Network Reachability & Circuit Breaker

Use this skill as an early circuit breaker when a network probe fails to reach the target host or the internet at large. A failed probe is a signal, not a reason to retry blindly. See GLOSSARY.md for shared term definitions.

When To Use

Trigger this procedure whenever a network-touching step reports the target host or the internet is unreachable:

• DNS failure (ENOTFOUND, EAI_AGAIN, "name resolution failed", "Temporary failure in name resolution").
• Connection refused (ECONNREFUSED, port closed).
• No route to host (ENETUNREACH, "Network is unreachable", "No route to host").
• Host seems down (nmap "Host seems down", no response to probes).
• Fetch-level network errors (fetch failed, Failed to fetch, NetworkError).

Procedure

1. STOP further probing immediately. Do not retry automatically or escalate to a broader scan against the same unreachable host.
2. Classify the boundary correctly. This is a target-readiness, routing, or harness failure unless separate evidence proves otherwise; it is not a security finding about the target.
3. Report the failure in chat. Include the exact operation, normalized error, target, timestamp, and the workspace/network boundary from which it was attempted. Preserve raw output in expandable diagnostics — the normalized summary supplements, never replaces, the exact bytes.
4. Offer one practical recovery step. Ask the user to start the target, correct its address/network attachment, or retry the same bounded baseline after readiness is restored. Do not suspend the run with a menu of speculative scans. A retry is a new execution: confirm a currently valid target authorization and a fresh matching durable approval before re-running; never reuse or replay a consumed, expired, or denied decision.
5. Record the blocker as a Research Observation via security-observation-intake, citing the raw probe output registered as an Artifact through the Evidence Interface (src/server/evidence/artifact-service.ts), so the research plan reflects reality and does not loop on the same unavailable target.

Guardrails

• Stay within the approved network profile and target scope. Never bypass egress iptables rules to force reachability.
• Layer-2 discovery (arping, arp-scan) bypasses the IP-layer allowlist and is not a reachability workaround: it needs its own scope and durable approval.
• Do not auto-escalate from a failed probe to a heavier scan. A broader scan is a separate, evidence-backed decision after basic target readiness is restored.