fix(sieve): stop classing every undeclared exec exit as network (#562)

[mlieberman85]

Summary

When an exec step's command exited with an undeclared code, _classify_exec_failure labelled it error_class=network unless stderr matched an auth or rate-limit pattern. Local failures read as network problems as a result. In one full test run, 232 of 242 error_class=network warnings came from this path. The most common causes were:

• grep finding no .github/workflows/ (105);
• commands that exited with nothing on stderr (50);
• fatal: not a git repository (35).

With this change:

• New error class unexpected_exit: a command exited with a code its step did not declare, and nothing in its output identified the cause.
• Classification, first match wins:
  • rate limit -> rate_limit;
  • auth (adds "not logged in") -> auth;
  • exit 127, "command not found", or <executable>: not found -> missing_tool;
  • recognizable connection failures -> network. These are DNS, refused or reset connections, unreachable hosts, connection timeouts, and TLS or certificate errors. An HTTP status reply such as git's "The requested URL returned error: 404" is excluded, because the server answered;
  • anything else -> unexpected_exit.
• The step message names the command and exit code, plus a stderr excerpt of at most 200 characters on one line, or "(no stderr)".
• Unchanged: the classification for MCP, gh_api, timeouts, and crashes.

After the change, the same test run has 10 error_class=network warnings, all from MCP.

Spec changes were made first:

• docs/architecture/framework-design.md: section 3.3 gains a decision table and a scenario; section 5.2 adds the class to the list.
• specs/036-tier2-error-class/contracts/error-class-addendum-562.md: unexpected_exit replaces network as the catch-all for undeclared exec exits.

Closes #562

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Anything that filtered on error_class == "network" for undeclared exec exits sees unexpected_exit now; the CHANGELOG notes this under Changed.

Framework Changes Checklist

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed
• Ran uv run python scripts/validate_sync.py --verbose and it passes

Testing

• Tests pass locally (uv run pytest tests/ -v): 5210 passed, 29 skipped
• Added tests for new functionality (if applicable)
• Linting passes (uv run ruff check .)

New tests:

• a 36-row classifier table test;
• tests for the step message: command, exit code, and stderr excerpt;
• rendering tests for summary JSON, SARIF, the attestation predicate, markdown, and CLI text.

Also passing: the corpus gates, and the integration tests with GitHub Actions environment variables set (334 passed).

AI assistance

• No AI assistance was used
• AI assistance was used

Claude (Claude Code, claude-opus-5-5) made this change: spec, code, and tests. This description was also drafted with Claude. Commits carry an Assisted-by: Claude:claude-opus-5-5 trailer.

Additional Notes

An undeclared exit keeps the step INCONCLUSIVE. When nothing else concludes, the control ends WARN with the generic message. The new cause is in the WARN log line and the step's pass history.

🤖 Generated with Claude Code