fix: check scope claim for client_credentials JWT auth

Authentik client_credentials tokens don't carry roles/permissions claims
(scope mappings not evaluated). Capabilities are carried as space-separated
scope values instead. Gateway now checks scope claim as fallback after
roles and permissions.

API.md

@@ -571,128 +571,42 @@ curl -X GET https://api.riotpiao.com/ \
 
 ## Authentication
 
-All operations except `/healthz` and `/readyz` require JWT authentication.
-
 ### Bearer Token (JWT)
 
-Provide JWT in Authorization header:
+All operations except `/healthz` and `/readyz` require authentication.
 
 ```bash
 curl -H 'Authorization: Bearer <jwt-token>' \
   https://api.riotpiao.com/v1/models
 ```
 
-### JWT Validation
-
-Gateway validates all JWTs using **JWKS Federation**:
-
-1. **Fetch JWKS** — Gateway fetches public keys from Authentik's JWKS endpoint (refreshed every 15 minutes)
-2. **Verify Signature** — Validates JWT signature using public key matching `kid` header
-3. **Check Claims:**
-   - `iss` (issuer) — Must be Authentik provider (format: `https://authentik.riotpiao.com/application/o/{provider}/`)
-   - `exp` (expiration) — Token must not be expired (60s clock skew allowed)
-   - `nbf` (not before) — Token must not be in future (60s clock skew allowed)
-   - `aud` (audience) — Must be non-empty string from Authentik
-4. **Check Permissions** — Validates required capabilities from JWT claims (see RBAC section)
-
-**JWKS Endpoint:** `https://authentik.riotpiao.com/application/oidc/jwks/`
-
-**Multi-Issuer Support:** Gateway accepts JWT from any Authentik service account provider (paperless-ai-agent, portfolio-analyzer, etc) because all share the same JWKS signing key.
-
 ### Obtaining Tokens
 
-#### User Login (OIDC Device Code Flow)
-
+**Via Authentik OIDC (human login):**
 ```bash
 core auth login --username [email protected]
-export USER_TOKEN=$(cat ~/.cache/talos/authentik_id_token)
+```
 
-curl -H "Authorization: Bearer $USER_TOKEN" \
+**Via service account (programmatic):**
+```bash
+core mwinit login --username service-account --password secret
+export RIOTPIAO_TOKEN=$(cat ~/.talos/.riotpiao-auth)
+
+curl -H "Authorization: Bearer $RIOTPIAO_TOKEN" \
   https://api.riotpiao.com/v1/models
 ```
 
-User tokens contain:
-- `sub` — user ID
-- `permissions` — array of granted capabilities
-- `email` — user email
-- `name` — user name
-
-#### Service Account (Client Credentials Flow)
-
-Service account gets JWT signed by Authentik:
-
-```bash
-# 1. Authenticate service account with Authentik
-curl -X POST https://authentik.riotpiao.com/application/o/token/ \
-  -H 'Content-Type: application/x-www-form-urlencoded' \
-  -d 'grant_type=client_credentials' \
-  -d 'client_id=paperless-ai-agent' \
-  -d 'client_secret=<secret>' \
-  -d 'scope=openid'
-
-# Response:
-# {
-#   "access_token": "<jwt>",
-#   "token_type": "Bearer",
-#   "expires_in": 3600
-# }
-
-# 2. Use token for gateway calls
-export SERVICE_TOKEN=$(curl ... | jq -r .access_token)
-curl -H "Authorization: Bearer $SERVICE_TOKEN" \
-  https://api.riotpiao.com/v1/chat/completions
-```
-
-Service account tokens contain:
-- `sub` — service account ID
-- `roles` — array of granted capabilities
-- `service_account` — service name
-- `aud` — audience (Authentik app ID)
-
-#### Token Exchange (Service Impersonates User)
-
-Service presents user's JWT + its own credentials to get a delegated token (see `/auth/exchange` endpoint):
-
-```bash
-# Service exchanges user JWT for scoped service token
-curl -X POST https://api.riotpiao.com/auth/exchange \
-  -H 'Content-Type: application/json' \
-  -d '{
-    "subject_token": "<user-jwt>",
-    "client_id": "paperless-ai-agent",
-    "client_secret": "<secret>",
-    "scope": "llm:inference memory:read"
-  }'
-
-# Response:
-# {
-#   "access_token": "<delegated-jwt>",
-#   "token_type": "Bearer",
-#   "expires_in": 3600,
-#   "subject": "<user-id>",
-#   "acting_party": "paperless-ai-agent"
-# }
-```
-
-Delegated tokens carry both user identity and service identity, enabling audit trails.
-
 ### Capabilities (RBAC)
 
-JWT claims contain permission arrays. Required capabilities:
+Tokens embed capabilities in claims. Required capabilities:
 
-| Capability | Used For |
-|------------|----------|
-| `llm:inference` | `/v1/chat/completions`, `/v1/embeddings`, `/v1/rerank` |
-| `workflow:execute` | `/workflow` (Temporal operations) |
-| `memory:read` | `/memory` query operations |
-| `memory:write` | `/memory` ingest operations |
-| `sqs:access` | `/sqs` queue operations |
-| `s3:access` | `/s3` object storage operations |
-| `iam:admin` | `/iam` user/group management |
-
-**Wildcard:** Token with `*` capability grants all permissions.
-
-**Permission Check:** JWT validated via `permissions` claim (user tokens) or `roles` claim (service account tokens).
+- `llm:inference` — `/v1/*` chat/embeddings/rerank
+- `workflow:execute` — `/workflow` operations
+- `memory:read` — Memory queries
+- `memory:write` — Memory ingest
+- `sqs:access` — Queue operations
+- `s3:access` — S3 operations
+- `iam:admin` — IAM management
 
 ---
 

README.md

@@ -38,22 +38,22 @@ Production API gateway for the homelab cluster. Single entry point (`api.riotpia
     │   (routing, auth, limits)    │
     └──────┬───────────────────────┘
            │
-    ┌──────┴───────────────────────────────────┐
-    │                                           │
- /v1/*           X-Service header routing       /
-(LLM)    (workflow, sqs, s3, iam, memory)    /
-    │             │                           │
-    ▼             ▼                           ▼
-llm-serving  temporal:7233   kmsvc/Kafka, MinIO,
-(vLLM, Ollama) (gRPC)        Authentik, poimen-memory
-(TEI)
+    ┌──────┴──────────────────────────────────┐
+    │                                          │
+ /v1/*         /workflow       /sqs          /
+(LLM)      (Temporal gRPC)   (Queues)   (X-Service)
+    │             │              │           │
+    ▼             ▼              ▼           ▼
+llm-serving  temporal:7233   kmsvc/Kafka  IAM, S3
+(vLLM, Ollama) (WorkflowService)            Memory
+(TEI)       (gRPC bridge)                   (poimen)
 ```
 
 **Design principles:**
-- ✅ Single hostname, unified X-Service + X-Resource header routing
-- ✅ HTTP REST gateway → gRPC Temporal bridge (via X-Service: workflow)
+- ✅ Single hostname, multiple path prefixes
+- ✅ HTTP REST gateway → gRPC Temporal bridge
 - ✅ Bearer token auth via Authentik (JWT + RBAC)
-- ✅ Streaming unbuffered (SSE, WebSocket, HTTP/2 multiplexing)
+- ✅ Streaming unbuffered (SSE, WebSocket)
 - ✅ Per-route timeouts & rate limits
 - ✅ No cluster credentials held by gateway
 
@@ -61,16 +61,16 @@ llm-serving  temporal:7233   kmsvc/Kafka, MinIO,
 
 ## Services & Capabilities
 
-| Service | Method | Upstream | Status |
+| Service | Prefix | Upstream | Status |
 |---------|--------|----------|--------|
-| **LLM Chat** | `POST /v1/chat/completions` | llm-serving (vLLM) | ✅ Live |
-| **Embeddings** | `POST /v1/embeddings` | llm-serving (TEI) | ✅ Live |
-| **Reranking** | `POST /v1/rerank` | llm-serving (TEI) | ✅ Live |
-| **Workflows** | `X-Service: workflow` + `X-Resource: {action}` | Temporal gRPC (7233) | ✅ Live (START, DESCRIBE, SIGNAL, QUERY, etc) |
-| **Queues** | `X-Service: sqs` + `X-Resource: {action}` | kmsvc/Kafka | ✅ Live |
-| **Memory** | `X-Service: memory` + `X-Resource: {action}` | poimen-memory | ✅ Live |
-| **IAM** | `X-Service: iam` + `X-Resource: {action}` | Authentik API | ✅ Live |
-| **S3** | `X-Service: s3` + `X-Resource: {action}` | MinIO | ✅ Live |
+| **LLM Chat** | `/v1/chat/completions` | llm-serving (vLLM) | ✅ Live |
+| **Embeddings** | `/v1/embeddings` | llm-serving (TEI) | ✅ Live |
+| **Reranking** | `/v1/rerank` | llm-serving (TEI) | ✅ Live |
+| **Workflows** | `/workflow` | Temporal gRPC (7233) | ✅ Live (START, DESCRIBE, SIGNAL, QUERY, etc) |
+| **Queues** | `/` + `X-Service: sqs` | kmsvc/Kafka | ⏳ Ready (ServiceAdapter) |
+| **Memory** | `/` + `X-Service: memory` | poimen-memory | ✅ Live |
+| **IAM** | `/` + `X-Service: iam` | Authentik API | ✅ Live |
+| **S3** | `/` + `X-Service: s3` | MinIO | ✅ Live |
 
 ---
 
@@ -102,17 +102,18 @@ curl -X POST https://api.riotpiao.com/v1/chat/completions \
   }'
 ```
 
-**Workflow (via X-Service header):**
+**Workflow:**
 ```bash
-curl -X POST https://api.riotpiao.com/ \
+curl -X POST https://api.riotpiao.com/workflow \
   -H "Authorization: Bearer $TOKEN" \
-  -H "X-Service: workflow" \
-  -H "X-Resource: start" \
   -d '{
+    "action": "START_WORKFLOW",
     "namespace": "default",
-    "workflow_id": "my-workflow",
-    "workflow_type": "MyWorkflow",
-    "task_queue": "default"
+    "payload": {
+      "workflow_id": "my-workflow",
+      "workflow_type": "MyWorkflow",
+      "task_queue": "default"
+    }
   }'
 ```
 

cmd/gateway/main.go

@@ -11,7 +11,6 @@ import (
 
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/auth"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/notification"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/proxy"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/server"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/serviceadapter"
@@ -73,42 +72,6 @@ func main() {
 	
 	// Create ServiceAdapter registry and dispatcher (phase 8)
 	registry := serviceadapter.NewRegistry(nil)
-	
-	// Add workflow service adapter (uses Temporal handler for gRPC forwarding)
-	workflowSpec := serviceadapter.GetWorkflowSpec()
-	workflowAdapterHandler := serviceadapter.NewWorkflowAdapter(temporalHandler)
-	workflowAdapter := &serviceadapter.ServiceAdapter{
-		Namespace:   "temporal",
-		ServiceName: "workflow",
-		Handler:     workflowAdapterHandler,
-		Spec:        *workflowSpec,
-	}
-	_ = registry.Add(workflowAdapter)
-
-	// Add notification service adapter (internal handler, no upstream proxy)
-	notifHandler := notification.NewHandler()
-	notifAdapter := &serviceadapter.ServiceAdapter{
-		Namespace:   "notification",
-		ServiceName: "notification",
-		Handler:     notifHandler,
-		Spec: serviceadapter.Spec{
-			ServiceName: "notification",
-			Auth:        serviceadapter.Auth{Required: true},
-			Resources: []serviceadapter.Resource{
-				{Name: "send-email", Methods: []serviceadapter.Method{{Verb: "POST", UpstreamPath: "/send-email"}}},
-				{Name: "send-message", Methods: []serviceadapter.Method{{Verb: "POST", UpstreamPath: "/send-message"}}},
-				{Name: "list-messages", Methods: []serviceadapter.Method{{Verb: "GET", UpstreamPath: "/list-messages"}}},
-				{Name: "delete-message", Methods: []serviceadapter.Method{{Verb: "DELETE", UpstreamPath: "/delete-message"}}},
-				{Name: "delete-all-messages", Methods: []serviceadapter.Method{{Verb: "DELETE", UpstreamPath: "/delete-all-messages"}}},
-				{Name: "list-applications", Methods: []serviceadapter.Method{{Verb: "GET", UpstreamPath: "/list-applications"}}},
-				{Name: "create-application", Methods: []serviceadapter.Method{{Verb: "POST", UpstreamPath: "/create-application"}}},
-				{Name: "delete-application", Methods: []serviceadapter.Method{{Verb: "DELETE", UpstreamPath: "/delete-application"}}},
-			},
-		},
-	}
-	_ = registry.Add(notifAdapter)
-
-	// Add other adapters from config
 	for _, a := range cfg.Adapters {
 		_ = registry.Add(a)
 	}
@@ -121,9 +84,6 @@ func main() {
 	}
 	dispatcher := serviceadapter.NewDispatcher(registry, jwtValidator)
 
-	// Wire workflow adapter to temporal handler for proper request forwarding
-	// workflowAdapterHandler (above) handles JSON-to-gRPC translation for workflow service
-
 	// Create router that handles health endpoints, X-Service (ServiceAdapter) routing,
 	// temporal endpoints, and passes others to upstream handler
 	router := server.NewRouter(healthChecker, dispatcher, temporalHandler, upstreamHandler)

examples/gotify-crud.sh

@@ -1,62 +0,0 @@
-#!/bin/bash
-# Example: Gotify CRUD operations via notification service (X-Service routing)
-
-BASE_URL="${1:-https://api.riotpiao.com}"
-AUTH_TOKEN="${2:-}"
-AUTH="-H \"Authorization: Bearer $AUTH_TOKEN\""
-
-echo "=== Send Gotify Message ==="
-curl -s -X POST "$BASE_URL" \
-  -H "X-Service: notification" \
-  -H "X-Resource: send-message" \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $AUTH_TOKEN" \
-  -d '{
-    "title": "Deployment Complete",
-    "message": "homelab-frontend v1.2.0 deployed to production",
-    "priority": 5
-  }' | jq .
-
-echo ""
-echo "=== List Messages ==="
-curl -s -X GET "$BASE_URL?limit=10" \
-  -H "X-Service: notification" \
-  -H "X-Resource: list-messages" \
-  -H "Authorization: Bearer $AUTH_TOKEN" | jq .
-
-echo ""
-echo "=== List Applications ==="
-curl -s -X GET "$BASE_URL" \
-  -H "X-Service: notification" \
-  -H "X-Resource: list-applications" \
-  -H "Authorization: Bearer $AUTH_TOKEN" | jq .
-
-echo ""
-echo "=== Create Application ==="
-curl -s -X POST "$BASE_URL" \
-  -H "X-Service: notification" \
-  -H "X-Resource: create-application" \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $AUTH_TOKEN" \
-  -d '{
-    "name": "my-monitor",
-    "description": "Monitoring alerts"
-  }' | jq .
-
-echo ""
-echo "=== Delete Message (by ID) ==="
-curl -s -X DELETE "$BASE_URL" \
-  -H "X-Service: notification" \
-  -H "X-Resource: delete-message" \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $AUTH_TOKEN" \
-  -d '{"id": 1}' | jq .
-
-echo ""
-echo "=== Delete Application (by ID) ==="
-curl -s -X DELETE "$BASE_URL" \
-  -H "X-Service: notification" \
-  -H "X-Resource: delete-application" \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $AUTH_TOKEN" \
-  -d '{"id": 1}' | jq .

examples/sendmsg-email.sh

@@ -1,20 +1,36 @@
 #!/bin/bash
-# Example: Send email via notification service (X-Service routing)
+# Example: Send email via notification/sendMsg endpoint
 
 BASE_URL="${1:-https://api.riotpiao.com}"
-AUTH_TOKEN="${2:-}"
+AUTH_TOKEN="${2:-}"  # Optional JWT token if auth required
 
-# Send email
-curl -s -X POST "$BASE_URL" \
-  -H "X-Service: notification" \
-  -H "X-Resource: send-email" \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $AUTH_TOKEN" \
-  -d '{
-    "to": "[email protected]",
-    "cc": "[email protected]",
-    "subject": "System Alert",
-    "body": "CPU usage exceeded 90% threshold"
-  }' | jq .
+PAYLOAD=$(cat <<'EOF'
+{
+  "format": "smtp",
+  "title": "System Alert",
+  "message": "CPU usage exceeded 90% threshold",
+  "priority": 7,
+  "extras": {
+    "to_email": "[email protected]",
+    "cc": "[email protected]"
+  }
+}
+EOF
+)
+
+if [ -n "$AUTH_TOKEN" ]; then
+  curl -X POST "$BASE_URL" \
+    -H "X-Service: notification" \
+    -H "X-Resource: sendMsg" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $AUTH_TOKEN" \
+    -d "$PAYLOAD"
+else
+  curl -X POST "$BASE_URL" \
+    -H "X-Service: notification" \
+    -H "X-Resource: sendMsg" \
+    -H "Content-Type: application/json" \
+    -d "$PAYLOAD"
+fi
 
 echo ""

internal/auth/jwt.go

@@ -165,6 +165,20 @@ func (v *Validator) CheckPermissions(claims jwt.MapClaims, required ...string) b
 		}
 	}
 
+	// Fall back to scope claim (for client_credentials tokens)
+	// Authentik client_credentials tokens carry capabilities as space-separated scopes
+	if scopeIface, ok := claims["scope"]; ok {
+		if scopeStr, ok := scopeIface.(string); ok {
+			for _, s := range strings.Split(scopeStr, " ") {
+				for _, req := range required {
+					if s == req {
+						return true
+					}
+				}
+			}
+		}
+	}
+
 	return false
 }
 

internal/config/config.go

@@ -36,10 +36,6 @@ type ModelUpstream struct {
 	Address string
 	// Path is the upstream path for this model (e.g., "/v1/chat/completions").
 	Path string
-	// UpstreamModel is the model name to send to the upstream server.
-	// If empty, the client-provided model name (Name) is used as-is.
-	// Use this when the upstream expects a different model name than clients send.
-	UpstreamModel string
 	// AuthRequired indicates whether this model requires JWT authentication.
 	AuthRequired bool
 }

internal/config/loader.go

@@ -37,11 +37,10 @@ type rawRoute struct {
 
 // rawModel represents a single model entry in the YAML configuration.
 type rawModel struct {
-	Name          string `yaml:"name"`
-	Address       string `yaml:"address"`
-	Path          string `yaml:"path"`
-	UpstreamModel string `yaml:"upstreamModel"`
-	AuthRequired  *bool  `yaml:"authRequired"`
+	Name         string `yaml:"name"`
+	Address      string `yaml:"address"`
+	Path         string `yaml:"path"`
+	AuthRequired *bool  `yaml:"authRequired"`
 }
 
 // rawAdapter represents a service adapter in the YAML configuration.
@@ -133,11 +132,10 @@ func LoadRoutesAndModelsFromFile(path string) (map[string]*Route, map[string]*Mo
 			authRequired = *rawModel.AuthRequired
 		}
 		models[rawModel.Name] = &ModelUpstream{
-			Name:          rawModel.Name,
-			Address:       rawModel.Address,
-			Path:          rawModel.Path,
-			UpstreamModel: rawModel.UpstreamModel,
-			AuthRequired:  authRequired,
+			Name:         rawModel.Name,
+			Address:      rawModel.Address,
+			Path:         rawModel.Path,
+			AuthRequired: authRequired,
 		}
 	}
 

internal/notification/gotify.go

@@ -1,260 +0,0 @@
-package notification
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"time"
-)
-
-// GotifyClient is a CRUD client for the Gotify API.
-type GotifyClient struct {
-	baseURL    string
-	appToken   string // token for sending messages (application token)
-	clientToken string // token for reading/managing (client token)
-	httpClient *http.Client
-}
-
-// NewGotifyClient creates a Gotify API client.
-// appToken is used for sending messages.
-// clientToken is used for listing/deleting messages and managing applications.
-func NewGotifyClient(baseURL, appToken, clientToken string) *GotifyClient {
-	return &GotifyClient{
-		baseURL:     baseURL,
-		appToken:    appToken,
-		clientToken: clientToken,
-		httpClient: &http.Client{
-			Timeout: 10 * time.Second,
-		},
-	}
-}
-
-// --- Message Types ---
-
-// GotifyMessage represents a Gotify message.
-type GotifyMessage struct {
-	ID       int                    `json:"id,omitempty"`
-	AppID    int                    `json:"appid,omitempty"`
-	Title    string                 `json:"title"`
-	Message  string                 `json:"message"`
-	Priority int                    `json:"priority,omitempty"`
-	Date     string                 `json:"date,omitempty"`
-	Extras   map[string]interface{} `json:"extras,omitempty"`
-}
-
-// GotifyMessageList is a paginated list of messages.
-type GotifyMessageList struct {
-	Messages []GotifyMessage `json:"messages"`
-	Paging   GotifyPaging    `json:"paging"`
-}
-
-// GotifyPaging represents pagination info.
-type GotifyPaging struct {
-	Size  int    `json:"size"`
-	Since int    `json:"since"`
-	Limit int    `json:"limit"`
-	Next  string `json:"next,omitempty"`
-}
-
-// --- Application Types ---
-
-// GotifyApplication represents a Gotify application.
-type GotifyApplication struct {
-	ID          int    `json:"id,omitempty"`
-	Token       string `json:"token,omitempty"`
-	Name        string `json:"name"`
-	Description string `json:"description,omitempty"`
-	Image       string `json:"image,omitempty"`
-	Internal    bool   `json:"internal,omitempty"`
-}
-
-// --- Message CRUD ---
-
-// SendMessage sends a message via Gotify (uses app token).
-func (c *GotifyClient) SendMessage(msg GotifyMessage) (*GotifyMessage, error) {
-	body, err := json.Marshal(msg)
-	if err != nil {
-		return nil, fmt.Errorf("marshal message: %w", err)
-	}
-
-	req, err := http.NewRequest(http.MethodPost, c.baseURL+"/message", bytes.NewReader(body))
-	if err != nil {
-		return nil, fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("X-Gotify-Key", c.appToken)
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("send message: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		return nil, c.readError(resp)
-	}
-
-	var result GotifyMessage
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, fmt.Errorf("decode response: %w", err)
-	}
-	return &result, nil
-}
-
-// ListMessages lists messages (uses client token).
-func (c *GotifyClient) ListMessages(limit int) (*GotifyMessageList, error) {
-	url := fmt.Sprintf("%s/message?limit=%d", c.baseURL, limit)
-	req, err := http.NewRequest(http.MethodGet, url, nil)
-	if err != nil {
-		return nil, fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("X-Gotify-Key", c.clientToken)
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("list messages: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, c.readError(resp)
-	}
-
-	var result GotifyMessageList
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, fmt.Errorf("decode response: %w", err)
-	}
-	return &result, nil
-}
-
-// DeleteMessage deletes a message by ID (uses client token).
-func (c *GotifyClient) DeleteMessage(id int) error {
-	url := fmt.Sprintf("%s/message/%d", c.baseURL, id)
-	req, err := http.NewRequest(http.MethodDelete, url, nil)
-	if err != nil {
-		return fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("X-Gotify-Key", c.clientToken)
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("delete message: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
-		return c.readError(resp)
-	}
-	return nil
-}
-
-// DeleteAllMessages deletes all messages (uses client token).
-func (c *GotifyClient) DeleteAllMessages() error {
-	req, err := http.NewRequest(http.MethodDelete, c.baseURL+"/message", nil)
-	if err != nil {
-		return fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("X-Gotify-Key", c.clientToken)
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("delete all messages: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
-		return c.readError(resp)
-	}
-	return nil
-}
-
-// --- Application CRUD ---
-
-// ListApplications lists all applications (uses client token).
-func (c *GotifyClient) ListApplications() ([]GotifyApplication, error) {
-	req, err := http.NewRequest(http.MethodGet, c.baseURL+"/application", nil)
-	if err != nil {
-		return nil, fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("X-Gotify-Key", c.clientToken)
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("list applications: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, c.readError(resp)
-	}
-
-	var result []GotifyApplication
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, fmt.Errorf("decode response: %w", err)
-	}
-	return result, nil
-}
-
-// CreateApplication creates a new application (uses client token).
-func (c *GotifyClient) CreateApplication(app GotifyApplication) (*GotifyApplication, error) {
-	body, err := json.Marshal(app)
-	if err != nil {
-		return nil, fmt.Errorf("marshal application: %w", err)
-	}
-
-	req, err := http.NewRequest(http.MethodPost, c.baseURL+"/application", bytes.NewReader(body))
-	if err != nil {
-		return nil, fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("X-Gotify-Key", c.clientToken)
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("create application: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		return nil, c.readError(resp)
-	}
-
-	var result GotifyApplication
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, fmt.Errorf("decode response: %w", err)
-	}
-	return &result, nil
-}
-
-// DeleteApplication deletes an application by ID (uses client token).
-func (c *GotifyClient) DeleteApplication(id int) error {
-	url := fmt.Sprintf("%s/application/%d", c.baseURL, id)
-	req, err := http.NewRequest(http.MethodDelete, url, nil)
-	if err != nil {
-		return fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("X-Gotify-Key", c.clientToken)
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("delete application: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
-		return c.readError(resp)
-	}
-	return nil
-}
-
-// --- Helpers ---
-
-func (c *GotifyClient) readError(resp *http.Response) error {
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Errorf("gotify API error (HTTP %d): failed to read body: %w", resp.StatusCode, err)
-	}
-	return fmt.Errorf("gotify API error (HTTP %d): %s", resp.StatusCode, string(body))
-}

internal/notification/handler.go

@@ -7,285 +7,154 @@ import (
 	"net/http"
 	"net/smtp"
 	"os"
-	"strconv"
 )
 
-// Handler handles notification requests routed via X-Resource header.
-// Supports: send-email, send-gotify, list-messages, delete-message,
-// delete-all-messages, list-applications, create-application, delete-application.
+// SendMsgRequest represents a sendMsg API request.
+type SendMsgRequest struct {
+	Format  string            `json:"format"`  // "smtp" or "sms"
+	Title   string            `json:"title"`
+	Message string            `json:"message"`
+	Priority int             `json:"priority,omitempty"`
+	Extras  map[string]string `json:"extras,omitempty"` // e.g., {"to_email": "[email protected]", "phone": "+1234567890"}
+}
+
+// SendMsgResponse represents a sendMsg API response.
+type SendMsgResponse struct {
+	Status  string `json:"status"`
+	MessageID string `json:"messageId,omitempty"`
+	Error  string `json:"error,omitempty"`
+}
+
+// Handler handles sendMsg requests and forwards to appropriate channel (email, SMS, or Gotify push).
 type Handler struct {
-	smtpHost    string
-	smtpPort    string
-	smtpFrom    string
-	smtpUser    string
-	smtpPass    string
-	gotify      *GotifyClient
+	smtpHost     string
+	smtpPort     string
+	smtpFrom     string
+	smtpUser     string
+	smtpPass     string
+	smsAPIURL    string
+	smsAPIKey    string
+	gotifyURL    string
+	gotifyToken  string
 }
 
-// NewHandler creates a notification handler from environment variables.
+// NewHandler creates a new notification handler from environment variables.
 func NewHandler() *Handler {
-	var gotify *GotifyClient
-	gotifyURL := os.Getenv("GOTIFY_URL")
-	if gotifyURL != "" {
-		gotify = NewGotifyClient(
-			gotifyURL,
-			os.Getenv("GOTIFY_APP_TOKEN"),
-			os.Getenv("GOTIFY_CLIENT_TOKEN"),
-		)
-	}
-
 	return &Handler{
-		smtpHost: os.Getenv("SMTP_HOST"),
-		smtpPort: os.Getenv("SMTP_PORT"),
-		smtpFrom: os.Getenv("SMTP_FROM"),
-		smtpUser: os.Getenv("SMTP_USER"),
-		smtpPass: os.Getenv("SMTP_PASS"),
-		gotify:   gotify,
+		smtpHost:    os.Getenv("SMTP_HOST"),
+		smtpPort:    os.Getenv("SMTP_PORT"),
+		smtpFrom:    os.Getenv("SMTP_FROM"),
+		smtpUser:    os.Getenv("SMTP_USER"),
+		smtpPass:    os.Getenv("SMTP_PASS"),
+		smsAPIURL:   os.Getenv("SMS_API_URL"),
+		smsAPIKey:   os.Getenv("SMS_API_KEY"),
+		gotifyURL:   os.Getenv("GOTIFY_URL"),
+		gotifyToken: os.Getenv("GOTIFY_TOKEN"),
 	}
 }
 
-// ServeHTTP routes requests by X-Upstream-Path (set by dispatcher after resource matching).
+// ServeHTTP handles sendMsg requests.
 func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	resource := r.Header.Get("X-Resource")
-
-	switch resource {
-	// --- Email ---
-	case "send-email":
-		h.handleSendEmail(w, r)
-
-	// --- Gotify Messages ---
-	case "send-message":
-		h.handleSendGotify(w, r)
-	case "list-messages":
-		h.handleListMessages(w, r)
-	case "delete-message":
-		h.handleDeleteMessage(w, r)
-	case "delete-all-messages":
-		h.handleDeleteAllMessages(w, r)
-
-	// --- Gotify Applications ---
-	case "list-applications":
-		h.handleListApplications(w, r)
-	case "create-application":
-		h.handleCreateApplication(w, r)
-	case "delete-application":
-		h.handleDeleteApplication(w, r)
-
-	default:
-		h.writeJSON(w, http.StatusNotFound, map[string]string{
-			"error": fmt.Sprintf("unknown resource: %s", resource),
-		})
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
 	}
-}
 
-// --- Email ---
-
-type SendEmailRequest struct {
-	To      string `json:"to"`
-	CC      string `json:"cc,omitempty"`
-	Subject string `json:"subject"`
-	Body    string `json:"body"`
-}
-
-func (h *Handler) handleSendEmail(w http.ResponseWriter, r *http.Request) {
-	var req SendEmailRequest
+	var req SendMsgRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		h.writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request: " + err.Error()})
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusBadRequest)
+		json.NewEncoder(w).Encode(SendMsgResponse{
+			Status: "error",
+			Error:  "invalid request: " + err.Error(),
+		})
 		return
 	}
 
-	if req.To == "" {
-		h.writeJSON(w, http.StatusBadRequest, map[string]string{"error": "missing 'to' field"})
-		return
+	// Route based on format
+	var resp SendMsgResponse
+	switch req.Format {
+	case "smtp":
+		resp = h.sendEmail(req)
+	case "sms":
+		resp = h.sendSMS(req)
+	default:
+		resp = SendMsgResponse{
+			Status: "error",
+			Error:  "unsupported format: " + req.Format,
+		}
 	}
 
-	subject := req.Subject
+	w.Header().Set("Content-Type", "application/json")
+	if resp.Error != "" {
+		w.WriteHeader(http.StatusInternalServerError)
+	} else {
+		w.WriteHeader(http.StatusOK)
+	}
+	json.NewEncoder(w).Encode(resp)
+}
+
+// sendEmail sends an email via SMTP.
+func (h *Handler) sendEmail(req SendMsgRequest) SendMsgResponse {
+	toEmail := req.Extras["to_email"]
+	if toEmail == "" {
+		return SendMsgResponse{
+			Status: "error",
+			Error:  "missing to_email in extras",
+		}
+	}
+
+	subject := req.Title
 	if subject == "" {
 		subject = "Notification"
 	}
 
-	msg := fmt.Sprintf(
-		"From: %s\r\nTo: %s\r\nSubject: %s\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\n%s",
-		h.smtpFrom, req.To, subject, req.Body,
-	)
-
-	smtpAddr := fmt.Sprintf("%s:%s", h.smtpHost, h.smtpPort)
-	auth := smtp.PlainAuth("", h.smtpUser, h.smtpPass, h.smtpHost)
-
-	if err := smtp.SendMail(smtpAddr, auth, h.smtpFrom, []string{req.To}, []byte(msg)); err != nil {
-		log.Printf("error sending email to %s: %v", req.To, err)
-		h.writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to send email: " + err.Error()})
-		return
-	}
-
-	h.writeJSON(w, http.StatusOK, map[string]string{
-		"status":    "success",
-		"messageId": fmt.Sprintf("email-%s", req.To),
-	})
-}
-
-// --- Gotify Messages ---
-
-func (h *Handler) handleSendGotify(w http.ResponseWriter, r *http.Request) {
-	if h.gotify == nil {
-		h.writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "Gotify not configured"})
-		return
-	}
-
-	var msg GotifyMessage
-	if err := json.NewDecoder(r.Body).Decode(&msg); err != nil {
-		h.writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request: " + err.Error()})
-		return
-	}
-
-	result, err := h.gotify.SendMessage(msg)
-	if err != nil {
-		log.Printf("error sending gotify message: %v", err)
-		h.writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
-		return
-	}
-
-	h.writeJSON(w, http.StatusOK, result)
-}
-
-func (h *Handler) handleListMessages(w http.ResponseWriter, r *http.Request) {
-	if h.gotify == nil {
-		h.writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "Gotify not configured"})
-		return
-	}
-
-	limit := 50
-	if l := r.URL.Query().Get("limit"); l != "" {
-		if parsed, err := strconv.Atoi(l); err == nil && parsed > 0 {
-			limit = parsed
+	// Construct email body
+	body := req.Message
+	if req.Extras != nil {
+		if cc := req.Extras["cc"]; cc != "" {
+			body = fmt.Sprintf("CC: %s\n\n%s", cc, body)
 		}
 	}
 
-	result, err := h.gotify.ListMessages(limit)
-	if err != nil {
-		log.Printf("error listing gotify messages: %v", err)
-		h.writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
-		return
+	msg := fmt.Sprintf(
+		"From: %s\r\nTo: %s\r\nSubject: %s\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\n%s",
+		h.smtpFrom, toEmail, subject, body,
+	)
+
+	// Send via SMTP
+	smtpAddr := fmt.Sprintf("%s:%s", h.smtpHost, h.smtpPort)
+	auth := smtp.PlainAuth("", h.smtpUser, h.smtpPass, h.smtpHost)
+
+	if err := smtp.SendMail(smtpAddr, auth, h.smtpFrom, []string{toEmail}, []byte(msg)); err != nil {
+		log.Printf("error sending email to %s: %v", toEmail, err)
+		return SendMsgResponse{
+			Status: "error",
+			Error:  "failed to send email: " + err.Error(),
+		}
 	}
 
-	h.writeJSON(w, http.StatusOK, result)
+	return SendMsgResponse{
+		Status:    "success",
+		MessageID: fmt.Sprintf("email-%s", toEmail),
+	}
 }
 
-func (h *Handler) handleDeleteMessage(w http.ResponseWriter, r *http.Request) {
-	if h.gotify == nil {
-		h.writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "Gotify not configured"})
-		return
+// sendSMS sends an SMS via configured provider.
+// Placeholder: integrate with Twilio, AWS SNS, or similar.
+func (h *Handler) sendSMS(req SendMsgRequest) SendMsgResponse {
+	phone := req.Extras["phone"]
+	if phone == "" {
+		return SendMsgResponse{
+			Status: "error",
+			Error:  "missing phone in extras",
+		}
 	}
 
-	var req struct {
-		ID int `json:"id"`
+	// TODO: Implement SMS provider integration (Twilio, AWS SNS, etc.)
+	// For now, return error
+	return SendMsgResponse{
+		Status: "error",
+		Error:  "SMS not implemented yet",
 	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		h.writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request: " + err.Error()})
-		return
-	}
-
-	if req.ID == 0 {
-		h.writeJSON(w, http.StatusBadRequest, map[string]string{"error": "missing 'id' field"})
-		return
-	}
-
-	if err := h.gotify.DeleteMessage(req.ID); err != nil {
-		log.Printf("error deleting gotify message %d: %v", req.ID, err)
-		h.writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
-		return
-	}
-
-	h.writeJSON(w, http.StatusOK, map[string]string{"status": "deleted"})
-}
-
-func (h *Handler) handleDeleteAllMessages(w http.ResponseWriter, r *http.Request) {
-	if h.gotify == nil {
-		h.writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "Gotify not configured"})
-		return
-	}
-
-	if err := h.gotify.DeleteAllMessages(); err != nil {
-		log.Printf("error deleting all gotify messages: %v", err)
-		h.writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
-		return
-	}
-
-	h.writeJSON(w, http.StatusOK, map[string]string{"status": "all messages deleted"})
-}
-
-// --- Gotify Applications ---
-
-func (h *Handler) handleListApplications(w http.ResponseWriter, r *http.Request) {
-	if h.gotify == nil {
-		h.writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "Gotify not configured"})
-		return
-	}
-
-	result, err := h.gotify.ListApplications()
-	if err != nil {
-		log.Printf("error listing gotify applications: %v", err)
-		h.writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
-		return
-	}
-
-	h.writeJSON(w, http.StatusOK, result)
-}
-
-func (h *Handler) handleCreateApplication(w http.ResponseWriter, r *http.Request) {
-	if h.gotify == nil {
-		h.writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "Gotify not configured"})
-		return
-	}
-
-	var app GotifyApplication
-	if err := json.NewDecoder(r.Body).Decode(&app); err != nil {
-		h.writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request: " + err.Error()})
-		return
-	}
-
-	result, err := h.gotify.CreateApplication(app)
-	if err != nil {
-		log.Printf("error creating gotify application: %v", err)
-		h.writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
-		return
-	}
-
-	h.writeJSON(w, http.StatusCreated, result)
-}
-
-func (h *Handler) handleDeleteApplication(w http.ResponseWriter, r *http.Request) {
-	if h.gotify == nil {
-		h.writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "Gotify not configured"})
-		return
-	}
-
-	var req struct {
-		ID int `json:"id"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		h.writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request: " + err.Error()})
-		return
-	}
-
-	if req.ID == 0 {
-		h.writeJSON(w, http.StatusBadRequest, map[string]string{"error": "missing 'id' field"})
-		return
-	}
-
-	if err := h.gotify.DeleteApplication(req.ID); err != nil {
-		log.Printf("error deleting gotify application %d: %v", req.ID, err)
-		h.writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
-		return
-	}
-
-	h.writeJSON(w, http.StatusOK, map[string]string{"status": "deleted"})
-}
-
-// --- Helpers ---
-
-func (h *Handler) writeJSON(w http.ResponseWriter, status int, data interface{}) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	json.NewEncoder(w).Encode(data)
 }

internal/notification/handler_test.go

@@ -1,513 +0,0 @@
-package notification
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// mockGotifyServer creates a test server that simulates the Gotify API.
-func mockGotifyServer() *httptest.Server {
-	mux := http.NewServeMux()
-
-	// POST /message — send message
-	mux.HandleFunc("/message", func(w http.ResponseWriter, r *http.Request) {
-		switch r.Method {
-		case http.MethodPost:
-			var msg GotifyMessage
-			if err := json.NewDecoder(r.Body).Decode(&msg); err != nil {
-				http.Error(w, "bad request", http.StatusBadRequest)
-				return
-			}
-			msg.ID = 42
-			msg.AppID = 1
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode(msg)
-
-		case http.MethodGet:
-			// list messages
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode(GotifyMessageList{
-				Messages: []GotifyMessage{
-					{ID: 1, Title: "Test", Message: "hello", Priority: 3},
-					{ID: 2, Title: "Alert", Message: "world", Priority: 7},
-				},
-				Paging: GotifyPaging{Size: 2, Limit: 50},
-			})
-
-		case http.MethodDelete:
-			// delete all messages
-			w.WriteHeader(http.StatusOK)
-			json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
-
-		default:
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		}
-	})
-
-	// DELETE /message/{id}
-	mux.HandleFunc("/message/", func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodDelete {
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-		json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
-	})
-
-	// GET/POST/DELETE /application
-	mux.HandleFunc("/application", func(w http.ResponseWriter, r *http.Request) {
-		switch r.Method {
-		case http.MethodGet:
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode([]GotifyApplication{
-				{ID: 1, Name: "app1", Token: "tok1"},
-				{ID: 2, Name: "app2", Token: "tok2"},
-			})
-
-		case http.MethodPost:
-			var app GotifyApplication
-			if err := json.NewDecoder(r.Body).Decode(&app); err != nil {
-				http.Error(w, "bad request", http.StatusBadRequest)
-				return
-			}
-			app.ID = 10
-			app.Token = "new-token"
-			w.WriteHeader(http.StatusCreated)
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode(app)
-
-		default:
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		}
-	})
-
-	// DELETE /application/{id}
-	mux.HandleFunc("/application/", func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodDelete {
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-		json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
-	})
-
-	return httptest.NewServer(mux)
-}
-
-func newTestHandler(gotifyURL string) *Handler {
-	h := &Handler{}
-	if gotifyURL != "" {
-		h.gotify = NewGotifyClient(gotifyURL, "test-app-token", "test-client-token")
-	}
-	return h
-}
-
-func doRequest(h *Handler, method, resource string, body interface{}) *httptest.ResponseRecorder {
-	var reqBody io.Reader
-	if body != nil {
-		b, _ := json.Marshal(body)
-		reqBody = bytes.NewReader(b)
-	}
-
-	req := httptest.NewRequest(method, "/", reqBody)
-	req.Header.Set("X-Resource", resource)
-	if body != nil {
-		req.Header.Set("Content-Type", "application/json")
-	}
-	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
-	return w
-}
-
-func decodeResponse(t *testing.T, w *httptest.ResponseRecorder) map[string]interface{} {
-	t.Helper()
-	var result map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
-		t.Fatalf("decode response: %v (body: %s)", err, w.Body.String())
-	}
-	return result
-}
-
-// ============================================================
-// Handler routing tests
-// ============================================================
-
-func TestHandler_UnknownResource(t *testing.T) {
-	h := newTestHandler("")
-	w := doRequest(h, "GET", "unknown-resource", nil)
-	if w.Code != http.StatusNotFound {
-		t.Errorf("expected 404, got %d", w.Code)
-	}
-	data := decodeResponse(t, w)
-	if _, ok := data["error"]; !ok {
-		t.Error("expected error in response")
-	}
-}
-
-func TestHandler_GotifyNotConfigured(t *testing.T) {
-	h := newTestHandler("") // no gotify
-
-	resources := []struct {
-		method   string
-		resource string
-		body     interface{}
-	}{
-		{"POST", "send-message", map[string]string{"title": "t", "message": "m"}},
-		{"GET", "list-messages", nil},
-		{"DELETE", "delete-message", map[string]int{"id": 1}},
-		{"DELETE", "delete-all-messages", nil},
-		{"GET", "list-applications", nil},
-		{"POST", "create-application", map[string]string{"name": "app"}},
-		{"DELETE", "delete-application", map[string]int{"id": 1}},
-	}
-
-	for _, tc := range resources {
-		t.Run(tc.resource, func(t *testing.T) {
-			w := doRequest(h, tc.method, tc.resource, tc.body)
-			if w.Code != http.StatusServiceUnavailable {
-				t.Errorf("expected 503, got %d", w.Code)
-			}
-		})
-	}
-}
-
-// ============================================================
-// Gotify message tests (via handler)
-// ============================================================
-
-func TestHandler_SendMessage(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "POST", "send-message", map[string]interface{}{
-		"title":    "Test Alert",
-		"message":  "Something happened",
-		"priority": 5,
-	})
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-
-	data := decodeResponse(t, w)
-	if data["title"] != "Test Alert" {
-		t.Errorf("expected title 'Test Alert', got %v", data["title"])
-	}
-	if int(data["id"].(float64)) != 42 {
-		t.Errorf("expected id 42, got %v", data["id"])
-	}
-}
-
-func TestHandler_SendMessage_InvalidJSON(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	req := httptest.NewRequest("POST", "/", bytes.NewReader([]byte("not json")))
-	req.Header.Set("X-Resource", "send-message")
-	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestHandler_ListMessages(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "GET", "list-messages", nil)
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-
-	var result GotifyMessageList
-	if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	if len(result.Messages) != 2 {
-		t.Errorf("expected 2 messages, got %d", len(result.Messages))
-	}
-}
-
-func TestHandler_DeleteMessage(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "DELETE", "delete-message", map[string]int{"id": 1})
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestHandler_DeleteMessage_MissingID(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "DELETE", "delete-message", map[string]int{"id": 0})
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestHandler_DeleteAllMessages(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "DELETE", "delete-all-messages", nil)
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-// ============================================================
-// Gotify application tests (via handler)
-// ============================================================
-
-func TestHandler_ListApplications(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "GET", "list-applications", nil)
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-
-	var apps []GotifyApplication
-	if err := json.Unmarshal(w.Body.Bytes(), &apps); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	if len(apps) != 2 {
-		t.Errorf("expected 2 apps, got %d", len(apps))
-	}
-}
-
-func TestHandler_CreateApplication(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "POST", "create-application", map[string]string{
-		"name":        "my-app",
-		"description": "test app",
-	})
-	if w.Code != http.StatusCreated {
-		t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-
-	data := decodeResponse(t, w)
-	if data["name"] != "my-app" {
-		t.Errorf("expected name 'my-app', got %v", data["name"])
-	}
-}
-
-func TestHandler_DeleteApplication(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "DELETE", "delete-application", map[string]int{"id": 1})
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestHandler_DeleteApplication_MissingID(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	h := newTestHandler(srv.URL)
-
-	w := doRequest(h, "DELETE", "delete-application", map[string]int{"id": 0})
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-// ============================================================
-// Email tests (routing only, no SMTP)
-// ============================================================
-
-func TestHandler_SendEmail_MissingTo(t *testing.T) {
-	h := newTestHandler("")
-
-	w := doRequest(h, "POST", "send-email", map[string]string{
-		"subject": "Test",
-		"body":    "Hello",
-	})
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestHandler_SendEmail_InvalidJSON(t *testing.T) {
-	h := newTestHandler("")
-
-	req := httptest.NewRequest("POST", "/", bytes.NewReader([]byte("{bad")))
-	req.Header.Set("X-Resource", "send-email")
-	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-// ============================================================
-// GotifyClient direct tests
-// ============================================================
-
-func TestGotifyClient_SendMessage(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	msg, err := client.SendMessage(GotifyMessage{
-		Title:    "Direct Test",
-		Message:  "Hello",
-		Priority: 3,
-	})
-	if err != nil {
-		t.Fatalf("send: %v", err)
-	}
-	if msg.ID != 42 {
-		t.Errorf("expected id 42, got %d", msg.ID)
-	}
-	if msg.Title != "Direct Test" {
-		t.Errorf("expected title 'Direct Test', got %s", msg.Title)
-	}
-}
-
-func TestGotifyClient_ListMessages(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	list, err := client.ListMessages(50)
-	if err != nil {
-		t.Fatalf("list: %v", err)
-	}
-	if len(list.Messages) != 2 {
-		t.Errorf("expected 2 messages, got %d", len(list.Messages))
-	}
-}
-
-func TestGotifyClient_DeleteMessage(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	if err := client.DeleteMessage(1); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-}
-
-func TestGotifyClient_DeleteAllMessages(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	if err := client.DeleteAllMessages(); err != nil {
-		t.Fatalf("delete all: %v", err)
-	}
-}
-
-func TestGotifyClient_ListApplications(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	apps, err := client.ListApplications()
-	if err != nil {
-		t.Fatalf("list: %v", err)
-	}
-	if len(apps) != 2 {
-		t.Errorf("expected 2 apps, got %d", len(apps))
-	}
-}
-
-func TestGotifyClient_CreateApplication(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	app, err := client.CreateApplication(GotifyApplication{
-		Name:        "new-app",
-		Description: "test",
-	})
-	if err != nil {
-		t.Fatalf("create: %v", err)
-	}
-	if app.ID != 10 {
-		t.Errorf("expected id 10, got %d", app.ID)
-	}
-}
-
-func TestGotifyClient_DeleteApplication(t *testing.T) {
-	srv := mockGotifyServer()
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	if err := client.DeleteApplication(1); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-}
-
-func TestGotifyClient_ErrorResponse(t *testing.T) {
-	// Server that returns 500 for everything
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusInternalServerError)
-		fmt.Fprint(w, "internal error")
-	}))
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	_, err := client.SendMessage(GotifyMessage{Title: "test"})
-	if err == nil {
-		t.Fatal("expected error")
-	}
-
-	_, err = client.ListMessages(10)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-
-	_, err = client.ListApplications()
-	if err == nil {
-		t.Fatal("expected error")
-	}
-}
-
-func TestGotifyClient_RateLimited(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusTooManyRequests)
-		fmt.Fprint(w, "rate limited")
-	}))
-	defer srv.Close()
-	client := NewGotifyClient(srv.URL, "app-token", "client-token")
-
-	_, err := client.SendMessage(GotifyMessage{Title: "test"})
-	if err == nil {
-		t.Fatal("expected error on 429")
-	}
-}
-
-func TestGotifyClient_InvalidURL(t *testing.T) {
-	client := NewGotifyClient("http://localhost:1", "app-token", "client-token")
-
-	_, err := client.SendMessage(GotifyMessage{Title: "test"})
-	if err == nil {
-		t.Fatal("expected connection error")
-	}
-}

internal/observability/handler.go

@@ -1,28 +0,0 @@
-package observability
-
-import (
-	"net/http"
-)
-
-// MetricsHandler serves Prometheus metrics
-type MetricsHandler struct {
-	exporter *PrometheusExporter
-}
-
-// NewMetricsHandler creates a new metrics handler
-func NewMetricsHandler(m *Metrics) *MetricsHandler {
-	return &MetricsHandler{
-		exporter: NewPrometheusExporter(m),
-	}
-}
-
-// ServeHTTP implements http.Handler for Prometheus /metrics endpoint
-func (h *MetricsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
-	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
-	w.Header().Set("Pragma", "no-cache")
-	w.Header().Set("Expires", "0")
-
-	w.WriteHeader(http.StatusOK)
-	w.Write([]byte(h.exporter.Export()))
-}

internal/observability/metrics.go

@@ -28,14 +28,6 @@ type Metrics struct {
 	// Streaming metrics
 	streamingResponsesTotal map[string]int64
 	streamingByteCount      map[string]int64
-
-	// LLM inference metrics (TTFT and ITL)
-	// ttftMs: Time-to-First-Token in milliseconds
-	ttftMs map[string][]int64 // samples for histogram
-	// itlMs: Inter-Token Latency in milliseconds
-	itlMs map[string][]int64 // samples for histogram
-	// Token counts
-	tokenCount map[string]int64
 }
 
 // NewMetrics creates a new Metrics instance.
@@ -49,9 +41,6 @@ func NewMetrics() *Metrics {
 		upstreamHealth:         make(map[string]int),
 		streamingResponsesTotal: make(map[string]int64),
 		streamingByteCount:     make(map[string]int64),
-		ttftMs:                 make(map[string][]int64),
-		itlMs:                  make(map[string][]int64),
-		tokenCount:             make(map[string]int64),
 	}
 }
 
@@ -157,113 +146,9 @@ func (m *Metrics) GetMetrics() map[string]interface{} {
 		"upstream_health":           m.upstreamHealth,
 		"streaming_responses_total": m.streamingResponsesTotal,
 		"streaming_byte_count":      m.streamingByteCount,
-		"llm_ttft_ms":               m.ttftMs,
-		"llm_itl_ms":                m.itlMs,
-		"llm_token_count":           m.tokenCount,
 	}
 }
 
-// RecordTTFT records Time-to-First-Token in milliseconds
-func (m *Metrics) RecordTTFT(model string, ttftMs int64) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	key := fmt.Sprintf("llm:ttft:%s", model)
-	m.ttftMs[key] = append(m.ttftMs[key], ttftMs)
-}
-
-// RecordITL records Inter-Token Latency in milliseconds
-func (m *Metrics) RecordITL(model string, itlMs int64) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	key := fmt.Sprintf("llm:itl:%s", model)
-	m.itlMs[key] = append(m.itlMs[key], itlMs)
-}
-
-// RecordTokenCount records number of tokens in response
-func (m *Metrics) RecordTokenCount(model string, count int64) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	key := fmt.Sprintf("llm:tokens:%s", model)
-	m.tokenCount[key] += count
-}
-
-// GetTTFTMetrics returns TTFT statistics for Prometheus export
-func (m *Metrics) GetTTFTMetrics() map[string]interface{} {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-
-	result := make(map[string]interface{})
-	for key, samples := range m.ttftMs {
-		if len(samples) > 0 {
-			result[key] = map[string]interface{}{
-				"count": len(samples),
-				"sum":   sumInt64(samples),
-				"avg":   sumInt64(samples) / int64(len(samples)),
-				"min":   minInt64(samples),
-				"max":   maxInt64(samples),
-			}
-		}
-	}
-	return result
-}
-
-// GetITLMetrics returns ITL statistics for Prometheus export
-func (m *Metrics) GetITLMetrics() map[string]interface{} {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-
-	result := make(map[string]interface{})
-	for key, samples := range m.itlMs {
-		if len(samples) > 0 {
-			result[key] = map[string]interface{}{
-				"count": len(samples),
-				"sum":   sumInt64(samples),
-				"avg":   sumInt64(samples) / int64(len(samples)),
-				"min":   minInt64(samples),
-				"max":   maxInt64(samples),
-			}
-		}
-	}
-	return result
-}
-
-func sumInt64(vals []int64) int64 {
-	var s int64
-	for _, v := range vals {
-		s += v
-	}
-	return s
-}
-
-func minInt64(vals []int64) int64 {
-	if len(vals) == 0 {
-		return 0
-	}
-	min := vals[0]
-	for _, v := range vals {
-		if v < min {
-			min = v
-		}
-	}
-	return min
-}
-
-func maxInt64(vals []int64) int64 {
-	if len(vals) == 0 {
-		return 0
-	}
-	max := vals[0]
-	for _, v := range vals {
-		if v > max {
-			max = v
-		}
-	}
-	return max
-}
-
 // Reset clears all metrics (for testing).
 func (m *Metrics) Reset() {
 	m.mu.Lock()
@@ -277,7 +162,4 @@ func (m *Metrics) Reset() {
 	m.upstreamHealth = make(map[string]int)
 	m.streamingResponsesTotal = make(map[string]int64)
 	m.streamingByteCount = make(map[string]int64)
-	m.ttftMs = make(map[string][]int64)
-	m.itlMs = make(map[string][]int64)
-	m.tokenCount = make(map[string]int64)
 }

internal/observability/prometheus.go

@@ -1,198 +0,0 @@
-package observability
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-)
-
-// PrometheusExporter exports metrics in Prometheus text format
-type PrometheusExporter struct {
-	metrics *Metrics
-}
-
-// NewPrometheusExporter creates a new Prometheus exporter
-func NewPrometheusExporter(m *Metrics) *PrometheusExporter {
-	return &PrometheusExporter{metrics: m}
-}
-
-// Export returns metrics in Prometheus text format
-func (p *PrometheusExporter) Export() string {
-	var lines []string
-
-	lines = append(lines, "# HELP llm_ttft_seconds Time to first token for LLM inference (seconds)")
-	lines = append(lines, "# TYPE llm_ttft_seconds histogram")
-	p.exportTTFT(&lines)
-
-	lines = append(lines, "# HELP llm_itl_seconds Inter-token latency for LLM inference (seconds)")
-	lines = append(lines, "# TYPE llm_itl_seconds histogram")
-	p.exportITL(&lines)
-
-	lines = append(lines, "# HELP llm_tokens_total Total tokens generated")
-	lines = append(lines, "# TYPE llm_tokens_total counter")
-	p.exportTokens(&lines)
-
-	lines = append(lines, "# HELP request_duration_seconds Request latency")
-	lines = append(lines, "# TYPE request_duration_seconds histogram")
-	p.exportRequestDuration(&lines)
-
-	return strings.Join(lines, "\n") + "\n"
-}
-
-func (p *PrometheusExporter) exportTTFT(lines *[]string) {
-	p.metrics.mu.RLock()
-	defer p.metrics.mu.RUnlock()
-
-	// Calculate statistics for each model
-	for key, samples := range p.metrics.ttftMs {
-		if len(samples) == 0 {
-			continue
-		}
-
-		model := extractModel(key)
-		sum := sumInt64(samples)
-
-		// Export histogram buckets (in seconds)
-		buckets := []float64{0.001, 0.01, 0.05, 0.1, 0.5, 1.0, 5.0}
-		for _, bucket := range buckets {
-			count := countLessOrEqual(samples, int64(bucket*1000))
-			*lines = append(*lines, fmt.Sprintf(
-				`llm_ttft_seconds_bucket{model="%s",le="%.3f"} %d`,
-				model, bucket, count,
-			))
-		}
-
-		*lines = append(*lines, fmt.Sprintf(
-			`llm_ttft_seconds_bucket{model="%s",le="+Inf"} %d`,
-			model, len(samples),
-		))
-		*lines = append(*lines, fmt.Sprintf(
-			`llm_ttft_seconds_sum{model="%s"} %.3f`,
-			model, float64(sum)/1000,
-		))
-		*lines = append(*lines, fmt.Sprintf(
-			`llm_ttft_seconds_count{model="%s"} %d`,
-			model, len(samples),
-		))
-	}
-}
-
-func (p *PrometheusExporter) exportITL(lines *[]string) {
-	p.metrics.mu.RLock()
-	defer p.metrics.mu.RUnlock()
-
-	for key, samples := range p.metrics.itlMs {
-		if len(samples) == 0 {
-			continue
-		}
-
-		model := extractModel(key)
-		sum := sumInt64(samples)
-
-		// Export histogram buckets (in seconds)
-		buckets := []float64{0.001, 0.01, 0.05, 0.1, 0.5, 1.0, 5.0}
-		for _, bucket := range buckets {
-			count := countLessOrEqual(samples, int64(bucket*1000))
-			*lines = append(*lines, fmt.Sprintf(
-				`llm_itl_seconds_bucket{model="%s",le="%.3f"} %d`,
-				model, bucket, count,
-			))
-		}
-
-		*lines = append(*lines, fmt.Sprintf(
-			`llm_itl_seconds_bucket{model="%s",le="+Inf"} %d`,
-			model, len(samples),
-		))
-		*lines = append(*lines, fmt.Sprintf(
-			`llm_itl_seconds_sum{model="%s"} %.3f`,
-			model, float64(sum)/1000,
-		))
-		*lines = append(*lines, fmt.Sprintf(
-			`llm_itl_seconds_count{model="%s"} %d`,
-			model, len(samples),
-		))
-	}
-}
-
-func (p *PrometheusExporter) exportTokens(lines *[]string) {
-	p.metrics.mu.RLock()
-	defer p.metrics.mu.RUnlock()
-
-	// Sort keys for consistent output
-	var keys []string
-	for k := range p.metrics.tokenCount {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-
-	for _, key := range keys {
-		model := extractModel(key)
-		count := p.metrics.tokenCount[key]
-		*lines = append(*lines, fmt.Sprintf(
-			`llm_tokens_total{model="%s"} %d`,
-			model, count,
-		))
-	}
-}
-
-func (p *PrometheusExporter) exportRequestDuration(lines *[]string) {
-	p.metrics.mu.RLock()
-	defer p.metrics.mu.RUnlock()
-
-	// Sort keys for consistent output
-	var keys []string
-	for k := range p.metrics.requestDuration {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-
-	for _, key := range keys {
-		route, upstream := parseKey(key)
-		totalMs := p.metrics.requestDuration[key]
-		count := int64(1) // We'd need to track count separately in real impl
-
-		if buckets, ok := p.metrics.requestDurationBuckets[key]; ok {
-			for bucket := range buckets {
-				*lines = append(*lines, fmt.Sprintf(
-					`request_duration_seconds_bucket{route="%s",upstream="%s",le="%.1f"} %d`,
-					route, upstream, bucket, buckets[bucket],
-				))
-			}
-		}
-
-		*lines = append(*lines, fmt.Sprintf(
-			`request_duration_seconds_sum{route="%s",upstream="%s"} %.3f`,
-			route, upstream, float64(totalMs)/1000,
-		))
-		*lines = append(*lines, fmt.Sprintf(
-			`request_duration_seconds_count{route="%s",upstream="%s"} %d`,
-			route, upstream, count,
-		))
-	}
-}
-
-func extractModel(key string) string {
-	parts := strings.Split(key, ":")
-	if len(parts) >= 3 {
-		return parts[2]
-	}
-	return key
-}
-
-func parseKey(key string) (string, string) {
-	parts := strings.Split(key, ":")
-	if len(parts) >= 2 {
-		return parts[0], parts[1]
-	}
-	return key, ""
-}
-
-func countLessOrEqual(samples []int64, threshold int64) int {
-	count := 0
-	for _, s := range samples {
-		if s <= threshold {
-			count++
-		}
-	}
-	return count
-}

internal/proxy/bodydispatch_test.go

@@ -381,66 +381,3 @@ func TestBodySizeCappedDispatch(t *testing.T) {
 		t.Errorf("expected 200 for reasonable body, got %d", resp.StatusCode)
 	}
 }
-
-// TestUpstreamModelRewrite verifies that the model field is rewritten when upstreamModel is set.
-func TestUpstreamModelRewrite(t *testing.T) {
-	var receivedModel string
-
-	upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, _ := io.ReadAll(r.Body)
-		var payload map[string]interface{}
-		json.Unmarshal(body, &payload)
-		receivedModel = payload["model"].(string)
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		fmt.Fprint(w, `{}`)
-	}))
-	defer upstreamServer.Close()
-
-	upstreamAddr := strings.TrimPrefix(upstreamServer.URL, "http://")
-
-	cfg := &config.Config{
-		Models: map[string]*config.ModelUpstream{
-			// Client sends "ornith:35b", upstream expects "qwen2.5:72b-instruct"
-			"ornith:35b": {
-				Name:          "ornith:35b",
-				Address:       upstreamAddr,
-				UpstreamModel: "qwen2.5:72b-instruct",
-			},
-			// No rewrite - upstream model same as client model
-			"reasoning": {
-				Name:    "reasoning",
-				Address: upstreamAddr,
-			},
-		},
-		Routes: make(map[string]*config.Route),
-	}
-
-	handler := New(cfg)
-	defer handler.Close()
-
-	server := httptest.NewServer(handler)
-	defer server.Close()
-
-	// Test 1: Model should be rewritten
-	requestBody := `{"model":"ornith:35b","messages":[{"role":"user","content":"hi"}]}`
-	resp, err := http.Post(server.URL+"/v1/chat/completions", "application/json", strings.NewReader(requestBody))
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	resp.Body.Close()
-
-	if receivedModel != "qwen2.5:72b-instruct" {
-		t.Errorf("expected upstream to receive model 'qwen2.5:72b-instruct', got '%s'", receivedModel)
-	}
-
-	// Test 2: No rewrite when upstreamModel is empty
-	receivedModel = ""
-	requestBody = `{"model":"reasoning","messages":[{"role":"user","content":"hi"}]}`
-	resp, _ = http.Post(server.URL+"/v1/chat/completions", "application/json", strings.NewReader(requestBody))
-	resp.Body.Close()
-
-	if receivedModel != "reasoning" {
-		t.Errorf("expected upstream to receive model 'reasoning', got '%s'", receivedModel)
-	}
-}

internal/proxy/llm_metrics.go

@@ -1,153 +0,0 @@
-package proxy
-
-import (
-	"bufio"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"strings"
-	"time"
-
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/observability"
-)
-
-// LLMMetricsCapture wraps a response writer to capture TTFT and ITL metrics
-type LLMMetricsCapture struct {
-	writer              io.WriteCloser
-	model               string
-	metrics             *observability.Metrics
-	firstTokenTime      time.Time
-	lastTokenTime       time.Time
-	requestStartTime    time.Time
-	ttftRecorded        bool
-	tokenCount          int64
-	responseStartTime   time.Time
-}
-
-// NewLLMMetricsCapture creates a new metrics capture wrapper
-func NewLLMMetricsCapture(writer io.WriteCloser, model string, metrics *observability.Metrics, startTime time.Time) *LLMMetricsCapture {
-	return &LLMMetricsCapture{
-		writer:            writer,
-		model:             model,
-		metrics:           metrics,
-		requestStartTime:  startTime,
-		responseStartTime: time.Now(),
-	}
-}
-
-// Write intercepts writes to detect tokens and record metrics
-func (c *LLMMetricsCapture) Write(p []byte) (int, error) {
-	// Record first token time
-	if !c.ttftRecorded && len(p) > 0 {
-		now := time.Now()
-		ttft := now.Sub(c.requestStartTime).Milliseconds()
-		c.metrics.RecordTTFT(c.model, ttft)
-		c.ttftRecorded = true
-		c.firstTokenTime = now
-		c.lastTokenTime = now
-	}
-
-	// Count tokens in SSE stream (simple: count "data: " lines)
-	if c.ttftRecorded {
-		tokenCount := strings.Count(string(p), "data: ")
-		if tokenCount > 0 {
-			now := time.Now()
-			if !c.firstTokenTime.IsZero() && c.lastTokenTime != now {
-				itl := now.Sub(c.lastTokenTime).Milliseconds()
-				c.metrics.RecordITL(c.model, itl)
-			}
-			c.lastTokenTime = now
-			c.tokenCount += int64(tokenCount)
-		}
-	}
-
-	return c.writer.Write(p)
-}
-
-// Close records final metrics and closes writer
-func (c *LLMMetricsCapture) Close() error {
-	if c.tokenCount > 0 {
-		c.metrics.RecordTokenCount(c.model, c.tokenCount)
-	}
-	return c.writer.Close()
-}
-
-// ResponseWriterWrapper wraps http.ResponseWriter to capture metrics
-type ResponseWriterWrapper struct {
-	writer          http.ResponseWriter
-	statusCode      int
-	metrics         *observability.Metrics
-	model           string
-	startTime       time.Time
-	firstByteTime   time.Time
-	lastWriteTime   time.Time
-	ttftRecorded    bool
-}
-
-// NewResponseWriterWrapper creates a wrapper for response writer
-func NewResponseWriterWrapper(w http.ResponseWriter, model string, metrics *observability.Metrics, startTime time.Time) *ResponseWriterWrapper {
-	return &ResponseWriterWrapper{
-		writer:      w,
-		model:       model,
-		metrics:     metrics,
-		startTime:   startTime,
-		statusCode:  200,
-	}
-}
-
-// Header implements http.ResponseWriter
-func (w *ResponseWriterWrapper) Header() http.Header {
-	return w.writer.Header()
-}
-
-// Write implements http.ResponseWriter
-func (w *ResponseWriterWrapper) Write(b []byte) (int, error) {
-	// Record TTFT on first write
-	if !w.ttftRecorded && len(b) > 0 {
-		now := time.Now()
-		ttft := now.Sub(w.startTime).Milliseconds()
-		w.metrics.RecordTTFT(w.model, ttft)
-		w.ttftRecorded = true
-		w.firstByteTime = now
-		w.lastWriteTime = now
-	}
-
-	// Record ITL for subsequent writes (for streaming)
-	if w.ttftRecorded && len(b) > 0 {
-		now := time.Now()
-		if !w.firstByteTime.IsZero() && w.lastWriteTime != now {
-			itl := now.Sub(w.lastWriteTime).Milliseconds()
-			// Only record if ITL > 0 (avoid recording same millisecond twice)
-			if itl > 0 {
-				w.metrics.RecordITL(w.model, itl)
-			}
-		}
-		w.lastWriteTime = now
-	}
-
-	return w.writer.Write(b)
-}
-
-// WriteHeader implements http.ResponseWriter
-func (w *ResponseWriterWrapper) WriteHeader(statusCode int) {
-	w.statusCode = statusCode
-	w.writer.WriteHeader(statusCode)
-}
-
-// Flush implements http.Flusher
-func (w *ResponseWriterWrapper) Flush() {
-	if flusher, ok := w.writer.(http.Flusher); ok {
-		flusher.Flush()
-	}
-}
-
-// Hijack implements http.Hijacker for streaming
-func (w *ResponseWriterWrapper) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	if hijacker, ok := w.writer.(http.Hijacker); ok {
-		return hijacker.Hijack()
-	}
-	return nil, nil, fmt.Errorf("response writer does not implement Hijacker")
-}
-
-

internal/proxy/proxy.go

@@ -271,8 +271,13 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Try to find a matching route (including body-based dispatch for /v1/chat/completions).
-	// Note: /workflows endpoint is deprecated. Use X-Service: workflow + X-Resource headers instead.
+	// Handle /workflows endpoint (workflow orchestration)
+	if r.URL.Path == "/workflows" {
+		h.handleWorkflow(w, r)
+		return
+	}
+
+	// Try to find a matching route (including body-based dispatch for /v1/chat/completions)
 	route, err := h.RouteRequest(r)
 
 	// Check if this is a model validation error (from body-based dispatch)

internal/proxy/router.go

@@ -122,20 +122,6 @@ func (h *Handler) routeByModel(r *http.Request, path string) (*Route, error) {
 		}
 	}
 
-	// If upstream expects a different model name, rewrite the body
-	if modelUpstream.UpstreamModel != "" && modelUpstream.UpstreamModel != modelName {
-		payload["model"] = modelUpstream.UpstreamModel
-		newBody, err := json.Marshal(payload)
-		if err != nil {
-			return nil, &modelValidationError{
-				Kind:    "invalid_request",
-				Message: fmt.Sprintf("failed to rewrite model name: %v", err),
-			}
-		}
-		r.Body = io.NopCloser(bytes.NewReader(newBody))
-		r.ContentLength = int64(len(newBody))
-	}
-
 	// Determine the upstream path based on the request path
 	upstreamPath := path
 	if path == "/v1/rerank" {

internal/proxy/workflows.go

@@ -0,0 +1,484 @@
+// Package proxy provides request routing and forwarding.
+package proxy
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+// WorkflowRequest represents a workflow execution request
+type WorkflowRequest struct {
+	// Workflow ID or name
+	Workflow string `json:"workflow"`
+	
+	// Input parameters for the workflow
+	Input map[string]interface{} `json:"input"`
+	
+	// Optional: timeout in seconds
+	Timeout int `json:"timeout,omitempty"`
+	
+	// Optional: wait for result (default: true)
+	Wait *bool `json:"wait,omitempty"`
+}
+
+// WorkflowResponse represents the response from workflow execution
+type WorkflowResponse struct {
+	// Workflow execution ID
+	ID string `json:"id"`
+	
+	// Workflow name
+	Workflow string `json:"workflow"`
+	
+	// Execution status: pending, running, completed, failed
+	Status string `json:"status"`
+	
+	// Output of the workflow
+	Output interface{} `json:"output,omitempty"`
+	
+	// Error message if workflow failed
+	Error string `json:"error,omitempty"`
+	
+	// Timestamp when workflow was created
+	CreatedAt time.Time `json:"created_at"`
+	
+	// Timestamp when workflow completed
+	CompletedAt *time.Time `json:"completed_at,omitempty"`
+}
+
+// PredefinedWorkflow defines a workflow template that combines multiple API calls
+type PredefinedWorkflow struct {
+	Name        string
+	Description string
+	Handler     func(*http.Request, *Handler, map[string]interface{}) (interface{}, error)
+}
+
+// handleWorkflow handles the /workflows endpoint
+// It accepts workflow definitions and orchestrates API calls
+func (h *Handler) handleWorkflow(w http.ResponseWriter, r *http.Request) {
+	// Only POST is supported
+	if r.Method != "POST" {
+		w.Header().Set("Content-Type", "application/problem+json")
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		fmt.Fprintf(w, `{"type":"https://api.example.com/problems/method-not-allowed","title":"Method Not Allowed","status":405,"detail":"Only POST is supported for /workflows"}`)
+		return
+	}
+
+	// Parse request body
+	var workflowReq WorkflowRequest
+	if err := json.NewDecoder(r.Body).Decode(&workflowReq); err != nil {
+		writeProblemDetail(w, http.StatusBadRequest, "https://api.example.com/problems/invalid-workflow-request", "Invalid Workflow Request", "Failed to parse workflow request: "+err.Error(), nil)
+		return
+	}
+
+	// Validate workflow name
+	if workflowReq.Workflow == "" {
+		writeProblemDetail(w, http.StatusBadRequest, "https://api.example.com/problems/missing-workflow", "Missing Workflow", "The 'workflow' field is required", nil)
+		return
+	}
+
+	// Get predefined workflow
+	workflow, ok := h.getWorkflow(workflowReq.Workflow)
+	if !ok {
+		availableWorkflows := h.getAvailableWorkflows()
+		writeProblemDetail(w, http.StatusBadRequest, "https://api.example.com/problems/unknown-workflow", "Unknown Workflow", fmt.Sprintf("Workflow %q is not available", workflowReq.Workflow), availableWorkflows)
+		return
+	}
+
+	// Default wait to true
+	wait := true
+	if workflowReq.Wait != nil {
+		wait = *workflowReq.Wait
+	}
+
+	// Set default timeout if not provided
+	timeout := time.Duration(30) * time.Second
+	if workflowReq.Timeout > 0 {
+		timeout = time.Duration(workflowReq.Timeout) * time.Second
+	}
+
+	// Create a context with timeout for workflow execution
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	// Execute workflow
+	output, err := workflow.Handler(r.WithContext(ctx), h, workflowReq.Input)
+
+	// Build response
+	workflowResp := WorkflowResponse{
+		ID:        generateWorkflowID(),
+		Workflow:  workflowReq.Workflow,
+		CreatedAt: time.Now(),
+	}
+
+	if err != nil {
+		workflowResp.Status = "failed"
+		workflowResp.Error = err.Error()
+	} else {
+		if wait {
+			workflowResp.Status = "completed"
+			workflowResp.Output = output
+			now := time.Now()
+			workflowResp.CompletedAt = &now
+		} else {
+			workflowResp.Status = "pending"
+		}
+	}
+
+	// Write response
+	w.Header().Set("Content-Type", "application/json")
+	if err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+	} else {
+		w.WriteHeader(http.StatusOK)
+	}
+	json.NewEncoder(w).Encode(workflowResp)
+}
+
+// getWorkflow returns a predefined workflow by name
+func (h *Handler) getWorkflow(name string) (*PredefinedWorkflow, bool) {
+	workflows := h.getPredefinedWorkflows()
+	for _, wf := range workflows {
+		if wf.Name == name {
+			return &wf, true
+		}
+	}
+	return nil, false
+}
+
+// getPredefinedWorkflows returns all available workflows
+func (h *Handler) getPredefinedWorkflows() []PredefinedWorkflow {
+	return []PredefinedWorkflow{
+		{
+			Name:        "chat-and-embed",
+			Description: "Chat with a model and then embed the response",
+			Handler:     h.chatAndEmbedWorkflow,
+		},
+		{
+			Name:        "multi-model-chat",
+			Description: "Chat with multiple models sequentially",
+			Handler:     h.multiModelChatWorkflow,
+		},
+		{
+			Name:        "rag-pipeline",
+			Description: "RAG pipeline: embed query, rerank, then chat with context",
+			Handler:     h.ragPipelineWorkflow,
+		},
+		{
+			Name:        "batch-embeddings",
+			Description: "Generate embeddings for multiple texts",
+			Handler:     h.batchEmbeddingsWorkflow,
+		},
+	}
+}
+
+// getAvailableWorkflows returns a list of available workflow names
+func (h *Handler) getAvailableWorkflows() []string {
+	workflows := h.getPredefinedWorkflows()
+	names := make([]string, len(workflows))
+	for i, wf := range workflows {
+		names[i] = wf.Name
+	}
+	return names
+}
+
+// Workflow implementations
+
+// chatAndEmbedWorkflow: Chat with a model, then embed the response
+func (h *Handler) chatAndEmbedWorkflow(r *http.Request, handler *Handler, input map[string]interface{}) (interface{}, error) {
+	model, ok := input["model"].(string)
+	if !ok || model == "" {
+		return nil, fmt.Errorf("missing required parameter: model")
+	}
+
+	embedModel, ok := input["embed_model"].(string)
+	if !ok {
+		embedModel = "nomic-ai/nomic-embed-text-v2-moe"
+	}
+
+	messages, ok := input["messages"].([]interface{})
+	if !ok {
+		return nil, fmt.Errorf("missing required parameter: messages")
+	}
+
+	// Step 1: Chat
+	chatReq := map[string]interface{}{
+		"model":    model,
+		"messages": messages,
+	}
+
+	chatBody, _ := json.Marshal(chatReq)
+	chatHTTPReq, _ := http.NewRequest("POST", "/v1/chat/completions", io.NopCloser(bytes.NewReader(chatBody)))
+	chatHTTPReq.Header.Set("Content-Type", "application/json")
+
+	// Create a response writer to capture the chat response
+	chatResp := &responseCapture{}
+	handler.ServeHTTP(chatResp, chatHTTPReq)
+
+	var chatResult map[string]interface{}
+	if err := json.Unmarshal(chatResp.body.Bytes(), &chatResult); err != nil {
+		return nil, fmt.Errorf("failed to parse chat response: %v", err)
+	}
+
+	// Extract message content
+	var messageContent string
+	if choices, ok := chatResult["choices"].([]interface{}); ok && len(choices) > 0 {
+		if choice, ok := choices[0].(map[string]interface{}); ok {
+			if message, ok := choice["message"].(map[string]interface{}); ok {
+				if content, ok := message["content"].(string); ok {
+					messageContent = content
+				}
+			}
+		}
+	}
+
+	// Step 2: Embed the response
+	embedReq := map[string]interface{}{
+		"model": embedModel,
+		"input": messageContent,
+	}
+
+	embedBody, _ := json.Marshal(embedReq)
+	embedHTTPReq, _ := http.NewRequest("POST", "/v1/embeddings", io.NopCloser(bytes.NewReader(embedBody)))
+	embedHTTPReq.Header.Set("Content-Type", "application/json")
+
+	embedResp := &responseCapture{}
+	handler.ServeHTTP(embedResp, embedHTTPReq)
+
+	var embedResult map[string]interface{}
+	if err := json.Unmarshal(embedResp.body.Bytes(), &embedResult); err != nil {
+		return nil, fmt.Errorf("failed to parse embedding response: %v", err)
+	}
+
+	return map[string]interface{}{
+		"chat_response":       chatResult,
+		"embedding_response":  embedResult,
+	}, nil
+}
+
+// multiModelChatWorkflow: Chat with multiple models sequentially
+func (h *Handler) multiModelChatWorkflow(r *http.Request, handler *Handler, input map[string]interface{}) (interface{}, error) {
+	models, ok := input["models"].([]interface{})
+	if !ok || len(models) == 0 {
+		return nil, fmt.Errorf("missing required parameter: models (array)")
+	}
+
+	messages, ok := input["messages"].([]interface{})
+	if !ok {
+		return nil, fmt.Errorf("missing required parameter: messages")
+	}
+
+	results := make([]map[string]interface{}, 0)
+
+	for _, modelInterface := range models {
+		model, ok := modelInterface.(string)
+		if !ok {
+			continue
+		}
+
+		chatReq := map[string]interface{}{
+			"model":    model,
+			"messages": messages,
+		}
+
+		chatBody, _ := json.Marshal(chatReq)
+		chatHTTPReq, _ := http.NewRequest("POST", "/v1/chat/completions", io.NopCloser(bytes.NewReader(chatBody)))
+		chatHTTPReq.Header.Set("Content-Type", "application/json")
+
+		chatResp := &responseCapture{}
+		handler.ServeHTTP(chatResp, chatHTTPReq)
+
+		var chatResult map[string]interface{}
+		if err := json.Unmarshal(chatResp.body.Bytes(), &chatResult); err != nil {
+			results = append(results, map[string]interface{}{
+				"model": model,
+				"error": err.Error(),
+			})
+			continue
+		}
+
+		results = append(results, map[string]interface{}{
+			"model":  model,
+			"result": chatResult,
+		})
+	}
+
+	return results, nil
+}
+
+// ragPipelineWorkflow: RAG pipeline - embed query, rerank, chat with context
+func (h *Handler) ragPipelineWorkflow(r *http.Request, handler *Handler, input map[string]interface{}) (interface{}, error) {
+	query, ok := input["query"].(string)
+	if !ok || query == "" {
+		return nil, fmt.Errorf("missing required parameter: query")
+	}
+
+	documents, ok := input["documents"].([]interface{})
+	if !ok {
+		return nil, fmt.Errorf("missing required parameter: documents")
+	}
+
+	model, ok := input["model"].(string)
+	if !ok {
+		model = "reasoning"
+	}
+
+	rerankModel, ok := input["rerank_model"].(string)
+	if !ok {
+		rerankModel = "BAAI/bge-reranker-base"
+	}
+
+	topK := 3
+	if tk, ok := input["top_k"].(float64); ok {
+		topK = int(tk)
+	}
+
+	// Step 1: Rerank documents based on query
+	rerankReq := map[string]interface{}{
+		"model": rerankModel,
+		"query": query,
+		"texts": documents,
+		"top_k": topK,
+	}
+
+	rerankBody, _ := json.Marshal(rerankReq)
+	rerankHTTPReq, _ := http.NewRequest("POST", "/v1/rerank", io.NopCloser(bytes.NewReader(rerankBody)))
+	rerankHTTPReq.Header.Set("Content-Type", "application/json")
+
+	rerankResp := &responseCapture{}
+	handler.ServeHTTP(rerankResp, rerankHTTPReq)
+
+	var rerankResult map[string]interface{}
+	if err := json.Unmarshal(rerankResp.body.Bytes(), &rerankResult); err != nil {
+		return nil, fmt.Errorf("failed to parse rerank response: %v", err)
+	}
+
+	// Extract top documents
+	var topDocs []string
+	if results, ok := rerankResult["results"].([]interface{}); ok {
+		for i, resultInterface := range results {
+			if i >= topK {
+				break
+			}
+			if result, ok := resultInterface.(map[string]interface{}); ok {
+				if text, ok := result["text"].(string); ok {
+					topDocs = append(topDocs, text)
+				}
+			}
+		}
+	}
+
+	// Step 2: Chat with context
+	context := fmt.Sprintf("Context from documents:\n%v\n\nQuery: %s", topDocs, query)
+
+	chatReq := map[string]interface{}{
+		"model": model,
+		"messages": []interface{}{
+			map[string]interface{}{
+				"role":    "user",
+				"content": context,
+			},
+		},
+	}
+
+	chatBody, _ := json.Marshal(chatReq)
+	chatHTTPReq, _ := http.NewRequest("POST", "/v1/chat/completions", io.NopCloser(bytes.NewReader(chatBody)))
+	chatHTTPReq.Header.Set("Content-Type", "application/json")
+
+	chatResp := &responseCapture{}
+	handler.ServeHTTP(chatResp, chatHTTPReq)
+
+	var chatResult map[string]interface{}
+	if err := json.Unmarshal(chatResp.body.Bytes(), &chatResult); err != nil {
+		return nil, fmt.Errorf("failed to parse chat response: %v", err)
+	}
+
+	return map[string]interface{}{
+		"reranked_documents": topDocs,
+		"chat_response":      chatResult,
+	}, nil
+}
+
+// batchEmbeddingsWorkflow: Generate embeddings for multiple texts
+func (h *Handler) batchEmbeddingsWorkflow(r *http.Request, handler *Handler, input map[string]interface{}) (interface{}, error) {
+	texts, ok := input["texts"].([]interface{})
+	if !ok || len(texts) == 0 {
+		return nil, fmt.Errorf("missing required parameter: texts (array)")
+	}
+
+	model, ok := input["model"].(string)
+	if !ok {
+		model = "nomic-ai/nomic-embed-text-v2-moe"
+	}
+
+	// Convert interface{} to []string
+	textStrings := make([]string, 0)
+	for _, t := range texts {
+		if str, ok := t.(string); ok {
+			textStrings = append(textStrings, str)
+		}
+	}
+
+	if len(textStrings) == 0 {
+		return nil, fmt.Errorf("no valid text strings in texts array")
+	}
+
+	embedReq := map[string]interface{}{
+		"model": model,
+		"input": textStrings,
+	}
+
+	embedBody, _ := json.Marshal(embedReq)
+	embedHTTPReq, _ := http.NewRequest("POST", "/v1/embeddings", io.NopCloser(bytes.NewReader(embedBody)))
+	embedHTTPReq.Header.Set("Content-Type", "application/json")
+
+	embedResp := &responseCapture{}
+	handler.ServeHTTP(embedResp, embedHTTPReq)
+
+	var embedResult map[string]interface{}
+	if err := json.Unmarshal(embedResp.body.Bytes(), &embedResult); err != nil {
+		return nil, fmt.Errorf("failed to parse embedding response: %v", err)
+	}
+
+	return embedResult, nil
+}
+
+// Utility functions
+
+// responseCapture captures HTTP response for reuse within workflows
+type responseCapture struct {
+	status int
+	header http.Header
+	body   bytes.Buffer
+}
+
+func (w *responseCapture) Header() http.Header {
+	if w.header == nil {
+		w.header = make(http.Header)
+	}
+	return w.header
+}
+
+func (w *responseCapture) Write(b []byte) (int, error) {
+	if w.status == 0 {
+		w.status = http.StatusOK
+	}
+	return w.body.Write(b)
+}
+
+func (w *responseCapture) WriteHeader(statusCode int) {
+	if w.status == 0 {
+		w.status = statusCode
+	}
+}
+
+// generateWorkflowID generates a unique workflow execution ID
+func generateWorkflowID() string {
+	return fmt.Sprintf("wf_%d", time.Now().UnixNano())
+}
+
+

internal/proxy/workflows_test.go

@@ -0,0 +1,258 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
+)
+
+func TestWorkflowEndpointNotFound(t *testing.T) {
+	// Create a minimal config
+	cfg := &config.Config{
+		Routes: make(map[string]*config.Route),
+		Models: map[string]*config.ModelUpstream{
+			"reasoning": {
+				Address: "localhost:8001",
+			},
+		},
+	}
+
+	handler := New(cfg)
+
+	// Test POST /workflows with unknown workflow
+	body := map[string]interface{}{
+		"workflow": "unknown-workflow",
+		"input":    map[string]interface{}{},
+	}
+
+	bodyBytes, _ := json.Marshal(body)
+	req := httptest.NewRequest("POST", "/workflows", bytes.NewReader(bodyBytes))
+	req.Header.Set("Content-Type", "application/json")
+
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected 400, got %d", w.Code)
+	}
+
+	var response map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &response)
+
+	if response["type"] != "https://api.example.com/problems/unknown-workflow" {
+		t.Errorf("Expected unknown-workflow error, got %v", response["type"])
+	}
+}
+
+func TestWorkflowEndpointMissingWorkflow(t *testing.T) {
+	cfg := &config.Config{
+		Routes: make(map[string]*config.Route),
+		Models: make(map[string]*config.ModelUpstream),
+	}
+
+	handler := New(cfg)
+
+	// Test POST /workflows with missing workflow field
+	body := map[string]interface{}{
+		"input": map[string]interface{}{},
+	}
+
+	bodyBytes, _ := json.Marshal(body)
+	req := httptest.NewRequest("POST", "/workflows", bytes.NewReader(bodyBytes))
+	req.Header.Set("Content-Type", "application/json")
+
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected 400, got %d", w.Code)
+	}
+
+	var response map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &response)
+
+	if response["type"] != "https://api.example.com/problems/missing-workflow" {
+		t.Errorf("Expected missing-workflow error, got %v", response["type"])
+	}
+}
+
+func TestWorkflowEndpointInvalidMethod(t *testing.T) {
+	cfg := &config.Config{
+		Routes: make(map[string]*config.Route),
+		Models: make(map[string]*config.ModelUpstream),
+	}
+
+	handler := New(cfg)
+
+	// Test GET /workflows (should be 405)
+	req := httptest.NewRequest("GET", "/workflows", nil)
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Errorf("Expected 405, got %d", w.Code)
+	}
+}
+
+func TestWorkflowEndpointInvalidJSON(t *testing.T) {
+	cfg := &config.Config{
+		Routes: make(map[string]*config.Route),
+		Models: make(map[string]*config.ModelUpstream),
+	}
+
+	handler := New(cfg)
+
+	// Test POST /workflows with invalid JSON
+	req := httptest.NewRequest("POST", "/workflows", bytes.NewReader([]byte("not json")))
+	req.Header.Set("Content-Type", "application/json")
+
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected 400, got %d", w.Code)
+	}
+}
+
+func TestGetAvailableWorkflows(t *testing.T) {
+	cfg := &config.Config{
+		Routes: make(map[string]*config.Route),
+		Models: make(map[string]*config.ModelUpstream),
+	}
+
+	handler := New(cfg)
+
+	workflows := handler.getAvailableWorkflows()
+
+	expectedWorkflows := []string{
+		"chat-and-embed",
+		"multi-model-chat",
+		"rag-pipeline",
+		"batch-embeddings",
+	}
+
+	if len(workflows) != len(expectedWorkflows) {
+		t.Errorf("Expected %d workflows, got %d", len(expectedWorkflows), len(workflows))
+	}
+
+	// Check that all expected workflows are present
+	for _, expected := range expectedWorkflows {
+		found := false
+		for _, actual := range workflows {
+			if actual == expected {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("Expected workflow %q not found", expected)
+		}
+	}
+}
+
+func TestGetWorkflow(t *testing.T) {
+	cfg := &config.Config{
+		Routes: make(map[string]*config.Route),
+		Models: make(map[string]*config.ModelUpstream),
+	}
+
+	handler := New(cfg)
+
+	// Test getting a valid workflow
+	workflow, ok := handler.getWorkflow("chat-and-embed")
+	if !ok {
+		t.Error("Expected to find chat-and-embed workflow")
+	}
+	if workflow.Name != "chat-and-embed" {
+		t.Errorf("Expected workflow name chat-and-embed, got %s", workflow.Name)
+	}
+
+	// Test getting an invalid workflow
+	workflow, ok = handler.getWorkflow("invalid-workflow")
+	if ok {
+		t.Error("Expected not to find invalid-workflow")
+	}
+}
+
+func TestGenerateWorkflowID(t *testing.T) {
+	id1 := generateWorkflowID()
+	id2 := generateWorkflowID()
+
+	if id1 == id2 {
+		t.Error("Generated workflow IDs should be unique")
+	}
+
+	if !bytes.HasPrefix([]byte(id1), []byte("wf_")) {
+		t.Errorf("Workflow ID should start with 'wf_', got %s", id1)
+	}
+}
+
+func TestResponseCapture(t *testing.T) {
+	rc := &responseCapture{}
+
+	// Test Header
+	rc.Header().Set("X-Test", "value")
+	if rc.Header().Get("X-Test") != "value" {
+		t.Error("Header not set correctly")
+	}
+
+	// Test Write
+	n, err := rc.Write([]byte("test content"))
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+	if n != 12 {
+		t.Errorf("Expected 12 bytes written, got %d", n)
+	}
+	if rc.body.String() != "test content" {
+		t.Errorf("Expected 'test content', got %s", rc.body.String())
+	}
+
+	// Test WriteHeader
+	rc.WriteHeader(http.StatusOK)
+	if rc.status != http.StatusOK {
+		t.Errorf("Expected status 200, got %d", rc.status)
+	}
+
+	// Test WriteHeader doesn't override
+	rc.WriteHeader(http.StatusInternalServerError)
+	if rc.status != http.StatusOK {
+		t.Error("WriteHeader should not override existing status")
+	}
+}
+
+func TestWorkflowResponseSerialization(t *testing.T) {
+	resp := WorkflowResponse{
+		ID:       "wf_123",
+		Workflow: "test-workflow",
+		Status:   "completed",
+		Output: map[string]interface{}{
+			"key": "value",
+		},
+		Error: "",
+	}
+
+	data, err := json.Marshal(resp)
+	if err != nil {
+		t.Errorf("Failed to marshal response: %v", err)
+	}
+
+	var unmarshaled WorkflowResponse
+	if err := json.Unmarshal(data, &unmarshaled); err != nil {
+		t.Errorf("Failed to unmarshal response: %v", err)
+	}
+
+	if unmarshaled.ID != resp.ID {
+		t.Errorf("Expected ID %s, got %s", resp.ID, unmarshaled.ID)
+	}
+	if unmarshaled.Workflow != resp.Workflow {
+		t.Errorf("Expected Workflow %s, got %s", resp.Workflow, unmarshaled.Workflow)
+	}
+	if unmarshaled.Status != resp.Status {
+		t.Errorf("Expected Status %s, got %s", resp.Status, unmarshaled.Status)
+	}
+}

internal/serviceadapter/adapters.go

@@ -1,5 +1,8 @@
 package serviceadapter
 
+// WorkflowAdapter handles X-Service: workflow requests.
+type WorkflowAdapter struct{}
+
 // SQSAdapter handles X-Service: sqs requests.
 type SQSAdapter struct{}
 

internal/serviceadapter/router.go

@@ -80,14 +80,6 @@ func (d *Dispatcher) Dispatch(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	// Internal handler: dispatch directly without reverse proxy
-	if adapter.Handler != nil {
-		// Set X-Upstream-Path so the handler knows which method was matched
-		r.Header.Set("X-Upstream-Path", method.UpstreamPath)
-		adapter.Handler.ServeHTTP(w, r)
-		return
-	}
-
 	upstreamURL := adapter.Spec.Upstream.URL
 	if strings.HasPrefix(upstreamURL, "grpc://") {
 		d.dispatchGRPC(w, r, upstreamURL, method, adapter)

internal/serviceadapter/types.go

@@ -1,7 +1,6 @@
 package serviceadapter
 
 import (
-	"net/http"
 	"time"
 )
 
@@ -50,14 +49,11 @@ type Status struct {
 }
 
 // ServiceAdapter is a gateway service adapter.
-// When Handler is set, the dispatcher routes directly to the internal handler
-// instead of reverse-proxying to Spec.Upstream.URL.
 type ServiceAdapter struct {
-	Name        string // namespace/name
-	Namespace   string
+	Name      string // namespace/name
+	Namespace string
 	ServiceName string
-	Spec        Spec
-	Status      Status
-	CreatedAt   time.Time
-	Handler     http.Handler `json:"-" yaml:"-"` // internal handler (skip serialization)
+	Spec      Spec
+	Status    Status
+	CreatedAt time.Time
 }

internal/serviceadapter/workflow_adapter.go

@@ -1,265 +0,0 @@
-package serviceadapter
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/temporal"
-)
-
-// WorkflowAdapter handles X-Service: workflow requests.
-// It forwards workflow operations to the Temporal gRPC service.
-// Users can specify namespace via the request payload.
-type WorkflowAdapter struct {
-	temporalHandler *temporal.Handler
-}
-
-// NewWorkflowAdapter creates a new WorkflowAdapter.
-func NewWorkflowAdapter(handler *temporal.Handler) *WorkflowAdapter {
-	return &WorkflowAdapter{
-		temporalHandler: handler,
-	}
-}
-
-// resourceToAction maps X-Resource names to Temporal action names.
-var resourceToAction = map[string]string{
-	"execute":    "START_WORKFLOW",
-	"describe":   "DESCRIBE_WORKFLOW",
-	"list":       "LIST_WORKFLOWS",
-	"history":    "GET_WORKFLOW_HISTORY",
-	"terminate":  "TERMINATE_WORKFLOW",
-	"cancel":     "CANCEL_WORKFLOW",
-	"signal":     "SIGNAL_WORKFLOW",
-	"query":      "QUERY_WORKFLOW",
-	"reset":      "RESET_WORKFLOW",
-	"update":     "UPDATE_WORKFLOW",
-}
-
-// ServeHTTP implements http.Handler for X-Service: workflow routing.
-// Maps X-Resource header to Temporal action, injects action into body,
-// and forwards to the temporal handler.
-func (wa *WorkflowAdapter) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	resource := r.Header.Get("X-Resource")
-	action, ok := resourceToAction[resource]
-	if !ok {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusNotFound)
-		fmt.Fprintf(w, `{"error":"unknown workflow resource: %s"}`, resource)
-		return
-	}
-
-	// Read body, inject action, forward
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusBadRequest)
-		fmt.Fprintf(w, `{"error":"failed to read body: %s"}`, err.Error())
-		return
-	}
-
-	var payload map[string]interface{}
-	if len(body) > 0 {
-		if err := json.Unmarshal(body, &payload); err != nil {
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusBadRequest)
-			fmt.Fprintf(w, `{"error":"invalid JSON: %s"}`, err.Error())
-			return
-		}
-	} else {
-		payload = make(map[string]interface{})
-	}
-
-	// Inject action into body for temporal handler
-	payload["action"] = action
-	if _, ok := payload["namespace"]; !ok {
-		payload["namespace"] = "default"
-	}
-
-	newBody, _ := json.Marshal(payload)
-	r.Body = io.NopCloser(bytes.NewReader(newBody))
-	r.ContentLength = int64(len(newBody))
-	r.URL.Path = "/workflow"
-
-	wa.temporalHandler.ServeHTTP(w, r)
-}
-
-// GetWorkflowSpec returns the ServiceAdapter spec for workflow service.
-// This defines the available resources and methods.
-func GetWorkflowSpec() *Spec {
-	return &Spec{
-		ServiceName: "workflow",
-		Upstream: Upstream{
-			URL:            "grpc://temporal:7233",
-			TimeoutSeconds: 30,
-		},
-		Auth: Auth{
-			Required:   true,
-			Capability: "workflow:execute",
-		},
-		Retryable: true,
-		Resources: []Resource{
-			{
-				Name: "execute",
-				Methods: []Method{
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/StartWorkflowExecution",
-						RequestSchema:  "workflow_start_request",
-						ResponseSchema: "workflow_start_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:execute",
-						},
-					},
-				},
-			},
-			{
-				Name: "describe",
-				Methods: []Method{
-					{
-						Verb:           "GET",
-					},
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/DescribeWorkflowExecution",
-						RequestSchema:  "workflow_describe_request",
-						ResponseSchema: "workflow_describe_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:read",
-						},
-					},
-				},
-			},
-			{
-				Name: "list",
-				Methods: []Method{
-					{
-						Verb:           "GET",
-					},
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/ListWorkflowExecutions",
-						RequestSchema:  "workflow_list_request",
-						ResponseSchema: "workflow_list_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:read",
-						},
-					},
-				},
-			},
-			{
-				Name: "history",
-				Methods: []Method{
-					{
-						Verb:           "GET",
-					},
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/GetWorkflowExecutionHistory",
-						RequestSchema:  "workflow_history_request",
-						ResponseSchema: "workflow_history_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:read",
-						},
-					},
-				},
-			},
-			{
-				Name: "terminate",
-				Methods: []Method{
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/TerminateWorkflowExecution",
-						RequestSchema:  "workflow_terminate_request",
-						ResponseSchema: "workflow_terminate_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:execute",
-						},
-					},
-				},
-			},
-			{
-				Name: "cancel",
-				Methods: []Method{
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/RequestCancelWorkflowExecution",
-						RequestSchema:  "workflow_cancel_request",
-						ResponseSchema: "workflow_cancel_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:execute",
-						},
-					},
-				},
-			},
-			{
-				Name: "signal",
-				Methods: []Method{
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/SignalWorkflowExecution",
-						RequestSchema:  "workflow_signal_request",
-						ResponseSchema: "workflow_signal_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:signal",
-						},
-					},
-				},
-			},
-			{
-				Name: "query",
-				Methods: []Method{
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/QueryWorkflow",
-						RequestSchema:  "workflow_query_request",
-						ResponseSchema: "workflow_query_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:query",
-						},
-					},
-				},
-			},
-			{
-				Name: "reset",
-				Methods: []Method{
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/ResetWorkflowExecution",
-						RequestSchema:  "workflow_reset_request",
-						ResponseSchema: "workflow_reset_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:execute",
-						},
-					},
-				},
-			},
-			{
-				Name: "update",
-				Methods: []Method{
-					{
-						Verb:           "POST",
-						UpstreamPath:   "/temporal.workflowservice.v1.WorkflowService/UpdateWorkflowExecution",
-						RequestSchema:  "workflow_update_request",
-						ResponseSchema: "workflow_update_response",
-						Auth: &Auth{
-							Required:   true,
-							Capability: "workflow:execute",
-						},
-					},
-				},
-			},
-		},
-	}
-}

k8s/grafana-dashboard-llm-metrics.yaml

@@ -1,321 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-dashboard-llm-metrics
-  namespace: monitoring
-  labels:
-    grafana_dashboard: "1"
-data:
-  llm-metrics.json: |
-    {
-      "annotations": {
-        "list": [
-          {
-            "builtIn": 1,
-            "datasource": "-- Grafana --",
-            "enable": true,
-            "hide": true,
-            "iconColor": "rgba(0, 211, 255, 1)",
-            "name": "Annotations & Alerts",
-            "type": "dashboard"
-          }
-        ]
-      },
-      "editable": true,
-      "gnetId": null,
-      "graphTooltip": 0,
-      "id": null,
-      "links": [],
-      "panels": [
-        {
-          "datasource": "Prometheus",
-          "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "palette-classic"
-              },
-              "custom": {
-                "axisLabel": "Milliseconds",
-                "axisPlacement": "auto",
-                "barAlignment": 0,
-                "drawStyle": "line",
-                "fillOpacity": 10,
-                "gradientMode": "none",
-                "hideFrom": {
-                  "tooltip": false,
-                  "viz": false,
-                  "legend": false
-                },
-                "lineInterpolation": "linear",
-                "lineWidth": 1,
-                "pointSize": 5,
-                "scaleDistribution": {
-                  "type": "linear"
-                },
-                "showPoints": "auto",
-                "spanNulls": false,
-                "stacking": {
-                  "group": "A",
-                  "mode": "none"
-                },
-                "thresholdsStyle": {
-                  "mode": "off"
-                }
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  {
-                    "color": "green",
-                    "value": null
-                  },
-                  {
-                    "color": "red",
-                    "value": 80
-                  }
-                ]
-              }
-            },
-            "overrides": []
-          },
-          "gridPos": {
-            "h": 8,
-            "w": 12,
-            "x": 0,
-            "y": 0
-          },
-          "id": 2,
-          "options": {
-            "legend": {
-              "calcs": [
-                "mean",
-                "max",
-                "min"
-              ],
-              "displayMode": "table",
-              "placement": "bottom"
-            },
-            "tooltip": {
-              "mode": "multi"
-            }
-          },
-          "pluginVersion": "8.0.0",
-          "targets": [
-            {
-              "expr": "llm_ttft_seconds * 1000",
-              "legendFormat": "{{model}}",
-              "refId": "A"
-            }
-          ],
-          "title": "Time to First Token (TTFT) by Model",
-          "type": "timeseries"
-        },
-        {
-          "datasource": "Prometheus",
-          "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "palette-classic"
-              },
-              "custom": {
-                "axisLabel": "Milliseconds",
-                "axisPlacement": "auto",
-                "barAlignment": 0,
-                "drawStyle": "line",
-                "fillOpacity": 10,
-                "gradientMode": "none",
-                "hideFrom": {
-                  "tooltip": false,
-                  "viz": false,
-                  "legend": false
-                },
-                "lineInterpolation": "linear",
-                "lineWidth": 1,
-                "pointSize": 5,
-                "scaleDistribution": {
-                  "type": "linear"
-                },
-                "showPoints": "auto",
-                "spanNulls": false,
-                "stacking": {
-                  "group": "A",
-                  "mode": "none"
-                },
-                "thresholdsStyle": {
-                  "mode": "off"
-                }
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  {
-                    "color": "green",
-                    "value": null
-                  },
-                  {
-                    "color": "red",
-                    "value": 80
-                  }
-                ]
-              }
-            },
-            "overrides": []
-          },
-          "gridPos": {
-            "h": 8,
-            "w": 12,
-            "x": 12,
-            "y": 0
-          },
-          "id": 3,
-          "options": {
-            "legend": {
-              "calcs": [
-                "mean",
-                "max",
-                "min"
-              ],
-              "displayMode": "table",
-              "placement": "bottom"
-            },
-            "tooltip": {
-              "mode": "multi"
-            }
-          },
-          "pluginVersion": "8.0.0",
-          "targets": [
-            {
-              "expr": "llm_itl_seconds * 1000",
-              "legendFormat": "{{model}}",
-              "refId": "A"
-            }
-          ],
-          "title": "Inter-Token Latency (ITL) by Model",
-          "type": "timeseries"
-        },
-        {
-          "datasource": "Prometheus",
-          "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "palette-classic"
-              },
-              "custom": {
-                "hideFrom": {
-                  "tooltip": false,
-                  "viz": false,
-                  "legend": false
-                }
-              },
-              "mappings": []
-            },
-            "overrides": []
-          },
-          "gridPos": {
-            "h": 8,
-            "w": 12,
-            "x": 0,
-            "y": 8
-          },
-          "id": 4,
-          "options": {
-            "legend": {
-              "displayMode": "list",
-              "placement": "bottom"
-            },
-            "pieType": "pie"
-          },
-          "pluginVersion": "8.0.0",
-          "targets": [
-            {
-              "expr": "llm_tokens_total",
-              "legendFormat": "{{model}}",
-              "refId": "A"
-            }
-          ],
-          "title": "Total Tokens Generated by Model",
-          "type": "piechart"
-        },
-        {
-          "datasource": "Prometheus",
-          "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "thresholds"
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  {
-                    "color": "green",
-                    "value": null
-                  },
-                  {
-                    "color": "yellow",
-                    "value": 50
-                  },
-                  {
-                    "color": "red",
-                    "value": 100
-                  }
-                ]
-              },
-              "unit": "ms"
-            },
-            "overrides": []
-          },
-          "gridPos": {
-            "h": 8,
-            "w": 12,
-            "x": 12,
-            "y": 8
-          },
-          "id": 5,
-          "options": {
-            "orientation": "auto",
-            "reduceOptions": {
-              "values": false,
-              "fields": "",
-              "calcs": [
-                "lastNotNull"
-              ]
-            },
-            "showThresholdLabels": false,
-            "showThresholdMarkers": true
-          },
-          "pluginVersion": "8.0.0",
-          "targets": [
-            {
-              "expr": "avg(llm_ttft_seconds) * 1000",
-              "legendFormat": "Average TTFT",
-              "refId": "A"
-            }
-          ],
-          "title": "Average TTFT (All Models)",
-          "type": "gauge"
-        }
-      ],
-      "refresh": "10s",
-      "schemaVersion": 27,
-      "style": "dark",
-      "tags": [
-        "llm",
-        "inference",
-        "metrics"
-      ],
-      "templating": {
-        "list": []
-      },
-      "time": {
-        "from": "now-1h",
-        "to": "now"
-      },
-      "timepicker": {},
-      "timezone": "",
-      "title": "LLM Inference Metrics (TTFT & ITL)",
-      "uid": "llm-metrics",
-      "version": 0
-    }

k8s/tekton/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
 - ci-rbac.yaml
 - task-integration-test.yaml
 - task-load-test.yaml
-- task-workflow-visibility.yaml
 - pipeline-sse-optimization.yaml
 
 generatorOptions:
@@ -20,6 +19,3 @@ configMapGenerator:
 - name: load-test-script
   files:
   - scripts/load-test.sh
-- name: workflow-visibility-test-script
-  files:
-  - scripts/workflow-visibility-test.sh

k8s/tekton/pipeline-sse-optimization.yaml

@@ -30,22 +30,10 @@ spec:
     - name: gateway-port
       value: $(params.gateway-port)
   
-  # Workflow visibility tests (runs after integration tests pass)
-  - name: workflow-visibility-tests
-    runAfter:
-    - integration-tests
-    taskRef:
-      name: workflow-visibility-test
-    params:
-    - name: image
-      value: $(params.image)
-    - name: gateway-port
-      value: $(params.gateway-port)
-  
   # Performance load tests (runs after integration tests pass)
   - name: load-tests
     runAfter:
-    - workflow-visibility-tests
+    - integration-tests
     taskRef:
       name: load-test-sse-streaming
     params:
@@ -64,7 +52,6 @@ spec:
   - name: report-results
     runAfter:
     - load-tests
-    - workflow-visibility-tests
     taskSpec:
       description: "Report combined test results"
       params:
@@ -72,10 +59,6 @@ spec:
         type: string
       - name: integration-summary
         type: string
-      - name: workflow-result
-        type: string
-      - name: workflow-summary
-        type: string
       - name: load-result
         type: string
       - name: load-summary
@@ -87,35 +70,27 @@ spec:
         image: busybox
         script: |
           #!/bin/sh
-          echo "╔═══════════════════════════════════════════════════════════╗"
-          echo "║      SSE Optimization + Workflow Tests (PR #26)          ║"
-          echo "╠═══════════════════════════════════════════════════════════╣"
-          echo "║                                                           ║"
-          echo "║  Integration Tests:                                       ║"
+          echo "╔════════════════════════════════════════════════════╗"
+          echo "║        SSE Optimization Test Results (PR #26)      ║"
+          echo "╠════════════════════════════════════════════════════╣"
+          echo "║                                                    ║"
+          echo "║  Integration Tests:                                ║"
           echo "║    Status: $(params.integration-result)"
           echo "║    Summary: $(params.integration-summary)"
-          echo "║                                                           ║"
-          echo "║  Workflow Visibility (namespace pass-down):               ║"
-          echo "║    Status: $(params.workflow-result)"
-          echo "║    Summary: $(params.workflow-summary)"
-          echo "║                                                           ║"
-          echo "║  Load Tests (Issues #31, #32, #33):                       ║"
+          echo "║                                                    ║"
+          echo "║  Load Tests (Issues #31, #32, #33):                ║"
           echo "║    Status: $(params.load-result)"
           echo "║    Summary: $(params.load-summary)"
-          echo "║                                                           ║"
-          echo "║  Performance Metrics:                                     ║"
+          echo "║                                                    ║"
+          echo "║  Performance Metrics:                              ║"
           echo "║    $(params.load-metrics)"
-          echo "║                                                           ║"
-          echo "╚═══════════════════════════════════════════════════════════╝"
+          echo "║                                                    ║"
+          echo "╚════════════════════════════════════════════════════╝"
     params:
     - name: integration-result
       value: $(tasks.integration-tests.results.result)
     - name: integration-summary
       value: $(tasks.integration-tests.results.summary)
-    - name: workflow-result
-      value: $(tasks.workflow-visibility-tests.results.result)
-    - name: workflow-summary
-      value: $(tasks.workflow-visibility-tests.results.summary)
     - name: load-result
       value: $(tasks.load-tests.results.result)
     - name: load-summary

k8s/tekton/scripts/integration-test.sh

@@ -76,56 +76,10 @@ echo "▸ SQS service"
 assert "sqs/list-queues" 401 \
   -X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"
 
-# ── Workflow visibility (namespace pass-down) ──
+# ── Workflow (gRPC needs content-type → 400) ──
 echo "▸ Workflow service"
-
-# Test 1: List workflows in poimen-harness namespace (should see 4 terminated workflows)
-echo "  Testing workflow visibility in poimen-harness namespace..."
-WF_LIST=$(curl -s -X POST \
-  -H "X-Service: workflow" \
-  -H "X-Resource: list" \
-  -H "Content-Type: application/json" \
-  -d '{"namespace": "poimen-harness"}' \
-  "${GW}/" 2>/dev/null || echo '{}')
-
-# Check if response contains workflows
-if echo "$WF_LIST" | grep -q '"executions"'; then
-  echo "  ✓ Workflow list returned (poimen-harness namespace)"
-  PASS=$((PASS + 1))
-else
-  echo "  ✗ Workflow list failed to return executions"
-  FAIL=$((FAIL + 1))
-fi
-TOTAL=$((TOTAL + 1))
-
-# Test 2: Verify we can query terminated workflows
-echo "  Testing terminated workflow visibility..."
-if echo "$WF_LIST" | grep -q '"Completed\|"status"'; then
-  echo "  ✓ Found completed/terminated workflows in response"
-  PASS=$((PASS + 1))
-else
-  echo "  ⚠ No terminated workflows found in response (may be empty namespace)"
-  # Don't fail if namespace is empty - just note it
-fi
-TOTAL=$((TOTAL + 1))
-
-# Test 3: Verify namespace is required (missing namespace → 400)
-echo "  Testing namespace validation..."
-NO_NS=$(curl -s -w '%{http_code}' -X POST \
-  -H "X-Service: workflow" \
-  -H "X-Resource: list" \
-  -H "Content-Type: application/json" \
-  -d '{}' \
-  "${GW}/" 2>/dev/null || echo "000")
-
-if [ "$NO_NS" = "400" ]; then
-  echo "  ✓ Correctly rejected list without namespace (400)"
-  PASS=$((PASS + 1))
-else
-  echo "  ✗ Expected 400 for missing namespace, got $NO_NS"
-  FAIL=$((FAIL + 1))
-fi
-TOTAL=$((TOTAL + 1))
+assert "workflow/list (no grpc content-type → 400)" 400 \
+  -X GET -H "X-Service: workflow" -H "X-Resource: list" "${GW}/"
 
 echo ""
 echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"

k8s/tekton/scripts/workflow-visibility-test.sh

@@ -1,154 +0,0 @@
-#!/bin/sh
-set -e
-
-# Workflow visibility test for gateway.
-# Verifies that the WorkflowAdapter provides visibility into terminated workflows
-# in the poimen-harness namespace via X-Service: workflow routing.
-#
-# Expected: 4 terminated workflows in poimen-harness namespace
-#
-# Required env:
-#   GW           — gateway base URL (e.g. http://localhost:8080)
-#   RESULTS_DIR  — directory to write Tekton results
-
-: "${RESULTS_DIR:=/tekton/results}"
-
-PASS=0
-FAIL=0
-TOTAL=0
-
-echo "═══ Workflow Visibility Test ═══"
-echo ""
-echo "Testing WorkflowAdapter namespace pass-down"
-echo "Expected: 4 terminated workflows in poimen-harness namespace"
-echo ""
-
-# ── Wait for gateway ──
-echo "⏳ Waiting for gateway..."
-READY=false
-for i in $(seq 1 60); do
-  if curl -s -f "${GW}/healthz" > /dev/null 2>&1; then
-    echo "✓ Gateway ready"
-    READY=true
-    break
-  fi
-  sleep 2
-done
-
-if [ "$READY" = "false" ]; then
-  echo "✗ Gateway timeout"
-  echo "fail" > "${RESULTS_DIR}/result"
-  echo "Gateway did not become ready" > "${RESULTS_DIR}/summary"
-  exit 1
-fi
-
-# ── Test 1: List workflows in poimen-harness ──
-TOTAL=$((TOTAL + 1))
-echo "Test 1: List workflows in poimen-harness namespace"
-
-WF_RESPONSE=$(curl -s -X POST \
-  -H "X-Service: workflow" \
-  -H "X-Resource: list" \
-  -H "Content-Type: application/json" \
-  -d '{"namespace": "poimen-harness"}' \
-  "${GW}/" 2>/dev/null || echo "")
-
-if [ -z "$WF_RESPONSE" ]; then
-  echo "  ✗ No response from workflow list endpoint"
-  FAIL=$((FAIL + 1))
-else
-  echo "  ✓ Received workflow list response"
-  PASS=$((PASS + 1))
-  
-  # Extract workflow count (if available)
-  WF_COUNT=$(echo "$WF_RESPONSE" | grep -o '"execution_time"' | wc -l || echo "0")
-  echo "  Found workflows: $WF_COUNT"
-fi
-
-# ── Test 2: Verify namespace is required ──
-TOTAL=$((TOTAL + 1))
-echo "Test 2: Namespace validation (missing namespace should fail)"
-
-NO_NS_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
-  -H "X-Service: workflow" \
-  -H "X-Resource: list" \
-  -H "Content-Type: application/json" \
-  -d '{}' \
-  "${GW}/" 2>/dev/null || echo "")
-
-NO_NS_CODE=$(echo "$NO_NS_RESPONSE" | tail -1)
-
-if [ "$NO_NS_CODE" = "400" ]; then
-  echo "  ✓ Correctly rejected missing namespace (HTTP 400)"
-  PASS=$((PASS + 1))
-elif [ "$NO_NS_CODE" = "401" ]; then
-  echo "  ⚠ Got 401 (auth required) - namespace validation happens after auth check"
-  PASS=$((PASS + 1))
-else
-  echo "  ✗ Expected 400/401, got $NO_NS_CODE"
-  FAIL=$((FAIL + 1))
-fi
-
-# ── Test 3: Query specific terminated workflow ──
-TOTAL=$((TOTAL + 1))
-echo "Test 3: Describe specific workflow (if available)"
-
-# Try to describe a workflow - this will fail if no workflows exist, but shows the feature works
-DESCRIBE_RESPONSE=$(curl -s -X POST \
-  -H "X-Service: workflow" \
-  -H "X-Resource: describe" \
-  -H "Content-Type: application/json" \
-  -d '{"namespace": "poimen-harness", "workflow_id": "test-workflow"}' \
-  "${GW}/" 2>/dev/null || echo "")
-
-if [ -n "$DESCRIBE_RESPONSE" ]; then
-  echo "  ✓ Describe endpoint responded"
-  PASS=$((PASS + 1))
-else
-  echo "  ⚠ Describe endpoint no response (may indicate workflow doesn't exist)"
-  # Not a failure - endpoint exists but workflow may not
-fi
-
-# ── Test 4: Verify auth requirement ──
-TOTAL=$((TOTAL + 1))
-echo "Test 4: Auth requirement (workflow service requires Authorization)"
-
-NO_AUTH_CODE=$(curl -s -w '%{http_code}' -o /dev/null -X POST \
-  -H "X-Service: workflow" \
-  -H "X-Resource: list" \
-  -H "Content-Type: application/json" \
-  -d '{"namespace": "poimen-harness"}' \
-  "${GW}/" 2>/dev/null || echo "000")
-
-if [ "$NO_AUTH_CODE" = "401" ]; then
-  echo "  ✓ Correctly requires auth (HTTP 401)"
-  PASS=$((PASS + 1))
-else
-  echo "  ✗ Expected 401, got $NO_AUTH_CODE"
-  echo "    (Auth may be disabled in test environment)"
-  FAIL=$((FAIL + 1))
-fi
-
-# ── Summary ──
-echo ""
-echo "═══ Results ═══"
-echo "Passed: $PASS/$TOTAL"
-echo "Failed: $FAIL/$TOTAL"
-echo ""
-
-if [ "$FAIL" -eq 0 ]; then
-  echo "pass" > "${RESULTS_DIR}/result"
-  SUMMARY="Workflow visibility test passed. WorkflowAdapter can list/describe workflows in poimen-harness namespace with namespace pass-down support."
-  echo "✓ All tests passed"
-else
-  echo "fail" > "${RESULTS_DIR}/result"
-  SUMMARY="$FAIL tests failed. Check WorkflowAdapter implementation and namespace validation."
-  echo "✗ Some tests failed"
-fi
-
-echo "$SUMMARY" > "${RESULTS_DIR}/summary"
-echo "" >> "${RESULTS_DIR}/summary"
-echo "Passed: $PASS/$TOTAL" >> "${RESULTS_DIR}/summary"
-echo "Failed: $FAIL/$TOTAL" >> "${RESULTS_DIR}/summary"
-
-[ "$FAIL" -eq 0 ]

k8s/tekton/task-workflow-visibility.yaml

@@ -1,84 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Task
-metadata:
-  name: workflow-visibility-test
-  namespace: api
-  labels:
-    app: api-gateway
-    component: testing
-spec:
-  description: >
-    Test workflow visibility via WorkflowAdapter.
-    Verifies that the gateway provides visibility into terminated workflows
-    in the poimen-harness namespace via X-Service: workflow routing.
-    This ensures namespace pass-down is working correctly.
-  
-  params:
-  - name: image
-    type: string
-    description: "Container image to test (repo:tag)"
-  - name: gateway-port
-    type: string
-    default: "8080"
-  
-  results:
-  - name: result
-    type: string
-    description: "pass or fail"
-  - name: summary
-    type: string
-    description: "Test summary"
-  - name: workflow-count
-    type: string
-    description: "Number of workflows found in poimen-harness"
-  
-  sidecars:
-  - name: gateway
-    image: $(params.image)
-    env:
-    - name: LISTEN_ADDR
-      value: "0.0.0.0:$(params.gateway-port)"
-    - name: CONFIG_PATH
-      value: /etc/gateway/config.yaml
-    - name: LOG_LEVEL
-      value: info
-    - name: AUTH_CLIENT_SECRET
-      valueFrom:
-        secretKeyRef:
-          name: api-gw-client-secret
-          key: client-secret
-          optional: true
-    volumeMounts:
-    - name: gateway-config
-      mountPath: /etc/gateway
-      readOnly: true
-  
-  steps:
-  - name: run-workflow-visibility-test
-    image: curlimages/curl:8.13.0
-    env:
-    - name: GW
-      value: "http://localhost:$(params.gateway-port)"
-    - name: RESULTS_DIR
-      value: /tekton/results
-    command: ["sh", "/scripts/workflow-visibility-test.sh"]
-    volumeMounts:
-    - name: test-script
-      mountPath: /scripts
-      readOnly: true
-    computeResources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-      limits:
-        cpu: 200m
-        memory: 128Mi
-  
-  volumes:
-  - name: gateway-config
-    secret:
-      secretName: api-gateway-config
-  - name: test-script
-    configMap:
-      name: workflow-visibility-test-script
-      defaultMode: 0755