feat(plugin)!: Add Switchyard Decision API routing plugin

.gitignore

@@ -85,3 +85,4 @@ CHANGELOG.md
 
 # Relay
 /.nemo-relay
+/artifacts/

Cargo.toml

@@ -10,6 +10,7 @@ members = [
     "crates/worker",
     "crates/adaptive",
     "crates/pii-redaction",
+    "crates/switchyard",
     "crates/cli",
     # Language Bindings
     "crates/python",
@@ -33,6 +34,8 @@ nemo-relay-worker-proto = { version = "0.6.0", path = "crates/worker-proto" }
 nemo-relay-worker = { version = "0.6.0", path = "crates/worker" }
 nemo-relay-adaptive = { version = "0.6.0", path = "crates/adaptive" }
 nemo-relay-pii-redaction = { version = "0.6.0", path = "crates/pii-redaction" }
+nemo-relay-switchyard = { version = "0.6.0", path = "crates/switchyard" }
+switchyard-translation = { git = "https://github.com/NVIDIA-NeMo/Switchyard.git", rev = "8f9db9a6a47f848cdff1d262276ba25a8ae9cbc8" }
 nemo-relay-ffi = { version = "0.6.0", path = "crates/ffi" }
 nemo-relay-cli = { version = "0.6.0", path = "crates/cli" }
 opentelemetry = { version = "0.31", default-features = false }

crates/cli/Cargo.toml

@@ -23,11 +23,13 @@ workspace = true
 [features]
 default = ["atof-streaming"]
 atof-streaming = ["nemo-relay/atof-streaming"]
+switchyard = ["dep:nemo-relay-switchyard"]
 
 [dependencies]
 nemo-relay = { workspace = true, features = ["guardrails-remote", "object-store", "otel", "openinference", "worker-grpc"] }
 nemo-relay-adaptive = { workspace = true, features = ["redis-backend"] }
 nemo-relay-pii-redaction.workspace = true
+nemo-relay-switchyard = { workspace = true, optional = true, features = ["schema"] }
 async-stream = "0.3"
 axum = "0.8"
 base64 = "0.22"
@@ -61,3 +63,8 @@ opentelemetry = { workspace = true, features = ["trace"] }
 opentelemetry_sdk = { workspace = true, features = ["trace", "testing"] }
 tempfile = "3"
 tower = { version = "0.5", features = ["util"] }
+
+[[test]]
+name = "switchyard_process_e2e"
+path = "tests/switchyard_process_e2e.rs"
+required-features = ["switchyard"]

crates/cli/src/doctor.rs

@@ -20,6 +20,10 @@ use nemo_relay::observability::plugin_component::OBSERVABILITY_PLUGIN_KIND;
 use nemo_relay::plugin::{DiagnosticLevel, PluginConfig, validate_plugin_config};
 use nemo_relay_adaptive::plugin_component::register_adaptive_component;
 use nemo_relay_pii_redaction::component::register_pii_redaction_component;
+#[cfg(feature = "switchyard")]
+use nemo_relay_switchyard::{
+    register_switchyard_component, validate_switchyard_atof_configuration,
+};
 use serde::Serialize;
 use serde_json::{Value, json};
 use tokio::time::timeout;
@@ -642,6 +646,24 @@ async fn collect_observability(gateway: &GatewayConfig) -> Vec<Check> {
         });
         return checks;
     }
+    #[cfg(feature = "switchyard")]
+    if let Err(error) = register_switchyard_component() {
+        checks.push(Check {
+            name: "Switchyard plugin",
+            status: Status::Fail,
+            details: format!("registration failed: {error}"),
+        });
+        return checks;
+    }
+    #[cfg(feature = "switchyard")]
+    if let Err(error) = validate_switchyard_atof_configuration(&plugin_config) {
+        checks.push(Check {
+            name: "Switchyard ATOF",
+            status: Status::Fail,
+            details: error,
+        });
+        return checks;
+    }
     let report = validate_plugin_config(&plugin_config);
     if report.diagnostics.is_empty() {
         checks.push(Check {
@@ -946,18 +968,38 @@ async fn probe_atof_endpoint(index: usize, endpoint: &Value) -> Check {
 }
 
 fn endpoint_headers(endpoint: &Value) -> Result<Vec<(String, String)>, String> {
-    let Some(headers) = endpoint.get("headers") else {
-        return Ok(Vec::new());
-    };
-    let Some(object) = headers.as_object() else {
-        return Err("headers must be an object of string values".into());
-    };
-    let mut out = Vec::with_capacity(object.len());
-    for (key, value) in object {
-        let Some(value) = value.as_str() else {
-            return Err(format!("headers.{key} must be a string"));
+    let mut out = Vec::new();
+    if let Some(headers) = endpoint.get("headers") {
+        let Some(object) = headers.as_object() else {
+            return Err("headers must be an object of string values".into());
+        };
+        for (key, value) in object {
+            let Some(value) = value.as_str() else {
+                return Err(format!("headers.{key} must be a string"));
+            };
+            out.push((key.clone(), value.to_string()));
+        }
+    }
+    if let Some(header_env) = endpoint.get("header_env") {
+        let Some(object) = header_env.as_object() else {
+            return Err("header_env must be an object of string values".into());
         };
-        out.push((key.clone(), value.to_string()));
+        for (key, variable) in object {
+            if out.iter().any(|(existing, _)| existing == key) {
+                return Err(format!(
+                    "header {key:?} cannot appear in both headers and header_env"
+                ));
+            }
+            let Some(variable) = variable.as_str() else {
+                return Err(format!("header_env.{key} must be a string"));
+            };
+            let value = std::env::var(variable)
+                .map_err(|_| format!("environment variable {variable:?} is not set"))?;
+            if value.trim().is_empty() {
+                return Err(format!("environment variable {variable:?} is blank"));
+            }
+            out.push((key.clone(), value));
+        }
     }
     Ok(out)
 }

crates/cli/src/error.rs

@@ -4,7 +4,7 @@
 use axum::Json;
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
-use nemo_relay::error::FlowError;
+use nemo_relay::error::{FlowError, UpstreamFailure};
 use serde::Serialize;
 use serde_json::{Map, Value, json};
 use strum::Display;
@@ -36,6 +36,8 @@ pub(crate) enum CliError {
     PayloadTooLarge(String),
     #[error("gateway upstream error: {0}")]
     Upstream(#[from] reqwest::Error),
+    #[error("{0}")]
+    ProviderFailure(UpstreamFailure),
     #[error("http error: {0}")]
     Http(#[from] http::Error),
     #[error("io error: {0}")]
@@ -87,16 +89,21 @@ impl CliError {
 
 impl IntoResponse for CliError {
     // Maps gateway errors into a compact JSON HTTP response. Bad hook payloads are client errors,
-    // upstream gateway failures are bad gateway responses, and local install/config/runtime faults
-    // remain internal errors so callers do not mistake them for agent policy decisions.
+    // network-level upstream failures are bad gateway responses, provider failures mirror the
+    // upstream status when available, and local install/config/runtime faults remain internal
+    // errors so callers do not mistake them for agent policy decisions.
     fn into_response(self) -> Response {
         let message = self.to_string();
         let guardrail_reason = self.guardrail_rejection_reason().map(ToOwned::to_owned);
-        let status = match (guardrail_reason.is_some(), self) {
+        let status = match (guardrail_reason.is_some(), &self) {
             (true, _) => StatusCode::FORBIDDEN,
             (false, Self::PayloadTooLarge(_)) => StatusCode::PAYLOAD_TOO_LARGE,
             (false, Self::InvalidPayload(_)) => StatusCode::BAD_REQUEST,
             (false, Self::Upstream(_)) => StatusCode::BAD_GATEWAY,
+            (false, Self::ProviderFailure(failure)) => failure
+                .status
+                .and_then(|status| StatusCode::from_u16(status).ok())
+                .unwrap_or(StatusCode::BAD_GATEWAY),
             (
                 false,
                 Self::Http(_)