Repository navigation

Harden OpenShell eval pipeline: judge-safe model routing, gateway alias, best-effort cleanup - #110

Merged

shricharan-ks merged 15 commits into

RHEcosystemAppEng:mainfrom

shricharan-ks:forge-nommen-eval-hardening

Oct 12, 2026

Merged

Harden OpenShell eval pipeline: judge-safe model routing, gateway alias, best-effort cleanup#110
shricharan-ks merged 15 commits into
RHEcosystemAppEng:mainfrom
shricharan-ks:forge-nommen-eval-hardening

Commits on Oct 12, 2026
- feat(forge-saw): add stable namespace-local openshell gateway alias Service
  
  shricharan-ks
  and
  claude
  committed
  ea97f12
- feat(litellm): add GLM-5-3-Flash routes for agent and judge traffic
  
  shricharan-ks
  and
  claude
  committed
  ee28289
- feat(pipeline): add eval-stack-probe task
  
  shricharan-ks
  and
  claude
  committed
  bad1b83
- fix(cleanup): make PVC cleanup best-effort and use in-cluster CLI image
  
  shricharan-ks
  and
  claude
  committed
  ebeb7b1
- feat(pipeline): default to GLM-5-3-Flash with judge route and gateway alias
  
  shricharan-ks
  and
  claude
  committed
  42812b8
- test: cover Flash defaults, judge route, alias Service, and cleanup hardening
  
  shricharan-ks
  and
  claude
  committed
  ec12e29
- chore: drop hardcoded namespaces from deployable manifests
  
  shricharan-ks
  and
  claude
  committed
  a79f6ca
- fix(pipeline): default endpoints to namespace-local short names
  
  shricharan-ks
  and
  claude
  committed
  fa6051d
- feat(pipeline): select gateway auth path with openshell-auth-mode
  
  shricharan-ks
  and
  claude
  committed
  56af0b8
- feat(probe): check the pipeline's gateway contract layer by layer
  
  shricharan-ks
  and
  claude
  committed
  71b8ea1
- feat(cleanup): surface PVC cleanup outcome instead of silent skip
  
  shricharan-ks
  and
  claude
  committed
  67f8584
- docs(guide): install the namespace-agnostic profile directly
  
  shricharan-ks
  and
  claude
  committed
  8c8acb4
- fix(evaluate): scope mTLS client-certificate staging to the mtls branch
  
  shricharan-ks
  and
  claude
  committed
  6c34a77
- fix(probe): propagate TLS client failures through the s_client|x509 pipe
  
  shricharan-ks
  and
  claude
  committed
  22b1a90
- fix(probe): validate the gateway chain against its own CA and fail on HTTP 5xx
  
  shricharan-ks
  and
  claude
  committed
  691bf1c

Commits

Commits on Oct 12, 2026