Equal(t, []string{"claude-sonnet-5"}, listingFor(t, eng),
-			"engineering must not be offered the model only sales may use")
-		assert.Equal(t, []string{"gpt-4o"}, listingFor(t, sales),
-			"sales must not be offered the model only engineering may use")
-	})
-
-	t.Run("a model no policy allows is offered to nobody", func(t *testing.T) {
-		for _, group := range []string{eng, sales} {
-			assert.NotContains(t, listingFor(t, group), "claude-haiku-4-5",
-				"the provider serves it, but no policy permits it")
-		}
-	})
-}
-
-// TestRouter_DiscoveryUnrestrictedPolicy covers the lifting rule: a caller
-// holding one policy without a model allowlist sees everything the provider
-// enumerates, whatever the other policies say.
-func TestRouter_DiscoveryUnrestrictedPolicy(t *testing.T) {
-	const (
-		eng   = "grp-eng"
-		admin = "grp-admin"
-	)
-	route := ProviderRoute{
-		ID:              "shared-gateway",
-		Models:          []string{"claude-sonnet-5", "gpt-4o"},
-		AllowedGroupIDs: []string{eng, admin},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "gateway.example.com",
-		ModelPolicies: []ModelPolicyRule{
-			{GroupIDs: []string{eng}, Models: []string{"claude-sonnet-5"}},
-			// nil Models: a policy that sets no allowlist at all.
-			{GroupIDs: []string{admin}},
-		},
-	}
-	mw := New(Config{Providers: []ProviderRoute{route}})
-
-	in := newModellessInput(modelListingPath)
-	in.UserGroups = []string{eng, admin}
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.ElementsMatch(t, []string{"claude-sonnet-5", "gpt-4o"},
-		out.Mutations.RewriteUpstream.DiscoveryModels,
-		"an unrestricted policy the caller holds lifts the restriction")
-}
-
-// TestRouter_DiscoveryOnGatewayRecord covers a record that enumerates no
-// models. It previously offered the upstream's whole catalogue however narrow
-// the policy was, because there was nothing to intersect against; the policy
-// allowlist is now the bound on its own.
-func TestRouter_DiscoveryOnGatewayRecord(t *testing.T) {
-	const eng = "grp-eng"
-	base := ProviderRoute{
-		ID:              "litellm",
-		AllowedGroupIDs: []string{eng},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "litellm.internal",
-	}
-
-	t.Run("a policy allowlist bounds it", func(t *testing.T) {
-		route := base
-		route.ModelPolicies = []ModelPolicyRule{{GroupIDs: []string{eng}, Models: []string{"gpt-4o"}}}
-		mw := New(Config{Providers: []ProviderRoute{route}})
-
-		in := newModellessInput(modelListingPath)
-		in.UserGroups = []string{eng}
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		assert.Equal(t, []string{"gpt-4o"}, out.Mutations.RewriteUpstream.DiscoveryModels,
-			"a catch-all record must still be bounded by what policy permits")
-	})
-
-	t.Run("an allowlist permitting nothing offers nothing", func(t *testing.T) {
-		route := base
-		route.ModelPolicies = []ModelPolicyRule{{GroupIDs: []string{eng}, Models: []string{}}}
-		mw := New(Config{Providers: []ProviderRoute{route}})
-
-		in := newModellessInput(modelListingPath)
-		in.UserGroups = []string{eng}
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
-			"an empty allowlist permits nothing, and must not be read as unrestricted")
-	})
-
-	t.Run("no policy restriction leaves the listing alone", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{base}})
-
-		in := newModellessInput(modelListingPath)
-		in.UserGroups = []string{eng}
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Nil(t, out.Mutations.RewriteUpstream.DiscoveryModels,
-			"nothing narrows the listing, so the upstream's own answer passes through")
-	})
-}

proxy/internal/middleware/decision.go

@@ -11,78 +11,11 @@ var codeRegex = regexp.MustCompile(`^[a-z][a-z0-9._-]{0,63}$`)
 // denyResponse is the on-wire shape rendered by RenderDenyResponse.
 // Keeping this as a typed struct ensures we never leak
 // middleware-supplied bytes outside known fields.
-//
-// Type and Error mirror the denial in the vendor's own error shape when
-// the request reached a known LLM surface. LLM clients only parse their
-// provider's envelope, so without the mirror a budget stop reaches the
-// user as an unexplained API error. The NetBird fields stay where they
-// were, so the body is a superset and existing consumers are unaffected.
 type denyResponse struct {
 	Code       string            `json:"code"`
 	Message    string            `json:"message,omitempty"`
 	Details    map[string]string `json:"details,omitempty"`
 	Middleware string            `json:"middleware,omitempty"`
-	Type       string            `json:"type,omitempty"`
-	Error      *providerError    `json:"error,omitempty"`
-}
-
-// providerError is the nested error object both vendor envelopes carry.
-type providerError struct {
-	Type    string `json:"type"`
-	Message string `json:"message,omitempty"`
-	Code    string `json:"code,omitempty"`
-}
-
-// Vendor error types keyed by HTTP status, per each provider's published
-// error reference.
-const (
-	anthropicErrInvalidRequest = "invalid_request_error"
-	anthropicErrPermission     = "permission_error"
-	anthropicErrRateLimit      = "rate_limit_error"
-	anthropicErrAPI            = "api_error"
-	openAIErrInvalidRequest    = "invalid_request_error"
-	openAIErrRateLimit         = "rate_limit_error"
-)
-
-// providerEnvelope returns the vendor-shaped mirror for a denial on the
-// given surface, or nil when the surface has no envelope we can speak.
-// message is the already-redacted public message.
-func providerEnvelope(surface, code, message string, status int) (string, *providerError) {
-	switch surface {
-	case "anthropic":
-		return "error", &providerError{
-			Type:    anthropicErrorType(status),
-			Message: message,
-		}
-	case "openai":
-		return "", &providerError{
-			Type:    openAIErrorType(status),
-			Message: message,
-			Code:    code,
-		}
-	default:
-		return "", nil
-	}
-}
-
-func anthropicErrorType(status int) string {
-	switch status {
-	case http.StatusForbidden:
-		return anthropicErrPermission
-	case http.StatusTooManyRequests:
-		return anthropicErrRateLimit
-	case http.StatusBadRequest:
-		return anthropicErrInvalidRequest
-	default:
-		return anthropicErrAPI
-	}
-}
-
-func openAIErrorType(status int) string {
-	if status == http.StatusTooManyRequests {
-		return openAIErrRateLimit
-	}
-	return openAIErrInvalidRequest
 }
 
 // RenderDenyResponse writes a structured JSON deny body. Status is
@@ -103,7 +36,6 @@ func RenderDenyResponse(w http.ResponseWriter, middlewareID string, reason *Deny
 		Message:    truncate(Scan(reason.Message), 256),
 		Middleware: truncate(Scan(middlewareID), 64),
 	}
-	resp.Type, resp.Error = providerEnvelope(reason.Surface, resp.Code, resp.Message, status)
 	if n := len(reason.Details); n > 0 {
 		resp.Details = make(map[string]string, min(n, 8))
 		for k, v := range reason.Details {

proxy/internal/middleware/decision_test.go

@@ -1,92 +0,0 @@
-package middleware
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// decodeDeny renders a denial and returns the parsed body plus the status.
-func decodeDeny(t *testing.T, reason *DenyReason, status int) (map[string]any, int) {
-	t.Helper()
-	rec := httptest.NewRecorder()
-	RenderDenyResponse(rec, "llm_limit_check", reason, status)
-
-	var body map[string]any
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body), "deny body must be valid JSON")
-	return body, rec.Code
-}
-
-// TestRenderDeny_AnthropicSurfaceMirrorsVendorShape covers a budget stop
-// reaching Claude Code. The client only parses the Anthropic envelope, so
-// without the mirror the user sees an unexplained API error instead of the
-// reason their request was refused.
-func TestRenderDeny_AnthropicSurfaceMirrorsVendorShape(t *testing.T) {
-	body, status := decodeDeny(t, &DenyReason{
-		Code:    "llm_policy.budget_cap_exceeded",
-		Message: "LLM policy limit exceeded",
-		Surface: "anthropic",
-	}, http.StatusForbidden)
-
-	assert.Equal(t, http.StatusForbidden, status)
-	assert.Equal(t, "error", body["type"], "Anthropic errors carry type=error at the top level")
-
-	errObj, ok := body["error"].(map[string]any)
-	require.True(t, ok, "error must be an object")
-	assert.Equal(t, "permission_error", errObj["type"], "403 maps to permission_error")
-	assert.Equal(t, "LLM policy limit exceeded", errObj["message"])
-
-	// The NetBird fields stay put so existing consumers keep working.
-	assert.Equal(t, "llm_policy.budget_cap_exceeded", body["code"])
-	assert.Equal(t, "LLM policy limit exceeded", body["message"])
-	assert.Equal(t, "llm_limit_check", body["middleware"])
-}
-
-// TestRenderDeny_OpenAISurfaceMirrorsVendorShape pins the OpenAI envelope,
-// which nests the code and carries no top-level type.
-func TestRenderDeny_OpenAISurfaceMirrorsVendorShape(t *testing.T) {
-	body, _ := decodeDeny(t, &DenyReason{
-		Code:    "llm_policy.model_blocked",
-		Message: "model is not in the policy allowlist",
-		Surface: "openai",
-	}, http.StatusForbidden)
-
-	assert.NotContains(t, body, "type", "OpenAI errors have no top-level type")
-
-	errObj, ok := body["error"].(map[string]any)
-	require.True(t, ok, "error must be an object")
-	assert.Equal(t, "invalid_request_error", errObj["type"])
-	assert.Equal(t, "llm_policy.model_blocked", errObj["code"], "the NetBird code rides in the vendor code field")
-	assert.Equal(t, "model is not in the policy allowlist", errObj["message"])
-}
-
-// TestRenderDeny_RateLimitStatusMapsToVendorRateLimit pins the mapping a
-// client's backoff keys on.
-func TestRenderDeny_RateLimitStatusMapsToVendorRateLimit(t *testing.T) {
-	body, status := decodeDeny(t, &DenyReason{
-		Code:    "llm_policy.token_cap_exceeded",
-		Message: "LLM policy limit exceeded",
-		Surface: "anthropic",
-	}, http.StatusTooManyRequests)
-
-	assert.Equal(t, http.StatusTooManyRequests, status, "429 must survive the status clamp")
-	errObj := body["error"].(map[string]any)
-	assert.Equal(t, "rate_limit_error", errObj["type"])
-}
-
-// TestRenderDeny_NoSurfaceKeepsLegacyShape guards non-LLM middlewares and
-// denials raised before a surface is known.
-func TestRenderDeny_NoSurfaceKeepsLegacyShape(t *testing.T) {
-	body, _ := decodeDeny(t, &DenyReason{
-		Code:    "llm_policy.model_not_routable",
-		Message: "no provider configured for model x",
-	}, http.StatusForbidden)
-
-	assert.NotContains(t, body, "type", "no surface means no vendor mirror")
-	assert.NotContains(t, body, "error", "no surface means no vendor mirror")
-	assert.Equal(t, "llm_policy.model_not_routable", body["code"])
-}

proxy/internal/middleware/keys.go

@@ -22,15 +22,6 @@ const (
 	// body. Empty for clients that don't send one.
 	KeyLLMSessionID = "llm.session_id"
 
-	// Sub-agent attribution (emitted by llm_request_parser from the
-	// client's request headers). A coding agent that spawns helpers
-	// stamps the spawned agent's id, and the spawning agent's id when
-	// the helper is itself nested, so cost within one session can be
-	// split across the agents that ran in parallel. These identify an
-	// agent, not a person or a device: never treat them as a user id.
-	KeyLLMAgentID       = "llm.agent_id"
-	KeyLLMParentAgentID = "llm.parent_agent_id"
-
 	// LLM response-side metadata (emitted by llm_response_parser).
 	//nolint:gosec // metadata key name, not a credential
 	KeyLLMInputTokens = "llm.input_tokens"
@@ -75,14 +66,6 @@ const (
 	// downstream gateways' spend logs.
 	KeyLLMAuthorisingGroups = "llm.authorising_groups"
 
-	// LLM non-inference marker (emitted by llm_router on the allow path
-	// for endpoints that legitimately carry no model, such as model
-	// listing). The router still authorises these against the caller's
-	// groups; the marker only tells the limits gate that a per-model
-	// allowlist has nothing to evaluate, so an empty model must not be
-	// read as an undetermined one. Never derived from client input.
-	KeyLLMNonInference = "llm.non_inference"
-
 	// LLM policy attribution (emitted by llm_limit_check on the allow
 	// path). Names the policy that paid for this request and the
 	// dimension counters the post-flight llm_limit_record middleware

proxy/internal/middleware/types.go

@@ -179,12 +179,6 @@ type DenyReason struct {
 	Code    string
 	Message string
 	Details map[string]string
-	// Surface names the LLM API dialect the caller speaks (the
-	// llm.provider value), so the rendered body can mirror the denial in
-	// that vendor's error shape alongside the NetBird fields. Empty for
-	// non-LLM middlewares and for denials raised before a surface was
-	// resolved; the body then carries the NetBird fields alone.
-	Surface string
 }
 
 // Output is the value each middleware returns to the dispatcher. The
@@ -253,12 +247,6 @@ type UpstreamRewrite struct {
 	// without verifying its TLS certificate. Set by llm_router from the
 	// provider's skip_tls_verification for self-hosted / internal gateways.
 	SkipTLSVerify bool
-	// DiscoveryModels, when non-empty, is the set of model ids the resolved
-	// route authorises, and the proxy drops everything else from the
-	// model-listing response. Empty leaves the upstream's list untouched,
-	// which is what a route that claims every model wants. Set by
-	// llm_router on a model-listing request only.
-	DiscoveryModels []string
 }
 
 // AuthHeader is a single name/value pair the proxy injects on the

proxy/internal/proxy/discovery_filter.go

@@ -1,191 +0,0 @@
-package proxy
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
-)
-
-// maxDiscoveryBodyBytes bounds the model-listing response the filter will
-// buffer. A listing is a few kilobytes of ids; anything larger is not a
-// listing we recognise, and buffering it to rewrite would cost more than
-// the filtering is worth.
-const maxDiscoveryBodyBytes = 1 << 20
-
-// modelDiscoveryFilter returns a ModifyResponse hook that drops models the
-// caller's policy does not authorise from a model-listing response, then
-// delegates to next (which may be nil).
-//
-// Clients populate their model picker from this endpoint, so an unfiltered
-// list offers models the very next request denies. The filter is
-// best-effort: a response it cannot safely rewrite passes through
-// untouched rather than reaching the client corrupted.
-func modelDiscoveryFilter(allowed []string, next func(*http.Response) error) func(*http.Response) error {
-	permitted := make(map[string]struct{}, len(allowed)*2)
-	for _, id := range allowed {
-		permitted[id] = struct{}{}
-		permitted[sharedllm.NormalizeAnthropicModel(id)] = struct{}{}
-	}
-
-	return func(resp *http.Response) error {
-		if err := filterModelListing(resp, permitted); err != nil {
-			return err
-		}
-		if next == nil {
-			return nil
-		}
-		return next(resp)
-	}
-}
-
-// filterModelListing rewrites the response body in place, keeping only the
-// entries whose id the policy authorises. Responses that are not a plain
-// JSON listing are left alone.
-func filterModelListing(resp *http.Response, permitted map[string]struct{}) error {
-	if !isPlainJSONListing(resp) {
-		return nil
-	}
-
-	// One byte past the cap, so an oversized body is detectable without
-	// buffering all of it.
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxDiscoveryBodyBytes+1))
-	if err != nil {
-		_ = resp.Body.Close()
-		return err
-	}
-	if len(body) > maxDiscoveryBodyBytes {
-		// Too large to filter. Put the bytes already read back in front of the
-		// unread remainder and forward the response exactly as the upstream
-		// sent it, headers included. Buffering what was read and closing here
-		// would truncate the body at the cap and hand the client a short,
-		// invalid listing — worse than not filtering at all.
-		resp.Body = spliceBody(body, resp.Body)
-		return nil
-	}
-	if err := resp.Body.Close(); err != nil {
-		return err
-	}
-
-	filtered, ok := filterListingBody(body, permitted)
-	if !ok {
-		restoreBody(resp, body)
-		return nil
-	}
-	restoreBody(resp, filtered)
-	return nil
-}
-
-// isPlainJSONListing reports whether the response is a JSON body the filter
-// can parse. A content-encoded body is skipped: the transport only
-// transparently decompresses what it negotiated itself, and the client
-// negotiates its own encoding on this request.
-func isPlainJSONListing(resp *http.Response) bool {
-	if resp == nil || resp.Body == nil {
-		return false
-	}
-	if resp.StatusCode != http.StatusOK {
-		return false
-	}
-	if enc := resp.Header.Get("Content-Encoding"); enc != "" && !strings.EqualFold(enc, "identity") {
-		return false
-	}
-	return strings.Contains(strings.ToLower(resp.Header.Get("Content-Type")), "application/json")
-}
-
-// filterListingBody returns the listing with unauthorised entries removed.
-// ok is false when the body is not a listing shape, in which case the
-// caller must forward the original bytes.
-func filterListingBody(body []byte, permitted map[string]struct{}) ([]byte, bool) {
-	var doc map[string]json.RawMessage
-	if err := json.Unmarshal(body, &doc); err != nil {
-		return nil, false
-	}
-	raw, present := doc["data"]
-	if !present {
-		return nil, false
-	}
-	var entries []map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &entries); err != nil {
-		return nil, false
-	}
-
-	kept := make([]map[string]json.RawMessage, 0, len(entries))
-	for _, entry := range entries {
-		if entryPermitted(entry, permitted) {
-			kept = append(kept, entry)
-		}
-	}
-
-	encoded, err := json.Marshal(kept)
-	if err != nil {
-		return nil, false
-	}
-	doc["data"] = encoded
-	out, err := json.Marshal(doc)
-	if err != nil {
-		return nil, false
-	}
-	return out, true
-}
-
-// entryPermitted reports whether a listing entry names a model the policy
-// authorises, trying every form the same model is written in.
-func entryPermitted(entry map[string]json.RawMessage, permitted map[string]struct{}) bool {
-	raw, ok := entry["id"]
-	if !ok {
-		return false
-	}
-	var id string
-	if err := json.Unmarshal(raw, &id); err != nil {
-		return false
-	}
-	for _, candidate := range modelIDForms(id) {
-		if _, ok := permitted[candidate]; ok {
-			return true
-		}
-	}
-	return false
-}
-
-// modelIDForms returns the forms a single model id may be written in: the id
-// itself, its undated form, and the same two with a gateway's provider
-// prefix removed ("vertex_ai/claude-sonnet-5"). The bare id is tried first,
-// because a self-hosted id can legitimately contain a slash of its own
-// ("Qwen/Qwen2.5-0.5B-Instruct") and must not be cut down to its tail.
-func modelIDForms(id string) []string {
-	if id == "" {
-		return nil
-	}
-	forms := []string{id, sharedllm.NormalizeAnthropicModel(id)}
-	if slash := strings.LastIndex(id, "/"); slash >= 0 {
-		tail := id[slash+1:]
-		forms = append(forms, tail, sharedllm.NormalizeAnthropicModel(tail))
-	}
-	return forms
-}
-
-// restoreBody puts body back on the response and fixes the length headers
-// so the client reads exactly what is there.
-// spliceBody returns a ReadCloser that yields prefix followed by whatever is
-// left in rest, closing rest when closed. It lets the filter put back bytes it
-// consumed while deciding, without owning the rest of the stream.
-func spliceBody(prefix []byte, rest io.ReadCloser) io.ReadCloser {
-	return struct {
-		io.Reader
-		io.Closer
-	}{
-		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
-		Closer: rest,
-	}
-}
-
-func restoreBody(resp *http.Response, body []byte) {
-	resp.Body = io.NopCloser(bytes.NewReader(body))
-	resp.ContentLength = int64(len(body))
-	resp.Header.Set("Content-Length", strconv.Itoa(len(body)))
-}

proxy/internal/proxy/discovery_filter_test.go

@@ -1,217 +0,0 @@
-package proxy
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// jsonListingResponse builds a 200 model-listing response with the given
-// body, as an upstream would return it.
-func jsonListingResponse(body string) *http.Response {
-	resp := &http.Response{
-		StatusCode:    http.StatusOK,
-		Header:        http.Header{},
-		Body:          io.NopCloser(strings.NewReader(body)),
-		ContentLength: int64(len(body)),
-	}
-	resp.Header.Set("Content-Type", "application/json")
-	return resp
-}
-
-// listedIDs runs the filter and returns the ids left in the response.
-func listedIDs(t *testing.T, allowed []string, body string) []string {
-	t.Helper()
-	resp := jsonListingResponse(body)                            //nolint:bodyclose // in-memory body, replaced by the filter
-	require.NoError(t, modelDiscoveryFilter(allowed, nil)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
-
-	raw, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
-
-	var doc struct {
-		Data []struct {
-			ID string `json:"id"`
-		} `json:"data"`
-	}
-	require.NoError(t, json.Unmarshal(raw, &doc), "filtered body must stay valid JSON")
-
-	ids := make([]string, 0, len(doc.Data))
-	for _, entry := range doc.Data {
-		ids = append(ids, entry.ID)
-	}
-	return ids
-}
-
-// TestModelDiscoveryFilter_KeepsOnlyAuthorisedModels covers the picker a
-// developer sees: an unfiltered upstream list offers every model the shared
-// key can reach, and each one the policy excludes is a request the chain
-// denies a moment later.
-func TestModelDiscoveryFilter_KeepsOnlyAuthorisedModels(t *testing.T) {
-	ids := listedIDs(t, []string{"claude-sonnet-5", "claude-haiku-4-5"}, `{
-		"data": [
-			{"id": "claude-opus-5", "display_name": "Claude Opus 5"},
-			{"id": "claude-sonnet-5", "display_name": "Claude Sonnet 5"},
-			{"id": "claude-haiku-4-5"}
-		],
-		"has_more": false
-	}`)
-
-	assert.Equal(t, []string{"claude-sonnet-5", "claude-haiku-4-5"}, ids,
-		"only the models the route authorises may reach the picker")
-}
-
-// TestModelDiscoveryFilter_MatchesDatedAndPrefixedIDs pins the two id forms
-// a gateway returns for a model the operator registered plainly.
-func TestModelDiscoveryFilter_MatchesDatedAndPrefixedIDs(t *testing.T) {
-	ids := listedIDs(t, []string{"claude-sonnet-4-5", "anthropic.claude-opus-5"}, `{
-		"data": [
-			{"id": "claude-sonnet-4-5-20250929"},
-			{"id": "bedrock/anthropic.claude-opus-5"},
-			{"id": "gpt-4o"}
-		]
-	}`)
-
-	assert.Equal(t, []string{"claude-sonnet-4-5-20250929", "bedrock/anthropic.claude-opus-5"}, ids,
-		"a dated or provider-prefixed id must match its registered form")
-}
-
-// TestModelDiscoveryFilter_PreservesEnvelopeFields guards the rest of the
-// document: clients read paging fields alongside data.
-func TestModelDiscoveryFilter_PreservesEnvelopeFields(t *testing.T) {
-	resp := jsonListingResponse(`{"data":[{"id":"claude-sonnet-5"}],"has_more":true,"first_id":"x"}`) //nolint:bodyclose // in-memory body, replaced by the filter
-	require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, nil)(resp))                  //nolint:bodyclose // in-memory body, replaced by the filter
-
-	raw, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
-
-	var doc map[string]any
-	require.NoError(t, json.Unmarshal(raw, &doc))
-	assert.Equal(t, true, doc["has_more"], "paging fields must survive the rewrite")
-	assert.Equal(t, "x", doc["first_id"])
-	assert.Equal(t, strconv.Itoa(len(raw)), resp.Header.Get("Content-Length"),
-		"Content-Length must match the rewritten body")
-}
-
-// TestModelDiscoveryFilter_PassesThroughUnfilterable covers the responses
-// the filter must not touch: a compressed body it cannot parse, a non-JSON
-// body, an error status, and a document with no data array.
-func TestModelDiscoveryFilter_PassesThroughUnfilterable(t *testing.T) {
-	cases := map[string]func() *http.Response{
-		"compressed": func() *http.Response {
-			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
-			resp.Header.Set("Content-Encoding", "gzip")
-			return resp
-		},
-		"not json": func() *http.Response {
-			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
-			resp.Header.Set("Content-Type", "text/html")
-			return resp
-		},
-		"error status": func() *http.Response {
-			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
-			resp.StatusCode = http.StatusInternalServerError
-			return resp
-		},
-		"no data array": func() *http.Response {
-			return jsonListingResponse(`{"object":"list"}`)
-		},
-	}
-
-	for name, build := range cases {
-		t.Run(name, func(t *testing.T) {
-			resp := build() //nolint:bodyclose // in-memory body, replaced by the filter
-			original, err := io.ReadAll(resp.Body)
-			require.NoError(t, err)
-			resp.Body = io.NopCloser(bytes.NewReader(original))
-
-			require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, nil)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
-
-			got, err := io.ReadAll(resp.Body)
-			require.NoError(t, err)
-			assert.Equal(t, string(original), string(got), "an unfilterable response must reach the client unchanged")
-		})
-	}
-}
-
-// TestModelDiscoveryFilter_RunsNextHook pins that an existing
-// ModifyResponse hook still runs after filtering.
-func TestModelDiscoveryFilter_RunsNextHook(t *testing.T) {
-	called := false
-	next := func(*http.Response) error {
-		called = true
-		return nil
-	}
-
-	resp := jsonListingResponse(`{"data":[{"id":"claude-sonnet-5"}]}`)                //nolint:bodyclose // in-memory body, replaced by the filter
-	require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, next)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
-	assert.True(t, called, "the chained hook must still run")
-}
-
-// TestModelDiscoveryFilter_KeepsSlashBearingIDs covers self-hosted backends
-// whose model ids carry a slash of their own. Treating the slash as a
-// gateway prefix and keeping only the tail dropped every such model from
-// the picker even though the policy named it exactly.
-func TestModelDiscoveryFilter_KeepsSlashBearingIDs(t *testing.T) {
-	ids := listedIDs(t, []string{"Qwen/Qwen2.5-0.5B-Instruct"}, `{
-		"object": "list",
-		"data": [
-			{"id": "Qwen/Qwen2.5-0.5B-Instruct"},
-			{"id": "Qwen/Qwen2.5-7B-Instruct"}
-		]
-	}`)
-
-	assert.Equal(t, []string{"Qwen/Qwen2.5-0.5B-Instruct"}, ids,
-		"a slash inside the model id is part of the id, not a provider prefix")
-}
-
-// TestModelDiscoveryFilter_ForwardsOversizedBodyIntact covers a listing past
-// the buffering cap. The filter reads one byte beyond the cap to detect the
-// size; forwarding only what it read would hand the client a body truncated
-// at exactly 1 MiB — valid-looking, short, and unparseable as JSON. The bytes
-// already read must be spliced back in front of the unread remainder so the
-// response reaches the client exactly as the upstream sent it.
-func TestModelDiscoveryFilter_ForwardsOversizedBodyIntact(t *testing.T) {
-	// A well-formed listing whose single entry pads the body past the cap.
-	padding := strings.Repeat("x", maxDiscoveryBodyBytes)
-	body := `{"object":"list","data":[{"id":"gpt-4o","note":"` + padding + `"}]}`
-	require.Greater(t, len(body), maxDiscoveryBodyBytes+1,
-		"the fixture must exceed the cap by more than the one-byte probe")
-
-	resp := jsonListingResponse(body)                        //nolint:bodyclose // in-memory body
-	require.NoError(t, modelDiscoveryFilter(nil, nil)(resp)) //nolint:bodyclose // in-memory body
-
-	got, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
-	assert.Equal(t, len(body), len(got),
-		"an oversized listing must reach the client whole, not truncated at the cap")
-	assert.Equal(t, body, string(got), "the forwarded bytes must be the upstream's own")
-
-	var doc map[string]json.RawMessage
-	assert.NoError(t, json.Unmarshal(got, &doc),
-		"the forwarded body must still parse as JSON")
-}
-
-// TestModelDiscoveryFilter_OversizedBodyKeepsUpstreamHeaders pins that the
-// oversized path leaves the response metadata alone. Rewriting Content-Length
-// to the truncated prefix is what made the corruption invisible to the client
-// until it tried to parse.
-func TestModelDiscoveryFilter_OversizedBodyKeepsUpstreamHeaders(t *testing.T) {
-	padding := strings.Repeat("x", maxDiscoveryBodyBytes)
-	body := `{"object":"list","data":[{"id":"gpt-4o","note":"` + padding + `"}]}`
-
-	resp := jsonListingResponse(body) //nolint:bodyclose // in-memory body
-	resp.Header.Set("Content-Length", strconv.Itoa(len(body)))
-	require.NoError(t, modelDiscoveryFilter(nil, nil)(resp)) //nolint:bodyclose // in-memory body
-
-	assert.Equal(t, int64(len(body)), resp.ContentLength,
-		"ContentLength must keep describing the body the client receives")
-	assert.Equal(t, strconv.Itoa(len(body)), resp.Header.Get("Content-Length"),
-		"the Content-Length header must not be rewritten to the truncated prefix")
-}

proxy/internal/proxy/reverseproxy.go

@@ -363,9 +363,6 @@ func (p *ReverseProxy) forwardUpstream(respWriter http.ResponseWriter, r *http.R
 	if result.rewriteRedirects {
 		rp.ModifyResponse = p.rewriteLocationFunc(effectiveURL, rewriteMatchedPath, r) //nolint:bodyclose
 	}
-	if upstreamRewrite != nil && len(upstreamRewrite.DiscoveryModels) > 0 {
-		rp.ModifyResponse = modelDiscoveryFilter(upstreamRewrite.DiscoveryModels, rp.ModifyResponse) //nolint:bodyclose // the hook replaces the body and closes the original
-	}
 	rp.ServeHTTP(respWriter, r.WithContext(ctx))
 }
 

shared/llm/model.go

@@ -46,27 +46,6 @@ func NormalizeBedrockModel(modelID string) string {
 	return bedrockVersionSuffix.ReplaceAllString(m, "")
 }
 
-// anthropicDatedModel matches a Claude model id carrying the trailing
-// "-YYYYMMDD" release-date suffix Anthropic appends to a pinned release,
-// capturing the id without it. The "claude" anchor is load-bearing: pricing
-// looks every model up through this helper regardless of surface, and an
-// operator may register a custom id with any shape at all, so an unanchored
-// "-\d{8}$" would let "internal-llm-20250101" silently inherit the rate
-// registered for "internal-llm". The anchor also covers the vendor-prefixed
-// forms ("anthropic.claude-...", "us.anthropic.claude-...").
-var anthropicDatedModel = regexp.MustCompile(`(?i)^(.*claude.*)-\d{8}$`)
-
-// NormalizeAnthropicModel strips the trailing release-date suffix from a
-// Claude model id, e.g. "claude-sonnet-4-5-20250929" -> "claude-sonnet-4-5",
-// so a dated id a client pins matches the undated one the operator
-// registered. Ids that are not Claude-family are returned untouched.
-// Callers try the verbatim id first and fall back to this, so two dated
-// releases of the same family stay distinct wherever both are registered
-// explicitly.
-func NormalizeAnthropicModel(modelID string) string {
-	return anthropicDatedModel.ReplaceAllString(modelID, "$1")
-}
-
 // NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
 // (e.g. "claude-sonnet-4-5@20250929" -> "claude-sonnet-4-5") so it matches
 // the catalog/pricing key. Vertex publisher models are priced under their

shared/llm/model_test.go

@@ -34,29 +34,3 @@ func TestNormalizeVertexModel(t *testing.T) {
 		require.Equal(t, want, NormalizeVertexModel(in), "normalize %q", in)
 	}
 }
-
-func TestNormalizeAnthropicModel(t *testing.T) {
-	cases := map[string]string{
-		"claude-sonnet-4-5-20250929":            "claude-sonnet-4-5",
-		"claude-3-5-haiku-20241022":             "claude-3-5-haiku",
-		"claude-sonnet-5":                       "claude-sonnet-5",
-		"claude-opus-4-8":                       "claude-opus-4-8",
-		"anthropic.claude-haiku-4-5":            "anthropic.claude-haiku-4-5",
-		"anthropic.claude-sonnet-4-5-20250929":  "anthropic.claude-sonnet-4-5",
-		"us.anthropic.claude-opus-4-8-20250101": "us.anthropic.claude-opus-4-8",
-		// Non-Claude ids must survive untouched even when they end in eight
-		// consecutive digits: an operator can register a custom model under
-		// any id, and pricing looks every one of them up through this helper.
-		"gpt-4o":                  "gpt-4o",
-		"gpt-4o-2024-08-06":       "gpt-4o-2024-08-06",
-		"gpt-4o-20240806":         "gpt-4o-20240806",
-		"internal-llm-20250101":   "internal-llm-20250101",
-		"deepseek-r1-20250120":    "deepseek-r1-20250120",
-		"Qwen/Qwen2.5-20250101":   "Qwen/Qwen2.5-20250101",
-		"gemini-2-5-pro-20250101": "gemini-2-5-pro-20250101",
-		"":                        "",
-	}
-	for in, want := range cases {
-		require.Equal(t, want, NormalizeAnthropicModel(in), "normalize %q", in)
-	}
-}

shared/management/http/api/openapi.yml

@@ -4608,7 +4608,7 @@ components:
 
     FleetDMMatchAttributes:
       type: object
-      description: Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
+      description: Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
       additionalProperties: false
       properties:
         disk_encryption_enabled:
@@ -5335,57 +5335,6 @@ components:
         - input_per_1k
         - output_per_1k
         - context_window
-    AgentNetworkModelDiscoveryRequest:
-      type: object
-      properties:
-        catalog_provider_id:
-          type: string
-          description: Catalog provider to query (AgentNetworkCatalogProvider.id). Determines the listing endpoint, the auth header and the response shape.
-          example: "bedrock_api"
-        upstream_url:
-          type: string
-          description: |
-            The upstream being configured. Used to reach vendors that serve their listing from the same host as inference, and to read back the region for those whose host embeds one. Ignored when provider_id is supplied.
-          example: "https://bedrock-runtime.eu-central-1.amazonaws.com"
-        api_key:
-          type: string
-          description: Credential to query the vendor with, for a provider that has not been saved yet. Mutually exclusive with provider_id.
-          example: "sk-..."
-        provider_id:
-          type: string
-          description: Existing Agent Network provider record whose stored credential and upstream should be used. Lets the form refresh the list without the client holding the key.
-          example: "ch8i4ug6lnn4g9hqv7m0"
-      required:
-        - catalog_provider_id
-    AgentNetworkModelDiscoveryResponse:
-      type: object
-      properties:
-        models:
-          type: array
-          description: Models the credential can reach, in the order the vendor returned them.
-          items:
-            $ref: '#/components/schemas/AgentNetworkDiscoveredModel'
-      required:
-        - models
-    AgentNetworkDiscoveredModel:
-      type: object
-      properties:
-        id:
-          type: string
-          description: |
-            Identifier to register on the provider record, in the form the vendor issues it. For Bedrock this is the region-prefixed inference-profile id, which is the only form AWS accepts at invoke time.
-          example: "eu.anthropic.claude-haiku-4-5-20251001-v1:0"
-        label:
-          type: string
-          description: Vendor-supplied display name, where the vendor supplies one.
-          example: "EU Anthropic Claude Haiku 4.5"
-        pricing_known:
-          type: boolean
-          description: Whether NetBird's shipped pricing table can price this model. When false the operator must set input/output rates, or requests to it would record a cost of zero.
-          example: true
-      required:
-        - id
-        - pricing_known
     AgentNetworkCatalogProvider:
       type: object
       properties:
@@ -14055,42 +14004,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
-  /api/agent-network/catalog/providers/models:
-    post:
-      summary: Discover the models a provider credential can reach
-      description: |
-        Asks the vendor which models the supplied credential can actually use, so the provider form can offer a live list instead of only the static catalog. The endpoint, auth header and response shape are taken from the catalog entry, never from the request.
-
-        Supply either an api_key together with the upstream_url being configured (before the provider is saved), or a provider_id of an existing record to reuse its stored credential.
-
-        Returns 422 for a catalog provider that has no listing endpoint (most gateways); the caller should fall back to the catalog's own model list. A model whose price the shipped table does not know is returned with pricing_known false, and the operator must set rates for it.
-      tags: [ Agent Network ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AgentNetworkModelDiscoveryRequest'
-      responses:
-        '200':
-          description: The models the credential can reach
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AgentNetworkModelDiscoveryResponse'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '422':
-          "$ref": "#/components/responses/validation_failed_simple"
-        '500':
-          "$ref": "#/components/responses/internal_error"
   /api/agent-network/providers:
     get:
       summary: List all Agent Network Providers

shared/management/http/api/types.gen.go

@@ -2120,18 +2120,6 @@ type AgentNetworkConsumption struct {
 // AgentNetworkConsumptionDimensionKind Whether this row counts a single end user or a single source group across every member.
 type AgentNetworkConsumptionDimensionKind string
 
-// AgentNetworkDiscoveredModel defines model for AgentNetworkDiscoveredModel.
-type AgentNetworkDiscoveredModel struct {
-	// Id Identifier to register on the provider record, in the form the vendor issues it. For Bedrock this is the region-prefixed inference-profile id, which is the only form AWS accepts at invoke time.
-	Id string `json:"id"`
-
-	// Label Vendor-supplied display name, where the vendor supplies one.
-	Label *string `json:"label,omitempty"`
-
-	// PricingKnown Whether NetBird's shipped pricing table can price this model. When false the operator must set input/output rates, or requests to it would record a cost of zero.
-	PricingKnown bool `json:"pricing_known"`
-}
-
 // AgentNetworkGuardrail defines model for AgentNetworkGuardrail.
 type AgentNetworkGuardrail struct {
 	// Checks Guardrail check parameters. Each entry has an `enabled` flag plus per-check configuration; disabled entries are inert.
@@ -2179,27 +2167,6 @@ type AgentNetworkGuardrailRequest struct {
 	Name string `json:"name"`
 }
 
-// AgentNetworkModelDiscoveryRequest defines model for AgentNetworkModelDiscoveryRequest.
-type AgentNetworkModelDiscoveryRequest struct {
-	// ApiKey Credential to query the vendor with, for a provider that has not been saved yet. Mutually exclusive with provider_id.
-	ApiKey *string `json:"api_key,omitempty"`
-
-	// CatalogProviderId Catalog provider to query (AgentNetworkCatalogProvider.id). Determines the listing endpoint, the auth header and the response shape.
-	CatalogProviderId string `json:"catalog_provider_id"`
-
-	// ProviderId Existing Agent Network provider record whose stored credential and upstream should be used. Lets the form refresh the list without the client holding the key.
-	ProviderId *string `json:"provider_id,omitempty"`
-
-	// UpstreamUrl The upstream being configured. Used to reach vendors that serve their listing from the same host as inference, and to read back the region for those whose host embeds one. Ignored when provider_id is supplied.
-	UpstreamUrl *string `json:"upstream_url,omitempty"`
-}
-
-// AgentNetworkModelDiscoveryResponse defines model for AgentNetworkModelDiscoveryResponse.
-type AgentNetworkModelDiscoveryResponse struct {
-	// Models Models the credential can reach, in the order the vendor returned them.
-	Models []AgentNetworkDiscoveredModel `json:"models"`
-}
-
 // AgentNetworkPolicy defines model for AgentNetworkPolicy.
 type AgentNetworkPolicy struct {
 	// CreatedAt Timestamp when the policy was created.
@@ -2909,7 +2876,7 @@ type EDRFleetDMRequest struct {
 	// LastSyncedInterval The devices last sync requirement interval in hours. Minimum value is 24 hours
 	LastSyncedInterval int `json:"last_synced_interval"`
 
-	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
+	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
 	MatchAttributes FleetDMMatchAttributes `json:"match_attributes"`
 }
 
@@ -2942,7 +2909,7 @@ type EDRFleetDMResponse struct {
 	// LastSyncedInterval The devices last sync requirement interval in hours.
 	LastSyncedInterval int `json:"last_synced_interval"`
 
-	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
+	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
 	MatchAttributes FleetDMMatchAttributes `json:"match_attributes"`
 
 	// UpdatedAt Timestamp of when the integration was last updated.
@@ -3162,7 +3129,7 @@ type Event struct {
 // EventActivityCode The string code of the activity that occurred during the event
 type EventActivityCode string
 
-// FleetDMMatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
+// FleetDMMatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
 type FleetDMMatchAttributes struct {
 	// DiskEncryptionEnabled Whether disk encryption (FileVault/BitLocker) must be enabled on the host
 	DiskEncryptionEnabled *bool `json:"disk_encryption_enabled,omitempty"`
@@ -6212,9 +6179,6 @@ type PostApiAgentNetworkBudgetRulesJSONRequestBody = AgentNetworkBudgetRuleReque
 // PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody defines body for PutApiAgentNetworkBudgetRulesRuleId for application/json ContentType.
 type PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody = AgentNetworkBudgetRuleRequest
 
-// PostApiAgentNetworkCatalogProvidersModelsJSONRequestBody defines body for PostApiAgentNetworkCatalogProvidersModels for application/json ContentType.
-type PostApiAgentNetworkCatalogProvidersModelsJSONRequestBody = AgentNetworkModelDiscoveryRequest
-
 // PostApiAgentNetworkGuardrailsJSONRequestBody defines body for PostApiAgentNetworkGuardrails for application/json ContentType.
 type PostApiAgentNetworkGuardrailsJSONRequestBody = AgentNetworkGuardrailRequest