[feat] Add Gateways (ongoing and far from properly tested)

api/ee/src/core/access/entitlements/types.py

@@ -52,7 +52,6 @@ class Counter(str, Enum):
     EVALUATIONS_RUN = "evaluations_run"
     TRACES_INGESTED = "traces_ingested"
     TRACES_RETRIEVED = "traces_retrieved"
-    CREDITS_CONSUMED = "credits_consumed"
     EVENTS_INGESTED = "events_ingested"
     RECORDS_INGESTED = "records_ingested"
 
@@ -345,12 +344,6 @@ class Throttle(BaseModel):
                 period=Period.DAILY,
                 scope=Scope.USER,
             ),
-            Counter.CREDITS_CONSUMED: Quota(
-                free=100,
-                limit=100,
-                strict=True,
-                period=Period.MONTHLY,
-            ),
             Counter.EVENTS_INGESTED: Quota(
                 retention=Retention.WEEKLY,
                 period=Period.MONTHLY,
@@ -437,12 +430,6 @@ class Throttle(BaseModel):
                 scope=Scope.USER,
                 period=Period.DAILY,
             ),
-            Counter.CREDITS_CONSUMED: Quota(
-                free=100,
-                limit=100,
-                strict=True,
-                period=Period.MONTHLY,
-            ),
             Counter.EVENTS_INGESTED: Quota(
                 retention=Retention.MONTHLY,
                 period=Period.MONTHLY,
@@ -527,12 +514,6 @@ class Throttle(BaseModel):
                 scope=Scope.USER,
                 period=Period.DAILY,
             ),
-            Counter.CREDITS_CONSUMED: Quota(
-                free=100,
-                limit=100,
-                strict=True,
-                period=Period.MONTHLY,
-            ),
             Counter.EVENTS_INGESTED: Quota(
                 retention=Retention.QUARTERLY,
                 period=Period.MONTHLY,
@@ -615,12 +596,6 @@ class Throttle(BaseModel):
                 scope=Scope.USER,
                 period=Period.DAILY,
             ),
-            Counter.CREDITS_CONSUMED: Quota(
-                free=100,
-                limit=100,
-                strict=True,
-                period=Period.MONTHLY,
-            ),
             Counter.EVENTS_INGESTED: Quota(
                 period=Period.MONTHLY,
             ),
@@ -655,10 +630,6 @@ class Throttle(BaseModel):
                 scope=Scope.USER,
                 period=Period.DAILY,
             ),
-            Counter.CREDITS_CONSUMED: Quota(
-                strict=True,
-                period=Period.MONTHLY,
-            ),
             Counter.EVENTS_INGESTED: Quota(
                 period=Period.MONTHLY,
             ),
@@ -701,7 +672,6 @@ class Throttle(BaseModel):
             Counter.EVALUATIONS_RUN,
             Counter.TRACES_INGESTED,
             Counter.TRACES_RETRIEVED,
-            Counter.CREDITS_CONSUMED,
             Counter.EVENTS_INGESTED,
             Counter.RECORDS_INGESTED,
         ],

api/ee/src/core/meters/types.py

@@ -25,7 +25,7 @@ class Meters(str, Enum):
     EVALUATIONS_RUN = Counter.EVALUATIONS_RUN.value
     TRACES_INGESTED = Counter.TRACES_INGESTED.value
     TRACES_RETRIEVED = Counter.TRACES_RETRIEVED.value
-    CREDITS_CONSUMED = Counter.CREDITS_CONSUMED.value
+    CREDITS_CONSUMED = "credits_consumed"  # legacy, dropped from Counter; keeps old meter rows readable
     EVENTS_INGESTED = Counter.EVENTS_INGESTED.value
     RECORDS_INGESTED = Counter.RECORDS_INGESTED.value
     # GAUGES

api/entrypoints/routers.py

@@ -163,6 +163,34 @@
 from oss.src.tasks.asyncio.triggers.dispatcher import TriggersDispatcher
 from oss.src.tasks.taskiq.triggers.worker import TriggersWorker
 from oss.src.tasks.taskiq.shared.broker import ProducerOnlyRedisStreamBroker
+
+# GATEWAYS: core/gateways/ (entities.md §9 "Wiring"). Two router objects per plane —
+# management CRUD and the data plane are separate surfaces (§1).
+from oss.src.dbs.postgres.gateways.llms.dao import LLMEndpointsDAO
+from oss.src.dbs.postgres.gateways.mcps.dao import MCPEndpointsDAO
+from oss.src.core.gateways.policy.resolution import SecretsResolver
+from oss.src.core.gateways.policy.service import GatewayPolicyService
+from oss.src.core.gateways.llms.registry import LLMUpstreamRegistry
+from oss.src.core.gateways.llms.service import LLMGatewayService
+from oss.src.core.gateways.llms.providers.mock.adapter import MockLLMAdapter
+from oss.src.core.gateways.llms.providers.passthrough.adapter import (
+    RelayLLMAdapter,
+)
+from oss.src.core.gateways.mcps.registry import MCPUpstreamRegistry
+from oss.src.core.gateways.mcps.service import MCPGatewayService
+from oss.src.core.gateways.mcps.providers.mock.adapter import MockMCPAdapter
+from oss.src.core.gateways.mcps.providers.http.adapter import HttpMCPAdapter
+from oss.src.core.gateways.mcps.oauth.client import MCPOAuthClient
+from oss.src.core.gateways.mcps.oauth.service import MCPOAuthConnectService
+from oss.src.apis.fastapi.gateways.llms.router import LLMGatewayRouter
+from oss.src.apis.fastapi.gateways.llms.proxy import LLMGatewayProxy
+from oss.src.apis.fastapi.gateways.mcps.router import MCPGatewayRouter
+from oss.src.apis.fastapi.gateways.mcps.proxy import MCPGatewayProxy
+from oss.src.apis.fastapi.gateways.mcps.oauth_router import MCPOAuthClientMetadataRouter
+
+# ComposioMCPAdapter serves the builtin namespace and has no owner in wave 1: no brokered
+# target is reachable yet, so our own servers and the mocks are the whole set (D23).
+
 from oss.src.apis.fastapi.shared.utils import SupportHeadersMiddleware
 from oss.src.dbs.postgres.mounts.dao import MountsDAO
 from oss.src.core.mounts.service import MountsService
@@ -1063,6 +1091,58 @@ async def _dispatch_detached_run(*, project_id, user_id, request) -> str:
     dispatch_task=_triggers_worker.dispatch_trigger,
 )
 
+# GATEWAYS: storage and the policy core (entities.md §9 "Wiring"). The plane services,
+# their registries and the routers/proxies land with WP6-WP10.
+llm_endpoints_dao = LLMEndpointsDAO(engine=_transactions_engine)
+mcp_endpoints_dao = MCPEndpointsDAO(engine=_transactions_engine)
+
+secrets_resolver = SecretsResolver(
+    vault_service=vault_service,
+)
+
+gateway_policy_service = GatewayPolicyService(resolver=secrets_resolver)
+
+llm_gateway_service = LLMGatewayService(
+    llm_endpoints_dao=llm_endpoints_dao,
+    policy=gateway_policy_service,
+    resolver=secrets_resolver,
+    upstream_registry=LLMUpstreamRegistry(
+        adapters={
+            "relay": RelayLLMAdapter(),
+            "mock": MockLLMAdapter(),
+        }
+    ),
+)
+
+mcp_gateway_service = MCPGatewayService(
+    mcp_endpoints_dao=mcp_endpoints_dao,
+    policy=gateway_policy_service,
+    resolver=secrets_resolver,
+    connections_service=connections_service,
+    upstream_registry=MCPUpstreamRegistry(
+        adapters={
+            "http": HttpMCPAdapter(),
+            "mock": MockMCPAdapter(),
+        }
+    ),
+)
+
+mcp_oauth_connect_service = MCPOAuthConnectService(
+    vault_service=vault_service,
+    client=MCPOAuthClient(),
+    api_url=env.agenta.api_url,
+    secret_key=env.agenta.crypt_key,
+)
+
+llm_gateway_router = LLMGatewayRouter(llm_gateway_service=llm_gateway_service)
+llm_gateway_proxy = LLMGatewayProxy(llm_gateway_service=llm_gateway_service)
+mcp_gateway_router = MCPGatewayRouter(
+    mcp_gateway_service=mcp_gateway_service,
+    oauth_connect_service=mcp_oauth_connect_service,
+)
+mcp_gateway_proxy = MCPGatewayProxy(mcp_gateway_service=mcp_gateway_service)
+mcp_oauth_client_metadata_router = MCPOAuthClientMetadataRouter()
+
 simple_traces = SimpleTracesRouter(
     simple_traces_service=simple_traces_service,
 )
@@ -1499,6 +1579,32 @@ async def _dispatch_detached_run(*, project_id, user_id, request) -> str:
     include_in_schema=False,
 )
 
+app.include_router(
+    router=llm_gateway_router.router,
+    prefix="/gateways/llms",
+    tags=["Gateway: LLM"],
+)
+app.include_router(
+    router=llm_gateway_proxy.router,
+    prefix="/gateways/llms",
+    include_in_schema=False,
+)
+app.include_router(
+    router=mcp_gateway_router.router,
+    prefix="/gateways/mcps",
+    tags=["Gateway: MCP"],
+)
+app.include_router(
+    router=mcp_gateway_proxy.router,
+    prefix="/gateways/mcps",
+    include_in_schema=False,
+)
+app.include_router(
+    router=mcp_oauth_client_metadata_router.router,
+    prefix="/gateways/mcps",
+    include_in_schema=False,
+)
+
 app.include_router(
     router=sessions.interactions.router,
     prefix="/sessions/interactions",

api/oss/databases/postgres/migrations/core_oss/versions/oss000000022_add_gateway_endpoints.py

@@ -0,0 +1,175 @@
+"""add gateway endpoints
+
+Creates the two tables the gateways domain persists (entities.md §1, §3):
+llms_endpoints and mcps_endpoints. Every row in both is a custom row by
+construction — standard and builtin endpoints are generated, never stored (D20).
+
+The two new Postgres enum types (llmdeploymentkind_enum, gatewayauthscheme_enum)
+use the enum member NAMES (upper-case), matching this codebase's existing
+SQLAlchemy-enum convention (see secretkind_enum) rather than the lower-case
+DTO values.
+
+secret_id is SET NULL on both tables: a dead secret must not silently delete an
+endpoint's configuration (§2.1). Each endpoint names one secret, project-owned —
+user-level grants are out of scope, and reopening them adds tables rather than
+changing these (out-of-scope.md).
+
+Revision ID: oss000000022
+Revises: oss000000020
+Create Date: 2026-08-13 00:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision: str = "oss000000022"
+down_revision: Union[str, None] = "oss000000021"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "llms_endpoints",
+        sa.Column("id", sa.UUID(as_uuid=True), nullable=False),
+        sa.Column("project_id", sa.UUID(as_uuid=True), nullable=False),
+        sa.Column("slug", sa.String(), nullable=False),
+        sa.Column("name", sa.String(), nullable=True),
+        sa.Column("description", sa.String(), nullable=True),
+        sa.Column("provider_key", sa.String(), nullable=False),
+        sa.Column(
+            "deployment_kind",
+            sa.Enum(
+                "DIRECT",
+                "CUSTOM",
+                "AZURE",
+                "BEDROCK",
+                "SAGEMAKER",
+                "VERTEX",
+                name="llmdeploymentkind_enum",
+            ),
+            nullable=False,
+        ),
+        sa.Column("secret_id", sa.UUID(as_uuid=True), nullable=True),
+        sa.Column("data", postgresql.JSON(none_as_null=True), nullable=True),
+        sa.Column("status", postgresql.JSONB(none_as_null=True), nullable=True),
+        sa.Column("flags", postgresql.JSONB(none_as_null=True), nullable=True),
+        sa.Column("tags", postgresql.JSONB(none_as_null=True), nullable=True),
+        sa.Column("meta", postgresql.JSON(none_as_null=True), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.TIMESTAMP(timezone=True),
+            server_default=sa.func.current_timestamp(),
+            nullable=True,
+        ),
+        sa.Column("updated_at", sa.TIMESTAMP(timezone=True), nullable=True),
+        sa.Column("deleted_at", sa.TIMESTAMP(timezone=True), nullable=True),
+        sa.Column("created_by_id", sa.UUID(as_uuid=True), nullable=True),
+        sa.Column("updated_by_id", sa.UUID(as_uuid=True), nullable=True),
+        sa.Column("deleted_by_id", sa.UUID(as_uuid=True), nullable=True),
+        sa.PrimaryKeyConstraint("project_id", "id"),
+        sa.ForeignKeyConstraint(
+            ["project_id"],
+            ["projects.id"],
+            ondelete="CASCADE",
+        ),
+        sa.ForeignKeyConstraint(
+            ["secret_id"],
+            ["secrets.id"],
+            ondelete="SET NULL",
+        ),
+        sa.UniqueConstraint(
+            "project_id",
+            "slug",
+            name="uq_llms_endpoints_project_slug",
+        ),
+    )
+    op.create_index(
+        "ix_llms_endpoints_project_provider",
+        "llms_endpoints",
+        ["project_id", "provider_key"],
+    )
+    op.create_index(
+        "ix_llms_endpoints_flags",
+        "llms_endpoints",
+        ["flags"],
+        postgresql_using="gin",
+    )
+
+    op.create_table(
+        "mcps_endpoints",
+        sa.Column("id", sa.UUID(as_uuid=True), nullable=False),
+        sa.Column("project_id", sa.UUID(as_uuid=True), nullable=False),
+        sa.Column("slug", sa.String(), nullable=False),
+        sa.Column("name", sa.String(), nullable=True),
+        sa.Column("description", sa.String(), nullable=True),
+        sa.Column(
+            "auth_mode",
+            sa.Enum(
+                "OAUTH",
+                "API_KEY",
+                "NONE",
+                name="gatewayauthscheme_enum",
+            ),
+            nullable=False,
+        ),
+        sa.Column("secret_id", sa.UUID(as_uuid=True), nullable=True),
+        sa.Column("data", postgresql.JSON(none_as_null=True), nullable=True),
+        sa.Column("status", postgresql.JSONB(none_as_null=True), nullable=True),
+        sa.Column("flags", postgresql.JSONB(none_as_null=True), nullable=True),
+        sa.Column("tags", postgresql.JSONB(none_as_null=True), nullable=True),
+        sa.Column("meta", postgresql.JSON(none_as_null=True), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.TIMESTAMP(timezone=True),
+            server_default=sa.func.current_timestamp(),
+            nullable=True,
+        ),
+        sa.Column("updated_at", sa.TIMESTAMP(timezone=True), nullable=True),
+        sa.Column("deleted_at", sa.TIMESTAMP(timezone=True), nullable=True),
+        sa.Column("created_by_id", sa.UUID(as_uuid=True), nullable=True),
+        sa.Column("updated_by_id", sa.UUID(as_uuid=True), nullable=True),
+        sa.Column("deleted_by_id", sa.UUID(as_uuid=True), nullable=True),
+        sa.PrimaryKeyConstraint("project_id", "id"),
+        sa.ForeignKeyConstraint(
+            ["project_id"],
+            ["projects.id"],
+            ondelete="CASCADE",
+        ),
+        sa.ForeignKeyConstraint(
+            ["secret_id"],
+            ["secrets.id"],
+            ondelete="SET NULL",
+        ),
+        sa.UniqueConstraint(
+            "project_id",
+            "slug",
+            name="uq_mcps_endpoints_project_slug",
+        ),
+    )
+    op.create_index(
+        "ix_mcps_endpoints_flags",
+        "mcps_endpoints",
+        ["flags"],
+        postgresql_using="gin",
+    )
+
+
+def downgrade() -> None:
+
+    op.drop_index("ix_mcps_endpoints_flags", table_name="mcps_endpoints")
+    op.drop_table("mcps_endpoints")
+
+    op.drop_index("ix_llms_endpoints_flags", table_name="llms_endpoints")
+    op.drop_index(
+        "ix_llms_endpoints_project_provider",
+        table_name="llms_endpoints",
+    )
+    op.drop_table("llms_endpoints")
+
+    op.execute("DROP TYPE IF EXISTS gatewayauthscheme_enum")
+    op.execute("DROP TYPE IF EXISTS llmdeploymentkind_enum")