feat(codex): align Search and execution protocol

2026-10-05 00:47:48 +08:00 · 2026-07-12 03:04:15 +08:00
parent 59d37ae1dd
commit 2316df5c9a
121 changed files with 5141 additions and 543 deletions
@@ -559,6 +559,103 @@ async fn gateway_creates_admin_provider_endpoint_locally_with_trusted_admin_prin
    upstream_handle.abort();
 }

+#[tokio::test]
+async fn gateway_rejects_streaming_policy_for_search_endpoint_before_catalog_write() {
+    let mut create_provider = sample_provider("provider-search-create", "search-create", 10);
+    create_provider.provider_type = "custom".to_string();
+    let mut update_provider = sample_provider("provider-search-update", "search-update", 20);
+    update_provider.provider_type = "custom".to_string();
+    let mut existing_endpoint = sample_endpoint(
+        "endpoint-search-update",
+        "provider-search-update",
+        "openai:search",
+        "https://search.example/v1",
+    );
+    existing_endpoint.config = Some(json!({"marker": "kept"}));
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![create_provider, update_provider],
+        vec![existing_endpoint],
+        vec![],
+    ));
+
+    let gateway = build_router_with_state(
+        AppState::new()
+            .expect("gateway should build")
+            .with_data_state_for_tests(
+                GatewayDataState::with_provider_catalog_repository_for_tests(
+                    provider_catalog_repository.clone(),
+                ),
+            ),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+    let client = reqwest::Client::new();
+
+    let create_response = client
+        .post(format!(
+            "{gateway_url}/api/admin/endpoints/providers/provider-search-create/endpoints"
+        ))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "provider_id": "provider-search-create",
+            "api_format": "openai:search",
+            "base_url": "https://search.example/v1",
+            "config": {"upstream_stream_policy": "force_stream"}
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+    assert_eq!(create_response.status(), StatusCode::BAD_REQUEST);
+    let create_payload: serde_json::Value = create_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(
+        create_payload["detail"],
+        "OpenAI Search 端点仅支持非流式上游请求"
+    );
+
+    let update_response = client
+        .put(format!(
+            "{gateway_url}/api/admin/endpoints/endpoint-search-update"
+        ))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "config": {"upstreamStreamPolicy": true}
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+    assert_eq!(update_response.status(), StatusCode::BAD_REQUEST);
+    let update_payload: serde_json::Value = update_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(
+        update_payload["detail"],
+        "OpenAI Search 端点仅支持非流式上游请求"
+    );
+
+    let created = provider_catalog_repository
+        .list_endpoints_by_provider_ids(&["provider-search-create".to_string()])
+        .await
+        .expect("endpoints should read");
+    assert!(created.is_empty());
+    let unchanged = provider_catalog_repository
+        .list_endpoints_by_ids(&["endpoint-search-update".to_string()])
+        .await
+        .expect("endpoint should read");
+    assert_eq!(unchanged.len(), 1);
+    assert_eq!(unchanged[0].config, Some(json!({"marker": "kept"})));
+
+    gateway_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_updates_admin_provider_endpoint_locally_with_trusted_admin_principal() {
    let upstream_hits = Arc::new(Mutex::new(0usize));
@@ -6086,6 +6086,9 @@ async fn gateway_manual_codex_oauth_refresh_reconciles_missing_fixed_endpoint_im
        .iter()
        .find(|endpoint| endpoint.api_format == "openai:responses")
        .expect("openai responses endpoint should be reconciled");
+    assert!(endpoints
+        .iter()
+        .any(|endpoint| endpoint.api_format == "openai:search"));
    assert_eq!(
        responses_endpoint.base_url,
        "https://chatgpt.com/backend-api/codex"
@@ -2399,6 +2399,188 @@ async fn gateway_streams_codex_openai_responses_upstream_for_admin_pool_model_te
    execution_runtime_handle.abort();
 }

+#[test]
+fn gateway_executes_codex_search_admin_pool_model_test_with_search_contract() {
+    run_provider_query_test(
+        "gateway_executes_codex_search_admin_pool_model_test_with_search_contract",
+        gateway_executes_codex_search_admin_pool_model_test_with_search_contract_impl,
+    );
+}
+
+async fn gateway_executes_codex_search_admin_pool_model_test_with_search_contract_impl() {
+    let execution_runtime = Router::new().route(
+        "/v1/execute/sync",
+        any(move |Json(plan): Json<ExecutionPlan>| async move {
+            assert_eq!(plan.provider_id, "provider-codex-search");
+            assert_eq!(plan.endpoint_id, "endpoint-codex-search");
+            assert_eq!(plan.key_id, "key-codex-search");
+            assert_eq!(plan.client_api_format, "openai:search");
+            assert_eq!(plan.provider_api_format, "openai:search");
+            assert_eq!(
+                plan.url,
+                "https://chatgpt.com/backend-api/codex/alpha/search"
+            );
+            assert_eq!(plan.model_name.as_deref(), Some("gpt-5.6-sol"));
+            assert!(!plan.stream, "Codex Search is a synchronous JSON protocol");
+            assert_eq!(
+                plan.timeouts
+                    .as_ref()
+                    .and_then(|timeouts| timeouts.total_ms),
+                Some(900_000)
+            );
+            assert_eq!(
+                plan.headers.get("authorization").map(String::as_str),
+                Some("Bearer codex-search-access-token")
+            );
+            assert_eq!(
+                plan.headers.get("chatgpt-account-id").map(String::as_str),
+                Some("account-search-admin")
+            );
+            assert_eq!(
+                plan.headers.get("x-openai-fedramp").map(String::as_str),
+                Some("true")
+            );
+            assert_eq!(
+                plan.headers.get("originator").map(String::as_str),
+                Some("codex_cli_rs")
+            );
+            assert!(plan
+                .headers
+                .get("user-agent")
+                .is_some_and(|value| value.starts_with("codex_cli_rs/")));
+            assert!(!plan.headers.contains_key("openai-beta"));
+            assert!(!plan
+                .headers
+                .contains_key("x-openai-internal-codex-responses-lite"));
+            assert_ne!(
+                plan.headers.get("accept").map(String::as_str),
+                Some("text/event-stream")
+            );
+
+            let body = plan.body.json_body.as_ref().expect("search json body");
+            assert_eq!(
+                body["id"],
+                json!("aether-model-test-provider-query-search-trace")
+            );
+            assert_eq!(body["model"], json!("gpt-5.6-sol"));
+            assert_eq!(body["input"], json!("find current OpenAI documentation"));
+            assert_eq!(
+                body["commands"]["search_query"][0]["q"],
+                json!("OpenAI Codex Search")
+            );
+            assert!(body.get("stream").is_none());
+            assert!(body.get("store").is_none());
+            assert!(body.get("service_tier").is_none());
+            assert!(body.get("unknown_field").is_none());
+
+            Json(json!({
+                "request_id": plan.request_id,
+                "candidate_id": plan.candidate_id,
+                "status_code": 200,
+                "headers": {
+                    "content-type": "application/json"
+                },
+                "body": {
+                    "json_body": {
+                        "output": "search result"
+                    }
+                },
+                "telemetry": {
+                    "elapsed_ms": 21
+                }
+            }))
+        }),
+    );
+
+    let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await;
+    let mut provider = sample_provider("provider-codex-search", "Codex Search", 10);
+    provider.provider_type = "codex".to_string();
+    provider.request_timeout_secs = Some(900.0);
+    let mut endpoint = sample_endpoint(
+        "endpoint-codex-search",
+        "provider-codex-search",
+        "openai:search",
+        "https://chatgpt.com/backend-api/codex",
+    );
+    endpoint.config = Some(json!({"upstream_stream_policy": "force_stream"}));
+    let mut key = sample_key(
+        "key-codex-search",
+        "provider-codex-search",
+        "openai:search",
+        "codex-search-access-token",
+    );
+    key.auth_type = "oauth".to_string();
+    key.encrypted_auth_config = Some(
+        aether_crypto::encrypt_python_fernet_plaintext(
+            DEVELOPMENT_ENCRYPTION_KEY,
+            r#"{"provider_type":"codex","account_id":"account-search-admin","is_fedramp":true}"#,
+        )
+        .expect("auth config should encrypt"),
+    );
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![endpoint],
+        vec![key],
+    ));
+
+    let gateway = build_router_with_state(
+        build_state_with_execution_runtime_override(execution_runtime_url)
+            .with_data_state_for_tests(GatewayDataState::with_provider_transport_reader_for_tests(
+                provider_catalog_repository,
+                DEVELOPMENT_ENCRYPTION_KEY.to_string(),
+            )),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .post(format!(
+            "{gateway_url}/api/admin/provider-query/test-model-failover"
+        ))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "provider_id": "provider-codex-search",
+            "mode": "pool",
+            "model": "gpt-5.6-sol",
+            "failover_models": ["gpt-5.6-sol"],
+            "api_format": "openai:search",
+            "endpoint_id": "endpoint-codex-search",
+            "request_id": "provider-query-search-trace",
+            "request_body": {
+                "model": "gpt-5.6-sol",
+                "input": "find current OpenAI documentation",
+                "commands": {
+                    "search_query": [{"q": "OpenAI Codex Search"}]
+                },
+                "max_output_tokens": 256,
+                "stream": true,
+                "store": false,
+                "service_tier": "priority",
+                "unknown_field": true
+            }
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["success"], json!(true), "payload={payload}");
+    assert_eq!(
+        payload["attempts"][0]["request_body"]["id"],
+        json!("aether-model-test-provider-query-search-trace")
+    );
+    assert_eq!(
+        payload["attempts"][0]["response_body"]["output"],
+        json!("search result")
+    );
+
+    gateway_handle.abort();
+    execution_runtime_handle.abort();
+}
+
 #[test]
 fn gateway_routes_grok_responses_admin_pool_model_test_through_grok_runtime() {
    run_provider_query_test(
@@ -832,7 +832,7 @@ async fn gateway_updates_admin_provider_locally_with_trusted_admin_principal() {
            "is_active": false,
            "concurrent_limit": 8,
            "max_retries": 6,
-            "request_timeout": 55.0,
+            "request_timeout": aether_contracts::MAX_EXECUTION_REQUEST_TIMEOUT_SECS,
            "stream_first_byte_timeout": 11.0,
            "enable_format_conversion": false,
            "config": {
@@ -860,7 +860,10 @@ async fn gateway_updates_admin_provider_locally_with_trusted_admin_principal() {
    assert_eq!(payload["enable_format_conversion"], false);
    assert_eq!(payload["is_active"], false);
    assert_eq!(payload["max_retries"], 6);
-    assert_eq!(payload["request_timeout"], 55.0);
+    assert_eq!(
+        payload["request_timeout"],
+        aether_contracts::MAX_EXECUTION_REQUEST_TIMEOUT_SECS
+    );
    assert_eq!(payload["stream_first_byte_timeout"], 11.0);
    assert_eq!(payload["proxy"], json!({"url": "https://proxy.example"}));
    assert_eq!(payload["claude_code_advanced"], json!({"pool_size": 2}));
@@ -870,6 +873,21 @@ async fn gateway_updates_admin_provider_locally_with_trusted_admin_principal() {
    assert_eq!(payload["ops_configured"], true);
    assert_eq!(payload["ops_architecture_id"], "cubence");

+    let invalid_timeout_response = reqwest::Client::new()
+        .patch(format!("{gateway_url}/api/admin/providers/provider-openai"))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "request_timeout":
+                aether_contracts::MAX_EXECUTION_REQUEST_TIMEOUT_SECS + 1
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+    assert_eq!(invalid_timeout_response.status(), StatusCode::BAD_REQUEST);
+
    let disable_response = reqwest::Client::new()
        .patch(format!("{gateway_url}/api/admin/providers/provider-openai"))
        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
@@ -924,6 +942,10 @@ async fn gateway_updates_admin_provider_locally_with_trusted_admin_principal() {
        .iter()
        .find(|provider| provider.id == "provider-openai")
        .expect("provider should exist");
+    assert_eq!(
+        updated_provider.request_timeout_secs,
+        Some(aether_contracts::MAX_EXECUTION_REQUEST_TIMEOUT_SECS as f64)
+    );
    assert_eq!(
        updated_provider
            .config
@@ -1000,6 +1022,7 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
            "website": "codex.example",
            "keep_priority_on_conversion": true,
            "max_retries": 7,
+            "request_timeout": aether_contracts::MAX_EXECUTION_REQUEST_TIMEOUT_SECS,
            "config": {"chat_pii_redaction": {"enabled": true}},
            "pool_advanced": {},
            "failover_rules": {"strategy": "ordered"},
@@ -1034,6 +1057,10 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
    assert_eq!(created.website.as_deref(), Some("https://codex.example"));
    assert!(created.enable_format_conversion);
    assert_eq!(created.max_retries, Some(7));
+    assert_eq!(
+        created.request_timeout_secs,
+        Some(aether_contracts::MAX_EXECUTION_REQUEST_TIMEOUT_SECS as f64)
+    );
    assert_eq!(created.keep_priority_on_conversion, true);
    assert_eq!(
        created
@@ -1080,7 +1107,7 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
        .list_endpoints_by_provider_ids(std::slice::from_ref(&created.id))
        .await
        .expect("endpoints should list");
-    assert_eq!(endpoints.len(), 3);
+    assert_eq!(endpoints.len(), 4);
    let responses_endpoint = endpoints
        .iter()
        .find(|endpoint| endpoint.api_format == "openai:responses")
@@ -1089,6 +1116,10 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
        .iter()
        .find(|endpoint| endpoint.api_format == "openai:responses:compact")
        .expect("compact endpoint should exist");
+    let search_endpoint = endpoints
+        .iter()
+        .find(|endpoint| endpoint.api_format == "openai:search")
+        .expect("search endpoint should exist");
    let image_endpoint = endpoints
        .iter()
        .find(|endpoint| endpoint.api_format == "openai:image")
@@ -1101,12 +1132,17 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
        compact_endpoint.base_url,
        "https://chatgpt.com/backend-api/codex"
    );
+    assert_eq!(
+        search_endpoint.base_url,
+        "https://chatgpt.com/backend-api/codex"
+    );
    assert_eq!(
        image_endpoint.base_url,
        "https://chatgpt.com/backend-api/codex"
    );
    assert_eq!(responses_endpoint.max_retries, Some(7));
    assert_eq!(compact_endpoint.max_retries, Some(7));
+    assert_eq!(search_endpoint.max_retries, Some(7));
    assert_eq!(image_endpoint.max_retries, Some(7));
    assert_eq!(
        responses_endpoint
@@ -1116,6 +1152,14 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
            .and_then(serde_json::Value::as_str),
        Some("force_stream")
    );
+    assert_eq!(
+        search_endpoint
+            .config
+            .as_ref()
+            .and_then(|value| value.get("upstream_stream_policy"))
+            .and_then(serde_json::Value::as_str),
+        None
+    );
    assert_eq!(
        image_endpoint
            .config
@@ -1126,6 +1170,7 @@ async fn gateway_creates_admin_provider_locally_with_trusted_admin_principal() {
    );
    assert!(responses_endpoint.body_rules.is_none());
    assert!(compact_endpoint.body_rules.is_none());
+    assert!(search_endpoint.body_rules.is_none());
    assert!(image_endpoint.body_rules.is_none());
    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);

@@ -1216,7 +1261,7 @@ async fn gateway_updates_fixed_provider_and_reconciles_template_managed_endpoint
        .list_endpoints_by_provider_ids(&["provider-codex".to_string()])
        .await
        .expect("endpoints should list");
-    assert_eq!(endpoints.len(), 3);
+    assert_eq!(endpoints.len(), 4);
    let responses_endpoint = endpoints
        .iter()
        .find(|endpoint| endpoint.api_format == "openai:responses")
@@ -1225,6 +1270,10 @@ async fn gateway_updates_fixed_provider_and_reconciles_template_managed_endpoint
        .iter()
        .find(|endpoint| endpoint.api_format == "openai:responses:compact")
        .expect("compact endpoint should exist");
+    let search_endpoint = endpoints
+        .iter()
+        .find(|endpoint| endpoint.api_format == "openai:search")
+        .expect("search endpoint should exist");
    let image_endpoint = endpoints
        .iter()
        .find(|endpoint| endpoint.api_format == "openai:image")
@@ -1232,6 +1281,7 @@ async fn gateway_updates_fixed_provider_and_reconciles_template_managed_endpoint

    assert_eq!(responses_endpoint.max_retries, Some(9));
    assert_eq!(compact_endpoint.max_retries, Some(9));
+    assert_eq!(search_endpoint.max_retries, Some(9));
    assert_eq!(image_endpoint.max_retries, Some(9));
    assert_eq!(
        responses_endpoint
@@ -1242,6 +1292,23 @@ async fn gateway_updates_fixed_provider_and_reconciles_template_managed_endpoint
            .and_then(serde_json::Value::as_bool),
        Some(true)
    );
+    assert_eq!(
+        search_endpoint
+            .config
+            .as_ref()
+            .and_then(|value| value.get("_aether_fixed_provider_template"))
+            .and_then(|value| value.get("managed"))
+            .and_then(serde_json::Value::as_bool),
+        Some(true)
+    );
+    assert_eq!(
+        search_endpoint
+            .config
+            .as_ref()
+            .and_then(|value| value.get("upstream_stream_policy"))
+            .and_then(serde_json::Value::as_str),
+        None
+    );
    assert_eq!(
        image_endpoint
            .config
@@ -1255,7 +1322,7 @@ async fn gateway_updates_fixed_provider_and_reconciles_template_managed_endpoint
        .await
        .expect("keys should list");
    assert_eq!(keys.len(), 1);
-    assert!(keys[0].api_formats.is_none());
+    assert_eq!(keys[0].api_formats, Some(json!(["openai:responses"])));
    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);

    gateway_handle.abort();
@@ -10,6 +10,8 @@ use futures_util::stream;
 use http::header::HeaderValue;
 use http::StatusCode;
 use serde_json::json;
+use std::collections::HashMap;
+use std::time::Duration;

 use super::{
    build_router_with_state, sample_proxy_node, start_server, AppState, GatewayDataState,
@@ -318,6 +320,88 @@ async fn gateway_forwards_tunnel_relay_to_attachment_owner() {
    owner_handle.abort();
 }

+#[tokio::test]
+async fn gateway_owner_relay_uses_non_stream_timeout_from_envelope() {
+    let owner = Router::new().route(
+        "/api/internal/tunnel/relay/node-123",
+        post(|body: Body| async move {
+            let body = axum::body::to_bytes(body, usize::MAX)
+                .await
+                .expect("body should read");
+            tokio::time::sleep(Duration::from_millis(40)).await;
+            (StatusCode::OK, Body::from(body))
+        }),
+    );
+
+    let (owner_url, owner_handle) = start_server(owner).await;
+    let data_state = GatewayDataState::disabled().with_system_config_values_for_tests(vec![(
+        "tunnel.attachments.node-123".to_string(),
+        json!({
+            "gateway_instance_id": "gateway-b",
+            "relay_base_url": owner_url,
+            "conn_count": 1,
+            "observed_at_unix_secs": 4_102_444_800u64,
+        }),
+    )]);
+    let mut state = AppState::new()
+        .expect("gateway should build")
+        .with_data_state_for_tests(data_state)
+        .with_tunnel_identity_for_tests("gateway-a", Some("http://gateway-a.internal"));
+    let short_timeout_client = reqwest::Client::builder()
+        .timeout(Duration::from_millis(10))
+        .build()
+        .expect("test client should build");
+    state.client = short_timeout_client.clone();
+    state.owner_forward_client = short_timeout_client;
+    let gateway = build_router_with_state(state);
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let meta = aether_contracts::tunnel::RequestMeta {
+        provider_id: Some("provider-1".to_string()),
+        endpoint_id: Some("endpoint-1".to_string()),
+        key_id: Some("key-1".to_string()),
+        method: "POST".to_string(),
+        url: "https://example.com/responses".to_string(),
+        headers: HashMap::new(),
+        stream: false,
+        request_timeout_ms: Some(100),
+        stream_first_byte_timeout_ms: None,
+        timeout: 60,
+        follow_redirects: None,
+        http1_only: false,
+        transport_profile: None,
+    };
+    let encoded_meta = serde_json::to_vec(&meta).expect("metadata should encode");
+    let mut envelope = Vec::new();
+    envelope.extend_from_slice(&(encoded_meta.len() as u32).to_be_bytes());
+    envelope.extend_from_slice(&encoded_meta);
+    envelope.extend_from_slice(b"relay-body");
+    let split_at = 4 + encoded_meta.len() / 2;
+    let request_body = reqwest::Body::wrap_stream(stream::iter(vec![
+        Ok::<Bytes, io::Error>(Bytes::copy_from_slice(&envelope[..split_at])),
+        Ok::<Bytes, io::Error>(Bytes::copy_from_slice(&envelope[split_at..])),
+    ]));
+
+    let response = reqwest::Client::builder()
+        .timeout(Duration::from_secs(1))
+        .build()
+        .expect("request client should build")
+        .post(format!("{gateway_url}/api/internal/tunnel/relay/node-123"))
+        .body(request_body)
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(
+        response.bytes().await.expect("response body should read"),
+        Bytes::from(envelope)
+    );
+
+    gateway_handle.abort();
+    owner_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_streams_tunnel_relay_body_to_attachment_owner() {
    let owner_hits = Arc::new(Mutex::new(0usize));
@@ -331,8 +415,12 @@ async fn gateway_streams_tunnel_relay_body_to_attachment_owner() {
                let body = axum::body::to_bytes(body, usize::MAX)
                    .await
                    .expect("body should read");
-                assert_eq!(body, Bytes::from_static(b"relay-stream-envelope"));
-                (StatusCode::OK, Body::from("stream-ok"))
+                let response_body = Body::from_stream(async_stream::stream! {
+                    yield Ok::<_, io::Error>(Bytes::from_static(b"stream-"));
+                    tokio::time::sleep(Duration::from_millis(40)).await;
+                    yield Ok::<_, io::Error>(Bytes::from_static(b"ok"));
+                });
+                (StatusCode::OK, response_body)
            }
        }),
    );
@@ -347,19 +435,41 @@ async fn gateway_streams_tunnel_relay_body_to_attachment_owner() {
            "observed_at_unix_secs": 4_102_444_800u64,
        }),
    )]);
-    let gateway = build_router_with_state(
-        AppState::new()
-            .expect("gateway should build")
-            .with_data_state_for_tests(data_state)
-            .with_tunnel_identity_for_tests("gateway-a", Some("http://gateway-a.internal")),
-    );
+    let mut state = AppState::new()
+        .expect("gateway should build")
+        .with_data_state_for_tests(data_state)
+        .with_tunnel_identity_for_tests("gateway-a", Some("http://gateway-a.internal"));
+    state.client = reqwest::Client::builder()
+        .timeout(Duration::from_millis(10))
+        .build()
+        .expect("short shared client should build");
+    let gateway = build_router_with_state(state);
    let (gateway_url, gateway_handle) = start_server(gateway).await;

-    let request_body = reqwest::Body::wrap_stream(stream::iter(vec![
-        Ok::<Bytes, io::Error>(Bytes::from_static(b"relay-")),
-        Ok::<Bytes, io::Error>(Bytes::from_static(b"stream-")),
-        Ok::<Bytes, io::Error>(Bytes::from_static(b"envelope")),
-    ]));
+    let meta = aether_contracts::tunnel::RequestMeta {
+        provider_id: Some("provider-1".to_string()),
+        endpoint_id: Some("endpoint-1".to_string()),
+        key_id: Some("key-1".to_string()),
+        method: "POST".to_string(),
+        url: "https://example.com/responses".to_string(),
+        headers: HashMap::new(),
+        stream: true,
+        request_timeout_ms: Some(900_000),
+        stream_first_byte_timeout_ms: Some(100),
+        timeout: 60,
+        follow_redirects: None,
+        http1_only: false,
+        transport_profile: None,
+    };
+    let encoded_meta = serde_json::to_vec(&meta).expect("metadata should encode");
+    let mut envelope = Vec::new();
+    envelope.extend_from_slice(&(encoded_meta.len() as u32).to_be_bytes());
+    envelope.extend_from_slice(&encoded_meta);
+    envelope.extend_from_slice(b"relay-stream-envelope");
+    let expected_envelope = Bytes::copy_from_slice(&envelope);
+    let request_body = reqwest::Body::wrap_stream(stream::iter(vec![Ok::<Bytes, io::Error>(
+        expected_envelope.clone(),
+    )]));
    let response = reqwest::Client::new()
        .post(format!("{gateway_url}/api/internal/tunnel/relay/node-123"))
        .body(request_body)
@@ -369,8 +479,8 @@ async fn gateway_streams_tunnel_relay_body_to_attachment_owner() {

    assert_eq!(response.status(), StatusCode::OK);
    assert_eq!(
-        response.text().await.expect("body should read"),
-        "stream-ok"
+        response.bytes().await.expect("body should read"),
+        Bytes::from_static(b"stream-ok")
    );
    assert_eq!(*owner_hits.lock().expect("mutex should lock"), 1);