Merge branch 'main' into fix/vertex-grok-generate-content-route

Resolve the test_litellm/test_utils.py conflict by keeping both this PR's Vertex Grok generateContent test and main's new request-logging tests. litellm/utils.py auto-merged; the xai/ -> completion-adapter route is intact.
2026-10-09 03:18:44 +00:00 · 2026-09-24 10:13:27 +08:00 · 2026-09-24 10:13:27 +08:00 · bcb78dfccd
commit bcb78dfccd
parent 843189740b 8e74bb0d23
2018 changed files with 212512 additions and 37023 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -6,6 +6,9 @@ parameters:
  migration_candidate_image:
    type: string
    default: ""
+  migration_baseline_image:
+    type: string
+    default: "ghcr.io/berriai/litellm-database:v1.102.0"
  migration_source_sha:
    type: string
    default: ""
@ -1508,7 +1511,7 @@ jobs:
      - run:
          name: Run tests
          command: |
-            uv run --no-sync python -m pytest -vv tests/local_testing/test_basic_python_version.py -k "not v2_resolver"
+            uv run --no-sync python -m pytest -vv tests/local_testing/test_basic_python_version.py -k "not legacy_resolver"

  installing_litellm_on_python_3_13:
    docker:
@ -1532,7 +1535,7 @@ jobs:
      - run:
          name: Run tests
          command: |
-            uv run --no-sync python -m pytest -v tests/local_testing/test_basic_python_version.py -k "not v2_resolver"
+            uv run --no-sync python -m pytest -v tests/local_testing/test_basic_python_version.py -k "not legacy_resolver"

  installing_litellm_on_python_v2_migration_resolver:
    docker:
@ -1561,10 +1564,11 @@ jobs:
          url: tcp://localhost:5432
          timeout: "60"
      - run:
-          name: Run v2 migration resolver proxy smoke test
+          name: Run both migration resolvers against Postgres
          command: |
            uv run --no-sync python -m pytest -vv \
-              tests/local_testing/test_basic_python_version.py::test_litellm_proxy_server_config_no_general_settings_v2_resolver
+              tests/local_testing/test_basic_python_version.py::test_litellm_proxy_server_config_no_general_settings \
+              tests/local_testing/test_basic_python_version.py::test_litellm_proxy_server_config_no_general_settings_legacy_resolver

  helm_chart_testing:
    machine:
@ -2945,7 +2949,10 @@ jobs:
    parameters:
      suite:
        type: enum
-        enum: [startup, recovery, legacy]
+        enum: [startup, recovery, legacy, upgrade, shaped]
+      baseline:
+        type: boolean
+        default: false
    machine:
      image: ubuntu-2204:2024.04.1
    resource_class: large
@ -2953,6 +2960,7 @@ jobs:
    environment:
      LITELLM_MIGRATION_TESTS: "1"
      LITELLM_MIGRATION_TEST_IMAGE: litellm-docker-database:ci
+      LITELLM_MIGRATION_BASELINE_IMAGE: << pipeline.parameters.migration_baseline_image >>
      MIGRATION_TEST_ADMIN_URL: postgresql://postgres:postgres@127.0.0.1:5432/postgres
      MIGRATION_TEST_CONTAINER_ADMIN_URL: postgresql://postgres:postgres@host.docker.internal:5432/postgres
      MIGRATION_TEST_OUTPUT: /tmp/migration-results
@ -2980,6 +2988,16 @@ jobs:
      - wait_for_service:
          url: tcp://localhost:5432
          timeout: "60"
+      - when:
+          condition: << parameters.baseline >>
+          steps:
+            - run:
+                name: Pull the baseline release the upgrade starts from
+                environment:
+                  BASELINE_IMAGE: << pipeline.parameters.migration_baseline_image >>
+                command: |
+                  [[ "$BASELINE_IMAGE" =~ ^ghcr.io/berriai/[a-z0-9._/-]+(@sha256:[0-9a-f]{64}|:v[0-9][0-9a-z.-]*)$ ]] || exit 1
+                  docker pull "$BASELINE_IMAGE"
      - run:
          name: Run migration startup regressions
          environment:
@ -3032,28 +3050,29 @@ jobs:
      - run:
          name: Run Docker container with bad DATABASE_URL
          command: |
+            set +e
            docker run --name my-app \
              -p 4000:4000 \
              -e LITELLM_DANGEROUSLY_PERMIT_WEAK_OR_UNSET_MASTER_KEY=true \
              -e DEFAULT_NUM_WORKERS_LITELLM_PROXY=1 \
              -e DATABASE_URL="postgresql://wrong:wrong@wrong:5432/wrong" \
              myapp:latest \
-              --port 4000 > docker_output.log 2>&1 || true
+              --port 4000 > docker_output.log 2>&1
+            echo "$?" > docker_exit_code
+            set -e
      - run:
          name: Display Docker logs
          command: cat docker_output.log
      - run:
-          name: Check for expected error
+          name: Proxy must refuse to serve on an unreachable database
          command: |
-            if grep -q "Error: P1001: Can't reach database server at" docker_output.log && \
-               (grep -q "Database setup failed after multiple retries" docker_output.log || \
-                grep -q "ERROR:    Application startup failed. Exiting." docker_output.log); then
-              echo "Expected error found. Test passed."
-            else
-              echo "Expected error not found. Test failed."
-              cat docker_output.log
-              exit 1
-            fi
+            fail() { echo "FAILED: $1"; cat docker_output.log; exit 1; }
+            exit_code="$(cat docker_exit_code)"
+            [ "$exit_code" -ne 0 ] || fail "proxy exited 0 with an unreachable database"
+            grep -q "P1001" docker_output.log || fail "log does not name the unreachable database server"
+            ! grep -q "Application startup complete" docker_output.log || fail "proxy reached serving state"
+            ! docker exec my-app true 2>/dev/null || fail "container is still running"
+            echo "Proxy refused to serve (exit $exit_code) and never reached startup. Test passed."

  provider_replay_harness:
    docker:
@ -3187,13 +3206,23 @@ workflows:
          name: migration-legacy-and-pooling
          suite: legacy
          requires: [build_docker_database_image]
+      - migration_startup_tests:
+          name: migration-upgrade
+          suite: upgrade
+          baseline: true
+          requires: [build_docker_database_image]
+      - migration_startup_tests:
+          name: migration-upgrade-shaped
+          suite: shaped
+          baseline: true
+          requires: [build_docker_database_image]
  migration_startup_scheduled:
    triggers:
      - schedule:
          cron: "17 0,6,12,18 * * *"
          filters:
            branches:
-              only: litellm_internal_staging
+              only: main
    jobs: *migration_jobs
  integration:
    unless: << pipeline.parameters.run_migration_tests >>
@ -3202,7 +3231,7 @@ workflows:
          name: integration-<< matrix.suite >>
          matrix:
            parameters:
-              suite: [management, accounting, database, providers, extensions, sdk, cost, browser]
+              suite: [management, accounting, database, providers, extensions, mcp, sdk, cost, browser]
          filters:
            branches:
              only:
--- a/.circleci/scripts/path_filter.sh
+++ b/.circleci/scripts/path_filter.sh
@ -11,7 +11,7 @@ run_full() {

 [ -n "${CIRCLE_PULL_REQUEST:-}" ] || run_full "not a pull request"

-candidate_bases="main litellm_internal_staging litellm_oss_staging"
+candidate_bases="${PATH_FILTER_BASE_BRANCH:-main}"
 merge_base=""
 for base in $candidate_bases; do
  git fetch --quiet origin "$base" 2>/dev/null || continue
--- a/.circleci/scripts/run_integration.sh
+++ b/.circleci/scripts/run_integration.sh
@ -9,7 +9,6 @@ fi
 suite="${1:?integration suite required}"
 results="test-results/integration-${suite}"
 mkdir -p "$results"
-shard_timeout=11m
 integration_identity="$(.venv/bin/python -c 'import uuid; print(uuid.uuid4().hex)')"
 upstream_pid=""
 proxy_pid=""
@ -112,6 +111,15 @@ upstream_pid=$!
 if [ "$suite" = cost ]; then
  export INTEGRATION_WORKERS=8
 fi
+if [ "$suite" = mcp ]; then
+  export INTEGRATION_WORKERS=4 INTEGRATION_COVERAGE=1
+fi
+coverage_data="$PWD/$results/coverage/data"
+proxy_command=(.venv/bin/python -m integration._support.proxy)
+if [ "${INTEGRATION_COVERAGE:-0}" = 1 ]; then
+  mkdir -p "$(dirname "$coverage_data")"
+  proxy_command=(.venv/bin/python -m coverage run --rcfile=tests/integration/mcp_coverage.toml -m integration._support.proxy)
+fi
 start_proxy() {
  local port="$1"
  local log_name="$2"
@ -121,16 +129,21 @@ start_proxy() {
      "LITELLM_MODEL_COST_MAP_URL=$INTEGRATION_UPSTREAM_URL/_cost_map"
      "MODEL_COST_MAP_MIN_MODEL_COUNT=1"
      "MODEL_COST_MAP_MAX_SHRINK_RATIO=0"
+      "GEMINI_API_BASE=$INTEGRATION_UPSTREAM_URL"
+      "ANTHROPIC_API_BASE=$INTEGRATION_UPSTREAM_URL"
+      "GEMINI_API_KEY=sk-scripted-provider"
+      "ANTHROPIC_API_KEY=sk-scripted-provider"
    )
  else
    cost_map_env=("LITELLM_LOCAL_MODEL_COST_MAP=True")
  fi
  setsid env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" INTEGRATION_RUN_ID="$integration_identity" \
    DATABASE_URL="$DATABASE_URL" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
+    INTEGRATION_UPSTREAM_URL="$INTEGRATION_UPSTREAM_URL" \
    LITELLM_MASTER_KEY="$LITELLM_MASTER_KEY" LITELLM_SALT_KEY="$LITELLM_SALT_KEY" LITELLM_UI_PATH="$LITELLM_UI_PATH" PROXY_BASE_URL="http://127.0.0.1:$port" \
    LITELLM_MODE=PRODUCTION STORE_MODEL_IN_DB=True "${cost_map_env[@]}" \
-    AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 \
-    .venv/bin/python -m integration._support.proxy --config tests/integration/proxy_config.yaml \
+    AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 COVERAGE_FILE="$coverage_data" \
+    "${proxy_command[@]}" --config tests/integration/proxy_config.yaml \
    --host 127.0.0.1 --port "$port" --num_workers 1 --telemetry False \
    --use_prisma_db_push --enforce_prisma_migration_check \
    > "$results/$log_name" 2>&1 &
@ -142,7 +155,7 @@ proxy_pid="$launched_pid"
 curl --noproxy '*' -sSf -X POST "$INTEGRATION_PROXY_URL/config/update" \
  -H "Authorization: Bearer $LITELLM_MASTER_KEY" -H 'Content-Type: application/json' \
  -d '{"router_settings": {"num_retries": 0}}' > "$results/seed-router-settings.json"
-if [ "$suite" = management ]; then
+if [ "$suite" = management ] || [ "$suite" = mcp ]; then
  export INTEGRATION_PEER_URL=http://127.0.0.1:4001
  start_proxy 4001 peer.log
  peer_pid="$launched_pid"
@ -172,7 +185,7 @@ if [ "$suite" = browser ]; then
  exit 0
 fi

-timeout --signal=TERM --kill-after=20s "$shard_timeout" env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
+env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
  INTEGRATION_RUN_ID="$integration_identity" \
  DATABASE_URL="$DATABASE_URL" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
  INTEGRATION_PROXY_URL="$INTEGRATION_PROXY_URL" INTEGRATION_PEER_URL="$INTEGRATION_PEER_URL" \
@ -183,3 +196,23 @@ timeout --signal=TERM --kill-after=20s "$shard_timeout" env -i PATH="$PATH" HOME
  INTEGRATION_ORDER_SEED="$INTEGRATION_ORDER_SEED" \
  LITELLM_LOCAL_MODEL_COST_MAP=True AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 \
  .venv/bin/python tests/integration/run.py "$suite" --results "$results"
+
+if [ "${INTEGRATION_COVERAGE:-0}" = 1 ]; then
+  for covered_pid in "$proxy_pid" "$peer_pid"; do
+    [ -n "$covered_pid" ] || continue
+    kill -TERM -- "-$covered_pid"
+    for _ in {1..300}; do
+      kill -0 "$covered_pid" 2>/dev/null || break
+      sleep 0.1
+    done
+    wait "$covered_pid" 2>/dev/null || true
+  done
+  proxy_pid=""
+  peer_pid=""
+  COVERAGE_FILE="$coverage_data" .venv/bin/python -m coverage combine --rcfile=tests/integration/mcp_coverage.toml
+  COVERAGE_FILE="$coverage_data" .venv/bin/python -m coverage report --rcfile=tests/integration/mcp_coverage.toml \
+    > "$results/coverage/coverage.txt"
+  COVERAGE_FILE="$coverage_data" .venv/bin/python -m coverage html --rcfile=tests/integration/mcp_coverage.toml \
+    -d "$results/coverage/html"
+  tail -n 1 "$results/coverage/coverage.txt"
+fi
--- a/.circleci/scripts/run_migration_tests.py
+++ b/.circleci/scripts/run_migration_tests.py
@ -13,6 +13,8 @@ SUITES: Final = {
    "startup": (("test_startup.py",), 12),
    "recovery": (("test_recovery.py",), 15),
    "legacy": (("test_legacy.py", "test_pooling.py"), 11),
+    "upgrade": (("test_upgrade.py", "test_rolling_upgrade.py"), 5),
+    "shaped": (("test_shaped_database.py",), 1),
 }


@ -93,6 +95,7 @@ def main() -> int:
            {
                **metadata,
                "suite": suite,
+                "baseline_image": os.environ.get("LITELLM_MIGRATION_BASELINE_IMAGE", ""),
                "expected_cases": expected,
                "passed": passed,
                "pytest_exit_code": result.returncode,
--- a/.circleci/scripts/verify_integration_browser.py
+++ b/.circleci/scripts/verify_integration_browser.py
@ -31,8 +31,8 @@ def main() -> None:
    result: Final = json.loads(Path(sys.argv[1]).read_text())
    assert not result.get("errors"), result.get("errors")
    expected: Final = json.loads(
-        (Path(__file__).resolve().parents[2] / "tests/integration/contracts.json").read_text()
-    )["browser"]
+        (Path(__file__).resolve().parents[2] / "tests/e2e/ui/tests/integrationCritical/expected.json").read_text()
+    )
    assert expected and result["stats"]["expected"] == len(expected)
    assert all(result["stats"][name] == 0 for name in ("unexpected", "flaky", "skipped"))

--- a/.circleci/tests.yml
+++ b/.circleci/tests.yml
@ -0,0 +1,292 @@
+version: 2.1
+
+commands:
+  wait_for_service:
+    parameters:
+      url:
+        type: string
+      timeout:
+        type: string
+        default: "60"
+    steps:
+      - run:
+          name: "Wait for << parameters.url >>"
+          command: |
+            TIMEOUT=<< parameters.timeout >>
+            URL="<< parameters.url >>"
+            ELAPSED=0
+            echo "Waiting up to ${TIMEOUT}s for ${URL} ..."
+            if echo "$URL" | grep -q '^tcp://'; then
+              HOST=$(echo "$URL" | sed 's|tcp://||' | cut -d: -f1)
+              PORT=$(echo "$URL" | sed 's|tcp://||' | cut -d: -f2)
+              while ! bash -c "echo > /dev/tcp/$HOST/$PORT" 2>/dev/null; do
+                sleep 2; ELAPSED=$((ELAPSED+2))
+                if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "Timed out"; exit 1; fi
+              done
+            else
+              while ! curl -sf --max-time 5 "$URL" > /dev/null 2>&1; do
+                sleep 2; ELAPSED=$((ELAPSED+2))
+                if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "Timed out"; exit 1; fi
+              done
+            fi
+            echo "Service ready after ${ELAPSED}s"
+  install_uv:
+    steps:
+      - run:
+          name: Install uv (pinned 0.10.9)
+          command: |
+            curl -LsSf -o /tmp/uv-install.sh https://astral.sh/uv/0.10.9/install.sh
+            echo "7fc46e39cb97290b57169c0c813a17970585ac519139f19006453c99b5f2f45f  /tmp/uv-install.sh" | sha256sum -c -
+            env UV_NO_MODIFY_PATH=1 sh /tmp/uv-install.sh
+            rm -f /tmp/uv-install.sh
+            echo 'export PATH="$HOME/.local/bin:$PATH"' >> "$BASH_ENV"
+            export PATH="$HOME/.local/bin:$PATH"
+  install_rust:
+    steps:
+      - run:
+          name: Install Rust (rustup 1.28.2, toolchain 1.98.0)
+          command: |
+            case "$(uname -m)" in
+              x86_64)
+                RUSTUP_TRIPLE=x86_64-unknown-linux-gnu
+                RUSTUP_SHA256=20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c
+                ;;
+              aarch64)
+                RUSTUP_TRIPLE=aarch64-unknown-linux-gnu
+                RUSTUP_SHA256=e3853c5a252fca15252d07cb23a1bdd9377a8c6f3efa01531109281ae47f841c
+                ;;
+              *)
+                echo "install_rust: unsupported architecture $(uname -m)" >&2
+                exit 1
+                ;;
+            esac
+            curl -sSLf -o /tmp/rustup-init \
+              "https://static.rust-lang.org/rustup/archive/1.28.2/${RUSTUP_TRIPLE}/rustup-init"
+            echo "${RUSTUP_SHA256}  /tmp/rustup-init" | sha256sum -c -
+            chmod +x /tmp/rustup-init
+            /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain 1.98.0
+            rm -f /tmp/rustup-init
+            echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> "$BASH_ENV"
+            export PATH="$HOME/.cargo/bin:$PATH"
+            rustc --version
+            cargo --version
+  install_codecov_cli:
+    steps:
+      - run:
+          name: Install Codecov CLI (pinned v11.3.1)
+          command: |
+            curl -sSLf -o /tmp/codecov https://cli.codecov.io/v11.3.1/linux/codecov
+            curl -sSLf -o /tmp/codecov.SHA256SUM https://cli.codecov.io/v11.3.1/linux/codecov.SHA256SUM
+            [ "$(cat /tmp/codecov.SHA256SUM)" = "ca1d64196d2d34771084afe76ea657d581bf628e31d993ff8e52ea09cc88a56d  codecov" ]
+            (cd /tmp && sha256sum -c codecov.SHA256SUM)
+            chmod +x /tmp/codecov
+            mkdir -p "$HOME/.local/bin"
+            mv /tmp/codecov "$HOME/.local/bin/codecov"
+  setup_litellm_enterprise_pip:
+    steps:
+      - run:
+          name: "Install local version of litellm-enterprise"
+          command: |
+            uv run --no-sync python -c "import litellm_enterprise; print('litellm-enterprise OK:', litellm_enterprise.__file__)"
+  setup_test_deps:
+    steps:
+      - checkout
+      - install_uv
+      - install_rust
+      - restore_cache:
+          keys:
+            - v3-integration-uv-cache-{{ checksum "uv.lock" }}
+      - run:
+          name: Install Dependencies
+          command: |
+            uv sync --frozen --all-groups --all-extras --python 3.12
+      - setup_litellm_enterprise_pip
+      - save_cache:
+          paths:
+            - ~/.cache/uv
+          key: v3-integration-uv-cache-{{ checksum "uv.lock" }}
+      - run:
+          name: Generate Prisma client
+          command: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+  skip_unless_relevant:
+    parameters:
+      category:
+        type: string
+        default: backend
+      base_ref:
+        type: string
+        default: ""
+      pull_request_url:
+        type: string
+        default: ""
+    steps:
+      - run:
+          name: "Skip job when no << parameters.category >>-relevant files changed"
+          command: |
+            export CIRCLE_PULL_REQUEST="${CIRCLE_PULL_REQUEST:-<< parameters.pull_request_url >>}"
+            export PATH_FILTER_BASE_BRANCH="<< parameters.base_ref >>"
+            [ -n "$PATH_FILTER_BASE_BRANCH" ] || unset PATH_FILTER_BASE_BRANCH
+            bash .circleci/scripts/path_filter.sh << parameters.category >>
+  start_postgres:
+    parameters:
+      db_name:
+        type: string
+        default: circle_test
+      image:
+        type: string
+        default: postgres:14@sha256:6a70deda415ec296f977890e11aba04a0db9f632a362e3fce45e845e3db74f26
+    steps:
+      - run:
+          name: Start PostgreSQL
+          command: |
+            docker run -d \
+              --name postgres-db \
+              -e POSTGRES_USER=postgres \
+              -e POSTGRES_PASSWORD=postgres \
+              -e POSTGRES_DB=<< parameters.db_name >> \
+              -p 5432:5432 \
+              << parameters.image >>
+      - wait_for_service:
+          url: tcp://localhost:5432
+          timeout: "60"
+  start_redis:
+    steps:
+      - run:
+          name: Start Redis
+          command: |
+            docker run -d \
+              --name redis-cache \
+              -p 6379:6379 \
+              redis:7-alpine@sha256:7aec734b2bb298a1d769fd8729f13b8514a41bf90fcdd1f38ec52267fbaa8ee6
+      - wait_for_service:
+          url: tcp://localhost:6379
+          timeout: "60"
+
+jobs:
+  unit:
+    parameters:
+      tests_path:
+        type: string
+        default: tests/unit
+      flag:
+        type: string
+        default: unit
+      shards:
+        type: integer
+        default: 6
+      base_ref:
+        type: string
+        default: ""
+      pull_request_url:
+        type: string
+        default: ""
+    machine:
+      image: ubuntu-2204:2024.04.1
+    resource_class: large
+    working_directory: ~/project
+    parallelism: << parameters.shards >>
+    environment:
+      LITELLM_LOCAL_MODEL_COST_MAP: "True"
+    steps:
+      - setup_test_deps
+      - skip_unless_relevant:
+          base_ref: << parameters.base_ref >>
+          pull_request_url: << parameters.pull_request_url >>
+      - run:
+          name: "Run << parameters.tests_path >> shard"
+          no_output_timeout: 20m
+          command: |
+            mkdir -p test-results/<< parameters.flag >>
+            mapfile -t files < <(find << parameters.tests_path >> -name 'test_*.py' | sort | circleci tests split --split-by=timings --timings-type=filename)
+            if [ "${#files[@]}" -eq 0 ]; then echo "shard ${CIRCLE_NODE_INDEX} received no << parameters.tests_path >> files; nothing to run"; exit 0; fi
+            set +e
+            uv run --no-sync pytest "${files[@]}" -p no:rerunfailures -p no:pytest-retry --timeout=90 -n 4 --dist=loadscope --tb=short --durations=20 -o junit_family=xunit1 --junitxml=test-results/<< parameters.flag >>/junit.xml --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml:coverage.xml --cov-config=pyproject.toml
+            status=$?
+            set -e
+            if [ "$status" -eq 5 ]; then echo "pytest collected no tests from the shard; passing"; exit 0; fi
+            exit "$status"
+      - install_codecov_cli
+      - run:
+          name: Upload coverage
+          when: always
+          command: |
+            [ -f coverage.xml ] || { echo "no coverage.xml produced; skipping upload"; exit 0; }
+            codecov upload-process --disable-search -f coverage.xml -F << parameters.flag >> -C "$CIRCLE_SHA1" -n "<< parameters.flag >>-${CIRCLE_NODE_INDEX}-${CIRCLE_BUILD_NUM}" --git-service github
+      - store_test_results:
+          path: test-results
+      - store_artifacts:
+          path: test-results
+      - store_artifacts:
+          path: coverage.xml
+  documentation:
+    machine:
+      image: ubuntu-2204:2024.04.1
+    resource_class: large
+    working_directory: ~/project
+    steps:
+      - setup_test_deps
+      - run:
+          name: Checkout litellm-docs
+          command: rm -rf docs/my-website && git clone --depth 1 https://github.com/BerriAI/litellm-docs.git docs/my-website
+      - run:
+          name: Run documentation validation
+          command: |
+            uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
+            uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
+            uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
+            uv run --no-sync python ./tests/documentation_tests/test_circular_imports.py
+  integration:
+    parameters:
+      suite:
+        type: string
+      base_ref:
+        type: string
+        default: ""
+      pull_request_url:
+        type: string
+        default: ""
+    machine:
+      image: ubuntu-2204:2024.04.1
+    resource_class: large
+    working_directory: ~/project
+    steps:
+      - setup_test_deps
+      - skip_unless_relevant:
+          base_ref: << parameters.base_ref >>
+          pull_request_url: << parameters.pull_request_url >>
+      - start_postgres:
+          image: postgres:16@sha256:e17e86066e5ef83e0952a9347f5c792b7ece00972e2aa787a6986f471b3dd3d5
+      - start_redis
+      - run:
+          name: Run owned integration contracts
+          command: bash .circleci/scripts/run_integration.sh << parameters.suite >>
+          no_output_timeout: 15m
+      - run:
+          name: Stop owned database and Redis
+          when: always
+          command: |
+            mkdir -p test-results/integration-<< parameters.suite >>
+            docker logs postgres-db > test-results/integration-<< parameters.suite >>/postgres.log 2>&1 || true
+            docker logs redis-cache > test-results/integration-<< parameters.suite >>/redis.log 2>&1 || true
+            docker rm -f postgres-db redis-cache
+            test -z "$(docker ps -aq --filter name=postgres-db --filter name=redis-cache)"
+      - store_test_results:
+          path: test-results
+      - store_artifacts:
+          path: test-results
+
+workflows:
+  tests:
+    when: (pipeline.event.name == "push" and pipeline.git.branch == "main") or pipeline.event.name == "api" or (pipeline.event.name == "pull_request" and (pipeline.event.github.pull_request.base.ref == "main" or pipeline.event.github.pull_request.base.ref starts-with "litellm_"))
+    jobs:
+      - unit:
+          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
+          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
+      - documentation
+      - integration:
+          name: integration-<< matrix.suite >>
+          matrix:
+            parameters:
+              suite: [sdk]
+          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
+          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
--- a/.githooks/pre-push
+++ b/.githooks/pre-push
@ -8,7 +8,6 @@
 #
 # Protected branches (always allowed):
 #   - main
-#   - litellm_internal_staging
 #   - dependabot/*
 #   - gh-readonly-queue/*
 #
@ -22,7 +21,7 @@ ZERO_OID_SHA256="000000000000000000000000000000000000000000000000000000000000000
 ALLOWED_TYPES="feature|bugfix|hotfix|release|chore"
 BRANCH_PATTERN="^(${ALLOWED_TYPES})/.+"

-PROTECTED_NAMES="main litellm_internal_staging"
+PROTECTED_NAMES="main"
 PROTECTED_PREFIXES="dependabot/ gh-readonly-queue/"

 is_protected() {
@ -78,8 +77,7 @@ if [ -n "$invalid" ]; then
    chore/bump-deps
    hotfix/auth-bypass

-  Protected (always allowed): main, litellm_internal_staging,
-  dependabot/*, gh-readonly-queue/*.
+  Protected (always allowed): main, dependabot/*, gh-readonly-queue/*.

 See https://conventional-branch.github.io/

--- a/.github/actions/cache-cargo-build/action.yml
+++ b/.github/actions/cache-cargo-build/action.yml
@ -15,6 +15,12 @@ description: >-
  cache the same directory for different workloads, and a shared key would let
  whichever ran first deny the others a save.

+inputs:
+  profile:
+    description: "Cargo profile the build uses (dev or release)"
+    required: false
+    default: "dev"
+
 runs:
  using: composite
  steps:
@ -25,6 +31,6 @@ runs:
          ~/.cargo/registry
          ~/.cargo/git
          litellm-rust/target
-        key: ${{ runner.os }}-maturin-dev-${{ hashFiles('litellm-rust/Cargo.lock') }}
+        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm-rust/Cargo.lock') }}
        restore-keys: |
-          ${{ runner.os }}-maturin-dev-
+          ${{ runner.os }}-maturin-${{ inputs.profile }}-
--- a/.github/ci-coverage-allowlist.yml
+++ b/.github/ci-coverage-allowlist.yml
@ -10,12 +10,13 @@ test_paths:
    paths:
      - tests/rust-python-harness
  - reason: >-
-      What is left of the caching suite in tests/local_testing that runs nowhere. Every job that
-      globs that directory either deselects it (local_testing_part1 and part2 carry `-k "... and
-      not caching and not cache"`) or keeps only another keyword (langfuse, router, assistants),
-      and no job names these files the way redis_caching_unit_tests names test_dual_cache.py.
-      The gap was eight files and 118 tests when measured 2026-08-20; the five keyless ones now
-      run in the caching-local shard, leaving these three. Measured 2026-08-21 with no provider
+      Live-provider caching cases in tests/local_testing that remain outside CI. Jobs that
+      glob that directory either deselect them (local_testing_part1 and part2 carry `-k "... and
+      not caching and not cache"`) or keep only another keyword (langfuse, router, assistants).
+      Separately, test-redis-compat.yml selects two IAM cluster authentication tests in
+      test_caching.py by node ID. It does not run that file's other tests.
+      The gap was eight files and 118 tests when measured 2026-08-20; the five keyless files now
+      run in the caching-local shard, leaving live cases in these three. Measured 2026-08-21 with no provider
      credentials and no Redis: test_caching.py needs both (37 of 65 fail without them),
      test_disk_cache_unit_tests.py needs OPENAI_API_KEY for 2 of its 4, and
      test_gcs_cache_unit_tests.py needs GCS credentials for all 4. They want the keyless/live
--- a/.github/e2e-stack/redact_output.py
+++ b/.github/e2e-stack/redact_output.py
@ -0,0 +1,83 @@
+import argparse
+import os
+import sys
+from functools import reduce
+from pathlib import Path
+from typing import Final
+from xml.sax.saxutils import escape
+
+from pydantic import JsonValue, TypeAdapter, ValidationError
+from secrets_to_env import MIN_MASKED_LENGTH
+
+REDACTED: Final = "***"
+json_adapter: Final[TypeAdapter[JsonValue]] = TypeAdapter(JsonValue)
+
+
+def string_leaves(node: JsonValue) -> tuple[str, ...]:
+    match node:
+        case str():
+            return (node,)
+        case list():
+            return tuple(leaf for child in node for leaf in string_leaves(child))
+        case dict():
+            return tuple(leaf for child in node.values() for leaf in string_leaves(child))
+    return ()
+
+
+def field_lines(value: str) -> tuple[str, ...]:
+    try:
+        return tuple(line for leaf in string_leaves(json_adapter.validate_json(value)) for line in leaf.splitlines())
+    except ValidationError:
+        return ()
+
+
+def masked_values(values_files: tuple[Path, ...]) -> tuple[str, ...]:
+    values: Final = frozenset(
+        line.split("=", 1)[1].strip().strip("'")
+        for path in values_files
+        for line in path.read_text().splitlines()
+        if "=" in line
+    )
+    texts: Final = frozenset(text for value in values for text in (value, *field_lines(value)))
+    renderings: Final = frozenset(
+        rendering
+        for text in texts
+        if len(text) >= MIN_MASKED_LENGTH
+        for rendering in (text, escape(text), escape(text, {'"': "&quot;"}))
+    )
+    return tuple(sorted(renderings, key=lambda rendering: (-len(rendering), rendering)))
+
+
+def redact(text: str, values: tuple[str, ...]) -> str:
+    return reduce(lambda redacted, value: redacted.replace(value, REDACTED), values, text)
+
+
+def write_redacted(source: Path, out_dir: Path, values: tuple[str, ...]) -> None:
+    target: Final = out_dir / source.name
+    with os.fdopen(os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600), "w") as handle:
+        _ = handle.write(redact(source.read_text(errors="replace"), values))
+
+
+def main() -> int:
+    parser: Final = argparse.ArgumentParser()
+    _ = parser.add_argument("--values", action="append", type=Path, required=True)
+    _ = parser.add_argument("--out", type=Path, required=True)
+    _ = parser.add_argument("files", nargs="*", type=Path)
+    args: Final = parser.parse_args()
+    values_files: Final = tuple(args.values)
+    out_dir: Final[Path] = args.out
+    sources: Final = tuple(args.files)
+    try:
+        values: Final = masked_values(values_files)
+        out_dir.mkdir(mode=0o700, exist_ok=True)
+        for source in sources:
+            write_redacted(source, out_dir, values)
+    except OSError as error:
+        _ = sys.stderr.write(f"could not redact {error.filename}\n")
+        return 1
+    _ = sys.stdout.write(f"redacted {len(sources)} file(s) into {out_dir}\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
--- a/.github/e2e-stack/secrets_to_env.py
+++ b/.github/e2e-stack/secrets_to_env.py
@ -9,6 +9,7 @@ from pydantic import TypeAdapter, ValidationError
 secrets_adapter: Final[TypeAdapter[dict[str, str]]] = TypeAdapter(dict[str, str])
 ENV_NAME: Final = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
 MIN_MASKED_LENGTH: Final = 8
+ACTIONS_RUNNER_FLAG: Final = "GITHUB_ACTIONS"


 def main() -> int:
@ -30,10 +31,15 @@ def main() -> int:
            f"these names or values cannot be represented in both bash and dotenv: {' '.join(sorted(unusable))}\n"
        )
        return 1
-    for value in secrets.values():
-        if len(value) >= MIN_MASKED_LENGTH:
-            _ = sys.stdout.write(f"::add-mask::{value.replace('%', '%25')}\n")
-    sys.stdout.flush()
+    if os.environ.get(ACTIONS_RUNNER_FLAG) == "true":
+        _ = sys.stdout.write(
+            "".join(
+                f"::add-mask::{value.replace('%', '%25')}\n"
+                for value in secrets.values()
+                if len(value) >= MIN_MASKED_LENGTH
+            )
+        )
+        sys.stdout.flush()
    lines: Final = tuple(f"{key}='{value}'" for key, value in secrets.items() if value)
    try:
        with os.fdopen(os.open(env_path, os.O_WRONLY | os.O_APPEND | os.O_CREAT | os.O_NOFOLLOW, 0o600), "w") as handle:
--- a/.github/e2e-stack/select_tests.py
+++ b/.github/e2e-stack/select_tests.py
@ -9,6 +9,9 @@ UNSUPPORTED: Final = re.compile(
    r"|^tests/e2e/llm_translation/realtime/test_realtime_pipecat_audio_e2e\.py$"
    r"|^tests/e2e/batches/test_managed_files_enforcement_e2e\.py$"
    r"|^tests/e2e/guardrails/test_presidio_masking_e2e\.py$"
+    r"|^tests/e2e/logging/test_otel_v2_langfuse_generation_output_e2e\.py$"
+    r"|^tests/e2e/logging/test_langsmith_batch_serialization_e2e\.py$"
+    r"|^tests/e2e/secret_manager/"
 )
 HARNESS: Final = re.compile(
    r"^tests/e2e/[A-Za-z0-9_.-]+\.(py|ini)$"
--- a/.github/e2e-stack/up.sh
+++ b/.github/e2e-stack/up.sh
@ -24,6 +24,7 @@ DATABASE_USER="${E2E_DATABASE_USER:-litellm}"
 DATABASE_PASSWORD="${E2E_DATABASE_PASSWORD:-dbpassword9090}"
 DATABASE_NAME="${E2E_DATABASE_NAME:-litellm}"
 JAEGER_OTLP_PORT="${E2E_JAEGER_OTLP_PORT:-4318}"
+JAEGER_OTLP_TLS_PORT="${E2E_JAEGER_OTLP_TLS_PORT:-4319}"
 JAEGER_QUERY_PORT="${E2E_JAEGER_QUERY_PORT:-16686}"
 KEYCLOAK_PORT="${E2E_KEYCLOAK_PORT:-8081}"

@ -122,7 +123,7 @@ SERVER_ENV=(
  "CONFIG_FILE_PATH=${CONFIG_PATH}"
  "STORE_MODEL_IN_DB=True"
  "OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf"
-  "OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:${JAEGER_OTLP_PORT}"
+  "OTEL_EXPORTER_OTLP_ENDPOINT=https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}"
  "SSL_CERT_FILE=${CERTS_DIR}/ca-bundle.pem"
  "PYTHONPATH=${REPO_ROOT}"
  "JWT_PUBLIC_KEY_URL=http://127.0.0.1:${KEYCLOAK_PORT}/realms/litellm-e2e/protocol/openid-connect/certs"
@ -143,20 +144,16 @@ env "${SERVER_ENV[@]}" uv run --no-sync python migrations/run.py >"${LOGS_DIR}/m

 start_server() {
  local name="$1"; shift
-  env "${SERVER_ENV[@]}" "$@" >"${LOGS_DIR}/${name}.log" 2>&1 &
+  env -u AWS_ROLE_NAME "${SERVER_ENV[@]}" "$@" >"${LOGS_DIR}/${name}.log" 2>&1 &
  echo $! > "${PIDS_DIR}/${name}.pid"
 }

-start_server backend uv run --no-sync uvicorn backend.main:app --host 0.0.0.0 --port "${BACKEND_PORT}"
-start_server gateway-1 uv run --no-sync uvicorn gateway.main:app --workers 1 --host 0.0.0.0 --port "${GATEWAY_PORT_1}"
-start_server gateway-2 uv run --no-sync uvicorn gateway.main:app --workers 1 --host 0.0.0.0 --port "${GATEWAY_PORT_2}"
-
 if [[ "$(uname)" == "Linux" ]]; then
  NGINX_UPSTREAM_HOST=127.0.0.1
  NGINX_DOCKER_ARGS=(--network host)
 else
  NGINX_UPSTREAM_HOST=host.docker.internal
-  NGINX_DOCKER_ARGS=(-p "${LB_PORT}:${LB_PORT}")
+  NGINX_DOCKER_ARGS=(-p "${LB_PORT}:${LB_PORT}" -p "${JAEGER_OTLP_TLS_PORT}:${JAEGER_OTLP_TLS_PORT}")
 fi

 cat > "${STACK_DIR}/nginx.conf" <<EOF
@ -186,12 +183,29 @@ http {
      proxy_send_timeout 600s;
    }
  }
+  server {
+    listen ${JAEGER_OTLP_TLS_PORT} ssl;
+    ssl_certificate /certs/server.crt;
+    ssl_certificate_key /certs/server.key;
+    client_max_body_size 100m;
+    location / {
+      proxy_pass http://${NGINX_UPSTREAM_HOST}:${JAEGER_OTLP_PORT};
+    }
+  }
 }
 EOF

 docker rm -f e2e-nginx >/dev/null 2>&1 || true
 docker run -d --name e2e-nginx "${NGINX_DOCKER_ARGS[@]}" \
-  -v "${STACK_DIR}/nginx.conf:/etc/nginx/nginx.conf:ro" "${NGINX_IMAGE}" >/dev/null
+  -v "${STACK_DIR}/nginx.conf:/etc/nginx/nginx.conf:ro" \
+  -v "${CERTS_DIR}:/certs:ro" "${NGINX_IMAGE}" >/dev/null
+
+wait_for "Jaeger OTLP TLS listener" \
+  "curl -sS --cacert ${CERTS_DIR}/ca.crt https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}/ -o /dev/null -w '%{http_code}' | grep -qE '^[2345]'"
+
+start_server backend uv run --no-sync uvicorn backend.main:app --host 0.0.0.0 --port "${BACKEND_PORT}"
+start_server gateway-1 uv run --no-sync uvicorn gateway.main:app --workers 1 --host 0.0.0.0 --port "${GATEWAY_PORT_1}"
+start_server gateway-2 uv run --no-sync uvicorn gateway.main:app --workers 1 --host 0.0.0.0 --port "${GATEWAY_PORT_2}"

 wait_for "backend" "curl -fs http://127.0.0.1:${BACKEND_PORT}/health/liveliness >/dev/null" 300
 wait_for "gateway-1" "curl -fs http://127.0.0.1:${GATEWAY_PORT_1}/health/liveliness >/dev/null" 300
@ -206,6 +220,7 @@ LITELLM_MASTER_KEY=${MASTER_KEY}
 REDIS_HOST=127.0.0.1
 REDIS_PORT=${REDIS_PORT}
 E2E_OTEL_QUERY_URL=http://127.0.0.1:${JAEGER_QUERY_PORT}
+E2E_OTEL_EXPORTER_ENDPOINT=https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}
 E2E_KEYCLOAK_URL=http://127.0.0.1:${KEYCLOAK_PORT}
 E2E_KEYCLOAK_ADMIN_USER=admin
 E2E_KEYCLOAK_ADMIN_PASSWORD=e2e-ephemeral-idp-not-a-secret
--- a/.github/merge-smoke-tests.json
+++ b/.github/merge-smoke-tests.json
@ -0,0 +1,15 @@
+{
+  "cases": {
+    "CHAT-JSON": "tests/test_litellm/llms/openai/test_openai.py::test_acompletion_returns_json_reply_over_injected_transport",
+    "CHAT-TEXT-STREAM": "tests/test_litellm/llms/openai/test_openai.py::test_acompletion_streams_text_deltas_over_injected_transport",
+    "CHAT-TOOL-STREAM": "tests/test_litellm/llms/openai/test_openai.py::test_acompletion_streams_tool_call_arguments_over_injected_transport",
+    "MODEL-ALLOW": "tests/test_litellm/proxy/auth/test_auth_checks.py::test_can_object_call_model_allows_listed_model_for_key",
+    "MODEL-DENY": "tests/test_litellm/proxy/auth/test_auth_checks.py::test_can_object_call_model_denials_return_forbidden[key-key_model_access_denied]",
+    "COST-EXPLICIT": "tests/test_litellm/test_cost_calculator.py::test_completion_cost_charges_explicit_per_token_rates_over_registered_ones",
+    "COST-ZERO": "tests/test_litellm/test_cost_calculator.py::test_completion_cost_is_zero_when_explicit_rates_are_zero",
+    "LOG-CONTENT-ON": "tests/test_litellm/litellm_core_utils/test_litellm_logging.py::test_standard_logging_payload_keeps_message_content_when_message_logging_is_on",
+    "LOG-CONTENT-OFF": "tests/test_litellm/litellm_core_utils/test_litellm_logging.py::test_standard_logging_payload_redacts_message_content_when_message_logging_is_off",
+    "CALLBACK-SUCCESS": "tests/test_litellm/litellm_core_utils/test_litellm_logging.py::test_async_success_handler_delivers_standard_logging_payload_to_custom_logger",
+    "CALLBACK-FAILURE": "tests/test_litellm/litellm_core_utils/test_litellm_logging.py::test_async_failure_handler_delivers_failure_payload_to_custom_logger"
+  }
+}
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@ -1,6 +1,8 @@
 <!-- The whole description's target audience is humans, not AI agents: write it in plain, simple,
     everyday engineering language, extremely parsable and readable at a glance. This goes double for
-     the TLDR, User Flow, and Caveats sections -->
+     the TLDR, User Flow, and Caveats sections
+     Drop every section you have nothing to put in, heading included: a bare "## Relevant issues" or
+     "## Affected release" with nothing under it must not appear in the final description -->

 ## TLDR

@ -21,6 +23,7 @@ How it solves it:
 <!-- Two ordered lists, Before and After, walking the same end user through the same task, written strictly from that user's seat
     Read the linked issue, ticket, or customer thread first so the flow reflects the real application and the routes its users actually hit; don't invent a generic scenario
     Lead each list with one plain sentence saying where the flow fails (Before) or succeeds (After), then number the steps
+     Keep it tight: aim for 3 to 5 steps per list, one line each, roughly 20 words max, and never pad a shorter flow with filler steps to hit the count. Cover the one path the PR changes and fold variants (case, other field, second endpoint) into a clause on the step they belong to rather than their own steps. The example below is the target length
     Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
     No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. "The upload hands back an ID that looks like OpenAI's own `file-abc123` instead of the scrambled one the gateway returned" is right, "no managed-file row was registered" is wrong
     Keep the two lists step-for-step identical until they diverge, so the changed step is obvious
@ -45,15 +48,15 @@ After: the same request comes back with real token counts, so the dashboard show

 ## Relevant issues

-<!-- e.g., "Fixes #000" -->
+<!-- e.g., "Fixes #000". Drop the section if there is none -->

 ## Affected release

-<!-- Only for a fix to a regression in a released or rc version (perf, memory, crash, or behavior): name the version it regressed in, e.g. "regression in v1.100.0" or "since v1.101.0-rc.1", and add the `backport-stable` label so the fix is cherry-picked onto the rc line before the stable is tagged. Leave the section blank otherwise -->
+<!-- Only for a fix to a regression in a released or rc version (perf, memory, crash, or behavior): name the version it regressed in, e.g. "regression in v1.100.0" or "since v1.101.0-rc.1", and add the `backport-stable` label so the fix is cherry-picked onto the rc line before the stable is tagged. Drop the section otherwise -->

 ## Linear ticket

-<!-- if you are an internal contributor, add "Resolves " followed by the Linear ticket e.g., "Resolves LIT-1234" to link the Linear ticket to the GitHub PR. If you don't have one, leave the section blank rather than guessing -->
+<!-- if you are an internal contributor, add "Resolves " followed by the Linear ticket e.g., "Resolves LIT-1234" to link the Linear ticket to the GitHub PR. If you don't have one, drop the section rather than guessing -->

 ## Pre-Submission checklist

@ -134,7 +137,7 @@ If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slac
     human reader
     If you assumed something instead of testing it, e.g. "only reproduces with X on" or "no
     user-observable behavior difference", list it here too with what breaks if it is wrong
-     Leave this section empty if there are none -->
+     Drop this section if there are none -->

 ## QA runbook

--- a/.github/scripts/assert_ci_coverage.py
+++ b/.github/scripts/assert_ci_coverage.py
@ -235,9 +235,7 @@ class Slice:
            return True  # a `-k` this parser cannot model is assumed to claim everything
        if any(term.lower() in relative_path.lower() for term in self.excluded):
            return False
-        return not self.required or any(
-            term.lower() in name.lower() for term in self.required for name in inner_names
-        )
+        return not self.required or any(term.lower() in name.lower() for term in self.required for name in inner_names)


 def _strings(node: object) -> Iterable[str]:
@ -307,9 +305,7 @@ def _matchable_names(relative_path: str) -> frozenset[str]:
    except (OSError, SyntaxError):
        return frozenset({relative_path})
    return frozenset({relative_path}) | frozenset(
-        node.name
-        for node in ast.walk(tree)
-        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef))
+        node.name for node in ast.walk(tree) if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef))
    )


@ -331,9 +327,7 @@ def _deselected_everywhere(allowlist: Allowlist) -> tuple[Finding, ...]:
    slices: Final = _slices()
    named_by_workflow: Final = _workflow_named_tokens()
    globbed: Final = tuple(
-        path
-        for path in _test_files()
-        if any(_token_covers(glob, path) for slice_ in slices for glob in slice_.globs)
+        path for path in _test_files() if any(_token_covers(glob, path) for slice_ in slices for glob in slice_.globs)
    )
    return tuple(
        Finding(
@ -363,11 +357,7 @@ def _shard_children(root: str, repo_root: pathlib.Path = REPO_ROOT) -> tuple[str
            child.relative_to(repo_root).as_posix()
            for child in (repo_root / root).iterdir()
            if not child.name.startswith(".")
-            and (
-                _holds_tests(child)
-                if child.is_dir()
-                else child.name.startswith("test_") and child.suffix == ".py"
-            )
+            and (_holds_tests(child) if child.is_dir() else child.name.startswith("test_") and child.suffix == ".py")
        )
    )

@ -499,13 +489,32 @@ def _check_shards() -> int:
    return 0


+def _integration_groups(runner: pathlib.Path) -> dict[str, tuple[str, ...]]:
+    module: Final = ast.parse(runner.read_text())
+    literal: Final = next(
+        node.value
+        for node in module.body
+        if isinstance(node, ast.AnnAssign) and isinstance(node.target, ast.Name) and node.target.id == "GROUPS"
+    )
+    mapping: Final = literal.args[0] if isinstance(literal, ast.Call) else literal
+    return {group: tuple(folders) for group, folders in ast.literal_eval(mapping).items()}
+
+
 def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozenset[str], tuple[Finding, ...]]:
-    manifest: Final = repo_root / "tests/integration/contracts.json"
-    if not manifest.exists():
+    runner: Final = repo_root / "tests/integration/run.py"
+    if not runner.exists():
        return frozenset(), ()
-    entries: Final = json.loads(manifest.read_text())
-    paths: Final = frozenset(node.split("::", 1)[0] for node in entries["tests"])
-    browser_paths: Final = frozenset(node.split("::", 1)[0] for node in entries.get("browser", {}))
+    groups: Final = _integration_groups(runner)
+    integration_root: Final = repo_root / "tests/integration"
+    paths: Final = frozenset(
+        str(path.relative_to(repo_root))
+        for folders in groups.values()
+        for folder in folders
+        for path in (integration_root / folder).glob("test_*.py")
+    )
+    browser_manifest: Final = repo_root / "tests/e2e/ui/tests/integrationCritical/expected.json"
+    browser_nodes: Final = json.loads(browser_manifest.read_text()) if browser_manifest.exists() else ()
+    browser_paths: Final = frozenset(node.split("::", 1)[0] for node in browser_nodes)
    circle_path: Final = repo_root / ".circleci/config.yml"
    circle: Final = yaml.safe_load(circle_path.read_text()) if circle_path.exists() else {}
    steps: Final = circle.get("jobs", {}).get("integration_contracts", {}).get("steps", ())
@ -526,15 +535,14 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
    )
    required: Final = (frozenset({"browser"}) if browser_paths else frozenset()) | frozenset(
        group
-        for group, folders in entries["groups"].items()
+        for group, folders in groups.items()
        if any(any(path.startswith(f"tests/integration/{folder}/") for folder in folders) for path in paths)
    )
    ungrouped: Final = frozenset(
        path
        for path in paths
        if sum(
-            any(path.startswith(f"tests/integration/{folder}/") for folder in folders)
-            for folders in entries["groups"].values()
+            any(path.startswith(f"tests/integration/{folder}/") for folder in folders) for folders in groups.values()
        )
        != 1
    )
@ -547,10 +555,6 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
        Finding(path, "integration contract is also selected by GitHub Actions")
        for path in paths
        if any(_token_covers(token, path) for token in gha_tokens)
-    ) + tuple(
-        Finding(path, "canonical integration test file is missing")
-        for path in paths
-        if not (repo_root / path).is_file()
    )
    browser_commands: Final = tuple(
        scalar.value
@ -592,7 +596,7 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
    ) + tuple(Finding(path, "canonical node must have exactly one integration group") for path in sorted(ungrouped))
    if not paths or not invoked or not scheduled:
        return frozenset(), findings + (
-            Finding(str(manifest.relative_to(repo_root)), "dedicated CircleCI runner is missing"),
+            Finding(str(runner.relative_to(repo_root)), "dedicated CircleCI runner is missing"),
        )
    return paths | browser_paths, findings + group_findings + browser_findings + exclusion_findings

--- a/.github/scripts/run_merge_smoke.py
+++ b/.github/scripts/run_merge_smoke.py
@ -0,0 +1,493 @@
+#!/usr/bin/env python3
+"""Merge smoke harness: bounded checks run inside a loopback-only Linux network namespace."""
+
+# ruff: noqa: T201  # CLI harness: stdout/stderr lines are the reported result
+
+from __future__ import annotations
+
+import argparse
+import contextlib
+import http.client
+import json
+import os
+import secrets
+import signal
+import socket
+import subprocess
+import sys
+import time
+from collections import Counter
+from collections.abc import Sequence
+from dataclasses import dataclass, field
+from pathlib import Path
+from types import MappingProxyType
+from typing import Final, NoReturn, TextIO, cast
+
+import pytest
+
+EXPECTED_CASES: Final = (
+    "CHAT-JSON",
+    "CHAT-TEXT-STREAM",
+    "CHAT-TOOL-STREAM",
+    "MODEL-ALLOW",
+    "MODEL-DENY",
+    "COST-EXPLICIT",
+    "COST-ZERO",
+    "LOG-CONTENT-ON",
+    "LOG-CONTENT-OFF",
+    "CALLBACK-SUCCESS",
+    "CALLBACK-FAILURE",
+)
+
+
+@dataclass(frozen=True, slots=True)
+class CheckResult:
+    ok: bool
+    detail: str = ""
+
+
+@dataclass(slots=True)
+class _Args:
+    command: str = ""
+    no_child: bool = False
+    expect: str = ""
+    litellm_bin: str | None = None
+    lite_bin: str | None = None
+    diagnostics_dir: str = ""
+    ready_deadline: float = 120.0
+    shutdown_deadline: float = 20.0
+    poll_interval: float = 0.5
+    manifest: str = ""
+    rootdir: str | None = None
+
+
+def fail(reason: str) -> NoReturn:
+    print(f"merge-smoke: FAIL {reason}", file=sys.stderr)
+    sys.exit(1)
+
+
+def ok(step: str) -> None:
+    print(f"merge-smoke: OK {step}")
+
+
+def tail(path: Path, lines: int = 20) -> str:
+    try:
+        return "\n".join(path.read_text(errors="replace").splitlines()[-lines:])
+    except OSError as exc:
+        return f"<cannot read {path}: {exc}>"
+
+
+def cmd_verify_isolation(args: _Args) -> int:
+    if os.geteuid() == 0:
+        fail("verify-isolation must run unprivileged (geteuid()==0)")
+    try:
+        socket.create_connection(("192.0.2.1", 9), timeout=3)
+    except OSError as exc:
+        print(f"external connect blocked as expected: errno={exc.errno} {exc}")
+    else:
+        fail("external TCP connect to 192.0.2.1:9 succeeded; namespace is not isolated")
+    listener: Final = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    listener.bind(("127.0.0.1", 0))
+    listener.listen(1)
+    port: Final = cast(int, listener.getsockname()[1])
+    client: Final = socket.create_connection(("127.0.0.1", port), timeout=5)
+    accepted: Final = listener.accept()
+    accepted[0].close()
+    client.close()
+    listener.close()
+    print(f"loopback connect ok on 127.0.0.1:{port}")
+    if not args.no_child:
+        proc: Final = subprocess.run(
+            [sys.executable, str(Path(__file__).resolve()), "verify-isolation", "--no-child"],
+            timeout=30,
+            capture_output=True,
+            text=True,
+        )
+        if proc.returncode != 0:
+            fail(f"child process did not inherit isolation: {proc.stderr.strip()}")
+        print("child process inherits isolation")
+    ok("verify-isolation")
+    return 0
+
+
+def cmd_interpreter(args: _Args) -> int:
+    print(sys.version)
+    print(sys.executable)
+    actual: Final = f"{sys.version_info.major}.{sys.version_info.minor}"
+    if actual != args.expect:
+        fail(f"interpreter is {actual}, expected {args.expect}")
+    ok(f"interpreter {actual}")
+    return 0
+
+
+def _run_cli(argv: Sequence[str], label: str) -> CheckResult:
+    try:
+        proc: Final = subprocess.run(list(argv), timeout=120, capture_output=True, text=True)
+    except subprocess.TimeoutExpired:
+        return CheckResult(ok=False, detail=f"{label} timed out after 120s")
+    sys.stdout.write(proc.stdout)
+    sys.stderr.write(proc.stderr)
+    if proc.returncode != 0:
+        return CheckResult(ok=False, detail=f"{label} exited {proc.returncode}")
+    return CheckResult(ok=True)
+
+
+def cmd_cli(args: _Args) -> int:
+    venv_bin: Final = Path(sys.executable).parent
+    litellm_bin: Final = Path(args.litellm_bin) if args.litellm_bin else venv_bin / "litellm"
+    lite_bin: Final = Path(args.lite_bin) if args.lite_bin else venv_bin / "lite"
+    commands: Final = (
+        ("import litellm", [sys.executable, "-c", "import litellm"]),
+        ("litellm --version", [str(litellm_bin), "--version"]),
+        ("lite version", [str(lite_bin), "version"]),
+    )
+    for label, argv in commands:
+        result = _run_cli(argv, label)
+        if not result.ok:
+            fail(result.detail)
+        ok(label)
+    return 0
+
+
+def _free_port() -> int:
+    sock: Final = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    sock.bind(("127.0.0.1", 0))
+    port: Final = cast(int, sock.getsockname()[1])
+    sock.close()
+    return port
+
+
+_CONFIG_TEMPLATE: Final = """model_list:
+  - model_name: smoke-model
+    litellm_params:
+      model: openai/smoke-model
+      api_base: http://127.0.0.1:9/v1
+      api_key: synthetic-key
+general_settings:
+  master_key: os.environ/LITELLM_MASTER_KEY
+"""
+
+
+def _listen_inode(port: int) -> str | None:
+    target: Final = f"{port:04X}"
+    for table in ("/proc/net/tcp", "/proc/net/tcp6"):
+        try:
+            rows = Path(table).read_text().splitlines()[1:]
+        except OSError:
+            continue
+        for row in rows:
+            cols = row.split()
+            if len(cols) > 9 and cols[3] == "0A" and cols[1].rsplit(":", 1)[-1] == target:
+                return cols[9]
+    return None
+
+
+def _ancestors(pid: int) -> frozenset[int]:
+    chain: Final[set[int]] = set()
+    pending: Final[list[int]] = [pid]
+    while pending:
+        current = pending.pop()
+        if current <= 0 or current in chain:
+            continue
+        chain.add(current)
+        try:
+            stat = Path(f"/proc/{current}/stat").read_text()
+        except OSError:
+            continue
+        pending.append(int(stat.rpartition(")")[2].split()[1]))
+    return frozenset(chain)
+
+
+def _socket_owner_pid(inode: str) -> int | None:
+    for proc_dir in Path("/proc").iterdir():
+        if not proc_dir.name.isdigit():
+            continue
+        fd_dir = proc_dir / "fd"
+        try:
+            for fd in fd_dir.iterdir():
+                try:
+                    if os.readlink(fd) == f"socket:[{inode}]":
+                        return int(proc_dir.name)
+                except OSError:
+                    continue
+        except OSError:
+            continue
+    return None
+
+
+def _verify_port_owner(port: int, proc: subprocess.Popen[bytes]) -> CheckResult:
+    inode: Final = _listen_inode(port)
+    if inode is None:
+        return CheckResult(ok=False, detail=f"no LISTEN socket found for port {port} in /proc/net/tcp")
+    owner: Final = _socket_owner_pid(inode)
+    if owner is None:
+        return CheckResult(ok=False, detail=f"no process owns the listen socket inode {inode} for port {port}")
+    if owner != proc.pid and proc.pid not in _ancestors(owner):
+        return CheckResult(
+            ok=False, detail=f"port {port} owned by pid {owner} outside the launched process group {proc.pid}"
+        )
+    if proc.poll() is not None:
+        return CheckResult(ok=False, detail=f"proxy exited with code {proc.returncode} after readiness")
+    return CheckResult(ok=True)
+
+
+def cmd_proxy_startup(args: _Args) -> int:
+    diagnostics: Final = Path(args.diagnostics_dir)
+    diagnostics.mkdir(parents=True, exist_ok=True)
+    venv_bin: Final = Path(sys.executable).parent
+    litellm_bin: Final = Path(args.litellm_bin) if args.litellm_bin else venv_bin / "litellm"
+    port: Final = _free_port()
+    master_key: Final = "sk-smoke-" + secrets.token_hex(16)
+    config_path: Final = diagnostics / "config.yaml"
+    config_path.write_text(_CONFIG_TEMPLATE)
+    log_path: Final = diagnostics / "proxy.log"
+    result_path: Final = diagnostics / "result.json"
+    outcome: Final[dict[str, object]] = {
+        "port": port,
+        "time_to_ready_s": None,
+        "shutdown_s": None,
+        "readiness": None,
+        "outcome": "failed",
+    }
+    log_file: Final = log_path.open("w")
+    env: Final = {
+        **os.environ,
+        "LITELLM_MASTER_KEY": master_key,
+        "LITELLM_LOCAL_MODEL_COST_MAP": "True",
+    }
+    started: Final = time.monotonic()
+    proc: Final = subprocess.Popen(
+        [str(litellm_bin), "--config", str(config_path), "--host", "127.0.0.1", "--port", str(port)],
+        stdout=log_file,
+        stderr=subprocess.STDOUT,
+        start_new_session=True,
+        env=env,
+    )
+    body: str | None = None
+    last_status: int | None = None
+    while time.monotonic() - started < args.ready_deadline:
+        if proc.poll() is not None:
+            log_file.close()
+            result_path.write_text(json.dumps(outcome))
+            fail(f"proxy exited early with code {proc.returncode}\n{tail(log_path)}")
+        try:
+            conn = http.client.HTTPConnection("127.0.0.1", port, timeout=5)
+            conn.request("GET", "/health/readiness")
+            resp = conn.getresponse()
+            last_status = resp.status
+            candidate = resp.read().decode()
+            conn.close()
+        except (http.client.HTTPException, ConnectionError, OSError):
+            time.sleep(args.poll_interval)
+            continue
+        if last_status == 200:
+            body = candidate
+            break
+        time.sleep(args.poll_interval)
+    outcome["time_to_ready_s"] = round(time.monotonic() - started, 3)
+    if body is None:
+        _terminate(proc, log_file)
+        result_path.write_text(json.dumps(outcome))
+        detail = f"last status {last_status}" if last_status is not None else "no response"
+        fail(f"readiness not reached within {args.ready_deadline}s ({detail})\n{tail(log_path)}")
+    outcome["readiness"] = body
+    try:
+        readiness = cast(object, json.loads(body))
+    except json.JSONDecodeError:
+        readiness = None
+    if readiness != {"status": "healthy", "db": "Not connected"}:
+        _terminate(proc, log_file)
+        result_path.write_text(json.dumps(outcome))
+        fail(f"unexpected readiness body: {body}")
+    owner_check: Final = _verify_port_owner(port, proc)
+    if not owner_check.ok:
+        _terminate(proc, log_file)
+        result_path.write_text(json.dumps(outcome))
+        fail(owner_check.detail)
+    shutdown_started: Final = time.monotonic()
+    os.killpg(proc.pid, signal.SIGTERM)
+    try:
+        proc.wait(timeout=args.shutdown_deadline)
+    except subprocess.TimeoutExpired:
+        os.killpg(proc.pid, signal.SIGKILL)
+        proc.wait(timeout=10)
+        outcome["shutdown_s"] = round(time.monotonic() - shutdown_started, 3)
+        log_file.close()
+        result_path.write_text(json.dumps(outcome))
+        fail(f"forced kill after {args.shutdown_deadline}s\n{tail(log_path)}")
+    outcome["shutdown_s"] = round(time.monotonic() - shutdown_started, 3)
+    try:
+        os.killpg(proc.pid, 0)
+    except ProcessLookupError:
+        pass
+    else:
+        os.killpg(proc.pid, signal.SIGKILL)
+        log_file.close()
+        result_path.write_text(json.dumps(outcome))
+        fail("process group survived SIGTERM")
+    log_file.close()
+    outcome["outcome"] = "ok"
+    result_path.write_text(json.dumps(outcome))
+    ok(f"proxy-startup ready={outcome['time_to_ready_s']}s shutdown={outcome['shutdown_s']}s")
+    return 0
+
+
+def _terminate(proc: subprocess.Popen[bytes], log_file: TextIO) -> None:
+    with contextlib.suppress(ProcessLookupError):
+        os.killpg(proc.pid, signal.SIGTERM)
+    try:
+        proc.wait(timeout=10)
+    except subprocess.TimeoutExpired:
+        with contextlib.suppress(ProcessLookupError):
+            os.killpg(proc.pid, signal.SIGKILL)
+        with contextlib.suppress(subprocess.TimeoutExpired):
+            proc.wait(timeout=10)
+    log_file.close()
+
+
+def _load_manifest(path: Path) -> MappingProxyType[str, str]:
+    def no_duplicates(pairs: list[tuple[object, object]]) -> dict[object, object]:
+        seen: dict[object, object] = {}
+        for key, value in pairs:
+            if key in seen:
+                raise ValueError(f"duplicate key in manifest: {key}")
+            seen[key] = value
+        return seen
+
+    raw_value: object = cast(object, json.loads(path.read_text(), object_pairs_hook=no_duplicates))
+    if not isinstance(raw_value, dict):
+        raise ValueError("manifest must be an object")
+    loaded: Final = cast(dict[object, object], raw_value)
+    cases_value: object = loaded.get("cases")
+    if not isinstance(cases_value, dict):
+        raise ValueError("manifest must be an object with a 'cases' object")
+    cases_any: Final = cast(dict[object, object], cases_value)
+    cases: Final = {k: v for k, v in cases_any.items() if isinstance(k, str) and isinstance(v, str)}
+    if len(cases) != len(cases_any):
+        raise ValueError("manifest 'cases' must map string ids to string node ids")
+    return MappingProxyType(cases)
+
+
+@dataclass(slots=True, eq=False)
+class _Recorder:
+    collect_failed: list[str] = field(default_factory=list)
+    collected: tuple[str, ...] = ()
+    reports: dict[str, list[tuple[str, str, bool]]] = field(default_factory=dict)
+
+    def pytest_collectreport(self, report: pytest.CollectReport) -> None:
+        if report.failed:
+            self.collect_failed.append(report.nodeid)
+
+    def pytest_collection_finish(self, session: pytest.Session) -> None:
+        self.collected = tuple(item.nodeid for item in session.items)
+
+    def pytest_runtest_logreport(self, report: pytest.TestReport) -> None:
+        self.reports.setdefault(report.nodeid, []).append((report.when, report.outcome, hasattr(report, "wasxfail")))
+
+
+def cmd_pytest(args: _Args) -> int:
+    try:
+        cases: Final = _load_manifest(Path(args.manifest))
+    except (OSError, ValueError, json.JSONDecodeError) as exc:
+        fail(f"manifest invalid: {exc}")
+    if tuple(cases) != EXPECTED_CASES:
+        fail(f"manifest case ids must be exactly {list(EXPECTED_CASES)} in order, got {list(cases)}")
+    node_ids: Final = tuple(cases.values())
+    if len(set(node_ids)) != len(node_ids):
+        fail("manifest node ids are not unique")
+    argv: Final = [
+        *node_ids,
+        "-p",
+        "no:cacheprovider",
+        "-p",
+        "no:xdist",
+        "-p",
+        "no:rerunfailures",
+        "-p",
+        "no:randomly",
+        "-rA",
+        "-q",
+        *(["--rootdir", args.rootdir] if args.rootdir else []),
+    ]
+
+    recorder: Final = _Recorder()
+    code: Final = pytest.main(argv, plugins=[recorder])
+    name_of: Final = MappingProxyType({node_id: case_id for case_id, node_id in cases.items()})
+    problems: Final[list[str]] = []
+    if code != 0:
+        problems.append(f"pytest exit code {code}")
+    for failed_id in recorder.collect_failed:
+        problems.append(f"collection failed: {name_of.get(failed_id, failed_id)}")
+    expected: Final = Counter(node_ids)
+    collected: Final = Counter(recorder.collected)
+    for node_id in expected - collected:
+        problems.append(f"missing case {name_of[node_id]} ({node_id})")
+    for node_id in collected - expected:
+        problems.append(f"unexpected test collected: {node_id}")
+    for node_id, count in collected.items():
+        if count > 1:
+            problems.append(f"duplicated test id: {node_id}")
+    if len(recorder.collected) != len(EXPECTED_CASES):
+        problems.append(f"collected {len(recorder.collected)} tests, expected {len(EXPECTED_CASES)}")
+    rows: Final[list[tuple[str, bool]]] = []
+    for case_id, node_id in cases.items():
+        reports = recorder.reports.get(node_id, [])
+        case_ok = (
+            bool(reports)
+            and all(outcome == "passed" and not wasxfail for _, outcome, wasxfail in reports)
+            and {when for when, _, _ in reports} >= {"setup", "call", "teardown"}
+        )
+        rows.append((case_id, case_ok))
+        if not reports:
+            problems.append(f"{case_id} ({node_id}) produced no runtest reports")
+            continue
+        for when, outcome, wasxfail in reports:
+            if outcome != "passed":
+                problems.append(f"{case_id} ({node_id}) {when} outcome={outcome}")
+            if wasxfail:
+                problems.append(f"{case_id} ({node_id}) {when} was xfail/xpass")
+        missing_phases = {"setup", "call", "teardown"} - {when for when, _, _ in reports}
+        for phase in sorted(missing_phases):
+            problems.append(f"{case_id} ({node_id}) missing {phase} report")
+    for case_id, passed in rows:
+        print(f"{case_id}  {'PASS' if passed else 'FAIL'}  {cases[case_id]}")
+    if problems:
+        for problem in problems:
+            print(f"merge-smoke: {problem}", file=sys.stderr)
+        fail("pytest verdict failed")
+    ok("pytest 11 cases")
+    return 0
+
+
+def main() -> int:
+    parser: Final = argparse.ArgumentParser(description=__doc__)
+    subs: Final = parser.add_subparsers(dest="command", required=True)
+    p_iso: Final = subs.add_parser("verify-isolation")
+    p_iso.add_argument("--no-child", action="store_true")
+    p_interp: Final = subs.add_parser("interpreter")
+    p_interp.add_argument("--expect", required=True)
+    p_cli: Final = subs.add_parser("cli")
+    p_cli.add_argument("--litellm-bin", default=None)
+    p_cli.add_argument("--lite-bin", default=None)
+    p_proxy: Final = subs.add_parser("proxy-startup")
+    p_proxy.add_argument("--diagnostics-dir", required=True)
+    p_proxy.add_argument("--litellm-bin", default=None)
+    p_proxy.add_argument("--ready-deadline", type=float, default=120)
+    p_proxy.add_argument("--shutdown-deadline", type=float, default=20)
+    p_proxy.add_argument("--poll-interval", type=float, default=0.5)
+    p_test: Final = subs.add_parser("pytest")
+    p_test.add_argument("--manifest", required=True)
+    p_test.add_argument("--rootdir", default=None)
+    args: Final = parser.parse_args(namespace=_Args())
+    handlers: Final = {
+        "verify-isolation": cmd_verify_isolation,
+        "interpreter": cmd_interpreter,
+        "cli": cmd_cli,
+        "proxy-startup": cmd_proxy_startup,
+        "pytest": cmd_pytest,
+    }
+    return handlers[args.command](args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
--- a/.github/scripts/verify_linux_native_wheel.py
+++ b/.github/scripts/verify_linux_native_wheel.py
@ -134,7 +134,16 @@ def main(
        uncompressed_wheel_size: Final = sum(member.file_size for member in wheel_members)
        native_path: Final = wheel.parent / "native" / Path(native_member.filename).name
        native_path.parent.mkdir(parents=True, exist_ok=True)
-        native_path.write_bytes(archive.read(native_member))
+        native_bytes: Final = archive.read(native_member)
+        native_path.write_bytes(native_bytes)
+        duplicated_vocabularies: Final = tuple(
+            member.filename
+            for member in wheel_members
+            if member.filename.startswith("litellm/litellm_core_utils/tokenizers/")
+            and re.fullmatch(r"[0-9a-f]{40}", PurePosixPath(member.filename).name)
+            and member.file_size > 0
+            and archive.read(member) in native_bytes
+        )

    wheel_metadata_tags_match: Final = (
        len(wheel_metadata_tags) == len(expanded_filename_tags)
@ -205,7 +214,7 @@ def main(
    native_module: Final = load_native_module(native_path)
    native_module_loads: Final = native_module is not None
    panic_test_hook_absent: Final = native_module is not None and not hasattr(native_module, "_panic_for_test")
-    native_size_limit: Final = 25_000_000
+    native_size_limit: Final = 40_000_000
    native_size_within_limit: Final = native_member.file_size <= native_size_limit
    validations: Final = (
        (f"Python tag is {EXPECTED_PYTHON_TAG}", python_tag == EXPECTED_PYTHON_TAG),
@ -222,7 +231,8 @@ def main(
        ("Python extension entry point is present", extension_entry_point_present),
        ("Native module loads", native_module_loads),
        ("Production module omits the panic test hook", panic_test_hook_absent),
-        ("Native extension does not exceed 25 MB", native_size_within_limit),
+        (f"Native extension does not exceed {native_size_limit / 1_000_000:.0f} MB", native_size_within_limit),
+        ("Tokenizer vocabularies are not duplicated in the native extension", not duplicated_vocabularies),
        ("Wheel contents are valid", not unexpected_members),
    )

@ -267,7 +277,8 @@ def main(
            ),
            (
                not native_size_within_limit,
-                f"native extension exceeds 20 MB: {native_member.file_size / 1_000_000:.2f} MB",
+                f"native extension exceeds {native_size_limit / 1_000_000:.0f} MB: "
+                f"{native_member.file_size / 1_000_000:.2f} MB",
            ),
            (bool(unexpected_members), f"wheel contains unexpected build artifacts: {', '.join(unexpected_members)}"),
        )
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@ -4,7 +4,13 @@ on:
  workflow_call:
    inputs:
      test-path:
-        description: "Pytest path(s) to run"
+        description: >-
+          Space-separated pytest paths to run. A path that no longer exists is
+          dropped with a warning instead of being passed to pytest, because one
+          missing path makes pytest-xdist collect nothing and report exit 5, which
+          the step treats as a drained shard. Options are passed through as
+          written, so use the `--flag=value` form: a bare `--ignore path` would
+          have its path existence-checked like any other token.
        required: true
        type: string
      workers:
@ -165,14 +171,22 @@ jobs:
          DIST: ${{ inputs.dist }}
          COVERAGE_CORE: sysmon
        run: |
-          found_path=false
-          for path in ${TEST_PATH}; do
-            if [ -e "${path%%::*}" ]; then
-              found_path=true
-              break
-            fi
+          pytest_args=()
+          existing_paths=0
+          for token in ${TEST_PATH:?}; do
+            case "${token}" in
+              -*) pytest_args+=("${token}") ;;
+              *)
+                if [ -e "${token%%::*}" ]; then
+                  pytest_args+=("${token}")
+                  existing_paths=$((existing_paths + 1))
+                else
+                  echo "::warning::${token} does not exist; drop it from this shard's test-path"
+                fi
+                ;;
+            esac
          done
-          if [ "$found_path" = false ]; then
+          if [ "${existing_paths}" -eq 0 ]; then
            echo "No path in TEST_PATH exists (${TEST_PATH}); nothing to run"
            exit 0
          fi
@ -181,7 +195,7 @@ jobs:
            xdist_args=(-n "${WORKERS}" --dist="${DIST}")
          fi
          set +e
-          uv run --no-sync pytest ${TEST_PATH:?} \
+          uv run --no-sync pytest "${pytest_args[@]}" \
            --tb=short -vv \
            --maxfail="${MAX_FAILURES}" \
            "${xdist_args[@]}" \
--- a/.github/workflows/check-ui-api-types.yml
+++ b/.github/workflows/check-ui-api-types.yml
@ -4,8 +4,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"

 permissions:
--- a/.github/workflows/ci-coverage.yml
+++ b/.github/workflows/ci-coverage.yml
@ -4,13 +4,10 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
  push:
    branches:
      - main
-      - litellm_internal_staging

 permissions:
  contents: read
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@ -67,12 +67,18 @@ jobs:
      # further up the stack are modified. The suppression is scoped to this one
      # file/rule pair via SARIF post-filtering so every other callsite of
      # py/weak-sensitive-data-hashing in the repository continues to be analyzed.
-      - name: Filter SARIF (OCI sha256)
+      # The same query fires on the HIBP k-anonymity lookup in
+      # litellm/proxy/auth/password_policy.py, where the password's SHA-1 is only
+      # a lookup key into the haveibeenpwned range API (the protocol mandates
+      # SHA-1) and the digest itself never leaves the proxy beyond its first 5
+      # characters.
+      - name: Filter SARIF (OCI sha256, HIBP sha1)
        if: matrix.language == 'python'
        uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1
        with:
          patterns: |
            -litellm/llms/oci/common_utils.py:py/weak-sensitive-data-hashing
+            -litellm/proxy/auth/password_policy.py:py/weak-sensitive-data-hashing
          input: sarif-results/python.sarif
          output: sarif-results/python.sarif

--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@ -4,7 +4,6 @@ on:
  push:
    branches:
      - main
-      - litellm_internal_staging
    paths:
      - "litellm/**"
      - "tests/benchmarks/**"
@ -13,10 +12,10 @@ on:
      - ".github/workflows/codspeed.yml"
      - ".github/actions/setup-uv-with-retries/**"
      - ".github/actions/cache-cargo-build/**"
+      - ".github/scripts/uv_sync_with_retries.sh"
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
    paths:
      - "litellm/**"
      - "tests/benchmarks/**"
@ -25,6 +24,7 @@ on:
      - ".github/workflows/codspeed.yml"
      - ".github/actions/setup-uv-with-retries/**"
      - ".github/actions/cache-cargo-build/**"
+      - ".github/scripts/uv_sync_with_retries.sh"
  # Allow CodSpeed to trigger backtest performance analysis
  # in order to generate initial data
  workflow_dispatch:
@ -59,19 +59,27 @@ jobs:

      - name: Cache the Rust build
        uses: ./.github/actions/cache-cargo-build
+        with:
+          profile: release

      # Build the wheel and resolve every dependency outside the CodSpeed
      # runner: the same maturin build took 42 minutes inside `codspeed run`
      # versus under 3 minutes as a plain step (LIT-6183)
-      - name: Build environment
+      - name: Build the release wheel
+        run: uv build --wheel --out-dir dist
+
+      - name: Install the wheel into the benchmark environment
+        run: |
+          UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/benchmark-venv" .github/scripts/uv_sync_with_retries.sh --frozen --no-default-groups --group benchmarks --no-install-project --python 3.12
+          uv pip install --python "${RUNNER_TEMP}/benchmark-venv/bin/python" --no-deps dist/*.whl
+
+      - name: Collect benchmarks
+        env:
+          PYTEST_DISABLE_PLUGIN_AUTOLOAD: "1"
+          LITELLM_REQUIRE_INSTALLED_WHEEL: "1"
        run: >
-          env PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-          uv run --frozen --no-default-groups
-          --with pytest==8.3.5
-          --with pytest-codspeed==4.3.0
-          --with "mcp>=2.2.0,<3.0"
-          --with "a2a-sdk>=1.1.0,<2.0"
-          pytest
+          "${RUNNER_TEMP}/benchmark-venv/bin/python" -I -m pytest
+          --import-mode=importlib
          -p pytest_codspeed.plugin
          tests/benchmarks/
          --codspeed
@ -82,13 +90,9 @@ jobs:
        with:
          mode: simulation
          run: >
-            env PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-            uv run --frozen --no-default-groups
-            --with pytest==8.3.5
-            --with pytest-codspeed==4.3.0
-            --with "mcp>=2.2.0,<3.0"
-            --with "a2a-sdk>=1.1.0,<2.0"
-            pytest
+            env PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 LITELLM_REQUIRE_INSTALLED_WHEEL=1
+            "${RUNNER_TEMP}/benchmark-venv/bin/python" -I -m pytest
+            --import-mode=importlib
            -p pytest_codspeed.plugin
            tests/benchmarks/
            --codspeed
--- a/.github/workflows/compat-matrix-image.yml
+++ b/.github/workflows/compat-matrix-image.yml
@ -0,0 +1,33 @@
+name: Compat Matrix Image
+
+on:
+  pull_request:
+    paths:
+      - tests/e2e/claude_code/cron_vm/**
+      - .github/workflows/compat-matrix-image.yml
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  compat-matrix-image:
+    name: compat-matrix-image
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build the Render cron image
+        run: docker build -f tests/e2e/claude_code/cron_vm/Dockerfile -t compat-matrix:${{ github.sha }} tests/e2e
+
+      - name: Run the pinned binaries as the cron user
+        run: |
+          docker run --rm compat-matrix:${{ github.sha }} bash -c 'set -e; whoami; claude --version; gh --version; uv --version'
--- a/.github/workflows/cost-map-guard.yml
+++ b/.github/workflows/cost-map-guard.yml
@ -4,8 +4,6 @@ on: # zizmor: ignore[dangerous-triggers] runs the base branch's code only; the P
  pull_request_target:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"

 permissions:
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@ -1,186 +0,0 @@
-name: Create Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Release tag (e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, 1.84.0-dev.2, 1.84.0.post1; legacy v1.83.10-stable still accepted)"
-        required: true
-        type: string
-      commit_hash:
-        description: "Full 40-char commit SHA to target"
-        required: true
-        type: string
-
-permissions: {}
-
-jobs:
-  release:
-    name: Create Release
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Validate inputs
-        env:
-          TAG: ${{ inputs.tag }}
-          COMMIT_HASH: ${{ inputs.commit_hash }}
-        run: |
-          if ! echo "${COMMIT_HASH}" | grep -qE '^[0-9a-f]{40}$'; then
-            echo "::error::commit_hash must be a full 40-character commit SHA"
-            exit 1
-          fi
-          if ! echo "${TAG}" | grep -qE '^v?[0-9]+\.[0-9]+\.[0-9]+'; then
-            echo "::error::tag must start with X.Y.Z (optional leading v), e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, or v1.83.10-stable"
-            exit 1
-          fi
-
-      - name: Create release
-        env:
-          TAG: ${{ inputs.tag }}
-          COMMIT_HASH: ${{ inputs.commit_hash }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            const tag = process.env.TAG;
-            const commitHash = process.env.COMMIT_HASH;
-
-            // Mark RC / dev / nightly / alpha / beta tags as GitHub pre-releases.
-            // Accept both PEP 440 (`.dev`) and SemVer (`-dev`) separators so tags
-            // like `1.84.0.dev2` and `1.84.0-dev.2` are both detected.
-            // PEP 440 post-releases (e.g. `1.84.0.post1`) and legacy `-stable[.patch.N]`
-            // are stable maintenance releases, not pre-releases.
-            const isPrerelease = /(?:rc|nightly|alpha|beta|[-.]dev)/i.test(tag);
-
-            // A stable release should only claim the repo "latest" badge when its
-            // version is >= the current latest. Otherwise a backport (e.g. 1.84.6)
-            // would steal "latest" from a newer line (e.g. 1.88.1).
-            const versionKey = (rawTag) => {
-              const m = String(rawTag).match(/^v?(\d+)\.(\d+)\.(\d+)/);
-              if (!m) return null;
-              const maintenance = String(rawTag).match(/(?:\.post|\.patch\.)(\d+)/i);
-              return [Number(m[1]), Number(m[2]), Number(m[3]), maintenance ? Number(maintenance[1]) : 0];
-            };
-            const isAtLeast = (a, b) => {
-              for (let i = 0; i < a.length; i++) {
-                if (a[i] !== b[i]) return a[i] > b[i];
-              }
-              return true;
-            };
-
-            const cosignSection = [
-              `## Verify Docker Image Signature`,
-              ``,
-              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit \`0112e53\`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).`,
-              ``,
-              `**Verify using the pinned commit hash (recommended):**`,
-              ``,
-              `A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:`,
-              ``,
-              '```bash',
-              `cosign verify \\`,
-              `  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \\`,
-              `  ghcr.io/berriai/litellm:${tag}`,
-              '```',
-              ``,
-              `**Verify using the release tag (convenience):**`,
-              ``,
-              `Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:`,
-              ``,
-              '```bash',
-              `cosign verify \\`,
-              `  --key https://raw.githubusercontent.com/BerriAI/litellm/${tag}/cosign.pub \\`,
-              `  ghcr.io/berriai/litellm:${tag}`,
-              '```',
-              ``,
-              `Expected output:`,
-              ``,
-              '```',
-              `The following checks were performed on each of these signatures:`,
-              `  - The cosign claims were validated`,
-              `  - The signatures were verified against the specified public key`,
-              '```',
-              ``,
-              `---`,
-              ``,
-            ].join('\n');
-
-            try {
-              let makeLatest = "false";
-              const newVersion = versionKey(tag);
-              if (!isPrerelease && newVersion) {
-                let latestVersion = null;
-                try {
-                  const latest = await github.rest.repos.getLatestRelease({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                  });
-                  latestVersion = versionKey(latest.data.tag_name);
-                } catch (error) {
-                  if (error.status !== 404) throw error;
-                }
-                makeLatest = (!latestVersion || isAtLeast(newVersion, latestVersion)) ? "true" : "false";
-              }
-
-              try {
-                await github.rest.git.createRef({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  ref: `refs/tags/${tag}`,
-                  sha: commitHash,
-                });
-              } catch (error) {
-                if (error.status !== 422) throw error;
-                const existing = await github.rest.git.getRef({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  ref: `tags/${tag}`,
-                });
-                if (existing.data.object.sha !== commitHash) {
-                  throw new Error(`Tag ${tag} already exists at ${existing.data.object.sha}, expected ${commitHash}`);
-                }
-              }
-
-              const response = await github.rest.repos.createRelease({
-                draft: true,
-                generate_release_notes: true,
-                name: tag,
-                owner: context.repo.owner,
-                prerelease: isPrerelease,
-                repo: context.repo.repo,
-                tag_name: tag,
-              });
-
-              const updatedBody = cosignSection + (response.data.body ?? '');
-              await github.rest.repos.updateRelease({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                release_id: response.data.id,
-                tag_name: tag,
-                body: updatedBody,
-                draft: false,
-              });
-
-              if (!isPrerelease) {
-                await github.rest.repos.updateRelease({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  release_id: response.data.id,
-                  tag_name: tag,
-                  make_latest: makeLatest,
-                });
-              }
-
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-
-  create-branch:
-    name: Create Release Branch
-    needs: release
-    permissions:
-      contents: write
-    uses: ./.github/workflows/create-release-branch.yml
-    with:
-      tag: ${{ inputs.tag }}
-      commit_hash: ${{ inputs.commit_hash }}
--- a/.github/workflows/create_daily_staging_branch.yml
+++ b/.github/workflows/create_daily_staging_branch.yml
@ -1,49 +0,0 @@
-name: Create Daily Staging Branch
-
-on:
-  schedule:
-    - cron: "0 0,12 * * *" # Runs every 12 hours at midnight and noon UTC
-  workflow_dispatch: # Allow manual trigger
-
-jobs:
-  create-staging-branch:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Create daily staging branch
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          BRANCH_NAME="litellm_oss_staging_$(date +'%m_%d_%Y')"
-          echo "Creating branch: $BRANCH_NAME"
-          if gh api "repos/${{ github.repository }}/git/ref/heads/$BRANCH_NAME" --silent 2>/dev/null; then
-            echo "Branch $BRANCH_NAME already exists. Skipping creation."
-            exit 0
-          fi
-          MAIN_SHA=$(gh api "repos/${{ github.repository }}/git/ref/heads/main" --jq '.object.sha')
-          gh api "repos/${{ github.repository }}/git/refs" -f ref="refs/heads/$BRANCH_NAME" -f sha="$MAIN_SHA" --silent
-          echo "Successfully created branch: $BRANCH_NAME at $MAIN_SHA"
-
-  create-internal-dev-branch:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Create internal dev branch
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          BRANCH_NAME="litellm_internal_dev_$(date +'%m_%d_%Y')"
-          echo "Creating branch: $BRANCH_NAME"
-          if gh api "repos/${{ github.repository }}/git/ref/heads/$BRANCH_NAME" --silent 2>/dev/null; then
-            echo "Branch $BRANCH_NAME already exists. Skipping creation."
-            exit 0
-          fi
-          MAIN_SHA=$(gh api "repos/${{ github.repository }}/git/ref/heads/main" --jq '.object.sha')
-          gh api "repos/${{ github.repository }}/git/refs" -f ref="refs/heads/$BRANCH_NAME" -f sha="$MAIN_SHA" --silent
-          echo "Successfully created branch: $BRANCH_NAME at $MAIN_SHA"
--- a/.github/workflows/guard-fork-dependencies.yml
+++ b/.github/workflows/guard-fork-dependencies.yml
@ -4,8 +4,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
    paths:
      - "uv.lock"
--- a/.github/workflows/image-scan.yml
+++ b/.github/workflows/image-scan.yml
@ -4,7 +4,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
      - litellm_oss_branch
      - "litellm_**"
    paths:
--- a/.github/workflows/issue_fixed_comment.yml
+++ b/.github/workflows/issue_fixed_comment.yml
@ -6,8 +6,12 @@ on:
  workflow_dispatch:
    inputs:
      issue_number:
-        description: "Closed issue number to comment on manually."
-        required: true
+        description: "Closed issue number to comment on and close the superseded pull requests of. Ignored by a sweep."
+        required: false
+      sweep:
+        description: "Close every open pull request whose linked issues were all fixed on the default branch. Reads every open pull request, so run it at most once an hour."
+        type: boolean
+        default: false
  pull_request:
    paths:
      - .github/workflows/issue_fixed_comment.yml
@ -39,16 +43,17 @@ jobs:
        with:
          bun-version: "1.4.0"

-      - name: Test the closer lookup, the release placement and the comment
+      - name: Test the closer lookup, the release placement, the comment and the superseded pull request close
        run: bun test scripts/comment-fixed-issue.test.ts

  comment-fixed-issue:
    if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm'
    runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 15
    permissions:
      contents: read
      issues: write
+      pull-requests: write
    steps:
      - name: Checkout scripts
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
@ -59,13 +64,16 @@ jobs:
      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
-          # Exact version, never latest: the next step holds an issues: write token
+          # Exact version, never latest: the next step holds issues: write and pull-requests: write tokens
          bun-version: "1.4.0"

-      - name: Name the release that carries the fix
+      - name: Name the release that carries the fix and close the pull requests it supersedes
+        shell: bash
        run: bun run scripts/comment-fixed-issue.ts | tee -a "${GITHUB_STEP_SUMMARY}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.issue.number || github.event.inputs.issue_number }}
+          SWEEP: ${{ github.event.inputs.sweep }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          DRY_RUN: ${{ vars.ISSUE_FIXED_COMMENT_ENABLED != 'true' }}
+          CLOSE_PRS_DRY_RUN: ${{ vars.ISSUE_FIXED_CLOSE_PRS_ENABLED != 'true' }}
--- a/.github/workflows/osv-scan.yml
+++ b/.github/workflows/osv-scan.yml
@ -4,8 +4,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
  schedule:
    - cron: "23 6 * * *"
--- a/.github/workflows/publish-basedpyright-base-counts.yml
+++ b/.github/workflows/publish-basedpyright-base-counts.yml
@ -1,6 +1,6 @@
 name: Publish basedpyright base counts

-# Every commit on main or litellm_internal_staging can become a future merge-base.
+# Every commit on main can become a future merge-base.
 # Publishing its per-rule basedpyright counts as an artifact lets
 # scripts/type_check_gate.py download them in seconds instead of paying a
 # 60-110s second basedpyright pass on every fresh worktree or moved merge-base.
@ -11,7 +11,6 @@ on:
  push:
    branches:
      - main
-      - litellm_internal_staging
  workflow_dispatch:
    inputs:
      ref:
--- a/.github/workflows/test-code-quality.yml
+++ b/.github/workflows/test-code-quality.yml
@ -4,13 +4,10 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
  push:
    branches:
      - main
-      - litellm_internal_staging

 permissions:
  contents: read
@ -83,6 +80,9 @@ jobs:
      - name: test_e2e_changed_gate
        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_changed_gate.py tests/code_coverage_tests/test_e2e_idp_stack.py

+      - name: Check merge smoke harness
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_merge_smoke.py
+
      - name: router_code_coverage
        run: uv run --no-sync python ./tests/code_coverage_tests/router_code_coverage.py

--- a/.github/workflows/test-e2e-changed.yml
+++ b/.github/workflows/test-e2e-changed.yml
@ -175,6 +175,8 @@ jobs:
        env:
          TESTS: ${{ needs.detect.outputs.tests }}
          E2E_FIXTURE_MODE: live
+          E2E_PROVIDER_EDGE_HOST_REACHABLE: '1'
+          COLUMNS: '400'
        run: |
          umask 077
          read -r -a test_files <<< "${TESTS}"
@ -189,6 +191,7 @@ jobs:
            uv run --no-sync python .github/e2e-stack/assert_tests_ran.py "${report}" "${test_files[@]}"
            verified=$?
            set -e
+            grep -E '^(FAILED|ERROR) ' "${log}" || true
            grep -E '^=+ .* in [0-9.]+s( \([0-9:]+\))? =+$' "${log}" | tail -n 1
            echo "::endgroup::"
            if [ "${status}" = "5" ]; then
@ -206,6 +209,24 @@ jobs:
            echo "pass ${pass} of 3 passed"
          done

+      - name: Redact the pytest output
+        if: always() && steps.boot.outcome == 'success'
+        run: |
+          umask 077
+          shopt -s nullglob
+          uv run --no-sync python .github/e2e-stack/redact_output.py \
+            --values tests/e2e/.env --values "${RUNNER_TEMP}/litellm-e2e-stack/stack.env" \
+            --out "${RUNNER_TEMP}/e2e-redacted" "${RUNNER_TEMP}"/e2e-pass-*.log "${RUNNER_TEMP}"/e2e-pass-*.xml
+
+      - name: Keep the redacted pytest output
+        if: always() && steps.boot.outcome == 'success'
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: e2e-changed-pytest-output-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/e2e-redacted
+          retention-days: 14
+          if-no-files-found: ignore
+
      - name: Stop the stack
        if: always() && steps.boot.outcome != 'skipped'
        run: bash .github/e2e-stack/down.sh
@ -214,7 +235,7 @@ jobs:
        if: always()
        run: |
          rm -f tests/e2e/.env "${RUNNER_TEMP}/e2e-boot.log" "${RUNNER_TEMP}"/e2e-pass-*.log "${RUNNER_TEMP}"/e2e-pass-*.xml
-          rm -rf "${RUNNER_TEMP}/litellm-e2e-stack"
+          rm -rf "${RUNNER_TEMP}/litellm-e2e-stack" "${RUNNER_TEMP}/e2e-redacted"

  gate:
    name: e2e-changed-tests
--- a/.github/workflows/test-linting.yml
+++ b/.github/workflows/test-linting.yml
@ -4,8 +4,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"

 permissions:
@ -130,6 +128,10 @@ jobs:
          echo "File content around line 43:"
          head -50 litellm/litellm_core_utils/custom_logger_registry.py | tail -10

+      - name: Check MCP operation boundary
+        if: steps.changes.outputs.decision != 'skip'
+        run: uv run --no-sync python scripts/check_mcp_operation_boundary.py
+
      - name: Run Ruff linting
        if: steps.changes.outputs.decision != 'skip'
        run: |
--- a/.github/workflows/test-litellm-ui-build.yml
+++ b/.github/workflows/test-litellm-ui-build.yml
@ -7,8 +7,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"

 concurrency:
--- a/.github/workflows/test-litellm-ui-lint.yml
+++ b/.github/workflows/test-litellm-ui-lint.yml
@ -6,8 +6,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"

 concurrency:
--- a/.github/workflows/test-litellm-ui-unit.yml
+++ b/.github/workflows/test-litellm-ui-unit.yml
@ -7,13 +7,10 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
  push:
    branches:
      - main
-      - litellm_internal_staging

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/test-mcp-dependency-resolution.yml
+++ b/.github/workflows/test-mcp-dependency-resolution.yml
@ -4,8 +4,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"

 permissions:
--- a/.github/workflows/test-merge-smoke.yml
+++ b/.github/workflows/test-merge-smoke.yml
@ -0,0 +1,95 @@
+name: Merge smoke checks
+
+on:
+  pull_request:
+    branches: [main, litellm_internal_staging, litellm_oss_staging, "litellm_**"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: merge-smoke-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  dashboard-build:
+    name: Dashboard build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build the dashboard stage
+        run: docker build --target ui-builder -f Dockerfile .
+
+  core-checks:
+    name: Core checks (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    env:
+      LITELLM_LOCAL_MODEL_COST_MAP: "True"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Install dependencies
+        run: .github/scripts/uv_sync_with_retries.sh --frozen --extra proxy --extra cli --group dev --group proxy-dev --python ${{ matrix.python-version }}
+
+      - name: Create the loopback-only network namespace
+        run: |
+          sudo ip netns add smoke
+          sudo ip netns exec smoke ip link set lo up
+          cat > "${RUNNER_TEMP}/in-netns" <<'WRAP'
+          #!/usr/bin/env bash
+          set -euo pipefail
+          exec sudo --preserve-env=LITELLM_LOCAL_MODEL_COST_MAP ip netns exec smoke setpriv --reuid "$(id -u)" --regid "$(id -g)" --init-groups -- env HOME="${HOME}" PATH="${PATH}" "$@"
+          WRAP
+          chmod +x "${RUNNER_TEMP}/in-netns"
+          echo "IN_NETNS=${RUNNER_TEMP}/in-netns" >> "${GITHUB_ENV}"
+
+      - name: Verify namespace isolation
+        run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py verify-isolation
+
+      - name: Verify interpreter version
+        run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py interpreter --expect ${{ matrix.python-version }}
+
+      - name: Import and CLI checks
+        run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py cli
+
+      - name: Proxy startup check
+        run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py proxy-startup --diagnostics-dir "${RUNNER_TEMP}/smoke-diagnostics"
+
+      - name: Run curated smoke cases
+        run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py pytest --manifest .github/merge-smoke-tests.json
+
+      - name: Upload smoke diagnostics
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: merge-smoke-diagnostics-py${{ matrix.python-version }}
+          path: ${{ runner.temp }}/smoke-diagnostics
+          if-no-files-found: ignore
+
+      - name: Remove the network namespace
+        if: always()
+        run: sudo ip netns delete smoke
--- a/.github/workflows/test-postgres.yml
+++ b/.github/workflows/test-postgres.yml
@ -4,13 +4,10 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
  push:
    branches:
      - main
-      - litellm_internal_staging
  workflow_dispatch:

 permissions:
--- a/.github/workflows/test-redis-compat.yml
+++ b/.github/workflows/test-redis-compat.yml
@ -4,13 +4,12 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
    paths:
      - "litellm/_redis.py"
      - "litellm/_redis_credential_provider.py"
      - "tests/test_litellm/test_redis.py"
+      - "tests/local_testing/test_caching.py"
      - "tests/test_litellm/caching/test_redis_connection_pool.py"
      - ".github/workflows/test-redis-compat.yml"
      - "pyproject.toml"
@ -28,6 +27,9 @@ jobs:
    name: "redis-py ${{ matrix.redis-version }}"
    runs-on: ubuntu-latest
    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write

    strategy:
      fail-fast: false
@ -57,7 +59,7 @@ jobs:

      - name: Install dependencies
        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra extra_proxy --extra semantic-router

      - name: Pin redis-py to the matrix version
        env:
@ -66,12 +68,33 @@ jobs:
          uv pip install "redis==${REDIS_VERSION:?}"
          uv run --no-sync python -c "import redis; assert redis.__version__ == '${REDIS_VERSION:?}', redis.__version__; print('redis-py', redis.__version__)"

+      - name: Build Redis for cluster authentication tests
+        run: |
+          curl --fail --location --retry 3 https://download.redis.io/releases/redis-7.2.16.tar.gz -o "$RUNNER_TEMP/redis-7.2.16.tar.gz"
+          echo "960a8ec15e34ff40e57ff16837b26b33bd81f2da6d24497bb63de532a323a18e  $RUNNER_TEMP/redis-7.2.16.tar.gz" | sha256sum --check
+          tar -xzf "$RUNNER_TEMP/redis-7.2.16.tar.gz" -C "$RUNNER_TEMP"
+          make -C "$RUNNER_TEMP/redis-7.2.16" -j2 MALLOC=libc OPTIMIZATION=-O1 redis-server
+          echo "$RUNNER_TEMP/redis-7.2.16/src" >> "$GITHUB_PATH"
+
      - name: Run redis unit tests
        run: |
+          redis-server --version
          uv run --no-sync pytest \
            tests/test_litellm/test_redis.py \
            tests/test_litellm/caching/test_redis_connection_pool.py \
+            tests/local_testing/test_caching.py::test_sync_cluster_authenticates_with_azure_credentials \
+            tests/local_testing/test_caching.py::test_sync_cluster_authenticates_with_gcp_credentials \
            --tb=short -vv \
            --reruns 2 \
            --reruns-delay 1 \
-            --durations=20
+            --durations=20 \
+            --cov=./litellm --cov-report=xml:coverage-redis.xml
+
+      - name: Upload Redis coverage
+        if: matrix.redis-version == '5.3.1'
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          files: coverage-redis.xml
+          flags: redis-compat
+          fail_ci_if_error: false
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@ -29,8 +29,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
    paths:
      - "litellm-rust/**"
@ -105,6 +103,16 @@ jobs:
        with:
          python-version: "3.12"

+      - uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Install Python dependencies for the bridge tests
+        working-directory: .
+        run: |
+          uv sync --frozen --no-install-project
+          echo "PYTHONPATH=$PWD/.venv/lib/$(ls .venv/lib)/site-packages" >> "$GITHUB_ENV"
+
      - run: rustup toolchain install --no-self-update

      - uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
@ -130,7 +138,7 @@ jobs:
      - name: Test secret manager feature combinations
        run: |
          cargo test -p litellm-auth-gcp --locked --no-default-features
-          for features in '' aws google aws,google; do
+          for features in '' aws google hashicorp azure cyberark aws,google aws,azure google,azure aws,google,azure aws,google,cyberark aws,google,azure,cyberark aws,google,hashicorp,azure,cyberark; do
            cargo test -p litellm-secrets --locked --no-default-features --features "$features"
          done

--- a/.github/workflows/test-semgrep.yml
+++ b/.github/workflows/test-semgrep.yml
@ -4,8 +4,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"

 permissions:
--- a/.github/workflows/test-terraform-modules.yml
+++ b/.github/workflows/test-terraform-modules.yml
@ -9,8 +9,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
    paths:
      - "terraform/litellm/aws/**"
--- a/.github/workflows/test-terraform-provider.yml
+++ b/.github/workflows/test-terraform-provider.yml
@ -8,8 +8,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
    paths:
      - "terraform/provider/**"
--- a/.github/workflows/test-unit-documentation.yml
+++ b/.github/workflows/test-unit-documentation.yml
@ -4,13 +4,10 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
  push:
    branches:
      - main
-      - litellm_internal_staging

 permissions:
  contents: read
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@ -4,13 +4,10 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
  push:
    branches:
      - main
-      - litellm_internal_staging

 permissions:
  contents: read
--- a/.github/workflows/test-unit.yml
+++ b/.github/workflows/test-unit.yml
@ -4,13 +4,10 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
  push:
    branches:
      - main
-      - litellm_internal_staging
  workflow_dispatch:

 permissions:
@ -107,26 +104,19 @@ jobs:
              tests/test_litellm/batches
              tests/test_litellm/secret_managers
              tests/test_litellm/a2a_protocol
-              tests/test_litellm/anthropic_interface
              tests/test_litellm/chat_completions
              tests/test_litellm/completion_extras
-              tests/test_litellm/compression
              tests/test_litellm/containers
              tests/test_litellm/endpoints
-              tests/test_litellm/models
-              tests/test_litellm/repositories
              tests/test_litellm/images
              tests/test_litellm/interactions
              tests/test_litellm/messages
+              tests/test_litellm/embeddings
              tests/test_litellm/ocr
              tests/test_litellm/passthrough
              tests/test_litellm/rag
-              tests/test_litellm/realtime_api
              tests/test_litellm/rerank_api
              tests/test_litellm/rust_bridge
-              tests/test_litellm/sandbox
-              tests/test_litellm/skills
-              tests/test_litellm/test_router
              tests/test_litellm/vector_stores
              tests/test_litellm/videos
              tests/test_litellm/test_*.py
--- a/.github/workflows/test-vscode-extension.yml
+++ b/.github/workflows/test-vscode-extension.yml
@ -6,8 +6,6 @@ on:
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"
    paths:
      - "vscode-extension/**"
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@ -2,12 +2,10 @@ name: GitHub Actions Security Analysis

 on:
  push:
-    branches: [main, litellm_internal_staging]
+    branches: [main]
  pull_request:
    branches:
      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
      - "litellm_**"

 concurrency:
--- a/AGENTS.md
+++ b/AGENTS.md
@ -33,11 +33,11 @@ End-to-end tests belong in `tests/e2e/` and must follow the harness conventions

 When creating PRs, target the repository's current default branch for both internal and external / OSS contributions. Check it with `python3 scripts/default_branch.py --branch` instead of assuming a branch name or relying on cached `origin/HEAD`

-When writing a PR body, treat the comments and imperative instructions inside .github/pull_request_template.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/pull_request_template.md from disk before writing a PR body to make sure you see every comment rule
+When writing a PR body, treat the comments and imperative instructions inside .github/pull_request_template.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/pull_request_template.md from disk before writing a PR body to make sure you see every comment rule. A section you have nothing to put in (Relevant issues, Affected release, Linear ticket, Caveats, QA runbook, and so on) is removed entirely, heading included, never left as an empty title

 Same applies for filing bug reports and feature requests, with .github/ISSUE_TEMPLATE/bug_report.yml and .github/ISSUE_TEMPLATE/feature_request.yml, respectively

-If you're resolving a linear ticket, in the "## Linear ticket" section of the PR, say "Resolves LIT-1234", replacing "LIT-1234" with the actual ticket id that you're resolving. If you don't have the ticket id, don't make one up or search for it. Just leave the section blank
+If you're resolving a linear ticket, in the "## Linear ticket" section of the PR, say "Resolves LIT-1234", replacing "LIT-1234" with the actual ticket id that you're resolving. If you don't have the ticket id, don't make one up or search for it. Just drop the section

 Never use `pytest` commands or the like as "Screenshots / Proof of Fix". We prefer curl'ing a live proxy instance running on localhost:4000 (I like to run it with `python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --detailed_debug --reload --use_v2_migration_resolver 2>&1 | tee litellm.log`; the Admin UI dev server is `npm run dev` in `ui/litellm-dashboard`, served on port 3000) and showing both the command run and the output. Also, it should hit real LLM provider APIs, not mocks, and cost real $$$ because that is the most realistic test. The proof of fix should be exactly what the end user / customer would see / do. The run logs in PR #27703 is a prime example of how to do it (not a huge fan of using a python test script that future me and the team will have no visibility into; I prefer just curl commands or a short list of bash commands (e.g., using `for`)). If it's a UI thing, or the main use case runs through a headful agentic coding tool like Claude Code or Codex, drive that surface yourself and embed your own before and after screenshots of it in the PR (the Admin UI page, or what the coding tool shows), next to an ordered list of the URLs to go to (e.g., http://localhost:4000/ui/?page=logs), where to click, and what fields to fill out so a reviewer can reproduce it

--- a/4
+++ b/4
@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1.7

 # Base image for building
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d

 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
 ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
--- a/1
+++ b/1
@ -164,6 +164,7 @@ lint-format-check-changed: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)

 # Linting targets
 lint-ruff: $(LINT_DEP_INSTALL)
+	$(UV_RUN) python scripts/check_mcp_operation_boundary.py
 	cd litellm && $(UV_RUN) ruff check . && cd ..
 	$(UV_RUN) ruff check --config ruff-tests.toml tests

--- a/README.md
+++ b/README.md
@ -307,6 +307,7 @@ For MCP OAuth, an upstream may advertise dynamic client registration but refuse
 | [Deepgram (`deepgram`)](https://docs.litellm.ai/docs/providers/deepgram) | ✅ | ✅ | ✅ |  |  | ✅ |  |  |  |  |
 | [DeepInfra (`deepinfra`)](https://docs.litellm.ai/docs/providers/deepinfra) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Deepseek (`deepseek`)](https://docs.litellm.ai/docs/providers/deepseek) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [Eden AI (`edenai`)](https://docs.litellm.ai/docs/providers/edenai) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |  |  |  |
 | [ElevenLabs (`elevenlabs`)](https://docs.litellm.ai/docs/providers/elevenlabs) | ✅ | ✅ | ✅ |  |  | ✅ | ✅ |  |  |  |
 | [Empower (`empower`)](https://docs.litellm.ai/docs/providers/empower) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Fal AI (`fal_ai`)](https://docs.litellm.ai/docs/providers/fal_ai) | ✅ | ✅ | ✅ |  | ✅ |  |  |  |  |  |
@ -356,7 +357,7 @@ For MCP OAuth, an upstream may advertise dynamic client registration but refuse
 | [Petals (`petals`)](https://docs.litellm.ai/docs/providers/petals) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Pinstripes (`pinstripes`)](https://docs.litellm.ai/docs/providers/pinstripes) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Predibase (`predibase`)](https://docs.litellm.ai/docs/providers/predibase) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
-| [Qwen AI Platform (`qwen_ai_platform`)](https://docs.litellm.ai/docs/providers/qwencloud) | ✅ | ✅ | ✅ | ✅ | ✅ |  |  |  |  | ✅ |
+| [Qianwen AI Platform (`qwen_ai_platform`)](https://docs.litellm.ai/docs/providers/qwencloud) | ✅ | ✅ | ✅ | ✅ | ✅ |  |  |  |  | ✅ |
 | [QwenCloud (`qwencloud`)](https://docs.litellm.ai/docs/providers/qwencloud) | ✅ | ✅ | ✅ | ✅ | ✅ |  |  |  |  | ✅ |
 | [Recraft (`recraft`)](https://docs.litellm.ai/docs/providers/recraft) |  |  |  |  | ✅ |  |  |  |  |  |
 | [Replicate (`replicate`)](https://docs.litellm.ai/docs/providers/replicate) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@ -1,5 +1,5 @@
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a

 FROM $UV_IMAGE AS uvbin
@ -61,6 +61,8 @@ RUN --mount=type=cache,target=/root/.cache/uv \
        --extra saml \
        --python python3.13

+RUN cp "$(python -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')"/litellm/rust_bridge/_native*.so litellm/rust_bridge/
+
 RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
    npm_config_cache=/root/.npm \
    prisma generate --schema=./schema.prisma
--- a/backend/routes/allowlist.py
+++ b/backend/routes/allowlist.py
@ -26,6 +26,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    "/v2/login",
    "/v3/login",
    "/logout",
+    "/session/logout",
    "/token",
    "/onboarding/",
    "/audit",
@ -51,6 +52,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    "/cache_settings",
    "/coordination_redis/",
    "/cost_tracking",
+    "/cost_optimization/",
    "/cost/",
    "/credentials",
    "/credential",
--- a/ci_cd/cost_map_guard.py
+++ b/ci_cd/cost_map_guard.py
@ -1,8 +1,11 @@
 """Guard the cost map on pull requests.

-Every pull request gets the file checks: the three cost map files parse, the backup copy matches the root file,
-and the JSON schema is in sync and validates the map. Pull requests from the cost map sync bot (branches named
-litellm_cost_map_sync_*) additionally may only touch those three files and may only add or update models.
+Every pull request whose diff against its merge base touches one of the three cost map files gets the file
+checks: the files parse, the backup copy matches the root file, and the JSON schema is in sync and validates the
+map. A pull request that leaves all three untouched skips them, since merging it keeps the base branch's copies
+and its head tree only carries whatever state the branch was cut from. Pull requests from the cost map sync bot
+(branches named litellm_cost_map_sync_*) always get the file checks and additionally may only touch those three
+files and may only add or update models.
 """

 from __future__ import annotations
@ -108,20 +111,37 @@ def _bot_failures(base: Snapshot, head_map: CostMap, changed_files: Sequence[str
    )


+def touches_cost_map(changed_files: Sequence[str]) -> bool:
+    return any(path in GUARDED_PATHS for path in changed_files)
+
+
+def contract_for(bot: bool, changed_files: Sequence[str]) -> str:
+    if bot:
+        return "bot contract enforced"
+    return "human PR, file checks only" if touches_cost_map(changed_files) else "human PR, cost map untouched"
+
+
 def guard_failures(base: Snapshot, head: Snapshot, changed_files: Sequence[str], bot: bool) -> tuple[str, ...]:
+    if not bot and not touches_cost_map(changed_files):
+        return ()
    head_map: Final = _parse_object(head.cost_map, COST_MAP_PATH)
    if isinstance(head_map, str):
        return (head_map,)
    return (*_file_failures(head, head_map), *(_bot_failures(base, head_map, changed_files) if bot else ()))


-def _git(*args: str) -> str:
+def _git(*args: str) -> str | None:
    result: Final = subprocess.run(("git", *args), check=False, capture_output=True, text=True)
-    return result.stdout if result.returncode == 0 else ""
+    return result.stdout if result.returncode == 0 else None


 def snapshot(revision: str) -> Snapshot:
-    return Snapshot(*(_git("show", f"{revision}:{path}") for path in GUARDED_PATHS))
+    return Snapshot(*(_git("show", f"{revision}:{path}") or "" for path in GUARDED_PATHS))
+
+
+def changed_files(base: str, head: str) -> tuple[str, ...] | None:
+    diff: Final = _git("diff", "--name-only", "--no-renames", base, head)
+    return None if diff is None else tuple(diff.splitlines())


 def main(argv: Sequence[str]) -> int:
@ -131,9 +151,12 @@ def main(argv: Sequence[str]) -> int:
    parser.add_argument("--head-ref", required=True, help="head branch name of the pull request")
    args: Final = parser.parse_args(argv)
    bot: Final = args.head_ref.startswith(BOT_BRANCH_PREFIX)
-    changed_files: Final = tuple(_git("diff", "--name-only", args.base, args.head).splitlines())
-    failures: Final = guard_failures(snapshot(args.base), snapshot(args.head), changed_files, bot)
-    contract: Final = "bot contract enforced" if bot else "human PR, file checks only"
+    changed: Final = changed_files(args.base, args.head)
+    if changed is None:
+        print(f"cost map guard failed: git diff {args.base} {args.head} failed, so the changed files are unknown")
+        return 1
+    failures: Final = guard_failures(snapshot(args.base), snapshot(args.head), changed, bot)
+    contract: Final = contract_for(bot, changed)
    if failures:
        print(f"cost map guard failed ({contract}):")
        print("\n".join(f"- {failure}" for failure in failures))
--- a/cookbook/litellm_proxy_server/grafana_dashboard/dashboard_all_metrics/grafana_dashboard.json
+++ b/cookbook/litellm_proxy_server/grafana_dashboard/dashboard_all_metrics/grafana_dashboard.json
@ -6267,6 +6267,63 @@
      ],
      "title": "Spend update queue sizes (litellm_<queue>_size)",
      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "description": "Requests that carried usage but were logged at $0 on a model whose pricing entry has a non-zero rate, by requested model and reason",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "lineWidth": 1,
+            "showPoints": "never",
+            "spanNulls": false
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 430
+      },
+      "id": 110,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(litellm_zero_cost_requests_total[$__rate_interval])) by (requested_model, reason)",
+          "legendFormat": "{{requested_model}} / {{reason}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "litellm_zero_cost_requests rate",
+      "type": "timeseries"
    }
  ],
  "preload": false,
--- a/docker/Dockerfile.database
+++ b/docker/Dockerfile.database
@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1.7

 # Base image for building
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d

 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
 ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1.7

 # Base images
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d
 ARG PROXY_EXTRAS_SOURCE=published
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
--- a/docker/README.md
+++ b/docker/README.md
@ -2,6 +2,17 @@

 This guide provides instructions for building and running the LiteLLM application using Docker and Docker Compose.

+> **Just want to run LiteLLM?** This guide builds from source. To run the published
+> image instead, use `docker-compose.quickstart.yml` in this directory — the
+> two-service stack (gateway + Postgres) that the
+> [Docker quickstart](https://docs.litellm.ai/docs/proxy/docker_quick_start) documents:
+>
+> ```bash
+> curl -sSLO https://github.com/BerriAI/litellm/raw/main/docker/docker-compose.quickstart.yml
+> printf 'LITELLM_MASTER_KEY=sk-%s\nLITELLM_SALT_KEY=sk-%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
+> docker compose -f docker-compose.quickstart.yml up -d
+> ```
+
 ## Prerequisites

 - Docker
--- a/docker/docker-compose.quickstart.yml
+++ b/docker/docker-compose.quickstart.yml
@ -0,0 +1,41 @@
+# LiteLLM quickstart stack: the gateway plus a Postgres database that stores
+# models, virtual keys, and spend logs. Used by
+# https://docs.litellm.ai/docs/proxy/docker_quick_start
+#
+#   curl -sSLO https://github.com/BerriAI/litellm/raw/main/docker/docker-compose.quickstart.yml
+#   printf 'LITELLM_MASTER_KEY=sk-%s\nLITELLM_SALT_KEY=sk-%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
+#   docker compose -f docker-compose.quickstart.yml up -d
+#
+# Compose reads .env from this directory. Keep it: regenerating LITELLM_SALT_KEY
+# makes credentials already stored in the database unreadable. For anything
+# beyond local evaluation, pin the image to a specific release tag.
+services:
+  litellm:
+    image: docker.litellm.ai/berriai/litellm:main-stable
+    ports:
+      - "4000:4000"
+    environment:
+      LITELLM_MASTER_KEY: ${LITELLM_MASTER_KEY:?set it in .env - see the header of this file}
+      LITELLM_SALT_KEY: ${LITELLM_SALT_KEY:?set it in .env - see the header of this file}
+      DATABASE_URL: postgresql://litellm:litellm@db:5432/litellm
+      STORE_MODEL_IN_DB: "True"
+    depends_on:
+      db:
+        condition: service_healthy
+
+  db:
+    image: postgres:16
+    environment:
+      POSTGRES_USER: litellm
+      POSTGRES_PASSWORD: litellm
+      POSTGRES_DB: litellm
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U litellm"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+
+volumes:
+  postgres_data:
--- a/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py
+++ b/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py
@ -2,10 +2,11 @@
 Polls LiteLLM_ManagedObjectTable to check if the batch job is complete, and if the cost has been tracked.
 """

+from collections.abc import Sequence
 from dataclasses import replace as dataclasses_replace
 from datetime import datetime, timedelta, timezone
 from types import MappingProxyType
-from typing import TYPE_CHECKING, Final, List, Literal, Optional, Tuple, cast
+from typing import TYPE_CHECKING, Final, List, Literal, Optional, Protocol, Tuple, cast

 from litellm._logging import verbose_proxy_logger
 from litellm._uuid import uuid
@ -18,8 +19,8 @@ if TYPE_CHECKING:
    from prisma import models as prisma_models

    from litellm.integrations.prometheus import PrometheusLogger
-    from litellm.proxy._types import LiteLLM_ManagedObjectTable
    from litellm.proxy.utils import PrismaClient, ProxyLogging
+    from litellm.repositories.prisma_protocols import TableActions
    from litellm.router import Router
    from litellm.types.router import Deployment
    from litellm.types.utils import LiteLLMBatch
@ -41,6 +42,42 @@ TERMINAL_MANAGED_OBJECT_STATUSES: Final[Tuple[str, ...]] = (
 )


+class _ManagedObjectRow(Protocol):
+    @property
+    def id(self) -> str: ...
+
+    @property
+    def unified_object_id(self) -> str: ...
+
+    @property
+    def created_by(self) -> str | None: ...
+
+    @property
+    def file_object(self) -> object: ...
+
+
+def _managed_object_table(prisma_client: "PrismaClient") -> "TableActions[_ManagedObjectRow]":
+    table: Final[TableActions[_ManagedObjectRow]] = prisma_client.db.litellm_managedobjecttable
+    return table
+
+
+def _user_table(prisma_client: "PrismaClient") -> "TableActions[prisma_models.LiteLLM_UserTable]":
+    table: Final[TableActions[prisma_models.LiteLLM_UserTable]] = prisma_client.db.litellm_usertable
+    return table
+
+
+def _token_table(prisma_client: "PrismaClient") -> "TableActions[prisma_models.LiteLLM_VerificationToken]":
+    table: Final[TableActions[prisma_models.LiteLLM_VerificationToken]] = (
+        prisma_client.db.litellm_verificationtoken
+    )
+    return table
+
+
+def _team_table(prisma_client: "PrismaClient") -> "TableActions[prisma_models.LiteLLM_TeamTable]":
+    table: Final[TableActions[prisma_models.LiteLLM_TeamTable]] = prisma_client.db.litellm_teamtable
+    return table
+
+
 class CheckBatchCost:
    def __init__(
        self,
@ -73,7 +110,7 @@ class CheckBatchCost:
        inline for a batch the first poll cycle then accounts again.
        """
        try:
-            await self.prisma_client.db.litellm_managedobjecttable.find_first(
+            await _managed_object_table(self.prisma_client).find_first(
                where={"file_purpose": "batch", "batch_processed": False}
            )
        except Exception as probe_err:
@ -97,10 +134,8 @@ class CheckBatchCost:
        if not user_id:
            return {}
        try:
-            user_row: prisma_models.LiteLLM_UserTable | None = (
-                await self.prisma_client.db.litellm_usertable.find_unique(
-                    where={"user_id": user_id}
-                )
+            user_row: prisma_models.LiteLLM_UserTable | None = await _user_table(self.prisma_client).find_unique(
+                where={"user_id": user_id}
            )
            if user_row is None:
                return {}
@ -117,11 +152,9 @@ class CheckBatchCost:
        if not api_key:
            return None
        try:
-            key_row: prisma_models.LiteLLM_VerificationToken | None = (
-                await self.prisma_client.db.litellm_verificationtoken.find_unique(
-                    where={"token": api_key}
-                )
-            )
+            key_row: prisma_models.LiteLLM_VerificationToken | None = await _token_table(
+                self.prisma_client
+            ).find_unique(where={"token": api_key})
            return getattr(key_row, "key_alias", None) if key_row is not None else None
        except Exception as e:
            verbose_proxy_logger.error(f"CheckBatchCost: could not look up key alias for batch {batch_id}: {e}")
@ -132,17 +165,15 @@ class CheckBatchCost:
        if not team_id:
            return None
        try:
-            team_row: prisma_models.LiteLLM_TeamTable | None = (
-                await self.prisma_client.db.litellm_teamtable.find_unique(
-                    where={"team_id": team_id}
-                )
+            team_row: prisma_models.LiteLLM_TeamTable | None = await _team_table(self.prisma_client).find_unique(
+                where={"team_id": team_id}
            )
            return getattr(team_row, "team_alias", None) if team_row is not None else None
        except Exception as e:
            verbose_proxy_logger.error(f"CheckBatchCost: could not look up team alias for team {team_id}: {e}")
            return None

-    async def _get_org_id(self, job: "LiteLLM_ManagedObjectTable", batch_id: str) -> str | None:
+    async def _get_org_id(self, job: "_ManagedObjectRow", batch_id: str) -> str | None:
        org_id = getattr(job, "org_id", None)
        if org_id:
            return org_id
@ -150,11 +181,9 @@ class CheckBatchCost:
        team_id = getattr(job, "team_id", None)
        if api_key:
            try:
-                key_row: prisma_models.LiteLLM_VerificationToken | None = (
-                    await self.prisma_client.db.litellm_verificationtoken.find_unique(
-                        where={"token": api_key}
-                    )
-                )
+                key_row: prisma_models.LiteLLM_VerificationToken | None = await _token_table(
+                    self.prisma_client
+                ).find_unique(where={"token": api_key})
                key_org_id = getattr(key_row, "organization_id", None) if key_row is not None else None
                if key_org_id:
                    return key_org_id
@ -166,10 +195,8 @@ class CheckBatchCost:
        if not team_id:
            return None
        try:
-            team_row: prisma_models.LiteLLM_TeamTable | None = (
-                await self.prisma_client.db.litellm_teamtable.find_unique(
-                    where={"team_id": team_id}
-                )
+            team_row: prisma_models.LiteLLM_TeamTable | None = await _team_table(self.prisma_client).find_unique(
+                where={"team_id": team_id}
            )
            return getattr(team_row, "organization_id", None) if team_row is not None else None
        except Exception as e:
@ -177,7 +204,7 @@ class CheckBatchCost:
            return None

    async def _build_creator_attribution_metadata(
-        self, job: "LiteLLM_ManagedObjectTable", batch_id: str
+        self, job: "_ManagedObjectRow", batch_id: str
    ) -> dict[str, object]:
        """
        Rebuild the spend-tracking metadata for the key, team, and tags that created the
@ -225,7 +252,7 @@ class CheckBatchCost:
        should not be polled.
        """
        cutoff: Final = datetime.now(timezone.utc) - timedelta(days=MANAGED_OBJECT_STALENESS_CUTOFF_DAYS)
-        result: Final = await self.prisma_client.db.litellm_managedobjecttable.update_many(
+        result: Final = await _managed_object_table(self.prisma_client).update_many(
            where={
                "file_purpose": "batch",
                "status": {"not_in": list(TERMINAL_MANAGED_OBJECT_STATUSES)},
@ -244,7 +271,7 @@ class CheckBatchCost:

        # A row already in a terminal status is never rewritten by the sweep above, so
        # without this it keeps a poll-page slot forever and starves newer batches.
-        retired: Final = await self.prisma_client.db.litellm_managedobjecttable.update_many(
+        retired: Final = await _managed_object_table(self.prisma_client).update_many(
            where={
                "file_purpose": "batch",
                "batch_processed": False,
@ -259,9 +286,9 @@ class CheckBatchCost:
                f"{MANAGED_OBJECT_STALENESS_CUTOFF_DAYS} days that were never costed"
            )

-    async def _fallback_find_jobs(self) -> list:
+    async def _fallback_find_jobs(self) -> "Sequence[_ManagedObjectRow]":
        """Query batch jobs without the batch_processed filter (for older schemas)."""
-        return await self.prisma_client.db.litellm_managedobjecttable.find_many(
+        return await _managed_object_table(self.prisma_client).find_many(
            where={
                "file_purpose": "batch",
                "status": {
@ -279,7 +306,7 @@ class CheckBatchCost:
            order={"created_at": "asc"},
        )

-    async def _retire_job(self, job: "LiteLLM_ManagedObjectTable", reason: str) -> None:
+    async def _retire_job(self, job: "_ManagedObjectRow", reason: str) -> None:
        """
        Take a row that can never be costed out of the poll page. Leaving it selectable
        would burn one of the MAX_OBJECTS_PER_POLL_CYCLE slots on every future cycle, and
@ -292,7 +319,7 @@ class CheckBatchCost:
            else {"status": "stale_expired"}
        )
        try:
-            await self.prisma_client.db.litellm_managedobjecttable.update(
+            await _managed_object_table(self.prisma_client).update(
                where={"id": job.id},
                data=data,
            )
@ -306,7 +333,7 @@ class CheckBatchCost:
            "so it will no longer be polled"
        )

-    async def _claim_job_for_costing(self, job: "LiteLLM_ManagedObjectTable") -> bool:
+    async def _claim_job_for_costing(self, job: "_ManagedObjectRow") -> bool:
        """
        Atomically flip batch_processed from false to true, returning whether this pod won
        the row. Every pod and uvicorn worker schedules its own poller against the shared
@ -321,7 +348,7 @@ class CheckBatchCost:
        if not self._has_batch_processed_column:
            return True
        try:
-            claimed: Final = await self.prisma_client.db.litellm_managedobjecttable.update_many(
+            claimed: Final = await _managed_object_table(self.prisma_client).update_many(
                where={"id": job.id, "batch_processed": False},
                data={"batch_processed": True},
            )
@ -332,7 +359,7 @@ class CheckBatchCost:
            return False
        return claimed > 0

-    async def _release_job_claim(self, job: "LiteLLM_ManagedObjectTable") -> None:
+    async def _release_job_claim(self, job: "_ManagedObjectRow") -> None:
        """Give a claimed row back once billing it failed, so a later poll cycle retries it.

        Safe to match on batch_processed=True: while this poller is active the retrieve
@ -342,7 +369,7 @@ class CheckBatchCost:
        if not self._has_batch_processed_column:
            return
        try:
-            await self.prisma_client.db.litellm_managedobjecttable.update_many(
+            await _managed_object_table(self.prisma_client).update_many(
                where={"id": job.id, "batch_processed": True},
                data={"batch_processed": False},
            )
@ -353,7 +380,7 @@ class CheckBatchCost:
            )

    @staticmethod
-    def _has_unified_id_without_model(job: "LiteLLM_ManagedObjectTable") -> bool:
+    def _has_unified_id_without_model(job: "_ManagedObjectRow") -> bool:
        """A unified id that decodes but carries no model_id can never be routed."""
        from litellm.proxy.openai_files_endpoints.common_utils import (
            convert_b64_uid_to_unified_uid,
@ -402,7 +429,7 @@ class CheckBatchCost:
        return isinstance(error, (NotFoundError, openai.NotFoundError)) and output_file_id in str(error)

    async def _finalize_unbilled_terminal_job(
-        self, job: "prisma_models.LiteLLM_ManagedObjectTable", response: "LiteLLMBatch"
+        self, job: "_ManagedObjectRow", response: "LiteLLMBatch"
    ) -> None:
        """Persist a terminal batch that has nothing billable, converting any raw
        provider file ids to managed ids, and take it out of the poll page."""
@ -426,7 +453,7 @@ class CheckBatchCost:
                "file_object": response.model_dump_json(),
                **({"batch_processed": True} if self._has_batch_processed_column else {}),
            }
-            await self.prisma_client.db.litellm_managedobjecttable.update(
+            await _managed_object_table(self.prisma_client).update(
                where={"id": job.id},
                data=update_data,
            )
@ -447,7 +474,7 @@ class CheckBatchCost:

    def _resolve_job_routing(
        self,
-        job: "LiteLLM_ManagedObjectTable",
+        job: "_ManagedObjectRow",
        prom_logger: Optional["PrometheusLogger"],
    ) -> Optional[Tuple[str, str]]:
        """
@ -524,7 +551,7 @@ class CheckBatchCost:

    def _resolve_unmanaged_provider_routing(
        self,
-        job: "LiteLLM_ManagedObjectTable",
+        job: "_ManagedObjectRow",
        prom_logger: Optional["PrometheusLogger"],
        llm_provider: str,
        bare_model_name: str,
@ -620,7 +647,7 @@ class CheckBatchCost:
    @classmethod
    def _get_managed_file_model_name(
        cls,
-        job: "LiteLLM_ManagedObjectTable",
+        job: "_ManagedObjectRow",
        deployment_info: "Deployment",
    ) -> Optional[str]:
        """
@ -640,7 +667,7 @@ class CheckBatchCost:
        )

    @staticmethod
-    def _get_input_file_id(job: "LiteLLM_ManagedObjectTable") -> Optional[str]:
+    def _get_input_file_id(job: "_ManagedObjectRow") -> Optional[str]:
        import json

        from litellm.types.utils import LiteLLMBatch
@ -660,7 +687,7 @@ class CheckBatchCost:

    async def _track_completed_batch_cost(
        self,
-        job: "LiteLLM_ManagedObjectTable",
+        job: "_ManagedObjectRow",
        response: "LiteLLMBatch",
        model_id: str,
        batch_id: str,
@ -936,7 +963,7 @@ class CheckBatchCost:
                # endpoint may transition a batch to "complete" before
                # CheckBatchCost runs.  The batch_processed=False filter
                # already prevents reprocessing finished batches.
-                jobs = await self.prisma_client.db.litellm_managedobjecttable.find_many(
+                jobs = await _managed_object_table(self.prisma_client).find_many(
                    where={
                        "file_purpose": "batch",
                        "batch_processed": False,
@ -1038,7 +1065,7 @@ class CheckBatchCost:
                    }
                    if self._has_batch_processed_column:
                        update_data["batch_processed"] = True
-                    await self.prisma_client.db.litellm_managedobjecttable.update(
+                    await _managed_object_table(self.prisma_client).update(
                        where={"id": job.id},
                        data=update_data,
                    )
--- a/enterprise/litellm_enterprise/proxy/common_utils/check_responses_cost.py
+++ b/enterprise/litellm_enterprise/proxy/common_utils/check_responses_cost.py
@ -6,7 +6,7 @@ same route are non-inference and free.
 """

 from datetime import datetime, timedelta, timezone
-from typing import TYPE_CHECKING, Dict, Optional, cast
+from typing import TYPE_CHECKING, Dict, Final, Optional, Protocol, cast

 import litellm
 from litellm._logging import verbose_proxy_logger
@ -22,11 +22,31 @@ from litellm.types.utils import BACKGROUND_RESPONSE_COST_POLL_CALL_ORIGIN

 if TYPE_CHECKING:
    from litellm.proxy.utils import PrismaClient, ProxyLogging
+    from litellm.repositories.prisma_protocols import TableActions
    from litellm.router import Router

 TERMINAL_RESPONSE_STATUSES = frozenset({"completed", "failed", "cancelled", "incomplete"})


+class _ManagedObjectRow(Protocol):
+    @property
+    def id(self) -> str: ...
+
+    @property
+    def unified_object_id(self) -> str: ...
+
+    @property
+    def created_by(self) -> str | None: ...
+
+    @property
+    def file_object(self) -> object: ...
+
+
+def _managed_object_table(prisma_client: "PrismaClient") -> "TableActions[_ManagedObjectRow]":
+    table: Final[TableActions[_ManagedObjectRow]] = prisma_client.db.litellm_managedobjecttable
+    return table
+
+
 class CheckResponsesCost:
    def __init__(
        self,
@ -128,7 +148,7 @@ class CheckResponsesCost:
                f"CheckResponsesCost: stale cleanup failed (poll will continue): {cleanup_err}"
            )

-        jobs = await self.prisma_client.db.litellm_managedobjecttable.find_many(
+        jobs = await _managed_object_table(self.prisma_client).find_many(
            where={
                "status": {"in": ["queued", "in_progress"]},
                "file_purpose": "response",
@ -138,7 +158,7 @@ class CheckResponsesCost:
        )
        
        verbose_proxy_logger.debug(f"Found {len(jobs)} response jobs to check")
-        completed_jobs = []
+        completed_jobs: Final[list[_ManagedObjectRow]] = []

        for job in jobs:
            unified_object_id = job.unified_object_id
@ -189,7 +209,7 @@ class CheckResponsesCost:

        # Mark completed jobs in the database
        if len(completed_jobs) > 0:
-            await self.prisma_client.db.litellm_managedobjecttable.update_many(
+            await _managed_object_table(self.prisma_client).update_many(
                where={"id": {"in": [job.id for job in completed_jobs]}},
                data={"status": "completed"},
            )
--- a/enterprise/litellm_enterprise/proxy/hooks/managed_files.py
+++ b/enterprise/litellm_enterprise/proxy/hooks/managed_files.py
@ -481,10 +481,8 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints):
        """
        if self.prisma_client is None:
            return
-        managed_object = (
-            await self.prisma_client.db.litellm_managedobjecttable.find_first(
-                where={"OR": [{"unified_object_id": object_id}, {"model_object_id": object_id}]}
-            )
+        managed_object = await _managed_object_table(self.prisma_client).find_first(
+            where={"OR": [{"unified_object_id": object_id}, {"model_object_id": object_id}]}
        )
        if managed_object is None:
            return
@ -509,10 +507,8 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints):
        """
        if self.prisma_client is None:
            return
-        managed_file = (
-            await self.prisma_client.db.litellm_managedfiletable.find_first(
-                where={"OR": [{"unified_file_id": file_id}, {"flat_model_file_ids": {"has": file_id}}]}
-            )
+        managed_file = await _managed_file_table(self.prisma_client).find_first(
+            where={"OR": [{"unified_file_id": file_id}, {"flat_model_file_ids": {"has": file_id}}]}
        )
        if managed_file is None:
            return
@ -535,8 +531,8 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints):
        provider_file_ids = tuple(
            file_id
            for file_id in (
-                getattr(response, "output_file_id", None),
-                getattr(response, "error_file_id", None),
+                response.output_file_id,
+                response.error_file_id,
            )
            if file_id and not _is_base64_encoded_unified_file_id(file_id)
        )
@ -544,10 +540,8 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints):
            return
        if self.prisma_client is None:
            return
-        batch_row = (
-            await self.prisma_client.db.litellm_managedobjecttable.find_first(
-                where={"unified_object_id": response.id}
-            )
+        batch_row = await _managed_object_table(self.prisma_client).find_first(
+            where={"unified_object_id": response.id}
        )
        if batch_row is None or (
            batch_row.created_by is None and batch_row.team_id is None
--- a/enterprise/pyproject.toml
+++ b/enterprise/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-enterprise"
-version = "0.1.69"
+version = "0.1.70"
 description = "Package for LiteLLM Enterprise features"
 readme = "README.md"
 requires-python = ">=3.9"
@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.1.69"
+version = "0.1.70"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-enterprise==",
--- a/gateway/Dockerfile
+++ b/gateway/Dockerfile
@ -1,5 +1,5 @@
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:e624c5d5e42382ce7165ddafcbbf8e6769a24cbd02ea6114b880b05ae5ba2a8d
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
 # Checksum from https://www.pgbouncer.org/downloads/ (the Wolfi repo only carries 1.24.x)
 ARG PGBOUNCER_VERSION=1.25.2
--- a/gateway/routes/allowlist.py
+++ b/gateway/routes/allowlist.py
@ -96,16 +96,19 @@ GATEWAY_PATH_PREFIXES: tuple[str, ...] = (
    "/assemblyai/",
    "/eu.assemblyai/",
    "/deepgram/",
+    "/fal_ai/",
    "/langfuse/",
    "/vllm/",
    "/mistral/",
    "/typesafe/",
+    "/openrouter/",
    "/nvidia_nim/",
    "/groq/",
    "/voyage/",
    "/cursor/",
    "/milvus/",
    "/openai_passthrough/",
+    "/tinyfish/",
    # Dynamic provider / toolset passthrough (path templates)
    "/{provider}/",
    "/toolset/",
@ -128,6 +131,7 @@ GATEWAY_EXACT_PATHS: frozenset[str] = frozenset(
        "/redoc",
        "/test",
        "/debug/memory/summary",
+        "/api/event_logging/batch",
    }
 )

--- a/helm/litellm/templates/backend/deployment.yaml
+++ b/helm/litellm/templates/backend/deployment.yaml
@ -7,6 +7,9 @@ metadata:
    {{- include "litellm.commonLabels" . | nindent 4 }}
    app.kubernetes.io/component: backend
 spec:
+  {{- if and (not .Values.backend.hpa.enabled) (not (kindIs "invalid" .Values.backend.replicaCount)) }}
+  replicas: {{ .Values.backend.replicaCount }}
+  {{- end }}
  {{- with .Values.backend.strategy }}
  strategy:
    {{- toYaml . | nindent 4 }}
--- a/helm/litellm/templates/gateway/deployment.yaml
+++ b/helm/litellm/templates/gateway/deployment.yaml
@ -7,6 +7,9 @@ metadata:
    {{- include "litellm.commonLabels" . | nindent 4 }}
    app.kubernetes.io/component: gateway
 spec:
+  {{- if and (not .Values.gateway.hpa.enabled) (not (kindIs "invalid" .Values.gateway.replicaCount)) }}
+  replicas: {{ .Values.gateway.replicaCount }}
+  {{- end }}
  {{- with .Values.gateway.strategy }}
  strategy:
    {{- toYaml . | nindent 4 }}
--- a/helm/litellm/templates/ingress.yaml
+++ b/helm/litellm/templates/ingress.yaml
@ -61,7 +61,7 @@
    "/v1/fine-tuning" "/fine-tuning" "/v1/responses" "/responses" "/v1/threads" "/threads"
    "/v1/assistants" "/assistants" "/v1/vector_stores" "/vector_stores" "/v1/indexes"
    "/v1/models" "/models" "/openai" "/engines"
-    "/v1/messages" "/messages" "/v1/skills" "/v1/a2a" "/a2a"
+    "/v1/messages" "/messages" "/v1/skills" "/v1/a2a" "/a2a" "/api/event_logging"
    "/v1/rerank" "/v2/rerank" "/rerank" "/v1/ocr" "/ocr" "/v1/rag" "/rag"
    "/v1/video" "/v1/videos" "/video" "/videos" "/v1/search" "/search"
    "/v1/containers" "/containers" "/v1/evals" "/v1/memory" "/queue/chat"
--- a/helm/litellm/templates/ui/deployment.yaml
+++ b/helm/litellm/templates/ui/deployment.yaml
@ -7,6 +7,9 @@ metadata:
    {{- include "litellm.commonLabels" . | nindent 4 }}
    app.kubernetes.io/component: ui
 spec:
+  {{- if and (not .Values.ui.hpa.enabled) (not (kindIs "invalid" .Values.ui.replicaCount)) }}
+  replicas: {{ .Values.ui.replicaCount }}
+  {{- end }}
  {{- with .Values.ui.strategy }}
  strategy:
    {{- toYaml . | nindent 4 }}
--- a/helm/litellm/tests/replica_count_tests.yaml
+++ b/helm/litellm/tests/replica_count_tests.yaml
@ -0,0 +1,100 @@
+suite: test fixed replica count when HPA is disabled
+templates:
+  - gateway/deployment.yaml
+  - gateway/configmap.yaml
+  - backend/deployment.yaml
+  - ui/deployment.yaml
+values:
+  - ./values/required.yaml
+tests:
+  - it: gateway renders replicaCount into spec.replicas when its HPA is disabled
+    template: gateway/deployment.yaml
+    set:
+      gateway.hpa.enabled: false
+      gateway.replicaCount: 3
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: spec.replicas
+          value: 3
+
+  - it: backend renders replicaCount into spec.replicas when its HPA is disabled
+    template: backend/deployment.yaml
+    set:
+      backend.hpa.enabled: false
+      backend.replicaCount: 2
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 2
+
+  - it: ui renders replicaCount into spec.replicas when its HPA is disabled
+    template: ui/deployment.yaml
+    set:
+      ui.hpa.enabled: false
+      ui.replicaCount: 2
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 2
+
+  - it: replicaCount 0 scales the gateway to zero instead of being treated as unset
+    template: gateway/deployment.yaml
+    set:
+      gateway.hpa.enabled: false
+      gateway.replicaCount: 0
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 0
+
+  - it: a component with HPA disabled but no replicaCount set keeps omitting spec.replicas, so upgrades do not reset a hand-scaled Deployment
+    set:
+      gateway.hpa.enabled: false
+      backend.hpa.enabled: false
+      ui.hpa.enabled: false
+    asserts:
+      - notExists:
+          path: spec.replicas
+        template: gateway/deployment.yaml
+      - notExists:
+          path: spec.replicas
+        template: backend/deployment.yaml
+      - notExists:
+          path: spec.replicas
+        template: ui/deployment.yaml
+
+  - it: every component omits spec.replicas when its HPA is enabled, so the autoscaler owns the count
+    set:
+      gateway.hpa.enabled: true
+      gateway.replicaCount: 3
+      backend.hpa.enabled: true
+      backend.replicaCount: 3
+      ui.hpa.enabled: true
+      ui.replicaCount: 3
+    asserts:
+      - notExists:
+          path: spec.replicas
+        template: gateway/deployment.yaml
+      - notExists:
+          path: spec.replicas
+        template: backend/deployment.yaml
+      - notExists:
+          path: spec.replicas
+        template: ui/deployment.yaml
+
+  - it: a component with HPA disabled renders replicas while a sibling with HPA enabled does not
+    set:
+      gateway.hpa.enabled: false
+      gateway.replicaCount: 4
+      backend.hpa.enabled: true
+      backend.replicaCount: 4
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 4
+        template: gateway/deployment.yaml
+      - notExists:
+          path: spec.replicas
+        template: backend/deployment.yaml
--- a/helm/litellm/values.yaml
+++ b/helm/litellm/values.yaml
@ -397,6 +397,11 @@ gateway:
  #   failureThreshold: 30
  #   periodSeconds: 10
  startupProbe: {}
+  # Optional fixed pod count, rendered into the Deployment's spec.replicas only
+  # when hpa.enabled is false. Unset by default so an existing Deployment keeps
+  # its current count; with the HPA on, the autoscaler owns the count, e.g.:
+  #   replicaCount: 3
+  replicaCount:
  hpa:
    enabled: true
    minReplicas: 1
@ -524,6 +529,8 @@ backend:
  strategy: {}
  # Optional startupProbe; same shape as gateway.startupProbe. Empty by default.
  startupProbe: {}
+  # Same semantics as gateway.replicaCount.
+  replicaCount:
  hpa:
    enabled: true
    minReplicas: 1
@ -590,6 +597,8 @@ ui:
  strategy: {}
  # Optional startupProbe; same shape as gateway.startupProbe. Empty by default.
  startupProbe: {}
+  # Same semantics as gateway.replicaCount.
+  replicaCount:
  hpa:
    enabled: false
    minReplicas: 1
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917000000_add_agent_access_group_ids/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917000000_add_agent_access_group_ids/migration.sql
@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_AgentsTable" ADD COLUMN IF NOT EXISTS "access_group_ids" TEXT[] DEFAULT ARRAY[]::TEXT[];
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260919000000_add_autorouter_user_session_rollup/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260919000000_add_autorouter_user_session_rollup/migration.sql
@ -0,0 +1,42 @@
+CREATE TABLE IF NOT EXISTS "LiteLLM_AutoRouterUserSession" (
+    "user_id" TEXT NOT NULL,
+    "api_key" TEXT NOT NULL,
+    "session_id" TEXT NOT NULL,
+    "router_name" TEXT NOT NULL,
+    "router_type" TEXT NOT NULL,
+    "first_turn_at" TIMESTAMP(3) NOT NULL,
+    "last_turn_at" TIMESTAMP(3) NOT NULL,
+    "last_model" TEXT NOT NULL,
+    "models" JSONB NOT NULL DEFAULT '{}',
+    "turns" INTEGER NOT NULL DEFAULT 0,
+    "unordered_turns" INTEGER NOT NULL DEFAULT 0,
+    "covered_turns" INTEGER NOT NULL DEFAULT 0,
+    "cache_hits" INTEGER NOT NULL DEFAULT 0,
+    "same_model_turns" INTEGER NOT NULL DEFAULT 0,
+    "same_model_hits" INTEGER NOT NULL DEFAULT 0,
+    "first_visit_turns" INTEGER NOT NULL DEFAULT 0,
+    "first_visit_hits" INTEGER NOT NULL DEFAULT 0,
+    "return_turns" INTEGER NOT NULL DEFAULT 0,
+    "return_hits" INTEGER NOT NULL DEFAULT 0,
+    "return_expired_misses" INTEGER NOT NULL DEFAULT 0,
+    "return_within_ttl_misses" INTEGER NOT NULL DEFAULT 0,
+    "ttl_5m_turns" INTEGER NOT NULL DEFAULT 0,
+    "ttl_1h_turns" INTEGER NOT NULL DEFAULT 0,
+    "total_tokens" BIGINT NOT NULL DEFAULT 0,
+    "spend" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "saved_spend" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "savings_estimated_turns" INTEGER NOT NULL DEFAULT 0,
+    "savings_estimated_actual_spend" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "savings_estimated_saved_spend" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "savings_estimated_baseline_models" JSONB NOT NULL DEFAULT '{}',
+    "classifier_cost" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "classifier_cost_recorded_turns" INTEGER NOT NULL DEFAULT 0,
+    "tier_turns" JSONB NOT NULL DEFAULT '{}',
+    "baseline_models" JSONB NOT NULL DEFAULT '{}',
+
+    CONSTRAINT "LiteLLM_AutoRouterUserSession_pkey" PRIMARY KEY ("user_id", "api_key", "session_id", "router_name")
+);
+
+CREATE INDEX IF NOT EXISTS "idx_autorouter_user_session_last_turn" ON "LiteLLM_AutoRouterUserSession"("last_turn_at");
+
+CREATE INDEX IF NOT EXISTS "idx_autorouter_user_session_user_last_turn" ON "LiteLLM_AutoRouterUserSession"("user_id", "last_turn_at");
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260920041500_add_policy_attachment_is_default/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260920041500_add_policy_attachment_is_default/migration.sql
@ -0,0 +1 @@
+ALTER TABLE "LiteLLM_PolicyAttachmentTable" ADD COLUMN IF NOT EXISTS "is_default" BOOLEAN NOT NULL DEFAULT false;
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260921000000_add_password_reset_columns/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260921000000_add_password_reset_columns/migration.sql
@ -0,0 +1,3 @@
+ALTER TABLE "LiteLLM_UserTable" ADD COLUMN IF NOT EXISTS "password_reset_required" BOOLEAN;
+
+ALTER TABLE "LiteLLM_UserTable" ADD COLUMN IF NOT EXISTS "last_breach_check_at" TIMESTAMP(3);
--- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
@ -73,6 +73,7 @@ model LiteLLM_AgentsTable {
  static_headers       Json?          @default("{}")
  extra_headers        String[]       @default([])
  agent_access_groups String[]       @default([])
+  access_group_ids     String[]       @default([])
  object_permission_id String?
  object_permission LiteLLM_ObjectPermissionTable? @relation(fields: [object_permission_id], references: [object_permission_id])
  spend      Float    @default(0.0)
@ -246,6 +247,8 @@ model LiteLLM_UserTable {
    organization_id String?
    object_permission_id String?
    password  String?
+    password_reset_required Boolean?
+    last_breach_check_at DateTime?
    teams    String[] @default([])
    user_role  String?
 		max_budget Float?
@ -1419,6 +1422,7 @@ model LiteLLM_PolicyAttachmentTable {
  models           String[]  @default([])  // Model names or patterns
  tags             String[]  @default([])  // Tag patterns (e.g., ["healthcare", "prod-*"])
  priority         Int?                    // Explicit execution order
+  is_default       Boolean   @default(false)  // Applied only when no non-default attachment matches
  created_at       DateTime  @default(now())
  created_by       String?
  updated_at       DateTime  @default(now()) @updatedAt
@ -1620,6 +1624,47 @@ model LiteLLM_AutoRouterSession {
  @@index([last_turn_at], map: "idx_autorouter_session_last_turn")
 }

+model LiteLLM_AutoRouterUserSession {
+  user_id               String
+  api_key               String
+  session_id            String
+  router_name           String
+  router_type           String
+  first_turn_at         DateTime
+  last_turn_at          DateTime
+  last_model            String
+  models                Json     @default("{}")
+  turns                 Int      @default(0)
+  unordered_turns       Int      @default(0)
+  covered_turns         Int      @default(0)
+  cache_hits            Int      @default(0)
+  same_model_turns      Int      @default(0)
+  same_model_hits       Int      @default(0)
+  first_visit_turns     Int      @default(0)
+  first_visit_hits      Int      @default(0)
+  return_turns          Int      @default(0)
+  return_hits           Int      @default(0)
+  return_expired_misses Int      @default(0)
+  return_within_ttl_misses  Int      @default(0)
+  ttl_5m_turns          Int      @default(0)
+  ttl_1h_turns          Int      @default(0)
+  total_tokens          BigInt   @default(0)
+  spend                 Float    @default(0)
+  saved_spend           Float    @default(0)
+  savings_estimated_turns Int    @default(0)
+  savings_estimated_actual_spend Float @default(0)
+  savings_estimated_saved_spend Float @default(0)
+  savings_estimated_baseline_models Json @default("{}")
+  classifier_cost       Float    @default(0)
+  classifier_cost_recorded_turns Int @default(0)
+  tier_turns            Json     @default("{}")
+  baseline_models       Json     @default("{}")
+
+  @@id([user_id, api_key, session_id, router_name])
+  @@index([last_turn_at], map: "idx_autorouter_user_session_last_turn")
+  @@index([user_id, last_turn_at], map: "idx_autorouter_user_session_user_last_turn")
+}
+
 // Shadow eval: evaluation of an auto-router against one or more keys' live traffic, in
 // either direction. forward duplicates the requests the keys did not route through the
 // router through it, answering whether they should adopt it; reverse duplicates the
--- a/litellm-proxy-extras/pyproject.toml
+++ b/litellm-proxy-extras/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-proxy-extras"
-version = "0.4.100"
+version = "0.4.101"
 description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package."
 readme = "README.md"
 requires-python = ">=3.9"
@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.4.100"
+version = "0.4.101"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-proxy-extras==",
--- a/litellm-rust/Cargo.lock
+++ b/litellm-rust/Cargo.lock
--- a/litellm-rust/Cargo.toml
+++ b/litellm-rust/Cargo.toml
@ -9,6 +9,8 @@ license = "MIT"
 repository = "https://github.com/BerriAI/litellm"

 [workspace.dependencies]
+litellm-tracing = { path = "crates/tracing" }
+tracing = "0.1"
 litellm-core = { path = "crates/core" }
 litellm-host = { path = "crates/host" }
 litellm-callbacks-legacy-python = { path = "crates/callbacks-legacy-python" }
@ -22,12 +24,24 @@ litellm-secrets = { path = "crates/secrets" }
 litellm-secrets-types = { path = "crates/secrets-types" }
 litellm-secrets-aws = { path = "crates/secrets-aws" }
 litellm-secrets-google = { path = "crates/secrets-google" }
+litellm-secrets-hashicorp = { path = "crates/secrets-hashicorp" }
+litellm-secrets-azure = { path = "crates/secrets-azure" }
+litellm-secrets-cyberark = { path = "crates/secrets-cyberark" }
 litellm-http = { path = "crates/http" }
 litellm-llms = { path = "crates/llms" }
 litellm-types = { path = "crates/types" }
 litellm-core-utils = { path = "crates/core-utils" }
 litellm-cache = { path = "crates/cache" }
+litellm-cache-azure-blob = { path = "crates/cache-azure-blob" }
 litellm-cache-memory = { path = "crates/cache-memory" }
+litellm-cache-redis = { path = "crates/cache-redis" }
+litellm-cache-s3 = { path = "crates/cache-s3" }
+litellm-cache-gcs = { path = "crates/cache-gcs" }
+litellm-cache-disk = { path = "crates/cache-disk" }
+litellm-cache-redis-semantic = { path = "crates/cache-redis-semantic" }
+litellm-cache-response = { path = "crates/cache-response" }
+litellm-cache-qdrant-semantic = { path = "crates/cache-qdrant-semantic" }
+litellm-cache-testing = { path = "crates/cache-testing" }
 litellm-token-counter = { path = "crates/token-counter" }
 litellm-token-counter-fast = { path = "crates/token-counter-fast" }
 litellm-token-counter-huggingface = { path = "crates/token-counter-huggingface" }
@ -45,9 +59,14 @@ pyo3-async-runtimes = { version = "0.29.0", features = ["tokio-runtime"] }
 pythonize = "0.29.0"
 rand = "0.8"
 reqwest = { version = "0.12", default-features = false, features = ["json", "multipart", "rustls-tls", "http2", "stream"] }
+qdrant-client = { version = "1.19.0", default-features = false }
+uuid = { version = "1", features = ["v4"] }
 rstest = "0.26.1"
 rstest_reuse = "0.7.0"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
+rustify = "=0.7.0"
+rustify_derive = "=0.5.5"
+vaultrs = { version = "=0.8.0", default-features = false, features = ["rustls"] }
 rustls-native-certs = "0.8"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["float_roundtrip"] }
@ -64,6 +83,7 @@ base64 = "0.22"
 moka = { version = "0.12.16", features = ["future"] }
 strum = { version = "0.28.0", features = ["derive"] }
 url = "2.5.8"
+percent-encoding = "2.3"
 webpki-roots = "1"
 time = { version = "0.3.53", features = ["parsing"] }
 criterion = "0.8.2"
@ -72,7 +92,7 @@ veil = "0.3.0"

 [profile.release]
 opt-level = 3
-lto = "thin"
+lto = "fat"
 codegen-units = 1
 panic = "unwind"
 debug = false
--- a/litellm-rust/crates/auth-aws/src/aws.rs
+++ b/litellm-rust/crates/auth-aws/src/aws.rs
@ -621,6 +621,26 @@ mod tests {
        None
    }

+    #[test]
+    fn secret_names_cover_environment_reads() {
+        let seen = std::sync::Arc::new(std::sync::Mutex::new(
+            std::collections::BTreeSet::<String>::new(),
+        ));
+        let recorded = seen.clone();
+        let env = |name: &str| {
+            recorded.lock().unwrap().insert(name.to_string());
+            None
+        };
+        resolve_aws_region(None, &Map::new(), &env);
+        aws_auth_config(&Map::new(), &env);
+        assert!(
+            seen.lock()
+                .unwrap()
+                .iter()
+                .all(|name| crate::constants::SECRET_NAMES.contains(&name.as_str()))
+        );
+    }
+
    #[test]
    fn a_region_comes_from_the_call_then_the_model_then_the_environment() {
        let params = Map::from_iter([("aws_region_name".to_string(), Value::from("eu-west-1"))]);
--- a/litellm-rust/crates/auth-aws/src/constants.rs
+++ b/litellm-rust/crates/auth-aws/src/constants.rs
@ -14,6 +14,19 @@ pub const AWS_WEB_IDENTITY_TOKEN_FILE: &str = "AWS_WEB_IDENTITY_TOKEN_FILE";
 pub const AWS_STS_ENDPOINT: &str = "AWS_STS_ENDPOINT";
 pub const AWS_EXTERNAL_ID: &str = "AWS_EXTERNAL_ID";
 pub const AWS_BEARER_TOKEN_BEDROCK: &str = "AWS_BEARER_TOKEN_BEDROCK";
+pub const SECRET_NAMES: &[&str] = &[
+    AWS_ACCESS_KEY_ID,
+    AWS_SECRET_ACCESS_KEY,
+    AWS_SESSION_TOKEN,
+    AWS_REGION_NAME,
+    AWS_REGION,
+    AWS_SESSION_NAME,
+    AWS_PROFILE_NAME,
+    AWS_ROLE_NAME,
+    AWS_WEB_IDENTITY_TOKEN,
+    AWS_STS_ENDPOINT,
+    AWS_EXTERNAL_ID,
+];

 /// Headers SigV4 covers, beyond the `x-amz-` / `x-amzn-` prefixes. Mirrors
 /// Python's `_filter_headers_for_aws_signature` allowlist.
--- a/litellm-rust/crates/auth-azure/src/lib.rs
+++ b/litellm-rust/crates/auth-azure/src/lib.rs
@ -3,5 +3,5 @@ mod native;
 mod resolve;
 mod types;

-pub use resolve::AzureAuthService;
-pub use types::AzureAuthInputs;
+pub use resolve::{AzureAuthService, SECRET_NAMES};
+pub use types::{AzureAuthInputs, ConfigValue};
--- a/litellm-rust/crates/auth-azure/src/resolve.rs
+++ b/litellm-rust/crates/auth-azure/src/resolve.rs
@ -19,6 +19,17 @@ const AZURE_AUTHORITY_HOST_ENV: &str = "AZURE_AUTHORITY_HOST";
 const AZURE_CREDENTIAL_ENV: &str = "AZURE_CREDENTIAL";
 const AZURE_FEDERATED_TOKEN_FILE_ENV: &str = "AZURE_FEDERATED_TOKEN_FILE";

+pub const SECRET_NAMES: &[&str] = &[
+    AZURE_AD_TOKEN_ENV,
+    AZURE_TENANT_ID_ENV,
+    AZURE_CLIENT_ID_ENV,
+    AZURE_CLIENT_SECRET_ENV,
+    AZURE_SCOPE_ENV,
+    AZURE_AUTHORITY_HOST_ENV,
+    AZURE_CREDENTIAL_ENV,
+    AZURE_FEDERATED_TOKEN_FILE_ENV,
+];
+
 #[derive(Clone, Debug)]
 pub(crate) enum AzureCredentialPlan {
    Supplied(Sourced<ResolvedCredential>),
@ -440,13 +451,14 @@ fn non_empty_reference(value: &str, kind: &str) -> Result<String, Error> {

 #[cfg(test)]
 mod tests {
+    use std::collections::BTreeSet;
    use std::future::Future;
    use std::sync::{Arc, Mutex};

    use serde_json::json;

    use super::{
-        AzureAuthService, AzureCredentialPlan, AzureTokenAcquirer, oidc_reference,
+        AzureAuthService, AzureCredentialPlan, AzureTokenAcquirer, SECRET_NAMES, oidc_reference,
        resolve_reference, select_auth_plan,
    };
    use crate::native::ValidatedAzureRequest;
@ -517,6 +529,24 @@ mod tests {
        assert!(matches!(plan, AzureCredentialPlan::Native(_)));
    }

+    #[test]
+    fn secret_names_cover_environment_reads() {
+        let seen = std::sync::Arc::new(std::sync::Mutex::new(BTreeSet::<String>::new()));
+        let recorded = seen.clone();
+        let inputs = AzureAuthInputs::default();
+        select_auth_plan(&inputs, &|name| {
+            recorded.lock().unwrap().insert(name.to_string());
+            None
+        })
+        .unwrap();
+        assert!(
+            seen.lock()
+                .unwrap()
+                .iter()
+                .all(|name| SECRET_NAMES.contains(&name.as_str()))
+        );
+    }
+
    #[test]
    fn supplied_token_does_not_require_refresh() {
        let params = json!({"azure_ad_token": "token"});
--- a/litellm-rust/crates/auth-azure/src/types.rs
+++ b/litellm-rust/crates/auth-azure/src/types.rs
@ -51,6 +51,21 @@ pub struct AzureAuthInputs {
 }

 impl AzureAuthInputs {
+    pub fn default_credential_for_scope(scope: &str) -> Self {
+        Self {
+            azure_scope: ConfigValue::Value(Sourced::new(
+                scope.to_string(),
+                InputSource::Deployment,
+            )),
+            azure_credential: ConfigValue::Value(Sourced::new(
+                "DefaultAzureCredential".to_string(),
+                InputSource::Deployment,
+            )),
+            enable_azure_ad_token_refresh: Sourced::new(true, InputSource::Deployment),
+            ..Self::default()
+        }
+    }
+
    pub fn or_configured_token_refresh(self, enabled: bool) -> Self {
        if *self.enable_azure_ad_token_refresh.value() || !enabled {
            return self;
--- a/litellm-rust/crates/auth-gcp/src/lib.rs
+++ b/litellm-rust/crates/auth-gcp/src/lib.rs
@ -23,6 +23,16 @@ const VERTEXAI_PROJECT_ENV: &str = "VERTEXAI_PROJECT";
 const VERTEXAI_LOCATION_ENV: &str = "VERTEXAI_LOCATION";
 const VERTEX_LOCATION_ENV: &str = "VERTEX_LOCATION";

+pub const SECRET_NAMES: &[&str] = &[
+    VERTEX_AI_API_KEY_ENV,
+    VERTEXAI_API_KEY_ENV,
+    VERTEXAI_CREDENTIALS_ENV,
+    GOOGLE_APPLICATION_CREDENTIALS_ENV,
+    VERTEXAI_PROJECT_ENV,
+    VERTEXAI_LOCATION_ENV,
+    VERTEX_LOCATION_ENV,
+];
+
 #[derive(Clone, Debug, Default)]
 pub struct VertexConfig {
    credentials: Option<Sourced<SecretValue>>,
@ -128,6 +138,14 @@ impl VertexAuth {
        }
    }

+    pub async fn access_token(
+        &self,
+        config: &VertexConfig,
+        env_lookup: &(dyn Fn(&str) -> Option<String> + Sync),
+    ) -> Result<String, Error> {
+        self.load_provider(config, env_lookup).await?.token().await
+    }
+
    pub async fn validate_environment(
        &self,
        headers: Vec<(String, String)>,
@ -398,6 +416,7 @@ fn auth_acquisition_error(error: gcp_auth::Error) -> Error {

 #[cfg(test)]
 mod tests {
+    use std::collections::BTreeSet;
    use std::sync::atomic::{AtomicUsize, Ordering};

    use serde_json::json;
@ -468,6 +487,27 @@ mod tests {
        );
    }

+    #[tokio::test]
+    async fn secret_names_cover_environment_reads() {
+        let seen = Arc::new(std::sync::Mutex::new(BTreeSet::<String>::new()));
+        let recorded = seen.clone();
+        let env = |name: &str| {
+            recorded.lock().unwrap().insert(name.to_string());
+            None
+        };
+        let auth = auth(Arc::new(AtomicUsize::new(0)), Arc::new(AtomicUsize::new(0)));
+        auth.validate_environment(Vec::new(), None, &VertexConfig::default(), &env)
+            .await
+            .unwrap();
+        get_vertex_ai_location(&VertexConfig::default(), &env);
+        assert!(
+            seen.lock()
+                .unwrap()
+                .iter()
+                .all(|name| SECRET_NAMES.contains(&name.as_str()))
+        );
+    }
+
    #[test]
    fn empty_primary_values_fall_back_to_python_aliases() {
        let config = config(json!({
--- a/litellm-rust/crates/auth-types/src/secret.rs
+++ b/litellm-rust/crates/auth-types/src/secret.rs
@ -1,4 +1,5 @@
 use serde::Deserialize;
+use std::hash::{Hash, Hasher};
 use veil::Redact;

 #[derive(Redact, Clone, Deserialize)]
@ -23,6 +24,12 @@ impl PartialEq for SecretValue {

 impl Eq for SecretValue {}

+impl Hash for SecretValue {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.0.hash(state);
+    }
+}
+
 #[cfg(test)]
 mod tests {
    use super::SecretValue;
--- a/litellm-rust/crates/cache-azure-blob/Cargo.toml
+++ b/litellm-rust/crates/cache-azure-blob/Cargo.toml
@ -0,0 +1,27 @@
+[package]
+name = "litellm-cache-azure-blob"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+litellm-auth-azure.workspace = true
+litellm-auth-types.workspace = true
+litellm-cache.workspace = true
+
+async-trait = "0.1"
+azure_core = "1.1.0"
+azure_storage_blob = "1.1.0"
+futures-util.workspace = true
+reqwest.workspace = true
+tokio.workspace = true
+url.workspace = true
+
+[dev-dependencies]
+litellm-cache-response.workspace = true
+litellm-cache-testing.workspace = true
+rstest.workspace = true
+serde_json.workspace = true
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+wiremock = "0.6.5"
--- a/litellm-rust/crates/cache-azure-blob/src/cache.rs
+++ b/litellm-rust/crates/cache-azure-blob/src/cache.rs
@ -0,0 +1,248 @@
+use std::{sync::Arc, time::Duration};
+
+use azure_core::{
+    credentials::TokenCredential,
+    error::ErrorKind,
+    http::{ClientOptions, RequestContent, Transport},
+};
+use azure_storage_blob::{
+    BlobContainerClient, BlobContainerClientOptions,
+    models::{BlobClientUploadOptions, StorageErrorCode},
+};
+use futures_util::{TryStreamExt, future::try_join_all};
+use litellm_cache::{
+    BaseCache, BatchCache, CacheCodec, DisconnectCache, Error, ExactCacheContext, FlushCache,
+};
+use tokio::runtime::Handle;
+use url::Url;
+
+use crate::{credential::AzureBlobCredential, transport::ReqwestTransport};
+
+pub struct AzureBlobCache<C> {
+    container: BlobContainerClient,
+    codec: C,
+    runtime: Handle,
+    account_url: String,
+    container_name: String,
+}
+
+impl<C: CacheCodec> AzureBlobCache<C> {
+    /// `http` is the host's pooled client; the SDK sends every request through it.
+    pub async fn connect(
+        account_url: &str,
+        container: &str,
+        http: reqwest::Client,
+        codec: C,
+        runtime: Handle,
+    ) -> Result<Self, Error> {
+        Self::connect_with_options(
+            account_url,
+            container,
+            Some(Arc::new(AzureBlobCredential::default())),
+            ClientOptions {
+                transport: Some(Transport::new(Arc::new(ReqwestTransport(http)))),
+                ..ClientOptions::default()
+            },
+            codec,
+            runtime,
+        )
+        .await
+    }
+
+    pub async fn connect_with_options(
+        account_url: &str,
+        container: &str,
+        credential: Option<Arc<dyn TokenCredential>>,
+        client_options: ClientOptions,
+        codec: C,
+        runtime: Handle,
+    ) -> Result<Self, Error> {
+        let parsed = Url::parse(account_url).map_err(|_| Error::Unavailable)?;
+        let account_url = parsed.as_str().trim_end_matches('/').to_string();
+        let container_url = {
+            let mut url = parsed;
+            url.path_segments_mut()
+                .map_err(|()| Error::Unavailable)?
+                .pop_if_empty()
+                .push(container);
+            url
+        };
+        let client = BlobContainerClient::new(
+            container_url,
+            credential,
+            Some(BlobContainerClientOptions {
+                client_options,
+                ..BlobContainerClientOptions::default()
+            }),
+        )
+        .map_err(|_| Error::Unavailable)?;
+        let cache = Self {
+            container: client,
+            codec,
+            runtime,
+            account_url,
+            container_name: container.to_string(),
+        };
+        cache.create_container().await?;
+        Ok(cache)
+    }
+
+    pub fn account_url(&self) -> &str {
+        &self.account_url
+    }
+
+    pub fn container_name(&self) -> &str {
+        &self.container_name
+    }
+
+    async fn create_container(&self) -> Result<(), Error> {
+        match self.container.create(None).await {
+            Ok(_) => Ok(()),
+            Err(error) if is_storage_error(&error, StorageErrorCode::ContainerAlreadyExists) => {
+                Ok(())
+            }
+            Err(_) => Err(Error::Unavailable),
+        }
+    }
+
+    async fn upload(&self, key: &str, value: &C::Value, overwrite: bool) -> Result<(), Error> {
+        let payload = self.codec.encode(value)?;
+        let options = (!overwrite).then(|| BlobClientUploadOptions::default().if_not_exists());
+        match self
+            .container
+            .blob_client(key)
+            .upload(RequestContent::from(payload), options)
+            .await
+        {
+            Ok(_) => Ok(()),
+            Err(error) if !overwrite && is_already_present(&error) => Ok(()),
+            Err(_) => Err(Error::Unavailable),
+        }
+    }
+
+    async fn download(&self, key: &str) -> Result<Option<C::Value>, Error> {
+        let response = match self.container.blob_client(key).download(None).await {
+            Ok(response) => response,
+            Err(error) if is_storage_error(&error, StorageErrorCode::BlobNotFound) => {
+                return Ok(None);
+            }
+            Err(_) => return Err(Error::Unavailable),
+        };
+        let bytes = response
+            .body
+            .collect()
+            .await
+            .map_err(|_| Error::Unavailable)?;
+        self.codec.decode(&bytes).map(Some)
+    }
+
+    async fn delete_all_blobs(&self) -> Result<(), Error> {
+        let mut pages = self
+            .container
+            .list_blobs(None)
+            .map_err(|_| Error::Unavailable)?
+            .into_pages();
+        while let Some(page) = pages.try_next().await.map_err(|_| Error::Unavailable)? {
+            let page = page.into_model().map_err(|_| Error::Unavailable)?;
+            for name in page.blob_items.into_iter().filter_map(|item| item.name) {
+                self.container
+                    .blob_client(&name)
+                    .delete(None)
+                    .await
+                    .map_err(|_| Error::Unavailable)?;
+            }
+        }
+        Ok(())
+    }
+
+    fn block_on<T>(&self, future: impl Future<Output = T>) -> T {
+        if Handle::try_current().is_ok() {
+            tokio::task::block_in_place(|| self.runtime.block_on(future))
+        } else {
+            self.runtime.block_on(future)
+        }
+    }
+}
+
+fn is_already_present(error: &azure_core::Error) -> bool {
+    is_storage_error(error, StorageErrorCode::BlobAlreadyExists)
+        || is_storage_error(error, StorageErrorCode::ConditionNotMet)
+}
+
+fn is_storage_error(error: &azure_core::Error, code: StorageErrorCode) -> bool {
+    matches!(
+        error.kind(),
+        ErrorKind::HttpResponse {
+            error_code: Some(error_code),
+            ..
+        } if error_code == code.as_ref()
+    )
+}
+
+impl<C: CacheCodec> BaseCache for AzureBlobCache<C> {
+    type Value = C::Value;
+    type Context = ExactCacheContext;
+
+    fn get_ttl(&self, _: &ExactCacheContext) -> Option<Duration> {
+        None
+    }
+
+    fn set_cache(&self, key: &str, value: C::Value, _: &ExactCacheContext) -> Result<(), Error> {
+        self.block_on(self.upload(key, &value, false))
+    }
+
+    fn get_cache(&self, key: &str, _: &ExactCacheContext) -> Result<Option<C::Value>, Error> {
+        self.block_on(self.download(key))
+    }
+
+    async fn async_set_cache(
+        &self,
+        key: &str,
+        value: C::Value,
+        _: ExactCacheContext,
+    ) -> Result<(), Error> {
+        self.upload(key, &value, true).await
+    }
+
+    async fn async_get_cache(
+        &self,
+        key: &str,
+        _: &ExactCacheContext,
+    ) -> Result<Option<C::Value>, Error> {
+        self.download(key).await
+    }
+
+    async fn async_set_cache_pipeline(
+        &self,
+        entries: Vec<(String, C::Value)>,
+        _: ExactCacheContext,
+    ) -> Result<(), Error> {
+        try_join_all(
+            entries
+                .iter()
+                .map(|(key, value)| self.upload(key, value, true)),
+        )
+        .await
+        .map(drop)
+    }
+}
+
+impl<C: CacheCodec> BatchCache for AzureBlobCache<C> {}
+
+impl<C: CacheCodec> FlushCache for AzureBlobCache<C> {
+    fn flush_cache(&self) -> Result<(), Error> {
+        self.block_on(self.delete_all_blobs())
+    }
+
+    async fn async_flush_cache(&self) -> Result<(), Error> {
+        self.delete_all_blobs().await
+    }
+}
+
+impl<C: CacheCodec> DisconnectCache for AzureBlobCache<C> {
+    /// Python closes its two SDK clients; the Rust clients hold no connection of their own
+    /// (the pooled transport belongs to the host), so there is nothing to release.
+    async fn disconnect(&self) -> Result<(), Error> {
+        Ok(())
+    }
+}
--- a/litellm-rust/crates/cache-azure-blob/src/credential.rs
+++ b/litellm-rust/crates/cache-azure-blob/src/credential.rs
@ -0,0 +1,84 @@
+use std::{
+    fmt,
+    sync::Arc,
+    time::{Duration, SystemTime},
+};
+
+use azure_core::{
+    credentials::{AccessToken, TokenCredential, TokenRequestOptions},
+    error::ErrorKind,
+    time::OffsetDateTime,
+};
+use litellm_auth_azure::{AzureAuthInputs, AzureAuthService};
+use litellm_auth_types::ResolvedCredential;
+
+const STATIC_TOKEN_LIFETIME: Duration = Duration::from_secs(300);
+const LLM_TOKEN_ENV: &str = "AZURE_AD_TOKEN";
+
+type EnvLookup = Arc<dyn Fn(&str) -> Option<String> + Send + Sync>;
+
+pub struct AzureBlobCredential {
+    service: AzureAuthService,
+    env_lookup: EnvLookup,
+}
+
+impl fmt::Debug for AzureBlobCredential {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("AzureBlobCredential")
+    }
+}
+
+impl Default for AzureBlobCredential {
+    fn default() -> Self {
+        Self::new(
+            AzureAuthService::default(),
+            Arc::new(|name| std::env::var(name).ok()),
+        )
+    }
+}
+
+impl AzureBlobCredential {
+    pub fn new(service: AzureAuthService, env_lookup: EnvLookup) -> Self {
+        Self {
+            service,
+            env_lookup,
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl TokenCredential for AzureBlobCredential {
+    async fn get_token(
+        &self,
+        scopes: &[&str],
+        _options: Option<TokenRequestOptions<'_>>,
+    ) -> azure_core::Result<AccessToken> {
+        let env_lookup = &self.env_lookup;
+        let lookup = move |name: &str| (name != LLM_TOKEN_ENV).then(|| env_lookup(name)).flatten();
+        let credential = self
+            .service
+            .get_azure_ad_token(
+                &AzureAuthInputs::default_credential_for_scope(&scopes.join(" ")),
+                &lookup,
+            )
+            .await
+            .map_err(|error| {
+                azure_core::Error::with_message(ErrorKind::Credential, error.to_string())
+            })?
+            .ok_or_else(|| {
+                azure_core::Error::with_message(
+                    ErrorKind::Credential,
+                    "no Azure credential is available for blob storage",
+                )
+            })?;
+        let (token, expires_on) = match credential.into_value() {
+            ResolvedCredential::AccessToken { token, expires_on } => (token, expires_on),
+            ResolvedCredential::Static(token) => (token, None),
+        };
+        let expires_on = expires_on.unwrap_or_else(|| SystemTime::now() + STATIC_TOKEN_LIFETIME);
+        Ok(AccessToken::new(
+            token.expose().to_string(),
+            OffsetDateTime::from(expires_on),
+        ))
+    }
+}
--- a/litellm-rust/crates/cache-azure-blob/src/lib.rs
+++ b/litellm-rust/crates/cache-azure-blob/src/lib.rs
@ -0,0 +1,7 @@
+mod cache;
+mod credential;
+mod transport;
+
+pub use cache::AzureBlobCache;
+pub use credential::AzureBlobCredential;
+pub use transport::ReqwestTransport;
--- a/litellm-rust/crates/cache-azure-blob/src/transport.rs
+++ b/litellm-rust/crates/cache-azure-blob/src/transport.rs
@ -0,0 +1,49 @@
+use azure_core::{
+    error::ErrorKind,
+    http::{
+        AsyncRawResponse, Body, HttpClient, Request,
+        headers::{HeaderName, HeaderValue, Headers},
+    },
+};
+use futures_util::TryStreamExt;
+
+#[derive(Debug)]
+pub struct ReqwestTransport(pub reqwest::Client);
+
+#[async_trait::async_trait]
+impl HttpClient for ReqwestTransport {
+    async fn execute_request(&self, request: &Request) -> azure_core::Result<AsyncRawResponse> {
+        let method = reqwest::Method::from_bytes(request.method().as_ref().as_bytes())
+            .map_err(|error| azure_core::Error::new(ErrorKind::Other, error))?;
+        let mut outgoing = self.0.request(method, request.url().as_str());
+        for (name, value) in request.headers().iter() {
+            outgoing = outgoing.header(name.as_str(), value.as_str());
+        }
+        let outgoing = match request.body().clone() {
+            Body::Bytes(bytes) => outgoing.body(bytes),
+            Body::SeekableStream(stream) => outgoing.body(reqwest::Body::wrap_stream(stream)),
+        };
+        let response = outgoing.send().await.map_err(|error| {
+            let kind = if error.is_connect() {
+                ErrorKind::Connection
+            } else {
+                ErrorKind::Io
+            };
+            azure_core::Error::new(kind, error)
+        })?;
+        let status = response.status().as_u16().into();
+        let mut headers = Headers::new();
+        for (name, value) in response.headers() {
+            if let Ok(value) = value.to_str() {
+                headers.insert(
+                    HeaderName::from(name.as_str().to_owned()),
+                    HeaderValue::from(value.to_owned()),
+                );
+            }
+        }
+        let body = response
+            .bytes_stream()
+            .map_err(|error| azure_core::Error::new(ErrorKind::Io, error));
+        Ok(AsyncRawResponse::new(status, headers, Box::pin(body)))
+    }
+}
--- a/litellm-rust/crates/cache-azure-blob/tests/cache.rs
+++ b/litellm-rust/crates/cache-azure-blob/tests/cache.rs
@ -0,0 +1,494 @@
+mod support;
+
+use std::{sync::Arc, time::Duration};
+
+use azure_core::http::Method;
+use litellm_cache::{
+    BaseCache, BatchCache, BatchEntry, DisconnectCache, Error, ExactCacheContext, FlushCache,
+};
+use litellm_cache_azure_blob::AzureBlobCache;
+use litellm_cache_response::{
+    CacheEntry, CacheKeyField, CacheKeyInput, ResponseCache, ResponseCacheCodec,
+    ResponseCacheRequest, cache_key,
+};
+use rstest::{fixture, rstest};
+use serde_json::json;
+use support::{ACCOUNT_URL, CONTAINER, FakeBlobService, RecordedRequest};
+use tokio::runtime::Runtime;
+
+type Fixture = support::Fixture<ResponseCacheCodec>;
+
+#[fixture]
+fn fixture() -> Fixture {
+    Fixture::new(FakeBlobService::default(), ResponseCacheCodec)
+}
+
+fn response_cache(fixture: &Fixture) -> ResponseCache<AzureBlobCache<ResponseCacheCodec>> {
+    ResponseCache::new(fixture.cache.clone())
+}
+
+fn request(model: &str) -> ResponseCacheRequest {
+    ResponseCacheRequest::new(CacheKeyInput {
+        fields: vec![CacheKeyField {
+            name: "model".into(),
+            value: Some(model.into()),
+            api_parameter: true,
+            internal_parameter: false,
+        }],
+        preset: None,
+        namespace: None,
+        include_provider_parameters: false,
+    })
+}
+
+fn now() -> Duration {
+    Duration::from_secs(1_700_000_000)
+}
+
+fn entry(value: serde_json::Value) -> CacheEntry {
+    CacheEntry {
+        timestamp: Some(1_700_000_000.5),
+        response: value,
+    }
+}
+
+fn no_ttl() -> ExactCacheContext {
+    ExactCacheContext::default()
+}
+
+fn with_ttl(seconds: u64) -> ExactCacheContext {
+    ExactCacheContext {
+        ttl: Some(Duration::from_secs(seconds)),
+    }
+}
+
+fn connect_to(account_url: &str) -> (FakeBlobService, AzureBlobCache<ResponseCacheCodec>) {
+    let runtime = Runtime::new().unwrap();
+    let service = FakeBlobService::default();
+    let cache = runtime
+        .block_on(support::connect(
+            &service,
+            account_url,
+            ResponseCacheCodec,
+            runtime.handle().clone(),
+        ))
+        .unwrap();
+    (service, cache)
+}
+
+#[rstest]
+fn connect_creates_the_container_once(fixture: Fixture) {
+    assert!(fixture.service.container_exists());
+    assert_eq!(
+        fixture.service.requests(),
+        vec![RecordedRequest {
+            method: Method::Put,
+            path: format!("/{CONTAINER}"),
+            query: "restype=container".into(),
+            if_none_match: None,
+        }]
+    );
+    assert_eq!(fixture.cache.account_url(), ACCOUNT_URL);
+    assert_eq!(fixture.cache.container_name(), CONTAINER);
+}
+
+#[rstest]
+fn connect_accepts_an_existing_container() {
+    let fixture = Fixture::new(
+        FakeBlobService::with_existing_container(),
+        ResponseCacheCodec,
+    );
+    assert!(fixture.service.container_exists());
+    assert_eq!(fixture.service.requests().len(), 1);
+}
+
+#[rstest]
+fn connect_accepts_account_urls_with_trailing_slash() {
+    let (service, cache) = connect_to("https://example.blob.core.windows.net/");
+    assert_eq!(service.requests()[0].path, format!("/{CONTAINER}"));
+    assert_eq!(cache.account_url(), "https://example.blob.core.windows.net");
+}
+
+#[rstest]
+fn connect_keeps_account_url_query_parameters_on_the_container_path() {
+    let (service, _) = connect_to("https://example.blob.core.windows.net/?sv=2024-01-01&sig=abc");
+    let create = &service.requests()[0];
+    assert_eq!(create.path, format!("/{CONTAINER}"));
+    assert!(create.query.contains("sig=abc"));
+}
+
+#[rstest]
+fn connect_surfaces_service_failures() {
+    let runtime = Runtime::new().unwrap();
+    let service = FakeBlobService::default();
+    service.set_failing(true);
+    let result = runtime.block_on(support::connect(
+        &service,
+        ACCOUNT_URL,
+        ResponseCacheCodec,
+        runtime.handle().clone(),
+    ));
+    assert!(matches!(result, Err(Error::Unavailable)));
+}
+
+#[rstest]
+fn sync_set_and_get_round_trip_python_json_shape(fixture: Fixture) {
+    let value = entry(json!({"choices": [{"message": {"content": "héllo 🌍"}}]}));
+    fixture
+        .cache
+        .set_cache("key-1", value.clone(), &no_ttl())
+        .unwrap();
+
+    assert_eq!(
+        fixture.stored_json("key-1"),
+        json!({
+            "timestamp": 1_700_000_000.5,
+            "response": {"choices": [{"message": {"content": "héllo 🌍"}}]}
+        })
+    );
+    assert_eq!(
+        fixture.cache.get_cache("key-1", &no_ttl()).unwrap(),
+        Some(value)
+    );
+}
+
+#[rstest]
+#[case::blob_already_exists(false)]
+#[case::precondition_conflict(true)]
+fn sync_set_does_not_overwrite_an_existing_blob(fixture: Fixture, #[case] precondition: bool) {
+    fixture.service.set_precondition_conflicts(precondition);
+    fixture
+        .cache
+        .set_cache("key", entry(json!({"v": "first"})), &no_ttl())
+        .unwrap();
+    fixture
+        .cache
+        .set_cache("key", entry(json!({"v": "second"})), &no_ttl())
+        .unwrap();
+
+    assert_eq!(
+        fixture.stored_json("key")["response"],
+        json!({"v": "first"})
+    );
+    let uploads: Vec<_> = fixture
+        .service
+        .requests()
+        .into_iter()
+        .filter(|request| request.method == Method::Put && request.path.ends_with("/key"))
+        .collect();
+    assert_eq!(uploads.len(), 2);
+    assert!(
+        uploads
+            .iter()
+            .all(|request| request.if_none_match.as_deref() == Some("*"))
+    );
+}
+
+#[rstest]
+fn async_set_overwrites_an_existing_blob(fixture: Fixture) {
+    fixture.runtime.block_on(async {
+        fixture
+            .cache
+            .async_set_cache("key", entry(json!({"v": "first"})), no_ttl())
+            .await
+            .unwrap();
+        fixture
+            .cache
+            .async_set_cache("key", entry(json!({"v": "second"})), no_ttl())
+            .await
+            .unwrap();
+        assert_eq!(
+            fixture
+                .cache
+                .async_get_cache("key", &no_ttl())
+                .await
+                .unwrap(),
+            Some(entry(json!({"v": "second"})))
+        );
+    });
+    assert_eq!(
+        fixture.stored_json("key")["response"],
+        json!({"v": "second"})
+    );
+    assert!(
+        fixture
+            .service
+            .requests()
+            .iter()
+            .filter(|request| request.method == Method::Put && request.path.ends_with("/key"))
+            .all(|request| request.if_none_match.is_none())
+    );
+}
+
+#[rstest]
+fn missing_blobs_are_misses(fixture: Fixture) {
+    assert_eq!(fixture.cache.get_cache("absent", &no_ttl()).unwrap(), None);
+    assert_eq!(
+        fixture
+            .runtime
+            .block_on(fixture.cache.async_get_cache("absent", &no_ttl()))
+            .unwrap(),
+        None
+    );
+}
+
+#[rstest]
+fn ttl_is_ignored_and_entries_never_expire(fixture: Fixture) {
+    assert_eq!(fixture.cache.get_ttl(&with_ttl(1)), None);
+    assert_eq!(fixture.cache.get_ttl(&no_ttl()), None);
+
+    fixture
+        .cache
+        .set_cache("key", entry(json!("value")), &with_ttl(1))
+        .unwrap();
+    std::thread::sleep(Duration::from_millis(1100));
+    assert_eq!(
+        fixture.cache.get_cache("key", &with_ttl(1)).unwrap(),
+        Some(entry(json!("value")))
+    );
+    assert!(
+        fixture
+            .service
+            .requests()
+            .iter()
+            .all(|request| !request.query.contains("expiry"))
+    );
+}
+
+#[rstest]
+#[case::broken_json("broken-json", b"{not json".as_slice())]
+#[case::broken_utf8("broken-utf8", &[0xff, 0xfe, 0x22])]
+#[case::wrong_shape("wrong-shape", br#"{"timestamp": "yesterday"}"#.as_slice())]
+fn malformed_blobs_are_invalid_entries(fixture: Fixture, #[case] key: &str, #[case] bytes: &[u8]) {
+    fixture.service.seed_blob(key, bytes);
+    assert!(matches!(
+        fixture.cache.get_cache(key, &no_ttl()),
+        Err(Error::InvalidEntry)
+    ));
+}
+
+#[rstest]
+fn malformed_blobs_are_response_cache_misses(fixture: Fixture) {
+    let response_cache = response_cache(&fixture);
+    let broken = request("broken");
+    fixture
+        .service
+        .seed_blob(&cache_key(&broken.key), b"{not json");
+    assert_eq!(response_cache.lookup(&broken, now()).unwrap(), None);
+    assert_eq!(
+        fixture
+            .runtime
+            .block_on(response_cache.async_lookup(&broken, now()))
+            .unwrap(),
+        None
+    );
+}
+
+#[rstest]
+fn batch_get_preserves_order_and_marks_misses_and_invalid_entries(fixture: Fixture) {
+    fixture
+        .cache
+        .set_cache("a", entry(json!("A")), &no_ttl())
+        .unwrap();
+    fixture
+        .cache
+        .set_cache("c", entry(json!("C")), &no_ttl())
+        .unwrap();
+    fixture.service.seed_blob("bad", b"nope");
+    let keys = ["c", "missing", "a", "bad"].map(String::from);
+
+    let sync = fixture.cache.batch_get_cache(&keys, &no_ttl()).unwrap();
+    assert_eq!(
+        sync,
+        vec![
+            BatchEntry::Hit(entry(json!("C"))),
+            BatchEntry::Miss,
+            BatchEntry::Hit(entry(json!("A"))),
+            BatchEntry::Invalid,
+        ]
+    );
+
+    let asynchronous = fixture
+        .runtime
+        .block_on(fixture.cache.async_batch_get_cache(keys.to_vec(), no_ttl()))
+        .unwrap();
+    assert_eq!(asynchronous, sync);
+
+    let response_cache = response_cache(&fixture);
+    let requests = [request("hit"), request("missing"), request("bad")];
+    response_cache
+        .store(&requests[0], json!("HIT"), now())
+        .unwrap();
+    fixture
+        .service
+        .seed_blob(&cache_key(&requests[2].key), b"nope");
+    let hits = response_cache.lookup_batch(&requests, now()).unwrap();
+    assert_eq!(hits.values, vec![Some(json!("HIT")), None, None]);
+    assert_eq!(hits.missing_indices, vec![1, 2]);
+    let async_hits = fixture
+        .runtime
+        .block_on(response_cache.async_lookup_batch(&requests, now()))
+        .unwrap();
+    assert_eq!(async_hits.values, hits.values);
+}
+
+#[rstest]
+fn async_pipeline_writes_every_entry_with_overwrite(fixture: Fixture) {
+    fixture.service.seed_blob("k2", b"stale");
+    fixture
+        .runtime
+        .block_on(fixture.cache.async_set_cache_pipeline(
+            vec![
+                ("k1".into(), entry(json!({"n": 1}))),
+                ("k2".into(), entry(json!({"n": 2}))),
+                ("k3".into(), entry(json!({"n": 3}))),
+            ],
+            with_ttl(30),
+        ))
+        .unwrap();
+    assert_eq!(fixture.service.blob_names(), ["k1", "k2", "k3"]);
+    assert_eq!(fixture.stored_json("k2")["response"], json!({"n": 2}));
+}
+
+#[rstest]
+fn flush_deletes_every_blob_in_the_container(fixture: Fixture) {
+    for key in ["x", "y", "z"] {
+        fixture
+            .cache
+            .set_cache(key, entry(json!(key)), &no_ttl())
+            .unwrap();
+    }
+    fixture.cache.flush_cache().unwrap();
+    assert!(fixture.service.blob_names().is_empty());
+    assert!(fixture.service.container_exists());
+
+    fixture
+        .cache
+        .set_cache("again", entry(json!(1)), &no_ttl())
+        .unwrap();
+    fixture
+        .runtime
+        .block_on(fixture.cache.async_flush_cache())
+        .unwrap();
+    assert!(fixture.service.blob_names().is_empty());
+}
+
+#[rstest]
+fn service_failures_map_to_unavailable(fixture: Fixture) {
+    fixture.service.set_failing(true);
+    assert!(matches!(
+        fixture.cache.get_cache("key", &no_ttl()),
+        Err(Error::Unavailable)
+    ));
+    assert!(matches!(
+        fixture.cache.set_cache("key", entry(json!(1)), &no_ttl()),
+        Err(Error::Unavailable)
+    ));
+    assert!(matches!(
+        fixture.cache.flush_cache(),
+        Err(Error::Unavailable)
+    ));
+    assert!(matches!(
+        fixture.runtime.block_on(
+            fixture
+                .cache
+                .async_set_cache_pipeline(vec![("k".into(), entry(json!(1)))], no_ttl())
+        ),
+        Err(Error::Unavailable)
+    ));
+}
+
+#[rstest]
+fn disconnect_is_idempotent_and_keeps_data(fixture: Fixture) {
+    fixture
+        .cache
+        .set_cache("key", entry(json!(1)), &no_ttl())
+        .unwrap();
+    fixture.runtime.block_on(async {
+        fixture.cache.disconnect().await.unwrap();
+        fixture.cache.disconnect().await.unwrap();
+    });
+    assert_eq!(
+        fixture.cache.get_cache("key", &no_ttl()).unwrap(),
+        Some(entry(json!(1)))
+    );
+}
+
+#[rstest]
+fn response_cache_stores_and_reads_through_the_backend(fixture: Fixture) {
+    let response_cache = response_cache(&fixture);
+    let mut request = request("gpt");
+    request.context = with_ttl(60);
+    let response = json!({"id": "chatcmpl-1"});
+    response_cache
+        .store(&request, response.clone(), now())
+        .unwrap();
+    assert_eq!(
+        fixture.stored_json(&cache_key(&request.key)),
+        json!({"timestamp": 1_700_000_000.0, "response": {"id": "chatcmpl-1"}})
+    );
+    assert_eq!(
+        response_cache
+            .lookup(&request, now() + Duration::from_secs(3600))
+            .unwrap(),
+        Some(response.clone())
+    );
+    assert_eq!(
+        fixture
+            .runtime
+            .block_on(response_cache.async_lookup(&request, now() + Duration::from_secs(3600)))
+            .unwrap(),
+        Some(response.clone())
+    );
+    fixture.runtime.block_on(async {
+        response_cache
+            .async_store(&request, json!("replaced"), now())
+            .await
+            .unwrap();
+        assert_eq!(
+            response_cache.async_lookup(&request, now()).await.unwrap(),
+            Some(json!("replaced"))
+        );
+        response_cache.async_flush().await.unwrap();
+        assert_eq!(
+            response_cache.async_lookup(&request, now()).await.unwrap(),
+            None
+        );
+    });
+}
+
+#[rstest]
+fn non_object_responses_are_written_serialized_like_python(fixture: Fixture) {
+    fixture
+        .cache
+        .set_cache("s", entry(json!("plain")), &no_ttl())
+        .unwrap();
+    assert_eq!(
+        fixture.stored_json("s"),
+        json!({"timestamp": 1_700_000_000.5, "response": "\"plain\""})
+    );
+    assert_eq!(
+        fixture.cache.get_cache("s", &no_ttl()).unwrap(),
+        Some(entry(json!("plain")))
+    );
+}
+
+#[rstest]
+#[tokio::test(flavor = "multi_thread")]
+async fn sync_methods_block_inside_a_multi_thread_runtime() {
+    let service = FakeBlobService::default();
+    let cache = support::connect(
+        &service,
+        ACCOUNT_URL,
+        ResponseCacheCodec,
+        tokio::runtime::Handle::current(),
+    )
+    .await
+    .map(Arc::new)
+    .unwrap();
+    cache.set_cache("key", entry(json!(1)), &no_ttl()).unwrap();
+    assert_eq!(
+        cache.get_cache("key", &no_ttl()).unwrap(),
+        Some(entry(json!(1)))
+    );
+}
--- a/litellm-rust/crates/cache-azure-blob/tests/contract.rs
+++ b/litellm-rust/crates/cache-azure-blob/tests/contract.rs
@ -0,0 +1,81 @@
+mod support;
+
+use litellm_cache::{ExactCacheContext, JsonCodec};
+use litellm_cache_azure_blob::AzureBlobCache;
+use litellm_cache_testing as contract;
+use rstest::{fixture, rstest};
+use serde_json::{Value, json};
+use support::{ACCOUNT_URL, FakeBlobService};
+use tokio::runtime::Handle;
+
+#[fixture]
+async fn azure() -> AzureBlobCache<JsonCodec<Value>> {
+    support::connect(
+        &FakeBlobService::default(),
+        ACCOUNT_URL,
+        JsonCodec::new(),
+        Handle::current(),
+    )
+    .await
+    .unwrap()
+}
+
+#[fixture]
+fn context() -> ExactCacheContext {
+    ExactCacheContext::default()
+}
+
+const PREFIX: &str = "contract:";
+
+// `overwrite_replaces` does not apply: sync `set_cache` never overwrites a blob, as in Python.
+
+#[rstest]
+#[tokio::test(flavor = "multi_thread")]
+async fn hit_and_miss(
+    #[future(awt)] azure: AzureBlobCache<JsonCodec<Value>>,
+    context: ExactCacheContext,
+) {
+    contract::hit_and_miss(&azure, context, PREFIX, json!({"answer": 42})).await;
+}
+
+#[rstest]
+#[tokio::test(flavor = "multi_thread")]
+async fn sync_async_equivalence(
+    #[future(awt)] azure: AzureBlobCache<JsonCodec<Value>>,
+    context: ExactCacheContext,
+) {
+    contract::sync_async_equivalence(&azure, context, PREFIX, json!("first"), json!([2])).await;
+}
+
+#[rstest]
+#[tokio::test(flavor = "multi_thread")]
+async fn pipeline_writes_every_entry(
+    #[future(awt)] azure: AzureBlobCache<JsonCodec<Value>>,
+    context: ExactCacheContext,
+) {
+    contract::pipeline_writes_every_entry(
+        &azure,
+        context,
+        PREFIX,
+        vec![json!("a"), json!(2), json!({"c": true})],
+    )
+    .await;
+}
+
+#[rstest]
+#[tokio::test(flavor = "multi_thread")]
+async fn batch_preserves_order(
+    #[future(awt)] azure: AzureBlobCache<JsonCodec<Value>>,
+    context: ExactCacheContext,
+) {
+    contract::batch_preserves_order(&azure, context, PREFIX, json!("first"), json!(2)).await;
+}
+
+#[rstest]
+#[tokio::test(flavor = "multi_thread")]
+async fn flush_clears(
+    #[future(awt)] azure: AzureBlobCache<JsonCodec<Value>>,
+    context: ExactCacheContext,
+) {
+    contract::flush_clears(&azure, context, PREFIX, json!("value")).await;
+}
--- a/litellm-rust/crates/cache-azure-blob/tests/support/mod.rs
+++ b/litellm-rust/crates/cache-azure-blob/tests/support/mod.rs
@ -0,0 +1,239 @@
+#![allow(dead_code)]
+
+use std::{
+    collections::BTreeMap,
+    sync::{Arc, Mutex},
+};
+
+use azure_core::http::{
+    AsyncRawResponse, Body, ClientOptions, HttpClient, Method, Request, StatusCode, Transport,
+    headers::{HeaderName, Headers},
+};
+use litellm_cache::{CacheCodec, Error};
+use litellm_cache_azure_blob::AzureBlobCache;
+use tokio::runtime::{Handle, Runtime};
+
+pub const ACCOUNT_URL: &str = "https://example.blob.core.windows.net";
+pub const CONTAINER: &str = "litellm-cache";
+const IF_NONE_MATCH: HeaderName = HeaderName::from_static("if-none-match");
+const ERROR_CODE: HeaderName = HeaderName::from_static("x-ms-error-code");
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RecordedRequest {
+    pub method: Method,
+    pub path: String,
+    pub query: String,
+    pub if_none_match: Option<String>,
+}
+
+#[derive(Default)]
+struct FakeState {
+    container_exists: bool,
+    blobs: BTreeMap<String, Vec<u8>>,
+    requests: Vec<RecordedRequest>,
+    failing: bool,
+    precondition_conflicts: bool,
+}
+
+#[derive(Clone, Default)]
+pub struct FakeBlobService {
+    state: Arc<Mutex<FakeState>>,
+}
+
+impl std::fmt::Debug for FakeBlobService {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("FakeBlobService")
+    }
+}
+
+impl FakeBlobService {
+    pub fn with_existing_container() -> Self {
+        let service = Self::default();
+        service.state.lock().unwrap().container_exists = true;
+        service
+    }
+
+    pub fn blob(&self, name: &str) -> Option<Vec<u8>> {
+        self.state.lock().unwrap().blobs.get(name).cloned()
+    }
+
+    pub fn blob_names(&self) -> Vec<String> {
+        self.state.lock().unwrap().blobs.keys().cloned().collect()
+    }
+
+    pub fn seed_blob(&self, name: &str, bytes: &[u8]) {
+        self.state
+            .lock()
+            .unwrap()
+            .blobs
+            .insert(name.to_string(), bytes.to_vec());
+    }
+
+    pub fn set_failing(&self, failing: bool) {
+        self.state.lock().unwrap().failing = failing;
+    }
+
+    pub fn set_precondition_conflicts(&self, enabled: bool) {
+        self.state.lock().unwrap().precondition_conflicts = enabled;
+    }
+
+    pub fn requests(&self) -> Vec<RecordedRequest> {
+        self.state.lock().unwrap().requests.clone()
+    }
+
+    pub fn container_exists(&self) -> bool {
+        self.state.lock().unwrap().container_exists
+    }
+
+    fn respond(status: StatusCode, error_code: Option<&str>, body: Vec<u8>) -> AsyncRawResponse {
+        let mut headers = Headers::new();
+        if let Some(code) = error_code {
+            headers.insert(ERROR_CODE, code.to_string());
+        }
+        AsyncRawResponse::from_bytes(status, headers, body)
+    }
+
+    fn list_body(state: &FakeState) -> Vec<u8> {
+        let mut xml = String::from(
+            r#"<?xml version="1.0" encoding="utf-8"?><EnumerationResults ServiceEndpoint="https://example.blob.core.windows.net/" ContainerName="litellm-cache"><Blobs>"#,
+        );
+        for name in state.blobs.keys() {
+            xml.push_str(&format!(
+                "<Blob><Name>{name}</Name><Properties><BlobType>BlockBlob</BlobType></Properties></Blob>"
+            ));
+        }
+        xml.push_str("</Blobs><NextMarker /></EnumerationResults>");
+        xml.into_bytes()
+    }
+}
+
+#[async_trait::async_trait]
+impl HttpClient for FakeBlobService {
+    async fn execute_request(&self, request: &Request) -> azure_core::Result<AsyncRawResponse> {
+        let mut state = self.state.lock().unwrap();
+        let path = request.url().path().to_string();
+        let query = request.url().query().unwrap_or_default().to_string();
+        let if_none_match = request
+            .headers()
+            .get_optional_str(&IF_NONE_MATCH)
+            .map(str::to_owned);
+        state.requests.push(RecordedRequest {
+            method: request.method(),
+            path: path.clone(),
+            query: query.clone(),
+            if_none_match: if_none_match.clone(),
+        });
+        if state.failing {
+            return Ok(Self::respond(
+                StatusCode::Forbidden,
+                Some("AuthorizationFailure"),
+                Vec::new(),
+            ));
+        }
+        let container_path = format!("/{CONTAINER}");
+        let blob_name = path
+            .strip_prefix(&format!("{container_path}/"))
+            .map(str::to_owned);
+        let is_container = path == container_path && query.contains("restype=container");
+        let response = match (request.method(), is_container, blob_name) {
+            (Method::Put, true, None) if state.container_exists => Self::respond(
+                StatusCode::Conflict,
+                Some("ContainerAlreadyExists"),
+                Vec::new(),
+            ),
+            (Method::Put, true, None) => {
+                state.container_exists = true;
+                Self::respond(StatusCode::Created, None, Vec::new())
+            }
+            (Method::Get, true, None) if query.contains("comp=list") => {
+                Self::respond(StatusCode::Ok, None, Self::list_body(&state))
+            }
+            (Method::Get, true, None) if state.container_exists => {
+                Self::respond(StatusCode::Ok, None, Vec::new())
+            }
+            (Method::Get, true, None) => {
+                Self::respond(StatusCode::NotFound, Some("ContainerNotFound"), Vec::new())
+            }
+            (Method::Put, false, Some(name)) => {
+                if if_none_match.as_deref() == Some("*") && state.blobs.contains_key(&name) {
+                    if state.precondition_conflicts {
+                        Self::respond(
+                            StatusCode::PreconditionFailed,
+                            Some("ConditionNotMet"),
+                            Vec::new(),
+                        )
+                    } else {
+                        Self::respond(StatusCode::Conflict, Some("BlobAlreadyExists"), Vec::new())
+                    }
+                } else {
+                    let bytes = match request.body() {
+                        Body::Bytes(bytes) => bytes.to_vec(),
+                        Body::SeekableStream(_) => panic!("unexpected streaming upload"),
+                    };
+                    state.blobs.insert(name, bytes);
+                    Self::respond(StatusCode::Created, None, Vec::new())
+                }
+            }
+            (Method::Get, false, Some(name)) => match state.blobs.get(&name) {
+                Some(bytes) => Self::respond(StatusCode::Ok, None, bytes.clone()),
+                None => Self::respond(StatusCode::NotFound, Some("BlobNotFound"), Vec::new()),
+            },
+            (Method::Delete, false, Some(name)) => match state.blobs.remove(&name) {
+                Some(_) => Self::respond(StatusCode::Accepted, None, Vec::new()),
+                None => Self::respond(StatusCode::NotFound, Some("BlobNotFound"), Vec::new()),
+            },
+            (method, _, _) => panic!("unexpected request {method:?} {path}?{query}"),
+        };
+        Ok(response)
+    }
+}
+
+pub async fn connect<C: CacheCodec>(
+    service: &FakeBlobService,
+    account_url: &str,
+    codec: C,
+    handle: Handle,
+) -> Result<AzureBlobCache<C>, Error> {
+    AzureBlobCache::connect_with_options(
+        account_url,
+        CONTAINER,
+        None,
+        ClientOptions {
+            transport: Some(Transport::new(Arc::new(service.clone()))),
+            ..ClientOptions::default()
+        },
+        codec,
+        handle,
+    )
+    .await
+}
+
+/// A cache on its own fake service and runtime, so sync methods run outside any runtime.
+pub struct Fixture<C> {
+    pub runtime: Runtime,
+    pub service: FakeBlobService,
+    pub cache: Arc<AzureBlobCache<C>>,
+}
+
+impl<C: CacheCodec> Fixture<C> {
+    pub fn new(service: FakeBlobService, codec: C) -> Self {
+        let runtime = Runtime::new().unwrap();
+        let cache = runtime
+            .block_on(connect(
+                &service,
+                ACCOUNT_URL,
+                codec,
+                runtime.handle().clone(),
+            ))
+            .unwrap();
+        Self {
+            runtime,
+            service,
+            cache: Arc::new(cache),
+        }
+    }
+
+    pub fn stored_json(&self, key: &str) -> serde_json::Value {
+        serde_json::from_slice(&self.service.blob(key).expect("blob should exist")).unwrap()
+    }
+}
--- a/litellm-rust/crates/cache-azure-blob/tests/transport.rs
+++ b/litellm-rust/crates/cache-azure-blob/tests/transport.rs
@ -0,0 +1,90 @@
+use std::sync::Arc;
+
+use azure_core::http::{ClientOptions, Transport};
+use litellm_cache::{BaseCache, ExactCacheContext, JsonCodec};
+use litellm_cache_azure_blob::{AzureBlobCache, ReqwestTransport};
+use rstest::{fixture, rstest};
+use serde_json::{Value, json};
+use tokio::runtime::Handle;
+use wiremock::{
+    Mock, MockServer, ResponseTemplate,
+    matchers::{body_json, header, method, path, query_param},
+};
+
+#[fixture]
+async fn server() -> MockServer {
+    let server = MockServer::start().await;
+    Mock::given(method("PUT"))
+        .and(path("/litellm-cache"))
+        .and(query_param("restype", "container"))
+        .respond_with(ResponseTemplate::new(201))
+        .expect(1)
+        .mount(&server)
+        .await;
+    server
+}
+
+async fn connect(server: &MockServer) -> AzureBlobCache<JsonCodec<Value>> {
+    AzureBlobCache::connect_with_options(
+        &server.uri(),
+        "litellm-cache",
+        None,
+        ClientOptions {
+            transport: Some(Transport::new(Arc::new(ReqwestTransport(
+                reqwest::Client::new(),
+            )))),
+            ..ClientOptions::default()
+        },
+        JsonCodec::new(),
+        Handle::current(),
+    )
+    .await
+    .unwrap()
+}
+
+#[rstest]
+#[tokio::test(flavor = "multi_thread")]
+async fn uploads_go_through_the_host_client(#[future(awt)] server: MockServer) {
+    Mock::given(method("PUT"))
+        .and(path("/litellm-cache/key"))
+        .and(header("if-none-match", "*"))
+        .and(body_json(json!({"answer": 1})))
+        .respond_with(ResponseTemplate::new(201))
+        .expect(1)
+        .mount(&server)
+        .await;
+    connect(&server)
+        .await
+        .set_cache("key", json!({"answer": 1}), &ExactCacheContext::default())
+        .unwrap();
+}
+
+#[rstest]
+#[case::hit(
+    ResponseTemplate::new(200).set_body_json(json!({"answer": 2})),
+    Some(json!({"answer": 2}))
+)]
+#[case::blob_not_found(
+    ResponseTemplate::new(404).insert_header("x-ms-error-code", "BlobNotFound"),
+    None
+)]
+#[tokio::test(flavor = "multi_thread")]
+async fn downloads_map_the_host_client_response(
+    #[future(awt)] server: MockServer,
+    #[case] response: ResponseTemplate,
+    #[case] expected: Option<Value>,
+) {
+    Mock::given(method("GET"))
+        .and(path("/litellm-cache/key"))
+        .respond_with(response)
+        .mount(&server)
+        .await;
+    assert_eq!(
+        connect(&server)
+            .await
+            .async_get_cache("key", &ExactCacheContext::default())
+            .await
+            .unwrap(),
+        expected
+    );
+}
--- a/litellm-rust/crates/cache-disk/Cargo.toml
+++ b/litellm-rust/crates/cache-disk/Cargo.toml
@ -0,0 +1,20 @@
+[package]
+name = "litellm-cache-disk"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+litellm-cache.workspace = true
+py_literal = "0.4.0"
+rand.workspace = true
+rusqlite = { version = "0.40", features = ["bundled"] }
+serde-pickle = "1.2"
+serde_json.workspace = true
+tokio.workspace = true
+
+[dev-dependencies]
+litellm-cache-testing.workspace = true
+rstest.workspace = true
+tempfile = "3.27.0"
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`ALTER TABLE "LiteLLM_PolicyAttachmentTable" ADD COLUMN IF NOT EXISTS "is_default" BOOLEAN NOT NULL DEFAULT false;`