mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-05 06:42:12 +03:00
f44ec7e1f2
T-30 — ADRs:
- 6 ADRs: SQLite, Fallback Strategy, OAuth, JS+JSDoc, Single-Tenant, Translator Registry
T-33 — JSDoc Coverage:
- Full JSDoc on all new modules (100% exported functions documented)
T-35 — Accessibility:
- a11yAudit.js: lightweight WCAG AA checker (aria-label, dialog role, alt text, labels)
T-38 — Password Reset CLI:
- bin/reset-password.mjs: interactive CLI tool for admin password reset
T-39 — Playwright Specs:
- tests/e2e/responsiveSpecs.mjs: viewports (375/768/1280), 4 pages, test matrix
T-42 — Eval Framework:
- evalRunner.js: 4 strategies (exact, contains, regex, custom) + golden set (10 cases)
T-43 — Compliance:
- audit_log table, noLog opt-out per API key, LOG_RETENTION_DAYS cleanup
TASKS.md: 46/46 Concluído ✅
Tests: 144/144 pass (119 existing + 25 new)
37 lines
1.4 KiB
Markdown
37 lines
1.4 KiB
Markdown
# ADR-002: Multi-Provider Fallback Strategy
|
|
|
|
**Date:** 2025-11-20
|
|
**Status:** Accepted
|
|
**Deciders:** @diegosouzapw
|
|
|
|
## Context
|
|
|
|
OmniRoute routes requests to multiple LLM providers (OpenAI, Anthropic, Google, etc.). Providers may become unavailable due to rate limiting, outages, or credential expiry. The system needs a strategy to handle these failures gracefully.
|
|
|
|
## Decision
|
|
|
|
Implement a **declarative fallback chain** with three layers:
|
|
|
|
1. **Credential Retry Loop** — Rotate through available credentials for the same provider before failing
|
|
2. **Model Fallback Policy** — Configurable fallback chain per model (e.g., `gpt-4o → azure-gpt-4o → anthropic-claude`)
|
|
3. **Circuit Breaker** — Trip open after consecutive failures to prevent cascading requests to broken providers
|
|
|
|
The fallback policy is defined in `src/domain/fallbackPolicy.js` and integrates with the circuit breaker in `src/shared/utils/circuitBreaker.js`.
|
|
|
|
## Consequences
|
|
|
|
### Positive
|
|
|
|
- Automatic failover with zero user intervention
|
|
- Per-model granularity — different models can have different fallback strategies
|
|
- Circuit breaker prevents wasting quota on broken providers
|
|
|
|
### Negative
|
|
|
|
- Fallback chain requires manual configuration per model
|
|
- Response latency increases when primary fails (retry + fallback time)
|
|
|
|
### Neutral
|
|
|
|
- Lockout policy (n consecutive failures → temporary block) complements but is separate from fallback
|