Summary

First wave of Arc 3 from the trust-system direction. Focused scope after advisor flagged rocky branch promote as a separate design exercise.

• Consolidated + enhanced CircuitBreaker. Three-state machine (Closed/Open/HalfOpen). New RetryConfig.circuit_breaker_recovery_timeout_secs promotes the breaker from "manual-reset only" to auto-recovery: after timeout elapses while Open, the next check transitions to HalfOpen and lets one trial through. Success closes the breaker (emits circuit_breaker_recovered); failure re-opens (emits circuit_breaker_tripped again). CAS on both trip paths guarantees exactly one event per transition even under concurrent failing trials.
• Adapter consolidation. rocky-databricks and rocky-snowflake drop their inline consecutive_failures: AtomicU32 and share Arc<CircuitBreaker> via RetryConfig::build_circuit_breaker(). Removes the orphan-module drift advisor surfaced — there's now one implementation. rocky-fivetran has no inline breaker (source adapter, retry shape different); rocky-bigquery likewise has no inline breaker.
• Events surfaced; hook deferred. Adapters emit circuit_breaker_tripped / _recovered on transitions with adapter-name target + error class. TransitionOutcome return value decouples the breaker from rocky-observe — callers choose whether to publish. HookEvent::CircuitBreakerTripped is deferred to wave 2 since adapter-emitted events don't currently have a hook bridge (mirrors statement_retry's existing precedent).

Deferred to later Arc 3 waves

• rocky branch promote <name> (atomic shadow→prod swap). Advisor flagged real deploy-semantics questions — cross-table atomicity, Unity Catalog rename privileges, dry-run output shape, behavior when branch/prod disagree on table set. Separate plan doc + dedicated PR.
• Event→hook bridge so [hook.on_circuit_breaker_tripped] fires.
• Transactional checkpoint atomicity audit (watermark + table_progress in one txn).

Test plan

• cargo test -p rocky-core — 976 tests (9 new circuit_breaker::tests::* covering half-open transitions, concurrent-trial CAS, timeout-elapsed check).
• cargo test -p rocky-databricks — 93 tests pass, wiremock suite clean.
• cargo test -p rocky-snowflake — 98 tests pass.
• cargo clippy --workspace --all-targets -- -D warnings clean.
• cargo fmt --check clean.
• just codegen — adapter_config + rocky_project schemas picked up the new circuit_breaker_recovery_timeout_secs field; Pydantic + TypeScript regenerated.
• just regen-fixtures — no RunOutput changes, fixture corpus unchanged.
• uv run pytest in integrations/dagster/ — 307 tests pass.

🤖 Generated with Claude Code