Function AdmissionControl

core/http/middleware/admission.go:29–53

AdmissionControl runs after RouteModel so the limit applies to the SERVED model — a router fanout that lands on a saturated downstream model gets rejected even though the requested router-model has slack. On reject: HTTP 503, Retry-After header, error JSON. An audit row goes into the shared event s

(limiter *admission.Limiter, events pii.EventStore)

// Models without limits.max_concurrent (the common case) hit a fast
// no-op path — Acquire returns immediately for max <= 0.
func AdmissionControl(limiter *admission.Limiter, events pii.EventStore) echo.MiddlewareFunc {
	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {
			cfg, ok := c.Get(CONTEXT_LOCALS_KEY_MODEL_CONFIG).(*config.ModelConfig)
			if !ok || cfg == nil {
				return next(c)
			}
			max := cfg.Limits.MaxConcurrent
			release, ok := limiter.Acquire(cfg.Name, max)
			if !ok {
				retryAfter := admission.RetryAfter(cfg.Limits.RetryAfterSeconds)
				recordAdmissionRejection(events, cfg.Name, retryAfter)
				c.Response().Header().Set("Retry-After", strconv.Itoa(int(retryAfter.Seconds())))
				return c.JSON(http.StatusServiceUnavailable, map[string]any{
					"error": map[string]any{
						"type":    "admission_rejected",
						"message": fmt.Sprintf("model %q is at capacity (max_concurrent=%d); retry after %s", cfg.Name, max, retryAfter),
					},
				})
			}
			defer release()
			return next(c)
		}
	}
}

// admissionEventSeq scopes IDs across the process so rapid
// rejections under load get unique row IDs without coordinating