feat(loop): classify failures + retry transient ones with backoff

[mabry1985]

What

The first P0 resilience port from protoMaker. A coder/infra failure used to mean Blocked (or, with a ladder, a model-tier climb) — but a rate limit or a transient git/network error isn't the feature's fault, and a stronger model won't clear it. It should be retried with backoff.

New failures.py — a small ordered regex table (a lean distillation of protoMaker's failure-classifier-service.ts) returning a retry Policy: category, retryable, base_delay_s, max_attempts. Pure + deterministic.

loop._drive, on a NoChangesError/WorktreeError, now:

1. transient (rate_limit / network / merge_conflict) → back off and retry the same tier (a fresh worktree off the latest base also clears a conflict), up to the policy's attempt cap;
2. capability failure (no diff / dispatch error) + a ladder → climb a model tier (fresh retry budget);
3. terminal (auth / unknown) or retries exhausted → Blocked, tagged with the category.

A rate limit no longer burns a stronger model or permanently blocks a feature; a flaky push retries instead of blocking.

Tests

+20 (92 total), all green: test_failures.py (every category, first-match-wins ordering, terminal fallback) + loop retry-then-succeed, exhaust-then-block, terminal-immediate-block (with asyncio.sleep stubbed — no real backoff waits). ruff clean.

Next in the P0 batch

• a stuck/stall watchdog on running drives
• crash recovery on boot (resume/reset stranded in_progress features)

🤖 Generated with Claude Code

[protoquinn]

👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow.

[protoquinn]

QA Audit — PR #7 | feat(loop): classify failures + retry transient ones with backoff

VERDICT: WARN (non-blocking — CI still queued; formal PASS/FAIL on re-dispatch)

---

CI Status

• test: ⏳ queued

Diff Review

• New failures.py (63 lines): ordered regex table mapping error messages → Policy dataclass. Pure, deterministic, trivially testable. Pattern ordering (rate_limit → transient → merge_conflict → auth → terminal) is correct.
• loop.py (~30 line delta): _drive now classifies NoChangesError/WorktreeError before acting. Transient infra errors (rate-limit, network, merge-conflict) retry same tier with backoff; capability failures still climb the ladder; exhausted/terminal blocks with category tag.
• retries < policy.max_attempts - 1 gate is correct for the docstring contract ("total dispatch attempts"): rate_limit gets 5 total, transient 3, merge_conflict 2.
• tests/test_failures.py (61 lines, new): exhaustive parametrized coverage of every category, unknown fallback, empty input, first-match-wins ordering, and retry budget assertions.
• tests/test_loop.py (truncated in diff): stubbed asyncio.sleep for retry-then-succeed, exhaust-then-block, terminal-immediate-block scenarios.

Observations

• LOW: clawpatch structural review unavailable — repo not in project registry. Manual diff review completed; no structural concerns identified.
• LOW: transient rule includes bare unavailable pattern — could match non-infra messages like "model unavailable." Mitigated by first-match ordering (rate_limit patterns fire first for capacity messages). Consider tightening to service unavailable or anchoring with \b.
• LOW: merge_conflict rule uses bare conflict — broad match. In the loop context, errors come from git/gh operations, so false positives are unlikely. Worth monitoring.

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on #7.