Module exit 

The public exit-code contract. RFC 0011 §5 — this is a stable, machine-actionable API (e.g. for a Kubernetes podFailurePolicy); treat changes as breaking.

Code	Meaning	Scheduler hint
0	success (one-shot completed / clean SIGTERM drain)	Complete
1	generic/unspecified failure	retriable
2	config / usage error (validation)	non-retriable
3	partial result	policy
4	intelligence unreachable / auth after retries	retriable
5	semantic — task cannot be done / refused	non-retriable
6	required MCP server failed to connect/handshake/die	retriable
7	budget exceeded (steps/tokens/deadline/tree)	policy
124	hard wall-clock deadline (mnemonic to timeout(1))	—
137	killed by SIGKILL (128+9, OS-set) — often OOM	raise memory
143	killed by SIGTERM (128+15, OS-set) — ungraceful	—

A clean SIGTERM drain returns 0, not 143 (RFC 0011 §5.1). 137/143 are set by the OS when the kernel kills us; we never exit(137) ourselves.

RFC 0016 §5 freezes the contract around this table: it pins a version (EXIT_CODES, surfaced at surfaces.exit_codes) and maps each code to a podFailurePolicy intent (pod_failure_intent) agentctl compiles into onExitCodes rules. This module owns neither the table values (RFC 0011 §5) nor the policy (agentctl) — only the frozen, versioned intent mapping.

Constants

BUDGET

DEADLINE

EXIT_CODES

The exit-code contract version (major.minor), surfaced in the manifest at surfaces.exit_codes (RFC 0016 §5.1 / §8.1). RFC 0011 §5 owns the table of code→meaning; this const freezes that mapping as a versioned public API a control plane authors podFailurePolicy rules against. Additive within a major; any change to a code’s meaning or to the pod_failure_intent mapping is breaking and bumps the major (RFC 0016 §8.2). agentctl refuses to compile rules for an exit_codes major it does not understand (§8.3).

GENERIC

INTEL_UNAVAILABLE

MCP_REQUIRED_DOWN

PARTIAL

REFUSED

SIGKILL_EXIT

The OS-set codes (128 + signo). agentd never returns these itself (once_exit tops out at DEADLINE = 124, RFC 0011 §5.1); the kernel sets them when it kills us. We name them so pod_failure_intent can classify the kernel exit code an agentctl reader observes (RFC 0016 §5.3).

SIGTERM_EXIT

SUCCESS

USAGE

Functions

apply_budget_remap

Apply the operator’s --budget-exit-code remap (RFC 0011 §5.2; ACC exit-codes.table.json x-budget-exit-code-remap). ONLY the two operator-tunable policy-intent budget codes are remappable — EXIT_PARTIAL (3) and EXIT_BUDGET (7); every other code (a clean 0, a terminal refusal 5, the policy deadline 124, a kernel 137) is returned UNCHANGED. With no remap configured (None) the canonical table applies verbatim.

once_exit

Map a one-shot root subagent’s outcome to an exit code (RFC 0011 §5.2). partial is the result-body property, not a status: a Completed run that only partially satisfied the objective exits 3. A budget-bounded run that nonetheless produced usable output is still reported under its budget code (7) with the partial flag carried in the result JSON.

pod_failure_intent

The podFailurePolicy intent a control plane compiles each exit code into (RFC 0016 §5.2). agentd emits the code; agentctl owns the actual FailJob/Ignore/Count choice and any operator override — this is the frozen hint it branches on, not a policy.