classifier 0.6.2 and kit 0.8.2: count a runner's own authentication retry

Routing section 9.3 treats an API key's authentication refusal as refused
for any use only once it "persists after the runner's own retry". Kit
0.8.1's routed checks required exactly one provider call per selection for a
401, so a runner retrying once on the same account failed two cases on the
count alone.

Classifier CONTRACT section 6.8 now pins the bound: a runner's own retry of
an authentication refusal is at most one more request on the same account
and selected model, is not a reselection, and never moves the batch to
another model. The kit accepts one or two calls per selection for the
refused item, keeps answered items at one call and unsent items at zero,
and requires a replay to add no provider call. The initial-failure case
keeps 0.8.1's rule that its optional reselection may pick a new model.
Self-tests accept one retry and reject two by check name.

Author: ualtinok

Cargo.lock

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.8.2
+
+- Pin classifier 0.6.2 and allow its runner-owned single authentication
+  retry in the routed initial and partial account-failure checks, without
+  allowing extra selections, model changes or provider calls on replay.
+- Keep answered items at one call and unsent items at zero. Add self-tests
+  that accept one authentication retry and fail a runner that retries twice.
+
 ## 0.8.1
 
 - Pin classifier 0.6.1, whose catalog check accepts `decision` rows. The

crates/cortexkit-role-classifier-conformance/CHANGELOG.md

@@ -7,7 +7,7 @@
 # production build never compiles the suite.
 [package]
 name = "cortexkit-role-classifier-conformance"
-version = "0.8.1"
+version = "0.8.2"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
@@ -17,7 +17,7 @@ publish = true
 
 [dependencies]
 async-trait = "0.1"
-cortexkit-role-classifier = { version = "=0.6.1", path = "../cortexkit-role-classifier" }
+cortexkit-role-classifier = { version = "=0.6.2", path = "../cortexkit-role-classifier" }
 futures-util = { version = "0.3", default-features = false }
 serde = { version = "1", features = ["derive"] }
 serde_jcs = "0.2"

crates/cortexkit-role-classifier-conformance/Cargo.toml

@@ -181,12 +181,12 @@ impl<S: ClassifierSubject> Suite<'_, S> {
             }
             let log = self.routing_log().await?;
             if !(1..=2).contains(&log.selections)
-                || log.provider_requests.len() != log.selections
-                || self.calls(&key).await != log.selections
+                || !(log.selections..=2 * log.selections).contains(&log.provider_requests.len())
+                || self.calls(&key).await != log.provider_requests.len()
                 || self.calls(&unsent_key).await != 0
             {
                 return Err(
-                    "initial account failure exceeded one reselection or sent a later item".into(),
+                    "initial account failure exceeded one reselection or one authentication retry per selection, or sent a later item".into(),
                 );
             }
         } else if name == "routed_partial_failure_keeps_model" {
@@ -212,20 +212,33 @@ impl<S: ClassifierSubject> Suite<'_, S> {
                 return Err("partial account failure did not fail the unanswered items".into());
             }
             let log = self.routing_log().await?;
+            let answered_calls = self.calls(&key).await;
+            let refused_calls = self.calls(&failed_key).await;
+            let unsent_calls = self.calls(&unsent_key).await;
             if log.selections != 1
-                || log.provider_requests != vec![first.clone(), first.clone()]
-                || self.calls(&unsent_key).await != 0
+                || answered_calls != 1
+                || !(1..=2).contains(&refused_calls)
+                || log.provider_requests.len() != answered_calls + refused_calls
+                || log
+                    .provider_requests
+                    .iter()
+                    .any(|decision| decision != first)
+                || unsent_calls != 0
             {
-                return Err("partial account failure selected again or mixed models".into());
+                return Err(
+                    "partial account failure selected again, mixed decisions or exceeded one authentication retry".into(),
+                );
             }
             self.script_answer(&failed_key, noul_body("0.25", None))
                 .await;
             let replay = Self::routed_reply(self.send(&request.to_string()).await?, first)?;
+            let replay_log = self.routing_log().await?;
             if replay != reply
-                || self.routing_log().await?.selections != 1
-                || self.calls(&key).await != 1
-                || self.calls(&failed_key).await != 1
-                || self.calls(&unsent_key).await != 0
+                || replay_log.selections != log.selections
+                || replay_log.provider_requests != log.provider_requests
+                || self.calls(&key).await != answered_calls
+                || self.calls(&failed_key).await != refused_calls
+                || self.calls(&unsent_key).await != unsent_calls
             {
                 return Err(
                     "partial account failure was retried instead of replayed from storage".into(),

crates/cortexkit-role-classifier-conformance/src/checks/routed.rs

@@ -270,6 +270,7 @@ struct RawItems {
 
 pub struct FakeModule {
     routed_models: bool,
+    auth_refusal_retries: usize,
     routing: Mutex<routed::RoutingState>,
     defects: Defects,
     priced: bool,
@@ -849,6 +850,11 @@ impl FakeSubject {
         subject
     }
 
+    pub fn with_auth_refusal_retries(mut self, retries: usize) -> Self {
+        Arc::get_mut(&mut self.module).unwrap().auth_refusal_retries = retries;
+        self
+    }
+
     fn build(
         defects: Defects,
         priced: bool,
@@ -859,6 +865,7 @@ impl FakeSubject {
         Self {
             module: Arc::new(FakeModule {
                 routed_models: false,
+                auth_refusal_retries: 0,
                 routing: Mutex::new(routed::RoutingState::default()),
                 defects,
                 priced,

crates/cortexkit-role-classifier-conformance/tests/fake/mod.rs

@@ -99,7 +99,18 @@ impl FakeModule {
                     let answers = serde_json::from_str(answer.answers.get()).unwrap();
                     items.push(ItemResult::answered(index as u64, answers));
                 }
-                Scripted::Status { .. } => {
+                Scripted::Status { status, .. } => {
+                    if status == 401 {
+                        for _ in 0..self.auth_refusal_retries {
+                            self.routing
+                                .lock()
+                                .unwrap()
+                                .observations
+                                .provider_requests
+                                .push(used.clone());
+                            self.stand_in.call(&item.state).await;
+                        }
+                    }
                     if index == 0 && self.defects.initial_account_failure_reselects_twice {
                         for _ in 0..2 {
                             let next = self.routing.lock().unwrap().select();

crates/cortexkit-role-classifier-conformance/tests/fake/routed.rs

@@ -195,6 +195,40 @@ async fn routed_initial_account_failure_cannot_select_twice() {
     .await;
 }
 
+#[tokio::test]
+async fn routed_two_auth_retries_are_detected() {
+    let subject = FakeSubject::routed(Defects::default()).with_auth_refusal_retries(2);
+    let report = run(&subject).await;
+    expect_breaks(
+        &report,
+        &[
+            "routed_partial_failure_keeps_model",
+            "routed_initial_account_failure_bounded",
+        ],
+        "partial account failure",
+    );
+}
+
+#[tokio::test]
+async fn routed_single_auth_retry_passes_both_failure_cases() {
+    let subject = FakeSubject::routed(Defects::default()).with_auth_refusal_retries(1);
+    let report = run(&subject).await;
+    assert_eq!(
+        report.verdict,
+        SuiteVerdict::PassedExceptNotApplicable {
+            not_applicable: LEGACY_AUTH_CHECKS.to_vec()
+        },
+        "{}",
+        report.render()
+    );
+    for check in [
+        "routed_initial_account_failure_bounded",
+        "routed_partial_failure_keeps_model",
+    ] {
+        assert_eq!(report.outcome(check), Some(&CheckOutcome::Passed));
+    }
+}
+
 #[tokio::test]
 async fn faithful_routed_provider_passes_applicable_checks() {
     let report = run(&FakeSubject::routed(Defects::default())).await;

crates/cortexkit-role-classifier-conformance/tests/suite.rs

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.6.2
+
+- Clarify in §6.8 that a runner may retry an authentication refusal once on
+  the same account and selected model under routing §9.3. This is not a
+  reselection and never moves the batch to another model. Contract text
+  only; no wire or Rust API changes.
+
 ## 0.6.1
 
 - A catalog row whose `kind` is `decision` now serves this role. That is

crates/cortexkit-role-classifier/CHANGELOG.md

@@ -304,6 +304,9 @@ numbers, and say what is this role's own.
 - [pinned] A `routed_models` provider reports usage per decision and account
   failures to routing under the routing contract's `route.report` (§8) and
   `route.account_observe` (§9.2); their reporting rules apply unchanged.
+- [pinned] A runner's own retry of an authentication refusal (routing §9.3)
+  is at most one more request on the same account and selected model, is not
+  a reselection, and never moves the batch to another model.
 
 ### 6.9 Spend guard
 

crates/cortexkit-role-classifier/CONTRACT.md

@@ -9,7 +9,7 @@
 # runner's production build never pulls in the suite.
 [package]
 name = "cortexkit-role-classifier"
-version = "0.6.1"
+version = "0.6.2"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true