chore: promote staging to main (2026-03-17 04:34 UTC)

[ironclaw-ci]

Auto-promotion from staging CI

Batch range: 4675e9618c2f35e803c76476197fbb1d85059f43..5c56032b888b436825e150853c88ca3ea4172dbc
Promotion branch: staging-promote/5c56032b-23178585631
Base: main
Triggered by: Staging CI batch at 2026-03-17 04:34 UTC

Commits in this batch (1):

• 5c56032 fix: Rate limiter returns retry after None instead of a duration (fix: Rate limiter returns retry after None instead of a duration #1269)

Current commits in this promotion (2)

Current base: main
Current head: staging-promote/5c56032b-23178585631
Current range: origin/main..origin/staging-promote/5c56032b-23178585631

• 5c56032 fix: Rate limiter returns retry after None instead of a duration (fix: Rate limiter returns retry after None instead of a duration #1269)
• 2784cef fix: relax timing thresholds in policy adversarial tests (100ms -> 500ms) (fix: relax timing thresholds in policy adversarial tests #1294)

Auto-updated by staging promotion metadata workflow

Waiting for gates:

• Tests: pending
• E2E: pending
• Claude Code review: pending (will post comments on this PR)

---

Auto-created by staging-ci workflow

[claude]

Code review

Found 8 issues:

1. [HIGH:75] Unbounded Retry-After duration DoS vulnerability — code accepts any valid u64 from Retry-After header without validation, allowing u64::MAX to freeze application indefinitely in tokio::time::sleep()

ironclaw/src/llm/anthropic_oauth.rs

Lines 150 to 154 in 5c56032

	.and_then(|v| v.to_str().ok())
	.and_then(|v| v.parse::<u64>().ok())
	.map(std::time::Duration::from_secs)
	.or(Some(std::time::Duration::from_secs(60)));

         if !status.is_success() {
             // Parse Retry-After header before consuming the body.
+            // Falls back to 60s if header is missing or unparseable (prevents "retry after None" errors).
             let retry_after = response

2. [HIGH:95] DRY violation — retry-after parsing logic duplicated across 3 modules (anthropic_oauth.rs, nearai_chat.rs, embeddings.rs) with separate test helpers

ironclaw/src/llm/nearai_chat.rs

Lines 2310 to 2331 in 5c56032

	let duration = parse_retry_after_for_test("3600"); // 1 hour
	assert_eq!(duration, Some(std::time::Duration::from_secs(3600)));
	}
	/// Helper function to test Retry-After header parsing logic
	/// (simulates the parsing done in send_request without actual HTTP, including fallback)
	fn parse_retry_after_for_test(header_value: &str) -> Option<std::time::Duration> {
	let trimmed = header_value.trim();
	let parsed = if let Ok(secs) = trimmed.parse::<u64>() {
	Some(std::time::Duration::from_secs(secs))
	} else if let Ok(dt) = chrono::DateTime::parse_from_rfc2822(trimmed) {
	let now = chrono::Utc::now();
	let delta = dt.signed_duration_since(now);
	Some(std::time::Duration::from_secs(
	delta.num_seconds().max(0) as u64
	))
	} else {
	None
	};
	// Apply fallback to 60s if parsing failed (matches actual code behavior)
	parsed.or(Some(std::time::Duration::from_secs(60)))
	}

     /// Helper function to test Retry-After header parsing logic
     /// (simulates the parsing done in send_request without actual HTTP, including fallback)
     fn parse_retry_after_for_test(header_value: &str) -> Option<std::time::Duration> {

3. [MEDIUM:85] Semantic mismatch — nearai_chat.rs test helper supports RFC2822 date parsing but anthropic_oauth.rs and embeddings.rs test helpers don't, creating inconsistent coverage

ironclaw/src/llm/nearai_chat.rs

Lines 2241 to 2265 in 5c56032

	assert!(duration.is_some());
	let d = duration.unwrap();
	// Allow ±5 seconds of drift due to processing time
	assert!(
	d.as_secs() >= 55 && d.as_secs() <= 65,
	"Expected ~60s, got {}s",
	d.as_secs()
	);
	}
	#[test]
	fn test_retry_after_fallback_missing_header() {
	// Regression test: When Retry-After header is missing,
	// should fall back to 60s instead of None
	let duration = parse_retry_after_for_test("");
	assert_eq!(
	duration,
	Some(std::time::Duration::from_secs(60)),
	"Missing header should fallback to 60s"
	);
	}
	#[test]
	fn test_retry_after_fallback_invalid_format() {
	// Regression test: When Retry-After header is in unexpected format,

     #[test]
     fn test_retry_after_parsing_rfc2822_date() {
         // Verify HTTP-date (RFC 2822) format is parsed correctly

4. [MEDIUM:70] Unprotected RFC2822 date parsing in rate-limit hot path — chrono's regex-based RFC2822 parsing is called for every 429 response without size limits or timeout, potential CPU DoS on pathological headers

ironclaw/src/llm/nearai_chat.rs

Lines 256 to 268 in 5c56032

	}
	// Try HTTP-date (e.g. "Mon, 02 Mar 2026 18:00:00 GMT")
	if let Ok(dt) = chrono::DateTime::parse_from_rfc2822(v.trim()) {
	let now = chrono::Utc::now();
	let delta = dt.signed_duration_since(now);
	// Use max(0) so past/present dates yield Duration::ZERO
	// rather than None (which would cause an immediate retry).
	return Some(std::time::Duration::from_secs(
	delta.num_seconds().max(0) as u64
	));
	}
	None
	})

         } else if let Ok(dt) = chrono::DateTime::parse_from_rfc2822(trimmed) {
             let now = chrono::Utc::now();
             let delta = dt.signed_duration_since(now);

5. [MEDIUM:60] Potential integer overflow in duration conversion — nearai_chat.rs line 2314 casts i64 to u64 via max(0) which is safe but semantically subtle

ironclaw/src/llm/nearai_chat.rs

Lines 2313 to 2315 in 5c56032

	/// Helper function to test Retry-After header parsing logic
	/// (simulates the parsing done in send_request without actual HTTP, including fallback)

             let now = chrono::Utc::now();
             let delta = dt.signed_duration_since(now);
             Some(std::time::Duration::from_secs(

6. [LOW:85] Unnecessary eager chrono::Utc::now() call in nearai_chat.rs — chrono::Utc::now() is called before verifying RFC2822 parse succeeds, should be deferred to successful parse block

ironclaw/src/llm/nearai_chat.rs

Lines 259 to 260 in 5c56032

	let now = chrono::Utc::now();
	let delta = dt.signed_duration_since(now);

         let retry_after_header = response
             .headers()

7. [LOW:75] Test code duplication — three nearly identical parse_retry_after_*_for_test() helper functions across modules violates DRY principle

ironclaw/src/llm/retry.rs

Lines 404 to 423 in 5c56032

	fn rate_limited_error_always_has_duration() {
	let err = LlmError::RateLimited {
	provider: "test".to_string(),
	retry_after: Some(std::time::Duration::from_secs(60)),
	};
	if let LlmError::RateLimited { retry_after, .. } = err {
	assert!(
	retry_after.is_some(),
	"Rate limited error should always have retry_after duration"
	);
	assert_eq!(
	retry_after,
	Some(std::time::Duration::from_secs(60)),
	"Fallback should be 60 seconds"
	);
	} else {
	panic!("Expected RateLimited error");
	}
	}

     #[test]
     fn rate_limited_error_always_has_duration() {
         let err = LlmError::RateLimited {

8. [LOW:70] Architectural inconsistency — LlmError::RateLimited field is Option but all creation sites now guarantee Some(), should be Duration (non-optional) per CLAUDE.md type-driven design

ironclaw/src/llm/anthropic_oauth.rs

Lines 150 to 154 in 5c56032

	.and_then(|v| v.to_str().ok())
	.and_then(|v| v.parse::<u64>().ok())
	.map(std::time::Duration::from_secs)
	.or(Some(std::time::Duration::from_secs(60)));

         if !status.is_success() {
             // Parse Retry-After header before consuming the body.
+            // Falls back to 60s if header is missing or unparseable (prevents "retry after None" errors).
             let retry_after = response