Tell the caller which class of provider failure it hit

A coder session that lost two turns in a row was told only "The model
provider failed. The call was not completed." twice. The reason had been
computed and logged on the server and then dropped: the caller got the
code `provider_failed` and nothing else, which reads as the product being
broken rather than as a call that ran out of context or hit a rate limit.

`OperationalLog.code/1` takes the reason's atom tag and bounds it to 64
characters, so it carries no provider text, no prompt, and no credential.
It is the same bounded word already written to the log. Send it as
`error.reason` beside the code.

The existing test still holds the boundary: the test provider fails with
`{:provider_failed, "test_failure"}`, and `test_failure` stays out of the
response body while the tag reaches it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012TRDRrfL1khQhQtNr3SRrA

Co-Authored-By

Claude Opus 5 (1M context) <noreply@anthropic.com>

Claude-Session

https://claude.ai/code/session_012TRDRrfL1khQhQtNr3SRrA

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

pushed

by user · WAL seq 311 · 2026-08-24T21:12:43.714905Z

Changed files

• modified lib/openagents_web/controllers/inference_proxy_controller.ex
• modified test/openagents_web/controllers/inference_proxy_controller_test.exs

Diff

2 files changed, +20 -3

        # sees a provider error, never raw provider detail.

        usage = usage_of(events)

        if usage != %{}, do: meter(grant, usage)

        Logger.warning("inference_proxy_failed code=#{OpenAgents.OperationalLog.code(reason)}")

        refuse(conn, :provider_failed)

        class = OpenAgents.OperationalLog.code(reason)

        Logger.warning("inference_proxy_failed code=#{class}")

        refuse(conn, {:provider_failed, class})

    end

  end

     }}

  end

  # The failure class travels with the refusal. `OperationalLog.code/1` takes

  # only the reason's atom tag and bounds it to 64 characters, so it carries no

  # provider text, no prompt, and no credential — it is the same bounded word

  # the server logs. Withholding it left the caller with "the model provider

  # failed" and nothing to act on, which reads as the product being broken

  # rather than as a call that ran out of context or hit a rate limit.

  defp error_for({:provider_failed, class}) do

    {502, %{"code" => "provider_failed", "reason" => class}}

  end

  defp error_for(reason) do

    {status, code} = status_for(reason)

    {status, %{"code" => code}}

    assert conn.status == 502

    body = Jason.decode!(conn.resp_body)

    assert body["error"]["code"] == "provider_failed"

    # No raw provider detail leaks.

    # The failure class travels with the refusal so a client can say more than

    # "something went wrong", but it is the reason's atom tag only.

    assert body["error"]["reason"] == "provider_failed"

    # No raw provider detail leaks. `OperationalLog.code/1` takes the tag and

    # drops the detail, which is what keeps the line above safe to send.

    refute conn.resp_body =~ "test_failure"

  end