[alex-mextner]

Why

Claude 5.5 is already integrated, but the default provider order tries z.ai first. Custom chains can also put HF ahead of preferred providers. This change applies the owner's intended priority and removes the remaining obsolete provider references.

The October 10–11 Claude 5.5 migration predates Anthropic's three reported November 8 requests. The available evidence does not identify HyperCalendarBot as their source.

Changes

• Prefer selected, configured Claude in smart, fast and role chains. Other preferred providers retain their relative order; HF stays last across role and legacy fallback slots.
• Preserve an explicit non-HF role override before legacy fallback. Legacy Claude must not displace its qualified preset or erase role/preset usage accounting. A regression found during review was reproduced and fixed.
• Preserve credential rotation, preset qualification, circuit breakers, deadlines, failure telemetry, visible output limits and provider-specific API settings.
• Remove remaining Gemini references from active source, scripts and fixtures. Historical usage rows remain readable through generic provider handling; no database content is changed.
• Refresh the optional DeepSeek preset to deepseek/deepseek-v4.1-flash-1017 and HF configuration to meta-llama/Llama-4-Scout-17B-16E-Instruct:deepinfra. Preserve explicit HF provider pins during discovery.
• Log the effective explicit provider order once and document the Claude-first/HF-last policy.

Verification

Current PR head: be02f1eb6157a667059aab45e771b1f4ee458485 (service version 0.3.8).

The normal ship gate required a release-version bump. The current commit changes only the two root service-version lines in pyproject.toml and uv.lock from 0.3.7 to 0.3.8; parsed TOML comparison proves dependency graphs are unchanged, and uv lock --check --offline passed. A genuine three-role staged review (0cebc7db84587e75) found no issues in this metadata patch and created its matching stamp. The normal commit hook passed. The unused source-hatch card was withdrawn by the agent; no owner denial or waiver is claimed.

• The supplemental runtime candidate passed 142 targeted tests across role routing, role usage accounting, failover, model exclusion/priority and configuration. Three regression assertions first failed on the faulty role/legacy ordering and passed after the fix. Coverage includes HF remaining last with its role metadata and z.ai retaining the caller's token limit after Claude fails.
• Full Biome validation passed for 1,189 files, with clean staged rig lint and whitespace checks. TypeScript passed through the supported home offload using system Bun 1.4.2, frozen dependencies and TypeScript 5.9.3. After that, only two text replacements clarified the HF exception and made the log message neutral; lint was rerun.
• Parent runtime head 438dced2: PR CI 43382629451 passed: 9,607 tests, 0 failures across 564 files, Biome for 1,189 files, and TypeScript. Stage build 43382629549 also passed. Fresh trusted Stage QA 43382992512 passed six cases; the origin/main gate verified its exact 438dced head and returned 0. These receipts remain evidence for that parent only and do not replace the current metadata head’s gates.
• Current-head PR CI 43390370809 passed 9,607 tests with 0 failures across 564 files, Biome for 1,189 files and TypeScript; Stage build 43390370721 also passed. Stage QA 43390716752 failed before its first case because the browser host could not write its temporary cases file: OSError [Errno 28] No space left on device. The configured browser state filesystem was independently confirmed to have zero free bytes. Stage application health passed and teardown removed the bot, Redis, network and exact stage image normally. No source assertion ran; zero cases is not a pass. The browser host was recovered through the installed uv cache prune command; it reclaimed only unused tool cache, and the exact state directory passed a write/fsync check with 869 MiB available. A fresh pre-rerun check found 948,428,800 bytes available. The same trusted Stage QA run was restarted with --failed at 08:44 UTC on the unchanged head. Attempt 2 completed successfully with six cases; the fresh trusted origin/main gate returned 0 at 08:59 UTC and verified the exact be02f1eb6157 head, QA job header, report inputs and status. The original failure remains recorded; no stage waiver was used.
• Preparation probes returned HTTP 200 and usable answers for Sonnet 5.5 and Haiku 5.5 with both existing Claude credentials. Those account/model probes are separate from deployed-bot acceptance.
• The final source scan found no Gemini matches in active source, tests, scripts or current configuration guidance.

Review

The original source revision and the two earlier narrow CI repairs have genuine owner-requested source hatch receipts. A full three-role review found the role/legacy regression above. A subsequent real staged review (55f0f49530412fe5, Opus 5.5, correctness/consistency/quality) confirmed the runtime repair with no P1/P2 findings and recorded three P3 observations. Two wording observations were addressed by the two text-only followups. The optional shared HF-order helper refactor was not added to this release. The normal commit hook accepted the commit; the genuine review stamp was not edited manually. The full release review is not claimed findings-free. The later normal gh ship gate independently authorized the merge: one passing iteration across three roles, according to the installed repo-scoped policy. Its actual authority verdict is preserved; no ship hatch was needed or created.

Production rollout completed

The owner approved production rollout on November 13. Normal gh ship merged this PR at 09:08:15 UTC from reviewed/tested head be02f1eb6157a667059aab45e771b1f4ee458485 into 90ee425826f9bd0e194e4f43e0962d6be997d6ee. The native post-merge hook initially returned its documented hosted_pending state; the bound official push/main workflow 43398802092 then completed successfully at 09:40:47 UTC, including the native prebuilt activation step. The shared host activation lock was preserved, and no second deployment was dispatched.

The single owned observer completed successfully at 09:41:06 UTC. Actual container and release receipt both identify the exact merge revision and image sha256:d5d11e81e40df421851df3af1592ad6a7fa25ab3c9f425dfa55195092593b5d9. Docker health was healthy before and after the provider proof. /health returned HTTP 200 ok; /ready returned HTTP 200 ok (unverified), recorded verbatim.

Actual deployed process configuration now selects Claude → ZAI → HF for both smart and fast chains, uses the pinned HF route, and contains zero Gemini environment variables. The approved environment hash matches; both existing Claude credentials are preserved. Private environment backup remains mode 0600 inside its private directory.

The observer invoked the real deployed aiStreamRound paths exactly once as an isolated process using the configured provider circuit state and synthetic prompts. Sonnet 5.5 and Haiku 5.5 each returned the required exact usable response, actual Anthropic HTTP 200, one attempt and zero fallbacks. Actual request records confirm max_tokens=128000, streaming with usage, and no temperature or top_p. These are deployed-code/provider results, not Telegram end-to-end acceptance; the probe sent no Telegram or email messages. HF remains the final reserve; billing changes are outside this release.

Final evidence: production-observer-result-90ee4258.json, production-proof-90ee425826f9-20261113T094057675503Z.json, and the exclusive once-only probe marker. The original Stage ENOSPC failure and native pending receipt remain preserved alongside their actual successful followups.

Refs UB-178

Task: UB-178.