feat!: remove gateway/GATEWAY_ and pre-rename legacy aliases#314
Open
njbrake wants to merge 3 commits into
Open
feat!: remove gateway/GATEWAY_ and pre-rename legacy aliases#314njbrake wants to merge 3 commits into
njbrake wants to merge 3 commits into
Conversation
The Otari rename (#142) kept the old names working for backward compatibility. The deprecation window has passed, so this retires them. Removed: - the `gateway` console-script alias (pyproject.toml); the CLI is `otari` - the `GATEWAY_` environment prefix: the native pydantic env_prefix (now `OTARI_`, which also covers complex fields), the `otari_env()` fallback in core/env.py, the `GATEWAY_MODE` alias, and the alembic `GATEWAY_DATABASE_URL` fallback - the pre-rename `AnyLLM-Key` / `X-AnyLLM-Key` request-header aliases - the pre-rename `OTARI_PLATFORM_TOKEN` / `ANY_LLM_PLATFORM_TOKEN` platform token env aliases; only `OTARI_AI_TOKEN` remains Kept intentionally: the `gateway` import package, internal identifiers, metric and logger names, and the `/gateway/...` platform wire-protocol paths and `X-Gateway-Token` header (contract surface, not product naming). Tests that asserted the legacy names worked now assert they are ignored. BREAKING CHANGE: the `gateway` CLI command, the `GATEWAY_` env prefix, the `AnyLLM-Key` / `X-AnyLLM-Key` headers, and the `OTARI_PLATFORM_TOKEN` / `ANY_LLM_PLATFORM_TOKEN` token env vars are no longer recognized. Use `otari`, `OTARI_` env vars, the `Otari-Key` header, and `OTARI_AI_TOKEN`. Fixes #157 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
njbrake
temporarily deployed
to
integration-tests
July 17, 2026 19:26 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
💤 Files with no reviewable changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughThe change removes legacy ChangesLegacy alias removal
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…fallbacks Making OTARI_ the native pydantic env_prefix meant a blank OTARI_MASTER_KEY (common from container templating) read as "" instead of unset. On the shared auth path _is_valid_master_key only guards `is not None`, so an empty bearer token would then match an empty master key. Set env_ignore_empty=True so the native prefix skips empty values, matching the empty-skip in _apply_otari_env_overrides, and add a regression test. Also drop the leftover GATEWAY_HOST / GATEWAY_PORT shell fallbacks from the `make dev` target. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
njbrake
temporarily deployed
to
integration-tests
July 17, 2026 19:32 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
tests/unit/test_web_search_backend.py (1)
557-566: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winExercise the canonical environment variable in this test.
The docstring says this case is reached via
OTARI_WEB_SEARCH_MAX_RESULTS, but the test only passesbad_valuedirectly toWebSearchBackend. Add an environment-resolution assertion, or remove this claim and cover the OTARI_ mapping separately.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/unit/test_web_search_backend.py` around lines 557 - 566, Update test_max_results_clamps_subone_to_one to exercise the canonical OTARI_WEB_SEARCH_MAX_RESULTS environment-variable resolution described in its docstring, asserting that a non-positive environment value is clamped to 1; alternatively, remove that environment-variable claim from the docstring and add separate coverage for the OTARI_ mapping.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/instructions/security-review.instructions.md:
- Line 141: In the security review instruction text, replace the em dash
separating the operator-controlled URL statement from the per-request override
warning with a colon, preserving the wording and meaning of the documentation.
In `@AGENTS.md`:
- Line 37: Add blank lines before and after the headings in the AGENTS.md
sections “Request lifecycle (chat completions)” and the headings at the
referenced locations, including those near lines 44, 55, and 60, so they satisfy
Markdownlint MD022 without changing the documentation content.
In `@src/gateway/core/config.py`:
- Around line 633-644: Update the validation messages in the configured_mode
checks within the configuration loading method to refer to the configured mode
rather than explicitly naming OTARI_MODE. Preserve the existing guidance about
required tokens and standalone-mode conflicts while ensuring the wording is
accurate for values originating from either environment variables or
gateway.yml.
In `@tests/unit/test_url_safety.py`:
- Line 92: Remove the duplicate monkeypatch.delenv call in the affected URL
safety test, keeping only the preceding statement that clears
OTARI_WEB_SEARCH_ALLOW_PRIVATE_HOSTS.
- Line 82: Remove the redundant monkeypatch.delenv call before
monkeypatch.setenv in the affected test, leaving setenv to overwrite
OTARI_MCP_ALLOW_PRIVATE_HOSTS directly.
---
Outside diff comments:
In `@tests/unit/test_web_search_backend.py`:
- Around line 557-566: Update test_max_results_clamps_subone_to_one to exercise
the canonical OTARI_WEB_SEARCH_MAX_RESULTS environment-variable resolution
described in its docstring, asserting that a non-positive environment value is
clamped to 1; alternatively, remove that environment-variable claim from the
docstring and add separate coverage for the OTARI_ mapping.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2523536a-aa6f-4dcc-9049-320d45d72e7a
📒 Files selected for processing (26)
.github/instructions/security-review.instructions.md.github/skills/backend-standards/SKILL.mdAGENTS.mdMakefilealembic/env.pydocs/api-reference.mddocs/configuration.mdpyproject.tomlscripts/web-search-brave-adapter/app.pyscripts/web-search-tavily-adapter/app.pysrc/gateway/api/deps.pysrc/gateway/core/config.pysrc/gateway/core/env.pysrc/gateway/main.pytests/integration/test_batches_endpoint.pytests/integration/test_config_env_loading.pytests/integration/test_hybrid_mode_chat.pytests/integration/test_hybrid_mode_messages.pytests/integration/test_hybrid_mode_responses.pytests/integration/test_messages_route_dispatch.pytests/integration/test_responses_route_dispatch.pytests/unit/test_extract_bearer_token.pytests/unit/test_otari_env_helper.pytests/unit/test_pipeline_settlement.pytests/unit/test_url_safety.pytests/unit/test_web_search_backend.py
💤 Files with no reviewable changes (2)
- pyproject.toml
- docs/api-reference.md
| - **Hybrid**: per-request provider credentials are resolved from the platform service (otari.ai); local DB/user/budget management is skipped and usage is reported upstream. `register_routers()` (`src/gateway/api/main.py`) only mounts `chat`, `messages`, `responses`, and `health`; management routers (keys/users/budgets/pricing/usage/etc.) are standalone-only. | ||
| - Hybrid mode spans two trust contexts that this codebase treats identically: a gateway someone self-hosts against otari.ai using a workspace's own (BYO) provider keys, and the gateway mozilla.ai operates as part of otari.ai, which additionally serves mozilla.ai-managed models. The managed-vs-BYO boundary (platform-owned upstream credentials are returned only to mozilla.ai's gateway, never to a self-hosted one) is enforced on the platform side (otari-ai), not here. User-facing explanation lives in `docs/modes.md`; the wire contract in `docs/hybrid-mode-protocol.md`. | ||
|
|
||
| ### Request lifecycle (chat completions) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the Markdown heading spacing warnings.
markdownlint-cli2 reports MD022 at Lines [37], [44], [55], and [60]. Add the required blank lines around these headings so the documentation lint passes.
Also applies to: 44-44, 55-55, 60-60
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 37-37: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 37, Add blank lines before and after the headings in the
AGENTS.md sections “Request lifecycle (chat completions)” and the headings at
the referenced locations, including those near lines 44, 55, and 60, so they
satisfy Markdownlint MD022 without changing the documentation content.
Source: Linters/SAST tools
…ruft - Make the mode-validation error messages source-agnostic (mode can be set via OTARI_MODE or the config `mode` field), rather than always naming OTARI_MODE. - Drop a redundant delenv-then-setenv and a duplicate delenv in test_url_safety.py left over from the mechanical GATEWAY_ -> OTARI_ rename. - Replace an em dash with a colon in the security-review instructions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #142 (the "Otari Gateway" to "Otari" rename), which kept the old names working for backward compatibility. The deprecation window has passed, so this retires them. Per the issue's open question, this also folds in the older pre-rename aliases.
Removed:
gatewayconsole-script alias (pyproject.toml); the CLI isotariGATEWAY_environment prefix: the native pydanticenv_prefix(nowOTARI_, which also lets complex fields be set via env), theotari_env()fallback /LEGACY_ENV_PREFIX(core/env.py), theGATEWAY_MODEalias, and the alembicGATEWAY_DATABASE_URLfallbackAnyLLM-Key/X-AnyLLM-Keyrequest-header aliasesOTARI_PLATFORM_TOKEN/ANY_LLM_PLATFORM_TOKENplatform-token env aliases; onlyOTARI_AI_TOKENremainsKept intentionally (out of scope per the issue):
gatewayPython import package (theotariPyPI name belongs to the client SDK)/gateway/...platform wire-protocol paths and theX-Gateway-Tokenheader (contract surface, not product naming)Tests that asserted the legacy names worked are inverted to assert they are now ignored (legacy env prefix ignored, legacy headers return 401, legacy token env leaves the gateway standalone).
PR Type
This is a breaking change (removes recognized CLI/env/header names); see the
BREAKING CHANGE:footer on the commit.Relevant issues
Fixes #157
Checklist
tests/unit,tests/integration).make lint,make typecheck,make test).uv run python scripts/generate_openapi.py).Note on
make test: unit tests pass (665 passed, 1 skipped). The Postgres/Testcontainers integration tests could not run in the dev sandbox (no Docker); the SQLite-based integration tests (config loading, hybrid mode, dispatch, batches) pass. CI runs the full Postgres suite.AI Usage
AI Model/Tool used: Claude Code (Opus 4.8)
Any additional AI details you'd like to share: Drafted via back-and-forth with @njbrake; the scope decision (folding in the pre-rename aliases) and the direction are his.
NOTE:
When responding to reviewer questions, please respond yourself rather than copy/pasting reviewer comments into an AI and pasting back its answer. We want to discuss with you, not your AI :)
Summary by CodeRabbit
Configuration
OTARI_environment variable prefix only.GATEWAY_environment-variable fallbacks, including related sandbox/web-search URL settings and database URL resolution.OTARI_HOST/OTARI_PORT.Authentication
Otari-KeyandAuthorization: Bearer ....AnyLLM-Key/X-AnyLLM-Keyrequest-header aliases.OTARI_AI_TOKEN.CLI / Entrypoints
gatewayconsole-script alias; onlyotariremains.Documentation & security guidance
OTARI_SANDBOX_URL/OTARI_WEB_SEARCH_URL.GATEWAY_precedence/fallbacks and legacy header names.Tests
OTARI_-based behavior is accepted.Technical notes
GATEWAY_env prefix fallbacks,GATEWAY_MODE/GATEWAY_DATABASE_URL,AnyLLM-Key/X-AnyLLM-Key, and legacy platform-token environment aliases (while keepingOTARI_AI_TOKENas the controlling token source).OTARI_SANDBOX_URL/OTARI_WEB_SEARCH_URL.