Problem
A scheduled Floom worker with a deterministic configuration error can create a failed run on every fire indefinitely.
Current code has two separate failure paths:
- Scheduler preflight creates a synthetic failed run for a declared missing secret.
- Run execution records a failed run and invokes the pause policy.
Only the execution path invokes the pause policy. The scheduler-preflight path can therefore repeat forever. The pause policy also recognizes only missing_secret, even though llm_model_not_configured is equally terminal until configuration changes.
The missed-fire path currently persists schedule_missed. The canonical taxonomy requested by downstream analytics is scheduler_missed.
Reproduction
- Create an enabled scheduled worker that declares a required secret.
- Do not configure the secret.
- Let the scheduler fire three times.
- Observe three synthetic failed rows with no engine-level worker pause.
Acceptance criteria
- Synthetic scheduler preflight failures participate in the same consecutive-failure policy as execution failures.
- Threshold defaults to 3 and remains configurable.
missing_secret and llm_model_not_configured are terminal configuration codes.
- Consecutive scheduled failures from transient classes such as timeout, E2B transport, or provider errors do not pause the worker.
- The third qualifying failure sets
enabled=false and writes the existing paused manifest state once.
- Missing-secret failures persist
error_code=missing_secret at the failure site.
- Missed scheduler fires persist
error_code=scheduler_missed at the failure site.
- Tests cover two failures, the third failure, mixed errors, manual provenance, and transient exclusions.
Cloud owner notification and multi-tenant persistence are intentionally outside this public issue.
Problem
A scheduled Floom worker with a deterministic configuration error can create a failed run on every fire indefinitely.
Current code has two separate failure paths:
Only the execution path invokes the pause policy. The scheduler-preflight path can therefore repeat forever. The pause policy also recognizes only
missing_secret, even thoughllm_model_not_configuredis equally terminal until configuration changes.The missed-fire path currently persists
schedule_missed. The canonical taxonomy requested by downstream analytics isscheduler_missed.Reproduction
Acceptance criteria
missing_secretandllm_model_not_configuredare terminal configuration codes.enabled=falseand writes the existing paused manifest state once.error_code=missing_secretat the failure site.error_code=scheduler_missedat the failure site.Cloud owner notification and multi-tenant persistence are intentionally outside this public issue.