Bug: 502 bad gateway for AI provider

[cgbarlow]

[cgbarlow]

Leaving this open — the body contains only a screenshot image I can't read from the CLI. Could you add the key text from the screenshot so I can diagnose? Specifically:

• Exact endpoint URL that returned 502 (e.g. POST /api/ai/ask vs POST /api/ai/sets/{id}/ask)
• Response body or error message text
• Which AI provider was selected / is the default on UAT
• Whether it's reproducible for every AI call or only sometimes

Hypothesis without the screenshot: the backend's except Exception in ask_question catches any provider error (missing API key, unreachable endpoint, invalid model name, rate limit, timeout) and returns 502 with LLM provider error: {exc}. If the UAT deployment has the Anthropic key missing or expired, every AI call would 502 with that shape.

Quick diagnostic steps you can run:

1. Admin → AI Providers → check that a provider is active and the API key is set on UAT Supabase.
2. Admin → AI Providers → click 'Test' on the default provider to see the specific error.
3. Check Render backend logs for LLM provider error in ask_question stack traces — the traceback will show the underlying exception.

[cgbarlow]

Partial fix shipped in v4.1.1 — the underlying 502 is upstream (agentics.org.nz returning 502 Bad Gateway from their edge, not an Iris issue), but the UX around it is now much better:

Cleaner error messages (commit ed4d7d2):
New app/ai/error_mapper.py classifies provider exceptions and returns user-facing messages instead of the raw httpx string. The Test button on the provider page will now say:

"AI provider is temporarily unavailable (upstream returned 502). Try again in a few minutes or switch to a different provider."

…instead of the previous "Server error '502 Bad Gateway' for url 'https://api.agentics.org.nz/v1/chat/completions' For more information check…". The raw URL + httpx dump stays in server logs for ops; users get a clean message. Regression-tested that the URL never leaks to user-facing text.

System notification banner (ADR-124):
Also added from this session — Admin → Settings → System Notification Banner now lets you post a system-wide message that appears as a sticky top strip for every visitor (including anonymous per ADR-123). Use this to tell users an outage is known and being worked on, without needing a deploy.

Leaving this issue open until you've confirmed in UAT that:

1. Clicking Test on the agentics provider now shows the friendly message (not the URL).
2. You can post a banner from /admin/settings.
3. Agentics.org.nz themselves eventually come back up (nothing Iris can do there).

If you want Iris to automatically fail over to a fallback provider when the default is down, I can ship that in a follow-up — would need a second provider configured first.