[rwinkelman]

Summary

• Map upstream LLM verification failures (including HTTP 5xx) to HTTP 400 from /verify
• Prevents the Control UI "Verify integration" button from surfacing a generic 500 when the configured endpoint is down or misconfigured

Test plan

• tests/integration/routes/test_verify.py mocks upstream 500 → client 400 with detail text
• Web UI verify against a deliberately bad upstream URL shows a failed verify, not Internal Server Error

Fixes #149

[rwinkelman]

Rebased onto current main. Grooming pass — branch updated for merge readiness.

[rwinkelman]

Grooming pass 2026-09-28: rebased onto current main to retrigger CI (prior failure looked like a runner pip uninstall babel PermissionError, not a patch defect).

[rwinkelman]

Rebased onto current main and the branch conflicts because this fix is already there.

verify now maps an upstream 4xx/5xx to HTTP 400 (Upstream returned HTTP {status}: {body}) and logs the failure, and tests/integration/routes/test_verify.py covers 401, 404, 500, and 503. Keeping this branch would mean dropping that landed copy for an older wording of the same mapping, so I left the PR as-is instead of pushing an empty rebase.

[rwinkelman]

Closing this as superseded. Current main already maps an upstream 4xx/5xx verify response to HTTP 400 with Upstream returned HTTP {status}: {body}, including the 401/404/500/503 cases in tests/integration/routes/test_verify.py. Rebasing this branch conflicts in agentic_security/routes/scan.py and that test file because the older wording here is a subset of what landed.