fix review comments

Signed-off-by: roytman <roytman@il.ibm.com>

Author: roytman

pkg/epp/framework/plugins/scheduling/filter/bylabel/selector_test.go

@@ -349,6 +349,32 @@ func TestLabelSelectorFilterEdgeCases(t *testing.T) {
 	})
 }
 
+// TestLabelSelectorFilterHasNoAllowsNoLabelEscapeHatch documents and verifies the
+// property a role-scoped deployment relies on when it shares one InferencePool
+// across roles (rather than one InferencePool per role): unlike the decode-filter
+// shorthand (NewDecodeRole, allowsNoLabel=true), label-selector-filter's
+// matchExpressions has no "endpoint without the label passes anyway" exception. A
+// role-scoped InferencePool selector makes decode-filter's allowsNoLabel safe,
+// since an unlabeled pod is never a candidate in the first place; a shared
+// InferencePool selector removes that guarantee, so the decode role must be
+// scoped with label-selector-filter instead to reject unlabeled/mislabeled pods.
+func TestLabelSelectorFilterHasNoAllowsNoLabelEscapeHatch(t *testing.T) {
+	rawParams := json.RawMessage(`{"matchExpressions": [{"key": "llm-d.ai/role", "operator": "In", "values": ["decode", "prefill-decode"]}]}`)
+	plugin, err := bylabel.SelectorFactory("decode-filter", fwkplugin.StrictDecoder(rawParams), nil)
+	require.NoError(t, err)
+	blf, ok := plugin.(*bylabel.Selector)
+	require.True(t, ok)
+
+	ctx := utils.NewTestContext(t)
+	decodeEndpoint := createEndpoint(k8stypes.NamespacedName{Name: "decode-0"}, "10.0.0.1", map[string]string{"llm-d.ai/role": "decode"})
+	encodeEndpoint := createEndpoint(k8stypes.NamespacedName{Name: "encode-0"}, "10.0.0.2", map[string]string{"llm-d.ai/role": "encode"})
+	unlabeledEndpoint := createEndpoint(k8stypes.NamespacedName{Name: "mystery-0"}, "10.0.0.3", map[string]string{})
+
+	result := blf.Filter(ctx, nil, []scheduling.Endpoint{decodeEndpoint, encodeEndpoint, unlabeledEndpoint})
+	assert.Equal(t, []scheduling.Endpoint{decodeEndpoint}, result,
+		"only the decode-labeled endpoint should pass; the mislabeled and unlabeled endpoints must not")
+}
+
 // Example for setting Prefill/Decode roles using a LabelSelector filter.
 // Definition of labels is based on https://github.com/llm-d/llm-d-router/issues/220.
 func ExamplePrefillDecodeRolesInLWS() {

pkg/epp/framework/plugins/scheduling/profilehandler/headerphase/README.md

@@ -14,10 +14,10 @@ Reads the configured header from the incoming request and looks up the
 
 - If a matching profile hasn't run yet, it runs that profile alone.
 - If the header is missing or names a profile that isn't configured, no profile runs. The
-  request fails with the scheduler's own generic "no profile ran" error (a 429 to the
-  client, since the scheduler doesn't distinguish a malformed request from exhausted
-  capacity); the EPP logs the specific reason (missing header vs. unconfigured value) for
-  operators.
+  scheduler reports that no profile could be run at all, without a reason, which the EPP
+  maps to a 429 response to the client -- misleading, since the scheduler doesn't
+  distinguish a malformed request from exhausted capacity. The EPP logs the specific
+  reason (missing header vs. unconfigured value) for operators.
 
 This differs from the [disagg profile handler](../disagg/README.md), which decides which
 profiles to run via decider plugins rather than a header.

test/coordinator/e2e/coordinator/configs_test.go

@@ -60,13 +60,27 @@ pipeline:
 // EPP-Phase header value (see header-phase-profile-handler); the role filters
 // narrow the combined encode+prefill+decode pod pool down to the profile's own
 // role, since the InferencePool now selects across all three roles at once.
+//
+// The decode profile uses label-selector-filter instead of decode-filter: the
+// decode-filter shorthand hardcodes allowsNoLabel=true (bylabel.NewDecodeRole),
+// which is safe only when decode has its own role-scoped InferencePool, so a
+// pod without the role label was never a candidate in the first place. Here
+// the InferencePool selects across all three roles, so an unlabeled or
+// mislabeled encode/prefill pod would otherwise be accepted as a decode
+// candidate; label-selector-filter's matchExpressions has no such exception.
 const eppConfig = `apiVersion: llm-d.ai/v1alpha1
 kind: EndpointPickerConfig
 plugins:
 - type: openai-parser
 - type: encode-filter
 - type: prefill-filter
-- type: decode-filter
+- type: label-selector-filter
+  name: decode-filter
+  parameters:
+    matchExpressions:
+    - key: llm-d.ai/role
+      operator: In
+      values: ["decode", "prefill-decode", "both", "encode-prefill-decode"]
 - type: queue-scorer
 - type: max-score-picker
 - type: header-phase-profile-handler