mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-24 16:41:30 +02:00
8f66ee2870
The guardrail enforces its own per-provider model allowlist and fails closed when the request names no model, which is right for a path-routed inference request whose shape the parser could not read. GET /v1/models names no model anywhere, so discovery still denied with model_unknown for exactly the accounts that configured an allowlist — the case skipping the management pre-flight was meant to fix. Only one of the two gates had been opened, and a client reads the 403 as an empty model picker. Exempt requests the router marked non-inference from the unknown-model branch. A named model is still checked, so the exemption covers only the endpoints that genuinely name nothing: the listing and the warm probe.