Repository navigation
feat(cli): wire the provider failover chain into every face via TOLE_FALLBACK_* (#209, 3/3) - #407
Merged
Merged
Conversation
…FALLBACK_* (#209, 3/3)
- A stream cut after a live sink showed output now reports "stream cut after output" and never fails over, so the reserve cannot re-stream a full answer after the partial one. - The chain walks from the active link and wraps round, so a sticky reserve that fails during the cooldown falls back to the primary. - The turn loop's transient retry reads only the last provider's error (failover::leading_error), so an earlier "timeout"/"429" no longer makes a fail-loud 401 from the reserve look retryable. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🔍 Cora AI Code Review✅ No issues found. Code looks good! Review powered by cora-code · BYOK · MIT |
Resolve mission.rs: keep the failover chain build and apply the pinned system prompt (from #410) to every link via configure_mission_provider. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ajianaz
added a commit
that referenced
this pull request
Oct 21, 2026
) Diffs of a few hundred lines already exceed the 10-minute limit: the job is cancelled mid-review and no verdict is posted, which blocks the merge gate (seen three times on #407). Sync the stated limit in AGENTS.md and CONTRIBUTING.md. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Wires the core
FailoverProviderfrom #404 (#209, 1/3) into every session face (run, chat, mission, serve, ACP and MCP) throughTOLE_FALLBACK_BASE_URL/TOLE_FALLBACK_API_KEY/TOLE_FALLBACK_MODEL. Also fixes three failover edge cases that a cora 0.19 agent-mode scan found in the core chain.Closes #209. There was no separate 2/3 PR; this PR finishes the issue.
Why
#209 asks for a reserve provider so missions keep going when the primary is unavailable. #404 added the chain to core but nothing used it yet. The scan also turned up three bugs in the chain:
Changes
tole-cli/src/provider_chain.rs(new): builds the chain from env. A reserve without its own key is refused, so the primary's key is never sent to another host. The model defaults to the primary's.main.rs,session_host.rs,mission.rs: every face builds its provider throughprovider_chain::build.tole-core/src/provider.rs: adds alast_routepassthrough sotole_routelands in the usage row.tole-core/src/failover.rs:FAILOVER_MARKERandleading_error().STREAM_CUT_AFTER_OUTPUTclass, which never fails over.tole-core/src/openai.rs: a stream read error after a sink has emitted output now reportsstream cut after outputinstead ofstream read.tole-core/src/turn.rs: transient retry classification goes throughis_transient_provider_error, which reads only the last provider's error.Testing
tests/provider_failover_e2e.rs: with the primary down, the reserve completes the turn andtole_routeis recorded. Auth errors do not fail over.cargo fmt --all,cargo clippy --workspace --all-targets -- -D warnings,cargo test --workspaceandcora review --staged(✅ no issues) all pass.openai::streaming_tests::wire_stats_are_per_call_not_carried_overfailed once. It passed 3 times on its own and in 4 fulltole-corelib runs. It uses the shared-port SSE mock, not the changed error path, so it looks like an existing flaky test.