Merge remote-tracking branch 'origin/main' into litellm_lit5824_mantle_cache_dialect

2026-10-15 04:19:08 +00:00 · 2026-10-07 13:58:50 -07:00 · 2026-10-07 13:58:50 -07:00 · e46b855877
commit e46b855877
parent 05928a9ce8 eb9355d11a
6284 changed files with 598593 additions and 116633 deletions
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@ -17,3 +17,6 @@ rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]

 [target.aarch64-apple-darwin]
 rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]
+
+[env]
+SQLX_OFFLINE = "true"
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
--- a/.circleci/scripts/classify_changes.sh
+++ b/.circleci/scripts/classify_changes.sh
@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -uo pipefail

-category="${1:?usage: classify_changes.sh <backend|client|ui|provider-harness|cost-map-only|mcp-dependencies>}"
+category="${1:?usage: classify_changes.sh <backend|client|ui|provider-harness|cost-map-only|mcp-dependencies|windows-release|redis-compat>}"

 has_client=false
 has_backend=false
@ -9,9 +9,15 @@ has_ci=false
 has_provider_harness=false
 has_cost_map=false
 has_mcp_dependencies=false
+has_windows_release=false
+has_redis_compat=false
 outside_cost_map_set=false
 while IFS= read -r file || [ -n "$file" ]; do
  [ -n "$file" ] || continue
+  case "$file" in
+    litellm/_redis.py | litellm/_redis_credential_provider.py | litellm/caching/redis_cache.py | litellm/caching/evicted_client_closer.py | tests/unit/test_redis.py | tests/local_testing/test_caching.py | tests/unit/caching/test_redis_connection_pool.py | tests/unit/caching/test_redis_cluster_cache.py | tests/unit/caching/test_evicted_client_closer.py | .circleci/config.yml | .circleci/scripts/classify_changes.sh | .circleci/scripts/path_filter.sh | pyproject.toml | uv.lock)
+      has_redis_compat=true ;;
+  esac
  case "$file" in
    *.md | *.mdx) : ;;
    pyproject.toml | */pyproject.toml | uv.lock | uv.toml | .python-version | rust-toolchain.toml | litellm-rust/* | litellm/__init__.py | litellm/proxy/proxy_server.py | litellm/*mcp* | tests/*mcp* | litellm/integrations/arize/* | tests/base_sdk_tests/* | scripts/check_mcp_sdk_install.py | .github/workflows/test-mcp-dependency-resolution.yml | .github/actions/detect-changes/* | .github/actions/setup-uv-with-retries/* | .github/actions/cache-cargo-build/* | .github/scripts/detect_changes.sh | .github/scripts/uv_sync_with_retries.sh | .circleci/scripts/classify_changes.sh | tests/unit/test_circleci_path_filter.py | tests/unit/test_detect_changes.py)
@ -22,6 +28,10 @@ while IFS= read -r file || [ -n "$file" ]; do
    tests/e2e/*.py | tests/code_coverage_tests/test_provider_cache.py | tests/code_coverage_tests/test_provider_replay_harness.py | tests/unit/test_circleci_path_filter.py | .circleci/* | pyproject.toml | uv.lock)
      has_provider_harness=true ;;
  esac
+  case "$file" in
+    litellm-rust/* | litellm/rust_bridge/* | rust-toolchain.toml | pyproject.toml | uv.lock | tests/windows_tests/* | .circleci/*)
+      has_windows_release=true ;;
+  esac
  case "$file" in
    ui/* | tests/e2e/ui/*) has_client=true ;;
    docs/* | *.md | *.mdx) : ;;
@ -46,6 +56,12 @@ case "$category" in
  provider-harness)
    [ "$has_provider_harness" = true ] && echo run || echo skip
    ;;
+  windows-release)
+    [ "$has_windows_release" = true ] && echo run || echo skip
+    ;;
+  redis-compat)
+    [ "$has_redis_compat" = true ] && echo run || echo skip
+    ;;
  backend)
    [ "$has_backend" = true ] && echo run || echo skip
    ;;
--- a/.circleci/scripts/path_filter.sh
+++ b/.circleci/scripts/path_filter.sh
@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -uo pipefail

-category="${1:?usage: path_filter.sh <backend|client|provider-harness>}"
+category="${1:?usage: path_filter.sh <backend|client|provider-harness|redis-compat>}"
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

 run_full() {
--- a/.circleci/scripts/run_integration.sh
+++ b/.circleci/scripts/run_integration.sh
@ -26,6 +26,7 @@ guard_created=false
 guard_installed=false
 guard6_created=false
 guard6_installed=false
+egress_cgroup=litellm-integration
 cleanup() {
  original_status=$?
  trap - EXIT INT TERM
@ -47,14 +48,14 @@ cleanup() {
    fi
  done
  if [ "$guard_installed" = true ]; then
-    sudo iptables -D OUTPUT -m owner --uid-owner "$(id -u)" -j integration_only || original_status=1
+    sudo iptables -D OUTPUT -m cgroup --path "$egress_cgroup" -j integration_only || original_status=1
  fi
  if [ "$guard_created" = true ]; then
    sudo iptables -F integration_only || original_status=1
    sudo iptables -X integration_only || original_status=1
  fi
  if [ "$guard6_installed" = true ]; then
-    sudo ip6tables -D OUTPUT -m owner --uid-owner "$(id -u)" -j integration_only || original_status=1
+    sudo ip6tables -D OUTPUT -m cgroup --path "$egress_cgroup" -j integration_only || original_status=1
  fi
  if [ "$guard6_created" = true ]; then
    sudo ip6tables -F integration_only || original_status=1
@ -71,7 +72,7 @@ export PATH="$PWD/.venv/bin:$PATH"
 export PYTHONPATH="$PWD:$PWD/tests:$PWD/tests/e2e"
 export DATABASE_URL="postgresql://postgres:postgres@127.0.0.1:5432/circle_test"
 export REDIS_HOST=127.0.0.1 REDIS_PORT=6379
-export LITELLM_MASTER_KEY=sk-integration-master LITELLM_SALT_KEY=sk-integration-salt
+export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 16)" LITELLM_SALT_KEY=sk-integration-salt
 export LITELLM_MODE=PRODUCTION LITELLM_LOCAL_MODEL_COST_MAP=True
 export STORE_MODEL_IN_DB=True AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1
 export INTEGRATION_PROXY_URL=http://127.0.0.1:4000
@ -100,6 +101,8 @@ if [ "$mode" = parity ]; then
  export INTEGRATION_ROUTING=capture
 fi

+sudo mkdir -p "/sys/fs/cgroup/$egress_cgroup"
+echo "$$" | sudo tee "/sys/fs/cgroup/$egress_cgroup/cgroup.procs" > /dev/null
 sudo iptables -N integration_only
 guard_created=true
 sudo iptables -A integration_only -o lo -j ACCEPT
@ -109,13 +112,13 @@ for service in postgres-db redis-cache; do
  sudo iptables -A integration_only -d "$address" -j ACCEPT
 done
 sudo iptables -A integration_only -j REJECT
-sudo iptables -I OUTPUT 1 -m owner --uid-owner "$(id -u)" -j integration_only
+sudo iptables -I OUTPUT 1 -m cgroup --path "$egress_cgroup" -j integration_only
 guard_installed=true
 sudo ip6tables -N integration_only
 guard6_created=true
 sudo ip6tables -A integration_only -o lo -j ACCEPT
 sudo ip6tables -A integration_only -j REJECT
-sudo ip6tables -I OUTPUT 1 -m owner --uid-owner "$(id -u)" -j integration_only
+sudo ip6tables -I OUTPUT 1 -m cgroup --path "$egress_cgroup" -j integration_only
 guard6_installed=true

 if curl --noproxy '*' --connect-timeout 2 -s http://198.51.100.1 >/dev/null 2>&1; then
@ -165,11 +168,12 @@ start_proxy() {
    "${database_env[@]}" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
    INTEGRATION_UPSTREAM_URL="$INTEGRATION_UPSTREAM_URL" \
    LITELLM_MASTER_KEY="$LITELLM_MASTER_KEY" LITELLM_SALT_KEY="$LITELLM_SALT_KEY" LITELLM_UI_PATH="$LITELLM_UI_PATH" PROXY_BASE_URL="http://127.0.0.1:$port" \
-    LITELLM_MODE=PRODUCTION STORE_MODEL_IN_DB=True "${cost_map_env[@]}" \
+    LITELLM_LICENSE="${LITELLM_LICENSE:-}" \
+    LITELLM_MODE=PRODUCTION STORE_MODEL_IN_DB=True LITELLM_ENABLE_MCP_STDIO=true "${cost_map_env[@]}" \
    AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 COVERAGE_FILE="$coverage_data" \
    "${proxy_command[@]}" --config tests/integration/proxy_config.yaml \
    --host 127.0.0.1 --port "$port" --num_workers 1 --telemetry False \
-    --use_prisma_db_push --enforce_prisma_migration_check \
+    --use_prisma_db_push \
    > "$results/$log_name" 2>&1 &
  launched_pid=$!
 }
@ -187,7 +191,7 @@ if [ "$suite" = management ] || [ "$suite" = mcp ]; then
 fi

 if [ "$suite" = providers ]; then
-  INTEGRATION_RUN_ID="$integration_identity" .venv/bin/python -m pytest --noconftest -o addopts= \
+  INTEGRATION_RUN_ID="$integration_identity" .venv/bin/python -m pytest --tb=short --noconftest -o addopts= \
    --strict-markers --strict-config -p no:pytest-retry -p no:rerunfailures --timeout=30 \
    tests/e2e/test_provider_edge.py::TestReplayMode::test_content_drift_returns_the_miss_status_naming_both_keys \
    tests/e2e/test_provider_edge.py::TestReplayMode::test_exhausted_key_returns_the_miss_status \
@ -209,6 +213,15 @@ if [ "$suite" = browser ]; then
  exit 0
 fi

+node_files=()
+if [ "${CIRCLE_NODE_TOTAL:-1}" -gt 1 ]; then
+  split="$(.venv/bin/python tests/integration/run.py "$suite" --list \
+    | circleci tests split --split-by=timings --timings-type=filename)"
+  read -r -a node_files <<< "$(printf '%s' "$split" | tr '\n' ' ')"
+  test "${#node_files[@]}" -gt 0
+  printf '%s\n' "${node_files[@]}" > "$results/node-files.txt"
+fi
+
 env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
  INTEGRATION_RUN_ID="$integration_identity" \
  DATABASE_URL="$DATABASE_URL" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
@ -216,13 +229,14 @@ env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
  INTEGRATION_UPSTREAM_URL="$INTEGRATION_UPSTREAM_URL" \
  INTEGRATION_WORKERS="${INTEGRATION_WORKERS:-1}" \
  INTEGRATION_MASTER_KEY="$INTEGRATION_MASTER_KEY" LITELLM_MODE=PRODUCTION \
+  LITELLM_LICENSE="${LITELLM_LICENSE:-}" \
  INTEGRATION_SEED="$INTEGRATION_SEED" \
  INTEGRATION_ORDER_SEED="$INTEGRATION_ORDER_SEED" \
  LITELLM_LOCAL_MODEL_COST_MAP=True AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 \
  INTEGRATION_PROXY_DATABASE_URL="$INTEGRATION_PROXY_DATABASE_URL" \
  INTEGRATION_PROXY_READ_REPLICA_URL="$INTEGRATION_PROXY_READ_REPLICA_URL" \
  INTEGRATION_ROUTING="$INTEGRATION_ROUTING" \
-  .venv/bin/python tests/integration/run.py "$suite" --results "$results"
+  .venv/bin/python tests/integration/run.py "$suite" --results "$results" "${node_files[@]}"

 if [ "${INTEGRATION_COVERAGE:-0}" = 1 ]; then
  for covered_pid in "$proxy_pid" "$peer_pid"; do
--- a/.circleci/scripts/unit_selection.sh
+++ b/.circleci/scripts/unit_selection.sh
@ -1,177 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-flag="${1:?usage: unit_selection.sh <codecov flag>}"
-
-legacy_flags=(
-  caching-local
-  core-utils
-  enterprise-package
-  enterprise-routing
-  integrations
-  llm-other-providers
-  llm-vertex-ai
-  mcp-integration
-  misc
-  proxy-db-auth-checks
-  proxy-db-budgets
-  proxy-db-custom-logging
-  proxy-db-db-and-spend
-  proxy-db-endpoints-and-responses
-  proxy-db-guardrails-hooks
-  proxy-db-jwt-and-keys
-  proxy-db-key-generation
-  proxy-db-logging-misc
-  proxy-db-proxy-runtime
-  proxy-db-proxy-server-core
-  proxy-db-proxy-utils
-  proxy-extras
-  proxy-infra
-  responses-caching-types
-)
-
-legacy_paths() {
-  case "$1" in
-    caching-local) echo tests/unit/caching ;;
-    core-utils) echo tests/unit/litellm_core_utils ;;
-    enterprise-package)
-      echo tests/unit/enterprise/integrations
-      echo tests/unit/enterprise/proxy/auth
-      echo tests/unit/enterprise/proxy/guardrails
-      echo tests/unit/enterprise/proxy/hooks
-      echo tests/unit/enterprise/proxy/management_endpoints
-      echo tests/unit/enterprise/proxy/test_audit_logging_endpoints.py
-      echo tests/unit/enterprise/enterprise_callbacks/test_prometheus_logging_callbacks.py ;;
-    enterprise-routing)
-      echo tests/unit/google_genai
-      echo tests/unit/router_strategy
-      echo tests/unit/router_utils
-      echo tests/unit/enterprise/enterprise_callbacks/send_emails
-      echo tests/unit/enterprise/proxy/test_afile_retrieve_returns_unified_id.py
-      echo tests/unit/enterprise/proxy/test_batch_retrieve_input_file_id.py
-      echo tests/unit/enterprise/proxy/test_batch_retrieve_registers_missing_output_file_id.py
-      echo tests/unit/enterprise/proxy/test_batch_retrieve_returns_unified_input_file_id.py
-      echo tests/unit/enterprise/proxy/test_batch_update_db_managed_output_file_id.py
-      echo tests/unit/enterprise/proxy/test_deleted_file_returns_403_not_404.py
-      echo tests/unit/enterprise/proxy/test_enterprise_routes.py
-      echo tests/unit/enterprise/proxy/test_file_deletion_blocking.py
-      echo tests/unit/enterprise/proxy/test_managed_files_access_check.py
-      echo tests/unit/enterprise/proxy/test_managed_files_hook.py ;;
-    integrations) echo tests/unit/integrations ;;
-    llm-other-providers) find tests/unit/llms -name 'test_*.py' -not -path 'tests/unit/llms/vertex_ai/*' ;;
-    llm-vertex-ai) echo tests/unit/llms/vertex_ai ;;
-    mcp-integration)
-      echo tests/unit/experimental_mcp_client
-      echo tests/unit/proxy/_experimental/mcp_server
-      echo tests/unit/responses/mcp
-      echo tests/mcp_tests/test_proxy_mcp_e2e.py ;;
-    misc)
-      find tests/unit -maxdepth 1 -name 'test_*.py'
-      echo tests/unit/test_router
-      echo tests/unit/a2a_protocol
-      echo tests/unit/batches
-      echo tests/unit/chat_completions
-      echo tests/unit/completion_extras
-      echo tests/unit/containers
-      echo tests/unit/embeddings
-      echo tests/unit/endpoints
-      echo tests/unit/files
-      echo tests/unit/images
-      echo tests/unit/interactions
-      echo tests/unit/messages
-      echo tests/unit/rag
-      echo tests/unit/rerank_api
-      echo tests/unit/rust_bridge
-      echo tests/unit/secret_managers
-      echo tests/unit/vector_stores
-      echo tests/unit/videos ;;
-    proxy-db-auth-checks)
-      echo tests/unit/proxy/auth/test_auth_checks.py
-      echo tests/unit/proxy/auth/test_user_api_key_auth.py
-      echo tests/unit/proxy/test_deprecated_key_grace_period.py ;;
-    proxy-db-budgets)
-      echo tests/unit/proxy/auth/test_default_end_user_budget_simple.py
-      echo tests/unit/proxy/hooks/test_unit_test_max_model_budget_limiter.py
-      echo tests/unit/proxy/test_zero_cost_model_budget_bypass.py ;;
-    proxy-db-custom-logging)
-      echo tests/unit/proxy/test_custom_callback_input.py
-      echo tests/unit/proxy/test_custom_logger_s3_gcs.py ;;
-    proxy-db-db-and-spend)
-      echo tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py
-      echo tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py
-      echo tests/unit/proxy/db/test_update_daily_tag_spend.py
-      echo tests/unit/proxy/test_db_schema_changes.py
-      echo tests/unit/proxy/test_prisma_client_backoff_retry.py
-      echo tests/unit/proxy/test_update_spend.py
-      echo tests/unit/skills/test_skills_db.py ;;
-    proxy-db-endpoints-and-responses)
-      echo tests/unit/proxy/auth/test_models_fallback_endpoint.py
-      echo tests/unit/proxy/common_utils/test_check_batch_cost.py
-      echo tests/unit/proxy/common_utils/test_check_responses_cost.py
-      echo tests/unit/proxy/common_utils/test_realtime_cache.py
-      echo tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py
-      echo tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py
-      echo tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py
-      echo tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py
-      echo tests/unit/proxy/response_polling/test_response_polling_handler.py
-      echo tests/unit/proxy/test_custom_tokenizer_bug.py
-      echo tests/unit/proxy/test_get_favicon.py
-      echo tests/unit/proxy/test_get_image.py
-      echo tests/unit/proxy/test_prompt_test_endpoint.py
-      echo tests/unit/proxy/test_reducto_ocr_route.py
-      echo tests/unit/proxy/test_response_polling_pre_call_checks.py
-      echo tests/unit/proxy/test_ui_path_detection.py ;;
-    proxy-db-guardrails-hooks)
-      echo tests/unit/proxy/hooks/test_banned_keyword_list.py
-      echo tests/unit/proxy/test_proxy_setting_guardrails.py
-      echo tests/unit/proxy/test_unit_test_proxy_hooks.py ;;
-    proxy-db-jwt-and-keys)
-      echo tests/unit/proxy/auth/test_jwt.py
-      echo tests/unit/proxy/management_endpoints/test_jwt_key_mapping.py
-      echo tests/unit/proxy/test_proxy_custom_auth.py ;;
-    proxy-db-key-generation) echo tests/unit/proxy/management_endpoints/test_key_generate_prisma.py ;;
-    proxy-db-logging-misc)
-      echo tests/unit/proxy/management_helpers/test_audit_logs_proxy.py
-      echo tests/unit/proxy/spend_tracking/test_search_api_logging.py
-      echo tests/unit/proxy/test_proxy_reject_logging.py ;;
-    proxy-db-proxy-runtime)
-      echo tests/unit/proxy/auth/test_multipart_bypass_repro.py
-      echo tests/unit/proxy/auth/test_proxy_routes.py
-      echo tests/unit/proxy/middleware/test_request_size_limit_middleware.py
-      echo tests/unit/proxy/test_proxy_config_unit_test.py
-      echo tests/unit/proxy/test_proxy_token_counter.py
-      echo tests/unit/proxy/test_server_root_path.py ;;
-    proxy-db-proxy-server-core)
-      echo tests/unit/proxy/test_aproxy_startup.py
-      echo tests/unit/proxy/test_proxy_server.py ;;
-    proxy-db-proxy-utils) echo tests/unit/proxy/test_proxy_utils.py ;;
-    proxy-extras) echo tests/unit/litellm_proxy_extras ;;
-    proxy-infra) echo tests/unit/gateway ;;
-    responses-caching-types)
-      find tests/unit/responses -name 'test_*.py' -not -path 'tests/unit/responses/mcp/*'
-      echo tests/unit/types ;;
-    *) echo "unit_selection.sh: unknown flag $1" >&2; exit 1 ;;
-  esac
-}
-
-expand() {
-  while read -r path; do
-    if [ -d "$path" ]; then
-      find "$path" -name 'test_*.py'
-    elif [ -f "$path" ]; then
-      echo "$path"
-    else
-      echo "unit_selection.sh: $path does not exist" >&2
-      exit 1
-    fi
-  done
-}
-
-if [ "$flag" = unit ]; then
-  comm -23 \
-    <(find tests/unit -name 'test_*.py' | sort) \
-    <(for legacy in "${legacy_flags[@]}"; do legacy_paths "$legacy"; done | expand | sort)
-  exit 0
-fi
-
-legacy_paths "$flag" | expand | sort
--- a/.circleci/tests.yml
+++ b/.circleci/tests.yml
@ -1,416 +0,0 @@
-version: 2.1
-
-commands:
-  wait_for_service:
-    parameters:
-      url:
-        type: string
-      timeout:
-        type: string
-        default: "60"
-    steps:
-      - run:
-          name: "Wait for << parameters.url >>"
-          command: |
-            TIMEOUT=<< parameters.timeout >>
-            URL="<< parameters.url >>"
-            ELAPSED=0
-            echo "Waiting up to ${TIMEOUT}s for ${URL} ..."
-            if echo "$URL" | grep -q '^tcp://'; then
-              HOST=$(echo "$URL" | sed 's|tcp://||' | cut -d: -f1)
-              PORT=$(echo "$URL" | sed 's|tcp://||' | cut -d: -f2)
-              while ! bash -c "echo > /dev/tcp/$HOST/$PORT" 2>/dev/null; do
-                sleep 2; ELAPSED=$((ELAPSED+2))
-                if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "Timed out"; exit 1; fi
-              done
-            else
-              while ! curl -sf --max-time 5 "$URL" > /dev/null 2>&1; do
-                sleep 2; ELAPSED=$((ELAPSED+2))
-                if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "Timed out"; exit 1; fi
-              done
-            fi
-            echo "Service ready after ${ELAPSED}s"
-  install_uv:
-    steps:
-      - run:
-          name: Install uv (pinned 0.10.9)
-          command: |
-            curl -LsSf -o /tmp/uv-install.sh https://astral.sh/uv/0.10.9/install.sh
-            echo "7fc46e39cb97290b57169c0c813a17970585ac519139f19006453c99b5f2f45f  /tmp/uv-install.sh" | sha256sum -c -
-            env UV_NO_MODIFY_PATH=1 sh /tmp/uv-install.sh
-            rm -f /tmp/uv-install.sh
-            echo 'export PATH="$HOME/.local/bin:$PATH"' >> "$BASH_ENV"
-            export PATH="$HOME/.local/bin:$PATH"
-  install_rust:
-    steps:
-      - run:
-          name: Install Rust (rustup 1.28.2, toolchain 1.98.0)
-          command: |
-            case "$(uname -m)" in
-              x86_64)
-                RUSTUP_TRIPLE=x86_64-unknown-linux-gnu
-                RUSTUP_SHA256=20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c
-                ;;
-              aarch64)
-                RUSTUP_TRIPLE=aarch64-unknown-linux-gnu
-                RUSTUP_SHA256=e3853c5a252fca15252d07cb23a1bdd9377a8c6f3efa01531109281ae47f841c
-                ;;
-              *)
-                echo "install_rust: unsupported architecture $(uname -m)" >&2
-                exit 1
-                ;;
-            esac
-            curl -sSLf -o /tmp/rustup-init \
-              "https://static.rust-lang.org/rustup/archive/1.28.2/${RUSTUP_TRIPLE}/rustup-init"
-            echo "${RUSTUP_SHA256}  /tmp/rustup-init" | sha256sum -c -
-            chmod +x /tmp/rustup-init
-            /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain 1.98.0
-            rm -f /tmp/rustup-init
-            echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> "$BASH_ENV"
-            export PATH="$HOME/.cargo/bin:$PATH"
-            rustc --version
-            cargo --version
-  install_codecov_cli:
-    steps:
-      - run:
-          name: Install Codecov CLI (pinned v11.3.1)
-          when: always
-          command: |
-            curl -sSLf -o /tmp/codecov https://cli.codecov.io/v11.3.1/linux/codecov
-            curl -sSLf -o /tmp/codecov.SHA256SUM https://cli.codecov.io/v11.3.1/linux/codecov.SHA256SUM
-            [ "$(cat /tmp/codecov.SHA256SUM)" = "ca1d64196d2d34771084afe76ea657d581bf628e31d993ff8e52ea09cc88a56d  codecov" ]
-            (cd /tmp && sha256sum -c codecov.SHA256SUM)
-            chmod +x /tmp/codecov
-            mkdir -p "$HOME/.local/bin"
-            mv /tmp/codecov "$HOME/.local/bin/codecov"
-  setup_litellm_enterprise_pip:
-    steps:
-      - run:
-          name: "Install local version of litellm-enterprise"
-          command: |
-            uv run --no-sync python -c "import litellm_enterprise; print('litellm-enterprise OK:', litellm_enterprise.__file__)"
-  setup_test_deps:
-    steps:
-      - install_uv
-      - install_rust
-      - restore_cache:
-          keys:
-            - v3-integration-uv-cache-{{ checksum "uv.lock" }}
-      - run:
-          name: Install Dependencies
-          command: |
-            uv sync --frozen --all-groups --all-extras --python 3.12
-      - setup_litellm_enterprise_pip
-      - save_cache:
-          paths:
-            - ~/.cache/uv
-          key: v3-integration-uv-cache-{{ checksum "uv.lock" }}
-      - run:
-          name: Generate Prisma client
-          command: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-  skip_unless_relevant:
-    parameters:
-      category:
-        type: string
-        default: backend
-      base_ref:
-        type: string
-        default: ""
-      pull_request_url:
-        type: string
-        default: ""
-    steps:
-      - run:
-          name: "Skip job when no << parameters.category >>-relevant files changed"
-          command: |
-            export CIRCLE_PULL_REQUEST="${CIRCLE_PULL_REQUEST:-<< parameters.pull_request_url >>}"
-            export PATH_FILTER_BASE_BRANCH="<< parameters.base_ref >>"
-            [ -n "$PATH_FILTER_BASE_BRANCH" ] || unset PATH_FILTER_BASE_BRANCH
-            bash .circleci/scripts/path_filter.sh << parameters.category >>
-  start_postgres:
-    parameters:
-      db_name:
-        type: string
-        default: circle_test
-      image:
-        type: string
-        default: postgres:14@sha256:6a70deda415ec296f977890e11aba04a0db9f632a362e3fce45e845e3db74f26
-    steps:
-      - run:
-          name: Start PostgreSQL
-          command: |
-            docker run -d \
-              --name postgres-db \
-              -e POSTGRES_USER=postgres \
-              -e POSTGRES_PASSWORD=postgres \
-              -e POSTGRES_DB=<< parameters.db_name >> \
-              -p 5432:5432 \
-              << parameters.image >>
-      - wait_for_service:
-          url: tcp://localhost:5432
-          timeout: "60"
-  start_redis:
-    steps:
-      - run:
-          name: Start Redis
-          command: |
-            docker run -d \
-              --name redis-cache \
-              -p 6379:6379 \
-              redis:7-alpine@sha256:7aec734b2bb298a1d769fd8729f13b8514a41bf90fcdd1f38ec52267fbaa8ee6
-      - wait_for_service:
-          url: tcp://localhost:6379
-          timeout: "60"
-
-jobs:
-  unit:
-    parameters:
-      flag:
-        type: string
-        default: unit
-      shards:
-        type: integer
-        default: 6
-      workers:
-        type: integer
-        default: 4
-      dist:
-        type: string
-        default: loadscope
-      base_ref:
-        type: string
-        default: ""
-      pull_request_url:
-        type: string
-        default: ""
-      legacy_mcp_peer:
-        type: boolean
-        default: false
-      reruns:
-        type: integer
-        default: 0
-    machine:
-      image: ubuntu-2204:2024.04.1
-    resource_class: large
-    working_directory: ~/project
-    parallelism: << parameters.shards >>
-    environment:
-      COVERAGE_CORE: sysmon
-      LITELLM_LOCAL_MODEL_COST_MAP: "True"
-    steps:
-      - checkout
-      - skip_unless_relevant:
-          base_ref: << parameters.base_ref >>
-          pull_request_url: << parameters.pull_request_url >>
-      - setup_test_deps
-      - when:
-          condition: << parameters.legacy_mcp_peer >>
-          steps:
-            - run:
-                name: Install MCP SDK1 peer
-                command: |
-                  uv venv --python 3.12 .venv-mcp-peer
-                  uv pip install --python .venv-mcp-peer 'mcp==1.28.1' 'langchain-mcp-adapters==0.2.1'
-                  echo "export MCP_TEST_PEER_PYTHON=$PWD/.venv-mcp-peer/bin/python" >> "$BASH_ENV"
-      - run:
-          name: "Run << parameters.flag >> shard"
-          no_output_timeout: 20m
-          command: |
-            mkdir -p test-results/<< parameters.flag >>
-            selection="$(bash .circleci/scripts/unit_selection.sh << parameters.flag >>)" || { echo "unit_selection.sh failed for << parameters.flag >>"; exit 1; }
-            [ -n "${selection}" ] || { echo "unit_selection.sh produced no files for << parameters.flag >>"; exit 1; }
-            shard="$(printf '%s\n' "${selection}" | circleci tests split --split-by=timings --timings-type=filename)" || { echo "circleci tests split failed for << parameters.flag >>"; exit 1; }
-            [ -n "${shard}" ] || { echo "shard ${CIRCLE_NODE_INDEX} received no << parameters.flag >> files; nothing to run"; exit 0; }
-            mapfile -t files < <(printf '%s\n' "${shard}")
-            xdist_args=()
-            if [ "<< parameters.workers >>" -gt 0 ]; then xdist_args=(-n << parameters.workers >> --dist=<< parameters.dist >>); fi
-            rerun_args=(-p no:rerunfailures)
-            if [ "<< parameters.reruns >>" -gt 0 ]; then rerun_args=(--reruns << parameters.reruns >> --reruns-delay 1 --rerun-except "from pytest-timeout"); fi
-            test_env=(PATH="$PATH" HOME="$HOME" CI=true COVERAGE_CORE="$COVERAGE_CORE" LITELLM_LOCAL_MODEL_COST_MAP="$LITELLM_LOCAL_MODEL_COST_MAP")
-            if [ -n "${MCP_TEST_PEER_PYTHON:-}" ]; then test_env+=(MCP_TEST_PEER_PYTHON="$MCP_TEST_PEER_PYTHON"); fi
-            set +e
-            env -i "${test_env[@]}" \
-              uv run --no-sync pytest "${files[@]}" "${rerun_args[@]}" -p no:pytest-retry --timeout=90 "${xdist_args[@]}" --tb=short --durations=20 -o junit_family=xunit1 --junitxml=test-results/<< parameters.flag >>/junit.xml --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml:coverage.xml --cov-config=pyproject.toml
-            status=$?
-            set -e
-            if [ "$status" -eq 5 ]; then echo "pytest collected no tests from the shard; passing"; exit 0; fi
-            exit "$status"
-      - install_codecov_cli
-      - run:
-          name: Upload coverage
-          when: always
-          command: |
-            [ -f coverage.xml ] || { echo "no coverage.xml produced; skipping upload"; exit 0; }
-            codecov upload-process --disable-search -f coverage.xml -F << parameters.flag >> -C "$CIRCLE_SHA1" -n "<< parameters.flag >>-${CIRCLE_NODE_INDEX}-${CIRCLE_BUILD_NUM}" --git-service github
-      - store_test_results:
-          path: test-results
-      - store_artifacts:
-          path: test-results
-      - store_artifacts:
-          path: coverage.xml
-  documentation:
-    machine:
-      image: ubuntu-2204:2024.04.1
-    resource_class: large
-    working_directory: ~/project
-    steps:
-      - checkout
-      - setup_test_deps
-      - run:
-          name: Checkout litellm-docs
-          command: rm -rf docs/my-website && git clone --depth 1 https://github.com/BerriAI/litellm-docs.git docs/my-website
-      - run:
-          name: Run documentation validation
-          command: |
-            uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
-            uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
-            uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
-            uv run --no-sync python ./tests/documentation_tests/test_circular_imports.py
-  integration:
-    parameters:
-      suite:
-        type: string
-      base_ref:
-        type: string
-        default: ""
-      pull_request_url:
-        type: string
-        default: ""
-    machine:
-      image: ubuntu-2204:2024.04.1
-    resource_class: large
-    working_directory: ~/project
-    steps:
-      - checkout
-      - skip_unless_relevant:
-          base_ref: << parameters.base_ref >>
-          pull_request_url: << parameters.pull_request_url >>
-      - setup_test_deps
-      - start_postgres:
-          image: postgres:16@sha256:e17e86066e5ef83e0952a9347f5c792b7ece00972e2aa787a6986f471b3dd3d5
-      - start_redis
-      - run:
-          name: Run owned integration contracts
-          command: env -i PATH="$PATH" HOME="$HOME" CIRCLE_SHA1="$CIRCLE_SHA1" CIRCLE_WORKFLOW_ID="$CIRCLE_WORKFLOW_ID" bash .circleci/scripts/run_integration.sh << parameters.suite >>
-          no_output_timeout: 15m
-      - run:
-          name: Stop owned database and Redis
-          when: always
-          command: |
-            mkdir -p test-results/integration-<< parameters.suite >>
-            docker logs postgres-db > test-results/integration-<< parameters.suite >>/postgres.log 2>&1 || true
-            docker logs redis-cache > test-results/integration-<< parameters.suite >>/redis.log 2>&1 || true
-            docker rm -f postgres-db redis-cache
-            test -z "$(docker ps -aq --filter name=postgres-db --filter name=redis-cache)"
-      - store_test_results:
-          path: test-results
-      - store_artifacts:
-          path: test-results
-
-workflows:
-  tests:
-    when: (pipeline.event.name == "push" and pipeline.git.branch == "main") or pipeline.event.name == "api" or (pipeline.event.name == "pull_request" and (pipeline.event.github.pull_request.base.ref == "main" or pipeline.event.github.pull_request.base.ref starts-with "litellm_"))
-    jobs:
-      - unit:
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-<< matrix.flag >>
-          shards: 1
-          workers: 2
-          reruns: 2
-          matrix:
-            parameters:
-              flag: [caching-local, proxy-extras, enterprise-routing]
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-mcp-integration
-          flag: mcp-integration
-          shards: 1
-          workers: 2
-          legacy_mcp_peer: true
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-<< matrix.flag >>
-          shards: 1
-          reruns: 2
-          matrix:
-            parameters:
-              flag:
-                - enterprise-package
-                - proxy-infra
-                - responses-caching-types
-                - proxy-db-auth-checks
-                - proxy-db-jwt-and-keys
-                - proxy-db-proxy-server-core
-                - proxy-db-proxy-runtime
-                - proxy-db-custom-logging
-                - proxy-db-logging-misc
-                - proxy-db-db-and-spend
-                - proxy-db-guardrails-hooks
-                - proxy-db-budgets
-                - proxy-db-endpoints-and-responses
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-llm-vertex-ai
-          flag: llm-vertex-ai
-          shards: 2
-          workers: 1
-          reruns: 2
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-llm-other-providers
-          flag: llm-other-providers
-          shards: 3
-          reruns: 2
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-core-utils
-          flag: core-utils
-          shards: 2
-          reruns: 1
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-integrations
-          flag: integrations
-          shards: 2
-          reruns: 3
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-misc
-          flag: misc
-          shards: 2
-          reruns: 2
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-proxy-db-proxy-utils
-          flag: proxy-db-proxy-utils
-          shards: 1
-          reruns: 2
-          dist: worksteal
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - unit:
-          name: unit-proxy-db-key-generation
-          flag: proxy-db-key-generation
-          shards: 1
-          workers: 0
-          reruns: 2
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
-      - documentation
-      - integration:
-          name: integration-<< matrix.suite >>
-          matrix:
-            parameters:
-              suite: [sdk]
-          base_ref: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.base.ref or "" >>
-          pull_request_url: << pipeline.event.name == "pull_request" and pipeline.event.github.pull_request.url or "" >>
--- a/.gitguardian.yaml
+++ b/.gitguardian.yaml
@ -84,10 +84,6 @@ secret:
    - name: Langfuse test credentials in test_completion
      match: c39310f68cc3d3e22f7b298bb6353c4f45759adcc37080d8b7f4e535d3cfd7f4
    
-    # Test password "sk-1234" in e2e test fixtures - test fixture, not a real secret
-    - name: Test password in e2e test fixtures
-      match: ce32b547202e209ec1dd50107b64be4cfcf2eb15c3b4f8e9dc611ef747af634f
-    
    # === Preventive patterns for test keys (pattern-based) ===
    
    # Test API keys (124 instances across 45 files)
@ -108,4 +104,3 @@ secret:

    - name: Short fake sk keys (1–9 digits only)
      match: \bsk-\d{1,9}\b
-
--- a/.githooks/commit-msg
+++ b/.githooks/commit-msg
@ -42,7 +42,7 @@ case "$subject" in
        ;;
 esac

-ALLOWED_TYPES="feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert"
+ALLOWED_TYPES="feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert|security"
 # Description must not start with an uppercase letter — kept in sync with the
 # subjectPattern in .github/workflows/conventional-commits.yml so the local
 # hook is the strictly tighter of the two gates. (Without this guard, a commit
@ -61,7 +61,7 @@ cat >&2 <<EOF
  Expected: <type>(<scope>)!: <description>
            (description must start with a lowercase letter)

-  Allowed types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
+  Allowed types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert, security
  Examples:
    feat(router): add weighted round-robin strategy
    fix(bedrock): decouple STS region from aws_region_name
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -1,10 +1,2 @@
-/ui/ @yuneng-berri @ryan-crabbe-berri
-/litellm/proxy/_experimental/out/ @yuneng-berri @ryan-crabbe-berri
-/ui/Dockerfile
-/ui/nginx.conf
-/ui/litellm-dashboard/src/lib/http/schema.d.ts
-/ui/litellm-dashboard/tsconfig.tsbuildinfo
 /model_prices_and_context_window.json @mateo-berri @ryan-crabbe-berri @kerry-berri
 /litellm/model_prices_and_context_window_backup.json @mateo-berri @ryan-crabbe-berri @kerry-berri
-/litellm-proxy-extras/litellm_proxy_extras/migrations/ @yuneng-berri @ryan-crabbe-berri
-/.github/CODEOWNERS @yuneng-berri
--- a/.github/PULL_REQUEST_TEMPLATE/general.md
+++ b/.github/PULL_REQUEST_TEMPLATE/general.md
@ -54,7 +54,7 @@ After: the same request comes back with real token counts, so the dashboard show

 ## Affected release

-<!-- Only for a fix to a regression in a released or rc version (perf, memory, crash, or behavior): name the version it regressed in, e.g. "regression in v1.100.0" or "since v1.101.0-rc.1", and add the `backport-stable` label so the fix is cherry-picked onto the rc line before the stable is tagged. Drop the section otherwise -->
+<!-- Only for a fix to a regression in a released or rc version (perf, memory, crash, or behavior): name the version it regressed in, e.g. "regression in v1.100.0" or "since v1.101.0-rc.1". Add the `backport-stable` label only when the regression is a P0, meaning its Linear ticket is Urgent (a security hole however narrow, data loss, or a crash or outage for every user on that version), because every labeled PR must be cherry-picked onto the baking rc line before the stable can be tagged; every other regression fix ships in the next rc unlabeled. Drop the section otherwise -->

 ## Linear ticket

@ -150,7 +150,7 @@ For each e2e test you added or changed, list the manual steps a reviewer can fol
 Example checklists:

 - tests/e2e/quota_management/ratelimit/test_rate_limit_e2e.py::TestKeyRateLimits::test_rpm_limit_blocks_over_limit - a key allowed 2 requests a minute serves exactly 2 and refuses the 3rd
-  - [ ] Generate a limited key: curl -X POST http://localhost:4000/key/generate -H "Authorization: Bearer sk-1234" -d '{"rpm_limit": 2}'
+  - [ ] Generate a limited key: curl -X POST http://localhost:4000/key/generate -H "Authorization: Bearer $LITELLM_MASTER_KEY" -d '{"rpm_limit": 2}'
  - [ ] Send three /v1/chat/completions requests with that key inside one minute
  - [ ] Expect the first two to return 200 and the third to return 429 naming the rpm limit
  - [ ] Sanity check: this test makes sense to add and is not hand-wavey (e.g., assert actual expected spend instead of just spend > 0) or potentially flaky
@ -164,4 +164,3 @@ Example checklists:
 ## Final Attestation

 - [ ] The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR
-
--- a/.github/PULL_REQUEST_TEMPLATE/rust.md
+++ b/.github/PULL_REQUEST_TEMPLATE/rust.md
@ -0,0 +1 @@
+<!-- Write the final PR description as concise bullets only -->
--- a/.github/actions/cache-cargo-build/action.yml
+++ b/.github/actions/cache-cargo-build/action.yml
@ -25,6 +25,7 @@ runs:
  using: composite
  steps:
    - name: Restore the Cargo registry and target directory
+      if: github.ref == 'refs/heads/main'
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: |
@ -34,3 +35,15 @@ runs:
        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm-rust/Cargo.lock') }}
        restore-keys: |
          ${{ runner.os }}-maturin-${{ inputs.profile }}-
+
+    - name: Restore the Cargo registry and target directory
+      if: github.ref != 'refs/heads/main'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+          litellm-rust/target
+        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm-rust/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-maturin-${{ inputs.profile }}-
--- a/.github/actions/cache-prisma-binaries/action.yml
+++ b/.github/actions/cache-prisma-binaries/action.yml
@ -30,6 +30,7 @@ runs:
        echo "version=${version}" >> "$GITHUB_OUTPUT"

    - name: Restore Prisma binaries
+      if: github.ref == 'refs/heads/main'
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        # ~/.cache/prisma-python holds the npm install tree prisma-client-py
@ -38,3 +39,12 @@ runs:
          ~/.cache/prisma-python
          ~/.cache/prisma
        key: ${{ runner.os }}-prisma-binaries-${{ steps.version.outputs.version }}
+
+    - name: Restore Prisma binaries
+      if: github.ref != 'refs/heads/main'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: |
+          ~/.cache/prisma-python
+          ~/.cache/prisma
+        key: ${{ runner.os }}-prisma-binaries-${{ steps.version.outputs.version }}
--- a/.github/actions/cache-uv-downloads/action.yml
+++ b/.github/actions/cache-uv-downloads/action.yml
@ -0,0 +1,25 @@
+name: "Cache uv downloads"
+description: >-
+  Restore the uv download cache on every run and save it only from main, so pull
+  requests reuse main's cache instead of evicting it with their own copies.
+
+runs:
+  using: composite
+  steps:
+    - name: Restore and save the uv download cache
+      if: github.ref == 'refs/heads/main'
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ env.UV_CACHE_DIR }}
+        key: ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-${{ hashFiles('uv.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-
+
+    - name: Restore the uv download cache
+      if: github.ref != 'refs/heads/main'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ env.UV_CACHE_DIR }}
+        key: ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-${{ hashFiles('uv.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-
--- a/.github/actions/rust-bridge/action.yml
+++ b/.github/actions/rust-bridge/action.yml
@ -0,0 +1,19 @@
+name: Set up the Rust bridge
+description: Select the shared Rust bridge artifact or the Cargo cache
+inputs:
+  artifact:
+    description: Rust bridge artifact name
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - name: Restore the Cargo build cache
+      if: inputs.artifact == ''
+      uses: ./.github/actions/cache-cargo-build
+    - name: Download the Rust bridge artifact
+      if: inputs.artifact != ''
+      uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
+      with:
+        name: ${{ inputs.artifact }}
+        path: rust-bridge-dist
--- a/.github/actions/setup-uv-with-retries/action.yml
+++ b/.github/actions/setup-uv-with-retries/action.yml
@ -17,6 +17,7 @@ runs:
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      with:
        version: ${{ inputs.version }}
+        save-cache: ${{ github.ref == 'refs/heads/main' }}

    - name: Wait before attempt 2
      if: steps.attempt-1.outcome == 'failure'
@ -30,6 +31,7 @@ runs:
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      with:
        version: ${{ inputs.version }}
+        save-cache: ${{ github.ref == 'refs/heads/main' }}

    - name: Wait before attempt 3
      if: steps.attempt-2.outcome == 'failure'
@ -41,3 +43,4 @@ runs:
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      with:
        version: ${{ inputs.version }}
+        save-cache: ${{ github.ref == 'refs/heads/main' }}
--- a/.github/assets/lens-datasets/add-to-dataset-dialog.png
+++ b/.github/assets/lens-datasets/add-to-dataset-dialog.png
--- a/.github/assets/lens-datasets/dataset-case-panel.png
+++ b/.github/assets/lens-datasets/dataset-case-panel.png
--- a/.github/assets/lens-datasets/dataset-detail.png
+++ b/.github/assets/lens-datasets/dataset-detail.png
--- a/.github/assets/lens-datasets/datasets-list.png
+++ b/.github/assets/lens-datasets/datasets-list.png
--- a/.github/assets/lens-datasets/old-revision.png
+++ b/.github/assets/lens-datasets/old-revision.png
--- a/.github/assets/lens-datasets/trace-header.png
+++ b/.github/assets/lens-datasets/trace-header.png
--- a/.github/assets/lens-result-retries/before-results.jpg
+++ b/.github/assets/lens-result-retries/before-results.jpg
--- a/.github/assets/lens-result-retries/partial-results.jpg
+++ b/.github/assets/lens-result-retries/partial-results.jpg
--- a/.github/assets/roi-calculator-integrations/after-github.jpg
+++ b/.github/assets/roi-calculator-integrations/after-github.jpg
--- a/.github/assets/roi-calculator-integrations/after-gitlab-detail-top.jpg
+++ b/.github/assets/roi-calculator-integrations/after-gitlab-detail-top.jpg
--- a/.github/assets/roi-calculator-integrations/after-gitlab-detail.jpg
+++ b/.github/assets/roi-calculator-integrations/after-gitlab-detail.jpg
--- a/.github/assets/roi-calculator-integrations/after-gitlab.jpg
+++ b/.github/assets/roi-calculator-integrations/after-gitlab.jpg
--- a/.github/assets/roi-calculator-integrations/before-github.jpg
+++ b/.github/assets/roi-calculator-integrations/before-github.jpg
--- a/.github/assets/roi-calculator-integrations/demo-exit-loading.jpg
+++ b/.github/assets/roi-calculator-integrations/demo-exit-loading.jpg
--- a/.github/assets/roi-calculator-integrations/demo-fallback-live.jpg
+++ b/.github/assets/roi-calculator-integrations/demo-fallback-live.jpg
--- a/.github/assets/roi-calculator-integrations/demo-overview.jpg
+++ b/.github/assets/roi-calculator-integrations/demo-overview.jpg
--- a/.github/assets/roi-calculator-integrations/demo-people.jpg
+++ b/.github/assets/roi-calculator-integrations/demo-people.jpg
--- a/.github/assets/roi-calculator-integrations/demo-pr-costs.jpg
+++ b/.github/assets/roi-calculator-integrations/demo-pr-costs.jpg
--- a/.github/assets/roi-calculator-integrations/demo-pr-detail.jpg
+++ b/.github/assets/roi-calculator-integrations/demo-pr-detail.jpg
--- a/.github/assets/roi-calculator-integrations/demo-preview-link.jpg
+++ b/.github/assets/roi-calculator-integrations/demo-preview-link.jpg
--- a/.github/assets/roi-calculator-integrations/demo-with-live-errors.jpg
+++ b/.github/assets/roi-calculator-integrations/demo-with-live-errors.jpg
--- a/.github/assets/roi-calculator-integrations/source-race-after.jpg
+++ b/.github/assets/roi-calculator-integrations/source-race-after.jpg
--- a/.github/assets/roi-calculator-integrations/source-race-before.jpg
+++ b/.github/assets/roi-calculator-integrations/source-race-before.jpg
--- a/.github/assets/roi-calculator/00-original-setup.png
+++ b/.github/assets/roi-calculator/00-original-setup.png
--- a/.github/assets/roi-calculator/01-connect-github.png
+++ b/.github/assets/roi-calculator/01-connect-github.png
--- a/.github/assets/roi-calculator/02-repositories.png
+++ b/.github/assets/roi-calculator/02-repositories.png
--- a/.github/assets/roi-calculator/03-estimator-schedule.png
+++ b/.github/assets/roi-calculator/03-estimator-schedule.png
--- a/.github/assets/roi-calculator/04-backfill-progress.png
+++ b/.github/assets/roi-calculator/04-backfill-progress.png
--- a/.github/assets/roi-calculator/06-overview.png
+++ b/.github/assets/roi-calculator/06-overview.png
--- a/.github/assets/roi-calculator/07-people-unmatched.png
+++ b/.github/assets/roi-calculator/07-people-unmatched.png
--- a/.github/assets/roi-calculator/08-match-email.png
+++ b/.github/assets/roi-calculator/08-match-email.png
--- a/.github/assets/roi-calculator/09-people-matched.png
+++ b/.github/assets/roi-calculator/09-people-matched.png
--- a/.github/assets/roi-calculator/10-pr-reasoning.png
+++ b/.github/assets/roi-calculator/10-pr-reasoning.png
--- a/.github/assets/roi-calculator/11-settings.png
+++ b/.github/assets/roi-calculator/11-settings.png
--- a/.github/assets/roi-calculator/12-restart-setup.png
+++ b/.github/assets/roi-calculator/12-restart-setup.png
--- a/.github/assets/roi-calculator/13-advanced-settings.png
+++ b/.github/assets/roi-calculator/13-advanced-settings.png
--- a/.github/assets/roi-calculator/14-overview-pulls.png
+++ b/.github/assets/roi-calculator/14-overview-pulls.png
--- a/.github/assets/roi-calculator/15-sample-preview.png
+++ b/.github/assets/roi-calculator/15-sample-preview.png
--- a/.github/assets/roi-calculator/16-calculator-sidebar.png
+++ b/.github/assets/roi-calculator/16-calculator-sidebar.png
--- a/.github/assets/roi-calculator/19-matching-calculator-icons.png
+++ b/.github/assets/roi-calculator/19-matching-calculator-icons.png
--- a/.github/assets/roi-calculator/20-partial-repository-report.png
+++ b/.github/assets/roi-calculator/20-partial-repository-report.png
--- a/.github/assets/roi-calculator/21-empty-repository-preserved-report.png
+++ b/.github/assets/roi-calculator/21-empty-repository-preserved-report.png
--- a/.github/assets/roi-calculator/22-partial-calculation-explanation.png
+++ b/.github/assets/roi-calculator/22-partial-calculation-explanation.png
--- a/.github/assets/roi-calculator/23-estimator-outage-preserved-report.png
+++ b/.github/assets/roi-calculator/23-estimator-outage-preserved-report.png
--- a/.github/ci-coverage-allowlist.yml
+++ b/.github/ci-coverage-allowlist.yml
@ -4,6 +4,14 @@ description: >-
  by a job nor listed here, so every entry below is a decision on the record.

 test_paths:
+  - reason: >-
+      litellm.agent() end-to-end suite. It drives the real claude, codex and opencode CLIs and
+      deepagents against a live LiteLLM AI Gateway, so it needs those binaries on PATH plus
+      LITELLM_PROXY_API_BASE / LITELLM_PROXY_API_KEY, and skips without them. Run manually
+      before changing litellm/harness; the mocked coverage runs in tests/unit/harness and
+      tests/unit/llms/*/harness
+    paths:
+      - tests/harness_e2e
  - reason: >-
      The Rust/Python parity harness is run manually through its local CLI. Recorded replay,
      fixture generation, and harness checks are intentionally outside pull request CI
@ -13,7 +21,7 @@ test_paths:
      Live-provider caching cases in tests/local_testing that remain outside CI. Jobs that
      glob that directory either deselect them (local_testing_part1 and part2 carry `-k "... and
      not caching and not cache"`) or keep only another keyword (langfuse, router, assistants).
-      Separately, test-redis-compat.yml selects two IAM cluster authentication tests in
+      Separately, the CircleCI redis-compat jobs select two IAM cluster authentication tests in
      test_caching.py by node ID. It does not run that file's other tests.
      The gap was eight files and 118 tests when measured 2026-08-20; the five keyless files now
      run in the caching-local shard, leaving live cases in these three. Measured 2026-08-21 with no provider
@ -111,3 +119,10 @@ dockerfiles:
      An example image under cookbook/ that is documentation rather than a shipped artifact
    paths:
      - cookbook/litellm-ollama-docker-image/Dockerfile
+  - reason: >-
+      The Rust gateway image compiles the whole workspace in release mode, which is too slow for
+      a per-pull-request job while the gateway binary is still being assembled; the Rust lint,
+      clippy, and compile jobs already cover the code it packages. Revisit when the gateway is
+      published
+    paths:
+      - litellm-rust/crates/gateway/Dockerfile
--- a/.github/codeql/codeql-config.yml
+++ b/.github/codeql/codeql-config.yml
@ -1,8 +1,5 @@
 name: "LiteLLM CodeQL config"

-queries:
-  - uses: security-and-quality
-
 # Known OOM queries on large Python codebases:
 # CodeQL builds a full data flow graph in memory. These two queries trace
 # sensitive data through every log call / regex pattern, causing combinatorial
@ -14,17 +11,6 @@ query-filters:
      id: py/clear-text-logging-sensitive-data  # CWE-312
  - exclude:
      id: py/polynomial-redos                   # CWE-730
-  # Import resolution confuses stdlib types with management_endpoints/types.py.
-  # The generic cycle query also reports intentional deferred imports.
-  - exclude:
-      id: py/cyclic-import
-  - exclude:
-      id: py/unsafe-cyclic-import
-  # Known false positives on live settings and Protocol placeholders.
-  - exclude:
-      id: py/unused-global-variable
-  - exclude:
-      id: py/ineffectual-statement

 paths-ignore:
  - tests
--- a/.github/e2e-stack/down.sh
+++ b/.github/e2e-stack/down.sh
@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -uo pipefail
-
-STACK_DIR="${E2E_STACK_DIR:-${RUNNER_TEMP:-/tmp}/litellm-e2e-stack}"
-
-for pid_file in "${STACK_DIR}"/pids/*.pid; do
-  [[ -f "${pid_file}" ]] || continue
-  pkill -TERM -P "$(cat "${pid_file}")" 2>/dev/null
-  kill -TERM "$(cat "${pid_file}")" 2>/dev/null
-  rm -f "${pid_file}"
-done
-
-for container in e2e-nginx e2e-keycloak e2e-valkey e2e-jaeger e2e-postgres; do
-  docker rm -f "${container}" >/dev/null 2>&1
-done
-
-exit 0
--- a/.github/e2e-stack/redact_output.py
+++ b/.github/e2e-stack/redact_output.py
@ -1,83 +0,0 @@
-import argparse
-import os
-import sys
-from functools import reduce
-from pathlib import Path
-from typing import Final
-from xml.sax.saxutils import escape
-
-from pydantic import JsonValue, TypeAdapter, ValidationError
-from secrets_to_env import MIN_MASKED_LENGTH
-
-REDACTED: Final = "***"
-json_adapter: Final[TypeAdapter[JsonValue]] = TypeAdapter(JsonValue)
-
-
-def string_leaves(node: JsonValue) -> tuple[str, ...]:
-    match node:
-        case str():
-            return (node,)
-        case list():
-            return tuple(leaf for child in node for leaf in string_leaves(child))
-        case dict():
-            return tuple(leaf for child in node.values() for leaf in string_leaves(child))
-    return ()
-
-
-def field_lines(value: str) -> tuple[str, ...]:
-    try:
-        return tuple(line for leaf in string_leaves(json_adapter.validate_json(value)) for line in leaf.splitlines())
-    except ValidationError:
-        return ()
-
-
-def masked_values(values_files: tuple[Path, ...]) -> tuple[str, ...]:
-    values: Final = frozenset(
-        line.split("=", 1)[1].strip().strip("'")
-        for path in values_files
-        for line in path.read_text().splitlines()
-        if "=" in line
-    )
-    texts: Final = frozenset(text for value in values for text in (value, *field_lines(value)))
-    renderings: Final = frozenset(
-        rendering
-        for text in texts
-        if len(text) >= MIN_MASKED_LENGTH
-        for rendering in (text, escape(text), escape(text, {'"': "&quot;"}))
-    )
-    return tuple(sorted(renderings, key=lambda rendering: (-len(rendering), rendering)))
-
-
-def redact(text: str, values: tuple[str, ...]) -> str:
-    return reduce(lambda redacted, value: redacted.replace(value, REDACTED), values, text)
-
-
-def write_redacted(source: Path, out_dir: Path, values: tuple[str, ...]) -> None:
-    target: Final = out_dir / source.name
-    with os.fdopen(os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600), "w") as handle:
-        _ = handle.write(redact(source.read_text(errors="replace"), values))
-
-
-def main() -> int:
-    parser: Final = argparse.ArgumentParser()
-    _ = parser.add_argument("--values", action="append", type=Path, required=True)
-    _ = parser.add_argument("--out", type=Path, required=True)
-    _ = parser.add_argument("files", nargs="*", type=Path)
-    args: Final = parser.parse_args()
-    values_files: Final = tuple(args.values)
-    out_dir: Final[Path] = args.out
-    sources: Final = tuple(args.files)
-    try:
-        values: Final = masked_values(values_files)
-        out_dir.mkdir(mode=0o700, exist_ok=True)
-        for source in sources:
-            write_redacted(source, out_dir, values)
-    except OSError as error:
-        _ = sys.stderr.write(f"could not redact {error.filename}\n")
-        return 1
-    _ = sys.stdout.write(f"redacted {len(sources)} file(s) into {out_dir}\n")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
--- a/.github/e2e-stack/secrets_to_env.py
+++ b/.github/e2e-stack/secrets_to_env.py
@ -1,55 +0,0 @@
-import os
-import re
-import sys
-from pathlib import Path
-from typing import Final
-
-from pydantic import TypeAdapter, ValidationError
-
-secrets_adapter: Final[TypeAdapter[dict[str, str]]] = TypeAdapter(dict[str, str])
-ENV_NAME: Final = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
-MIN_MASKED_LENGTH: Final = 8
-ACTIONS_RUNNER_FLAG: Final = "GITHUB_ACTIONS"
-
-
-def main() -> int:
-    env_path: Final = Path(sys.argv[1])
-    try:
-        secrets: Final = {
-            key: value.rstrip("\r\n") for key, value in secrets_adapter.validate_json(sys.stdin.read()).items()
-        }
-    except (ValidationError, UnicodeError):
-        _ = sys.stderr.write("expected a JSON object containing string environment values\n")
-        return 1
-    unusable: Final = tuple(
-        key
-        for key, value in secrets.items()
-        if ENV_NAME.fullmatch(key) is None or any(char in value for char in "'\n\r\0")
-    )
-    if unusable:
-        _ = sys.stderr.write(
-            f"these names or values cannot be represented in both bash and dotenv: {' '.join(sorted(unusable))}\n"
-        )
-        return 1
-    if os.environ.get(ACTIONS_RUNNER_FLAG) == "true":
-        _ = sys.stdout.write(
-            "".join(
-                f"::add-mask::{value.replace('%', '%25')}\n"
-                for value in secrets.values()
-                if len(value) >= MIN_MASKED_LENGTH
-            )
-        )
-        sys.stdout.flush()
-    lines: Final = tuple(f"{key}='{value}'" for key, value in secrets.items() if value)
-    try:
-        with os.fdopen(os.open(env_path, os.O_WRONLY | os.O_APPEND | os.O_CREAT | os.O_NOFOLLOW, 0o600), "w") as handle:
-            os.fchmod(handle.fileno(), 0o600)
-            _ = handle.write("\n".join(lines) + "\n")
-    except OSError:
-        _ = sys.stderr.write("could not write the environment file\n")
-        return 1
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
--- a/.github/e2e-stack/select_tests.py
+++ b/.github/e2e-stack/select_tests.py
@ -1,51 +0,0 @@
-import re
-import sys
-from typing import Final
-
-SELECTABLE: Final = re.compile(r"^tests/e2e/([A-Za-z0-9_.-]+/)*test_[A-Za-z0-9_.-]+\.py$")
-UNSUPPORTED: Final = re.compile(
-    r"^tests/e2e/(ui|claude_code|load|migrations)/"
-    r"|^tests/e2e/mcp/test_mcp_oauth_happy_path_e2e\.py$"
-    r"|^tests/e2e/llm_translation/realtime/test_realtime_pipecat_audio_e2e\.py$"
-    r"|^tests/e2e/batches/test_managed_files_enforcement_e2e\.py$"
-    r"|^tests/e2e/guardrails/test_presidio_masking_e2e\.py$"
-    r"|^tests/e2e/logging/test_otel_v2_langfuse_generation_output_e2e\.py$"
-    r"|^tests/e2e/logging/test_langsmith_batch_serialization_e2e\.py$"
-    r"|^tests/e2e/secret_manager/"
-)
-HARNESS: Final = re.compile(
-    r"^tests/e2e/[A-Za-z0-9_.-]+\.(py|ini)$"
-    r"|^tests/e2e/idp_realm\.json$"
-    r"|^tests/e2e/management/(management_client|jwt_actors|conftest)\.py$"
-    r"|^tests/e2e/coverage_registry/management_cases\.py$"
-    r"|^tests/e2e/gateway/"
-    r"|^\.github/e2e-stack/"
-    r"|^\.github/workflows/test-e2e-changed\.yml$"
-)
-UNEXPANDED: Final = re.compile(r"[*?\[]")
-
-
-def is_selectable(path: str) -> bool:
-    return SELECTABLE.match(path) is not None and UNSUPPORTED.match(path) is None
-
-
-def select(changed: tuple[str, ...], canary: tuple[str, ...]) -> tuple[str, ...]:
-    direct: Final = frozenset(path for path in changed if is_selectable(path))
-    harness_changed: Final = any(HARNESS.match(path) for path in changed)
-    canary_tests: Final = frozenset(path for path in canary if harness_changed and is_selectable(path))
-    return tuple(sorted(direct | canary_tests))
-
-
-def main() -> int:
-    canary: Final = tuple(sys.argv[1:])
-    unexpanded: Final = tuple(path for path in canary if UNEXPANDED.search(path))
-    if unexpanded:
-        _ = sys.stderr.write(f"the canary paths reached the selector unexpanded: {' '.join(unexpanded)}\n")
-        return 1
-    changed: Final = tuple(line.strip() for line in sys.stdin if line.strip())
-    _ = sys.stdout.write(" ".join(select(changed, canary)) + "\n")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
--- a/.github/e2e-stack/up.sh
+++ b/.github/e2e-stack/up.sh
@ -1,231 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-umask 077
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-STACK_DIR="${E2E_STACK_DIR:-${RUNNER_TEMP:-/tmp}/litellm-e2e-stack}"
-CERTS_DIR="${STACK_DIR}/certs"
-LOGS_DIR="${STACK_DIR}/logs"
-PIDS_DIR="${STACK_DIR}/pids"
-
-POSTGRES_IMAGE="${E2E_POSTGRES_IMAGE:-postgres:16.6}"
-VALKEY_IMAGE="${E2E_VALKEY_IMAGE:-valkey/valkey:8.1.4@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa}"
-JAEGER_IMAGE="${E2E_JAEGER_IMAGE:-jaegertracing/jaeger:2.10.0}"
-NGINX_IMAGE="${E2E_NGINX_IMAGE:-nginx:1.29.1-alpine@sha256:42a516af16b852e33b7682d5ef8acbd5d13fe08fecadc7ed98605ba5e3b26ab8}"
-
-LB_PORT="${E2E_LB_PORT:-4000}"
-GATEWAY_PORT_1="${E2E_GATEWAY_PORT_1:-4010}"
-GATEWAY_PORT_2="${E2E_GATEWAY_PORT_2:-4011}"
-BACKEND_PORT="${E2E_BACKEND_PORT:-4001}"
-REDIS_PORT="${E2E_REDIS_PORT:-6379}"
-DATABASE_HOST="${E2E_DATABASE_HOST:-127.0.0.1}"
-DATABASE_PORT="${E2E_DATABASE_PORT:-5432}"
-DATABASE_USER="${E2E_DATABASE_USER:-litellm}"
-DATABASE_PASSWORD="${E2E_DATABASE_PASSWORD:-dbpassword9090}"
-DATABASE_NAME="${E2E_DATABASE_NAME:-litellm}"
-JAEGER_OTLP_PORT="${E2E_JAEGER_OTLP_PORT:-4318}"
-JAEGER_OTLP_TLS_PORT="${E2E_JAEGER_OTLP_TLS_PORT:-4319}"
-JAEGER_QUERY_PORT="${E2E_JAEGER_QUERY_PORT:-16686}"
-KEYCLOAK_PORT="${E2E_KEYCLOAK_PORT:-8081}"
-
-MASTER_KEY="${LITELLM_MASTER_KEY:-sk-e2e-$(openssl rand -hex 16)}"
-
-mkdir -p "${CERTS_DIR}" "${LOGS_DIR}" "${PIDS_DIR}"
-chmod 700 "${STACK_DIR}" "${LOGS_DIR}" "${PIDS_DIR}"
-chmod 755 "${CERTS_DIR}"
-
-log() { printf 'e2e-stack: %s\n' "$*"; }
-
-port_open() { (exec 3<>"/dev/tcp/127.0.0.1/$1") 2>/dev/null; }
-
-wait_for() {
-  local label="$1" check="$2" deadline=$((SECONDS + ${3:-120}))
-  until eval "${check}"; do
-    if ((SECONDS >= deadline)); then
-      log "timed out waiting for ${label}"
-      exit 1
-    fi
-    sleep 2
-  done
-  log "${label} is up"
-}
-
-if [[ -f "${REPO_ROOT}/tests/e2e/.env" ]]; then
-  set -a
-  source "${REPO_ROOT}/tests/e2e/.env"
-  set +a
-fi
-
-if [[ -z "${DD_API_KEY:-}" ]]; then
-  log "DD_API_KEY is empty; the gateway config enables the datadog callback, so put a Datadog API key in tests/e2e/.env"
-  exit 1
-fi
-export DD_SITE="${DD_SITE:-datadoghq.com}"
-
-if ! port_open "${DATABASE_PORT}"; then
-  docker run -d --name e2e-postgres -p "${DATABASE_PORT}:5432" \
-    -e "POSTGRES_USER=${DATABASE_USER}" -e "POSTGRES_PASSWORD=${DATABASE_PASSWORD}" -e "POSTGRES_DB=${DATABASE_NAME}" \
-    "${POSTGRES_IMAGE}" >/dev/null
-fi
-wait_for "postgres" "port_open ${DATABASE_PORT}"
-
-if ! port_open "${JAEGER_QUERY_PORT}"; then
-  docker run -d --name e2e-jaeger -p "${JAEGER_OTLP_PORT}:4318" -p "${JAEGER_QUERY_PORT}:16686" \
-    "${JAEGER_IMAGE}" >/dev/null
-fi
-wait_for "jaeger" "curl -fs http://127.0.0.1:${JAEGER_QUERY_PORT}/api/services >/dev/null"
-
-openssl genrsa -out "${CERTS_DIR}/ca.key" 2048 2>/dev/null
-openssl req -x509 -new -nodes -key "${CERTS_DIR}/ca.key" -sha256 -days 7 \
-  -subj "/CN=litellm-e2e-ca" \
-  -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign" \
-  -out "${CERTS_DIR}/ca.crt" 2>/dev/null
-openssl genrsa -out "${CERTS_DIR}/server.key" 2048 2>/dev/null
-openssl req -new -key "${CERTS_DIR}/server.key" -subj "/CN=localhost" -out "${CERTS_DIR}/server.csr" 2>/dev/null
-openssl x509 -req -in "${CERTS_DIR}/server.csr" -CA "${CERTS_DIR}/ca.crt" -CAkey "${CERTS_DIR}/ca.key" \
-  -CAcreateserial -days 7 -sha256 \
-  -extfile <(printf 'basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:localhost,IP:127.0.0.1\n') \
-  -out "${CERTS_DIR}/server.crt" 2>/dev/null
-chmod 644 "${CERTS_DIR}"/*.key "${CERTS_DIR}"/*.crt
-
-CERTIFI_BUNDLE="$(cd "${REPO_ROOT}" && uv run --no-sync python -c 'import certifi; print(certifi.where())')"
-cat "${CERTIFI_BUNDLE}" "${CERTS_DIR}/ca.crt" > "${CERTS_DIR}/ca-bundle.pem"
-
-docker rm -f e2e-valkey >/dev/null 2>&1 || true
-docker run -d --name e2e-valkey -p "${REDIS_PORT}:${REDIS_PORT}" -v "${CERTS_DIR}:/certs:ro" \
-  "${VALKEY_IMAGE}" valkey-server \
-  --cluster-enabled yes --port 0 --tls-port "${REDIS_PORT}" \
-  --tls-cert-file /certs/server.crt --tls-key-file /certs/server.key --tls-ca-cert-file /certs/ca.crt \
-  --tls-auth-clients no --cluster-announce-ip 127.0.0.1 >/dev/null
-VALKEY_CLI="docker exec e2e-valkey valkey-cli --tls --cacert /certs/ca.crt -h 127.0.0.1 -p ${REDIS_PORT}"
-wait_for "valkey" "${VALKEY_CLI} ping 2>/dev/null | grep -q PONG"
-${VALKEY_CLI} cluster addslotsrange 0 16383 >/dev/null
-wait_for "valkey cluster" "${VALKEY_CLI} cluster info 2>/dev/null | grep -q cluster_state:ok"
-
-CONFIG_SOURCE="${REPO_ROOT}/tests/e2e/gateway/stage_mirror_ci_config.yml"
-CONFIG_PATH="${CONFIG_SOURCE}"
-if [[ "${REDIS_PORT}" != "6379" ]]; then
-  CONFIG_PATH="${STACK_DIR}/litellm-config.yml"
-  sed "s/port: 6379/port: ${REDIS_PORT}/" "${CONFIG_SOURCE}" > "${CONFIG_PATH}"
-fi
-
-SERVER_ENV=(
-  "LITELLM_MASTER_KEY=${MASTER_KEY}"
-  "DATABASE_HOST=${DATABASE_HOST}"
-  "DATABASE_PORT=${DATABASE_PORT}"
-  "DATABASE_USER=${DATABASE_USER}"
-  "DATABASE_PASSWORD=${DATABASE_PASSWORD}"
-  "DATABASE_NAME=${DATABASE_NAME}"
-  "DISABLE_SCHEMA_UPDATE=true"
-  "REDIS_HOST=127.0.0.1"
-  "REDIS_PORT=${REDIS_PORT}"
-  "REDIS_CLUSTER_NODES=[{\"host\":\"127.0.0.1\",\"port\":${REDIS_PORT}}]"
-  "CONFIG_FILE_PATH=${CONFIG_PATH}"
-  "STORE_MODEL_IN_DB=True"
-  "OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf"
-  "OTEL_EXPORTER_OTLP_ENDPOINT=https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}"
-  "SSL_CERT_FILE=${CERTS_DIR}/ca-bundle.pem"
-  "PYTHONPATH=${REPO_ROOT}"
-  "JWT_PUBLIC_KEY_URL=http://127.0.0.1:${KEYCLOAK_PORT}/realms/litellm-e2e/protocol/openid-connect/certs"
-  "JWT_ISSUER=http://127.0.0.1:${KEYCLOAK_PORT}/realms/litellm-e2e"
-  "JWT_AUDIENCE=litellm-e2e"
-)
-if [[ -n "${VERTEXAI_CREDENTIALS:-}" ]]; then
-  printf '%s' "${VERTEXAI_CREDENTIALS}" > "${STACK_DIR}/vertex-adc.json"
-  SERVER_ENV+=("GOOGLE_APPLICATION_CREDENTIALS=${STACK_DIR}/vertex-adc.json")
-fi
-
-cd "${REPO_ROOT}"
-
-env "${SERVER_ENV[@]}" "E2E_KEYCLOAK_PORT=${KEYCLOAK_PORT}" bash .github/e2e-stack/start-idp.sh
-
-log "running migrations"
-env "${SERVER_ENV[@]}" uv run --no-sync python migrations/run.py >"${LOGS_DIR}/migrations.log" 2>&1
-
-start_server() {
-  local name="$1"; shift
-  env -u AWS_ROLE_NAME "${SERVER_ENV[@]}" "$@" >"${LOGS_DIR}/${name}.log" 2>&1 &
-  echo $! > "${PIDS_DIR}/${name}.pid"
-}
-
-if [[ "$(uname)" == "Linux" ]]; then
-  NGINX_UPSTREAM_HOST=127.0.0.1
-  NGINX_DOCKER_ARGS=(--network host)
-else
-  NGINX_UPSTREAM_HOST=host.docker.internal
-  NGINX_DOCKER_ARGS=(-p "${LB_PORT}:${LB_PORT}" -p "${JAEGER_OTLP_TLS_PORT}:${JAEGER_OTLP_TLS_PORT}")
-fi
-
-cat > "${STACK_DIR}/nginx.conf" <<EOF
-events {}
-http {
-  map \$http_upgrade \$connection_upgrade {
-    default upgrade;
-    '' close;
-  }
-  upstream litellm_gateways {
-    server ${NGINX_UPSTREAM_HOST}:${GATEWAY_PORT_1};
-    server ${NGINX_UPSTREAM_HOST}:${GATEWAY_PORT_2};
-  }
-  server {
-    listen ${LB_PORT};
-    client_max_body_size 100m;
-    location / {
-      proxy_pass http://litellm_gateways;
-      proxy_http_version 1.1;
-      proxy_set_header Host \$host;
-      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-      proxy_set_header X-Forwarded-Proto \$scheme;
-      proxy_set_header Upgrade \$http_upgrade;
-      proxy_set_header Connection \$connection_upgrade;
-      proxy_buffering off;
-      proxy_read_timeout 600s;
-      proxy_send_timeout 600s;
-    }
-  }
-  server {
-    listen ${JAEGER_OTLP_TLS_PORT} ssl;
-    ssl_certificate /certs/server.crt;
-    ssl_certificate_key /certs/server.key;
-    client_max_body_size 100m;
-    location / {
-      proxy_pass http://${NGINX_UPSTREAM_HOST}:${JAEGER_OTLP_PORT};
-    }
-  }
-}
-EOF
-
-docker rm -f e2e-nginx >/dev/null 2>&1 || true
-docker run -d --name e2e-nginx "${NGINX_DOCKER_ARGS[@]}" \
-  -v "${STACK_DIR}/nginx.conf:/etc/nginx/nginx.conf:ro" \
-  -v "${CERTS_DIR}:/certs:ro" "${NGINX_IMAGE}" >/dev/null
-
-wait_for "Jaeger OTLP TLS listener" \
-  "curl -sS --cacert ${CERTS_DIR}/ca.crt https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}/ -o /dev/null -w '%{http_code}' | grep -qE '^[2345]'"
-
-start_server backend uv run --no-sync uvicorn backend.main:app --host 0.0.0.0 --port "${BACKEND_PORT}"
-start_server gateway-1 uv run --no-sync uvicorn gateway.main:app --workers 1 --host 0.0.0.0 --port "${GATEWAY_PORT_1}"
-start_server gateway-2 uv run --no-sync uvicorn gateway.main:app --workers 1 --host 0.0.0.0 --port "${GATEWAY_PORT_2}"
-
-wait_for "backend" "curl -fs http://127.0.0.1:${BACKEND_PORT}/health/liveliness >/dev/null" 300
-wait_for "gateway-1" "curl -fs http://127.0.0.1:${GATEWAY_PORT_1}/health/liveliness >/dev/null" 300
-wait_for "gateway-2" "curl -fs http://127.0.0.1:${GATEWAY_PORT_2}/health/liveliness >/dev/null" 300
-wait_for "load balancer" "curl -fs http://127.0.0.1:${LB_PORT}/health/liveliness >/dev/null" 60
-
-cat > "${STACK_DIR}/stack.env" <<EOF
-LITELLM_PROXY_URL=http://127.0.0.1:${LB_PORT}
-LITELLM_CONTROL_PLANE_URL=http://127.0.0.1:${BACKEND_PORT}
-LITELLM_PROXY_REPLICA_URLS=http://127.0.0.1:${GATEWAY_PORT_1},http://127.0.0.1:${GATEWAY_PORT_2}
-LITELLM_MASTER_KEY=${MASTER_KEY}
-REDIS_HOST=127.0.0.1
-REDIS_PORT=${REDIS_PORT}
-E2E_OTEL_QUERY_URL=http://127.0.0.1:${JAEGER_QUERY_PORT}
-E2E_OTEL_EXPORTER_ENDPOINT=https://127.0.0.1:${JAEGER_OTLP_TLS_PORT}
-E2E_KEYCLOAK_URL=http://127.0.0.1:${KEYCLOAK_PORT}
-E2E_KEYCLOAK_ADMIN_USER=admin
-E2E_KEYCLOAK_ADMIN_PASSWORD=e2e-ephemeral-idp-not-a-secret
-SSL_CERT_FILE=${CERTS_DIR}/ca-bundle.pem
-DATABASE_URL=postgresql://${DATABASE_USER}:${DATABASE_PASSWORD}@${DATABASE_HOST}:${DATABASE_PORT}/${DATABASE_NAME}
-EOF
-
-log "stack is up; pytest env written to ${STACK_DIR}/stack.env"
--- a/.github/merge-smoke-tests.json
+++ b/.github/merge-smoke-tests.json
@ -3,8 +3,8 @@
    "CHAT-JSON": "tests/unit/llms/openai/test_openai.py::test_acompletion_returns_json_reply_over_injected_transport",
    "CHAT-TEXT-STREAM": "tests/unit/llms/openai/test_openai.py::test_acompletion_streams_text_deltas_over_injected_transport",
    "CHAT-TOOL-STREAM": "tests/unit/llms/openai/test_openai.py::test_acompletion_streams_tool_call_arguments_over_injected_transport",
-    "MODEL-ALLOW": "tests/test_litellm/proxy/auth/test_auth_checks.py::test_can_object_call_model_allows_listed_model_for_key",
-    "MODEL-DENY": "tests/test_litellm/proxy/auth/test_auth_checks.py::test_can_object_call_model_denials_return_forbidden[key-key_model_access_denied]",
+    "MODEL-ALLOW": "tests/unit/proxy/auth/test_auth_checks_object_access_and_lookup.py::test_can_object_call_model_allows_listed_model_for_key",
+    "MODEL-DENY": "tests/unit/proxy/auth/test_auth_checks_object_access_and_lookup.py::test_can_object_call_model_denials_return_forbidden[key-key_model_access_denied]",
    "COST-EXPLICIT": "tests/unit/test_cost_calculator.py::test_completion_cost_charges_explicit_per_token_rates_over_registered_ones",
    "COST-ZERO": "tests/unit/test_cost_calculator.py::test_completion_cost_is_zero_when_explicit_rates_are_zero",
    "LOG-CONTENT-ON": "tests/unit/litellm_core_utils/test_litellm_logging.py::test_standard_logging_payload_keeps_message_content_when_message_logging_is_on",
--- a/.github/scripts/assert_ci_coverage.py
+++ b/.github/scripts/assert_ci_coverage.py
@ -21,11 +21,12 @@ TESTS_ROOT = REPO_ROOT / "tests"

 ALLOWLIST_KEYS = frozenset({"description", "test_paths", "dockerfiles"})
 PATH_FILTER_KEYS = frozenset({"paths", "paths-ignore"})
-TEST_PATH_KEYS = frozenset({"test-path", "test-paths"})
+TEST_PATH_KEYS = frozenset({"test-path", "test-paths", "test_path"})
 DOCKERFILE_INPUT_KEYS = frozenset({"file", "dockerfile"})
 TEST_RUNNER_RE = re.compile(r"\bpytest\b|\bcircleci tests\b|\bhelm unittest\b|\bplaywright test\b|\bpython[0-9.]*\s")
 IMAGE_BUILD_RE = re.compile(r"\bdocker\s+(?:buildx\s+)?build\b")
 TEST_TOKEN_RE = re.compile(r"tests/[A-Za-z0-9_./*?-]+")
+IGNORE_ARG_RE: Final = re.compile(r"--ignore(?:-glob)?[= ](\S+)")
 DOCKERFILE_TOKEN_RE = re.compile(r"[A-Za-z0-9_./-]*Dockerfile[A-Za-z0-9_.-]*")
 COMMENT_RE = re.compile(r"^\s*#.*$", re.MULTILINE)
 GLOB_CHARS = frozenset("*?")
@ -35,7 +36,7 @@ GLOB_CHARS = frozenset("*?")
 # itself decomposed one level deeper and is checked through its own entry.
 SHARDED_ROOTS: tuple[str, ...] = (
    "tests/test_litellm",
-    "tests/test_litellm/proxy",
+    "tests/unit/proxy",
 )


@ -71,6 +72,17 @@ class Scalar:
    value: str


+@dataclass(frozen=True, slots=True)
+class Selection:
+    included: frozenset[str]
+    ignored: frozenset[str]
+
+    def covers(self, relative_path: str) -> bool:
+        return any(_token_covers(token, relative_path) for token in self.included) and not any(
+            _token_covers(token, relative_path) for token in self.ignored
+        )
+
+
@dataclass(frozen=True, slots=True)
 class Finding:
    subject: str
@ -110,20 +122,32 @@ def _uncommented(value: str) -> str:
    return COMMENT_RE.sub("", value)


-def _invoked_test_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
-    return frozenset(
-        match.group(0).rstrip("/")
+def _selection_for_scalar(scalar: Scalar) -> Selection:
+    text: Final = _uncommented(scalar.value)
+    ignored: Final = frozenset().union(
+        *(
+            frozenset(token.rstrip("/") for token in TEST_TOKEN_RE.findall(ignored_argument))
+            for ignored_argument in IGNORE_ARG_RE.findall(text)
+        )
+    )
+    included: Final = frozenset(
+        match.group(0).rstrip("/") for match in TEST_TOKEN_RE.finditer(IGNORE_ARG_RE.sub("", text))
+    )
+    return Selection(included=included, ignored=ignored)
+
+
+def _invoked_selections(scalars: Iterable[Scalar]) -> tuple[Selection, ...]:
+    selected_scalars: Final = tuple(
+        scalar
        for scalar in scalars
        if scalar.key in TEST_PATH_KEYS or TEST_RUNNER_RE.search(scalar.value)
-        for match in TEST_TOKEN_RE.finditer(_uncommented(scalar.value))
    )
+    selections: Final = tuple(_selection_for_scalar(scalar) for scalar in selected_scalars)
+    return tuple(selection for selection in selections if selection.included)


-def _unit_selection_tokens(repo_root: pathlib.Path = REPO_ROOT) -> frozenset[str]:
-    script: Final = repo_root / ".circleci/scripts/unit_selection.sh"
-    if not script.is_file():
-        return frozenset()
-    return frozenset(match.group(0).rstrip("/") for match in TEST_TOKEN_RE.finditer(_uncommented(script.read_text())))
+def _invoked_test_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
+    return frozenset().union(*(selection.included for selection in _invoked_selections(scalars)))


 def _built_dockerfile_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
@ -186,11 +210,12 @@ def _dockerfiles() -> tuple[str, ...]:
    )


-def _uncovered_tests(allowlist: Allowlist, tokens: frozenset[str]) -> tuple[Finding, ...]:
+def _uncovered_tests(allowlist: Allowlist, selections: tuple[Selection, ...]) -> tuple[Finding, ...]:
    uncovered = tuple(
        relative_path
        for relative_path in _test_files()
-        if not any(_token_covers(token, relative_path) for token in tokens) and not allowlist.covers_test(relative_path)
+        if not any(selection.covers(relative_path) for selection in selections)
+        and not allowlist.covers_test(relative_path)
    )
    directories = tuple(dict.fromkeys(path.rsplit("/", 1)[0] for path in uncovered))
    return tuple(
@ -506,23 +531,46 @@ def _integration_groups(runner: pathlib.Path) -> dict[str, tuple[str, ...]]:
    return {group: tuple(folders) for group, folders in ast.literal_eval(mapping).items()}


+def _integration_github_files(runner: pathlib.Path) -> frozenset[str]:
+    module: Final = ast.parse(runner.read_text())
+    literal: Final = next(
+        (
+            node.value
+            for node in module.body
+            if isinstance(node, ast.AnnAssign)
+            and isinstance(node.target, ast.Name)
+            and node.target.id == "GITHUB_FILES"
+        ),
+        None,
+    )
+    if literal is None:
+        return frozenset()
+    values: Final = literal.args[0] if isinstance(literal, ast.Call) else literal
+    return frozenset(ast.literal_eval(values))
+
+
 def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozenset[str], tuple[Finding, ...]]:
    runner: Final = repo_root / "tests/integration/run.py"
    if not runner.exists():
        return frozenset(), ()
    groups: Final = _integration_groups(runner)
+    github_files: Final = _integration_github_files(runner)
    integration_root: Final = repo_root / "tests/integration"
    paths: Final = frozenset(
        str(path.relative_to(repo_root))
        for folders in groups.values()
        for folder in folders
-        for path in (integration_root / folder).glob("test_*.py")
+        for path in (integration_root / folder).rglob("test_*.py")
+        if str(path.relative_to(repo_root)) not in github_files
    )
    browser_manifest: Final = repo_root / "tests/e2e/ui/tests/integrationCritical/expected.json"
    browser_nodes: Final = json.loads(browser_manifest.read_text()) if browser_manifest.exists() else ()
    browser_paths: Final = frozenset(node.split("::", 1)[0] for node in browser_nodes)
    circle_path: Final = repo_root / ".circleci/config.yml"
    circle: Final = yaml.safe_load(circle_path.read_text()) if circle_path.exists() else {}
+    circle_test_path_tokens: Final = _invoked_test_tokens(
+        scalar for scalar in _scalars(circle, "config.yml") if scalar.key == "test_path"
+    )
    steps: Final = circle.get("jobs", {}).get("integration_contracts", {}).get("steps", ())
    invoked: Final = any(
        ".circleci/scripts/run_integration.sh" in scalar.value
@ -557,10 +605,22 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
        for path in (repo_root / ".github/workflows").glob("*.y*ml")
        for scalar in _scalars(yaml.safe_load(path.read_text()), path.name)
    )
-    findings: Final = tuple(
-        Finding(path, "integration contract is also selected by GitHub Actions")
-        for path in paths
-        if any(_token_covers(token, path) for token in gha_tokens)
+    findings: Final = (
+        tuple(
+            Finding(path, "integration contract is also selected by GitHub Actions")
+            for path in paths
+            if any(_token_covers(token, path) for token in gha_tokens)
+        )
+        + tuple(
+            Finding(path, "GitHub-owned integration contract has no invoking job")
+            for path in sorted(github_files)
+            if not any(_token_covers(token, path) for token in gha_tokens | circle_test_path_tokens)
+        )
+        + tuple(
+            Finding(path, "GitHub-owned integration file is missing")
+            for path in sorted(github_files)
+            if not (repo_root / path).is_file()
+        )
    )
    browser_commands: Final = tuple(
        scalar.value
@ -604,7 +664,7 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
        return frozenset(), findings + (
            Finding(str(runner.relative_to(repo_root)), "dedicated CircleCI runner is missing"),
        )
-    return paths | browser_paths, findings + group_findings + browser_findings + exclusion_findings
+    return paths | browser_paths | github_files, findings + group_findings + browser_findings + exclusion_findings


 def main() -> int:
@ -618,7 +678,11 @@ def main() -> int:

    integration_paths, ownership_findings = _integration_ownership()
    test_findings = (
-        _uncovered_tests(allowlist, _invoked_test_tokens(scalars) | _unit_selection_tokens() | integration_paths)
+        _uncovered_tests(
+            allowlist,
+            _invoked_selections(scalars)
+            + (Selection(included=integration_paths, ignored=frozenset()),),
+        )
        + ownership_findings
    )
    dockerfile_findings = _uncovered_dockerfiles(allowlist, _built_dockerfile_tokens(scalars))
--- a/.github/scripts/verify_linux_native_wheel.py
+++ b/.github/scripts/verify_linux_native_wheel.py
@ -214,7 +214,7 @@ def main(
    native_module: Final = load_native_module(native_path)
    native_module_loads: Final = native_module is not None
    panic_test_hook_absent: Final = native_module is not None and not hasattr(native_module, "_panic_for_test")
-    native_size_limit: Final = 40_000_000
+    native_size_limit: Final = 48_000_000
    native_size_within_limit: Final = native_member.file_size <= native_size_limit
    validations: Final = (
        (f"Python tag is {EXPECTED_PYTHON_TAG}", python_tag == EXPECTED_PYTHON_TAG),
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@ -3,6 +3,11 @@ name: _Unit Test Base (Reusable)
 on:
  workflow_call:
    inputs:
+      python-version:
+        description: "Python version used to install dependencies and run tests"
+        required: false
+        type: string
+        default: "3.12"
      test-path:
        description: >-
          Space-separated pytest paths to run. A path that no longer exists is
@ -13,16 +18,6 @@ on:
          have its path existence-checked like any other token.
        required: true
        type: string
-      unit-flag:
-        description: >-
-          Codecov flag of the `.circleci/tests.yml` job that now owns part of
-          this shard. The shard also runs the files
-          `.circleci/scripts/unit_selection.sh` lists for the flag, on every
-          event, because the CircleCI pipeline is manual-only while the tests
-          migrate.
-        required: false
-        type: string
-        default: ""
      workers:
        description: "Number of pytest-xdist workers"
        required: false
@ -79,17 +74,16 @@ on:
        description: "Unique name for the coverage artifact (must be unique per run)"
        required: true
        type: string
-      legacy-mcp-peer:
-        description: "Install the isolated SDK1 peer for MCP compatibility tests"
+      rust-bridge-artifact:
+        description: "Prebuilt editable Rust bridge artifact"
        required: false
-        type: boolean
-        default: false
-
+        type: string
+        default: ""
 permissions:
  contents: read

 env:
-  UV_PYTHON: "3.12"
+  UV_PYTHON: ${{ inputs.python-version }}
  LITELLM_LOCAL_MODEL_COST_MAP: "True"

 jobs:
@ -132,32 +126,31 @@ jobs:
      - name: Cache uv dependencies
        if: steps.changes.outputs.decision != 'skip'
        timeout-minutes: 5
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: ${{ env.UV_CACHE_DIR }}
-          key: ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-downloads-py${{ env.UV_PYTHON }}-
+        uses: ./.github/actions/cache-uv-downloads

-      - name: Cache the Rust build
+      - name: Set up the Rust build
        if: steps.changes.outputs.decision != 'skip'
        timeout-minutes: 5
-        uses: ./.github/actions/cache-cargo-build
+        uses: ./.github/actions/rust-bridge
+        with:
+          artifact: ${{ inputs.rust-bridge-artifact }}

      - name: Install dependencies
        if: steps.changes.outputs.decision != 'skip'
        timeout-minutes: 8
        env:
-          LEGACY_MCP_PEER: ${{ inputs.legacy-mcp-peer }}
+          RUST_BRIDGE_ARTIFACT: ${{ inputs.rust-bridge-artifact }}
        run: |
          diff -u model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml
-          uv run --no-sync python -c 'import os, sys; print(sys.version); assert f"{sys.version_info.major}.{sys.version_info.minor}" == os.environ["UV_PYTHON"]'
-          if [ "$LEGACY_MCP_PEER" = "true" ]; then
-            uv venv --python "${UV_PYTHON}" .venv-mcp-peer
-            uv pip install --python .venv-mcp-peer 'mcp==1.28.1' 'langchain-mcp-adapters==0.2.1'
-            echo "MCP_TEST_PEER_PYTHON=$GITHUB_WORKSPACE/.venv-mcp-peer/bin/python" >> "$GITHUB_ENV"
+          if [ -z "$RUST_BRIDGE_ARTIFACT" ]; then
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime
+          else
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --no-install-project
+            uv pip install --no-deps --python .venv/bin/python rust-bridge-dist/*.whl
+            cp rust-bridge-dist/litellm/rust_bridge/_native.abi3.so litellm/rust_bridge/_native.abi3.so
+            uv run --no-sync python -c "import importlib.metadata; import litellm.rust_bridge._native; print(importlib.metadata.version('litellm'))"
          fi
+          uv run --no-sync python -c 'import os, sys; print(sys.version); assert f"{sys.version_info.major}.{sys.version_info.minor}" == os.environ["UV_PYTHON"]'

      - name: Cache Prisma binaries
        if: steps.changes.outputs.decision != 'skip'
@ -176,7 +169,6 @@ jobs:
        timeout-minutes: ${{ inputs.timeout-minutes }}
        env:
          TEST_PATH: ${{ inputs.test-path }}
-          UNIT_FLAG: ${{ inputs.unit-flag }}
          MAX_FAILURES: ${{ inputs.max-failures }}
          WORKERS: ${{ inputs.workers }}
          RERUNS: ${{ inputs.reruns }}
@ -186,9 +178,6 @@ jobs:
        run: |
          echo "has-coverage=false" >> "$GITHUB_OUTPUT"
          selection="${TEST_PATH}"
-          if [ -n "${UNIT_FLAG}" ]; then
-            selection="${TEST_PATH} $(bash .circleci/scripts/unit_selection.sh "${UNIT_FLAG}" | tr '\n' ' ')"
-          fi
          if [ -z "${selection// /}" ]; then
            echo "shard selection is empty; nothing to run"
            exit 0
@ -274,7 +263,7 @@ jobs:
      - name: Upload to Codecov
        id: codecov-upload
        continue-on-error: true
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          use_oidc: true
          directory: coverage-reports
@ -285,7 +274,7 @@ jobs:
      - name: Upload to Codecov (retry)
        if: steps.codecov-upload.outcome == 'failure'
        continue-on-error: true
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          use_oidc: true
          directory: coverage-reports
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@ -1,8 +1,6 @@
 name: "CodeQL"

 on:
-  push:
-    branches: [main]
  pull_request:
    branches: [main]
  schedule:
@ -43,14 +41,15 @@ jobs:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: ./.github/codeql/codeql-config.yml
+          queries: ${{ github.event_name == 'pull_request' && '+security-extended' || '' }}

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          category: "/language:${{ matrix.language }}"
          output: sarif-results
@ -83,7 +82,7 @@ jobs:
          output: sarif-results/python.sarif

      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          sarif_file: sarif-results
          category: "/language:${{ matrix.language }}"
--- a/.github/workflows/conventional-commits.yml
+++ b/.github/workflows/conventional-commits.yml
@ -41,6 +41,7 @@ jobs:
            ci
            chore
            revert
+            security
          requireScope: false
          subjectPattern: ^(?![A-Z]).+$
          subjectPatternError: |
--- a/.github/workflows/create-rc-branch.yml
+++ b/.github/workflows/create-rc-branch.yml
@ -15,6 +15,8 @@ jobs:
    runs-on: ubuntu-latest
    permissions:
      contents: write
+    outputs:
+      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Require main
        env:
@ -64,3 +66,14 @@ jobs:
              sha: context.sha,
            });
            core.info(`Created branch ${branchName} at ${context.sha}`);
+
+  linear-release:
+    name: Move the Linear release to rc
+    needs: create-rc-branch
+    permissions:
+      contents: read
+    uses: ./.github/workflows/linear-release.yml
+    with:
+      rc_version: ${{ needs.create-rc-branch.outputs.version }}
+    secrets:
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
--- a/.github/workflows/image-scan.yml
+++ b/.github/workflows/image-scan.yml
@ -9,15 +9,24 @@ on:
    paths:
      - Dockerfile
      - docker/Dockerfile.non_root
+      - docker/Dockerfile.database
      - migrations/Dockerfile
      - migrations/run.py
      - gateway/Dockerfile
      - gateway/main.py
+      - gateway/routes/allowlist.py
      - backend/Dockerfile
      - backend/main.py
+      - deploy/lens/**
+      - litellm/proxy/lens/**
+      - tests/e2e/migrations/lens_compose_smoke.sh
      - docker/component_entrypoint.sh
      - docker/entrypoint.sh
      - litellm/proxy/prisma_migration.py
+      - litellm/proxy/admin_mcp.py
+      - litellm/proxy/proxy_server.py
+      - backend/routes/allowlist.py
+      - pyproject.toml
      - litellm-proxy-extras/**
      - tests/proxy_migration_tests/**
      - uv.lock
@ -37,6 +46,80 @@ concurrency:
  cancel-in-progress: true

 jobs:
+  lens-worker-image:
+    name: lens-worker-image (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+            grype_sha256: edda0968d8827daab01d32b3cd7de192ae0915005e7bbfcfef9e68e79bc43343
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+            grype_sha256: 553e4c36d9d61349830ba6034d43b8700a7f10576d3e2f4981c0fd2b96086465
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - name: Build the release worker
+        env:
+          RELEASE_TAG: sha-${{ github.sha }}
+        run: docker build --build-arg LITELLM_RELEASE_TAG="${RELEASE_TAG}" -f deploy/lens/Dockerfile -t lens-worker-scan .
+      - name: Verify the standalone worker on a read-only filesystem
+        env:
+          RELEASE_TAG: sha-${{ github.sha }}
+        run: |
+          docker run --rm --network none --read-only --cap-drop ALL \
+            --tmpfs /tmp:rw,noexec,nosuid,size=1g --security-opt no-new-privileges \
+            -e EXPECTED_RELEASE_TAG="${RELEASE_TAG}" --entrypoint python lens-worker-scan -c '
+          import os
+          import lens.worker
+          from lens.release import release_tag
+          from lens.trace_store import trace_store
+          assert os.getuid() == 65532
+          assert release_tag() == os.environ["EXPECTED_RELEASE_TAG"]
+          with trace_store() as store:
+              assert store.count() == 0
+          '
+      - name: Reject a dependency whose hash has changed
+        run: |
+          docker build --target builder -f deploy/lens/Dockerfile -t lens-worker-deps .
+          sed -E 's/sha256:[0-9a-f]{64}/sha256:0000000000000000000000000000000000000000000000000000000000000000/g' \
+            deploy/lens/requirements.lock > "$RUNNER_TEMP/tampered.lock"
+          if docker run --rm -v "$RUNNER_TEMP/tampered.lock:/tmp/tampered.lock:ro" \
+            --entrypoint uv lens-worker-deps pip sync --python /app/.venv/bin/python \
+            --require-hashes --only-binary :all: --reinstall --no-cache /tmp/tampered.lock \
+            > "$RUNNER_TEMP/hash-check.log" 2>&1; then
+            echo "::error::Dependency hash mismatch was accepted"
+            exit 1
+          fi
+          cat "$RUNNER_TEMP/hash-check.log"
+          grep -qi 'hash mismatch' "$RUNNER_TEMP/hash-check.log"
+      - name: Download Grype v0.114.0
+        env:
+          ARCH: ${{ matrix.arch }}
+          GRYPE_SHA256: ${{ matrix.grype_sha256 }}
+        run: |
+          curl -fsSL --retry 3 -o "$RUNNER_TEMP/grype.tar.gz" \
+            "https://github.com/anchore/grype/releases/download/v0.114.0/grype_0.114.0_linux_${ARCH}.tar.gz"
+          echo "${GRYPE_SHA256}  $RUNNER_TEMP/grype.tar.gz" | sha256sum -c -
+          tar xzf "$RUNNER_TEMP/grype.tar.gz" -C "$RUNNER_TEMP" grype
+          chmod +x "$RUNNER_TEMP/grype"
+      - name: Scan the worker for fixable HIGH/CRITICAL CVEs
+        env:
+          GRYPE_MATCH_PYTHON_USING_CPES: "true"
+        run: |
+          "$RUNNER_TEMP/grype" lens-worker-scan \
+            --config .grype.yaml --only-fixed --fail-on high --output table
+
  image-scan:
    name: image-scan
    runs-on: ubuntu-latest
@ -65,6 +148,9 @@ jobs:
      - name: Build runtime image
        run: docker build -f docker/Dockerfile.non_root -t litellm-image-scan:${{ github.sha }} .

+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f docker/Dockerfile.non_root -t litellm-admin-mcp-schema:${{ github.sha }} .
+
      # The prisma bake must migrate a fresh DB with no egress as an arbitrary
      # non-root uid (OpenShift restricted-v2 / air-gapped / readOnlyRootFilesystem).
      # `docker run` as the default uid with network hides a broken bake because
@ -78,9 +164,10 @@ jobs:
      - name: Verify offline migration as a non-root uid
        env:
          LITELLM_IMAGE: litellm-image-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
        run: |
          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py -v
+          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py tests/proxy_migration_tests/test_image_admin_mcp.py -v

      # Scans the whole shipped artifact: OS/apk plus every language package
      # baked into the image, including ones no lockfile declares (e.g. prisma's
@ -99,21 +186,28 @@ jobs:
            --output table

  runtime-image:
-    name: runtime-image
+    name: runtime-image (${{ matrix.dockerfile }})
    runs-on: ubuntu-latest
    if: >-
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 30
+    timeout-minutes: 45
    permissions:
      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        dockerfile: [Dockerfile, docker/Dockerfile.database]
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          persist-credentials: false

      - name: Build runtime image
-        run: docker build -f Dockerfile -t litellm-runtime-scan:${{ github.sha }} .
+        run: docker build --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci -f "${{ matrix.dockerfile }}" -t litellm-runtime-scan:${{ github.sha }} .
+
+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f "${{ matrix.dockerfile }}" -t litellm-admin-mcp-schema:${{ github.sha }} .

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
@ -123,9 +217,16 @@ jobs:
      - name: Verify offline migration as a non-root uid
        env:
          LITELLM_IMAGE: litellm-runtime-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
        run: |
          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py -v
+          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py tests/proxy_migration_tests/test_image_admin_mcp.py -v
+
+      - name: Verify the bundled Lens Compose installation and restart
+        if: matrix.dockerfile == 'Dockerfile'
+        env:
+          LITELLM_IMAGE: litellm-runtime-scan:${{ github.sha }}
+        run: bash tests/e2e/migrations/lens_compose_smoke.sh

  migrations-image:
    name: migrations-image
@ -184,9 +285,10 @@ jobs:
        env:
          LITELLM_IMAGE: litellm-gateway-scan:${{ github.sha }}
          LITELLM_COMPONENT_PORT: "4000"
+          LITELLM_IMAGE_COMPONENT: gateway
        run: |
          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py -v
+          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py tests/proxy_migration_tests/test_image_bedrock_realtime_extra.py tests/proxy_migration_tests/test_image_admin_mcp.py -v

  ui-image:
    name: ui-image
@ -234,6 +336,9 @@ jobs:
      - name: Build backend image
        run: docker build -f backend/Dockerfile -t litellm-backend-scan:${{ github.sha }} .

+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f backend/Dockerfile -t litellm-admin-mcp-schema:${{ github.sha }} .
+
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
@ -242,7 +347,9 @@ jobs:
      - name: Verify the backend serves offline as a non-root uid
        env:
          LITELLM_IMAGE: litellm-backend-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
          LITELLM_COMPONENT_PORT: "4001"
+          LITELLM_IMAGE_COMPONENT: backend
        run: |
          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py -v
+          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py tests/proxy_migration_tests/test_image_admin_mcp.py -v
--- a/.github/workflows/lens-worker.yml
+++ b/.github/workflows/lens-worker.yml
@ -0,0 +1,130 @@
+name: Lens Worker Image
+
+on:
+  pull_request:
+    branches: [main, litellm_oss_branch, "litellm_**"]
+    paths:
+      - deploy/lens/**
+      - litellm/proxy/lens/**
+      - tests/proxy_behavior/lens/**
+      - .github/workflows/lens-worker.yml
+  push:
+    branches: [main]
+    paths:
+      - deploy/lens/**
+      - litellm/proxy/lens/**
+      - tests/proxy_behavior/lens/**
+      - .github/workflows/lens-worker.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lens-worker-image:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - name: Build Lens worker
+        run: docker build --build-arg LITELLM_RELEASE_TAG=sha-${{ github.sha }} -f deploy/lens/Dockerfile -t lens-worker:${{ github.sha }} .
+      - name: Reject custom builds without a matching release tag
+        run: |
+          if docker build --progress plain -f deploy/lens/Dockerfile -t lens-worker:unversioned . > missing-tag.log 2>&1; then
+            echo "::error::An unversioned worker build unexpectedly succeeded"
+            exit 1
+          fi
+          grep -F 'LITELLM_RELEASE_TAG: Pass --build-arg LITELLM_RELEASE_TAG matching the gateway' missing-tag.log
+      - name: Verify standalone imports with a read-only filesystem
+        run: |
+          docker run --rm --network none --read-only --cap-drop ALL --tmpfs /tmp:rw,noexec,nosuid,size=1g \
+            --security-opt no-new-privileges --entrypoint python \
+            lens-worker:${{ github.sha }} -c '
+          import os
+          import lens.worker
+          from lens.trace_store import trace_store
+          assert os.getuid() == 65532
+          with trace_store() as store:
+              assert store.count() == 0
+          '
+      - name: Prepare test-only coverage tool
+        run: |
+          coverage_directory=$(mktemp -d "$RUNNER_TEMP/lens-coverage.XXXXXX")
+          curl --fail --silent --show-error --location \
+            https://files.pythonhosted.org/packages/61/e8/cb8e80d6f9f55b99588625062822bf946cf03ed06315df4bd8397f5632a1/coverage-7.14.0-py3-none-any.whl \
+            --output "$coverage_directory/coverage.whl"
+          printf '%s  %s\n' 8de5b61163aee3d05c8a2beab6f47913df7981dad1baf82c414d99158c286ab1 \
+            "$coverage_directory/coverage.whl" | sha256sum --check
+          chmod 777 "$coverage_directory"
+          echo "LENS_COVERAGE_DIRECTORY=$coverage_directory" >> "$GITHUB_ENV"
+      - name: Verify confined Python execution
+        run: |
+          docker run --rm --network none --read-only --cap-drop ALL \
+            --tmpfs /tmp:rw,noexec,nosuid,size=1g --security-opt no-new-privileges \
+            -v "$PWD/tests/proxy_behavior/lens/worker_python_smoke.py:/app/python_smoke.py:ro" \
+            -v "$PWD/tests/proxy_behavior/lens/coverage.ini:/coverage.ini:ro" \
+            -v "$LENS_COVERAGE_DIRECTORY:/coverage" \
+            -e PYTHONPATH=/coverage/coverage.whl -e COVERAGE_RCFILE=/coverage.ini \
+            --entrypoint python lens-worker:${{ github.sha }} \
+            -m coverage run --data-file=/coverage/.coverage.python /app/python_smoke.py
+      - name: Verify workspace investigation and live review output
+        run: |
+          docker run --rm --network none --read-only --cap-drop ALL \
+            --tmpfs /tmp:rw,noexec,nosuid,size=1g --security-opt no-new-privileges \
+            -v "$PWD/tests/proxy_behavior/lens/worker_context_smoke.py:/app/context_smoke.py:ro" \
+            -v "$PWD/tests/proxy_behavior/lens/coverage.ini:/coverage.ini:ro" \
+            -v "$LENS_COVERAGE_DIRECTORY:/coverage" \
+            -e PYTHONPATH=/coverage/coverage.whl -e COVERAGE_RCFILE=/coverage.ini \
+            --entrypoint python lens-worker:${{ github.sha }} \
+            -m coverage run --data-file=/coverage/.coverage.context /app/context_smoke.py
+      - name: Verify default workspace recovery after Python scratch storage fills
+        run: |
+          docker run --rm --network none --read-only --cap-drop ALL \
+            --tmpfs /tmp:rw,noexec,nosuid,size=64k --security-opt no-new-privileges \
+            -v "$PWD/tests/proxy_behavior/lens/worker_storage_smoke.py:/app/storage_smoke.py:ro" \
+            -v "$PWD/tests/proxy_behavior/lens/coverage.ini:/coverage.ini:ro" \
+            -v "$LENS_COVERAGE_DIRECTORY:/coverage" \
+            -e PYTHONPATH=/coverage/coverage.whl -e COVERAGE_RCFILE=/coverage.ini \
+            --entrypoint python lens-worker:${{ github.sha }} \
+            -m coverage run --data-file=/coverage/.coverage.storage /app/storage_smoke.py
+      - name: Map native worker coverage to repository sources
+        if: always() && env.LENS_COVERAGE_DIRECTORY != ''
+        run: |
+          docker run --rm --network none --read-only --cap-drop ALL \
+            --security-opt no-new-privileges -w /workspace \
+            -v "$PWD/litellm/proxy/lens:/workspace/litellm/proxy/lens:ro" \
+            -v "$PWD/tests/proxy_behavior/lens/coverage.ini:/coverage.ini:ro" \
+            -v "$LENS_COVERAGE_DIRECTORY:/coverage" \
+            -e PYTHONPATH=/coverage/coverage.whl -e COVERAGE_RCFILE=/coverage.ini \
+            --entrypoint /bin/sh lens-worker:${{ github.sha }} \
+            -c 'python -m coverage combine && python -m coverage xml'
+      - name: Upload native worker coverage
+        if: always() && env.LENS_COVERAGE_DIRECTORY != ''
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        with:
+          use_oidc: true
+          files: ${{ env.LENS_COVERAGE_DIRECTORY }}/lens-worker.xml
+          root_dir: ${{ github.workspace }}
+          flags: lens-worker
+          fail_ci_if_error: false
+      - name: Publish versioned Lens worker
+        if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm' && github.ref == 'refs/heads/main'
+        env:
+          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_USER: ${{ github.actor }}
+          IMAGE: ghcr.io/berriai/litellm-lens-worker-dev:sha-${{ github.sha }}
+        run: |
+          printf '%s' "$REGISTRY_TOKEN" | docker login ghcr.io -u "$REGISTRY_USER" --password-stdin
+          docker tag lens-worker:${{ github.sha }} "$IMAGE"
+          docker push "$IMAGE"
+          printf 'Lens worker image: `%s`\n' "$IMAGE" >> "$GITHUB_STEP_SUMMARY"
--- a/.github/workflows/linear-release.yml
+++ b/.github/workflows/linear-release.yml
@ -0,0 +1,131 @@
+name: Linear Release
+
+on:
+  push:
+    branches:
+      - main
+      - "rc/**"
+  release:
+    types: [published]
+  workflow_call:
+    inputs:
+      rc_version:
+        description: "X.Y.0 release whose rc branch was just cut"
+        required: true
+        type: string
+    secrets:
+      LINEAR_API_KEY:
+        required: true
+
+permissions: {}
+
+jobs:
+  linear-release:
+    name: Linear Release
+    if: github.repository == 'BerriAI/litellm'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Plan
+        id: plan
+        env:
+          EVENT: ${{ github.event_name }}
+          REF_NAME: ${{ github.ref_name }}
+          BEFORE: ${{ github.event.before }}
+          CREATED: ${{ github.event.created }}
+          RC_VERSION: ${{ inputs.rc_version }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          set -euo pipefail
+          sync_base="${BEFORE}"
+          if [ "${CREATED}" = "true" ]; then
+            sync_base=""
+          fi
+          if [ -n "${RC_VERSION}" ]; then
+            echo "version=${RC_VERSION}" >> "$GITHUB_OUTPUT"
+            echo "stage=rc" >> "$GITHUB_OUTPUT"
+          elif [ "${EVENT}" = "release" ]; then
+            if [ "${PRERELEASE}" = "true" ] || ! echo "${RELEASE_TAG}" | grep -qE '^v[0-9]+\.[0-9]+\.0$'; then
+              echo "::notice::${RELEASE_TAG} is not an X.Y.0 stable release; nothing to complete"
+              exit 0
+            fi
+            echo "version=${RELEASE_TAG#v}" >> "$GITHUB_OUTPUT"
+            echo "complete=true" >> "$GITHUB_OUTPUT"
+          elif [ "${REF_NAME}" = "main" ]; then
+            version="$(python3 .github/scripts/read_rc_version.py | cut -d= -f2)"
+            status=0
+            git ls-remote --exit-code --heads origin "rc/${version}" > /dev/null || status=$?
+            case "${status}" in
+              0)
+                IFS=. read -r major minor _ <<< "${version}"
+                version="${major}.$((minor + 1)).0"
+                ;;
+              2) ;;
+              *)
+                echo "::error::could not check whether rc/${version} exists (git ls-remote exit ${status})"
+                exit 1
+                ;;
+            esac
+            echo "version=${version}" >> "$GITHUB_OUTPUT"
+            echo "sync_base=${sync_base}" >> "$GITHUB_OUTPUT"
+            echo "main=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "version=${REF_NAME#rc/}" >> "$GITHUB_OUTPUT"
+            echo "sync_base=${sync_base}" >> "$GITHUB_OUTPUT"
+            echo "stage=rc" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Sync commits into the release
+        if: steps.plan.outputs.sync_base != ''
+        uses: linear/linear-release-action@d4af10092984f9bc6d5efa075b242bdf01333463 # v0.18.0
+        with:
+          access_key: ${{ secrets.LINEAR_API_KEY }}
+          command: sync
+          name: LiteLLM ${{ steps.plan.outputs.version }}
+          version: ${{ steps.plan.outputs.version }}
+          base_ref: ${{ steps.plan.outputs.sync_base }}
+          cli_version: v0.18.0
+
+      - name: Keep the main stage unless the rc branch was cut during this run
+        id: main_stage
+        if: steps.plan.outputs.main == 'true'
+        env:
+          VERSION: ${{ steps.plan.outputs.version }}
+        run: |
+          set -euo pipefail
+          status=0
+          git ls-remote --exit-code --heads origin "rc/${VERSION}" > /dev/null || status=$?
+          case "${status}" in
+            0) echo "::notice::rc/${VERSION} was cut during this run; leaving the release in its rc stage" ;;
+            2) echo "stage=main" >> "$GITHUB_OUTPUT" ;;
+            *)
+              echo "::error::could not check whether rc/${VERSION} exists (git ls-remote exit ${status})"
+              exit 1
+              ;;
+          esac
+
+      - name: Move the release to its stage
+        if: steps.plan.outputs.stage != '' || steps.main_stage.outputs.stage != ''
+        uses: linear/linear-release-action@d4af10092984f9bc6d5efa075b242bdf01333463 # v0.18.0
+        with:
+          access_key: ${{ secrets.LINEAR_API_KEY }}
+          command: update
+          stage: ${{ steps.plan.outputs.stage || steps.main_stage.outputs.stage }}
+          version: ${{ steps.plan.outputs.version }}
+          cli_version: v0.18.0
+
+      - name: Complete the release
+        if: steps.plan.outputs.complete == 'true'
+        uses: linear/linear-release-action@d4af10092984f9bc6d5efa075b242bdf01333463 # v0.18.0
+        with:
+          access_key: ${{ secrets.LINEAR_API_KEY }}
+          command: complete
+          version: ${{ steps.plan.outputs.version }}
+          cli_version: v0.18.0
--- a/.github/workflows/mutation-test.yml
+++ b/.github/workflows/mutation-test.yml
@ -44,6 +44,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
+        if: github.ref == 'refs/heads/main'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -53,6 +54,17 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-

+      - name: Cache uv dependencies
+        if: github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
      - name: Cache the Rust build
        uses: ./.github/actions/cache-cargo-build

--- a/.github/workflows/test-code-quality.yml
+++ b/.github/workflows/test-code-quality.yml
@ -44,6 +44,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
+        if: github.ref == 'refs/heads/main'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -53,6 +54,17 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-

+      - name: Cache uv dependencies
+        if: github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
      - name: Cache the Rust build
        uses: ./.github/actions/cache-cargo-build

@ -80,6 +92,13 @@ jobs:
      - name: test_e2e_changed_gate
        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_changed_gate.py tests/code_coverage_tests/test_e2e_idp_stack.py

+      - name: test_e2e_metadata
+        env:
+          PYTHONPATH: tests/e2e
+        run: |
+          export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 16)"
+          uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_e2e_metadata.py tests/code_coverage_tests/test_e2e_junit_report.py
+
      - name: Check merge smoke harness
        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_merge_smoke.py

@ -146,6 +165,15 @@ jobs:
      - name: check_migrations_no_data_rewrites
        run: uv run --no-sync python ./tests/code_coverage_tests/check_migrations_no_data_rewrites.py

+      - name: check_no_publicly_known_master_key
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_no_publicly_known_master_key.py
+
+      - name: test_check_no_publicly_known_master_key
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_check_no_publicly_known_master_key.py
+
+      - name: check_unbounded_in_lists (fails on findings not in the baseline)
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_unbounded_in_lists.py
+
      - name: memory_test
        run: uv run --no-sync python ./tests/code_coverage_tests/memory_test.py

--- a/.github/workflows/test-e2e-changed.yml
+++ b/.github/workflows/test-e2e-changed.yml
@ -1,264 +0,0 @@
-name: e2e-changed-tests
-
-on:
-  pull_request:
-
-concurrency:
-  group: e2e-changed-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  detect:
-    name: Detect changed e2e tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      tests: ${{ steps.changed.outputs.tests }}
-      any: ${{ steps.changed.outputs.any }}
-    steps:
-      - name: Checkout the selector and the canary suite
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          sparse-checkout: |
-            .github/e2e-stack
-            tests/e2e/access_control
-            tests/e2e/management/test_jwt_management_e2e.py
-            tests/e2e/other/test_jwt_auth_e2e.py
-          persist-credentials: false
-          ref: ${{ github.sha }}
-
-      - name: List the e2e test files this PR added or modified
-        id: changed
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          gh api "repos/${REPO}/pulls/${PR_NUMBER}" \
-            --jq 'select(.head.sha == env.HEAD_SHA and .changed_files < 3000) | .head.sha' \
-            | grep -Fxq "${HEAD_SHA}"
-          files="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/files" --paginate \
-            --jq '.[] | select(.status != "removed") | .filename')"
-          gh api "repos/${REPO}/pulls/${PR_NUMBER}" --jq '.head.sha' | grep -Fxq "${HEAD_SHA}"
-          tests="$(printf '%s\n' "${files}" \
-            | python3 .github/e2e-stack/select_tests.py tests/e2e/access_control/test_*.py \
-                tests/e2e/management/test_jwt_management_e2e.py tests/e2e/other/test_jwt_auth_e2e.py)"
-          echo "tests=${tests}" >> "${GITHUB_OUTPUT}"
-          if [ -n "${tests}" ]; then
-            echo "any=true" >> "${GITHUB_OUTPUT}"
-            echo "selected e2e tests: ${tests}"
-          else
-            echo "any=false" >> "${GITHUB_OUTPUT}"
-            echo "no changed e2e test files supported by this stack; nothing to run"
-          fi
-
-  run:
-    name: Run changed e2e tests against the stage-mirror stack
-    needs: detect
-    if: needs.detect.outputs.any == 'true' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    timeout-minutes: 90
-    environment: e2e-changed
-    permissions:
-      contents: read
-      id-token: write
-    services:
-      postgres:
-        image: postgres:16.6
-        env:
-          POSTGRES_USER: litellm
-          POSTGRES_PASSWORD: dbpassword9090
-          POSTGRES_DB: litellm
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U litellm"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-      jaeger:
-        image: jaegertracing/jaeger:2.10.0
-        ports:
-          - 4318:4318
-          - 16686:16686
-    steps:
-      - name: Validate configuration
-        env:
-          ROLE: ${{ vars.E2E_AWS_ROLE_TO_ASSUME }}
-        run: test -n "${ROLE}" || { echo "::error::Set repo variable E2E_AWS_ROLE_TO_ASSUME to an OIDC role with read access to the e2e secrets"; exit 1; }
-
-      - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-          ref: ${{ github.sha }}
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.13"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen \
-            --extra proxy --extra proxy-runtime --extra extra_proxy \
-            --extra semantic-router --extra bedrock-realtime \
-            --group ci --group proxy-dev --group e2e-dev
-          uv pip install "pipecat-ai[openai]==1.4.0"
-
-      - name: Cache Prisma binaries
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        run: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Install Playwright chromium
-        run: uv run --no-sync playwright install --with-deps chromium
-
-      - name: Configure AWS credentials
-        id: aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
-        with:
-          role-to-assume: ${{ vars.E2E_AWS_ROLE_TO_ASSUME }}
-          aws-region: us-east-1
-          role-session-name: litellm-e2e-changed-${{ github.run_id }}
-          role-duration-seconds: 900
-          output-env-credentials: false
-          output-credentials: true
-
-      - name: Fetch provider credentials from AWS Secrets Manager
-        env:
-          AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
-          AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
-          AWS_SESSION_TOKEN: ${{ steps.aws.outputs.aws-session-token }}
-          AWS_DEFAULT_REGION: us-east-1
-        run: |
-          umask 077
-          aws secretsmanager get-secret-value --secret-id litellm-e2e-changed-provider-keys \
-            --query SecretString --output text \
-            | uv run --no-sync python .github/e2e-stack/secrets_to_env.py tests/e2e/.env
-          aws secretsmanager get-secret-value --secret-id litellm-e2e-changed-license \
-            --query SecretString --output text \
-            | jq -R -s '{"LITELLM_LICENSE": .}' \
-            | uv run --no-sync python .github/e2e-stack/secrets_to_env.py tests/e2e/.env
-
-      - name: Boot the stage-mirror stack
-        id: boot
-        run: |
-          umask 077
-          if ! bash .github/e2e-stack/up.sh > "${RUNNER_TEMP}/e2e-boot.log" 2>&1; then
-            echo "::error::stage-mirror stack failed to boot; raw logs are not published"
-            exit 1
-          fi
-
-      - name: Export stack environment
-        run: |
-          master_key="$(grep '^LITELLM_MASTER_KEY=' "${RUNNER_TEMP}/litellm-e2e-stack/stack.env" | cut -d= -f2-)"
-          echo "::add-mask::${master_key}"
-          cat "${RUNNER_TEMP}/litellm-e2e-stack/stack.env" >> "${GITHUB_ENV}"
-
-      - name: Run the selected tests three times
-        env:
-          TESTS: ${{ needs.detect.outputs.tests }}
-          E2E_FIXTURE_MODE: live
-          E2E_PROVIDER_EDGE_HOST_REACHABLE: '1'
-          COLUMNS: '400'
-        run: |
-          umask 077
-          read -r -a test_files <<< "${TESTS}"
-          for pass in 1 2 3; do
-            report="${RUNNER_TEMP}/e2e-pass-${pass}.xml"
-            log="${RUNNER_TEMP}/e2e-pass-${pass}.log"
-            echo "::group::pass ${pass} of 3"
-            set +e
-            uv run --no-sync pytest "${test_files[@]}" --rootdir=. -v --reruns 0 -p no:cacheprovider \
-              -o junit_family=xunit1 --junitxml="${report}" > "${log}" 2>&1
-            status=$?
-            uv run --no-sync python .github/e2e-stack/assert_tests_ran.py "${report}" "${test_files[@]}"
-            verified=$?
-            set -e
-            grep -E '^(FAILED|ERROR) ' "${log}" || true
-            grep -E '^=+ .* in [0-9.]+s( \([0-9:]+\))? =+$' "${log}" | tail -n 1
-            echo "::endgroup::"
-            if [ "${status}" = "5" ]; then
-              echo "::error::the selected files collected no runnable tests, so nothing was verified"
-              exit 1
-            fi
-            if [ "${status}" != "0" ]; then
-              echo "::error::pass ${pass} of 3 failed with exit code ${status}"
-              exit "${status}"
-            fi
-            if [ "${verified}" != "0" ]; then
-              echo "::error::pass ${pass} of 3 did not verify every selected file"
-              exit 1
-            fi
-            echo "pass ${pass} of 3 passed"
-          done
-
-      - name: Redact the pytest output
-        if: always() && steps.boot.outcome == 'success'
-        run: |
-          umask 077
-          shopt -s nullglob
-          uv run --no-sync python .github/e2e-stack/redact_output.py \
-            --values tests/e2e/.env --values "${RUNNER_TEMP}/litellm-e2e-stack/stack.env" \
-            --out "${RUNNER_TEMP}/e2e-redacted" "${RUNNER_TEMP}"/e2e-pass-*.log "${RUNNER_TEMP}"/e2e-pass-*.xml
-
-      - name: Keep the redacted pytest output
-        if: always() && steps.boot.outcome == 'success'
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: e2e-changed-pytest-output-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/e2e-redacted
-          retention-days: 14
-          if-no-files-found: ignore
-
-      - name: Stop the stack
-        if: always() && steps.boot.outcome != 'skipped'
-        run: bash .github/e2e-stack/down.sh
-
-      - name: Remove credentials and raw output
-        if: always()
-        run: |
-          rm -f tests/e2e/.env "${RUNNER_TEMP}/e2e-boot.log" "${RUNNER_TEMP}"/e2e-pass-*.log "${RUNNER_TEMP}"/e2e-pass-*.xml
-          rm -rf "${RUNNER_TEMP}/litellm-e2e-stack" "${RUNNER_TEMP}/e2e-redacted"
-
-  gate:
-    name: e2e-changed-tests
-    needs: [detect, run]
-    if: always()
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Require three successful passes when tests changed
-        env:
-          DETECT_RESULT: ${{ needs.detect.result }}
-          ANY_TESTS: ${{ needs.detect.outputs.any }}
-          RUN_RESULT: ${{ needs.run.result }}
-        run: |
-          if [ "${DETECT_RESULT}" != "success" ]; then
-            echo "::error::changed-test detection did not succeed"
-            exit 1
-          fi
-          if [ "${ANY_TESTS}" = "false" ]; then
-            echo "no changed e2e test files supported by this stack; nothing to run"
-            exit 0
-          fi
-          if [ "${ANY_TESTS}" != "true" ] || [ "${RUN_RESULT}" != "success" ]; then
-            echo "::error::selected e2e tests require an approved, successful run; fork PRs must run from a reviewed same-repository branch"
-            exit 1
-          fi
--- a/.github/workflows/test-litellm-ui-unit.yml
+++ b/.github/workflows/test-litellm-ui-unit.yml
@ -49,6 +49,10 @@ jobs:
        if: steps.changes.outputs.decision != 'skip'
        run: npm ci

+      - name: Check UI production source types
+        if: steps.changes.outputs.decision != 'skip'
+        run: npm run typecheck
+
      - name: Run UI type tests (Vitest)
        if: steps.changes.outputs.decision != 'skip'
        env:
--- a/.github/workflows/test-mcp-dependency-resolution.yml
+++ b/.github/workflows/test-mcp-dependency-resolution.yml
@ -5,6 +5,27 @@ on:
    branches:
      - main
      - "litellm_**"
+    paths:
+      - "**/pyproject.toml"
+      - "uv.lock"
+      - "uv.toml"
+      - ".python-version"
+      - "rust-toolchain.toml"
+      - "litellm-rust/**"
+      - "litellm/__init__.py"
+      - "litellm/proxy/proxy_server.py"
+      - "litellm/**/*mcp*"
+      - "litellm/**/*mcp*/**"
+      - "litellm/integrations/arize/**"
+      - "scripts/check_mcp_sdk_install.py"
+      - "tests/base_sdk_tests/**"
+      - ".github/workflows/test-mcp-dependency-resolution.yml"
+      - ".github/actions/detect-changes/**"
+      - ".github/actions/setup-uv-with-retries/**"
+      - ".github/actions/cache-cargo-build/**"
+      - ".github/scripts/detect_changes.sh"
+      - ".github/scripts/uv_sync_with_retries.sh"
+      - ".circleci/scripts/classify_changes.sh"

 permissions:
  contents: read
@ -17,7 +38,7 @@ concurrency:
 jobs:
  resolve:
    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
--- a/.github/workflows/test-postgres.yml
+++ b/.github/workflows/test-postgres.yml
@ -1,142 +0,0 @@
-name: "Postgres Tests"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  postgres:
-    name: ${{ matrix.shard }}
-    runs-on: ubuntu-latest
-    timeout-minutes: ${{ matrix.job-timeout-minutes }}
-    permissions:
-      contents: read
-
-    services:
-      postgres:
-        image: postgres:16@sha256:e17e86066e5ef83e0952a9347f5c792b7ece00972e2aa787a6986f471b3dd3d5
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: litellm_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 10
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - shard: proxy-behavior
-            test-path: "tests/proxy_behavior"
-            seed: db-push
-            workers: 0
-            timeout-minutes: 25
-            job-timeout-minutes: 50
-
-          - shard: proxy-security
-            test-path: "tests/proxy_security_tests"
-            seed: db-push
-            workers: 0
-            timeout-minutes: 15
-            job-timeout-minutes: 40
-
-          - shard: schema-migration
-            test-path: "tests/proxy_migration_tests"
-            seed: none
-            workers: 0
-            timeout-minutes: 20
-            job-timeout-minutes: 45
-
-    env:
-      DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/litellm_test"
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        timeout-minutes: 3
-        with:
-          persist-credentials: false
-
-      - name: Detect relevant changes
-        id: changes
-        timeout-minutes: 2
-        uses: ./.github/actions/detect-changes
-
-      - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-postgres-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-postgres-
-
-      - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 12
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --all-groups --all-extras
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Seed database schema
-        if: steps.changes.outputs.decision != 'skip' && matrix.seed != 'none'
-        timeout-minutes: 10
-        run: |
-          uv run --no-sync prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
-
-      - name: Run tests
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: ${{ matrix.timeout-minutes }}
-        env:
-          TEST_PATH: ${{ matrix.test-path }}
-          WORKERS: ${{ matrix.workers }}
-        run: |
-          if [ "${WORKERS}" = "0" ]; then
-            uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10
-          else
-            uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10 -n "${WORKERS}"
-          fi
--- a/.github/workflows/test-redis-compat.yml
+++ b/.github/workflows/test-redis-compat.yml
@ -1,106 +0,0 @@
-name: "Unit Tests: Redis Client Version Compatibility"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-    paths:
-      - "litellm/_redis.py"
-      - "litellm/_redis_credential_provider.py"
-      - "litellm/caching/redis_cache.py"
-      - "litellm/caching/evicted_client_closer.py"
-      - "tests/unit/test_redis.py"
-      - "tests/local_testing/test_caching.py"
-      - "tests/unit/caching/test_redis_connection_pool.py"
-      - "tests/unit/caching/test_redis_cluster_cache.py"
-      - "tests/unit/caching/test_evicted_client_closer.py"
-      - ".github/workflows/test-redis-compat.yml"
-      - "pyproject.toml"
-      - "uv.lock"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  redis-compat:
-    name: "redis-py ${{ matrix.redis-version }}"
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      id-token: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        # 5.3.1 is the version pinned in uv.lock (redisvl caps it below 6); the
-        # newer legs prove the inspect.signature introspection in litellm/_redis.py
-        # keeps extracting kwargs on the redis-py releases people actually run now.
-        # Only the exact release 6.0.0 is skipped: rq (pulled by the proxy extra)
-        # specifies `redis != 6`, which excludes 6.0.0 alone, so 6.4.0 stands in
-        # for the 6.x line.
-        redis-version: ["5.3.1", "6.4.0", "7.4.1", "8.0.1"]
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Install dependencies
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra extra_proxy --extra semantic-router
-
-      - name: Pin redis-py to the matrix version
-        env:
-          REDIS_VERSION: ${{ matrix.redis-version }}
-        run: |
-          uv pip install "redis==${REDIS_VERSION:?}"
-          uv run --no-sync python -c "import redis; assert redis.__version__ == '${REDIS_VERSION:?}', redis.__version__; print('redis-py', redis.__version__)"
-
-      - name: Build Redis for cluster authentication tests
-        run: |
-          curl --fail --location --retry 3 https://download.redis.io/releases/redis-7.2.16.tar.gz -o "$RUNNER_TEMP/redis-7.2.16.tar.gz"
-          echo "960a8ec15e34ff40e57ff16837b26b33bd81f2da6d24497bb63de532a323a18e  $RUNNER_TEMP/redis-7.2.16.tar.gz" | sha256sum --check
-          tar -xzf "$RUNNER_TEMP/redis-7.2.16.tar.gz" -C "$RUNNER_TEMP"
-          make -C "$RUNNER_TEMP/redis-7.2.16" -j2 MALLOC=libc OPTIMIZATION=-O1 redis-server
-          echo "$RUNNER_TEMP/redis-7.2.16/src" >> "$GITHUB_PATH"
-
-      - name: Run redis unit tests
-        run: |
-          redis-server --version
-          uv run --no-sync pytest \
-            tests/unit/test_redis.py \
-            tests/unit/caching/test_redis_connection_pool.py \
-            tests/unit/caching/test_redis_cluster_cache.py \
-            tests/unit/caching/test_evicted_client_closer.py \
-            tests/local_testing/test_caching.py::test_sync_cluster_authenticates_with_azure_credentials \
-            tests/local_testing/test_caching.py::test_sync_cluster_authenticates_with_gcp_credentials \
-            --tb=short -vv \
-            --reruns 2 \
-            --reruns-delay 1 \
-            --durations=20 \
-            --cov=./litellm --cov-report=xml:coverage-redis.xml
-
-      - name: Upload Redis coverage
-        if: matrix.redis-version == '5.3.1'
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
-        with:
-          use_oidc: true
-          files: coverage-redis.xml
-          flags: redis-compat
-          fail_ci_if_error: false
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@ -5,6 +5,8 @@ on:
    paths:
      - "litellm-rust/**"
      - "litellm/rust_bridge/**"
+      - "scripts/generate_trace_types.py"
+      - "scripts/trace_codegen/**"
      - "tests/test_litellm_rust/**"
      - "litellm/integrations/custom_logger.py"
      - "litellm/litellm_core_utils/litellm_logging.py"
@ -32,6 +34,8 @@ on:
    paths:
      - "litellm-rust/**"
      - "litellm/rust_bridge/**"
+      - "scripts/generate_trace_types.py"
+      - "scripts/trace_codegen/**"
      - "tests/test_litellm_rust/**"
      - "litellm/integrations/custom_logger.py"
      - "litellm/litellm_core_utils/litellm_logging.py"
@ -83,12 +87,13 @@ jobs:
        with:
          workspaces: litellm-rust
          cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/main' }}

-      - run: cargo clippy --workspace --all-targets --locked -- -D warnings
+      - run: cargo clippy --workspace --all-targets --locked --features litellm-traces/schema,litellm-traces-clickhouse/schema -- -D warnings

  rust-test:
    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
    defaults:
      run:
        working-directory: litellm-rust
@ -121,8 +126,13 @@ jobs:
        with:
          workspaces: litellm-rust
          cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/main' }}

-      - run: cargo nextest run --workspace --locked
+      - name: Check generated trace contracts
+        working-directory: .
+        run: uv run scripts/generate_trace_types.py --check
+
+      - run: cargo nextest run --workspace --locked --features litellm-traces/schema,litellm-traces-clickhouse/schema

      - run: cargo test --workspace --doc --locked

@ -162,6 +172,7 @@ jobs:
        with:
          workspaces: litellm-rust
          cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/main' }}

      - run: uv build --wheel --out-dir dist

--- a/.github/workflows/test-terraform-provider.yml
+++ b/.github/workflows/test-terraform-provider.yml
@ -77,6 +77,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
+        if: github.ref == 'refs/heads/main'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -86,6 +87,17 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-

+      - name: Cache uv dependencies
+        if: github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
      - name: Cache the Rust build
        uses: ./.github/actions/cache-cargo-build

--- a/.github/workflows/test-unit-documentation.yml
+++ b/.github/workflows/test-unit-documentation.yml
@ -54,7 +54,7 @@ jobs:
          version: "0.10.9"

      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
+        if: steps.changes.outputs.decision != 'skip' && github.ref == 'refs/heads/main'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -64,6 +64,17 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-uv-

+      - name: Cache uv dependencies
+        if: steps.changes.outputs.decision != 'skip' && github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
      - name: Cache the Rust build
        if: steps.changes.outputs.decision != 'skip'
        uses: ./.github/actions/cache-cargo-build
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@ -20,13 +20,6 @@ concurrency:
 # rather than alphabetical letter ranges. Adding a new test file means adding it
 # to whichever group it belongs to, not reshuffling slices.
 #
-# `.circleci/tests.yml` runs each group's files on same-repo events under the
-# `proxy-db-<group>` Codecov flag; `.circleci/scripts/unit_selection.sh` holds
-# the file lists. That pipeline is manual-only while the tests migrate, so
-# `unit-flag` makes the shard run that list on every event. `test-path` keeps
-# the files that still reach real providers and never left
-# tests/proxy_unit_tests.
-#
 # Design targets:
 #   * Every shard runs in <= 7 minutes of wall-clock on the default runner.
 #     Most of a shard's time is pytest plugin load + xdist worker imports +
@ -46,6 +39,21 @@ concurrency:
 #     pinning the whole file to one worker (the default --dist=loadscope
 #     behavior for single-file targets).
 jobs:
+  lens-python-310:
+    name: Lens Python 3.10
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      python-version: "3.10"
+      test-path: tests/unit/proxy/lens/test_inference.py
+      workers: 0
+      reruns: 0
+      timeout-minutes: 5
+      artifact-name: lens-python-310
+
  # Fast guard — fails the workflow when a test directory or file inside a sharded
  # tree is claimed by no shard. The semantic-shard design has no catch-all bucket,
  # so an unassigned child runs nowhere; assert_ci_coverage.py holds the tree list
@ -78,93 +86,136 @@ jobs:
        include:
          # Must run serially — event-loop conflict with the logging worker.
          - test-group: key-generation
-            test-path: ""
-            unit-flag: proxy-db-key-generation
+            test-path: >-
+              tests/unit/proxy/management_endpoints/test_key_generate_prisma.py
            workers: 0
            dist: loadscope
            timeout: 20

          # ---- auth: split into 2 shards ----
          - test-group: auth-checks
-            test-path: ""
-            unit-flag: proxy-db-auth-checks
+            test-path: >-
+              tests/unit/proxy/auth/test_auth_checks.py
+              tests/unit/proxy/auth/test_user_api_key_auth.py
+              tests/unit/proxy/test_credential_slot_registry.py
+              tests/unit/proxy/test_deprecated_key_grace_period.py
            workers: 4
            dist: loadscope
            timeout: 15
          - test-group: jwt-and-keys
-            test-path: ""
-            unit-flag: proxy-db-jwt-and-keys
+            test-path: >-
+              tests/unit/proxy/auth/test_jwt.py
+              tests/unit/proxy/management_endpoints/test_jwt_key_mapping.py
+              tests/unit/proxy/test_proxy_custom_auth.py
            workers: 4
            dist: loadscope
            timeout: 15

          # ---- test_proxy_utils.py, single shard, worksteal distribution ----
          - test-group: proxy-utils
-            test-path: ""
-            unit-flag: proxy-db-proxy-utils
+            test-path: >-
+              tests/unit/proxy/test_proxy_utils.py
            workers: 4
            dist: worksteal
            timeout: 15

          # ---- proxy server: split into 2 shards ----
          - test-group: proxy-server-core
-            test-path: "tests/proxy_unit_tests/test_proxy_server_gemini_pass_through.py"
-            unit-flag: proxy-db-proxy-server-core
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_server_gemini_pass_through.py
+              tests/unit/proxy/test__lazy_features.py
+              tests/unit/proxy/test_aproxy_startup.py
+              tests/unit/proxy/test_proxy_server.py
            workers: 4
            dist: loadscope
            timeout: 15
          - test-group: proxy-runtime
-            test-path: ""
-            unit-flag: proxy-db-proxy-runtime
+            test-path: >-
+              tests/unit/proxy/auth/test_multipart_bypass_repro.py
+              tests/unit/proxy/auth/test_proxy_routes.py
+              tests/unit/proxy/middleware/test_request_size_limit_middleware.py
+              tests/unit/proxy/test_proxy_config_unit_test.py
+              tests/unit/proxy/test_proxy_token_counter.py
+              tests/unit/proxy/test_server_root_path.py
            workers: 4
            dist: loadscope
            timeout: 15

          # ---- logging: split into 2 shards ----
          - test-group: custom-logging
-            test-path: "tests/proxy_unit_tests/test_proxy_custom_logger.py"
-            unit-flag: proxy-db-custom-logging
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_custom_logger.py
+              tests/unit/proxy/test_custom_callback_input.py
+              tests/unit/proxy/test_custom_logger_s3_gcs.py
            workers: 4
            dist: loadscope
            timeout: 15
          - test-group: logging-misc
-            test-path: ""
-            unit-flag: proxy-db-logging-misc
+            test-path: >-
+              tests/unit/proxy/management_helpers/test_audit_logs_proxy.py
+              tests/unit/proxy/spend_tracking/test_search_api_logging.py
+              tests/unit/proxy/test_proxy_reject_logging.py
            workers: 4
            dist: loadscope
            timeout: 15

          - test-group: db-and-spend
-            test-path: ""
-            unit-flag: proxy-db-db-and-spend
+            test-path: >-
+              tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py
+              tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py
+              tests/unit/proxy/db/test_update_daily_tag_spend.py
+              tests/unit/proxy/test_db_schema_changes.py
+              tests/unit/proxy/test_prisma_client_backoff_retry.py
+              tests/unit/proxy/test_update_spend.py
+              tests/unit/skills/test_skills_db.py
            workers: 4
            dist: loadscope
            timeout: 15

          # ---- guardrails + budget + hooks: split into 2 ----
          - test-group: guardrails-hooks
-            test-path: ""
-            unit-flag: proxy-db-guardrails-hooks
+            test-path: >-
+              tests/unit/proxy/hooks/test_banned_keyword_list.py
+              tests/unit/proxy/test_proxy_setting_guardrails.py
+              tests/unit/proxy/test_unit_test_proxy_hooks.py
            workers: 4
            dist: loadscope
            timeout: 15
          - test-group: budgets
-            test-path: ""
-            unit-flag: proxy-db-budgets
+            test-path: >-
+              tests/unit/proxy/auth/test_default_end_user_budget_simple.py
+              tests/unit/proxy/hooks/test_unit_test_max_model_budget_limiter.py
+              tests/unit/proxy/test_zero_cost_model_budget_bypass.py
            workers: 4
            dist: loadscope
            timeout: 15

          - test-group: endpoints-and-responses
-            test-path: "tests/proxy_unit_tests/test_proxy_exception_mapping.py"
-            unit-flag: proxy-db-endpoints-and-responses
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_exception_mapping.py
+              tests/unit/proxy/lens
+              tests/unit/proxy/auth/test_models_fallback_endpoint.py
+              tests/unit/proxy/common_utils/test_check_batch_cost.py
+              tests/unit/proxy/common_utils/test_check_responses_cost.py
+              tests/unit/proxy/common_utils/test_realtime_cache.py
+              tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py
+              tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py
+              tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py
+              tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py
+              tests/unit/proxy/response_polling
+              tests/unit/proxy/test_custom_tokenizer_bug.py
+              tests/unit/proxy/test_get_favicon.py
+              tests/unit/proxy/test_get_image.py
+              tests/unit/proxy/test_prompt_test_endpoint.py
+              tests/unit/proxy/test_reducto_ocr_route.py
+              tests/unit/proxy/test_response_polling_pre_call_checks.py
+              tests/unit/proxy/test_ui_path_detection.py
            workers: 4
            dist: loadscope
            timeout: 15
    uses: ./.github/workflows/_test-unit-base.yml
    with:
      test-path: ${{ matrix.test-path }}
-      unit-flag: ${{ matrix.unit-flag }}
      workers: ${{ matrix.workers }}
      reruns: 2
      timeout-minutes: ${{ matrix.timeout }}
--- a/.github/workflows/test-unit.yml
+++ b/.github/workflows/test-unit.yml
@ -21,10 +21,8 @@ concurrency:
 # files that each wrapped a single call to _test-unit-base.yml. Adding a shard is
 # now one matrix entry rather than a new file.
 #
-# `name` is the shard id and nothing else, so each check reports as
-# "<shard> / Run tests" exactly as it did when the shard had its own file. Those
-# strings are the branch ruleset's required contexts, so they are load-bearing:
-# renaming an entry renames a required check and the ruleset stops matching it.
+# `name` is the shard id, and each check reports as "<shard> / Run tests".
+# Unit shard names are not required ruleset contexts, so matrix entries can be split freely.
 #
 # Every entry states its timeouts even when they equal the base workflow's
 # defaults. An absent matrix key renders as an empty string, which is not a
@ -35,13 +33,102 @@ concurrency:
 # a matrix and carries a shard-coverage guard that reads that file by name.
 # Folding it in here is a follow-up, together with generalising that guard into
 # assert_ci_coverage.py.
-#
-# `unit-flag` names the `.circleci/tests.yml` job that now runs part of the
-# shard under the same Codecov flag. That pipeline is manual-only while the
-# tests migrate, so the shard also runs those files on every event.
 jobs:
+  rust-bridge:
+    name: Build the Rust bridge
+    outputs:
+      artifact: ${{ steps.rust-bridge-artifact.outputs.name }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    env:
+      UV_PYTHON: "3.12"
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+        with:
+          persist-credentials: false
+
+      - name: Detect relevant changes
+        id: changes
+        timeout-minutes: 2
+        uses: ./.github/actions/detect-changes
+
+      - name: Define editable Rust bridge cache key
+        id: rust-bridge-key
+        if: steps.changes.outputs.decision != 'skip'
+        env:
+          RUST_BRIDGE_CACHE_KEY: ${{ runner.os }}-rust-bridge-editable-${{ hashFiles('litellm-rust/Cargo.lock', 'litellm-rust/Cargo.toml', 'litellm-rust/crates/**', 'pyproject.toml') }}
+        run: echo "key=$RUST_BRIDGE_CACHE_KEY" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Python
+        if: steps.changes.outputs.decision != 'skip'
+        timeout-minutes: 3
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: ${{ env.UV_PYTHON }}
+
+      - name: Set up uv
+        if: steps.changes.outputs.decision != 'skip'
+        timeout-minutes: 3
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Restore editable Rust bridge
+        id: rust-bridge-cache
+        if: steps.changes.outputs.decision != 'skip'
+        timeout-minutes: 5
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830
+        with:
+          path: rust-bridge-dist
+          key: ${{ steps.rust-bridge-key.outputs.key }}
+
+      - name: Cache the Rust build
+        if: steps.changes.outputs.decision != 'skip' && steps.rust-bridge-cache.outputs.cache-hit != 'true'
+        timeout-minutes: 5
+        uses: ./.github/actions/cache-cargo-build
+
+      - name: Build editable Rust bridge
+        if: steps.changes.outputs.decision != 'skip' && steps.rust-bridge-cache.outputs.cache-hit != 'true'
+        timeout-minutes: 15
+        run: |
+          mkdir -p rust-bridge-dist
+          uv run --no-project --with maturin==1.15.0 python -c 'import maturin; maturin.build_editable("rust-bridge-dist")'
+          strip --strip-debug litellm/rust_bridge/_native.abi3.so
+          mkdir -p rust-bridge-dist/litellm/rust_bridge
+          cp litellm/rust_bridge/_native.abi3.so rust-bridge-dist/litellm/rust_bridge/_native.abi3.so
+
+      - name: Upload Rust bridge artifact
+        if: steps.changes.outputs.decision != 'skip'
+        timeout-minutes: 10
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
+        with:
+          name: rust-bridge-${{ github.run_id }}-${{ github.run_attempt }}
+          path: rust-bridge-dist/
+          retention-days: 1
+
+      - name: Save editable Rust bridge
+        if: steps.changes.outputs.decision != 'skip' && github.ref == 'refs/heads/main' && steps.rust-bridge-cache.outputs.cache-hit != 'true'
+        timeout-minutes: 10
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830
+        with:
+          path: rust-bridge-dist
+          key: ${{ steps.rust-bridge-key.outputs.key }}
+
+      - name: Expose the Rust bridge artifact
+        id: rust-bridge-artifact
+        if: steps.changes.outputs.decision != 'skip'
+        timeout-minutes: 1
+        env:
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: echo "name=rust-bridge-${RUN_ID}-${RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
+
  unit:
    name: ${{ matrix.shard }}
+    needs: rust-bridge
+    if: ${{ !cancelled() }}
    permissions:
      contents: read
      id-token: write
@ -50,57 +137,79 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - shard: mcp-integration
-            artifact-name: mcp-integration
-            test-path: "tests/mcp_tests"
-            unit-flag: mcp-integration
-            workers: 2
-            reruns: 0
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
          - shard: core-utils
            artifact-name: core-utils
-            test-path: ""
-            unit-flag: core-utils
-            workers: 2
-            reruns: 1
+            test-path: >-
+              tests/unit/decisions
+              tests/unit/litellm_core_utils
+            workers: 4
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: enterprise-routing
            artifact-name: enterprise-routing
-            test-path: ""
-            unit-flag: enterprise-routing
-            workers: 2
+            test-path: >-
+              tests/unit/google_genai
+              tests/unit/router_strategy
+              tests/unit/router_utils
+              tests/unit/proxy/common_utils/test_cache_aware_routing.py
+              tests/unit/enterprise/enterprise_callbacks/send_emails
+              tests/unit/enterprise/proxy/test_afile_retrieve_returns_unified_id.py
+              tests/unit/enterprise/proxy/test_batch_retrieve_input_file_id.py
+              tests/unit/enterprise/proxy/test_batch_retrieve_registers_missing_output_file_id.py
+              tests/unit/enterprise/proxy/test_batch_retrieve_returns_unified_input_file_id.py
+              tests/unit/enterprise/proxy/test_batch_update_db_managed_output_file_id.py
+              tests/unit/enterprise/proxy/test_deleted_file_returns_403_not_404.py
+              tests/unit/enterprise/proxy/test_enterprise_routes.py
+              tests/unit/enterprise/proxy/test_file_deletion_blocking.py
+              tests/unit/enterprise/proxy/test_managed_files_access_check.py
+              tests/unit/enterprise/proxy/test_managed_files_hook.py
+            workers: 4
            reruns: 2
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: integrations
            artifact-name: integrations
-            test-path: ""
-            unit-flag: integrations
-            workers: 2
-            reruns: 3
+            test-path: >-
+              tests/test_litellm/integrations
+              tests/test_litellm/tracing
+              tests/unit/integrations
+            workers: 4
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: Vertex AI
            artifact-name: llm-vertex-ai
-            test-path: ""
-            unit-flag: llm-vertex-ai
-            workers: 1
-            reruns: 2
+            test-path: >-
+              tests/unit/llms/vertex_ai
+            workers: 4
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: All Other Providers
            artifact-name: llm-other-providers
-            test-path: ""
-            unit-flag: llm-other-providers
-            workers: 2
-            reruns: 2
+            test-path: >-
+              tests/unit/llms
+              --ignore=tests/unit/llms/vertex_ai
+              --ignore=tests/unit/llms/openai
+              --ignore=tests/unit/llms/meta
+              --ignore=tests/unit/llms/base_llm/batches/base_batches_config_test.py
+            workers: 4
+            reruns: 0
+            timeout-minutes: 20
+            job-timeout-minutes: 60
+
+          - shard: OpenAI and Meta Providers
+            artifact-name: llm-openai-meta
+            test-path: >-
+              tests/unit/llms/openai
+              tests/unit/llms/meta
+            workers: 4
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

@ -108,134 +217,283 @@ jobs:
            artifact-name: misc
            test-path: >-
              tests/test_litellm/test_*.py
-            unit-flag: misc
-            workers: 2
+              tests/unit/test_*.py
+            workers: 4
            reruns: 2
            timeout-minutes: 20
            job-timeout-minutes: 60

+          - shard: misc-dirs
+            artifact-name: misc-dirs
+            test-path: >-
+              tests/unit/test_router
+              tests/unit/a2a_protocol
+              tests/unit/batches
+              tests/unit/chat_completions
+              tests/unit/completion_extras
+              tests/unit/containers
+              tests/unit/embeddings
+              tests/unit/endpoints
+              tests/unit/files
+              tests/unit/harness
+              tests/unit/images
+              tests/unit/interactions
+              tests/unit/messages
+              tests/unit/rag
+              tests/unit/rerank_api
+              tests/unit/rust_bridge
+              tests/unit/secret_managers
+              tests/unit/vector_stores
+              tests/unit/videos
+              --ignore=tests/unit/rust_bridge/native_route_wheel_test.py
+            workers: 4
+            reruns: 0
+            timeout-minutes: 20
+            job-timeout-minutes: 60
+
          - shard: proxy-auth
            artifact-name: proxy-auth
            test-path: >-
-              tests/test_litellm/proxy/auth
-              tests/test_litellm/proxy/hooks
-              tests/test_litellm/proxy/policy_engine
-              tests/test_litellm/proxy/client
-            workers: 2
-            reruns: 2
+              tests/unit/proxy/auth
+              --ignore=tests/unit/proxy/auth/test_auth_checks.py
+              --ignore=tests/unit/proxy/auth/test_user_api_key_auth.py
+              --ignore=tests/unit/proxy/auth/test_default_end_user_budget_simple.py
+              --ignore=tests/unit/proxy/auth/test_jwt.py
+              --ignore=tests/unit/proxy/auth/test_models_fallback_endpoint.py
+              --ignore=tests/unit/proxy/auth/test_multipart_bypass_repro.py
+              --ignore=tests/unit/proxy/auth/test_proxy_routes.py
+            workers: 4
+            reruns: 0
+            timeout-minutes: 20
+            job-timeout-minutes: 60
+
+          - shard: proxy-hooks-client
+            artifact-name: proxy-hooks-client
+            test-path: >-
+              tests/unit/proxy/hooks
+              tests/unit/proxy/policy_engine
+              tests/unit/proxy/client
+              --ignore=tests/unit/proxy/hooks/test_banned_keyword_list.py
+              --ignore=tests/unit/proxy/hooks/test_unit_test_max_model_budget_limiter.py
+            workers: 4
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: proxy-endpoints
            artifact-name: proxy-endpoints
            test-path: >-
-              tests/test_litellm/proxy/analytics_endpoints
-              tests/test_litellm/proxy/management_endpoints
-              tests/test_litellm/proxy/list_api
-              tests/test_litellm/proxy/memory
-              tests/test_litellm/proxy/guardrails
-              tests/test_litellm/proxy/management_helpers
-              tests/test_litellm/proxy/anthropic_endpoints
-              tests/test_litellm/proxy/google_endpoints
-              tests/test_litellm/proxy/openai_files_endpoint
-              tests/test_litellm/proxy/batches_endpoints
-              tests/test_litellm/proxy/container_endpoints
-              tests/test_litellm/proxy/fine_tuning_endpoints
-              tests/test_litellm/proxy/vector_store_files_endpoints
-              tests/test_litellm/proxy/video_endpoints
-              tests/test_litellm/proxy/response_api_endpoints
-              tests/test_litellm/proxy/image_endpoints
-              tests/test_litellm/proxy/ocr_endpoints
-              tests/test_litellm/proxy/vector_store_endpoints
-              tests/test_litellm/proxy/agent_endpoints
-              tests/test_litellm/proxy/a2a
-              tests/test_litellm/proxy/credential_endpoints
-              tests/test_litellm/proxy/discovery_endpoints
-              tests/test_litellm/proxy/health_endpoints
-              tests/test_litellm/proxy/shutdown
-              tests/test_litellm/proxy/public_endpoints
-              tests/test_litellm/proxy/prompts
-              tests/test_litellm/proxy/rag_endpoints
-              tests/test_litellm/proxy/rerank_endpoints
-              tests/test_litellm/proxy/realtime_endpoints
-              tests/test_litellm/proxy/ui_crud_endpoints
-              tests/test_litellm/proxy/config_resolvers
-              tests/test_litellm/proxy/utils
+              tests/unit/proxy/management_endpoints
+              tests/unit/proxy/management_helpers
+              tests/unit/proxy/list_api
+              tests/unit/proxy/analytics_endpoints
+              tests/unit/proxy/decisions_endpoints
+              tests/unit/proxy/memory
+              tests/unit/proxy/agent_endpoints
+              tests/unit/proxy/openai_files_endpoint
+              tests/unit/proxy/health_endpoints
+              tests/unit/proxy/batches_endpoints
+              --ignore=tests/unit/proxy/management_endpoints/test_jwt_key_mapping.py
+              --ignore=tests/unit/proxy/management_endpoints/test_key_generate_prisma.py
+              --ignore=tests/unit/proxy/management_endpoints/test_roi_calculator_endpoints.py
+              --ignore=tests/unit/proxy/management_helpers/test_audit_logs_proxy.py
            workers: 4
-            reruns: 2
+            reruns: 0
+            timeout-minutes: 20
+            job-timeout-minutes: 60
+
+          - shard: proxy-feature-endpoints
+            artifact-name: proxy-feature-endpoints
+            test-path: >-
+              tests/unit/proxy/guardrails
+              --ignore=tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py
+              --ignore=tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py
+              --ignore=tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py
+              --ignore=tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py
+              tests/unit/proxy/anthropic_endpoints
+              tests/unit/proxy/google_endpoints
+              tests/unit/proxy/container_endpoints
+              tests/unit/proxy/fine_tuning_endpoints
+              tests/unit/proxy/vector_store_files_endpoints
+              tests/unit/proxy/video_endpoints
+              tests/unit/proxy/response_api_endpoints
+              tests/unit/proxy/image_endpoints
+              tests/unit/proxy/ocr_endpoints
+              tests/unit/proxy/search_endpoints
+              tests/unit/proxy/vector_store_endpoints
+              tests/unit/proxy/a2a
+              tests/unit/proxy/credential_endpoints
+              tests/unit/proxy/discovery_endpoints
+              tests/unit/proxy/shutdown
+              tests/unit/proxy/public_endpoints
+              tests/unit/proxy/prompts
+              tests/unit/proxy/rag_endpoints
+              tests/unit/proxy/rerank_endpoints
+              tests/unit/proxy/realtime_endpoints
+              tests/unit/proxy/ui_crud_endpoints
+              tests/unit/proxy/config_resolvers
+              tests/unit/proxy/utils
+            workers: 4
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: proxy-server
            artifact-name: proxy-server
-            test-path: "tests/test_litellm/proxy/proxy_server"
+            test-path: "tests/unit/proxy/proxy_server"
            workers: 4
-            reruns: 2
+            reruns: 0
            timeout-minutes: 60
            job-timeout-minutes: 100

          - shard: proxy-infra
            artifact-name: proxy-infra
            test-path: >-
-              tests/test_litellm/proxy/db
-              tests/test_litellm/proxy/middleware
-              tests/test_litellm/proxy/spend_tracking
-              tests/test_litellm/proxy/pass_through_endpoints
-              tests/test_litellm/proxy/_experimental
-              tests/test_litellm/proxy/experimental
-              tests/test_litellm/proxy/common_utils
-              tests/test_litellm/proxy/enterprise_billing
-              tests/test_litellm/proxy/types_utils
-              tests/test_litellm/proxy/logging_endpoints
-              tests/test_litellm/proxy/test_*.py
-            unit-flag: proxy-infra
+              tests/unit/proxy/db
+              --ignore=tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py
+              --ignore=tests/unit/proxy/db/test_update_daily_tag_spend.py
+              tests/unit/proxy/middleware
+              --ignore=tests/unit/proxy/middleware/test_request_size_limit_middleware.py
+              tests/unit/proxy/spend_tracking
+              --ignore=tests/unit/proxy/spend_tracking/test_search_api_logging.py
+              tests/unit/proxy/pass_through_endpoints
+              tests/unit/proxy/_experimental
+              --ignore=tests/unit/proxy/_experimental/mcp_server
+              tests/unit/proxy/experimental
+              tests/unit/proxy/common_utils
+              --ignore=tests/unit/proxy/common_utils/test_cache_aware_routing.py
+              --ignore=tests/unit/proxy/common_utils/test_check_batch_cost.py
+              --ignore=tests/unit/proxy/common_utils/test_check_responses_cost.py
+              --ignore=tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py
+              --ignore=tests/unit/proxy/common_utils/test_realtime_cache.py
+              tests/unit/proxy/enterprise_billing
+              tests/unit/proxy/types_utils
+              tests/unit/proxy/logging_endpoints
+              tests/unit/gateway
+              tests/unit/proxy/management
+              tests/unit/proxy/management_endpoints/test_roi_calculator_endpoints.py
+              tests/unit/proxy/roi_calculator
            workers: 4
-            reruns: 2
+            reruns: 0
+            timeout-minutes: 20
+            job-timeout-minutes: 60
+
+          - shard: proxy-infra-root
+            artifact-name: proxy-infra-root
+            test-path: >-
+              tests/unit/proxy/test_*.py
+              --ignore=tests/unit/proxy/test_aproxy_startup.py
+              --ignore=tests/unit/proxy/test_credential_slot_registry.py
+              --ignore=tests/unit/proxy/test_custom_callback_input.py
+              --ignore=tests/unit/proxy/test_custom_logger_s3_gcs.py
+              --ignore=tests/unit/proxy/test_custom_tokenizer_bug.py
+              --ignore=tests/unit/proxy/test_db_schema_changes.py
+              --ignore=tests/unit/proxy/test_deprecated_key_grace_period.py
+              --ignore=tests/unit/proxy/test_get_favicon.py
+              --ignore=tests/unit/proxy/test_get_image.py
+              --ignore=tests/unit/proxy/test_prisma_client_backoff_retry.py
+              --ignore=tests/unit/proxy/test_prompt_test_endpoint.py
+              --ignore=tests/unit/proxy/test_proxy_config_unit_test.py
+              --ignore=tests/unit/proxy/test_proxy_custom_auth.py
+              --ignore=tests/unit/proxy/test_proxy_reject_logging.py
+              --ignore=tests/unit/proxy/test_proxy_server.py
+              --ignore=tests/unit/proxy/test_proxy_setting_guardrails.py
+              --ignore=tests/unit/proxy/test_proxy_token_counter.py
+              --ignore=tests/unit/proxy/test_proxy_utils.py
+              --ignore=tests/unit/proxy/test_reducto_ocr_route.py
+              --ignore=tests/unit/proxy/test_response_polling_pre_call_checks.py
+              --ignore=tests/unit/proxy/test_server_root_path.py
+              --ignore=tests/unit/proxy/test_ui_path_detection.py
+              --ignore=tests/unit/proxy/test_unit_test_proxy_hooks.py
+              --ignore=tests/unit/proxy/test_update_spend.py
+              --ignore=tests/unit/proxy/test_zero_cost_model_budget_bypass.py
+            workers: 4
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: caching-local
            artifact-name: caching-local
-            test-path: ""
-            unit-flag: caching-local
+            test-path: >-
+              tests/unit/caching
            workers: 2
-            reruns: 2
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: proxy-extras
            artifact-name: proxy-extras
-            test-path: ""
-            unit-flag: proxy-extras
+            test-path: >-
+              tests/unit/litellm_proxy_extras
            workers: 2
-            reruns: 2
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

          - shard: enterprise-package
            artifact-name: enterprise-package
-            test-path: ""
-            unit-flag: enterprise-package
+            test-path: >-
+              tests/unit/enterprise/integrations
+              tests/unit/enterprise/proxy/auth
+              tests/unit/enterprise/proxy/guardrails
+              tests/unit/enterprise/proxy/management_endpoints
+              tests/unit/enterprise/proxy/test_audit_logging_endpoints.py
+              tests/unit/enterprise/proxy/test_liteadmin.py
+              tests/unit/enterprise/enterprise_callbacks/test_prometheus_logging_callbacks.py
            workers: 4
-            reruns: 2
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60

+          - shard: enterprise-managed-files
+            artifact-name: enterprise-managed-files
+            test-path: >-
+              tests/unit/enterprise/proxy/hooks
+            workers: 4
+            reruns: 0
+            timeout-minutes: 20
+            job-timeout-minutes: 60
+            dist: load
+
          - shard: responses-caching-types
            artifact-name: responses-caching-types
-            test-path: ""
-            unit-flag: responses-caching-types
+            test-path: >-
+              tests/unit/responses
+              tests/unit/types
+              --ignore=tests/unit/responses/mcp
            workers: 2
-            reruns: 2
+            reruns: 0
+            timeout-minutes: 20
+            job-timeout-minutes: 60
+
+          - shard: unit
+            artifact-name: unit
+            test-path: >-
+              tests/unit/anthropic_interface
+              tests/unit/compression
+              tests/unit/enterprise/enterprise_callbacks/test_callback_controls.py
+              tests/unit/enterprise/enterprise_callbacks/test_llm_guard.py
+              tests/unit/enterprise/enterprise_callbacks/test_secret_detection.py
+              tests/unit/integration_support
+              tests/unit/models
+              tests/unit/ocr
+              tests/unit/passthrough
+              tests/unit/realtime_api
+              tests/unit/repositories
+              tests/unit/sandbox
+              tests/unit/skills/test_skills_main.py
+              tests/unit/tracing
+            workers: 2
+            reruns: 0
            timeout-minutes: 20
            job-timeout-minutes: 60
    uses: ./.github/workflows/_test-unit-base.yml
    with:
+      rust-bridge-artifact: ${{ needs.rust-bridge.outputs.artifact }}
      test-path: ${{ matrix.test-path }}
-      unit-flag: ${{ matrix.unit-flag || '' }}
      workers: ${{ matrix.workers }}
      reruns: ${{ matrix.reruns }}
      timeout-minutes: ${{ matrix.timeout-minutes }}
      job-timeout-minutes: ${{ matrix.job-timeout-minutes }}
+      dist: ${{ matrix.dist || 'loadscope' }}
      artifact-name: ${{ matrix.artifact-name }}
-      legacy-mcp-peer: ${{ matrix.shard == 'mcp-integration' }}
--- a/.gitignore
+++ b/.gitignore
@ -58,6 +58,7 @@ litellm/proxy/tests/package-lock.json
 ui/litellm-dashboard/.next
 ui/litellm-dashboard/node_modules
 ui/litellm-dashboard/next-env.d.ts
+*.tsbuildinfo
 ui/litellm-dashboard/package.json
 ui/litellm-dashboard/package-lock.json
 helm/litellm-helm/*.tgz
@ -104,7 +105,7 @@ litellm_config.yaml
 .cursor
 litellm/proxy/to_delete_loadtest_work/*
 update_model_cost_map.py
-tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
 scripts/test_vertex_ai_search.py
 LAZY_LOADING_IMPROVEMENTS.md
 STABILIZATION_TODO.md
@ -150,3 +151,6 @@ litellm.log

 .coverage-rust
 coverage-rust.xml
+
+# make lens-dev worker token, generated config and logs
+.lens-dev/
--- a/AGENTS.md
+++ b/AGENTS.md
@ -62,7 +62,7 @@ Never edit or commit `ruff-strict-budget.json`, `type-discipline-budget.json`, `

 If you're trying to create a new function that relies on untyped stuff, instead of adding more Any's and pushing `reportAny` / `reportExplicitAny` closer to their basedpyright ceilings, just validate it in the caller with Pydantic (a model or `TypeAdapter` that returns the typed thing or raises will do) and then pass the now typed variable in

-If you get an LIT001 or LIT002 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `MappingProxyType()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally, `# mutable-ok` is never used; reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason
+If you get an LIT001 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `MappingProxyType()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally, `# mutable-ok` is never used; reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason

 Every lint or type suppression must name the exact rule inside brackets and carry a reason comment, e.g. `# pyright: ignore[reportArgumentType]  # stubs lack async overload` or `# noqa: TID251  # <reason>`. `# type: ignore` is banned (LIT009): pyrightconfig.json sets `enableTypeIgnoreComments` to false, so it silently does nothing

--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@ -336,7 +336,7 @@ Each translation is isolated in its own file, making it easy to test and modify
 | `/v1/chat/completions` | Gemini | `llms/gemini/chat/transformation.py` |
 | `/v1/chat/completions` | Vertex AI | `llms/vertex_ai/gemini/transformation.py` |
 | `/v1/chat/completions` | OpenAI | `llms/openai/chat/gpt_transformation.py` |
-| `/v1/messages` (passthrough) | Anthropic | `llms/anthropic/experimental_pass_through/messages/transformation.py` |
+| `/v1/messages` (passthrough) | Anthropic | `llms/anthropic/pass_through/messages/transformation.py` |
 | `/v1/messages` (passthrough) | Bedrock | `llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py` |
 | `/v1/messages` (passthrough) | Vertex AI | `llms/vertex_ai/vertex_ai_partner_models/anthropic/experimental_pass_through/transformation.py` |
 | Passthrough endpoints | All | `proxy/pass_through_endpoints/llm_provider_handlers/` |
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -98,7 +98,7 @@ Add your tests to the [`tests/unit/` directory](https://github.com/BerriAI/litel

 The `tests/unit/` directory follows the same structure as `litellm/`:

- `litellm/proxy/caching_routes.py` → `tests/test_litellm/proxy/test_caching_routes.py`
+- `litellm/proxy/caching_routes.py` → `tests/unit/proxy/test_caching_routes.py`
 - `litellm/utils.py` → `tests/unit/test_utils.py`

 ### Example Test
@ -136,7 +136,7 @@ If you're running broader test suites, proxy tests, or anything that touches Pos
 make install-test-deps
 ```

-This syncs the locked test environment used across the repo, including `psycopg` v3 plus `psycopg-binary` (used by `pytest-postgresql`), `psycopg2-binary` (used by some proxy E2E tests), and a generated Prisma client for DB-backed proxy tests, so pytest startup matches CI without manual package installs.
+This syncs the locked test environment used across the repo, including `psycopg` v3 plus `psycopg-binary`, `psycopg2-binary` (used by some proxy E2E tests), and a generated Prisma client for DB-backed proxy tests, so pytest startup matches CI without manual package installs.

 ### Running Linting and Formatting Checks

--- a/19
+++ b/19
@ -9,8 +9,8 @@ ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
 ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
 # Checksum from https://www.pgbouncer.org/downloads/ (the Wolfi repo only carries 1.24.x)
-ARG PGBOUNCER_VERSION=1.25.2
-ARG PGBOUNCER_SHA256=924ad35113fd0a71c8e2dbe85b5d03445532e2b7b37a9f8a48983beea238b332
+ARG PGBOUNCER_VERSION=1.26.0
+ARG PGBOUNCER_SHA256=afd25dd61ee6775d37b40629b87ce08736b3e6955f3057bb212e410fbf21c71d

 FROM $UV_IMAGE AS uvbin

@ -79,6 +79,7 @@ COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
 RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
    --extra proxy \
    --extra proxy-runtime \
+    --group admin-mcp \
    --extra extra_proxy \
    --extra semantic-router \
    --extra saml \
@ -101,6 +102,7 @@ RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.
 RUN uv sync --frozen --no-default-groups --no-editable \
    --extra proxy \
    --extra proxy-runtime \
+    --group admin-mcp \
    --extra extra_proxy \
    --extra semantic-router \
    --extra saml \
@ -114,8 +116,20 @@ RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/
 RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh

+FROM $LITELLM_BUILD_IMAGE AS liteadmin-builder
+COPY --from=uvbin /uv /usr/local/bin/uv
+RUN apk add --no-cache python-3.13
+ADD --checksum=sha256:2f7ae5cdd9d91731c0990e74a58239dc3e3fd2bf28dab23b55eafcdc47aaf87e \
+    https://github.com/BerriAI/litellm-admin-agent/archive/ef501e94bc9fbacb9233b922abf71427f030408c.tar.gz /tmp/liteadmin.tar.gz
+RUN mkdir /tmp/liteadmin && tar xzf /tmp/liteadmin.tar.gz --strip-components=1 -C /tmp/liteadmin && \
+    uv venv /opt/liteadmin --python python3.13 && \
+    uv pip install --python /opt/liteadmin/bin/python --require-hashes -r /tmp/liteadmin/requirements.txt && \
+    uv pip install --python /opt/liteadmin/bin/python --no-deps /tmp/liteadmin
+
 # Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
+ARG LITELLM_RELEASE_TAG=""
+ENV LITELLM_RELEASE_TAG=${LITELLM_RELEASE_TAG}

 USER root

@ -141,6 +155,7 @@ ENV PATH="/app/.venv/bin:${PATH}" \
 # ship (manifest-scanning tools attribute everything in it to this image).
 # entrypoint.sh invokes litellm/proxy/prisma_migration.py by source path.
 COPY --from=builder /app/.venv /app/.venv
+COPY --from=liteadmin-builder /opt/liteadmin /opt/liteadmin
 COPY --from=builder /app/docker /app/docker
 COPY --from=builder /app/schema.prisma /app/schema.prisma
 COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/prisma_migration.py
--- a/22
+++ b/22
@ -1,10 +1,10 @@
 # LiteLLM Makefile
 # Simple Makefile for running tests and basic development tasks

-.PHONY: help test test-unit test-unit-llms test-unit-proxy-guardrails test-unit-proxy-core test-unit-proxy-misc \
+.PHONY: help test test-unit test-unit-llms test-unit-proxy-guardrails test-unit-proxy-core test-unit-proxy-misc test-unit-proxy-root \
 	test-unit-integrations test-unit-core-utils test-unit-other test-unit-root \
 	test-proxy-unit-a test-proxy-unit-b test-integration test-unit-helm \
-	test-rust-extension \
+	test-rust-extension rust-sqlx-prepare lens-dev \
 	info lint lint-inner lint-dev lint-checks format \
 	lint-basedpyright lint-e2e-basedpyright lint-basedpyright-budget-update lint-type-discipline lint-type-discipline-budget-update \
 	lint-ruff-budget lint-ruff-budget-update lint-budget-update lint-gate \
@ -47,6 +47,7 @@ help:
 	@echo "  make test-unit-proxy-guardrails - Run proxy guardrails+mgmt tests (~51 files)"
 	@echo "  make test-unit-proxy-core - Run proxy auth+client+db+hooks tests (~52 files)"
 	@echo "  make test-unit-proxy-misc - Run proxy misc tests (~77 files)"
+	@echo "  make test-unit-proxy-root - Run proxy root-file tests (tests/unit/proxy/test_*.py)"
 	@echo "  make test-unit-integrations - Run integration tests (~60 files)"
 	@echo "  make test-unit-core-utils - Run core utils tests (~32 files)"
 	@echo "  make test-unit-other    - Run other tests (caching, responses, etc., ~69 files)"
@ -56,6 +57,8 @@ help:
 	@echo "  make test-integration   - Run integration tests"
 	@echo "  make test-unit-helm     - Run helm unit tests"
 	@echo "  make test-rust-extension - Build the Rust extension and run its public Python tests"
+	@echo "  make rust-sqlx-prepare  - Refresh litellm-rust/crates/db/.sqlx against a migrated Postgres container"
+	@echo "  make lens-dev           - Run proxy + Lens worker + hot-reload dashboard (ARGS=\"--seed large --seed-logs\", LENS_DEV_PROXY_PORT, LENS_DEV_UI_PORT)"
 	@echo ""
 	@echo "Heavy targets (check, lint) queue for LITELLM_GATE_SLOTS machine-wide"
 	@echo "slots (default 2; 0 disables) so parallel sessions don't thrash one machine."
@ -306,6 +309,12 @@ test-rust-extension:
 	LITELLM_RUST=1 LITELLM_LOCAL_MODEL_COST_MAP=True \
 	"$$temporary/venv/bin/python" -I -m pytest --import-mode=importlib -m requires_rust_extension tests/test_litellm_rust

+rust-sqlx-prepare:
+	cd litellm-rust && cargo run -p litellm-db-testing --bin sqlx-prepare
+
+lens-dev:
+	./scripts/lens_dev.sh $(ARGS)
+
 test: install-test-deps
 	$(UV_RUN) pytest tests/

@ -317,13 +326,16 @@ test-unit-llms: install-test-deps
 	$(UV_RUN) pytest tests/unit/llms --tb=short -vv -n 4 --durations=20

 test-unit-proxy-guardrails: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/proxy/guardrails tests/unit/proxy/management_endpoints tests/unit/proxy/management_helpers --tb=short -vv -n 4 --durations=20

 test-unit-proxy-core: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/proxy/auth tests/unit/proxy/client tests/unit/proxy/db tests/unit/proxy/hooks tests/unit/proxy/policy_engine --ignore=tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py --ignore=tests/unit/proxy/db/test_update_daily_tag_spend.py --tb=short -vv -n 4 --durations=20

 test-unit-proxy-misc: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/shutdown tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/proxy/agent_endpoints tests/unit/proxy/anthropic_endpoints tests/unit/proxy/common_utils --ignore=tests/unit/proxy/common_utils/test_cache_aware_routing.py --ignore=tests/unit/proxy/common_utils/test_check_batch_cost.py --ignore=tests/unit/proxy/common_utils/test_check_responses_cost.py --ignore=tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py --ignore=tests/unit/proxy/common_utils/test_realtime_cache.py tests/unit/proxy/discovery_endpoints tests/unit/proxy/experimental tests/unit/proxy/google_endpoints tests/unit/proxy/health_endpoints tests/unit/proxy/image_endpoints tests/unit/proxy/middleware --ignore=tests/unit/proxy/middleware/test_request_size_limit_middleware.py tests/unit/proxy/openai_files_endpoint tests/unit/proxy/pass_through_endpoints tests/unit/proxy/prompts tests/unit/proxy/public_endpoints tests/unit/proxy/response_api_endpoints tests/unit/proxy/shutdown tests/unit/proxy/spend_tracking --ignore=tests/unit/proxy/spend_tracking/test_search_api_logging.py tests/unit/proxy/ui_crud_endpoints tests/unit/proxy/vector_store_endpoints tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py --ignore=tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py --ignore=tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py --ignore=tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py --ignore=tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py --tb=short -vv -n 4 --durations=20
+
+test-unit-proxy-root: install-test-deps
+	$(UV_RUN) pytest tests/unit/proxy/test_*.py --ignore=tests/unit/proxy/test_aproxy_startup.py --ignore=tests/unit/proxy/test_credential_slot_registry.py --ignore=tests/unit/proxy/test_custom_callback_input.py --ignore=tests/unit/proxy/test_custom_logger_s3_gcs.py --ignore=tests/unit/proxy/test_custom_tokenizer_bug.py --ignore=tests/unit/proxy/test_db_schema_changes.py --ignore=tests/unit/proxy/test_deprecated_key_grace_period.py --ignore=tests/unit/proxy/test_get_favicon.py --ignore=tests/unit/proxy/test_get_image.py --ignore=tests/unit/proxy/test_prisma_client_backoff_retry.py --ignore=tests/unit/proxy/test_prompt_test_endpoint.py --ignore=tests/unit/proxy/test_proxy_config_unit_test.py --ignore=tests/unit/proxy/test_proxy_custom_auth.py --ignore=tests/unit/proxy/test_proxy_reject_logging.py --ignore=tests/unit/proxy/test_proxy_server.py --ignore=tests/unit/proxy/test_proxy_setting_guardrails.py --ignore=tests/unit/proxy/test_proxy_token_counter.py --ignore=tests/unit/proxy/test_proxy_utils.py --ignore=tests/unit/proxy/test_reducto_ocr_route.py --ignore=tests/unit/proxy/test_response_polling_pre_call_checks.py --ignore=tests/unit/proxy/test_server_root_path.py --ignore=tests/unit/proxy/test_ui_path_detection.py --ignore=tests/unit/proxy/test_unit_test_proxy_hooks.py --ignore=tests/unit/proxy/test_update_spend.py --ignore=tests/unit/proxy/test_zero_cost_model_budget_bypass.py --tb=short -vv -n 4 --durations=20

 test-unit-integrations: install-test-deps
 	$(UV_RUN) pytest tests/unit/integrations --tb=short -vv -n 4 --durations=20
--- a/README.md
+++ b/README.md
@ -268,6 +268,31 @@ For MCP OAuth, an upstream may advertise dynamic client registration but refuse

 </details>

+<details>
+<summary><b>Agents</b> - Run Claude Code, Codex, OpenCode or Deep Agents on any model (Python SDK)</summary>
+
+### Python SDK - Agents
+
+```python
+import litellm
+from litellm import Harness, sandbox
+
+result = litellm.agent(
+    Harness.CLAUDE_CODE,  # or Harness.CODEX, Harness.OPENCODE, Harness.DEEPAGENTS
+    "Find why tests/test_router.py is flaky and fix it.",
+    sandbox=sandbox.local("./repo"),
+    model="litellm_proxy/claude-sonnet-4-5",  # a model group on your AI Gateway
+)
+
+print(result.text, result.cost, [f.path for f in result.files])
+```
+
+Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call the agent makes goes through your AI Gateway, tagged `harness,claude_code`. Drop the `litellm_proxy/` prefix to call a provider directly. Install `starlette uvicorn` plus the agent's CLI (`claude`, `codex` or `opencode`), or `deepagents langchain-litellm` for Deep Agents.
+
+[**Docs: Agent Harnesses**](https://docs.litellm.ai/docs/harness)
+
+</details>
+
 ### Supported Providers ([Website Supported Models](https://models.litellm.ai/) | [Docs](https://docs.litellm.ai/docs/providers))

 | Provider                                                                            | `/chat/completions` | `/messages` | `/responses` | `/embeddings` | `/image/generations` | `/audio/transcriptions` | `/audio/speech` | `/moderations` | `/batches` | `/rerank` |
@ -362,13 +387,16 @@ For MCP OAuth, an upstream may advertise dynamic client registration but refuse
 | [Recraft (`recraft`)](https://docs.litellm.ai/docs/providers/recraft) |  |  |  |  | ✅ |  |  |  |  |  |
 | [Replicate (`replicate`)](https://docs.litellm.ai/docs/providers/replicate) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Sagemaker Chat (`sagemaker_chat`)](https://docs.litellm.ai/docs/providers/aws_sagemaker) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [Sail (`sail`)](https://docs.litellm.ai/docs/providers/sail) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Sambanova (`sambanova`)](https://docs.litellm.ai/docs/providers/sambanova) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Snowflake (`snowflake`)](https://docs.litellm.ai/docs/providers/snowflake) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [Strands Decider (`strands_decider`)](https://docs.litellm.ai/docs/providers) |  |  |  |  |  |  |  |  |  |  |
 | [Text Completion Codestral (`text-completion-codestral`)](https://docs.litellm.ai/docs/providers/codestral) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Text Completion OpenAI (`text-completion-openai`)](https://docs.litellm.ai/docs/providers/text_completion_openai) | ✅ | ✅ | ✅ |  |  | ✅ | ✅ | ✅ | ✅ |  |
 | [Together AI (`together_ai`)](https://docs.litellm.ai/docs/providers/togetherai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Topaz (`topaz`)](https://docs.litellm.ai/docs/providers/topaz) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Triton (`triton`)](https://docs.litellm.ai/docs/providers/triton-inference-server) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [Typesafe Decisions API (`typesafe`)](https://docs.litellm.ai/docs/providers) |  |  |  |  |  |  |  |  |  |  |
 | [V0 (`v0`)](https://docs.litellm.ai/docs/providers/v0) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Vercel AI Gateway (`vercel_ai_gateway`)](https://docs.litellm.ai/docs/providers/vercel_ai_gateway) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [VLLM (`vllm`)](https://docs.litellm.ai/docs/providers/vllm) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@ -44,6 +44,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
        --extra proxy \
        --extra proxy-runtime \
+        --group admin-mcp \
        --extra extra_proxy \
        --extra semantic-router \
        --extra saml \
@ -56,6 +57,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-default-groups --no-editable \
        --extra proxy \
        --extra proxy-runtime \
+        --group admin-mcp \
        --extra extra_proxy \
        --extra semantic-router \
        --extra saml \
@ -71,6 +73,8 @@ RUN sed -i 's/\r$//' docker/component_entrypoint.sh && chmod +x docker/component

 # ---------- Runtime ----------
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
+ARG LITELLM_RELEASE_TAG=""
+ENV LITELLM_RELEASE_TAG=${LITELLM_RELEASE_TAG}

 USER root

--- a/backend/main.py
+++ b/backend/main.py
@ -8,9 +8,13 @@ Run with:
    uvicorn backend.main:app --host 0.0.0.0 --port 4001
 """

+from collections.abc import AsyncGenerator, Mapping
 from contextlib import asynccontextmanager
+from typing import Final

-from fastapi.routing import Mount
+from starlette.applications import Starlette
+from starlette.routing import Mount
+from starlette.types import Lifespan

 # See gateway/main.py for why we assemble DATABASE_URL(s) here before
 # importing proxy_server.
@ -43,14 +47,16 @@ def _is_backend_route(route) -> bool:

 # See gateway/main.py for why the trim runs inside the lifespan instead of at
 # module scope.
-_proxy_lifespan = app.router.lifespan_context
+_proxy_lifespan: Final = app.router.lifespan_context


@asynccontextmanager
-async def _backend_lifespan(app_):
-    async with _proxy_lifespan(app_):
+async def _backend_lifespan(
+    app_: Starlette, lifespan: Lifespan[Starlette] = _proxy_lifespan
+) -> AsyncGenerator[Mapping[str, object], None]:
+    async with lifespan(app_) as state:
        app_.router.routes = [r for r in app_.router.routes if _is_backend_route(r)]
-        yield
+        yield state if state is not None else {}


 app.router.lifespan_context = _backend_lifespan
--- a/backend/routes/allowlist.py
+++ b/backend/routes/allowlist.py
@ -22,6 +22,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    "/customer/",
    "/end_user/",
    "/sso/",
+    "/liteadmin/slack/connect/",
    "/login",
    "/v2/login",
    "/v3/login",
@ -60,6 +61,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    # Tools / agents (registry & policy admin)
    "/v1/tool/",
    "/v1/agents",
+    "/agent/daily/activity/",
    # Guardrails admin
    "/v2/guardrails/",
    # MCP server admin + BYOK OAuth flow (UI-initiated) + dynamic per-server endpoints
@ -81,6 +83,9 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    # Spend / analytics
    "/spend/",
    "/analytics/",
+    "/lens/",
+    "/v1/traces",
+    "/v1/logs",
    "/global/",
    "/user_agent",
    "/usage/",
@ -144,6 +149,7 @@ BACKEND_EXACT_PATHS: frozenset[str] = frozenset(
    {
        "/",
        "/routes",
+        "/lens",
        "/openapi.json",
        "/docs",
        "/docs/oauth2-redirect",
@ -155,6 +161,7 @@ BACKEND_EXACT_PATHS: frozenset[str] = frozenset(

 BACKEND_MOUNT_PATHS: frozenset[str] = frozenset(
    {
+        "/admin",
        "/swagger",  # API documentation static assets belong to the backend
        "/mcp",  # lazily-mounted MCP sub-app serves on the backend component
    }
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`<!-- Write the final PR description as concise bullets only -->`