fix(pixel-relay): return 502 bad gateway when upstream model router is unavailable

[vaibhavsrv]

Why this matters

When Pixel agent forwards chat or model discovery requests to the internal model router through ods/extensions/services/pixel-model-relay/relay.py, an unavailable, terminating, or restarting model-router container causes upstream_task to raise an uncaught aiohttp.ClientConnectorError (or ClientError / OSError / TimeoutError). Because the reverse proxy endpoint _inference in relay.py evaluated upstream = await upstream_task without connection error handling, transport failures bubble up to the aiohttp framework, resulting in an unhandled HTTP 500 "Server got itself in trouble" error rather than a structured HTTP 502 Bad Gateway response. Additionally, sending data=body on GET requests (such as /v1/models) passes an empty string body with a forced JSON content-type header, which can break upstream endpoints expecting clean GET requests.

This fix surgically guards await upstream_task in _inference against (ClientError, OSError, asyncio.TimeoutError) and returns a standardized JSON 502 Bad Gateway payload ({"error": {"message": "upstream model router unavailable", "type": "bad_gateway", "code": "502"}}). It also sanitizes GET requests to avoid sending empty request bodies, and cleanly catches client errors during chunk consumption. Existing routing, authentication, authorization checks, and stream piping semantics remain untouched.

Validation

• Baseline reproduction: Pointing relay.UPSTREAM to an unreachable port raised unhandled ClientConnectorError inside _inference, failing with HTTP 500 Internal Server Error (500 != 502).
• Post-fix behavior: Requests to /v1/chat/completions and /v1/models against an unreachable upstream cleanly return HTTP 502 Bad Gateway with standard JSON error payload.
• Telemetry statement: "[Pixel-model-relay] suites: 2 passed. New-test Ruff, ShellCheck, and diff checks pass; new regressions wired into Linux CI."

Overlap check

• PR fix(pixel-edge): accumulate content before finish reason in stream fallback guard #5604 (fix(pixel-edge): accumulate content before finish reason in stream fallback guard): Focused on edge runtime chunk buffering and fallback finish reasoning; no overlap with reverse proxy upstream connection handling in pixel-model-relay.
• PR fix(pixel): guard task group exception groups during stream revocation cleanup #5600 (fix(pixel): guard task group exception groups during stream revocation cleanup): Touches agent stream revocation in pixel-agent; does not modify pixel-model-relay transport or error mapping.
• PR Portal public beta: agent workspace, context recovery and model transitions #5565 (codex/portal-public-beta-integration): Introduced pixel-model-relay; this patch directly hardens its upstream error boundaries without conflicting with any ongoing portal integration work.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens reverse proxy upstream connection error handling, not runtime admission. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #5604 at 8e30bba without conflicts. Production and test diffs passed together; pixel model relay checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.