test(straiker): assert a saved api_version v1 with an sk_agt_ key routes to v3

[devin-ai-integration]

TLDR

Problem this solves:

• fix(guardrails): straiker v3 routes sk_agt_ keys to v3 and fails closed on a missing verdict #44011 routes an sk_agt_ key saved with api_version: v1 to v3
• The checked-in integration cell from test(straiker): deterministic integration audit of the v3 platform relay #42781 still pins the old v1 route
• The extensions integration suite is red at fix(guardrails): straiker v3 routes sk_agt_ keys to v3 and fails closed on a missing verdict #44011's head (35/36), invisible on the PR since CircleCI runs on main only

How it solves it:

• The cell now asserts the saved-v1 guardrail posts to /api/v3/detect and never to the v1 webhook
• It covers both the allow and the block verdict on that route
• Stacked on litellm_straiker_v3_review_fixes (a mirror of fix(guardrails): straiker v3 routes sk_agt_ keys to v3 and fails closed on a missing verdict #44011's tip fcebfa9) so it lands with it

User Flow

Before: a maintainer merging #44011 gets a red extensions suite on the next main run

1. CircleCI runs integration-extensions on main after the merge
2. test_explicit_api_version_v1_overrides_key_prefix fails: the sink saw a v3 call, the test wanted the v1 webhook

After: the suite describes the shipped behavior and stays green

1. CircleCI runs integration-extensions on main after the merge
2. test_saved_api_version_v1_with_v3_key_routes_to_v3_not_the_v1_webhook passes with the rest of the file

Relevant issues

Stacked on #44011, follow-up to #42781

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• The handful of test files covering my change pass locally, e.g. uv run pytest tests/unit/<your_test_file>.py -v. Leave the suites (make test-unit-*, make test-unit) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

Test-only change, so the proof is the integration rig from tests/integration/README.md: a real proxy with two workers, real Postgres and Redis, the scripted upstream and a local Straiker sink, no mocks inside litellm. Legs are the #44011 merge base (63b6e7f) and the #44011 tip (fcebfa9) that this branch sits on

Before (63b6e7f)

1. uv run --no-sync python -m pytest tests/integration/observability/test_straiker_v3_platform.py::test_saved_api_version_v1_with_v3_key_routes_to_v3_not_the_v1_webhook -q
2. FAILED ... 1 failed in 24.21s: the saved-v1 guardrail posted to /api/v1/detect/webhook, zero v3 calls at the sink

After (fcebfa9 plus this commit)

1. uv run --no-sync python -m pytest tests/integration/observability/test_straiker_v3_platform.py -q (run id ac42505a18e843c3bc37a225e3969aa6)
2. 36 passed in 78.75s, then a second run with the same selection 36 passed in 66.44s, identical collected and passed sets, no skips

Type

✅ Test

Link to Devin session: https://app.devin.ai/sessions/16f17e78d5b6462991838dcfb24e3249
Open in Devin Desktop: https://app.devin.ai/desktop/session/16f17e78d5b6462991838dcfb24e3249?variant=devin
Requested by: @yucheng-berri

---

---

Note

Low Risk
Test-only change; no production code or runtime behavior is modified.

Overview
Updates the Straiker integration test for the straiker-v3-as-v1 guardrail (sk_agt_ key with saved api_version: v1) so expectations match routing after #44011.

Replaces test_explicit_api_version_v1_overrides_key_prefix, which asserted the v1 webhook (litellm format header), with test_saved_api_version_v1_with_v3_key_routes_to_v3_not_the_v1_webhook. The new test checks allow and block paths: traffic goes to /api/v3/detect (including block verdict and no upstream call), and never to the v1 webhook for that key.

^{Reviewed by Cursor Bugbot for commit eea7cdb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Confidence Score: 5/5

[Low risk] Test case for API version routing behavior.

The test-only change appears safe to merge.

Summary

The PR updates one integration test to assert that a guardrail saved with api_version: v1 and an sk_agt_ key uses the v3 detect endpoint rather than the v1 webhook.

• It checks both an allowed request and a blocked request, including whether each reaches the provider.

_{Reviews (1) · Last reviewed commit: "test(straiker): assert a saved api_versi..."}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[yucheng-berri]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit eea7cdb. Configure here.}