fix: circuit breaker for c3_delegate CLI backends (v2.39.1)

[drknowhow]

Problem

A broken-but-installed delegate backend (gemini/codex/claude) re-spawned a 90–120s subprocess on every c3_delegate call. The handlers in cli/tools/delegate.py returned the error on runtime failure (if not ok:) but never demoted the backend, so an installed-but-broken CLI (expired auth, model pulled, repeated timeouts) kept paying the full subprocess + timeout cost on every subsequent call.

Surfaced by a multi-agent evaluation of techniques worth borrowing from Headroom: this was the one "operational hardening" idea that transfers (the cache-centric ideas don't, since C3 doesn't own the Anthropic prefix cache).

Change

• New services/circuit_breaker.py — a small, dependency-free, thread-safe CircuitBreaker: closed → open after N consecutive failures → half-open single probe after a cooldown → close on success.
• cli/tools/delegate.py — per-backend breaker wired into all three CLI handlers:
  • allow()-gate before spawning → returns [delegate:degraded] instead of re-spawning when open
  • record_failure() on the if not ok: path, record_success() on success
  • one-shot NotificationStore warning when a backend trips
  • the auto router now skips tripped backends and falls back to ollama

Design notes

• Thresholds configurable via delegate_config: breaker_failure_threshold (default 3), breaker_cooldown_seconds (default 60).
• Breaker state is process-global on purpose — backend health (auth, CLI version) is a host fact, not per-project, so a tripped backend should gate all projects on the machine.
• The Ollama embed/generate breaker is intentionally not wired up yet — there's no telemetry signal of flapping; the primitive is ready if/when that appears.

Tests

tests/test_circuit_breaker.py — 4 unit tests for the primitive + 1 integration test proving a broken gemini backend stops re-spawning after the breaker trips and emits exactly one notification. All 5 pass; test_cli_smoke.py unaffected.

🤖 Generated with Claude Code