[github-actions]

agentgateway/agentgateway#4093 and related release-note entries

Docs versions: standalone/main, standalone/latest, kubernetes/main, kubernetes/latest (first shipped in v1.7.0)

No code-path rule covers 3 touched file(s). The planner could route these only by identifier search, so the candidate pages may miss what they changed, including in the other mode:

• crates/agentgateway/src/proxy/gateway.rs
• crates/agentgateway/src/proxy/httpproxy.rs
• crates/agentgateway/src/proxy/mod.rs

What changes for users: This bundle records seven user-visible fixes: client-safe Substrate TLS denials, redacted ext_authz and rate-limit trace logs, stopped ext_proc upstream streaming after downstream disconnect, restored buffered Completions model metadata, controller mesh-config updates without panic, Bedrock file and document conversion, and prompt-cache markers for major-only GPT model names.

What the docs now say: Each item leaves a proposed Fixes bullet for the release-notes page, grouped under the existing Traffic management, LLM, and Operations labels. No content page changed because the planner found no page that documents these fixes.

Not verified: No cluster was available and no configuration was applied. Hugo was not run, so internal links are unchecked.

How agentgateway-4093 was drafted, and what was not verified

• Code PR: Remove InterceptDenied and expose substrate specific error messagss agentgateway#4093, ext_authz, ratelimit: don't log header values from check responses agentgateway#4139, fix(ext_proc): stop body stream when downstream is dropped agentgateway#4174, fix(llm): restore missing model in buffered completions agentgateway#4181, controller: avoid panic when mesh config changes agentgateway#4195, fix(llm): convert OpenAI file parts & Anthropic document blocks to Bedrock documents agentgateway#4199, Fix cache markers for gpt 6 agentgateway#4249
• Product: agentgateway (upstream) -> agentgateway/website
• Docs version: standalone/main, standalone/latest, kubernetes/main, kubernetes/latest. #4093 first shipped in v1.7.0; #4139 first shipped in v1.7.0-rc.1. The remaining entries target the development tree.
• Category: release-note-entry / pr

Plan, and what changed it

• Planned: Write one Fixes release-note bullet for each authorized release-note-entry item in the cluster.
• Learned: Existing release-notes pages already use Traffic management, LLM, and Operations labels under ## 🐛 Fixes, from content/docs/*/release-notes/release-notes.md.
• Did: Wrote one proposed-release-note.md in each authorized item dossier and this single cluster report in the lowest-numbered dossier.

Why a documentation change is necessary

The work-list classified each item as release-note-entry: the planner found no content page that documents the changed behavior, but the agentgateway release-notes page has a Fixes section. The dossier diffs show user-visible behavior changes for traffic handling, logs, controller reconciliation, and LLM conversion. A release-note bullet is the only documentation artifact requested for these items.

How to verify this change

2. In the generated diff, check the agentgateway release-notes pages for the mode and version trees named in the work-list.
3. Confirm that each placed Fixes bullet appears under the expected label and carries the corresponding code PR reference.

Proposed release note

Wrote a proposed release note for each authorized release-note-entry item in this cluster. The workflow places those notes on the release-notes pages after the write guards pass.

What was not verified

No cluster was available, and no configuration was applied. The configuration is unrun. Hugo was not run, so internal links are unchecked.

How the pages were chosen (triage report)

Feature clusters

These pull requests document one feature between them:

Cluster	Pull requests	Product	Why grouped
c5	agentgateway/agentgateway#4093, agentgateway/agentgateway#4139, agentgateway/agentgateway#4171, agentgateway/agentgateway#4174, agentgateway/agentgateway#4181, agentgateway/agentgateway#4195, agentgateway/agentgateway#4199, agentgateway/agentgateway#4249	agentgateway	both are Fixes bullets for the same release-notes page, so they share one pull request

Draft a release-note entry: a fix no page documents

agentgateway/agentgateway#4093 — Remove InterceptDenied and expose substrate specific error messagss

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, standalone/latest, kubernetes/main, kubernetes/latest
• Summary (read from the body): Substrate's tests/contract expects that TLS Passthrough that is untrusted gets blocked at ClientHello (we currently return a 403). Furthermore, we were running networkAuthorization after returning 200 to the CONNECT, but we should do it before. We should do it before, but going to do that in a follow up so we can get up to date before 1.7
• Not tested: no cluster was available, so every command in this diff is unrun

agentgateway/agentgateway#4139 — ext_authz, ratelimit: don't log header values from check responses

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, standalone/latest, kubernetes/main, kubernetes/latest
• Code issue: ext_authz: "check response" trace log prints header values from the auth server in clear agentgateway#4129
• Summary (read from the body): Summary - Updated the ext_authz and rate-limit client trace logs to prevent sensitive header values from being exposed. The logs now include response status, header names, query-parameter names, and body length without logging actual values.
• Not tested: no cluster was available, so every command in this diff is unrun

agentgateway/agentgateway#4174 — fix(ext_proc): stop body stream when downstream is dropped

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, kubernetes/main
• Code issue: InferencePool: client disconnect does not close the upstream connection agentgateway#4119
• Summary (read from the body): - llm-d on a k8s cluster with agentgateway
• Not tested: no cluster was available, so every command in this diff is unrun

agentgateway/agentgateway#4181 — fix(llm): restore missing model in buffered completions

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, kubernetes/main
• Code issue: Completions: responses missing the model field fail to parse agentgateway#4169
• Summary (the title; the body has no description): restore missing model in buffered completions
• Not tested: no cluster was available, so every command in this diff is unrun

agentgateway/agentgateway#4195 — controller: avoid panic when mesh config changes

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: kubernetes/main
• Summary (the title; the body has no description): controller: avoid panic when mesh config changes
• Not tested: no cluster was available, so every command in this diff is unrun

agentgateway/agentgateway#4199 — fix(llm): convert OpenAI file parts & Anthropic document blocks to Bedrock documents

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, kubernetes/main
• Code issue: Bedrock conversion silently drops file/document Content Parts for OpenAI & Anthropic Requests agentgateway#4177
• Summary (read from the body): Summary Inline file parts in OpenAI chat completions requests and document content in Anthropic messages requests were silently dropped in the Bedrock conversion layer i.e the model never saw the attached file, even though the request returned a 200.
• Not tested: no cluster was available, so every command in this diff is unrun

agentgateway/agentgateway#4249 — Fix cache markers for gpt 6

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, kubernetes/main
• Summary (read from the body): we expected major.minor but gpt-6-luna is just major; allow that as well
• Not tested: no cluster was available, so every command in this diff is unrun

Release notes

This pull request also adds its release-note entries:

• content/docs/kubernetes/latest/release-notes/release-notes.md: Remove InterceptDenied and expose substrate specific error messagss (fix, under Traffic management)
• content/docs/kubernetes/latest/release-notes/release-notes.md: ext_authz, ratelimit: don't log header values from check responses (fix, under Traffic management)
• content/docs/kubernetes/main/release-notes/release-notes.md: Remove InterceptDenied and expose substrate specific error messagss (fix, under Traffic management)
• content/docs/kubernetes/main/release-notes/release-notes.md: ext_authz, ratelimit: don't log header values from check responses (fix, under Traffic management)
• content/docs/kubernetes/main/release-notes/release-notes.md: fix(ext_proc): stop body stream when downstream is dropped (fix, under Traffic management, in a new 1.8 section)
• content/docs/kubernetes/main/release-notes/release-notes.md: fix(llm): restore missing model in buffered completions (fix, under LLM)
• content/docs/kubernetes/main/release-notes/release-notes.md: controller: avoid panic when mesh config changes (fix, under Operations)
• content/docs/kubernetes/main/release-notes/release-notes.md: fix(llm): convert OpenAI file parts & Anthropic document blocks to Bedrock documents (fix, under LLM)
• content/docs/kubernetes/main/release-notes/release-notes.md: Fix cache markers for gpt 6 (fix, under LLM)
• content/docs/standalone/latest/release-notes/release-notes.md: Remove InterceptDenied and expose substrate specific error messagss (fix, under Traffic management)
• content/docs/standalone/latest/release-notes/release-notes.md: ext_authz, ratelimit: don't log header values from check responses (fix, under Traffic management)
• content/docs/standalone/main/release-notes/release-notes.md: Remove InterceptDenied and expose substrate specific error messagss (fix, under Traffic management)
• content/docs/standalone/main/release-notes/release-notes.md: ext_authz, ratelimit: don't log header values from check responses (fix, under Traffic management)
• content/docs/standalone/main/release-notes/release-notes.md: fix(ext_proc): stop body stream when downstream is dropped (fix, under Traffic management, in a new 1.8 section)
• content/docs/standalone/main/release-notes/release-notes.md: fix(llm): restore missing model in buffered completions (fix, under LLM)
• content/docs/standalone/main/release-notes/release-notes.md: fix(llm): convert OpenAI file parts & Anthropic document blocks to Bedrock documents (fix, under LLM)
• content/docs/standalone/main/release-notes/release-notes.md: Fix cache markers for gpt 6 (fix, under LLM)

Check these release-note links and names. Each note is on its page, but a link may not reach the drafted content there, or a name may belong to the other mode:

• content/docs/kubernetes/main/release-notes/release-notes.md: Fix cache markers for gpt 6 agentgateway#4249's note names gpt-6-luna, which content/docs/standalone/main mentions and content/docs/kubernetes/main does not. Check that this tree's readers can set it, or word the note for this mode.

Draft branch: pr-tracker-draft-agentgateway-4093-plus6

[cloudflare-workers-and-pages]

Deploying agentproxy with    Cloudflare Pages

Latest commit:	a0a681a
Status:	✅  Deploy successful!
Preview URL:	https://bed78b64.agentproxy.pages.dev
Branch Preview URL:	https://pr-tracker-draft-agentgatewa-kkdt.agentproxy.pages.dev

View logs