Resilience Patterns skill for Claude Code

# Resilience configurations by stack

Starting configurations implementing timeouts, breakers, bulkheads and retry budgets.
Tune values from the dependency failure matrix; confirm option names against the
installed library version.

## Java: resilience4j (Spring Boot)

```yaml
resilience4j:
  circuitbreaker:
    instances:
      payments:
        slidingWindowType: COUNT_BASED
        slidingWindowSize: 50
        minimumNumberOfCalls: 20
        failureRateThreshold: 50
        slowCallDurationThreshold: 800ms
        slowCallRateThreshold: 50
        waitDurationInOpenState: 30s
        permittedNumberOfCallsInHalfOpenState: 5
        automaticTransitionFromOpenToHalfOpenEnabled: true
        ignoreExceptions:
          - com.acme.payments.PaymentDeclinedException   # business errors are not failures
  timelimiter:
    instances:
      payments:
        timeoutDuration: 1s
  bulkhead:
    instances:
      payments:
        maxConcurrentCalls: 20
        maxWaitDuration: 5ms
  retry:
    instances:
      payments:
        maxAttempts: 2                     # 1 retry
        waitDuration: 100ms
        enableExponentialBackoff: true
        exponentialBackoffMultiplier: 2
        retryExceptions:
          - java.net.SocketTimeoutException
          - java.io.IOException
```

```java
@CircuitBreaker(name = "payments", fallbackMethod = "queuePayment")
@Bulkhead(name = "payments")
@Retry(name = "payments")
public PaymentResult charge(ChargeRequest req) { return client.charge(req); }

private PaymentResult queuePayment(ChargeRequest req, Throwable t) {
    outbox.enqueue(req);                   // degraded: process later
    return PaymentResult.pending();
}
```

Aspect order matters (by default Retry wraps CircuitBreaker wraps Bulkhead...); check the
configured aspect order so retries do not bypass the breaker. Also set HTTP client
connect and read timeouts; `timelimiter` applies only to async return types.

## .NET: Polly v8 and Microsoft.Extensions.Http.Resilience

Default for HttpClient:

```csharp
builder.Services.AddHttpClient<PaymentsClient>(c => c.BaseAddress = new("https://payments.internal"))
    .AddStandardResilienceHandler(o =>
    {
        o.AttemptTimeout.Timeout = TimeSpan.FromMilliseconds(800);
        o.TotalRequestTimeout.Timeout = TimeSpan.FromSeconds(2);
        o.Retry.MaxRetryAttempts = 1;
        o.CircuitBreaker.FailureRatio = 0.5;
        o.CircuitBreaker.MinimumThroughput = 20;
        o.CircuitBreaker.SamplingDuration = TimeSpan.FromSeconds(30);
        o.CircuitBreaker.BreakDuration = TimeSpan.FromSeconds(30);
    });
```

Custom pipeline for non-HTTP calls:

```csharp
var pipeline = new ResiliencePipelineBuilder<Quote>()
    .AddFallback(new() { FallbackAction = _ => Outcome.FromResultAsValueTask(Quote.Cached()) })
    .AddCircuitBreaker(new() { FailureRatio = 0.5, MinimumThroughput = 20,
        SamplingDuration = TimeSpan.FromSeconds(30), BreakDuration = TimeSpan.FromSeconds(30) })
    .AddConcurrencyLimiter(permitLimit: 20, queueLimit: 0)     // bulkhead (Polly.RateLimiting)
    .AddTimeout(TimeSpan.FromMilliseconds(800))
    .Build();

var quote = await pipeline.ExecuteAsync(async ct => await pricing.GetQuoteAsync(id, ct), ct);
```

Strategies execute outermost first in the order added. ASP.NET Core's built-in
`AddRateLimiter` with a `ConcurrencyLimiter` policy provides inbound load shedding.

## Envoy

```yaml
clusters:
- name: payments
  connect_timeout: 0.25s
  circuit_breakers:
    thresholds:
    - priority: DEFAULT
      max_connections: 100
      max_pending_requests: 50          # bulkhead on queued requests
      max_requests: 200
      retry_budget:
        budget_percent: { value: 20.0 } # retries <= 20% of active requests
        min_retry_concurrency: 3
  outlier_detection:
    consecutive_5xx: 5
    interval: 10s
    base_ejection_time: 30s
    max_ejection_percent: 50
routes:
- match: { prefix: "/payments" }
  route:
    cluster: payments
    timeout: 2s
    retry_policy:
      retry_on: "connect-failure,reset,retriable-status-codes"
      retriable_status_codes: [503]
      num_retries: 1
      per_try_timeout: 0.8s
```

Envoy's adaptive concurrency HTTP filter can shed load based on measured latency; enable
it only after the static limits work.

## Istio

```yaml
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: { name: payments }
spec:
  host: payments.prod.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp: { maxConnections: 100, connectTimeout: 250ms }
      http: { http1MaxPendingRequests: 50, http2MaxRequests: 200, maxRetries: 3 }
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
---
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: { name: payments }
spec:
  hosts: [payments.prod.svc.cluster.local]
  http:
  - timeout: 2s
    retries: { attempts: 1, perTryTimeout: 800ms, retryOn: "connect-failure,reset,503" }
    route: [{ destination: { host: payments.prod.svc.cluster.local } }]
```

Fault injection for tests: add `fault: { delay: { percentage: { value: 50 }, fixedDelay: 2s } }`
or `abort: { httpStatus: 503, percentage: { value: 100 } }` to a test-only route.

## Node.js: opossum, AbortSignal, p-limit

```ts
import CircuitBreaker from "opossum";
import pLimit from "p-limit";

const limit = pLimit(20);                                   // bulkhead: 20 in flight

async function callPricing(id: string) {
  const res = await fetch(`${PRICING_URL}/quotes/${id}`, { signal: AbortSignal.timeout(800) });
  if (res.status >= 500) throw new Error(`pricing ${res.status}`);
  if (!res.ok) return { error: res.status };                // 4xx: not a breaker failure
  return res.json();
}

const breaker = new CircuitBreaker((id: string) => limit(() => callPricing(id)), {
  timeout: 1000,                   // breaker-level timeout (slightly above fetch timeout)
  errorThresholdPercentage: 50,
  volumeThreshold: 20,             // minimum calls before tripping
  resetTimeout: 30_000,            // open duration before half-open
  rollingCountTimeout: 30_000,
});
breaker.fallback((id: string) => quoteCache.get(id) ?? null);
breaker.on("open", () => metrics.increment("breaker.pricing.open"));

const quote = await breaker.fire(id);
```

## Go: context deadlines, gobreaker, semaphores

```go
var cb = gobreaker.NewCircuitBreaker[*Quote](gobreaker.Settings{
    Name:        "pricing",
    MaxRequests: 5,                       // half-open probes
    Interval:    30 * time.Second,        // closed-state counter reset
    Timeout:     30 * time.Second,        // open duration
    ReadyToTrip: func(c gobreaker.Counts) bool {
        return c.Requests >= 20 && float64(c.TotalFailures)/float64(c.Requests) >= 0.5
    },
})
var sem = semaphore.NewWeighted(20)     // golang.org/x/sync/semaphore

func GetQuote(ctx context.Context, id string) (*Quote, error) {
    if !sem.TryAcquire(1) {
        return cachedQuote(id), nil         // bulkhead full: degrade immediately
    }
    defer sem.Release(1)
    ctx, cancel := context.WithTimeout(ctx, 800*time.Millisecond)
    defer cancel()
    q, err := cb.Execute(func() (*Quote, error) { return pricing.Get(ctx, id) })
    if errors.Is(err, gobreaker.ErrOpenState) || errors.Is(err, gobreaker.ErrTooManyRequests) {
        return cachedQuote(id), nil
    }
    return q, err
}
```

Set `http.Client{Timeout: ...}` and transport `MaxConnsPerHost` per dependency client.
This uses gobreaker v2 (generic API, module path `github.com/sony/gobreaker/v2`).

## Python: httpx timeouts, pybreaker, semaphores

```python
import threading
import httpx
import pybreaker

client = httpx.Client(base_url=PRICING_URL,
                      timeout=httpx.Timeout(0.8, connect=0.25),
                      limits=httpx.Limits(max_connections=20))   # pool size doubles as a bulkhead
breaker = pybreaker.CircuitBreaker(fail_max=5, reset_timeout=30,
                                   exclude=[lambda e: isinstance(e, httpx.HTTPStatusError)
                                            and e.response.status_code < 500])
bulkhead = threading.BoundedSemaphore(20)

@breaker
def _fetch_quote(qid: str) -> dict:
    resp = client.get(f"/quotes/{qid}")
    resp.raise_for_status()
    return resp.json()

def get_quote(qid: str) -> dict | None:
    if not bulkhead.acquire(blocking=False):
        return cached_quote(qid)                    # bulkhead full: degrade immediately
    try:
        return _fetch_quote(qid)
    except (pybreaker.CircuitBreakerError, httpx.TransportError):
        return cached_quote(qid)
    finally:
        bulkhead.release()
```

- pybreaker opens after `fail_max` consecutive failures rather than a failure rate over a
  window; for rate-based breaking, pick a library with sliding windows or wrap your own
  counter.
- asyncio services: bound concurrency with `asyncio.Semaphore`, time out with
  `async with asyncio.timeout(1.0)` (Python 3.11+), and use an asyncio-native breaker
  library (verify its API) rather than calling a thread-based breaker from the event loop.
- Retries: tenacity with `stop=stop_after_attempt(2)` and
  `wait=wait_random_exponential(multiplier=0.1, max=1)`, retrying only transport errors
  and 503.