[kcoopermiller]

Why

Since Sep 1, hosted managed RFT runs start their orchestrator with --monitors.prime.name, RUN_ID, a per-run token in PRIME_API_KEY and PRIME_API_BASE=<platform>/api/internal/rft. That internal router authenticates the run's token from the x-api-key header and serves the monitoring routes only (/rft/metrics, /rft/samples/presign, /rft/samples/confirm, /rft/finalize). The old prime-rl TrainRun used that root verbatim and sent both Authorization and x-api-key.

PlatformClient addressed everything under <base>/api/v1 with a Bearer header alone, so once prime-rl's monitor moves to this SDK (PrimeIntellect-ai/prime-rl#3459) an attached hosted run would 404 every upload and go silently unmonitored — the failure #4885 had just fixed. Against prod, unauthenticated, for the record:

POST https://api.primeintellect.ai/api/internal/rft/metrics          → 422 "header -> x-api-key: Field required"
POST https://api.primeintellect.ai/api/internal/api/v1/rft/metrics   → 404   (what 0.1.0 builds from that base URL)

What

• PlatformClient recognises the internal root (…/api/internal, with or without the trailing /rft): requests go under <base>/api/internal and the token is repeated in x-api-key. The public root is unchanged; a …/api/v1/rft root (the RFT client's historical default) is normalised the same way. client.internal says which router is in use.
• Auth headers are also sent per request, not only as the pool's defaults, so a caller-supplied httpx.Client authenticates like one the SDK opened.
• Docs: init() and RftBackend.attach docstrings, README (training bullet + configuration). Registering a run or setting its status is not available on the internal root — attach only — which is exactly the hosted case.

No change for external runs or evals: same URLs, same headers.

Tests

tests/test_http.py: internal roots → /api/internal prefix + x-api-key (parametrised over the three spellings), public roots → /api/v1 and no x-api-key (four spellings), injected client gets the headers. tests/test_rft_backend.py: attach + finalize through the internal router with the run's token. 254 passed; ruff clean.

Release

Ships as prime-runs 0.1.1 (release PR follows, stacked on this one). prime-rl#3459 then bumps to prime-runs[train]>=0.1.1; its _base_url() already passes $PRIME_API_BASE minus /rft, which this accepts unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EYdQmKAVnGteT1tkimJb3g

---

Note

Medium Risk
Changes core HTTP routing and auth for all platform calls when base_url includes an internal path; mistakes could break hosted monitoring or mis-route external runs, though public URLs are explicitly preserved and heavily tested.

Overview
PlatformClient now supports the internal RFT base URL that hosted training launchers inject (…/api/internal or …/api/internal/rft). When that root is detected via new split_api_root(), requests target /api/internal (not a doubled /api/v1 path) and the run token is sent in x-api-key in addition to Bearer auth; client.internal flags this mode. Public origins and historical …/api/v1/rft URLs keep the previous behavior.

Each HTTP call merges auth headers on the request so a caller-injected httpx.Client still authenticates like the SDK-owned pool.

README and init() / RftBackend.attach docs explain attaching hosted runs with $PRIME_API_BASE and that register/status APIs stay on the public API only. Tests cover internal vs public URL spellings, hostnames that look like path suffixes, per-request headers, and finalize through the internal router.

^{Reviewed by Cursor Bugbot for commit b1a26e6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T04:21:17.829304Z	c9e1a2e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9e1a2eaf3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".