diff --git a/.github/workflows.disabled/_README.md b/.github/workflows.disabled/_README.md
new file mode 100644
index 000000000000..f6895c653263
--- /dev/null
+++ b/.github/workflows.disabled/_README.md
@@ -0,0 +1,56 @@
+# Disabled workflows
+
+GitHub Actions only loads workflows from `.github/workflows/`. Files in this
+sibling directory **do not execute**. This is the convention this fork uses
+to disable upstream-inherited workflows without deleting them, so they remain
+available for diff/reference against upstream and can be re-enabled by moving
+back to `.github/workflows/` if needed.
+
+## Why disabled
+
+The fork ships internal-only changes against a pinned upstream tag
+(`v1.83.10-stable`) and runs **only release workflows** in CI:
+
+| Active workflow | Trigger | Purpose |
+|---|---|---|
+| `release-docker.yml` | tag push `v*-internal.*` | Build + publish multi-arch Docker image to Docker Hub |
+| `release-swr.yml` | tag push `v*-internal.*` / `v*-ghisha.*`, workflow_dispatch | Mirror image to Huawei Cloud SWR |
+
+All other workflows were inherited from upstream and one of:
+
+- Filter to `main` / `litellm_**` branches and skip our `ship/v1.83.10` PRs
+  anyway (effectively dead weight on our actions UI / billing)
+- Operate on upstream concerns (auto price update, daily staging branch,
+  GitHub issue automation, supply-chain scoring, docs)
+- Are workflow_call helpers only consumed by the above
+
+Rather than maintain branch-filter overrides on 40+ files (each requires
+a per-file diff and a maintenance burden when rebasing from upstream),
+this fork chooses to disable them wholesale. Test discipline relies on:
+
+1. Local `make lint` + `make test-unit` before commit (mandatory per CLAUDE.md)
+2. Manual `vitest run` for UI changes
+3. Local e2e via `e2e/tools/proxy start` + `e2e/tools/run-all-cases`
+
+## To re-enable a workflow
+
+```bash
+git mv .github/workflows.disabled/<workflow>.yml .github/workflows/
+```
+
+That's it — GitHub Actions picks it up on next push.
+
+## To re-enable a class of workflows (e.g. all unit tests)
+
+The unit test workflows filter their `pull_request.branches` to:
+
+```yaml
+- 'main'
+- 'litellm_internal_staging'
+- 'litellm_oss_branch'
+- 'litellm_**'
+```
+
+Note that `ship/v1.83.10` does NOT match `litellm_**` (literal glob). If you
+re-enable them and want them to fire on PRs targeting `ship/v1.83.10`, add
+`'ship/**'` to the branches list in each workflow first.
diff --git a/.github/workflows/_test-unit-base.yml b/.github/workflows.disabled/_test-unit-base.yml
similarity index 100%
rename from .github/workflows/_test-unit-base.yml
rename to .github/workflows.disabled/_test-unit-base.yml
diff --git a/.github/workflows/_test-unit-services-base.yml b/.github/workflows.disabled/_test-unit-services-base.yml
similarity index 100%
rename from .github/workflows/_test-unit-services-base.yml
rename to .github/workflows.disabled/_test-unit-services-base.yml
diff --git a/.github/workflows/auto_update_price_and_context_window.yml b/.github/workflows.disabled/auto_update_price_and_context_window.yml
similarity index 100%
rename from .github/workflows/auto_update_price_and_context_window.yml
rename to .github/workflows.disabled/auto_update_price_and_context_window.yml
diff --git a/.github/workflows/auto_update_price_and_context_window_file.py b/.github/workflows.disabled/auto_update_price_and_context_window_file.py
similarity index 100%
rename from .github/workflows/auto_update_price_and_context_window_file.py
rename to .github/workflows.disabled/auto_update_price_and_context_window_file.py
diff --git a/.github/workflows/check-schema-sync.yml b/.github/workflows.disabled/check-schema-sync.yml
similarity index 100%
rename from .github/workflows/check-schema-sync.yml
rename to .github/workflows.disabled/check-schema-sync.yml
diff --git a/.github/workflows/check_duplicate_issues.yml b/.github/workflows.disabled/check_duplicate_issues.yml
similarity index 100%
rename from .github/workflows/check_duplicate_issues.yml
rename to .github/workflows.disabled/check_duplicate_issues.yml
diff --git a/.github/workflows/codeql.yml b/.github/workflows.disabled/codeql.yml
similarity index 100%
rename from .github/workflows/codeql.yml
rename to .github/workflows.disabled/codeql.yml
diff --git a/.github/workflows/codspeed.yml b/.github/workflows.disabled/codspeed.yml
similarity index 100%
rename from .github/workflows/codspeed.yml
rename to .github/workflows.disabled/codspeed.yml
diff --git a/.github/workflows/create-release-branch.yml b/.github/workflows.disabled/create-release-branch.yml
similarity index 100%
rename from .github/workflows/create-release-branch.yml
rename to .github/workflows.disabled/create-release-branch.yml
diff --git a/.github/workflows/create-release.yml b/.github/workflows.disabled/create-release.yml
similarity index 100%
rename from .github/workflows/create-release.yml
rename to .github/workflows.disabled/create-release.yml
diff --git a/.github/workflows/create_daily_staging_branch.yml b/.github/workflows.disabled/create_daily_staging_branch.yml
similarity index 100%
rename from .github/workflows/create_daily_staging_branch.yml
rename to .github/workflows.disabled/create_daily_staging_branch.yml
diff --git a/.github/workflows/guard-fork-dependencies.yml b/.github/workflows.disabled/guard-fork-dependencies.yml
similarity index 100%
rename from .github/workflows/guard-fork-dependencies.yml
rename to .github/workflows.disabled/guard-fork-dependencies.yml
diff --git a/.github/workflows/guard-main-branch.yml b/.github/workflows.disabled/guard-main-branch.yml
similarity index 100%
rename from .github/workflows/guard-main-branch.yml
rename to .github/workflows.disabled/guard-main-branch.yml
diff --git a/.github/workflows/helm_unit_test.yml b/.github/workflows.disabled/helm_unit_test.yml
similarity index 100%
rename from .github/workflows/helm_unit_test.yml
rename to .github/workflows.disabled/helm_unit_test.yml
diff --git a/.github/workflows/issue-keyword-labeler.yml b/.github/workflows.disabled/issue-keyword-labeler.yml
similarity index 100%
rename from .github/workflows/issue-keyword-labeler.yml
rename to .github/workflows.disabled/issue-keyword-labeler.yml
diff --git a/.github/workflows/label-component.yml b/.github/workflows.disabled/label-component.yml
similarity index 100%
rename from .github/workflows/label-component.yml
rename to .github/workflows.disabled/label-component.yml
diff --git a/.github/workflows/mutation-test.yml b/.github/workflows.disabled/mutation-test.yml
similarity index 100%
rename from .github/workflows/mutation-test.yml
rename to .github/workflows.disabled/mutation-test.yml
diff --git a/.github/workflows.disabled/release-docker.yml b/.github/workflows.disabled/release-docker.yml
new file mode 100644
index 000000000000..aeefb1459943
--- /dev/null
+++ b/.github/workflows.disabled/release-docker.yml
@@ -0,0 +1,336 @@
+name: Release Docker Image
+
+on:
+  push:
+    tags:
+      # Internal release tags only: v1.83.10-internal.1, v1.83.10-internal.2, etc.
+      - 'v*-internal.*'
+
+permissions:
+  contents: read
+
+env:
+  # Change this if you want a different Docker Hub repo name.
+  IMAGE_NAME: zsk2026/litellm
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # 1. Build multi-arch image and push to Docker Hub
+  # ---------------------------------------------------------------------------
+  build-and-push:
+    name: Build and push multi-arch image
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    # To require manual approval before pushing, create a GitHub Environment
+    # named e.g. "docker-release" with required reviewers, then add:
+    #   environment: docker-release
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+      tag: ${{ steps.version.outputs.tag }}
+      base_version: ${{ steps.version.outputs.base_version }}
+      git_sha: ${{ steps.version.outputs.git_sha }}
+      git_sha_full: ${{ steps.version.outputs.git_sha_full }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0  # need full history for changelog generation in release job
+
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost
+          sudo apt-get clean
+          df -h /
+
+      - name: Verify tag is reachable from ship/* branch
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          echo "Validating tag: ${TAG}"
+          git fetch origin '+refs/heads/ship/*:refs/remotes/origin/ship/*' --no-tags
+          CONTAINING=$(git branch -r --contains "${TAG}" | grep 'origin/ship/' || true)
+          if [ -z "${CONTAINING}" ]; then
+            echo "::error::Tag ${TAG} is not on any ship/* branch. Refusing to publish."
+            exit 1
+          fi
+          echo "Tag is on:${CONTAINING}"
+
+      - name: Extract version components
+        id: version
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          BASE_VERSION="${TAG%-internal.*}"
+          GIT_SHA=$(git rev-parse --short HEAD)
+          GIT_SHA_FULL=$(git rev-parse HEAD)
+
+          echo "tag=${TAG}"               >> "$GITHUB_OUTPUT"
+          echo "base_version=${BASE_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "git_sha=${GIT_SHA}"       >> "$GITHUB_OUTPUT"
+          echo "git_sha_full=${GIT_SHA_FULL}" >> "$GITHUB_OUTPUT"
+
+      - name: Set up QEMU (for arm64 emulation)
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6.14
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
+            ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}-${{ steps.version.outputs.git_sha }}
+            ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.base_version }}-stable
+          labels: |
+            org.opencontainers.image.title=litellm
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ steps.version.outputs.git_sha_full }}
+            org.opencontainers.image.version=${{ steps.version.outputs.tag }}
+            org.opencontainers.image.created=${{ github.event.repository.updated_at }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          # provenance=true would attach SLSA provenance attestation. We're
+          # using cosign signing in the next job instead.
+          provenance: false
+
+      - name: Build summary
+        run: |
+          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
+          # Docker image built and pushed
+
+          | Tag | Image |
+          |---|---|
+          | Internal release  | \`${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}\` |
+          | + git sha (audit) | \`${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}-${{ steps.version.outputs.git_sha }}\` |
+          | Rolling stable    | \`${{ env.IMAGE_NAME }}:${{ steps.version.outputs.base_version }}-stable\` |
+
+          **Digest:** \`${{ steps.build.outputs.digest }}\`
+          EOF
+
+  # ---------------------------------------------------------------------------
+  # 2. Sign the pushed image with cosign (keyless, OIDC-based)
+  # ---------------------------------------------------------------------------
+  sign:
+    name: Sign image with cosign (keyless)
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      # Required for keyless signing via GitHub OIDC → Sigstore Fulcio
+      id-token: write
+      contents: read
+
+    steps:
+      - name: Install cosign
+        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+        with:
+          cosign-release: 'v2.4.1'
+
+      - name: Log in to Docker Hub (cosign needs registry auth)
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Sign image by digest
+        env:
+          DIGEST: ${{ needs.build-and-push.outputs.digest }}
+          TAG: ${{ needs.build-and-push.outputs.tag }}
+          BASE_VERSION: ${{ needs.build-and-push.outputs.base_version }}
+          GIT_SHA: ${{ needs.build-and-push.outputs.git_sha }}
+        run: |
+          # We sign the immutable digest. All three tags resolve to the same
+          # digest, so signing the digest once covers all of them.
+          IMAGE="${IMAGE_NAME}@${DIGEST}"
+          echo "Signing: ${IMAGE}"
+
+          cosign sign --yes \
+            --annotations="repo=${GITHUB_REPOSITORY}" \
+            --annotations="ref=${GITHUB_REF}" \
+            --annotations="sha=${GITHUB_SHA}" \
+            --annotations="workflow=${GITHUB_WORKFLOW}" \
+            --annotations="run_id=${GITHUB_RUN_ID}" \
+            "${IMAGE}"
+
+      - name: Verify signature (self-check)
+        env:
+          DIGEST: ${{ needs.build-and-push.outputs.digest }}
+        run: |
+          # Sanity check: verify the signature we just created. This confirms
+          # the sig was written to the registry and is verifiable end-to-end.
+          cosign verify \
+            --certificate-identity-regexp "^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release-docker.yml@refs/tags/.*" \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "${IMAGE_NAME}@${DIGEST}" \
+            > /dev/null
+          echo "Signature verified."
+
+      - name: Sign summary
+        env:
+          DIGEST: ${{ needs.build-and-push.outputs.digest }}
+        run: |
+          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
+          # Image signed (keyless cosign)
+
+          **Signed digest:** \`${DIGEST}\`
+
+          **Verify locally:**
+
+          \`\`\`bash
+          cosign verify \\
+            --certificate-identity-regexp '^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release-docker.yml@refs/tags/.*' \\
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \\
+            ${IMAGE_NAME}@${DIGEST}
+          \`\`\`
+          EOF
+
+  # ---------------------------------------------------------------------------
+  # 3. Create a GitHub Release with auto-generated changelog
+  # ---------------------------------------------------------------------------
+  release:
+    name: Create GitHub Release
+    needs: [build-and-push, sign]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write  # required to create the release
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Generate changelog from previous internal tag
+        id: changelog
+        env:
+          TAG: ${{ needs.build-and-push.outputs.tag }}
+          BASE_VERSION: ${{ needs.build-and-push.outputs.base_version }}
+        run: |
+          # Find previous internal tag of the same base version
+          PREV_TAG=$(git tag --list "${BASE_VERSION}-internal.*" --sort=-v:refname \
+            | grep -v "^${TAG}$" | head -n1 || true)
+
+          if [ -n "${PREV_TAG}" ]; then
+            RANGE="${PREV_TAG}..${TAG}"
+            echo "Previous tag: ${PREV_TAG}"
+          else
+            # First internal release of this base version — use upstream tag
+            # as the lower bound if it exists.
+            if git rev-parse "refs/tags/${BASE_VERSION}-stable" >/dev/null 2>&1; then
+              PREV_TAG="${BASE_VERSION}-stable"
+              RANGE="${PREV_TAG}..${TAG}"
+              echo "First internal tag, using upstream pin: ${PREV_TAG}"
+            else
+              RANGE="HEAD~20..${TAG}"
+              echo "No baseline tag found, using last 20 commits"
+            fi
+          fi
+
+          # Build changelog. Use HEREDOC delimiter for multi-line output.
+          {
+            echo "changelog<<CHANGELOG_EOF"
+            git log --pretty=format:'- %s ([\`%h\`](${{ github.server_url }}/${{ github.repository }}/commit/%H))' "${RANGE}" --no-merges
+            echo ""
+            echo "CHANGELOG_EOF"
+            echo "prev_tag=${PREV_TAG}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Compose release notes
+        id: notes
+        env:
+          TAG: ${{ needs.build-and-push.outputs.tag }}
+          BASE_VERSION: ${{ needs.build-and-push.outputs.base_version }}
+          GIT_SHA: ${{ needs.build-and-push.outputs.git_sha }}
+          GIT_SHA_FULL: ${{ needs.build-and-push.outputs.git_sha_full }}
+          DIGEST: ${{ needs.build-and-push.outputs.digest }}
+          CHANGELOG: ${{ steps.changelog.outputs.changelog }}
+          PREV_TAG: ${{ steps.changelog.outputs.prev_tag }}
+        run: |
+          cat > release-notes.md <<EOF
+          Internal release **${TAG}** based on upstream pin \`${BASE_VERSION}-stable\`.
+
+          ## Docker Images
+
+          | Tag | Description |
+          |---|---|
+          | \`${IMAGE_NAME}:${TAG}\` | Immutable internal release |
+          | \`${IMAGE_NAME}:${TAG}-${GIT_SHA}\` | Immutable + git sha (audit trail) |
+          | \`${IMAGE_NAME}:${BASE_VERSION}-stable\` | Rolling stable pointer for ${BASE_VERSION} |
+
+          **Image digest:** \`${DIGEST}\`
+
+          **Pull:**
+
+          \`\`\`bash
+          docker pull ${IMAGE_NAME}:${TAG}
+          \`\`\`
+
+          ## Verify Docker Image Signature
+
+          All images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/)
+          using GitHub OIDC keyless signing. No public key required — verification uses
+          the workflow identity.
+
+          \`\`\`bash
+          cosign verify \\
+            --certificate-identity-regexp '^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release-docker.yml@refs/tags/.*' \\
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \\
+            ${IMAGE_NAME}@${DIGEST}
+          \`\`\`
+
+          Expected output:
+
+          \`\`\`
+          Verification for ${IMAGE_NAME}@${DIGEST} --
+          The following checks were performed on each of these signatures:
+            - The cosign claims were validated
+            - Existence of the claims in the transparency log was verified offline
+            - The code-signing certificate was verified using trusted certificate authority certificates
+          \`\`\`
+
+          ## Changes since ${PREV_TAG:-baseline}
+
+          ${CHANGELOG}
+
+          ## Source
+
+          Built from commit [\`${GIT_SHA}\`](${{ github.server_url }}/${{ github.repository }}/commit/${GIT_SHA_FULL}) on branch \`ship/${BASE_VERSION#v}\` (or wherever the tag was pushed from).
+          EOF
+
+          echo "Release notes written:"
+          cat release-notes.md
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ needs.build-and-push.outputs.tag }}
+        run: |
+          gh release create "${TAG}" \
+            --title "${TAG}" \
+            --notes-file release-notes.md \
+            --target "${GITHUB_SHA}" \
+            --verify-tag
+
+      - name: Release summary
+        env:
+          TAG: ${{ needs.build-and-push.outputs.tag }}
+        run: |
+          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
+          # GitHub Release created
+
+          [View release: ${TAG}](${{ github.server_url }}/${{ github.repository }}/releases/tag/${TAG})
+          EOF
diff --git a/.github/workflows/run_llm_translation_tests.py b/.github/workflows.disabled/run_llm_translation_tests.py
similarity index 100%
rename from .github/workflows/run_llm_translation_tests.py
rename to .github/workflows.disabled/run_llm_translation_tests.py
diff --git a/.github/workflows/scorecard.yml b/.github/workflows.disabled/scorecard.yml
similarity index 100%
rename from .github/workflows/scorecard.yml
rename to .github/workflows.disabled/scorecard.yml
diff --git a/.github/workflows/stale.yml b/.github/workflows.disabled/stale.yml
similarity index 100%
rename from .github/workflows/stale.yml
rename to .github/workflows.disabled/stale.yml
diff --git a/.github/workflows/sync-schema.yml b/.github/workflows.disabled/sync-schema.yml
similarity index 100%
rename from .github/workflows/sync-schema.yml
rename to .github/workflows.disabled/sync-schema.yml
diff --git a/.github/workflows/test-code-quality.yml b/.github/workflows.disabled/test-code-quality.yml
similarity index 100%
rename from .github/workflows/test-code-quality.yml
rename to .github/workflows.disabled/test-code-quality.yml
diff --git a/.github/workflows/test-linting.yml b/.github/workflows.disabled/test-linting.yml
similarity index 100%
rename from .github/workflows/test-linting.yml
rename to .github/workflows.disabled/test-linting.yml
diff --git a/.github/workflows/test-litellm-ui-build.yml b/.github/workflows.disabled/test-litellm-ui-build.yml
similarity index 100%
rename from .github/workflows/test-litellm-ui-build.yml
rename to .github/workflows.disabled/test-litellm-ui-build.yml
diff --git a/.github/workflows/test-mcp.yml b/.github/workflows.disabled/test-mcp.yml
similarity index 100%
rename from .github/workflows/test-mcp.yml
rename to .github/workflows.disabled/test-mcp.yml
diff --git a/.github/workflows/test-model-map.yaml b/.github/workflows.disabled/test-model-map.yaml
similarity index 100%
rename from .github/workflows/test-model-map.yaml
rename to .github/workflows.disabled/test-model-map.yaml
diff --git a/.github/workflows/test-semgrep.yml b/.github/workflows.disabled/test-semgrep.yml
similarity index 100%
rename from .github/workflows/test-semgrep.yml
rename to .github/workflows.disabled/test-semgrep.yml
diff --git a/.github/workflows/test-unit-core-utils.yml b/.github/workflows.disabled/test-unit-core-utils.yml
similarity index 100%
rename from .github/workflows/test-unit-core-utils.yml
rename to .github/workflows.disabled/test-unit-core-utils.yml
diff --git a/.github/workflows/test-unit-documentation.yml b/.github/workflows.disabled/test-unit-documentation.yml
similarity index 100%
rename from .github/workflows/test-unit-documentation.yml
rename to .github/workflows.disabled/test-unit-documentation.yml
diff --git a/.github/workflows/test-unit-enterprise-routing.yml b/.github/workflows.disabled/test-unit-enterprise-routing.yml
similarity index 100%
rename from .github/workflows/test-unit-enterprise-routing.yml
rename to .github/workflows.disabled/test-unit-enterprise-routing.yml
diff --git a/.github/workflows/test-unit-integrations.yml b/.github/workflows.disabled/test-unit-integrations.yml
similarity index 100%
rename from .github/workflows/test-unit-integrations.yml
rename to .github/workflows.disabled/test-unit-integrations.yml
diff --git a/.github/workflows/test-unit-llm-providers.yml b/.github/workflows.disabled/test-unit-llm-providers.yml
similarity index 100%
rename from .github/workflows/test-unit-llm-providers.yml
rename to .github/workflows.disabled/test-unit-llm-providers.yml
diff --git a/.github/workflows/test-unit-misc.yml b/.github/workflows.disabled/test-unit-misc.yml
similarity index 100%
rename from .github/workflows/test-unit-misc.yml
rename to .github/workflows.disabled/test-unit-misc.yml
diff --git a/.github/workflows/test-unit-proxy-auth.yml b/.github/workflows.disabled/test-unit-proxy-auth.yml
similarity index 100%
rename from .github/workflows/test-unit-proxy-auth.yml
rename to .github/workflows.disabled/test-unit-proxy-auth.yml
diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows.disabled/test-unit-proxy-db.yml
similarity index 100%
rename from .github/workflows/test-unit-proxy-db.yml
rename to .github/workflows.disabled/test-unit-proxy-db.yml
diff --git a/.github/workflows/test-unit-proxy-endpoints.yml b/.github/workflows.disabled/test-unit-proxy-endpoints.yml
similarity index 100%
rename from .github/workflows/test-unit-proxy-endpoints.yml
rename to .github/workflows.disabled/test-unit-proxy-endpoints.yml
diff --git a/.github/workflows/test-unit-proxy-infra.yml b/.github/workflows.disabled/test-unit-proxy-infra.yml
similarity index 100%
rename from .github/workflows/test-unit-proxy-infra.yml
rename to .github/workflows.disabled/test-unit-proxy-infra.yml
diff --git a/.github/workflows/test-unit-proxy-legacy.yml b/.github/workflows.disabled/test-unit-proxy-legacy.yml
similarity index 100%
rename from .github/workflows/test-unit-proxy-legacy.yml
rename to .github/workflows.disabled/test-unit-proxy-legacy.yml
diff --git a/.github/workflows/test-unit-proxy-mgmt-behavior.yml b/.github/workflows.disabled/test-unit-proxy-mgmt-behavior.yml
similarity index 100%
rename from .github/workflows/test-unit-proxy-mgmt-behavior.yml
rename to .github/workflows.disabled/test-unit-proxy-mgmt-behavior.yml
diff --git a/.github/workflows/test-unit-responses-caching-types.yml b/.github/workflows.disabled/test-unit-responses-caching-types.yml
similarity index 100%
rename from .github/workflows/test-unit-responses-caching-types.yml
rename to .github/workflows.disabled/test-unit-responses-caching-types.yml
diff --git a/.github/workflows/test-unit-security.yml b/.github/workflows.disabled/test-unit-security.yml
similarity index 100%
rename from .github/workflows/test-unit-security.yml
rename to .github/workflows.disabled/test-unit-security.yml
diff --git a/.github/workflows/test_server_root_path.yml b/.github/workflows.disabled/test_server_root_path.yml
similarity index 100%
rename from .github/workflows/test_server_root_path.yml
rename to .github/workflows.disabled/test_server_root_path.yml
diff --git a/.github/workflows/zizmor.yml b/.github/workflows.disabled/zizmor.yml
similarity index 100%
rename from .github/workflows/zizmor.yml
rename to .github/workflows.disabled/zizmor.yml
diff --git a/.github/workflows/release-swr.yml b/.github/workflows/release-swr.yml
new file mode 100644
index 000000000000..3d9584006fca
--- /dev/null
+++ b/.github/workflows/release-swr.yml
@@ -0,0 +1,116 @@
+name: Push to Huawei Cloud SWR
+
+on:
+  push:
+    tags:
+      - 'v*-internal.*'
+      - 'v*-ghisha.*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Image tag to publish (e.g. v1.83.10-ghisha.1). Does not need to be a git tag.'
+        required: true
+        type: string
+
+env:
+  SWR_REGION: ap-southeast-3
+  SWR_REGISTRY: swr.ap-southeast-3.myhuaweicloud.com
+  SWR_ORG: ghisha
+  IMAGE_NAME: ghisha-gateway
+
+jobs:
+  build-and-push:
+    name: Build and push to SWR
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost
+          sudo apt-get clean
+          df -h /
+
+      - name: Resolve tag
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            TAG="${{ github.event.inputs.tag }}"
+          else
+            TAG="${GITHUB_REF_NAME}"
+          fi
+          # Strip -internal.N or -ghisha.N suffix to get base version
+          BASE_VERSION=$(echo "$TAG" | sed -E 's/-(internal|ghisha)\.[0-9]+$//')
+          GIT_SHA=$(git rev-parse --short HEAD)
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "base_version=${BASE_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "git_sha=${GIT_SHA}" >> "$GITHUB_OUTPUT"
+          echo "Tag: ${TAG}, Base: ${BASE_VERSION}, SHA: ${GIT_SHA}"
+
+      - name: Verify tag is reachable from ship/* branch
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+          git fetch origin '+refs/heads/ship/*:refs/remotes/origin/ship/*' --no-tags
+          CONTAINING=$(git branch -r --contains "${TAG}" | grep 'origin/ship/' || true)
+          if [ -z "${CONTAINING}" ]; then
+            echo "::error::Tag ${TAG} is not on any ship/* branch. Refusing to publish."
+            exit 1
+          fi
+          echo "Tag is on:${CONTAINING}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Huawei Cloud SWR
+        env:
+          HUAWEI_AK: ${{ secrets.HUAWEI_AK }}
+          HUAWEI_TOKEN: ${{ secrets.HUAWEI_TOKEN }}
+        run: |
+          echo "$HUAWEI_TOKEN" | docker login ${{ env.SWR_REGISTRY }} -u "${{ env.SWR_REGION }}@$HUAWEI_AK" --password-stdin
+
+      - name: Build and push to SWR
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64
+          provenance: false
+          build-args: |
+            LITELLM_BUILD_TAG=${{ steps.version.outputs.tag }}
+            LITELLM_BUILD_SHA=${{ steps.version.outputs.git_sha }}
+          tags: |
+            ${{ env.SWR_REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
+            ${{ env.SWR_REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}-${{ steps.version.outputs.git_sha }}
+            ${{ env.SWR_REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.base_version }}-stable
+          labels: |
+            org.opencontainers.image.title=litellm
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ steps.version.outputs.git_sha }}
+            org.opencontainers.image.version=${{ steps.version.outputs.tag }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build summary
+        run: |
+          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
+          # SWR image pushed
+
+          | Tag | Image |
+          |---|---|
+          | Internal release  | \`${{ env.SWR_REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}\` |
+          | + git sha (audit) | \`${{ env.SWR_REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}-${{ steps.version.outputs.git_sha }}\` |
+          | Rolling stable    | \`${{ env.SWR_REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.base_version }}-stable\` |
+
+          **Pull:**
+          \`\`\`bash
+          docker pull ${{ env.SWR_REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
+          \`\`\`
+          EOF
diff --git a/.gitignore b/.gitignore
index dff64e3c9e9f..6417a8cf09c3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,8 @@
 .venv
 .venv_policy_test
 .env
+.env1
+.env2
 .claude
 .newenv
 newenv/*
diff --git a/scripts/release-tag.sh b/scripts/release-tag.sh
new file mode 100755
index 000000000000..f075d0a63bb6
--- /dev/null
+++ b/scripts/release-tag.sh
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Cut an internal release: validate state, create annotated tag, push to GitHub.
+# The release-docker.yml workflow takes over from there.
+#
+# Usage: scripts/release-tag.sh v1.83.10-internal.N
+
+set -euo pipefail
+
+VERSION="${1:-}"
+if [[ -z "${VERSION}" ]]; then
+  echo "Usage: $0 v1.83.10-internal.N" >&2
+  exit 2
+fi
+
+# Tag format: v<MAJOR>.<MINOR>.<PATCH>-internal.<N>
+if ! [[ "${VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-internal\.[0-9]+$ ]]; then
+  echo "Error: tag must match vX.Y.Z-internal.N (got: ${VERSION})" >&2
+  exit 2
+fi
+
+BRANCH=$(git rev-parse --abbrev-ref HEAD)
+if [[ "${BRANCH}" != ship/* ]]; then
+  echo "Error: must release from a ship/* branch (currently on: ${BRANCH})" >&2
+  exit 2
+fi
+
+if [[ -n "$(git status --porcelain)" ]]; then
+  echo "Error: worktree is dirty. Commit or stash first." >&2
+  exit 2
+fi
+
+# Ensure local branch is up to date with origin
+git fetch origin "${BRANCH}"
+LOCAL=$(git rev-parse HEAD)
+REMOTE=$(git rev-parse "origin/${BRANCH}")
+if [[ "${LOCAL}" != "${REMOTE}" ]]; then
+  echo "Error: local ${BRANCH} is not in sync with origin (local=${LOCAL} remote=${REMOTE})" >&2
+  echo "Run: git pull --ff-only origin ${BRANCH}" >&2
+  exit 2
+fi
+
+# Refuse to overwrite an existing tag
+if git rev-parse "refs/tags/${VERSION}" >/dev/null 2>&1; then
+  echo "Error: tag ${VERSION} already exists locally." >&2
+  exit 2
+fi
+if git ls-remote --tags origin "${VERSION}" | grep -q "${VERSION}"; then
+  echo "Error: tag ${VERSION} already exists on origin." >&2
+  exit 2
+fi
+
+# Auto-generate changelog body from commits since the last internal tag
+BASE_VERSION="${VERSION%-internal.*}"
+LAST_TAG=$(git tag --list "${BASE_VERSION}-internal.*" --sort=-v:refname | head -n1 || true)
+if [[ -n "${LAST_TAG}" ]]; then
+  RANGE="${LAST_TAG}..HEAD"
+  echo "Generating changelog from ${LAST_TAG}..HEAD"
+else
+  RANGE="HEAD~10..HEAD"
+  echo "No previous internal tag found, using last 10 commits"
+fi
+
+CHANGELOG=$(git log --pretty=format:'- %s (%h)' "${RANGE}" --no-merges | head -n 30)
+
+cat <<EOF
+
+============================================================
+About to create tag: ${VERSION}
+On commit:           ${LOCAL}
+Branch:              ${BRANCH}
+
+Changelog:
+${CHANGELOG}
+============================================================
+EOF
+
+read -rp "Proceed? [y/N] " CONFIRM
+if [[ "${CONFIRM}" != "y" && "${CONFIRM}" != "Y" ]]; then
+  echo "Aborted."
+  exit 1
+fi
+
+# Create annotated tag with changelog as message
+git tag -a "${VERSION}" -m "Internal release ${VERSION}
+
+${CHANGELOG}
+"
+
+git push origin "${VERSION}"
+
+cat <<EOF
+
+Tag ${VERSION} pushed to origin.
+
+Watch the build at:
+  https://github.com/${GITHUB_REPOSITORY:-GhishaDev/litellm}/actions/workflows/release-docker.yml
+
+Once green, the following images will be available:
+  docker pull <your-dockerhub-user>/litellm:${VERSION}
+  docker pull <your-dockerhub-user>/litellm:${BASE_VERSION}-stable
+EOF