infra_auth: dev-mesh-triage/backlog/security failing — Claude session rate limit (429), 2026-07-05 (6 runs, self-resolved)

[github-actions]

Triager classification

Label: infra_auth
Action: Escalate to human — do NOT re-kick, do NOT attempt a code fix.

---

Failing runs (all 2026-07-05 UTC)

Run ID	Workflow	Time (UTC)	Error
28748701338	dev-mesh-backlog	17:19	rate_limit, HTTP 429
28750242294	dev-mesh-triage	18:14	rate_limit, HTTP 429
28750891360	dev-mesh-backlog	18:38	rate_limit, HTTP 429
28752622509	dev-mesh-triage	19:42	rate_limit, HTTP 429
28752951777	dev-mesh-security	19:54	rate_limit, HTTP 429
28753607198	dev-mesh-backlog	20:18	rate_limit, HTTP 429

All six share the identical terminal claude-code-action result envelope:

{
  "type": "result",
  "is_error": true,
  "api_error_status": 429,
  "result": "You've hit your session limit · resets 8:20pm (UTC)",
  "error": "rate_limit"
}

(preceded by a "type": "rate_limit_event" block with the same reset-time text).

Classifier reasoning

Applied src/dev-mesh/classify.js with precedence: infra > out-of-scope > flake > real_bug.

• infraError — INFRA_RE does not currently match rate_limit/429/"session limit" literally (it covers auth/network/HTTP 529/api overloaded patterns only).
• ranAnyTest = false — no # tests N TAP output; these are claude-code-action jobs that errored before any node --test run started (duration_ms in the low hundreds, well under fastFailMs).
• Classification path: !ranAnyTest → INFRA_AUTH ("no test executed before exit"), same path used for the earlier HTTP-529 incidents (infra_auth: dev-mesh-intake failing with HTTP 529 (Claude API overloaded) — 4 runs, 2026-06-22 #418, [triage] infra_auth — dev-mesh-intake failing: Claude API overloaded (HTTP 529) #456, infra_auth: persistent HTTP 529 API overload in dev-mesh-intake (8+ failures, 2026-06-22–23) #482).
• By spirit: an explicit Claude Code session/usage-limit response is a platform quota condition, not a code bug — same class as the 529-overload precedent.

Why NOT flake / NOT real_bug

Precedence infra > flake > real_bug — an infra_auth is never re-kicked or handed to the Coder. There is no diff to relate a "real_bug" classification to: none of these are PR CI runs, they're the mesh's own scheduled automation (dev-mesh-triage/dev-mesh-backlog/dev-mesh-security) hitting the OAuth key's own usage ceiling.

Current status: self-resolved

The reported reset time (8:20pm UTC) has passed. Scheduled runs of the same workflows after ~20:20 UTC (e.g. dev-mesh-triage at 21:17:49Z, dev-mesh-backlog at 21:34:24Z and later) are back to success. No human action is required to unstick anything right now — filing this for the record per the infra_auth precedent (#418/#456/#482) and as a signal that INFRA_RE in src/dev-mesh/classify.js could optionally be extended with a rate_limit/429/"session limit" pattern so future occurrences classify via infraError = true directly rather than falling through to the !ranAnyTest branch — not doing that edit here since Triager does not edit code.