Skip to content

fix(queue): absorb item-lifecycle and throttle stalls without spending review-failure budget - #968

Merged
steipete merged 1 commit into
mainfrom
fix/lifecycle-throttle-reservations
Jul 30, 2026
Merged

fix(queue): absorb item-lifecycle and throttle stalls without spending review-failure budget#968
steipete merged 1 commit into
mainfrom
fix/lifecycle-throttle-reservations

Conversation

@steipete

Copy link
Copy Markdown
Contributor

Problem

After #966, two failure classes remained in the review lane (38 failures in the 16:13–17:13Z hour):

  1. Cannot reserve a review lease for #N: state is closed. — the item closed between enqueue and review (now common again since the apply lane resumed closing). The stale entry failed as codex_or_content_failure and burned review-failure budget (sample runs 30564729361, 30563527242).
  2. gh: API rate limit exceeded for installation ID 122230863 (HTTP 403) — the resumed apply + comment-sync lanes plus ~400 reviews/hour saturated the shared App installation token; reservations retried ~13 minutes in-process, then failed the run (sample runs 30562882522, 30562788053).

Fix

  • reserve-review-lease completes closed/locked items as {"status":"superseded","reason":"item_not_open"} — the workflow already maps superseded reservations to successful no-op completions.
  • The reservation step in sweep.yml converts rate-limit stderr (rate limit exceeded|secondary rate limit|HTTP 429) into {"status":"held","retryAt":"+20min"} so the durable queue redelivers after the window instead of counting a failure.
  • Feed rate trimmed 600/h → 450/h in dashboard/wrangler.toml (with rationale comment): at ~30 API calls/review, 450/h leaves the write lanes headroom inside the installation allowance. Requires a Worker redeploy after merge.

Proof

  • Closed-item regression test (fake gh): red on pre-fix code (command exits 1), green with the fix; asserts superseded JSON and no lease comment.
  • Workflow-shape assertions for the throttle-held branch.
  • Suites: command 14/14, sweep-workflow 80/80, dashboard-worker 259/259.
  • Autoreview (codex, xhigh): clean, "patch is correct (0.98)".

@steipete
steipete requested a review from a team as a code owner July 30, 2026 17:20
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Jul 30, 2026
@clawsweeper

clawsweeper Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 30, 2026, 1:24 PM ET / 17:24 UTC.

ClawSweeper review

What this changes

The PR makes exact-review reservations treat closed items as superseded no-ops, defer GitHub-throttled reservations for retry, and lowers the exact-review feed rate from 600 to 450 per hour.

Merge readiness

Blocked until real behavior proof from a real setup is added - 5 items remain

Keep this PR open: it addresses a concrete review-queue reliability problem and current main only contains the adjacent head-drift handling from #966. The queue and workflow changes look directionally sound, but the release-owned CHANGELOG.md edit must be removed and the PR still needs redacted after-fix operational proof before merge.

Priority: P2
Reviewed head: 1e4df4ba6e56bde6a4665ba0bb4a0111eea7a53a

Review scores

Measure Result What it means
Overall readiness 🦪 silver shellfish (2/6) The repair is focused and has targeted test coverage, but it has a correctable policy defect and lacks real operational proof for the altered retry behavior.
Proof confidence 🦪 silver shellfish (2/6) Needs real behavior proof before merge: The PR body reports unit and workflow-shape tests, but it does not provide an after-fix run from a real queue or GitHub-throttling setup; add a redacted live workflow/queue trace and redact tokens, endpoints, IP addresses, and other private operational data. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🦐 gold shrimp (3/6) 1 actionable review finding remain.

Verification

Check Result Evidence
Real behavior Needs proof Needs real behavior proof before merge: The PR body reports unit and workflow-shape tests, but it does not provide an after-fix run from a real queue or GitHub-throttling setup; add a redacted live workflow/queue trace and redact tokens, endpoints, IP addresses, and other private operational data. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 6 items Adjacent current-main behavior: Current main includes the merged adjacent fix for exact-review head drift as a superseded no-op, but this PR covers distinct item-closure and throttling paths.
Proposed lifecycle handling: The branch changes a non-open item from a thrown lease-reservation error into structured superseded output, preventing stale queued work from consuming failure budget.
Proposed throttle deferral: The workflow recognizes rate-limit diagnostics and emits a held reservation with a 20-minute retry timestamp instead of returning a failed reservation attempt.
Findings 1 actionable finding [P2] Remove release-owned changelog edits
Security None None.

How this fits together

ClawSweeper’s exact-review queue reserves a lease before Codex reviews an item and publishes the result. The reservation command and sweep workflow classify item lifecycle changes and GitHub API responses so the durable queue can either continue, skip stale work, or retry later without consuming review-failure budget.

flowchart LR
  A[Exact-review queue] --> B[Reserve lease]
  B --> C{Item and GitHub state}
  C -->|Item no longer open| D[Superseded no-op]
  C -->|GitHub throttled| E[Held retry]
  C -->|Lease granted| F[Codex review]
  D --> G[Successful queue completion]
  E --> H[Durable redelivery]
  F --> I[Publish review result]
Loading

Before merge

  • Add real behavior proof - Needs real behavior proof before merge: The PR body reports unit and workflow-shape tests, but it does not provide an after-fix run from a real queue or GitHub-throttling setup; add a redacted live workflow/queue trace and redact tokens, endpoints, IP addresses, and other private operational data. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
  • Remove release-owned changelog edits (P2) - The repository policy reserves CHANGELOG.md for release work and explicitly says normal contributor PRs should keep release-note context in the PR body and commit message instead. Remove these two entries; they otherwise create release-note churn outside the release process.
  • Resolve merge risk (P1) - Merging changes the sweep workflow’s classification of GitHub API failures; the held path needs a redacted live queue trace showing that it redelivers rather than being recorded as a successful terminal completion.
  • Resolve merge risk (P1) - The 450/hour rate is an operational throughput reduction that requires the stated Worker redeploy and should be observed after rollout to confirm it leaves enough token headroom without starving backlog processing.
  • Complete next step (P2) - A narrow automated repair can remove the release-owned changelog edit, while real operational proof remains contributor-owned before merge.

Findings

  • [P2] Remove release-owned changelog edits — CHANGELOG.md:21-22
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Changed surface 7 files: 103 added, 7 removed The PR changes command behavior, workflow control flow, production dispatch configuration, tests, and release notes.
Operational rate 600/h to 450/h This lowers exact-review throughput by 25% to reserve shared GitHub App token capacity for apply and comment-sync lanes.

Root-cause cluster

Relationship: canonical
Canonical: #968
Summary: This PR is the canonical active work for closed-item lifecycle races and GitHub throttling during exact-review reservation; the merged head-drift fix is closely related but covers a different source of stale queue work.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

  1. Prove and preserve the queue retry contract (recommended)
    Remove the release-owned changelog edit and add a redacted after-fix trace showing that a throttled reservation is held for durable redelivery rather than counted as a terminal success or review failure.
  2. Pause the rate change
    Land only the lifecycle no-op handling and defer the throughput reduction if maintainers do not want to make a production capacity tradeoff without post-deploy observation.

Technical review

Best possible solution:

Remove the release-owned changelog entries, retain the narrow command and workflow regression coverage, and add redacted live evidence that closed items complete as superseded while a throttled reservation becomes a durable held retry after the Worker redeploy.

Do we have a high-confidence way to reproduce the issue?

Yes in source terms: the supplied failure modes map directly to the reservation command’s non-open-item error path and the workflow’s reservation failure path. The PR also adds focused fake-gh and workflow-shape coverage, although a live operational reproduction was not included.

Is this the best way to solve the issue?

Mostly yes: structured superseded output for stale closed items and a held retry for throttling are narrower than charging these ordinary queue conditions to review-failure budget. The release-owned changelog edit is not part of the correct solution and should be removed.

Full review comments:

  • [P2] Remove release-owned changelog edits — CHANGELOG.md:21-22
    The repository policy reserves CHANGELOG.md for release work and explicitly says normal contributor PRs should keep release-note context in the PR body and commit message instead. Remove these two entries; they otherwise create release-note churn outside the release process.
    Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3dc70e67f287.

Labels

Label changes:

  • add P2: The PR repairs recurring exact-review queue failures and throttling with a bounded but meaningful operational impact.
  • add merge-risk: 🚨 automation: The changed workflow determines whether exact-review reservations are retried, skipped, or charged against failure handling.
  • add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body reports unit and workflow-shape tests, but it does not provide an after-fix run from a real queue or GitHub-throttling setup; add a redacted live workflow/queue trace and redact tokens, endpoints, IP addresses, and other private operational data. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

  • P2: The PR repairs recurring exact-review queue failures and throttling with a bounded but meaningful operational impact.
  • merge-risk: 🚨 automation: The changed workflow determines whether exact-review reservations are retried, skipped, or charged against failure handling.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body reports unit and workflow-shape tests, but it does not provide an after-fix run from a real queue or GitHub-throttling setup; add a redacted live workflow/queue trace and redact tokens, endpoints, IP addresses, and other private operational data. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Acceptance criteria:

  • [P1] git diff --check.
  • [P1] pnpm run test:unit -- test/command.test.ts.
  • [P1] pnpm run test:unit -- test/sweep-workflow.test.ts.
  • [P1] pnpm run test:unit -- test/dashboard-worker.test.ts.

What I checked:

  • Adjacent current-main behavior: Current main includes the merged adjacent fix for exact-review head drift as a superseded no-op, but this PR covers distinct item-closure and throttling paths. (src/clawsweeper.ts:22924, 3dc70e67f287)
  • Proposed lifecycle handling: The branch changes a non-open item from a thrown lease-reservation error into structured superseded output, preventing stale queued work from consuming failure budget. (src/clawsweeper.ts:22924, 1e4df4ba6e56)
  • Proposed throttle deferral: The workflow recognizes rate-limit diagnostics and emits a held reservation with a 20-minute retry timestamp instead of returning a failed reservation attempt. (.github/workflows/sweep.yml:963, 1e4df4ba6e56)
  • Focused regression coverage: The branch adds a fake-gh command regression test for a closed item and workflow-shape assertions for the held-throttle branch. (test/command.test.ts:276, 1e4df4ba6e56)
  • Release-note policy conflict: The PR modifies the release-owned changelog despite repository policy reserving normal changelog updates for releases rather than contributor PRs. (CHANGELOG.md:21, 1e4df4ba6e56)
  • Feature-history provenance: The same exact-review superseded-completion area appears to have been recently carried into current main by the merged adjacent change, providing the strongest available ownership signal for this path. (src/clawsweeper.ts:22924, 3dc70e67f287)

Likely related people:

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Remove the CHANGELOG.md entries and keep release-note context in the PR body or commit message.
  • Add redacted after-fix evidence that shows a closed-item superseded completion and a throttled reservation held for durable redelivery.
  • After the PR body changes, obtain a fresh ClawSweeper review if one is not triggered automatically.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@steipete
steipete merged commit b4d1ede into main Jul 30, 2026
17 checks passed
@steipete
steipete deleted the fix/lifecycle-throttle-reservations branch July 30, 2026 17:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. P2 Normal priority bug or improvement with limited blast radius. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant