feat(summarizer): resilient endpoint chain with local→cloud fallback (ADR-022)

The first friendly-pilot live run produced zero summaries: koala/phi4-mini hit
three silent failure modes — 8k context overflow on long transcripts (HTTP 400),
intermittent malformed JSON (highlights as a bare string), and no fallback wired
at all (summarizer.New(primary, nil)).

Keep phi4-mini as the fast primary and add resilience around it:

- Ordered endpoint chain (summarizer.NewChain): phi4-mini → koala/phi4-14b
  (local) → berget/mistral-small (worst-case external). All reached through the
  one LiteLLM gateway by alias.
- A parse failure now advances the chain like a transport error — the old
  Primary→Fallback shape returned the parse error without trying anyone else.
- Tolerant parse: highlights/takeaways coerce string→[]string, absorbing the
  common small-model quirk without spending a fallback round-trip.
- Transcript truncation (TAPIR_MAX_TRANSCRIPT_CHARS=18000) prevents the overflow
  rather than recovering from it; validated to fit phi4-mini's 8k window.
- Bounded completion budget (TAPIR_SUMMARY_MAX_TOKENS=1500) — the old 8192 budget
  itself contributed to the overflow.

Local-first guarantee preserved by ordering: external endpoint is tried only
after every local one fails. TAPIR_CLOUD_FALLBACK_MODEL="" disables it entirely
for client/NDA deployments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/adapters/summarizer/summarizer.go

@@ -1,17 +1,21 @@
 // Package summarizer implements ports.Summarizer backed by the copied llm
-// package's local-Primary -> BYO-Fallback routing (ADR-004). It is the only
-// place content ever leaves the engine toward an AI model, so it is also the
-// enforcement point for the local-first guarantee in
-// docs/use-cases/ai_routing.feature: a user with no BYO provider configured has
-// their content sent to the local stack and nowhere else.
+// package's routing (ADR-004, extended by ADR-022). It is the only place content
+// ever leaves the engine toward an AI model, so it is also the enforcement point
+// for the local-first guarantee in docs/use-cases/ai_routing.feature: endpoints
+// are tried in order, locals first, so content only reaches an external model
+// after every local endpoint has failed — and never at all when no external
+// endpoint is configured.
 package summarizer
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
+	"unicode/utf8"
 
 	"gitea.d-ma.be/mathias/tapir/internal/domain"
 )
@@ -29,19 +33,41 @@ type Endpoint struct {
 	Model    string // resolved alias, e.g. "iguana/deepseek-r1-14b"
 }
 
-// Summarizer routes a transcript through the local endpoint first, then the
-// optional BYO endpoint. It owns its routing (rather than delegating to
-// llm.Router) so it can record which provider answered and whether the fallback
-// was used — information llm.Router collapses away.
+// Summarizer routes a transcript through an ordered chain of endpoints, trying
+// each in turn until one returns a parseable summary. It owns its routing
+// (rather than delegating to llm.Router) so it can record which provider answered
+// and whether a fallback was used — information llm.Router collapses away. The
+// chain ordering is the local-first guarantee: callers place local endpoints
+// first and any external endpoint last, so content only reaches an external model
+// after every local endpoint has failed.
 type Summarizer struct {
-	primary  Endpoint
-	fallback *Endpoint // nil => no BYO; primary errors are returned, never sent externally
-	now      func() time.Time
+	endpoints     []Endpoint
+	maxInputChars int // transcript truncation budget; 0 = no limit
+	now           func() time.Time
 }
 
-// New constructs a Summarizer. fallback may be nil (no BYO provider configured).
+// New constructs a Summarizer from a primary endpoint and an optional fallback
+// (the historical local-Primary -> BYO-Fallback shape, ADR-004). A nil fallback
+// means a single-endpoint chain: errors are returned, content never leaves it.
 func New(primary Endpoint, fallback *Endpoint) *Summarizer {
-	return &Summarizer{primary: primary, fallback: fallback, now: time.Now}
+	eps := []Endpoint{primary}
+	if fallback != nil {
+		eps = append(eps, *fallback)
+	}
+	return &Summarizer{endpoints: eps, now: time.Now}
+}
+
+// NewChain constructs a Summarizer over an ordered endpoint chain (ADR-022).
+// endpoints are tried in order; the first to return a parseable summary wins, and
+// FallbackUsed is recorded true for any endpoint past the first. maxInputChars
+// bounds the transcript text sent to every endpoint (0 = unbounded), so a long
+// transcript does not overflow a small-context primary model's window. It panics
+// on an empty chain — a wiring bug, not a runtime condition.
+func NewChain(endpoints []Endpoint, maxInputChars int) *Summarizer {
+	if len(endpoints) == 0 {
+		panic("summarizer: NewChain requires at least one endpoint")
+	}
+	return &Summarizer{endpoints: endpoints, maxInputChars: maxInputChars, now: time.Now}
 }
 
 const systemPrompt = `You are Tapir, a video-summarization assistant.
@@ -53,31 +79,35 @@ Respond with ONLY a JSON object, no prose and no code fences:
 - "takeaways": the actionable conclusions a viewer should leave with.
 Output the JSON object and nothing else.`
 
-// Summarize implements ports.Summarizer.
+// Summarize implements ports.Summarizer. It walks the endpoint chain in order:
+// the first endpoint whose reply parses into a non-empty summary wins. An
+// endpoint is considered failed — and the next one tried — when the model call
+// errors OR when its reply cannot be parsed (a 200 with malformed JSON or a
+// highlights field the model emitted as a bare string). Truncation is applied
+// once, up front, so every endpoint sees the same bounded prompt. When the whole
+// chain fails, the joined error is returned so the engine queues the work for
+// retry and delivers no summary.
 func (s *Summarizer) Summarize(ctx context.Context, v domain.Video, t domain.Transcript) (domain.Summary, error) {
 	if !t.HasText() {
 		return domain.Summary{}, fmt.Errorf("summarize: transcript for video %s has no text", v.ID)
 	}
-	user := buildUserPrompt(v, t)
+	user := buildUserPrompt(v, t, s.maxInputChars)
 
-	// Primary = local stack. Only on its failure is anything sent externally,
-	// and only when a BYO fallback is configured.
-	out, err := s.primary.Client.Complete(ctx, systemPrompt, user)
-	if err == nil {
-		return s.build(v, s.primary, false, out)
+	var errs []error
+	for i, ep := range s.endpoints {
+		out, err := ep.Client.Complete(ctx, systemPrompt, user)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s/%s call: %w", ep.Provider, ep.Model, err))
+			continue
+		}
+		sum, perr := s.build(v, ep, i > 0, out)
+		if perr != nil {
+			errs = append(errs, fmt.Errorf("%s/%s output: %w", ep.Provider, ep.Model, perr))
+			continue
+		}
+		return sum, nil
 	}
-
-	if s.fallback == nil {
-		// No BYO: content was sent to the local stack only. Surface the error so
-		// the engine can queue the work for retry; deliver no summary.
-		return domain.Summary{}, fmt.Errorf("summarize: local AI failed and no BYO provider configured: %w", err)
-	}
-
-	out, ferr := s.fallback.Client.Complete(ctx, systemPrompt, user)
-	if ferr != nil {
-		return domain.Summary{}, fmt.Errorf("summarize: local AI failed: %w; BYO %s failed: %v", err, s.fallback.Provider, ferr)
-	}
-	return s.build(v, *s.fallback, true, out)
+	return domain.Summary{}, fmt.Errorf("summarize: all %d endpoint(s) failed: %w", len(s.endpoints), errors.Join(errs...))
 }
 
 func (s *Summarizer) build(v domain.Video, ep Endpoint, fallbackUsed bool, raw string) (domain.Summary, error) {
@@ -89,8 +119,8 @@ func (s *Summarizer) build(v domain.Video, ep Endpoint, fallbackUsed bool, raw s
 		UserID:       v.UserID,
 		VideoID:      v.ID,
 		Summary:      parsed.Summary,
-		Highlights:   parsed.Highlights,
-		Takeaways:    parsed.Takeaways,
+		Highlights:   []string(parsed.Highlights),
+		Takeaways:    []string(parsed.Takeaways),
 		AIProvider:   ep.Provider,
 		AIModel:      ep.Model,
 		FallbackUsed: fallbackUsed,
@@ -98,20 +128,94 @@ func (s *Summarizer) build(v domain.Video, ep Endpoint, fallbackUsed bool, raw s
 	}, nil
 }
 
-func buildUserPrompt(v domain.Video, t domain.Transcript) string {
+func buildUserPrompt(v domain.Video, t domain.Transcript, maxInputChars int) string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "Title: %s\n", v.Title)
 	if v.URL != "" {
 		fmt.Fprintf(&b, "URL: %s\n", v.URL)
 	}
-	fmt.Fprintf(&b, "\nTranscript:\n%s", t.Content)
+	fmt.Fprintf(&b, "\nTranscript:\n%s", truncate(t.Content, maxInputChars))
 	return b.String()
 }
 
+// truncate caps content to max bytes on a UTF-8 rune boundary, appending a
+// marker so the model knows the transcript was cut. A non-positive max (or a
+// content already within budget) returns content unchanged. Bounding the input
+// keeps a long transcript from overflowing a small-context model's window — the
+// production failure mode where koala/phi4-mini's 8k context returned HTTP 400 on
+// a 11.6k-token transcript.
+func truncate(content string, max int) string {
+	if max <= 0 || len(content) <= max {
+		return content
+	}
+	cut := max
+	for cut > 0 && !utf8.RuneStart(content[cut]) {
+		cut--
+	}
+	return content[:cut] + "\n…[transcript truncated to fit the model context]"
+}
+
+// flexStrings is a []string that also unmarshals from a single JSON string or a
+// JSON array of scalars. Small local models (koala/phi4-mini) sometimes emit
+// "highlights": "one point" instead of an array, or mix in a number; rather than
+// fail the whole summary on that quirk, coerce to []string. Empty/whitespace
+// elements are dropped.
+type flexStrings []string
+
+func (f *flexStrings) UnmarshalJSON(b []byte) error {
+	b = bytes.TrimSpace(b)
+	if len(b) == 0 || string(b) == "null" {
+		*f = nil
+		return nil
+	}
+	if b[0] == '[' {
+		var raw []json.RawMessage
+		if err := json.Unmarshal(b, &raw); err != nil {
+			return err
+		}
+		out := make([]string, 0, len(raw))
+		for _, r := range raw {
+			s, err := rawToString(r)
+			if err != nil {
+				return err
+			}
+			if strings.TrimSpace(s) != "" {
+				out = append(out, s)
+			}
+		}
+		*f = out
+		return nil
+	}
+	s, err := rawToString(b)
+	if err != nil {
+		return err
+	}
+	if strings.TrimSpace(s) == "" {
+		*f = nil
+	} else {
+		*f = flexStrings{s}
+	}
+	return nil
+}
+
+// rawToString renders a JSON scalar as text: a quoted string is unquoted; any
+// other scalar (number, bool) is kept as its literal source so no content is lost.
+func rawToString(r json.RawMessage) (string, error) {
+	r = bytes.TrimSpace(r)
+	if len(r) > 0 && r[0] == '"' {
+		var s string
+		if err := json.Unmarshal(r, &s); err != nil {
+			return "", err
+		}
+		return s, nil
+	}
+	return string(r), nil
+}
+
 type parsedSummary struct {
-	Summary    string   `json:"summary"`
-	Highlights []string `json:"highlights"`
-	Takeaways  []string `json:"takeaways"`
+	Summary    string      `json:"summary"`
+	Highlights flexStrings `json:"highlights"`
+	Takeaways  flexStrings `json:"takeaways"`
 }
 
 // parse extracts the JSON object from a model reply. Thinking models (qwen3,

internal/adapters/summarizer/summarizer_test.go

@@ -129,8 +129,8 @@ func TestSummarize_NoBYO_ContentOnlyLocal(t *testing.T) {
 	local := &fakeClient{reply: goodReply}
 	s := New(Endpoint{Client: local, Provider: "local", Model: "iguana/deepseek-r1-14b"}, nil)
 
-	if s.fallback != nil {
-		t.Fatal("no BYO configured but fallback endpoint is non-nil")
+	if len(s.endpoints) != 1 {
+		t.Fatalf("no BYO configured but chain has %d endpoints, want 1", len(s.endpoints))
 	}
 	for i := 0; i < 3; i++ {
 		sum, err := s.Summarize(context.Background(), testVideo(), testTranscript())
@@ -176,3 +176,97 @@ func TestParse_EmptySummaryRejected(t *testing.T) {
 		t.Fatal("want error for empty summary (thinking model returned no content)")
 	}
 }
+
+// parse tolerates a small model emitting "highlights" as a bare string instead
+// of an array — the production koala/phi4-mini quirk that errored with
+// "cannot unmarshal string into Go struct field ... highlights of type []string".
+func TestParse_ToleratesStringHighlights(t *testing.T) {
+	p, err := parse(`{"summary":"s","highlights":"one big point","takeaways":["a","b"]}`)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if len(p.Highlights) != 1 || p.Highlights[0] != "one big point" {
+		t.Errorf("highlights = %v, want [\"one big point\"]", p.Highlights)
+	}
+	if len(p.Takeaways) != 2 {
+		t.Errorf("takeaways = %v, want 2", p.Takeaways)
+	}
+}
+
+// Chain: an endpoint that returns a 200 with unparseable output is treated as a
+// failure, and the next endpoint in the chain is tried. This is the case the old
+// primary->fallback shape missed — a parse error short-circuited instead of
+// falling back.
+func TestSummarize_FallsBackOnMalformedOutput(t *testing.T) {
+	bad := &fakeClient{reply: `{"summary": not json`}
+	good := &fakeClient{reply: goodReply}
+	s := NewChain([]Endpoint{
+		{Client: bad, Provider: "local", Model: "koala/phi4-mini"},
+		{Client: good, Provider: "local", Model: "koala/phi4-14b"},
+	}, 0)
+
+	sum, err := s.Summarize(context.Background(), testVideo(), testTranscript())
+	if err != nil {
+		t.Fatalf("Summarize: %v", err)
+	}
+	if sum.AIModel != "koala/phi4-14b" {
+		t.Errorf("AIModel = %q, want koala/phi4-14b (fell back past malformed primary)", sum.AIModel)
+	}
+	if !sum.FallbackUsed {
+		t.Error("FallbackUsed = false, want true")
+	}
+	if bad.calls != 1 || good.calls != 1 {
+		t.Errorf("calls: bad=%d good=%d, want 1 and 1", bad.calls, good.calls)
+	}
+}
+
+// Chain: when every endpoint fails, no summary is produced and the joined error
+// names each failure so the engine queues the work for retry.
+func TestSummarize_ChainAllEndpointsFail(t *testing.T) {
+	a := &fakeClient{err: errors.New("context overflow")}
+	b := &fakeClient{reply: "not even json"}
+	s := NewChain([]Endpoint{
+		{Client: a, Provider: "local", Model: "m1"},
+		{Client: b, Provider: "berget", Model: "m2"},
+	}, 0)
+
+	if _, err := s.Summarize(context.Background(), testVideo(), testTranscript()); err == nil {
+		t.Fatal("want error when all endpoints fail")
+	}
+	if a.calls != 1 || b.calls != 1 {
+		t.Errorf("calls: a=%d b=%d, want 1 and 1", a.calls, b.calls)
+	}
+}
+
+// A transcript longer than the chain's input budget is truncated before it
+// reaches any model, so a small-context primary does not overflow its window.
+func TestSummarize_TruncatesLongTranscript(t *testing.T) {
+	local := &fakeClient{reply: goodReply}
+	const budget = 100
+	s := NewChain([]Endpoint{{Client: local, Provider: "local", Model: "m"}}, budget)
+
+	long := domain.Transcript{
+		VideoID: "vid-1", UserID: "user-1", Source: domain.SourceCaptions,
+		Content: strings.Repeat("word ", 1000), // 5000 bytes, well over budget
+	}
+	if _, err := s.Summarize(context.Background(), testVideo(), long); err != nil {
+		t.Fatalf("Summarize: %v", err)
+	}
+	// The prompt carries title/URL framing plus the truncation marker, so allow
+	// headroom over the raw transcript budget — but it must be far below 5000.
+	if len(local.lastUser) > budget+300 {
+		t.Errorf("prompt length = %d, want <= %d (transcript not truncated)", len(local.lastUser), budget+300)
+	}
+	if !strings.Contains(local.lastUser, "truncated") {
+		t.Error("truncation marker missing from prompt")
+	}
+}
+
+func TestNewChain_PanicsOnEmptyChain(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("want panic on empty endpoint chain")
+		}
+	}()
+	NewChain(nil, 0)
+}