proxy: allow sibling failover for BYOK gateway turns via held gateway keys

[devin-ai-integration]

Summary

BYOK disables all failover (shouldFailover): a foreign provider would 401 on the customer's credentials. In the Snowflake POC's grok run this meant every gateway status=0 timeout that survived same-binding retries killed the session — 189 failed calls, 41 sessions ended on an error row, 30/97 tasks lost at least one session — even though the same installation held a second gateway key (anthropic_gateway/opus) that could have served the turn.

This carves out the one BYOK case where failover is credential-safe: rescuing onto a sibling model reachable through a gateway key the request itself holds.

• siblingFailoverDecision now branches for gateway-exclusive requests (gatewayProvidersForRequest(ctx) non-empty) into gatewaySiblingDecision: walks the same CandidateModels/PairedModel order and context-fit checks, but resolves each candidate against the request's own gateway aliases instead of deployment-keyed providers:

provider, ok := gatewayProviderFor(id, s.customBindingsForRequest(ctx), gw) // alias-declared AND key held

Off-failed-provider candidates still rank first (grok on openai_gateway → opus via anthropic_gateway), same-gateway aliases second; anything not aliased by a held gateway key is never a candidate, so direct-vendor bindings stay unreachable.

• The siblingViable gate in ProxyMessages loosens from s.shouldFailover(ctx) to:

(s.shouldFailover(ctx) || s.gatewaySiblingAllowed(ctx, siblingDecision))

where gatewaySiblingAllowed requires the chosen sibling's provider to be one of the request's held gateway keys. Baseline and subscription failover are untouched; the rescue-chain ordering, prelude-buffer/commit semantics, and credential re-resolution (resolveAndInjectCredentials picks the same BYOK gateway key) are unchanged.

Tests: gateway rescue via the other held gateway key, no rescue onto a deployment-keyed vendor binding the gateway doesn't alias, and same-gateway alias rescue. internal/proxy tests, go vet, wv router tc, wv router t all pass.

Follow-up to #1101 (gateway session affinity) from the same incident; independent change, no dependency between the two.

Link to Devin session: https://app.devin.ai/sessions/85739dd5156f4ffd9b4ce1941cd91e13
Open in Devin Desktop: https://app.devin.ai/desktop/session/85739dd5156f4ffd9b4ce1941cd91e13?variant=devin
Requested by: @steventohme

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

PR author is not in the allowed authors list.

[claude]

Claude finished @devin-ai-integration[bot]'s task —— View job

---

Comment-length lint

• Run diff and analyze added comment blocks
• Post review with suggestions for verbose comment blocks

Posted 3 committable suggestions on comment-length nits (advisory only):

1. service.go 3559–3562 — 4-line BYOK gateway credential WHY condensed to 3 lines
2. sibling_failover.go 61–68 — 8-line gatewaySiblingDecision godoc condensed to 5 lines (filler and restatement removed)
3. sibling_failover.go 101–103 — 3-line gatewaySiblingAllowed godoc condensed to 2 lines

[workweave-bot]

Advisory only — comment-length nits. Won't block merge.

[claude]

Claude finished @devin-ai-integration[bot]'s task —— View job

---

Comment-length lint

• Run diff and analyze added comment blocks
• Post review with suggestions or exit silently

No comment blocks warrant flagging — all added blocks are already at or below the ~5-line threshold and explain genuinely non-obvious WHY (credential-reuse invariant, 401 reasoning, ranking preference). Nothing to post.

View job