fix(gooddata-eval): fall back to the default score retry delay for negative or NaN Retry-After

time.sleep rejects a negative or NaN delay, so a skewed or hostile Retry-After header would
turn a throttled score write into an exception instead of a retry. Such values now use the
default delay; the existing cap still bounds long waits.

jira: trivial
risk: low

Author: tychtjan

packages/gooddata-eval/src/gooddata_eval/core/langfuse/client.py

@@ -32,11 +32,18 @@ def _is_retryable(resp: httpx.Response) -> bool:
 
 
 def _retry_delay(resp: httpx.Response) -> float:
-    """Seconds to wait before the next attempt, from `Retry-After` when the server names one."""
+    """Seconds to wait before the next attempt, from `Retry-After` when the server names one.
+
+    Unparsable, negative or NaN values fall back to the default; the cap bounds the wait so a
+    throttled score cannot hold a linking worker for long.
+    """
     try:
-        return min(float(resp.headers.get("Retry-After", "")), _MAX_RETRY_DELAY)
+        asked_for = float(resp.headers.get("Retry-After", ""))
     except ValueError:
         return _DEFAULT_RETRY_DELAY
+    if not asked_for >= 0:
+        return _DEFAULT_RETRY_DELAY
+    return min(asked_for, _MAX_RETRY_DELAY)
 
 
 class _TraceListResult:

packages/gooddata-eval/tests/test_langfuse_client.py

@@ -139,6 +139,24 @@ def test_a_retry_delay_the_server_did_not_name_falls_back_to_a_short_one(make_cl
     assert slept == [0.5]
 
 
+@pytest.mark.parametrize("header", ["-5", "nan"])
+def test_a_retry_after_that_cannot_be_slept_falls_back_to_the_default(header):
+    # time.sleep rejects a negative or NaN delay, so either would turn a retry into an exception.
+    assert client_module._retry_delay(httpx.Response(429, headers={"Retry-After": header})) == 0.5
+
+
+def test_a_retry_after_beyond_the_cap_is_clamped():
+    assert client_module._retry_delay(httpx.Response(429, headers={"Retry-After": "60"})) == 5.0
+
+
+def test_a_retry_after_given_as_a_date_falls_back_to_the_default():
+    # Retry-After is allowed to be an HTTP-date; this client reads seconds only. Langfuse
+    # documents the header as a number of seconds, and the cap already bounds the wait, so
+    # parsing a date could only turn the 0.5s fallback into the same 5s ceiling.
+    response = httpx.Response(429, headers={"Retry-After": "Wed, 21 Oct 2026 07:28:00 GMT"})
+    assert client_module._retry_delay(response) == 0.5
+
+
 def test_a_score_gives_up_after_three_attempts(make_client, monkeypatch):
     monkeypatch.setattr(client_module.time, "sleep", lambda _seconds: None)
     attempts = 0