Harden LLM gateway dev deploy guardrails

[Git-on-my-level]

Summary

• add a dev-only LLM Gateway deploy helper that validates env wiring, deploys backend secrets, adopts known bootstrapped dev resources, and runs Helm rollout from one path
• add automatic dev-only LLM Gateway deploy on main changes to gateway/chart/deploy files
• route manual gateway deploy and the legacy backend-pusher gateway path through the shared helper
• fold the newer ExternalSecret wait/verify flow into the backend-secrets helper so workflows do not drift
• document that gateway deploys remain dev-only until the prod launch checklist is explicitly completed

Verification

• DRY_RUN=true ENVIRONMENT=dev GCP_PROJECT_ID=based-hardware-dev GKE_CLUSTER=dev-omi-gke REGION=us-central1 IMAGE_TAG=test backend/scripts/deploy-llm-gateway.sh
• DRY_RUN=true ENVIRONMENT=prod GCP_PROJECT_ID=based-hardware GKE_CLUSTER=prod-omi-gke REGION=us-central1 IMAGE_TAG=test backend/scripts/deploy-llm-gateway.sh exits 2 with the dev-only guard
• parsed edited GitHub workflows with Python YAML loader
• python backend/scripts/validate-llm-gateway-env.py for dev and prod values
• git diff --check origin/main...HEAD
• pre-push checks passed, including selected backend unit tests, OpenAPI contract check, workflow checks, and desktop Rust check
• manual dev-only workflow run succeeded and smoked gateway after rebase: https://github.com/BasedHardware/omi/actions/runs/28541000227
• live dev gateway image after deploy: gcr.io/based-hardware-dev/llm-gateway:c6fb64f, 1/1 pod ready

Notes

• prod gateway deploys are still blocked in the helper and workflows
• local gitignored prod rollout checklist updated under .coordination/llm-gateway-rollout-plan.md with the prod enablement gate

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
deepeninc	🟡 Building	–	Jul 1, 2026, 6:56 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
omi	🟢 Ready	View Preview	Jul 1, 2026, 7:01 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[cubic-dev-ai]

2 issues found across 7 files

Confidence score: 3/5

• In backend/scripts/deploy-llm-gateway.sh, custom CHART_DIR, VALUES_FILE, or RELEASE_NAME can leak into deploy-backend-secrets.sh, so the backend-secrets step may render/deploy the wrong chart or values and misconfigure secrets in the target environment — isolate or explicitly reset gateway-specific overrides before invoking the secrets deploy script.
• In backend/scripts/deploy-backend-secrets.sh, force-sync appears to target an annotation name that can diverge when externalSecret.name is customized, so Helm may report success but sync still fails and leaves deployment in a partially applied state — derive the ExternalSecret target from the configured externalSecret.name (or the rendered manifest) before merging.

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[Git-on-my-level]

Addressed the two Cubic review comments in 2d34f2716:

• deploy-llm-gateway.sh now invokes deploy-backend-secrets.sh with CHART_DIR, VALUES_FILE, and RELEASE_NAME explicitly unset, while passing only the intended backend-secret env. I verified RELEASE_NAME=custom-gateway VALUES_FILE=backend/charts/llm-gateway/dev_omi_llm_gateway_values.yaml ... deploy-llm-gateway.sh still renders dev-omi-backend-secrets, so gateway overrides no longer leak into the backend-secrets helper.
• deploy-backend-secrets.sh now derives externalSecret.name and externalSecret.targetSecretName from the backend-secrets values file, with optional explicit overrides, and uses those names for force-sync, wait, and secret-key verification.

Local verification and pre-push passed.