Maycon Santos 12c44701d7 [e2e] guardrail blocks the unselected model for path-routed providers ...

Add an always-on (no-credentials) e2e regression guard for the report
that a model-allowlist guardrail attached to a policy has no effect for
PATH-ROUTED providers, where the model travels in the URL rather than the
JSON body: Google Vertex (…/models/{model}:rawPredict) and AWS Bedrock
(/model/{id}/invoke) — the shape the customer actually hits.

Through the real management API it creates a Vertex and a Bedrock
provider (both catch-all, so the router forwards any model and a 403 can
only be the guardrail, never model_not_routable) and one guardrail whose
allowlist selects a single model per provider, attached to the policy.
Over the tunnel, for each provider the selected model (in the URL path)
is served 200 and an unselected model is denied 403 by the guardrail
(llm_policy.model_blocked) before the upstream. The Bedrock case sends a
region-prefixed, versioned inference-profile id, so URL-path model
normalization is exercised too.

Only the upstream LLM is mocked (the vLLM nginx answers any path 200);
management synth/reconcile, the proxy middleware chain (URL-path model
extraction, router, guardrail) and the tunnel are all real, and the
guardrail denies before the upstream is dialed so the mock cannot
influence the block. Providers use a static bearer api key so the router
injects a static Authorization header instead of minting a GCP token —
the only reason path-routed providers normally need live credentials —
so the test runs with none and always executes in CI.

2026-07-23 06:59:24 +00:00

..

agentnetwork

[e2e] guardrail blocks the unselected model for path-routed providers

2026-07-23 06:59:24 +00:00

harness

[misc] Probe the agent-network endpoint with a GET instead of getent (#6867)

2026-07-23 15:30:40 +09:00