Bounded self-healing

Write-capable implement calls are reported with their partial transcript and workspace delta after a timeout; they are never automatically retried.

A bridge call performs at most one remedy. It writes one incident record for every fault and attempts one optional health.jsonl append for every completed call, including unsuccessful calls; unsafe telemetry paths or health I/O failures preserve the original result and add a sanitized nonblocking warning to public findings.

turn.failed with reasoning.effort or an equivalent structured Claude error may trigger one supported-effort substitution. A missing or unauthenticated CLI, a permission refusal, an unknown fault, or a repeated substitution is reported without retry. Timeout retry is limited to read-only verbs; implement is reported with its partial transcript and workspace delta. An unavailable model and a stale resume session are also reported without remedy: bridge does not maintain a model fallback ladder, and no verified structured signal distinguishes a stale session from other resume faults.

An output-limit incident is terminal and never automatically retried. Ordinary raw records and every compacted record have a 256 KiB ceiling. Only a parsed prefix proving item.completed and command_execution before an aggregated_output string permits a temporary raw record up to 8 MiB; type fields after the string do not qualify. The full record must validate and compact within 256 KiB, with non-output fields also fitting 256 KiB. Other oversized or malformed records remain terminal; retained stdout/stderr still share the 256 KiB capture cap. When the envelope's incident path is present, open its JSON file and inspect the fault. Codex prompts warn that command text counts against the derived capture cap: started command text becomes size/digest, completed commands keep at most a UTF-8-safe 4 KiB prefix with size/digest when truncated, and completed command output becomes size/digest. Claude prompts require compact final JSON within the same cap; read-only prompts state files cannot be written. Optional Codex-only partial_output in the envelope and incident holds at most 4 KiB of the last complete agent message; label it an unverified fragment and use it only to scope a split follow-up, never as findings or a verdict. For read-only work, inspect bounded transcript, make fresh requests split by explicit files, modules, symbols, or independent questions with bounded tool output, and reconcile all scopes before accepting a result. For implement, inspect worktree delta and changed files first, then request only verified remaining work in a separate bounded task. Follow-up briefs must keep commands small with no inline scripts or data. Never treat a truncated transcript as a completed result.

Incident records contain classified fault and reason, model, effort, verb, duration budget, transcript path, and any killed-implementation workspace delta. They deliberately exclude child arguments and environment data because task text and credentials may be present there. Bounded transcript omits completed Codex command-output payloads but records their UTF-8 byte counts and SHA-256 digest; digest does not reconstruct discarded output, and capture savings do not prove provider token savings. Stderr is never the primary fault classifier.