feat(inference): add llmisvc_model_provider_resolver

[jland-redhat]

Summary

• Add llmisvc_model_provider_resolver, porting only the LLMISvc / KServe BBR body-rewrite path from IPP’s model-provider-resolver.
• Prefer a configurable model header (default X-Model, aligned with model_to_header), fall back to body "model", and when the value is a publisher ID (publishers/.../models/<name>) rewrite the body "model" to <name> only.
• Leave the routing header untouched so KServe can still route on the publisher ID; stash the original ID in llmisvc_model_provider_resolver.publisher_id for metering.
• Includes unit tests, example config, integration coverage, and generated filter docs.

Does not port ExternalModel / ExternalProvider resolution, weighted provider selection, Host rewrite, api-format detection, or credential handling.

Sister PR (merge after this)

• praxis-extproc: fix ExtProc body-mutation path to set content-length to the mutated body length (avoids Envoy mismatch_between_content_length_and_the_length_of_the_mutated_body / 500).
• Link: fix(extproc): sync content-length on body mutate + rustls CryptoProvider opendatahub-io/praxis-extproc#23

Without the ExtProc follow-up, body rewrites that change length will fail in Envoy BUFFERED + header SEND mode even though this filter’s rewrite is correct.

Test plan

• Unit tests for rewrite / header preference / body fallback / non-publisher passthrough
• Example config + integration tests
• Validated on local cluster with publisher-ID model request; upstream returned a completion:

{
  "id": "chatcmpl-efb19481-6952-5be9-9572-ebfb8aa9070b",
  "model": "demo/sim-stream",
  "object": "chat.completion",
  "choices": [
    {
      "finish_reason": "stop",
      "message": {
        "role": "assistant",
        "content": "I am fine, how are you today? ..."
      }
    }
  ]
}

[praxis-bot]

praxis-bot review (round 2)

Fix commit is clean: backtick formatting, CI metrics_route field, and test loop refactor all look correct. One nit below. The prior Medium (body mutation when "model" absent) remains open.

Findings: 1 nit

[praxis-bot]

[Nit] Assertion message says SplitN but the implementation (line 279) uses split_once. They are semantically similar, but the message should match the actual method for accuracy.

[jland-redhat]

Fixed — assertion message now says split_once.

[praxis-bot]

praxis-bot review (round 3)

Clean implementation with good separation of concerns. Config validation (deny_unknown_fields, empty-header rejection, validate_max_body_bytes), the header-vs-body resolution chain, and the split_once-based publisher-ID parsing are all correct. Integration tests exercise the core rewrite, routing-header preservation, and non-publisher passthrough end-to-end. The register.rs test refactor to a loop is a nice cleanup.

The prior Medium from round 1 (body mutation when "model" absent -- obj.insert(...) adds a field the caller never sent) remains the only actionable concern and is not yet addressed.

Findings: 0 new (prior Medium still open)

[praxis-bot]

PR Re-Review

Summary: Previous findings (Medium: body mutation when model absent, Nit: SplitN assertion message) are both resolved. Commit 8656cdd5 added the guard to prevent inventing a body "model" field, and the test leaves_body_unchanged_when_header_publisher_id_but_no_body_model exercises this path. The assertion message now correctly references split_once. One new medium finding on missing test coverage.

Severity	Count
Medium	1

[praxis-bot]

[Medium] The config struct has #[serde(deny_unknown_fields)] but no test exercises this validation. While the annotation is present, untested validation paths can silently break if refactored.

Add a test:

#[test]
fn from_config_rejects_unknown_fields() {
    let yaml: serde_yaml::Value = serde_yaml::from_str(
        r#"
header: "X-Model"
bogus_field: true
"#,
    )
    .unwrap();
    assert!(
        LlmisvcModelProviderResolverFilter::from_config(&yaml).is_err(),
        "unknown fields should be rejected"
    );
}

Other filters in the codebase (e.g. identity_header_guard in PR #709) include this test to ensure deny_unknown_fields actually rejects invalid config.