mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-16 23:43:10 +00:00
1688cd5b91
Run 01M0DH033P2XSTHAGVBHG6922F completed 2.8 hours of work, then failed terminally because four consecutive publish pushes hit GitHub's token-replication lag (404 "Repository not found") — the push path had no retry, the failure was misclassified as deterministic, and the same fresh-mint-then-push pattern silently disabled metadata snapshots. This generalizes the clone retry machinery to pushes and makes attempt detail durable. - clone_retry -> git_retry: the classifier's boolean becomes a CredentialContext derived from the token snapshot (fresh App tokens retry 404s as replication lag, mature ones as transient infra, static credentials fail fast), and the attempt/backoff limits become a RetryPlan with layered optional bounds. Clone behavior is preserved: Docker keeps its absolute five-minute deadline, Daytona keeps no deadline. - Pushes take a scoped CredentialLease before the first attempt: it owns the embed mutex for the whole operation, pins the single successful resolve, retries only failed resolves, falls back to the last embedded token when a mint fails, and force-re-embeds the pinned token once after the first auth-shaped failure (drift repair). The margin invariant (REFRESH_MARGIN > every push plan's max_elapsed) guarantees the pinned token outlives the operation; a unit test asserts it. - Sandbox::git_push_ref now takes a RetryPlan and returns PushReport / PushError with per-attempt records (classification, redacted output tail, token generation/provenance/age, credential action, refresh errors). Checkpoint pushes use a 90-second budget; the terminal publish push gets 5 attempts over at most 4 minutes. - The single durable git.push event per push gains a nested attempts array (GitPushAttemptProps, token snapshot flattened to flat fields); stored events without it still deserialize. Publish push failures now carry an explicit failure category — exhausted transient retries stay transient_infra instead of deterministic — plus one bounded cause line per attempt and the last successful push time in the message. - Metadata snapshot degradation records why it degraded: push failures with retryable classifications leave the writer eligible to re-probe at each later checkpoint, and a successful snapshot clears the degraded state and re-arms the warning. Permanent failures keep today's latch. Plan: .ai/plans/git-push-token-resilience.md (PR 2: items 1, 2, 4, 7 and the metadata re-probe). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| build-support | ||
| fabro-api | ||
| fabro-auth | ||
| fabro-client | ||
| fabro-config | ||
| fabro-core | ||
| fabro-db | ||
| fabro-dev | ||
| fabro-http | ||
| fabro-macros | ||
| fabro-model | ||
| fabro-oauth | ||
| fabro-options-metadata | ||
| fabro-proc | ||
| fabro-redact | ||
| fabro-static | ||
| fabro-telemetry | ||
| fabro-template | ||
| fabro-test | ||
| fabro-types | ||
| fabro-util | ||
| fabro-vault | ||