litellm_keys.sh's port-forward log exists before its first read #345

Caller: an incident in CI. On PR #338 the same tip 8392461 passed checks in run 42673886357 and failed it in run 42678835628 with bad-name: exit 2, not 1: sed: can't read /tmp/…/forward-litellm.log: No such file or directory, a red run that cost a rerun while CI is the bottleneck. Found by the merge gate of #338 (comment on that PR's lane).

The defect

scripts/litellm_keys.sh:125-132, start_forward: the port-forward's log is created only by the background job's own >"$log" redirection. The parent's first sed -n … "$log" | head -n 1 can run before the child has opened the file; sed then exits 2, and under pipefail the script ends 2 instead of the refusal's 1. It depends on scheduling under load.

What it builds

start_forward creates the log before it starts the background job (: >"$log"), so the first read finds an empty file and the loop waits as it does for a slow forward. Nothing else changes.

Proof

The cell that failed passes in checks. A deterministic regression test would need the script's structure changed to delay the child's open, which no fake kubectl can do, since the redirection happens before the command runs; the one-line fix is proven by reading and by CI.

Risk

None: a test-path race in an operator tool; the change cannot alter a value the tool writes.

version = 1
now = "Opened 09.11.2026 from #338's merge gate."
next = "Build: create the log before the forward starts."
done_when = "start_forward creates its log before the background job, and checks is green."
scope = ["scripts/litellm_keys.sh"]
size = "S"