fix(noema): dispatch capacity continuation with scoped write token

[seonghobae]

Failure and cause

On contextual-orchestrator PR #1209, Noema run 36024200990 exhausted its admitted free gateway routes with HTTP 429. Its bounded same-head continuation then failed with HTTP 403 at POST /repos/{owner}/{repo}/dispatches: the reviewer App token requested Contents: read, whereas this REST endpoint requires Contents: write.

Repair

Move only the continuation dispatch into a separate job. The model and sidecar job retain contents: read; the trusted dispatch job receives target-repository GITHUB_TOKEN with contents: write and pull-requests: read. It accepts only a failed, admitted capacity result, validates the PR number, head SHA, bounded delay, and exact attempt transition (0→1 or 1→2), re-reads the live head after the delay, and dispatches only to github.repository. No reviewer credential or provider secret enters this job.

This does not alter gateway routing or treat a failed review as approval. Gateway pin adoption is separately tracked in #2366; all-429 preflight classification is separately tracked in #2339.

Verification at ab59ca40c1cf8cdd20659d3a2f5ae424e79ffd24

• 150 focused Noema/workflow tests passed.
• 16 affected tests passed with GITHUB_ACTIONS=true.
• The workflow shell regression executed one dispatch for a live head and refused stale heads and malformed attempt transitions.
• actionlint .github/workflows/noema-review.yml and git diff --check passed.
• Hosted token permission and fresh-run creation after a real capacity failure remain unverified until this workflow reaches a consumer and produces an exact-head continuation run.

[coderabbitai]

Warning

Review limit reached

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 024eefbb-2b2a-4b4b-a36e-bdbc44861eed

📥 Commits

Reviewing files that changed from the base of the PR and between e6334e2 and ab59ca4.

📒 Files selected for processing (5)

• .github/workflows/noema-review.yml
• docs/adr/0031-noema-transport-capacity-redispatch.md
• tests/test_noema_orchestrator_workflow_contract.py
• tests/test_noema_reviewer_token_lifetime.py
• tests/test_noema_transport_dispatch_capability.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• .github/workflows/noema-review.yml — GitHub Actions review job
• docs/adr/0031-noema-transport-capacity-redispatch.md — operator or user guidance
• tests/test_noema_orchestrator_workflow_contract.py — regression suite
• tests/test_noema_reviewer_token_lifetime.py — regression suite
• tests/test_noema_transport_dispatch_capability.py — regression suite

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: noema-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: noema-review.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Docs: 0031-noema-transport-capacity-redispatch.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: 0031-noema-transport-capacity-redispatch.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test: test_noema_orchestrator_workflow_contract.py (3 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_noema_orchestrator_workflow_contract.py (3 files)"]
  R3 --> V3["targeted test run"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: ab59ca40c1cf8cdd20659d3a2f5ae424e79ffd24
• Workflow run: 36189849721
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: noema-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: noema-review.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Docs: 0031-noema-transport-capacity-redispatch.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: 0031-noema-transport-capacity-redispatch.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test: test_noema_orchestrator_workflow_contract.py (3 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_noema_orchestrator_workflow_contract.py (3 files)"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: ab59ca40c1cf8cdd20659d3a2f5ae424e79ffd24
• Workflow run: 36189849721
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: fix(noema): dispatch capacity continuation with scoped write token #2371 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.