fix(responses): distinguish encrypted task recovery failure reasons

[lidge-jun]

Summary

Address the diagnostic residual of #3661 with bounded HTTP rejection, timeout, shared abort, transport and invalid-output reasons. Carry outcomes through shared flights while preserving strict admission, success-only plaintext caching and caller-local cancellation. No retry or multipart reconstruction.

Related #3661 (multipart/retry remain open). Reporter Hu9956 is acknowledged in the commit.

Manual delivery chain: #3825 quota → #3826 CLI version guidance → #3827 recovery diagnostics. This is an integration/review order; the CLI and recovery fixes do not depend on quota at runtime. Parent base: codex/axis1-version-guidance. No GitHub native stack registration.

Verification

• No local application test suites or typecheck were run. Pushes use --no-verify, as explicitly requested by the maintainer.
• Current combined candidate: 9470fdb1bc9a02715a3760c36301d3d030a4e4fa, containing all four layers and dev bf85e675484a2391b94b2135bbebe739813a9621; expected tree 90a75118402d2f310393bef9ac3e4668cfcbdcfa.
• Cross-platform CI 34074350604 passed all 26 jobs. Service lifecycle 34074351720 passed Linux, macOS and Windows at that exact candidate.
• Independent Astra high source/security reviews passed the quota, CLI and recovery changes, merge interactions, and supporting exact-file-identity correction in fix(clients): compare Aside file identities without precision loss #3842. Semantic tests cover real consumers, private identity boundaries and negative paths.
• Combined privacy scan passed. Documentation static build passed at 2522264 (425 pages, 8.23s); the documentation subtree is unchanged by fix(clients): compare Aside file identities without precision loss #3842. Dependency installation used --frozen-lockfile --ignore-scripts. These checks did not run an application test suite.
• Historical candidate a8d5fa9 passed all25 jobs in CI34066373596 before later review refinements. Earlier fixture defects were fixed without weakening assertions: real CODEX_HOME directories, valid default config and future reset dates for current-measurement tests. Explicit expiry tests retain fixed simulated boundaries.
• Imported delivery-note contact addresses blocked privacy; documentation-only docs: keep delivery attribution without contact addresses #3836 removed them while retaining names and commit attribution. No scanner rule/allowlist changed.
• Windows Aside failures prompted fix(clients): compare Aside file identities without precision loss #3842's independently proven precision correction, but incident IDs were not captured. An unchanged provider-outbound test also timed out in an earlier run; its phase/root remains unmeasured and out of scope. A passing run does not establish that every intermittent failure has been eliminated.
• Final manual delivery order: fix(anthropic): preserve serving-account quota and upstream reset deadlines #3825 → fix(cli): distinguish stale CLI from stale running proxy #3826 → fix(responses): distinguish encrypted task recovery failure reasons #3827 → fix(clients): compare Aside file identities without precision loss #3842. Lower CI is deferred; superseded/duplicate runs are cancelled, never marked passing. The owner explicitly authorized admin merge and local/lower-CI exceptions; original commits and contributor trailers are preserved. No release/deployment.

Final merge proof: Cross-platform CI34074350604 passed all26 jobs at9470fdb1; Service34074351720 passed all3 platform jobs at the same head. All current review threads are resolved. Owner-authorized admin merge will preserve source commits/trailers and compare the resulting dev tree with90a75118402d2f310393bef9ac3e4668cfcbdcfa.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: b0aa48ee-1235-4b2e-b85a-fd4638a9a30d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

리뷰 · 우선순위 69 / 80

이 PR은 암호화된 agent task 복구가 실패했을 때, 예전처럼 전부 recovery_unavailable로 뭉개지 않고 이유를 나누는 #3661 잔여 수정입니다. 기준 dev(137d6a727)의 requestRecovery는 HTTP 거절·타임아웃·전송 오류·잘못된 SSE를 모두 null로 돌려, 캐시/호출 쪽도 “없다”와 “거절됐다”를 구분하지 못합니다. 베이스는 codex/axis1-version-guidance(#3826)이고, 런타임으로 앞 두 PR에 의존하지 않습니다. 머지 순서만 3825 → 3826 → 이 PR입니다. multipart 재조립·재시도는 범위 밖이고 #3661은 열어 둘 수 있습니다.

핵심 타입은 AgentTaskRecoveryResolution입니다. 성공만 assignment 문자열을 캐시에 넣고, 실패는 recovery_http_rejected / recovery_timeout / recovery_aborted / recovery_transport_error / recovery_invalid_output / caller_cancelled / recovery_unavailable(용량 거부 등 시도 전)로 공유 flight에 실립니다. 예전 resolveCachedAgentTaskRecovery(string|null) API는 어댑터로 남기고, 새 경로는 resolveCachedAgentTaskRecoveryWithResult를 씁니다. 성공 plaintext만 캐시하고, 엄격한 admission·호출자 로컬 취소 우선순위는 유지합니다.

requestRecovery는 응답이 ok가 아니면 body cancel을 await하지 않고(void … catch), 이미 죽은 취소가 복구 deadline을 늘리지 않게 합니다. body를 읽은 뒤에는 truncate/oversized/displaySafe 실패와 SSE에서 assignment를 못 뽑으면 recovery_invalid_output, 소유 timeout·body.timedOut이면 recovery_timeout, 호출자 abort면 recovery_aborted(바깥에서 최종 caller_cancelled로 덮을 수 있음)입니다. catch 절은 boundedBodyDecodeFailure로 UTF-8 디코드 실패와 timeout flush 출처를 가립니다. 디코더가 던진 객체만 WeakMap에 표시해서, 독자적인 reader/caller TypeError 정체성은 유지합니다.

src/lib/bounded-body.ts 변경은 그 표시기입니다. fatal UTF-8 경로와 timeout flush 경로를 구분해, 복구 층이 “깨진 바이트”와 “시간 초과로 flush하다 깨진 것”을 같은 invalid로 섞지 않습니다. 테스트는 HTTP 거절 시 pending/rejecting cancel을 기다리지 않음, headers/body/caller 지점별 timeout vs caller_cancelled 우선순위, 디코드 discriminator, 캐시가 실패를 넣지 않음을 고정합니다. 에러 JSON의 recovery_reason이 예를 들어 transport/invalid_output로 구체화됩니다.

지금 dev 대비 사용자 증상은 “복구가 안 됨” 자체보다 “왜 안 되는지 운영/이슈에 쓸 말이 없음”에 가깝습니다. 그래도 encrypted task 경로의 실패 분류는 지원·회귀에 바로 쓰이고, 성공 캐시 계약을 깨지 않으므로 axis1 꼭대기로 적절합니다. 누적 Cross-platform CI가 이 브랜치 tip에서 도는 전제와 맞습니다. 하위 체크 fail 배너는 메인테이너 예외로 해석합니다.

라인 - src/server/responses/agent-task-recovery.ts requestRecovery catch: boundedBodyDecodeFailure === "invalid_utf8" → recovery_invalid_output, "timeout" → recovery_timeout, 그 외 → recovery_transport_error. 호출자 abort가 있으면 먼저 recovery_aborted입니다.

경로/심볼 - resolveCachedAgentTaskRecoveryWithResult: flight wait 중 호출자 abort는 caller_cancelled이고, 공유 controller abort는 recovery_aborted입니다. 성공만 insertRecoveryCacheEntry합니다.

경로/심볼 - boundedBodyDecodeFailure: WeakMap 표시는 디코더가 던진 객체에만 붙습니다. reader/caller 오류에 잘못 붙지 않는 테스트가 있습니다.

경로/심볼 - 공개 recovery_reason 문자열 집합이 늘어납니다. 클라이언트/문서가 예전 coarse 값만 기대한 곳이 있으면 호환을 한 번 보면 좋습니다(아키텍처 문서는 이 PR이 갱신).

메인테이너의 판단이 필요한 지점

• #3661의 multipart/retry는 이 PR 밖으로 남길지(본문과 같음, 권장).
• 외부에 새 reason enum을 바로 노출할지, 로그/내부만 세부하고 wire는 coarse로 둘지(이 PR은 wire에도 세부 reason).
• 스택을 한 번에 랜딩할지, #3825만 먼저 넣고 진단 둘은 CI 보고 묶을지.

너의 추천
#3825·#3826 다음에 머지하세요. 캐시·admission 계약을 유지한 채 실패 분류만 늘리므로 회귀 면이 좁습니다. #3661은 multipart/retry 잔여가 있으면 열어둡니다. 랜딩 전 누적 hosted CI만 확인하면 됩니다.

이 댓글은 grok-bot이 작성했습니다

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T00:04:30.103013Z	a8d5fa9	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.