code-coordinator 0.5.535__tar.gz → 0.5.537__tar.gz

{code_coordinator-0.5.535 → code_coordinator-0.5.537}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.535
+Version: 0.5.537
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.535 → code_coordinator-0.5.537}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.535
+Version: 0.5.537
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.535 → code_coordinator-0.5.537}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.535",
+  "tag": "0.5.537",
   "distance": 0,
-  "node": "gb4633aa4d9fe33c39961caa7723f8214fa8b67d0",
+  "node": "g0b0484bb17ec9c86ad41ee4d4d8123042044c389",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-09-30"

{code_coordinator-0.5.535 → code_coordinator-0.5.537}/coord/commands/gate_a.py

@@ -137,17 +137,46 @@ def _fetch_contract(repo_cfg, config, milestone_number: int) -> str | None:
     number doesn't say whether it's a directory-discovered driver's slice
     (shared repo-root tree) or an entrypoint-linked driver's relocated one,
     so this checks each candidate :func:`coord.acceptance.
-    gate_a_contract_candidates` returns until one exists."""
+    gate_a_contract_candidates` returns until one exists.
+
+    Returns ``None`` only when every candidate genuinely 404'd — a
+    confirmed absence. Raises :class:`coord.github_ops.GhTransientError`
+    (unchanged) when a candidate's read failed because ``gh`` classified it
+    as a GitHub rate limit (:func:`coord.github_ops._classify_rate_limit`,
+    surfaced as :class:`coord.github_ops.GhRateLimitError`) rather than a
+    404: #2973's bug was exactly this distinction getting lost — a
+    rate-limited read was folded into the same ``except RuntimeError:
+    continue`` as a real 404, so "I could not tell" silently became "it
+    does not exist". A transient failure on ANY candidate makes the whole
+    read inconclusive (a later candidate 404'ing doesn't confirm the
+    transiently-failed one is absent too), so it takes priority over a
+    clean ``None`` even if a later candidate genuinely 404s.
+
+    Narrower than it may sound: only a rate limit is currently classified
+    this way — a plain non-zero ``gh`` exit that isn't a rate limit (a bad
+    token, a genuine network failure, ``gh`` missing) still raises a plain
+    ``RuntimeError``/:class:`coord.github_ops.GhError` and is still folded
+    into ``continue`` below, same as before this fix. Tracked as a
+    follow-up rather than widened here, since ``_is_transient_error``-style
+    reclassification of those cases is a broader, separately-reviewable
+    change to ``coord.github_ops._gh`` itself.
+    """
     from coord import github_ops  # noqa: PLC0415
     from coord.acceptance import gate_a_contract_candidates  # noqa: PLC0415
 
+    transient: github_ops.GhTransientError | None = None
     for path in gate_a_contract_candidates(config, repo_cfg.name, milestone_number):
         try:
             return github_ops.get_repo_file(
                 repo_cfg.github, path, branch=repo_cfg.default_branch,
             )
+        except github_ops.GhTransientError as e:
+            transient = transient or e
+            continue
         except RuntimeError:
             continue
+    if transient is not None:
+        raise transient
     return None
 
 
@@ -216,7 +245,27 @@ def gate_a(
         sys.exit(2)
     milestone_number = int(milestone_number)
 
-    contract_text = _fetch_contract(repo_cfg, cfg, milestone_number)
+    try:
+        contract_text = _fetch_contract(repo_cfg, cfg, milestone_number)
+    except github_ops.GhTransientError as e:
+        # #2973: a failed READ is a different claim than a confirmed
+        # ABSENCE — only the latter justifies telling the caller to
+        # dispatch `coord acceptance mock` (which, against a milestone
+        # that already has an approved contract, produces a duplicate/
+        # conflicting one). Mirror the issue-fetch path just above, which
+        # already reports this correctly: name the real cause and ask for
+        # a retry, print no remedy.
+        click.echo(
+            f"error: could not read the Gate-A contract for ms-{milestone_number} "
+            f"({repo}#{tracking_issue}): {e}",
+            err=True,
+        )
+        click.echo(
+            "  This is a failed read, not a confirmed absence — the contract "
+            "may well exist. Retry once the rate limit clears.",
+            err=True,
+        )
+        sys.exit(1)
     if contract_text is None:
         from coord.acceptance import gate_a_contract_candidates  # noqa: PLC0415
 

{code_coordinator-0.5.535 → code_coordinator-0.5.537}/coord/commands/merge.py

@@ -137,7 +137,6 @@ def _apply_revalidation(items, board, config, gh_ops, *, dry_run: bool, skip_rev
 
 def _apply_ci_revalidation(
     items, board, config, ci_store, gh_ops, *, dry_run: bool,
-    poll_sleep=None, poll_clock=None,
 ) -> set[str]:
     """#1851: the ``--revalidate`` arm for CI staleness — the CI analogue of
     :func:`_apply_revalidation`'s stale-local-verdict arm, resolving a
@@ -147,64 +146,35 @@ def _apply_ci_revalidation(
     outlive the base it actually validated even when the local Test verdict
     is perfectly fresh).
 
-    Unlike :func:`_apply_revalidation` there is nothing to compose and no
-    local suite to run — the remedy is :meth:`coord.ci_store.CiStore.
-    rerun_for_pr`, a ``gh run rerun`` that costs CI minutes on GitHub's own
-    runners, not a routed Test-stage agent. Strictly cheaper than what
-    :func:`_apply_revalidation` does for the same reason CI should always be
-    preferred when both would establish the same fact (#1851's "Cost
-    framing").
+    #3276: every candidate :func:`coord.merge_queue.ci_revalidation_candidates`
+    returns is, by that function's own contract, blocked *solely* on CI
+    staleness — and the remedy that would have been here,
+    :meth:`coord.ci_store.CiStore.rerun_for_pr`, is a same-base ``gh run
+    rerun`` that a staleness reading (the base moved; the check didn't) can
+    never satisfy. #3266 already established exactly that and fixed the two
+    unattended call sites (``merge_queue.process()``'s own #2197 auto-rerun
+    and ``coord.commands.drive_queue._run_auto_revalidate_checks_stale``) to
+    stop spending a CI cycle on it — see ``MAX_CI_STALE_RERUNS``'s comment in
+    ``coord/merge_queue.py``. This CLI arm was left as a disclosed scope cut
+    (opt-in, human-invoked, no budget counter) with a docstring promising a
+    "tracked follow-up" that was never filed as an issue — #3276 is that
+    follow-up. So: no candidate here is ever handed to ``rerun_for_pr``
+    anymore. Each one gets the rebase remedy on stdout instead, both under
+    ``--dry-run`` and for real — the two cases are identical now because
+    nothing is actually triggered either way (#3276's acceptance: ``--dry-
+    run`` must say the same thing it would do).
 
     Opt-in behind ``--revalidate`` exactly like :func:`_apply_revalidation`
-    — never called from auto-drain (see ``docs/DRIVE_QUEUE.md``). Under
-    ``--dry-run`` this only *names* what it would trigger; no ``gh`` mutation
-    runs.
-
-    #1925: triggering a rerun and then handing the entry straight to
-    ``merge_queue.process()`` used to fail-close on the rerun's OWN
-    registration gap — ``gh pr checks`` errors for the few seconds before
-    GitHub has created any check-run record, which reads as the #1525
-    synthetic ``unknown`` conclusion and blocks exactly like a genuinely
-    broken CI would. :func:`coord.ci_store.wait_for_ci_settle` closes that
-    gap with a bounded poll right here, so the caller's subsequent
-    ``process()`` call sees a real, resolved result — pass or fail — for the
-    common case.
-
-    Returns the ``assignment_id``s whose wait ran out the budget while STILL
-    only seeing the registration-gap symptom (never a real check) —
-    :func:`wait_for_ci_settle`'s ``registering=True`` case. The caller must
-    exclude these from the ``process()`` call that follows: evaluating the
-    gate against that exact symptom is the bug this fixes, so it must not
-    reappear at the timeout edge just because the wait gave up. The entry
-    stays ``PENDING`` with an explanatory ``entry.error`` instead — legible
-    as "come back shortly", never as "checks failed" (#1925's acceptance:
-    an ``unknown`` this command caused must not be presented identically to
-    an ``unknown`` from genuinely broken CI).
-
-    #3266 — KNOWN FOLLOW-UP, not fixed here: every candidate this selects
-    (via :func:`coord.merge_queue.ci_revalidation_candidates`) is blocked
-    *solely* on CI staleness, and the ``rerun_for_pr`` call below is a
-    same-base ``gh run rerun`` that a staleness reading, by definition,
-    can never satisfy — see ``MAX_CI_STALE_RERUNS``'s comment in
-    ``coord/merge_queue.py``, which #3266 fixed identically at
-    ``merge_queue.process()`` and at ``coord.commands.drive_queue.
-    _run_auto_revalidate_checks_stale`` (the unattended periodic call
-    site). This CLI arm is the one remaining caller still spending a real
-    CI cycle on that guaranteed no-op. Left unfixed here on purpose for
-    this round — it is opt-in and human-invoked, unlike the unattended
-    drive-queue path, and the misleading ``ci_stale_reason`` remedy text
-    that used to point an operator at ``--revalidate`` *for this specific
-    condition* was already removed by #3266 — but an operator who runs
-    ``--revalidate`` for an unrelated reason (a genuine infra-failure
-    retry) on a PR that also happens to be ``checks_stale`` still silently
-    burns a no-op CI cycle for that PR. Tracked as a follow-up: the fix
-    would be to drop this entry from *candidates* (or from what gets
-    rerun) whenever the ONLY reason it is here is staleness, so
-    ``--revalidate`` never fires `rerun_for_pr` for a condition it cannot
-    clear.
+    — never called from auto-drain (see ``docs/DRIVE_QUEUE.md``).
+
+    Returns an empty set always now — kept as a ``set[str]`` return (rather
+    than ``None``) so the two call sites' "entries this arm deferred, exclude
+    them from this pass's ``process()`` call" plumbing (#1925's ``registering``
+    case, from when this arm still triggered a rerun and had to wait out its
+    own registration gap) needs no change; there is simply never anything to
+    defer any more, since nothing is triggered.
     """
     from coord import merge_queue as _mq  # noqa: PLC0415
-    from coord.ci_store import wait_for_ci_settle  # noqa: PLC0415
 
     deferred: set[str] = set()
     if ci_store is None or not ci_store.is_available:
@@ -218,61 +188,31 @@ def _apply_ci_revalidation(
         return deferred
     for entry in candidates:
         label = f"{entry.repo_name} #{entry.issue_number} ({entry.branch})"
-        if dry_run:
-            click.echo(
-                f"  --revalidate: would re-run CI for {label} "
-                f"(PR #{entry.pr_number}) — checks predate the current base"
-            )
-            continue
-        ok = ci_store.rerun_for_pr(entry.repo_github, entry.pr_number)
-        if not ok:
-            click.echo(
-                f"  --revalidate: could not trigger a CI re-run for {label} "
-                f"(PR #{entry.pr_number}) — see gh output above",
-                err=True,
-            )
-            continue
         click.echo(
-            f"  --revalidate: triggered a CI re-run for {label} "
-            f"(PR #{entry.pr_number})"
-        )
-        result = wait_for_ci_settle(
-            ci_store, entry.repo_github, entry.pr_number,
-            echo=click.echo, sleep=poll_sleep, clock=poll_clock,
+            f"  --revalidate: skipping {label} (PR #{entry.pr_number}) — "
+            "blocked solely on stale CI checks; a re-run replays the same "
+            "run against the same base it already ran against and can "
+            "never clear this (#3276). Rebase (or push a new commit) to "
+            "get a check against the current base."
         )
-        if result.settled:
-            click.echo(
-                f"  --revalidate: CI re-run for {label} settled after "
-                f"{result.waited_seconds:.0f}s — the merge gate will "
-                "evaluate the fresh result"
-            )
-        elif result.registering:
-            entry.error = (
-                f"{label}: the CI re-run --revalidate just triggered "
-                f"(PR #{entry.pr_number}) has not registered on GitHub yet "
-                f"after {result.waited_seconds:.0f}s — this is the re-run "
-                "THIS command started, not a CI failure; re-run `coord "
-                "merge --revalidate` (or plain `coord merge`) shortly (#1925)"
-            )
-            deferred.add(entry.assignment_id)
-            click.echo(f"  --revalidate: {entry.error}")
-        else:
-            click.echo(
-                f"  --revalidate: CI re-run for {label} is still running "
-                f"after {result.waited_seconds:.0f}s — leaving it to the "
-                "merge gate this pass (will report as CI still running)"
-            )
     return deferred
 
 
 def _reload_board_after_wait(board, *, dry_run: bool):
-    """#2143: force a fresh board read after ``_apply_ci_revalidation``'s
-    ``wait_for_ci_settle`` poll — which, like ``_apply_revalidation``'s
-    composite/solo suite runs, can hold the caller for minutes.
+    """#2143: force a fresh board read after ``--revalidate``'s CI-staleness
+    arm (:func:`_apply_ci_revalidation`) — which, like
+    :func:`_apply_revalidation`'s composite/solo suite runs, used to be able
+    to hold the caller for minutes via a post-rerun settle poll.
+
+    #3276: that poll is gone — :func:`_apply_ci_revalidation` no longer
+    triggers a rerun at all (see its own docstring), so it returns quickly.
+    This reload stays anyway: :func:`_apply_revalidation`'s local-suite arm,
+    called just before this in both callers, can still run for minutes, and
+    the same staleness argument below applies to it too.
 
     ``_apply_revalidation`` already refreshes the board it hands back, but
-    only when *it* recorded a new verdict; it has no way to know a CI-settle
-    wait ran afterwards. Real state can change on GitHub during that wait —
+    only when *it* recorded a new verdict; it has no way to know what ran
+    after it. Real state can change on GitHub while either arm is running —
     most dangerously a review approval landing, or a concurrent merge driver
     (the drive-queue timer, another operator) merging the exact branch this
     run is about to act on — and `merge_queue.process()` must not evaluate
@@ -283,9 +223,9 @@ def _reload_board_after_wait(board, *, dry_run: bool):
     Unconditional (not "only when something looks stale"): the risk here is
     a stale *read*, and there's no cheap way to tell "nothing changed" from
     "something changed but we didn't notice" without just re-reading. One
-    extra ``load_board()`` is a rounding error next to the suite run(s) or
-    the CI-settle poll that just happened. Under ``--dry-run`` nothing was
-    triggered (no wait actually ran), so the board is left untouched.
+    extra ``load_board()`` is a rounding error next to the suite run(s) that
+    just happened. Under ``--dry-run`` nothing was triggered (no suite run
+    actually ran), so the board is left untouched.
     """
     if dry_run:
         return board
@@ -2392,15 +2332,16 @@ def merge(
                 only_items, board_only, cfg_only, ci_store_only, gh_ops,
                 dry_run=dry_run,
             )
-            # #2143: the CI-settle wait just above can run for minutes —
-            # re-read the board so the gates `process()` runs below see
-            # whatever landed on GitHub during it, not the pre-wait snapshot.
+            # #2143: `_apply_revalidation`'s local-suite run just above can
+            # run for minutes — re-read the board so the gates `process()`
+            # runs below see whatever landed on GitHub during it, not a
+            # pre-run snapshot. (#3276: `_apply_ci_revalidation` itself no
+            # longer triggers a rerun, so this is no longer also covering a
+            # CI-settle wait — see its own docstring.)
             board_only = _reload_board_after_wait(board_only, dry_run=dry_run)
-        # #1925: an entry deferred by the CI-settle wait above must not go
-        # through process() this pass — that would immediately re-derive the
-        # exact self-triggered "unknown" reading the wait was just trying to
-        # avoid handing to the gate. It stays PENDING with the explanatory
-        # `entry.error` _apply_ci_revalidation already set.
+        # #1925/#3276: `deferred_ci` is always empty now that
+        # `_apply_ci_revalidation` never triggers a rerun — kept so this
+        # exclusion needs no change if that ever stops being true.
         if only_entry.assignment_id in deferred_ci:
             events_only = []
         else:
@@ -2841,15 +2782,17 @@ def merge(
         deferred_ci = _apply_ci_revalidation(
             pending, board, cfg, ci_store, gh_ops, dry_run=dry_run,
         )
-        # #2143: the CI-settle wait just above can run for minutes —
-        # re-read the board so the gates `process()` runs below see
-        # whatever landed on GitHub during it, not the pre-wait snapshot.
+        # #2143: `_apply_revalidation`'s local-suite run just above can run
+        # for minutes — re-read the board so the gates `process()` runs
+        # below see whatever landed on GitHub during it, not a pre-run
+        # snapshot. (#3276: `_apply_ci_revalidation` itself no longer
+        # triggers a rerun, so this is no longer also covering a CI-settle
+        # wait — see its own docstring.)
         board = _reload_board_after_wait(board, dry_run=dry_run)
-    # #1925: entries the CI-settle wait above gave up on while still only
-    # seeing the registration-gap symptom must not go through process() this
-    # pass — see `_apply_ci_revalidation`'s docstring. They keep their
-    # PENDING state and the explanatory `entry.error` it already set; `items`
-    # (unfiltered) still carries them through to the save step below.
+    # #1925/#3276: `deferred_ci` is always empty now that
+    # `_apply_ci_revalidation` never triggers a rerun — kept so this
+    # exclusion needs no change if that ever stops being true. `items`
+    # (unfiltered) still carries every entry through to the save step below.
     process_items = (
         [x for x in items if x.assignment_id not in deferred_ci]
         if deferred_ci else items

{code_coordinator-0.5.535 → code_coordinator-0.5.537}/coord/merge_queue.py

@@ -2539,9 +2539,12 @@ MAX_CI_INFRA_RERUNS = 2
 # all. Kept defined — rather than deleted — because `QueuedMerge.
 # ci_stale_reruns` still exists for rows written before this fix (see its
 # own comment) and because `coord.commands.merge._apply_ci_revalidation`
-# (the opt-in ``--revalidate`` CLI arm) still references it; that caller is
-# lower severity (opt-in, human-invoked) and is a tracked follow-up, not
-# something this fix's file scope covers.
+# (the opt-in ``--revalidate`` CLI arm) still references it in its own
+# docstring. #3276 closed the gap #3266 left open there: that caller now
+# reports the rebase remedy for a staleness-only candidate instead of
+# calling `rerun_for_pr` for it either — the third and last of this
+# primitive's call sites, so nothing left in this module calls `rerun_for_pr`
+# for a condition it can never clear.
 MAX_CI_STALE_RERUNS = 2
 
 # #2252: at most one auto-rerun per failure streak before a genuinely-
@@ -3804,12 +3807,12 @@ def ci_revalidation_candidates(
     `rerun_for_pr` replays the same run against the same base it already
     used, so it can never see the new one. `process()`'s OWN #2197
     auto-rerun for this trigger was dropped for that reason (see
-    `MAX_CI_STALE_RERUNS`'s comment). The one remaining caller that still
-    calls `rerun_for_pr` on what this returns is `coord.commands.merge
-    ._apply_ci_revalidation` (the opt-in ``--revalidate`` CI arm) — equally
-    unable to clear the block, but lower severity since a human has to
-    explicitly ask for it. Left as-is here: fixing it is a change to that
-    module, out of this function's/file's scope, and a tracked follow-up.
+    `MAX_CI_STALE_RERUNS`'s comment). `coord.commands.merge
+    ._apply_ci_revalidation` (the opt-in ``--revalidate`` CI arm) was the one
+    remaining caller that still called `rerun_for_pr` on what this returns —
+    #3276 fixed it too: it now reports the rebase remedy for every entry this
+    function returns (all of them are staleness-only, by this function's own
+    contract above) instead of spending a guaranteed no-op CI cycle.
 
     #3396: `coord.commands.drive_queue._run_auto_revalidate_checks_stale`
     (the unattended periodic call site) still calls this function to find
@@ -4099,12 +4102,13 @@ class QueuedMerge:
     # this column.
     #
     # `coord.commands.merge._apply_ci_revalidation` (the opt-in
-    # ``--revalidate`` CLI arm) is the one remaining caller of
-    # `ci_revalidation_candidates` that still calls `rerun_for_pr` for this
-    # exact condition — it does not touch this counter (no budget, no cap;
-    # a human invoked it once, on purpose), but it is equally unable to
-    # clear a staleness block for the reason above, and is a tracked,
-    # lower-severity follow-up (see its own docstring).
+    # ``--revalidate`` CLI arm) never touched this counter (no budget, no
+    # cap; a human invoked it once, on purpose) but, until #3276, was the
+    # one remaining caller of `ci_revalidation_candidates` that still called
+    # `rerun_for_pr` for this exact unclearable condition. #3276 fixed it:
+    # that arm now reports the rebase remedy for a staleness-only candidate
+    # instead of re-running, so nothing in the codebase calls `rerun_for_pr`
+    # for a block only a rebase can clear.
     ci_stale_reruns: int = 0
     # #2252: count of automatic `CiStore.rerun_failed_for_pr` calls
     # `process()` has issued for this entry's CURRENT streak of genuinely-

{code_coordinator-0.5.535 → code_coordinator-0.5.537}/coord/milestone_dispatch.py

@@ -197,6 +197,11 @@ def is_milestone_complete(ctx: MilestoneContext) -> bool:
 
 # (repo_github, path, branch) -> True if the file exists at that ref.
 # Injected so tests never hit `gh` — mirrors ``coord.claim``'s BranchLookup.
+#
+# #2973: may also raise ``coord.github_ops.GhTransientError`` — a failed
+# read (auth, network, a GitHub rate limit) is a different claim than a
+# confirmed 404, and callers (``gate_a_status``) must not fold the two
+# together the way the pre-#2973 default implementation did.
 GateAFileExists = Callable[[str, str, str], bool]
 
 
@@ -206,6 +211,11 @@ def _default_gate_a_file_exists(repo_github: str, path: str, branch: str) -> boo
     try:
         github_ops.get_repo_file(repo_github, path, branch=branch)
         return True
+    except github_ops.GhTransientError:
+        # #2973: a rate-limited (or otherwise transient) read is NOT a
+        # confirmed absence — let it propagate so `gate_a_status` can tell
+        # the two apart, instead of silently becoming `False` here.
+        raise
     except RuntimeError:
         return False
 
@@ -235,17 +245,42 @@ def gate_a_status(
     checking only the legacy repo-root path and reporting a false "Gate A
     not satisfied" for a milestone whose contract already exists, just
     somewhere else.
+
+    #2973: a candidate whose read *fails* (auth, network, a GitHub rate
+    limit — :class:`coord.github_ops.GhTransientError`) is a different claim
+    than a candidate that genuinely 404s, and only the latter justifies the
+    "run `coord acceptance mock`" remedy below — that remedy dispatches a
+    duplicate mock-author against a milestone that may already have an
+    approved contract. Mirrors :func:`coord.commands.gate_a._fetch_contract`:
+    a confirmed existence on ANY candidate wins outright (even after an
+    earlier candidate's transient failure), but a transient failure on any
+    checked candidate makes the whole read inconclusive when nothing else
+    confirms existence — reported distinctly, with no dispatch-a-mock-author
+    remedy attached.
     """
     if not config.acceptance.has_driver(repo_cfg.name):
         return None
 
+    from coord import github_ops  # noqa: PLC0415
     from coord.acceptance import gate_a_contract_candidates  # noqa: PLC0415
 
     candidates = gate_a_contract_candidates(config, repo_cfg.name, milestone_number)
     check = file_exists or _default_gate_a_file_exists
+    transient: github_ops.GhTransientError | None = None
     for path in candidates:
-        if check(repo_cfg.github, path, repo_cfg.default_branch):
-            return None
+        try:
+            if check(repo_cfg.github, path, repo_cfg.default_branch):
+                return None
+        except github_ops.GhTransientError as e:
+            transient = transient or e
+            continue
+    if transient is not None:
+        return (
+            f"Gate A undetermined: could not read {repo_cfg.name}'s Gate-A "
+            f"contract on {repo_cfg.default_branch!r} ({transient}). This is "
+            "a failed read, not a confirmed absence — the contract may well "
+            "exist. Retry once the rate limit clears."
+        )
     named = " or ".join(repr(p) for p in candidates)
     return (
         f"Gate A not satisfied: {named} does not exist yet on "
@@ -257,6 +292,17 @@ def gate_a_status(
 
 # (repo_github, path, branch) -> file content, or None if it doesn't exist.
 # Injected so tests never hit `gh` — mirrors GateAFileExists above.
+#
+# #2973: may also raise ``coord.github_ops.GhTransientError`` — same reason
+# as ``GateAFileExists`` above. ``gate_a_signoff_status`` and
+# ``issue_oracle_ready`` both build a ``GateAFileExists`` closure on top of
+# this fetch (memoised, so the existence probe and the content read share
+# one call), so this must propagate the same distinction they'd otherwise
+# lose. Callers that only want *content*, never existence — the manifest/
+# exempt reads in ``_fetch_manifest_data`` and the contract-hashing loop in
+# ``gate_a_signoff`` — catch it locally and keep degrading to ``None``,
+# their pre-#2973 behaviour: those reads are advisory/best-effort, not the
+# gate whose misreporting #2973 is about.
 ManifestFetch = Callable[[str, str, str], "str | None"]
 
 
@@ -265,6 +311,8 @@ def _default_fetch_repo_file(repo_github: str, path: str, branch: str) -> str |
 
     try:
         return github_ops.get_repo_file(repo_github, path, branch=branch)
+    except github_ops.GhTransientError:
+        raise
     except RuntimeError:
         return None
 
@@ -313,6 +361,7 @@ def _fetch_manifest_data(
     legacy manifest and/or fragment file; a milestone's data lives under
     exactly one, so the first root that produces anything wins.
     """
+    from coord import github_ops  # noqa: PLC0415
     from coord.acceptance import (  # noqa: PLC0415
         ACCEPTANCE_DIRNAME,
         MANIFEST_FRAGMENTS_DIRNAME,
@@ -326,7 +375,14 @@ def _fetch_manifest_data(
     def _fetch_one(dir_path: str, filename_stem: str) -> "tuple[ManifestData, bool]":
         for ext in (".yml", ".yaml", ".json"):
             path = f"{dir_path}/{filename_stem}{ext}"
-            content = fetch(repo_github, path, branch)
+            try:
+                content = fetch(repo_github, path, branch)
+            except github_ops.GhTransientError:
+                # #2973: this is an advisory manifest/exempt read, not the
+                # contract-existence gate — a transient GitHub error here
+                # degrades to "no manifest data yet" exactly like a genuine
+                # 404 always has, rather than crashing dispatch.
+                content = None
             if content is None:
                 continue
             try:
@@ -433,11 +489,23 @@ def gate_a_signoff(
     for the common single-candidate case).
     """
     from coord import gate_a as gate_a_mod  # noqa: PLC0415
+    from coord import github_ops  # noqa: PLC0415
     from coord.acceptance import gate_a_contract_candidates  # noqa: PLC0415
 
     contract_text: str | None = None
     for path in gate_a_contract_candidates(config, repo_cfg.name, milestone_number):
-        contract_text = fetch(repo_cfg.github, path, repo_cfg.default_branch)
+        try:
+            contract_text = fetch(repo_cfg.github, path, repo_cfg.default_branch)
+        except github_ops.GhTransientError:
+            # #2973: by the time this runs, `gate_a_status` has already
+            # confirmed SOME candidate exists (that's the precondition every
+            # caller of this checks first) — a transient failure re-reading
+            # a candidate here (this loop re-walks the same list, and a
+            # not-yet-memoised path can still hit a fresh rate limit) just
+            # means this particular candidate isn't the hashable one; keep
+            # walking rather than letting the read crash the signoff check.
+            contract_text = None
+            continue
         if contract_text is not None:
             break
     return gate_a_mod.evaluate(

{code_coordinator-0.5.535 → code_coordinator-0.5.537}/tests/test_cli_gate_a.py

@@ -209,6 +209,40 @@ class TestGateACommand:
         assert result.exit_code == 1
         assert "coord acceptance mock" in result.output
 
+    def test_a_rate_limited_read_is_not_reported_as_a_missing_contract(
+        self, config_file: Path, coord_db
+    ) -> None:
+        """#2973: a failed contents-API read (GitHub secondary rate limit)
+        must not be folded into the same "does not exist" outcome as a
+        genuine 404 — the file was on `main` the whole time; only the read
+        failed. Reporting it as absent recommends `coord acceptance mock`,
+        which against an already-approved milestone dispatches a duplicate
+        mock-author."""
+        from coord.github_ops import GhRateLimitError
+
+        def _repo_file(repo: str, path: str, branch: str | None = None) -> str:
+            raise GhRateLimitError(
+                "gh api repos/acme/api/contents/tests/acceptance/ms-37/"
+                "contract.md?ref=main failed: API rate limit exceeded for "
+                "user ID 12345",
+                secondary=True,
+            )
+
+        with patch(
+            "coord.github_ops.get_issue",
+            return_value={"title": "ms-37 epic", "milestone": {"number": 37}, "labels": []},
+        ), patch("coord.github_ops.get_repo_file", side_effect=_repo_file):
+            result = CliRunner().invoke(
+                main,
+                ["gate-a", "--approved", "api", "900", "--config", str(config_file)],
+            )
+
+        assert result.exit_code == 1
+        assert "does not exist" not in result.output
+        assert "coord acceptance mock" not in result.output
+        assert "rate limit" in result.output.lower()
+        assert "retry" in result.output.lower()
+
     def test_unknown_repo_exits_two(self, config_file: Path, coord_db) -> None:
         result = _run(config_file, ["--approved", "nope", "900"])
         assert result.exit_code == 2