Merge remote-tracking branch 'origin/main' into litellm_usage_url_state

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.circleci/scripts/classify_changes.sh

@@ -1,28 +1,27 @@
 #!/usr/bin/env bash
 set -uo pipefail
 
-category="${1:?usage: classify_changes.sh <backend|client|ui|provider-harness|cost-map-only|mcp-dependencies|windows-release>}"
+category="${1:?usage: classify_changes.sh <backend|client|ui|cost-map-only|mcp-dependencies|windows-release|redis-compat>}"
 
 has_client=false
 has_backend=false
 has_ci=false
-has_provider_harness=false
 has_cost_map=false
 has_mcp_dependencies=false
 has_windows_release=false
+has_redis_compat=false
 outside_cost_map_set=false
 while IFS= read -r file || [ -n "$file" ]; do
   [ -n "$file" ] || continue
+  case "$file" in
+    litellm/_redis.py | litellm/_redis_credential_provider.py | litellm/caching/redis_cache.py | litellm/caching/evicted_client_closer.py | tests/unit/test_redis.py | tests/integration/sdk/test_redis_cluster_iam_auth.py | tests/unit/caching/test_redis_connection_pool.py | tests/unit/caching/test_redis_cluster_cache.py | tests/unit/caching/test_evicted_client_closer.py | .github/workflows/test-unit.yml | .github/actions/detect-changes/* | .github/scripts/detect_changes.sh | .circleci/scripts/classify_changes.sh | tests/integration/run.py | pyproject.toml | uv.lock)
+      has_redis_compat=true ;;
+  esac
   case "$file" in
     *.md | *.mdx) : ;;
     pyproject.toml | */pyproject.toml | uv.lock | uv.toml | .python-version | rust-toolchain.toml | litellm-rust/* | litellm/__init__.py | litellm/proxy/proxy_server.py | litellm/*mcp* | tests/*mcp* | litellm/integrations/arize/* | tests/base_sdk_tests/* | scripts/check_mcp_sdk_install.py | .github/workflows/test-mcp-dependency-resolution.yml | .github/actions/detect-changes/* | .github/actions/setup-uv-with-retries/* | .github/actions/cache-cargo-build/* | .github/scripts/detect_changes.sh | .github/scripts/uv_sync_with_retries.sh | .circleci/scripts/classify_changes.sh | tests/unit/test_circleci_path_filter.py | tests/unit/test_detect_changes.py)
       has_mcp_dependencies=true ;;
   esac
-  case "$file" in
-    tests/e2e/*/*.py) : ;;
-    tests/e2e/*.py | tests/code_coverage_tests/test_provider_cache.py | tests/code_coverage_tests/test_provider_replay_harness.py | tests/unit/test_circleci_path_filter.py | .circleci/* | pyproject.toml | uv.lock)
-      has_provider_harness=true ;;
-  esac
   case "$file" in
     litellm-rust/* | litellm/rust_bridge/* | rust-toolchain.toml | pyproject.toml | uv.lock | tests/windows_tests/* | .circleci/*)
       has_windows_release=true ;;
@@ -36,7 +35,7 @@ while IFS= read -r file || [ -n "$file" ]; do
   case "$file" in
     model_prices_and_context_window.json | litellm/model_prices_and_context_window_backup.json | model_prices_and_context_window.schema.json)
       has_cost_map=true ;;
-    tests/test_litellm/* | tests/proxy_unit_tests/* | tests/unit/proxy/*) : ;;
+    tests/unit/proxy/*) : ;;
     *) outside_cost_map_set=true ;;
   esac
 done
@@ -48,12 +47,12 @@ case "$category" in
   cost-map-only)
     { [ "$has_cost_map" = true ] && [ "$outside_cost_map_set" = false ]; } && echo run || echo skip
     ;;
-  provider-harness)
-    [ "$has_provider_harness" = true ] && echo run || echo skip
-    ;;
   windows-release)
     [ "$has_windows_release" = true ] && echo run || echo skip
     ;;
+  redis-compat)
+    [ "$has_redis_compat" = true ] && echo run || echo skip
+    ;;
   backend)
     [ "$has_backend" = true ] && echo run || echo skip
     ;;

.circleci/scripts/path_filter.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -uo pipefail
 
-category="${1:?usage: path_filter.sh <backend|client|provider-harness>}"
+category="${1:?usage: path_filter.sh <backend|client|windows-release>}"
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 run_full() {

.circleci/scripts/run_integration.sh

@@ -72,7 +72,7 @@ export PATH="$PWD/.venv/bin:$PATH"
 export PYTHONPATH="$PWD:$PWD/tests:$PWD/tests/e2e"
 export DATABASE_URL="postgresql://postgres:postgres@127.0.0.1:5432/circle_test"
 export REDIS_HOST=127.0.0.1 REDIS_PORT=6379
-export LITELLM_MASTER_KEY=sk-integration-master LITELLM_SALT_KEY=sk-integration-salt
+export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 16)" LITELLM_SALT_KEY=sk-integration-salt
 export LITELLM_MODE=PRODUCTION LITELLM_LOCAL_MODEL_COST_MAP=True
 export STORE_MODEL_IN_DB=True AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1
 export INTEGRATION_PROXY_URL=http://127.0.0.1:4000
@@ -128,14 +128,31 @@ fi
 sudo iptables -L integration_only -n -v -x > "$results/egress-guard.txt"
 awk '$3 == "REJECT" && $1 > 0 { rejected=1 } END { exit !rejected }' "$results/egress-guard.txt"
 
-setsid env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" INTEGRATION_RUN_ID="$integration_identity" \
-  .venv/bin/python -m integration._support.upstream > "$results/upstream.log" 2>&1 &
-upstream_pid=$!
+if [ "$mode" = parity ]; then
+  export INTEGRATION_WORKERS=1
+else
+  case "$suite" in
+    management|accounting) export INTEGRATION_WORKERS=2 ;;
+    providers|extensions) export INTEGRATION_WORKERS=4 ;;
+  esac
+fi
 if [ "$suite" = cost ]; then
   export INTEGRATION_WORKERS=8
 fi
+if [ "$suite" = security ]; then
+  export INTEGRATION_WORKERS=4
+fi
 if [ "$suite" = mcp ]; then
-  export INTEGRATION_WORKERS=4 INTEGRATION_COVERAGE=1
+  export INTEGRATION_WORKERS=2 INTEGRATION_COVERAGE=1
+fi
+isolated_workers=false
+if [ "${INTEGRATION_WORKERS:-1}" -gt 1 ]; then
+  isolated_workers=true
+fi
+if [ "$isolated_workers" = false ]; then
+  setsid env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" INTEGRATION_RUN_ID="$integration_identity" \
+    .venv/bin/python -m integration._support.upstream > "$results/upstream.log" 2>&1 &
+  upstream_pid=$!
 fi
 coverage_data="$PWD/$results/coverage/data"
 proxy_command=(.venv/bin/python -m integration._support.proxy)
@@ -177,26 +194,28 @@ start_proxy() {
     > "$results/$log_name" 2>&1 &
   launched_pid=$!
 }
-start_proxy 4000 proxy.log
-proxy_pid="$launched_pid"
-.venv/bin/python .circleci/scripts/wait_integration_services.py
-curl --noproxy '*' -sSf -X POST "$INTEGRATION_PROXY_URL/config/update" \
-  -H "Authorization: Bearer $LITELLM_MASTER_KEY" -H 'Content-Type: application/json' \
-  -d '{"router_settings": {"num_retries": 0}}' > "$results/seed-router-settings.json"
-if [ "$suite" = management ] || [ "$suite" = mcp ]; then
-  export INTEGRATION_PEER_URL=http://127.0.0.1:4001
-  start_proxy 4001 peer.log
-  peer_pid="$launched_pid"
+if [ "$isolated_workers" = false ]; then
+  start_proxy 4000 proxy.log
+  proxy_pid="$launched_pid"
   .venv/bin/python .circleci/scripts/wait_integration_services.py
+  curl --noproxy '*' -sSf -X POST "$INTEGRATION_PROXY_URL/config/update" \
+    -H "Authorization: Bearer $LITELLM_MASTER_KEY" -H 'Content-Type: application/json' \
+    -d '{"router_settings": {"num_retries": 0}}' > "$results/seed-router-settings.json"
+  if [ "$suite" = management ] || [ "$suite" = mcp ]; then
+    export INTEGRATION_PEER_URL=http://127.0.0.1:4001
+    start_proxy 4001 peer.log
+    peer_pid="$launched_pid"
+    .venv/bin/python .circleci/scripts/wait_integration_services.py
+  fi
 fi
 
 if [ "$suite" = providers ]; then
   INTEGRATION_RUN_ID="$integration_identity" .venv/bin/python -m pytest --tb=short --noconftest -o addopts= \
     --strict-markers --strict-config -p no:pytest-retry -p no:rerunfailures --timeout=30 \
-    tests/e2e/test_provider_edge.py::TestReplayMode::test_content_drift_returns_the_miss_status_naming_both_keys \
-    tests/e2e/test_provider_edge.py::TestReplayMode::test_exhausted_key_returns_the_miss_status \
-    tests/e2e/test_provider_edge.py::TestReplayLeftover::test_partially_consumed_recording_names_the_leftover \
-    tests/e2e/test_provider_edge.py::TestStreamingFidelity::test_replay_of_a_stream_makes_no_provider_connection \
+    tests/e2e_harness/test_provider_edge.py::TestReplayMode::test_content_drift_returns_the_miss_status_naming_both_keys \
+    tests/e2e_harness/test_provider_edge.py::TestReplayMode::test_exhausted_key_returns_the_miss_status \
+    tests/e2e_harness/test_provider_edge.py::TestReplayLeftover::test_partially_consumed_recording_names_the_leftover \
+    tests/e2e_harness/test_provider_edge.py::TestStreamingFidelity::test_replay_of_a_stream_makes_no_provider_connection \
     --junitxml="$results/replay-controls.xml"
 fi
 
@@ -213,30 +232,42 @@ if [ "$suite" = browser ]; then
   exit 0
 fi
 
-node_files=()
+shard_arguments=()
 if [ "${CIRCLE_NODE_TOTAL:-1}" -gt 1 ]; then
-  split="$(.venv/bin/python tests/integration/run.py "$suite" --list \
-    | circleci tests split --split-by=timings --timings-type=filename)"
-  read -r -a node_files <<< "$(printf '%s' "$split" | tr '\n' ' ')"
-  test "${#node_files[@]}" -gt 0
-  printf '%s\n' "${node_files[@]}" > "$results/node-files.txt"
+  .venv/bin/python tests/integration/run.py "$suite" --list \
+    | circleci tests split --split-by=timings --timings-type=filename > "$results/node-files.txt"
+  shard_arguments=(--shard-files "$results/node-files.txt")
+fi
+
+shared_services=()
+worker_coverage=()
+if [ "$isolated_workers" = false ]; then
+  shared_services=(
+    "REDIS_HOST=$REDIS_HOST" "REDIS_PORT=$REDIS_PORT"
+    "INTEGRATION_PROXY_URL=$INTEGRATION_PROXY_URL" "INTEGRATION_PEER_URL=$INTEGRATION_PEER_URL"
+    "INTEGRATION_UPSTREAM_URL=$INTEGRATION_UPSTREAM_URL" "INTEGRATION_MASTER_KEY=$INTEGRATION_MASTER_KEY"
+  )
+elif [ "${INTEGRATION_COVERAGE:-0}" = 1 ]; then
+  worker_coverage=("INTEGRATION_COVERAGE_FILE=$coverage_data")
 fi
 
 env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
   INTEGRATION_RUN_ID="$integration_identity" \
-  DATABASE_URL="$DATABASE_URL" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
-  INTEGRATION_PROXY_URL="$INTEGRATION_PROXY_URL" INTEGRATION_PEER_URL="$INTEGRATION_PEER_URL" \
-  INTEGRATION_UPSTREAM_URL="$INTEGRATION_UPSTREAM_URL" \
+  DATABASE_URL="$DATABASE_URL" \
+  "${shared_services[@]}" "${worker_coverage[@]}" \
   INTEGRATION_WORKERS="${INTEGRATION_WORKERS:-1}" \
-  INTEGRATION_MASTER_KEY="$INTEGRATION_MASTER_KEY" LITELLM_MODE=PRODUCTION \
+  LITELLM_MODE=PRODUCTION \
   LITELLM_LICENSE="${LITELLM_LICENSE:-}" \
   INTEGRATION_SEED="$INTEGRATION_SEED" \
   INTEGRATION_ORDER_SEED="$INTEGRATION_ORDER_SEED" \
+  INTEGRATION_CASE_SHARDS="${CIRCLE_NODE_TOTAL:-1}" INTEGRATION_CASE_SHARD_INDEX="${CIRCLE_NODE_INDEX:-0}" \
   LITELLM_LOCAL_MODEL_COST_MAP=True AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 \
   INTEGRATION_PROXY_DATABASE_URL="$INTEGRATION_PROXY_DATABASE_URL" \
   INTEGRATION_PROXY_READ_REPLICA_URL="$INTEGRATION_PROXY_READ_REPLICA_URL" \
   INTEGRATION_ROUTING="$INTEGRATION_ROUTING" \
-  .venv/bin/python tests/integration/run.py "$suite" --results "$results" "${node_files[@]}"
+  MCP_TEST_PEER_PYTHON="${MCP_TEST_PEER_PYTHON:-}" \
+  .venv/bin/python tests/integration/run.py "$suite" --results "$results" \
+  "${shard_arguments[@]}"
 
 if [ "${INTEGRATION_COVERAGE:-0}" = 1 ]; then
   for covered_pid in "$proxy_pid" "$peer_pid"; do

.circleci/scripts/run_migration_tests.py

@@ -10,7 +10,7 @@ from typing import Final
 from xml.etree import ElementTree
 
 SUITES: Final = {
-    "startup": (("test_startup.py",), 12),
+    "startup": (("test_startup.py",), 13),
     "recovery": (("test_recovery.py",), 15),
     "legacy": (("test_legacy.py", "test_pooling.py"), 11),
     "upgrade": (("test_upgrade.py", "test_rolling_upgrade.py"), 5),

.circleci/scripts/unit_selection.sh

@@ -1,186 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-flag="${1:?usage: unit_selection.sh <codecov flag>}"
-
-legacy_flags=(
-  caching-local
-  core-utils
-  enterprise-package
-  enterprise-routing
-  integrations
-  llm-other-providers
-  llm-vertex-ai
-  mcp-integration
-  misc
-  proxy-db-auth-checks
-  proxy-db-budgets
-  proxy-db-custom-logging
-  proxy-db-db-and-spend
-  proxy-db-endpoints-and-responses
-  proxy-db-guardrails-hooks
-  proxy-db-jwt-and-keys
-  proxy-db-key-generation
-  proxy-db-logging-misc
-  proxy-db-proxy-runtime
-  proxy-db-proxy-server-core
-  proxy-db-proxy-utils
-  proxy-extras
-  proxy-infra
-  responses-caching-types
-)
-
-legacy_paths() {
-  case "$1" in
-    caching-local) echo tests/unit/caching ;;
-    core-utils) echo tests/unit/litellm_core_utils ;;
-    enterprise-package)
-      echo tests/unit/enterprise/integrations
-      echo tests/unit/enterprise/proxy/auth
-      echo tests/unit/enterprise/proxy/guardrails
-      echo tests/unit/enterprise/proxy/hooks
-      echo tests/unit/enterprise/proxy/management_endpoints
-      echo tests/unit/enterprise/proxy/test_audit_logging_endpoints.py
-      echo tests/unit/enterprise/enterprise_callbacks/test_prometheus_logging_callbacks.py ;;
-    enterprise-routing)
-      echo tests/unit/google_genai
-      echo tests/unit/router_strategy
-      echo tests/unit/router_utils
-      echo tests/unit/proxy/common_utils/test_cache_aware_routing.py
-      echo tests/unit/enterprise/enterprise_callbacks/send_emails
-      echo tests/unit/enterprise/proxy/test_afile_retrieve_returns_unified_id.py
-      echo tests/unit/enterprise/proxy/test_batch_retrieve_input_file_id.py
-      echo tests/unit/enterprise/proxy/test_batch_retrieve_registers_missing_output_file_id.py
-      echo tests/unit/enterprise/proxy/test_batch_retrieve_returns_unified_input_file_id.py
-      echo tests/unit/enterprise/proxy/test_batch_update_db_managed_output_file_id.py
-      echo tests/unit/enterprise/proxy/test_deleted_file_returns_403_not_404.py
-      echo tests/unit/enterprise/proxy/test_enterprise_routes.py
-      echo tests/unit/enterprise/proxy/test_file_deletion_blocking.py
-      echo tests/unit/enterprise/proxy/test_managed_files_access_check.py
-      echo tests/unit/enterprise/proxy/test_managed_files_hook.py ;;
-    integrations) echo tests/unit/integrations ;;
-    llm-other-providers) find tests/unit/llms -name 'test_*.py' -not -path 'tests/unit/llms/vertex_ai/*' ;;
-    llm-vertex-ai) echo tests/unit/llms/vertex_ai ;;
-    mcp-integration)
-      echo tests/unit/experimental_mcp_client
-      echo tests/unit/proxy/_experimental/mcp_server
-      echo tests/unit/responses/mcp
-      echo tests/mcp_tests/test_proxy_mcp_e2e.py ;;
-    misc)
-      find tests/unit -maxdepth 1 -name 'test_*.py'
-      echo tests/unit/test_router
-      echo tests/unit/a2a_protocol
-      echo tests/unit/batches
-      echo tests/unit/chat_completions
-      echo tests/unit/completion_extras
-      echo tests/unit/containers
-      echo tests/unit/embeddings
-      echo tests/unit/endpoints
-      echo tests/unit/files
-      echo tests/unit/harness
-      echo tests/unit/images
-      echo tests/unit/interactions
-      echo tests/unit/messages
-      echo tests/unit/rag
-      echo tests/unit/rerank_api
-      echo tests/unit/rust_bridge
-      echo tests/unit/secret_managers
-      echo tests/unit/vector_stores
-      echo tests/unit/videos ;;
-    proxy-db-auth-checks)
-      echo tests/unit/proxy/auth/test_auth_checks.py
-      echo tests/unit/proxy/auth/test_user_api_key_auth.py
-      echo tests/unit/proxy/test_credential_slot_registry.py
-      echo tests/unit/proxy/test_deprecated_key_grace_period.py ;;
-    proxy-db-budgets)
-      echo tests/unit/proxy/auth/test_default_end_user_budget_simple.py
-      echo tests/unit/proxy/hooks/test_unit_test_max_model_budget_limiter.py
-      echo tests/unit/proxy/test_zero_cost_model_budget_bypass.py ;;
-    proxy-db-custom-logging)
-      echo tests/unit/proxy/test_custom_callback_input.py
-      echo tests/unit/proxy/test_custom_logger_s3_gcs.py ;;
-    proxy-db-db-and-spend)
-      echo tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py
-      echo tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py
-      echo tests/unit/proxy/db/test_update_daily_tag_spend.py
-      echo tests/unit/proxy/test_db_schema_changes.py
-      echo tests/unit/proxy/test_prisma_client_backoff_retry.py
-      echo tests/unit/proxy/test_update_spend.py
-      echo tests/unit/skills/test_skills_db.py ;;
-    proxy-db-endpoints-and-responses)
-      echo tests/unit/proxy/lens
-      echo tests/unit/proxy/auth/test_models_fallback_endpoint.py
-      echo tests/unit/proxy/common_utils/test_check_batch_cost.py
-      echo tests/unit/proxy/common_utils/test_check_responses_cost.py
-      echo tests/unit/proxy/common_utils/test_realtime_cache.py
-      echo tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py
-      echo tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py
-      echo tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py
-      echo tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py
-      echo tests/unit/proxy/response_polling
-      echo tests/unit/proxy/test_custom_tokenizer_bug.py
-      echo tests/unit/proxy/test_get_favicon.py
-      echo tests/unit/proxy/test_get_image.py
-      echo tests/unit/proxy/test_prompt_test_endpoint.py
-      echo tests/unit/proxy/test_reducto_ocr_route.py
-      echo tests/unit/proxy/test_response_polling_pre_call_checks.py
-      echo tests/unit/proxy/test_ui_path_detection.py ;;
-    proxy-db-guardrails-hooks)
-      echo tests/unit/proxy/hooks/test_banned_keyword_list.py
-      echo tests/unit/proxy/test_proxy_setting_guardrails.py
-      echo tests/unit/proxy/test_unit_test_proxy_hooks.py ;;
-    proxy-db-jwt-and-keys)
-      echo tests/unit/proxy/auth/test_jwt.py
-      echo tests/unit/proxy/management_endpoints/test_jwt_key_mapping.py
-      echo tests/unit/proxy/test_proxy_custom_auth.py ;;
-    proxy-db-key-generation) echo tests/unit/proxy/management_endpoints/test_key_generate_prisma.py ;;
-    proxy-db-logging-misc)
-      echo tests/unit/proxy/management_helpers/test_audit_logs_proxy.py
-      echo tests/unit/proxy/spend_tracking/test_search_api_logging.py
-      echo tests/unit/proxy/test_proxy_reject_logging.py ;;
-    proxy-db-proxy-runtime)
-      echo tests/unit/proxy/auth/test_multipart_bypass_repro.py
-      echo tests/unit/proxy/auth/test_proxy_routes.py
-      echo tests/unit/proxy/middleware/test_request_size_limit_middleware.py
-      echo tests/unit/proxy/test_proxy_config_unit_test.py
-      echo tests/unit/proxy/test_proxy_token_counter.py
-      echo tests/unit/proxy/test_server_root_path.py ;;
-    proxy-db-proxy-server-core)
-      echo tests/unit/proxy/test__lazy_features.py
-      echo tests/unit/proxy/test_aproxy_startup.py
-      echo tests/unit/proxy/test_proxy_server.py ;;
-    proxy-db-proxy-utils) echo tests/unit/proxy/test_proxy_utils.py ;;
-    proxy-extras) echo tests/unit/litellm_proxy_extras ;;
-    proxy-infra)
-      echo tests/unit/gateway
-      echo tests/unit/proxy/management
-      echo tests/unit/proxy/management_endpoints/test_roi_calculator_endpoints.py
-      echo tests/unit/proxy/roi_calculator ;;
-    responses-caching-types)
-      find tests/unit/responses -name 'test_*.py' -not -path 'tests/unit/responses/mcp/*'
-      echo tests/unit/types ;;
-    *) echo "unit_selection.sh: unknown flag $1" >&2; exit 1 ;;
-  esac
-}
-
-expand() {
-  while read -r path; do
-    if [ -d "$path" ]; then
-      find "$path" -name 'test_*.py'
-    elif [ -f "$path" ]; then
-      echo "$path"
-    else
-      echo "unit_selection.sh: $path does not exist" >&2
-      exit 1
-    fi
-  done
-}
-
-if [ "$flag" = unit ]; then
-  comm -23 \
-    <(find tests/unit -name 'test_*.py' | sort) \
-    <(for legacy in "${legacy_flags[@]}"; do legacy_paths "$legacy"; done | expand | sort)
-  exit 0
-fi
-
-legacy_paths "$flag" | expand | sort

.circleci/scripts/wait_integration_services.py

@@ -1,42 +1,31 @@
 import os
-import time
+from contextlib import ExitStack
 from typing import Final
 
 import httpx
+from integration._support.client import Gateway
+from integration._support.workers import wait_for_services
 from redis import Redis
 
 
 def main() -> None:
     primary: Final = os.environ["INTEGRATION_PROXY_URL"]
     peer: Final = os.environ.get("INTEGRATION_PEER_URL")
-    proxies: Final = (primary, peer) if peer else (primary,)
-    deadline: Final = time.monotonic() + 90
-    headers: Final = {"Authorization": f"Bearer {os.environ['INTEGRATION_MASTER_KEY']}"}
-    with httpx.Client(trust_env=False, timeout=2) as client, Redis(
-        host=os.environ["REDIS_HOST"], port=int(os.environ["REDIS_PORT"]), socket_timeout=2
-    ) as cache:
-        while True:
-            try:
-                ready: Final = (
-                    client.get(f"{os.environ['INTEGRATION_UPSTREAM_URL']}/health").status_code == 200
-                    and all(client.get(f"{url}/health/readiness").status_code == 200 for url in proxies)
-                )
-                if ready:
-                    for url in proxies:
-                        response: Final = client.get(f"{url}/cache/ping", headers=headers)
-                        response.raise_for_status()
-                        result: Final = response.json()
-                        assert result["status"] == "healthy", result
-                        assert result["cache_type"] == "redis", result
-                        assert result["ping_response"] is True, result
-                        assert result["set_cache_response"] == "success", result
-                    if cache.pubsub_numsub("litellm_proxy.auth_cache_invalidation")[0][1] >= len(proxies):
-                        return
-            except httpx.TransportError:
-                pass
-            if time.monotonic() >= deadline:
-                raise SystemExit("Integration services or auth-cache subscribers did not become ready")
-            time.sleep(0.2)
+    urls: Final = (primary, peer) if peer else (primary,)
+    upstream: Final = os.environ["INTEGRATION_UPSTREAM_URL"]
+    with ExitStack() as stack:
+        proxies: Final = tuple(
+            Gateway(
+                stack.enter_context(httpx.Client(base_url=url, trust_env=False, timeout=2)),
+                os.environ["INTEGRATION_MASTER_KEY"],
+                upstream,
+            )
+            for url in urls
+        )
+        cache: Final = stack.enter_context(
+            Redis(host=os.environ["REDIS_HOST"], port=int(os.environ["REDIS_PORT"]), socket_timeout=2)
+        )
+        wait_for_services(upstream, proxies, cache)
 
 
 if __name__ == "__main__":

.circleci/tests.yml

@@ -1,416 +0,0 @@
-version: 2.1
-
-commands:
-  wait_for_service:
-    parameters:
-      url:
-        type: string
-      timeout:
-        type: string
-        default: "60"
-    steps:
-      - run:
-          name: "Wait for << parameters.url >>"
-          command: |
-            TIMEOUT=<< parameters.timeout >>
-            URL="<< parameters.url >>"
-            ELAPSED=0
-            echo "Waiting up to ${TIMEOUT}s for ${URL} ..."
-            if echo "$URL" | grep -q '^tcp://'; then
-              HOST=$(echo "$URL" | sed 's|tcp://||' | cut -d: -f1)
-              PORT=$(echo "$URL" | sed 's|tcp://||' | cut -d: -f2)
-              while ! bash -c "echo > /dev/tcp/$HOST/$PORT" 2>/dev/null; do
-                sleep 2; ELAPSED=$((ELAPSED+2))
-                if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "Timed out"; exit 1; fi
-              done
-            else
-              while ! curl -sf --max-time 5 "$URL" > /dev/null 2>&1; do
-                sleep 2; ELAPSED=$((ELAPSED+2))
-                if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "Timed out"; exit 1; fi
-              done
-            fi
-            echo "Service ready after ${ELAPSED}s"
-  install_uv:
-    steps:
-      - run:
-          name: Install uv (pinned 0.10.9)
-          command: |
-            curl -LsSf -o /tmp/uv-install.sh https://astral.sh/uv/0.10.9/install.sh
-            echo "7fc46e39cb97290b57169c0c813a17970585ac519139f19006453c99b5f2f45f  /tmp/uv-install.sh" | sha256sum -c -
-            env UV_NO_MODIFY_PATH=1 sh /tmp/uv-install.sh
-            rm -f /tmp/uv-install.sh
-            echo 'export PATH="$HOME/.local/bin:$PATH"' >> "$BASH_ENV"
-            export PATH="$HOME/.local/bin:$PATH"
-  install_rust:
-    steps:
-      - run:
-          name: Install Rust (rustup 1.28.2, toolchain 1.98.0)
-          command: |
-            case "$(uname -m)" in
-              x86_64)
-                RUSTUP_TRIPLE=x86_64-unknown-linux-gnu
-                RUSTUP_SHA256=20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c
-                ;;
-              aarch64)
-                RUSTUP_TRIPLE=aarch64-unknown-linux-gnu
-                RUSTUP_SHA256=e3853c5a252fca15252d07cb23a1bdd9377a8c6f3efa01531109281ae47f841c
-                ;;
-              *)
-                echo "install_rust: unsupported architecture $(uname -m)" >&2
-                exit 1
-                ;;
-            esac
-            curl -sSLf -o /tmp/rustup-init \
-              "https://static.rust-lang.org/rustup/archive/1.28.2/${RUSTUP_TRIPLE}/rustup-init"
-            echo "${RUSTUP_SHA256}  /tmp/rustup-init" | sha256sum -c -
-            chmod +x /tmp/rustup-init
-            /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain 1.98.0
-            rm -f /tmp/rustup-init
-            echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> "$BASH_ENV"
-            export PATH="$HOME/.cargo/bin:$PATH"
-            rustc --version
-            cargo --version
-  install_codecov_cli:
-    steps:
-      - run:
-          name: Install Codecov CLI (pinned v11.3.1)
-          when: always
-          command: |
-            curl -sSLf -o /tmp/codecov https://cli.codecov.io/v11.3.1/linux/codecov
-            curl -sSLf -o /tmp/codecov.SHA256SUM https://cli.codecov.io/v11.3.1/linux/codecov.SHA256SUM
-            [ "$(cat /tmp/codecov.SHA256SUM)" = "ca1d64196d2d34771084afe76ea657d581bf628e31d993ff8e52ea09cc88a56d  codecov" ]
-            (cd /tmp && sha256sum -c codecov.SHA256SUM)
-            chmod +x /tmp/codecov
-            mkdir -p "$HOME/.local/bin"
-            mv /tmp/codecov "$HOME/.local/bin/codecov"
-  setup_litellm_enterprise_pip:
-    steps:
-      - run:
-          name: "Install local version of litellm-enterprise"
-          command: |
-            uv run --no-sync python -c "import litellm_enterprise; print('litellm-enterprise OK:', litellm_enterprise.__file__)"
-  setup_test_deps:
-    steps:
-      - install_uv
-      - install_rust
-      - restore_cache:
-          keys:
-            - v3-integration-uv-cache-{{ checksum "uv.lock" }}
-      - run:
-          name: Install Dependencies
-          command: |
-            uv sync --frozen --all-groups --all-extras --python 3.12
-      - setup_litellm_enterprise_pip
-      - save_cache:
-          paths:
-            - ~/.cache/uv
-          key: v3-integration-uv-cache-{{ checksum "uv.lock" }}
-      - run:
-          name: Generate Prisma client
-          command: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-  skip_unless_relevant:
-    parameters:
-      category:
-        type: string
-        default: backend
-      base_ref:
-        type: string
-        default: ""
-      pull_request_url:
-        type: string
-        default: ""
-    steps:
-      - run:
-          name: "Skip job when no << parameters.category >>-relevant files changed"
-          command: |
-            export CIRCLE_PULL_REQUEST="${CIRCLE_PULL_REQUEST:-<< parameters.pull_request_url >>}"
-            export PATH_FILTER_BASE_BRANCH="<< parameters.base_ref >>"
-            [ -n "$PATH_FILTER_BASE_BRANCH" ] || unset PATH_FILTER_BASE_BRANCH
-            bash .circleci/scripts/path_filter.sh << parameters.category >>
-  start_postgres:
-    parameters:
-      db_name:
-        type: string
-        default: circle_test
-      image:
-        type: string
-        default: postgres:14@sha256:6a70deda415ec296f977890e11aba04a0db9f632a362e3fce45e845e3db74f26
-    steps:
-      - run:
-          name: Start PostgreSQL
-          command: |
-            docker run -d \
-              --name postgres-db \
-              -e POSTGRES_USER=postgres \
-              -e POSTGRES_PASSWORD=postgres \
-              -e POSTGRES_DB=<< parameters.db_name >> \
-              -p 5432:5432 \
-              << parameters.image >>
-      - wait_for_service:
-          url: tcp://localhost:5432
-          timeout: "60"
-  start_redis:
-    steps:
-      - run:
-          name: Start Redis
-          command: |
-            docker run -d \
-              --name redis-cache \
-              -p 6379:6379 \
-              redis:7-alpine@sha256:7aec734b2bb298a1d769fd8729f13b8514a41bf90fcdd1f38ec52267fbaa8ee6
-      - wait_for_service:
-          url: tcp://localhost:6379
-          timeout: "60"
-
-jobs:
-  unit:
-    parameters:
-      flag:
-        type: string
-        default: unit
-      shards:
-        type: integer
-        default: 6
-      workers:
-        type: integer
-        default: 4
-      dist:
-        type: string
-        default: loadscope
-      base_ref:
-        type: string
-        default: ""
-      pull_request_url:
-        type: string
-        default: ""
-      legacy_mcp_peer:
-        type: boolean
-        default: false
-      reruns:
-        type: integer
-        default: 0
-    machine:
-      image: ubuntu-2204:2024.04.1
-    resource_class: large
-    working_directory: ~/project
-    parallelism: << parameters.shards >>
-    environment:
-      COVERAGE_CORE: sysmon
-      LITELLM_LOCAL_MODEL_COST_MAP: "True"
-    steps:
-      - checkout
-      - skip_unless_relevant:
-          base_ref: << parameters.base_ref >>
-          pull_request_url: << parameters.pull_request_url >>
-      - setup_test_deps
-      - when:
-          condition: << parameters.legacy_mcp_peer >>
-          steps:
-            - run:
-                name: Install MCP SDK1 peer
-                command: |
-                  uv venv --python 3.12 .venv-mcp-peer
-                  uv pip install --python .venv-mcp-peer 'mcp==1.28.1' 'langchain-mcp-adapters==0.2.1'
-                  echo "export MCP_TEST_PEER_PYTHON=$PWD/.venv-mcp-peer/bin/python" >> "$BASH_ENV"
-      - run:
-          name: "Run << parameters.flag >> shard"
-          no_output_timeout: 20m
-          command: |
-            mkdir -p test-results/<< parameters.flag >>
-            selection="$(bash .circleci/scripts/unit_selection.sh << parameters.flag >>)" || { echo "unit_selection.sh failed for << parameters.flag >>"; exit 1; }
-            [ -n "${selection}" ] || { echo "unit_selection.sh produced no files for << parameters.flag >>"; exit 1; }
-            shard="$(printf '%s\n' "${selection}" | circleci tests split --split-by=timings --timings-type=filename)" || { echo "circleci tests split failed for << parameters.flag >>"; exit 1; }
-            [ -n "${shard}" ] || { echo "shard ${CIRCLE_NODE_INDEX} received no << parameters.flag >> files; nothing to run"; exit 0; }
-            mapfile -t files < <(printf '%s\n' "${shard}")
-            xdist_args=()
-            if [ "<< parameters.workers >>" -gt 0 ]; then xdist_args=(-n << parameters.workers >> --dist=<< parameters.dist >>); fi
-            rerun_args=(-p no:rerunfailures)
-            if [ "<< parameters.reruns >>" -gt 0 ]; then rerun_args=(--reruns << parameters.reruns >> --reruns-delay 1 --rerun-except "from pytest-timeout"); fi
-            test_env=(PATH="$PATH" HOME="$HOME" CI=true COVERAGE_CORE="$COVERAGE_CORE" LITELLM_LOCAL_MODEL_COST_MAP="$LITELLM_LOCAL_MODEL_COST_MAP")
-            if [ -n "${MCP_TEST_PEER_PYTHON:-}" ]; then test_env+=(MCP_TEST_PEER_PYTHON="$MCP_TEST_PEER_PYTHON"); fi
-            set +e
-            env -i "${test_env[@]}" \
-              uv run --no-sync pytest "${files[@]}" "${rerun_args[@]}" -p no:pytest-retry --timeout=90 "${xdist_args[@]}" --tb=short --durations=20 -o junit_family=xunit1 --junitxml=test-results/<< parameters.flag >>/junit.xml --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml:coverage.xml --cov-config=pyproject.toml
-            status=$?
-            set -e
-            if [ "$status" -eq 5 ]; then echo "pytest collected no tests from the shard; passing"; exit 0; fi
-            exit "$status"
-      - install_codecov_cli
-      - run:
-          name: Upload coverage
-          when: always
-          command: |
-            [ -f coverage.xml ] || { echo "no coverage.xml produced; skipping upload"; exit 0; }
-            codecov upload-process --disable-search -f coverage.xml -F << parameters.flag >> -C "$CIRCLE_SHA1" -n "<< parameters.flag >>-${CIRCLE_NODE_INDEX}-${CIRCLE_BUILD_NUM}" --git-service github
-      - store_test_results:
-          path: test-results
-      - store_artifacts:
-          path: test-results
-      - store_artifacts:
-          path: coverage.xml
-  documentation:
-    machine:
-      image: ubuntu-2204:2024.04.1
-    resource_class: large
-    working_directory: ~/project
-    steps:
-      - checkout
-      - setup_test_deps
-      - run:
-          name: Checkout litellm-docs
-          command: rm -rf docs/my-website && git clone --depth 1 https://github.com/BerriAI/litellm-docs.git docs/my-website
-      - run:
-          name: Run documentation validation
-          command: |
-            uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
-            uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
-            uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
-            uv run --no-sync python ./tests/documentation_tests/test_circular_imports.py
-  integration:
-    parameters:
-      suite:
-        type: string
-      base_ref:
-        type: string
-        default: ""
-      pull_request_url:
-        type: string
-        default: ""
-    machine:
-      image: ubuntu-2204:2024.04.1
-    resource_class: large
-    working_directory: ~/project
-    steps:
-      - checkout
-      - skip_unless_relevant:
-          base_ref: << parameters.base_ref >>
-          pull_request_url: << parameters.pull_request_url >>
-      - setup_test_deps
-      - start_postgres:
-          image: postgres:16@sha256:e17e86066e5ef83e0952a9347f5c792b7ece00972e2aa787a6986f471b3dd3d5
-      - start_redis
-      - run:
-          name: Run owned integration contracts
-          command: env -i PATH="$PATH" HOME="$HOME" CIRCLE_SHA1="$CIRCLE_SHA1" CIRCLE_WORKFLOW_ID="$CIRCLE_WORKFLOW_ID" bash .circleci/scripts/run_integration.sh << parameters.suite >>
-          no_output_timeout: 15m
-      - run:
-          name: Stop owned database and Redis
-          when: always
-          command: |
-            mkdir -p test-results/integration-<< parameters.suite >>
-            docker logs postgres-db > test-results/integration-<< parameters.suite >>/postgres.log 2>&1 || true
-            docker logs redis-cache > test-results/integration-<< parameters.suite >>/redis.log 2>&1 || true
-            docker rm -f postgres-db redis-cache
-            test -z "$(docker ps -aq --filter name=postgres-db --filter name=redis-cache)"
-      - store_test_results:
-          path: test-results
-      - store_artifacts:
-          path: test-results
-
-workflows:
-  tests:
-    when: (pipeline.event.name == "push" and pipeline.git.branch == "main") or pipeline.event.name == "api" or (pipeline.event.name == "pull_request" and (pipeline.event.github.pull_request.base.ref == "main" or pipeline.event.github.pull_request.base.ref starts-with "litellm_"))
-    jobs:
-      - unit:
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-<< matrix.flag >>
-          shards: 1
-          workers: 2
-          reruns: 2
-          matrix:
-            parameters:
-              flag: [caching-local, proxy-extras, enterprise-routing]
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-mcp-integration
-          flag: mcp-integration
-          shards: 1
-          workers: 2
-          legacy_mcp_peer: true
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-<< matrix.flag >>
-          shards: 1
-          reruns: 2
-          matrix:
-            parameters:
-              flag:
-                - enterprise-package
-                - proxy-infra
-                - responses-caching-types
-                - proxy-db-auth-checks
-                - proxy-db-jwt-and-keys
-                - proxy-db-proxy-server-core
-                - proxy-db-proxy-runtime
-                - proxy-db-custom-logging
-                - proxy-db-logging-misc
-                - proxy-db-db-and-spend
-                - proxy-db-guardrails-hooks
-                - proxy-db-budgets
-                - proxy-db-endpoints-and-responses
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-llm-vertex-ai
-          flag: llm-vertex-ai
-          shards: 2
-          workers: 1
-          reruns: 2
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-llm-other-providers
-          flag: llm-other-providers
-          shards: 3
-          reruns: 2
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-core-utils
-          flag: core-utils
-          shards: 2
-          reruns: 1
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-integrations
-          flag: integrations
-          shards: 2
-          reruns: 3
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-misc
-          flag: misc
-          shards: 2
-          reruns: 2
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-proxy-db-proxy-utils
-          flag: proxy-db-proxy-utils
-          shards: 1
-          reruns: 2
-          dist: worksteal
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-proxy-db-key-generation
-          flag: proxy-db-key-generation
-          shards: 1
-          workers: 0
-          reruns: 2
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - documentation
-      - integration:
-          name: integration-<< matrix.suite >>
-          matrix:
-            parameters:
-              suite: [sdk]
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>

.gitguardian.yaml

@@ -84,10 +84,6 @@ secret:
     - name: Langfuse test credentials in test_completion
       match: c39310f68cc3d3e22f7b298bb6353c4f45759adcc37080d8b7f4e535d3cfd7f4
     
-    # Test password "sk-1234" in e2e test fixtures - test fixture, not a real secret
-    - name: Test password in e2e test fixtures
-      match: ce32b547202e209ec1dd50107b64be4cfcf2eb15c3b4f8e9dc611ef747af634f
-    
     # === Preventive patterns for test keys (pattern-based) ===
     
     # Test API keys (124 instances across 45 files)
@@ -108,4 +104,3 @@ secret:
 
     - name: Short fake sk keys (1–9 digits only)
       match: \bsk-\d{1,9}\b
-

.github/CODEOWNERS

@@ -1,2 +1,2 @@
-/model_prices_and_context_window.json @mateo-berri @ryan-crabbe-berri @kerry-berri
-/litellm/model_prices_and_context_window_backup.json @mateo-berri @ryan-crabbe-berri @kerry-berri
+/model_prices_and_context_window.json @mateo-berri @ryan-crabbe-berri @kerrylu-berri
+/litellm/model_prices_and_context_window_backup.json @mateo-berri @ryan-crabbe-berri @kerrylu-berri

.github/PULL_REQUEST_TEMPLATE/general.md

@@ -0,0 +1,166 @@
+<!-- The whole description's target audience is humans, not AI agents: write it in plain, simple,
+     everyday engineering language, extremely parsable and readable at a glance. This goes double for
+     the TLDR, User Flow, and Caveats sections
+     Drop every section you have nothing to put in, heading included: a bare "## Relevant issues" or
+     "## Affected release" with nothing under it must not appear in the final description -->
+
+## TLDR
+
+<!-- Fill in the bullets below and keep each one short and concrete: one line per bullet, roughly 10 words max
+     If the PR intentionally changes what existing users see or how a screen behaves, add a line under the bullets that starts "Intentional product change:" describing what changes, why, and what users lose. Reviewers must never have to infer a deliberate UX change from the diff -->
+
+Problem this solves:
+
+- <blah>
+- ...
+
+How it solves it:
+
+- <blah>
+- ...
+
+## User Flow
+
+<!-- Two ordered lists, Before and After, walking the same end user through the same task, written strictly from that user's seat
+     Read the linked issue, ticket, or customer thread first so the flow reflects the real application and the routes its users actually hit; don't invent a generic scenario
+     Lead each list with one plain sentence saying where the flow fails (Before) or succeeds (After), then number the steps
+     Keep it tight: aim for 3 to 5 steps per list, one line each, roughly 20 words max, and never pad a shorter flow with filler steps to hit the count. Cover the one path the PR changes and fold variants (case, other field, second endpoint) into a clause on the step they belong to rather than their own steps. The example below is the target length
+     Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
+     No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. "The upload hands back an ID that looks like OpenAI's own `file-abc123` instead of the scrambled one the gateway returned" is right, "no managed-file row was registered" is wrong
+     Keep the two lists step-for-step identical until they diverge, so the changed step is obvious
+     If the bug had a security or authorization consequence, end each list with what another user could or could no longer do
+     Regenerate this section, screenshots included, whenever new commits change the PR's behavior, so it never describes an older revision
+     If the PR changes what an Admin UI page shows, embed a before and an after screenshot of that page right after its list, taken at the same URL on the same data, with the rows, fields, or controls that changed boxed in red so a reader spots the difference without reading the steps. These are the UI screenshots for Screenshots / Proof of Fix too: embed them once here and have that section's Before and After steps point back to them instead of repeating the images
+
+Example:
+
+Before: a developer whose app streams chat completions gets no token counts back, so their cost dashboard reads zero
+
+1. They send POST https://litellm-domain/v1/chat/completions with `"stream": true` and no `stream_options`
+2. The last SSE chunk arrives with `"usage": null`, so their app records 0 prompt and 0 completion tokens
+3. They open https://litellm-domain/ui/?page=logs and see the request logged at $0 spend
+
+After: the same request comes back with real token counts, so the dashboard shows real spend
+
+1. The proxy admin sets `always_include_stream_usage: true` and restarts the proxy
+2. The developer sends the same POST https://litellm-domain/v1/chat/completions with `"stream": true` and no `stream_options`
+3. The last SSE chunk now carries a `usage` object with real prompt and completion token counts
+4. https://litellm-domain/ui/?page=logs shows that request at non-zero spend
+-->
+
+## Relevant issues
+
+<!-- e.g., "Fixes #000". Drop the section if there is none -->
+
+## Affected release
+
+<!-- Only for a fix to a regression in a released or rc version (perf, memory, crash, or behavior): name the version it regressed in, e.g. "regression in v1.100.0" or "since v1.101.0-rc.1". Add the `backport-stable` label only when the regression is a P0, meaning its Linear ticket is Urgent (a security hole however narrow, data loss, or a crash or outage for every user on that version), because every labeled PR must be cherry-picked onto the baking rc line before the stable can be tagged; every other regression fix ships in the next rc unlabeled. Drop the section otherwise -->
+
+## Linear ticket
+
+<!-- if you are an internal contributor, add "Resolves " followed by the Linear ticket e.g., "Resolves LIT-1234" to link the Linear ticket to the GitHub PR. If you don't have one, drop the section rather than guessing -->
+
+## Pre-Submission checklist
+
+**Please complete all items before asking a LiteLLM maintainer to review your PR**
+
+- [ ] I have added meaningful tests
+- [ ] The handful of test files covering my change pass locally, e.g. `uv run pytest tests/unit/<your_test_file>.py -v`. Leave the suites (`make test-unit-*`, `make test-unit`) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
+- [ ] My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
+- [ ] My PR's scope is as isolated as possible; it only solves 1 specific problem
+- [ ] Every automated review on my PR's latest commit has finished, and I have addressed or replied to each of its findings before requesting a maintainer review
+
+## Delays in PR merge?
+
+If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slack (#pr-review)](https://join.slack.com/t/litellmossslack/shared_invite/zt-3o7nkuyfr-p_kbNJj8taRfXGgQI1~YyA).
+
+## Screenshots / Proof of Fix
+
+<!-- Include screenshots, screen recordings, or command (e.g., curl) + output demonstrating that your changes work as expected
+     The proof must be completely e2e with no mocks, using actual LLM calls costing real $$$ if applicable. `pytest` commands are not enough
+     Show ONLY the latest run: capture Before at the merge base and After at the PR's current tip, and when new commits change behavior, replace this whole section with the fresh run instead of stacking it on top of older ones. The run must be up to date. As soon as a new commit is made and it makes this PR description's after sha stale (it's no longer tip of PR), you must re-run the QA
+     Structure the section exactly as below: Before and After one heading level below this section, each naming the commit hash it was captured at, one lower-level heading per case inside each, the same case names in the same order on both sides, and numbered steps (command, observed output) under every case, never loose prose; shared setup (config, payloads) goes above Before, and with a single case, drop the case headings and number the steps directly
+
+### Before (<hash>)
+
+#### <case 1>
+
+1. ...
+2. ...
+
+#### <case 2>
+
+1. ...
+
+### After (<hash>)
+
+#### <case 1>
+
+1. ...
+2. ...
+
+#### <case 2>
+
+1. ...
+
+     For bug fixes: Before shows the reproduction, After shows the same steps passing
+     For new features: Before shows the capability missing, After shows it working end-to-end
+     If the change applies to all three LLM endpoints (/v1/responses, /v1/chat/completions, /v1/messages), make each endpoint its own case, not just one
+     For UI changes: before/after screenshots under the same headings
+     If the main use case runs through a coding tool like Claude Code or Codex, drive that tool interactively the way the user does (never `claude -p`, `codex exec`, or curl on its own) and embed before/after screenshots of its pane under the same headings; curl replays and headless runs can follow as extra cases, never as the only proof -->
+
+## Type
+
+<!-- Select the type of Pull Request -->
+<!-- Keep only the necessary ones -->
+
+🆕 New Feature
+🐛 Bug Fix
+🧹 Refactoring
+📖 Documentation
+🚄 Infrastructure
+✅ Test
+
+## Caveats (if any)
+
+<!-- Group caveats under severity subheadings (### Severe, ### High, ### Medium, ### Low), with
+     short bullet points inside each, just like the TLDR: one line per bullet, roughly 10 words max
+     Call out known limitations, follow-up work, or anything a reviewer should watch out for
+     Include only the tiers that have caveats; drop the empty ones
+     - Severe: inherent to what the PR deliberately ships, there even when the code works as intended:
+       it can degrade or take down a running deployment (e.g. a slow or table-locking boot migration),
+       rewrite data by design, break an existing workflow on purpose, or change auth behavior. An
+       operator must plan around it before rollout
+     - High: an unintended hole: a correctness, security, data-loss, or backward-compatibility bug,
+       unsafe to ship as is
+     - Medium: a real gap someone can hit, but with a workaround or a narrow blast radius
+     - Low: anything else worth noting: naming, cleanup, an edge case nobody hits
+     Nest bullets as deep as helps: hierarchy beats one long line when it makes things clearer to a
+     human reader
+     If you assumed something instead of testing it, e.g. "only reproduces with X on" or "no
+     user-observable behavior difference", list it here too with what breaks if it is wrong
+     Drop this section if there are none -->
+
+## QA runbook
+
+<!-- Only needed when your PR edits tests/e2e; delete this section otherwise
+
+For each e2e test you added or changed, list the manual steps a reviewer can follow to reproduce it by hand against a live proxy, mapping 1:1 to what the test asserts: one top-level bullet per test giving its pytest node id followed by what it proves in plain words, then a nested "- [ ]" checklist where each item is a concrete action (route, request body, expected response) and the final item is the sanity-check step shown in the examples. Note environment prerequisites (provider credentials, config flags) and any nuances a manual run will hit. See PRs #32914 and #32963 for full examples
+
+Example checklists:
+
+- tests/e2e/quota_management/ratelimit/test_rate_limit_e2e.py::TestKeyRateLimits::test_rpm_limit_blocks_over_limit - a key allowed 2 requests a minute serves exactly 2 and refuses the 3rd
+  - [ ] Generate a limited key: curl -X POST http://localhost:4000/key/generate -H "Authorization: Bearer $LITELLM_MASTER_KEY" -d '{"rpm_limit": 2}'
+  - [ ] Send three /v1/chat/completions requests with that key inside one minute
+  - [ ] Expect the first two to return 200 and the third to return 429 naming the rpm limit
+  - [ ] Sanity check: this test makes sense to add and is not hand-wavey (e.g., assert actual expected spend instead of just spend > 0) or potentially flaky
+
+- tests/e2e/management/test_management_e2e.py::TestModelRoutes::test_model_create_appears_in_ui - a deployment created through the API shows up on the Admin UI models page
+  - [ ] POST /model/new with the master key, a bedrock model, and aws_region_name (needs STORE_MODEL_IN_DB=True and AWS credentials)
+  - [ ] Open http://localhost:4000/ui/?page=models and expect a deployment row showing the returned model id
+  - [ ] Sanity check: this test makes sense to add and is not hand-wavey (e.g., assert actual expected spend instead of just spend > 0) or potentially flaky
+-->
+
+## Final Attestation
+
+- [ ] The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

.github/PULL_REQUEST_TEMPLATE/rust.md

@@ -0,0 +1 @@
+<!-- Write the final PR description as concise bullets only -->

.github/actions/rust-bridge/action.yml

@@ -0,0 +1,19 @@
+name: Set up the Rust bridge
+description: Select the shared Rust bridge artifact or the Cargo cache
+inputs:
+  artifact:
+    description: Rust bridge artifact name
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - name: Restore the Cargo build cache
+      if: inputs.artifact == ''
+      uses: ./.github/actions/cache-cargo-build
+    - name: Download the Rust bridge artifact
+      if: inputs.artifact != ''
+      uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
+      with:
+        name: ${{ inputs.artifact }}
+        path: rust-bridge-dist

.github/ci-coverage-allowlist.yml

@@ -18,22 +18,11 @@ test_paths:
     paths:
       - tests/rust-python-harness
   - reason: >-
-      Live-provider caching cases in tests/local_testing that remain outside CI. Jobs that
-      glob that directory either deselect them (local_testing_part1 and part2 carry `-k "... and
-      not caching and not cache"`) or keep only another keyword (langfuse, router, assistants).
-      Separately, test-redis-compat.yml selects two IAM cluster authentication tests in
-      test_caching.py by node ID. It does not run that file's other tests.
-      The gap was eight files and 118 tests when measured 2026-08-20; the five keyless files now
-      run in the caching-local shard, leaving live cases in these three. Measured 2026-08-21 with no provider
-      credentials and no Redis: test_caching.py needs both (37 of 65 fail without them),
-      test_disk_cache_unit_tests.py needs OPENAI_API_KEY for 2 of its 4, and
-      test_gcs_cache_unit_tests.py needs GCS credentials for all 4. They want the keyless/live
-      split that porting tests/local_testing off CircleCI will force, not a job that is red by
-      construction
+      Owned by the open pull request that moves the Rust/Python parity checks (#45135). It ran in
+      the CircleCI build_and_test job that globbed tests/test_*.py, which this migration deletes,
+      and that pull request gives it a new home
     paths:
-      - tests/local_testing/test_caching.py
-      - tests/local_testing/test_disk_cache_unit_tests.py
-      - tests/local_testing/test_gcs_cache_unit_tests.py
+      - tests/test_rust_python_harness.py
   - reason: >-
       The end-to-end suite runs against a deployed proxy from its own in-cluster rig rather than
       from a pull request; it needs a live gateway and provider credentials no PR job holds
@@ -59,48 +48,6 @@ test_paths:
       choice it informed is settled
     paths:
       - tests/code_coverage_tests/test_aio_http_image_conversion.py
-  - reason: >-
-      No job invokes this suite and its files mix pure transformation tests with ones driving live
-      vendor vector stores, so assigning them needs a per-file decision
-    paths:
-      - tests/vector_store_tests/rag/test_rag_bedrock.py
-      - tests/vector_store_tests/rag/test_rag_openai.py
-      - tests/vector_store_tests/rag/test_rag_s3_vectors.py
-      - tests/vector_store_tests/rag/test_rag_vertex_ai.py
-      - tests/vector_store_tests/test_azure_ai_vector_store.py
-      - tests/vector_store_tests/test_azure_vector_store.py
-      - tests/vector_store_tests/test_bedrock_vector_store.py
-      - tests/vector_store_tests/test_gemini_vector_store.py
-      - tests/vector_store_tests/test_milvus_vector_store.py
-      - tests/vector_store_tests/test_openai_vector_store.py
-      - tests/vector_store_tests/test_ragflow_vector_store.py
-      - tests/vector_store_tests/test_s3_vectors_vector_store.py
-      - tests/vector_store_tests/test_vertex_ai_search_api_vector_store.py
-      - tests/vector_store_tests/test_vertex_ai_vector_store.py
-  - reason: >-
-      Throughput and memory-growth measurements whose runtime and variance make them unsuitable for
-      a per-pull-request job
-    paths:
-      - tests/load_tests/test_datadog_load_test.py
-      - tests/load_tests/test_langsmith_load_test.py
-      - tests/load_tests/test_linear_memory_growth.py
-      - tests/load_tests/test_memory_usage.py
-      - tests/load_tests/test_otel_load_test.py
-      - tests/load_tests/test_vertex_embeddings_load_test.py
-      - tests/load_tests/test_vertex_load_tests.py
-  - reason: >-
-      Env-gated saturation benchmark requires a live proxy and provider credentials, so it is run
-      locally rather than in pull-request jobs
-    paths:
-      - tests/load_tests/test_granian_admission_saturation.py
-  - reason: >-
-      A local-only agent rig: test_a2a_completion_bridge.py needs a LangGraph server on
-      localhost:2024 and test_a2a.py drives a live A2A endpoint, so neither can run in a
-      pull request job. Until 2026-08-20 the CircleCI agent job hid them behind a grep -v
-      that this census could not see; the glob now excludes them structurally and this entry
-      is the decision on the record. Revisit when the A2A bridge gets a recorded-wire fixture
-    paths:
-      - tests/agent_tests/local_only_agent_tests
   - reason: >-
       Third-party integration tests that skip themselves without OCI configuration or sandbox
       credentials, neither of which a pull request job holds

.github/codeql/codeql-config.yml

@@ -1,8 +1,5 @@
 name: "LiteLLM CodeQL config"
 
-queries:
-  - uses: security-and-quality
-
 # Known OOM queries on large Python codebases:
 # CodeQL builds a full data flow graph in memory. These two queries trace
 # sensitive data through every log call / regex pattern, causing combinatorial
@@ -14,17 +11,6 @@ query-filters:
       id: py/clear-text-logging-sensitive-data  # CWE-312
   - exclude:
       id: py/polynomial-redos                   # CWE-730
-  # Import resolution confuses stdlib types with management_endpoints/types.py.
-  # The generic cycle query also reports intentional deferred imports.
-  - exclude:
-      id: py/cyclic-import
-  - exclude:
-      id: py/unsafe-cyclic-import
-  # Known false positives on live settings and Protocol placeholders.
-  - exclude:
-      id: py/unused-global-variable
-  - exclude:
-      id: py/ineffectual-statement
 
 paths-ignore:
   - tests

.github/e2e-stack/down.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -uo pipefail
-
-STACK_DIR="${E2E_STACK_DIR:-${RUNNER_TEMP:-/tmp}/litellm-e2e-stack}"
-
-for pid_file in "${STACK_DIR}"/pids/*.pid; do
-  [[ -f "${pid_file}" ]] || continue
-  pkill -TERM -P "$(cat "${pid_file}")" 2>/dev/null
-  kill -TERM "$(cat "${pid_file}")" 2>/dev/null
-  rm -f "${pid_file}"
-done
-
-for container in e2e-nginx e2e-keycloak e2e-valkey e2e-jaeger e2e-postgres; do
-  docker rm -f "${container}" >/dev/null 2>&1
-done
-
-exit 0

.github/e2e-stack/redact_output.py

@@ -1,83 +0,0 @@
-import argparse
-import os
-import sys
-from functools import reduce
-from pathlib import Path
-from typing import Final
-from xml.sax.saxutils import escape
-
-from pydantic import JsonValue, TypeAdapter, ValidationError
-from secrets_to_env import MIN_MASKED_LENGTH
-
-REDACTED: Final = "***"
-json_adapter: Final[TypeAdapter[JsonValue]] = TypeAdapter(JsonValue)
-
-
-def string_leaves(node: JsonValue) -> tuple[str, ...]:
-    match node:
-        case str():
-            return (node,)
-        case list():
-            return tuple(leaf for child in node for leaf in string_leaves(child))
-        case dict():
-            return tuple(leaf for child in node.values() for leaf in string_leaves(child))
-    return ()
-
-
-def field_lines(value: str) -> tuple[str, ...]:
-    try:
-        return tuple(line for leaf in string_leaves(json_adapter.validate_json(value)) for line in leaf.splitlines())
-    except ValidationError:
-        return ()
-
-
-def masked_values(values_files: tuple[Path, ...]) -> tuple[str, ...]:
-    values: Final = frozenset(
-        line.split("=", 1)[1].strip().strip("'")
-        for path in values_files
-        for line in path.read_text().splitlines()
-        if "=" in line
-    )
-    texts: Final = frozenset(text for value in values for text in (value, *field_lines(value)))
-    renderings: Final = frozenset(
-        rendering
-        for text in texts
-        if len(text) >= MIN_MASKED_LENGTH
-        for rendering in (text, escape(text), escape(text, {'"': """}))
-    )
-    return tuple(sorted(renderings, key=lambda rendering: (-len(rendering), rendering)))
-
-
-def redact(text: str, values: tuple[str, ...]) -> str:
-    return reduce(lambda redacted, value: redacted.replace(value, REDACTED), values, text)
-
-
-def write_redacted(source: Path, out_dir: Path, values: tuple[str, ...]) -> None:
-    target: Final = out_dir / source.name
-    with os.fdopen(os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600), "w") as handle:
-        _ = handle.write(redact(source.read_text(errors="replace"), values))
-
-
-def main() -> int:
-    parser: Final = argparse.ArgumentParser()
-    _ = parser.add_argument("--values", action="append", type=Path, required=True)
-    _ = parser.add_argument("--out", type=Path, required=True)
-    _ = parser.add_argument("files", nargs="*", type=Path)
-    args: Final = parser.parse_args()
-    values_files: Final = tuple(args.values)
-    out_dir: Final[Path] = args.out
-    sources: Final = tuple(args.files)
-    try:
-        values: Final = masked_values(values_files)
-        out_dir.mkdir(mode=0o700, exist_ok=True)
-        for source in sources:
-            write_redacted(source, out_dir, values)
-    except OSError as error:
-        _ = sys.stderr.write(f"could not redact {error.filename}\n")
-        return 1
-    _ = sys.stdout.write(f"redacted {len(sources)} file(s) into {out_dir}\n")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/e2e-stack/secrets_to_env.py

@@ -1,55 +0,0 @@
-import os
-import re
-import sys
-from pathlib import Path
-from typing import Final
-
-from pydantic import TypeAdapter, ValidationError
-
-secrets_adapter: Final[TypeAdapter[dict[str, str]]] = TypeAdapter(dict[str, str])
-ENV_NAME: Final = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
-MIN_MASKED_LENGTH: Final = 8
-ACTIONS_RUNNER_FLAG: Final = "GITHUB_ACTIONS"
-
-
-def main() -> int:
-    env_path: Final = Path(sys.argv[1])
-    try:
-        secrets: Final = {
-            key: value.rstrip("\r\n") for key, value in secrets_adapter.validate_json(sys.stdin.read()).items()
-        }
-    except (ValidationError, UnicodeError):
-        _ = sys.stderr.write("expected a JSON object containing string environment values\n")
-        return 1
-    unusable: Final = tuple(
-        key
-        for key, value in secrets.items()
-        if ENV_NAME.fullmatch(key) is None or any(char in value for char in "'\n\r\0")
-    )
-    if unusable:
-        _ = sys.stderr.write(
-            f"these names or values cannot be represented in both bash and dotenv: {' '.join(sorted(unusable))}\n"
-        )
-        return 1
-    if os.environ.get(ACTIONS_RUNNER_FLAG) == "true":
-        _ = sys.stdout.write(
-            "".join(
-                f"::add-mask::{value.replace('%', '%25')}\n"
-                for value in secrets.values()
-                if len(value) >= MIN_MASKED_LENGTH
-            )
-        )
-        sys.stdout.flush()
-    lines: Final = tuple(f"{key}='{value}'" for key, value in secrets.items() if value)
-    try:
-        with os.fdopen(os.open(env_path, os.O_WRONLY | os.O_APPEND | os.O_CREAT | os.O_NOFOLLOW, 0o600), "w") as handle:
-            os.fchmod(handle.fileno(), 0o600)
-            _ = handle.write("\n".join(lines) + "\n")
-    except OSError:
-        _ = sys.stderr.write("could not write the environment file\n")
-        return 1
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/e2e-stack/select_tests.py

@@ -1,52 +0,0 @@
-import re
-import sys
-from typing import Final
-
-SELECTABLE: Final = re.compile(r"^tests/e2e/([A-Za-z0-9_.-]+/)*test_[A-Za-z0-9_.-]+\.py$")
-UNSUPPORTED: Final = re.compile(
-    r"^tests/e2e/(ui|claude_code|load|migrations)/"
-    r"|^tests/e2e/mcp/test_mcp_oauth_happy_path_e2e\.py$"
-    r"|^tests/e2e/llm_translation/realtime/test_realtime_pipecat_audio_e2e\.py$"
-    r"|^tests/e2e/batches/test_managed_files_enforcement_e2e\.py$"
-    r"|^tests/e2e/guardrails/test_presidio_masking_e2e\.py$"
-    r"|^tests/e2e/logging/test_otel_v2_langfuse_generation_output_e2e\.py$"
-    r"|^tests/e2e/logging/test_langsmith_batch_serialization_e2e\.py$"
-    r"|^tests/e2e/logging/test_s3_log_e2e\.py$"
-    r"|^tests/e2e/secret_manager/"
-)
-HARNESS: Final = re.compile(
-    r"^tests/e2e/[A-Za-z0-9_.-]+\.(py|ini)$"
-    r"|^tests/e2e/idp_realm\.json$"
-    r"|^tests/e2e/management/(management_client|jwt_actors|conftest)\.py$"
-    r"|^tests/e2e/coverage_registry/management_cases\.py$"
-    r"|^tests/e2e/gateway/"
-    r"|^\.github/e2e-stack/"
-    r"|^\.github/workflows/test-e2e-changed\.yml$"
-)
-UNEXPANDED: Final = re.compile(r"[*?\[]")
-
-
-def is_selectable(path: str) -> bool:
-    return SELECTABLE.match(path) is not None and UNSUPPORTED.match(path) is None
-
-
-def select(changed: tuple[str, ...], canary: tuple[str, ...]) -> tuple[str, ...]:
-    direct: Final = frozenset(path for path in changed if is_selectable(path))
-    harness_changed: Final = any(HARNESS.match(path) for path in changed)
-    canary_tests: Final = frozenset(path for path in canary if harness_changed and is_selectable(path))
-    return tuple(sorted(direct | canary_tests))
-
-
-def main() -> int:
-    canary: Final = tuple(sys.argv[1:])
-    unexpanded: Final = tuple(path for path in canary if UNEXPANDED.search(path))
-    if unexpanded:
-        _ = sys.stderr.write(f"the canary paths reached the selector unexpanded: {' '.join(unexpanded)}\n")
-        return 1
-    changed: Final = tuple(line.strip() for line in sys.stdin if line.strip())
-    _ = sys.stdout.write(" ".join(select(changed, canary)) + "\n")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/e2e-stack/up.sh

@@ -1,231 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-umask 077
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-STACK_DIR="${E2E_STACK_DIR:-${RUNNER_TEMP:-/tmp}/litellm-e2e-stack}"
-CERTS_DIR="${STACK_DIR}/certs"
-LOGS_DIR="${STACK_DIR}/logs"
-PIDS_DIR="${STACK_DIR}/pids"
-
-POSTGRES_IMAGE="${E2E_POSTGRES_IMAGE:-postgres:16.6}"
-VALKEY_IMAGE="${E2E_VALKEY_IMAGE:-valkey/valkey:8.1.4@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa}"
-JAEGER_IMAGE="${E2E_JAEGER_IMAGE:-jaegertracing/jaeger:2.10.0}"
-NGINX_IMAGE="${E2E_NGINX_IMAGE:-nginx:1.29.1-alpine@sha256:42a516af16b852e33b7682d5ef8acbd5d13fe08fecadc7ed98605ba5e3b26ab8}"
-
-LB_PORT="${E2E_LB_PORT:-4000}"
-GATEWAY_PORT_1="${E2E_GATEWAY_PORT_1:-4010}"
-GATEWAY_PORT_2="${E2E_GATEWAY_PORT_2:-4011}"
-BACKEND_PORT="${E2E_BACKEND_PORT:-4001}"
-REDIS_PORT="${E2E_REDIS_PORT:-6379}"
-DATABASE_HOST="${E2E_DATABASE_HOST:-127.0.0.1}"
-DATABASE_PORT="${E2E_DATABASE_PORT:-5432}"
-DATABASE_USER="${E2E_DATABASE_USER:-litellm}"
-DATABASE_PASSWORD="${E2E_DATABASE_PASSWORD:-dbpassword9090}"
-DATABASE_NAME="${E2E_DATABASE_NAME:-litellm}"
-JAEGER_OTLP_PORT="${E2E_JAEGER_OTLP_PORT:-4318}"
-JAEGER_OTLP_TLS_PORT="${E2E_JAEGER_OTLP_TLS_PORT:-4319}"
-JAEGER_QUERY_PORT="${E2E_JAEGER_QUERY_PORT:-16686}"
-KEYCLOAK_PORT="${E2E_KEYCLOAK_PORT:-8081}"
-
-MASTER_KEY="${LITELLM_MASTER_KEY:-sk-e2e-$(openssl rand -hex 16)}"
-
-mkdir -p "${CERTS_DIR}" "${LOGS_DIR}" "${PIDS_DIR}"
-chmod 700 "${STACK_DIR}" "${LOGS_DIR}" "${PIDS_DIR}"
-chmod 755 "${CERTS_DIR}"
-
-log() { printf 'e2e-stack: %s\n' "$*"; }
-
-port_open() { (exec 3<>"/dev/tcp/127.0.0.1/$1") 2>/dev/null; }
-
-wait_for() {
-  local label="$1" check="$2" deadline=$((SECONDS + ${3:-120}))
-  until eval "${check}"; do
-    if ((SECONDS >= deadline)); then
-      log "timed out waiting for ${label}"
-      exit 1
-    fi
-    sleep 2
-  done
-  log "${label} is up"
-}
-
-if [[ -f "${REPO_ROOT}/tests/e2e/.env" ]]; then
-  set -a
-  source "${REPO_ROOT}/tests/e2e/.env"
-  set +a
-fi
-
-if [[ -z "${DD_API_KEY:-}" ]]; then
-  log "DD_API_KEY is empty; the gateway config enables the datadog callback, so put a Datadog API key in tests/e2e/.env"
-  exit 1
-fi
-export DD_SITE="${DD_SITE:-datadoghq.com}"
-
-if ! port_open "${DATABASE_PORT}"; then
-  docker run -d --name e2e-postgres -p "${DATABASE_PORT}:5432" \
-    -e "POSTGRES_USER=${DATABASE_USER}" -e "POSTGRES_PASSWORD=${DATABASE_PASSWORD}" -e "POSTGRES_DB=${DATABASE_NAME}" \
-    "${POSTGRES_IMAGE}" >/dev/null
-fi
-wait_for "postgres" "port_open ${DATABASE_PORT}"
-
-if ! port_open "${JAEGER_QUERY_PORT}"; then
-  docker run -d --name e2e-jaeger -p "${JAEGER_OTLP_PORT}:4318" -p "${JAEGER_QUERY_PORT}:16686" \
-    "${JAEGER_IMAGE}" >/dev/null
-fi
-wait_for "jaeger" "curl -fs http://127.0.0.1:${JAEGER_QUERY_PORT}/api/services >/dev/null"
-
-openssl genrsa -out "${CERTS_DIR}/ca.key" 2048 2>/dev/null
-openssl req -x509 -new -nodes -key "${CERTS_DIR}/ca.key" -sha256 -days 7 \
-  -subj "/CN=litellm-e2e-ca" \
-  -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign" \
-  -out "${CERTS_DIR}/ca.crt" 2>/dev/null
-openssl genrsa -out "${CERTS_DIR}/server.key" 2048 2>/dev/null
-openssl req -new -key "${CERTS_DIR}/server.key" -subj "/CN=localhost" -out "${CERTS_DIR}/server.csr" 2>/dev/null
-openssl x509 -req -in "${CERTS_DIR}/server.csr" -CA "${CERTS_DIR}/ca.crt" -CAkey "${CERTS_DIR}/ca.key" \
-  -CAcreateserial -days 7 -sha256 \
-  -extfile <(printf 'basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:localhost,IP:127.0.0.1\n') \
-  -out "${CERTS_DIR}/server.crt" 2>/dev/null
-chmod 644 "${CERTS_DIR}"/*.key "${CERTS_DIR}"/*.crt
-
-CERTIFI_BUNDLE="$(cd "${REPO_ROOT}" && uv run --no-sync python -c 'import certifi; print(certifi.where())')"
-cat "${CERTIFI_BUNDLE}" "${CERTS_DIR}/ca.crt" > "${CERTS_DIR}/ca-bundle.pem"
-
-docker rm -f e2e-valkey >/dev/null 2>&1 || true
-docker run -d --name e2e-valkey -p "${REDIS_PORT}:${REDIS_PORT}" -v "${CERTS_DIR}:/certs:ro" \
-  "${VALKEY_IMAGE}" valkey-server \
-  --cluster-enabled yes --port 0 --tls-port "${REDIS_PORT}" \
-  --tls-cert-file /certs/server.crt --tls-key-file /certs/server.key --tls-ca-cert-file /certs/ca.crt \
-  --tls-auth-clients no --cluster-announce-ip 127.0.0.1 >/dev/null
-VALKEY_CLI="docker exec e2e-valkey valkey-cli --tls --cacert /certs/ca.crt -h 127.0.0.1 -p ${REDIS_PORT}"
-wait_for "valkey" "${VALKEY_CLI} ping 2>/dev/null | grep -q PONG"
-${VALKEY_CLI} cluster addslotsrange 0 16383 >/dev/null
-wait_for "valkey cluster" "${VALKEY_CLI} cluster info 2>/dev/null | grep -q cluster_state:ok"
-
-CONFIG_SOURCE="${REPO_ROOT}/tests/e2e/gateway/stage_mirror_ci_config.yml"
-CONFIG_PATH="${CONFIG_SOURCE}"
-if [[ "${REDIS_PORT}" != "6379" ]]; then
-  CONFIG_PATH="${STACK_DIR}/litellm-config.yml"
-  sed "s/port: 6379/port: ${REDIS_PORT}/" "${CONFIG_SOURCE}" > "${CONFIG_PATH}"
-fi
-
-SERVER_ENV=(
-  "LITELLM_MASTER_KEY=${MASTER_KEY}"
-  "DATABASE_HOST=${DATABASE_HOST}"
-  "DATABASE_PORT=${DATABASE_PORT}"
-  "DATABASE_USER=${DATABASE_USER}"
-  "DATABASE_PASSWORD=${DATABASE_PASSWORD}"
-  "DATABASE_NAME=${DATABASE_NAME}"
-  "DISABLE_SCHEMA_UPDATE=true"
-  "REDIS_HOST=127.0.0.1"
-  "REDIS_PORT=${REDIS_PORT}"
-  "REDIS_CLUSTER_NODES=[{\"host\":\"127.0.0.1\",\"port\":${REDIS_PORT}}]"
-  "CONFIG_FILE_PATH=${CONFIG_PATH}"
-  "STORE_MODEL_IN_DB=True"
-  "OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf"
-  "OTEL_EXPORTER_OTLP_ENDPOINT=https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}"
-  "SSL_CERT_FILE=${CERTS_DIR}/ca-bundle.pem"
-  "PYTHONPATH=${REPO_ROOT}"
-  "JWT_PUBLIC_KEY_URL=http://127.0.0.1:${KEYCLOAK_PORT}/realms/litellm-e2e/protocol/openid-connect/certs"
-  "JWT_ISSUER=http://127.0.0.1:${KEYCLOAK_PORT}/realms/litellm-e2e"
-  "JWT_AUDIENCE=litellm-e2e"
-)
-if [[ -n "${VERTEXAI_CREDENTIALS:-}" ]]; then
-  printf '%s' "${VERTEXAI_CREDENTIALS}" > "${STACK_DIR}/vertex-adc.json"
-  SERVER_ENV+=("GOOGLE_APPLICATION_CREDENTIALS=${STACK_DIR}/vertex-adc.json")
-fi
-
-cd "${REPO_ROOT}"
-
-env "${SERVER_ENV[@]}" "E2E_KEYCLOAK_PORT=${KEYCLOAK_PORT}" bash .github/e2e-stack/start-idp.sh
-
-log "running migrations"
-env "${SERVER_ENV[@]}" uv run --no-sync python migrations/run.py >"${LOGS_DIR}/migrations.log" 2>&1
-
-start_server() {
-  local name="$1"; shift
-  env -u AWS_ROLE_NAME "${SERVER_ENV[@]}" "$@" >"${LOGS_DIR}/${name}.log" 2>&1 &
-  echo $! > "${PIDS_DIR}/${name}.pid"
-}
-
-if [[ "$(uname)" == "Linux" ]]; then
-  NGINX_UPSTREAM_HOST=127.0.0.1
-  NGINX_DOCKER_ARGS=(--network host)
-else
-  NGINX_UPSTREAM_HOST=host.docker.internal
-  NGINX_DOCKER_ARGS=(-p "${LB_PORT}:${LB_PORT}" -p "${JAEGER_OTLP_TLS_PORT}:${JAEGER_OTLP_TLS_PORT}")
-fi
-
-cat > "${STACK_DIR}/nginx.conf" <<EOF
-events {}
-http {
-  map \$http_upgrade \$connection_upgrade {
-    default upgrade;
-    '' close;
-  }
-  upstream litellm_gateways {
-    server ${NGINX_UPSTREAM_HOST}:${GATEWAY_PORT_1};
-    server ${NGINX_UPSTREAM_HOST}:${GATEWAY_PORT_2};
-  }
-  server {
-    listen ${LB_PORT};
-    client_max_body_size 100m;
-    location / {
-      proxy_pass http://litellm_gateways;
-      proxy_http_version 1.1;
-      proxy_set_header Host \$host;
-      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-      proxy_set_header X-Forwarded-Proto \$scheme;
-      proxy_set_header Upgrade \$http_upgrade;
-      proxy_set_header Connection \$connection_upgrade;
-      proxy_buffering off;
-      proxy_read_timeout 600s;
-      proxy_send_timeout 600s;
-    }
-  }
-  server {
-    listen ${JAEGER_OTLP_TLS_PORT} ssl;
-    ssl_certificate /certs/server.crt;
-    ssl_certificate_key /certs/server.key;
-    client_max_body_size 100m;
-    location / {
-      proxy_pass http://${NGINX_UPSTREAM_HOST}:${JAEGER_OTLP_PORT};
-    }
-  }
-}
-EOF
-
-docker rm -f e2e-nginx >/dev/null 2>&1 || true
-docker run -d --name e2e-nginx "${NGINX_DOCKER_ARGS[@]}" \
-  -v "${STACK_DIR}/nginx.conf:/etc/nginx/nginx.conf:ro" \
-  -v "${CERTS_DIR}:/certs:ro" "${NGINX_IMAGE}" >/dev/null
-
-wait_for "Jaeger OTLP TLS listener" \
-  "curl -sS --cacert ${CERTS_DIR}/ca.crt https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}/ -o /dev/null -w '%{http_code}' | grep -qE '^[2345]'"
-
-start_server backend uv run --no-sync uvicorn backend.main:app --host 0.0.0.0 --port "${BACKEND_PORT}"
-start_server gateway-1 uv run --no-sync uvicorn gateway.main:app --workers 1 --host 0.0.0.0 --port "${GATEWAY_PORT_1}"
-start_server gateway-2 uv run --no-sync uvicorn gateway.main:app --workers 1 --host 0.0.0.0 --port "${GATEWAY_PORT_2}"
-
-wait_for "backend" "curl -fs http://127.0.0.1:${BACKEND_PORT}/health/liveliness >/dev/null" 300
-wait_for "gateway-1" "curl -fs http://127.0.0.1:${GATEWAY_PORT_1}/health/liveliness >/dev/null" 300
-wait_for "gateway-2" "curl -fs http://127.0.0.1:${GATEWAY_PORT_2}/health/liveliness >/dev/null" 300
-wait_for "load balancer" "curl -fs http://127.0.0.1:${LB_PORT}/health/liveliness >/dev/null" 60
-
-cat > "${STACK_DIR}/stack.env" <<EOF
-LITELLM_PROXY_URL=http://127.0.0.1:${LB_PORT}
-LITELLM_CONTROL_PLANE_URL=http://127.0.0.1:${BACKEND_PORT}
-LITELLM_PROXY_REPLICA_URLS=http://127.0.0.1:${GATEWAY_PORT_1},http://127.0.0.1:${GATEWAY_PORT_2}
-LITELLM_MASTER_KEY=${MASTER_KEY}
-REDIS_HOST=127.0.0.1
-REDIS_PORT=${REDIS_PORT}
-E2E_OTEL_QUERY_URL=http://127.0.0.1:${JAEGER_QUERY_PORT}
-E2E_OTEL_EXPORTER_ENDPOINT=https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}
-E2E_KEYCLOAK_URL=http://127.0.0.1:${KEYCLOAK_PORT}
-E2E_KEYCLOAK_ADMIN_USER=admin
-E2E_KEYCLOAK_ADMIN_PASSWORD=e2e-ephemeral-idp-not-a-secret
-SSL_CERT_FILE=${CERTS_DIR}/ca-bundle.pem
-DATABASE_URL=postgresql://${DATABASE_USER}:${DATABASE_PASSWORD}@${DATABASE_HOST}:${DATABASE_PORT}/${DATABASE_NAME}
-EOF
-
-log "stack is up; pytest env written to ${STACK_DIR}/stack.env"

.github/merge-smoke-tests.json

@@ -1,15 +0,0 @@
-{
-  "cases": {
-    "CHAT-JSON": "tests/unit/llms/openai/test_openai.py::test_acompletion_returns_json_reply_over_injected_transport",
-    "CHAT-TEXT-STREAM": "tests/unit/llms/openai/test_openai.py::test_acompletion_streams_text_deltas_over_injected_transport",
-    "CHAT-TOOL-STREAM": "tests/unit/llms/openai/test_openai.py::test_acompletion_streams_tool_call_arguments_over_injected_transport",
-    "MODEL-ALLOW": "tests/unit/proxy/auth/test_auth_checks_object_access_and_lookup.py::test_can_object_call_model_allows_listed_model_for_key",
-    "MODEL-DENY": "tests/unit/proxy/auth/test_auth_checks_object_access_and_lookup.py::test_can_object_call_model_denials_return_forbidden[key-key_model_access_denied]",
-    "COST-EXPLICIT": "tests/unit/test_cost_calculator.py::test_completion_cost_charges_explicit_per_token_rates_over_registered_ones",
-    "COST-ZERO": "tests/unit/test_cost_calculator.py::test_completion_cost_is_zero_when_explicit_rates_are_zero",
-    "LOG-CONTENT-ON": "tests/unit/litellm_core_utils/test_litellm_logging.py::test_standard_logging_payload_keeps_message_content_when_message_logging_is_on",
-    "LOG-CONTENT-OFF": "tests/unit/litellm_core_utils/test_litellm_logging.py::test_standard_logging_payload_redacts_message_content_when_message_logging_is_off",
-    "CALLBACK-SUCCESS": "tests/unit/litellm_core_utils/test_litellm_logging.py::test_async_success_handler_delivers_standard_logging_payload_to_custom_logger",
-    "CALLBACK-FAILURE": "tests/unit/litellm_core_utils/test_litellm_logging.py::test_async_failure_handler_delivers_failure_payload_to_custom_logger"
-  }
-}

.github/pull_request_template.md

@@ -1,167 +0,0 @@
-<!-- The whole description's target audience is humans, not AI agents: write it in plain, simple,
-     everyday engineering language, extremely parsable and readable at a glance. This goes double for
-     the TLDR, User Flow, and Caveats sections
-     Drop every section you have nothing to put in, heading included: a bare "## Relevant issues" or
-     "## Affected release" with nothing under it must not appear in the final description -->
-
-## TLDR
-
-<!-- Fill in the bullets below and keep each one short and concrete: one line per bullet, roughly 10 words max
-     If the PR intentionally changes what existing users see or how a screen behaves, add a line under the bullets that starts "Intentional product change:" describing what changes, why, and what users lose. Reviewers must never have to infer a deliberate UX change from the diff -->
-
-Problem this solves:
-
-- <blah>
-- ...
-
-How it solves it:
-
-- <blah>
-- ...
-
-## User Flow
-
-<!-- Two ordered lists, Before and After, walking the same end user through the same task, written strictly from that user's seat
-     Read the linked issue, ticket, or customer thread first so the flow reflects the real application and the routes its users actually hit; don't invent a generic scenario
-     Lead each list with one plain sentence saying where the flow fails (Before) or succeeds (After), then number the steps
-     Keep it tight: aim for 3 to 5 steps per list, one line each, roughly 20 words max, and never pad a shorter flow with filler steps to hit the count. Cover the one path the PR changes and fold variants (case, other field, second endpoint) into a clause on the step they belong to rather than their own steps. The example below is the target length
-     Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
-     No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. "The upload hands back an ID that looks like OpenAI's own `file-abc123` instead of the scrambled one the gateway returned" is right, "no managed-file row was registered" is wrong
-     Keep the two lists step-for-step identical until they diverge, so the changed step is obvious
-     If the bug had a security or authorization consequence, end each list with what another user could or could no longer do
-     Regenerate this section, screenshots included, whenever new commits change the PR's behavior, so it never describes an older revision
-     If the PR changes what an Admin UI page shows, embed a before and an after screenshot of that page right after its list, taken at the same URL on the same data, with the rows, fields, or controls that changed boxed in red so a reader spots the difference without reading the steps. These are the UI screenshots for Screenshots / Proof of Fix too: embed them once here and have that section's Before and After steps point back to them instead of repeating the images
-
-Example:
-
-Before: a developer whose app streams chat completions gets no token counts back, so their cost dashboard reads zero
-
-1. They send POST https://litellm-domain/v1/chat/completions with `"stream": true` and no `stream_options`
-2. The last SSE chunk arrives with `"usage": null`, so their app records 0 prompt and 0 completion tokens
-3. They open https://litellm-domain/ui/?page=logs and see the request logged at $0 spend
-
-After: the same request comes back with real token counts, so the dashboard shows real spend
-
-1. The proxy admin sets `always_include_stream_usage: true` and restarts the proxy
-2. The developer sends the same POST https://litellm-domain/v1/chat/completions with `"stream": true` and no `stream_options`
-3. The last SSE chunk now carries a `usage` object with real prompt and completion token counts
-4. https://litellm-domain/ui/?page=logs shows that request at non-zero spend
--->
-
-## Relevant issues
-
-<!-- e.g., "Fixes #000". Drop the section if there is none -->
-
-## Affected release
-
-<!-- Only for a fix to a regression in a released or rc version (perf, memory, crash, or behavior): name the version it regressed in, e.g. "regression in v1.100.0" or "since v1.101.0-rc.1". Add the `backport-stable` label only when the regression is a P0, meaning its Linear ticket is Urgent (a security hole however narrow, data loss, or a crash or outage for every user on that version), because every labeled PR must be cherry-picked onto the baking rc line before the stable can be tagged; every other regression fix ships in the next rc unlabeled. Drop the section otherwise -->
-
-## Linear ticket
-
-<!-- if you are an internal contributor, add "Resolves " followed by the Linear ticket e.g., "Resolves LIT-1234" to link the Linear ticket to the GitHub PR. If you don't have one, drop the section rather than guessing -->
-
-## Pre-Submission checklist
-
-**Please complete all items before asking a LiteLLM maintainer to review your PR**
-
-- [ ] I have added meaningful tests
-- [ ] The handful of test files covering my change pass locally, e.g. `uv run pytest tests/unit/<your_test_file>.py -v`. Leave the suites (`make test-unit-*`, `make test-unit`) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
-- [ ] My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
-- [ ] My PR's scope is as isolated as possible; it only solves 1 specific problem
-- [ ] I have received a Greptile **Confidence Score of at least 4/5** before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment `@greptileai` to re-request a review after pushing changes)
-
-## Delays in PR merge?
-
-If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slack (#pr-review)](https://join.slack.com/t/litellmossslack/shared_invite/zt-3o7nkuyfr-p_kbNJj8taRfXGgQI1~YyA).
-
-## Screenshots / Proof of Fix
-
-<!-- Include screenshots, screen recordings, or command (e.g., curl) + output demonstrating that your changes work as expected
-     The proof must be completely e2e with no mocks, using actual LLM calls costing real $$$ if applicable. `pytest` commands are not enough
-     Show ONLY the latest run: capture Before at the merge base and After at the PR's current tip, and when new commits change behavior, replace this whole section with the fresh run instead of stacking it on top of older ones. The run must be up to date. As soon as a new commit is made and it makes this PR description's after sha stale (it's no longer tip of PR), you must re-run the QA
-     Structure the section exactly as below: Before and After one heading level below this section, each naming the commit hash it was captured at, one lower-level heading per case inside each, the same case names in the same order on both sides, and numbered steps (command, observed output) under every case, never loose prose; shared setup (config, payloads) goes above Before, and with a single case, drop the case headings and number the steps directly
-
-### Before (<hash>)
-
-#### <case 1>
-
-1. ...
-2. ...
-
-#### <case 2>
-
-1. ...
-
-### After (<hash>)
-
-#### <case 1>
-
-1. ...
-2. ...
-
-#### <case 2>
-
-1. ...
-
-     For bug fixes: Before shows the reproduction, After shows the same steps passing
-     For new features: Before shows the capability missing, After shows it working end-to-end
-     If the change applies to all three LLM endpoints (/v1/responses, /v1/chat/completions, /v1/messages), make each endpoint its own case, not just one
-     For UI changes: before/after screenshots under the same headings
-     If the main use case runs through a coding tool like Claude Code or Codex, drive that tool interactively the way the user does (never `claude -p`, `codex exec`, or curl on its own) and embed before/after screenshots of its pane under the same headings; curl replays and headless runs can follow as extra cases, never as the only proof -->
-
-## Type
-
-<!-- Select the type of Pull Request -->
-<!-- Keep only the necessary ones -->
-
-🆕 New Feature
-🐛 Bug Fix
-🧹 Refactoring
-📖 Documentation
-🚄 Infrastructure
-✅ Test
-
-## Caveats (if any)
-
-<!-- Group caveats under severity subheadings (### Severe, ### High, ### Medium, ### Low), with
-     short bullet points inside each, just like the TLDR: one line per bullet, roughly 10 words max
-     Call out known limitations, follow-up work, or anything a reviewer should watch out for
-     Include only the tiers that have caveats; drop the empty ones
-     - Severe: inherent to what the PR deliberately ships, there even when the code works as intended:
-       it can degrade or take down a running deployment (e.g. a slow or table-locking boot migration),
-       rewrite data by design, break an existing workflow on purpose, or change auth behavior. An
-       operator must plan around it before rollout
-     - High: an unintended hole: a correctness, security, data-loss, or backward-compatibility bug,
-       unsafe to ship as is
-     - Medium: a real gap someone can hit, but with a workaround or a narrow blast radius
-     - Low: anything else worth noting: naming, cleanup, an edge case nobody hits
-     Nest bullets as deep as helps: hierarchy beats one long line when it makes things clearer to a
-     human reader
-     If you assumed something instead of testing it, e.g. "only reproduces with X on" or "no
-     user-observable behavior difference", list it here too with what breaks if it is wrong
-     Drop this section if there are none -->
-
-## QA runbook
-
-<!-- Only needed when your PR edits tests/e2e; delete this section otherwise
-
-For each e2e test you added or changed, list the manual steps a reviewer can follow to reproduce it by hand against a live proxy, mapping 1:1 to what the test asserts: one top-level bullet per test giving its pytest node id followed by what it proves in plain words, then a nested "- [ ]" checklist where each item is a concrete action (route, request body, expected response) and the final item is the sanity-check step shown in the examples. Note environment prerequisites (provider credentials, config flags) and any nuances a manual run will hit. See PRs #32914 and #32963 for full examples
-
-Example checklists:
-
-- tests/e2e/quota_management/ratelimit/test_rate_limit_e2e.py::TestKeyRateLimits::test_rpm_limit_blocks_over_limit - a key allowed 2 requests a minute serves exactly 2 and refuses the 3rd
-  - [ ] Generate a limited key: curl -X POST http://localhost:4000/key/generate -H "Authorization: Bearer sk-1234" -d '{"rpm_limit": 2}'
-  - [ ] Send three /v1/chat/completions requests with that key inside one minute
-  - [ ] Expect the first two to return 200 and the third to return 429 naming the rpm limit
-  - [ ] Sanity check: this test makes sense to add and is not hand-wavey (e.g., assert actual expected spend instead of just spend > 0) or potentially flaky
-
-- tests/e2e/management/test_management_e2e.py::TestModelRoutes::test_model_create_appears_in_ui - a deployment created through the API shows up on the Admin UI models page
-  - [ ] POST /model/new with the master key, a bedrock model, and aws_region_name (needs STORE_MODEL_IN_DB=True and AWS credentials)
-  - [ ] Open http://localhost:4000/ui/?page=models and expect a deployment row showing the returned model id
-  - [ ] Sanity check: this test makes sense to add and is not hand-wavey (e.g., assert actual expected spend instead of just spend > 0) or potentially flaky
--->
-
-## Final Attestation
-
-- [ ] The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR
-

.github/scripts/assert_ci_coverage.py

@@ -9,6 +9,7 @@ import sys
 import warnings
 from collections.abc import Callable, Iterable, Mapping, Sequence
 from dataclasses import dataclass
+from functools import lru_cache
 from types import MappingProxyType
 from typing import Final
 
@@ -22,11 +23,12 @@ TESTS_ROOT = REPO_ROOT / "tests"
 
 ALLOWLIST_KEYS = frozenset({"description", "test_paths", "dockerfiles"})
 PATH_FILTER_KEYS = frozenset({"paths", "paths-ignore"})
-TEST_PATH_KEYS = frozenset({"test-path", "test-paths"})
+TEST_PATH_KEYS = frozenset({"test-path", "test-paths", "test_path"})
 DOCKERFILE_INPUT_KEYS = frozenset({"file", "dockerfile"})
 TEST_RUNNER_RE = re.compile(r"\bpytest\b|\bcircleci tests\b|\bhelm unittest\b|\bplaywright test\b|\bpython[0-9.]*\s")
 IMAGE_BUILD_RE = re.compile(r"\bdocker\s+(?:buildx\s+)?build\b")
 TEST_TOKEN_RE = re.compile(r"tests/[A-Za-z0-9_./*?-]+")
+IGNORE_ARG_RE: Final = re.compile(r"--ignore(?:-glob)?[= ](\S+)")
 DOCKERFILE_TOKEN_RE = re.compile(r"[A-Za-z0-9_./-]*Dockerfile[A-Za-z0-9_.-]*")
 COMMENT_RE = re.compile(r"^\s*#.*$", re.MULTILINE)
 GLOB_CHARS = frozenset("*?")
@@ -35,8 +37,15 @@ GLOB_CHARS = frozenset("*?")
 # tests has to be named by some shard or it runs nowhere. A child listed here is
 # itself decomposed one level deeper and is checked through its own entry.
 SHARDED_ROOTS: tuple[str, ...] = (
-    "tests/test_litellm",
+    "tests/unit",
+    "tests/unit/enterprise",
+    "tests/unit/enterprise/enterprise_callbacks",
+    "tests/unit/enterprise/proxy",
+    "tests/unit/llms",
     "tests/unit/proxy",
+    "tests/unit/proxy/_experimental",
+    "tests/unit/responses",
+    "tests/unit/skills",
 )
 
 
@@ -72,6 +81,17 @@ class Scalar:
     value: str
 
 
+@dataclass(frozen=True, slots=True)
+class Selection:
+    included: frozenset[str]
+    ignored: frozenset[str]
+
+    def covers(self, relative_path: str) -> bool:
+        return any(_token_covers(token, relative_path) for token in self.included) and not any(
+            _token_covers(token, relative_path) for token in self.ignored
+        )
+
+
 @dataclass(frozen=True, slots=True)
 class Finding:
     subject: str
@@ -111,57 +131,32 @@ def _uncommented(value: str) -> str:
     return COMMENT_RE.sub("", value)
 
 
-def _invoked_test_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
-    return frozenset(
-        match.group(0).rstrip("/")
+def _selection_for_scalar(scalar: Scalar) -> Selection:
+    text: Final = _uncommented(scalar.value)
+    ignored: Final = frozenset().union(
+        *(
+            frozenset(token.rstrip("/") for token in TEST_TOKEN_RE.findall(ignored_argument))
+            for ignored_argument in IGNORE_ARG_RE.findall(text)
+        )
+    )
+    included: Final = frozenset(
+        match.group(0).rstrip("/") for match in TEST_TOKEN_RE.finditer(IGNORE_ARG_RE.sub("", text))
+    )
+    return Selection(included=included, ignored=ignored)
+
+
+def _invoked_selections(scalars: Iterable[Scalar]) -> tuple[Selection, ...]:
+    selected_scalars: Final = tuple(
+        scalar
         for scalar in scalars
         if scalar.key in TEST_PATH_KEYS or TEST_RUNNER_RE.search(scalar.value)
-        for match in TEST_TOKEN_RE.finditer(_uncommented(scalar.value))
     )
+    selections: Final = tuple(_selection_for_scalar(scalar) for scalar in selected_scalars)
+    return tuple(selection for selection in selections if selection.included)
 
 
-SELECTION_ARM_RE = re.compile(r"(?ms)^\s*([A-Za-z0-9_|*-]+)\)\s*(.*?);;")
-
-
-def _unit_selection_arms(repo_root: pathlib.Path = REPO_ROOT) -> Mapping[str, frozenset[str]]:
-    script: Final = repo_root / ".circleci/scripts/unit_selection.sh"
-    if not script.is_file():
-        return MappingProxyType({})
-    text: Final = _uncommented(script.read_text())
-    return MappingProxyType(
-        {
-            label: frozenset(
-                match.group(0).rstrip("/") for match in TEST_TOKEN_RE.finditer(body)
-            )
-            for label, body in SELECTION_ARM_RE.findall(text)
-        }
-    )
-
-
-def _unit_selection_tokens(repo_root: pathlib.Path = REPO_ROOT) -> frozenset[str]:
-    return frozenset(
-        token for tokens in _unit_selection_arms(repo_root).values() for token in tokens
-    )
-
-
-def _wired_unit_flags(scalars: Iterable[Scalar]) -> frozenset[str]:
-    return frozenset(
-        scalar.value
-        for scalar in scalars
-        if scalar.key == "unit-flag" and "${{" not in scalar.value
-    )
-
-
-def _shard_tokens(
-    scalars: Iterable[Scalar], arms: Mapping[str, frozenset[str]]
-) -> frozenset[str]:
-    wired: Final = _wired_unit_flags(scalars)
-    return _invoked_test_tokens(scalars) | frozenset(
-        token
-        for label, tokens in arms.items()
-        if label in wired
-        for token in tokens
-    )
+def _invoked_test_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
+    return frozenset().union(*(selection.included for selection in _invoked_selections(scalars)))
 
 
 def _built_dockerfile_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
@@ -224,11 +219,12 @@ def _dockerfiles() -> tuple[str, ...]:
     )
 
 
-def _uncovered_tests(allowlist: Allowlist, tokens: frozenset[str]) -> tuple[Finding, ...]:
+def _uncovered_tests(allowlist: Allowlist, selections: tuple[Selection, ...]) -> tuple[Finding, ...]:
     uncovered = tuple(
         relative_path
         for relative_path in _test_files()
-        if not any(_token_covers(token, relative_path) for token in tokens) and not allowlist.covers_test(relative_path)
+        if not any(selection.covers(relative_path) for selection in selections)
+        and not allowlist.covers_test(relative_path)
     )
     directories = tuple(dict.fromkeys(path.rsplit("/", 1)[0] for path in uncovered))
     return tuple(
@@ -321,6 +317,7 @@ def _keyword_terms(
 def _slices() -> tuple[Slice, ...]:
     if not CIRCLECI_CONFIG.exists():
         return ()
+    test_files: Final = frozenset(_test_files())
     jobs: Final = yaml.safe_load(CIRCLECI_CONFIG.read_text()).get("jobs", {})
     return tuple(
         Slice(job=job, globs=globs, named=named, required=required, excluded=excluded, understood=understood)
@@ -328,7 +325,7 @@ def _slices() -> tuple[Slice, ...]:
         for text in ("\n".join(_strings(body)),)
         if "pytest" in text
         for globs in (tuple(GLOB_CALL_RE.findall(text)),)
-        for named in (frozenset(TEST_TOKEN_RE.findall(text)) & frozenset(_test_files()),)
+        for named in (frozenset(TEST_TOKEN_RE.findall(text)) & test_files,)
         for required, excluded, understood in (
             _keyword_terms(tuple(KEYWORD_RE.findall(text)), attributable=len(globs) < 2),
         )
@@ -368,6 +365,7 @@ def _workflow_named_tokens() -> frozenset[str]:
 
 
 def _deselected_everywhere(allowlist: Allowlist) -> tuple[Finding, ...]:
+    matchable_names: Final = lru_cache(maxsize=None)(_matchable_names)
     slices: Final = _slices()
     named_by_workflow: Final = _workflow_named_tokens()
     globbed: Final = tuple(
@@ -381,7 +379,7 @@ def _deselected_everywhere(allowlist: Allowlist) -> tuple[Finding, ...]:
         for path in globbed
         if not allowlist.covers_test(path)
         and not any(_token_covers(token, path) for token in named_by_workflow)
-        and not any(slice_.claims(path, _matchable_names(path)) for slice_ in slices)
+        and not any(slice_.claims(path, matchable_names(path)) for slice_ in slices)
     )
 
 
@@ -518,7 +516,7 @@ def _check_slices() -> int:
 
 
 def _check_shards() -> int:
-    findings = _unassigned_shard_children(_shard_tokens(_all_scalars(), _unit_selection_arms()))
+    findings = _unassigned_shard_children(_invoked_test_tokens(_all_scalars()))
     if findings:
         _report(
             "test directories and files that no shard claims",
@@ -544,23 +542,46 @@ def _integration_groups(runner: pathlib.Path) -> dict[str, tuple[str, ...]]:
     return {group: tuple(folders) for group, folders in ast.literal_eval(mapping).items()}
 
 
+def _integration_github_files(runner: pathlib.Path) -> frozenset[str]:
+    module: Final = ast.parse(runner.read_text())
+    literal: Final = next(
+        (
+            node.value
+            for node in module.body
+            if isinstance(node, ast.AnnAssign)
+            and isinstance(node.target, ast.Name)
+            and node.target.id == "GITHUB_FILES"
+        ),
+        None,
+    )
+    if literal is None:
+        return frozenset()
+    values: Final = literal.args[0] if isinstance(literal, ast.Call) else literal
+    return frozenset(ast.literal_eval(values))
+
+
 def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozenset[str], tuple[Finding, ...]]:
     runner: Final = repo_root / "tests/integration/run.py"
     if not runner.exists():
         return frozenset(), ()
     groups: Final = _integration_groups(runner)
+    github_files: Final = _integration_github_files(runner)
     integration_root: Final = repo_root / "tests/integration"
     paths: Final = frozenset(
         str(path.relative_to(repo_root))
         for folders in groups.values()
         for folder in folders
         for path in (integration_root / folder).rglob("test_*.py")
+        if str(path.relative_to(repo_root)) not in github_files
     )
     browser_manifest: Final = repo_root / "tests/e2e/ui/tests/integrationCritical/expected.json"
     browser_nodes: Final = json.loads(browser_manifest.read_text()) if browser_manifest.exists() else ()
     browser_paths: Final = frozenset(node.split("::", 1)[0] for node in browser_nodes)
     circle_path: Final = repo_root / ".circleci/config.yml"
     circle: Final = yaml.safe_load(circle_path.read_text()) if circle_path.exists() else {}
+    circle_test_path_tokens: Final = _invoked_test_tokens(
+        scalar for scalar in _scalars(circle, "config.yml") if scalar.key == "test_path"
+    )
     steps: Final = circle.get("jobs", {}).get("integration_contracts", {}).get("steps", ())
     invoked: Final = any(
         ".circleci/scripts/run_integration.sh" in scalar.value
@@ -595,10 +616,22 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
         for path in (repo_root / ".github/workflows").glob("*.y*ml")
         for scalar in _scalars(yaml.safe_load(path.read_text()), path.name)
     )
-    findings: Final = tuple(
-        Finding(path, "integration contract is also selected by GitHub Actions")
-        for path in paths
-        if any(_token_covers(token, path) for token in gha_tokens)
+    findings: Final = (
+        tuple(
+            Finding(path, "integration contract is also selected by GitHub Actions")
+            for path in paths
+            if any(_token_covers(token, path) for token in gha_tokens)
+        )
+        + tuple(
+            Finding(path, "GitHub-owned integration contract has no invoking job")
+            for path in sorted(github_files)
+            if not any(_token_covers(token, path) for token in gha_tokens | circle_test_path_tokens)
+        )
+        + tuple(
+            Finding(path, "GitHub-owned integration file is missing")
+            for path in sorted(github_files)
+            if not (repo_root / path).is_file()
+        )
     )
     browser_commands: Final = tuple(
         scalar.value
@@ -642,7 +675,7 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
         return frozenset(), findings + (
             Finding(str(runner.relative_to(repo_root)), "dedicated CircleCI runner is missing"),
         )
-    return paths | browser_paths, findings + group_findings + browser_findings + exclusion_findings
+    return paths | browser_paths | github_files, findings + group_findings + browser_findings + exclusion_findings
 
 
 def main() -> int:
@@ -656,7 +689,11 @@ def main() -> int:
 
     integration_paths, ownership_findings = _integration_ownership()
     test_findings = (
-        _uncovered_tests(allowlist, _invoked_test_tokens(scalars) | _unit_selection_tokens() | integration_paths)
+        _uncovered_tests(
+            allowlist,
+            _invoked_selections(scalars)
+            + (Selection(included=integration_paths, ignored=frozenset()),),
+        )
         + ownership_findings
     )
     dockerfile_findings = _uncovered_dockerfiles(allowlist, _built_dockerfile_tokens(scalars))

.github/scripts/run_merge_smoke.py

@@ -16,29 +16,11 @@ import socket
 import subprocess
 import sys
 import time
-from collections import Counter
 from collections.abc import Sequence
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from pathlib import Path
-from types import MappingProxyType
 from typing import Final, NoReturn, TextIO, cast
 
-import pytest
-
-EXPECTED_CASES: Final = (
-    "CHAT-JSON",
-    "CHAT-TEXT-STREAM",
-    "CHAT-TOOL-STREAM",
-    "MODEL-ALLOW",
-    "MODEL-DENY",
-    "COST-EXPLICIT",
-    "COST-ZERO",
-    "LOG-CONTENT-ON",
-    "LOG-CONTENT-OFF",
-    "CALLBACK-SUCCESS",
-    "CALLBACK-FAILURE",
-)
-
 
 @dataclass(frozen=True, slots=True)
 class CheckResult:
@@ -57,8 +39,6 @@ class _Args:
     ready_deadline: float = 120.0
     shutdown_deadline: float = 20.0
     poll_interval: float = 0.5
-    manifest: str = ""
-    rootdir: str | None = None
 
 
 def fail(reason: str) -> NoReturn:
@@ -345,120 +325,6 @@ def _terminate(proc: subprocess.Popen[bytes], log_file: TextIO) -> None:
     log_file.close()
 
 
-def _load_manifest(path: Path) -> MappingProxyType[str, str]:
-    def no_duplicates(pairs: list[tuple[object, object]]) -> dict[object, object]:
-        seen: dict[object, object] = {}
-        for key, value in pairs:
-            if key in seen:
-                raise ValueError(f"duplicate key in manifest: {key}")
-            seen[key] = value
-        return seen
-
-    raw_value: object = cast(object, json.loads(path.read_text(), object_pairs_hook=no_duplicates))
-    if not isinstance(raw_value, dict):
-        raise ValueError("manifest must be an object")
-    loaded: Final = cast(dict[object, object], raw_value)
-    cases_value: object = loaded.get("cases")
-    if not isinstance(cases_value, dict):
-        raise ValueError("manifest must be an object with a 'cases' object")
-    cases_any: Final = cast(dict[object, object], cases_value)
-    cases: Final = {k: v for k, v in cases_any.items() if isinstance(k, str) and isinstance(v, str)}
-    if len(cases) != len(cases_any):
-        raise ValueError("manifest 'cases' must map string ids to string node ids")
-    return MappingProxyType(cases)
-
-
-@dataclass(slots=True, eq=False)
-class _Recorder:
-    collect_failed: list[str] = field(default_factory=list)
-    collected: tuple[str, ...] = ()
-    reports: dict[str, list[tuple[str, str, bool]]] = field(default_factory=dict)
-
-    def pytest_collectreport(self, report: pytest.CollectReport) -> None:
-        if report.failed:
-            self.collect_failed.append(report.nodeid)
-
-    def pytest_collection_finish(self, session: pytest.Session) -> None:
-        self.collected = tuple(item.nodeid for item in session.items)
-
-    def pytest_runtest_logreport(self, report: pytest.TestReport) -> None:
-        self.reports.setdefault(report.nodeid, []).append((report.when, report.outcome, hasattr(report, "wasxfail")))
-
-
-def cmd_pytest(args: _Args) -> int:
-    try:
-        cases: Final = _load_manifest(Path(args.manifest))
-    except (OSError, ValueError, json.JSONDecodeError) as exc:
-        fail(f"manifest invalid: {exc}")
-    if tuple(cases) != EXPECTED_CASES:
-        fail(f"manifest case ids must be exactly {list(EXPECTED_CASES)} in order, got {list(cases)}")
-    node_ids: Final = tuple(cases.values())
-    if len(set(node_ids)) != len(node_ids):
-        fail("manifest node ids are not unique")
-    argv: Final = [
-        *node_ids,
-        "-p",
-        "no:cacheprovider",
-        "-p",
-        "no:xdist",
-        "-p",
-        "no:rerunfailures",
-        "-p",
-        "no:randomly",
-        "-rA",
-        "-q",
-        *(["--rootdir", args.rootdir] if args.rootdir else []),
-    ]
-
-    recorder: Final = _Recorder()
-    code: Final = pytest.main(argv, plugins=[recorder])
-    name_of: Final = MappingProxyType({node_id: case_id for case_id, node_id in cases.items()})
-    problems: Final[list[str]] = []
-    if code != 0:
-        problems.append(f"pytest exit code {code}")
-    for failed_id in recorder.collect_failed:
-        problems.append(f"collection failed: {name_of.get(failed_id, failed_id)}")
-    expected: Final = Counter(node_ids)
-    collected: Final = Counter(recorder.collected)
-    for node_id in expected - collected:
-        problems.append(f"missing case {name_of[node_id]} ({node_id})")
-    for node_id in collected - expected:
-        problems.append(f"unexpected test collected: {node_id}")
-    for node_id, count in collected.items():
-        if count > 1:
-            problems.append(f"duplicated test id: {node_id}")
-    if len(recorder.collected) != len(EXPECTED_CASES):
-        problems.append(f"collected {len(recorder.collected)} tests, expected {len(EXPECTED_CASES)}")
-    rows: Final[list[tuple[str, bool]]] = []
-    for case_id, node_id in cases.items():
-        reports = recorder.reports.get(node_id, [])
-        case_ok = (
-            bool(reports)
-            and all(outcome == "passed" and not wasxfail for _, outcome, wasxfail in reports)
-            and {when for when, _, _ in reports} >= {"setup", "call", "teardown"}
-        )
-        rows.append((case_id, case_ok))
-        if not reports:
-            problems.append(f"{case_id} ({node_id}) produced no runtest reports")
-            continue
-        for when, outcome, wasxfail in reports:
-            if outcome != "passed":
-                problems.append(f"{case_id} ({node_id}) {when} outcome={outcome}")
-            if wasxfail:
-                problems.append(f"{case_id} ({node_id}) {when} was xfail/xpass")
-        missing_phases = {"setup", "call", "teardown"} - {when for when, _, _ in reports}
-        for phase in sorted(missing_phases):
-            problems.append(f"{case_id} ({node_id}) missing {phase} report")
-    for case_id, passed in rows:
-        print(f"{case_id}  {'PASS' if passed else 'FAIL'}  {cases[case_id]}")
-    if problems:
-        for problem in problems:
-            print(f"merge-smoke: {problem}", file=sys.stderr)
-        fail("pytest verdict failed")
-    ok("pytest 11 cases")
-    return 0
-
-
 def main() -> int:
     parser: Final = argparse.ArgumentParser(description=__doc__)
     subs: Final = parser.add_subparsers(dest="command", required=True)
@@ -475,16 +341,12 @@ def main() -> int:
     p_proxy.add_argument("--ready-deadline", type=float, default=120)
     p_proxy.add_argument("--shutdown-deadline", type=float, default=20)
     p_proxy.add_argument("--poll-interval", type=float, default=0.5)
-    p_test: Final = subs.add_parser("pytest")
-    p_test.add_argument("--manifest", required=True)
-    p_test.add_argument("--rootdir", default=None)
     args: Final = parser.parse_args(namespace=_Args())
     handlers: Final = {
         "verify-isolation": cmd_verify_isolation,
         "interpreter": cmd_interpreter,
         "cli": cmd_cli,
         "proxy-startup": cmd_proxy_startup,
-        "pytest": cmd_pytest,
     }
     return handlers[args.command](args)
 

.github/scripts/verify_linux_native_wheel.py

@@ -214,7 +214,7 @@ def main(
     native_module: Final = load_native_module(native_path)
     native_module_loads: Final = native_module is not None
     panic_test_hook_absent: Final = native_module is not None and not hasattr(native_module, "_panic_for_test")
-    native_size_limit: Final = 45_000_000
+    native_size_limit: Final = 48_000_000
     native_size_within_limit: Final = native_member.file_size <= native_size_limit
     validations: Final = (
         (f"Python tag is {EXPECTED_PYTHON_TAG}", python_tag == EXPECTED_PYTHON_TAG),

.github/workflows/_test-unit-base.yml

@@ -1,289 +0,0 @@
-name: _Unit Test Base (Reusable)
-
-on:
-  workflow_call:
-    inputs:
-      test-path:
-        description: >-
-          Space-separated pytest paths to run. A path that no longer exists is
-          dropped with a warning instead of being passed to pytest, because one
-          missing path makes pytest-xdist collect nothing and report exit 5, which
-          the step treats as a drained shard. Options are passed through as
-          written, so use the `--flag=value` form: a bare `--ignore path` would
-          have its path existence-checked like any other token.
-        required: true
-        type: string
-      unit-flag:
-        description: >-
-          Codecov flag of the `.circleci/tests.yml` job that now owns part of
-          this shard. The shard also runs the files
-          `.circleci/scripts/unit_selection.sh` lists for the flag, on every
-          event, because the CircleCI pipeline is manual-only while the tests
-          migrate.
-        required: false
-        type: string
-        default: ""
-      workers:
-        description: "Number of pytest-xdist workers"
-        required: false
-        type: number
-        default: 2
-      reruns:
-        description: "Number of reruns for flaky tests"
-        required: false
-        type: number
-        default: 2
-      timeout-minutes:
-        description: >-
-          Timeout for the test step alone. Setup (checkout, dependency install,
-          Prisma client generation) gets its own allowance on top, so a slow
-          runner or a cold binary download can never cancel passing tests.
-        required: false
-        type: number
-        default: 20
-      job-timeout-minutes:
-        description: >-
-          Backstop for the whole job. Keep it >= `timeout-minutes` plus 40: 35 for
-          the per-step ceilings on the setup steps below, and 5 for the runner
-          overhead the job clock charges but no step owns (job init, step
-          transitions, post-job cleanup). That headroom is what makes the test
-          budget a floor rather than a hope, since setup cannot overrun into it
-          without failing its own step first. GitHub expressions have no
-          arithmetic, so the sum is passed in rather than computed.
-        required: false
-        type: number
-        default: 60
-      test-timeout-seconds:
-        description: >-
-          Per-test ceiling enforced by pytest-timeout, covering fixture setup and
-          teardown as well as the test body. A test that hangs fails with a
-          traceback of where it was stuck instead of idling the shard until
-          `timeout-minutes` cancels it. Timed-out tests are excluded from reruns
-          because pytest-timeout arms its timer once per test and
-          pytest-rerunfailures reruns inside that same window, so a rerun of a
-          timed-out test would run with no timer at all.
-        required: false
-        type: number
-        default: 120
-      max-failures:
-        description: "Stop after this many failures"
-        required: false
-        type: number
-        default: 10
-      dist:
-        description: "pytest-xdist distribution mode (loadscope|load|worksteal|loadfile|no)"
-        required: false
-        type: string
-        default: "loadscope"
-      artifact-name:
-        description: "Unique name for the coverage artifact (must be unique per run)"
-        required: true
-        type: string
-      legacy-mcp-peer:
-        description: "Install the isolated SDK1 peer for MCP compatibility tests"
-        required: false
-        type: boolean
-        default: false
-
-permissions:
-  contents: read
-
-env:
-  UV_PYTHON: "3.12"
-  LITELLM_LOCAL_MODEL_COST_MAP: "True"
-
-jobs:
-  run:
-    name: Run tests
-    runs-on: ubuntu-latest
-    timeout-minutes: ${{ inputs.job-timeout-minutes }}
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      decision: ${{ steps.changes.outputs.decision }}
-      has-coverage: ${{ steps.tests.outputs.has-coverage }}
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        timeout-minutes: 3
-        with:
-          persist-credentials: false
-
-      - name: Detect relevant changes
-        id: changes
-        timeout-minutes: 2
-        uses: ./.github/actions/detect-changes
-
-      - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: ${{ env.UV_PYTHON }}
-
-      - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        uses: ./.github/actions/cache-uv-downloads
-
-      - name: Cache the Rust build
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 8
-        env:
-          LEGACY_MCP_PEER: ${{ inputs.legacy-mcp-peer }}
-        run: |
-          diff -u model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml
-          uv run --no-sync python -c 'import os, sys; print(sys.version); assert f"{sys.version_info.major}.{sys.version_info.minor}" == os.environ["UV_PYTHON"]'
-          if [ "$LEGACY_MCP_PEER" = "true" ]; then
-            uv venv --python "${UV_PYTHON}" .venv-mcp-peer
-            uv pip install --python .venv-mcp-peer 'mcp==1.28.1' 'langchain-mcp-adapters==0.2.1'
-            echo "MCP_TEST_PEER_PYTHON=$GITHUB_WORKSPACE/.venv-mcp-peer/bin/python" >> "$GITHUB_ENV"
-          fi
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Run tests
-        id: tests
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: ${{ inputs.timeout-minutes }}
-        env:
-          TEST_PATH: ${{ inputs.test-path }}
-          UNIT_FLAG: ${{ inputs.unit-flag }}
-          MAX_FAILURES: ${{ inputs.max-failures }}
-          WORKERS: ${{ inputs.workers }}
-          RERUNS: ${{ inputs.reruns }}
-          TEST_TIMEOUT_SECONDS: ${{ inputs.test-timeout-seconds }}
-          DIST: ${{ inputs.dist }}
-          COVERAGE_CORE: sysmon
-        run: |
-          echo "has-coverage=false" >> "$GITHUB_OUTPUT"
-          selection="${TEST_PATH}"
-          if [ -n "${UNIT_FLAG}" ]; then
-            selection="${TEST_PATH} $(bash .circleci/scripts/unit_selection.sh "${UNIT_FLAG}" | tr '\n' ' ')"
-          fi
-          if [ -z "${selection// /}" ]; then
-            echo "shard selection is empty; nothing to run"
-            exit 0
-          fi
-          pytest_args=()
-          existing_paths=0
-          for token in ${selection}; do
-            case "${token}" in
-              -*) pytest_args+=("${token}") ;;
-              *)
-                if [ -e "${token%%::*}" ]; then
-                  pytest_args+=("${token}")
-                  existing_paths=$((existing_paths + 1))
-                else
-                  echo "::warning::${token} does not exist; drop it from this shard's test-path"
-                fi
-                ;;
-            esac
-          done
-          if [ "${existing_paths}" -eq 0 ]; then
-            echo "No path in the selection exists (${selection}); nothing to run"
-            exit 0
-          fi
-          xdist_args=()
-          if [ "${WORKERS}" != "0" ]; then
-            xdist_args=(-n "${WORKERS}" --dist="${DIST}")
-          fi
-          set +e
-          uv run --no-sync pytest "${pytest_args[@]}" \
-            --tb=short -vv \
-            --maxfail="${MAX_FAILURES}" \
-            "${xdist_args[@]}" \
-            --reruns "${RERUNS}" \
-            --reruns-delay 1 \
-            --timeout="${TEST_TIMEOUT_SECONDS}" \
-            --rerun-except "from pytest-timeout" \
-            --durations=20 \
-            --cov=./litellm --cov=./enterprise/litellm_enterprise \
-            --cov-report=xml:coverage.xml \
-            --cov-config=pyproject.toml
-          status=$?
-          set -e
-          if [ -f coverage.xml ]; then
-            echo "has-coverage=true" >> "$GITHUB_OUTPUT"
-          fi
-          if [ "$status" -eq 5 ]; then
-            echo "pytest collected no tests from ${selection}; passing"
-            exit 0
-          fi
-          exit "$status"
-
-      - name: Save coverage report
-        if: always() && steps.changes.outputs.decision != 'skip'
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: coverage.xml
-          retention-days: 1
-
-  upload-coverage:
-    name: Upload coverage to Codecov
-    needs: run
-    if: always() && needs.run.outputs.decision != 'skip' && needs.run.outputs.has-coverage == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-      pull-requests: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Download coverage report
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
-        with:
-          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: coverage-reports
-          merge-multiple: true
-
-      - name: Upload to Codecov
-        id: codecov-upload
-        continue-on-error: true
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
-        with:
-          use_oidc: true
-          directory: coverage-reports
-          root_dir: ${{ github.workspace }}
-          flags: ${{ inputs.artifact-name }}
-          fail_ci_if_error: false
-
-      - name: Upload to Codecov (retry)
-        if: steps.codecov-upload.outcome == 'failure'
-        continue-on-error: true
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
-        with:
-          use_oidc: true
-          directory: coverage-reports
-          root_dir: ${{ github.workspace }}
-          flags: ${{ inputs.artifact-name }}
-          fail_ci_if_error: false

.github/workflows/check-ui-api-types.yml

@@ -1,134 +0,0 @@
-name: Check UI API Types Sync
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  check-sync:
-    name: Verify schema.d.ts matches the proxy OpenAPI spec
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-          fetch-depth: 2
-
-      - name: Detect changes that can affect the generated types
-        id: changes
-        run: |
-          set -euo pipefail
-          if ! base="$(git rev-parse --verify --quiet HEAD^2 >/dev/null && git rev-parse HEAD^1)"; then
-            echo "Not a pull request merge commit, running the full check."
-            echo "relevant=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          files="$(git diff --name-only "$base" HEAD)"
-          if grep -Eq '^(litellm/(proxy|types)/|ui/litellm-dashboard/(src/lib/http/schema\.d\.ts|scripts/gen-api-types\.mjs|package(-lock)?\.json)$|\.github/workflows/check-ui-api-types\.yml$)' <<< "$files"; then
-            echo "relevant=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "No proxy, types or generator changes in this pull request, nothing to verify."
-            echo "relevant=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Set up Python
-        if: steps.changes.outputs.relevant == 'true'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        if: steps.changes.outputs.relevant == 'true'
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.relevant == 'true'
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-
-
-      - name: Cache the Rust build
-        if: steps.changes.outputs.relevant == 'true'
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install backend dependencies
-        if: steps.changes.outputs.relevant == 'true'
-        run: .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.relevant == 'true'
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        if: steps.changes.outputs.relevant == 'true'
-        run: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Regenerate the lazy OpenAPI snapshot
-        if: steps.changes.outputs.relevant == 'true'
-        run: uv run --no-sync python -m litellm.proxy._lazy_openapi_snapshot
-
-      - name: Fail if the lazy OpenAPI snapshot is stale
-        if: steps.changes.outputs.relevant == 'true'
-        run: |
-          if ! git diff --exit-code -- litellm/proxy/_lazy_openapi_snapshot.json; then
-            echo "::error file=litellm/proxy/_lazy_openapi_snapshot.json::The lazy OpenAPI snapshot is out of sync with the lazily loaded routes."
-            echo ""
-            echo "A lazily loaded route or model changed without regenerating the snapshot that /openapi.json serves for unloaded features."
-            echo "To fix, run from the repo root:"
-            echo "  uv run python -m litellm.proxy._lazy_openapi_snapshot"
-            echo "then run npm run gen:api from ui/litellm-dashboard and commit both files."
-            exit 1
-          fi
-          echo "_lazy_openapi_snapshot.json is in sync with the lazily loaded routes."
-
-      - name: Set up Node.js
-        if: steps.changes.outputs.relevant == 'true'
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version-file: ui/litellm-dashboard/.nvmrc
-          cache: "npm"
-          cache-dependency-path: ui/litellm-dashboard/package-lock.json
-
-      - name: Install dashboard dependencies
-        if: steps.changes.outputs.relevant == 'true'
-        working-directory: ui/litellm-dashboard
-        run: npm ci
-
-      - name: Regenerate types from the live spec
-        if: steps.changes.outputs.relevant == 'true'
-        working-directory: ui/litellm-dashboard
-        env:
-          LITELLM_PYTHON: "uv run --no-sync python"
-        run: npm run gen:api
-
-      - name: Fail if types are stale
-        if: steps.changes.outputs.relevant == 'true'
-        run: |
-          if ! git diff --exit-code -- ui/litellm-dashboard/src/lib/http/schema.d.ts; then
-            echo "::error file=ui/litellm-dashboard/src/lib/http/schema.d.ts::Generated API types are out of sync with the proxy OpenAPI spec."
-            echo ""
-            echo "A backend route or model changed without regenerating the dashboard types."
-            echo "To fix, run from ui/litellm-dashboard:"
-            echo "  npm run gen:api"
-            echo "then commit the updated src/lib/http/schema.d.ts."
-            exit 1
-          fi
-          echo "schema.d.ts is in sync with the proxy OpenAPI spec."

.github/workflows/ci-coverage.yml

@@ -1,48 +0,0 @@
-name: "CI Coverage"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  assert-ci-coverage:
-    name: assert-ci-coverage
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Assert every test file and Dockerfile is invoked by a job
-        run: |
-          python -m pip install "pyyaml==6.0.3"
-          python .github/scripts/assert_ci_coverage.py
-
-      # The census asks whether a job names a file; this asks whether that job's -k
-      # then throws it back out. A file both globbed and deselected everywhere runs
-      # nowhere while counting as covered, which is how the caching suite went unrun.
-      - name: Assert no -k expression deselects a file from every job that globs it
-        run: python .github/scripts/assert_ci_coverage.py --slices
-
-      - name: Assert .github/workflows/ holds only workflows, correctly named
-        run: python .github/scripts/assert_workflow_dir_hygiene.py

.github/workflows/codeql.yml

@@ -1,8 +1,6 @@
 name: "CodeQL"
 
 on:
-  push:
-    branches: [main]
   pull_request:
     branches: [main]
   schedule:
@@ -43,14 +41,15 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           config-file: ./.github/codeql/codeql-config.yml
+          queries: ${{ github.event_name == 'pull_request' && '+security-extended' || '' }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/language:${{ matrix.language }}"
           output: sarif-results
@@ -83,7 +82,7 @@ jobs:
           output: sarif-results/python.sarif
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: sarif-results
           category: "/language:${{ matrix.language }}"

.github/workflows/deploy-dev-on-main.yml

@@ -0,0 +1,30 @@
+name: Deploy main to gateway-dev
+
+on:
+  push:
+    branches: [main]
+
+permissions: {}
+
+concurrency:
+  group: deploy-dev-dispatch
+  cancel-in-progress: true
+
+jobs:
+  dispatch:
+    if: github.repository == 'BerriAI/litellm'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+        id: token
+        with:
+          app-id: ${{ secrets.LITELLM_OPS_DISPATCH_APP_ID }}
+          private-key: ${{ secrets.LITELLM_OPS_DISPATCH_APP_PRIVATE_KEY }}
+          owner: BerriAI
+          repositories: litellm-ops
+          permission-actions: write
+      - name: Dispatch the litellm-ops dev deploy
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh api --method POST repos/BerriAI/litellm-ops/actions/workflows/deploy-dev.yml/dispatches -f ref=main

.github/workflows/helm_unit_test.yml

@@ -1,54 +0,0 @@
-name: Helm unit test
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  unit-test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Helm 3.11.1
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
-        with:
-          version: "3.11.1"
-
-      - name: Download and verify Helm Unit Test Plugin
-        run: |
-          curl -fsSLo "$RUNNER_TEMP/helm-unittest.tgz" https://github.com/helm-unittest/helm-unittest/releases/download/v0.8.2/helm-unittest-linux-amd64-0.8.2.tgz
-          echo "56ab3091e6fa52a7c92ee951def9bed957f295d9ce98483aed404e748d7b3a94  $RUNNER_TEMP/helm-unittest.tgz" | sha256sum -c -
-
-      - name: Install Helm Unit Test Plugin
-        run: |
-          PLUGIN_DIR="$(helm env HELM_PLUGINS)/helm-unittest"
-          mkdir -p "$PLUGIN_DIR"
-          tar -xzf "$RUNNER_TEMP/helm-unittest.tgz" -C "$PLUGIN_DIR"
-          helm plugin list
-
-      - name: Run unit tests
-        run: |
-          for chart in helm/litellm-helm helm/litellm; do
-            declared="$(grep -h '^suite:' "$chart"/tests/*.yaml | wc -l | tr -d '[:space:]')"
-            output="$(mktemp)"
-            helm unittest -f 'tests/*.yaml' "$chart" | tee "$output"
-            executed="$(sed -n 's/^Test Suites:.*[[:space:]]\([0-9][0-9]*\) total$/\1/p' "$output")"
-            if [ "$declared" != "$executed" ]; then
-              echo "::error::$chart declares $declared test suites but helm-unittest ran $executed. Suites are being skipped silently, so their assertions never execute."
-              exit 1
-            fi
-            echo "$chart: all $declared declared test suites ran"
-          done

.github/workflows/image-scan.yml

@@ -9,17 +9,25 @@ on:
     paths:
       - Dockerfile
       - docker/Dockerfile.non_root
+      - docker/Dockerfile.database
       - migrations/Dockerfile
       - migrations/run.py
       - gateway/Dockerfile
       - gateway/main.py
+      - gateway/routes/allowlist.py
       - backend/Dockerfile
       - backend/main.py
+      - litellm-rust/**
+      - litellm/proxy/lens/**
       - docker/component_entrypoint.sh
       - docker/entrypoint.sh
       - litellm/proxy/prisma_migration.py
+      - litellm/proxy/admin_mcp.py
+      - litellm/proxy/proxy_server.py
+      - backend/routes/allowlist.py
+      - pyproject.toml
       - litellm-proxy-extras/**
-      - tests/proxy_migration_tests/**
+      - tests/integration/database/image/**
       - uv.lock
       - ui/litellm-dashboard/package-lock.json
       - ui/Dockerfile
@@ -65,6 +73,9 @@ jobs:
       - name: Build runtime image
         run: docker build -f docker/Dockerfile.non_root -t litellm-image-scan:${{ github.sha }} .
 
+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f docker/Dockerfile.non_root -t litellm-admin-mcp-schema:${{ github.sha }} .
+
       # The prisma bake must migrate a fresh DB with no egress as an arbitrary
       # non-root uid (OpenShift restricted-v2 / air-gapped / readOnlyRootFilesystem).
       # `docker run` as the default uid with network hides a broken bake because
@@ -78,9 +89,10 @@ jobs:
       - name: Verify offline migration as a non-root uid
         env:
           LITELLM_IMAGE: litellm-image-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
         run: |
           python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py -v
+          python -m pytest --noconftest tests/integration/database/image/test_offline_image_migration.py tests/integration/database/image/test_image_bedrock_realtime_extra.py tests/integration/database/image/test_image_admin_mcp.py -v
 
       # Scans the whole shipped artifact: OS/apk plus every language package
       # baked into the image, including ones no lockfile declares (e.g. prisma's
@@ -99,21 +111,28 @@ jobs:
             --output table
 
   runtime-image:
-    name: runtime-image
+    name: runtime-image (${{ matrix.dockerfile }})
     runs-on: ubuntu-latest
     if: >-
       github.event_name != 'pull_request' ||
       github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 30
+    timeout-minutes: 45
     permissions:
       contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        dockerfile: [Dockerfile, docker/Dockerfile.database]
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
 
       - name: Build runtime image
-        run: docker build -f Dockerfile -t litellm-runtime-scan:${{ github.sha }} .
+        run: docker build --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci -f "${{ matrix.dockerfile }}" -t litellm-runtime-scan:${{ github.sha }} .
+
+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f "${{ matrix.dockerfile }}" -t litellm-admin-mcp-schema:${{ github.sha }} .
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
@@ -123,9 +142,11 @@ jobs:
       - name: Verify offline migration as a non-root uid
         env:
           LITELLM_IMAGE: litellm-runtime-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
         run: |
           python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py -v
+          python -m pytest --noconftest tests/integration/database/image/test_offline_image_migration.py tests/integration/database/image/test_image_bedrock_realtime_extra.py tests/integration/database/image/test_image_admin_mcp.py -v
+
 
   migrations-image:
     name: migrations-image
@@ -156,7 +177,7 @@ jobs:
           LITELLM_MIGRATION_SCRIPT: /app/run.py
         run: |
           python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v
+          python -m pytest --noconftest tests/integration/database/image/test_offline_image_migration.py -v
 
   gateway-image:
     name: gateway-image
@@ -184,9 +205,10 @@ jobs:
         env:
           LITELLM_IMAGE: litellm-gateway-scan:${{ github.sha }}
           LITELLM_COMPONENT_PORT: "4000"
+          LITELLM_IMAGE_COMPONENT: gateway
         run: |
           python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py -v
+          python -m pytest --noconftest tests/integration/database/image/test_component_image_serves_offline.py tests/integration/database/image/test_image_bedrock_realtime_extra.py tests/integration/database/image/test_image_admin_mcp.py -v
 
   ui-image:
     name: ui-image
@@ -215,7 +237,7 @@ jobs:
           LITELLM_IMAGE: litellm-ui-scan:${{ github.sha }}
         run: |
           python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_ui_image_serves_offline.py -v
+          python -m pytest --noconftest tests/integration/database/image/test_ui_image_serves_offline.py -v
 
   backend-image:
     name: backend-image
@@ -234,6 +256,9 @@ jobs:
       - name: Build backend image
         run: docker build -f backend/Dockerfile -t litellm-backend-scan:${{ github.sha }} .
 
+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f backend/Dockerfile -t litellm-admin-mcp-schema:${{ github.sha }} .
+
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
@@ -242,7 +267,9 @@ jobs:
       - name: Verify the backend serves offline as a non-root uid
         env:
           LITELLM_IMAGE: litellm-backend-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
           LITELLM_COMPONENT_PORT: "4001"
+          LITELLM_IMAGE_COMPONENT: backend
         run: |
           python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py -v
+          python -m pytest --noconftest tests/integration/database/image/test_component_image_serves_offline.py tests/integration/database/image/test_image_admin_mcp.py -v

.github/workflows/lens-install-smoke.yml

@@ -0,0 +1,152 @@
+name: Lens installation smoke
+
+on:
+  workflow_dispatch:
+    inputs:
+      lens_image:
+        description: Verified baseline Lens image at ghcr.io/berriai/lens@sha256
+        required: true
+        type: string
+      lens_upgrade_image:
+        description: Compatible Lens upgrade image at ghcr.io/berriai/lens@sha256
+        required: true
+        type: string
+      gateway_baseline_ref:
+        description: Previously qualified gateway source commit, full SHA
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lens-install-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-images:
+    runs-on: ubuntu-latest-16-cores
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - component: gateway
+            dockerfile: gateway/Dockerfile
+          - component: backend
+            dockerfile: backend/Dockerfile
+          - component: ui
+            dockerfile: ui/Dockerfile
+          - component: migrations
+            dockerfile: migrations/Dockerfile
+          - component: monolith
+            dockerfile: Dockerfile
+          - component: gateway
+            dockerfile: gateway/Dockerfile
+            baseline: true
+          - component: backend
+            dockerfile: backend/Dockerfile
+            baseline: true
+          - component: monolith
+            dockerfile: Dockerfile
+            baseline: true
+    env:
+      COMPONENT: ${{ matrix.component }}
+      DOCKERFILE: ${{ matrix.dockerfile }}
+      SOURCE_REF: ${{ matrix.baseline && inputs.gateway_baseline_ref || github.sha }}
+      IMAGE_TAG: ${{ matrix.baseline && 'v0.0.0-lens-ci-baseline' || 'v0.0.0-lens-ci' }}
+      CURRENT_REF: ${{ github.sha }}
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+          ref: ${{ env.SOURCE_REF }}
+      - name: Verify the selected source
+        shell: bash -euo pipefail {0}
+        run: |
+          [[ "$SOURCE_REF" =~ ^[0-9a-f]{40}$ ]]
+          test "$(git rev-parse HEAD)" = "$SOURCE_REF"
+          if [[ "$IMAGE_TAG" == v0.0.0-lens-ci-baseline ]]; then
+            test "$SOURCE_REF" != "$CURRENT_REF"
+          fi
+      - name: Build the matching release image
+        run: |
+          docker build --build-arg "LITELLM_RELEASE_TAG=$IMAGE_TAG" \
+            -f "$DOCKERFILE" -t "lens-ci-$COMPONENT:$IMAGE_TAG" .
+      - name: Save the matching release image
+        run: |
+          docker save "lens-ci-$COMPONENT:$IMAGE_TAG" \
+            | gzip -1 > "$RUNNER_TEMP/lens-install-$COMPONENT-$IMAGE_TAG.tar.gz"
+      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: lens-install-${{ matrix.component }}-${{ env.IMAGE_TAG }}-${{ github.sha }}
+          path: ${{ runner.temp }}/lens-install-${{ matrix.component }}-${{ env.IMAGE_TAG }}.tar.gz
+          compression-level: 0
+          retention-days: 3
+          if-no-files-found: error
+          overwrite: true
+
+  helm-install:
+    needs: build-images
+    runs-on: ubuntu-latest-16-cores
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: lens-install-*-${{ github.sha }}
+          merge-multiple: true
+          path: ${{ runner.temp }}/lens-install-images
+      - name: Load the matching release images
+        run: |
+          for archive in "$RUNNER_TEMP"/lens-install-images/lens-install-*.tar.gz; do
+            gzip -dc "$archive" | docker load
+            rm "$archive"
+          done
+      - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+        with:
+          cosign-release: v2.4.3
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ vars.LENS_READ_USER || github.actor }}
+          password: ${{ secrets.LENS_READ_TOKEN }}
+      - name: Verify independent Lens images before loading them
+        env:
+          LENS_IMAGE: ${{ inputs.lens_image }}
+          LENS_UPGRADE_IMAGE: ${{ inputs.lens_upgrade_image }}
+          LENS_PUBLIC_KEY: ${{ vars.LENS_COSIGN_PUBLIC_KEY }}
+          LENS_PUBLIC_KEY_SHA256: ${{ vars.LENS_COSIGN_PUBLIC_KEY_SHA256 }}
+        shell: bash -euo pipefail {0}
+        run: |
+          [[ "$LENS_PUBLIC_KEY_SHA256" =~ ^[0-9a-f]{64}$ ]]
+          printf '%s' "$LENS_PUBLIC_KEY" > "$RUNNER_TEMP/lens.pub"
+          echo "$LENS_PUBLIC_KEY_SHA256  $RUNNER_TEMP/lens.pub" | sha256sum --check
+          for image in "$LENS_IMAGE" "$LENS_UPGRADE_IMAGE"; do
+            [[ "$image" =~ ^ghcr.io/berriai/lens@sha256:[0-9a-f]{64}$ ]]
+            cosign verify --key "$RUNNER_TEMP/lens.pub" "$image" > /dev/null
+            cosign verify-attestation --key "$RUNNER_TEMP/lens.pub" --type spdxjson "$image" > /dev/null
+            docker pull "$image"
+          done
+          docker tag "$LENS_IMAGE" lens-ci-worker:baseline
+          docker tag "$LENS_UPGRADE_IMAGE" lens-ci-worker:upgrade
+      - name: Install pinned Kubernetes test tools
+        run: |
+          curl --fail --location --output "$RUNNER_TEMP/kind" \
+            https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
+          echo "a6875aaea358acf0ac07786b1a6755d08fd640f4c79b7a2e46681cc13f49a04b  $RUNNER_TEMP/kind" | sha256sum --check
+          chmod +x "$RUNNER_TEMP/kind"
+          curl --fail --location --output "$RUNNER_TEMP/kubectl" \
+            https://dl.k8s.io/release/v1.32.2/bin/linux/amd64/kubectl
+          echo "4f6a959dcc5b702135f8354cc7109b542a2933c46b808b248a214c1f69f817ea  $RUNNER_TEMP/kubectl" | sha256sum --check
+          chmod +x "$RUNNER_TEMP/kubectl"
+          curl --fail --location --output "$RUNNER_TEMP/helm.tar.gz" \
+            https://get.helm.sh/helm-v3.19.0-linux-amd64.tar.gz
+          echo "a7f81ce08007091b86d8bd696eb4d86b8d0f2e1b9f6c714be62f82f96a594496  $RUNNER_TEMP/helm.tar.gz" | sha256sum --check
+          tar -xzf "$RUNNER_TEMP/helm.tar.gz" -C "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+          echo "$RUNNER_TEMP/linux-amd64" >> "$GITHUB_PATH"
+      - name: Install, ingest, upgrade, and restart both charts
+        run: bash tests/e2e/migrations/lens_helm_smoke.sh

.github/workflows/lens-worker.yml

@@ -1,66 +0,0 @@
-name: Lens Worker Image
-
-on:
-  pull_request:
-    branches: [main, litellm_oss_branch, "litellm_**"]
-    paths:
-      - deploy/lens/**
-      - litellm/proxy/lens/**
-      - .github/workflows/lens-worker.yml
-  push:
-    branches: [main]
-    paths:
-      - deploy/lens/**
-      - litellm/proxy/lens/**
-      - .github/workflows/lens-worker.yml
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  lens-worker-image:
-    permissions:
-      contents: read
-      packages: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-      - name: Build Lens worker
-        run: docker build -f deploy/lens/Dockerfile -t lens-worker:${{ github.sha }} .
-      - name: Verify standalone imports with a read-only filesystem
-        run: |
-          docker run --rm --network none --read-only --cap-drop ALL --tmpfs /tmp:rw,noexec,nosuid,size=1g \
-            --security-opt no-new-privileges --entrypoint python \
-            lens-worker:${{ github.sha }} -c '
-          import os
-          import lens.worker
-          from lens.trace_store import trace_store
-          assert os.getuid() == 65532
-          with trace_store() as store:
-              assert store.count() == 0
-          '
-      - name: Verify recovery after temporary storage fills
-        run: |
-          docker run --rm --network none --read-only --cap-drop ALL \
-            --tmpfs /tmp:rw,noexec,nosuid,size=64k --security-opt no-new-privileges \
-            -v "$PWD/tests/proxy_behavior/lens/worker_storage_smoke.py:/app/storage_smoke.py:ro" \
-            --entrypoint python lens-worker:${{ github.sha }} /app/storage_smoke.py
-      - name: Publish versioned Lens worker
-        if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm'
-        env:
-          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REGISTRY_USER: ${{ github.actor }}
-          IMAGE: ghcr.io/berriai/litellm-lens-worker:sha-${{ github.sha }}
-        run: |
-          printf '%s' "$REGISTRY_TOKEN" | docker login ghcr.io -u "$REGISTRY_USER" --password-stdin
-          docker tag lens-worker:${{ github.sha }} "$IMAGE"
-          docker push "$IMAGE"
-          printf 'Lens worker image: `%s`\n' "$IMAGE" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/publish-basedpyright-base-counts.yml

@@ -1,65 +0,0 @@
-name: Publish basedpyright base counts
-
-# Every commit on main can become a future merge-base.
-# Publishing its per-rule basedpyright counts as an artifact lets
-# scripts/type_check_gate.py download them in seconds instead of paying a
-# 60-110s second basedpyright pass on every fresh worktree or moved merge-base.
-# No concurrency group on purpose: runs must never cancel each other, because
-# every sha's artifact matters (any of them can become a merge-base).
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "Ref to compute and publish base counts for (defaults to the workflow run's commit)"
-        required: false
-
-permissions:
-  contents: read
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          ref: ${{ inputs.ref || github.sha }}
-          clean: true
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Cache Prisma binaries
-        uses: ./.github/actions/cache-prisma-binaries
-
-      # The gate provisions its own measurement env (.venv-typecheck: a frozen
-      # uv sync of its canonical dependency groups plus a generated Prisma
-      # client), so no install step here can drift from what local runs measure.
-      - name: Emit basedpyright counts for HEAD
-        run: |
-          python scripts/type_check_gate.py --emit-counts-dir "$RUNNER_TEMP/basedpyright-counts"
-          counts_file=$(ls "$RUNNER_TEMP"/basedpyright-counts/basedpyright-counts-*.json)
-          echo "COUNTS_ARTIFACT_NAME=$(basename "$counts_file" .json)" >> "$GITHUB_ENV"
-
-      - name: Upload counts artifact
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: ${{ env.COUNTS_ARTIFACT_NAME }}
-          path: ${{ runner.temp }}/basedpyright-counts/
-          if-no-files-found: error

.github/workflows/publish-lint-base-counts.yml

@@ -0,0 +1,106 @@
+name: Publish lint base counts
+
+# Every commit on main can become a future merge-base.
+# Publishing its per-rule counts for each lint gate (strict ruff, type discipline,
+# test quality, basedpyright) as an artifact lets the gates download them through
+# scripts/lint_base_counts.py in seconds instead of scanning the merge-base tree in
+# a throwaway worktree on every fresh checkout or moved merge-base.
+# No concurrency group on purpose: runs must never cancel each other, because
+# every sha's artifact matters (any of them can become a merge-base).
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Ref to compute and publish base counts for (defaults to the workflow run's commit)"
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - checker: ruff-strict
+            script: scripts/ruff_strict_gate.py
+          - checker: type-discipline
+            script: scripts/type_discipline_gate.py
+          - checker: test-quality
+            script: scripts/test_quality_gate.py
+          - checker: openapi-docs
+            script: scripts/openapi_docs_gate.py
+          - checker: basedpyright
+            script: scripts/type_check_gate.py
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          clean: true
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Cache the Rust build
+        if: matrix.checker == 'basedpyright'
+        uses: ./.github/actions/cache-cargo-build
+
+      - name: Cache Prisma binaries
+        if: matrix.checker == 'basedpyright' || matrix.checker == 'openapi-docs'
+        uses: ./.github/actions/cache-prisma-binaries
+
+      # The source scanners only need the pinned dev tools (ruff and the
+      # stdlib checkers), the same versions test-linting.yml's python job runs.
+      - name: Install the dev tools
+        if: matrix.checker != 'basedpyright' && matrix.checker != 'openapi-docs'
+        run: |
+          uv sync --frozen --only-group dev --no-install-project
+
+      # The OpenAPI gate imports the proxy app, so it needs the same install the
+      # test-linting.yml python job uses, Prisma client included.
+      - name: Install the proxy
+        if: matrix.checker == 'openapi-docs'
+        run: |
+          uv sync --frozen --group proxy-dev --group e2e-dev --extra proxy
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Emit ${{ matrix.checker }} counts for HEAD
+        if: matrix.checker != 'basedpyright'
+        run: |
+          uv run --no-sync python ${{ matrix.script }} --emit-counts-dir "$RUNNER_TEMP/lint-counts"
+
+      # The basedpyright gate provisions its own measurement env (.venv-typecheck:
+      # a frozen uv sync of its canonical dependency groups plus a generated Prisma
+      # client), so no install step here can drift from what local runs measure.
+      - name: Emit basedpyright counts for HEAD
+        if: matrix.checker == 'basedpyright'
+        run: |
+          python scripts/type_check_gate.py --emit-counts-dir "$RUNNER_TEMP/lint-counts"
+
+      - name: Name the counts artifact
+        run: |
+          counts_file=$(ls "$RUNNER_TEMP"/lint-counts/${{ matrix.checker }}-counts-*.json)
+          echo "COUNTS_ARTIFACT_NAME=$(basename "$counts_file" .json)" >> "$GITHUB_ENV"
+
+      - name: Upload counts artifact
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: ${{ env.COUNTS_ARTIFACT_NAME }}
+          path: ${{ runner.temp }}/lint-counts/
+          if-no-files-found: error

.github/workflows/test-code-quality.yml

@@ -1,212 +0,0 @@
-name: Code Quality Checks
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  code-quality:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Checkout litellm-docs into docs/my-website (for documentation_tests)
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          repository: BerriAI/litellm-docs
-          path: docs/my-website
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        if: github.ref == 'refs/heads/main'
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-
-
-      - name: Cache uv dependencies
-        if: github.ref != 'refs/heads/main'
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        run: uv sync --frozen --all-groups --all-extras
-
-      - name: check_licenses
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_licenses.py
-
-      - name: check_provider_folders_documented
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_provider_folders_documented.py
-
-      - name: check_prisma_binary_cache
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_prisma_binary_cache.py
-
-      - name: check_workflow_startup_safety
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_workflow_startup_safety.py
-
-      - name: check_workflow_job_name_collisions
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_workflow_job_name_collisions.py
-
-      - name: test_workflow_job_name_collisions
-        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_workflow_job_name_collisions.py
-
-      - name: test_e2e_changed_gate
-        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_changed_gate.py tests/code_coverage_tests/test_e2e_idp_stack.py
-
-      - name: test_e2e_metadata
-        env:
-          PYTHONPATH: tests/e2e
-        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_metadata.py tests/code_coverage_tests/test_e2e_junit_report.py
-
-      - name: Check merge smoke harness
-        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_merge_smoke.py
-
-      - name: router_code_coverage
-        run: uv run --no-sync python ./tests/code_coverage_tests/router_code_coverage.py
-
-      - name: test_chat_completion_imports
-        run: uv run --no-sync python ./tests/code_coverage_tests/test_chat_completion_imports.py
-
-      - name: info_log_check
-        run: uv run --no-sync python ./tests/code_coverage_tests/info_log_check.py
-
-      - name: check_guardrail_apply_decorator
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_guardrail_apply_decorator.py
-
-      - name: test_ban_set_verbose
-        run: uv run --no-sync python ./tests/code_coverage_tests/test_ban_set_verbose.py
-
-      - name: code_qa_check_tests
-        run: uv run --no-sync python ./tests/code_coverage_tests/code_qa_check_tests.py
-
-      - name: check_get_model_cost_key_performance
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_get_model_cost_key_performance.py
-
-      - name: test_proxy_types_import
-        run: uv run --no-sync python ./tests/code_coverage_tests/test_proxy_types_import.py
-
-      - name: callback_manager_test
-        run: uv run --no-sync python ./tests/code_coverage_tests/callback_manager_test.py
-
-      - name: recursive_detector
-        run: uv run --no-sync python ./tests/code_coverage_tests/recursive_detector.py
-
-      - name: test_router_strategy_async
-        run: uv run --no-sync python ./tests/code_coverage_tests/test_router_strategy_async.py
-
-      - name: litellm_logging_code_coverage
-        run: uv run --no-sync python ./tests/code_coverage_tests/litellm_logging_code_coverage.py
-
-      - name: ensure_async_clients_test
-        run: uv run --no-sync python ./tests/code_coverage_tests/ensure_async_clients_test.py
-
-      - name: enforce_llms_folder_style
-        run: uv run --no-sync python ./tests/code_coverage_tests/enforce_llms_folder_style.py
-
-      - name: prevent_key_leaks_in_exceptions
-        run: uv run --no-sync python ./tests/code_coverage_tests/prevent_key_leaks_in_exceptions.py
-
-      - name: check_unsafe_enterprise_import
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_unsafe_enterprise_import.py
-
-      - name: ban_copy_deepcopy_kwargs
-        run: uv run --no-sync python ./tests/code_coverage_tests/ban_copy_deepcopy_kwargs.py
-
-      - name: check_fastuuid_usage
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_fastuuid_usage.py
-
-      - name: check_py310_typing_imports
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_py310_typing_imports.py
-
-      - name: check_e2e_no_raw_requests
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_e2e_no_raw_requests.py
-
-      - name: check_migrations_no_data_rewrites
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_migrations_no_data_rewrites.py
-
-      - name: check_unbounded_in_lists (fails on findings not in the baseline)
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_unbounded_in_lists.py
-
-      - name: memory_test
-        run: uv run --no-sync python ./tests/code_coverage_tests/memory_test.py
-
-      - name: documentation_test_env_keys
-        run: uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
-
-      - name: documentation_test_router_settings
-        run: uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
-
-      - name: documentation_test_api_docs
-        run: uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
-
-  python-310-import-smoke:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.10"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Install dependencies
-        run: uv sync --frozen --extra proxy --extra cli --python 3.10
-
-      - run: uv run --no-sync python --version
-
-      - name: Import litellm
-        run: uv run --no-sync python -c "import litellm"
-
-      - name: Check litellm CLI
-        run: uv run --no-sync litellm --version
-
-      - name: Check lite CLI
-        run: uv run --no-sync lite version

.github/workflows/test-e2e-changed.yml

@@ -1,265 +0,0 @@
-name: e2e-changed-tests
-
-on:
-  pull_request:
-
-concurrency:
-  group: e2e-changed-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  detect:
-    name: Detect changed e2e tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      tests: ${{ steps.changed.outputs.tests }}
-      any: ${{ steps.changed.outputs.any }}
-    steps:
-      - name: Checkout the selector and the canary suite
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          sparse-checkout: |
-            .github/e2e-stack
-            tests/e2e/access_control
-            tests/e2e/management/test_jwt_management_e2e.py
-            tests/e2e/other/test_jwt_auth_e2e.py
-          persist-credentials: false
-          ref: ${{ github.sha }}
-
-      - name: List the e2e test files this PR added or modified
-        id: changed
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          gh api "repos/${REPO}/pulls/${PR_NUMBER}" \
-            --jq 'select(.head.sha == env.HEAD_SHA and .changed_files < 3000) | .head.sha' \
-            | grep -Fxq "${HEAD_SHA}"
-          files="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/files" --paginate \
-            --jq '.[] | select(.status != "removed") | .filename')"
-          gh api "repos/${REPO}/pulls/${PR_NUMBER}" --jq '.head.sha' | grep -Fxq "${HEAD_SHA}"
-          tests="$(printf '%s\n' "${files}" \
-            | python3 .github/e2e-stack/select_tests.py tests/e2e/access_control/test_*.py \
-                tests/e2e/management/test_jwt_management_e2e.py tests/e2e/other/test_jwt_auth_e2e.py)"
-          echo "tests=${tests}" >> "${GITHUB_OUTPUT}"
-          if [ -n "${tests}" ]; then
-            echo "any=true" >> "${GITHUB_OUTPUT}"
-            echo "selected e2e tests: ${tests}"
-          else
-            echo "any=false" >> "${GITHUB_OUTPUT}"
-            echo "no changed e2e test files supported by this stack; nothing to run"
-          fi
-
-  run:
-    name: Run changed e2e tests against the stage-mirror stack
-    needs: detect
-    if: needs.detect.outputs.any == 'true' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    timeout-minutes: 90
-    environment: e2e-changed
-    permissions:
-      contents: read
-      id-token: write
-    services:
-      postgres:
-        image: postgres:16.6
-        env:
-          POSTGRES_USER: litellm
-          POSTGRES_PASSWORD: dbpassword9090
-          POSTGRES_DB: litellm
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U litellm"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-      jaeger:
-        image: jaegertracing/jaeger:2.10.0
-        ports:
-          - 4318:4318
-          - 16686:16686
-    steps:
-      - name: Validate configuration
-        env:
-          ROLE: ${{ vars.E2E_AWS_ROLE_TO_ASSUME }}
-        run: test -n "${ROLE}" || { echo "::error::Set repo variable E2E_AWS_ROLE_TO_ASSUME to an OIDC role with read access to the e2e secrets"; exit 1; }
-
-      - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-          ref: ${{ github.sha }}
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.13"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen \
-            --extra proxy --extra proxy-runtime --extra extra_proxy \
-            --extra semantic-router --extra bedrock-realtime \
-            --group ci --group proxy-dev --group e2e-dev
-          uv pip install "pipecat-ai[openai]==1.4.0"
-
-      - name: Cache Prisma binaries
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        run: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Install Playwright chromium
-        run: uv run --no-sync playwright install --with-deps chromium
-
-      - name: Configure AWS credentials
-        id: aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
-        with:
-          role-to-assume: ${{ vars.E2E_AWS_ROLE_TO_ASSUME }}
-          aws-region: us-east-1
-          role-session-name: litellm-e2e-changed-${{ github.run_id }}
-          role-duration-seconds: 900
-          output-env-credentials: false
-          output-credentials: true
-
-      - name: Fetch provider credentials from AWS Secrets Manager
-        env:
-          AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
-          AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
-          AWS_SESSION_TOKEN: ${{ steps.aws.outputs.aws-session-token }}
-          AWS_DEFAULT_REGION: us-east-1
-        run: |
-          umask 077
-          aws secretsmanager get-secret-value --secret-id litellm-e2e-changed-provider-keys \
-            --query SecretString --output text \
-            | uv run --no-sync python .github/e2e-stack/secrets_to_env.py tests/e2e/.env
-          aws secretsmanager get-secret-value --secret-id litellm-e2e-changed-license \
-            --query SecretString --output text \
-            | jq -R -s '{"LITELLM_LICENSE": .}' \
-            | uv run --no-sync python .github/e2e-stack/secrets_to_env.py tests/e2e/.env
-
-      - name: Boot the stage-mirror stack
-        id: boot
-        run: |
-          umask 077
-          if ! bash .github/e2e-stack/up.sh > "${RUNNER_TEMP}/e2e-boot.log" 2>&1; then
-            echo "::error::stage-mirror stack failed to boot; raw logs are not published"
-            exit 1
-          fi
-
-      - name: Export stack environment
-        run: |
-          master_key="$(grep '^LITELLM_MASTER_KEY=' "${RUNNER_TEMP}/litellm-e2e-stack/stack.env" | cut -d= -f2-)"
-          echo "::add-mask::${master_key}"
-          cat "${RUNNER_TEMP}/litellm-e2e-stack/stack.env" >> "${GITHUB_ENV}"
-
-      - name: Run the selected tests three times
-        env:
-          TESTS: ${{ needs.detect.outputs.tests }}
-          E2E_FIXTURE_MODE: live
-          E2E_PROVIDER_EDGE_HOST_REACHABLE: '1'
-          E2E_OWNED_GATEWAY: '1'
-          COLUMNS: '400'
-        run: |
-          umask 077
-          read -r -a test_files <<< "${TESTS}"
-          for pass in 1 2 3; do
-            report="${RUNNER_TEMP}/e2e-pass-${pass}.xml"
-            log="${RUNNER_TEMP}/e2e-pass-${pass}.log"
-            echo "::group::pass ${pass} of 3"
-            set +e
-            uv run --no-sync pytest "${test_files[@]}" --rootdir=. -v --reruns 0 -p no:cacheprovider \
-              -o junit_family=xunit1 --junitxml="${report}" > "${log}" 2>&1
-            status=$?
-            uv run --no-sync python .github/e2e-stack/assert_tests_ran.py "${report}" "${test_files[@]}"
-            verified=$?
-            set -e
-            grep -E '^(FAILED|ERROR) ' "${log}" || true
-            grep -E '^=+ .* in [0-9.]+s( \([0-9:]+\))? =+$' "${log}" | tail -n 1
-            echo "::endgroup::"
-            if [ "${status}" = "5" ]; then
-              echo "::error::the selected files collected no runnable tests, so nothing was verified"
-              exit 1
-            fi
-            if [ "${status}" != "0" ]; then
-              echo "::error::pass ${pass} of 3 failed with exit code ${status}"
-              exit "${status}"
-            fi
-            if [ "${verified}" != "0" ]; then
-              echo "::error::pass ${pass} of 3 did not verify every selected file"
-              exit 1
-            fi
-            echo "pass ${pass} of 3 passed"
-          done
-
-      - name: Redact the pytest output
-        if: always() && steps.boot.outcome == 'success'
-        run: |
-          umask 077
-          shopt -s nullglob
-          uv run --no-sync python .github/e2e-stack/redact_output.py \
-            --values tests/e2e/.env --values "${RUNNER_TEMP}/litellm-e2e-stack/stack.env" \
-            --out "${RUNNER_TEMP}/e2e-redacted" "${RUNNER_TEMP}"/e2e-pass-*.log "${RUNNER_TEMP}"/e2e-pass-*.xml
-
-      - name: Keep the redacted pytest output
-        if: always() && steps.boot.outcome == 'success'
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: e2e-changed-pytest-output-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/e2e-redacted
-          retention-days: 14
-          if-no-files-found: ignore
-
-      - name: Stop the stack
-        if: always() && steps.boot.outcome != 'skipped'
-        run: bash .github/e2e-stack/down.sh
-
-      - name: Remove credentials and raw output
-        if: always()
-        run: |
-          rm -f tests/e2e/.env "${RUNNER_TEMP}/e2e-boot.log" "${RUNNER_TEMP}"/e2e-pass-*.log "${RUNNER_TEMP}"/e2e-pass-*.xml
-          rm -rf "${RUNNER_TEMP}/litellm-e2e-stack" "${RUNNER_TEMP}/e2e-redacted"
-
-  gate:
-    name: e2e-changed-tests
-    needs: [detect, run]
-    if: always()
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Require three successful passes when tests changed
-        env:
-          DETECT_RESULT: ${{ needs.detect.result }}
-          ANY_TESTS: ${{ needs.detect.outputs.any }}
-          RUN_RESULT: ${{ needs.run.result }}
-        run: |
-          if [ "${DETECT_RESULT}" != "success" ]; then
-            echo "::error::changed-test detection did not succeed"
-            exit 1
-          fi
-          if [ "${ANY_TESTS}" = "false" ]; then
-            echo "no changed e2e test files supported by this stack; nothing to run"
-            exit 0
-          fi
-          if [ "${ANY_TESTS}" != "true" ] || [ "${RUN_RESULT}" != "success" ]; then
-            echo "::error::selected e2e tests require an approved, successful run; fork PRs must run from a reviewed same-repository branch"
-            exit 1
-          fi

.github/workflows/test-e2e-redis-chaos.yml

@@ -91,12 +91,12 @@ jobs:
 
       - name: Run the Redis chaos load test
         env:
-          E2E_REDIS_CHAOS: "1"
+          E2E_PERF_TESTS: "1"
           LITELLM_PROXY_URL: http://localhost:4000
           REDIS_HOST: 127.0.0.1
           REDIS_PORT: "6379"
         run: |
-          uv run --no-sync pytest tests/e2e/load/test_redis_chaos_e2e.py -v --tb=short -rA -s
+          uv run --no-sync pytest tests/e2e/perf/test_redis_chaos_e2e.py -v --tb=short -rA -s
 
       - name: Show proxy log on failure
         if: failure()

.github/workflows/test-linting.yml

@@ -1,4 +1,4 @@
-name: LiteLLM Linting
+name: lint
 
 on:
   pull_request:
@@ -14,22 +14,26 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    # actions: read lets scripts/type_check_gate.py download the base-counts
-    # artifact published by publish-basedpyright-base-counts.yml instead of
-    # re-running basedpyright over the merge-base tree.
+  python:
+    name: python
     permissions:
       contents: read
       pull-requests: read
       actions: read
-
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    services:
+      redis:
+        image: redis@sha256:e2debfb7956fa12c7ddc79d7e645c8cf26b30c99a6e9161ea9bf4171e1668a5f
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        # Check out the PR head, not the default refs/pull/N/merge: the merge ref
-        # folds in newer base commits, which the diff-based gates (ruff delta,
-        # Any-discipline) would otherwise blame on this branch.
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
@@ -100,9 +104,6 @@ jobs:
         if: steps.changes.outputs.decision != 'skip'
         uses: ./.github/actions/cache-prisma-binaries
 
-      # basedpyright resolves Prisma's generated client (litellm/proxy/schema.prisma)
-      # only after `prisma generate` writes prisma/client.py et al. Without this the
-      # DB wrappers typed against the generated client would degrade to Unknown.
       - name: Generate Prisma client
         if: steps.changes.outputs.decision != 'skip'
         run: |
@@ -144,27 +145,41 @@ jobs:
         run: |
           uv run --no-sync ruff check --config ruff-tests.toml tests
 
-      - name: Check strict-rule budget (delta vs base)
+      - name: Check strict ruff rules (delta vs merge-base counts)
         if: steps.changes.outputs.decision != 'skip'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           uv run --no-sync python scripts/ruff_strict_gate.py --base "$GATE_BASE_SHA"
 
-      - name: Check type-discipline budget (mutable collections / casts / type guards / kwargs / unexplained suppressions, delta vs base)
+      - name: Check type discipline (mutable collections / casts / type guards / kwargs / unexplained suppressions, delta vs merge-base counts)
         if: steps.changes.outputs.decision != 'skip'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           uv run --no-sync python scripts/type_discipline_gate.py --base "$GATE_BASE_SHA"
 
-      - name: Check test-quality budget (zero-assert / mock-echo tests, sys.path.insert, raw env writes, litellm global mutation, credential-gated skips, conftest snapshot inventory, delta vs base)
+      - name: Check test quality (zero-assert / mock-echo tests, sys.path.insert, raw env writes, litellm global mutation, credential-gated skips, conftest snapshot inventory, delta vs merge-base counts)
         if: steps.changes.outputs.decision != 'skip'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           uv run --no-sync python scripts/test_quality_gate.py --base "$GATE_BASE_SHA"
 
+      - name: Check OpenAPI docs (POST routes without a request schema, description or 200 schema, delta vs merge-base counts)
+        if: steps.changes.outputs.decision != 'skip'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          uv sync --frozen --group proxy-dev --group e2e-dev --extra proxy
+          uv run --no-sync python scripts/openapi_docs_gate.py --base "$GATE_BASE_SHA"
+
       - name: Print OpenAI version
         if: steps.changes.outputs.decision != 'skip'
         run: |
           uv run --no-sync python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
 
-      - name: Check basedpyright budget (delta vs base)
+      - name: Check basedpyright (delta vs merge-base counts)
         if: steps.changes.outputs.decision != 'skip'
         env:
           GH_TOKEN: ${{ github.token }}
@@ -174,23 +189,29 @@ jobs:
       - name: Check tests/e2e basedpyright (zero errors)
         if: steps.changes.outputs.decision != 'skip'
         run: |
-          if git diff --name-only --diff-filter=ACMRD "$GATE_BASE_SHA" HEAD -- ':(glob)tests/e2e/**/*.py' | grep -q .; then
-            uv run --no-sync basedpyright tests/e2e
+          if git diff --name-only --diff-filter=ACMRD "$GATE_BASE_SHA" HEAD -- ':(glob)tests/e2e/**/*.py' ':(glob)tests/e2e_harness/**/*.py' pyrightconfig.json | grep -q .; then
+            uv run --no-sync basedpyright tests/e2e tests/e2e_harness
           else
             echo "No changed tests/e2e Python files; skipping."
           fi
 
-      - name: Run the claude_code harness unit tests
+      - name: Run the e2e harness tests
         if: steps.changes.outputs.decision != 'skip'
+        env:
+          LITELLM_MASTER_KEY: sk-e2e-harness-tests-reach-no-proxy
+          E2E_CACHE_TEST_REDIS_URL: redis://127.0.0.1:6379/0
         run: |
-          if ! git diff --name-only --diff-filter=ACMRD "$GATE_BASE_SHA" HEAD -- ':(glob)tests/e2e/claude_code/**/*.py' ':(glob)tests/e2e/*.py' tests/e2e/claude_code/cron_vm/install_claude_code.sh pyproject.toml uv.lock .github/workflows/test-linting.yml | grep -q .; then
-            echo "No changed claude_code harness files; skipping."
+          if ! git diff --name-only --diff-filter=ACMRD "$GATE_BASE_SHA" HEAD -- tests/e2e tests/e2e_harness ':(exclude)tests/e2e/ui' tests/code_coverage_tests/test_provider_replay_harness.py tests/code_coverage_tests/test_provider_cache.py pyproject.toml uv.lock .github/workflows/test-linting.yml | grep -q .; then
+            echo "No changed e2e harness files; skipping."
             exit 0
           fi
           retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
           CLAUDE_VERSION="$(retry uv run --no-sync python tests/e2e/claude_code/pr_gate_version_resolver.py)"
           tests/e2e/claude_code/cron_vm/install_claude_code.sh "$CLAUDE_VERSION" "$RUNNER_TEMP/claude-cli"
-          PATH="$RUNNER_TEMP/claude-cli:$PATH" uv run --no-sync pytest -q --noconftest -o addopts= -o pythonpath=tests/e2e -p no:rerunfailures tests/e2e/claude_code/_*_unit_tests
+          PATH="$RUNNER_TEMP/claude-cli:$PATH" uv run --no-sync pytest -q tests/e2e_harness
+          uv run --no-sync pytest --tb=short -q --noconftest -o addopts= -o "pythonpath=tests/e2e tests/e2e_harness" -p no:rerunfailures \
+            tests/code_coverage_tests/test_provider_replay_harness.py \
+            tests/code_coverage_tests/test_provider_cache.py
 
       - name: Check for circular imports
         if: steps.changes.outputs.decision != 'skip'
@@ -203,47 +224,11 @@ jobs:
         if: steps.changes.outputs.decision != 'skip'
         run: |
           uv run --no-sync python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
-
-  # Intentionally NON-GATING. This job turns red when a *-budget.json ceiling is
-  # raised (or a rule/budget is dropped) so a loosening is obvious in review, but it
-  # must be kept OUT of the branch-protection required-checks list so a justified
-  # bump can still be merged by a human who has seen and accepted the red.
-  budget-ratchet:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Fetch ratchet base
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
-          retry git fetch --no-tags --depth=1 origin "$BASE_SHA"
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Ratchet check (budgets may only decrease; non-gating)
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          python scripts/budget_ratchet_check.py --base "$BASE_SHA"
-
   secret-scan:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
     permissions:
       contents: read
-
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
@@ -275,3 +260,441 @@ jobs:
           else
             echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
           fi
+  ui:
+    name: ui
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 8
+    defaults:
+      run:
+        working-directory: ui/litellm-dashboard
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Collect changed files
+        id: changed
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          # base.sha is the base branch tip from when the PR was opened, while
+          # actions/checkout leaves HEAD on a merge of the PR into the *current*
+          # base tip. "$BASE_SHA"...HEAD therefore spans every base-branch commit
+          # landed since, so a PR that touches no UI file still gets linted
+          # against hundreds of other people's files. Diff the PR head against its
+          # own merge base instead, which is exactly what this PR changed.
+          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          test -n "$merge_base"
+          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
+          : > "$RUNNER_TEMP/prettier_files.txt"
+          : > "$RUNNER_TEMP/eslint_files.txt"
+          while IFS= read -r f; do
+            [ -f "$f" ] || continue
+            case "$f" in
+              *.js | *.jsx | *.ts | *.tsx | *.mjs | *.cjs)
+                printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt"
+                printf '%s\n' "$f" >> "$RUNNER_TEMP/eslint_files.txt" ;;
+              *.json | *.css | *.scss | *.md | *.mdx | *.yml | *.yaml | *.html)
+                printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt" ;;
+            esac
+          done < <(git diff --name-only --diff-filter=ACMR --relative "$merge_base" "$HEAD_SHA" -- .)
+          if [ -s "$RUNNER_TEMP/prettier_files.txt" ] || [ -s "$RUNNER_TEMP/eslint_files.txt" ]; then
+            echo "has_files=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_files=false" >> "$GITHUB_OUTPUT"
+            echo "No lintable UI files changed in this PR; nothing to check."
+          fi
+
+      - name: Setup Node.js
+        if: steps.changed.outputs.has_files == 'true'
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version-file: ui/litellm-dashboard/.nvmrc
+          cache: "npm"
+          cache-dependency-path: ui/litellm-dashboard/package-lock.json
+
+      - name: Install dependencies
+        if: steps.changed.outputs.has_files == 'true'
+        run: npm ci
+
+      - name: Lint changed files (prettier + eslint)
+        if: steps.changed.outputs.has_files == 'true'
+        run: |
+          prettier_files=()
+          eslint_files=()
+          while IFS= read -r f; do prettier_files+=("$f"); done < "$RUNNER_TEMP/prettier_files.txt"
+          while IFS= read -r f; do eslint_files+=("$f"); done < "$RUNNER_TEMP/eslint_files.txt"
+          status=0
+          if [ ${#prettier_files[@]} -gt 0 ]; then
+            echo "::group::Prettier (${#prettier_files[@]} files)"
+            npx prettier --check "${prettier_files[@]}" || { status=1; echo "::error::Unformatted files. Fix with: npm run format"; }
+            echo "::endgroup::"
+          fi
+          if [ ${#eslint_files[@]} -gt 0 ]; then
+            echo "::group::ESLint (${#eslint_files[@]} files)"
+            npx eslint --no-warn-ignored --pass-on-unpruned-suppressions "${eslint_files[@]}" || status=1
+            echo "::endgroup::"
+          fi
+          exit $status
+
+      - name: Check lint budgets
+        if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }}
+        run: |
+          npx eslint . -f json -o "$RUNNER_TEMP/lint-report.json" || true
+          node scripts/check-lint-budgets.mjs "$RUNNER_TEMP/lint-report.json" eslint-budgets.json
+
+      - name: Check for dead code (knip)
+        if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }}
+        run: npm run knip:ci
+  ui-api-types:
+    name: ui-api-types
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+          fetch-depth: 2
+
+      - name: Detect changes that can affect the generated types
+        id: changes
+        run: |
+          set -euo pipefail
+          if ! base="$(git rev-parse --verify --quiet HEAD^2 >/dev/null && git rev-parse HEAD^1)"; then
+            echo "Not a pull request merge commit, running the full check."
+            echo "relevant=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          files="$(git diff --name-only "$base" HEAD)"
+          if grep -Eq '^(litellm/(proxy|types)/|ui/litellm-dashboard/(src/lib/http/schema\.d\.ts|scripts/gen-api-types\.mjs|package(-lock)?\.json)$|\.github/workflows/test-linting\.yml$)' <<< "$files"; then
+            echo "relevant=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No proxy, types or generator changes in this pull request, nothing to verify."
+            echo "relevant=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Python
+        if: steps.changes.outputs.relevant == 'true'
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        if: steps.changes.outputs.relevant == 'true'
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Cache uv dependencies
+        if: steps.changes.outputs.relevant == 'true'
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Cache the Rust build
+        if: steps.changes.outputs.relevant == 'true'
+        uses: ./.github/actions/cache-cargo-build
+
+      - name: Install backend dependencies
+        if: steps.changes.outputs.relevant == 'true'
+        run: .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+
+      - name: Cache Prisma binaries
+        if: steps.changes.outputs.relevant == 'true'
+        uses: ./.github/actions/cache-prisma-binaries
+
+      - name: Generate Prisma client
+        if: steps.changes.outputs.relevant == 'true'
+        run: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Regenerate the lazy OpenAPI snapshot
+        if: steps.changes.outputs.relevant == 'true'
+        run: uv run --no-sync python -m litellm.proxy._lazy_openapi_snapshot
+
+      - name: Fail if the lazy OpenAPI snapshot is stale
+        if: steps.changes.outputs.relevant == 'true'
+        run: |
+          if ! git diff --exit-code -- litellm/proxy/_lazy_openapi_snapshot.json; then
+            echo "::error file=litellm/proxy/_lazy_openapi_snapshot.json::The lazy OpenAPI snapshot is out of sync with the lazily loaded routes."
+            echo ""
+            echo "A lazily loaded route or model changed without regenerating the snapshot that /openapi.json serves for unloaded features."
+            echo "To fix, run from the repo root:"
+            echo "  uv run python -m litellm.proxy._lazy_openapi_snapshot"
+            echo "then run npm run gen:api from ui/litellm-dashboard and commit both files."
+            exit 1
+          fi
+          echo "_lazy_openapi_snapshot.json is in sync with the lazily loaded routes."
+
+      - name: Set up Node.js
+        if: steps.changes.outputs.relevant == 'true'
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version-file: ui/litellm-dashboard/.nvmrc
+          cache: "npm"
+          cache-dependency-path: ui/litellm-dashboard/package-lock.json
+
+      - name: Install dashboard dependencies
+        if: steps.changes.outputs.relevant == 'true'
+        working-directory: ui/litellm-dashboard
+        run: npm ci
+
+      - name: Regenerate types from the live spec
+        if: steps.changes.outputs.relevant == 'true'
+        working-directory: ui/litellm-dashboard
+        env:
+          LITELLM_PYTHON: "uv run --no-sync python"
+        run: npm run gen:api
+
+      - name: Fail if types are stale
+        if: steps.changes.outputs.relevant == 'true'
+        run: |
+          if ! git diff --exit-code -- ui/litellm-dashboard/src/lib/http/schema.d.ts; then
+            echo "::error file=ui/litellm-dashboard/src/lib/http/schema.d.ts::Generated API types are out of sync with the proxy OpenAPI spec."
+            echo ""
+            echo "A backend route or model changed without regenerating the dashboard types."
+            echo "To fix, run from ui/litellm-dashboard:"
+            echo "  npm run gen:api"
+            echo "then commit the updated src/lib/http/schema.d.ts."
+            exit 1
+          fi
+          echo "schema.d.ts is in sync with the proxy OpenAPI spec."
+  code-quality:
+    name: code-quality
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Checkout litellm-docs into docs/my-website (for documentation_tests)
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          repository: BerriAI/litellm-docs
+          path: docs/my-website
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Cache uv dependencies
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Cache the Rust build
+        uses: ./.github/actions/cache-cargo-build
+
+      - name: Install dependencies
+        run: uv sync --frozen --all-groups --all-extras
+
+      - name: check_licenses
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_licenses.py
+
+      - name: check_provider_folders_documented
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_provider_folders_documented.py
+
+      - name: check_prisma_binary_cache
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_prisma_binary_cache.py
+
+      - name: check_workflow_startup_safety
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_workflow_startup_safety.py
+
+      - name: check_workflow_job_name_collisions
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_workflow_job_name_collisions.py
+
+      - name: test_workflow_job_name_collisions
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_workflow_job_name_collisions.py
+
+      - name: test_unit_passed_gate
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_unit_passed_gate.py
+
+      - name: test_e2e_changed_gate
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_changed_gate.py tests/code_coverage_tests/test_e2e_idp_stack.py
+
+      - name: test_e2e_metadata
+        env:
+          PYTHONPATH: tests/e2e
+        run: |
+          export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 16)"
+          uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_metadata.py tests/code_coverage_tests/test_e2e_junit_report.py
+
+      - name: Check merge smoke harness
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_merge_smoke.py
+
+      - name: router_code_coverage
+        run: uv run --no-sync python ./tests/code_coverage_tests/router_code_coverage.py
+
+      - name: test_chat_completion_imports
+        run: uv run --no-sync python ./tests/code_coverage_tests/test_chat_completion_imports.py
+
+      - name: info_log_check
+        run: uv run --no-sync python ./tests/code_coverage_tests/info_log_check.py
+
+      - name: check_guardrail_apply_decorator
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_guardrail_apply_decorator.py
+
+      - name: test_ban_set_verbose
+        run: uv run --no-sync python ./tests/code_coverage_tests/test_ban_set_verbose.py
+
+      - name: code_qa_check_tests
+        run: uv run --no-sync python ./tests/code_coverage_tests/code_qa_check_tests.py
+
+      - name: check_get_model_cost_key_performance
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_get_model_cost_key_performance.py
+
+      - name: test_proxy_types_import
+        run: uv run --no-sync python ./tests/code_coverage_tests/test_proxy_types_import.py
+
+      - name: callback_manager_test
+        run: uv run --no-sync python ./tests/code_coverage_tests/callback_manager_test.py
+
+      - name: recursive_detector
+        run: uv run --no-sync python ./tests/code_coverage_tests/recursive_detector.py
+
+      - name: test_router_strategy_async
+        run: uv run --no-sync python ./tests/code_coverage_tests/test_router_strategy_async.py
+
+      - name: litellm_logging_code_coverage
+        run: uv run --no-sync python ./tests/code_coverage_tests/litellm_logging_code_coverage.py
+
+      - name: ensure_async_clients_test
+        run: uv run --no-sync python ./tests/code_coverage_tests/ensure_async_clients_test.py
+
+      - name: enforce_llms_folder_style
+        run: uv run --no-sync python ./tests/code_coverage_tests/enforce_llms_folder_style.py
+
+      - name: prevent_key_leaks_in_exceptions
+        run: uv run --no-sync python ./tests/code_coverage_tests/prevent_key_leaks_in_exceptions.py
+
+      - name: check_unsafe_enterprise_import
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_unsafe_enterprise_import.py
+
+      - name: ban_copy_deepcopy_kwargs
+        run: uv run --no-sync python ./tests/code_coverage_tests/ban_copy_deepcopy_kwargs.py
+
+      - name: check_fastuuid_usage
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_fastuuid_usage.py
+
+      - name: check_py310_typing_imports
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_py310_typing_imports.py
+
+      - name: check_e2e_no_raw_requests
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_e2e_no_raw_requests.py
+
+      - name: check_migrations_no_data_rewrites
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_migrations_no_data_rewrites.py
+
+      - name: check_no_publicly_known_master_key
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_no_publicly_known_master_key.py
+
+      - name: test_check_no_publicly_known_master_key
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_check_no_publicly_known_master_key.py
+
+      - name: check_unbounded_in_lists (fails on findings not in the baseline)
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_unbounded_in_lists.py
+
+      - name: memory_test
+        run: uv run --no-sync python ./tests/code_coverage_tests/memory_test.py
+
+      - name: documentation_test_env_keys
+        run: uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
+
+      - name: documentation_test_router_settings
+        run: uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
+
+      - name: documentation_test_api_docs
+        run: uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
+  ci-coverage:
+    name: ci-coverage
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Assert every test file and Dockerfile is invoked by a job
+        run: |
+          python -m pip install "pyyaml==6.0.3"
+          python .github/scripts/assert_ci_coverage.py
+
+      - name: Assert no -k expression deselects a file from every job that globs it
+        run: python .github/scripts/assert_ci_coverage.py --slices
+
+      - name: Assert .github/workflows/ holds only workflows, correctly named
+        run: python .github/scripts/assert_workflow_dir_hygiene.py
+  semgrep:
+    name: semgrep
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Run Semgrep (custom rules)
+        run: uv tool run --from 'semgrep==1.157.0' semgrep scan --config .semgrep/rules . --error
+  lint-passed:
+    name: lint passed
+    needs: [python, secret-scan, ui, ui-api-types, code-quality, ci-coverage, semgrep]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions: {}
+    steps:
+      - name: Require every lint job to succeed
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: |
+          jq -r 'to_entries[] | "\(.key): \(.value.result)"' <<< "$NEEDS"
+          jq -e 'all(.[]; .result == "success")' <<< "$NEEDS" > /dev/null

.github/workflows/test-litellm-ui-build.yml

@@ -1,40 +0,0 @@
-name: UI Build Check
-permissions:
-  contents: read
-  pull-requests: read
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  build-ui:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Detect relevant changes
-        id: changes
-        uses: ./.github/actions/detect-changes
-        with:
-          category: ui
-
-      # Built through the image stage rather than the checkout, because the
-      # stage copies ui/litellm-dashboard/ alone: an import reaching above the
-      # dashboard root resolves in a checkout and fails in every image we ship.
-      # Dockerfile, docker/Dockerfile.non_root and ui/Dockerfile share this
-      # stage verbatim, so building one covers all three.
-      - name: Build the dashboard as the shipped images build it
-        if: steps.changes.outputs.decision != 'skip'
-        run: docker build --target ui-builder -f Dockerfile .

.github/workflows/test-litellm-ui-lint.yml

@@ -1,105 +0,0 @@
-name: UI Lint
-permissions:
-  contents: read
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  frontend-lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 8
-    defaults:
-      run:
-        working-directory: ui/litellm-dashboard
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Collect changed files
-        id: changed
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          # base.sha is the base branch tip from when the PR was opened, while
-          # actions/checkout leaves HEAD on a merge of the PR into the *current*
-          # base tip. "$BASE_SHA"...HEAD therefore spans every base-branch commit
-          # landed since, so a PR that touches no UI file still gets linted
-          # against hundreds of other people's files. Diff the PR head against its
-          # own merge base instead, which is exactly what this PR changed.
-          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
-          test -n "$merge_base"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-          : > "$RUNNER_TEMP/prettier_files.txt"
-          : > "$RUNNER_TEMP/eslint_files.txt"
-          while IFS= read -r f; do
-            [ -f "$f" ] || continue
-            case "$f" in
-              *.js | *.jsx | *.ts | *.tsx | *.mjs | *.cjs)
-                printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt"
-                printf '%s\n' "$f" >> "$RUNNER_TEMP/eslint_files.txt" ;;
-              *.json | *.css | *.scss | *.md | *.mdx | *.yml | *.yaml | *.html)
-                printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt" ;;
-            esac
-          done < <(git diff --name-only --diff-filter=ACMR --relative "$merge_base" "$HEAD_SHA" -- .)
-          if [ -s "$RUNNER_TEMP/prettier_files.txt" ] || [ -s "$RUNNER_TEMP/eslint_files.txt" ]; then
-            echo "has_files=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_files=false" >> "$GITHUB_OUTPUT"
-            echo "No lintable UI files changed in this PR; nothing to check."
-          fi
-
-      - name: Setup Node.js
-        if: steps.changed.outputs.has_files == 'true'
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version-file: ui/litellm-dashboard/.nvmrc
-          cache: "npm"
-          cache-dependency-path: ui/litellm-dashboard/package-lock.json
-
-      - name: Install dependencies
-        if: steps.changed.outputs.has_files == 'true'
-        run: npm ci
-
-      - name: Lint changed files (prettier + eslint)
-        if: steps.changed.outputs.has_files == 'true'
-        run: |
-          prettier_files=()
-          eslint_files=()
-          while IFS= read -r f; do prettier_files+=("$f"); done < "$RUNNER_TEMP/prettier_files.txt"
-          while IFS= read -r f; do eslint_files+=("$f"); done < "$RUNNER_TEMP/eslint_files.txt"
-          status=0
-          if [ ${#prettier_files[@]} -gt 0 ]; then
-            echo "::group::Prettier (${#prettier_files[@]} files)"
-            npx prettier --check "${prettier_files[@]}" || { status=1; echo "::error::Unformatted files. Fix with: npm run format"; }
-            echo "::endgroup::"
-          fi
-          if [ ${#eslint_files[@]} -gt 0 ]; then
-            echo "::group::ESLint (${#eslint_files[@]} files)"
-            npx eslint --no-warn-ignored --pass-on-unpruned-suppressions "${eslint_files[@]}" || status=1
-            echo "::endgroup::"
-          fi
-          exit $status
-
-      - name: Check lint budgets
-        if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }}
-        run: |
-          npx eslint . -f json -o "$RUNNER_TEMP/lint-report.json" || true
-          node scripts/check-lint-budgets.mjs "$RUNNER_TEMP/lint-report.json" eslint-budgets.json
-
-      - name: Check for dead code (knip)
-        if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }}
-        run: npm run knip:ci

.github/workflows/test-litellm-ui-unit.yml

@@ -1,95 +0,0 @@
-name: UI Unit Tests
-permissions:
-  contents: read
-  pull-requests: read
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-  push:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  ui-unit-tests:
-    runs-on: ubuntu-latest-16-cores
-    timeout-minutes: 20
-    defaults:
-      run:
-        working-directory: ui/litellm-dashboard
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Detect relevant changes
-        id: changes
-        uses: ./.github/actions/detect-changes
-        with:
-          category: ui
-
-      - name: Setup Node.js
-        if: steps.changes.outputs.decision != 'skip'
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version-file: ui/litellm-dashboard/.nvmrc
-          cache: "npm"
-          cache-dependency-path: ui/litellm-dashboard/package-lock.json
-
-      - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        run: npm ci
-
-      - name: Run UI type tests (Vitest)
-        if: steps.changes.outputs.decision != 'skip'
-        env:
-          CI: "true"
-        run: npm run test:types
-
-      - name: Run UI unit tests (Vitest)
-        if: steps.changes.outputs.decision != 'skip'
-        env:
-          CI: "true"
-          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          full_suite() { npm run test -- --run --pool forks --maxWorkers=14; }
-
-          if [ -z "$BASE_SHA" ]; then
-            echo "Push to $GITHUB_REF_NAME: running the full suite"
-            full_suite
-            exit 0
-          fi
-
-          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
-          test -n "$merge_base"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-          changed_files=()
-          while IFS= read -r f; do
-            changed_files+=("$f")
-          done < <(git diff --name-only --relative "$merge_base" "$HEAD_SHA" -- .)
-          if [ ${#changed_files[@]} -eq 0 ]; then
-            echo "No UI files changed in this PR; skipping unit tests."
-            exit 0
-          fi
-
-          scope=$(printf '%s\n' "${changed_files[@]}" | bash "$GITHUB_WORKSPACE/.github/scripts/select_ui_test_scope.sh")
-          if [ "$scope" != related ]; then
-            echo "Pull request: ${#changed_files[@]} changed UI files reach outside src/, so related would miss their dependents; running the full suite"
-            full_suite
-            exit 0
-          fi
-
-          echo "Pull request: running tests related to ${#changed_files[@]} changed UI files"
-          npm run test -- related "${changed_files[@]}" --run --passWithNoTests \
-            --pool forks --maxWorkers=14

.github/workflows/test-mcp-dependency-resolution.yml

@@ -5,6 +5,30 @@ on:
     branches:
       - main
       - "litellm_**"
+    paths:
+      - "**/pyproject.toml"
+      - "uv.lock"
+      - "uv.toml"
+      - ".python-version"
+      - "rust-toolchain.toml"
+      - "litellm-rust/**"
+      - "litellm/__init__.py"
+      - "litellm/_version.py"
+      - "litellm/_lazy_imports_registry.py"
+      - "scripts/build_core_distribution.py"
+      - "litellm/proxy/proxy_server.py"
+      - "litellm/**/*mcp*"
+      - "litellm/**/*mcp*/**"
+      - "litellm/integrations/arize/**"
+      - "scripts/check_mcp_sdk_install.py"
+      - "tests/base_sdk_tests/**"
+      - ".github/workflows/test-mcp-dependency-resolution.yml"
+      - ".github/actions/detect-changes/**"
+      - ".github/actions/setup-uv-with-retries/**"
+      - ".github/actions/cache-cargo-build/**"
+      - ".github/scripts/detect_changes.sh"
+      - ".github/scripts/uv_sync_with_retries.sh"
+      - ".circleci/scripts/classify_changes.sh"
 
 permissions:
   contents: read
@@ -65,6 +89,7 @@ jobs:
             uv pip check --python ".venv-$extra"
             if [ "$extra" = core ]; then
               checker=("$GITHUB_WORKSPACE/tests/base_sdk_tests/check_base_sdk_install.py")
+              (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-$extra/bin/python" -I "$GITHUB_WORKSPACE/tests/base_sdk_tests/check_sdk_http.py")
             else
               checker=("$GITHUB_WORKSPACE/scripts/check_mcp_sdk_install.py" --extra "$extra")
             fi
@@ -94,3 +119,63 @@ jobs:
             fi
             (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-lowest-$extra/bin/python" "${checker[@]}")
           done
+
+  core-distribution:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+      LITELLM_LOCAL_MODEL_COST_MAP: "True"
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+      - uses: ./.github/actions/cache-cargo-build
+      - name: Build the core wheel and source distribution
+        run: >-
+          uv run --no-project --with coverage==7.14.0 python -m coverage run --rcfile=/dev/null
+          --branch --include="*/scripts/build_core_distribution.py"
+          scripts/build_core_distribution.py --out-dir dist/core
+      - name: Verify metadata, resources, and independent source rebuild
+        env:
+          CORE_DISTRIBUTION_DIR: ${{ github.workspace }}/dist/core
+        run: >-
+          uv run --no-project --with pytest==9.0.3 --with pytest-cov==5.0.0 --with coverage==7.14.0 --with 'tomli==2.4.1; python_version < "3.11"'
+          python -m pytest tests/base_sdk_tests/test_core_distribution.py -v
+          --cov-config=/dev/null --cov=scripts.build_core_distribution --cov-branch --cov-append --cov-report=
+      - name: Verify isolated core installations
+        run: |
+          wheel=$(realpath dist/core/litellm_core-*.whl)
+          for resolution in highest lowest-direct; do
+            uv venv --python ${{ matrix.python-version }} ".venv-core-$resolution"
+            uv pip install --python ".venv-core-$resolution" --resolution "$resolution" "$wheel"
+            uv pip check --python ".venv-core-$resolution"
+            (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-core-$resolution/bin/python" -I "$GITHUB_WORKSPACE/tests/base_sdk_tests/check_base_sdk_install.py" --profile core)
+            (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-core-$resolution/bin/python" -I "$GITHUB_WORKSPACE/tests/base_sdk_tests/check_sdk_http.py")
+          done
+          uv pip install --python .venv-core-highest coverage==7.14.0
+          .venv-core-highest/bin/python -I -m coverage run --rcfile=/dev/null --append --branch --include="*/tests/base_sdk_tests/check_base_sdk_install.py" tests/base_sdk_tests/check_base_sdk_install.py --profile core
+          uv pip install --python .venv-core-highest boto3 tokenizers huggingface-hub
+          (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-core-highest/bin/python" -I "$GITHUB_WORKSPACE/tests/base_sdk_tests/check_base_sdk_install.py" --profile dependencies)
+          (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-core-highest/bin/python" -I "$GITHUB_WORKSPACE/tests/base_sdk_tests/check_sdk_http.py")
+          uv run --no-project --with coverage==7.14.0 python -m coverage xml --rcfile=/dev/null -o coverage-core.xml
+      - name: Upload core packaging coverage
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        with:
+          use_oidc: true
+          files: coverage-core.xml
+          flags: core-packaging
+          fail_ci_if_error: false

.github/workflows/test-merge-smoke.yml

@@ -1,4 +1,4 @@
-name: Merge smoke checks
+name: smoke
 
 on:
   pull_request:
@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   dashboard-build:
-    name: Dashboard build
+    name: dashboard-build
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
@@ -27,7 +27,7 @@ jobs:
         run: docker build --target ui-builder -f Dockerfile .
 
   core-checks:
-    name: Core checks (Python ${{ matrix.python-version }})
+    name: py${{ matrix.python-version }}
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
@@ -79,9 +79,6 @@ jobs:
       - name: Proxy startup check
         run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py proxy-startup --diagnostics-dir "${RUNNER_TEMP}/smoke-diagnostics"
 
-      - name: Run curated smoke cases
-        run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py pytest --manifest .github/merge-smoke-tests.json
-
       - name: Upload smoke diagnostics
         if: always()
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
@@ -93,3 +90,190 @@ jobs:
       - name: Remove the network namespace
         if: always()
         run: sudo ip netns delete smoke
+
+  all-extras:
+    name: all-extras-py${{ matrix.python-version }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+    env:
+      LITELLM_LOCAL_MODEL_COST_MAP: "True"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Install every extra and dependency group
+        run: .github/scripts/uv_sync_with_retries.sh --frozen --all-groups --all-extras --python ${{ matrix.python-version }}
+
+      - name: Import the SDK, the proxy server and the enterprise package
+        run: .venv/bin/python -c "import litellm, litellm.proxy.proxy_server, litellm_enterprise"
+
+  windows-sdk:
+    name: windows-sdk
+    runs-on: windows-2025
+    timeout-minutes: 10
+    env:
+      LITELLM_LOCAL_MODEL_COST_MAP: "True"
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.11"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Install dependencies
+        run: .github/scripts/uv_sync_with_retries.sh --frozen --no-install-workspace --group dev --python 3.11
+
+      - name: Run the Windows tests
+        run: uv run --no-sync python -m pytest --tb=short -v tests/windows_tests
+
+  proxy-build-from-pip:
+    name: proxy-build-from-pip
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    services:
+      postgres:
+        image: postgres:14@sha256:6a70deda415ec296f977890e11aba04a0db9f632a362e3fce45e845e3db74f26
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: circle_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Install the test client dependencies
+        run: .github/scripts/uv_sync_with_retries.sh --frozen --no-install-workspace --extra proxy --group dev --python 3.12
+
+      - name: Build the image from the published package
+        run: docker build -t litellm-build-from-pip:smoke -f docker/build_from_pip/Dockerfile.build_from_pip .
+
+      - name: Start the fake OpenAI endpoint
+        run: |
+          nohup .venv/bin/python tests/_fake_openai_endpoint_server.py --host 0.0.0.0 --port 8190 > "${RUNNER_TEMP}/fake-openai.log" 2>&1 &
+          for _ in $(seq 1 30); do
+            curl -sf http://localhost:8190/health > /dev/null && exit 0
+            sleep 1
+          done
+          cat "${RUNNER_TEMP}/fake-openai.log"
+          exit 1
+
+      - name: Generate a master key
+        run: |
+          key="sk-$(openssl rand -hex 16)"
+          echo "::add-mask::${key}"
+          echo "LITELLM_MASTER_KEY=${key}" >> "${GITHUB_ENV}"
+
+      - name: Start the proxy container
+        run: |
+          docker run -d \
+            -p 4000:4000 \
+            -e DATABASE_URL=postgresql://postgres:postgres@host.docker.internal:5432/circle_test \
+            -e LITELLM_MASTER_KEY \
+            -e FAKE_OPENAI_API_BASE=http://host.docker.internal:8190 \
+            -e OTEL_EXPORTER=in_memory \
+            -e USE_DDTRACE=True \
+            -e GCS_FLUSH_INTERVAL=1 \
+            -e LITELLM_LOG=ERROR \
+            --add-host host.docker.internal:host-gateway \
+            --name litellm-build-from-pip \
+            -v "${GITHUB_WORKSPACE}/docker/build_from_pip/litellm_config.yaml:/app/config.yaml" \
+            litellm-build-from-pip:smoke \
+            --config /app/config.yaml \
+            --port 4000
+          for _ in $(seq 1 150); do
+            curl -sf --max-time 5 -o /dev/null http://localhost:4000 && exit 0
+            sleep 2
+          done
+          exit 1
+
+      - name: Run the startup tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          base_url=http://localhost:4000
+          readiness_response="$(curl -sS --fail-with-body --write-out $'\n%{http_code}' "${base_url}/health/readiness")"
+          readiness_status="${readiness_response##*$'\n'}"
+          readiness_body="${readiness_response%$'\n'*}"
+          [[ "${readiness_status}" == "200" ]]
+          jq -e '.status == "healthy" or .status == "connected"' <<< "${readiness_body}" > /dev/null
+          liveness_status="$(curl -sS --fail-with-body --output /dev/null --write-out '%{http_code}' "${base_url}/health/liveness")"
+          [[ "${liveness_status}" == "200" ]]
+          completion_response="$(curl -sS --fail-with-body --write-out $'\n%{http_code}' \
+            --header "Authorization: Bearer ${LITELLM_MASTER_KEY}" \
+            --header 'Content-Type: application/json' \
+            --data '{"model":"gpt-4","messages":[{"role":"system","content":"You are a helpful assistant."},{"role":"user","content":"Hello!"}]}' \
+            "${base_url}/chat/completions")"
+          completion_status="${completion_response##*$'\n'}"
+          completion_body="${completion_response%$'\n'*}"
+          [[ "${completion_status}" == "200" ]]
+          jq -e '
+            (.choices | length) == 1 and
+            .choices[0].message.role == "assistant" and
+            .choices[0].message.content == "Hello! This is a mock response from the fake OpenAI endpoint."
+          ' <<< "${completion_body}" > /dev/null
+
+      - name: Show the proxy logs
+        if: always()
+        run: docker logs litellm-build-from-pip || true
+
+  smoke-passed:
+    name: smoke passed
+    needs: [dashboard-build, core-checks, all-extras, windows-sdk, proxy-build-from-pip]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions: {}
+    steps:
+      - name: Require every smoke job to succeed
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: |
+          jq -r 'to_entries[] | "\(.key): \(.value.result)"' <<< "$NEEDS"
+          jq -e 'all(.[]; .result == "success")' <<< "$NEEDS" > /dev/null

.github/workflows/test-postgres.yml

@@ -1,167 +0,0 @@
-name: "Postgres Tests"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  postgres:
-    name: ${{ matrix.shard }}
-    runs-on: ubuntu-latest
-    timeout-minutes: ${{ matrix.job-timeout-minutes }}
-    permissions:
-      contents: read
-      id-token: write
-
-    services:
-      postgres:
-        image: postgres:16@sha256:e17e86066e5ef83e0952a9347f5c792b7ece00972e2aa787a6986f471b3dd3d5
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: litellm_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 10
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - shard: proxy-behavior
-            test-path: "tests/proxy_behavior"
-            seed: db-push
-            workers: 0
-            timeout-minutes: 25
-            job-timeout-minutes: 50
-
-          - shard: proxy-security
-            test-path: "tests/proxy_security_tests"
-            seed: db-push
-            workers: 0
-            timeout-minutes: 15
-            job-timeout-minutes: 40
-
-          - shard: schema-migration
-            test-path: "tests/proxy_migration_tests"
-            seed: none
-            workers: 0
-            timeout-minutes: 20
-            job-timeout-minutes: 45
-
-    env:
-      DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/litellm_test"
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        timeout-minutes: 3
-        with:
-          persist-credentials: false
-
-      - name: Detect relevant changes
-        id: changes
-        timeout-minutes: 2
-        uses: ./.github/actions/detect-changes
-
-      - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip' && github.ref == 'refs/heads/main'
-        timeout-minutes: 5
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-postgres-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-postgres-
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip' && github.ref != 'refs/heads/main'
-        timeout-minutes: 5
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-postgres-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-postgres-
-
-      - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 12
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --all-groups --all-extras
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Seed database schema
-        if: steps.changes.outputs.decision != 'skip' && matrix.seed != 'none'
-        timeout-minutes: 10
-        run: |
-          uv run --no-sync prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
-
-      - name: Run tests
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: ${{ matrix.timeout-minutes }}
-        env:
-          TEST_PATH: ${{ matrix.test-path }}
-          WORKERS: ${{ matrix.workers }}
-          PYTEST_ADDOPTS: ${{ matrix.shard == 'proxy-behavior' && '--cov=./litellm --cov-report=xml:coverage-lens-postgres.xml' || '' }}
-        run: |
-          if [ "${WORKERS}" = "0" ]; then
-            uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10
-          else
-            uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10 -n "${WORKERS}"
-          fi
-
-      - name: Upload Lens database coverage
-        if: steps.changes.outputs.decision != 'skip' && matrix.shard == 'proxy-behavior' && !cancelled()
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
-        with:
-          use_oidc: true
-          version: v11.3.1
-          root_dir: ${{ github.workspace }}
-          files: coverage-lens-postgres.xml
-          flags: lens-postgres
-          fail_ci_if_error: true

.github/workflows/test-redis-compat.yml

@@ -1,106 +0,0 @@
-name: "Unit Tests: Redis Client Version Compatibility"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-    paths:
-      - "litellm/_redis.py"
-      - "litellm/_redis_credential_provider.py"
-      - "litellm/caching/redis_cache.py"
-      - "litellm/caching/evicted_client_closer.py"
-      - "tests/unit/test_redis.py"
-      - "tests/local_testing/test_caching.py"
-      - "tests/unit/caching/test_redis_connection_pool.py"
-      - "tests/unit/caching/test_redis_cluster_cache.py"
-      - "tests/unit/caching/test_evicted_client_closer.py"
-      - ".github/workflows/test-redis-compat.yml"
-      - "pyproject.toml"
-      - "uv.lock"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  redis-compat:
-    name: "redis-py ${{ matrix.redis-version }}"
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      id-token: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        # 5.3.1 is the version pinned in uv.lock (redisvl caps it below 6); the
-        # newer legs prove the inspect.signature introspection in litellm/_redis.py
-        # keeps extracting kwargs on the redis-py releases people actually run now.
-        # Only the exact release 6.0.0 is skipped: rq (pulled by the proxy extra)
-        # specifies `redis != 6`, which excludes 6.0.0 alone, so 6.4.0 stands in
-        # for the 6.x line.
-        redis-version: ["5.3.1", "6.4.0", "7.4.1", "8.0.1"]
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Install dependencies
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra extra_proxy --extra semantic-router
-
-      - name: Pin redis-py to the matrix version
-        env:
-          REDIS_VERSION: ${{ matrix.redis-version }}
-        run: |
-          uv pip install "redis==${REDIS_VERSION:?}"
-          uv run --no-sync python -c "import redis; assert redis.__version__ == '${REDIS_VERSION:?}', redis.__version__; print('redis-py', redis.__version__)"
-
-      - name: Build Redis for cluster authentication tests
-        run: |
-          curl --fail --location --retry 3 https://download.redis.io/releases/redis-7.2.16.tar.gz -o "$RUNNER_TEMP/redis-7.2.16.tar.gz"
-          echo "960a8ec15e34ff40e57ff16837b26b33bd81f2da6d24497bb63de532a323a18e  $RUNNER_TEMP/redis-7.2.16.tar.gz" | sha256sum --check
-          tar -xzf "$RUNNER_TEMP/redis-7.2.16.tar.gz" -C "$RUNNER_TEMP"
-          make -C "$RUNNER_TEMP/redis-7.2.16" -j2 MALLOC=libc OPTIMIZATION=-O1 redis-server
-          echo "$RUNNER_TEMP/redis-7.2.16/src" >> "$GITHUB_PATH"
-
-      - name: Run redis unit tests
-        run: |
-          redis-server --version
-          uv run --no-sync pytest \
-            tests/unit/test_redis.py \
-            tests/unit/caching/test_redis_connection_pool.py \
-            tests/unit/caching/test_redis_cluster_cache.py \
-            tests/unit/caching/test_evicted_client_closer.py \
-            tests/local_testing/test_caching.py::test_sync_cluster_authenticates_with_azure_credentials \
-            tests/local_testing/test_caching.py::test_sync_cluster_authenticates_with_gcp_credentials \
-            --tb=short -vv \
-            --reruns 2 \
-            --reruns-delay 1 \
-            --durations=20 \
-            --cov=./litellm --cov-report=xml:coverage-redis.xml
-
-      - name: Upload Redis coverage
-        if: matrix.redis-version == '5.3.1'
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
-        with:
-          use_oidc: true
-          files: coverage-redis.xml
-          flags: redis-compat
-          fail_ci_if_error: false

.github/workflows/test-rust.yml

@@ -5,6 +5,10 @@ on:
     paths:
       - "litellm-rust/**"
       - "litellm/rust_bridge/**"
+      - "scripts/generate_trace_types.py"
+      - "scripts/trace_codegen/**"
+      - "scripts/lens_assets/**"
+      - "litellm/tracing/**"
       - "tests/test_litellm_rust/**"
       - "litellm/integrations/custom_logger.py"
       - "litellm/litellm_core_utils/litellm_logging.py"
@@ -14,7 +18,6 @@ on:
       - "litellm/ocr/**"
       - "litellm/llms/base_llm/ocr/**"
       - "litellm/llms/custom_httpx/llm_http_handler.py"
-      - "tests/test_litellm/conftest.py"
       - "Makefile"
       - ".cargo/**"
       - "pyproject.toml"
@@ -32,6 +35,10 @@ on:
     paths:
       - "litellm-rust/**"
       - "litellm/rust_bridge/**"
+      - "scripts/generate_trace_types.py"
+      - "scripts/trace_codegen/**"
+      - "scripts/lens_assets/**"
+      - "litellm/tracing/**"
       - "tests/test_litellm_rust/**"
       - "litellm/integrations/custom_logger.py"
       - "litellm/litellm_core_utils/litellm_logging.py"
@@ -41,7 +48,6 @@ on:
       - "litellm/ocr/**"
       - "litellm/llms/base_llm/ocr/**"
       - "litellm/llms/custom_httpx/llm_http_handler.py"
-      - "tests/test_litellm/conftest.py"
       - "Makefile"
       - ".cargo/**"
       - "pyproject.toml"
@@ -90,6 +96,9 @@ jobs:
   rust-test:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    # Trim debuginfo to keep the job's target dir within the runner's disk
+    env:
+      CARGO_PROFILE_DEV_DEBUG: line-tables-only
     defaults:
       run:
         working-directory: litellm-rust
@@ -124,6 +133,10 @@ jobs:
           cache-on-failure: true
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
+      - name: Check generated trace contracts
+        working-directory: .
+        run: uv run scripts/generate_trace_types.py --check
+
       - run: cargo nextest run --workspace --locked
 
       - run: cargo test --workspace --doc --locked

.github/workflows/test-semgrep.yml

@@ -1,37 +0,0 @@
-name: Semgrep
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  semgrep:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Run Semgrep (custom rules)
-        run: uv tool run --from 'semgrep==1.157.0' semgrep scan --config .semgrep/rules . --error

.github/workflows/test-unit-documentation.yml

@@ -1,103 +0,0 @@
-name: "Unit Tests: Documentation Validation"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  documentation:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      pull-requests: read
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Detect relevant changes
-        id: changes
-        uses: ./.github/actions/detect-changes
-
-      - name: Checkout litellm-docs into docs/my-website (for documentation_tests)
-        if: steps.changes.outputs.decision != 'skip'
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          repository: BerriAI/litellm-docs
-          path: docs/my-website
-          persist-credentials: false
-
-      - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip' && github.ref == 'refs/heads/main'
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip' && github.ref != 'refs/heads/main'
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-
-
-      - name: Cache the Rust build
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      # Run the same documentation tests that CircleCI ran (as direct Python scripts)
-      - name: Run documentation validation tests
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
-          uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
-          uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
-          uv run --no-sync python ./tests/documentation_tests/test_circular_imports.py

.github/workflows/test-unit-proxy-db.yml

@@ -1,172 +0,0 @@
-name: "Unit Tests: Proxy DB Operations"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-# Semantic matrix: each shard groups tests by concern (auth, server, logging, …)
-# rather than alphabetical letter ranges. Adding a new test file means adding it
-# to whichever group it belongs to, not reshuffling slices.
-#
-# `.circleci/tests.yml` runs each group's files on same-repo events under the
-# `proxy-db-<group>` Codecov flag; `.circleci/scripts/unit_selection.sh` holds
-# the file lists. That pipeline is manual-only while the tests migrate, so
-# `unit-flag` makes the shard run that list on every event. `test-path` keeps
-# the files that still reach real providers and never left
-# tests/proxy_unit_tests.
-#
-# Design targets:
-#   * Every shard runs in <= 7 minutes of wall-clock on the default runner.
-#     Most of a shard's time is pytest plugin load + xdist worker imports +
-#     pytest-cov instrumentation, not the tests themselves. Keeping per-shard
-#     work low and matching worker count to runner cores is what controls it.
-#   * `timeout` bounds the pytest step only. Checkout, dependency install, and
-#     Prisma client generation draw on a separate allowance in the base
-#     workflow, so slow setup shows up as a slow job rather than as a
-#     cancelled shard whose tests were passing.
-#   * workers: 4 matches the 4-core ubuntu-latest runner. -n 8 on 4 cores
-#     oversubscribes 2x and workers fight for CPU during their cold-start
-#     imports (measured ~441% CPU for -n 8 locally, i.e. ~55% effective).
-#   * test_key_generate_prisma.py stays serial (workers=0) — it has event-loop
-#     conflicts with the logging worker when run in parallel.
-#   * test_proxy_utils.py runs as a single shard with --dist=worksteal so
-#     xdist balances its 188 parametrized cases across workers instead of
-#     pinning the whole file to one worker (the default --dist=loadscope
-#     behavior for single-file targets).
-jobs:
-  # Fast guard — fails the workflow when a test directory or file inside a sharded
-  # tree is claimed by no shard. The semantic-shard design has no catch-all bucket,
-  # so an unassigned child runs nowhere; assert_ci_coverage.py holds the tree list
-  # and reads the same test-path keys the coverage census does.
-  assert-shard-coverage:
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-      - name: Assert every test directory and file is claimed by a shard
-        run: python3 .github/scripts/assert_ci_coverage.py --shards
-
-  proxy-db:
-    needs: assert-shard-coverage
-    # Display only the semantic shard name in the checks UI instead of GHA's
-    # default "proxy-db (key-generation, tests/unit/proxy/…, 0, loadscope, 20)"
-    # which includes every matrix field and gets truncated past the test-path.
-    name: ${{ matrix.test-group }}
-    permissions:
-      contents: read
-      id-token: write
-      pull-requests: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # Must run serially — event-loop conflict with the logging worker.
-          - test-group: key-generation
-            test-path: ""
-            unit-flag: proxy-db-key-generation
-            workers: 0
-            dist: loadscope
-            timeout: 20
-
-          # ---- auth: split into 2 shards ----
-          - test-group: auth-checks
-            test-path: ""
-            unit-flag: proxy-db-auth-checks
-            workers: 4
-            dist: loadscope
-            timeout: 15
-          - test-group: jwt-and-keys
-            test-path: ""
-            unit-flag: proxy-db-jwt-and-keys
-            workers: 4
-            dist: loadscope
-            timeout: 15
-
-          # ---- test_proxy_utils.py, single shard, worksteal distribution ----
-          - test-group: proxy-utils
-            test-path: ""
-            unit-flag: proxy-db-proxy-utils
-            workers: 4
-            dist: worksteal
-            timeout: 15
-
-          # ---- proxy server: split into 2 shards ----
-          - test-group: proxy-server-core
-            test-path: "tests/proxy_unit_tests/test_proxy_server_gemini_pass_through.py"
-            unit-flag: proxy-db-proxy-server-core
-            workers: 4
-            dist: loadscope
-            timeout: 15
-          - test-group: proxy-runtime
-            test-path: ""
-            unit-flag: proxy-db-proxy-runtime
-            workers: 4
-            dist: loadscope
-            timeout: 15
-
-          # ---- logging: split into 2 shards ----
-          - test-group: custom-logging
-            test-path: "tests/proxy_unit_tests/test_proxy_custom_logger.py"
-            unit-flag: proxy-db-custom-logging
-            workers: 4
-            dist: loadscope
-            timeout: 15
-          - test-group: logging-misc
-            test-path: ""
-            unit-flag: proxy-db-logging-misc
-            workers: 4
-            dist: loadscope
-            timeout: 15
-
-          - test-group: db-and-spend
-            test-path: ""
-            unit-flag: proxy-db-db-and-spend
-            workers: 4
-            dist: loadscope
-            timeout: 15
-
-          # ---- guardrails + budget + hooks: split into 2 ----
-          - test-group: guardrails-hooks
-            test-path: ""
-            unit-flag: proxy-db-guardrails-hooks
-            workers: 4
-            dist: loadscope
-            timeout: 15
-          - test-group: budgets
-            test-path: ""
-            unit-flag: proxy-db-budgets
-            workers: 4
-            dist: loadscope
-            timeout: 15
-
-          - test-group: endpoints-and-responses
-            test-path: "tests/proxy_unit_tests/test_proxy_exception_mapping.py"
-            unit-flag: proxy-db-endpoints-and-responses
-            workers: 4
-            dist: loadscope
-            timeout: 15
-    uses: ./.github/workflows/_test-unit-base.yml
-    with:
-      test-path: ${{ matrix.test-path }}
-      unit-flag: ${{ matrix.unit-flag }}
-      workers: ${{ matrix.workers }}
-      reruns: 2
-      timeout-minutes: ${{ matrix.timeout }}
-      dist: ${{ matrix.dist }}
-      artifact-name: proxy-db-${{ matrix.test-group }}

.github/workflows/weekly_load_anomaly.yml

@@ -63,7 +63,7 @@ jobs:
 
       - name: Start the proxy
         run: |
-          nohup uv run --no-sync litellm --config tests/e2e/load/weekly_anomaly_config.yml --port 4000 > proxy.log 2>&1 &
+          nohup uv run --no-sync litellm --config tests/e2e/perf/weekly_anomaly_config.yml --port 4000 > proxy.log 2>&1 &
           for _ in $(seq 1 90); do
             if curl -fs http://localhost:4000/health/liveliness > /dev/null; then
               exit 0
@@ -78,7 +78,7 @@ jobs:
         env:
           E2E_WEEKLY_ANOMALY: "1"
         run: |
-          uv run --no-sync pytest tests/e2e/load/test_weekly_session_anomaly_e2e.py -v --tb=short -rA
+          uv run --no-sync pytest tests/e2e/perf/test_weekly_session_anomaly_e2e.py -v --tb=short -rA
 
       - name: Show proxy log on failure
         if: failure()

.gitignore

@@ -151,3 +151,7 @@ litellm.log
 
 .coverage-rust
 coverage-rust.xml
+
+# make lens-dev worker token, generated config and logs
+.lens-dev/
+.mypy_cache/

AGENTS.md

@@ -25,7 +25,7 @@ Same thing for bug fixes. The tests should make it so that this specific bug can
 
 Never test structure of code only function of it
 
-A test must only fail when litellm code changes. Never pin facts we don't own (a vendor's price, a third party's field, an upstream default, today's date) as literals or as "X must be absent"; assert the invariant our code guarantees instead, e.g. two rows agree, a value is within range, a field is derived from another. If an outside fact is truly load-bearing, cite its source and date next to the assertion so a reader can tell stale from broken
+A test must only fail when litellm code changes. Never pin facts we don't own (a vendor's price, a third party's field, an upstream default, today's date) as literals or as "X must be absent". Assert the invariant our code guarantees instead, e.g. two rows agree, a value is within range, a field is derived from another. If an outside fact is truly load-bearing, cite its source and date next to the assertion so a reader can tell stale from broken
 
 `tests/unit/` mirrors `litellm/` in a parallel path (see `tests/unit/AGENTS.md`). Name tests `test_<filename>.py`, but always match the existing test file in the directory you touch — many provider dirs use longer descriptive names (e.g. `test_anthropic_chat_transformation.py`) to avoid ambiguity across sibling folders. For bug fixes, extend the existing mapped test file rather than creating a new one. Only create a new test file for a new feature (provider, endpoint, or transformation module) that has no mapped test yet, following that directory's naming convention (or `test_<filename>.py` if you're the first test there). One focused regression test beats many shallow ones
 
@@ -33,20 +33,20 @@ End-to-end tests belong in `tests/e2e/` and must follow the harness conventions
 
 When creating PRs, target the repository's current default branch for both internal and external / OSS contributions. Check it with `python3 scripts/default_branch.py --branch` instead of assuming a branch name or relying on cached `origin/HEAD`
 
-When writing a PR body, treat the comments and imperative instructions inside .github/pull_request_template.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/pull_request_template.md from disk before writing a PR body to make sure you see every comment rule. A section you have nothing to put in (Relevant issues, Affected release, Linear ticket, Caveats, QA runbook, and so on) is removed entirely, heading included, never left as an empty title
+When writing a PR body, treat the comments and imperative instructions inside .github/PULL_REQUEST_TEMPLATE/general.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/PULL_REQUEST_TEMPLATE/general.md from disk before writing a PR body to make sure you see every comment rule. A section you have nothing to put in (Relevant issues, Affected release, Linear ticket, Caveats, QA runbook, and so on) is removed entirely, heading included, never left as an empty title
 
 Same applies for filing bug reports and feature requests, with .github/ISSUE_TEMPLATE/bug_report.yml and .github/ISSUE_TEMPLATE/feature_request.yml, respectively
 
 If you're resolving a linear ticket, in the "## Linear ticket" section of the PR, say "Resolves LIT-1234", replacing "LIT-1234" with the actual ticket id that you're resolving. If you don't have the ticket id, don't make one up or search for it. Just drop the section
 
-Never use `pytest` commands or the like as "Screenshots / Proof of Fix". We prefer curl'ing a live proxy instance running on localhost:4000 (I like to run it with `python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --detailed_debug --reload --use_v2_migration_resolver 2>&1 | tee litellm.log`; the Admin UI dev server is `npm run dev` in `ui/litellm-dashboard`, served on port 3000) and showing both the command run and the output. Also, it should hit real LLM provider APIs, not mocks, and cost real $$$ because that is the most realistic test. The proof of fix should be exactly what the end user / customer would see / do. The run logs in PR #27703 is a prime example of how to do it (not a huge fan of using a python test script that future me and the team will have no visibility into; I prefer just curl commands or a short list of bash commands (e.g., using `for`)). If it's a UI thing, or the main use case runs through a headful agentic coding tool like Claude Code or Codex, drive that surface yourself and embed your own before and after screenshots of it in the PR (the Admin UI page, or what the coding tool shows), next to an ordered list of the URLs to go to (e.g., http://localhost:4000/ui/?page=logs), where to click, and what fields to fill out so a reviewer can reproduce it
+Never use `pytest` commands or the like as "Screenshots / Proof of Fix". We prefer curl'ing a live proxy instance running on localhost:4000 (I like to run it with `python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --detailed_debug --reload --use_v2_migration_resolver 2>&1 | tee litellm.log`. The Admin UI dev server is `npm run dev` in `ui/litellm-dashboard`, served on port 3000) and showing both the command run and the output. Also, it should hit real LLM provider APIs, not mocks, and cost real $$$ because that is the most realistic test. The proof of fix should be exactly what the end user / customer would see / do. The run logs in PR #27703 is a prime example of how to do it (not a huge fan of using a python test script that future me and the team will have no visibility into. I prefer just curl commands or a short list of bash commands (e.g., using `for`)). If it's a UI thing, or the main use case runs through a headful agentic coding tool like Claude Code or Codex, drive that surface yourself and embed your own before and after screenshots of it in the PR (the Admin UI page, or what the coding tool shows), next to an ordered list of the URLs to go to (e.g., http://localhost:4000/ui/?page=logs), where to click, and what fields to fill out so a reviewer can reproduce it
 
 If you ever write any human-facing text (pull requests, issues, commit messages, discussion posts, github comments, release notes, docs, etc.), always follow these guidelines to sound less AI-y:
 - don't use emojis
-- don't use "—". Instead, reach for ",", ".", conjunction words, ":", ";", etc. in descending order of preference: vary among them, weighted toward the front of the list, and skip "," where it would cause a comma splice or the sentence is getting long. Overusing any one of them, ";" especially, also feels AI-y. A word cap does not penalize you for adding more sentences: when writing under tight word budgets, prefer a period split or a conjunction over ";", and keep to at most one ";" per message
+- don't use "—". Don't use ";" or ":" unless it would be nonsensical not to. Instead, reach for ",", ".", conjunction words, etc. in descending order of preference: vary among them, weighted toward the front of the list, and skip "," where it would cause a comma splice or the sentence is getting long. Overusing any one of them also feels AI-y. A word cap does not penalize you for adding more sentences
 - don't use the pattern "It's not X, it's Y", "You're not X, you're Y", etc.
 - unless explicitly asked, don't use bulleted or numbered lists unless it would be nonsensical not to. Instead, prefer prose
-- don't add a trailing "." at the end of paragraphs (just like this file). That means every paragraph, not just the last one (of the markdown file, PR description, GitHub comment, etc.). Rule of thumb: if you're adding new line(s) before the next sentence, don't add a "."
+- don't add a trailing "." at the end of paragraphs (just like this file). That means every paragraph, not just the last one (of the markdown file, PR description, GitHub comment, etc.). Rule of thumb: if you're adding new line(s) before the next sentence, don't add a ".". Exception is that docs (i.e., litellm-docs) should have trailing "."
 - don't use →. Instead, prefer not to use arrows, and if need be, use -> instead
 - use plain, simple, everyday engineering language: the common phrase engineers actually say over rare compact phrasing, in grammatically complete sentences. When explicitly asked to use bullets or ordered lists and structure legitimately helps the reader, prefer nested bullets (any depth is fine) over dense lines in a flat structure
 
@@ -54,21 +54,21 @@ Don't hesitate to use values in .env to get needed API keys and other secrets, a
 
 Python max line length is 120, not 88
 
-Never edit or commit `ruff-strict-budget.json`, `type-discipline-budget.json`, `basedpyright-code-budget.json`, or `test-quality-budget.json` on a PR branch, and don't run `make lint-budget-update` there. A scheduled Devin automation lowers the limits on the default branch in its own PR by exactly what landed since the last ratchet, so concurrent PRs don't fight over the same `"limit"` lines. Keep the hosted automation's target in sync when the repository default changes. If your branch already carries a budget edit, drop it before opening the PR
+The five lint gates (`scripts/ruff_strict_gate.py`, `scripts/type_discipline_gate.py`, `scripts/test_quality_gate.py`, `scripts/openapi_docs_gate.py`, `scripts/type_check_gate.py`) compare each rule's codebase count on your branch against the count at its merge-base with the default branch, and a rule may not grow. There are no budget files to edit or ratchet: when a gate fails, fix the violations the branch introduced or remove at least as many of that rule elsewhere in the tree. The one exception is `reportAny` / `reportExplicitAny`, which share a fixed codebase-wide cap in `ANY_CAPS` in `scripts/type_check_gate.py` because Any spreads past the lines you touch. A branch may add Anys while the total stays under that cap. Only lower `ANY_CAPS`, and only in its own PR to the default branch, never raise it on a feature branch
 
 `make check` (f.k.a. `make pre-commit`, which still works identically as an alias) saves its complete output to a log file in .git (overwriting previous logs) and prints that path as its first and last output lines. To inspect a run, read or grep that log instead of re-running the multi-minute checks just to see a different slice
 
-`make check`, `make lint`, `scripts/pre_commit_lint.sh`, and the standalone budget gates (`scripts/ruff_strict_gate.py`, `scripts/type_discipline_gate.py`, `scripts/type_check_gate.py`) each hold one of 2 machine-wide slots, so when other sessions or worktrees on the same box are already running heavy work, yours prints "all N machine-wide slots are busy; queueing" and then stays quiet until a slot frees. Give the command a long timeout and let it wait rather than killing it, retrying it, or assuming it hung. Don't change the # of machine-wide slots or make it unlimited by setting `LITELLM_GATE_SLOTS=0`
+`make check`, `make lint`, `scripts/pre_commit_lint.sh`, and the standalone lint gates (`scripts/ruff_strict_gate.py`, `scripts/type_discipline_gate.py`, `scripts/type_check_gate.py`) each hold one of 2 machine-wide slots, so when other sessions or worktrees on the same box are already running heavy work, yours prints "all N machine-wide slots are busy" followed by "queueing" and then stays quiet until a slot frees. Give the command a long timeout and let it wait rather than killing it, retrying it, or assuming it hung. Don't change the # of machine-wide slots or make it unlimited by setting `LITELLM_GATE_SLOTS=0`
 
-If you're trying to create a new function that relies on untyped stuff, instead of adding more Any's and pushing `reportAny` / `reportExplicitAny` closer to their basedpyright ceilings, just validate it in the caller with Pydantic (a model or `TypeAdapter` that returns the typed thing or raises will do) and then pass the now typed variable in
+If you're trying to create a new function that relies on untyped stuff, instead of adding more Any's and pushing `reportAny` / `reportExplicitAny` closer to their cap in `ANY_CAPS`, just validate it in the caller with Pydantic (a model or `TypeAdapter` that returns the typed thing or raises will do) and then pass the now typed variable in
 
-If you get an LIT001 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `MappingProxyType()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally, `# mutable-ok` is never used; reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason
+If you get an LIT001 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `MappingProxyType()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally, `# mutable-ok` is never used. Reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason
 
 Every lint or type suppression must name the exact rule inside brackets and carry a reason comment, e.g. `# pyright: ignore[reportArgumentType]  # stubs lack async overload` or `# noqa: TID251  # <reason>`. `# type: ignore` is banned (LIT009): pyrightconfig.json sets `enableTypeIgnoreComments` to false, so it silently does nothing
 
 Commit and push your work when you're done without asking
 
-When referencing or running models (coding, QA'ing, writing docs, writing tests, etc.), use the latest model in that model family unless otherwise specified; treat your training knowledge, memories, configs, and tests as stale, and determine the family's latest with model_prices_and_context_window.json or the web
+When referencing or running models (coding, QA'ing, writing docs, writing tests, etc.), use the latest model in that model family unless otherwise specified. Treat your training knowledge, memories, configs, and tests as stale, and determine the family's latest with model_prices_and_context_window.json or the web
 
 Always pull before starting any work. The checkout or worktree may be sitting on a stale branch
 
@@ -84,7 +84,7 @@ Monkeypatching attributes of a class to do testing is an anti-pattern. Prefer de
 
 Do not put names of customers or customer company names in code, PR descriptions, issue bodies, etc. This means never mention literally any company name. Especially if you're about to say a sentence mentioning that the reason the PR exists was a feature/model/bug fix/etc. requested by a company. That's the indication that you should replace that company name with "the customer". e.g. not "Model request from Acme (Pylon #1234)" but "Model request from a customer (Pylon #1234)". This is because the codebase is public. The only exception is for publicly known providers or vendors such as OpenAI, Anthropic, AWS Bedrock, etc. only IF we're adding support for that provider/vendor in general and NOT if that PR or whatnot was a request by one of them, and they're actually one of our customers.
 
-CI supply-chain safety: Never pipe a remote script into a shell (`curl ... | bash`, `wget ... | sh`); download the artifact to a file, verify its SHA-256 checksum, then install. Pin every external tool to a specific version with a full URL (not `latest` or `stable`). Verify checksums for all downloaded binaries, using the provider's official `.sha256` / `.sha256sum` sidecar when available. These rules apply to every download in CI
+CI supply-chain safety: Never pipe a remote script into a shell (`curl ... | bash`, `wget ... | sh`). Download the artifact to a file, verify its SHA-256 checksum, then install. Pin every external tool to a specific version with a full URL (not `latest` or `stable`). Verify checksums for all downloaded binaries, using the provider's official `.sha256` / `.sha256sum` sidecar when available. These rules apply to every download in CI
 
 Prisma migrations apply synchronously at proxy boot, before it serves traffic, so a migration must only change schema, never rewrite rows. No `UPDATE`, `DELETE` or `MERGE`, and no `INSERT ... SELECT`: on a spend-log-sized table any of those is minutes of downtime plus a doubled heap that plain autovacuum won't give back. `tests/code_coverage_tests/check_migrations_no_data_rewrites.py` enforces this. When a rewrite is genuinely bounded and has to ship inside the migration, mark the statement `-- data-migration-ok: <what bounds it>`
 
@@ -92,18 +92,19 @@ Follow these coding conventions for new/updated code (a three-line fix in a lega
 
 - Composition over inheritance
 - Never-nester: early returns over deep nesting
-- Don't throw; model failures as values (One function (e.g., raise_public) maps error union to existing public exception contracts via exhaustive match + assert_never)
-- No mutation; don't reassign variables, global or local. Instead of mutable lists and dicts, prefer tuples, frozen dataclasses (with slots=True), `MappingProxyType`, etc.
-  - Annotate every variable with `: Final` (LIT010). Unpacking and walrus targets cannot carry the annotation, so they are implicitly final. Don't rebind them. Never rebind or mutate function parameters (LIT011); `self`/`cls` attribute stores are the exception. If rebinding or in-place mutation is truly unavoidable, suppress with `# rebind-ok: <reason>`
+- Don't throw. Model failures as values (One function (e.g., raise_public) maps error union to existing public exception contracts via exhaustive match + assert_never)
+- No mutation. Don't reassign variables, global or local. Instead of mutable lists and dicts, prefer tuples, frozen dataclasses (with slots=True), `MappingProxyType`, etc.
+  - Annotate every variable with `: Final` (LIT010). Unpacking and walrus targets cannot carry the annotation, so they are implicitly final. Don't rebind them. Never rebind or mutate function parameters (LIT011). `self`/`cls` attribute stores are the exception. If rebinding or in-place mutation is truly unavoidable, suppress with `# rebind-ok: <reason>`
   - Qualify every TypedDict field with `ReadOnly[...]` (LIT012), which nests freely with `Required` / `NotRequired` / `Annotated` in any order. If making the key writable is truly unavoidable, suppress with `# writable-ok: <reason>`
-  - Comprehensions take at most one `for` clause and one `if` clause (LIT014); split stacked clauses into a helper generator, a named intermediate, or a plain loop. Suppress with `# comprehension-ok: <reason>` only when unavoidable
+  - Comprehensions take at most one `for` clause and one `if` clause (LIT014). Split stacked clauses into a helper generator, a named intermediate, or a plain loop. Suppress with `# comprehension-ok: <reason>` only when unavoidable
+  - Every pydantic model must be frozen (LIT015), set via `model_config = ConfigDict(frozen=True)`, a dict-literal `model_config`, an inner `class Config`, or the class keywords. Subclasses inherit it unless they override it. Replace in-place field writes with `model_copy(update=...)`. If making the model mutable is truly unavoidable, suppress with `# frozen-ok: <reason>` on the `class` line
 - Use dependency injection
-- Fully typed; no `Any` or coarse types like `dict[str, Any]` or just `dict`. Every function parameter must be strongly typed
+- Fully typed. No `Any` or coarse types like `dict[str, Any]` or just `dict`. Every function parameter must be strongly typed
 - Use tagged unions + match
 - No monster files or god objects
 - No file sprawl: deliberate file and folder structure
-- Standard over hand-rolled: use the official SDK or a library where one exists; where none does, follow industry standards instead of inventing local conventions
-- API-fragmentation-aware: when logic must branch on which API surface produced or consumes data (e.g. chat completions vs Anthropic Messages vs Responses API shapes), proactively look for an existing shared helper (e.g. `litellm_core_utils/prompt_templates/factory.py`) before writing per-surface parsing in the new module; if none exists, add one there instead of duplicating the same format-detection logic in every new guardrail/integration
+- Standard over hand-rolled: use the official SDK or a library where one exists. Where none does, follow industry standards instead of inventing local conventions
+- API-fragmentation-aware: when logic must branch on which API surface produced or consumes data (e.g. chat completions vs Anthropic Messages vs Responses API shapes), proactively look for an existing shared helper (e.g. `litellm_core_utils/prompt_templates/factory.py`) before writing per-surface parsing in the new module. If none exists, add one there instead of duplicating the same format-detection logic in every new guardrail/integration
 
 Follow conventional commits for commit names and PR titles
 
@@ -129,4 +130,4 @@ Before implementing:
 
 Ask yourself: "Would a senior engineer say this is overcomplicated?" If yes, simplify
 
-Before requesting maintainer review, verify the current PR tip passes required CI and code coverage, meets Greptile confidence of at least 4/5, and has acceptable Veria and Bugbot reviews. Inspect warnings and findings, fix actionable issues, and rerun the affected checks and reviewers after changes. Record evidence for any false positive or unavailable review; never treat a pending or missing bot result as a pass. Do not lower coverage thresholds or lint budgets to satisfy a check
+Before requesting maintainer review, verify the current PR tip passes required CI and code coverage and has acceptable reviews from the review bots on the PR, such as Veria and Bugbot. Inspect warnings and findings, fix actionable issues, and rerun the affected checks and reviewers after changes. Record evidence for any false positive or unavailable review. Never treat a pending or missing bot result as a pass. Do not lower coverage thresholds or raise `ANY_CAPS` to satisfy a check

Dockerfile

@@ -9,8 +9,8 @@ ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
 ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
 # Checksum from https://www.pgbouncer.org/downloads/ (the Wolfi repo only carries 1.24.x)
-ARG PGBOUNCER_VERSION=1.25.2
-ARG PGBOUNCER_SHA256=924ad35113fd0a71c8e2dbe85b5d03445532e2b7b37a9f8a48983beea238b332
+ARG PGBOUNCER_VERSION=1.26.0
+ARG PGBOUNCER_SHA256=afd25dd61ee6775d37b40629b87ce08736b3e6955f3057bb212e410fbf21c71d
 
 FROM $UV_IMAGE AS uvbin
 
@@ -39,6 +39,7 @@ ENV NEXT_TELEMETRY_DISABLED=1 \
 WORKDIR /ui
 
 COPY ui/litellm-dashboard/package.json ui/litellm-dashboard/package-lock.json ./
+COPY ui/litellm-dashboard/vendor/ ./vendor/
 RUN --mount=type=cache,target=/root/.npm npm ci --prefer-offline
 
 COPY ui/litellm-dashboard/ ./
@@ -79,6 +80,7 @@ COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
 RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
     --extra proxy \
     --extra proxy-runtime \
+    --group admin-mcp \
     --extra extra_proxy \
     --extra semantic-router \
     --extra saml \
@@ -101,6 +103,7 @@ RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.
 RUN uv sync --frozen --no-default-groups --no-editable \
     --extra proxy \
     --extra proxy-runtime \
+    --group admin-mcp \
     --extra extra_proxy \
     --extra semantic-router \
     --extra saml \
@@ -114,8 +117,20 @@ RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/
 RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
     sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
+FROM $LITELLM_BUILD_IMAGE AS liteadmin-builder
+COPY --from=uvbin /uv /usr/local/bin/uv
+RUN apk add --no-cache python-3.13
+ADD --checksum=sha256:2f7ae5cdd9d91731c0990e74a58239dc3e3fd2bf28dab23b55eafcdc47aaf87e \
+    https://github.com/BerriAI/litellm-admin-agent/archive/ef501e94bc9fbacb9233b922abf71427f030408c.tar.gz /tmp/liteadmin.tar.gz
+RUN mkdir /tmp/liteadmin && tar xzf /tmp/liteadmin.tar.gz --strip-components=1 -C /tmp/liteadmin && \
+    uv venv /opt/liteadmin --python python3.13 && \
+    uv pip install --python /opt/liteadmin/bin/python --require-hashes -r /tmp/liteadmin/requirements.txt && \
+    uv pip install --python /opt/liteadmin/bin/python --no-deps /tmp/liteadmin
+
 # Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
+ARG LITELLM_RELEASE_TAG=""
+ENV LITELLM_RELEASE_TAG=${LITELLM_RELEASE_TAG}
 
 USER root
 
@@ -141,6 +156,7 @@ ENV PATH="/app/.venv/bin:${PATH}" \
 # ship (manifest-scanning tools attribute everything in it to this image).
 # entrypoint.sh invokes litellm/proxy/prisma_migration.py by source path.
 COPY --from=builder /app/.venv /app/.venv
+COPY --from=liteadmin-builder /opt/liteadmin /opt/liteadmin
 COPY --from=builder /app/docker /app/docker
 COPY --from=builder /app/schema.prisma /app/schema.prisma
 COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/prisma_migration.py

Makefile

@@ -6,9 +6,8 @@
 	test-proxy-unit-a test-proxy-unit-b test-integration test-unit-helm \
 	test-rust-extension rust-sqlx-prepare \
 	info lint lint-inner lint-dev lint-checks format \
-	lint-basedpyright lint-e2e-basedpyright lint-basedpyright-budget-update lint-type-discipline lint-type-discipline-budget-update \
-	lint-ruff-budget lint-ruff-budget-update lint-budget-update lint-gate \
-	lint-test-quality lint-test-quality-budget-update \
+	lint-basedpyright lint-e2e-basedpyright lint-type-discipline \
+	lint-ruff-strict lint-gate lint-test-quality lint-openapi-docs \
 	install-dev install-proxy-dev install-test-deps install-hooks \
 	install-helm-unittest check-circular-imports check-import-safety check check-inner pre-commit \
 	lint-install lint-fetch-base bootstrap
@@ -31,18 +30,16 @@ help:
 	@echo "  make lint               - Run all linting (Ruff, basedpyright, format check, circular imports, import safety)"
 	@echo "  make lint-ruff          - Run Ruff linting only"
 	@echo "  make lint-basedpyright  - Run basedpyright strict, gated by per-rule error counts"
-	@echo "  make lint-e2e-basedpyright - Run basedpyright over tests/e2e (zero errors allowed)"
-	@echo "  make lint-basedpyright-budget-update - Ratchet basedpyright limits down by what this branch fixed"
+	@echo "  make lint-e2e-basedpyright - Run basedpyright over tests/e2e and tests/e2e_harness (zero errors allowed)"
 	@echo "  make lint-format        - Check ruff format formatting (matches CI)"
-	@echo "  make lint-ruff-budget - Gate the codebase total of each strict ruff rule against its limit"
+	@echo "  make lint-ruff-strict   - Gate each strict ruff rule's codebase total against its merge-base count"
 	@echo "  make lint-gate        - Strict ruff gate in CI-parity mode (fetches the default branch, simulates the merge)"
-	@echo "  make lint-ruff-budget-update - Ratchet ruff-strict-budget.json limits down by what this branch fixed"
-	@echo "  make lint-test-quality  - Gate the test suite against test-quality-budget.json"
-	@echo "  make lint-budget-update - Ratchet all budgets down (ruff + type-discipline + test quality + basedpyright)"
+	@echo "  make lint-test-quality  - Gate the test suite's TQ counts against their merge-base counts"
+	@echo "  make lint-openapi-docs  - Gate undocumented POST routes in the proxy OpenAPI document against their merge-base counts"
 	@echo "  make check-circular-imports - Check for circular imports"
 	@echo "  make check-import-safety - Check import safety"
 	@echo "  make test               - Run all tests"
-	@echo "  make test-unit          - Run unit tests (tests/unit and tests/test_litellm)"
+	@echo "  make test-unit          - Run unit tests (tests/unit)"
 	@echo "  make test-unit-llms     - Run LLM provider tests (~225 files)"
 	@echo "  make test-unit-proxy-guardrails - Run proxy guardrails+mgmt tests (~51 files)"
 	@echo "  make test-unit-proxy-core - Run proxy auth+client+db+hooks tests (~52 files)"
@@ -140,9 +137,9 @@ format-check: install-dev
 lint-fetch-base:
 	@$(RESOLVE_BASE)
 
-# Mirror test-linting.yml's lint job environment: the proxy-dev group plus a generated
+# Mirror test-linting.yml's python job environment: the proxy-dev group plus a generated
 # Prisma client, so `basedpyright tests/e2e` resolves the same modules CI does. The
-# budget gate itself no longer measures here (scripts/type_check_gate.py provisions its
+# basedpyright gate itself no longer measures here (scripts/type_check_gate.py provisions its
 # own .venv-typecheck). --inexact tops up the venv instead of pruning the proxy extras
 # gen:api and the running proxy need.
 lint-install:
@@ -210,27 +207,28 @@ lint-basedpyright: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 	$(UV_RUN) python scripts/type_check_gate.py --base "$(BASE_REF)"
 
 lint-e2e-basedpyright: $(LINT_E2E_DEP_INSTALL)
-	$(UV_RUN) basedpyright tests/e2e
+	$(UV_RUN) basedpyright tests/e2e tests/e2e_harness
 
-# Type-discipline budget (mutable collections / casts / type guards / kwargs /
+# Type-discipline gate (mutable collections / casts / type guards / kwargs /
 # unexplained suppressions), the test-linting.yml step `make lint` used to omit.
 lint-type-discipline: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 	$(UV_RUN) python scripts/type_discipline_gate.py --base "$(BASE_REF)"
 
-# Test-quality budget (zero-assert / mock-echo tests, sys.path.insert, raw env writes,
+# Test-quality gate (zero-assert / mock-echo tests, sys.path.insert, raw env writes,
 # litellm module-global mutation, credential-gated skips, conftest snapshot
 # inventory), counted across tests/ the same delta-vs-base way.
 lint-test-quality: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 	$(UV_RUN) python scripts/test_quality_gate.py --base "$(BASE_REF)"
 
-# --update lowers each limit by what this branch fixed since its branch point, so
-# it needs the base ref fetched to resolve the merge-base.
-lint-basedpyright-budget-update: install-dev
-	$(UV_RUN) python scripts/type_check_gate.py --update --base "$(BASE_REF)"
+# OpenAPI docs gate (POST routes without a request body schema, a description or a
+# 200 schema in app.openapi()), counted the same delta-vs-base way so a new endpoint
+# has to show up documented in Swagger UI.
+lint-openapi-docs: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
+	$(UV_RUN) python scripts/openapi_docs_gate.py --base "$(BASE_REF)"
 
 lint-format: format-check
 
-lint-ruff-budget: install-dev
+lint-ruff-strict: install-dev
 	$(UV_RUN) python scripts/ruff_strict_gate.py --base "$(BASE_REF)"
 
 # Strict gate, invoked the same way CI does in test-linting.yml so a local pass
@@ -238,28 +236,16 @@ lint-ruff-budget: install-dev
 lint-gate: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 	$(UV_RUN) python scripts/ruff_strict_gate.py --base "$(BASE_REF)"
 
-lint-ruff-budget-update: install-dev
-	$(UV_RUN) python scripts/ruff_strict_gate.py --update --base "$(BASE_REF)"
-
-lint-type-discipline-budget-update: install-dev
-	$(UV_RUN) python scripts/type_discipline_gate.py --update --base "$(BASE_REF)"
-
-lint-test-quality-budget-update: install-dev
-	$(UV_RUN) python scripts/test_quality_gate.py --update --base "$(BASE_REF)"
-
-# Ratchet all budgets in one shot (ruff strict + type-discipline + test quality + basedpyright)
-lint-budget-update: lint-ruff-budget-update lint-type-discipline-budget-update lint-test-quality-budget-update lint-basedpyright-budget-update
-
 check-circular-imports: $(LINT_DEP_INSTALL)
 	cd litellm && $(UV_RUN) python ../tests/documentation_tests/test_circular_imports.py && cd ..
 
 check-import-safety: $(LINT_DEP_INSTALL)
 	@$(UV_RUN) python -c "from litellm import *; print('[from litellm import *] OK! no issues!');" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
 
-# Combined linting, isomorphic to test-linting.yml's lint job so a local pass means a
+# Combined linting, isomorphic to test-linting.yml's python job so a local pass means a
 # green CI lint: it installs the same env (proxy-dev + generated Prisma client) and then
 # runs the diff-scoped ruff format check, whole-tree ruff check, the strict-rule /
-# type-discipline / basedpyright budgets as a delta vs the base, then the circular-import
+# type-discipline / basedpyright gates as a delta vs the base, then the circular-import
 # and import-safety checks. Steps that compare against the base resolve it the same way CI
 # does (merge-base with origin's current default branch). Setup (env sync, Prisma client,
 # base fetch) runs once up front; the checks themselves are independent, so a sub-make
@@ -271,7 +257,7 @@ lint-inner: lint-install
 	@base_ref=$$($(RESOLVE_BASE)) && \
 	$(MAKE) BASE_REF="$$base_ref" -j $(LINT_JOBS) $(LINT_OUTPUT_SYNC) LINT_DEP_INSTALL= LINT_E2E_DEP_INSTALL= LINT_DEP_BASE= lint-checks
 
-lint-checks: lint-format-check-changed lint-ruff lint-gate lint-type-discipline lint-test-quality lint-basedpyright lint-e2e-basedpyright check-circular-imports check-import-safety
+lint-checks: lint-format-check-changed lint-ruff lint-gate lint-type-discipline lint-test-quality lint-openapi-docs lint-basedpyright lint-e2e-basedpyright check-circular-imports check-import-safety
 
 # Faster linting for local development (only checks changed code)
 lint-dev: lint-format-changed check-circular-imports check-import-safety
@@ -280,8 +266,7 @@ lint-dev: lint-format-changed check-circular-imports check-import-safety
 # is staged (warning about changed files left unstaged); with nothing staged it falls
 # back to the working tree's diff against the merge base with the base branch, so a
 # fresh merge commit or an unstaged working tree still gets checked. Mirrors
-# test-linting.yml (Python), test-litellm-ui-build.yml's frontend-lint (dashboard), and
-# check-ui-api-types.yml (API-type drift), skipping any whose files aren't in scope.
+# test-linting.yml (Python, UI, and API types), skipping any whose files aren't in scope.
 # Not auto-installed as a git hook so it never slows an unrelated human commit.
 check:
 	@$(GATE_SLOT_LOCK) $(MAKE) check-inner
@@ -315,7 +300,7 @@ test: install-test-deps
 	$(UV_RUN) pytest tests/
 
 test-unit: install-test-deps
-	$(UV_RUN) pytest tests/unit tests/test_litellm -x -vv -n 4
+	$(UV_RUN) pytest tests/unit -x -vv -n 4
 
 # Matrix test targets (matching CI workflow groups)
 test-unit-llms: install-test-deps
@@ -343,7 +328,7 @@ test-unit-other: install-test-deps
 	$(UV_RUN) pytest tests/unit/caching tests/unit/responses tests/unit/secret_managers tests/unit/vector_stores tests/unit/a2a_protocol tests/unit/completion_extras tests/unit/containers tests/unit/enterprise tests/unit/experimental_mcp_client tests/unit/google_genai tests/unit/images tests/unit/interactions tests/unit/router_strategy tests/unit/router_utils tests/unit/types --tb=short -vv -n 4 --durations=20
 
 test-unit-root: install-test-deps
-	$(UV_RUN) pytest tests/unit/test_*.py tests/test_litellm/test_*.py --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/test_*.py --tb=short -vv -n 4 --durations=20
 
 # Proxy unit tests (tests/unit/proxy split alphabetically)
 test-proxy-unit-a: install-test-deps
@@ -353,7 +338,7 @@ test-proxy-unit-b: install-test-deps
 	$(UV_RUN) pytest tests/unit/proxy/test_[p-z]*.py tests/unit/skills --tb=short -vv -n 2 --durations=20
 
 test-integration: install-test-deps
-	$(UV_RUN) pytest tests/ -k "not test_litellm"
+	$(UV_RUN) pytest tests/
 
 test-unit-helm: install-helm-unittest
 	helm unittest -f 'tests/*.yaml' helm/litellm-helm

README.md

@@ -90,6 +90,24 @@ Managing LLM calls across providers gets complicated fast — different SDKs, au
 uv add litellm
 ```
 
+An independent `litellm-core` distribution provides the Python SDK with the same
+`import litellm` API and runtime dependencies. It has no optional extras, CLI entry
+points, or bundled dashboard. Install one SDK distribution per environment because
+`litellm` and `litellm-core` own overlapping Python files. Use `litellm` for the
+proxy, CLI, and optional extras
+
+Build and install core from this checkout while its release integration is pending:
+
+```shell
+python scripts/build_core_distribution.py --out-dir dist/core
+python -m pip install dist/core/litellm_core-*.whl
+```
+
+The builder requires Git, `uv` and the Rust build toolchain. It reads the release version
+from the root `pyproject.toml`, leaves source files unchanged, and produces a wheel
+and a self-contained sdist in `dist/core`. Run installation in a fresh environment
+without `litellm`
+
 ```python
 from litellm import completion
 import os
@@ -389,17 +407,20 @@ Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call th
 | [Sagemaker Chat (`sagemaker_chat`)](https://docs.litellm.ai/docs/providers/aws_sagemaker) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Sail (`sail`)](https://docs.litellm.ai/docs/providers/sail) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Sambanova (`sambanova`)](https://docs.litellm.ai/docs/providers/sambanova) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [ScaleDown (`scaledown`)](https://docs.litellm.ai/docs/providers/scaledown) | ✅ |  |  |  |  |  |  |  |  |  |
 | [Snowflake (`snowflake`)](https://docs.litellm.ai/docs/providers/snowflake) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [Strands Decider (`strands_decider`)](https://docs.litellm.ai/docs/providers) |  |  |  |  |  |  |  |  |  |  |
 | [Text Completion Codestral (`text-completion-codestral`)](https://docs.litellm.ai/docs/providers/codestral) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Text Completion OpenAI (`text-completion-openai`)](https://docs.litellm.ai/docs/providers/text_completion_openai) | ✅ | ✅ | ✅ |  |  | ✅ | ✅ | ✅ | ✅ |  |
 | [Together AI (`together_ai`)](https://docs.litellm.ai/docs/providers/togetherai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Topaz (`topaz`)](https://docs.litellm.ai/docs/providers/topaz) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Triton (`triton`)](https://docs.litellm.ai/docs/providers/triton-inference-server) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [Typesafe Decisions API (`typesafe`)](https://docs.litellm.ai/docs/providers) |  |  |  |  |  |  |  |  |  |  |
 | [V0 (`v0`)](https://docs.litellm.ai/docs/providers/v0) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Vercel AI Gateway (`vercel_ai_gateway`)](https://docs.litellm.ai/docs/providers/vercel_ai_gateway) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [VLLM (`vllm`)](https://docs.litellm.ai/docs/providers/vllm) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Volcengine (`volcengine`)](https://docs.litellm.ai/docs/providers/volcano) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
-| [Voyage AI (`voyage`)](https://docs.litellm.ai/docs/providers/voyage) |  |  |  | ✅ |  |  |  |  |  |  |
+| [VoyageAI by MongoDB (`voyage`)](https://docs.litellm.ai/docs/providers/voyage) |  |  |  | ✅ |  |  |  |  |  |  |
 | [WandB Inference (`wandb`)](https://docs.litellm.ai/docs/providers/wandb_inference) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Watsonx Text (`watsonx_text`)](https://docs.litellm.ai/docs/providers/watsonx) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [xAI (`xai`)](https://docs.litellm.ai/docs/providers/xai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |

backend/Dockerfile

@@ -44,6 +44,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
         --extra proxy \
         --extra proxy-runtime \
+        --group admin-mcp \
         --extra extra_proxy \
         --extra semantic-router \
         --extra saml \
@@ -56,6 +57,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-default-groups --no-editable \
         --extra proxy \
         --extra proxy-runtime \
+        --group admin-mcp \
         --extra extra_proxy \
         --extra semantic-router \
         --extra saml \
@@ -71,6 +73,8 @@ RUN sed -i 's/\r$//' docker/component_entrypoint.sh && chmod +x docker/component
 
 # ---------- Runtime ----------
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
+ARG LITELLM_RELEASE_TAG=""
+ENV LITELLM_RELEASE_TAG=${LITELLM_RELEASE_TAG}
 
 USER root
 

backend/routes/allowlist.py

@@ -22,6 +22,8 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
     "/customer/",
     "/end_user/",
     "/sso/",
+    "/liteadmin/slack/connect/",
+    "/moyai/connect/",
     "/login",
     "/v2/login",
     "/v3/login",
@@ -84,13 +86,15 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
     "/analytics/",
     "/lens/",
     "/v1/traces",
+    "/v1/logs",
     "/global/",
     "/user_agent",
     "/usage/",
     "/daily/",
-    # Deployment-wide gateway request counts. Scoped to the analytics read rather
+    # Deployment-wide gateway request and error counts. Scoped to the analytics reads rather
     # than all of /gateway/, which stays free for data-plane routes.
     "/gateway/daily/",
+    "/gateway/errors/",
     # CloudZero cost-export admin (init / settings / export / dry-run / delete)
     "/cloudzero/",
     # Caching admin
@@ -159,6 +163,7 @@ BACKEND_EXACT_PATHS: frozenset[str] = frozenset(
 
 BACKEND_MOUNT_PATHS: frozenset[str] = frozenset(
     {
+        "/admin",
         "/swagger",  # API documentation static assets belong to the backend
         "/mcp",  # lazily-mounted MCP sub-app serves on the backend component
     }

basedpyright-code-budget.json

@@ -1,146 +0,0 @@
-{
-  "reportAny": {
-    "limit": 13429
-  },
-  "reportArgumentType": {
-    "limit": 2198
-  },
-  "reportAssignmentType": {
-    "limit": 319
-  },
-  "reportAttributeAccessIssue": {
-    "limit": 480
-  },
-  "reportCallIssue": {
-    "limit": 112
-  },
-  "reportConstantRedefinition": {
-    "limit": 40
-  },
-  "reportDeprecated": {
-    "limit": 209
-  },
-  "reportDuplicateImport": {
-    "limit": 19
-  },
-  "reportExplicitAny": {
-    "limit": 3369
-  },
-  "reportFunctionMemberAccess": {
-    "limit": 7
-  },
-  "reportGeneralTypeIssues": {
-    "limit": 101
-  },
-  "reportIncompatibleMethodOverride": {
-    "limit": 56
-  },
-  "reportIncompatibleVariableOverride": {
-    "limit": 8
-  },
-  "reportInconsistentOverload": {
-    "limit": 12
-  },
-  "reportIndexIssue": {
-    "limit": 24
-  },
-  "reportInvalidTypeForm": {
-    "limit": 30
-  },
-  "reportInvalidTypeVarUse": {
-    "limit": 1
-  },
-  "reportMatchNotExhaustive": {
-    "limit": 0
-  },
-  "reportMissingParameterType": {
-    "limit": 5570
-  },
-  "reportMissingTypeArgument": {
-    "limit": 15281
-  },
-  "reportMissingTypeStubs": {
-    "limit": 40
-  },
-  "reportOperatorIssue": {
-    "limit": 0
-  },
-  "reportOptionalCall": {
-    "limit": 0
-  },
-  "reportOptionalIterable": {
-    "limit": 0
-  },
-  "reportOptionalMemberAccess": {
-    "limit": 0
-  },
-  "reportOptionalOperand": {
-    "limit": 0
-  },
-  "reportOptionalSubscript": {
-    "limit": 0
-  },
-  "reportPossiblyUnboundVariable": {
-    "limit": 56
-  },
-  "reportPrivateUsage": {
-    "limit": 1804
-  },
-  "reportRedeclaration": {
-    "limit": 8
-  },
-  "reportReturnType": {
-    "limit": 180
-  },
-  "reportTypedDictNotRequiredAccess": {
-    "limit": 22
-  },
-  "reportUndefinedVariable": {
-    "limit": 0
-  },
-  "reportUnknownArgumentType": {
-    "limit": 44802
-  },
-  "reportUnknownLambdaType": {
-    "limit": 109
-  },
-  "reportUnknownMemberType": {
-    "limit": 38269
-  },
-  "reportUnknownParameterType": {
-    "limit": 19584
-  },
-  "reportUnknownVariableType": {
-    "limit": 29814
-  },
-  "reportUnnecessaryCast": {
-    "limit": 110
-  },
-  "reportUnnecessaryComparison": {
-    "limit": 687
-  },
-  "reportUnnecessaryContains": {
-    "limit": 4
-  },
-  "reportUnnecessaryIsInstance": {
-    "limit": 816
-  },
-  "reportUntypedBaseClass": {
-    "limit": 0
-  },
-  "reportUntypedFunctionDecorator": {
-    "limit": 27
-  },
-  "reportUnusedClass": {
-    "limit": 21
-  },
-  "reportUnusedFunction": {
-    "limit": 136
-  },
-  "reportUnusedImport": {
-    "limit": 542
-  },
-  "reportUnusedVariable": {
-    "limit": 137
-  }
-}

ci_cd/TEST_KEY_PATTERNS.md

@@ -5,7 +5,7 @@ Standard patterns for test/mock keys and credentials in the LiteLLM codebase to
 ## How GitGuardian Works
 
 GitGuardian uses **machine learning and entropy analysis**, not just pattern matching:
-- **Low entropy** values (like `sk-1234`, `postgres`) are automatically ignored
+- **Low entropy** values (like `sk-test`, `postgres`) are automatically ignored
 - **High entropy** values (realistic-looking secrets) trigger detection
 - **Context-aware** detection understands code syntax like `os.environ["KEY"]`
 
@@ -15,8 +15,8 @@ GitGuardian uses **machine learning and entropy analysis**, not just pattern mat
 These won't trigger GitGuardian's ML detector:
 
 ```python
-api_key = "sk-1234"
-api_key = "sk-12345"
+api_key = "sk-test"
+api_key = "sk-mock"
 database_password = "postgres"
 token = "test123"
 ```

ci_cd/cost_map_guard.py

@@ -14,8 +14,9 @@ import argparse
 import json
 import subprocess
 import sys
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from dataclasses import dataclass
+from types import MappingProxyType
 from typing import Final
 
 from generate_model_prices_schema import SPECIAL_ROOT_KEYS, build_schema, render, validation_errors
@@ -25,6 +26,7 @@ BACKUP_PATH: Final = "litellm/model_prices_and_context_window_backup.json"
 SCHEMA_PATH: Final = "model_prices_and_context_window.schema.json"
 GUARDED_PATHS: Final = (COST_MAP_PATH, BACKUP_PATH, SCHEMA_PATH)
 BOT_BRANCH_PREFIX: Final = "litellm_cost_map_sync_"
+EVALUATION_OUTPUT_PRICE_SOURCES: Final[Mapping[str, str]] = MappingProxyType({})
 
 CostMap = dict[str, object]
 
@@ -51,7 +53,31 @@ def _rendered_schema(cost_map: CostMap) -> str:
         return str(error)
 
 
-def _file_failures(head: Snapshot, head_map: CostMap) -> tuple[str, ...]:
+def _evaluation_output_price_failure(
+    key: str, entry: object, evaluation_output_price_sources: Mapping[str, str]
+) -> str | None:
+    if not isinstance(entry, dict) or entry.get("mode") != "evaluation":
+        return None
+    output_cost: Final = entry.get("output_cost_per_token")
+    if (
+        not isinstance(output_cost, (int, float))
+        or isinstance(output_cost, bool)
+        or output_cost <= 0
+        or key in evaluation_output_price_sources
+    ):
+        return None
+    return (
+        f"{key}: mode evaluation rows bill input only; output_cost_per_token must be 0 unless the vendor "
+        "prices output tokens for this model (add the source to EVALUATION_OUTPUT_PRICE_SOURCES)"
+    )
+
+
+def _file_failures(
+    head: Snapshot,
+    head_map: CostMap,
+    *,
+    evaluation_output_price_sources: Mapping[str, str] = EVALUATION_OUTPUT_PRICE_SOURCES,
+) -> tuple[str, ...]:
     schema_text: Final = _rendered_schema(head_map)
     if not schema_text.startswith("{"):
         return (schema_text,)
@@ -75,6 +101,16 @@ def _file_failures(head: Snapshot, head_map: CostMap) -> tuple[str, ...]:
             f"{COST_MAP_PATH} does not validate against its schema: {error}"
             for error in validation_errors(head_map, json.loads(schema_text))[:20]
         ),
+        *(
+            failure
+            for key, entry in head_map.items()
+            if (
+                failure := _evaluation_output_price_failure(
+                    key, entry, evaluation_output_price_sources
+                )
+            )
+            is not None
+        ),
     )
 
 
@@ -121,13 +157,25 @@ def contract_for(bot: bool, changed_files: Sequence[str]) -> str:
     return "human PR, file checks only" if touches_cost_map(changed_files) else "human PR, cost map untouched"
 
 
-def guard_failures(base: Snapshot, head: Snapshot, changed_files: Sequence[str], bot: bool) -> tuple[str, ...]:
+def guard_failures(
+    base: Snapshot,
+    head: Snapshot,
+    changed_files: Sequence[str],
+    bot: bool,
+    *,
+    evaluation_output_price_sources: Mapping[str, str] = EVALUATION_OUTPUT_PRICE_SOURCES,
+) -> tuple[str, ...]:
     if not bot and not touches_cost_map(changed_files):
         return ()
     head_map: Final = _parse_object(head.cost_map, COST_MAP_PATH)
     if isinstance(head_map, str):
         return (head_map,)
-    return (*_file_failures(head, head_map), *(_bot_failures(base, head_map, changed_files) if bot else ()))
+    return (
+        *_file_failures(
+            head, head_map, evaluation_output_price_sources=evaluation_output_price_sources
+        ),
+        *(_bot_failures(base, head_map, changed_files) if bot else ()),
+    )
 
 
 def _git(*args: str) -> str | None:

codecov.yaml

@@ -6,7 +6,7 @@ codecov:
 ignore:
   - "litellm-rust/**"
 
-# Uploads are flagged per workflow/shard (GHA) or "circleci". carryforward makes
+# Uploads are flagged per workflow tier (GHA) or "circleci". carryforward makes
 # a re-upload of a flag replace its prior session instead of accumulating a
 # conflicting one, and lets a commit reuse a flag from its parent when that flag
 # was not re-uploaded. Required because the same commit can receive the
@@ -27,6 +27,78 @@ flag_management:
       carryforward: false
     - name: circleci
       carryforward: false
+    - name: core-utils
+      carryforward: false
+    - name: enterprise-routing
+      carryforward: false
+    - name: integrations
+      carryforward: false
+    - name: llm-vertex-ai
+      carryforward: false
+    - name: llm-other-providers
+      carryforward: false
+    - name: llm-openai-meta
+      carryforward: false
+    - name: misc
+      carryforward: false
+    - name: misc-dirs
+      carryforward: false
+    - name: proxy-auth
+      carryforward: false
+    - name: proxy-hooks-client
+      carryforward: false
+    - name: proxy-endpoints
+      carryforward: false
+    - name: proxy-feature-endpoints
+      carryforward: false
+    - name: proxy-server
+      carryforward: false
+    - name: mcp-elicitation
+      carryforward: false
+    - name: proxy-infra
+      carryforward: false
+    - name: proxy-infra-root
+      carryforward: false
+    - name: caching-local
+      carryforward: false
+    - name: proxy-extras
+      carryforward: false
+    - name: enterprise-package
+      carryforward: false
+    - name: enterprise-managed-files
+      carryforward: false
+    - name: responses-caching-types
+      carryforward: false
+    - name: lens-python-310
+      carryforward: false
+    - name: lens-postgres
+      carryforward: false
+    - name: proxy-db-key-generation
+      carryforward: false
+    - name: proxy-db-auth-checks
+      carryforward: false
+    - name: proxy-db-jwt-and-keys
+      carryforward: false
+    - name: proxy-db-proxy-utils
+      carryforward: false
+    - name: proxy-db-proxy-server-core
+      carryforward: false
+    - name: proxy-db-proxy-runtime
+      carryforward: false
+    - name: proxy-db-mcp-oauth
+      carryforward: false
+    - name: proxy-db-custom-logging
+      carryforward: false
+    - name: proxy-db-logging-misc
+      carryforward: false
+    - name: proxy-db-db-and-spend
+      carryforward: false
+    - name: proxy-db-guardrails-hooks
+      carryforward: false
+    - name: proxy-db-budgets
+      carryforward: false
+    - name: proxy-db-endpoints-and-responses
+      carryforward: false
 
 component_management:
   individual_components:

cookbook/Migrating_to_LiteLLM_Proxy_from_OpenAI_Azure_OpenAI.ipynb

@@ -16,6 +16,8 @@
         "\n",
         "These are **selected examples**. LiteLLM Proxy is **OpenAI-Compatible**, it works with any project that calls OpenAI. Just change the `base_url`, `api_key` and `model`.\n",
         "\n",
+        "Set `LITELLM_MASTER_KEY` in the notebook environment to the same key configured on the proxy before running authenticated examples\n",
+        "\n",
         "For more examples, [go here](https://docs.litellm.ai/docs/proxy/user_keys)\n",
         "\n",
         "To pass provider-specific args, [go here](https://docs.litellm.ai/docs/completion/provider_specific_params#proxy-usage)\n",
@@ -95,9 +97,10 @@
       },
       "outputs": [],
       "source": [
+        "import os\n",
         "from openai import OpenAI\n",
         "client = OpenAI(\n",
-        "    api_key=\"sk-1234\", # [OPTIONAL] set if you set one on proxy, else set \"\"\n",
+        "    api_key=os.environ[\"LITELLM_MASTER_KEY\"],\n",
         "    base_url=\"http://0.0.0.0:4000\",\n",
         ")\n",
         "\n",
@@ -298,14 +301,14 @@
         "    engine=\"azure-gpt-3.5\",               # model_name on litellm proxy\n",
         "    temperature=0.0,\n",
         "    azure_endpoint=\"http://0.0.0.0:4000\", # litellm proxy endpoint\n",
-        "    api_key=\"sk-1234\",                    # litellm proxy API Key\n",
+        "    api_key=os.environ[\"LITELLM_MASTER_KEY\"],\n",
         "    api_version=\"2023-07-01-preview\",\n",
         ")\n",
         "\n",
         "embed_model = AzureOpenAIEmbedding(\n",
         "    deployment_name=\"azure-embedding-model\",\n",
         "    azure_endpoint=\"http://0.0.0.0:4000\",\n",
-        "    api_key=\"sk-1234\",\n",
+        "    api_key=os.environ[\"LITELLM_MASTER_KEY\"],\n",
         "    api_version=\"2023-07-01-preview\",\n",
         ")\n",
         "\n",
@@ -341,7 +344,7 @@
         "\n",
         "const model = new ChatOpenAI({\n",
         "  modelName: \"gpt-4\",\n",
-        "  openAIApiKey: \"sk-1234\",\n",
+        "  openAIApiKey: process.env.LITELLM_MASTER_KEY,\n",
         "  modelKwargs: {\"metadata\": \"hello world\"} // 👈 PASS Additional params here\n",
         "}, {\n",
         "  basePath: \"http://0.0.0.0:4000\",\n",
@@ -372,7 +375,7 @@
         "const { OpenAI } = require('openai');\n",
         "\n",
         "const openai = new OpenAI({\n",
-        "  apiKey: \"sk-1234\", // This is the default and can be omitted\n",
+        "  apiKey: process.env.LITELLM_MASTER_KEY,\n",
         "  baseURL: \"http://0.0.0.0:4000\"\n",
         "});\n",
         "\n",

cookbook/Proxy_Batch_Users.ipynb

@@ -6,7 +6,9 @@
     "id": "680oRk1af-xJ"
    },
    "source": [
-    "# Environment Setup"
+    "# Environment Setup\n",
+    "\n",
+    "Set `LITELLM_MASTER_KEY` in the notebook environment to the same key configured on the proxy before running the cells"
    ]
   },
   {
@@ -17,6 +19,7 @@
    },
    "outputs": [],
    "source": [
+    "import os\n",
     "import csv\n",
     "from typing import Optional\n",
     "import httpx\n",
@@ -24,7 +27,7 @@
     "import asyncio\n",
     "\n",
     "proxy_base_url = \"http://0.0.0.0:4000\" # 👈 SET TO PROXY URL\n",
-    "master_key = \"sk-1234\" # 👈 SET TO PROXY MASTER KEY"
+    "master_key = os.environ[\"LITELLM_MASTER_KEY\"]"
    ]
   },
   {

cookbook/ai_coding_tool_guides/claude_code_quickstart/guide.md

@@ -47,7 +47,7 @@ Set your environment variables:
 
 ```bash
 export ANTHROPIC_API_KEY="your-anthropic-api-key"
-export LITELLM_MASTER_KEY="sk-1234567890"  # Generate a secure key
+export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 32)"
 ```
 
 ## Step 2: Start Proxy
@@ -292,4 +292,3 @@ model_list:
 - [LiteLLM Documentation](https://docs.litellm.ai/)
 - [Claude Code Documentation](https://docs.anthropic.com/en/docs/claude-code/overview)
 - [Anthropic's LiteLLM Configuration Guide](https://docs.anthropic.com/en/docs/claude-code/llm-gateway#litellm-configuration)
-

cookbook/anthropic_agent_sdk/README.md

@@ -20,6 +20,12 @@ litellm --model claude-sonnet-4-20250514
 litellm --config config.yaml
 ```
 
+Generate a master key before starting the proxy:
+
+```bash
+export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 32)"
+```
+
 ### 3. Run the chat
 
 **Basic Agent (no MCP):**
@@ -58,7 +64,7 @@ Set these environment variables if needed:
 
 ```bash
 export LITELLM_PROXY_URL="http://localhost:4000"
-export LITELLM_API_KEY="sk-1234"
+export LITELLM_API_KEY="$LITELLM_MASTER_KEY"
 export LITELLM_MODEL="bedrock-claude-sonnet-4.5"
 ```
 
@@ -98,7 +104,7 @@ The key is pointing the Agent SDK to LiteLLM instead of directly to Anthropic:
 ```python
 # Point to LiteLLM gateway (not Anthropic)
 os.environ["ANTHROPIC_BASE_URL"] = "http://localhost:4000"
-os.environ["ANTHROPIC_API_KEY"] = "sk-1234"  # Your LiteLLM key
+os.environ["ANTHROPIC_API_KEY"] = os.environ["LITELLM_API_KEY"]
 
 # Use any model configured in LiteLLM
 options = ClaudeAgentOptions(

cookbook/anthropic_agent_sdk/common.py

@@ -13,7 +13,7 @@ class Config:
     LITELLM_PROXY_URL = os.getenv("LITELLM_PROXY_URL", "http://localhost:4000")
 
     # LiteLLM API key (master key or virtual key)
-    LITELLM_API_KEY = os.getenv("LITELLM_API_KEY", "sk-1234")
+    LITELLM_API_KEY = os.environ["LITELLM_API_KEY"]
 
     # Model name as configured in LiteLLM (e.g., "bedrock-claude-sonnet-4", "gpt-4", etc.)
     LITELLM_MODEL = os.getenv("LITELLM_MODEL", "bedrock-claude-sonnet-4.5")

cookbook/litellm_proxy_server/batch_api/bedrock/bedrock.py

@@ -1,8 +1,10 @@
+import os
+
 from openai import OpenAI
 
 client = OpenAI(
     base_url="http://0.0.0.0:4000",
-    api_key="sk-1234",
+    api_key=os.environ["LITELLM_MASTER_KEY"],
 )
 
 BEDROCK_BATCH_MODEL = "bedrock/batch-anthropic.claude-3-5-sonnet-20240620-v1:0"

cookbook/litellm_proxy_server/grafana_dashboard/dashboard_all_metrics/grafana_dashboard.json

@@ -5710,6 +5710,17 @@
         }
       },
       "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.95, sum(rate(litellm_anthropic_wif_latency_bucket[$__rate_interval])) by (le))",
+          "legendFormat": "anthropic_wif",
+          "range": true,
+          "refId": "A"
+        },
         {
           "datasource": {
             "type": "prometheus",
@@ -5719,7 +5730,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_auth_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "auth",
           "range": true,
-          "refId": "A"
+          "refId": "B"
         },
         {
           "datasource": {
@@ -5730,7 +5741,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_batch_write_to_db_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "batch_write_to_db",
           "range": true,
-          "refId": "B"
+          "refId": "C"
         },
         {
           "datasource": {
@@ -5741,7 +5752,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_postgres_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "postgres",
           "range": true,
-          "refId": "C"
+          "refId": "D"
         },
         {
           "datasource": {
@@ -5752,7 +5763,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_proxy_pre_call_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "proxy_pre_call",
           "range": true,
-          "refId": "D"
+          "refId": "E"
         },
         {
           "datasource": {
@@ -5763,7 +5774,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_redis_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "redis",
           "range": true,
-          "refId": "E"
+          "refId": "F"
         },
         {
           "datasource": {
@@ -5774,7 +5785,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_redis_daily_org_spend_update_queue_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "redis_daily_org_spend_update_queue",
           "range": true,
-          "refId": "F"
+          "refId": "G"
         },
         {
           "datasource": {
@@ -5785,7 +5796,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_redis_daily_tag_spend_update_queue_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "redis_daily_tag_spend_update_queue",
           "range": true,
-          "refId": "G"
+          "refId": "H"
         },
         {
           "datasource": {
@@ -5796,7 +5807,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_redis_daily_team_spend_update_queue_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "redis_daily_team_spend_update_queue",
           "range": true,
-          "refId": "H"
+          "refId": "I"
         },
         {
           "datasource": {
@@ -5807,7 +5818,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_redis_window_spend_update_queue_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "redis_window_spend_update_queue",
           "range": true,
-          "refId": "I"
+          "refId": "J"
         },
         {
           "datasource": {
@@ -5818,7 +5829,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_reset_budget_job_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "reset_budget_job",
           "range": true,
-          "refId": "J"
+          "refId": "K"
         },
         {
           "datasource": {
@@ -5829,7 +5840,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_router_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "router",
           "range": true,
-          "refId": "K"
+          "refId": "L"
         },
         {
           "datasource": {
@@ -5840,7 +5851,7 @@
           "expr": "histogram_quantile(0.95, sum(rate(litellm_self_latency_bucket[$__rate_interval])) by (le))",
           "legendFormat": "self",
           "range": true,
-          "refId": "L"
+          "refId": "M"
         }
       ],
       "title": "Service latency p95 (litellm_<service>_latency)",
@@ -5888,6 +5899,28 @@
         }
       },
       "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(litellm_anthropic_wif_total_requests_total[$__rate_interval]))",
+          "legendFormat": "anthropic_wif",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(litellm_anthropic_wif_cache_total_requests_total[$__rate_interval]))",
+          "legendFormat": "anthropic_wif_cache",
+          "range": true,
+          "refId": "B"
+        },
         {
           "datasource": {
             "type": "prometheus",
@@ -5897,7 +5930,7 @@
           "expr": "sum(rate(litellm_auth_total_requests_total[$__rate_interval]))",
           "legendFormat": "auth",
           "range": true,
-          "refId": "A"
+          "refId": "C"
         },
         {
           "datasource": {
@@ -5908,7 +5941,7 @@
           "expr": "sum(rate(litellm_batch_write_to_db_total_requests_total[$__rate_interval]))",
           "legendFormat": "batch_write_to_db",
           "range": true,
-          "refId": "B"
+          "refId": "D"
         },
         {
           "datasource": {
@@ -5919,7 +5952,7 @@
           "expr": "sum(rate(litellm_postgres_total_requests_total[$__rate_interval]))",
           "legendFormat": "postgres",
           "range": true,
-          "refId": "C"
+          "refId": "E"
         },
         {
           "datasource": {
@@ -5930,7 +5963,7 @@
           "expr": "sum(rate(litellm_proxy_pre_call_total_requests_total[$__rate_interval]))",
           "legendFormat": "proxy_pre_call",
           "range": true,
-          "refId": "D"
+          "refId": "F"
         },
         {
           "datasource": {
@@ -5941,7 +5974,7 @@
           "expr": "sum(rate(litellm_redis_total_requests_total[$__rate_interval]))",
           "legendFormat": "redis",
           "range": true,
-          "refId": "E"
+          "refId": "G"
         },
         {
           "datasource": {
@@ -5952,7 +5985,7 @@
           "expr": "sum(rate(litellm_redis_daily_org_spend_update_queue_total_requests_total[$__rate_interval]))",
           "legendFormat": "redis_daily_org_spend_update_queue",
           "range": true,
-          "refId": "F"
+          "refId": "H"
         },
         {
           "datasource": {
@@ -5963,7 +5996,7 @@
           "expr": "sum(rate(litellm_redis_daily_tag_spend_update_queue_total_requests_total[$__rate_interval]))",
           "legendFormat": "redis_daily_tag_spend_update_queue",
           "range": true,
-          "refId": "G"
+          "refId": "I"
         },
         {
           "datasource": {
@@ -5974,7 +6007,7 @@
           "expr": "sum(rate(litellm_redis_daily_team_spend_update_queue_total_requests_total[$__rate_interval]))",
           "legendFormat": "redis_daily_team_spend_update_queue",
           "range": true,
-          "refId": "H"
+          "refId": "J"
         },
         {
           "datasource": {
@@ -5985,7 +6018,7 @@
           "expr": "sum(rate(litellm_redis_window_spend_update_queue_total_requests_total[$__rate_interval]))",
           "legendFormat": "redis_window_spend_update_queue",
           "range": true,
-          "refId": "I"
+          "refId": "K"
         },
         {
           "datasource": {
@@ -5996,7 +6029,7 @@
           "expr": "sum(rate(litellm_reset_budget_job_total_requests_total[$__rate_interval]))",
           "legendFormat": "reset_budget_job",
           "range": true,
-          "refId": "J"
+          "refId": "L"
         },
         {
           "datasource": {
@@ -6007,7 +6040,7 @@
           "expr": "sum(rate(litellm_router_total_requests_total[$__rate_interval]))",
           "legendFormat": "router",
           "range": true,
-          "refId": "K"
+          "refId": "M"
         },
         {
           "datasource": {
@@ -6018,7 +6051,7 @@
           "expr": "sum(rate(litellm_self_total_requests_total[$__rate_interval]))",
           "legendFormat": "self",
           "range": true,
-          "refId": "L"
+          "refId": "N"
         }
       ],
       "title": "Service request rate (litellm_<service>_total_requests)",
@@ -6066,6 +6099,28 @@
         }
       },
       "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(litellm_anthropic_wif_failed_requests_total[$__rate_interval])) by (error_class)",
+          "legendFormat": "anthropic_wif / {{error_class}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(litellm_anthropic_wif_cache_failed_requests_total[$__rate_interval])) by (error_class)",
+          "legendFormat": "anthropic_wif_cache / {{error_class}}",
+          "range": true,
+          "refId": "B"
+        },
         {
           "datasource": {
             "type": "prometheus",
@@ -6075,7 +6130,7 @@
           "expr": "sum(rate(litellm_auth_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "auth / {{error_class}}",
           "range": true,
-          "refId": "A"
+          "refId": "C"
         },
         {
           "datasource": {
@@ -6086,7 +6141,7 @@
           "expr": "sum(rate(litellm_batch_write_to_db_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "batch_write_to_db / {{error_class}}",
           "range": true,
-          "refId": "B"
+          "refId": "D"
         },
         {
           "datasource": {
@@ -6097,7 +6152,7 @@
           "expr": "sum(rate(litellm_postgres_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "postgres / {{error_class}}",
           "range": true,
-          "refId": "C"
+          "refId": "E"
         },
         {
           "datasource": {
@@ -6108,7 +6163,7 @@
           "expr": "sum(rate(litellm_proxy_pre_call_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "proxy_pre_call / {{error_class}}",
           "range": true,
-          "refId": "D"
+          "refId": "F"
         },
         {
           "datasource": {
@@ -6119,7 +6174,7 @@
           "expr": "sum(rate(litellm_redis_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "redis / {{error_class}}",
           "range": true,
-          "refId": "E"
+          "refId": "G"
         },
         {
           "datasource": {
@@ -6130,7 +6185,7 @@
           "expr": "sum(rate(litellm_redis_daily_org_spend_update_queue_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "redis_daily_org_spend_update_queue / {{error_class}}",
           "range": true,
-          "refId": "F"
+          "refId": "H"
         },
         {
           "datasource": {
@@ -6141,7 +6196,7 @@
           "expr": "sum(rate(litellm_redis_daily_tag_spend_update_queue_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "redis_daily_tag_spend_update_queue / {{error_class}}",
           "range": true,
-          "refId": "G"
+          "refId": "I"
         },
         {
           "datasource": {
@@ -6152,7 +6207,7 @@
           "expr": "sum(rate(litellm_redis_daily_team_spend_update_queue_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "redis_daily_team_spend_update_queue / {{error_class}}",
           "range": true,
-          "refId": "H"
+          "refId": "J"
         },
         {
           "datasource": {
@@ -6163,7 +6218,7 @@
           "expr": "sum(rate(litellm_redis_window_spend_update_queue_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "redis_window_spend_update_queue / {{error_class}}",
           "range": true,
-          "refId": "I"
+          "refId": "K"
         },
         {
           "datasource": {
@@ -6174,7 +6229,7 @@
           "expr": "sum(rate(litellm_reset_budget_job_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "reset_budget_job / {{error_class}}",
           "range": true,
-          "refId": "J"
+          "refId": "L"
         },
         {
           "datasource": {
@@ -6185,7 +6240,7 @@
           "expr": "sum(rate(litellm_router_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "router / {{error_class}}",
           "range": true,
-          "refId": "K"
+          "refId": "M"
         },
         {
           "datasource": {
@@ -6196,7 +6251,7 @@
           "expr": "sum(rate(litellm_self_failed_requests_total[$__rate_interval])) by (error_class)",
           "legendFormat": "self / {{error_class}}",
           "range": true,
-          "refId": "L"
+          "refId": "N"
         }
       ],
       "title": "Service failure rate (litellm_<service>_failed_requests)",
@@ -6381,6 +6436,133 @@
       ],
       "title": "litellm_zero_cost_requests rate",
       "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 438
+      },
+      "id": 112,
+      "panels": [],
+      "title": "Project model rate limits",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "description": "Configured rate limit for the Project on the requested model in the current window, by rate_limit_type",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "lineWidth": 1,
+            "showPoints": "never",
+            "spanNulls": false
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 439
+      },
+      "id": 113,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "max by (project_id, project_alias, requested_model, rate_limit_type) (litellm_project_model_rate_limit_allowed_metric)",
+          "legendFormat": "{{project_alias}} ({{project_id}}) / {{requested_model}} / {{rate_limit_type}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "litellm_project_model_rate_limit_allowed_metric",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "description": "Requests or tokens the Project has consumed on the requested model in the current rate limit window, by rate_limit_type",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "lineWidth": 1,
+            "showPoints": "never",
+            "spanNulls": false
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 439
+      },
+      "id": 114,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "max by (project_id, project_alias, requested_model, rate_limit_type) (litellm_project_model_rate_limit_used_metric)",
+          "legendFormat": "{{project_alias}} ({{project_id}}) / {{requested_model}} / {{rate_limit_type}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "litellm_project_model_rate_limit_used_metric",
+      "type": "timeseries"
     }
   ],
   "preload": false,

cookbook/litellm_proxy_server/grafana_dashboard/dashboard_all_metrics/readme.md

@@ -1,6 +1,6 @@
 # LiteLLM All Prometheus Metrics dashboard
 
-Every `litellm_*` metric family the proxy can expose on `/metrics` (136 families across 97 panels), grouped into rows: proxy traffic, latency, spend and tokens, cache, LLM API deployments, key and team rate limits, budgets, guardrails, MCP, managed files and batches, users and teams, the Redis circuit breaker, the spend log cleanup job, and the `prometheus_system` service callback metrics (per-service latency, request and failure rates, spend update queue sizes). Panel titles are the metric names so you can grep the JSON for the metric you care about
+Every `litellm_*` metric family the proxy can expose on `/metrics` (141 families across 97 panels), grouped into rows: proxy traffic, latency, spend and tokens, cache, LLM API deployments, key and team rate limits, budgets, guardrails, MCP, managed files and batches, users and teams, the Redis circuit breaker, the spend log cleanup job, and the `prometheus_system` service callback metrics (per-service latency, request and failure rates, spend update queue sizes). Panel titles are the metric names so you can grep the JSON for the metric you care about
 
 Import `grafana_dashboard.json` from **Dashboards > New > Import** and pick your Prometheus data source when prompted (the `DS_PROMETHEUS` variable). Counters are plotted as `rate()` over `$__rate_interval`, histograms as p50 / p95 / p99, gauges as the raw value grouped by the most useful label. Every query names the metric exactly as the proxy emits it (counters carry the `_total` suffix the Prometheus client adds), and `tests/unit/integrations/test_prometheus_metric_name_consistency.py` fails if a metric is renamed without updating this dashboard
 

cookbook/litellm_proxy_server/mcp/mcp_with_litellm_proxy.py

@@ -4,10 +4,12 @@ Use LiteLLM Proxy MCP Gateway to call MCP tools.
 When using LiteLLM Proxy, you can use the same MCP tools across all your LLM providers.
 """
 
+import os
+
 import openai
 
 client = openai.OpenAI(
-    api_key="sk-1234",  # paste your litellm proxy api key here
+    api_key=os.environ["LITELLM_MASTER_KEY"],
     base_url="http://localhost:4000",  # paste your litellm proxy base url here
 )
 print("Making API request to Responses API with MCP tools")

cookbook/livekit_agent_sdk/README.md

@@ -15,12 +15,14 @@ pip install livekit-agents[xai] websockets
 ```bash
 # With xAI
 export XAI_API_KEY="your-xai-key"
+export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 32)"
 litellm --config config.yaml --port 4000
 ```
 
 ### 3. Run the voice agent
 
 ```bash
+export LITELLM_API_KEY="$LITELLM_MASTER_KEY"
 python main.py
 ```
 
@@ -32,7 +34,7 @@ Set these environment variables if needed:
 
 ```bash
 export LITELLM_PROXY_URL="http://localhost:4000"
-export LITELLM_API_KEY="sk-1234"
+export LITELLM_API_KEY="$LITELLM_MASTER_KEY"
 export LITELLM_MODEL="grok-voice-agent"
 ```
 
@@ -59,7 +61,7 @@ model_list:
       mode: realtime
 
 general_settings:
-  master_key: sk-1234
+  master_key: os.environ/LITELLM_MASTER_KEY
 ```
 
 Then start: `litellm --config config.yaml --port 4000`
@@ -73,7 +75,7 @@ from livekit.plugins import xai
 
 model = xai.realtime.RealtimeModel(
     voice="ara",
-    api_key="sk-1234",              # LiteLLM proxy key
+    api_key=os.environ["LITELLM_MASTER_KEY"],
     base_url="http://localhost:4000", # Point to LiteLLM
 )
 ```

cookbook/livekit_agent_sdk/config.example.yaml

@@ -17,4 +17,4 @@ litellm_settings:
   drop_params: True
 
 general_settings:
-  master_key: sk-1234  # Change this to a secure key
+  master_key: os.environ/LITELLM_MASTER_KEY

cookbook/livekit_agent_sdk/main.py

@@ -13,7 +13,7 @@ import websockets
 
 # Configuration
 PROXY_URL = os.getenv("LITELLM_PROXY_URL", "http://localhost:4000")
-API_KEY = os.getenv("LITELLM_API_KEY", "sk-1234")
+API_KEY = os.environ["LITELLM_API_KEY"]
 MODEL = os.getenv("LITELLM_MODEL", "grok-voice-agent")
 
 

cookbook/misc/config.yaml

@@ -58,7 +58,7 @@ litellm_settings:
   context_window_fallbacks: [{"gpt-3.5-turbo": ["gpt-3.5-turbo-large"]}]
 
 general_settings: 
-  master_key: sk-1234 # [OPTIONAL] Use to enforce auth on proxy. See - https://docs.litellm.ai/docs/proxy/virtual_keys
+  master_key: os.environ/LITELLM_MASTER_KEY
   store_model_in_db: True
   proxy_budget_rescheduler_min_time: 60
   proxy_budget_rescheduler_max_time: 64