fix(noema): authorize exact-head 429 continuation dispatch

.github/workflows/noema-review.yml

@@ -357,7 +357,8 @@ jobs:
     permissions:
       actions: write
       checks: read
-      contents: read
+      # Same-repository repository_dispatch requires Contents write.
+      contents: write
       id-token: write
       pull-requests: read
     env:
@@ -763,7 +764,7 @@ jobs:
           NOEMA_REVIEW_TOKEN_SOURCE: ${{ steps.noema_credential.outputs.source == 'pat' && 'noema-review-pat' || steps.noema_credential.outputs.source == 'github-app' && 'noema-review-github-app' || 'noema-review-app-oidc' }}
           NOEMA_REVIEW_ACTOR: ${{ steps.noema_github_app_token.outputs['app-slug'] && format('{0}[bot]', steps.noema_github_app_token.outputs['app-slug']) || '' }}
           NOEMA_REVIEW_INSTALLATION_ID: ${{ steps.noema_github_app_token.outputs['installation-id'] }}
-          NOEMA_TRANSPORT_RETRY_ATTEMPT: ${{ github.event.client_payload.transport_retry_attempt || 0 }}
+          NOEMA_TRANSPORT_RETRY_ATTEMPT: ${{ toJSON(github.event.client_payload.transport_retry_attempt) }}
         run: |
           set -euo pipefail
           if [ -z "${PR_NUMBER:-}" ]; then
@@ -801,7 +802,7 @@ jobs:
           && steps.noema_prepare.outputs.transport_capacity_unavailable == 'true'
           && steps.noema_prepare.outputs.transport_retry_eligible == 'true'
         env:
-          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || github.token }}
+          GH_TOKEN: ${{ github.token }}
           DELAY_SECONDS: ${{ steps.noema_prepare.outputs.transport_retry_delay_seconds }}
           NEXT_ATTEMPT: ${{ steps.noema_prepare.outputs.transport_retry_next_attempt }}
           PROVIDER_ATTEMPT_COUNT: ${{ steps.noema_prepare.outputs.provider_attempt_count || '' }}

scripts/ci/noema_review_gate.py

@@ -292,12 +292,14 @@ def transport_redispatch_delay_seconds(
 
 
 def current_transport_retry_attempt() -> int:
-    """Parse the workflow-supplied automatic re-dispatch counter, failing closed to 0."""
-    raw = (os.environ.get("NOEMA_TRANSPORT_RETRY_ATTEMPT") or "0").strip()
-    if not raw.isdecimal():
+    """Parse the retry counter; invalid values exhaust the automatic budget."""
+    raw = os.environ.get("NOEMA_TRANSPORT_RETRY_ATTEMPT")
+    if raw is None or raw == "null":
         return 0
+    if not re.fullmatch(r"[0-9]{1,2}", raw):
+        return MAX_TRANSPORT_REDISPATCH_ATTEMPTS
     value = int(raw)
-    return value if value <= 64 else 0
+    return min(value, MAX_TRANSPORT_REDISPATCH_ATTEMPTS)
 
 
 def append_github_output(values: dict[str, str]) -> None:

tests/test_noema_orchestrator_workflow_contract.py

@@ -200,13 +200,21 @@ def test_noema_review_credentials_and_llm_use_orchestrator_free() -> None:
     assert '.github/actions/noema-review/two_phase.py' in prepare
     assert '--prepare-verdict-file "$verdict_file"' in prepare
     assert "NOEMA_TRANSPORT_RETRY_ATTEMPT" in prepare
+    assert "toJSON(github.event.client_payload.transport_retry_attempt)" in prepare
     assert '.github/actions/noema-review/two_phase.py' in publish
     assert '--publish-verdict-file "$verdict_file"' in publish
     redispatch = workflow_step(workflow, "Schedule bounded Noema transport re-dispatch")
     assert 'transport_capacity_unavailable == \'true\'' in redispatch
     assert 'transport_retry_eligible == \'true\'' in redispatch
     assert 'event_type: "noema-review"' in redispatch
     assert "transport_retry_attempt" in redispatch
+    # repository_dispatch requires Contents write; reviewer credentials are
+    # intentionally limited to review publication and cannot resume a 429.
+    noema_job = workflow.split("\n  noema-review:\n", 1)[1]
+    assert re.search(r"(?m)^    permissions:\n(?:^      [^\n]+\n)*^      contents: write$", noema_job)
+    assert "GH_TOKEN: ${{ github.token }}" in redispatch
+    assert "secrets.NOEMA_REVIEW_TOKEN" not in redispatch
+    assert "steps.noema_github_app_token.outputs.token" not in redispatch
     assert "python3 -m scripts.ci.noema_review_gate" not in workflow
     assert (
         "contextual-orchestrator review sidecar must be provisioned before Noema LLM review."

tests/test_noema_review_gate.py

@@ -1725,10 +1725,15 @@ def test_append_github_output_noop_without_path_or_values(monkeypatch):
     noema.append_github_output({})
 
 
-def test_current_transport_retry_attempt_rejects_oversized_counter(monkeypatch):
-    """Counters above the hard ceiling fail closed to zero."""
-    monkeypatch.setenv("NOEMA_TRANSPORT_RETRY_ATTEMPT", "65")
-    assert noema.current_transport_retry_attempt() == 0
+@pytest.mark.parametrize("counter", ["65", "junk", "-1", "", '"1"', "true", "9" * 80])
+def test_current_transport_retry_attempt_rejects_invalid_counter(monkeypatch, counter):
+    """Malformed counters spend the budget instead of restarting it."""
+    monkeypatch.setenv("NOEMA_TRANSPORT_RETRY_ATTEMPT", counter)
+    attempt = noema.current_transport_retry_attempt()
+    assert attempt == noema.MAX_TRANSPORT_REDISPATCH_ATTEMPTS
+    assert noema.transport_redispatch_delay_seconds(
+        transport_retry_attempt=attempt, head_sha="a" * 40
+    ) is None
 
 
 def test_transport_redispatch_delay_rejects_negative_attempt_and_non_int_retry_after():
@@ -1832,10 +1837,12 @@ def test_append_github_output_writes_allowlisted_keys(tmp_path, monkeypatch):
 
 
 def test_current_transport_retry_attempt_parses_decimal_env(monkeypatch):
-    """Malformed counters fail closed to zero rather than inventing a budget."""
+    """Only an absent counter starts the first dispatch budget."""
     monkeypatch.setenv("NOEMA_TRANSPORT_RETRY_ATTEMPT", "1")
     assert noema.current_transport_retry_attempt() == 1
-    monkeypatch.setenv("NOEMA_TRANSPORT_RETRY_ATTEMPT", "nope")
+    monkeypatch.setenv("NOEMA_TRANSPORT_RETRY_ATTEMPT", "2")
+    assert noema.current_transport_retry_attempt() == 2
+    monkeypatch.setenv("NOEMA_TRANSPORT_RETRY_ATTEMPT", "null")
     assert noema.current_transport_retry_attempt() == 0
     monkeypatch.delenv("NOEMA_TRANSPORT_RETRY_ATTEMPT", raising=False)
     assert noema.current_transport_retry_attempt() == 0