The chain

chain is a list, tried left to right: the first source that answers serves the bytes.

'chain' => ['anu_public', 'anu_quantum', 'random_org', 'system'],

A literal list and not a comma-separated environment variable. Lists belong in the config file, and parsing one out of an env string is a trap for a value nobody types twice: a semicolon instead of a comma gives you an invented source name and a runtime error.

A list rather than one source plus a fallback flag, too. A flag is a boolean that secretly names a source: it says yes and the code decides the backup is the CSPRNG. Here the backup is written down, and there can be more than one.

What gets built

The provider folds the list, gives each source its own cooldown and puts one buffer over the whole thing:

Buffer( Fallback( Cooldown(AnuPublicSource),
        Fallback( Cooldown(AnuQuantumSource),
        Fallback( Cooldown(RandomOrgSource), SystemSource ))))

The last entry decides whether a draw can fail

It is the one with nothing underneath it.

Put system there and a draw can never fail. Leave it out and a draw fails loudly when every provider does. Do that where the origin is a guarantee you have made rather than a preference, a public lottery or an audited shuffle, because there an error is more honest than a quiet substitution.

system never fails in practice, so anything listed after it is dead.

Why it is buffered

The arithmetic asks for a byte at a time, and dealing seven cards unbuffered is eight HTTP requests. A kilobyte block makes it one, and the next few hundred draws free. These providers meter calls, not bytes.

'block' => 1024,

Raise it if a provider meters you per request and you draw a lot. Lower it only if you have a reason to want less unused entropy sitting in memory.

Why the buffer goes outside

The order is not a detail.

Inside the chain, the thing that fills the buffer is the thing that can fail, so a provider that is down means the buffer never fills and every scrap of entropy goes back out to the network: seven cards become eight chained timeouts.

Outside, the block is asked for once, the chain settles it whoever is down, and a failed provider is not retried until the block runs out. That is a circuit breaker for free.

Watch the log

Every fall to a lower source is a warning on your default channel.

This matters more than it looks. A fallback nobody watches means believing you run on a quantum generator while the free tier ran out in March. Silence looks exactly like success here, and the whole reason for using a named source is a claim you are making out loud.