# Eve provider and route resilience — 2026-09

Task 15.2 is closed at source commit `e4b3501f488dd7f2141617565f4c21d23f28f51c`.
The machine record is
[`eve-sota-provider-route-resilience/2026-09-16.json`](eve-sota-provider-route-resilience/2026-09-16.json),
validated by
[`eve-sota-provider-route-resilience.schema.json`](eve-sota-provider-route-resilience.schema.json).

The route now treats three recovery mechanisms as different products:

- Endpoint failover stays on the exact reviewed turn model and inside the
  request-class allowlist. Plain calls may use Baidu, DeepInfra, or StreamLake;
  tool calls narrow to Baidu and require every request parameter.
- Model fallback is disabled. The request sends no `models` fallback array, and
  a response naming any other model is rejected before buffered stream content
  is released.
- Deterministic degradation is a preflight-only recovery. Three consecutive
  failed provider turns open a 30-second process-local circuit; the next call
  receives a 503 naming the deterministic message route before a model, tool,
  confirmation, or durable model turn starts. An in-flight failure remains an
  honest refusal because replay could duplicate a tool effect.

Paired faults exercise the positive and negative halves: a reviewed non-tool
endpoint is allowed, an unmeasured tool endpoint is refused; the exact model and
Baidu tool provider are accepted, cross-model or wrong-provider responses
release only an error; and a circuit-open request degrades before work while an
ambiguous in-flight turn does not replay.

## Live boundary

The retained live probe sent the exact model, Baidu-only tool route,
`allow_fallbacks`, parameter enforcement, training denial, and ZDR to the US
regional endpoint. The account returned HTTP 403 before model routing. That is
useful fail-closed evidence, not a live failover success. The receipt retains no
credential, prompt, response content, or tool arguments. The paired fault tests
therefore carry the behavior claim; the live receipt carries only the regional
admission posture.

The gateway-reported model and provider checks are application-layer evidence,
not cryptographic upstream attestation. The circuit is process-local; Task 15.5
owns fleet-wide health, quarantine, canary, drift, and rollback automation.