Struct RetryPolicy 

pub struct RetryPolicy {
    pub max_attempts: u32,
    pub base_delay: Duration,
    pub capacity_base_delay: Duration,
    pub capacity_max_delay: Duration,
    pub max_total_backoff: Duration,
    pub job_timeout: Duration,
}

How a transient inference failure is retried before the agent is failed.

Transient errors (see ProviderError::is_transient) are retried with exponential backoff; a permanent error (auth, invalid request, token limit) fails immediately. This keeps a passing network blip from marking a stage error and carrying its half-finished work forward.

A capacity failure - a 429, or Anthropic’s 529 “overloaded” - is retried on its own, much slower schedule (see Self::capacity_base_delay), because it describes a window that lasts minutes rather than a blip that clears in a second. When the provider said how long to wait, that answer is used instead of any of these numbers.

Every schedule is bounded twice over: by Self::max_attempts, and by Self::max_total_backoff on the sum of the waits. A job can never retry forever.

Fields

max_attempts: u32

Total attempts including the first (e.g. 4 = one try + three retries).

base_delay: Duration

Base backoff; the retry after attempt n waits base_delay * 2^(n-1) (so 1s, 2s, 4s, … for a 1s base).

capacity_base_delay: Duration

Base backoff for a capacity failure the provider gave no Retry-After for, doubling per attempt exactly as Self::base_delay does and capped at Self::capacity_max_delay. Defaults to CAPACITY_BASE_DELAY_SECS, so the default schedule is 15s, 30s, 60s.

capacity_max_delay: Duration

Ceiling on one capacity backoff, and on an honored Retry-After. Defaults to CAPACITY_MAX_DELAY_SECS.

max_total_backoff: Duration

Ceiling on the sum of every backoff this job sleeps. Once it is spent the job stops retrying and reports the last error, whatever Self::max_attempts still allowed. Defaults to MAX_TOTAL_BACKOFF_SECS.

job_timeout: Duration

Hard ceiling on the total wall-clock time one job (all attempts + backoffs) may run before it is aborted and its pool slot freed.

Providers apply this same deadline as their own per-call timeout, so a call normally ends there. This outer bound is the backstop: a provider timer can be defeated (e.g. a connection that keeps trickling keepalive bytes without ever completing resets a read timer forever), which would leak the permit until the model’s pool fills and new agents never get a slot. Wrapping the whole job in a wall-clock timeout guarantees the slot is released within a fixed time regardless. Defaults to leviath_providers::DEFAULT_INFERENCE_TIMEOUT_SECS; a stage’s request_timeout_secs overrides it per stage.

Trait Implementations

impl Clone for RetryPolicy

fn clone(&self) -> RetryPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RetryPolicy

impl Debug for RetryPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RetryPolicy

fn default() -> Self

Returns the “default value” for a type.