{
  "schemaVersion": "eve-sota-provider-route-resilience.v1",
  "taskId": "15.2",
  "recordedAt": "2026-09-16T02:33:03.912Z",
  "source": {
    "repository": "GreyChimp/oshun",
    "commit": "e4b3501f488dd7f2141617565f4c21d23f28f51c",
    "bindings": [
      {
        "path": "apps/oshun/bff/src/assistant/provider-route-resilience.ts",
        "sha256": "9edaef26e03188754a8a0a2bea64dc600aa0aeac461b96738e8484ba32d52028"
      },
      {
        "path": "apps/oshun/bff/src/assistant/provider-route-resilience.spec.ts",
        "sha256": "9e2581e0526eb22d30f7c1efabf8471cb7492bdea17feb977caa6cbfb4471339"
      },
      {
        "path": "apps/oshun/bff/src/assistant/agent-provider-config.ts",
        "sha256": "4df01fbaeb333ea85bce370dfdcd1f510acefcb66a4b1d34ce6b2684ec7eff23"
      },
      {
        "path": "apps/oshun/bff/src/routes/assistant.ts",
        "sha256": "9bb32bc727ed9513dabe4b567f32dc557cdb4549769972014e226600603976c4"
      },
      {
        "path": "libs/shared/ai/src/providers/openai.ts",
        "sha256": "1d44aa8fc8dde88ff4e82082d12821d235ebb86080a175ee755e129c959c8379"
      },
      {
        "path": "libs/shared/ai/src/providers/openrouter-route-resilience.spec.ts",
        "sha256": "acd1b24c4a30e1901eacde73d5dbe4e17c4ab6e263d6bdff3643d5824f5b6a70"
      },
      {
        "path": "apps/oshun/mobile/src/assistant/mobileAssistantTransportPolicy.ts",
        "sha256": "debd46c29b2deaebf857a9fa50b383c175dc6c38a8da6e7741cc1b477b4b004b"
      },
      {
        "path": "apps/oshun/bff/src/assistant/security/threat-model.ts",
        "sha256": "b53f47bfa07a23b427a43320c5fb3d2341a9fcdef8d55e52ef94f01f06034910"
      }
    ]
  },
  "dependency": {
    "taskId": "15.1",
    "state": "complete",
    "manifest": "docs/audits/eve-sota-evidence/phase-15/task-15-1.json",
    "manifestSha256": "850202ab7236714f9c59bf32ece6704e5fd7342c46a8c693fa6eff00a985c544"
  },
  "routes": {
    "endpointFailover": {
      "enabled": true,
      "scope": "same exact model within the reviewed request-class endpoint allowlist",
      "controls": [
        "provider.allow_fallbacks=true is explicit",
        "plain calls admit Baidu, DeepInfra, or StreamLake",
        "tool calls admit Baidu only and require every request parameter",
        "gateway-reported upstream identity is checked before held bytes release"
      ]
    },
    "modelFallback": {
      "enabled": false,
      "scope": "no cross-model candidate is admitted for the assistant turn leg",
      "controls": [
        "no models array is sent",
        "the response model must exactly equal deepseek/deepseek-v4-flash-0731",
        "mismatch rejects before held stream bytes release"
      ]
    },
    "deterministicDegraded": {
      "enabled": true,
      "scope": "preflight only after the provider circuit opens",
      "controls": [
        "three consecutive failed provider turns open a 30 second circuit",
        "503 names the deterministic message route",
        "in-flight failures refuse without automatic replay"
      ]
    }
  },
  "faultMatrix": [
    {
      "id": "plain-reviewed-endpoint",
      "fault": "primary reviewed endpoint is unavailable for a non-tool request",
      "expected": "preserve",
      "observed": "preserved",
      "test": "provider-route-resilience.spec.ts distinguishes same-model endpoint failover"
    },
    {
      "id": "tool-reviewed-endpoint",
      "fault": "tool request is considered for the measured Baidu endpoint",
      "expected": "preserve",
      "observed": "preserved",
      "test": "provider-route-resilience.spec.ts paired tool fault positive"
    },
    {
      "id": "tool-unmeasured-endpoint",
      "fault": "tool request is considered for DeepInfra despite failed execution evidence",
      "expected": "refuse",
      "observed": "refused",
      "test": "provider-route-resilience.spec.ts paired tool fault negative"
    },
    {
      "id": "cross-model-response",
      "fault": "gateway reports a different model after a routed request",
      "expected": "refuse",
      "observed": "refused",
      "test": "openrouter-route-resilience.spec.ts releases only an error event"
    },
    {
      "id": "wrong-tool-provider-response",
      "fault": "gateway reports DeepInfra for a Baidu-only tool request",
      "expected": "refuse",
      "observed": "refused",
      "test": "openrouter-route-resilience.spec.ts withholds pretend tool content"
    },
    {
      "id": "repeated-provider-fault",
      "fault": "three consecutive provider turns fail",
      "expected": "degrade-before-start",
      "observed": "degraded-before-start",
      "test": "assistant-turns-route.spec.ts fourth request is a pre-stream 503 and deterministic route answers"
    },
    {
      "id": "ambiguous-in-flight-fault",
      "fault": "provider fails after a model turn may have started work",
      "expected": "refuse",
      "observed": "refused",
      "test": "provider-route-resilience.spec.ts paired replay fault negative"
    }
  ],
  "circuit": {
    "consecutiveFailureThreshold": 3,
    "cooldownMs": 30000,
    "scope": "process-local-assistant-route",
    "successReset": true
  },
  "clientDegradation": {
    "reason": "assistant_agent_provider_circuit_open",
    "fallback": "deterministic_message_route",
    "preflightOnly": true,
    "ambiguousReplay": "refused"
  },
  "livePosture": {
    "receipt": "docs/audits/eve-sota-provider-route-resilience/2026-09-16.live.probe.json",
    "sha256": "9f04a0784169c1775b9bdd912f4a9d3e8b5a3f440f728144667fa71caf538ba1",
    "result": "regional-route-unavailable",
    "httpStatus": 403,
    "claimBoundary": "The live call proves the reviewed regional route fails closed under this account; it does not prove endpoint failover because no model endpoint was admitted."
  },
  "limitations": [
    "The regional OpenRouter account route returned HTTP 403, so no live endpoint failover success is claimed.",
    "Provider identity is reported by the TLS gateway and checked by the application; it is not cryptographic attestation from the upstream endpoint.",
    "The circuit is process-local and does not quarantine an endpoint across replicas; Task 15.5 owns automated endpoint quarantine and canary rollback.",
    "Deterministic degradation has a smaller capability surface and never impersonates model tools; it is allowed only before the model turn begins.",
    "No cross-model fallback is admitted, benchmarked, priced, or presented as available by this record."
  ]
}