# Provider guide
Owns provider construction, request formats, HTTP transport, catalogs, and stream parsing.
## Where to look
| Validate selection and construct providers | `factory.rs` |
| Conversation and request types | `request.rs` |
| Codex and compatible endpoints | `openai/codex.rs`, `openai/compatible.rs` |
| Live Codex quota for `/usage` | `codex_usage.rs` |
| Bodies, headers, model discovery | `openai/bodies.rs`, `openai/headers.rs`, `openai/catalog.rs` |
| Anthropic Messages and parser | `anthropic.rs`, `anthropic/stream.rs` |
| Attempts, cancellation, semantic timeout | `openai_stream.rs` |
| Blocking HTTP and byte-idle watchdog | `transport.rs` |
| SSE framing and diagnostics | `sse.rs` |
| Chat/Responses event assembly | `stream/mod.rs`, `stream/chat_completions.rs`, `stream/openai_responses.rs` |
| Inline calls and reasoning summaries | `stream/inline_tools.rs`, `stream/reasoning.rs` |
## Local rules
- Preparation selects the provider; the factory validates/builds it. The shared `Provider` trait lives in `openai/mod.rs` despite the family-specific location.
- Keep provider-family auth headers separate, and Chat Completions/Responses body builders distinct.
- `openai/codex/web_search.rs` uses the existing Codex transport/auth-refresh path. Bound raw SSE, require `response.completed`, preserve citations and label synthesis separately from page content. Do not add an experimental search endpoint or Exa fallback.
- Codex replay sanitization in `openai/bodies.rs` replaces null role-item content with a space, removes role-item `tool_calls`, and strips `id`/`status` from reasoning/function-call items. Retain function calls and outputs, including call identity.
- Preparation gates primary reasoning updates. `ProviderConversationItem::ReasoningSelection` is local durable metadata; projection emits eligible ordered `configuration_update` items and preserves original effort. Body builders omit unprojected selections.
- Fast service-tier metadata alone is not semantic progress. Preserve call ids, partial arguments, response-item order and terminal events; bound SSE-event and argument buffers. Retry decisions belong above parsers.
- Distinguish byte-idle transport failures from semantic-progress failures; use configured request timeouts rather than one assumed timeout for all workloads.
- Redact catalog/wire diagnostics. Terminal streaming-redaction boundaries belong to output renderers, not parsers.
- Quota reads use stored Codex OAuth, bounded direct HTTP and one refresh on 401. Never substitute cached quota after failure.
## Verification landmarks
Request/auth/replay tests live in `openai/tests.rs` and `tests.rs`; parser tests also live inline and in `anthropic/stream/tests.rs`.