Validate model listener filter references before serving traffic

[mukeshbaphna]

Summary

Fixes #945.

This makes model-listener filter references fail closed in both config generation and Brightstaff startup. output_filters are now validated the same way as input_filters, and Brightstaff no longer silently drops missing filter IDs when resolving the runtime filter pipeline.

This PR does not change runtime output-filter failure behavior. It only makes invalid filter references fail fast before traffic is served. Startup/config validation and runtime stream execution need different handling modes: a missing filter ID is a config bug, while an output filter service failing mid-stream is still handled by the existing log-and-pass-through behavior.

Why

Filter chains are part of Plano's guardrails path. If an output_filters ID has a typo, config generation or startup should fail early with a clear error instead of allowing the response path to continue without the intended filter.

This came up while working on a similar ingress/egress processing flow in SGLang: sgl-project/sglang#21154

Design Notes

• Python config generation catches the normal plano_config.yaml path before rendered config is produced.
• Brightstaff startup catches rendered configs or non-CLI startup paths that bypass Python config generation.
• Missing input_filters references already fail during config generation; this makes output_filters consistent with that behavior.
• Existing runtime behavior for configured output filters is unchanged: if an output filter errors while streaming, Plano logs the error and passes through the original chunk.

Changes

• Validate listener-level input_filters and output_filters against defined agents / filters during config generation
• Preserve valid output_filters configs with a positive config-generator test
• Make Brightstaff startup return an error when rendered config references a missing filter ID
• Add focused Rust tests for valid, missing input filter, and missing output filter resolution

Local Testing

cd cli
uv run pytest test/test_config_generator.py

cd crates
cargo test -p brightstaff resolve_filter_chain

Result locally:

22 passed
3 passed

[Copilot]

Pull request overview

This PR closes a validation gap for model-listener filter chains by ensuring both input_filters and output_filters references are validated up-front, causing startup/config generation to fail fast (fail closed) when a referenced filter/agent ID is missing—before any traffic is served.

Changes:

• CLI config generation now validates listener-level output_filters the same way as input_filters.
• Brightstaff startup now errors if a rendered config references missing filter IDs instead of silently dropping them.
• Added focused Brightstaff unit tests covering valid chains and missing input/output filter references.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
crates/brightstaff/src/main.rs	Replaces silent filter-chain resolution with strict resolution that errors on missing IDs; adds unit tests.
cli/planoai/config_generator.py	Extends listener filter ID validation to include output_filters as well as input_filters.
cli/test/test_config_generator.py	Adds config-generator test cases for missing/valid output_filters references.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Spherrrical]

Thank you for the contribution! Will merge once CI is finished.

[mukeshbaphna]

Thank you for the contribution! Will merge once CI is finished.

Hi @Spherrrical - PR seems to be blocked by secret-backed e2e jobs. What's the recommendation?

[Spherrrical]

CI for fork PRs cannot access repository secrets (including after workflow approval), so e2e jobs will not get API keys on this PR.

I pushed the same branch to `katanemo/plano` and opened #955 to run full CI with secrets. Once #955 is green, this PR is safe to merge.