ContextualWisdomLab · seonghobae · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
@@ -67,6 +67,13 @@ push or open a PR.
 
 ### This repo: the org LLM gateway
 
+- Classify retry safety by the failure boundary, not a generic timeout name.
+  Only a direct local-slot admission failure proves no upstream send began;
+  wrapped exceptions and post-send timeouts do not authorize replay. Test the
+  real slot-to-transport path with per-candidate transport call counts and keep
+  unknown-outcome no-replay controls alongside it. Transport spies are not wire
+  delivery evidence. Preserve the default-null model timeout.
+
 - Endpoint races require a complete operator-reviewed equivalence contract.
   Never infer equivalence from provider/model names, and never treat missing loser
   usage as free or zero-cost execution.

@@ -20,6 +20,10 @@ and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 
 ### Fixed
 
+- Model, Agent, gateway, and structured-output repair requests now default to
+  no application timeout. An administrator-owned per-model wait is applied only
+  to that model; there is no shared 90s/900s/3-hour ceiling. Explicit probe,
+  discovery, benchmark, and operator limits remain bounded.
 - Workflow workers now preserve the caller message array exactly once, while
   the added envelope carries only the subtask and Conductor-style prior-step
   access list instead of duplicating the task or source attachments.

@@ -34,6 +34,15 @@
         "models_table_scroll_hint": "Model details table. Scroll horizontally to review latency and success.",
         "no_agents_configured": "Add a model connection to start routing requests.",
         "no_audit_events": "Run a workflow to create your first audit event.",
+        "audit_timeout_changed": "Model time limit updated",
+        "audit_timeout_restored": "Model time limit restored",
+        "audit_model_reference": "Model",
+        "audit_revision_reference": "Revision",
+        "audit_restored_reference": "Restored from revision",
+        "audit_date_unknown": "Date unavailable",
+        "audit_event_heading": "Event",
+        "audit_detail_heading": "Detail",
+        "audit_created_heading": "Created",
         "no_policy_evidence": "No policy evidence is loaded. Open Audit to review recorded events.",
         "no_recent_errors": "No current alerts. Open Audit to review recent changes.",
         "prompt_placeholder": "Describe the task you want to route, then run the trace.",
@@ -297,6 +306,15 @@
         "models_table_scroll_hint": "모델 상세 표입니다. 지연 시간과 성공률을 보려면 가로로 스크롤하세요.",
         "no_agents_configured": "요청 라우팅을 시작하려면 모델 연결을 추가하세요.",
         "no_audit_events": "첫 감사 이벤트를 만들려면 워크플로를 실행하세요.",
+        "audit_timeout_changed": "모델 시간 제한 변경",
+        "audit_timeout_restored": "모델 시간 제한 복원",
+        "audit_model_reference": "모델",
+        "audit_revision_reference": "변경 버전",
+        "audit_restored_reference": "복원한 버전",
+        "audit_date_unknown": "날짜 확인 불가",
+        "audit_event_heading": "변경 내용",
+        "audit_detail_heading": "상세",
+        "audit_created_heading": "기록 시각",
         "no_policy_evidence": "불러온 정책 근거가 없습니다. 기록된 이벤트를 검토하려면 감사를 여세요.",
         "no_recent_errors": "현재 알림이 없습니다. 최근 변경 사항을 검토하려면 감사를 여세요.",
         "prompt_placeholder": "라우팅할 작업을 설명한 다음 트레이스를 실행하세요.",
@@ -879,6 +897,9 @@
     @media (prefers-reduced-motion: reduce) {
       *, *::before, *::after { scroll-behavior: auto !important; }
     }
+    .audit-table { min-width: 0; table-layout: fixed; }
+    .audit-table th, .audit-table td { white-space: normal; overflow-wrap: anywhere; vertical-align: top; }
+    .audit-table th:nth-child(2) { width: 45%; }
   </style>
 </head>
 <body>
@@ -1067,7 +1088,7 @@
       <section class="detail-grid view" data-view="audit" hidden>
         <section class="panel wide">
           <div class="panel-header"><h1 data-i18n="audit_compliance">Audit &amp; Compliance</h1><span class="chip">Evidence</span></div>
-          <table><thead><tr><th>Event</th><th>Detail</th><th>Created</th></tr></thead><tbody id="auditRows"></tbody></table>
+          <table class="audit-table"><thead><tr><th data-i18n="audit_event_heading">Event</th><th data-i18n="audit_detail_heading">Detail</th><th data-i18n="audit_created_heading">Created</th></tr></thead><tbody id="auditRows"></tbody></table>
         </section>
       </section>
       <section class="detail-grid view" data-view="settings" hidden>
@@ -1616,9 +1637,24 @@
     }
     function renderAudit() {
       const events = state.recent_audit_events || [];
-      els.auditRows.innerHTML = events.map(event => `
-        <tr><td>${escapeHtml(event.event_type)}</td><td><pre>${escapeHtml(JSON.stringify(event.event_detail))}</pre></td><td>${escapeHtml(event.created_at)}</td></tr>
-      `).join("") || `<tr><td colspan="3" class="empty" data-i18n="no_audit_events">${t("no_audit_events")}</td></tr>`;
+      els.auditRows.innerHTML = events.map(event => {
+        let label = event.event_type;
+        let detail = JSON.stringify(event.event_detail);
+        if (event.event_type === "model_timeout_policy_changed") {
+          const data = event.event_detail || {};
+          const restored = Number.isSafeInteger(data.restored_from_revision) && data.restored_from_revision > 0;
+          label = t(restored ? "audit_timeout_restored" : "audit_timeout_changed");
+          const references = [];
+          if (typeof data.worker_agent_id === "string") references.push(`${t("audit_model_reference")}: ${data.worker_agent_id}`);
+          if (Number.isSafeInteger(data.revision) && data.revision > 0) references.push(`${t("audit_revision_reference")}: ${data.revision}`);
+          if (restored) references.push(`${t("audit_restored_reference")}: ${data.restored_from_revision}`);
+          detail = references.join(" · ");
+        }
+        const date = typeof event.created_at === "number" && Number.isFinite(event.created_at)
+          ? new Date(event.created_at * 1000) : new Date(NaN);
+        const created = Number.isNaN(date.getTime()) ? t("audit_date_unknown") : date.toLocaleString(currentLang);
+        return `<tr><td>${escapeHtml(label)}</td><td>${escapeHtml(detail)}</td><td>${escapeHtml(created)}</td></tr>`;
+      }).join("") || `<tr><td colspan="3" class="empty" data-i18n="no_audit_events">${t("no_audit_events")}</td></tr>`;
     }
     function renderSecondaryViews() {
       if (!state.policy) return;

@@ -471,6 +471,78 @@
                 "responses": {"200": {"description": "Agent pool collection"}},
             }
         },
+        "/api/v1/agent_pools/{agent_pool_id}/worker_agents/{worker_agent_id}/timeout_policy/history": {
+            "get": {
+                "operationId": "list_model_timeout_history",
+                "summary": "Read older model timeout changes with a stable revision cursor",
+                "security": [{"admin_bearer_auth": []}],
+                "parameters": [
+                    {"name": "agent_pool_id", "in": "path", "required": True, "schema": {"type": "string"}},
+                    {"name": "worker_agent_id", "in": "path", "required": True, "schema": {"type": "string"}},
+                    {"name": "page_size", "in": "query", "schema": {"type": "integer", "minimum": 1, "maximum": 100, "default": 20}},
+                    {"name": "before_revision", "in": "query", "schema": {"type": "integer", "minimum": 1, "maximum": _AGENT_POOL_INTEGER_MAX}},
+                ],
+                "responses": {
+                    "200": {"description": "Descending revisions; changed_at is Unix seconds, actor_id is an opaque digest or null",
+                            "content": {"application/json": {"schema": {
+                                "type": "object", "additionalProperties": False,
+                                "required": ["items", "next_before_revision", "history_available"],
+                                "properties": {
+                                    "history_available": {"type": "boolean"},
+                                    "next_before_revision": {"type": ["integer", "null"], "minimum": 1},
+                                    "items": {"type": "array", "maxItems": 100, "items": {
+                                        "type": "object", "additionalProperties": False,
+                                        "required": ["revision", "previous_seconds", "configured_seconds", "changed_at", "actor_id", "restored_from_revision"],
+                                        "properties": {
+                                            "revision": {"type": "integer", "minimum": 1},
+                                            "previous_seconds": {"type": ["number", "null"]},
+                                            "configured_seconds": {"type": ["number", "null"]},
+                                            "changed_at": {"type": "number"},
+                                            "actor_id": {"type": ["string", "null"]},
+                                            "restored_from_revision": {"type": ["integer", "null"], "minimum": 1},
+                                        },
+                                    }},
+                                },
+                            }}}},
+                    "400": {"description": "Invalid page size or revision cursor"},
+                    "401": {"description": "Administrator authentication required"},
+                    "404": {"description": "Model configuration not found"},
+                },
+            },
+        },
+        "/api/v1/agent_pools/{agent_pool_id}/worker_agents/{worker_agent_id}/timeout_policy": {
+            "get": {
+                "operationId": "get_model_timeout_policy",
+                "summary": "Read configured timeout and whether serving applies that model wait",
+                "security": [{"admin_bearer_auth": []}],
+                "parameters": [
+                    {"name": name, "in": "path", "required": True, "schema": {"type": "string"}}
+                    for name in ("agent_pool_id", "worker_agent_id")
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Stored policy and local snapshot; serving applies the selected model wait",
+                        "content": {"application/json": {"schema": {
+                            "type": "object", "additionalProperties": False,
+                            "required": ["configured_seconds", "revision", "unit",
+                                         "serving_snapshot_seconds", "serving_snapshot_revision",
+                                         "enforcement_available"],
+                            "properties": {
+                                "configured_seconds": {"type": ["number", "null"], "exclusiveMinimum": 0},
+                                "revision": {"type": "integer", "minimum": 0},
+                                "unit": {"const": "seconds"},
+                                "serving_snapshot_seconds": {"type": ["number", "null"], "exclusiveMinimum": 0},
+                                "serving_snapshot_revision": {"type": "integer", "minimum": 0},
+                                "enforcement_available": {"const": True},
+                            },
+                        }}},
+                    },
+                    "401": {"description": "Authentication required"},
+                    "403": {"description": "Administrator scope required"},
+                    "404": {"description": "Model configuration not found"},
+                },
+            },
+        },
         "/api/v1/agent_pools/{agent_pool_id}/worker_agents/{worker_agent_id}": {
             "patch": {
                 "operationId": "patch_worker_agent",
@@ -523,6 +595,12 @@
                                         ]
                                     },
                                     "stream_usage_supported": {"type": "boolean"},
+                                    "model_timeout_seconds": {
+                                        "anyOf": [
+                                            {"type": "number", "exclusiveMinimum": 0},
+                                            {"type": "null"},
+                                        ]
+                                    },
                                 },
                             },
                         },

@@ -1111,8 +1111,8 @@ def _publish_terminal(
                 self._errors[job_id] = error
             self._states[job_id] = status
 
-    def wait(self, job: BatchJob, *, timeout: float) -> Dict[str, Any]:
-        """Wait within the caller's explicit deadline for a terminal state."""
+    def wait(self, job: BatchJob, *, timeout: float | None) -> Dict[str, Any]:
+        """Wait for a terminal state, bounded only when the caller sets a deadline."""
         event = self._terminal_events.get(job.job_id)
         if event is not None:
             event.wait(timeout=timeout)

@@ -59,6 +59,7 @@
 _DEFAULT_EMBEDDING_MAX_TOKENS_PER_REQUEST = 280_000
 _DEFAULT_EMBEDDING_MAX_CHARS_PER_PART = 240_000
 _DEFAULT_EMBEDDING_MAX_INPUTS_PER_REQUEST = 1
+_DEFAULT_PROVIDER_EMBEDDING_CLAIM_LEASE_SECONDS = 30.0
 _BATCH_LEDGER_SETTLEMENT_TIMEOUT_SECONDS = 1.0
 _EMBEDDING_UNIT_RE = re.compile(r"\S+\s*|\s+", re.UNICODE)
 
@@ -232,15 +233,22 @@ def _run_embedding_shard(
 
     def _provider_embedding_backend(self) -> ProviderEmbeddingBatchBackend:
         client = getattr(self.orchestrator, "client", None)
-        client_timeout = float(getattr(client, "timeout", 0))
+        configured_timeout = getattr(client, "timeout", None)
+        client_timeout = (
+            float(configured_timeout) if configured_timeout is not None else 0.0
+        )
         return ProviderEmbeddingBatchBackend(
             self._run_provider_embeddings,
             job_registry=self.job_registry,
             max_concurrency=getattr(client, "local_concurrency", 1),
             claim_lease_seconds=(
                 client_timeout
                 if self.job_registry.durable and client_timeout > 0
-                else None
+                else (
+                    _DEFAULT_PROVIDER_EMBEDDING_CLAIM_LEASE_SECONDS
+                    if self.job_registry.durable
+                    else None
+                )
             ),
             execution_timeout_seconds=client_timeout if client_timeout > 0 else None,
         )
@@ -1834,9 +1842,9 @@ def complete_embeddings_batch(
     ) -> Dict[str, Any]:
         """Submit an embeddings batch and return its document (one round-trip).
 
-        Local backends complete immediately. Callers that require a synchronous
-        provider result pass ``wait_timeout``; a timed-out queued job is
-        cancelled so the synchronous surface does not leave orphaned work.
+        Local backends complete immediately. ``wait_timeout=None`` waits without
+        an application deadline; a timed-out queued job is cancelled only when
+        the caller supplied a finite deadline.
         """
         job = self.submit_embeddings_batch(
             inputs,
@@ -1848,9 +1856,13 @@ def complete_embeddings_batch(
             owner_id=owner_id,
         )
         backend = self._embedding_backend_for(job)
-        if wait_timeout is not None and hasattr(backend, "wait"):
+        if hasattr(backend, "wait"):
             status = backend.wait(job, timeout=wait_timeout)
-            if not status.get("is_complete") and hasattr(backend, "cancel"):
+            if (
+                wait_timeout is not None
+                and not status.get("is_complete")
+                and hasattr(backend, "cancel")
+            ):
                 backend.cancel(job, reason="synchronous request deadline elapsed")
         return self.embeddings_batch_document(job.job_id, owner_id=owner_id)
 

@@ -79,7 +79,7 @@ def race_first_valid(
     attempts: list[EndpointAttempt[T]],
     *,
     validate: Callable[[T], bool],
-    deadline_seconds: float,
+    deadline_seconds: float | None,
     max_concurrency: int,
     on_attempt_complete: Callable[[str, T | None, BaseException | None], None] | None = None,
 ) -> RaceOutcome[T]:
@@ -94,7 +94,7 @@ def race_first_valid(
         raise ValueError("immediate_race requires concurrency capacity of at least two")
     if max_concurrency < len(attempts):
         raise ValueError("immediate_race capacity must cover every declared endpoint")
-    if deadline_seconds <= 0:
+    if deadline_seconds is not None and deadline_seconds <= 0:
         raise ValueError("deadline_seconds must be positive")
     contract = attempts[0].contract
     if any(attempt.contract != contract for attempt in attempts[1:]):
@@ -128,8 +128,12 @@ def execute(attempt: EndpointAttempt[T]) -> T:
     last_error: BaseException | None = None
     try:
         while pending:
-            remaining = deadline_seconds - (time.monotonic() - started)
-            if remaining <= 0:
+            remaining = (
+                None
+                if deadline_seconds is None
+                else deadline_seconds - (time.monotonic() - started)
+            )
+            if remaining is not None and remaining <= 0:
                 raise TimeoutError("equivalent endpoint race exceeded its deadline")
             done, pending = wait(pending, timeout=remaining, return_when=FIRST_COMPLETED)
             if not done: