fix(beta9): 5 bugs from Cubic review of upstream PR — status-checking, idempotency, NodePort Service, SDK batch-embeddings

[Wingie]

Summary

Addresses 5 bugs Cubic AI flagged on the (now-closed) upstream PR beam-cloud#1562. All fixes land with tests; full Go + SDK suites pass (62/62 SDK, was 61/62).

Branch off origin/main; one commit per fix for clean review.

Fixes

Commit	Finding	File
e463ced4	SDK batch-embedding field routing — embedding now receives a single vector, embeddings receives the batch list-of-lists	sdk/src/beta9/inference.py
55adb935	UnloadModel status-checks worker response; non-200 logs error with ≤4 KiB body, returns error, leaves LoadState unchanged	pkg/gateway/inference_router.go
cd7acd37	/inference/pull status-checks Ollama before decoding; decode errors return 502; includes isAllowedModelName() allowlist (blocks ..) + MaxBytesReader(4096)	pkg/agent/control.go
241e932a	KeepaliveLoop Start/Stop guarded with sync.Once + atomic started flag; Stop-before-Start no longer hangs; Stop is idempotent; concurrent Stop is safe	pkg/agent/keepalive.go
14d47d1f	Added Service/gateway-nodeport (type NodePort, ports 31994 + 31993, selector app=gateway) alongside the existing ClusterIP Service	manifests/k3d/beta9.yaml

Tests added / updated

• sdk/tests/test_cubic_fixes.py::test_batch_embeddings — pre-existing, now passes
• pkg/gateway/inference_router_test.go — new — TestUnloadModelNonOK (200/500/404 table) + TestUnloadModelNodeNotFound
• pkg/agent/control_test.go — new — TestInferencePullStatus (200/404/500) + TestInferencePullDecodeFailureReturnsBadGateway + TestInferencePullRejectsInvalidModelName + TestInferencePullMethodNotAllowed
• pkg/agent/keepalive_test.go — new — TestKeepaliveLoopIdempotent + TestKeepaliveLoopConcurrentStop (32 goroutines) + TestKeepaliveLoopStopBeforeStart

Verification

• go build ./... — clean
• go test ./... -count=1 -timeout=300s — all packages PASS
• go vet ./... — clean on touched files (pre-existing warnings in pkg/worker/worker.go and pkg/gateway/services/stub.go unchanged)
• cd sdk && python -m pytest tests/ -x --tb=short — 62 passed (was 61 passed / 1 failed before this PR)

Notes

• The NodePort Service (commit 14d47d1) was validated via Python YAML parse (the build host had no kubectl). Worth re-verifying with kubectl apply --dry-run=client -f manifests/k3d/beta9.yaml before apply.
• Cubic's line numbers drifted vs current origin/main; fixes are by function identity, not line — the underlying bugs were unchanged.
• /inference/pull allowlist and body cap are inlined here (not pulled from security-hardening-b9agent branch) since this PR is based on origin/main for a clean diff.
• Fix context (all 40 Cubic findings + cross-check against our earlier audits): https://github.com/Wingie/flowstate-agents/blob/main/wip-specs/beta9/cubic-review-findings-1562-2026-04-20.md

Co-Authored-By: Claudistrator savetheplanet@agentosaurus.com

[Wingie]

Manual review (no @claude workflow on this repo, so no bot review is coming)

Verdict: APPROVE. Five fixes, one commit each, 9 new Go tests, suites green (62/62 SDK, was 61/62). This is the shape a bugfix PR should have.

isAllowedModelName() is built correctly — an allowlist, not a blocklist: length-bounded (1–128), explicit .. rejection, explicit character whitelist with default: return false. URL-encoded traversal (%2e%2e) can't slip through because % isn't permitted. Rejecting on strings.Contains(name, "..") is the right call here — it over-rejects rather than under-rejects, which is the correct failure direction for a security guard.

One gap worth a follow-up: / is allowed and there's no leading-slash check, so /etc/passwd passes the allowlist. .. blocks upward traversal, but absolute paths aren't rejected. Whether that's exploitable depends on how Ollama consumes the name (a leading / probably just 404s upstream), so not blocking — but if strings.HasPrefix(name, "/") { return false } would close it for the cost of one line, and defense-in-depth on a path-ish input is cheap.

The rest read well: status-checking before decode (the old code swallowed decode errors and returned success unconditionally), MaxBytesReader(4096) and the ≤4 KiB error-body cap bounding untrusted input, and the sync.Once + atomic guard fixing a real Stop-before-Start hang and making Stop idempotent under concurrency. Leaving LoadState unchanged on a non-200 UnloadModel is the right conservative choice.

Merging with --merge rather than squash, consistent with how the other submodules are handled here, so the head SHA stays reachable if a parent gitlink ever pins it.