TDD 0067: /build-tdds Retry and escalation, judged by the model that actually ran

[cahenesy]

Implements TDD 0067 revision 2 (PRD f6ef178, ADR 0015 + ADR 0016). This is the last of the model cost/performance stack; 0064–0066 are already on master.

What changed

• Retry (step 3). A TDD that halted on a gate FAIL can be retried. The implementer fixes the failure on the existing build branch, using the failed gate's report, and then every gate re-runs.
  • Halt-time verdicts are archived into retry-<N>/, so an interrupted Retry resumes at test-first.
  • The step-3 prompt now also appears when every TDD in the run has failed.
• Escalation (FR-88). --escalate / THROUGHLINE_ESCALATE=1, or automatic on a Retry when the TDD hasn't changed since the halt. --no-auto-escalate turns the automatic case off.
  • The decision is made before the queue confirmation and shown there, and recorded in the per-TDD sidecar.
• Outcomes are judged by the model that actually ran (ADR 0016). After each escalated worker, tl_escalation_verify reads subagents/agent-<id>.jsonl:
  • a different family, or a model that can't be read, records fell-back with a reason;
  • credits_required counts as a fall-back, not a pause;
  • a substituted worker's output is kept, and the TDD's later workers inherit the parent model.
• Live probe tests/live/escalation-probe.sh (run only in the verify gate): P1 uses the escalation binding, P2 a bogus model, P3 is a positive control on opus. It handles both sync and async Agent streams.
• tests/escalation.test.sh: 303 checks, run against the real functions and the blocks extracted from the skill.
• Version 3.48.0 → 3.49.0, plus a releases.json entry.

History

The first build halted BLOCKED at runtime-verify, which was correct:

• The probe found fable refused with credits_required when run headless.
• In this interactive session, a fable dispatch silently ran claude-opus-5-5.
• The TDD was revised (design: TDD 0067 rev 2 + ADR 0016 (escalation judged by the model that actually ran) #186, plus ADR 0016), and this Retry continued on the same branch rather than rebuilding.

Gates (retry)

Gate	Result
test-first	PASS (abf96dd test(failing) was red on the pre-retry code, then 835ac7d feat)
ci-checks	PASS (10 evals; escalation 303/0)
runtime-verify	PASS: 15/15 observations. Live probe exit 0: P1 fable refused → fell-back, P2 refused, P3 opus → escalated. P3's transcript was checked independently and reads claude-opus-5-5.
review	PASS: no blockers or majors

Review follow-ups (not blocking)

• Minor: dispatch-error text reaches a double-quoted shell argument in the fall-back prose (SKILL.md:346). Pass it via an env var instead.
• Minor: the implementer's rate-limit rule doesn't point to the credits_required exception (SKILL.md:421), so a credits refusal could be classed as a pause and the refused model re-dispatched on every resume.
• Minor: each probe run leaves ~/.claude/projects/-tmp-tmp-* session folders behind. The cleanup trap should delete them.
• Minor: tl_run_retry_begin splits the .prev.txt copy and the report= line between the function and the skill block, and names the copy differently from the TDD (<slug>.<gate>.prev.txt). It works and is tested; the TDD wording should be aligned.
• Nits:
  • TL_BASE_SHA isn't validated;
  • an exact-id override does match, so the TDD's "never matches" is too strong;
  • family matching accepts older versions of the same family.

After merging

claude plugin update throughline@throughline, then /reload-plugins, to get 3.49.0.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ki3TDnP2bNqqpEkFoZaEXq