fix(gateway): resolve configured aliases for typed decisions

[huronat]

Configured model aliases already work for native extract, but System One and Decisions checked the unresolved alias for typed-question support and returned MODEL_NOT_FOUND.

Resolve aliases through the existing model and access-policy helper before checking capability. Responses retain the caller’s model spelling, while native dispatch uses the canonical model. Regression tests cover aliases, case normalization, named profiles, bundle targets, non-decision models and hidden models.

Validation at f124a99183a8a7e3e564a699158882df4a9e19a2: 19 System One tests and 14 Decisions tests passed. Three existing model-resolution policy regressions, all-target Clippy and formatting checks also passed. The independent review found a distinguishable not-found error for hidden versus absent aliases with an empty registry. The follow-up normalizes that code while preserving early visibility checks; both routes now compare complete error bodies for empty and populated registries. CodeRabbit and all20 current checks pass. The fresh independent review approves this head and explicitly resolves the original finding, with60 focused tests and8 independent probes. The interrupted prior attempt is retained without approval. No release or deployment is included.

Summary by CodeRabbit

• New Features
  • Configured model aliases and bundles now route decision requests to their resolved models, while responses retain the model name supplied by the caller.
  • Aliases hidden by the current access policy return the same 404 response as unavailable models, without revealing the resolved model’s name.
  • Decision and encode aliases are checked for visibility before their decision capabilities are evaluated.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Team
• Run ID: 18c9c35c-a777-4bbf-b3b9-953317945400

📥 Commits

Reviewing files that changed from the base of the PR and between 714d85b and f124a99.

📒 Files selected for processing: 2

• packages/sie_gateway/src/handlers/decisions.rs
• packages/sie_gateway/src/handlers/systemone.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

The System One proxy now resolves model aliases and bundles before checking decision capability. Tests cover alias dispatch, preserved response model names, error outcomes, and access-policy visibility on both routes.

Changes: Model alias routing

Layer / File(s)	Summary
Alias resolution and route checks packages/sie_gateway/src/handlers/systemone.rs, packages/sie_gateway/src/handlers/decisions.rs	The System One proxy checks decision capability on the resolved model. Tests cover alias and bundle dispatch, preserved response model names, missing and non-decision model responses, and visibility policy behavior.

Suggested reviewers: svonava, rparundekar

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to f124a

No actionable merge-blocking issue is established. Merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 84.62% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 2 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: resolving configured gateway aliases for typed decisions.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[huronat]

Agent-generated independent adversarial review. The report and full prompt below are preserved verbatim.

Independent adversarial review — public SIE PR #785

Disposition: REQUEST CHANGES.

Reviewer: /root/public785_independent_review, an independent Codex reviewer session that did not author the change. This review independently inspected the public source diff and dependencies and built its own test artifacts. No author-built binary or another review's conclusion was used as proof of safety.

Base: 04f808008897c0bc6ab22ca69074e718c1eff598.
Head: 714d85bc81ee0dbad04094d12fc7ee02d3a6b6f9.
Range: 04f808008897c0bc6ab22ca69074e718c1eff598..714d85bc81ee0dbad04094d12fc7ee02d3a6b6f9.

The supplied public checkout remained clean and at that head. The complete diff changes only packages/sie_gateway/src/handlers/systemone.rs and packages/sie_gateway/src/handlers/decisions.rs: 134 additions, 2 deletions. revision-evidence.json, reviewed.diff and source-sha256.txt record that evidence.

Finding

[P2] Normalize hidden and absent 404 responses when the model registry is empty

Location: packages/sie_gateway/src/handlers/systemone.rs:545–549 (new resolver/error-return branch), in combination with the retained capability-miss response at lines 550–556.

The new preflight can distinguish an alias hidden by ModelAccessPolicy::visible from an absent alias when the catalog has no models. A visibility denial returns the shared resolver's lowercase model_not_found code and is immediately translated here. By contrast, an otherwise allowed unknown model reaches the shared resolver's existing empty-registry fallback, then fails is_decision_model and returns the retained uppercase MODEL_NOT_FOUND code. The status, error type, message and caller spelling can all be identical while the code reveals which branch ran.

This violates the public model-policy contract that a hidden model be indistinguishable from an absent one (server.rs:47–57). A caller probing friendly names can distinguish aliases resolving to policy-hidden identities from names that are simply absent, in a deployment with such a policy and an empty registry. The probe does not demonstrate unauthorized dispatch or access to model output. The default no-policy case does not expose a hidden-model distinction.

Independent reproduction used two otherwise equivalent empty-registry fake gateways and the same caller request for decision: one with a visibility-denying policy and one with no policy. Both returned 404, both echoed only decision, and neither dispatcher received work. Their full JSON bodies differed:

{"detail":{"error_type":"not_found_error","message":"Model 'decision' not found","code":"model_not_found"}}

{"detail":{"error_type":"not_found_error","message":"Model 'decision' not found","code":"MODEL_NOT_FOUND"}}

The same equality assertion fails at the reviewed head and passes at the exact base. empty-registry-probe.rs, probe-head.log and probe-base.log contain the complete probe and results. The isolated head copy adds only this test. For the base control, both changed files were restored from the base, then the identical test was added; all remaining public source files are identical across the range.

The Decisions wrapper forwards this code through its existing conversion (decisions.rs:481–487); that downstream consequence is established by source inspection, not by a separate end-to-end probe of this edge case.

Requested correction: render model-not-found failures through one consistent response path, preserving the original caller spelling and the early visibility check. Add hidden-versus-absent equality coverage for empty and populated registries through both typed-decision surfaces. Do not remove or postpone the policy check to solve the discrepancy.

Other abuse cases assessed

• Alias, case, __, profile and bundle semantics: Both preflight and native dispatch use resolve_model_spec_with_aliases. Registered model IDs take precedence over friendly aliases; alias lookup folds ASCII case; __ falls back to slash form; configured profile targets are resolved as registered variants; explicit native bundle overrides retain their existing precedence. The original caller spelling is retained for the outer response and encoded inner request. Direct colon-bearing model/profile syntax remains rejected by the unchanged compatibility-ID grammar; configured aliases can target those variants. No alias chaining or new caller-controlled route selector was introduced.
• Wrong capability via a sibling profile: Registry variant entries carry the selected profile's adapter module, and the base route's adapter modules derive from its default profile. The new check uses that resolved entry rather than the alias spelling. No additional capability-bypass defect was found in these reviewed sections.
• Hidden-model enumeration: The new check correctly places visibility before capability errors for a populated registry; the added test exercises decision and non-decision aliases with missing caller context. The empty-registry mismatch above is the actionable gap.
• Serving refusal and sealed routes: The common resolver checks visibility before serving refusal and serving refusal before sealed routing. Native routing repeats these gates. A sealed identity absent from the decision catalog still fails capability lookup; this patch does not independently authorize such an identity to answer typed questions. Existing public fake-policy ordering tests passed. No real deployment policy implementation was exercised.
• Authenticated context and duplicate policy calls: Both wrappers carry the original request extensions into the native request. The successful path now consults visibility/serving policy during preflight and again during native resolution; it does not turn a preflight success into a bypass of the native gate. This is an additional consultation, not an additional dispatch. Custom policy side effects or non-idempotent implementations are outside the tested public fixtures; no claim is made about them.
• Error and billing-related markers: Existing conversion retains response extensions, including GatewayOwnedFault, and allowlisted retry/error headers. Local tests covered malformed replies, undelivered results and retry caps. Apart from the reported not-found discrepancy, no changed billing authority or bypass was found in the reviewed adapter-to-native call chain. No billing runtime was accessed or tested.
• Malformed input and path/header injection: Existing size/type/field validation remains before resolution. The model validator rejects query/fragment delimiters, backslashes, traversal-like double dots and non-ASCII input; compatibility_model_uri percent-encodes the model. Header allowlists and original request extensions remain in use. Decisions still rejects backend options rather than adding them to the native body.
• Native dispatch: Successful new tests record one native extract dispatch with canonical model/profile identity, retaining the caller spelling in the response. Bundle compatibility and native routing continue to be resolved by existing code. No change to queue publication, execution authority, pool admission or auth middleware was part of this diff.
• Concurrent configuration updates: This review did not stress hot reload or prove one snapshot across preflight and native dispatch. Native policy resolution remains in the call chain; no new snapshot-race defect was established from the reviewed change.

Review scope and sibling sweep

Full changed files and all diff hunks were reviewed:

• packages/sie_gateway/src/handlers/systemone.rs
• packages/sie_gateway/src/handlers/decisions.rs

Relevant unchanged public files were reviewed in the following scope (not a claim of whole-file review for these dependencies):

File	Sections inspected
AGENTS.md	Complete public contributor guide.
packages/sie_gateway/src/handlers/proxy.rs	Native unknown-model rendering; native routing at roughly 2132–2440 and dispatch entry around 3160–3290; resolve_model_and_bundle at 8512–8623; alias/model-spec/path resolution at 11830–12000; compatibility model/header helpers around 12202–12310 and URI helper at 15930; embeddings capability preflight around 15300 and validation around 15505; alias/policy/URI tests around 16565–16810, 19620–20050, 23345–23380 and 30245–30263.
packages/sie_gateway/src/server.rs	ModelAccessPolicy and SealedRoute contracts; typed-decision route registration and enclosing auth layer.
packages/sie_gateway/src/state/model_registry.rs	Profile expansion at 580–640; adapter scoping around 1176–1215; bundle resolution around 1258–1345; canonical names and model-info lookup around 1575–1600 and 1722–1760.
packages/sie_gateway/src/handlers/test_support.rs	Fake model YAMLs and dispatcher record shape; TestGateway construction, policy/alias installation and worker registration; test configuration.
packages/sie_gateway/src/handlers/models.rs	Existing alias precision/bundle resolver test around 620–690.
packages/sie_gateway/src/handlers/audio.rs	Same compatibility-ID validation shape around 250–320.
packages/sie_gateway/src/middleware/auth.rs	Layer setup, non-exempt request credential checks and forwarding around 1–290; no live credentials.
packages/sie_gateway/src/http_error.rs	Native and OpenAI not-found code definitions and mappings, located by targeted search.
packages/sie_gateway/src/lib.rs	Public library module tree.
packages/sie_gateway/docs/architecture-guide.md	Routing/config terminology and request/bundle/error contracts in sections 1–2; targeted searches for profile/visibility behavior.
packages/sie_gateway/README.md	Targeted unknown-model contract excerpt.
packages/sie_server/src/sie_server/api/systemone.py	Decision adapter whitelist and capability check, error-type mapping and response assembly; sibling behavior only.
packages/sie_server/tests/api/test_systemone.py	Unknown-model/error assertions around 290–310.
Cargo.toml, packages/sie_gateway/Cargo.toml, mise.toml	Workspace/package dependencies and Rust version needed for the isolated build.

Cargo.lock and packages/wire-fixtures/{systemone,decisions}.json were locked build/test inputs, included in source hashes; the fixtures were exercised by the selected tests, not separately audited in full. Additional rg filename/symbol searches were used for navigation, including configuration and SDK references; search hits alone are not counted as full review.

The sibling sweep traced both typed-decision surfaces to the shared native resolver, and checked the embeddings preflight, audio model validation, profile-expansion semantics and existing resolver tests. It did not expand into a full audit of all public endpoints.

Independent tests and isolation

All test/build invocations used run-clean.sh: env -i, an empty review HOME, an isolated Cargo home containing only a symlink to the existing public dependency registry cache, a new review-only target directory, CARGO_NET_OFFLINE=true, --offline --locked, and installed Rust/Cargo 1.98.1 selected to match the public mise.toml. Version output was rustc 1.98.1 (48a229cea 2026-09-01) and cargo 1.98.1 (797e8a9bc 2026-08-05).

No credentials were inspected or supplied. No provider/model calls, real API requests, GitHub writes, deployment actions or external network requests were made. Tests used temporary YAML fixtures, pure resolution functions and fake dispatch. No service was started for this review. The source checkout was not modified; the regression test was added only to a temporary public source copy.

This is not a hard operating-system credential or network firewall. Clearing the environment and HOME prevents ambient configuration being passed normally; it does not establish that arbitrary executable code could not read an absolute host path. Cargo's offline mode prevents dependency fetching; it is not a general sandbox for all test/build code. The claim here is the actual commands and local fake code paths exercised, not stronger isolation.

Test selection	Result
handlers::systemone::tests::	18 passed
handlers::decisions::tests::	13 passed
resolve_model_and_bundle	3 passed
test_resolve_model_spec	10 passed
test_canonicalize_with_aliases	5 passed
test_resolve_path_model_id	5 passed
Visibility-before-serving-refusal ordering	1 passed
Serving-refusal-before-sealed ordering	1 passed
Visibility-before-sealed ordering	1 passed
test_compatibility_model_uri	1 passed
Independent empty-registry equality probe at head	1 failed, expected counterexample; exit 101
Identical probe at base	1 passed; exit 0

Thus 58 existing focused tests passed independently; the new regression probe failed only at the reviewed head. Full logs and the exact runner scripts accompany this report. The initial full test-binary build used a fresh target; later runs reused only this review's own artifacts. The head and base probe builds ran sequentially in that target.

The supplied claims about CodeRabbit approval, all-target Clippy/fmt and CI status were not independently fetched or treated as safety evidence. No CI conclusion is asserted here. This review did not run all gateway tests, live models, deployment integrations, benchmarks, or every feature combination.

Prompt record

The complete initial review prompt follows verbatim. No follow-up prompts were received by this reviewer before this report was finalized.

Perform an independent adversarial security and correctness review of public superlinked/sie PR785 at exact head714d85bc81ee0dbad04094d12fc7ee02d3a6b6f9, base04f808008897c0bc6ab22ca69074e718c1eff598. You did not author this change. No inherited authoring context is supplied. Worktree /private/tmp/sie-public-decision-model-aliases-20261017 is fixed at that head, two changed paths: packages/sie_gateway/src/handlers/systemone.rs and packages/sie_gateway/src/handlers/decisions.rs. Read AGENTS.md, inspect the whole diff and relevant unchanged dependencies yourself. CodeRabbit has approved this exact head; local 18 System One,13 Decisions,3 existing model-policy tests, all-target Clippy/fmt passed; CI is still running. Verify these statements from public evidence if useful, do not treat them as proof of safety.

The change resolves configured aliases through existing resolve_model_and_bundle before typed-question capability validation. Assess alias/case/profile/bundle semantics, original caller identity vs canonical dispatch identity, hidden-model enumeration, serving refusal/sealed models, auth extensions, error conversion, malformed inputs, duplicate policy calls, native dispatch and no unintended routing/billing authority. Sweep sibling same-shape paths where appropriate. Find actionable defects, not stylistic preferences. No source fixes, commits, pushes, messages or GitHub writes. No credentials, provider/model calls, real APIs, deployment or external network. Local fake/loopback tests are allowed; use a cleared environment and offline locked toolchain. Use a separate target/evidence directory if compiling; do not race with authoring targets. You may inspect prebuilt local test artifacts only with explicit provenance/limits. State actual isolation honestly; absence of credentials in supplied environment is not a hard OS credential firewall.

All output must use only public facts. Do not inspect or mention any private repository, systems, issues, runtime or motivation. Save a complete unedited report at /private/tmp/sie-public-decision-model-aliases-20261017-evidence/independent-review/REPORT.md and hashes/commands alongside it. The report must include this full initial prompt, every follow-up prompt verbatim, your canonical reviewer identity, exact base/head/range, full file list reviewed, test/probe results and limits, abuse cases considered, findings with severity/file/line/impact, and explicit disposition APPROVE or REQUEST CHANGES. We will post the complete report on the public PR. A claim of no findings must remain bounded by what you actually reviewed/tested. If you need a runtime or private fact, record the limitation instead of accessing it.

[huronat]

Agent-generated interrupted independent review record

This record is supplied by the parent session, not a completed reviewer report.

Reviewer session: /root/public785_f124_independent.
Reviewed head: f124a99183a8a7e3e564a699158882df4a9e19a2.
Requested whole-PR range: origin/main...f124a99183a8a7e3e564a699158882df4a9e19a2, exact base 04f808008897c0bc6ab22ca69074e718c1eff598.

Disposition: INCOMPLETE — no approval or finding disposition issued. The platform usage limit interrupted the reviewer before its report. The prior P2 remains unresolved by this attempt. A separate fresh reviewer is examining the complete change and that finding.

The retained local run-status record lists these selections as completed; this is evidence of attempted validation, not a completed whole-diff security conclusion. An additional probe source file was drafted, but no execution result is asserted for it. All artifacts are preserved.

handlers::systemone::tests:: exit=0
handlers::decisions::tests:: exit=0
resolve_model_and_bundle exit=0
test_resolve_model_spec exit=0
test_canonicalize_with_aliases exit=0
test_resolve_path_model_id exit=0
resolve_routing_runs_the_visibility_gate_before_the_serving_refusal exit=0
resolve_routing_refuses_before_it_seals exit=0
resolve_routing_runs_visibility_gate_before_the_sealed_branch exit=0
test_compatibility_model_uri exit=0

No report is being reconstructed or attributed to the interrupted reviewer. No changed file was excluded by the prompt.

Full prompt verbatim

Perform a NEW independent, agent-generated adversarial review of the WHOLE public superlinked/sie PR785, including resolution of the prior blocking finding. You did not author this work. Checkout /private/tmp/sie-public-decision-model-aliases-20261017, exact head f124a99183a8a7e3e564a699158882df4a9e19a2, exact origin/main/base04f808008897c0bc6ab22ca69074e718c1eff598. Entire diff is 2files227additions2deletions: packages/sie_gateway/src/handlers/systemone.rs and decisions.rs. Inspect all hunks and relevant dependencies; no changed file is excluded. CodeRabbit has approved exactf124 and has zero review threads; normal CI remains in progress. Work source/read-only, no repository edits or GitHub writes. You may create isolated scratch evidence/test copies under /private/tmp/sie-public-decision-model-aliases-20261017-evidence/independent-review-f124. Do not retrieve/use credentials or use authenticated tooling. Use cleared environment, empty HOME, offline locked tools and a fresh reviewer-owned target; do not rely on author binaries. Existing public dependency registry caches may be used read-only. Public Rust1.98.1 is installed at /Users/attila/.rustup/toolchains/1.98.1-aarch64-apple-darwin/bin. State actual isolation honestly, not a hard credential/network firewall claim. Tests must use local fakes, no real model/provider/API traffic, no release/deployment. Read public AGENTS.md and relevant source/design.

Prior full independent report and prompt: /private/tmp/sie-public-decision-model-aliases-20261017-evidence/independent-review/REPORT.md (SHA256 a8138a821859fac24f95e8b077cdd0797d7ec59efdf8fe58f5815962a94a4104), published https://github.com/superlinked/sie/pull/785#issuecomment-6234295073. Its one P2 found an information leak: with an empty registry, hidden aliases return lowercase model_not_found while absent aliases return uppercase MODEL_NOT_FOUND. Full-body equality failed at714d and passed at04f. Author correction atf124 normalizes only404 MODEL_NOT_FOUND case in SystemOne translation, retaining original caller spelling, early policy gates, response markers/headers and native dispatch. New tests compare full JSON for hidden/absent through both routes, empty/populated registries and case variants. Author evidence:19SystemOne+14Decisions tests, all-targetClippy/fmt pass. These are inputs, not independent proof. Original change resolves configured alias/model/profile/bundle identity with existing resolve_model_and_bundle before typed-decision capability lookup.

Review abuse cases: hidden/absent equality, caller spelling, aliases/case/profile/bundle resolution, capability bypass, visible/serve/sealed policy order, forwarding authenticated context, repeated policy consultation, request validation/URI injection, error marker/header propagation, exactly-one native dispatch, race/fail-open behavior, all changed tests. Inspect sibling paths. Probe independently as appropriate and say precisely what ran. A blocking finding remains blocking until YOU explicitly conclude resolved or invalid with evidence; otherwise REQUEST CHANGES. Report any new concrete finding with priority/path/line/reproduction. Do not edit code to fix it.

Write REPORT.md with an explicit 'Agent-generated independent adversarial review' label, reviewer canonical session id, reviewed head and full range origin/main...head plus fullSHAs, scope, abuse cases, exact test evidence, verbatim findings and disposition of prior P2, actual limitations, and THIS FULL PROMPT VERBATIM. No scope limit excludes any changed file. Preserve every attempted/failed/superseded review run and test evidence in the report; do not hide unsuccessful probes. All report text must contain public source facts only, no private systems/context. The parent will post your entire report unedited to the public PR. Return final disposition and report hash. Do not use claims or contact other agents; no shared edits are needed.

[huronat]

Agent-generated independent adversarial review — public SIE PR #785

Disposition: APPROVE at f124a99183a8a7e3e564a699158882df4a9e19a2.

Original P2: RESOLVED, not invalidated. No additional actionable finding was established within the full PR scope and the verification limits below.

Reviewer canonical session ID: /root/public785_final_independent. This fresh reviewer did not author the change. I inspected the complete source diff and relevant dependencies, then compiled and ran the tests in my own new target directory. I did not use an author-built binary or the interrupted review's results as independent proof.

Base / recorded origin/main: 04f808008897c0bc6ab22ca69074e718c1eff598.

Head: f124a99183a8a7e3e564a699158882df4a9e19a2.

Full requested range: origin/main...f124a99183a8a7e3e564a699158882df4a9e19a2, resolved locally to 04f808008897c0bc6ab22ca69074e718c1eff598...f124a99183a8a7e3e564a699158882df4a9e19a2.

The entire change is 227 additions and 2 deletions in two files. Both complete changed files and every diff hunk were reviewed; no changed file was excluded:

• packages/sie_gateway/src/handlers/systemone.rs
• packages/sie_gateway/src/handlers/decisions.rs

The supplied checkout remained clean at the exact head before and after review. No source edits were made there. revision-evidence.txt, final-revision-evidence.json, reviewed.diff, source-sha256.txt, and the before/after status files record the reviewed inputs. No remote refs or CI status were fetched.

Original P2: independent disposition

The prior report's SHA-256 was independently verified as a8138a821859fac24f95e8b077cdd0797d7ec59efdf8fe58f5815962a94a4104. Its disposition was, verbatim:

Disposition: REQUEST CHANGES.

The original finding follows verbatim, including its original line references and evidence statements. Those statements describe the earlier review, not this head:

[P2] Normalize hidden and absent 404 responses when the model registry is empty

Location: packages/sie_gateway/src/handlers/systemone.rs:545–549 (new resolver/error-return branch), in combination with the retained capability-miss response at lines 550–556.

The new preflight can distinguish an alias hidden by ModelAccessPolicy::visible from an absent alias when the catalog has no models. A visibility denial returns the shared resolver's lowercase model_not_found code and is immediately translated here. By contrast, an otherwise allowed unknown model reaches the shared resolver's existing empty-registry fallback, then fails is_decision_model and returns the retained uppercase MODEL_NOT_FOUND code. The status, error type, message and caller spelling can all be identical while the code reveals which branch ran.

This violates the public model-policy contract that a hidden model be indistinguishable from an absent one (server.rs:47–57). A caller probing friendly names can distinguish aliases resolving to policy-hidden identities from names that are simply absent, in a deployment with such a policy and an empty registry. The probe does not demonstrate unauthorized dispatch or access to model output. The default no-policy case does not expose a hidden-model distinction.

Independent reproduction used two otherwise equivalent empty-registry fake gateways and the same caller request for decision: one with a visibility-denying policy and one with no policy. Both returned 404, both echoed only decision, and neither dispatcher received work. Their full JSON bodies differed:

{"detail":{"error_type":"not_found_error","message":"Model 'decision' not found","code":"model_not_found"}}

{"detail":{"error_type":"not_found_error","message":"Model 'decision' not found","code":"MODEL_NOT_FOUND"}}

The same equality assertion fails at the reviewed head and passes at the exact base. empty-registry-probe.rs, probe-head.log and probe-base.log contain the complete probe and results. The isolated head copy adds only this test. For the base control, both changed files were restored from the base, then the identical test was added; all remaining public source files are identical across the range.

The Decisions wrapper forwards this code through its existing conversion (decisions.rs:481–487); that downstream consequence is established by source inspection, not by a separate end-to-end probe of this edge case.

Requested correction: render model-not-found failures through one consistent response path, preserving the original caller spelling and the early visibility check. Add hidden-versus-absent equality coverage for empty and populated registries through both typed-decision surfaces. Do not remove or postpone the policy check to solve the discrepancy.

Current disposition: RESOLVED

At the new head, systemone.rs:462–468 normalizes an error code to MODEL_NOT_FOUND only when the response status is 404 and the code matches that identifier case-insensitively. The early resolve_model_and_bundle policy gate remains at systemone.rs:552–556; capability lookup still uses the resolved identity. The caller's original spelling remains in the missing-model message and the inner request.

I reran the unchanged original independent_review_empty_registry_hidden_matches_absent probe from source, using my own compiler artifacts:

Revision	Original probe result
Prior head 714d85bc81ee0dbad04094d12fc7ee02d3a6b6f9	FAIL, exit 101: hidden code model_not_found, absent code MODEL_NOT_FOUND.
Exact base 04f808008897c0bc6ab22ca69074e718c1eff598	PASS, exit 0.
Reviewed head f124a99183a8a7e3e564a699158882df4a9e19a2	PASS, exit 0.

original-empty-registry-probe.rs, probe-prior-714d.log, probe-base-04f.log, and probe-head.log contain the source and complete results. The prior-head failure is preserved; it is the expected regression control, not a failed test at the approved head. Controls replaced only the two changed files in the scratch source with their exact revision contents and appended the same original probe. The scratch source was subsequently restored to the reviewed head plus the reviewer probes.

The new head also independently passes a stronger 24-pair matrix: both endpoints, empty and populated registries, and six spellings covering simple/mixed-case aliases, configured profile and bundle targets, __, and slash/case forms. This probe compares status, all response headers, and exact body bytes, verifies the canonical error code and original caller message, and asserts zero dispatch for both sides. Both endpoints' committed regression tests also pass. These observations resolve the P2 without postponing or removing the visibility gate.

Abuse cases and conclusions

• Alias, case, profile and bundle resolution: Both preflight and native routing use the existing resolve_model_spec_with_aliases rules. Registered identities precede aliases; alias keys fold ASCII case; __ is a fallback; profile/bundle targets are parsed by the common resolver. The capability check sees the resolved registry entry, while the response and encoded native URI retain the caller spelling. Existing resolver tests cover alias-carried bundle selection and real-ID precedence. The added probe confirms an incompatible bundle returns 409 with no dispatch, and visibility denial wins over that conflict.
• Capability bypass through a sibling profile: Registry expansion gives variants their selected profile's adapter module, and the base entry uses the default profile's adapter module. An independent two-way probe puts the decision adapter on the default profile and then on the alternate profile; each route accepts only the decision-capable selected variant and dispatches its exact identity. No cross-profile capability bypass was found.
• Visibility, serving refusal and sealed routing: The common helper and the native routing path consult visibility before serving refusal, then sealed routing. Tests with a sealed-route policy confirm that neither a refusal nor a hidden identity reaches sealed routing, and a visible sealed identity with no decision catalog entry still returns 404 without dispatch. A sealed-route result does not waive the typed-decision capability requirement.
• Caller context and repeated policy consultation: Both wrappers preserve request extensions. The independent policy asserts that its synthetic caller extension and canonical model identity reach every consultation. Successful normal requests consult visible, serving_refusal, and sealed_route twice: preflight and native routing. A policy that denies visibility or refuses serving on the second consultation stops dispatch. This demonstrates fail-closed behavior for those sequential policy changes. The repeated consultation adds no second wrapper dispatch. Policies with arbitrary side effects remain a composition concern; no real policy implementation was accessed.
• Error normalization, headers and fault markers: An independent 12-case status/code matrix checks 404, 403 and 500 against lower/mixed/upper-case model-not-found and unrelated codes. Only 404 model-not-found is normalized; status, message, allowlisted request/error headers and GatewayOwnedFault survive. Retry headers retain the existing 60-second cap; unrelated Set-Cookie is filtered. Policy-refusal probes additionally exercise marker/header preservation through both outer endpoints. Existing malformed-result and undelivered-result tests pass.
• Malformed models and URI injection: Eleven malformed model spellings are rejected before any policy lookup through both endpoints, including query/fragment syntax, percent escapes, traversal-like dots, backslash, CRLF, direct profile/bundle syntax, non-ASCII, leading slash and empty input. The unchanged validator restricts the caller grammar; the URI helper percent-encodes the valid caller model and the native route decodes it once. Configured alias targets are resolved by configuration rules rather than interpolated into that URI.
• Exactly one native operation on the tested success paths: Both committed alias tests and the independent policy/profile probes observe one recorded extract dispatch with canonical model/profile identity and the original caller spelling in the response. Refused requests observe zero dispatches. The wrappers still call the existing native proxy once; they do not add queue publication, worker calls or an alternate transport. Existing native retry/fallback mechanisms were not exhaustively tested, so this is not a claim that every transport mode publishes only once.
• Authentication and routing authority: Both routes remain under the unchanged router authentication layer. The added resolver is a preflight policy/capability decision and does not replace the native gate, introduce credentials, accept new backend fields, or change the header allowlists. Decisions still rejects unsupported backend options. No changed authentication bypass or new routing/billing authority was found in the reviewed chain.
• Concurrency and fail-open concerns: Alias configuration is immutable within AppState, while registry queries load snapshots separately. This review does not prove a single snapshot across preflight, capability lookup and native routing, and it did not stress concurrent catalog reloads. The native policy check remains authoritative for its resolved identity, and the second-consultation refusal probes pass. No new actionable race defect was established from this diff; no broader atomicity claim is made.

Relevant dependencies and sibling sweep

The following unchanged public files were inspected in the stated scope. This table is not a claim of whole-file review beyond the two changed files:

File	Inspected scope
AGENTS.md	Complete public contributor guide.
packages/sie_gateway/docs/architecture-guide.md	Services, bundle/model semantics, inference request path, empty-registry fallback and error contracts.
packages/sie_gateway/src/handlers/proxy.rs	Unknown-model rendering around 1548–1585; native policy/bundle routing around 2110–2450; native request parsing/resolution around 3160–3295; complete resolve_model_and_bundle around 8505–8623; alias/spec/path helpers around 11820–12015; compatibility grammar/header/error helpers around 12195–12310; embeddings capability preflight and model validation around 15285–15375 and 15495–15565; URI helper around 15930–15942.
packages/sie_gateway/src/server.rs	Model access/serving/sealed policy contracts and typed-decision route registration beneath AuthLayer.
packages/sie_gateway/src/state/model_registry.rs	Profile expansion, default/variant adapter scoping, bundle compatibility, canonical lookup, model-info lookup and snapshot access.
packages/sie_gateway/src/handlers/test_support.rs	Test model/bundle definitions, fake dispatch record and publish_work, in-memory results, gateway construction, policy/alias injection and worker fixture setup.
packages/sie_gateway/src/handlers/models.rs	Existing alias-carried precision/bundle resolver test and its conflict behavior.
packages/sie_gateway/src/handlers/audio.rs	Sibling compatibility-model validation.
packages/sie_gateway/src/middleware/auth.rs	Authentication layer, exemptions, credential selection/refusals and forwarding through approximately line 290.
packages/sie_gateway/src/http_error.rs	GatewayOwnedFault, native/OpenAI not-found constants and envelope definitions through approximately line 180.
packages/sie_server/src/sie_server/api/systemone.py	Decision-adapter whitelist, capability check and dispatch entry as a sibling implementation.
Cargo.toml, packages/sie_gateway/Cargo.toml, mise.toml	Workspace/package graph and pinned Rust toolchain.

Cargo.lock and packages/wire-fixtures/{systemone,decisions}.json were locked build/test inputs and hashed. The fixture tests exercised their expected behavior; the fixture files were not separately audited in full. sibling-sweep-command.txt and sibling-sweep.log record the symbol search across compatibility wrappers and single-server decision surfaces. Search hits alone are not counted as audited code. The sweep checked the shared resolver, embeddings preflight, audio validation, profile scoping and error-envelope relationships; it was not a full audit of every endpoint.

Independent verification and preserved runs

All build/test invocations used run-clean.sh: env -i, an empty reviewer HOME, a reviewer Cargo home containing only a symlink to the public dependency registry cache, a newly created reviewer target directory, CARGO_NET_OFFLINE=true, and installed Rust/Cargo 1.98.1. Cargo compilation and tests used --offline --locked. Toolchain output was rustc 1.98.1 (48a229cea 2026-09-01) and cargo 1.98.1 (797e8a9bc 2026-08-05).

The unmodified head was archived from Git and independently built. No prior or author target directory was copied or used. Later test runs reused only artifacts built by this review. The original regression probe and the interrupted review's six supplemental probe drafts were read and reused as source, not accepted as previous passing evidence; I added the bundle-conflict probe and compiled all eight locally. The prior completed report and prior interrupted review directory were left unchanged. The interrupted review has no disposition and is not treated as approval.

Selection/check at reviewed head	Result
handlers::systemone::tests::	19 passed
handlers::decisions::tests::	14 passed
resolve_model_and_bundle	3 passed
test_resolve_model_spec	10 passed
test_canonicalize_with_aliases	5 passed
test_resolve_path_model_id	5 passed
Visibility-before-serving-refusal ordering	1 passed
Serving-refusal-before-sealed ordering	1 passed
Visibility-before-sealed ordering	1 passed
test_compatibility_model_uri	1 passed
Original P2 plus supplemental independent_review_ probes	8 passed
cargo fmt --all -- --check on unmodified head	Passed, exit 0
cargo clippy --offline --locked -p sie-gateway --all-targets -- -D warnings on unmodified head	Passed, exit 0

Thus 60 existing focused tests and 8 reviewer probes passed at the reviewed head. The old-head control failed as expected, and the base control passed. There were no other failed test/check invocations in this review. Every test/check log, including the expected failure, and each runner is retained in the evidence directory. run-status.txt records all exits; no failed or superseded run was overwritten. EVIDENCE-SHA256.txt hashes the report, prompts, logs, scripts and recorded source evidence.

Tests used only local YAML fixtures, fake policies, fake workers and an in-memory recording dispatcher. No model/provider request, external API request, authenticated tool, real service, release or deployment was used. No credential was inspected or supplied. Shell/source inspection was read-only outside the designated scratch directory.

This is not a hard filesystem or network firewall. An empty environment/HOME avoids passing ordinary ambient configuration but does not prevent arbitrary executable code from opening a known absolute host path. Cargo offline mode prevents dependency fetching, not arbitrary network access by executable code. The isolation claim is limited to the actual local fake paths and commands exercised.

No full runtime, real model, live policy, transport-service, full gateway suite, benchmark or exhaustive feature-matrix claim is made. The reported CodeRabbit approval and CI status were not independently fetched and are not asserted as evidence by this review. This approval concerns the exact full PR diff reviewed above and does not itself authorize merge, release or deployment.

Full initial prompt, verbatim

The complete initial task prompt follows verbatim. One subsequent coordination message, received while finalizing this report, is recorded after it. The reported CI status in that message was not independently fetched by this reviewer and did not change the review scope or test evidence.

Independent agent adversarial review of full PUBLIC superlinked/sie PR785. You must start from source, not author conclusions, and inspect whole diff. Public checkout /private/tmp/sie-public-decision-model-aliases-20261017, head f124a99183a8a7e3e564a699158882df4a9e19a2, origin/main/base04f808008897c0bc6ab22ca69074e718c1eff598. Entire2file diff227additions2deletions: packages/sie_gateway/src/handlers/systemone.rs and decisions.rs. Current-head CodeRabbit approved; CI status being read. You are fresh reviewer; no prior author context. No write credentials, authenticated tools, external API/model/provider traffic or releases/deployments. Read public AGENTS and relevant design/source. Scratch-only evidence allowed at /private/tmp/sie-public-decision-model-aliases-20261017-evidence/independent-review-final. Use env-i, empty HOME, reviewer-owned build target, installedRust1.98.1 /Users/attila/.rustup/toolchains/1.98.1-aarch64-apple-darwin/bin, offline locked dependency caches. Honest isolation: not a hard filesystem/network firewall. No sharedsource edits; test copies scratch only.

Original independent review714d REQUESTCHANGES1P2 is at /private/tmp/sie-public-decision-model-aliases-20261017-evidence/independent-review/REPORT.md SHA a8138a821859fac24f95e8b077cdd0797d7ec59efdf8fe58f5815962a94a4104. Hidden alias vs absent alias returns distinguishable404 code lowercase model_not_found vs uppercase MODEL_NOT_FOUND when registryempty. Fullbody equalityfailed714d/passedbase04f. The prior review on f124 (/root/public785_f124_independent) was interrupted by platform usage limit before report/disposition. Its logs under independent-review-f124 record10focused selections exit0 and an additional-probes.rs draft; preserve as prior incomplete evidence, do not treat as approval. You may inspect/reuse test source, not prior compiledbinaries as independent proof. Parent will separately publish incomplete review record and fullprompt.

Author fix f124 normalizes only404 eq-ignore-ascii-case MODEL_NOT_FOUND in SystemOne error translation, retainingearlyvisibilitychecks, originalcallerspelling, headers/extensions andnativepipeline. Bothroutes nowcompare fullJSONhidden/absent errors for empty/populatedregistries andcasevariants. Original PR resolves configuredaliases/profile/bundle via existing resolve_model_and_bundle before typeddecisioncapability lookup. Author reports19SystemOne+14Decisions+3existingpolicytests/Clippy/fmtpass; independentlyverify.

Review all hunks and dependencies, including aliases/case/profile/bundle and capability bypass; hidden/absent equality including registryempty; visibility/serve/sealed policyordering; forwardedauthcontext; duplicatepolicyconsultation; malformedmodel/URIinjection; preservederrorheaders/GatewayOwnedFault; exactlyonenativedispatch; failopen/race concerns. Sweep siblings. Explicitly conclude whether originalP2isresolved/invalid/remains, withindependent evidence; do not inventfindings. Priorfinding stays blocking until newreviewerreportsresolved. WholePRscope, no excludedfiles. Tests only localfakes; nofullruntimeclaim.

Deliver REPORT.md with explicit Agent-generated independent adversarial review label, canonicalreviewersessionid, exacthead/fullrange origin/main...head andfullSHAs, fullscope/abusecases, actualtestevidence andfailures, verbatim findings/disposition ofP2, limitations and THISFULLPROMPTVERBATIM. Preserve everyfailed/supersededrun. PublicfactsONLY; no privatecontext orsystems. Parent postsentirereportunedited onpublicPR. Returndisposition andSHA256.

Subsequent coordination message, verbatim

All20 current PR checks now SUCCESS, exactf124 remains CLEAN/MERGEABLE; fresh fetch stillbase04f. Parent will post your entire final report and verify it before exact-head normal merge. No additional review scope is requested; please finish the existing complete report and hashes when ready.