[aw-failures] [P1] Fix Claude Code CLI → Anthropic API connection-refused failures (proxy/firewall)

[github-actions]

Fix the cli-proxy/squid egress path for Claude Code CLI — it dropped connections to the Anthropic API mid-run twice in 6 hours.

Two runs failed at the Execute Claude Code CLI step with API Error: Connection refused:

• §31548182853 — Daily Documentation Healer — failed after 2 turns / 19m12s; harness exhausted 4 retry attempts × 10 nested api_retry each.
• §31535557507 — Daily Caveman Optimizer — same failed step, 0 completed turns (connection refused before the first response), consistent with the same proxy issue firing even earlier.

Probable root cause: the cli-proxy → squid → api.anthropic.com egress path intermittently refuses connections. audit-diff between the two runs shows zero firewall/domain/status/volume changes, ruling out a new allowlist gap — this is an availability/connectivity issue in the existing proxy chain, not a config drift.

Proposed remediation:

1. Pull squid/cli-proxy sidecar logs for 2026-08-11 ~22:00–00:10 UTC and check for refused connections, restarts, or resource exhaustion.
2. Cross-check the Anthropic status page for a transient outage in that window vs. a local proxy issue.
3. Add a proxy health-check/backoff before the first Claude Code CLI turn — the 0-turn failure indicates the harness fails fast on a cold/unready proxy instead of retrying with backoff.

Success criteria: Daily Documentation Healer and Daily Caveman Optimizer complete 3 consecutive scheduled runs without Connection refused. If root cause is a confirmed transient upstream Anthropic outage, close with that note and keep monitoring.

Analyzed run IDs: 31548182853, 31535557507 (audit + audit-diff). Parent: #52061.
Related to #52061

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 221.7 AIC · ⌖ 47.4 AIC · ⊞ 5.3K · ◷

• expires on Aug 18, 2026, 5:27 PM UTC-08:00