chore: merge main into litellm_durable_background_interaction_settlement and meet its new lint gates

2026-10-04 02:31:27 +00:00 · 2026-10-01 15:45:36 -07:00 · 2026-10-01 15:45:36 -07:00 · 6ce60b9492
commit 6ce60b9492
parent 5ef919d85c 0f6a06a6b9
2879 changed files with 185172 additions and 27237 deletions
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@ -17,3 +17,6 @@ rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]

 [target.aarch64-apple-darwin]
 rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]
+
+[env]
+SQLX_OFFLINE = "true"
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -141,7 +141,7 @@ commands:
            node --version
            npm --version
  install_rust:
-    description: "Install pinned rustup (1.28.2) and Rust toolchain (1.98.0) with checksum verification. Adds ~/.cargo/bin to PATH. Run this before any `uv sync` or `uv build` of the workspace: the root package builds litellm-rust through maturin, and on an image without cargo maturin fetches an unpinned rustup and a floating toolchain by itself."
+    description: "Install pinned rustup (1.28.2) and Rust toolchain (1.98.0) with checksum verification. Adds ~/.cargo/bin to PATH. Run this before any `uv sync` or `uv build` of the workspace: the root package builds litellm-rust through maturin, and on an image without cargo maturin fetches an unpinned rustup and a floating toolchain by itself. Also restores the dev-profile cargo cache that save_cargo_target writes on main, minus the workspace crates' fingerprints so those always rebuild from the checked-out source."
    steps:
      - run:
          name: Install Rust (rustup 1.28.2, toolchain 1.98.0)
@ -167,9 +167,29 @@ commands:
            /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain 1.98.0
            rm -f /tmp/rustup-init
            echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> "$BASH_ENV"
+            echo 'export CARGO_INCREMENTAL=0' >> "$BASH_ENV"
            export PATH="$HOME/.cargo/bin:$PATH"
            rustc --version
            cargo --version
+            { rustc -vV; cc --version; cat /etc/os-release; } > /tmp/cargo-build-env
+      - restore_cache:
+          keys:
+            - v1-cargo-dev-{{ checksum "/tmp/cargo-build-env" }}-{{ checksum "litellm-rust/Cargo.lock" }}
+            - v1-cargo-dev-{{ checksum "/tmp/cargo-build-env" }}-
+      - run:
+          name: Force a rebuild of the workspace crates restored from the cargo cache
+          command: rm -rf litellm-rust/target/debug/.fingerprint/litellm-*
+  save_cargo_target:
+    steps:
+      - when:
+          condition:
+            equal: [main, << pipeline.git.branch >>]
+          steps:
+            - save_cache:
+                key: v1-cargo-dev-{{ checksum "/tmp/cargo-build-env" }}-{{ checksum "litellm-rust/Cargo.lock" }}
+                paths:
+                  - ~/.cargo/registry
+                  - ~/project/litellm-rust/target/debug
  start_postgres:
    description: "Start a postgres-db container on port 5432 and wait until it accepts connections."
    parameters:
@ -281,51 +301,11 @@ commands:
            # `uv sync --package litellm-enterprise` here — that overwrites the
            # shared .venv and strips out dev/test deps (pytest, prisma, etc.).
            uv run --no-sync python -c "import litellm_enterprise; print('litellm-enterprise OK:', litellm_enterprise.__file__)"
-  setup_litellm_test_deps:
+  install_windows_toolchain:
    steps:
-      - checkout
-      - setup_google_dns
-      - install_uv
-      - install_rust
-      - restore_cache:
-          keys:
-            - v3-integration-uv-cache-{{ checksum "uv.lock" }}
      - run:
-          name: Install Dependencies
-          command: |
-            uv sync --frozen --all-groups --all-extras --python 3.12
-      - setup_litellm_enterprise_pip
-      - save_cache:
-          paths:
-            - ~/.cache/uv
-          key: v3-integration-uv-cache-{{ checksum "uv.lock" }}
-
-jobs:
-  # Add Windows testing job
-  using_litellm_on_windows:
-    executor:
-      name: win/default
-      shell: powershell.exe
-    working_directory: ~/project
-    environment:
-      UV_PYTHON: "3.11"
-      CARGO_HTTP_MULTIPLEXING: "false"
-      CARGO_NET_RETRY: "5"
-    steps:
-      - checkout
-      - run:
-          name: Install Python
-          command: |
-            choco install python --version=3.11.0 -y --no-progress --force
-            refreshenv
-            python --version
-          environment:
-            CHOCOLATEY_CONFIRM_ALL: "true"
-      - run:
-          name: Install Dependencies
+          name: Install Rust and uv
          no_output_timeout: 30m
-          environment:
-            UV_HTTP_TIMEOUT: "300"
          command: |
            $rustupInit = Join-Path $env:TEMP "rustup-init.exe"
            $rustupVersion = "1.28.2"
@ -365,6 +345,55 @@ jobs:
            if (-not (Select-String -Path $PROFILE -SimpleMatch $cargoBin -Quiet)) {
              Add-Content -Path $PROFILE -Value "`$env:Path = `"$cargoBin;`$env:Path`""
            }
+  setup_litellm_test_deps:
+    steps:
+      - checkout
+      - setup_google_dns
+      - install_uv
+      - install_rust
+      - restore_cache:
+          keys:
+            - v3-integration-uv-cache-{{ checksum "uv.lock" }}
+      - run:
+          name: Install Dependencies
+          command: |
+            uv sync --frozen --all-groups --all-extras --python 3.12
+      - setup_litellm_enterprise_pip
+      - save_cache:
+          paths:
+            - ~/.cache/uv
+          key: v3-integration-uv-cache-{{ checksum "uv.lock" }}
+      - save_cargo_target
+
+jobs:
+  # Add Windows testing job
+  using_litellm_on_windows:
+    executor:
+      name: win/default
+      shell: powershell.exe
+    working_directory: ~/project
+    environment:
+      UV_PYTHON: "3.11"
+      CARGO_HTTP_MULTIPLEXING: "false"
+      CARGO_NET_RETRY: "5"
+    steps:
+      - checkout
+      - run:
+          name: Install Python
+          command: |
+            choco install python --version=3.11.0 -y --no-progress --force
+            refreshenv
+            python --version
+          environment:
+            CHOCOLATEY_CONFIRM_ALL: "true"
+      - install_windows_toolchain
+      - run:
+          name: Install Dependencies
+          no_output_timeout: 30m
+          environment:
+            UV_HTTP_TIMEOUT: "300"
+          command: |
+            $env:Path = "$HOME\.cargo\bin;$HOME\.local\bin;$env:Path"
            for ($attempt = 1; $attempt -le 5; $attempt++) {
              Write-Host "uv sync attempt $attempt/5"
              uv sync --frozen --group dev --python 3.11
@ -379,18 +408,69 @@ jobs:
      - run:
          name: Run Windows-specific test
          command: |
-            uv run --no-sync python -m pytest tests/windows_tests/ -v
+            uv run --no-sync python -m pytest --tb=short tests/windows_tests/ -v
+
+  windows_release_wheel:
+    executor:
+      name: win/default
+      shell: powershell.exe
+      size: xlarge
+    working_directory: ~/project
+    environment:
+      UV_PYTHON: "3.11"
+      CARGO_HTTP_MULTIPLEXING: "false"
+      CARGO_NET_RETRY: "5"
+    steps:
+      - checkout
      - run:
-          name: Guard against MAX_PATH-busting packaged wheel paths
+          name: Skip job when no windows-release-relevant files changed
+          shell: bash.exe
+          command: bash .circleci/scripts/path_filter.sh windows-release
+      - run:
+          name: Install Python
+          command: |
+            choco install python --version=3.11.0 -y --no-progress --force
+            refreshenv
+            python --version
+          environment:
+            CHOCOLATEY_CONFIRM_ALL: "true"
+      - install_windows_toolchain
+      - run:
+          name: Record the Rust build environment for the release cargo cache key
+          command: |
+            & "$HOME\.cargo\bin\rustc.exe" -vV | Out-File -Encoding ascii .cargo-build-env
+      - restore_cache:
+          keys:
+            - v1-cargo-release-windows-{{ checksum ".cargo-build-env" }}-{{ checksum "litellm-rust/Cargo.lock" }}
+            - v1-cargo-release-windows-{{ checksum ".cargo-build-env" }}-
+      - run:
+          name: Force a rebuild of the workspace crates restored from the cargo cache
+          command: |
+            $fingerprints = "litellm-rust/target/release/.fingerprint"
+            if (Test-Path $fingerprints) {
+              Get-ChildItem -Path $fingerprints -Filter "litellm-*" | Remove-Item -Recurse -Force
+            }
+      - run:
+          name: Build the release wheel and install it under a worst-case MAX_PATH prefix
          no_output_timeout: 30m
          environment:
            UV_HTTP_TIMEOUT: "300"
          command: |
            $env:Path = "$HOME\.cargo\bin;$HOME\.local\bin;$env:Path"
-            cargo --version
-            Get-ChildItem -Path "litellm\rust_bridge" -Filter "_native*" -File -ErrorAction SilentlyContinue | Remove-Item -Force
            uv build --wheel --out-dir dist
-            uv run --no-sync python tests/windows_tests/check_windows_wheel_install.py
+            if ($LASTEXITCODE -ne 0) {
+              exit $LASTEXITCODE
+            }
+            python tests/windows_tests/check_windows_wheel_install.py
+      - when:
+          condition:
+            equal: [main, << pipeline.git.branch >>]
+          steps:
+            - save_cache:
+                key: v1-cargo-release-windows-{{ checksum ".cargo-build-env" }}-{{ checksum "litellm-rust/Cargo.lock" }}
+                paths:
+                  - ~/.cargo/registry
+                  - ~/project/litellm-rust/target/release

  base_sdk_install:
    docker:
@ -406,6 +486,7 @@ jobs:
      - install_rust
      - run:
          name: Build the wheel
+          no_output_timeout: 30m
          environment:
            UV_HTTP_TIMEOUT: "300"
          command: |
@ -418,6 +499,10 @@ jobs:
            uv venv /tmp/base-sdk --python 3.12
            VIRTUAL_ENV=/tmp/base-sdk uv pip install dist/*.whl
            /tmp/base-sdk/bin/python tests/base_sdk_tests/check_base_sdk_install.py
+      - run:
+          name: Guard against MAX_PATH-busting packaged wheel paths
+          command: |
+            python3 tests/windows_tests/check_windows_wheel_install.py --lengths-only

  local_testing_part1:
    docker:
@ -446,6 +531,7 @@ jobs:
          paths:
            - ~/.cache/uv
          key: v1-uv-cache-{{ checksum "uv.lock" }}
+      - save_cargo_target
      - run:
          name: Run prisma ./docker/entrypoint.sh
          command: |
@ -465,7 +551,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --split-by=timings \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise \
                --cov-report=xml \
@ -539,7 +625,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --split-by=timings \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise \
                --cov-report=xml \
@ -611,7 +697,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/local_testing/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -666,7 +752,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/proxy_admin_ui_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -729,7 +815,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --split-by=timings \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                -k 'router' \
                -n 4 \
@ -773,7 +859,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/router_unit_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -818,7 +904,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/local_testing/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -862,7 +948,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/llm_translation/**/test_*.py" | grep -v "^tests/llm_translation/realtime/")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit.xml \
                --durations=20 \
@ -900,7 +986,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/llm_translation/realtime/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -945,7 +1031,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/agent_tests/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -989,7 +1075,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/guardrails_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -1035,7 +1121,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/unified_google_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -1090,7 +1176,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/llm_responses_api_testing/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -1124,7 +1210,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/ocr_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -1168,7 +1254,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/search_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -1212,7 +1298,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/batches_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -1256,7 +1342,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/litellm_utils_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -1301,7 +1387,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/pass_through_unit_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -1346,7 +1432,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/image_gen_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -1380,7 +1466,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/logging_callback_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                -n 4 \
@ -1425,7 +1511,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/audio_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
@ -1445,61 +1531,6 @@ jobs:
          paths:
            - audio_coverage.xml
            - audio_coverage
-  redis_caching_unit_tests:
-    docker:
-      - *python312_image
-    working_directory: ~/project
-
-    steps:
-      - checkout
-      - skip_if_unrelated_changes
-      - setup_google_dns
-      - restore_cache:
-          keys:
-            - v1-uv-cache-{{ checksum "uv.lock" }}
-      - install_uv
-      - install_rust
-      - run:
-          name: Install Dependencies
-          command: |
-            uv sync --frozen --all-groups --all-extras --python 3.12
-      - save_cache:
-          paths:
-            - ~/.cache/uv
-          key: v1-uv-cache-{{ checksum "uv.lock" }}
-      # Run pytest and generate JUnit XML report
-      - run:
-          name: Run tests
-          command: |
-            mkdir -p test-results
-            TEST_FILES=$(printf "%s\n" \
-              tests/local_testing/test_dual_cache.py \
-              tests/local_testing/test_redis_batch_optimizations.py \
-              tests/local_testing/test_redis_increment_with_floor.py \
-              tests/local_testing/test_router_utils.py)
-            echo "$TEST_FILES" | circleci tests run \
-              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -s \
-                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
-                --junitxml=test-results/junit.xml \
-                --durations=5 -n 2 \
-                --reruns 2 --reruns-delay 1"
-          no_output_timeout: 20m
-      - run:
-          name: Rename the coverage files
-          command: |
-            mv coverage.xml redis_caching_coverage.xml
-            mv .coverage redis_caching_coverage
-
-      # Store test results
-      - store_test_results:
-          path: test-results
-      - persist_to_workspace:
-          root: .
-          paths:
-            - redis_caching_coverage.xml
-            - redis_caching_coverage
  installing_litellm_on_python:
    docker:
      - *python312_image
@ -1519,7 +1550,7 @@ jobs:
      - run:
          name: Run tests
          command: |
-            uv run --no-sync python -m pytest -vv tests/local_testing/test_basic_python_version.py -k "not legacy_resolver"
+            uv run --no-sync python -m pytest --tb=short -vv tests/local_testing/test_basic_python_version.py -k "not legacy_resolver"

  installing_litellm_on_python_3_13:
    docker:
@ -1543,7 +1574,7 @@ jobs:
      - run:
          name: Run tests
          command: |
-            uv run --no-sync python -m pytest -v tests/local_testing/test_basic_python_version.py -k "not legacy_resolver"
+            uv run --no-sync python -m pytest --tb=short -v tests/local_testing/test_basic_python_version.py -k "not legacy_resolver"

  installing_litellm_on_python_v2_migration_resolver:
    docker:
@ -1574,7 +1605,7 @@ jobs:
      - run:
          name: Run both migration resolvers against Postgres
          command: |
-            uv run --no-sync python -m pytest -vv \
+            uv run --no-sync python -m pytest --tb=short -vv \
              tests/local_testing/test_basic_python_version.py::test_litellm_proxy_server_config_no_general_settings \
              tests/local_testing/test_basic_python_version.py::test_litellm_proxy_server_config_no_general_settings_legacy_resolver

@ -1743,7 +1774,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/basic_proxy_startup_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit-2.xml \
                --durations=5"
@ -1840,7 +1871,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -s -v \
                --junitxml=test-results/junit.xml \
                -n 4 \
@ -1927,7 +1958,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/openai_endpoints_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -s -vv \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -2010,7 +2041,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/otel_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -2062,7 +2093,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/basic_proxy_startup_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit-2.xml \
                --durations=5"
@ -2143,7 +2174,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/spend_tracking_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -2248,7 +2279,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/multi_instance_e2e_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -2320,7 +2351,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/store_model_in_db_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -2405,7 +2436,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/basic_proxy_startup_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv \
                --junitxml=test-results/junit-2.xml \
                --durations=5"
@ -2502,7 +2533,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/pass_through_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -v \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -2573,7 +2604,7 @@ jobs:
            TEST_FILES=$(circleci tests glob "tests/proxy_e2e_anthropic_messages_tests/**/test_*.py")
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
-              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
+              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest --tb=short \
                -vv -s \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -2603,7 +2634,7 @@ jobs:
      - run:
          name: Combine Coverage
          command: |
-            uv tool run --from 'coverage[toml]==7.10.6' coverage combine realtime_translation_coverage ocr_coverage search_coverage logging_coverage audio_coverage local_testing_part1_coverage local_testing_part2_coverage pass_through_unit_tests_coverage batches_coverage guardrails_coverage redis_caching_coverage agent_coverage google_generate_content_endpoint_coverage litellm_utils_coverage router_unit_tests_coverage auth_ui_unit_tests_coverage
+            uv tool run --from 'coverage[toml]==7.10.6' coverage combine realtime_translation_coverage ocr_coverage search_coverage logging_coverage audio_coverage local_testing_part1_coverage local_testing_part2_coverage pass_through_unit_tests_coverage batches_coverage guardrails_coverage agent_coverage google_generate_content_endpoint_coverage litellm_utils_coverage router_unit_tests_coverage auth_ui_unit_tests_coverage
            uv tool run --from 'coverage[toml]==7.10.6' coverage xml
      - codecov/upload:
          file: ./coverage.xml
@ -3103,7 +3134,7 @@ jobs:
          name: Test provider capture and replay harness
          command: |
            mkdir -p test-results/provider-replay-harness
-            uv run --no-sync pytest -q --noconftest -o addopts= -o pythonpath=tests/e2e -p no:rerunfailures \
+            uv run --no-sync pytest --tb=short -q --noconftest -o addopts= -o pythonpath=tests/e2e -p no:rerunfailures \
              --junitxml=test-results/provider-replay-harness/junit.xml \
              tests/e2e/test_provider_edge.py tests/e2e/test_fixture_bundle.py \
              tests/e2e/test_fixture_canonical.py tests/e2e/test_fixture_mode.py \
@ -3120,10 +3151,14 @@ jobs:
        type: enum
        enum: [standard, replica]
        default: standard
+      parallelism:
+        type: integer
+        default: 1
    machine:
      image: ubuntu-2204:2024.04.1
    resource_class: large
    working_directory: ~/project
+    parallelism: << parameters.parallelism >>
    steps:
      - setup_litellm_test_deps
      - when:
@ -3249,6 +3284,7 @@ jobs:
      image: ubuntu-2204:2024.04.1
    resource_class: large
    working_directory: ~/project
+    parallelism: 4
    steps:
      - setup_litellm_test_deps
      - run:
@ -3258,10 +3294,11 @@ jobs:
          name: Run unit tests
          command: |
            mkdir -p test-results/unit
-            mapfile -t files < <(find tests/unit -name 'test_*.py' | sort)
-            if [ "${#files[@]}" -eq 0 ]; then echo "tests/unit holds no test_*.py files; nothing to run"; exit 0; fi
+            shard="$(find tests/unit -name 'test_*.py' | sort | circleci tests split --split-by=timings --timings-type=filename)"
+            if [ -z "${shard}" ]; then echo "shard ${CIRCLE_NODE_INDEX} received no tests/unit files; nothing to run"; exit 0; fi
+            mapfile -t files < <(printf '%s\n' "${shard}")
            set +e
-            LITELLM_LOCAL_MODEL_COST_MAP=True uv run --no-sync pytest "${files[@]}" -p no:rerunfailures -p no:pytest-retry --timeout=90 -n 4 --dist=loadscope --tb=short --junitxml=test-results/unit/junit.xml
+            LITELLM_LOCAL_MODEL_COST_MAP=True uv run --no-sync pytest "${files[@]}" -p no:rerunfailures -p no:pytest-retry --timeout=90 -n 4 --dist=loadscope --tb=short -o junit_family=xunit1 --junitxml=test-results/unit/junit.xml
            status=$?
            set -e
            if [ "$status" -eq 5 ]; then echo "pytest collected no tests from tests/unit; passing"; exit 0; fi
@ -3328,7 +3365,11 @@ workflows:
          name: integration-<< matrix.suite >>
          matrix:
            parameters:
-              suite: [management, accounting, database, providers, extensions, mcp, sdk, cost, browser]
+              suite: [management, accounting, database, providers, mcp, sdk, cost, security, browser]
+      - integration_contracts:
+          name: integration-extensions
+          suite: extensions
+          parallelism: 4
      - integration_contracts:
          name: integration-<< matrix.suite >>-replica
          matrix:
@ -3343,6 +3384,7 @@ workflows:
            equal: ["", << pipeline.parameters.routing_parity_base >>]
    jobs:
      - using_litellm_on_windows
+      - windows_release_wheel
      - unit
      - provider_replay_harness
      - base_sdk_install
@ -3395,7 +3437,6 @@ workflows:
      - image_gen_testing
      - logging_testing
      - audio_testing
-      - redis_caching_unit_tests
      - upload-coverage:
          requires:
            - realtime_translation_testing
@ -3410,7 +3451,6 @@ workflows:
            - image_gen_testing
            - logging_testing
            - audio_testing
-            - redis_caching_unit_tests
            - langfuse_logging_unit_tests
            - local_testing_part1
            - local_testing_part2
--- a/.circleci/scripts/classify_changes.sh
+++ b/.circleci/scripts/classify_changes.sh
@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -uo pipefail

-category="${1:?usage: classify_changes.sh <backend|client|ui|provider-harness|cost-map-only|mcp-dependencies>}"
+category="${1:?usage: classify_changes.sh <backend|client|ui|provider-harness|cost-map-only|mcp-dependencies|windows-release>}"

 has_client=false
 has_backend=false
@ -9,6 +9,7 @@ has_ci=false
 has_provider_harness=false
 has_cost_map=false
 has_mcp_dependencies=false
+has_windows_release=false
 outside_cost_map_set=false
 while IFS= read -r file || [ -n "$file" ]; do
  [ -n "$file" ] || continue
@ -22,6 +23,10 @@ while IFS= read -r file || [ -n "$file" ]; do
    tests/e2e/*.py | tests/code_coverage_tests/test_provider_cache.py | tests/code_coverage_tests/test_provider_replay_harness.py | tests/unit/test_circleci_path_filter.py | .circleci/* | pyproject.toml | uv.lock)
      has_provider_harness=true ;;
  esac
+  case "$file" in
+    litellm-rust/* | litellm/rust_bridge/* | rust-toolchain.toml | pyproject.toml | uv.lock | tests/windows_tests/* | .circleci/*)
+      has_windows_release=true ;;
+  esac
  case "$file" in
    ui/* | tests/e2e/ui/*) has_client=true ;;
    docs/* | *.md | *.mdx) : ;;
@ -46,6 +51,9 @@ case "$category" in
  provider-harness)
    [ "$has_provider_harness" = true ] && echo run || echo skip
    ;;
+  windows-release)
+    [ "$has_windows_release" = true ] && echo run || echo skip
+    ;;
  backend)
    [ "$has_backend" = true ] && echo run || echo skip
    ;;
--- a/.circleci/scripts/run_integration.sh
+++ b/.circleci/scripts/run_integration.sh
@ -168,6 +168,7 @@ start_proxy() {
    "${database_env[@]}" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
    INTEGRATION_UPSTREAM_URL="$INTEGRATION_UPSTREAM_URL" \
    LITELLM_MASTER_KEY="$LITELLM_MASTER_KEY" LITELLM_SALT_KEY="$LITELLM_SALT_KEY" LITELLM_UI_PATH="$LITELLM_UI_PATH" PROXY_BASE_URL="http://127.0.0.1:$port" \
+    LITELLM_LICENSE="${LITELLM_LICENSE:-}" \
    LITELLM_MODE=PRODUCTION STORE_MODEL_IN_DB=True "${cost_map_env[@]}" \
    AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 COVERAGE_FILE="$coverage_data" \
    "${proxy_command[@]}" --config tests/integration/proxy_config.yaml \
@ -190,7 +191,7 @@ if [ "$suite" = management ] || [ "$suite" = mcp ]; then
 fi

 if [ "$suite" = providers ]; then
-  INTEGRATION_RUN_ID="$integration_identity" .venv/bin/python -m pytest --noconftest -o addopts= \
+  INTEGRATION_RUN_ID="$integration_identity" .venv/bin/python -m pytest --tb=short --noconftest -o addopts= \
    --strict-markers --strict-config -p no:pytest-retry -p no:rerunfailures --timeout=30 \
    tests/e2e/test_provider_edge.py::TestReplayMode::test_content_drift_returns_the_miss_status_naming_both_keys \
    tests/e2e/test_provider_edge.py::TestReplayMode::test_exhausted_key_returns_the_miss_status \
@ -212,6 +213,15 @@ if [ "$suite" = browser ]; then
  exit 0
 fi

+node_files=()
+if [ "${CIRCLE_NODE_TOTAL:-1}" -gt 1 ]; then
+  split="$(.venv/bin/python tests/integration/run.py "$suite" --list \
+    | circleci tests split --split-by=timings --timings-type=filename)"
+  read -r -a node_files <<< "$(printf '%s' "$split" | tr '\n' ' ')"
+  test "${#node_files[@]}" -gt 0
+  printf '%s\n' "${node_files[@]}" > "$results/node-files.txt"
+fi
+
 env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
  INTEGRATION_RUN_ID="$integration_identity" \
  DATABASE_URL="$DATABASE_URL" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
@ -219,13 +229,14 @@ env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
  INTEGRATION_UPSTREAM_URL="$INTEGRATION_UPSTREAM_URL" \
  INTEGRATION_WORKERS="${INTEGRATION_WORKERS:-1}" \
  INTEGRATION_MASTER_KEY="$INTEGRATION_MASTER_KEY" LITELLM_MODE=PRODUCTION \
+  LITELLM_LICENSE="${LITELLM_LICENSE:-}" \
  INTEGRATION_SEED="$INTEGRATION_SEED" \
  INTEGRATION_ORDER_SEED="$INTEGRATION_ORDER_SEED" \
  LITELLM_LOCAL_MODEL_COST_MAP=True AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 \
  INTEGRATION_PROXY_DATABASE_URL="$INTEGRATION_PROXY_DATABASE_URL" \
  INTEGRATION_PROXY_READ_REPLICA_URL="$INTEGRATION_PROXY_READ_REPLICA_URL" \
  INTEGRATION_ROUTING="$INTEGRATION_ROUTING" \
-  .venv/bin/python tests/integration/run.py "$suite" --results "$results"
+  .venv/bin/python tests/integration/run.py "$suite" --results "$results" "${node_files[@]}"

 if [ "${INTEGRATION_COVERAGE:-0}" = 1 ]; then
  for covered_pid in "$proxy_pid" "$peer_pid"; do
--- a/.circleci/scripts/unit_selection.sh
+++ b/.circleci/scripts/unit_selection.sh
@ -46,6 +46,7 @@ legacy_paths() {
      echo tests/unit/google_genai
      echo tests/unit/router_strategy
      echo tests/unit/router_utils
+      echo tests/unit/proxy/common_utils/test_cache_aware_routing.py
      echo tests/unit/enterprise/enterprise_callbacks/send_emails
      echo tests/unit/enterprise/proxy/test_afile_retrieve_returns_unified_id.py
      echo tests/unit/enterprise/proxy/test_batch_retrieve_input_file_id.py
@ -76,6 +77,7 @@ legacy_paths() {
      echo tests/unit/embeddings
      echo tests/unit/endpoints
      echo tests/unit/files
+      echo tests/unit/harness
      echo tests/unit/images
      echo tests/unit/interactions
      echo tests/unit/messages
@ -88,6 +90,7 @@ legacy_paths() {
    proxy-db-auth-checks)
      echo tests/unit/proxy/auth/test_auth_checks.py
      echo tests/unit/proxy/auth/test_user_api_key_auth.py
+      echo tests/unit/proxy/test_credential_slot_registry.py
      echo tests/unit/proxy/test_deprecated_key_grace_period.py ;;
    proxy-db-budgets)
      echo tests/unit/proxy/auth/test_default_end_user_budget_simple.py
@ -105,6 +108,7 @@ legacy_paths() {
      echo tests/unit/proxy/test_update_spend.py
      echo tests/unit/skills/test_skills_db.py ;;
    proxy-db-endpoints-and-responses)
+      echo tests/unit/proxy/lens
      echo tests/unit/proxy/auth/test_models_fallback_endpoint.py
      echo tests/unit/proxy/common_utils/test_check_batch_cost.py
      echo tests/unit/proxy/common_utils/test_check_responses_cost.py
@ -113,7 +117,7 @@ legacy_paths() {
      echo tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py
      echo tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py
      echo tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py
-      echo tests/unit/proxy/response_polling/test_response_polling_handler.py
+      echo tests/unit/proxy/response_polling
      echo tests/unit/proxy/test_custom_tokenizer_bug.py
      echo tests/unit/proxy/test_get_favicon.py
      echo tests/unit/proxy/test_get_image.py
@ -146,7 +150,11 @@ legacy_paths() {
      echo tests/unit/proxy/test_proxy_server.py ;;
    proxy-db-proxy-utils) echo tests/unit/proxy/test_proxy_utils.py ;;
    proxy-extras) echo tests/unit/litellm_proxy_extras ;;
-    proxy-infra) echo tests/unit/gateway ;;
+    proxy-infra)
+      echo tests/unit/gateway
+      echo tests/unit/proxy/management
+      echo tests/unit/proxy/management_endpoints/test_roi_calculator_endpoints.py
+      echo tests/unit/proxy/roi_calculator ;;
    responses-caching-types)
      find tests/unit/responses -name 'test_*.py' -not -path 'tests/unit/responses/mcp/*'
      echo tests/unit/types ;;
--- a/.githooks/commit-msg
+++ b/.githooks/commit-msg
@ -42,7 +42,7 @@ case "$subject" in
        ;;
 esac

-ALLOWED_TYPES="feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert"
+ALLOWED_TYPES="feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert|security"
 # Description must not start with an uppercase letter — kept in sync with the
 # subjectPattern in .github/workflows/conventional-commits.yml so the local
 # hook is the strictly tighter of the two gates. (Without this guard, a commit
@ -61,7 +61,7 @@ cat >&2 <<EOF
  Expected: <type>(<scope>)!: <description>
            (description must start with a lowercase letter)

-  Allowed types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
+  Allowed types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert, security
  Examples:
    feat(router): add weighted round-robin strategy
    fix(bedrock): decouple STS region from aws_region_name
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -1,10 +1,2 @@
-/ui/ @yuneng-berri @ryan-crabbe-berri
-/litellm/proxy/_experimental/out/ @yuneng-berri @ryan-crabbe-berri
-/ui/Dockerfile
-/ui/nginx.conf
-/ui/litellm-dashboard/src/lib/http/schema.d.ts
-/ui/litellm-dashboard/tsconfig.tsbuildinfo
 /model_prices_and_context_window.json @mateo-berri @ryan-crabbe-berri @kerry-berri
 /litellm/model_prices_and_context_window_backup.json @mateo-berri @ryan-crabbe-berri @kerry-berri
-/litellm-proxy-extras/litellm_proxy_extras/migrations/ @yuneng-berri @ryan-crabbe-berri
-/.github/CODEOWNERS @yuneng-berri
--- a/.github/actions/cache-cargo-build/action.yml
+++ b/.github/actions/cache-cargo-build/action.yml
@ -25,6 +25,7 @@ runs:
  using: composite
  steps:
    - name: Restore the Cargo registry and target directory
+      if: github.ref == 'refs/heads/main'
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: |
@ -34,3 +35,15 @@ runs:
        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm-rust/Cargo.lock') }}
        restore-keys: |
          ${{ runner.os }}-maturin-${{ inputs.profile }}-
+
+    - name: Restore the Cargo registry and target directory
+      if: github.ref != 'refs/heads/main'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+          litellm-rust/target
+        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm-rust/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-maturin-${{ inputs.profile }}-
--- a/.github/actions/cache-prisma-binaries/action.yml
+++ b/.github/actions/cache-prisma-binaries/action.yml
@ -30,6 +30,7 @@ runs:
        echo "version=${version}" >> "$GITHUB_OUTPUT"

    - name: Restore Prisma binaries
+      if: github.ref == 'refs/heads/main'
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        # ~/.cache/prisma-python holds the npm install tree prisma-client-py
@ -38,3 +39,12 @@ runs:
          ~/.cache/prisma-python
          ~/.cache/prisma
        key: ${{ runner.os }}-prisma-binaries-${{ steps.version.outputs.version }}
+
+    - name: Restore Prisma binaries
+      if: github.ref != 'refs/heads/main'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: |
+          ~/.cache/prisma-python
+          ~/.cache/prisma
+        key: ${{ runner.os }}-prisma-binaries-${{ steps.version.outputs.version }}
--- a/.github/actions/cache-uv-downloads/action.yml
+++ b/.github/actions/cache-uv-downloads/action.yml
@ -0,0 +1,25 @@
+name: "Cache uv downloads"
+description: >-
+  Restore the uv download cache on every run and save it only from main, so pull
+  requests reuse main's cache instead of evicting it with their own copies.
+
+runs:
+  using: composite
+  steps:
+    - name: Restore and save the uv download cache
+      if: github.ref == 'refs/heads/main'
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ env.UV_CACHE_DIR }}
+        key: ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-${{ hashFiles('uv.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-
+
+    - name: Restore the uv download cache
+      if: github.ref != 'refs/heads/main'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ env.UV_CACHE_DIR }}
+        key: ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-${{ hashFiles('uv.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-
--- a/.github/actions/setup-uv-with-retries/action.yml
+++ b/.github/actions/setup-uv-with-retries/action.yml
@ -17,6 +17,7 @@ runs:
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      with:
        version: ${{ inputs.version }}
+        save-cache: ${{ github.ref == 'refs/heads/main' }}

    - name: Wait before attempt 2
      if: steps.attempt-1.outcome == 'failure'
@ -30,6 +31,7 @@ runs:
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      with:
        version: ${{ inputs.version }}
+        save-cache: ${{ github.ref == 'refs/heads/main' }}

    - name: Wait before attempt 3
      if: steps.attempt-2.outcome == 'failure'
@ -41,3 +43,4 @@ runs:
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      with:
        version: ${{ inputs.version }}
+        save-cache: ${{ github.ref == 'refs/heads/main' }}
--- a/.github/assets/roi-calculator/00-original-setup.png
+++ b/.github/assets/roi-calculator/00-original-setup.png
--- a/.github/assets/roi-calculator/01-connect-github.png
+++ b/.github/assets/roi-calculator/01-connect-github.png
--- a/.github/assets/roi-calculator/02-repositories.png
+++ b/.github/assets/roi-calculator/02-repositories.png
--- a/.github/assets/roi-calculator/03-estimator-schedule.png
+++ b/.github/assets/roi-calculator/03-estimator-schedule.png
--- a/.github/assets/roi-calculator/04-backfill-progress.png
+++ b/.github/assets/roi-calculator/04-backfill-progress.png
--- a/.github/assets/roi-calculator/06-overview.png
+++ b/.github/assets/roi-calculator/06-overview.png
--- a/.github/assets/roi-calculator/07-people-unmatched.png
+++ b/.github/assets/roi-calculator/07-people-unmatched.png
--- a/.github/assets/roi-calculator/08-match-email.png
+++ b/.github/assets/roi-calculator/08-match-email.png
--- a/.github/assets/roi-calculator/09-people-matched.png
+++ b/.github/assets/roi-calculator/09-people-matched.png
--- a/.github/assets/roi-calculator/10-pr-reasoning.png
+++ b/.github/assets/roi-calculator/10-pr-reasoning.png
--- a/.github/assets/roi-calculator/11-settings.png
+++ b/.github/assets/roi-calculator/11-settings.png
--- a/.github/assets/roi-calculator/12-restart-setup.png
+++ b/.github/assets/roi-calculator/12-restart-setup.png
--- a/.github/assets/roi-calculator/13-advanced-settings.png
+++ b/.github/assets/roi-calculator/13-advanced-settings.png
--- a/.github/assets/roi-calculator/14-overview-pulls.png
+++ b/.github/assets/roi-calculator/14-overview-pulls.png
--- a/.github/assets/roi-calculator/15-sample-preview.png
+++ b/.github/assets/roi-calculator/15-sample-preview.png
--- a/.github/assets/roi-calculator/16-calculator-sidebar.png
+++ b/.github/assets/roi-calculator/16-calculator-sidebar.png
--- a/.github/assets/roi-calculator/19-matching-calculator-icons.png
+++ b/.github/assets/roi-calculator/19-matching-calculator-icons.png
--- a/.github/assets/roi-calculator/20-partial-repository-report.png
+++ b/.github/assets/roi-calculator/20-partial-repository-report.png
--- a/.github/assets/roi-calculator/21-empty-repository-preserved-report.png
+++ b/.github/assets/roi-calculator/21-empty-repository-preserved-report.png
--- a/.github/assets/roi-calculator/22-partial-calculation-explanation.png
+++ b/.github/assets/roi-calculator/22-partial-calculation-explanation.png
--- a/.github/assets/roi-calculator/23-estimator-outage-preserved-report.png
+++ b/.github/assets/roi-calculator/23-estimator-outage-preserved-report.png
--- a/.github/ci-coverage-allowlist.yml
+++ b/.github/ci-coverage-allowlist.yml
@ -4,6 +4,14 @@ description: >-
  by a job nor listed here, so every entry below is a decision on the record.

 test_paths:
+  - reason: >-
+      litellm.agent() end-to-end suite. It drives the real claude, codex and opencode CLIs and
+      deepagents against a live LiteLLM AI Gateway, so it needs those binaries on PATH plus
+      LITELLM_PROXY_API_BASE / LITELLM_PROXY_API_KEY, and skips without them. Run manually
+      before changing litellm/harness; the mocked coverage runs in tests/unit/harness and
+      tests/unit/llms/*/harness
+    paths:
+      - tests/harness_e2e
  - reason: >-
      The Rust/Python parity harness is run manually through its local CLI. Recorded replay,
      fixture generation, and harness checks are intentionally outside pull request CI
@ -111,3 +119,10 @@ dockerfiles:
      An example image under cookbook/ that is documentation rather than a shipped artifact
    paths:
      - cookbook/litellm-ollama-docker-image/Dockerfile
+  - reason: >-
+      The Rust gateway image compiles the whole workspace in release mode, which is too slow for
+      a per-pull-request job while the gateway binary is still being assembled; the Rust lint,
+      clippy, and compile jobs already cover the code it packages. Revisit when the gateway is
+      published
+    paths:
+      - litellm-rust/crates/gateway/Dockerfile
--- a/.github/e2e-stack/select_tests.py
+++ b/.github/e2e-stack/select_tests.py
@ -11,6 +11,7 @@ UNSUPPORTED: Final = re.compile(
    r"|^tests/e2e/guardrails/test_presidio_masking_e2e\.py$"
    r"|^tests/e2e/logging/test_otel_v2_langfuse_generation_output_e2e\.py$"
    r"|^tests/e2e/logging/test_langsmith_batch_serialization_e2e\.py$"
+    r"|^tests/e2e/logging/test_s3_log_e2e\.py$"
    r"|^tests/e2e/secret_manager/"
 )
 HARNESS: Final = re.compile(
--- a/.github/merge-smoke-tests.json
+++ b/.github/merge-smoke-tests.json
@ -3,8 +3,8 @@
    "CHAT-JSON": "tests/unit/llms/openai/test_openai.py::test_acompletion_returns_json_reply_over_injected_transport",
    "CHAT-TEXT-STREAM": "tests/unit/llms/openai/test_openai.py::test_acompletion_streams_text_deltas_over_injected_transport",
    "CHAT-TOOL-STREAM": "tests/unit/llms/openai/test_openai.py::test_acompletion_streams_tool_call_arguments_over_injected_transport",
-    "MODEL-ALLOW": "tests/test_litellm/proxy/auth/test_auth_checks.py::test_can_object_call_model_allows_listed_model_for_key",
-    "MODEL-DENY": "tests/test_litellm/proxy/auth/test_auth_checks.py::test_can_object_call_model_denials_return_forbidden[key-key_model_access_denied]",
+    "MODEL-ALLOW": "tests/unit/proxy/auth/test_auth_checks_object_access_and_lookup.py::test_can_object_call_model_allows_listed_model_for_key",
+    "MODEL-DENY": "tests/unit/proxy/auth/test_auth_checks_object_access_and_lookup.py::test_can_object_call_model_denials_return_forbidden[key-key_model_access_denied]",
    "COST-EXPLICIT": "tests/unit/test_cost_calculator.py::test_completion_cost_charges_explicit_per_token_rates_over_registered_ones",
    "COST-ZERO": "tests/unit/test_cost_calculator.py::test_completion_cost_is_zero_when_explicit_rates_are_zero",
    "LOG-CONTENT-ON": "tests/unit/litellm_core_utils/test_litellm_logging.py::test_standard_logging_payload_keeps_message_content_when_message_logging_is_on",
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@ -54,7 +54,7 @@ After: the same request comes back with real token counts, so the dashboard show

 ## Affected release

-<!-- Only for a fix to a regression in a released or rc version (perf, memory, crash, or behavior): name the version it regressed in, e.g. "regression in v1.100.0" or "since v1.101.0-rc.1", and add the `backport-stable` label so the fix is cherry-picked onto the rc line before the stable is tagged. Drop the section otherwise -->
+<!-- Only for a fix to a regression in a released or rc version (perf, memory, crash, or behavior): name the version it regressed in, e.g. "regression in v1.100.0" or "since v1.101.0-rc.1". Add the `backport-stable` label only when the regression is a P0, meaning its Linear ticket is Urgent (a security hole however narrow, data loss, or a crash or outage for every user on that version), because every labeled PR must be cherry-picked onto the baking rc line before the stable can be tagged; every other regression fix ships in the next rc unlabeled. Drop the section otherwise -->

 ## Linear ticket

--- a/.github/scripts/assert_ci_coverage.py
+++ b/.github/scripts/assert_ci_coverage.py
@ -9,6 +9,7 @@ import sys
 import warnings
 from collections.abc import Callable, Iterable, Mapping, Sequence
 from dataclasses import dataclass
+from types import MappingProxyType
 from typing import Final

 import yaml
@ -35,7 +36,7 @@ GLOB_CHARS = frozenset("*?")
 # itself decomposed one level deeper and is checked through its own entry.
 SHARDED_ROOTS: tuple[str, ...] = (
    "tests/test_litellm",
-    "tests/test_litellm/proxy",
+    "tests/unit/proxy",
 )


@ -119,11 +120,48 @@ def _invoked_test_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
    )


-def _unit_selection_tokens(repo_root: pathlib.Path = REPO_ROOT) -> frozenset[str]:
+SELECTION_ARM_RE = re.compile(r"(?ms)^\s*([A-Za-z0-9_|*-]+)\)\s*(.*?);;")
+
+
+def _unit_selection_arms(repo_root: pathlib.Path = REPO_ROOT) -> Mapping[str, frozenset[str]]:
    script: Final = repo_root / ".circleci/scripts/unit_selection.sh"
    if not script.is_file():
-        return frozenset()
-    return frozenset(match.group(0).rstrip("/") for match in TEST_TOKEN_RE.finditer(_uncommented(script.read_text())))
+        return MappingProxyType({})
+    text: Final = _uncommented(script.read_text())
+    return MappingProxyType(
+        {
+            label: frozenset(
+                match.group(0).rstrip("/") for match in TEST_TOKEN_RE.finditer(body)
+            )
+            for label, body in SELECTION_ARM_RE.findall(text)
+        }
+    )
+
+
+def _unit_selection_tokens(repo_root: pathlib.Path = REPO_ROOT) -> frozenset[str]:
+    return frozenset(
+        token for tokens in _unit_selection_arms(repo_root).values() for token in tokens
+    )
+
+
+def _wired_unit_flags(scalars: Iterable[Scalar]) -> frozenset[str]:
+    return frozenset(
+        scalar.value
+        for scalar in scalars
+        if scalar.key == "unit-flag" and "${{" not in scalar.value
+    )
+
+
+def _shard_tokens(
+    scalars: Iterable[Scalar], arms: Mapping[str, frozenset[str]]
+) -> frozenset[str]:
+    wired: Final = _wired_unit_flags(scalars)
+    return _invoked_test_tokens(scalars) | frozenset(
+        token
+        for label, tokens in arms.items()
+        if label in wired
+        for token in tokens
+    )


 def _built_dockerfile_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
@ -480,7 +518,7 @@ def _check_slices() -> int:


 def _check_shards() -> int:
-    findings = _unassigned_shard_children(_invoked_test_tokens(_all_scalars()))
+    findings = _unassigned_shard_children(_shard_tokens(_all_scalars(), _unit_selection_arms()))
    if findings:
        _report(
            "test directories and files that no shard claims",
@ -516,7 +554,7 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
        str(path.relative_to(repo_root))
        for folders in groups.values()
        for folder in folders
-        for path in (integration_root / folder).glob("test_*.py")
+        for path in (integration_root / folder).rglob("test_*.py")
    )
    browser_manifest: Final = repo_root / "tests/e2e/ui/tests/integrationCritical/expected.json"
    browser_nodes: Final = json.loads(browser_manifest.read_text()) if browser_manifest.exists() else ()
--- a/.github/scripts/verify_linux_native_wheel.py
+++ b/.github/scripts/verify_linux_native_wheel.py
@ -214,7 +214,7 @@ def main(
    native_module: Final = load_native_module(native_path)
    native_module_loads: Final = native_module is not None
    panic_test_hook_absent: Final = native_module is not None and not hasattr(native_module, "_panic_for_test")
-    native_size_limit: Final = 40_000_000
+    native_size_limit: Final = 45_000_000
    native_size_within_limit: Final = native_member.file_size <= native_size_limit
    validations: Final = (
        (f"Python tag is {EXPECTED_PYTHON_TAG}", python_tag == EXPECTED_PYTHON_TAG),
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@ -132,12 +132,7 @@ jobs:
      - name: Cache uv dependencies
        if: steps.changes.outputs.decision != 'skip'
        timeout-minutes: 5
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: ${{ env.UV_CACHE_DIR }}
-          key: ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-
+        uses: ./.github/actions/cache-uv-downloads

      - name: Cache the Rust build
        if: steps.changes.outputs.decision != 'skip'
@ -274,7 +269,7 @@ jobs:
      - name: Upload to Codecov
        id: codecov-upload
        continue-on-error: true
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          use_oidc: true
          directory: coverage-reports
@ -285,7 +280,7 @@ jobs:
      - name: Upload to Codecov (retry)
        if: steps.codecov-upload.outcome == 'failure'
        continue-on-error: true
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          use_oidc: true
          directory: coverage-reports
--- a/.github/workflows/conventional-commits.yml
+++ b/.github/workflows/conventional-commits.yml
@ -41,6 +41,7 @@ jobs:
            ci
            chore
            revert
+            security
          requireScope: false
          subjectPattern: ^(?![A-Z]).+$
          subjectPatternError: |
--- a/.github/workflows/create-rc-branch.yml
+++ b/.github/workflows/create-rc-branch.yml
@ -15,6 +15,8 @@ jobs:
    runs-on: ubuntu-latest
    permissions:
      contents: write
+    outputs:
+      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Require main
        env:
@ -64,3 +66,14 @@ jobs:
              sha: context.sha,
            });
            core.info(`Created branch ${branchName} at ${context.sha}`);
+
+  linear-release:
+    name: Move the Linear release to rc
+    needs: create-rc-branch
+    permissions:
+      contents: read
+    uses: ./.github/workflows/linear-release.yml
+    with:
+      rc_version: ${{ needs.create-rc-branch.outputs.version }}
+    secrets:
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
--- a/.github/workflows/lens-worker.yml
+++ b/.github/workflows/lens-worker.yml
@ -0,0 +1,66 @@
+name: Lens Worker Image
+
+on:
+  pull_request:
+    branches: [main, litellm_oss_branch, "litellm_**"]
+    paths:
+      - deploy/lens/**
+      - litellm/proxy/lens/**
+      - .github/workflows/lens-worker.yml
+  push:
+    branches: [main]
+    paths:
+      - deploy/lens/**
+      - litellm/proxy/lens/**
+      - .github/workflows/lens-worker.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lens-worker-image:
+    permissions:
+      contents: read
+      packages: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - name: Build Lens worker
+        run: docker build -f deploy/lens/Dockerfile -t lens-worker:${{ github.sha }} .
+      - name: Verify standalone imports with a read-only filesystem
+        run: |
+          docker run --rm --network none --read-only --cap-drop ALL --tmpfs /tmp:rw,noexec,nosuid,size=1g \
+            --security-opt no-new-privileges --entrypoint python \
+            lens-worker:${{ github.sha }} -c '
+          import os
+          import lens.worker
+          from lens.trace_store import trace_store
+          assert os.getuid() == 65532
+          with trace_store() as store:
+              assert store.count() == 0
+          '
+      - name: Verify recovery after temporary storage fills
+        run: |
+          docker run --rm --network none --read-only --cap-drop ALL \
+            --tmpfs /tmp:rw,noexec,nosuid,size=64k --security-opt no-new-privileges \
+            -v "$PWD/tests/proxy_behavior/lens/worker_storage_smoke.py:/app/storage_smoke.py:ro" \
+            --entrypoint python lens-worker:${{ github.sha }} /app/storage_smoke.py
+      - name: Publish versioned Lens worker
+        if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm'
+        env:
+          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_USER: ${{ github.actor }}
+          IMAGE: ghcr.io/berriai/litellm-lens-worker:sha-${{ github.sha }}
+        run: |
+          printf '%s' "$REGISTRY_TOKEN" | docker login ghcr.io -u "$REGISTRY_USER" --password-stdin
+          docker tag lens-worker:${{ github.sha }} "$IMAGE"
+          docker push "$IMAGE"
+          printf 'Lens worker image: `%s`\n' "$IMAGE" >> "$GITHUB_STEP_SUMMARY"
--- a/.github/workflows/linear-release.yml
+++ b/.github/workflows/linear-release.yml
@ -0,0 +1,131 @@
+name: Linear Release
+
+on:
+  push:
+    branches:
+      - main
+      - "rc/**"
+  release:
+    types: [published]
+  workflow_call:
+    inputs:
+      rc_version:
+        description: "X.Y.0 release whose rc branch was just cut"
+        required: true
+        type: string
+    secrets:
+      LINEAR_API_KEY:
+        required: true
+
+permissions: {}
+
+jobs:
+  linear-release:
+    name: Linear Release
+    if: github.repository == 'BerriAI/litellm'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Plan
+        id: plan
+        env:
+          EVENT: ${{ github.event_name }}
+          REF_NAME: ${{ github.ref_name }}
+          BEFORE: ${{ github.event.before }}
+          CREATED: ${{ github.event.created }}
+          RC_VERSION: ${{ inputs.rc_version }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          set -euo pipefail
+          sync_base="${BEFORE}"
+          if [ "${CREATED}" = "true" ]; then
+            sync_base=""
+          fi
+          if [ -n "${RC_VERSION}" ]; then
+            echo "version=${RC_VERSION}" >> "$GITHUB_OUTPUT"
+            echo "stage=rc" >> "$GITHUB_OUTPUT"
+          elif [ "${EVENT}" = "release" ]; then
+            if [ "${PRERELEASE}" = "true" ] || ! echo "${RELEASE_TAG}" | grep -qE '^v[0-9]+\.[0-9]+\.0$'; then
+              echo "::notice::${RELEASE_TAG} is not an X.Y.0 stable release; nothing to complete"
+              exit 0
+            fi
+            echo "version=${RELEASE_TAG#v}" >> "$GITHUB_OUTPUT"
+            echo "complete=true" >> "$GITHUB_OUTPUT"
+          elif [ "${REF_NAME}" = "main" ]; then
+            version="$(python3 .github/scripts/read_rc_version.py | cut -d= -f2)"
+            status=0
+            git ls-remote --exit-code --heads origin "rc/${version}" > /dev/null || status=$?
+            case "${status}" in
+              0)
+                IFS=. read -r major minor _ <<< "${version}"
+                version="${major}.$((minor + 1)).0"
+                ;;
+              2) ;;
+              *)
+                echo "::error::could not check whether rc/${version} exists (git ls-remote exit ${status})"
+                exit 1
+                ;;
+            esac
+            echo "version=${version}" >> "$GITHUB_OUTPUT"
+            echo "sync_base=${sync_base}" >> "$GITHUB_OUTPUT"
+            echo "main=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "version=${REF_NAME#rc/}" >> "$GITHUB_OUTPUT"
+            echo "sync_base=${sync_base}" >> "$GITHUB_OUTPUT"
+            echo "stage=rc" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Sync commits into the release
+        if: steps.plan.outputs.sync_base != ''
+        uses: linear/linear-release-action@d4af10092984f9bc6d5efa075b242bdf01333463 # v0.18.0
+        with:
+          access_key: ${{ secrets.LINEAR_API_KEY }}
+          command: sync
+          name: LiteLLM ${{ steps.plan.outputs.version }}
+          version: ${{ steps.plan.outputs.version }}
+          base_ref: ${{ steps.plan.outputs.sync_base }}
+          cli_version: v0.18.0
+
+      - name: Keep the main stage unless the rc branch was cut during this run
+        id: main_stage
+        if: steps.plan.outputs.main == 'true'
+        env:
+          VERSION: ${{ steps.plan.outputs.version }}
+        run: |
+          set -euo pipefail
+          status=0
+          git ls-remote --exit-code --heads origin "rc/${VERSION}" > /dev/null || status=$?
+          case "${status}" in
+            0) echo "::notice::rc/${VERSION} was cut during this run; leaving the release in its rc stage" ;;
+            2) echo "stage=main" >> "$GITHUB_OUTPUT" ;;
+            *)
+              echo "::error::could not check whether rc/${VERSION} exists (git ls-remote exit ${status})"
+              exit 1
+              ;;
+          esac
+
+      - name: Move the release to its stage
+        if: steps.plan.outputs.stage != '' || steps.main_stage.outputs.stage != ''
+        uses: linear/linear-release-action@d4af10092984f9bc6d5efa075b242bdf01333463 # v0.18.0
+        with:
+          access_key: ${{ secrets.LINEAR_API_KEY }}
+          command: update
+          stage: ${{ steps.plan.outputs.stage || steps.main_stage.outputs.stage }}
+          version: ${{ steps.plan.outputs.version }}
+          cli_version: v0.18.0
+
+      - name: Complete the release
+        if: steps.plan.outputs.complete == 'true'
+        uses: linear/linear-release-action@d4af10092984f9bc6d5efa075b242bdf01333463 # v0.18.0
+        with:
+          access_key: ${{ secrets.LINEAR_API_KEY }}
+          command: complete
+          version: ${{ steps.plan.outputs.version }}
+          cli_version: v0.18.0
--- a/.github/workflows/mutation-test.yml
+++ b/.github/workflows/mutation-test.yml
@ -44,6 +44,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
+        if: github.ref == 'refs/heads/main'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -53,6 +54,17 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-

+      - name: Cache uv dependencies
+        if: github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
      - name: Cache the Rust build
        uses: ./.github/actions/cache-cargo-build

--- a/.github/workflows/test-code-quality.yml
+++ b/.github/workflows/test-code-quality.yml
@ -44,6 +44,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
+        if: github.ref == 'refs/heads/main'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -53,6 +54,17 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-

+      - name: Cache uv dependencies
+        if: github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
      - name: Cache the Rust build
        uses: ./.github/actions/cache-cargo-build

@ -80,6 +92,11 @@ jobs:
      - name: test_e2e_changed_gate
        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_changed_gate.py tests/code_coverage_tests/test_e2e_idp_stack.py

+      - name: test_e2e_metadata
+        env:
+          PYTHONPATH: tests/e2e
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_metadata.py tests/code_coverage_tests/test_e2e_junit_report.py
+
      - name: Check merge smoke harness
        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_merge_smoke.py

@ -146,6 +163,9 @@ jobs:
      - name: check_migrations_no_data_rewrites
        run: uv run --no-sync python ./tests/code_coverage_tests/check_migrations_no_data_rewrites.py

+      - name: check_unbounded_in_lists (fails on findings not in the baseline)
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_unbounded_in_lists.py
+
      - name: memory_test
        run: uv run --no-sync python ./tests/code_coverage_tests/memory_test.py

--- a/.github/workflows/test-postgres.yml
+++ b/.github/workflows/test-postgres.yml
@ -24,6 +24,7 @@ jobs:
    timeout-minutes: ${{ matrix.job-timeout-minutes }}
    permissions:
      contents: read
+      id-token: write

    services:
      postgres:
@ -94,7 +95,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
+        if: steps.changes.outputs.decision != 'skip' && github.ref == 'refs/heads/main'
        timeout-minutes: 5
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
@ -105,6 +106,18 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-postgres-

+      - name: Cache uv dependencies
+        if: steps.changes.outputs.decision != 'skip' && github.ref != 'refs/heads/main'
+        timeout-minutes: 5
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-postgres-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-postgres-
+
      - name: Install dependencies
        if: steps.changes.outputs.decision != 'skip'
        timeout-minutes: 12
@ -134,9 +147,21 @@ jobs:
        env:
          TEST_PATH: ${{ matrix.test-path }}
          WORKERS: ${{ matrix.workers }}
+          PYTEST_ADDOPTS: ${{ matrix.shard == 'proxy-behavior' && '--cov=./litellm --cov-report=xml:coverage-lens-postgres.xml' || '' }}
        run: |
          if [ "${WORKERS}" = "0" ]; then
            uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10
          else
            uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10 -n "${WORKERS}"
          fi
+
+      - name: Upload Lens database coverage
+        if: steps.changes.outputs.decision != 'skip' && matrix.shard == 'proxy-behavior' && !cancelled()
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          use_oidc: true
+          version: v11.3.1
+          root_dir: ${{ github.workspace }}
+          files: coverage-lens-postgres.xml
+          flags: lens-postgres
+          fail_ci_if_error: true
--- a/.github/workflows/test-redis-compat.yml
+++ b/.github/workflows/test-redis-compat.yml
@ -98,7 +98,7 @@ jobs:

      - name: Upload Redis coverage
        if: matrix.redis-version == '5.3.1'
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          use_oidc: true
          files: coverage-redis.xml
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@ -83,6 +83,7 @@ jobs:
        with:
          workspaces: litellm-rust
          cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/main' }}

      - run: cargo clippy --workspace --all-targets --locked -- -D warnings

@ -121,6 +122,7 @@ jobs:
        with:
          workspaces: litellm-rust
          cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/main' }}

      - run: cargo nextest run --workspace --locked

@ -162,6 +164,7 @@ jobs:
        with:
          workspaces: litellm-rust
          cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/main' }}

      - run: uv build --wheel --out-dir dist

--- a/.github/workflows/test-terraform-provider.yml
+++ b/.github/workflows/test-terraform-provider.yml
@ -77,6 +77,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
+        if: github.ref == 'refs/heads/main'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -86,6 +87,17 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-

+      - name: Cache uv dependencies
+        if: github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
      - name: Cache the Rust build
        uses: ./.github/actions/cache-cargo-build

--- a/.github/workflows/test-unit-documentation.yml
+++ b/.github/workflows/test-unit-documentation.yml
@ -54,7 +54,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
+        if: steps.changes.outputs.decision != 'skip' && github.ref == 'refs/heads/main'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -64,6 +64,17 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-

+      - name: Cache uv dependencies
+        if: steps.changes.outputs.decision != 'skip' && github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
      - name: Cache the Rust build
        if: steps.changes.outputs.decision != 'skip'
        uses: ./.github/actions/cache-cargo-build
--- a/.github/workflows/test-unit.yml
+++ b/.github/workflows/test-unit.yml
@ -79,7 +79,9 @@ jobs:

          - shard: integrations
            artifact-name: integrations
-            test-path: ""
+            test-path: >-
+              tests/test_litellm/integrations
+              tests/test_litellm/tracing
            unit-flag: integrations
            workers: 2
            reruns: 3
@ -117,10 +119,19 @@ jobs:
          - shard: proxy-auth
            artifact-name: proxy-auth
            test-path: >-
-              tests/test_litellm/proxy/auth
-              tests/test_litellm/proxy/hooks
-              tests/test_litellm/proxy/policy_engine
-              tests/test_litellm/proxy/client
+              tests/unit/proxy/auth
+              tests/unit/proxy/hooks
+              tests/unit/proxy/policy_engine
+              tests/unit/proxy/client
+              --ignore=tests/unit/proxy/auth/test_auth_checks.py
+              --ignore=tests/unit/proxy/auth/test_user_api_key_auth.py
+              --ignore=tests/unit/proxy/auth/test_default_end_user_budget_simple.py
+              --ignore=tests/unit/proxy/auth/test_jwt.py
+              --ignore=tests/unit/proxy/auth/test_models_fallback_endpoint.py
+              --ignore=tests/unit/proxy/auth/test_multipart_bypass_repro.py
+              --ignore=tests/unit/proxy/auth/test_proxy_routes.py
+              --ignore=tests/unit/proxy/hooks/test_banned_keyword_list.py
+              --ignore=tests/unit/proxy/hooks/test_unit_test_max_model_budget_limiter.py
            workers: 2
            reruns: 2
            timeout-minutes: 20
@ -129,38 +140,46 @@ jobs:
          - shard: proxy-endpoints
            artifact-name: proxy-endpoints
            test-path: >-
-              tests/test_litellm/proxy/analytics_endpoints
-              tests/test_litellm/proxy/management_endpoints
-              tests/test_litellm/proxy/list_api
-              tests/test_litellm/proxy/memory
-              tests/test_litellm/proxy/guardrails
-              tests/test_litellm/proxy/management_helpers
-              tests/test_litellm/proxy/anthropic_endpoints
-              tests/test_litellm/proxy/google_endpoints
-              tests/test_litellm/proxy/openai_files_endpoint
-              tests/test_litellm/proxy/batches_endpoints
-              tests/test_litellm/proxy/container_endpoints
-              tests/test_litellm/proxy/fine_tuning_endpoints
-              tests/test_litellm/proxy/vector_store_files_endpoints
-              tests/test_litellm/proxy/video_endpoints
-              tests/test_litellm/proxy/response_api_endpoints
-              tests/test_litellm/proxy/image_endpoints
-              tests/test_litellm/proxy/ocr_endpoints
-              tests/test_litellm/proxy/vector_store_endpoints
-              tests/test_litellm/proxy/agent_endpoints
-              tests/test_litellm/proxy/a2a
-              tests/test_litellm/proxy/credential_endpoints
-              tests/test_litellm/proxy/discovery_endpoints
-              tests/test_litellm/proxy/health_endpoints
-              tests/test_litellm/proxy/shutdown
-              tests/test_litellm/proxy/public_endpoints
-              tests/test_litellm/proxy/prompts
-              tests/test_litellm/proxy/rag_endpoints
-              tests/test_litellm/proxy/rerank_endpoints
-              tests/test_litellm/proxy/realtime_endpoints
-              tests/test_litellm/proxy/ui_crud_endpoints
-              tests/test_litellm/proxy/config_resolvers
-              tests/test_litellm/proxy/utils
+              tests/unit/proxy/analytics_endpoints
+              tests/unit/proxy/management_endpoints
+              tests/unit/proxy/list_api
+              tests/unit/proxy/memory
+              tests/unit/proxy/guardrails
+              tests/unit/proxy/management_helpers
+              --ignore=tests/unit/proxy/management_endpoints/test_jwt_key_mapping.py
+              --ignore=tests/unit/proxy/management_endpoints/test_key_generate_prisma.py
+              --ignore=tests/unit/proxy/management_endpoints/test_roi_calculator_endpoints.py
+              --ignore=tests/unit/proxy/management_helpers/test_audit_logs_proxy.py
+              --ignore=tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py
+              --ignore=tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py
+              --ignore=tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py
+              --ignore=tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py
+              tests/unit/proxy/anthropic_endpoints
+              tests/unit/proxy/google_endpoints
+              tests/unit/proxy/openai_files_endpoint
+              tests/unit/proxy/batches_endpoints
+              tests/unit/proxy/container_endpoints
+              tests/unit/proxy/fine_tuning_endpoints
+              tests/unit/proxy/vector_store_files_endpoints
+              tests/unit/proxy/video_endpoints
+              tests/unit/proxy/response_api_endpoints
+              tests/unit/proxy/image_endpoints
+              tests/unit/proxy/ocr_endpoints
+              tests/unit/proxy/vector_store_endpoints
+              tests/unit/proxy/agent_endpoints
+              tests/unit/proxy/a2a
+              tests/unit/proxy/credential_endpoints
+              tests/unit/proxy/discovery_endpoints
+              tests/unit/proxy/health_endpoints
+              tests/unit/proxy/shutdown
+              tests/unit/proxy/public_endpoints
+              tests/unit/proxy/prompts
+              tests/unit/proxy/rag_endpoints
+              tests/unit/proxy/rerank_endpoints
+              tests/unit/proxy/realtime_endpoints
+              tests/unit/proxy/ui_crud_endpoints
+              tests/unit/proxy/config_resolvers
+              tests/unit/proxy/utils
            workers: 4
            reruns: 2
            timeout-minutes: 20
@ -168,7 +187,7 @@ jobs:

          - shard: proxy-server
            artifact-name: proxy-server
-            test-path: "tests/test_litellm/proxy/proxy_server"
+            test-path: "tests/unit/proxy/proxy_server"
            workers: 4
            reruns: 2
            timeout-minutes: 60
@ -177,23 +196,66 @@ jobs:
          - shard: proxy-infra
            artifact-name: proxy-infra
            test-path: >-
-              tests/test_litellm/proxy/db
-              tests/test_litellm/proxy/middleware
-              tests/test_litellm/proxy/spend_tracking
-              tests/test_litellm/proxy/pass_through_endpoints
-              tests/test_litellm/proxy/_experimental
-              tests/test_litellm/proxy/experimental
-              tests/test_litellm/proxy/common_utils
-              tests/test_litellm/proxy/enterprise_billing
-              tests/test_litellm/proxy/types_utils
-              tests/test_litellm/proxy/logging_endpoints
-              tests/test_litellm/proxy/test_*.py
+              tests/unit/proxy/db
+              --ignore=tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py
+              --ignore=tests/unit/proxy/db/test_update_daily_tag_spend.py
+              tests/unit/proxy/middleware
+              --ignore=tests/unit/proxy/middleware/test_request_size_limit_middleware.py
+              tests/unit/proxy/spend_tracking
+              --ignore=tests/unit/proxy/spend_tracking/test_search_api_logging.py
+              tests/unit/proxy/pass_through_endpoints
+              tests/unit/proxy/_experimental
+              --ignore=tests/unit/proxy/_experimental/mcp_server
+              tests/unit/proxy/experimental
+              tests/unit/proxy/common_utils
+              --ignore=tests/unit/proxy/common_utils/test_cache_aware_routing.py
+              --ignore=tests/unit/proxy/common_utils/test_check_batch_cost.py
+              --ignore=tests/unit/proxy/common_utils/test_check_responses_cost.py
+              --ignore=tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py
+              --ignore=tests/unit/proxy/common_utils/test_realtime_cache.py
+              tests/unit/proxy/enterprise_billing
+              tests/unit/proxy/types_utils
+              tests/unit/proxy/logging_endpoints
            unit-flag: proxy-infra
            workers: 4
            reruns: 2
            timeout-minutes: 20
            job-timeout-minutes: 60

+          - shard: proxy-infra-root
+            artifact-name: proxy-infra-root
+            test-path: >-
+              tests/unit/proxy/test_*.py
+              --ignore=tests/unit/proxy/test_aproxy_startup.py
+              --ignore=tests/unit/proxy/test_credential_slot_registry.py
+              --ignore=tests/unit/proxy/test_custom_callback_input.py
+              --ignore=tests/unit/proxy/test_custom_logger_s3_gcs.py
+              --ignore=tests/unit/proxy/test_custom_tokenizer_bug.py
+              --ignore=tests/unit/proxy/test_db_schema_changes.py
+              --ignore=tests/unit/proxy/test_deprecated_key_grace_period.py
+              --ignore=tests/unit/proxy/test_get_favicon.py
+              --ignore=tests/unit/proxy/test_get_image.py
+              --ignore=tests/unit/proxy/test_prisma_client_backoff_retry.py
+              --ignore=tests/unit/proxy/test_prompt_test_endpoint.py
+              --ignore=tests/unit/proxy/test_proxy_config_unit_test.py
+              --ignore=tests/unit/proxy/test_proxy_custom_auth.py
+              --ignore=tests/unit/proxy/test_proxy_reject_logging.py
+              --ignore=tests/unit/proxy/test_proxy_server.py
+              --ignore=tests/unit/proxy/test_proxy_setting_guardrails.py
+              --ignore=tests/unit/proxy/test_proxy_token_counter.py
+              --ignore=tests/unit/proxy/test_proxy_utils.py
+              --ignore=tests/unit/proxy/test_reducto_ocr_route.py
+              --ignore=tests/unit/proxy/test_response_polling_pre_call_checks.py
+              --ignore=tests/unit/proxy/test_server_root_path.py
+              --ignore=tests/unit/proxy/test_ui_path_detection.py
+              --ignore=tests/unit/proxy/test_unit_test_proxy_hooks.py
+              --ignore=tests/unit/proxy/test_update_spend.py
+              --ignore=tests/unit/proxy/test_zero_cost_model_budget_bypass.py
+            workers: 4
+            reruns: 2
+            timeout-minutes: 20
+            job-timeout-minutes: 60
+
          - shard: caching-local
            artifact-name: caching-local
            test-path: ""
--- a/.gitignore
+++ b/.gitignore
@ -104,7 +104,7 @@ litellm_config.yaml
 .cursor
 litellm/proxy/to_delete_loadtest_work/*
 update_model_cost_map.py
-tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
 scripts/test_vertex_ai_search.py
 LAZY_LOADING_IMPROVEMENTS.md
 STABILIZATION_TODO.md
--- a/AGENTS.md
+++ b/AGENTS.md
@ -62,7 +62,7 @@ Never edit or commit `ruff-strict-budget.json`, `type-discipline-budget.json`, `

 If you're trying to create a new function that relies on untyped stuff, instead of adding more Any's and pushing `reportAny` / `reportExplicitAny` closer to their basedpyright ceilings, just validate it in the caller with Pydantic (a model or `TypeAdapter` that returns the typed thing or raises will do) and then pass the now typed variable in

-If you get an LIT001 or LIT002 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `MappingProxyType()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally, `# mutable-ok` is never used; reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason
+If you get an LIT001 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `MappingProxyType()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally, `# mutable-ok` is never used; reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason

 Every lint or type suppression must name the exact rule inside brackets and carry a reason comment, e.g. `# pyright: ignore[reportArgumentType]  # stubs lack async overload` or `# noqa: TID251  # <reason>`. `# type: ignore` is banned (LIT009): pyrightconfig.json sets `enableTypeIgnoreComments` to false, so it silently does nothing

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -98,7 +98,7 @@ Add your tests to the [`tests/unit/` directory](https://github.com/BerriAI/litel

 The `tests/unit/` directory follows the same structure as `litellm/`:

- `litellm/proxy/caching_routes.py` → `tests/test_litellm/proxy/test_caching_routes.py`
+- `litellm/proxy/caching_routes.py` → `tests/unit/proxy/test_caching_routes.py`
 - `litellm/utils.py` → `tests/unit/test_utils.py`

 ### Example Test
@ -136,7 +136,7 @@ If you're running broader test suites, proxy tests, or anything that touches Pos
 make install-test-deps
 ```

-This syncs the locked test environment used across the repo, including `psycopg` v3 plus `psycopg-binary` (used by `pytest-postgresql`), `psycopg2-binary` (used by some proxy E2E tests), and a generated Prisma client for DB-backed proxy tests, so pytest startup matches CI without manual package installs.
+This syncs the locked test environment used across the repo, including `psycopg` v3 plus `psycopg-binary`, `psycopg2-binary` (used by some proxy E2E tests), and a generated Prisma client for DB-backed proxy tests, so pytest startup matches CI without manual package installs.

 ### Running Linting and Formatting Checks

--- a/18
+++ b/18
@ -1,10 +1,10 @@
 # LiteLLM Makefile
 # Simple Makefile for running tests and basic development tasks

-.PHONY: help test test-unit test-unit-llms test-unit-proxy-guardrails test-unit-proxy-core test-unit-proxy-misc \
+.PHONY: help test test-unit test-unit-llms test-unit-proxy-guardrails test-unit-proxy-core test-unit-proxy-misc test-unit-proxy-root \
 	test-unit-integrations test-unit-core-utils test-unit-other test-unit-root \
 	test-proxy-unit-a test-proxy-unit-b test-integration test-unit-helm \
-	test-rust-extension \
+	test-rust-extension rust-sqlx-prepare \
 	info lint lint-inner lint-dev lint-checks format \
 	lint-basedpyright lint-e2e-basedpyright lint-basedpyright-budget-update lint-type-discipline lint-type-discipline-budget-update \
 	lint-ruff-budget lint-ruff-budget-update lint-budget-update lint-gate \
@ -47,6 +47,7 @@ help:
 	@echo "  make test-unit-proxy-guardrails - Run proxy guardrails+mgmt tests (~51 files)"
 	@echo "  make test-unit-proxy-core - Run proxy auth+client+db+hooks tests (~52 files)"
 	@echo "  make test-unit-proxy-misc - Run proxy misc tests (~77 files)"
+	@echo "  make test-unit-proxy-root - Run proxy root-file tests (tests/unit/proxy/test_*.py)"
 	@echo "  make test-unit-integrations - Run integration tests (~60 files)"
 	@echo "  make test-unit-core-utils - Run core utils tests (~32 files)"
 	@echo "  make test-unit-other    - Run other tests (caching, responses, etc., ~69 files)"
@ -56,6 +57,7 @@ help:
 	@echo "  make test-integration   - Run integration tests"
 	@echo "  make test-unit-helm     - Run helm unit tests"
 	@echo "  make test-rust-extension - Build the Rust extension and run its public Python tests"
+	@echo "  make rust-sqlx-prepare  - Refresh litellm-rust/crates/db/.sqlx against a migrated Postgres container"
 	@echo ""
 	@echo "Heavy targets (check, lint) queue for LITELLM_GATE_SLOTS machine-wide"
 	@echo "slots (default 2; 0 disables) so parallel sessions don't thrash one machine."
@ -306,6 +308,9 @@ test-rust-extension:
 	LITELLM_RUST=1 LITELLM_LOCAL_MODEL_COST_MAP=True \
 	"$$temporary/venv/bin/python" -I -m pytest --import-mode=importlib -m requires_rust_extension tests/test_litellm_rust

+rust-sqlx-prepare:
+	cd litellm-rust && cargo run -p litellm-db-testing --bin sqlx-prepare
+
 test: install-test-deps
 	$(UV_RUN) pytest tests/

@ -317,13 +322,16 @@ test-unit-llms: install-test-deps
 	$(UV_RUN) pytest tests/unit/llms --tb=short -vv -n 4 --durations=20

 test-unit-proxy-guardrails: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/proxy/guardrails tests/unit/proxy/management_endpoints tests/unit/proxy/management_helpers --tb=short -vv -n 4 --durations=20

 test-unit-proxy-core: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/proxy/auth tests/unit/proxy/client tests/unit/proxy/db tests/unit/proxy/hooks tests/unit/proxy/policy_engine --ignore=tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py --ignore=tests/unit/proxy/db/test_update_daily_tag_spend.py --tb=short -vv -n 4 --durations=20

 test-unit-proxy-misc: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/shutdown tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/proxy/agent_endpoints tests/unit/proxy/anthropic_endpoints tests/unit/proxy/common_utils --ignore=tests/unit/proxy/common_utils/test_cache_aware_routing.py --ignore=tests/unit/proxy/common_utils/test_check_batch_cost.py --ignore=tests/unit/proxy/common_utils/test_check_responses_cost.py --ignore=tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py --ignore=tests/unit/proxy/common_utils/test_realtime_cache.py tests/unit/proxy/discovery_endpoints tests/unit/proxy/experimental tests/unit/proxy/google_endpoints tests/unit/proxy/health_endpoints tests/unit/proxy/image_endpoints tests/unit/proxy/middleware --ignore=tests/unit/proxy/middleware/test_request_size_limit_middleware.py tests/unit/proxy/openai_files_endpoint tests/unit/proxy/pass_through_endpoints tests/unit/proxy/prompts tests/unit/proxy/public_endpoints tests/unit/proxy/response_api_endpoints tests/unit/proxy/shutdown tests/unit/proxy/spend_tracking --ignore=tests/unit/proxy/spend_tracking/test_search_api_logging.py tests/unit/proxy/ui_crud_endpoints tests/unit/proxy/vector_store_endpoints tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py --ignore=tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py --ignore=tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py --ignore=tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py --ignore=tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py --tb=short -vv -n 4 --durations=20
+
+test-unit-proxy-root: install-test-deps
+	$(UV_RUN) pytest tests/unit/proxy/test_*.py --ignore=tests/unit/proxy/test_aproxy_startup.py --ignore=tests/unit/proxy/test_credential_slot_registry.py --ignore=tests/unit/proxy/test_custom_callback_input.py --ignore=tests/unit/proxy/test_custom_logger_s3_gcs.py --ignore=tests/unit/proxy/test_custom_tokenizer_bug.py --ignore=tests/unit/proxy/test_db_schema_changes.py --ignore=tests/unit/proxy/test_deprecated_key_grace_period.py --ignore=tests/unit/proxy/test_get_favicon.py --ignore=tests/unit/proxy/test_get_image.py --ignore=tests/unit/proxy/test_prisma_client_backoff_retry.py --ignore=tests/unit/proxy/test_prompt_test_endpoint.py --ignore=tests/unit/proxy/test_proxy_config_unit_test.py --ignore=tests/unit/proxy/test_proxy_custom_auth.py --ignore=tests/unit/proxy/test_proxy_reject_logging.py --ignore=tests/unit/proxy/test_proxy_server.py --ignore=tests/unit/proxy/test_proxy_setting_guardrails.py --ignore=tests/unit/proxy/test_proxy_token_counter.py --ignore=tests/unit/proxy/test_proxy_utils.py --ignore=tests/unit/proxy/test_reducto_ocr_route.py --ignore=tests/unit/proxy/test_response_polling_pre_call_checks.py --ignore=tests/unit/proxy/test_server_root_path.py --ignore=tests/unit/proxy/test_ui_path_detection.py --ignore=tests/unit/proxy/test_unit_test_proxy_hooks.py --ignore=tests/unit/proxy/test_update_spend.py --ignore=tests/unit/proxy/test_zero_cost_model_budget_bypass.py --tb=short -vv -n 4 --durations=20

 test-unit-integrations: install-test-deps
 	$(UV_RUN) pytest tests/unit/integrations --tb=short -vv -n 4 --durations=20
--- a/README.md
+++ b/README.md
@ -268,6 +268,31 @@ For MCP OAuth, an upstream may advertise dynamic client registration but refuse

 </details>

+<details>
+<summary><b>Agents</b> - Run Claude Code, Codex, OpenCode or Deep Agents on any model (Python SDK)</summary>
+
+### Python SDK - Agents
+
+```python
+import litellm
+from litellm import Harness, sandbox
+
+result = litellm.agent(
+    Harness.CLAUDE_CODE,  # or Harness.CODEX, Harness.OPENCODE, Harness.DEEPAGENTS
+    "Find why tests/test_router.py is flaky and fix it.",
+    sandbox=sandbox.local("./repo"),
+    model="litellm_proxy/claude-sonnet-4-5",  # a model group on your AI Gateway
+)
+
+print(result.text, result.cost, [f.path for f in result.files])
+```
+
+Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call the agent makes goes through your AI Gateway, tagged `harness,claude_code`. Drop the `litellm_proxy/` prefix to call a provider directly. Install `starlette uvicorn` plus the agent's CLI (`claude`, `codex` or `opencode`), or `deepagents langchain-litellm` for Deep Agents.
+
+[**Docs: Agent Harnesses**](https://docs.litellm.ai/docs/harness)
+
+</details>
+
 ### Supported Providers ([Website Supported Models](https://models.litellm.ai/) | [Docs](https://docs.litellm.ai/docs/providers))

 | Provider                                                                            | `/chat/completions` | `/messages` | `/responses` | `/embeddings` | `/image/generations` | `/audio/transcriptions` | `/audio/speech` | `/moderations` | `/batches` | `/rerank` |
--- a/backend/routes/allowlist.py
+++ b/backend/routes/allowlist.py
@ -81,6 +81,8 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    # Spend / analytics
    "/spend/",
    "/analytics/",
+    "/lens/",
+    "/v1/traces",
    "/global/",
    "/user_agent",
    "/usage/",
@ -144,6 +146,7 @@ BACKEND_EXACT_PATHS: frozenset[str] = frozenset(
    {
        "/",
        "/routes",
+        "/lens",
        "/openapi.json",
        "/docs",
        "/docs/oauth2-redirect",
--- a/basedpyright-code-budget.json
+++ b/basedpyright-code-budget.json
@ -99,7 +99,7 @@
    "limit": 0
  },
  "reportUnknownArgumentType": {
-    "limit": 44358
+    "limit": 44802
  },
  "reportUnknownLambdaType": {
    "limit": 109
--- a/cookbook/misc/config.yaml
+++ b/cookbook/misc/config.yaml
@ -24,7 +24,7 @@ model_list:
  - model_name: sagemaker-completion-model
    litellm_params:
      model: sagemaker/berri-benchmarking-Llama-2-70b-chat-hf-4
-      input_cost_per_second: 0.000420  
+      cost_per_second: 0.000420
  - model_name: text-embedding-ada-002
    litellm_params: 
      model: azure/azure-embedding-model
--- a/cookbook/misc/test_responses_api.py
+++ b/cookbook/misc/test_responses_api.py
@ -12,7 +12,7 @@ def encode_image(image_path):


 # Path to your image
-image_path = "litellm/proxy/logo.jpg"
+image_path = "litellm/proxy/logo.png"

 # Getting the Base64 string
 base64_image = encode_image(image_path)
@ -27,7 +27,7 @@ response = client.responses.create(
                {"type": "input_text", "text": "what color is the image"},
                {
                    "type": "input_image",
-                    "image_url": f"data:image/jpeg;base64,{base64_image}",
+                    "image_url": f"data:image/png;base64,{base64_image}",
                },
            ],
        }
--- a/deploy/lens/Dockerfile
+++ b/deploy/lens/Dockerfile
@ -0,0 +1,6 @@
+FROM python:3.12-slim
+WORKDIR /app
+RUN pip install --no-cache-dir httpx==0.28.1 pydantic==2.11.7
+COPY litellm/proxy/lens/__init__.py litellm/proxy/lens/models.py litellm/proxy/lens/trace_store.py litellm/proxy/lens/analysis.py litellm/proxy/lens/worker.py /app/lens/
+USER 65532:65532
+CMD ["python", "-m", "lens.worker"]
--- a/deploy/lens/Dockerfile.dockerignore
+++ b/deploy/lens/Dockerfile.dockerignore
@ -0,0 +1,8 @@
+**
+!litellm/
+!litellm/proxy/
+!litellm/proxy/lens/
+!litellm/proxy/lens/__init__.py
+!litellm/proxy/lens/models.py
+!litellm/proxy/lens/analysis.py
+!litellm/proxy/lens/worker.py
--- a/deploy/lens/README.md
+++ b/deploy/lens/README.md
@ -0,0 +1,117 @@
+# Lens worker
+
+Lens reviews recorded activity and saves evidence-linked findings in the LiteLLM dashboard under Observability, Lens (`/ui/lens/`)
+
+## Start a worker
+
+Upgrade your existing LiteLLM proxy to a release that includes Lens with PostgreSQL, agent tracing (`general_settings.tracing: {store: clickhouse}`), and ClickHouse configured through `CLICKHOUSE_URL` and a separate SELECT-only `CLICKHOUSE_READER_URL`. Enable the ClickHouse callback and request/response logging to analyze LLM requests. Lens can only inspect content you actually retain
+
+In Lens, click **Set up analysis**, choose an existing virtual key or **Create worker key**, then **Generate setup command**. The LiteLLM address is filled in for you; change it only if the server running Docker needs a different network address. Copy the command and run it on your server. The dialog changes to **Analyzer connected** when the container checks in
+
+The command already contains the compatible worker image and one worker token. The selected virtual key stays on the proxy; its secret is never sent to the worker. No source checkout, environment file, or second LiteLLM deployment is needed. Keep the command private because it includes the token. The LiteLLM release provides the dashboard and APIs; the container only runs background analysis
+
+The dashboard and Compose file pin a verified worker image by digest. The image uses Linux amd64, and the generated command selects that platform. Worker image releases are independent of proxy releases: update the pinned image when changing their API contract. CI also publishes immutable commit tags for reproducible builds
+
+For deployments managed with Compose, download `compose.yaml` and provide `LITELLM_URL` and `LENS_WORKER_TOKEN` in an environment file. Its default image is already selected:
+
+```bash
+docker compose --env-file /path/to/lens.env -f compose.yaml up -d
+```
+
+Developers can build locally with `LENS_WORKER_IMAGE=litellm-lens-worker:local docker compose -f deploy/lens/compose.yaml -f deploy/lens/compose.build.yaml up -d --build`
+
+The generated command gives the worker 1 GiB of temporary memory-backed storage, shared across parallel reviews. Change `size=1g` in the Docker command or set `LENS_WORKER_TMP_SIZE` with Compose to fit your server and workload. A storage failure marks the scan as failed, cleans up temporary traces, and leaves the worker available for other scans; it does not silently truncate the review. Existing workers must be recreated with the new image and mount options
+
+The worker needs outbound HTTPS access to LiteLLM. It needs no inbound ports, provider keys, direct database access, or GPU. The proxy calls your selected model through its normal virtual-key authorization and inference pipeline; trace content reaches that model provider. Use a model with JSON output support and known token prices. One worker handles one scan at a time and can serve multiple lenses. For more throughput, start another worker with a separate credential
+
+If your deployment restricts `allowed_ips`, allow the worker's address. For workers behind a reverse proxy with `use_x_forwarded_for: true`, also configure `mcp_trusted_proxy_ranges` with that proxy's CIDRs and, when needed, `mcp_xff_num_trusted_hops`. Lens reuses these existing trusted-proxy settings. Forwarded addresses without an established trust boundary are rejected by the allowlist; accepting them would let a worker impersonate an allowed address
+
+V1 setup, manual runs, feedback, and worker credentials are restricted to proxy administrators. Proxy-admin viewers can inspect results. Regular user and team keys cannot access the Lens API. Worker credentials can serve the administrator’s lenses. Revoke it in the connection dialog when retiring a worker. Redeploy the worker alongside proxy upgrades so their API versions match
+
+## Configure a lens
+
+Choose agent runs, individual LLM requests, or both. The matching-activity preview updates as you choose an application (the recorded OpenTelemetry service.name) or, for request activity, a LiteLLM model group and add metadata conditions. It shows run names, timestamps, and trace IDs; open a run to inspect its original steps before starting analysis. Suggestions come from up to 100 recent executions and may not include every recorded attribute. You can enter other exact keys and values. Leave service and filters blank for all activity your account can access. Filters are exact key/value matches, combined with AND. Trace filters match span or resource attributes on the same span. Request filters match logged metadata, including caller metadata stored under `requester_metadata`; `tag=value` matches request tags. `swarm=research` works only if your instrumentation records that attribute
+
+Describe how the agent should behave and optionally add specific checks. Select the lookback window, team and metadata, then choose the percentage to review and an optional maximum. **100% with no maximum selects every matching run**. The preview pages through all matching activity and lets you select particular runs. Percentage sampling uses a stable hash order, rounds up, and applies the optional maximum after the percentage
+
+Choose your analysis model, parallelism and monthly budget. Parallelism controls simultaneous model calls, not the number of runs selected. New lenses run once by default. Turn on monitoring to repeat the same setup at a custom interval. **Run now** uses the same saved settings immediately, including the same lookback window and sampling. Every scan recalculates the window, so overlapping windows can review the same activity again. Duplicate a lens when you want a separate investigation without changing an existing monitor
+
+Pausing stops future scheduled scans; cancel the active scan separately if needed. The worker polls every 10 seconds; creating a lens or clicking Run now queues a scan, and due schedules are queued when the worker polls. Scans for the same lens never overlap, and its next interval starts after completion. Closing the browser does not stop the worker. Configuration edits apply to the next scan. A running scan retains its settings and selected execution IDs across retries
+
+## Read the results
+
+Needs attention shows issues, highest priority first. Patterns contains useful trends and successful behavior that may not need a fix. Each finding starts with a short explanation and a next step when useful. Expand the limitations for uncertainty and counterexamples. Evidence is grouped by run and collapsed until you need it; each quote opens the original step
+
+Use the batch selector or Scans tab to reopen previous results. Each batch keeps its own findings, settings, selected runs, coverage and cost. Older batches created before snapshot support remain available through accumulated findings. The Runs tab lists the selected batch's sample and can filter per-run observations, including runs without an observed issue and runs with insufficient evidence. These observations precede the final evidence investigation. Linked-run counts on findings include cited counterexamples, so they are not failure counts
+
+Choose **This is expected** and explain why to teach later scans about acceptable behavior. Feedback is kept with the lens and included in subsequent reviews. It does not alter historical evidence or exempt different problems
+
+## What a scan does
+
+The proxy selects executions received or updated within the configured lookback window, with a two-minute settling period. Older rows without receipt timestamps use execution end time. Overlapping scans do not increment a finding's occurrence count for the same execution ID
+
+A trace is spans sharing a trace ID within one team, not an automatically reconstructed conversation session. Requests are individual LLM calls. When both sources are enabled, requests correlated to a recorded span by response ID are excluded to reduce double counting
+
+The worker reviews the selected executions in parallel. It pages through their recorded spans and gives the first reviewer a catalog, task and outcome excerpts. The reviewer can read more original content to resolve uncertainties. Large catalogs and groups of observations are processed in bounded context windows, with every page available. Grouping retains supporting run IDs in code, so a pattern occurring thousands of times does not require a model to repeat thousands of IDs. Candidate investigators can page through supporting observations, other runs and original evidence
+
+There is no fixed total run, span, candidate or investigation-turn cutoff. Repeated or empty evidence requests stop a stalled investigation. Context windows, the configured budget, available model capacity and recorded evidence still bound practical work. The dashboard reports completed work and gaps. The investigator has no shell, browsing, code-editing or production-action tools
+
+Each model response must match a bounded JSON schema. A malformed response gets one repair attempt through the same budget controls; repeated invalid output fails the scan. Both the worker and proxy validate quoted evidence. Findings retain exact quotes and open the source trace or request. Resolve a finding after a fix, or dismiss it with a reason. A resolved finding reopens when new execution IDs support the same pattern; dismissed findings remain dismissed
+
+Coverage distinguishes eligible, sampled, reviewed, partial, and unassessable executions. Findings describe observations in the sample, not population-wide success rates or proven causes. A root span does not prove that a trace contains every expected span. Long, missing, redacted, or expired content limits the conclusions
+
+## Operations and limits
+
+PostgreSQL stores configurations, findings and all scan history, returned in pages of 50 jobs. Workers claim jobs with optimistic concurrency and a five-minute lease, renewed every 30 seconds. A disconnected job can be reclaimed up to three times. Cancellation stops subsequent work; a model call already in flight may finish and incur cost
+
+Before every model call, Lens reserves a conservative amount against the monthly lens budget. Successful calls reconcile to reported cost where pricing is available. Interrupted calls retain their reservation because the provider may have charged. A scan stops when the next reservation would exceed the limit, so it can stop with some budget remaining. Both the Lens budget and the selected virtual key’s budgets, model permissions, and rate limits apply. Analysis spend appears under that key in Virtual Keys and normal request logs, with Lens, scan, and worker IDs in request metadata. Analysis prompts and responses are redacted from spend logs; source traces and findings remain available through the administrator-only Lens API. Existing workers need a billing key assigned in **Set up analysis** before they can resume
+
+V1 requires ClickHouse for both sources. It does not reconstruct sessions from unrelated trace IDs, guarantee exhaustive reviews, cache all per-execution observations across scans, or automatically fix agent code. Trace contents can change as late spans arrive, even though a job's selected IDs are fixed. Findings should be reviewed by a person before acting on them
+
+
+## API access
+
+The UI and API use the same scan lifecycle. Authenticate with a proxy administrator credential for writes, or a proxy-admin viewer credential for reads. Worker credentials are only for worker operations
+
+```bash
+curl "$LITELLM_URL/lens" -H "Authorization: Bearer $LITELLM_API_KEY" \
+  -H 'Content-Type: application/json' -d '{
+    "name": "Research quality", "model": "your-model-alias",
+    "context": "Answer the requested question using cited, retrieved evidence.",
+    "source": "traces", "lookback_hours": 24,
+    "sample_percent": 100, "sample_size": null, "concurrency": 8,
+    "enabled": true, "interval_minutes": 1440, "monthly_budget": 50
+  }'
+
+curl "$LITELLM_URL/lens/$LENS_ID/runs" -X POST \
+  -H "Authorization: Bearer $LITELLM_API_KEY" -H 'Content-Type: application/json' -d '{}'
+
+curl "$LITELLM_URL/lens/$LENS_ID/runs?offset=0" -H "Authorization: Bearer $LITELLM_API_KEY"
+curl "$LITELLM_URL/lens/$LENS_ID/runs/$BATCH_ID" -H "Authorization: Bearer $LITELLM_API_KEY"
+```
+
+Creation queues the first batch. Posting to `/lens/{id}/runs` queues another, or returns the existing active batch. The run response contains its ID under `jobs[0].id`. Poll the batch URL for status, findings and assessments. List responses omit large result payloads; request a batch to retrieve them. Supply an optional complete `settings` object on the runs POST for a one-off override; the saved lens stays unchanged. Selection accepts `team_id`, exact `filters`, and opaque `execution_ids` returned by `/lens/preview/sample`. Preview accepts `offset` and `as_of` to keep the time window fixed while paging. Feedback uses `PATCH /lens/{id}/findings/{finding_id}` with `status` and `reason`
+
+## Quality evaluation
+
+Run the checked-in cases against a configured real model. Expected labels are used only for scoring, never passed to the model. Dev and held-out cases include missing outcomes, failed tools, recovery, handoffs, unsupported claims, repeated work, long evidence and prompt injection. The background option adds clean arithmetic traces to test rare-issue discovery at scale; those repeated synthetic cases do not establish accuracy on every production workload
+
+```bash
+python -m tests.proxy_behavior.lens.evaluate --api-base "$LITELLM_URL" \
+  --model your-model-alias --split all --background 1000 --concurrency 16 \
+  --output /tmp/lens-quality.json
+```
+
+Set `LITELLM_API_KEY` privately. This makes paid model calls. Inspect missed and unexpected per-run labels, final findings and coverage; do not equate a passing dataset with guaranteed detection on arbitrary traces
+
+The worker uses temporary disk space for trace content while reviewing it, and removes those files after each review. The Docker command supplies a writable temporary mount while keeping the application filesystem read-only
+
+To check that accepted behavior stays accepted without hiding new problems, run the evaluator with `--dataset tests/proxy_behavior/lens/feedback_cases.json`. Reports include elapsed time, model call count, reported cost when the proxy provides it, missed checks, unexpected checks, and inconclusive candidates
+
+## Upgrading from the original Lens API
+
+The Lens API now uses `/lens` instead of `/engine`, list responses use `lenses`, and worker claims use `lens_id`. Upgrade the proxy and recreate every worker with the image shown by the upgraded dashboard before starting new scans. Update API clients to the new paths and response fields. Old worker images cannot poll the renamed API
+
+Stop workers and let active scans finish before upgrading. Deploy proxy instances together: older proxies cannot use the renamed database tables. The schema migration renames the three Lens tables and the run-history identifier column in place, preserving saved investigations, findings, history, worker credentials, and billing assignments. Existing migration files retain their original names and checksums
+
+Upgrades using `--use_prisma_db_push` stop before schema changes if any legacy Lens table exists, preventing Prisma from dropping saved data. Apply `litellm-proxy-extras/litellm_proxy_extras/migrations/20261001100000_rename_lens/migration.sql` to the configured database schema before retrying. Deployments already using migration history can instead start without `--use_prisma_db_push` to apply the shipped migration normally. Fresh databases and databases already using the renamed tables can continue using database push
--- a/deploy/lens/compose.build.yaml
+++ b/deploy/lens/compose.build.yaml
@ -0,0 +1,6 @@
+services:
+  lens-worker:
+    build:
+      context: ../..
+      dockerfile: deploy/lens/Dockerfile
+    image: litellm-lens-worker:local
--- a/deploy/lens/compose.yaml
+++ b/deploy/lens/compose.yaml
@ -0,0 +1,12 @@
+services:
+  lens-worker:
+    image: ${LENS_WORKER_IMAGE:-ghcr.io/berriai/litellm-lens-worker@sha256:a8e8731d954916594eea462969946b9292fb771681ff515a9fd296b53f856c77}
+    environment:
+      LITELLM_URL: ${LITELLM_URL:?Set the URL reachable from this container}
+      LENS_WORKER_TOKEN: ${LENS_WORKER_TOKEN:?Create a worker credential in the Lens UI}
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=${LENS_WORKER_TMP_SIZE:-1g}
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@ -103,7 +103,7 @@ ENV LITELLM_NON_ROOT=true

 RUN mkdir -p /var/lib/litellm/ui /var/lib/litellm/assets && \
    cp -r /app/litellm/proxy/_experimental/out/. /var/lib/litellm/ui/ && \
-    cp /app/litellm/proxy/logo.jpg /var/lib/litellm/assets/logo.jpg && \
+    cp /app/litellm/proxy/logo.png /var/lib/litellm/assets/logo.png && \
    touch /var/lib/litellm/ui/.litellm_ui_ready

 RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \
--- a/docker/docker-compose.tracing.yml
+++ b/docker/docker-compose.tracing.yml
@ -0,0 +1,62 @@
+name: litellm-tracing
+
+services:
+  litellm:
+    build:
+      context: ..
+      target: runtime
+    command: ["--config", "/app/tracing-config.yaml", "--port", "4000"]
+    environment:
+      LITELLM_MASTER_KEY: local-tracing-master-key
+      LITELLM_SALT_KEY: sk-local-tracing-salt-key
+      DATABASE_URL: postgresql://litellm:litellm@db:5432/litellm
+      STORE_MODEL_IN_DB: "True"
+      CLICKHOUSE_URL: http://default:local-tracing@clickhouse:8123
+      CLICKHOUSE_READER_URL: http://default:local-tracing@clickhouse:8123
+      CLICKHOUSE_DATABASE: litellm
+      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
+    volumes:
+      - ./tracing-config.yaml:/app/tracing-config.yaml:ro
+    ports:
+      - "127.0.0.1:4002:4000"
+    depends_on:
+      db:
+        condition: service_healthy
+      clickhouse:
+        condition: service_healthy
+
+  db:
+    image: postgres:16
+    environment:
+      POSTGRES_DB: litellm
+      POSTGRES_USER: litellm
+      POSTGRES_PASSWORD: litellm
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    ports:
+      - "127.0.0.1:15432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U litellm -d litellm"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  clickhouse:
+    image: clickhouse/clickhouse-server:26.9.6.6
+    environment:
+      CLICKHOUSE_USER: default
+      CLICKHOUSE_PASSWORD: local-tracing
+      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
+    volumes:
+      - clickhouse_data:/var/lib/clickhouse
+    ports:
+      - "127.0.0.1:18123:8123"
+    healthcheck:
+      test: ["CMD", "clickhouse-client", "--user", "default", "--password", "local-tracing", "--query", "SELECT 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+volumes:
+  postgres_data:
+  clickhouse_data:
--- a/docker/tracing-config.yaml
+++ b/docker/tracing-config.yaml
@ -0,0 +1,10 @@
+model_list:
+  - model_name: gpt-6.1-sol
+    litellm_params:
+      model: openai/gpt-6.1-sol
+      api_key: os.environ/OPENAI_API_KEY
+
+general_settings:
+  master_key: os.environ/LITELLM_MASTER_KEY
+  tracing:
+    store: clickhouse
--- a/enterprise/litellm_enterprise/enterprise_callbacks/secret_detection.py
+++ b/enterprise/litellm_enterprise/enterprise_callbacks/secret_detection.py
@ -616,7 +616,7 @@ class _ENTERPRISE_SecretDetection(CustomGuardrail):
            data["prompt"] = self.redact_text(prompt, source="prompt")
            return 1
        if isinstance(prompt, list):
-            data["prompt"] = [  # mutable-ok: data["prompt"] is a list on the wire
+            data["prompt"] = [
                self.redact_text(item, source="prompt")
                if isinstance(item, str) and item
                else item
--- a/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py
+++ b/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py
@ -22,10 +22,8 @@ from litellm._uuid import uuid
 from litellm.proxy._types import *
 from litellm.proxy.auth.auth_checks import delete_cached_project_object
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
-from litellm.proxy.management_endpoints.common_utils import (
-    _is_user_team_admin,  # pyright: ignore[reportPrivateUsage]  # shared owner of team-admin membership
-    _set_object_metadata_field,
-)
+from litellm.proxy.management.teams.access import is_team_admin
+from litellm.proxy.management_endpoints.common_utils import _set_object_metadata_field
 from litellm.proxy.management_endpoints.team_admin_field_permissions import team_admin_may_manage_projects
 from litellm.proxy.management_helpers.utils import (
    management_endpoint_wrapper,
@ -117,7 +115,7 @@ async def _check_user_permission_for_project(
        return False

    team: Final = LiteLLM_TeamTable.model_validate(team_row.model_dump())
-    return _is_user_team_admin(user_api_key_dict, team) or user_api_key_dict.user_id in (team.admins or [])
+    return is_team_admin(user_api_key_dict, team) or user_api_key_dict.user_id in (team.admins or [])


 async def _validate_team_exists(
--- a/enterprise/pyproject.toml
+++ b/enterprise/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-enterprise"
-version = "0.1.71"
+version = "0.1.72"
 description = "Package for LiteLLM Enterprise features"
 readme = "README.md"
 requires-python = ">=3.9"
@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.1.71"
+version = "0.1.72"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-enterprise==",
--- a/gateway/routes/allowlist.py
+++ b/gateway/routes/allowlist.py
@ -73,6 +73,7 @@ GATEWAY_PATH_PREFIXES: tuple[str, ...] = (
    "/v1/containers",
    "/containers",
    "/v1/evals",
+    "/v1/traces",
    "/v1/memory",
    "/queue/chat/",
    # Google data plane (v1beta is the Google AI Studio version)
--- a/litellm-proxy-extras/litellm_proxy_extras/migration_lock.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/migration_lock.py
@ -87,3 +87,21 @@ def migration_lock(database_url: str) -> Generator[MigrationCoordinator, None, N
        f"Timed out waiting for another v2 migration resolver after {wait_seconds}s. "
        f"Check the running migration or increase {MIGRATION_LOCK_TIMEOUT_ENV_VAR}."
    )
+
+
+@contextmanager
+def held_migration_lock(connection: "psycopg.Connection[tuple[object, ...]]") -> Generator[bool, None, None]:
+    """A session-level, non-blocking hold of the migration coordinator lock on an autocommit
+    connection, for DDL that cannot run inside a transaction (`CREATE INDEX CONCURRENTLY`).
+    Yields whether the lock was acquired; a v2 resolver or another migration job's index build
+    holding it yields False. Released on exit."""
+    from psycopg.rows import class_row
+
+    with connection.cursor(row_factory=class_row(_LockResult)) as cursor:
+        row: Final = cursor.execute("SELECT pg_try_advisory_lock(%s) AS acquired", (MIGRATION_LOCK_KEY,)).fetchone()
+    acquired: Final = row is not None and row.acquired
+    try:
+        yield acquired
+    finally:
+        if acquired:
+            connection.execute("SELECT pg_advisory_unlock(%s)", (MIGRATION_LOCK_KEY,))
--- a/litellm-proxy-extras/litellm_proxy_extras/migration_recovery.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/migration_recovery.py
@ -1,4 +1,5 @@
 import hashlib
+import re
 import subprocess
 from collections.abc import Mapping
 from dataclasses import dataclass
@ -156,3 +157,48 @@ def baseline_current_schema(
        "review any feature-specific backfill requirements.",
        len(migrations),
    )
+
+
+_LINE_COMMENT_RE: Final = re.compile(r"--[^\n]*")
+_BLOCK_COMMENT_RE: Final = re.compile(r"/\*.*?\*/", re.DOTALL)
+_NO_OP_STATEMENT_RE: Final = re.compile(r"^\s*SELECT\s+1\s*$", re.IGNORECASE)
+
+
+def is_inert_migration(script: str) -> bool:
+    """Whether a migration file changes nothing: only comments and `SELECT 1`, so
+    applying it can neither repeat nor skip a database change."""
+    stripped: Final = _LINE_COMMENT_RE.sub("", _BLOCK_COMMENT_RE.sub("", script))
+    return all(not part.strip() or _NO_OP_STATEMENT_RE.match(part) for part in stripped.split(";"))
+
+
+def roll_back_failed_inert_migration(coordinator: MigrationCoordinator, schema: str, migration: Path) -> bool:
+    """Roll back the failed ledger row of a migration whose file in this build is inert,
+    so `migrate deploy` applies the inert file on its next pass. The row records an
+    earlier build's attempt at SQL this build no longer ships (an index now built by the
+    migration job), so no database change can be repeated or skipped by replaying
+    the empty file. The caller commits this checkpoint before the next Prisma command.
+    """
+    from psycopg import sql
+
+    if not is_inert_migration(migration.read_text(encoding="utf-8")):
+        return False
+    coordinator.acquire_prisma_lock()
+    records: Final = _migration_records(coordinator.connection, schema, migration)
+    unfinished: Final = tuple(record for record in records if not record.finished)
+    if len(unfinished) != 1:
+        return False
+    result: Final = coordinator.connection.execute(
+        sql.SQL(
+            "UPDATE {} SET rolled_back_at = current_timestamp "
+            "WHERE id = %s AND finished_at IS NULL AND rolled_back_at IS NULL"
+        ).format(sql.Identifier(schema, "_prisma_migrations")),
+        (unfinished[0].id,),
+    )
+    if result.rowcount != 1:
+        raise RuntimeError("Could not roll back the failed inert migration history row; rerun the database setup.")
+    logger.info(
+        "Rolled back the failed history row of %s: this build ships it as an inert migration, "
+        "its index is built by the migration job",
+        migration.parent.name,
+    )
+    return True
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260823000000_add_spend_logs_api_key_starttime_index/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260823000000_add_spend_logs_api_key_starttime_index/migration.sql
@ -1,2 +1,6 @@
-- CreateIndex
-CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogs_api_key_startTime_idx" ON "LiteLLM_SpendLogs"("api_key", "startTime");
+-- The (api_key, startTime) index on LiteLLM_SpendLogs is built after migrate deploy,
+-- through litellm_proxy_extras/request_log_indexes.py: concurrently on a plain table and
+-- per partition on a partitioned one. The migration job builds it; a serving proxy that
+-- ran the migrations itself builds it in the background once it serves. A migration
+-- cannot do either without blocking spend-log writes or failing on a partitioned table.
+SELECT 1;
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260831120001_spend_logs_litellm_call_id_index/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260831120001_spend_logs_litellm_call_id_index/migration.sql
@ -1,12 +1,6 @@
-- CreateIndex (CONCURRENTLY)
--
-- Disclaimer:
-- - CREATE INDEX CONCURRENTLY cannot run inside a transaction. This migration must stay a
--   single statement so Prisma Migrate on PostgreSQL can apply it outside a transaction.
-- - Builds are slower and use more I/O than a blocking CREATE INDEX; if the build is
--   interrupted, Postgres may leave an INVALID index that must be dropped and recreated.
-- - Do not edit this file after it has been applied to any database: Prisma checksums
--   migrations; add a new migration instead.
-- - Requires PostgreSQL that supports CONCURRENTLY with IF NOT EXISTS (use a new migration
--   without IF NOT EXISTS if you must support older versions).
-CREATE INDEX CONCURRENTLY IF NOT EXISTS "LiteLLM_SpendLogs_litellm_call_id_idx" ON "LiteLLM_SpendLogs"("litellm_call_id");
+-- The litellm_call_id index on LiteLLM_SpendLogs is built after migrate deploy, through
+-- litellm_proxy_extras/request_log_indexes.py: concurrently on a plain table and per
+-- partition on a partitioned one. The migration job builds it; a serving proxy that ran
+-- the migrations itself builds it in the background once it serves. Postgres refuses
+-- CREATE INDEX CONCURRENTLY on a partitioned parent, so this migration no longer runs it.
+SELECT 1;
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260921190000_agent_identity/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260921190000_agent_identity/migration.sql
@ -0,0 +1,97 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_AgentsTable" ADD COLUMN IF NOT EXISTS "enabled" BOOLEAN NOT NULL DEFAULT true,
+ADD COLUMN IF NOT EXISTS "execution_mode" TEXT NOT NULL DEFAULT 'autonomous',
+ADD COLUMN IF NOT EXISTS "identity_managed" BOOLEAN NOT NULL DEFAULT false;
+
+-- AlterTable
+ALTER TABLE "LiteLLM_SpendLogs" ADD COLUMN IF NOT EXISTS "billing_agent_id" TEXT;
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_AgentIdentity" (
+    "agent_id" TEXT NOT NULL,
+    "active" BOOLEAN NOT NULL DEFAULT true,
+    "provider" TEXT NOT NULL,
+    "issuer" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "service_principal_id" TEXT,
+    "required_roles" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "required_scopes" TEXT[] DEFAULT ARRAY['user_impersonation']::TEXT[],
+    "revision" TEXT NOT NULL,
+    "last_authenticated_at" TIMESTAMP(3),
+
+    CONSTRAINT "LiteLLM_AgentIdentity_pkey" PRIMARY KEY ("agent_id")
+);
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_RetiredAgentIdentity" (
+    "binding_id" TEXT NOT NULL,
+    "agent_id" TEXT,
+    "provider" TEXT NOT NULL,
+    "issuer" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+
+    CONSTRAINT "LiteLLM_RetiredAgentIdentity_pkey" PRIMARY KEY ("binding_id")
+);
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_RetiredAgent" (
+    "original_agent_id" TEXT NOT NULL,
+    "retired_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "LiteLLM_RetiredAgent_pkey" PRIMARY KEY ("original_agent_id")
+);
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_VerifiedSubject" (
+    "subject_id" TEXT NOT NULL,
+    "issuer" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "oid" TEXT NOT NULL,
+    "kind" TEXT NOT NULL DEFAULT 'human',
+    "user_id" TEXT,
+    "verified_via" TEXT NOT NULL DEFAULT 'sso_interactive',
+    "verified_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "LiteLLM_VerifiedSubject_pkey" PRIMARY KEY ("subject_id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_AgentIdentity_provider_tenant_id_client_id_key" ON "LiteLLM_AgentIdentity"("provider", "tenant_id", "client_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_AgentIdentity_issuer_service_principal_id_key" ON "LiteLLM_AgentIdentity"("issuer", "service_principal_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_RetiredAgentIdentity_provider_tenant_id_client_id_key" ON "LiteLLM_RetiredAgentIdentity"("provider", "tenant_id", "client_id");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "LiteLLM_VerifiedSubject_user_id_idx" ON "LiteLLM_VerifiedSubject"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_VerifiedSubject_issuer_tenant_id_oid_key" ON "LiteLLM_VerifiedSubject"("issuer", "tenant_id", "oid");
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_AgentIdentity_agent_id_fkey') THEN
+        ALTER TABLE "LiteLLM_AgentIdentity" ADD CONSTRAINT "LiteLLM_AgentIdentity_agent_id_fkey" FOREIGN KEY ("agent_id") REFERENCES "LiteLLM_AgentsTable"("agent_id") ON DELETE CASCADE ON UPDATE CASCADE;
+    END IF;
+END $$;
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_RetiredAgentIdentity_agent_id_fkey') THEN
+        ALTER TABLE "LiteLLM_RetiredAgentIdentity" ADD CONSTRAINT "LiteLLM_RetiredAgentIdentity_agent_id_fkey" FOREIGN KEY ("agent_id") REFERENCES "LiteLLM_AgentsTable"("agent_id") ON DELETE SET NULL ON UPDATE CASCADE;
+    END IF;
+END $$;
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_VerifiedSubject_user_id_fkey') THEN
+        ALTER TABLE "LiteLLM_VerifiedSubject" ADD CONSTRAINT "LiteLLM_VerifiedSubject_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "LiteLLM_UserTable"("user_id") ON DELETE CASCADE ON UPDATE CASCADE;
+    END IF;
+END $$;
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260925000000_add_mcp_pinned_tools/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260925000000_add_mcp_pinned_tools/migration.sql
@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_MCPServerTable" ADD COLUMN IF NOT EXISTS "pinned_tools" JSONB DEFAULT '{}';
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260928000000_add_daily_model_usage/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260928000000_add_daily_model_usage/migration.sql
@ -0,0 +1,19 @@
+CREATE TABLE IF NOT EXISTS "LiteLLM_DailyModelUsage" (
+    "date" TEXT NOT NULL,
+    "model_group" TEXT NOT NULL,
+    "model" TEXT NOT NULL,
+    "custom_llm_provider" TEXT NOT NULL,
+    "task_type" TEXT NOT NULL,
+    "spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0,
+    "prompt_tokens" BIGINT NOT NULL DEFAULT 0,
+    "completion_tokens" BIGINT NOT NULL DEFAULT 0,
+    "request_count" BIGINT NOT NULL DEFAULT 0,
+    "successful_requests" BIGINT NOT NULL DEFAULT 0,
+    "failed_requests" BIGINT NOT NULL DEFAULT 0,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "LiteLLM_DailyModelUsage_pkey" PRIMARY KEY ("date", "model_group", "model", "custom_llm_provider", "task_type")
+);
+
+CREATE INDEX IF NOT EXISTS "LiteLLM_DailyModelUsage_date_idx" ON "LiteLLM_DailyModelUsage"("date");
+CREATE INDEX IF NOT EXISTS "LiteLLM_DailyModelUsage_model_group_idx" ON "LiteLLM_DailyModelUsage"("model_group");
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260930000000_agent_engine/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260930000000_agent_engine/migration.sql
@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS "LiteLLM_Engine" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "version" INTEGER NOT NULL DEFAULT 0,
+    "data" JSONB NOT NULL
+);
+CREATE TABLE IF NOT EXISTS "LiteLLM_EngineWorker" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "token_hash" TEXT NOT NULL UNIQUE,
+    "data" JSONB NOT NULL
+);
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20261001000000_lens_run_history/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20261001000000_lens_run_history/migration.sql
@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS "LiteLLM_EngineRun" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "engine_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL,
+    "data" JSONB NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "LiteLLM_EngineRun_engine_id_created_at_idx" ON "LiteLLM_EngineRun"("engine_id", "created_at");
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20261001100000_rename_lens/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20261001100000_rename_lens/migration.sql
@ -0,0 +1,18 @@
+DO $$
+BEGIN
+    ALTER TABLE IF EXISTS "LiteLLM_Engine" RENAME TO "LiteLLM_Lens";
+    ALTER TABLE IF EXISTS "LiteLLM_EngineRun" RENAME TO "LiteLLM_LensRun";
+    ALTER TABLE IF EXISTS "LiteLLM_EngineWorker" RENAME TO "LiteLLM_LensWorker";
+    IF EXISTS (
+        SELECT 1 FROM pg_attribute
+        WHERE attrelid = to_regclass('"LiteLLM_LensRun"')
+          AND attname = 'engine_id' AND NOT attisdropped
+    ) THEN
+        ALTER TABLE "LiteLLM_LensRun" RENAME COLUMN "engine_id" TO "lens_id";
+    END IF;
+    ALTER INDEX IF EXISTS "LiteLLM_Engine_pkey" RENAME TO "LiteLLM_Lens_pkey";
+    ALTER INDEX IF EXISTS "LiteLLM_EngineRun_pkey" RENAME TO "LiteLLM_LensRun_pkey";
+    ALTER INDEX IF EXISTS "LiteLLM_EngineWorker_pkey" RENAME TO "LiteLLM_LensWorker_pkey";
+    ALTER INDEX IF EXISTS "LiteLLM_EngineWorker_token_hash_key" RENAME TO "LiteLLM_LensWorker_token_hash_key";
+    ALTER INDEX IF EXISTS "LiteLLM_EngineRun_engine_id_created_at_idx" RENAME TO "LiteLLM_LensRun_lens_id_created_at_idx";
+END $$;
--- a/litellm-proxy-extras/litellm_proxy_extras/request_log_indexes.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/request_log_indexes.py
@ -0,0 +1,448 @@
+"""The request-log indexes built after `prisma migrate deploy` instead of by a migration:
+by the migration job, or by a serving proxy that ran the migrations itself (in the
+background, once it serves).
+
+A migration cannot build them: a plain `CREATE INDEX` blocks spend-log inserts for the
+whole build, and `CREATE INDEX CONCURRENTLY` is refused on a partitioned parent
+(db_scripts/partition_spend_logs.sql). `REQUEST_LOG_INDEXES` is the one list to extend;
+names match what Prisma derives from the `@@index` declarations in schema.prisma, so an
+index a database already has is recognized and never rebuilt.
+"""
+
+import hashlib
+import random
+import re
+import time
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Final
+
+from litellm_proxy_extras._logging import logger
+from litellm_proxy_extras.migration_lock import held_migration_lock
+
+if TYPE_CHECKING:
+    import psycopg
+    from psycopg import sql
+
+
+@dataclass(frozen=True, slots=True)
+class RequestLogIndex:
+    """One index the migration job owns: the table, the exact Prisma index name and the
+    column list as it would be written after `ON <table>`."""
+
+    table: str
+    name: str
+    definition: str
+
+    @property
+    def columns(self) -> tuple[str, ...]:
+        return tuple(re.findall(r'"([^"]+)"', self.definition))
+
+    def partition_index_name(self, partition: str) -> str:
+        """The child index name for one partition, built the way Postgres names the
+        children of a partitioned index, and kept within the 63 byte identifier limit."""
+        name: Final = f"{partition}_{self.name.removeprefix(f'{self.table}_')}"
+        if len(name.encode()) <= _IDENTIFIER_MAX_BYTES:
+            return name
+        digest: Final = hashlib.sha256(name.encode()).hexdigest()[:_DIGEST_LENGTH]
+        budget: Final = _IDENTIFIER_MAX_BYTES - _DIGEST_LENGTH - 1
+        kept: Final = next(name[:length] for length in range(len(name), 0, -1) if len(name[:length].encode()) <= budget)
+        return f"{kept}_{digest}"
+
+
+REQUEST_LOG_INDEXES: Final = (
+    RequestLogIndex("LiteLLM_SpendLogs", "LiteLLM_SpendLogs_api_key_startTime_idx", '("api_key", "startTime")'),
+    RequestLogIndex("LiteLLM_SpendLogs", "LiteLLM_SpendLogs_litellm_call_id_idx", '("litellm_call_id")'),
+)
+
+_IDENTIFIER_MAX_BYTES: Final = 63
+_PARENT_LOCK_TIMEOUT: Final = "2s"
+_PARENT_LOCK_ATTEMPTS: Final = 30
+_LOCK_HANDOVER_SECONDS: Final = 2.0
+_DIGEST_LENGTH: Final = 8
+_CREATE_INDEX_STATEMENT: Final = re.compile(
+    r'^\s*CREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?(?:IF\s+NOT\s+EXISTS\s+)?"(?P<index>[^"]+)"\s+ON\b',
+    re.IGNORECASE,
+)
+_TABLE_KIND_SQL: Final = "SELECT c.relkind = 'p' AS partitioned FROM pg_class c WHERE c.oid = to_regclass(%s)"
+_CHILDREN_WITHOUT_THE_INDEX_SQL: Final = (
+    "SELECT child.relname AS name, n.nspname AS schema, child.relkind = 'p' AS partitioned "
+    "FROM pg_inherits i JOIN pg_class child ON child.oid = i.inhrelid "
+    "JOIN pg_namespace n ON n.oid = child.relnamespace "
+    "WHERE i.inhparent = to_regclass(%s) AND NOT EXISTS ("
+    "SELECT 1 FROM pg_inherits attached JOIN pg_index x ON x.indexrelid = attached.inhrelid "
+    "WHERE attached.inhparent = to_regclass(%s) AND x.indrelid = child.oid) "
+    "ORDER BY child.relname"
+)
+_EQUIVALENT_INDEXES_SQL: Final = (
+    "SELECT i.relname AS name, x.indisvalid AS valid "
+    "FROM pg_index x JOIN pg_class i ON i.oid = x.indexrelid JOIN pg_am am ON am.oid = i.relam "
+    "WHERE x.indrelid = to_regclass(%s) AND i.relname <> %s AND am.amname = 'btree' AND NOT x.indisunique "
+    "AND x.indexprs IS NULL AND x.indpred IS NULL AND x.indnkeyatts = x.indnatts "
+    "AND NOT EXISTS (SELECT 1 FROM unnest(x.indoption::int2[]) o WHERE o <> 0) "
+    "AND NOT EXISTS (SELECT 1 FROM unnest(x.indclass::oid[]) c JOIN pg_opclass oc ON oc.oid = c WHERE NOT oc.opcdefault) "
+    "AND NOT EXISTS (SELECT 1 FROM unnest(x.indcollation::oid[]) WITH ORDINALITY c(coll, ord) "
+    "JOIN unnest(x.indkey::int2[]) WITH ORDINALITY k(attnum, ord) ON k.ord = c.ord "
+    "JOIN pg_attribute a ON a.attrelid = x.indrelid AND a.attnum = k.attnum "
+    "WHERE c.coll <> 0 AND c.coll <> a.attcollation) "
+    "AND (SELECT array_agg(a.attname::text ORDER BY k.ord) FROM unnest(x.indkey::int2[]) WITH ORDINALITY k(attnum, ord) "
+    "JOIN pg_attribute a ON a.attrelid = x.indrelid AND a.attnum = k.attnum) = %s::text[] "
+    "AND NOT EXISTS (SELECT 1 FROM pg_inherits WHERE inhrelid = x.indexrelid) "
+    "ORDER BY x.indisvalid DESC, i.relname"
+)
+_INDEX_STATE_SQL: Final = (
+    'SELECT x.indisvalid AS valid, t.relname AS "table" '
+    "FROM pg_index x JOIN pg_class t ON t.oid = x.indrelid WHERE x.indexrelid = to_regclass(%s)"
+)
+
+
+@dataclass(frozen=True, slots=True)
+class _Relation:
+    name: str
+    schema: str
+    partitioned: bool
+
+
+@dataclass(frozen=True, slots=True)
+class _IndexState:
+    valid: bool
+    table: str
+
+
+@dataclass(frozen=True, slots=True)
+class _EquivalentIndex:
+    name: str
+    valid: bool
+
+
+@dataclass(frozen=True, slots=True)
+class _TableKind:
+    partitioned: bool
+
+
+def filter_request_log_index_diff(diff_sql: str, indexes: tuple[RequestLogIndex, ...] = REQUEST_LOG_INDEXES) -> str:
+    """The `prisma migrate diff` script without the statements that create a migration-job-owned
+    index, which the schema declares and the migrations deliberately do not build."""
+    names: Final = frozenset(index.name for index in indexes)
+    statements: Final = diff_sql.split(";")
+    kept: Final = tuple(statement for statement in statements if not _creates_one_of(statement, names))
+    return ";".join(kept) if any(part.strip() for part in kept) else ""
+
+
+def _creates_one_of(statement: str, names: frozenset[str]) -> bool:
+    match: Final = _CREATE_INDEX_STATEMENT.match(_without_comments(statement))
+    return match is not None and match["index"] in names
+
+
+def _without_comments(statement: str) -> str:
+    return "\n".join(line for line in statement.splitlines() if not line.lstrip().startswith("--"))
+
+
+def _connect(database_url: str) -> "psycopg.Connection[tuple[object, ...]]":
+    import psycopg
+
+    return psycopg.connect(database_url, connect_timeout=10, autocommit=True)
+
+
+def ensure_request_log_indexes(
+    database_url: str,
+    schema: str,
+    indexes: tuple[RequestLogIndex, ...] = REQUEST_LOG_INDEXES,
+    connect: "Callable[[str], psycopg.Connection[tuple[object, ...]]]" = _connect,
+) -> bool:
+    """Build every listed index that is missing or invalid. Each build step runs under
+    the migration coordinator lock, held per statement so a resolver booting on another
+    replica gets in between partitions rather than waiting for the whole table. Any
+    failure is logged and left for the next index build; the result says whether
+    every index ended up valid. Never raises."""
+    import psycopg
+
+    try:
+        with connect(database_url) as connection:
+            connection.execute("SET statement_timeout = 0")
+            results: Final = tuple(_ensure_index(connection, schema, index) for index in indexes)
+    except psycopg.Error as exc:
+        logger.warning("Could not build the request-log indexes, leaving them for the next index build: %s", exc)
+        return False
+    if not all(results):
+        logger.warning("Some request-log indexes are not in place yet, leaving them for the next index build")
+        return False
+    logger.info("Request-log indexes are all in place")
+    return True
+
+
+def _under_migration_lock(connection: "psycopg.Connection[tuple[object, ...]]", step: Callable[[], bool]) -> bool:
+    with held_migration_lock(connection) as held:
+        if not held:
+            logger.info(
+                "Another process holds the migration lock, leaving the request-log indexes to the next index build"
+            )
+            return False
+        return step()
+
+
+def _ensure_index(connection: "psycopg.Connection[tuple[object, ...]]", schema: str, index: RequestLogIndex) -> bool:
+    from psycopg.rows import class_row
+
+    with connection.cursor(row_factory=class_row(_TableKind)) as cursor:
+        table: Final = cursor.execute(_TABLE_KIND_SQL, (_regclass_name(connection, schema, index.table),)).fetchone()
+    if table is None:
+        logger.info("Table %s does not exist yet, skipping index %s", index.table, index.name)
+        return True
+    if table.partitioned:
+        return build_index_on_partitioned_table(connection, schema, index)
+    return _build_leaf_index(connection, schema, index.table, index.name, index)
+
+
+def _regclass_name(connection: "psycopg.Connection[tuple[object, ...]]", schema: str, name: str) -> str:
+    from psycopg import sql
+
+    return sql.Identifier(schema, name).as_string(connection)
+
+
+def _create_index_statement(
+    connection: "psycopg.Connection[tuple[object, ...]]", prefix: "sql.Composed", definition: str
+) -> bytes:
+    return (prefix.as_string(connection) + definition).encode()
+
+
+def _index_state(connection: "psycopg.Connection[tuple[object, ...]]", schema: str, index: str) -> "_IndexState | None":
+    from psycopg.rows import class_row
+
+    with connection.cursor(row_factory=class_row(_IndexState)) as cursor:
+        return cursor.execute(_INDEX_STATE_SQL, (_regclass_name(connection, schema, index),)).fetchone()
+
+
+def _equivalent_indexes(
+    connection: "psycopg.Connection[tuple[object, ...]]",
+    schema: str,
+    table: str,
+    name: str,
+    index: RequestLogIndex,
+) -> tuple[_EquivalentIndex, ...]:
+    """The indexes on `table` other than `name` with the same definition: default btree
+    over the same columns in the same order, no expression, predicate, DESC or custom
+    opclass or collation, and not attached under a partitioned index. Valid ones first."""
+    from psycopg.rows import class_row
+
+    with connection.cursor(row_factory=class_row(_EquivalentIndex)) as cursor:
+        return tuple(
+            cursor.execute(
+                _EQUIVALENT_INDEXES_SQL, (_regclass_name(connection, schema, table), name, list(index.columns))
+            ).fetchall()
+        )
+
+
+def _adopt_equivalent_index(
+    connection: "psycopg.Connection[tuple[object, ...]]",
+    schema: str,
+    table: str,
+    name: str,
+    index: RequestLogIndex,
+) -> bool:
+    """Rename a valid index of the same definition under another name (an operator's
+    hand-built copy, say) to the name this code expects, instead of building a second
+    one. RENAME on an index is a catalog change that lets writes through."""
+    from psycopg import sql
+
+    equivalent: Final = next(
+        (found for found in _equivalent_indexes(connection, schema, table, name, index) if found.valid), None
+    )
+    if equivalent is None:
+        return False
+    logger.info(
+        "Renaming the equivalent index %s on %s to %s instead of building a second one", equivalent.name, table, name
+    )
+    connection.execute(
+        sql.SQL("ALTER INDEX {} RENAME TO {}").format(sql.Identifier(schema, equivalent.name), sql.Identifier(name))
+    )
+    return True
+
+
+def _report_second_copies(
+    connection: "psycopg.Connection[tuple[object, ...]]",
+    schema: str,
+    table: str,
+    name: str,
+    index: RequestLogIndex,
+    concurrently: bool,
+) -> None:
+    """Log every other index of the same definition with the statement that removes it.
+    Dropping is the operator's call: a second copy costs writes and disk, never results."""
+    from psycopg import sql
+
+    drop: Final = "DROP INDEX CONCURRENTLY" if concurrently else "DROP INDEX"
+    for copy in _equivalent_indexes(connection, schema, table, name, index):
+        logger.warning(
+            "Index %s on %s is a second copy of %s and only costs writes and disk; remove it with: %s %s",
+            copy.name,
+            table,
+            name,
+            drop,
+            sql.Identifier(schema, copy.name).as_string(connection),
+        )
+
+
+def _children_without_the_index(
+    connection: "psycopg.Connection[tuple[object, ...]]", schema: str, table: str, index: str
+) -> tuple[_Relation, ...]:
+    from psycopg.rows import class_row
+
+    with connection.cursor(row_factory=class_row(_Relation)) as cursor:
+        return tuple(
+            cursor.execute(
+                _CHILDREN_WITHOUT_THE_INDEX_SQL,
+                (_regclass_name(connection, schema, table), _regclass_name(connection, schema, index)),
+            ).fetchall()
+        )
+
+
+def _build_leaf_index(
+    connection: "psycopg.Connection[tuple[object, ...]]",
+    schema: str,
+    table: str,
+    name: str,
+    index: RequestLogIndex,
+) -> bool:
+    """Build one plain table's or partition's index with CONCURRENTLY so writes keep
+    flowing. The catalog is read under the migration lock, so a replica that saw an
+    invalid index before the lock finds the valid one another replica just built and
+    leaves it. An invalid index left by an interrupted build is dropped and rebuilt; a
+    valid index of the same definition under another name is renamed rather than
+    duplicated; an index of that name on another table is a collision this code will
+    not touch."""
+    from psycopg import sql
+
+    def build() -> bool:
+        existing: Final = _index_state(connection, schema, name)
+        if existing is not None and existing.table != table:
+            logger.warning(
+                "Index %s already exists on %s rather than %s, leaving it alone", name, existing.table, table
+            )
+            return False
+        if existing is not None and existing.valid:
+            return True
+        if existing is not None:
+            logger.info("Dropping the invalid index %s left by an interrupted build on %s", name, table)
+            connection.execute(sql.SQL("DROP INDEX CONCURRENTLY {}").format(sql.Identifier(schema, name)))
+        elif _adopt_equivalent_index(connection, schema, table, name, index):
+            return True
+        logger.info("Building index %s on %s concurrently", name, table)
+        prefix: Final = sql.SQL("CREATE INDEX CONCURRENTLY IF NOT EXISTS {} ON {} ").format(
+            sql.Identifier(name), sql.Identifier(schema, table)
+        )
+        connection.execute(_create_index_statement(connection, prefix, index.definition))
+        built: Final = _index_state(connection, schema, name)
+        return built is not None and built.valid
+
+    current: Final = _index_state(connection, schema, name)
+    if current is None or not current.valid or current.table != table:
+        if not _under_migration_lock(connection, build):
+            return False
+        time.sleep(_LOCK_HANDOVER_SECONDS)
+    _report_second_copies(connection, schema, table, name, index, concurrently=True)
+    return True
+
+
+def build_index_on_partitioned_table(
+    connection: "psycopg.Connection[tuple[object, ...]]",
+    schema: str,
+    index: RequestLogIndex,
+    table: "str | None" = None,
+    name: "str | None" = None,
+) -> bool:
+    """Build the index the way Postgres allows on a partitioned parent: a metadata-only
+    parent index ON ONLY the parent, one CONCURRENTLY build per partition, and ATTACH
+    PARTITION for each child. Partitions that are themselves partitioned get the same
+    treatment one level down. Every step checks the catalog before acting, so an
+    interrupted run resumes where it stopped and a second run finds nothing to do; a
+    parent or child index of the same definition under another name is renamed and
+    used rather than duplicated. The connection must be in autocommit mode. True when
+    the parent index ends up valid."""
+
+    parent_table: Final = index.table if table is None else table
+    parent_index: Final = index.name if name is None else name
+    existing: Final = _index_state(connection, schema, parent_index)
+    if existing is not None and existing.table != parent_table:
+        logger.warning(
+            "Index %s already exists on %s rather than %s, leaving it alone", parent_index, existing.table, parent_table
+        )
+        return False
+    if existing is None and not _under_migration_lock(
+        connection,
+        lambda: (
+            _adopt_equivalent_index(connection, schema, parent_table, parent_index, index)
+            or _create_parent_index(connection, schema, parent_index, parent_table, index)
+        ),
+    ):
+        return False
+    children: Final = _children_without_the_index(connection, schema, parent_table, parent_index)
+    if not all(_attach_child_index(connection, schema, parent_index, child, index) for child in children):
+        return False
+    final: Final = _index_state(connection, schema, parent_index)
+    if final is None or not final.valid:
+        return False
+    _report_second_copies(connection, schema, parent_table, parent_index, index, concurrently=False)
+    return True
+
+
+def _create_parent_index(
+    connection: "psycopg.Connection[tuple[object, ...]]",
+    schema: str,
+    name: str,
+    table: str,
+    index: RequestLogIndex,
+) -> bool:
+    """Create the metadata-only parent index. Postgres takes a SHARE lock on the
+    parent for that statement, so it waits for in-flight writes and queues new ones
+    behind it; a short lock_timeout with retries keeps every such pause bounded."""
+    import psycopg
+    from psycopg import sql
+
+    prefix: Final = sql.SQL("CREATE INDEX IF NOT EXISTS {} ON ONLY {} ").format(
+        sql.Identifier(name), sql.Identifier(schema, table)
+    )
+    statement: Final = _create_index_statement(connection, prefix, index.definition)
+    connection.execute(sql.SQL("SET lock_timeout = {}").format(sql.Literal(_PARENT_LOCK_TIMEOUT)))
+    try:
+        for _ in range(_PARENT_LOCK_ATTEMPTS):
+            try:
+                connection.execute(statement)
+                return True
+            except psycopg.errors.LockNotAvailable:
+                logger.info("Waiting for in-flight writes to %s before creating the parent index %s", table, name)
+                time.sleep(random.uniform(0.1, 0.5))
+    finally:
+        connection.execute("SET lock_timeout = 0")
+    logger.warning("Could not get the parent lock on %s to create %s, leaving it for the next index build", table, name)
+    return False
+
+
+def _attach_child_index(
+    connection: "psycopg.Connection[tuple[object, ...]]",
+    schema: str,
+    parent_index: str,
+    child: _Relation,
+    index: RequestLogIndex,
+) -> bool:
+    from psycopg import sql
+
+    child_index: Final = index.partition_index_name(child.name)
+    built: Final = (
+        build_index_on_partitioned_table(connection, child.schema, index, child.name, child_index)
+        if child.partitioned
+        else _build_leaf_index(connection, child.schema, child.name, child_index, index)
+    )
+    if not built:
+        return False
+
+    def attach() -> bool:
+        connection.execute(
+            sql.SQL("ALTER INDEX {} ATTACH PARTITION {}").format(
+                sql.Identifier(schema, parent_index), sql.Identifier(child.schema, child_index)
+            )
+        )
+        logger.info("Attached index %s on partition %s to %s", child_index, child.name, parent_index)
+        return True
+
+    return _under_migration_lock(connection, attach)
--- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
@ -78,6 +78,11 @@ model LiteLLM_AgentsTable {
  object_permission_id String?
  object_permission LiteLLM_ObjectPermissionTable? @relation(fields: [object_permission_id], references: [object_permission_id])
  spend      Float    @default(0.0)
+  identity_managed Boolean @default(false)
+  enabled Boolean @default(true)
+  execution_mode String @default("autonomous")
+  identity LiteLLM_AgentIdentity?
+  retired_identities LiteLLM_RetiredAgentIdentity[]
  tpm_limit  Int?
  rpm_limit  Int?
  session_tpm_limit Int?
@ -88,6 +93,56 @@ model LiteLLM_AgentsTable {
  updated_by String
 }

+model LiteLLM_AgentIdentity {
+  agent_id String @id
+  active Boolean @default(true)
+  agent LiteLLM_AgentsTable @relation(fields: [agent_id], references: [agent_id], onDelete: Cascade)
+  provider String
+  issuer String
+  tenant_id String
+  client_id String
+  service_principal_id String?
+  required_roles String[] @default([])
+  required_scopes String[] @default(["user_impersonation"])
+  revision String @default(uuid())
+  last_authenticated_at DateTime?
+  @@unique([provider, tenant_id, client_id])
+  @@unique([issuer, service_principal_id])
+}
+
+model LiteLLM_RetiredAgentIdentity {
+  binding_id String @id @default(uuid())
+  agent_id String?
+  agent LiteLLM_AgentsTable? @relation(fields: [agent_id], references: [agent_id], onDelete: SetNull)
+  provider String
+  issuer String
+  tenant_id String
+  client_id String
+  @@unique([provider, tenant_id, client_id])
+}
+
+model LiteLLM_RetiredAgent {
+  original_agent_id String @id
+  retired_at DateTime @default(now())
+}
+
+model LiteLLM_VerifiedSubject {
+  subject_id String @id @default(uuid())
+  issuer String
+  tenant_id String
+  oid String
+  kind String @default("human")
+  user_id String?
+  user LiteLLM_UserTable? @relation(fields: [user_id], references: [user_id], onDelete: Cascade)
+  verified_via String @default("sso_interactive")
+  verified_at DateTime @default(now())
+  @@unique([issuer, tenant_id, oid])
+  @@index([user_id])
+}
+
+
+
+
 model LiteLLM_OrganizationTable {
 		organization_id String @id @default(uuid())
    organization_alias  String
@ -241,6 +296,7 @@ model LiteLLM_DeletedTeamTable {

 // Track spend, rate limit, budget Users
 model LiteLLM_UserTable {
+    verified_subjects LiteLLM_VerifiedSubject[]
 		user_id    String @id
    user_alias String? 
    team_id    String?
@ -322,6 +378,7 @@ model LiteLLM_MCPServerTable {
  allowed_tools String[]      @default([])
  tool_name_to_display_name Json? @default("{}")
  tool_name_to_description   Json? @default("{}")
+  pinned_tools Json? @default("{}")
  extra_headers String[]    @default([])
  static_headers Json?        @default("{}")
  // Admin-configured environment variables interpolated into static_headers
@ -674,6 +731,7 @@ model LiteLLM_SpendLogs {
  session_id          String?
  status              String?
  mcp_namespaced_tool_name String? 
+  billing_agent_id    String?
  agent_id            String?
  proxy_server_request Json?     @default("{}")
  litellm_call_id     String?
@ -1259,6 +1317,26 @@ model LiteLLM_DailyToolSpend {
  @@id([date, tool_name])
 }

+model LiteLLM_DailyModelUsage {
+  date                String
+  model_group         String
+  model               String
+  custom_llm_provider String
+  task_type           String
+  spend               Float    @default(0.0)
+  prompt_tokens       BigInt   @default(0)
+  completion_tokens   BigInt   @default(0)
+  request_count       BigInt   @default(0)
+  successful_requests BigInt   @default(0)
+  failed_requests     BigInt   @default(0)
+  created_at          DateTime @default(now())
+  updated_at          DateTime @updatedAt
+
+  @@id([date, model_group, model, custom_llm_provider, task_type])
+  @@index([date])
+  @@index([model_group])
+}
+
 // Gateway request counts recorded at the ASGI edge by
 // BillableRequestMetricsMiddleware. This is the source of truth for SGR
 // (successful gateway requests): it counts what the proxy actually answered,
@ -1832,3 +1910,24 @@ model LiteLLM_BackgroundInteractionSettlement {

  @@index([claimed_at], map: "idx_background_interaction_settlement_claimed_at")
 }
+
+model LiteLLM_Lens {
+  id      String @id
+  version Int @default(0)
+  data    Json
+}
+
+model LiteLLM_LensRun {
+  id         String @id
+  lens_id  String
+  created_at DateTime
+  data       Json
+
+  @@index([lens_id, created_at])
+}
+
+model LiteLLM_LensWorker {
+  id         String @id
+  token_hash String @unique
+  data       Json
+}
--- a/litellm-proxy-extras/litellm_proxy_extras/utils.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/utils.py
@ -5,6 +5,7 @@ import re
 import shutil
 import subprocess
 import tempfile
+import threading
 import time
 from collections.abc import Callable
 from dataclasses import dataclass, replace
@ -13,6 +14,7 @@ from typing import TYPE_CHECKING, Final, Optional

 from litellm_proxy_extras import prisma_toolchain
 from litellm_proxy_extras._logging import logger
+from litellm_proxy_extras.migration_lock import held_migration_lock
 from litellm_proxy_extras.prisma_toolchain import (
    PRISMA_COMMAND_TIMEOUT_ENV_VAR,
    PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR,
@ -24,6 +26,7 @@ from litellm_proxy_extras.replica_identity import (
    REPLICA_IDENTITY_FULL_ENV_VAR,
    apply_replica_identity_full,
 )
+from litellm_proxy_extras.request_log_indexes import ensure_request_log_indexes, filter_request_log_index_diff

 if TYPE_CHECKING:
    import psycopg
@ -433,6 +436,21 @@ class ProxyExtrasDBManager:
                return True
        return False

+    @staticmethod
+    def _filter_migration_job_owned_drift(diff_sql: str, partitioned: bool | None = None) -> str:
+        """The drift script without the indexes the migration job builds (the schema
+        declares them, the migrations deliberately do not) and, when LiteLLM_SpendLogs
+        is partitioned, without its primary-key rewrite and partitioning artifacts."""
+        without_indexes: Final = filter_request_log_index_diff(diff_sql)
+        is_partitioned: Final = ProxyExtrasDBManager.spend_logs_is_partitioned() if partitioned is None else partitioned
+        if not is_partitioned:
+            return without_indexes
+        logger.info(
+            "LiteLLM_SpendLogs is partitioned; removed its primary-key "
+            "rewrite and partitioning artifacts from the drift script"
+        )
+        return filter_partitioned_spend_logs_diff(without_indexes)
+
    @staticmethod
    def _resolve_all_migrations(
        migrations_dir: str, schema_path: str, mark_all_applied: bool = True
@ -513,21 +531,14 @@ class ProxyExtrasDBManager:
            return
        logger.info(f"Migration diff created at {diff_sql_path}")

-        if ProxyExtrasDBManager.spend_logs_is_partitioned():
-            filtered_sql = filter_partitioned_spend_logs_diff(
-                diff_sql_path.read_text()
-            )
-            diff_sql_path.write_text(filtered_sql)
-            logger.info(
-                "LiteLLM_SpendLogs is partitioned; removed its primary-key "
-                "rewrite and partitioning artifacts from the drift script"
-            )
-            if not filtered_sql.strip():
-                logger.info("Drift script is empty after filtering; nothing to apply")
-                if not mark_all_applied:
-                    return
-                ProxyExtrasDBManager._mark_migrations_applied(migrations_dir)
+        filtered_sql: Final = ProxyExtrasDBManager._filter_migration_job_owned_drift(diff_sql_path.read_text())
+        diff_sql_path.write_text(filtered_sql)
+        if not filtered_sql.strip():
+            logger.info("Drift script is empty after filtering; nothing to apply")
+            if not mark_all_applied:
                return
+            ProxyExtrasDBManager._mark_migrations_applied(migrations_dir)
+            return

        # 2. Run prisma db execute to apply the migration
        applied_ok = False
@ -590,6 +601,36 @@ class ProxyExtrasDBManager:
                        f"Failed to resolve migration {migration_name}: {e.stderr}"
                    )

+    @staticmethod
+    def raise_if_lens_rename_pending() -> None:
+        database_url: Final = os.environ.get("DATABASE_URL")
+        if not database_url:
+            return
+        try:
+            import psycopg
+        except ImportError as exc:
+            raise RuntimeError("Install psycopg to verify Lens data safety before prisma db push.") from exc
+        try:
+            with psycopg.connect(
+                ProxyExtrasDBManager._strip_prisma_query_params(database_url), connect_timeout=10, autocommit=True
+            ) as connection:
+                legacy: Final = connection.execute(
+                    "SELECT 1 FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace "
+                    "WHERE n.nspname=%s AND c.relname IN ('LiteLLM_Engine', 'LiteLLM_EngineRun', 'LiteLLM_EngineWorker') "
+                    "LIMIT 1",
+                    (ProxyExtrasDBManager._prisma_schema_param(database_url) or "public",),
+                ).fetchone()
+        except psycopg.Error as exc:
+            raise RuntimeError(
+                "Cannot verify Lens data safety; refusing prisma db push. Check database connectivity and psycopg installation."
+            ) from exc
+        if legacy is not None:
+            raise RuntimeError(
+                "Legacy Lens tables exist. prisma db push would drop saved Lens data. "
+                "Apply the shipped 20261001100000_rename_lens migration to this database schema before retrying. "
+                "Deployments using migration history can upgrade without --use_prisma_db_push instead."
+            )
+
    @staticmethod
    def spend_logs_is_partitioned() -> bool:
        """True when the connected database's LiteLLM_SpendLogs is a
@ -770,7 +811,7 @@ class ProxyExtrasDBManager:
            conn.execute(statement)
        except psycopg.Error as e:
            logger.warning(
-                "Could not repair invalid index %s.%s, will retry on the next startup. "
+                "Could not repair invalid index %s.%s, will retry on the next database setup run. "
                "If this keeps happening, run `%s` by hand as the index owner. Error: %s",
                index.schema,
                index.name,
@ -781,16 +822,21 @@ class ProxyExtrasDBManager:
        logger.info("%s invalid index %s.%s", action, index.schema, index.name)

    @staticmethod
-    def repair_invalid_indexes(lock_timeout: str = "30s") -> bool:
+    def repair_invalid_indexes(
+        lock_timeout: str = "30s",
+        repair: "Callable[[psycopg.Connection[tuple[str, str, str]], _InvalidIndex], None] | None" = None,
+    ) -> bool:
        """Rebuild LiteLLM indexes an interrupted CREATE INDEX CONCURRENTLY left
        INVALID (a migration deadlock between replicas is the usual cause; the
        retried migration skips them because of IF NOT EXISTS). Never raises:
        returns True when no invalid index remains, False when the repair was
-        skipped or failed and will be retried on the next startup. Looks in the
+        skipped or failed and will be retried on the next database setup run. Looks in the
        schema DATABASE_URL names, the only URL Prisma migrates through, but
        connects over DIRECT_URL when set: the session settings, the advisory
        lock and REINDEX CONCURRENTLY all need one server session, which a
-        transaction pooler does not give."""
+        transaction pooler does not give. Each rebuild holds the migration
+        coordinator lock on its own, like the migration job's index build, so a resolver
+        booting on another replica waits for one index at most."""
        prisma_url: Final = os.getenv("DATABASE_URL")
        if not prisma_url:
            return False
@ -826,20 +872,53 @@ class ProxyExtrasDBManager:
                if lock_row is None or not lock_row[0]:
                    logger.info("Another replica is already rebuilding the invalid indexes, skipping")
                    return False
-                for index in ProxyExtrasDBManager._invalid_litellm_indexes(conn, schema):
-                    ProxyExtrasDBManager._repair_index(conn, index)
+                repair_one: Final = repair or ProxyExtrasDBManager._repair_index
+                repaired: Final = all(
+                    ProxyExtrasDBManager._repair_under_migration_lock(conn, schema, index, repair_one)
+                    for index in found
+                )
+                if not repaired:
+                    return False
                remaining: Final = ProxyExtrasDBManager._invalid_litellm_indexes(conn, schema)
        except psycopg.Error as e:
-            logger.warning("Could not check for invalid indexes, will retry on the next startup. Error: %s", e)
+            logger.warning(
+                "Could not check for invalid indexes, will retry on the next database setup run. Error: %s", e
+            )
            return False
        return not remaining

+    @staticmethod
+    def _repair_under_migration_lock(
+        conn: "psycopg.Connection[tuple[str, str, str]]",
+        schema: str,
+        index: _InvalidIndex,
+        repair: "Callable[[psycopg.Connection[tuple[str, str, str]], _InvalidIndex], None]",
+    ) -> bool:
+        """Rebuild one index under the migration coordinator lock, skipping it when a
+        migration job finished or dropped it in the meantime. False when another process
+        holds the lock, so the check waits for the next database setup run."""
+        with held_migration_lock(conn) as held:
+            if not held:
+                logger.info(
+                    "Another process is building indexes under the migration lock, leaving the "
+                    "invalid index check to the next database setup run"
+                )
+                return False
+            still_invalid: Final = ProxyExtrasDBManager._invalid_litellm_indexes(conn, schema)
+            if any(found.schema == index.schema and found.name == index.name for found in still_invalid):
+                repair(conn, index)
+            return True
+
    @staticmethod
    def _setup_database_v2(use_migrate: bool) -> bool:
        if not use_migrate:
            return ProxyExtrasDBManager._run_database_v2(False)
        from litellm_proxy_extras.migration_lock import migration_environment, migration_lock
-        from litellm_proxy_extras.migration_recovery import baseline_current_schema, recover_completed_migration
+        from litellm_proxy_extras.migration_recovery import (
+            baseline_current_schema,
+            recover_completed_migration,
+            roll_back_failed_inert_migration,
+        )

        database_url: Final = os.environ.get("DATABASE_URL")
        if not database_url:
@ -854,7 +933,9 @@ class ProxyExtrasDBManager:
            if not migration.is_file():
                return False
            with migration_lock(lock_url) as coordinator:
-                return recover_completed_migration(coordinator, schema, migration)
+                return recover_completed_migration(coordinator, schema, migration) or roll_back_failed_inert_migration(
+                    coordinator, schema, migration
+                )

        def baseline_existing(migrations_dir: str) -> None:
            with migration_lock(lock_url) as coordinator:
@ -895,6 +976,7 @@ class ProxyExtrasDBManager:
        migrations_dir = ProxyExtrasDBManager._get_prisma_dir()

        if not use_migrate:
+            ProxyExtrasDBManager.raise_if_lens_rename_pending()
            if ProxyExtrasDBManager.spend_logs_is_partitioned():
                raise RuntimeError(PARTITIONED_SPEND_LOGS_PUSH_ERROR)
            original_dir = os.getcwd()
@ -1146,13 +1228,16 @@ class ProxyExtrasDBManager:
        )

    @staticmethod
-    def setup_database(
-        use_migrate: bool = False, use_v2_resolver: bool = False
-    ) -> bool:
+    def setup_database(use_migrate: bool = False, use_v2_resolver: bool = False) -> bool:
        """
        Set up the database using either prisma migrate or prisma db push
        Uses migrations from litellm-proxy-extras package

+        The request-log indexes in `REQUEST_LOG_INDEXES` are not built here: the
+        migration job builds them through `run_migration_job`, and a serving proxy that
+        ran the migrations itself starts them through `start_request_log_index_build`
+        once it is ready to serve.
+
        Args:
            use_migrate: Whether to use prisma migrate instead of db push
            use_v2_resolver: Opt into the v2 migration resolver (safer during
@ -1169,10 +1254,48 @@ class ProxyExtrasDBManager:
        migrated = ProxyExtrasDBManager._run_migrations(
            use_migrate=use_migrate, use_v2_resolver=use_v2_resolver
        )
-        if migrated:
-            ProxyExtrasDBManager.repair_invalid_indexes()
-            ProxyExtrasDBManager.apply_replica_identity_full_if_requested()
-        return migrated
+        if not migrated:
+            return False
+        ProxyExtrasDBManager.repair_invalid_indexes()
+        ProxyExtrasDBManager.apply_replica_identity_full_if_requested()
+        return True
+
+    @staticmethod
+    def build_request_log_indexes(build: Callable[[str, str], bool] = ensure_request_log_indexes) -> bool:
+        """Build the indexes in `REQUEST_LOG_INDEXES` on the writer, in the schema the
+        migrations target. Idempotent and never raises; False when an index is still
+        missing or invalid, so the migration job reports it and gets rerun instead of
+        leaving the table unindexed until the next deploy."""
+        database_url: Final = os.environ.get("DATABASE_URL")
+        if not database_url:
+            return True
+        direct_url: Final = ProxyExtrasDBManager._strip_prisma_query_params(
+            os.environ.get("DIRECT_URL") or database_url
+        )
+        schema: Final = ProxyExtrasDBManager._prisma_schema_param(database_url) or "public"
+        return build(direct_url, schema)
+
+    @staticmethod
+    def run_migration_job(
+        use_migrate: bool = False,
+        use_v2_resolver: bool = False,
+        setup: Callable[[bool, bool], bool] = setup_database,
+        build: Callable[[], bool] = build_request_log_indexes,
+    ) -> bool:
+        """The migration job's whole run: `setup_database`, then the request-log indexes,
+        built synchronously so the job exits only once they are in place. False when the
+        migrations failed or an index could not be built, so the Job is rerun."""
+        return setup(use_migrate, use_v2_resolver) and build()
+
+    @staticmethod
+    def start_request_log_index_build(build: Callable[[], bool] = build_request_log_indexes) -> threading.Thread:
+        """A serving proxy that ran the migrations itself (schema updates not disabled)
+        builds the request-log indexes on a daemon thread, so a long build never delays
+        readiness. A build that could not finish is logged and picked up by the next boot
+        or the migration job."""
+        thread: Final = threading.Thread(target=build, name="litellm-request-log-indexes", daemon=True)
+        thread.start()
+        return thread

    @staticmethod
    def _run_migrations(use_migrate: bool, use_v2_resolver: bool) -> bool:
@ -1216,15 +1339,16 @@ class ProxyExtrasDBManager:
                        logger.info("✅ Post-migration sanity check completed")
                        return True
                    except subprocess.CalledProcessError as e:
-                        logger.info(f"prisma db error: {e.stderr}, e: {e.stdout}")
-                        if "P3009" in e.stderr:
+                        stderr: Final = str(e.stderr or "")
+                        logger.info(f"prisma db error: {stderr}, e: {e.stdout}")
+                        if "P3009" in stderr:
                            # Extract the failed migration name from the error message
                            migration_match = re.search(
-                                r"`(\d+_.*)` migration", e.stderr
+                                r"`(\d+_.*)` migration", stderr
                            )
                            if migration_match:
                                failed_migration = migration_match.group(1)
-                                if ProxyExtrasDBManager._is_idempotent_error(e.stderr):
+                                if ProxyExtrasDBManager._is_idempotent_error(stderr):
                                    logger.info(
                                        f"Migration {failed_migration} failed due to idempotent error (e.g., column already exists), resolving as applied"
                                    )
@ -1280,8 +1404,8 @@ class ProxyExtrasDBManager:
                                        f"✅ Migration {failed_migration} marked as rolled back... retrying"
                                    )
                        elif (
-                            "P3005" in e.stderr
-                            and "database schema is not empty" in e.stderr
+                            "P3005" in stderr
+                            and "database schema is not empty" in stderr
                        ):
                            logger.info(
                                "Database schema is not empty, creating baseline migration. In read-only file system, please set an environment variable `LITELLM_MIGRATION_DIR` to a writable directory to enable migrations. Learn more - https://docs.litellm.ai/docs/proxy/prod#read-only-file-system"
@ -1295,13 +1419,13 @@ class ProxyExtrasDBManager:
                            )
                            logger.info("✅ All migrations resolved.")
                            return True
-                        elif "P3018" in e.stderr:
+                        elif "P3018" in stderr:
                            # Check if this is a permission error or idempotent error
-                            if ProxyExtrasDBManager._is_permission_error(e.stderr):
+                            if ProxyExtrasDBManager._is_permission_error(stderr):
                                # Permission errors should NOT be marked as applied
                                # Extract migration name for logging
                                migration_match = re.search(
-                                    r"Migration name: (\d+_.*)", e.stderr
+                                    r"Migration name: (\d+_.*)", stderr
                                )
                                migration_name = (
                                    migration_match.group(1)
@ -1311,7 +1435,7 @@ class ProxyExtrasDBManager:

                                logger.error(
                                    f"❌ Migration {migration_name} failed due to insufficient permissions. "
-                                    f"Please check database user privileges. Error: {e.stderr}"
+                                    f"Please check database user privileges. Error: {stderr}"
                                )

                                # Mark as rolled back and exit with error
@ -1334,7 +1458,7 @@ class ProxyExtrasDBManager:
                                    f"was NOT applied. Please grant necessary database permissions and retry."
                                ) from e

-                            elif ProxyExtrasDBManager._is_idempotent_error(e.stderr):
+                            elif ProxyExtrasDBManager._is_idempotent_error(stderr):
                                # Idempotent errors mean the migration has effectively been applied
                                logger.info(
                                    "Migration failed due to idempotent error (e.g., column already exists), "
@ -1342,7 +1466,7 @@ class ProxyExtrasDBManager:
                                )
                                # Extract the migration name from the error message
                                migration_match = re.search(
-                                    r"Migration name: (\d+_.*)", e.stderr
+                                    r"Migration name: (\d+_.*)", stderr
                                )
                                if migration_match:
                                    migration_name = migration_match.group(1)
@ -1391,13 +1515,14 @@ class ProxyExtrasDBManager:
                                logger.warning(
                                    f"P3018 error encountered but could not classify "
                                    f"as permission or idempotent error. "
-                                    f"Error: {e.stderr}"
+                                    f"Error: {stderr}"
                                )
                                raise
                else:
                    if ProxyExtrasDBManager.spend_logs_is_partitioned():
                        raise RuntimeError(PARTITIONED_SPEND_LOGS_PUSH_ERROR)
                    # Use prisma db push with increased timeout
+                    ProxyExtrasDBManager.raise_if_lens_rename_pending()
                    prisma_toolchain.run_prisma(
                        [_get_prisma_command(), "db", "push", "--accept-data-loss"],
                        timeout=prisma_command_timeout(),
--- a/litellm-proxy-extras/pyproject.toml
+++ b/litellm-proxy-extras/pyproject.toml
@ -1,9 +1,13 @@
 [project]
 name = "litellm-proxy-extras"
-version = "0.4.102"
+version = "0.4.103"
 description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package."
 readme = "README.md"
 requires-python = ">=3.9"
+dependencies = [
+    "psycopg>=3.2,<4.0",
+    "psycopg-binary>=3.2,<4.0",
+]
 license = "MIT"
 license-files = ["LICENSE"]
 authors = [
@ -26,7 +30,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.4.102"
+version = "0.4.103"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-proxy-extras==",
--- a/litellm-rust/.agents/skills/rust-tracing/SKILL.md
+++ b/litellm-rust/.agents/skills/rust-tracing/SKILL.md
@ -0,0 +1,22 @@
+---
+name: rust-tracing
+description: Add or change Rust diagnostic tracing in litellm-rust, including route spans, subscriber layers, and Python logger delivery
+---
+
+# Rust tracing
+
+Use upstream `tracing` throughout Rust, including `#[tracing::instrument]`, events, and span propagation. Centralize collection and delivery infrastructure in `crates/tracing`. Direct upstream imports still reach our configured subscriber; re-exporting macros does not control delivery. Do not introduce Rust `log` or `pyo3-log` for this path
+
+`litellm-tracing` owns shared subscriber layers, span field collection, and diagnostic processing. Keep adapters composable as `tracing_subscriber::Layer`s, with `Logger` providing host setup. Runtime-specific delivery belongs in the host bridge. The Python bridge delivers directly to the existing Python SDK logger, preserving its handlers, filtering, redaction, and request correlation. Keep Python dependencies out of `crates/tracing`
+
+Hosts configure subscribers. Keep Python execution scoped to its captured dispatch rather than installing a process-wide subscriber. Propagate both span context and dispatch across spawned work and returned streams
+
+In core, instrument execution shared by native calls and hosted machines. Use consistent route, model, provider, streaming, and outcome fields. Put status recording at shared provider boundaries instead of scattering basic logging through handlers. Keep upstream HTTP status separate from route success
+
+Use `skip_all` and explicitly selected fields. Basic tracing excludes bodies, credentials, headers, and raw error strings. Avoid automatic `ret` or `err` capture of sensitive values. Keep payload diagnostics separate and subject to existing redaction
+
+A returned stream retains its route span until exhaustion, error, or drop, with exactly one terminal outcome. Builder construction does not start a trace. Never hold a span entry guard across an await. Diagnostic tracing remains separate from lifecycle callbacks and `CustomLogger` dispatch
+
+Use `litellm_tracing::sink_layer` to compose a sink with other subscriber layers. It inherits span fields into events and emits span-close summaries with elapsed time. Test observable records, concurrent isolation, dynamic filtering, sensitive-field exclusion, and stream cancellation when changing this behavior
+
+Consult the [tracing API](https://docs.rs/tracing/latest/tracing/) and [subscriber layers](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/layer/index.html) for implementation details
--- a/litellm-rust/AGENTS.md
+++ b/litellm-rust/AGENTS.md
@ -1,5 +1,7 @@
 # Rust workspace rules

+For diagnostic tracing changes, follow [.agents/skills/rust-tracing/SKILL.md](.agents/skills/rust-tracing/SKILL.md)
+
 ## Test placement

 - Never create a `tests.rs` (or `test.rs`) file under `src/`, and never `#[path = "tests.rs"] mod tests;`
@ -16,7 +18,9 @@ Use [`#[rstest]`](https://docs.rs/rstest/latest/rstest/attr.rstest.html) for new
 ## Error definitions

 - A crate's errors live in `src/error.rs`, defined with `thiserror`, and re-exported from `lib.rs`
+- Put message templates in the variant's `#[error(...)]` declaration. Callers pass only the small typed arguments needed to fill them, never `Error::Variant(format!(...))` or a preformatted message. Keep the smallest set of neutral variants that callers need to distinguish; different wording or providers do not justify new variants
 - Default to one top-level `Error` enum per crate, with one variant per failure mode and a `#[error(...)]` message on each. A failure mode is something a caller handles differently (phase, status code, retry, a message Python parity pins exactly); failures no caller tells apart share one variant and differ only in its message
+- Keep shared error enums minimal and provider-neutral. Provider names, credential types, configuration fields, and setup guidance belong in caller-supplied data, not dedicated variants or hardcoded shared messages. Reuse a variant for the same failure mode across providers, such as `MissingApiBase { provider: "Azure", guidance: "..." }`. An exact parity message does not justify a provider-specific variant when caller-supplied context can preserve it
 - Wrap a lower-level error as a variant with `#[from]` or `#[source]` instead of flattening it to a string
 - Exception: split into separate types when different functions fail in disjoint ways, especially when different callers see them. A shared enum would force every caller to match variants its function can never return
 - Name a split type after what went wrong (a unit struct is fine for a single failure mode), not after the function that returns it
--- a/litellm-rust/Cargo.lock
+++ b/litellm-rust/Cargo.lock
--- a/litellm-rust/Cargo.toml
+++ b/litellm-rust/Cargo.toml
@ -12,12 +12,19 @@ repository = "https://github.com/BerriAI/litellm"
 litellm-config = { path = "crates/config" }
 litellm-router = { path = "crates/router" }
 litellm-tracing = { path = "crates/tracing" }
+litellm-traces = { path = "crates/traces" }
+litellm-storage-clickhouse = { path = "crates/storage-clickhouse" }
 litellm-core = { path = "crates/core" }
+litellm-gateway-mcp = { path = "crates/gateway-mcp" }
 litellm-gateway = { path = "crates/gateway" }
 litellm-gateway-inference = { path = "crates/gateway-inference" }
 litellm-gateway-auth = { path = "crates/gateway-auth" }
+litellm-gateway-management = { path = "crates/gateway-management" }
+litellm-gateway-ui = { path = "crates/gateway-ui" }
 litellm-coroutine = { path = "crates/coroutine" }
 litellm-host = { path = "crates/host" }
+litellm-host-http = { path = "crates/host-http" }
+litellm-host-native = { path = "crates/host-native" }
 litellm-callbacks-legacy-python = { path = "crates/callbacks-legacy-python" }
 litellm-framing = { path = "crates/framer" }
 litellm-auth = { path = "crates/auth" }
@ -34,8 +41,10 @@ litellm-secrets-azure = { path = "crates/secrets-azure" }
 litellm-secrets-cyberark = { path = "crates/secrets-cyberark" }
 litellm-http = { path = "crates/http" }
 litellm-llms = { path = "crates/llms" }
-litellm-types = { path = "crates/types" }
+litellm-llms-types = { path = "crates/llms-types" }
 litellm-core-utils = { path = "crates/core-utils" }
+litellm-db = { path = "crates/db" }
+litellm-db-testing = { path = "crates/db-testing" }
 litellm-cache = { path = "crates/cache" }
 litellm-cache-azure-blob = { path = "crates/cache-azure-blob" }
 litellm-cache-memory = { path = "crates/cache-memory" }
@ -56,6 +65,8 @@ litellm-python-compat = { path = "crates/python-compat" }

 tracing = "0.1"
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "multipart"] }
+axum-login = "0.18.0"
+tower-sessions = { version = "0.14.0", features = ["memory-store"] }
 bytes = "1"
 http = "1"
 google-cloud-auth = { version = "1.16.0", default-features = false }
@ -65,11 +76,13 @@ proptest = "1.7.0"
 pyo3 = "0.29.2"
 pyo3-async-runtimes = { version = "0.29.0", features = ["tokio-runtime"] }
 rand = "0.8"
+macro_rules_attribute = "0.2.3"
 schemars = "1"
 reqwest = { version = "0.12", default-features = false, features = ["json", "multipart", "rustls-tls", "http2", "stream"] }
 qdrant-client = { version = "1.19.0", default-features = false }
 uuid = { version = "1", features = ["v4"] }
 rstest = "0.26.1"
+wiremock = "0.6.5"
 rstest_reuse = "0.7.0"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 rustify = "=0.7.0"
@ -80,6 +93,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["float_roundtrip"] }
 serde_with = { version = "=3.16.1", default-features = false, features = ["std", "macros"] }
 sha2 = "0.10"
+sqlx = { version = "0.9.0", default-features = false, features = ["json", "macros", "postgres", "runtime-tokio", "chrono", "tls-rustls-ring-native-roots"] }
 subtle = "2"
 thiserror = "2.0"
 tokenizers = { version = "0.23.1", default-features = false, features = ["onig"] }
@ -103,6 +117,8 @@ time = { version = "0.3.53", features = ["parsing"] }
 criterion = "0.8.2"
 fancy-regex = "0.19.2"
 veil = "0.3.0"
+prost = "0.14.4"
+opentelemetry-proto = "0.33"

 [profile.release]
 opt-level = 3
--- a/litellm-rust/clippy.toml
+++ b/litellm-rust/clippy.toml
@ -1,4 +1,4 @@
-# The Tokio runtime is reached only through `host-python/src/execution.rs`, whose fork gate
+# The Tokio runtime is reached only through `host-python/src/runtime.rs`, whose fork gate
 # must see every entry. Going around it makes a fork-after-use hang instead of raising.
 disallowed-methods = [
    { path = "pyo3_async_runtimes::tokio::get_runtime", reason = "use litellm_host_python::run_sync / run_sync_value" },
@ -12,6 +12,13 @@ disallowed-methods = [
    { path = "reqwest::ClientBuilder::danger_accept_invalid_certs", reason = "set HttpClientConfig::verify instead" },
    { path = "reqwest::ClientBuilder::identity", reason = "set HttpClientConfig::client_certificate instead" },
    { path = "reqwest::ClientBuilder::use_preconfigured_tls", reason = "HttpClientConfig owns the TLS configuration" },
+    { path = "sqlx::query", reason = "use sqlx::query! or query_file! so the SQL is checked against the migrated schema" },
+    { path = "sqlx::query_as", reason = "use sqlx::query_as! or query_file_as! so the SQL is checked against the migrated schema" },
+    { path = "sqlx::query_scalar", reason = "use sqlx::query_scalar! so the SQL is checked against the migrated schema" },
+    { path = "sqlx::query_with", reason = "use sqlx::query! or query_file! so the SQL is checked against the migrated schema" },
+    { path = "sqlx::query_as_with", reason = "use sqlx::query_as! or query_file_as! so the SQL is checked against the migrated schema" },
+    { path = "sqlx::query_scalar_with", reason = "use sqlx::query_scalar! so the SQL is checked against the migrated schema" },
+    { path = "sqlx::raw_sql", reason = "raw_sql is unchecked; use the checked query macros" },
 ]

 # Every outbound client comes from litellm_http::HttpClientPool so it honors the host's TLS,
--- a/litellm-rust/crates/auth-azure/src/native.rs
+++ b/litellm-rust/crates/auth-azure/src/native.rs
@ -133,7 +133,7 @@ impl NativeAzureTokenAcquirer {
        let token = credential
            .get_token(&[scope.as_str()], None)
            .await
-            .map_err(|error| Error::AzureTokenAcquisition(error.to_string()))?;
+            .map_err(|error| Error::CredentialAcquisition(error.to_string().into()))?;
        let expires_on = u64::try_from(token.expires_on.unix_timestamp())
            .ok()
            .map(|seconds| UNIX_EPOCH + Duration::from_secs(seconds));
@ -250,7 +250,12 @@ fn validate_authority(request: &NativeAzureRequest) -> Result<(), Error> {
    let Some(authority) = authority else {
        return Ok(());
    };
-    let url = url::Url::parse(authority.value()).map_err(|_| Error::InvalidAzureAuthority)?;
+    let url = url::Url::parse(authority.value()).map_err(|_| {
+        Error::InvalidConfiguration(
+            "Azure authority must be an HTTPS origin without credentials, query, or fragment"
+                .into(),
+        )
+    })?;
    if url.scheme() != "https"
        || url.host_str().is_none()
        || !url.username().is_empty()
@ -259,7 +264,10 @@ fn validate_authority(request: &NativeAzureRequest) -> Result<(), Error> {
        || url.fragment().is_some()
        || !matches!(url.path(), "" | "/")
    {
-        return Err(Error::InvalidAzureAuthority);
+        return Err(Error::InvalidConfiguration(
+            "Azure authority must be an HTTPS origin without credentials, query, or fragment"
+                .into(),
+        ));
    }
    Ok(())
 }
@ -368,7 +376,9 @@ fn trusted_source(sources: &[InputSource]) -> InputSource {
 }

 fn mixed_sources<T>() -> Result<T, Error> {
-    Err(Error::MixedAzureCredentialSources)
+    Err(Error::InvalidConfiguration(
+        "request-controlled Azure auth inputs cannot be combined with host credentials".into(),
+    ))
 }

 fn build_credential(
@ -433,7 +443,12 @@ fn build_credential(
        NativeAzureRequest::DeveloperTools { .. } => DeveloperToolsCredential::new(None)
            .map(|credential| credential as Arc<dyn TokenCredential>),
    }
-    .map_err(|error| Error::AzureCredentialInitialization(error.to_string()))
+    .map_err(|error| {
+        Error::InvalidConfiguration(litellm_auth_types::ErrorDetail::failed(
+            "Azure credential initialization",
+            error,
+        ))
+    })
 }

 fn client_options(
@ -638,7 +653,7 @@ mod tests {
        assert_eq!(transport.requests.lock().unwrap().len(), 6);
    }

-    #[test]
+    #[rstest::rstest]
    fn request_authority_requires_request_owned_client_secret_identity() {
        let error = ValidatedAzureRequest::new(sourced_client_secret(
            InputSource::Deployment,
@ -647,10 +662,13 @@ mod tests {
        ))
        .unwrap_err();

-        assert!(matches!(
+        assert_eq!(
            error,
-            litellm_auth_types::Error::MixedAzureCredentialSources
-        ));
+            litellm_auth_types::Error::InvalidConfiguration(
+                "request-controlled Azure auth inputs cannot be combined with host credentials"
+                    .into()
+            )
+        );
    }

    #[test]
@ -665,24 +683,24 @@ mod tests {
        assert_eq!(request.credential_source(), InputSource::Request);
    }

-    #[test]
-    fn authority_is_restricted_to_an_https_origin() {
-        for authority in [
-            "http://login.example",
-            "https://user@login.example",
-            "https://login.example/tenant",
-            "https://login.example?target=other",
-        ] {
-            let error = ValidatedAzureRequest::new(sourced_client_secret(
-                InputSource::Deployment,
-                InputSource::Deployment,
-                authority,
-            ))
-            .unwrap_err();
-            assert!(matches!(
-                error,
-                litellm_auth_types::Error::InvalidAzureAuthority
-            ));
-        }
+    #[rstest::rstest]
+    #[case::http("http://login.example")]
+    #[case::userinfo("https://user@login.example")]
+    #[case::path("https://login.example/tenant")]
+    #[case::query("https://login.example?target=other")]
+    fn authority_is_restricted_to_an_https_origin(#[case] authority: &str) {
+        let error = ValidatedAzureRequest::new(sourced_client_secret(
+            InputSource::Deployment,
+            InputSource::Deployment,
+            authority,
+        ))
+        .unwrap_err();
+        assert_eq!(
+            error,
+            litellm_auth_types::Error::InvalidConfiguration(
+                "Azure authority must be an HTTPS origin without credentials, query, or fragment"
+                    .into()
+            )
+        );
    }
 }
--- a/litellm-rust/crates/auth-azure/src/resolve.rs
+++ b/litellm-rust/crates/auth-azure/src/resolve.rs
@ -91,7 +91,9 @@ impl AzureAuthService {
            AzureCredentialPlan::Caller(caller) => {
                let credential = caller.acquire().await?;
                if credential.secret().expose().is_empty() {
-                    return Err(Error::EmptyAzureToken);
+                    return Err(Error::EmptyCallerCredential(
+                        "Azure AD token provider returned an empty token",
+                    ));
                }
                Ok(Some(Sourced::new(credential, InputSource::Deployment)))
            }
@ -104,7 +106,11 @@ impl AzureAuthService {
            } => {
                let assertion = resolve_reference(inputs, env_lookup, reference.value())
                    .await?
-                    .ok_or(Error::UnresolvedOidcReference)?;
+                    .ok_or_else(|| {
+                        Error::CredentialAcquisition(
+                            "Azure OIDC reference did not resolve to a value".into(),
+                        )
+                    })?;
                let request = ValidatedAzureRequest::new(NativeAzureRequest::ClientAssertion {
                    tenant_id,
                    client_id,
@ -167,7 +173,7 @@ pub(crate) fn select_auth_plan(
                .map(|selector| Sourced::new(selector, value.source()))
        })
        .transpose()
-        .map_err(|_| Error::InvalidAzureSelector)?;
+        .map_err(|_| Error::InvalidConfiguration("invalid Azure credential selector".into()))?;
    let federated_token_file = configured_string(
        &inputs.federated_token_file,
        AZURE_FEDERATED_TOKEN_FILE_ENV,
@ -257,7 +263,9 @@ fn select_native_plan(
    let selection_source = selected.source();

    match selected.into_value() {
-        AzureCredentialType::ClientSecretCredential => Err(Error::MissingClientSecretFields),
+        AzureCredentialType::ClientSecretCredential => Err(Error::InvalidConfiguration(
+            "ClientSecretCredential requires tenant_id, client_id, and client_secret".into(),
+        )),
        AzureCredentialType::WorkloadIdentityCredential => {
            Ok(AzureCredentialPlan::Native(ValidatedAzureRequest::new(
                workload_request(tenant_id, client_id, federated_token_file, scope, authority)?,
@ -341,9 +349,17 @@ fn workload_request(
    authority: Option<Sourced<String>>,
 ) -> Result<NativeAzureRequest, Error> {
    Ok(NativeAzureRequest::WorkloadIdentity {
-        tenant_id: tenant_id.ok_or(Error::MissingWorkloadTenant)?,
-        client_id: client_id.ok_or(Error::MissingWorkloadClient)?,
-        token_file_path: token_file_path.ok_or(Error::MissingWorkloadTokenFile)?,
+        tenant_id: tenant_id.ok_or_else(|| {
+            Error::InvalidConfiguration("WorkloadIdentityCredential requires tenant_id".into())
+        })?,
+        client_id: client_id.ok_or_else(|| {
+            Error::InvalidConfiguration("WorkloadIdentityCredential requires client_id".into())
+        })?,
+        token_file_path: token_file_path.ok_or_else(|| {
+            Error::InvalidConfiguration(
+                "WorkloadIdentityCredential requires azure_federated_token_file".into(),
+            )
+        })?,
        scope,
        authority,
    })
@ -394,10 +410,11 @@ async fn resolve_reference(
            .map_or(CredentialLookup::Missing, CredentialLookup::Found),
        CredentialRef::None => return Ok(None),
        CredentialRef::File(_) | CredentialRef::Request(_) | CredentialRef::Host(_) => {
-            let resolver = inputs
-                .credential_resolver
-                .as_ref()
-                .ok_or(Error::MissingHostResolver)?;
+            let resolver = inputs.credential_resolver.as_ref().ok_or_else(|| {
+                Error::InvalidConfiguration(
+                    "credential reference requires a host credential resolver".into(),
+                )
+            })?;
            resolver.resolve(reference).await?
        }
    };
@ -415,7 +432,9 @@ fn oidc_reference(
    };
    let value = token.value().expose();
    if token.source() == InputSource::Request && value.starts_with("oidc/") {
-        return Err(Error::RequestAzureCredentialReference);
+        return Err(Error::InvalidConfiguration(
+            "request-controlled Azure credential references are not allowed".into(),
+        ));
    }
    if let Some(name) = value.strip_prefix("oidc/env/") {
        return non_empty_reference(name, "OIDC environment reference")
@ -437,14 +456,20 @@ fn oidc_reference(
        )));
    }
    if value.starts_with("oidc/") {
-        return Err(Error::UnsupportedOidcReference);
+        return Err(Error::InvalidConfiguration(
+            "unsupported OIDC reference".into(),
+        ));
    }
    Ok(None)
 }

 fn non_empty_reference(value: &str, kind: &str) -> Result<String, Error> {
    if value.is_empty() {
-        return Err(Error::EmptyReference(kind.to_string()));
+        return Err(Error::InvalidConfiguration(
+            litellm_auth_types::ErrorDetail::Empty {
+                subject: kind.into(),
+            },
+        ));
    }
    Ok(value.to_string())
 }
@ -493,7 +518,7 @@ mod tests {
                        expires_on: None,
                    })
                } else {
-                    Err(Error::AzureTokenAcquisition(format!("{kind} failed")))
+                    Err(Error::CredentialAcquisition(kind.into()))
                }
            })
        }
@ -602,7 +627,7 @@ mod tests {
        assert!(error.to_string().contains("unsupported OIDC reference"));
    }

-    #[test]
+    #[rstest::rstest]
    fn request_oidc_reference_is_rejected_before_lookup() {
        let params = json!({
            "azure_ad_token": "oidc/env/ASSERTION",
@ -624,7 +649,12 @@ mod tests {
        })
        .unwrap_err();

-        assert!(matches!(error, Error::RequestAzureCredentialReference));
+        assert_eq!(
+            error,
+            Error::InvalidConfiguration(
+                "request-controlled Azure credential references are not allowed".into()
+            )
+        );
    }

    #[tokio::test]
@ -723,6 +753,7 @@ mod tests {
        assert_eq!(credential.value().secret().expose(), "caller-token");
    }

+    #[rstest::rstest]
    #[tokio::test]
    async fn empty_caller_token_is_rejected() {
        let error = AzureAuthService::default()
@ -730,6 +761,9 @@ mod tests {
            .await
            .unwrap_err();

-        assert!(matches!(error, Error::EmptyAzureToken));
+        assert_eq!(
+            error,
+            Error::EmptyCallerCredential("Azure AD token provider returned an empty token")
+        );
    }
 }
--- a/litellm-rust/crates/auth-azure/src/types.rs
+++ b/litellm-rust/crates/auth-azure/src/types.rs
@ -117,7 +117,12 @@ fn string_config(
        None => Ok(ConfigValue::Absent),
        Some(Value::Null) => Ok(ConfigValue::ExplicitNone(source)),
        Some(Value::String(value)) => Ok(ConfigValue::Value(Sourced::new(value.clone(), source))),
-        Some(_) => Err(Error::InvalidFieldType(name.to_string())),
+        Some(_) => Err(Error::InvalidConfiguration(
+            litellm_auth_types::ErrorDetail::InvalidType {
+                field: name.into(),
+                expected: "a string or null",
+            },
+        )),
    }
 }

--- a/litellm-rust/crates/auth-gcp/Cargo.toml
+++ b/litellm-rust/crates/auth-gcp/Cargo.toml
@ -19,3 +19,6 @@ tokio.workspace = true
 gcp_auth = "0.12.7"
 google-cloud-auth = { workspace = true, optional = true }
 http = { workspace = true, optional = true }
+
+[dev-dependencies]
+rstest.workspace = true
--- a/litellm-rust/crates/auth-gcp/src/lib.rs
+++ b/litellm-rust/crates/auth-gcp/src/lib.rs
@ -299,7 +299,7 @@ fn validate_request_credentials(configured: &str) -> Result<&str, Error> {
                .map(str::to_string)
        });
    if token_uri.as_deref() != Some(GOOGLE_OAUTH_TOKEN_ENDPOINT) {
-        return Err(Error::RequestVertexTokenEndpoint);
+        return Err(Error::InvalidConfiguration("request-controlled Vertex credentials must use the canonical Google OAuth token endpoint".into()));
    }
    Ok(configured)
 }
@ -376,10 +376,20 @@ fn optional_credentials(
                    .map(SecretValue::new)
                    .map(|value| Sourced::new(value, source))
                    .map(Some)
-                    .map_err(|error| Error::InvalidFieldType(format!("{}: {error}", names[0])));
+                    .map_err(|error| {
+                        Error::InvalidConfiguration(litellm_auth_types::ErrorDetail::failed(
+                            "credential serialization",
+                            error,
+                        ))
+                    });
            }
            Some(_) => {
-                return Err(Error::InvalidFieldType(names[0].to_string()));
+                return Err(Error::InvalidConfiguration(
+                    litellm_auth_types::ErrorDetail::InvalidType {
+                        field: names[0].into(),
+                        expected: "a string or null",
+                    },
+                ));
            }
        }
    }
@ -397,7 +407,12 @@ fn optional_string(params: &Map<String, Value>, names: &[&str]) -> Result<Option
            Some(Value::String(value)) if value.trim().is_empty() => continue,
            Some(Value::String(value)) => return Ok(Some(value.clone())),
            Some(_) => {
-                return Err(Error::InvalidFieldType(names[0].to_string()));
+                return Err(Error::InvalidConfiguration(
+                    litellm_auth_types::ErrorDetail::InvalidType {
+                        field: names[0].into(),
+                        expected: "a string or null",
+                    },
+                ));
            }
        }
    }
@ -411,7 +426,10 @@ fn non_empty_env(env_lookup: &dyn Fn(&str) -> Option<String>, name: &str) -> Opt
 }

 fn auth_acquisition_error(error: gcp_auth::Error) -> Error {
-    Error::VertexTokenAcquisition(error.to_string())
+    Error::CredentialAcquisition(litellm_auth_types::ErrorDetail::failed(
+        "Vertex AI credentials",
+        error,
+    ))
 }

 #[cfg(test)]
@ -612,20 +630,15 @@ mod tests {
        );
    }

-    #[test]
-    fn request_credentials_require_canonical_token_endpoint() {
-        assert!(
-            validate_request_credentials(r#"{"token_uri":"https://oauth2.googleapis.com/token"}"#)
-                .is_ok()
-        );
-        assert!(matches!(
-            validate_request_credentials(r#"{"token_uri":"http://127.0.0.1/token"}"#),
-            Err(Error::RequestVertexTokenEndpoint)
-        ));
-        assert!(matches!(
-            validate_request_credentials("{}"),
-            Err(Error::RequestVertexTokenEndpoint)
-        ));
+    #[rstest::rstest]
+    #[case::canonical_endpoint(r#"{"token_uri":"https://oauth2.googleapis.com/token"}"#, true)]
+    #[case::noncanonical_endpoint(r#"{"token_uri":"http://127.0.0.1/token"}"#, false)]
+    #[case::missing_endpoint("{}", false)]
+    fn request_credentials_require_canonical_token_endpoint(
+        #[case] credentials: &str,
+        #[case] accepted: bool,
+    ) {
+        assert_eq!(validate_request_credentials(credentials).is_ok(), accepted);
    }

    #[tokio::test]
--- a/litellm-rust/crates/auth-types/Cargo.toml
+++ b/litellm-rust/crates/auth-types/Cargo.toml
@ -12,4 +12,5 @@ thiserror.workspace = true
 veil.workspace = true

 [dev-dependencies]
+rstest.workspace = true
 tokio.workspace = true
--- a/litellm-rust/crates/auth-types/src/credential.rs
+++ b/litellm-rust/crates/auth-types/src/credential.rs
@ -86,7 +86,9 @@ impl CredentialPlan {
            Self::Caller(caller) => {
                let credential = caller.acquire().await?;
                if credential.secret().expose().is_empty() {
-                    return Err(Error::EmptyCallerCredential);
+                    return Err(Error::EmptyCallerCredential(
+                        "credential caller returned an empty credential",
+                    ));
                }
                Ok(CredentialPlanResolution::Resolved(credential))
            }
@ -147,10 +149,15 @@ mod tests {

    impl CredentialResolver for FailingResolver {
        fn resolve<'a>(&'a self, _reference: &'a CredentialRef) -> CredentialLookupFuture<'a> {
-            Box::pin(async { Err(Error::UnresolvedOidcReference) })
+            Box::pin(async {
+                Err(Error::CredentialAcquisition(
+                    "host credential lookup failed".into(),
+                ))
+            })
        }
    }

+    #[rstest::rstest]
    #[tokio::test]
    async fn acquisition_failure_is_terminal() {
        let resolver = CredentialResolverHandle::new(Arc::new(FailingResolver));
@ -161,6 +168,9 @@ mod tests {
            .await
            .expect_err("acquisition errors cannot become fallback");

-        assert_eq!(error, Error::UnresolvedOidcReference);
+        assert_eq!(
+            error,
+            Error::CredentialAcquisition("host credential lookup failed".into())
+        );
    }
 }
--- a/litellm-rust/crates/auth-types/src/error.rs
+++ b/litellm-rust/crates/auth-types/src/error.rs
@ -2,84 +2,16 @@ use thiserror::Error as ThisError;

 #[derive(Clone, Debug, ThisError, PartialEq, Eq)]
 pub enum Error {
-    #[error("invalid authentication configuration: credential header already exists")]
-    ExistingCredentialHeader,
-    #[error(
-        "invalid authentication configuration: credential plan is not allowed by the provider auth policy"
-    )]
-    DisallowedCredentialPlan,
-    #[error("invalid authentication configuration: credential cannot be empty")]
-    EmptyCredential,
-    #[error("invalid authentication configuration: invalid Azure credential selector")]
-    InvalidAzureSelector,
-    #[error(
-        "invalid authentication configuration: ClientSecretCredential requires tenant_id, client_id, and client_secret"
-    )]
-    MissingClientSecretFields,
-    #[error("invalid authentication configuration: WorkloadIdentityCredential requires tenant_id")]
-    MissingWorkloadTenant,
-    #[error("invalid authentication configuration: WorkloadIdentityCredential requires client_id")]
-    MissingWorkloadClient,
-    #[error(
-        "invalid authentication configuration: WorkloadIdentityCredential requires azure_federated_token_file"
-    )]
-    MissingWorkloadTokenFile,
-    #[error(
-        "invalid authentication configuration: credential reference requires a host credential resolver"
-    )]
-    MissingHostResolver,
-    #[error(
-        "invalid authentication configuration: caller credential plan requires provider-specific inputs"
-    )]
-    MissingCallerInputs,
-    #[error("invalid authentication configuration: credential header {0} already exists")]
-    DuplicateHeader(&'static str),
-    #[error("invalid authentication configuration: {0} must be a string or null")]
-    InvalidFieldType(String),
-    #[error("invalid authentication configuration: unsupported OIDC reference")]
-    UnsupportedOidcReference,
-    #[error("invalid authentication configuration: {0} cannot be empty")]
-    EmptyReference(String),
-    #[error("invalid authentication configuration: Azure credential initialization failed: {0}")]
-    AzureCredentialInitialization(String),
-    #[error(
-        "invalid authentication configuration: Azure authority must be an HTTPS origin without credentials, query, or fragment"
-    )]
-    InvalidAzureAuthority,
-    #[error(
-        "invalid authentication configuration: request-controlled Azure auth inputs cannot be combined with host credentials"
-    )]
-    MixedAzureCredentialSources,
-    #[error(
-        "invalid authentication configuration: request-controlled Azure credential references are not allowed"
-    )]
-    RequestAzureCredentialReference,
-    #[error(
-        "invalid authentication configuration: host credentials cannot be sent to a request-controlled Azure endpoint"
-    )]
-    RequestAzureCredentialDestination,
-    #[error(
-        "invalid authentication configuration: credentials cannot be sent to a request-controlled Vertex AI endpoint"
-    )]
-    RequestVertexCredentialDestination,
-    #[error(
-        "invalid authentication configuration: request-controlled Vertex credentials must use the canonical Google OAuth token endpoint"
-    )]
-    RequestVertexTokenEndpoint,
+    #[error("invalid authentication configuration: {0}")]
+    InvalidConfiguration(#[source] ErrorDetail),
    #[error("credential acquisition failed: {0}")]
-    AzureTokenAcquisition(String),
-    #[error("credential acquisition failed: Vertex AI credentials: {0}")]
-    VertexTokenAcquisition(String),
+    CredentialAcquisition(#[source] ErrorDetail),
+    #[error("credential caller failed: {0}")]
+    EmptyCallerCredential(&'static str),
    #[error("{0}")]
    ProviderAuthentication(String),
    #[error("credential acquisition failed: {}", .0.iter().map(ToString::to_string).collect::<Vec<_>>().join("; "))]
    CredentialChain(Vec<Error>),
-    #[error("credential caller failed: credential caller returned an empty credential")]
-    EmptyCallerCredential,
-    #[error("credential caller failed: Azure AD token provider returned an empty token")]
-    EmptyAzureToken,
-    #[error("credential acquisition failed: Azure OIDC reference did not resolve to a value")]
-    UnresolvedOidcReference,
    #[error(
        "Missing {provider} API Key - Set `api_key` or the {environment_variable} environment variable"
    )]
@ -87,34 +19,87 @@ pub enum Error {
        provider: &'static str,
        environment_variable: &'static str,
    },
-    #[error(
-        "Missing {provider} API Base - Set {environment_variable} environment variable or pass api_base parameter"
-    )]
+    #[error("Missing {provider} API Base - {guidance}")]
    MissingApiBase {
        provider: &'static str,
-        environment_variable: &'static str,
+        guidance: &'static str,
    },
-    #[error(
-        "Missing Azure API Base - Set `api_base` or the AZURE_API_BASE environment variable. Expected format: https://<resource-name>.services.ai.azure.com/anthropic"
-    )]
-    MissingAzureApiBase,
    #[error("invalid authentication header")]
    InvalidHeader,
 }

-#[cfg(test)]
-mod tests {
-    use super::Error;
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+pub enum ErrorDetail {
+    #[error("{0}")]
+    Message(String),
+    #[error("{field} must be {expected}")]
+    InvalidType {
+        field: String,
+        expected: &'static str,
+    },
+    #[error("{subject} cannot be empty")]
+    Empty { subject: String },
+    #[error("credential header {0} already exists")]
+    DuplicateHeader(&'static str),
+    #[error("{operation} failed: {source}")]
+    Failed {
+        operation: &'static str,
+        #[source]
+        source: ErrorSource,
+    },
+}

-    #[test]
-    fn missing_api_key_names_provider_and_environment_variable() {
-        assert_eq!(
-            Error::MissingApiKey {
-                provider: "Anthropic",
-                environment_variable: "ANTHROPIC_API_KEY",
-            }
-            .to_string(),
-            "Missing Anthropic API Key - Set `api_key` or the ANTHROPIC_API_KEY environment variable"
-        );
+impl ErrorDetail {
+    pub fn failed(
+        operation: &'static str,
+        source: impl std::error::Error + Send + Sync + 'static,
+    ) -> Self {
+        Self::Failed {
+            operation,
+            source: ErrorSource::new(source),
+        }
    }
 }
+
+impl From<String> for ErrorDetail {
+    fn from(message: String) -> Self {
+        Self::Message(message)
+    }
+}
+
+impl From<&str> for ErrorDetail {
+    fn from(message: &str) -> Self {
+        Self::Message(message.into())
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct ErrorSource(std::sync::Arc<dyn std::error::Error + Send + Sync>);
+
+impl std::ops::Deref for ErrorSource {
+    type Target = dyn std::error::Error + Send + Sync;
+
+    fn deref(&self) -> &Self::Target {
+        self.0.as_ref()
+    }
+}
+
+impl std::fmt::Display for ErrorSource {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        std::fmt::Display::fmt(&self.0, formatter)
+    }
+}
+
+impl ErrorSource {
+    pub fn new(error: impl std::error::Error + Send + Sync + 'static) -> Self {
+        Self(std::sync::Arc::new(error))
+    }
+}
+
+impl PartialEq for ErrorSource {
+    fn eq(&self, other: &Self) -> bool {
+        std::sync::Arc::ptr_eq(&self.0, &other.0)
+    }
+}
+
+impl Eq for ErrorSource {}
--- a/litellm-rust/crates/auth-types/src/http.rs
+++ b/litellm-rust/crates/auth-types/src/http.rs
@ -21,13 +21,17 @@ pub fn apply_credential(
    placement: CredentialPlacement,
 ) -> Result<Vec<(String, String)>, Error> {
    if credential.trim().is_empty() {
-        return Err(Error::EmptyCredential);
+        return Err(Error::InvalidConfiguration(
+            "credential cannot be empty".into(),
+        ));
    }
    if headers
        .iter()
        .any(|(name, _)| name.eq_ignore_ascii_case(placement.header_name()))
    {
-        return Err(Error::DuplicateHeader(placement.header_name()));
+        return Err(Error::InvalidConfiguration(
+            crate::ErrorDetail::DuplicateHeader(placement.header_name()),
+        ));
    }
    let value = match placement {
        CredentialPlacement::Bearer => format!("Bearer {credential}"),
--- a/Show more
+++ b/Show more