Repository navigation
docs: correct the networking page against the node code - #765
Merged
Merged
Conversation
The networking page listed /v1/* among the endpoints that never forward anything, and the node API reference said nothing on the /v1 path forwards Authorization. The gate strips the header that carried the node's token, and /v1/* forwards an Authorization header that is still present to the backend, as the proxy path does. Every route that needs the token, except the proxy path, accepts it in Authorization.
The networking page said the node API has four parts. The node also serves /oauth/token, /oauth/revoke, /egress/, the Envoy ext_authz and ext_proc routes, /mesh/identity and /debug/.
The networking page, the scalability guide and the router reference said a member connects to no router it does not hold. To reach a peer behind a third router, the node runs the handshake with that router and dials the circuit through it, as the networking page's connecting section already said. Lookups still go only to the routers the member holds.
The networking page, the node configuration reference and the --backend-probe-timeout entry said the node probes every backend before it advertises it. Only MCP and A2A services implement a probe. An inference service, and an egress destination the node serves, is advertised without one.
The networking page said discovery results carry the provider's labels, the node API reference listed labels in discover_remote_services and find_remote_tools results, and the authorization concept said discovery labels rank candidates. DiscoveredProvider has no labels field, and no find_remote_tools row sets one. Labels are checked only in the provider's credential. The reference also said only inference results carry local_proxy_url; every result carries it.
The networking page listed enrollments, refreshes, leases, policy fetches and catalog reports. A member also calls /token/exchange and /sts/token, and its sync pulls /keys, /info, /egress and /revocations.
The networking page and the node API reference said remote inference providers are ranked by labels and load. Nothing supplies a remote provider's labels or load, so the node rotates among the remote providers, skips one in backoff after a failure, and checks the required labels on the provider's credential.
The networking page said routers inject the events and listed only bans and key rotations. The control plane's publish-only peer publishes them on the routers' gossip, and the routers forward them to members. Policy update events exist too, and make a node sync its policy at once.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the documentation across several conceptual, guide, and reference files to align with recent architectural changes in Agent Mesh. Key updates include clarifying header forwarding and removal behavior for authentication tokens, specifying that backend probing only applies to MCP and A2A services (excluding inference and egress), detailing the updated model provider rotation and failure-skipping logic, and clarifying that nodes only connect to other routers to reach peers behind them. Additionally, references to labels in discovery results have been removed. There are no review comments to evaluate, and the documentation changes appear accurate and complete; therefore, I have no feedback to provide.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The networking page describes several behaviors the node no longer has: discovery results with labels, providers ranked by load, routers that inject events, and a probe for every backend. Some of the same claims appear in the node API, node configuration, router and scalability pages.
What changed
/v1/*forwards the backend'sAuthorizationheader, and the page names the routes beyond the four an agent uses.Scope
Verification