LCORE-5096,LCORE-5089: Backports for 0.7.2 release

.github/workflows/e2e_tests_providers.yaml

@@ -23,13 +23,13 @@ jobs:
         # Expected default LLM for Behave (matches tests/e2e/configs/run-<env>.yaml).
         # | environment | model_id                                   | provider_id   |
         # |-------------|--------------------------------------------| --------------|
-        # | azure       | gpt-4o-mini                                | azure         |
+        # | azure       | gpt-5.6-luna                                | azure         |
         # | vertexai    | publishers/google/models/gemini-2.5-flash  | google-vertex |
         # | watsonx     | meta-llama/llama-3-3-70b-instruct          | watsonx       |
         # | bedrock     | deepseek.v3-v1:0                           | aws-bedrock   |
         include:
           - environment: azure
-            e2e_default_model: gpt-4o-mini
+            e2e_default_model: gpt-5.6-luna
             e2e_default_provider: azure
           - environment: vertexai
             e2e_default_model: publishers/google/models/gemini-2.5-flash

Makefile

@@ -99,7 +99,7 @@ start-ogx-container: build-ogx-image ## Start OGX container
 		-e OPENAI_API_KEY \
 		-e BRAVE_SEARCH_API_KEY \
 		-e TAVILY_SEARCH_API_KEY \
-		-e E2E_OPENAI_MODEL=$${E2E_OPENAI_MODEL:-gpt-4o-mini} \
+		-e E2E_OPENAI_MODEL=$${E2E_OPENAI_MODEL:-gpt-5.6-luna} \
 		-e TENANT_ID=$${TENANT_ID:-} \
 		-e CLIENT_ID=$${CLIENT_ID:-} \
 		-e CLIENT_SECRET \

README.md

@@ -241,11 +241,11 @@ __Note__: Support for individual models is dependent on the specific inference p
 
 | Provider       | Model                                                                        | Tool Calling  | provider_type    | Example                                                                    |
 |----------------|------------------------------------------------------------------------------|---------------|------------------|----------------------------------------------------------------------------|
-| OpenAI         | gpt-5, gpt-4o, gpt-4-turbo, gpt-4.1, o1, o3, o4                               | Yes           | remote::openai   | [1](examples/openai-faiss-run.yaml) [2](examples/openai-pgvector-run.yaml) |
+| OpenAI         | gpt-5, gpt-5.6-luna, gpt-4-turbo, gpt-4.1, o1, o3, o4                               | Yes           | remote::openai   | [1](examples/openai-faiss-run.yaml) [2](examples/openai-pgvector-run.yaml) |
 | OpenAI         | gpt-3.5-turbo, gpt-4                                                         | No            | remote::openai   |                                                                            |
 | RHOAI (vLLM)   | meta-llama/Llama-3.2-1B-Instruct                                             | Yes           | remote::vllm     | [1](tests/e2e-prow/rhoai/configs/run.yaml)                                 |
 | RHEL AI (RHAIIS/vLLM) | meta-llama/Llama-3.1-8B-Instruct                                      | Yes           | remote::vllm     | [1](tests/e2e/configs/run-rhelai.yaml) [2](tests/e2e/configs/run-rhaiis.yaml) |
-| Azure          | gpt-5, gpt-5-mini, gpt-5-nano, gpt-4o-mini, o3-mini, o4-mini, o1             | Yes           | remote::azure    | [1](examples/azure-run.yaml)                                               |
+| Azure          | gpt-5, gpt-5-mini, gpt-5-nano, gpt-5.6-luna, o3-mini, o4-mini, o1             | Yes           | remote::azure    | [1](examples/azure-run.yaml)                                               |
 | Azure          | gpt-5-chat, gpt-4.1, gpt-4.1-mini, gpt-4.1-nano,  o1-mini                    | No or limited | remote::azure    |                                                                            |
 | VertexAI       | google/gemini-2.0-flash, google/gemini-2.5-flash, google/gemini-2.5-pro [^1] | Yes           | remote::vertexai | [1](examples/vertexai-run.yaml)                                            |
 | WatsonX        | meta-llama/llama-3-3-70b-instruct                                            | Yes           | remote::watsonx  | [1](examples/watsonx-run.yaml)                                             |
@@ -1254,12 +1254,12 @@ will be returned.
       "model_type": "embedding"
     },
     {
-      "identifier": "openai/gpt-4o-mini",
+      "identifier": "openai/gpt-5.6-luna",
       "metadata": {},
       "api_model_type": "llm",
       "provider_id": "openai",
       "type": "model",
-      "provider_resource_id": "gpt-4o-mini",
+      "provider_resource_id": "gpt-5.6-luna",
       "model_type": "llm"
     },
     {

docker-compose-library.yaml

@@ -36,7 +36,7 @@ services:
       - TAVILY_SEARCH_API_KEY=${TAVILY_SEARCH_API_KEY:-}
       # OpenAI
       - OPENAI_API_KEY=${OPENAI_API_KEY}
-      - E2E_OPENAI_MODEL=${E2E_OPENAI_MODEL:-gpt-4o-mini}
+      - E2E_OPENAI_MODEL=${E2E_OPENAI_MODEL:-gpt-5.6-luna}
       # Azure Entra ID credentials (AZURE_API_KEY is obtained dynamically in Python)
       - TENANT_ID=${TENANT_ID:-}
       - CLIENT_ID=${CLIENT_ID:-}

docker-compose.yaml

@@ -34,7 +34,7 @@ services:
       - TAVILY_SEARCH_API_KEY=${TAVILY_SEARCH_API_KEY:-}
       # OpenAI
       - OPENAI_API_KEY=${OPENAI_API_KEY}
-      - E2E_OPENAI_MODEL=${E2E_OPENAI_MODEL:-gpt-4o-mini}
+      - E2E_OPENAI_MODEL=${E2E_OPENAI_MODEL:-gpt-5.6-luna}
       # Azure Entra ID credentials (AZURE_API_KEY is passed via provider_data at request time)
       - TENANT_ID=${TENANT_ID:-}
       - CLIENT_ID=${CLIENT_ID:-}

docs/basic_info/getting_started.md

@@ -184,10 +184,10 @@ authentication:
                         DEBUG    Set provider/model configuration for openai/openai/gpt-3.5-turbo-instruct to 0                  utils.py:45
                         DEBUG    Set provider/model configuration for openai/openai/gpt-4 to 0                                   utils.py:45
                         DEBUG    Set provider/model configuration for openai/openai/gpt-4-turbo to 0                             utils.py:45
-                        DEBUG    Set provider/model configuration for openai/openai/gpt-4o to 0                                  utils.py:45
+                        DEBUG    Set provider/model configuration for openai/openai/gpt-5.6-luna to 0                                  utils.py:45
                         DEBUG    Set provider/model configuration for openai/openai/gpt-4o-2024-08-06 to 0                       utils.py:45
                         DEBUG    Set provider/model configuration for openai/openai/gpt-4o-audio-preview to 0                    utils.py:45
-                        DEBUG    Set provider/model configuration for openai/openai/gpt-4o-mini to 0                             utils.py:45
+                        DEBUG    Set provider/model configuration for openai/openai/gpt-5.6-luna to 0                             utils.py:45
                         DEBUG    Set provider/model configuration for openai/openai/o1 to 0                                      utils.py:45
                         DEBUG    Set provider/model configuration for openai/openai/o1-mini to 0                                 utils.py:45
                         DEBUG    Set provider/model configuration for openai/openai/o3-mini to 0                                 utils.py:45

docs/design/conversation-compaction/conversation-compaction-spike.md

@@ -501,7 +501,7 @@ To verify: check that the docs site renders correctly and OpenAPI spec validates
 
 # PoC results
 
-A proof-of-concept was built in lightspeed-stack and tested against a real OGX + OpenAI (gpt-4o-mini) setup.
+A proof-of-concept was built in lightspeed-stack and tested against a real OGX + OpenAI (gpt-5.6-luna) setup.
 
 ## What the PoC does
 

docs/design/conversation-compaction/conversation-compaction.md

@@ -136,10 +136,10 @@ Context window sizes are configured per model in YAML:
 
 ``` yaml
 inference:
-  default_model: openai/gpt-4o-mini
+  default_model: openai/gpt-5.6-luna
   context_windows:
-    openai/gpt-4o-mini: 128000
-    openai/gpt-4o: 128000
+    openai/gpt-5.6-luna: 128000
+    openai/gpt-5.6-luna: 128000
 ```
 
 Token estimation runs on every request. Cost: ~1-5ms for a 10K token conversation, negligible compared to the LLM call (seconds).
@@ -383,7 +383,7 @@ Example config files go in `examples/`.
 | Trigger turn      | 1 LLM call (or 413) | 2 LLM calls (summarize + respond)       |
 | Post-trigger turn | 1 LLM call          | 1 LLM call (no change)                  |
 
-Compaction adds latency only on the trigger turn. In PoC testing, compaction turns took 14-40 seconds vs 9-20 seconds for normal turns (gpt-4o-mini).
+Compaction adds latency only on the trigger turn. In PoC testing, compaction turns took 14-40 seconds vs 9-20 seconds for normal turns (gpt-5.6-luna).
 
 # Open Questions for Future Work
 

docs/design/ogx-config-merge/ogx-config-merge-spike.md

@@ -200,7 +200,7 @@ also stay under `ogx.config` whenever they ship as high-level keys
 Literal values (`openai`, `azure`, `sentence_transformers`, `vertexai`,
 `watsonx`, `vllm_rhaiis`, `vllm_rhel_ai`). They are vendor identifiers
 that both OGX (`provider_type: remote::openai`) and Pydantic AI
-(model-string prefixes such as `openai:gpt-4o-mini`) recognise. Each
+(model-string prefixes such as `openai:gpt-5.6-luna`) recognise. Each
 backend-specific synthesizer translates the canonical LCORE vocabulary to
 its target shape; we do not adopt either backend's surface verbatim.
 
@@ -941,7 +941,7 @@ Summary of validation:
   from production design").
 - **Vacuous safety-shield validation in the library-mode PoC**. The
   `native_override` used during PoC validation registered `llama-guard`
-  with `provider_shield_id: openai/gpt-4o-mini` — an OpenAI chat model,
+  with `provider_shield_id: openai/gpt-5.6-luna` — an OpenAI chat model,
   not a Llama Guard checkpoint. The "`native_override` took effect"
   evidence row above only shows that the key landed in the synthesized
   output; it does **not** show that a real safety shield gated any
@@ -1184,7 +1184,7 @@ curl -sSL -o /tmp/lcore-836-poc/lightspeed-stack-unified-library.yaml \
 
 # 1. Start LCORE in library mode with the unified config
 export OPENAI_API_KEY=<your-key>
-export E2E_OPENAI_MODEL=gpt-4o-mini
+export E2E_OPENAI_MODEL=gpt-5.6-luna
 uv run lightspeed-stack \
   -c /tmp/lcore-836-poc/lightspeed-stack-unified-library.yaml
 

docs/design/ogx-config-merge/ogx-config-merge.md

@@ -256,12 +256,12 @@ Top-level high-level sections plus a sub-section under the existing
 # with a `providers:` list (Decision S5). Backend-agnostic: it stays at the
 # root, not under `ogx`, so it survives a future backend change.
 inference:
-  default_model: gpt-4o-mini       # existing — query-time default routing
+  default_model: gpt-5.6-luna       # existing — query-time default routing
   default_provider: openai         # existing — query-time default routing
   providers:                       # NEW — high-level provider setup (synthesis input)
     - type: openai                 # mapped to remote::openai
       api_key_env: OPENAI_API_KEY
-      allowed_models: [gpt-4o-mini]
+      allowed_models: [gpt-5.6-luna]
     - type: sentence_transformers
 
 ogx:
@@ -588,7 +588,7 @@ providers:
       provider_type: remote::openai
       config:
         api_key: ${env.OPENAI_API_KEY}
-        allowed_models: ["${env.E2E_OPENAI_MODEL:=gpt-4o-mini}"]
+        allowed_models: ["${env.E2E_OPENAI_MODEL:=gpt-5.6-luna}"]
 # ... more ...
 ```
 
@@ -629,7 +629,7 @@ ogx:
             provider_type: remote::openai
             config:
               api_key: ${env.OPENAI_API_KEY}
-              allowed_models: ["${env.E2E_OPENAI_MODEL:=gpt-4o-mini}"]
+              allowed_models: ["${env.E2E_OPENAI_MODEL:=gpt-5.6-luna}"]
       # ... rest of run.yaml content under native_override ...
 # ... rest of lightspeed-stack.yaml content ...
 ```
@@ -652,7 +652,7 @@ providers:
       provider_type: remote::openai
       config:
         api_key: ${env.OPENAI_API_KEY}
-        allowed_models: ["${env.OPENAI_MODEL:=gpt-4o-mini}"]
+        allowed_models: ["${env.OPENAI_MODEL:=gpt-5.6-luna}"]
     - provider_id: sentence-transformers
       provider_type: inline::sentence-transformers
 # ... the rest is the same shape as a working run.yaml ...

docs/devel_doc/container_orchestration.md

@@ -314,7 +314,7 @@ See [OKP Guide](okp_guide.md) for detailed setup instructions.
 
 #### Other Configuration
 
-- `E2E_OPENAI_MODEL`: OpenAI model for E2E tests (default: `gpt-4o-mini`)
+- `E2E_OPENAI_MODEL`: OpenAI model for E2E tests (default: `gpt-5.6-luna`)
 - `OGX_LOGGING`: Enable debug logging in OGX
 - `FAISS_VECTOR_STORE_ID`: FAISS vector store identifier
 - `LITELLM_DROP_PARAMS`: Drop unsupported params in LiteLLM (default: `true`)

docs/devel_doc/openapi.json

@@ -14153,6 +14153,12 @@
                                 "type": "null"
                             }
                         ]
+                    },
+                    "responses_request_max_size": {
+                        "type": "integer",
+                        "title": "Maximum character length for the serialized responses request body",
+                        "description": "Maximum character length for the serialized /v1/response responses request body",
+                        "default": 131072
                     }
                 },
                 "additionalProperties": false,

docs/devel_doc/openapi.md

@@ -6591,7 +6591,7 @@ Inference configuration.
 |-------|------|-------------|
 | default_model |  | Identification of default model used when no other model is specified. |
 | default_provider |  | Identification of default provider used when no other model is specified. |
-| context_windows | object | Map of fully-qualified model identifier (e.g., "openai/gpt-4o-mini") to context window size in tokens. Used by the conversation compaction trigger to decide when older turns must be summarized before the input exceeds the window. Models absent from this map have no registered window — callers fall back to their own default or skip the token-based trigger. |
+| context_windows | object | Map of fully-qualified model identifier (e.g., "openai/gpt-5.6-luna") to context window size in tokens. Used by the conversation compaction trigger to decide when older turns must be summarized before the input exceeds the window. Models absent from this map have no registered window — callers fall back to their own default or skip the token-based trigger. |
 
 
 ## InfoResponse

docs/devel_doc/responses.md

@@ -595,12 +595,46 @@ When server-tool merging is active, the response stream and output include items
 
 In streaming mode, server-deployed MCP events (e.g. `mcp_call`, `mcp_list_tools`) are filtered from the SSE stream so clients only see standard output types (`message`, `function_call`, etc.) for their own tools.
 
+### Shield Moderation After Last Refusal
+
+By default, shields moderate the **entire** extracted `input` (plus attachments). Clients that own their own context (`store: false`, no conversation id) resend full history on every call. Once a blocked turn is in that history, every later request is refused — even when the new user turn is clean.
+
+Set the `X-LCS-Shield-After-Last-Refusal: true` request header to window moderation:
+
+```bash
+curl -X POST http://localhost:8090/v1/responses \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "X-LCS-Shield-After-Last-Refusal: true" \
+  -d '{
+    "input": [
+      {"type": "message", "role": "user", "content": "<some violent message>"},
+      {"type": "message", "role": "assistant", "id": "modr-abc", "content": "I cannot help with that."},
+      {"type": "message", "role": "user", "content": "What is Kubernetes?"}
+    ],
+    "store": false
+  }'
+```
+
+When this header is set to `true`:
+
+1. LCORE finds the **last** input item whose `id` starts with `modr` (a prior shield refusal).
+2. Shields run only on text and attachments extracted from items **after** that refusal.
+3. If no `modr-` item is present, behavior matches today (moderate the full input).
+
+When the header is absent or `false`, full-input moderation applies (no breaking change for conversation / `store: true` clients).
+
+**Client guidance:** Keep refusal items (with their `modr-…` ids) in resent history so the window can advance. Shield refusals use response and output-item ids of the form `modr-…` (not `resp_…`). Deployments that require blocked content never enter the model should omit this header.
+
+See also the [Safety Shields Guide](../user_doc/shields_guide.md).
+
 ### LCORE-Specific Extensions
 
 The API introduces extensions that are not part of the OpenResponses specification:
 
 - `generate_topic_summary` (request) — When set to `true` and a new conversation is created, a topic summary is automatically generated and stored in conversation metadata.
 - `shield_ids` (request) — Optional list of LCORE shield `name` values to apply. If omitted, all shields from `lightspeed-stack.yaml` are used. See the [Safety Shields Guide](../user_doc/shields_guide.md).
+- `X-LCS-Shield-After-Last-Refusal` (request header) — When `true`, shields moderate only input items after the last prior refusal (`modr-…`). See [Shield Moderation After Last Refusal](#shield-moderation-after-last-refusal).
 - `solr` (request) — Object with optional `mode` (`semantic`, `hybrid`, or `lexical`) and `filters` (Solr vector_io provider payload). Legacy filter-only objects (no `mode`/`filters` wrapper) still work.
 - `available_quotas` (response) — Provides real-time quota information from all configured quota limiters.
 

docs/models/common.json

@@ -389,7 +389,7 @@
                     "model": {
                         "description": "Model identifier used for this turn",
                         "examples": [
-                            "gpt-4o-mini"
+                            "gpt-5.6-luna"
                         ],
                         "title": "Model",
                         "type": "string"

docs/models/conversation_summary.json

@@ -7,7 +7,7 @@
     "components": {
         "schemas": {
             "ConversationSummary": {
-                "description": "A single compaction-produced summary chunk.\n\nAttributes:\n    summary_text: The natural-language summary produced by the\n        summarization LLM call. Used directly as context for\n        subsequent requests (alongside any later summary chunks\n        and the buffer of recent turns kept verbatim).\n    summarized_through_turn: Running total of conversation items\n        consumed by this and all preceding summaries. Used by the\n        caller to advance the partition boundary on the next\n        compaction so the new summary only covers items that\n        have not yet been summarized.\n    token_count: Number of tokens in ``summary_text``. Tracked so\n        the recursive-resummarize fallback can decide when the\n        cumulative summary size itself approaches the context\n        limit without re-tokenizing.\n    created_at: ISO 8601 timestamp recording when this summary was\n        produced. Kept as a string (not datetime) to match the\n        cache schema convention used elsewhere in the codebase.\n    model_used: Fully-qualified model identifier used for the\n        summarization LLM call (e.g., ``\"openai/gpt-4o-mini\"``).\n        Preserved for audit and for diagnostics when summary\n        quality varies between models.",
+                "description": "A single compaction-produced summary chunk.\n\nAttributes:\n    summary_text: The natural-language summary produced by the\n        summarization LLM call. Used directly as context for\n        subsequent requests (alongside any later summary chunks\n        and the buffer of recent turns kept verbatim).\n    summarized_through_turn: Running total of conversation items\n        consumed by this and all preceding summaries. Used by the\n        caller to advance the partition boundary on the next\n        compaction so the new summary only covers items that\n        have not yet been summarized.\n    token_count: Number of tokens in ``summary_text``. Tracked so\n        the recursive-resummarize fallback can decide when the\n        cumulative summary size itself approaches the context\n        limit without re-tokenizing.\n    created_at: ISO 8601 timestamp recording when this summary was\n        produced. Kept as a string (not datetime) to match the\n        cache schema convention used elsewhere in the codebase.\n    model_used: Fully-qualified model identifier used for the\n        summarization LLM call (e.g., ``\"openai/gpt-5.6-luna\"``).\n        Preserved for audit and for diagnostics when summary\n        quality varies between models.",
                 "properties": {
                     "summary_text": {
                         "description": "Natural-language summary produced by the summarization LLM call.",