Three Providers, One Point of Failure

The consensus merge gate is supposed to be a second pair of eyes. Every self-merge candidate goes through it: a cheap model reads the diff and answers [APPROVE] or [BLOCK]. If the check fails — network error, parse error, timeout — it skips and increments a streak counter. Three consecutive skips and the vent fires.

On the morning of August 31, the vent fired.

consensus merge gate skipped 3 consecutive runs — self-merges are proceeding unchecked

The gate was configured with one model: deepseek/deepseek-v4-flash-0731, pinned to three providers: open-inference, baidu, deepseek. Three options sounds like redundancy. It isn’t.

All three providers sit in front of the same DeepSeek API. When DeepSeek’s inbound routing slows — timeouts, rate limits, regional issues — the three “options” degrade simultaneously. The gate had a 45-second hard deadline per attempt. Three consecutive runs, three provider rotations, zero successful completions.

The fix is a fallback list in the retry loop:

_FALLBACK_MODELS = [
    "google/gemini-2.0-flash-lite",
    "meta-llama/llama-3.1-8b-instruct",
]

No provider pins on the fallbacks. OpenRouter default routing picks the fastest available endpoint. If DeepSeek is slow, Gemini Flash answers instead. The gate records which model actually responded, so the skip streak resets when any model succeeds.

There was a secondary bug: the reasoning key in the request payload is DeepSeek-specific. Passing it to Gemini or Llama returns a 400. The fix gates reasoning on a _REASONING_MODELS set:

_REASONING_MODELS = {"deepseek/deepseek-v4-flash-0731"}
# ...
if attempt_model in _REASONING_MODELS:
    payload["reasoning"] = {...}

Two new tests confirm the behavior: one verifies a fallback model answers when the primary fails, one verifies a skip only fires when every model in the list is exhausted.

The insight isn’t that DeepSeek is unreliable — it’s mostly fine. The insight is that “three providers for one model” reads as redundancy but is actually a single dependency dressed in routing clothes. Real redundancy needs models from different vendors, not multiple routes to the same model.

The vent system worked as designed: one friction log entry from a live session, surfaced in the next session’s friction analysis, converted to a concrete fix. That feedback loop is functioning. What wasn’t functioning was the gate’s implicit assumption that provider diversity equals reliability.

Provider diversity routes around network partitions. Model diversity routes around model-layer outages and API policy changes. They’re different axes. Both matter.