[Incident] Claude lane infrastructure failure

[github-actions]

Claude lane infrastructure incident

The Claude review lanes reported an infrastructure failure that no retry
clears. The lanes are advisory and conclude green by design, so their
checks look healthy — this issue is the only signal that PRs in the
repositories below went unreviewed.

• First seen: 2026-08-16T06:57:58.003Z
• Last seen: 2026-08-16T07:44:42.275Z
• Consecutive clean cycles: 3 of 3 (auto-closes at 3; only cycles whose coverage of this incident is complete count — see step 5)
• Observed api_error_status: 429 (9)
• Repositories affected: 3
• Unrecognized class= tokens seen: 0

Failure classes

Counts are the peak number of distinct pull requests seen failing this way
in any single polling window, not a running total of annotations.

Class	Peak affected pull requests	Escalating
other	4	no
rate-limit	9	storm (>=3 PRs in one cycle)

Affected repositories

Repository	Classes	Pull requests
melodic-software/ci-workflows	rate-limit	#477
melodic-software/claude-code-plugins	other, rate-limit	#2686, #2689, #2694, #2696, #2804, #2805, #2810, #2811
melodic-software/provisioning	rate-limit	#293, #294, #295, #298

Remediate

1. auth — the org credential is unusable until a human acts. 401
   rotate or replace the token; 402 fix billing or entitlement in the
   Claude Console; 403 fix key permissions and workspace access.
2. runner — the lane could not resolve a runner; check the governed
   runner fleet and the caller's selector inputs.
3. rate-limit at storm density (>=3 distinct PRs in one polling
   window) — the shared org seat's usage window is exhausted, and every
   PR merging until it lifts goes unreviewed. Check the seat's usage and
   quota in the Claude Console; re-review the PRs that merged during the
   window. A singleton 429 never opens this issue — it is listed above
   only as context when an incident is already open.
4. Confirm the lanes are ENABLED before waiting for this to close. A
   kill-switched lane still publishes a name-stable skipped check, and a
   skip is not evidence the lanes ran — so while CLAUDE_LANES_DISABLED
   (or a per-lane switch) is set, this issue can never auto-close.
5. A clean cycle counts only when its coverage of this incident is
   complete: the tracked index still names repositories, it polled every
   repository the incident TRACKS, and the tracked index accounts for
   every repository the incident has SEEN. That index is the durable
   record behind this report, not the table above — the table is capped
   separately, so a fleet-wide incident tracks more repositories than it
   lists, and can have seen more still. An index that names nothing has
   nothing to poll and nothing to account for, so those two conditions
   read as met while no cycle can count.
   Polling scope is the aggregator App's installation, so a missing App
   credential narrows it to this repository and stops the count without
   failing anything; the run log's coverage= field and its warning
   annotation name what went unobserved. Three causes hold an incident
   open for good, and none of them recovers on its own — each is closed by
   hand once you have confirmed the lane failures behind it are addressed:
   a repository that is gone — archived, or removed from the
   installation — can never be covered again; an incident wider than the
   tracked index can never account for what the index dropped; and an
   index this watchdog can no longer read — hand-edited, or written by an
   older schema, which a version bump does to every open incident at
   once — names nothing a cycle could cover.
6. Re-run the affected lane jobs once the cause is fixed, then let this
   watchdog observe 3 consecutive covered clean cycles; it closes itself.

---

Maintained automatically by .github/workflows/claude-lane-incident-aggregator.yml.
Only allowlisted class tokens and validated identifiers are reported here —
no annotation text, and no model-authored content, is ever copied into this issue.
Closing this by hand while the failure persists reopens it on the next cycle.

[github-actions]

Routed to the attended queue: this incident needs a human.

An incident opens only on an escalating failure, and recovery
needs a human — auth: rotate, re-entitle, or re-permission
the org credential; runner: repair the governed runner fleet;
rate-limit at storm density: restore the shared seat's usage
headroom and re-review what merged unreviewed. No autonomous
session can do any of those, so this issue carries the
human-gated role label plus this marker, which together
surface it as [escalated] in the attended queue.

Posted automatically by .github/workflows/claude-lane-incident-aggregator.yml.

[github-actions]

The Claude lanes have reported three consecutive clean cycles with no escalating failure; closing this rolling incident.