[{"data":1,"prerenderedAt":970},["ShallowReactive",2],{"navigation_docs":3,"-docs-proxy-provider-routing-and-resilience":356,"-docs-proxy-provider-routing-and-resilience-surround":965},[4,8,34,64,90,139,157,171,193,227,241,266,312,334],{"title":5,"path":6,"stem":7},"Documentation","\u002Fdocs","docs\u002Findex",{"title":9,"path":10,"stem":11,"children":12},"Getting started","\u002Fdocs\u002Fgetting-started","docs\u002F01.getting-started\u002Findex",[13,14,18,22,26,30],{"title":9,"path":10,"stem":11},{"title":15,"path":16,"stem":17},"Introduction","\u002Fdocs\u002Fgetting-started\u002Fintroduction","docs\u002F01.getting-started\u002F01.introduction",{"title":19,"path":20,"stem":21},"Concepts","\u002Fdocs\u002Fgetting-started\u002Fconcepts","docs\u002F01.getting-started\u002F02.concepts",{"title":23,"path":24,"stem":25},"Quickstart (5 minutes)","\u002Fdocs\u002Fgetting-started\u002Fquickstart","docs\u002F01.getting-started\u002F03.quickstart",{"title":27,"path":28,"stem":29},"Local development","\u002Fdocs\u002Fgetting-started\u002Flocal-development","docs\u002F01.getting-started\u002F04.local-development",{"title":31,"path":32,"stem":33},"FAQ","\u002Fdocs\u002Fgetting-started\u002Ffaq","docs\u002F01.getting-started\u002F05.faq",{"title":35,"path":36,"stem":37,"children":38},"Architecture","\u002Fdocs\u002Farchitecture","docs\u002F02.architecture\u002Findex",[39,40,44,48,52,56,60],{"title":35,"path":36,"stem":37},{"title":41,"path":42,"stem":43},"Architecture overview","\u002Fdocs\u002Farchitecture\u002Foverview","docs\u002F02.architecture\u002F01.overview",{"title":45,"path":46,"stem":47},"Services","\u002Fdocs\u002Farchitecture\u002Fservices","docs\u002F02.architecture\u002F02.services",{"title":49,"path":50,"stem":51},"Request lifecycle","\u002Fdocs\u002Farchitecture\u002Frequest-lifecycle","docs\u002F02.architecture\u002F03.request-lifecycle",{"title":53,"path":54,"stem":55},"Data model","\u002Fdocs\u002Farchitecture\u002Fdata-model","docs\u002F02.architecture\u002F04.data-model",{"title":57,"path":58,"stem":59},"Status and evidence","\u002Fdocs\u002Farchitecture\u002Fstatus-and-evidence","docs\u002F02.architecture\u002F05.status-and-evidence",{"title":61,"path":62,"stem":63},"Target architecture and authority","\u002Fdocs\u002Farchitecture\u002Ftarget-architecture","docs\u002F02.architecture\u002F06.target-architecture",{"title":65,"path":66,"stem":67,"children":68},"Auth","\u002Fdocs\u002Fauth","docs\u002F03.auth\u002Findex",[69,70,74,78,82,86],{"title":65,"path":66,"stem":67},{"title":71,"path":72,"stem":73},"Overview","\u002Fdocs\u002Fauth\u002Foverview","docs\u002F03.auth\u002F01.overview",{"title":75,"path":76,"stem":77},"Organization and agent model","\u002Fdocs\u002Fauth\u002Forg-project-model","docs\u002F03.auth\u002F02.org-project-model",{"title":79,"path":80,"stem":81},"Issuing API keys","\u002Fdocs\u002Fauth\u002Fissuing-api-keys","docs\u002F03.auth\u002F03.issuing-api-keys",{"title":83,"path":84,"stem":85},"Multi-tenant RLS","\u002Fdocs\u002Fauth\u002Fmulti-tenant-rls","docs\u002F03.auth\u002F04.multi-tenant-rls",{"title":87,"path":88,"stem":89},"Operator sessions and step-up","\u002Fdocs\u002Fauth\u002Foperator-sessions","docs\u002F03.auth\u002F05.operator-sessions",{"title":91,"path":92,"stem":93,"children":94},"Proxy","\u002Fdocs\u002Fproxy","docs\u002F04.proxy\u002Findex",[95,96,99,103,107,111,115,119,123,127,131,135],{"title":91,"path":92,"stem":93},{"title":71,"path":97,"stem":98},"\u002Fdocs\u002Fproxy\u002Foverview","docs\u002F04.proxy\u002F01.overview",{"title":100,"path":101,"stem":102},"Authentication","\u002Fdocs\u002Fproxy\u002Fauthentication","docs\u002F04.proxy\u002F02.authentication",{"title":104,"path":105,"stem":106},"Request routing","\u002Fdocs\u002Fproxy\u002Frequest-routing","docs\u002F04.proxy\u002F03.request-routing",{"title":108,"path":109,"stem":110},"Sessions","\u002Fdocs\u002Fproxy\u002Fsessions","docs\u002F04.proxy\u002F04.sessions",{"title":112,"path":113,"stem":114},"Directives","\u002Fdocs\u002Fproxy\u002Fdirectives","docs\u002F04.proxy\u002F05.directives",{"title":116,"path":117,"stem":118},"Idempotency and budgets","\u002Fdocs\u002Fproxy\u002Fidempotency-and-budgets","docs\u002F04.proxy\u002F06.idempotency-and-budgets",{"title":120,"path":121,"stem":122},"Rate limiting","\u002Fdocs\u002Fproxy\u002Frate-limiting","docs\u002F04.proxy\u002F07.rate-limiting",{"title":124,"path":125,"stem":126},"Provider adapters","\u002Fdocs\u002Fproxy\u002Fprovider-adapters","docs\u002F04.proxy\u002F08.provider-adapters",{"title":128,"path":129,"stem":130},"Auth caching","\u002Fdocs\u002Fproxy\u002Fauth-caching","docs\u002F04.proxy\u002F09.auth-caching",{"title":132,"path":133,"stem":134},"Configuration","\u002Fdocs\u002Fproxy\u002Fconfiguration","docs\u002F04.proxy\u002F10.configuration",{"title":136,"path":137,"stem":138},"Provider routing and resilience","\u002Fdocs\u002Fproxy\u002Fprovider-routing-and-resilience","docs\u002F04.proxy\u002F11.provider-routing-and-resilience",{"title":140,"path":141,"stem":142,"children":143},"Memory","\u002Fdocs\u002Fmemory","docs\u002F05.memory\u002Findex",[144,145,149,153],{"title":140,"path":141,"stem":142},{"title":146,"path":147,"stem":148},"Memory overview","\u002Fdocs\u002Fmemory\u002Foverview","docs\u002F05.memory\u002F01.overview",{"title":150,"path":151,"stem":152},"Write path","\u002Fdocs\u002Fmemory\u002Fwrite-path","docs\u002F05.memory\u002F02.write-path",{"title":154,"path":155,"stem":156},"Search and lifecycle","\u002Fdocs\u002Fmemory\u002Fsearch-and-lifecycle","docs\u002F05.memory\u002F03.search-and-lifecycle",{"title":158,"path":159,"stem":160,"children":161},"Context","\u002Fdocs\u002Fcontext","docs\u002F06.context\u002Findex",[162,163,167],{"title":158,"path":159,"stem":160},{"title":164,"path":165,"stem":166},"Assembly pipeline","\u002Fdocs\u002Fcontext\u002Foverview","docs\u002F06.context\u002F01.overview",{"title":168,"path":169,"stem":170},"Ranking and packing","\u002Fdocs\u002Fcontext\u002Franking-and-packing","docs\u002F06.context\u002F02.ranking-and-packing",{"title":172,"path":173,"stem":174,"children":175},"Intelligence","\u002Fdocs\u002Fintelligence","docs\u002F07.intelligence\u002Findex",[176,177,181,185,189],{"title":172,"path":173,"stem":174},{"title":178,"path":179,"stem":180},"Workers","\u002Fdocs\u002Fintelligence\u002Fworkers","docs\u002F07.intelligence\u002F01.workers",{"title":182,"path":183,"stem":184},"Extraction","\u002Fdocs\u002Fintelligence\u002Fextraction","docs\u002F07.intelligence\u002F02.extraction",{"title":186,"path":187,"stem":188},"Embedder","\u002Fdocs\u002Fintelligence\u002Fembedder","docs\u002F07.intelligence\u002F03.embedder",{"title":190,"path":191,"stem":192},"Extraction evaluation","\u002Fdocs\u002Fintelligence\u002Fevaluation","docs\u002F07.intelligence\u002F04.evaluation",{"title":194,"path":195,"stem":196,"children":197},"API reference","\u002Fdocs\u002Fapi-reference","docs\u002F08.api-reference\u002Findex",[198,199,203,207,211,215,219,223],{"title":194,"path":195,"stem":196},{"title":200,"path":201,"stem":202},"Chat completions","\u002Fdocs\u002Fapi-reference\u002Fchat-completions","docs\u002F08.api-reference\u002F01.chat-completions",{"title":204,"path":205,"stem":206},"Responses","\u002Fdocs\u002Fapi-reference\u002Fresponses","docs\u002F08.api-reference\u002F02.responses",{"title":208,"path":209,"stem":210},"Errors","\u002Fdocs\u002Fapi-reference\u002Ferrors","docs\u002F08.api-reference\u002F03.errors",{"title":212,"path":213,"stem":214},"Health and metrics","\u002Fdocs\u002Fapi-reference\u002Fproxy-health","docs\u002F08.api-reference\u002F04.proxy-health",{"title":216,"path":217,"stem":218},"HTTP route inventory","\u002Fdocs\u002Fapi-reference\u002Fhttp-routes","docs\u002F08.api-reference\u002F05.http-routes",{"title":220,"path":221,"stem":222},"Management API","\u002Fdocs\u002Fapi-reference\u002Fmanagement-api","docs\u002F08.api-reference\u002F06.management-api",{"title":224,"path":225,"stem":226},"Auth gRPC (ValidateToken, ValidateAgent)","\u002Fdocs\u002Fapi-reference\u002Fauth-grpc","docs\u002F08.api-reference\u002F07.auth-grpc",{"title":228,"path":229,"stem":230,"children":231},"MCP","\u002Fdocs\u002Fmcp","docs\u002F09.mcp\u002Findex",[232,233,237],{"title":228,"path":229,"stem":230},{"title":234,"path":235,"stem":236},"Memory server","\u002Fdocs\u002Fmcp\u002Fmemory-server","docs\u002F09.mcp\u002F01.memory-server",{"title":238,"path":239,"stem":240},"Operator gateway","\u002Fdocs\u002Fmcp\u002Foperator-gateway","docs\u002F09.mcp\u002F02.operator-gateway",{"title":242,"path":243,"stem":244,"children":245},"Security","\u002Fdocs\u002Fsecurity","docs\u002F10.security\u002Findex",[246,247,251,254,258,262],{"title":242,"path":243,"stem":244},{"title":248,"path":249,"stem":250},"Security overview","\u002Fdocs\u002Fsecurity\u002Foverview","docs\u002F10.security\u002F01.overview",{"title":100,"path":252,"stem":253},"\u002Fdocs\u002Fsecurity\u002Fauthentication","docs\u002F10.security\u002F02.authentication",{"title":255,"path":256,"stem":257},"Tenant isolation","\u002Fdocs\u002Fsecurity\u002Ftenant-isolation","docs\u002F10.security\u002F03.tenant-isolation",{"title":259,"path":260,"stem":261},"Secrets and keys","\u002Fdocs\u002Fsecurity\u002Fsecrets-and-keys","docs\u002F10.security\u002F04.secrets-and-keys",{"title":263,"path":264,"stem":265},"Prompt injection","\u002Fdocs\u002Fsecurity\u002Fprompt-injection","docs\u002F10.security\u002F05.prompt-injection",{"title":267,"path":268,"stem":269,"children":270},"Operations","\u002Fdocs\u002Foperations","docs\u002F11.operations\u002Findex",[271,272,276,280,284,288,292,296,300,304,308],{"title":267,"path":268,"stem":269},{"title":273,"path":274,"stem":275},"Observability","\u002Fdocs\u002Foperations\u002Fobservability","docs\u002F11.operations\u002F01.observability",{"title":277,"path":278,"stem":279},"Traces and ClickHouse","\u002Fdocs\u002Foperations\u002Ftraces-and-clickhouse","docs\u002F11.operations\u002F02.traces-and-clickhouse",{"title":281,"path":282,"stem":283},"Health checks","\u002Fdocs\u002Foperations\u002Fhealth-checks","docs\u002F11.operations\u002F03.health-checks",{"title":285,"path":286,"stem":287},"Incident response","\u002Fdocs\u002Foperations\u002Fincident-response","docs\u002F11.operations\u002F04.incident-response",{"title":289,"path":290,"stem":291},"Troubleshooting","\u002Fdocs\u002Foperations\u002Ftroubleshooting","docs\u002F11.operations\u002F05.troubleshooting",{"title":293,"path":294,"stem":295},"Billing and budgets","\u002Fdocs\u002Foperations\u002Fbilling-and-budgets","docs\u002F11.operations\u002F06.billing-and-budgets",{"title":297,"path":298,"stem":299},"Evidence and relay","\u002Fdocs\u002Foperations\u002Fevidence-and-relay","docs\u002F11.operations\u002F07.evidence-and-relay",{"title":301,"path":302,"stem":303},"Console","\u002Fdocs\u002Foperations\u002Fconsole","docs\u002F11.operations\u002F08.console",{"title":305,"path":306,"stem":307},"Failure modes and recovery","\u002Fdocs\u002Foperations\u002Ffailure-and-recovery","docs\u002F11.operations\u002F09.failure-and-recovery",{"title":309,"path":310,"stem":311},"Data lifecycle and deletion","\u002Fdocs\u002Foperations\u002Fdata-lifecycle-and-deletion","docs\u002F11.operations\u002F10.data-lifecycle-and-deletion",{"title":313,"path":314,"stem":315,"children":316},"Deployment","\u002Fdocs\u002Fdeployment","docs\u002F12.deployment\u002Findex",[317,318,322,326,330],{"title":313,"path":314,"stem":315},{"title":319,"path":320,"stem":321},"Docker Compose (dev)","\u002Fdocs\u002Fdeployment\u002Fdocker-compose","docs\u002F12.deployment\u002F01.docker-compose",{"title":323,"path":324,"stem":325},"Environment variables","\u002Fdocs\u002Fdeployment\u002Fenvironment-variables","docs\u002F12.deployment\u002F02.environment-variables",{"title":327,"path":328,"stem":329},"Kubernetes","\u002Fdocs\u002Fdeployment\u002Fkubernetes","docs\u002F12.deployment\u002F03.kubernetes",{"title":331,"path":332,"stem":333},"Production readiness","\u002Fdocs\u002Fdeployment\u002Fproduction-readiness","docs\u002F12.deployment\u002F04.production-readiness",{"title":335,"path":336,"stem":337,"children":338},"Reference","\u002Fdocs\u002Freference","docs\u002F13.reference\u002Findex",[339,340,344,348,352],{"title":335,"path":336,"stem":337},{"title":341,"path":342,"stem":343},"Glossary","\u002Fdocs\u002Freference\u002Fglossary","docs\u002F13.reference\u002F01.glossary",{"title":345,"path":346,"stem":347},"Roadmap and gates","\u002Fdocs\u002Freference\u002Froadmap","docs\u002F13.reference\u002F02.roadmap",{"title":349,"path":350,"stem":351},"Architecture decisions","\u002Fdocs\u002Freference\u002Fadr","docs\u002F13.reference\u002F03.adr",{"title":353,"path":354,"stem":355},"Compatibility and versioning","\u002Fdocs\u002Freference\u002Fcompatibility","docs\u002F13.reference\u002F04.compatibility",{"id":357,"title":136,"audience":358,"author":359,"authorUrl":359,"body":360,"coverIndex":359,"coverLabel":359,"coverTone":359,"date":359,"decisionStatus":359,"description":956,"excerpt":359,"extension":957,"featured":958,"historical":958,"meta":959,"navigation":960,"path":137,"readingTime":359,"scope":961,"seo":962,"sourceOfTruth":963,"status":367,"stem":138,"tags":359,"verifiedDate":368,"__hash__":964},"docs\u002Fdocs\u002F04.proxy\u002F11.provider-routing-and-resilience.md","integrator",null,{"type":361,"value":362,"toc":941},"minimark",[363,369,373,378,389,394,419,425,429,435,502,517,548,555,559,562,579,582,586,589,619,640,650,654,657,723,730,754,757,763,777,781,784,790,794,890,894,908,912],[364,365],"page-status",{"note":366,"status":367,"verified":368},"Local routing, breakers, and fallback; no hosted SLO or universal provider support","IMPLEMENTED","2026-10-21",[370,371,372],"p",{},"A model name is not a capability contract. The proxy resolves the requested model through tenant policy, the provider registry, and a capability manifest before it calls an upstream. On failure it may fail fast, or substitute an explicitly configured fallback model. Those are separate decisions with separate failure semantics.",[374,375,377],"h2",{"id":376},"routing-order","Routing order",[379,380,386],"pre",{"className":381,"code":383,"language":384,"meta":385},[382],"language-text","request model\n  → if empty, agent.default_model\n  → org model policy (deny veto)\n  → registry lookup\n  → adapter + credential selection\n  → capability\u002Ftoken admission\n  → upstream Complete\n","text","",[387,388,383],"code",{"__ignoreMap":385},[390,391,393],"h3",{"id":392},"model-selection","Model selection",[395,396,397,405,412],"ol",{},[398,399,400,401,404],"li",{},"Use a non-empty trimmed ",[387,402,403],{},"model"," from the request body.",[398,406,407,408,411],{},"Otherwise use the verified agent's ",[387,409,410],{},"agents.default_model"," from PostgreSQL.",[398,413,414,415,418],{},"Otherwise return ",[387,416,417],{},"400 model is required",".",[370,420,421,424],{},[387,422,423],{},"default_provider"," is not used for registry lookup. The model ID remains the routing key.",[390,426,428],{"id":427},"org-model-policy","Org model policy",[370,430,431,434],{},[387,432,433],{},"OrgAwareRegistry"," wraps the process registry without changing its exact-match behavior. Policies are evaluated in ascending priority; the first matching pattern wins.",[436,437,438,451],"table",{},[439,440,441],"thead",{},[442,443,444,448],"tr",{},[445,446,447],"th",{},"Result",[445,449,450],{},"Behavior",[452,453,454,463,471,481,491],"tbody",{},[442,455,456,460],{},[457,458,459],"td",{},"No matching policy",[457,461,462],{},"Any registered model is allowed",[442,464,465,468],{},[457,466,467],{},"Matching allow policy",[457,469,470],{},"Model allowed; its optional fallback chain may apply",[442,472,473,476],{},[457,474,475],{},"Matching deny policy",[457,477,478],{},[387,479,480],{},"403 MODEL_NOT_ALLOWED",[442,482,483,486],{},[457,484,485],{},"Allowed but not in the registry",[457,487,488],{},[387,489,490],{},"501 PROVIDER_NOT_CONFIGURED",[442,492,493,496],{},[457,494,495],{},"Policy dependency unavailable",[457,497,498,501],{},[387,499,500],{},"503 SERVICE_DEGRADED","; no provider call",[370,503,504,505,508,509,512,513,516],{},"Patterns use Go ",[387,506,507],{},"filepath.Match"," syntax: ",[387,510,511],{},"*",", ",[387,514,515],{},"?",", character classes, ranges, and negation. Two operator traps matter:",[518,519,520,545],"ul",{},[398,521,522,524,525,529,530,533,534,537,538,541,542,418],{},[387,523,511],{}," does ",[526,527,528],"strong",{},"not"," cross ",[387,531,532],{},"\u002F",". A catch-all for catalog IDs such as ",[387,535,536],{},"openai\u002Fgpt-4"," needs ",[387,539,540],{},"*\u002F*"," or ",[387,543,544],{},"provider\u002F*",[398,546,547],{},"The management API rejects malformed patterns that the proxy would otherwise fail closed on.",[370,549,550,551,554],{},"Policy reads use a process-local LRU with a 60-second TTL. Management publishes ",[387,552,553],{},"model_policy_updates:{org_id}"," invalidation events; a failed publish can leave a replica serving a stale decision until the TTL expires. The hot path does not fail open when policy cannot be loaded.",[374,556,558],{"id":557},"capability-manifest","Capability manifest",[370,560,561],{},"The provider capability manifest is a preflight hint, not an execution guarantee. It records provider, model revision, endpoint identity, context limit, tokenizer family, streaming\u002Ftool\u002Fstructured-output support, modalities, usage reporting, retry semantics, residency, and pricing provenance.",[370,563,564,565,541,568,571,572,541,575,578],{},"Missing, stale, unknown, or contradictory capability returns a typed ",[387,566,567],{},"UNSUPPORTED_CAPABILITY",[387,569,570],{},"NO_ROUTE"," error rather than silently degrading the request. Model aliases such as ",[387,573,574],{},"fast",[387,576,577],{},"coding"," must resolve to immutable deployment identities before execution.",[370,580,581],{},"The current manifest is intentionally limited to repository-allowlisted models. Provider catalogs and prices change independently of IBEX; adding a model is a code, capability, and test change, not a configuration-only promotion.",[374,583,585],{"id":584},"circuit-breakers","Circuit breakers",[370,587,588],{},"Breakers are independent per provider and per proxy replica. State is in-process; a shared Redis breaker is not implemented.",[436,590,591,601],{},[439,592,593],{},[442,594,595,598],{},[445,596,597],{},"Provider class",[445,599,600],{},"Default trip model",[452,602,603,611],{},[442,604,605,608],{},[457,606,607],{},"OpenAI \u002F Anthropic",[457,609,610],{},"Rolling window: 30 s, 3 s buckets, at least 10 samples, 50% failure rate",[442,612,613,616],{},[457,614,615],{},"Self-hosted OpenAI-compatible",[457,617,618],{},"Consecutive failures: 5 failures, 30 s cooldown",[370,620,621,622,625,626,512,628,631,632,635,636,639],{},"Client faults with a 4xx status other than ",[387,623,624],{},"429"," do not count as breaker failures. ",[387,627,624],{},[387,629,630],{},"5xx",", timeouts, and transport errors do. An open breaker returns ",[387,633,634],{},"503"," with ",[387,637,638],{},"Retry-After"," set to the cooldown.",[370,641,642,643,541,646,649],{},"Requests using organization BYO credentials (",[387,644,645],{},"APIKeyOverride",[387,647,648],{},"BaseURLOverride",") bypass the shared provider breaker. A customer's bad upstream must not open, or be blocked by, the platform breaker.",[374,651,653],{"id":652},"fallback-routing","Fallback routing",[370,655,656],{},"Fallback is opt-in per org model policy and only for eligible failures:",[436,658,659,669],{},[439,660,661],{},[442,662,663,666],{},[445,664,665],{},"Trigger",[445,667,668],{},"Fallback allowed",[452,670,671,679,689,696,709,716],{},[442,672,673,676],{},[457,674,675],{},"Circuit open",[457,677,678],{},"Yes",[442,680,681,687],{},[457,682,683,684,686],{},"HTTP ",[387,685,630],{}," after adapter retries",[457,688,678],{},[442,690,691,694],{},[457,692,693],{},"Timeout",[457,695,678],{},[442,697,698,706],{},[457,699,683,700,703,704],{},[387,701,702],{},"4xx",", including ",[387,705,624],{},[457,707,708],{},"No",[442,710,711,714],{},[457,712,713],{},"BYO credential request",[457,715,708],{},[442,717,718,721],{},[457,719,720],{},"Failure after SSE headers flushed",[457,722,708],{},[370,724,725,726,729],{},"Configuration lives on the first matching ",[526,727,728],{},"allow"," policy:",[518,731,732,738,741,748,751],{},[398,733,734,737],{},[387,735,736],{},"fallback_chain"," is a text array with at most eight entries.",[398,739,740],{},"An empty chain disables fallback.",[398,742,743,744,747],{},"Runtime hops are ",[387,745,746],{},"min(chain length, IBEX_PROVIDER_FALLBACK_MAX_DEPTH)","; the default depth is 1.",[398,749,750],{},"Every hop must pass the same org policy. A denied or unknown model is skipped; policy infrastructure failure aborts fallback and returns the original primary error.",[398,752,753],{},"Fallback is only considered before any client bytes are sent. A mid-stream provider failure is not retried with a different model.",[370,755,756],{},"On successful substitution the proxy sets:",[379,758,761],{"className":759,"code":760,"language":384,"meta":385},[382],"X-IBEX-Provider-Fallback: \u003Creason>\nX-IBEX-Provider-Used: \u003Cfallback provider>\n",[387,762,760],{"__ignoreMap":385},[370,764,765,766,512,769,772,773,776],{},"The ClickHouse trace rows carry ",[387,767,768],{},"original_model",[387,770,771],{},"fallback_model",", and ",[387,774,775],{},"fallback_reason","; usage is attributed to the model that actually served the request. Non-fallback rows leave those fields empty.",[374,778,780],{"id":779},"streaming-and-responses","Streaming and Responses",[370,782,783],{},"Chat Completions supports streaming. Idempotency keys are accepted only for non-streaming chat; a request with both streaming and an idempotency key is rejected rather than silently weakening replay semantics.",[370,785,786,789],{},[387,787,788],{},"POST \u002Fv1\u002Fresponses"," is a separate, capability-gated, non-streaming contract. It preserves ordered typed output items and unknown item\u002Fevent data instead of flattening Responses into Chat Completions. Semantic SSE, replay persistence, and multi-call execution are not part of the current slice.",[374,791,793],{"id":792},"failure-summary","Failure summary",[436,795,796,809],{},[439,797,798],{},[442,799,800,803,806],{},[445,801,802],{},"Failure",[445,804,805],{},"Client signal",[445,807,808],{},"Provider called?",[452,810,811,822,833,844,854,868,879],{},[442,812,813,816,820],{},[457,814,815],{},"Denied by org policy",[457,817,818],{},[387,819,480],{},[457,821,708],{},[442,823,824,827,831],{},[457,825,826],{},"Model absent from registry",[457,828,829],{},[387,830,490],{},[457,832,708],{},[442,834,835,838,842],{},[457,836,837],{},"Policy store unavailable",[457,839,840],{},[387,841,500],{},[457,843,708],{},[442,845,846,849,852],{},[457,847,848],{},"Capability unsupported",[457,850,851],{},"Typed capability error",[457,853,708],{},[442,855,856,859,866],{},[457,857,858],{},"Breaker open with no fallback",[457,860,861,863,864],{},[387,862,634],{}," + ",[387,865,638],{},[457,867,708],{},[442,869,870,873,876],{},[457,871,872],{},"Eligible primary failure with fallback",[457,874,875],{},"Successful response from fallback",[457,877,878],{},"Yes, fallback only",[442,880,881,884,887],{},[457,882,883],{},"Mid-stream upstream failure",[457,885,886],{},"Stream terminates; no model swap",[457,888,889],{},"Already in progress",[374,891,893],{"id":892},"known-limits","Known limits",[518,895,896,899,902,905],{},[398,897,898],{},"Breaker state is per replica; load balancing can make open\u002Fclosed decisions differ across instances.",[398,900,901],{},"Fallback is a policy feature, not a general retry mechanism; non-idempotent tool effects are never blindly replayed.",[398,903,904],{},"The capability manifest does not prove provider account entitlement, current model availability, or production residency.",[398,906,907],{},"No hosted provider-latency or failover SLO is published.",[374,909,911],{"id":910},"related","Related",[518,913,914,920,925,931,936],{},[398,915,916,919],{},[917,918,124],"a",{"href":125}," — supported wire dialects and mock\u002Flive behavior",[398,921,922,924],{},[917,923,104],{"href":105}," — middleware order and model handoff",[398,926,927,930],{},[917,928,929],{"href":133},"Proxy configuration"," — environment variables",[398,932,933,935],{},[917,934,204],{"href":205}," — non-streaming contract",[398,937,938,940],{},[917,939,57],{"href":58}," — what is not proven",{"title":385,"searchDepth":942,"depth":942,"links":943},2,[944,949,950,951,952,953,954,955],{"id":376,"depth":942,"text":377,"children":945},[946,948],{"id":392,"depth":947,"text":393},3,{"id":427,"depth":947,"text":428},{"id":557,"depth":942,"text":558},{"id":584,"depth":942,"text":585},{"id":652,"depth":942,"text":653},{"id":779,"depth":942,"text":780},{"id":792,"depth":942,"text":793},{"id":892,"depth":942,"text":893},{"id":910,"depth":942,"text":911},"Per-org model policy, capability checks, circuit breakers, and opt-in fallback routing.","md",false,{},true,"shipped-local",{"title":136,"description":956},"engineering\u002Fadr\u002F0075-per-org-model-routing-policy.md; engineering\u002Fadr\u002F0076-circuit-breaker-per-provider.md; engineering\u002Fadr\u002F0077-provider-fallback-routing.md; services\u002Fproxy\u002FREADME.md","gBvJT7Xie8WVO6xS0RS2nVYHRqK7r25vFdRF-leE5aM",[966,968],{"title":132,"path":133,"stem":134,"description":967,"children":-1},"Environment variables and config for the proxy service.",{"title":140,"path":141,"stem":142,"description":969,"children":-1},"Tenant-scoped writes, PII quarantine, deduplication, conflict handling, and semantic retrieval.",1792875070769]