Repository navigation
opencode-route-proxy: opendesign leaves sit in pools but the provider's credential is inactive — walks burn attempts and surface a misleading auth error #3228
Description
Finding (2026-10-31, from the route_attempt ledger in opencode.db)
The opendesign provider has a credential row in the OpenCode credential store, but the row is not active (SELECT integration_id, COUNT(*), SUM(active) FROM credential GROUP BY 1 → opendesign: 1 row, SUM(active) = NULL). The route proxy's credential lookup requires active = 1 (bin/opencode-route-proxy.mjs, credentialKey()), so every pool walk that reaches an opendesign leaf records:
provider_id=opendesign, outcome=failure, error_tag=Authentication— "no credential for provider opendesign"
The proxy's own header contract says "disabled providers skipped" — but a provider whose credential is merely inactive is not skipped: it burns one of the walk's MAX_ATTEMPTS with a guaranteed failure, and when it is the last candidate tried, its Authentication error is the one surfaced to the caller. Observed live 2026-10-31 ~16:00 CDT: a workhorse completion walked quota-dead deepseek leaves (opencode-go.personal / opencode-go.lab 429 "Go usage limit exceeded", cline-pass 429 monthly limit), a commandcode timeout, and terminated on the opendesign credential error; OpenClaw's gateway then classified the whole run as an auth failure ("Couldn't sign in to opencode-route. Your saved login looks expired") — a misleading surface for what is a dead-credential leaf inside the pool.
Ask
Pick one, per the owner's intent for this provider:
- If opendesign should be usable: activate its credential row (after verifying the stored key is still valid), or
- If it should not: mark the provider disabled in the OpenCode config so
resolveRouteskips its leaves entirely, or remove the opendesign leaves from the pools that contain them (e.g. the deepseek pool containingopendesign/deepseek-v4.1-flash).
Also worth considering in the proxy: a leaf whose credential lookup comes back empty could be treated as a skip (like a disabled provider) rather than an attempt — the credential store's active flag already carries the intent.
Context
Found while closing out the OpenClaw route-only deploy (#3061): the deploy itself is verified working (gateway up on the new system generation, route-only config live, runs walk workhorse → specialist → speed as configured). The runs currently fail on leaf health — chiefly quota exhaustion across the deepseek doors on 2026-10-31 — of which this inactive-credential leaf is the one permanent, non-quota defect.
Acceptance criteria
- A pool walk never spends one of its attempts on a provider whose credential row is inactive: inactive-credential providers are skipped like disabled providers (or the credential is activated / the provider disabled, per the owner's recorded intent — see the Ask in the original body).
- When every candidate in a walk fails, the error surfaced to the caller is not a misleading Authentication error produced by an inactive-credential leaf.
- A test or probe pins the behaviour: a pool containing an inactive-credential leaf and one healthy leaf completes via the healthy leaf with no attempt recorded against the inactive provider.
- The chosen resolution (activate / disable / skip-inactive) is recorded on this issue.
Activity
dezren39 commentedon Oct 31, 2026
Intake review
Related: #3225 (same
app/opencode-route-proxysurface, filed the same evening); the misleading-surface failure was observed live 2026-10-31 ~16:00 CDT per the issue body.Notes: The defect is verified in the body with the route_attempt ledger evidence:
credentialKey()requiresactive = 1, butresolveRoutedoes not skip providers whose only credential is inactive, so the walk burns attempts and can surface the dead leaf's Authentication error as the run's failure. The fix direction (skip-inactive in the walk) is mechanical; the choice among the issue's three options is not — options 1 and 2 change the owner's provider setup.Risks: Low code risk for the skip-inactive change. The larger risk is leaving the surfaced-error behaviour as-is: downstream classifiers (OpenClaw gateway in the observed case) read it as an expired login and misdirect recovery.
Suggested approach: Implement skip-inactive in
resolveRoute/credentialKeyso the walk treats an inactive credential like a disabled provider, pin it with the acceptance-criteria probe, and record the owner's intent for opendesign itself underuser/review(Muse review lane) rather than guessing it in a lane.— fleet monitor intake, 2026-10-31 fleet-monitor run (17:12 CDT)
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
11 remaining items
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
Merge pull request #5156 from developing-today/queue/8762-3228-skip-i…
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done
fix(route-proxy): Codex round on #5295 — credential-aware gate fallba…
developing-today commentedon Nov 8, 2026
🤖 Agent note · picked up
direct— this lane works the triage itself. Fresh check: issue opencode-route-proxy: opendesign leaves sit in pools but the provider's credential is inactive — walks burn attempts and surface a misleading auth error #3228 is OPEN, no hard-stop labels; it carriesuser/review, which per protocol means this worker reviews first — done in the verdict below.developing-today commentedon Nov 8, 2026
🤖 Agent note · escalated
user/review— reviewed by the worker first, per protocol)user/review→user/escalated).Triage verdict (task 12102): harm fixed, proxy retired — one owner question remains, with a recommendation
Verified fresh this shift via
ghand the laptop primary clone atorigin/main:bd6855a9a): credential-less leaves are skipped like disabled providers, and a walk with no credentialed members fails as "no credentialed members" before any attempt is recorded (task 8762, tests 27/27). PR fix(route-proxy): known-100% seating gate — exclude pairs with a future quota reset (#5295) #5296 (known-100% seating gate, for issue opencode-route-proxy: known-100% seating gate — exclude legs whose binding quota window is known exhausted until reset (#4370c) #5295) is also MERGED (2026-11-04).e8b4cdc754("rewire OpenClaw to the server facade and retire the route proxy", opencode#1153) is onorigin/main: it deletedbin/opencode-route-proxy.mjs(−1,221 lines) and its tests. There are no proxy pool walks left to burn attempts or to surface the misleading auth error; OpenClaw now goes through the server facade..opencode/opencode.jsoncon main), opendesign is explicitly the design provider and is "(on)", seated in pools, with renewal machinery in pm-stack (src/opendesign-renewal.ts). Nothing in current config treats opendesign as disabled or removed.The one Drew question: issue #3228's Ask was to pick the owner's intent for opendesign — (1) activate/keep usable, (2) disable it in config, or (3) remove its leaves from pools. Options and ramifications:
.opencode/opencode.jsoncpools) — a worker will file/route it as a fresh fix on Drew's word; nothing in this issue's proxy-era evidence argues for it.Disposition: task 12102 completes as
triaged. Issue #3228 stays OPEN underuser/escalatedfor the A/B ruling above; no fix packet is enqueued, because there is no engineering remainder — only the ruling.dezren39 commentedon Nov 8, 2026
Partial verification — staying open (2026-11-07 done-task-only audit, tracking: #7016).
Queue task(s) [8206, 8762] were marked done, and some work did land:
No merged change closes this issue's full scope, so the done status is not treated as completion. No remainder task enqueued: this item sits with Drew review.