Merge remote-tracking branch 'origin/main' into codex/pool-key-bulk-management-20260714

# Conflicts:
#	apps/aether-gateway/src/handlers/admin/request/provider/tasks.rs
#	frontend/src/api/endpoints/pool.ts

apps/aether-gateway/src/control/tests/admin_endpoints.rs

@@ -454,6 +454,25 @@ fn classifies_admin_codex_reset_credit_consume_as_admin_proxy_route() {
     assert!(!decision.is_execution_runtime_candidate());
 }
 
+#[test]
+fn admin_codex_reset_credit_consume_buffers_idempotency_key_body() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/endpoints/keys/key-codex/codex-reset-credit/consume"
+        .parse()
+        .expect("uri should parse");
+    let decision = classify_control_route(&http::Method::POST, &uri, &headers)
+        .expect("decision should resolve");
+    let context = GatewayPublicRequestContext::from_request_parts(
+        "trace-codex-reset-credit-consume",
+        &http::Method::POST,
+        &uri,
+        &headers,
+        Some(decision),
+    );
+
+    assert!(local_proxy_route_requires_buffered_body(&context));
+}
+
 #[test]
 fn admin_refresh_provider_quota_buffers_request_body_for_key_selection() {
     let headers = headers(&[]);

apps/aether-gateway/src/control/tests/ai.rs

@@ -56,6 +56,28 @@ fn classifies_openai_rerank_as_rerank_not_chat() {
     assert!(decision.is_execution_runtime_candidate());
 }
 
+#[test]
+fn classifies_openai_search_as_its_own_sync_endpoint() {
+    let headers = headers(&[("authorization", "Bearer sk-test")]);
+    let uri: Uri = "/v1/alpha/search".parse().expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_family.as_deref(), Some("openai"));
+    assert_eq!(decision.route_kind.as_deref(), Some("search"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("openai:search")
+    );
+    assert!(decision.is_execution_runtime_candidate());
+    assert!(classify_control_route(&http::Method::GET, &uri, &headers).is_none());
+
+    let upstream_uri: Uri = "/backend-api/codex/alpha/search"
+        .parse()
+        .expect("uri should parse");
+    assert!(classify_control_route(&http::Method::POST, &upstream_uri, &headers).is_none());
+}
+
 #[test]
 fn classifies_openai_chat_and_responses_separately_from_embedding() {
     let headers = headers(&[("authorization", "Bearer sk-test")]);

apps/aether-gateway/src/control/tests/public_support.rs

@@ -20,6 +20,39 @@ fn classifies_models_list_as_public_support_route() {
     assert!(!decision.is_execution_runtime_candidate());
 }
 
+#[test]
+fn classifies_codex_models_list_with_responses_auth_signature() {
+    let headers = headers(&[("authorization", "Bearer sk-test")]);
+    let uri: Uri = "/v1/models?client_version=0.144.1"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("public_support"));
+    assert_eq!(decision.route_family.as_deref(), Some("models"));
+    assert_eq!(decision.route_kind.as_deref(), Some("list"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("openai:responses")
+    );
+}
+
+#[test]
+fn empty_codex_client_version_keeps_standard_openai_models_signature() {
+    let headers = headers(&[("authorization", "Bearer sk-test")]);
+    let uri: Uri = "/v1/models?client_version="
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("openai:chat")
+    );
+}
+
 #[test]
 fn classifies_v1beta_models_as_gemini_public_support_route() {
     let headers = headers(&[]);