code-coordinator 0.5.532__tar.gz → 0.5.533__tar.gz

{code_coordinator-0.5.532 → code_coordinator-0.5.533}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.532
+Version: 0.5.533
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.532 → code_coordinator-0.5.533}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.532
+Version: 0.5.533
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

code_coordinator-0.5.533/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.533",
+  "distance": 0,
+  "node": "g3ea458dbd41140d5bf4dca2f931046590f1b3fb0",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-09-30"
+}

{code_coordinator-0.5.532 → code_coordinator-0.5.533}/coord/drive.py

@@ -1387,7 +1387,9 @@ def _decide_acceptance_author(
         # cites), so the thing being waited for could not happen even with
         # `merge.auto_drain` on.
         return replace(
-            _decide_acceptance_landing(state, oracle, opts, counters, machine),
+            _decide_acceptance_landing(
+                state, oracle, opts, counters, machine, verifier
+            ),
             warnings=(
                 f"ACCEPTANCE: JIT slice {aid} is ADVISORY with commits present "
                 "— proceeding per --accept-advisory (#1357)",
@@ -1460,7 +1462,9 @@ def _decide_acceptance_author(
         # Authoring finished and the branch carries commits: hand over to the
         # landing driver, which observes the daemon-driven Test/Review stages
         # and performs the one step the daemon will not (#2079 — the merge).
-        return _decide_acceptance_landing(state, oracle, opts, counters, machine)
+        return _decide_acceptance_landing(
+            state, oracle, opts, counters, machine, verifier
+        )
 
     # "" / running: still authoring — nothing to drive yet.
     return _wait(
@@ -1476,6 +1480,7 @@ def _decide_acceptance_landing(
     opts: DriveOptions,
     counters: DriveCounters,
     machine: str,
+    verifier: MergeVerifier,
 ) -> Action:
     """Land the authored JIT acceptance slice (#2079).
 
@@ -1673,7 +1678,7 @@ def _decide_acceptance_landing(
         merge_aid=state.acceptance_merge_aid,
         merge_pr_url=state.acceptance_merge_pr_url,
     )
-    action = _decide_merge(shadow, opts, counters.slice_budget())
+    action = _decide_merge(shadow, opts, counters.slice_budget(), verifier)
     return replace(
         action,
         label=_acceptance_label(action.label),
@@ -1779,6 +1784,8 @@ class MergeVerifier(Protocol):
         self, state: IssueState
     ) -> EpicChecklistSnapshot | None: ...
 
+    def github_backoff_active(self) -> bool: ...
+
 
 def _remote_matches_repo(remote_url: str, repo_github: str) -> bool:
     """Loosely compare a ``git remote get-url origin`` URL against the
@@ -1991,6 +1998,26 @@ class GitMergeVerifier:
 
         return github_ops.get_branch_sha(state.repo_github, state.work_branch)
 
+    def github_backoff_active(self) -> bool:
+        """True when GitHub's shared, fleet-wide rate-limit backoff
+        (:mod:`coord.github_throttle`, #2809/#2934) is currently in force.
+
+        #3479: the ONE thing :func:`_decide_merge`'s ``"unknown_head"`` arm
+        must check before spending a live ``coord merge --only`` re-check —
+        see that arm's own docstring for the latched-reason bug this
+        guards against. Routed through :func:`coord.github_throttle.
+        consult` (not the same-host-only :func:`~coord.github_throttle.
+        current`) so this honours a backoff another machine recorded via
+        the daemon, exactly like the shared funnel every live ``gh`` call
+        already consults before it ever reaches GitHub — re-probing INTO a
+        window another host just tripped is precisely the synchronized-
+        hammering #2809 exists to prevent.
+        """
+        from coord import github_throttle  # noqa: PLC0415
+
+        _sleep_s, backoff = github_throttle.consult()
+        return backoff is not None
+
     def epic_checklist_snapshot(
         self, state: IssueState
     ) -> EpicChecklistSnapshot | None:
@@ -2913,7 +2940,7 @@ def decide(
             warnings=warnings,
         )
 
-    merge = _decide_merge(state, opts, counters)
+    merge = _decide_merge(state, opts, counters, verifier)
     return replace(merge, warnings=warnings + merge.warnings)
 
 
@@ -4275,7 +4302,10 @@ def _park_uat_fixup_dispatch_failure(
 
 
 def _decide_merge(
-    state: IssueState, opts: DriveOptions, counters: DriveCounters
+    state: IssueState,
+    opts: DriveOptions,
+    counters: DriveCounters,
+    verifier: MergeVerifier,
 ) -> Action:
     """The MERGE stage.
 
@@ -4335,13 +4365,55 @@ def _decide_merge(
     # confirmed. No retry or fix this driver can take changes GitHub's
     # answer; wait, exactly like the CI-unreadable case below, and never
     # spend a merge attempt re-observing the identical unreadable probe.
+    #
+    # #3479: this used to be a BARE `_wait()` for as long as this reason
+    # stayed on the board — nothing here ever re-probed, so a `merge_reason`
+    # from an outage that had already cleared just kept getting re-read
+    # forever (quadraui#1083: 309 consecutive polls over 2.5h reprinting the
+    # identical "branch head unknown" line while GitHub was fully healthy
+    # the whole time — `gh auth status` OK, rate limit 5000/5000 — because
+    # the REAL block, a failing required CI check, was a few lines further
+    # down in `_decide_merge` and this arm returned before ever reaching
+    # it). "Branch head unknown" means "wait until the probe recovers", so
+    # this now actually re-probes: once the shared GitHub backoff
+    # (:mod:`coord.github_throttle`, #2809/#2934 — the SAME funnel every
+    # live `gh` call already consults) is no longer active, dispatch the
+    # identical budget-exempt real `coord merge --only <aid>` re-check the
+    # CI-unreadable arm below uses, instead of re-reading a value nothing
+    # here ever refreshes. That live attempt re-evaluates every gate,
+    # including CI, so a resolved outage reaches the SAME `checks_failed` →
+    # `coord.commands.merge._dispatch_ci_fixes` path a human running the
+    # identical command by hand already does — the quadraui#1083 recovery.
+    #
+    # While the backoff IS active, this still just waits, WITHOUT touching
+    # `verifier`/GitHub at all — #2809's whole point is that hammering
+    # GitHub during a backoff window only prolongs it, so no probe (real or
+    # otherwise) is issued while one is in force.
     if _merge_gate_kind(gate_reason) == "unknown_head":
-        return _wait(
-            label=(
-                "MERGE: branch head unknown — GitHub read failed (rate "
-                "limit, auth, or network); waiting, not retrying (#2704): "
-                f"{gate_reason}"
+        if verifier.github_backoff_active():
+            return _wait(
+                label=(
+                    "MERGE: branch head unknown — GitHub backoff active "
+                    "(#2809); waiting, not probing (#2704/#3479): "
+                    f"{gate_reason}"
+                )
             )
+        aid = state.merge_aid or state.work_aid
+        return Action(
+            kind=RUN,
+            label=(
+                "MERGE: branch head unknown — GitHub backoff clear, "
+                "re-checking for real instead of re-reading the latched "
+                f"reason (#2704/#3479): {gate_reason}"
+            ),
+            command=("merge", "--only", aid, "--method", opts.merge_method),
+            on_error="warn",
+            error_message=(
+                "coord merge returned non-zero (or the merge lock timed "
+                "out) while re-checking an unknown branch head — "
+                "re-checking next poll"
+            ),
+            serialize_merge=True,
         )
     # #2947 (follow-up to #2687): the UAT gate is a human-attended block — no
     # `coord merge` retry can clear it, only an operator or a customer

{code_coordinator-0.5.532 → code_coordinator-0.5.533}/tests/test_drive.py

@@ -131,15 +131,22 @@ class FakeVerifier:
         # `work_type` before ever calling this, so every pre-#3246 test
         # (which never sets `work_type="epic-decompose"`) is unaffected.
         epic_snapshot: "EpicChecklistSnapshot | None" = None,
+        # #3479: the #2704 unknown_head re-probe's own gate. `False` (the
+        # default) is "no active backoff" — every pre-#3479 test never
+        # touched this, so leaving it off preserves their assertions
+        # byte-for-byte; the #3479 tests below override it explicitly.
+        github_backoff: bool = False,
     ) -> None:
         self._has_commits = has_commits
         self._merged = merged
         self._head_sha = head_sha
         self._epic_snapshot = epic_snapshot
+        self._github_backoff = github_backoff
         self.commits_calls = 0
         self.merged_calls = 0
         self.head_sha_calls = 0
         self.epic_snapshot_calls = 0
+        self.github_backoff_calls = 0
 
     def branch_has_commits(self, s: IssueState) -> bool | None:
         self.commits_calls += 1
@@ -157,6 +164,10 @@ class FakeVerifier:
         self.epic_snapshot_calls += 1
         return self._epic_snapshot
 
+    def github_backoff_active(self) -> bool:
+        self.github_backoff_calls += 1
+        return self._github_backoff
+
 
 def step(s: IssueState, opts: DriveOptions | None = None, **kw) -> Action:
     """One decide() call with sensible defaults."""
@@ -4258,33 +4269,50 @@ def test_a_genuinely_failed_check_is_not_read_as_ci_unreadable():
 # UNKNOWN_BRANCH_HEAD_REASON`. Before #2704 this fabricated a "review
 # required but not approved" refusal (fails CLOSED with the WRONG reason) or
 # a silently-passing smoke gate (fails OPEN). Now it is its own gate kind:
-# the drive waits for GitHub to answer again rather than retry `coord merge`
-# (a no-op — nothing about GitHub's reachability changes by re-running it) or
-# escalate a re-review/Test re-run for a gate nothing here actually refused.
+# the drive re-probes (or waits, while GitHub's shared backoff is active)
+# rather than escalate a re-review/Test re-run for a gate nothing here
+# actually refused.
+#
+# #3479: a bare `_wait()` here used to be the WHOLE story — nothing ever
+# re-probed, so a latched reason from a cleared outage got re-read forever
+# (quadraui#1083: 309 consecutive polls over 2.5h while GitHub was fully
+# healthy, because the real block — a failing CI check — sat a few lines
+# further down in `_decide_merge` and this arm always returned first). Now
+# the arm checks the shared GitHub backoff (`verifier.github_backoff_active()`)
+# before deciding: active → still a bare wait, no probe issued; clear →
+# dispatch the SAME budget-exempt real `coord merge --only <aid>` re-check
+# the CI-unreadable arm uses, which is what actually reaches a fresh
+# CI-failed → ci-fix dispatch instead of a fabricated reading.
 # ═══════════════════════════════════════════════════════════════════════════
 
 
 @pytest.mark.parametrize("status", ["", "PENDING", "READY", "BLOCKED"])
-def test_unknown_branch_head_waits_regardless_of_which_status_the_board_shows(status):
+def test_unknown_branch_head_waits_regardless_of_status_when_backoff_active(status):
+    """#3479: while GitHub's shared backoff IS active, this arm must still
+    be a bare wait — hammering GitHub mid-backoff only prolongs it (#2809)."""
     from coord.merge_queue import UNKNOWN_BRANCH_HEAD_REASON
 
+    verifier = FakeVerifier(github_backoff=True)
     action = step(
-        approved_work(merge_status=status, merge_reason=UNKNOWN_BRANCH_HEAD_REASON)
+        approved_work(merge_status=status, merge_reason=UNKNOWN_BRANCH_HEAD_REASON),
+        verifier=verifier,
     )
     assert action.kind == WAIT
     assert "branch head unknown" in action.label
-    assert "not retrying" in action.label
+    assert "backoff active" in action.label
+    assert verifier.github_backoff_calls == 1
 
 
-def test_unknown_branch_head_never_spends_an_attempt():
+def test_unknown_branch_head_never_spends_an_attempt_while_backoff_active():
     from coord.merge_queue import UNKNOWN_BRANCH_HEAD_REASON
 
     counters = DriveCounters()
     opts = DriveOptions(machine="precision", max_merge_attempts=2)
+    verifier = FakeVerifier(github_backoff=True)
     s = approved_work(merge_status="", merge_reason=UNKNOWN_BRANCH_HEAD_REASON)
 
     for _ in range(5):
-        action = step(s, opts, counters=counters)
+        action = step(s, opts, counters=counters, verifier=verifier)
         assert action.kind == WAIT
         assert counters.merge_attempts == 0
 
@@ -4297,12 +4325,14 @@ def test_unknown_branch_head_does_not_escalate_a_fabricated_review_refusal():
     would have been classified as the "review" gate kind, and — because the
     driver's view contradicts a plain "review" refusal — escalated via
     `_merge_gate_divergence` proposing `coord review-reaffirm` for a review
-    nothing actually refused. It must instead be its own kind and just
-    wait."""
+    nothing actually refused. It must instead be its own kind and never
+    escalate — regardless of whether the backoff check lands it on a wait
+    or a re-check (#3479)."""
     from coord.merge_queue import UNKNOWN_BRANCH_HEAD_REASON
 
     action = step(
-        approved_work(merge_status="BLOCKED", merge_reason=UNKNOWN_BRANCH_HEAD_REASON)
+        approved_work(merge_status="BLOCKED", merge_reason=UNKNOWN_BRANCH_HEAD_REASON),
+        verifier=FakeVerifier(github_backoff=True),
     )
     assert action.kind == WAIT
     assert not action.is_exit
@@ -4318,6 +4348,73 @@ def test_merge_gate_kind_recognises_unknown_branch_head_as_its_own_kind():
     assert _merge_gate_kind(UNKNOWN_BRANCH_HEAD_REASON) != "review"
 
 
+# ═══════════════════════════════════════════════════════════════════════════
+# #3479: the re-probe itself — the #2704 wait arm must re-evaluate the gate
+# once GitHub's shared backoff is no longer active, rather than latch onto
+# the stale reason forever (quadraui#1083).
+# ═══════════════════════════════════════════════════════════════════════════
+
+
+def test_unknown_branch_head_reprobes_for_real_once_backoff_clears():
+    """No active backoff: the drive's next decision must be a REAL
+    (non-dry-run) `coord merge --only <aid>` re-check — never a bare
+    `_wait()` — because that live attempt is what actually re-evaluates
+    every gate (including a failing CI check) and reaches the SAME
+    `checks_failed` → ci-fix dispatch path the quadraui#1083 incident's
+    manual recovery (`coord merge --only <aid>`) took by hand."""
+    from coord.merge_queue import UNKNOWN_BRANCH_HEAD_REASON
+
+    verifier = FakeVerifier(github_backoff=False)
+    counters = DriveCounters()
+    s = approved_work(
+        merge_status="BLOCKED",
+        merge_reason=UNKNOWN_BRANCH_HEAD_REASON,
+        merge_aid="m1",
+    )
+    action = step(s, counters=counters, verifier=verifier)
+
+    assert action.kind == RUN
+    assert action.command[:3] == ("merge", "--only", "m1")
+    assert not action.is_exit
+    # Budget-exempt, same as the CI-unreadable sibling arm (#2347/#2704):
+    # an indefinitely-unreachable GitHub can never exhaust
+    # `--max-merge-attempts` through THIS arm.
+    assert counters.merge_attempts == 0
+    assert verifier.github_backoff_calls == 1
+
+
+def test_unknown_branch_head_reprobe_never_spends_an_attempt_across_polls():
+    from coord.merge_queue import UNKNOWN_BRANCH_HEAD_REASON
+
+    counters = DriveCounters()
+    opts = DriveOptions(machine="precision", max_merge_attempts=2)
+    verifier = FakeVerifier(github_backoff=False)
+    s = approved_work(merge_status="", merge_reason=UNKNOWN_BRANCH_HEAD_REASON)
+
+    for _ in range(5):
+        action = step(s, opts, counters=counters, verifier=verifier)
+        assert action.kind == RUN
+        assert counters.merge_attempts == 0
+
+
+def test_unknown_branch_head_reprobe_checks_backoff_before_every_dispatch():
+    """The backoff check is consulted on every poll — a backoff recorded
+    BETWEEN two polls (e.g. this same `coord merge --only` re-check itself
+    tripping a fresh 403) must be honoured on the very next one, not just
+    the first."""
+    from coord.merge_queue import UNKNOWN_BRANCH_HEAD_REASON
+
+    s = approved_work(merge_status="", merge_reason=UNKNOWN_BRANCH_HEAD_REASON)
+
+    clear_verifier = FakeVerifier(github_backoff=False)
+    action = step(s, verifier=clear_verifier)
+    assert action.kind == RUN
+
+    active_verifier = FakeVerifier(github_backoff=True)
+    action = step(s, verifier=active_verifier)
+    assert action.kind == WAIT
+
+
 # ═══════════════════════════════════════════════════════════════════════════
 # #2947 (follow-up to #2687): the UAT gate. `coord/merge_queue.py` reports a
 # missing/failed UAT verdict with the same `MergeGateFailure` shape as smoke
@@ -5888,6 +5985,35 @@ def test_base_accepts_a_genuinely_valid_checkout(recorded_git, tmp_path):
     assert warned == []
 
 
+# ═══════════════════════════════════════════════════════════════════════════
+# GitMergeVerifier.github_backoff_active — #3479's real backoff read
+# ═══════════════════════════════════════════════════════════════════════════
+
+
+def test_github_backoff_active_is_false_with_no_recorded_backoff():
+    assert GitMergeVerifier().github_backoff_active() is False
+
+
+def test_github_backoff_active_is_true_once_a_hit_is_recorded():
+    from coord.github_throttle import local_record
+
+    local_record(reason="secondary_rate_limit", status=403, request_id=None, retry_after_s=None)
+    assert GitMergeVerifier().github_backoff_active() is True
+
+
+def test_github_backoff_active_clears_once_the_window_expires():
+    from coord.github_throttle import local_record
+
+    local_record(
+        reason="secondary_rate_limit", status=403, request_id=None,
+        retry_after_s=1, now=1000.0,
+    )
+    # `consult()` defaults to the real wall clock, which is long past the
+    # `now=1000.0` + 1s window this recorded — same "fails open once
+    # expired" contract `coord.github_throttle.current()` documents.
+    assert GitMergeVerifier().github_backoff_active() is False
+
+
 @pytest.mark.parametrize(
     "remote_url",
     [

code_coordinator-0.5.532/code_coordinator.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "0.5.532",
-  "distance": 0,
-  "node": "ga69005346d9332617f56dbceb66b67c41a1e2d78",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-09-28"
-}