Addresses #323. Doesn't close it: the four unseeded profiles and the zero-token timeout heuristic are still open, and so is the claude gap described below.

A provider usage-limit error wasn't recognised as an environment fault. The loop recorded env_fault: false, spent max_dev_attempts on the story, deferred it, and moved to the next story, which hit the same wall. One 5-hour quota window turned into three deferred stories and seven dead sessions, four of which consumed zero tokens. The specs were fine. The first story of the run completed and merged on the same adapter and model, it just happened to be the one that exhausted the quota.

The structural half

run() has always called _classify_env_fault for every adapter. The implementation lived on GenericAdapter, and OpencodeHttpAdapter is its sibling rather than its subclass, so the base identity no-op applied and the feature was absent. The base docstring justified that with "adapters with no post-mortem signal (HTTP/mock)", which stopped being true once opencode_http started teeing the serve process's stdout to logs/<task_id>.log. That's the exact file the classifier reads.

The classifier now lives in adapters/env_fault.EnvFaultMixin and both adapters mix it in. The signal is the log, not the transport, so any adapter that writes logs/<task_id>.log inherits it instead of re-omitting it. Patterns compile lazily off self.profile, so mixing the class in is the whole wiring step. There's no __init__ line to forget, which is how this got missed the first time.

One profile seeds patterns, on purpose

opencode.toml is anchored on the structured field the serve process emits, error.error="AI_APICallError: ...", and verified by replaying the shipped profile through the mixin over a real outage's logs. Four sessions classify, the healthy merged story's three don't, and the first hit lands on story 2's second attempt. That's where the run now pauses instead of marching into stories 3, 4 and 5.

codex, gemini, copilot and antigravity stay inert. I drafted patterns for all four and withdrew them. They could only be written from error strings scraped off public issue trackers, for CLIs I haven't run, and an unverified pattern isn't a neutral bet. The tmux adapters match against a pane capture that contains the model's own output, so a pattern that fires on a story which merely implements rate limiting pauses a healthy run. That's worse than the miss, because the miss only reproduces current behaviour. An adversarial pass demonstrated it on realistic fixture and assertion text before any of them shipped.

I also drafted a quota pattern for claude.toml and withdrew it for the same reason, so that profile is untouched. An Anthropic plan's usage limit is still unclassified on that adapter. Its existing connection pattern already matches ordinary prose about provider errors, including this repo's own CHANGELOG and docs, so a bmad-loop session working on bmad-loop is exposed. That's pre-existing #194 debt. It's now pinned by an xfail(strict) test rather than left undocumented, and fixing it needs a captured Claude Code quota line plus a stronger anchor than "API Error".

Which file gets scanned is part of the contract

Rebasing onto current main turned up a fourth defect, and it's the one worth reading.

The readable-logs work repurposed opencode's logs/<task_id>.log. It's now the curated [bmad] conversation transcript written by the SSE reader, and the server's own stdout moved to <task_id>.server.out. The classifier was still scanning .log, which breaks two things at once. The provider's AI_APICallError lines aren't there any more, so nothing would ever classify. And the patterns are only sound against a log the model can't write to, so pointing them at a transcript of the model talking would have made the verbatim-citation false positives live.

EnvFaultMixin now has ENV_FAULT_LOG_SUFFIX, and the opencode adapter overrides it to .server.out. The safety property is documented at the override, because it's a property of the file, not of the patterns.

None of the unit tests caught this. They write their fixture to whatever path the code resolves, so they agree with any answer. The only thing that caught it was the end-to-end test through run(), which exists because a reviewer flagged its absence as the lowest-severity finding in the whole review.

Also fixed in the classifier

Three more defects, all found by adversarial review rather than by me.

The 64 KiB tail seek lands on an arbitrary byte, so the line straddling the window edge arrived as a fragment whose head could be a U+FFFD from the errors="replace" decode. That fragment is discarded now, unless discarding it would leave nothing to scan.

_excerpt marked a dropped prefix but silently dropped a suffix, so a truncated excerpt read as a complete line that ended there. Both ends are marked, and the markers are spent from the evidence budget rather than added on top of it.

The evidence window is centred on the match and slides left when the match sits near the end of the line. opencode's logfmt puts around 250 characters of metadata before error.error=, so before this the operator saw every field except the failure. The quota evidence now reads through to the reset timestamp.

Tests

Corpora are split three ways: lines that must classify (captured from the outage), lines that must not (realistic healthy-session output), and lines that pin the limit of the approach. A story quoting a provider error verbatim produces a line byte-identical to the emitted one, so it matches, and no content-based pattern can separate them. That's tolerable for opencode only because the file it scans is <task_id>.server.out, which the model can't write to. It's asserted positively so it can't change quietly, and that assertion is the one that will fire if the scanned file is ever repointed at something carrying model output again.

Reachability of the bait is asserted too. That corpus was briefly vacuous, guarding nothing while looking thorough, after the profile it had been written for was withdrawn.

Correlation ids in the corpora are fakes. The run they came from is a private project.

Verification

3323 passed, 42 skipped, 5 xfailed. The xfails are all the claude debt test. ruff, black, isort and pyright clean.

The replay over the original outage logs was re-run after the rebase, with the log suffix overridden, because that run predates the .log / .server.out split and its captured bytes were written when .log was still the server sink. Same four sessions classify, the healthy story's three still don't.

Summary by CodeRabbit

• New Features
  • Improved detection of provider quota, rate-limit, and connection/transport environment faults.
  • OpenCode HTTP sessions now analyze captured server logs to determine whether a timeout is fault-related.
  • Fault results now include concise evidence excerpts for easier diagnosis.
• Bug Fixes
  • Avoids misclassifying healthy timeouts and completed sessions as environment faults.
  • Prevents reuse of stale per-task log output when re-running with the same task id.
  • More robust evidence handling for truncated or missing logs.
• Tests
  • Added and expanded pattern and evidence extraction coverage, including OpenCode end-to-end regressions.