fix: per-PR isolation and single-review retry (closes #132)

scripts/review-batch.sh

@@ -103,13 +103,10 @@ while IFS= read -r pr_url; do
       abort_reason="rate-limit on fallback engine"
       ;;
     *)
-      # Other failure — session-fatal. A systemic problem (model degraded,
-      # prompt regression, malformed verdicts) shouldn't burn the queue.
+      # Per-PR failure — log and continue. Remaining candidates still run.
+      # Accumulated failures surface in the session summary.
       failed=$((failed + 1))
       echo "::error::Review failed for $pr_url (exit code $rc)"
-      session_aborted=1
-      abort_pr="$pr_url"
-      abort_reason="exit code $rc"
       ;;
   esac
 

scripts/review-one-pr.sh

@@ -316,10 +316,57 @@ if [ "$TRIAGE_ESCALATE" = "false" ]; then
   echo "    [approve] triage cleared — running single confirmation ($ENGINE_SINGLE_MODEL)"
   export REVIEW_MODE="triage-approved"
   VERDICT_JSON="/tmp/cascade/single-review-verdict.json"
-  OUTPUT_FILE="$VERDICT_JSON"
-  export OUTPUT_FILE
-  run_agentic prompts/single-review.md "$ENGINE_SINGLE_MODEL" > "$VERDICT_JSON.raw"
-  extract_verdict_json "$VERDICT_JSON.raw" "$VERDICT_JSON" || { echo "::error::single-review did not produce valid JSON"; exit 1; }
+  SINGLE_REVIEW_MAX_RETRIES="${SINGLE_REVIEW_MAX_RETRIES:-2}"
+  SINGLE_REVIEW_RETRY_DELAY_SEC="${SINGLE_REVIEW_RETRY_DELAY_SEC:-15}"
+
+  single_attempt=1
+  single_ok=false
+  while [ "$single_attempt" -le "$SINGLE_REVIEW_MAX_RETRIES" ]; do
+    rm -f "$VERDICT_JSON" "$VERDICT_JSON.raw"
+    OUTPUT_FILE="$VERDICT_JSON"
+    export OUTPUT_FILE
+    SINGLE_LOG="/tmp/cascade/single-review-attempt-${single_attempt}.log"
+
+    single_rc=0
+    run_agentic prompts/single-review.md "$ENGINE_SINGLE_MODEL" \
+      > "$VERDICT_JSON.raw" 2>"$SINGLE_LOG" || single_rc=$?
+
+    # Check for rate limit before retrying — exit code 2 lets review-batch.sh
+    # trigger engine fallback rather than burning retries on the same engine.
+    SINGLE_STDOUT=$(cat "$VERDICT_JSON.raw" 2>/dev/null || true)
+    SINGLE_STDERR=$(cat "$SINGLE_LOG" 2>/dev/null || true)
+    if is_rate_limited "$SINGLE_STDOUT" || is_rate_limited "$SINGLE_STDERR"; then
+      echo "    [approve] rate limit detected — exiting with code 2 for engine fallback"
+      [ -n "$SINGLE_STDERR" ] && echo "    limit stderr: $SINGLE_STDERR"
+      exit 2
+    fi
+
+    if [ "$single_rc" -eq 0 ] && extract_verdict_json "$VERDICT_JSON.raw" "$VERDICT_JSON"; then
+      single_ok=true
+      break
+    fi
+
+    echo "    [approve] single-review attempt $single_attempt/$SINGLE_REVIEW_MAX_RETRIES produced no valid JSON (exit $single_rc)"
+    head -20 "$VERDICT_JSON.raw" 2>/dev/null || true
+    [ -n "$SINGLE_STDERR" ] && echo "    stderr: $SINGLE_STDERR"
+    if [ "$single_attempt" -lt "$SINGLE_REVIEW_MAX_RETRIES" ]; then
+      echo "    [approve] retrying in ${SINGLE_REVIEW_RETRY_DELAY_SEC}s"
+      sleep "$SINGLE_REVIEW_RETRY_DELAY_SEC"
+    fi
+    single_attempt=$((single_attempt + 1))
+  done
+
+  if [ "$single_ok" = "false" ]; then
+    echo "::warning::single-review failed after $SINGLE_REVIEW_MAX_RETRIES attempts — flagging for manual review"
+    for i in $(seq 1 "$SINGLE_REVIEW_MAX_RETRIES"); do
+      log="/tmp/cascade/single-review-attempt-${i}.log"
+      [ -s "$log" ] && { echo "    attempt $i stderr:"; cat "$log"; }
+    done
+    if [ "${DRY_RUN:-false}" = "false" ]; then
+      gh pr edit "$PR_URL" --add-label needs-human-review 2>/dev/null || true
+    fi
+    exit 1
+  fi
   rm -f "$VERDICT_JSON.raw"
 
   # Post the review using the verdict