Summary
probeReesSecretAtStartup in src/review/enrichment-wire.ts already detects a REES shared-secret mismatch (401/403) at boot and logs rees_secret_mismatch, but buildReviewEnrichment has no mechanism to act on that — it keeps calling /v1/enrich on every single PR review, each one failing the same way, for the whole process lifetime until a manual restart. Each failure also logs review_context_fetch_failed, adding noise without new information.
Fix
Add a module-level circuit breaker: once the startup probe confirms an auth rejection, skip subsequent /v1/enrich calls for the rest of the process (with capped logging so the skip doesn't itself spam the logs), rather than repeating a call that is confirmed to fail. A non-auth probe failure (e.g. a 500) must not trip the breaker, since that isn't a confirmed secret mismatch.
This mirrors the approach in the closed PR #3738.
Validation
Unit tests covering: default-closed (proceeds normally), trips-and-skips on a confirmed 401, log volume capped at 3 occurrences, and a non-auth failure (500) does not trip the breaker.
Summary
probeReesSecretAtStartupinsrc/review/enrichment-wire.tsalready detects a REES shared-secret mismatch (401/403) at boot and logsrees_secret_mismatch, butbuildReviewEnrichmenthas no mechanism to act on that — it keeps calling/v1/enrichon every single PR review, each one failing the same way, for the whole process lifetime until a manual restart. Each failure also logsreview_context_fetch_failed, adding noise without new information.Fix
Add a module-level circuit breaker: once the startup probe confirms an auth rejection, skip subsequent
/v1/enrichcalls for the rest of the process (with capped logging so the skip doesn't itself spam the logs), rather than repeating a call that is confirmed to fail. A non-auth probe failure (e.g. a 500) must not trip the breaker, since that isn't a confirmed secret mismatch.This mirrors the approach in the closed PR #3738.
Validation
Unit tests covering: default-closed (proceeds normally), trips-and-skips on a confirmed 401, log volume capped at 3 occurrences, and a non-auth failure (500) does not trip the breaker.