{"record":{"id":"639c8f781dad7b05","repo":"openai/codex","slug":"could-not-resolve-the-luna-model-provider-0","errorCode":null,"errorMessage":"could not resolve the Luna model provider: {0}","messagePattern":"could not resolve the Luna model provider: (.+?)","errorType":"exception","errorClass":"LunaSamplerError","httpStatus":null,"severity":"error","filePath":"codex-rs/ext/guardian-v2/src/async_scorer/sampler.rs","lineNumber":110,"sourceCode":"    /// Optional bounded screenshots accompanying the transcript.\n    pub images: Vec<ContentItem>,\n    /// Opaque parent compaction to reuse only for compatible model configurations.\n    pub parent_compaction: Option<ResponseItem>,\n    /// Current parent model's encrypted-compaction compatibility hash.\n    pub parent_compaction_hash: Option<String>,\n    /// Strict JSON schema constraining the model response.\n    pub output_schema: Value,\n    /// Reasoning budget explicitly selected for this request.\n    pub reasoning_effort: ReasoningEffort,\n    /// Owning turn identifier used for request attribution.\n    pub turn_id: String,\n}\n\n/// Failures returned while connecting or sampling the Luna model.\n#[derive(Debug, Error)]\npub enum LunaSamplerError {\n    /// The thread's provider or scoped credentials could not be resolved.\n    #[error(\"could not resolve the Luna model provider: {0}\")]\n    Provider(#[source] CodexErr),\n    /// The Responses WebSocket could not be opened or streamed.\n    #[error(\"Luna Responses WebSocket failed: {0}\")]\n    Api(#[source] ApiError),\n    /// The provider's WebSocket connect deadline elapsed.\n    #[error(\"Luna Responses WebSocket connection timed out\")]\n    ConnectionTimeout,\n    /// The response did not contain an assistant text value.\n    #[error(\"Luna response did not contain assistant output\")]\n    MissingOutput,\n    /// The response exceeded the bounded output limit.\n    #[error(\"Luna response exceeded the output limit\")]\n    OutputTooLarge,\n    /// A newer classification replaced this request when the pool was full.\n    #[error(\"Luna request was superseded by a newer classification\")]\n    Superseded,\n}\n","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/ext/guardian-v2/src/async_scorer/sampler.rs#L92-L128","documentation":"LunaSampler::open_connection resolves the thread's model provider (api_provider) and scoped credentials (api_auth_for_scope) before dialing the Responses WebSocket; either failing wraps the CodexErr as Provider. Guardian-v2's classifier model has no usable provider/auth for this thread. The sampler classifies it non-retryable, so it will not recover on its own.","triggerScenarios":"Starting LunaSampler::connect or leasing a connection when auth is missing/expired, the provider's env_key API key variable is unset, the model_provider entry is invalid, or agent-identity auth cannot be scoped for the session source.","commonSituations":"CI or container runs without credentials; login tokens expired; provider config renamed the env var; agent-identity policy selected for a session source with no fallback.","solutions":["Inspect the nested CodexErr source — it names the exact provider/auth failure.","Re-authenticate (login flow) or export the provider's env_key API key.","Verify the model_providers entry resolves base_url, env_key, and wire_api correctly for the thread.","For agent-identity setups, confirm the session source permits AgentIdentitySessionFallback or provision credentials."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before constructing the sampler, fail fast when credentials cannot resolve\nif sampler_config.provider.auth().await.is_none() {\n    return Err(anyhow::anyhow!(\"no auth for the Luna provider; log in or set the provider env key\"));\n}","typeGuard":null,"tryCatchPattern":"match result {\n    Err(LunaSamplerError::Provider(codex_err)) => {\n        tracing::error!(error = %codex_err, \"guardian classifier disabled: provider/auth unresolvable\");\n        Classification::none()\n    }\n    r => r?,\n}","preventionTips":["Provision credentials (login or env_key) in every environment that enables guardian-v2.","Log the nested CodexErr — it distinguishes missing auth from a bad provider config.","Treat Provider as permanent for the session; do not retry-loop it."],"tags":["rust","auth","model-provider","guardian","codex"],"backgroundTag":"model-provider-auth-failed","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}