Skip to content

rules(models,gateways): remove the per-model image concept — one shared gateway (#294) - #295

Open
elronbandel wants to merge 1 commit into
mainfrom
elron/no-per-model-images-rules
Open

rules(models,gateways): remove the per-model image concept — one shared gateway (#294)#295
elronbandel wants to merge 1 commit into
mainfrom
elron/no-per-model-images-rules

Conversation

@elronbandel

@elronbandel elronbandel commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Doctrine half of #294, following the #187 pattern (rules first, implementation second — contributing rule 2). The implementation PR is #296.

What changes

The model axis keeps exactly one framework image kind: the shared generic gateway. EVAL_MODEL=<provider>/<model> is the only way to pick a model; the image only picks the proxy flavor. models/replay stays as the sole in-tree pinned exception.

  • models rule 1 — the framework MUST NOT ship or publish images that bake an upstream model (was: "MAY pin as a deliberate exception"); replay (rule 17) is the single in-tree exception.
  • models rule 1a (new) — custom model images remain possible as downstream, user-owned artifacts: FROM a published gateways/<flavor> + config template only, selected via the standard image seam (EVAL_GATEWAY_IMAGE / gatewayImageRef). Explicitly non-default; never in the framework's tree or registry. This is the backward-compatibility escape hatch for teams that relied on a pinned image's custom config — they can rebuild the identical artifact in their own registry.
  • models rule 12 — retargeted from the LiteLLM/core/litellm pin to the gateway build-time pin (gateway.<flavor>_version, gateways rule 14).
  • models rule 13 — deprecated in place (meta rule 10): the EVAL_LITELLM_VERSION runtime override has had no implementer since Delete dead eval-entrypoint.sh #50 and its only intended consumers (the pinned per-model images) are being removed.
  • models rule 15 — required labels retargeted to eval.type + gateway.kind (replay keeps eval.model.*).
  • models rule 16 — the enforcement pointer to containers/core/litellm/eval-litellm-entrypoint.sh dropped (the base image goes with the pinned images); the cap requirement itself is unchanged.
  • gateways rules 16–17 — rewritten: the framework publishes exactly one combo per flavor (models/<flavor> FROM gateways/<flavor>, template-only); per-model combos are no longer published by the framework, while downstream template-only derivations stay permitted (models rule 1a).
  • RULES.md principle 9 / src rules 10, 12EVAL_LITELLM_VERSION / --litellm-version dropped from the internal-version axis and CLI parity list.
  • add-benchmark template + audit-rules-drift example updated to the single-path story.

All four changed RULES.md files carry dated changelog entries.

Rules checked against

Resolves the doctrine half of #294.

…ed gateway, models are runtime-only (#294)

Doctrine half of #294 (the #187 pattern). The model axis keeps exactly one
image kind: the shared generic gateway, with the model always selected at
runtime via EVAL_MODEL.

- models rule 1: images that bake an upstream model are forbidden; replay
  (rule 17) is the sole sanctioned exception.
- models rule 12 retargeted to the gateway build-time version pin
  (gateway.<flavor>_version); rule 13 (EVAL_LITELLM_VERSION runtime
  override — unimplemented since #50) deprecated in place; rule 15 labels
  retargeted to gateway.kind; rule 16's enforcement pointer to the deleted
  core/litellm entrypoint dropped.
- gateways rules 16-17: one combo per flavor (models/<flavor> FROM
  gateways/<flavor>), per-model combos (models/<model>--<gateway>) forbidden.
- RULES.md principle 9 + src rules 10/12: EVAL_LITELLM_VERSION /
  --litellm-version dropped from the internal-version axis.
- add-benchmark template + audit-rules-drift example updated to the
  single-path story.

Checked against: meta/rules 9-10 (changelogs, deprecate-in-place),
contributing 1-3.

Signed-off-by: Elron Bandel <elron.bandel@ibm.com>
@elronbandel
elronbandel force-pushed the elron/no-per-model-images-rules branch from 5790d93 to 0050146 Compare August 9, 2026 14:35
elronbandel added a commit that referenced this pull request Aug 9, 2026
…models picked at runtime (#294)

Implementation half of #294 (doctrine: #295). The model axis now has exactly
one image kind: the shared generic gateway. EVAL_MODEL=<provider>/<model> is
the only way to pick a model; EVAL_GATEWAY_IMAGE picks only the proxy flavor
(bifrost default; litellm/portkey). models/replay stays as the sole pinned
exception (models rule 17).

Removed:
- containers/models/{gpt-5,gpt-5.4,gpt-4.1-mini,claude-opus-4,claude-sonnet-4}
  (the five pinned per-model images) and containers/core/litellm, their only
  base — orphaned once they are gone (gateways/litellm is independent).
- The litellmVersion chart knob + EVAL_LITELLM_VERSION env plumbing
  (unimplemented since #50) and the litellm-version rego gates, which matched
  exactly the five deleted Dockerfiles.

Retargeted guards:
- tests/static/model-paths.sweep.sh: asserts the single path — default flavor
  + flavor swap, with the handle always reaching the gateway at runtime.
- tests/static/check.rs::model_axis_generic_default_no_silent_model: every
  models/<name> image must be FROM a gateways/<flavor> image (replay
  excepted), so a per-model image cannot sneak back in.

deploy/oc scripts un-conflated: --model is now the <provider>/<model> handle
(what the chart's `model` value actually is) and --gateway the flavor; the
dead evalModel plumbing and the --bifrost-suffix-stripping handle derivation
are gone; result paths key on the clean model label.

Docs, PR/issue templates, and .env.example collapse to the single-path story;
stale core/litellm pointers now name gateways/litellm.

Checked against: models/RULES.md 1, 12-17; gateways/RULES.md 16-17;
RULES.md 8-9, 15; src/RULES.md 10, 12; verification/RULES.md (static gates
green: cargo test -p eval-containers + --test check + dockerfile_inspection,
conftest verify 80/80, helm sweep 102/102, model-paths sweep).

BREAKING CHANGE: the models/{gpt-5,gpt-5.4,gpt-4.1-mini,claude-opus-4,
claude-sonnet-4} images are no longer published; set
EVAL_MODEL=<provider>/<model> on the shared gateway instead.

Signed-off-by: Elron Bandel <elron.bandel@ibm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove per-model gateway images — one shared model gateway, models are runtime-only

1 participant