[CharmingGroot]

Stacked on #110.

#110's ext_proc server required BUFFERED bodies. agentgateway defaults to fullDuplexStreamed, and Envoy Gateway offers Streamed, so a pasu attached with their defaults refused every completion. This PR accepts both streamed modes without letting an unjudged byte through, and verifies pasu on two more data planes.

Streamed body modes (eb1876a)

pasu still sees the whole body before any of it goes on:

mode	while the body arrives	once whole	a refused streamed completion
BUFFERED	(one message)	pass / rewrite / refuse	clean 403
STREAMED	each piece answered by clearing it	the last piece carries the whole body	reset with no body byte (headers were already downstream), or a clean 403 if the refusal beats them
FULL_DUPLEX_STREAMED	nothing answered; response headers withheld too	whole body sent back in ≤64 KiB pieces	clean 403

• Size limits apply to the whole held body.
• A held body that ends in trailers is refused.
• NONE, BUFFERED_PARTIAL and GRPC are still refused (500) when they would hide a body pasu must judge.
• Bodies pasu does not judge stream through as they arrive.

Tests: 20 new tests in tests/ext_proc_streamed_e2e.rs. Each of 8 mutants is caught: hold, clear, header withholding, per-piece limit, trailer check, accepting BUFFERED_PARTIAL, skipping the final replacement, judging each piece alone.

On Envoy 1.38, with a slow chunked client:

• Streamed text arrives byte-identical.
• A denied streamed tool call delivers no body byte.
• A resident number split across request pieces never reaches the provider.
• --redact delivers [REDACTED:ko-rrn].
• With clearing disabled, 763 bytes containing tool_calls leaked.

Misconfiguration refusals (0a19c96, 5329c7a)

• The 500 now names every wrong body mode, in Envoy, Envoy Gateway and agentgateway spelling. Before, it named one, in Envoy's.
• It carries "type":"pasu_misconfigured" instead of pasu_policy_block, so an alert on blocks neither fires on a configuration error nor hides one.

agentgateway 1.5.0 (385e2fe, 60e2292)

integrations/agentgateway/config.yaml has been tested in both buffered and the default fullDuplexStreamed:

• A denied tool call, streamed or not, is a clean 403 with no tool-call byte.
• /v1/embeddings and a resident-number prompt are refused.
• failureMode: failClosed (the default) with pasu stopped is a 500.
• failOpen forwarded everything, the denied tool call included. The docs say never.
• The default maxBufferSize is 2 MiB.
• One difference in full duplex: the request headers go upstream before the body is judged. A refused prompt therefore opens a request at the provider; its body never arrives. Use buffered if the provider must not see it at all. The same applies to Envoy's two streamed modes, and is documented there.

Envoy Gateway v1.9.2 on kind (aabbbfc)

integrations/envoy-gateway/ contains manifests: pasu, an EnvoyExtensionPolicy, and a ClientTrafficPolicy buffer limit. The 32 KiB default refused a 100 KiB prompt.

With Buffered bodies everything fails closed, including pasu scaled to 0. Three settings fail open, and pasu cannot detect them because it is never asked:

• processingMode left out
• failOpen: true
• shadowMode: true

The README and the manifests name all three. Envoy Gateway was measured before the streamed-mode support; its Streamed rows say so and were not re-run.

Verification

cargo test (224), clippy -D warnings with default features and without, and fmt --check all pass.

Not verified here:

• The MSRV 1.86 toolchain (CI's job will check it).
• Envoy Gateway with streamed modes.
• An HTTPS backend behind agentgateway.

🤖 Generated with Claude Code