fix: sanitize Responses reasoning across backend handoffs

crates/libsy-llm-client/Cargo.toml

@@ -29,6 +29,7 @@ parking_lot.workspace = true
 http.workspace = true
 httpdate.workspace = true
 serde_json.workspace = true
+serde.workspace = true
 tokio.workspace = true
 tracing.workspace = true
 tracing-opentelemetry.workspace = true

crates/libsy-llm-client/README.md

@@ -246,6 +246,9 @@ fn build_multi_format_client(
   transport failures, timeouts, HTTP 408/429, and 5xx responses. Buffered body
   transport failures are retried; streaming body failures are not replayed after
   the response has been returned.
+- `ModelConfig::with_responses_reasoning` controls reasoning-item replay for a
+  Responses model. `PreserveEncrypted` keeps signed provider state without
+  plaintext; `Drop` removes reasoning while retaining messages and tool history.
 
 Retries replay the same upstream request to the same model. Each candidate's
 `max_retries` budget is exhausted before candidate fallback advances to the next

crates/libsy-llm-client/src/client.rs

@@ -62,6 +62,7 @@ pub struct ModelConfig {
     model_name: ModelId,
     default_backend: Backend,
     other_backends: Option<Vec<Backend>>,
+    responses_reasoning: crate::ResponsesReasoningPolicy,
 }
 
 impl ModelConfig {
@@ -76,8 +77,16 @@ impl ModelConfig {
             model_name: model_name.into(),
             default_backend,
             other_backends,
+            responses_reasoning: crate::ResponsesReasoningPolicy::default(),
         }
     }
+
+    /// Sets how Responses reasoning items are replayed to this model.
+    #[must_use]
+    pub fn with_responses_reasoning(mut self, policy: crate::ResponsesReasoningPolicy) -> Self {
+        self.responses_reasoning = policy;
+        self
+    }
 }
 
 /// A client that dispatches neutral-IR requests to per-model HTTP backends.
@@ -221,6 +230,13 @@ impl TranslatingLlmClient {
             strip_anthropic_incompatible_fields(&mut body);
             strip_unsigned_thinking_blocks(&mut body);
         }
+        if matches!(backend, Backend::OpenAiResponses(_)) {
+            self.model_to_config
+                .get(model)
+                .map(|config| config.responses_reasoning)
+                .unwrap_or_default()
+                .normalize(&mut body);
+        }
         merge_extra_body(&mut body, backend.extra_body());
         if matches!(backend, Backend::Anthropic(_)) {
             enable_anthropic_prompt_caching(&mut body);
@@ -871,6 +887,21 @@ mod tests {
         )]
     }
 
+    fn responses_map(base_url: &str) -> Vec<ModelConfig> {
+        vec![ModelConfig::new(
+            "gpt",
+            Backend::OpenAiResponses(config(base_url)),
+            None,
+        )]
+    }
+
+    fn local_responses_map(base_url: &str) -> Vec<ModelConfig> {
+        vec![
+            ModelConfig::new("local", Backend::OpenAiResponses(config(base_url)), None)
+                .with_responses_reasoning(crate::ResponsesReasoningPolicy::Drop),
+        ]
+    }
+
     fn chat_map_with_retries(base_url: &str, max_retries: u32) -> Vec<ModelConfig> {
         vec![ModelConfig::new(
             "gpt",
@@ -1368,6 +1399,149 @@ mod tests {
         Ok(())
     }
 
+    // Local Responses backends can emit plaintext reasoning that strict upstreams cannot replay.
+    // Conversely, local backends require signed reasoning replayed from a strict
+    // upstream to retain `content` as an array, even though it must be empty.
+    #[tokio::test]
+    async fn responses_requests_drop_unsigned_reasoning_items()
+    -> std::result::Result<(), Box<dyn Error + Sync + Send + 'static>> {
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path("/v1/responses"))
+            .and(|request: &wiremock::Request| {
+                let body: Value = serde_json::from_slice(&request.body).unwrap_or(Value::Null);
+                let Some(input) = body.get("input").and_then(Value::as_array) else {
+                    return false;
+                };
+                let reasoning: Vec<&Value> = input
+                    .iter()
+                    .filter(|item| item.get("type").and_then(Value::as_str) == Some("reasoning"))
+                    .collect();
+                reasoning.len() == 1
+                    && reasoning[0]
+                        .get("encrypted_content")
+                        .and_then(Value::as_str)
+                        == Some("encrypted")
+                    && reasoning[0].get("content") == Some(&json!([]))
+                    && input.iter().any(|item| {
+                        item.get("type").and_then(Value::as_str) == Some("function_call")
+                    })
+                    && input.iter().any(|item| {
+                        item.get("type").and_then(Value::as_str) == Some("function_call_output")
+                    })
+            })
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                "id": "resp_1",
+                "object": "response",
+                "model": "gpt",
+                "status": "completed",
+                "output": [{
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [{"type": "output_text", "text": "ok"}]
+                }],
+                "usage": {"input_tokens": 1, "output_tokens": 1, "total_tokens": 2}
+            })))
+            .mount(&server)
+            .await;
+
+        let client = TranslatingLlmClient::new(&responses_map(&format!("{}/v1", server.uri())))?;
+        let raw = json!({
+            "model": "client-facing",
+            "input": [
+                {"type": "message", "role": "user", "content": "inspect the repo"},
+                {
+                    "type": "reasoning",
+                    "content": [{"type": "reasoning_text", "text": "private local reasoning"}],
+                    "encrypted_content": ""
+                },
+                {"type": "function_call", "call_id": "call_1", "name": "shell", "arguments": "{}"},
+                {"type": "function_call_output", "call_id": "call_1", "output": "ok"},
+                {
+                    "type": "reasoning",
+                    "content": [{"type": "reasoning_text", "text": "must not be replayed"}],
+                    "encrypted_content": "encrypted"
+                }
+            ]
+        });
+
+        client
+            .call_rewrite_model_raw(
+                raw,
+                None,
+                Some(&ModelId::from("gpt")),
+                WireFormat::OpenAiResponses,
+            )
+            .await?;
+        Ok(())
+    }
+
+    // Encrypted hosted reasoning is opaque to a local Responses backend. Dropping
+    // it avoids llama.cpp rejecting a missing or empty `content` array while
+    // retaining the conversation and tool-call history it can consume.
+    #[tokio::test]
+    async fn local_responses_requests_drop_encrypted_reasoning_items()
+    -> std::result::Result<(), Box<dyn Error + Sync + Send + 'static>> {
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path("/v1/responses"))
+            .and(|request: &wiremock::Request| {
+                let body: Value = serde_json::from_slice(&request.body).unwrap_or(Value::Null);
+                let Some(input) = body.get("input").and_then(Value::as_array) else {
+                    return false;
+                };
+                input
+                    .iter()
+                    .all(|item| item.get("type").and_then(Value::as_str) != Some("reasoning"))
+                    && input.iter().any(|item| {
+                        item.get("type").and_then(Value::as_str) == Some("function_call")
+                    })
+                    && input.iter().any(|item| {
+                        item.get("type").and_then(Value::as_str) == Some("function_call_output")
+                    })
+            })
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                "id": "resp_local",
+                "object": "response",
+                "model": "local",
+                "status": "completed",
+                "output": [{
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [{"type": "output_text", "text": "ok"}]
+                }],
+                "usage": {"input_tokens": 1, "output_tokens": 1, "total_tokens": 2}
+            })))
+            .mount(&server)
+            .await;
+
+        let client =
+            TranslatingLlmClient::new(&local_responses_map(&format!("{}/v1", server.uri())))?;
+        let raw = json!({
+            "model": "client-facing",
+            "input": [
+                {"type": "message", "role": "user", "content": [{"type": "input_text", "text": "inspect"}]},
+                {
+                    "type": "reasoning",
+                    "encrypted_content": "opaque-provider-reasoning"
+                },
+                {"type": "function_call", "call_id": "call_1", "name": "shell", "arguments": "{}"},
+                {"type": "function_call_output", "call_id": "call_1", "output": "ok"},
+                {"type": "message", "role": "user", "content": [{"type": "input_text", "text": "continue"}]}
+            ]
+        });
+
+        client
+            .call_rewrite_model_raw(
+                raw,
+                None,
+                Some(&ModelId::from("local")),
+                WireFormat::OpenAiResponses,
+            )
+            .await?;
+        Ok(())
+    }
+
     // A router can serve earlier turns from an OpenAI target and later turns from
     // an Anthropic one, so the Anthropic leg must drop OpenAI-only fields the
     // caller keeps sending or the upstream rejects the whole request.

crates/libsy-llm-client/src/lib.rs

@@ -23,13 +23,15 @@ pub mod metrics;
 mod observability;
 mod observation;
 pub mod raw;
+mod responses_reasoning;
 pub mod run;
 
 pub use backend::{Backend, DEFAULT_MAX_RETRIES, HttpBackendConfig};
 pub use client::{ModelConfig, TranslatingLlmClient};
 pub use error::{LlmClientError, Result};
 pub use observation::{LlmCallObservation, RunObservation, RunObserver};
 pub use raw::RawResponse;
+pub use responses_reasoning::ResponsesReasoningPolicy;
 pub use run::{ClientRouter, run};
 pub use switchyard_translation::RawEventStream;
 

crates/libsy-llm-client/src/responses_reasoning.rs

@@ -0,0 +1,116 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Target-specific replay policy for OpenAI Responses reasoning items.
+
+use serde::Deserialize;
+use serde_json::Value;
+
+/// Controls which Responses reasoning items are replayed to an upstream.
+#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum ResponsesReasoningPolicy {
+    /// Preserve provider-encrypted reasoning but remove plaintext reasoning.
+    ///
+    /// This is the safe default for strict hosted Responses providers.
+    #[default]
+    PreserveEncrypted,
+    /// Drop all reasoning items while preserving messages and tool-call history.
+    ///
+    /// Use this for local Responses-compatible servers that cannot consume
+    /// another provider's encrypted reasoning representation.
+    Drop,
+}
+
+impl ResponsesReasoningPolicy {
+    /// Normalizes a Responses request body for this replay policy.
+    pub(crate) fn normalize(self, body: &mut Value) {
+        let Some(Value::Array(input)) = body.get_mut("input") else {
+            return;
+        };
+        input.retain_mut(|item| self.normalize_item(item));
+    }
+
+    fn normalize_item(self, item: &mut Value) -> bool {
+        let Some(object) = item.as_object_mut() else {
+            return true;
+        };
+        if object.get("type").and_then(Value::as_str) != Some("reasoning") {
+            return true;
+        }
+
+        let signed = matches!(
+            object.get("encrypted_content").and_then(Value::as_str),
+            Some(encrypted_content) if !encrypted_content.is_empty()
+        );
+        if self == Self::PreserveEncrypted && signed {
+            object.insert("content".to_string(), Value::Array(Vec::new()));
+            true
+        } else {
+            false
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    fn mixed_history() -> Value {
+        json!({
+            "input": [
+                {"type": "message", "role": "user", "content": []},
+                {
+                    "type": "reasoning",
+                    "content": [{"type": "reasoning_text", "text": "plaintext"}],
+                    "encrypted_content": ""
+                },
+                {"type": "function_call", "call_id": "call_1"},
+                {"type": "function_call_output", "call_id": "call_1", "output": "ok"},
+                {
+                    "type": "reasoning",
+                    "content": [{"type": "reasoning_text", "text": "must be removed"}],
+                    "encrypted_content": "encrypted"
+                }
+            ]
+        })
+    }
+
+    #[test]
+    fn preserve_encrypted_drops_unsigned_and_clears_plaintext() {
+        let mut body = mixed_history();
+        ResponsesReasoningPolicy::PreserveEncrypted.normalize(&mut body);
+
+        let input = body["input"].as_array().expect("input array");
+        let reasoning: Vec<&Value> = input
+            .iter()
+            .filter(|item| item["type"] == "reasoning")
+            .collect();
+        assert_eq!(reasoning.len(), 1);
+        assert_eq!(reasoning[0]["encrypted_content"], "encrypted");
+        assert_eq!(reasoning[0]["content"], json!([]));
+        assert!(input.iter().any(|item| item["type"] == "function_call"));
+        assert!(
+            input
+                .iter()
+                .any(|item| item["type"] == "function_call_output")
+        );
+    }
+
+    #[test]
+    fn drop_removes_all_reasoning_and_keeps_tool_history() {
+        let mut body = mixed_history();
+        ResponsesReasoningPolicy::Drop.normalize(&mut body);
+
+        let input = body["input"].as_array().expect("input array");
+        assert!(input.iter().all(|item| item["type"] != "reasoning"));
+        assert!(input.iter().any(|item| item["type"] == "function_call"));
+        assert!(
+            input
+                .iter()
+                .any(|item| item["type"] == "function_call_output")
+        );
+    }
+}

crates/switchyard-server/README.md

@@ -85,6 +85,10 @@ Target-level `extra_body` values are shallow-merged into the upstream request wh
 the request does not already contain that key.
 `max_retries` defaults to `2` and applies to transport failures, timeouts, HTTP 408/429, and 5xx
 responses.
+For an `openai_responses` client, `responses_reasoning` defaults to
+`preserve_encrypted`. Set it to `drop` for a local compatible server that cannot
+replay another provider's encrypted reasoning items; messages and tool history
+are retained.
 
 Random-route `weights` are relative, follow target order, and do not need to sum to one. Omit them
 for equal weighting. The optional `seed` reproduces the selection sequence for the same call order.