R16: Generalize embedding HTTP resilience

[100yenadmin]

Port provider-neutral bounded attempts, Retry-After handling, retry cap, minimum interval, cancellation, checkpoint, and idempotent resume. Retain GITNEXUS_EMBEDDING_MAX_ATTEMPTS, GITNEXUS_EMBEDDING_RETRY_CAP_MS, and GITNEXUS_EMBEDDING_MIN_INTERVAL_MS; provider-specific defaults remain fork configuration.

Acceptance: retries are bounded, cancellation stops promptly, resume is idempotent, and no secret appears in logs or persisted state.

Validation: deterministic 429, 5xx, transport interruption, cancellation, and restart tests.

Parent epic: #39

Tracking ID: R16

[100yenadmin]

R16 implemented at 8970429dea73bd35283f7eea8046cd3594010f64 and opened as PR #78. Focused resilience/resume matrix: 173 passed; broader embedding/server matrix: 85 passed; typecheck and full build passed. Includes real cancellation, durable checkpoints, idempotent hash resume, model/dimension drift refusal, and nested-cause credential redaction. No live index or runtime state changed.

[evaos-code-review-bot]

evaOS issue enrichment

Issue: #55 - R16: Generalize embedding HTTP resilience
State: open; milestone: GitNexus v1.6.10 Reconciliation - Sprint 3 - Retrieval Resilience and Scale Proof

Related issues/PRs: #39.
Existing labels: reconciliation, P1, evidence-gate, upstream-candidate.
Suggested labels: security, tests.
Suggested owners: none.

Related context

• EPIC: Reconcile evaOS GitNexus with upstream v1.6.10 #39 - mentioned in issue metadata; inspect for dependency, duplicate, or prior-decision risk.

Agent-start packet

Problem shape: R16: Generalize embedding HTTP resilience - Port provider-neutral bounded attempts, Retry-After handling, retry cap, minimum interval, cancellation, checkpoint, and idempotent resume. Retain GITNEXUS_EMBEDDING_MAX_ATTEMPTS, GITNEXUS_EMBEDDING_RETRY_CAP_MS,
Product fit: Architecture/integration issue; check repo policy, prior decisions, and operational constraints before implementation.
Implementation wedge: Start with a bounded adapter/contract or dry-run packet before changing live runtime behavior.

Build / borrow / buy scan:

• Build: identify the smallest implementation wedge that proves the issue without broad rollout.
• Borrow: inspect same-repo prior art, repo memory, GitNexus context, and allowlisted cross-repo examples first.
• Buy/use: deferred; no product, architecture, UX, library-choice, integration, roadmap, or market-positioning trigger detected.

Candidate sources:

• VISION.md / repo policy / repo-memory.md / GitNexus packet.
• Same-repo issues and PRs referenced by issue metadata.

Acceptance criteria:

• Preserve and execute the issue's stated acceptance criteria.
• Include source citations for any external OSS/library/current-market claims.
• Keep issue-enrichment comments sticky and idempotent.
• Keep labels, owners, reviewers, and roadmap fields suggestion-only.

Proof plan:

• Focused unit/fixture test for the changed planner behavior.
• Dry-run issue-enrichment evidence packet before live comment posting.
• Redaction check for issue body, citations, and generated markdown.
• Contract or degraded-mode proof before runtime promotion.

Known traps:

• Do not treat related links as proof by themselves; each source needs a reason why it matters.
• Do not scan old issue backlogs or exceed repo-level enrichment throttles.

Non-goals:

• Do not auto-apply labels, owners, reviewers, roadmap fields, or milestones.
• Do not bulk-enrich old backlog issues from this planner output.
• Do not claim external market or OSS research was performed unless cited sources are present.

Context-source taxonomy:

• [enabled] vision_repo_policy_memory_gitnexus: Use repo vision, policy, memory, and GitNexus first before external research.
• [enabled] same_repo_issues_prs: Issue metadata contains same-repo references.
• [deferred] allowlisted_cross_repo_github: Deferred until product, UX, market-positioning, or library-choice signal appears.
• [deferred] external_oss_examples: Deferred for low-research-value issue class.
• [deferred] library_api_docs: Deferred unless a library/API decision is present.
• [deferred] current_market_examples: Deferred for implementation-only issues.
• [enabled] internal_mcp_docs: Use internal docs/MCP context when available; missing context is degraded, not blocking.

Validation suggestions

• Confirm owner, acceptance criteria, and validation evidence before implementation.

Triage gaps

• Owner or reviewer signal not detected in issue body.

No labels, owners, reviewers, or roadmap fields were changed by this bot.

[100yenadmin]

Checkpoint update: the HTTP resilience review found and fixed a P0 resume-integrity gap before promotion.

A process stop after only some chunks of a multi-chunk node were inserted could leave a current node hash on a partial row. Hash-only resume then skipped the node and silently retained missing chunks.

Internal follow-up f32f14ecd3c7ab151efb5a88510ba332c3381af0 on PR #78 now:

• writes a bounded pending-node window before mutation;
• checkpoints LadybugDB before clearing it;
• forces matching-hash pending nodes through delete plus complete regeneration;
• deletes rows for pending nodes that are no longer embeddable;
• applies the contract to CLI analysis and /api/embed;
• retains the repository lock until cancelled work actually stops; and
• rejects model/dimension mismatch before mutation.

Focused proof on the RC19 stack: build pass, typecheck pass, formatting pass, git diff --check pass, and 183/183 focused tests pass. Remote CI on the new head is the remaining cross-platform gate.

Sanitized upstream artifacts: abhigyanpatwari#2467 and abhigyanpatwari#2468.

Evidence: /Volumes/LEXAR/Codex/session-notes/2026-07-13/gitnexus-fork-upstream-reconciliation/r16-partial-window-resume-evidence.md

[100yenadmin]

R16 acceptance complete at fork PR #78 head f32f14ecd3c7ab151efb5a88510ba332c3381af0.

Proof includes bounded 429/5xx/transport retries, Retry-After capping, deterministic pacing, cancellation, credential redaction, pending-node checkpoint windows, matching-hash forced resume, disappeared-node cleanup, model/dimension refusal before mutation, API cancellation, and lock lifetime. Focused validation passed 183 tests plus build, typecheck, formatting, and diff integrity. The failed-only Windows rerun completed successfully, leaving 33 exact-head checks green and zero pending or failing.

Sanitized upstream sharing is abhigyanpatwari#2467 / PR abhigyanpatwari#2468. Upstream acceptance is non-blocking. The stacked fork PR remains open for R24 source integration; closing this implementation issue does not merge, publish, deploy, or mutate a live index.