fix(review): reconcile unbounded exact-head agents

.github/workflows/noema-review.yml

@@ -3,16 +3,13 @@ run-name: >-
   Required Noema Review ${{ github.event.client_payload.target_repository ||
   github.event.pull_request.base.repo.full_name || github.repository }}#${{
   github.event.client_payload.pr_number || github.event.pull_request.number ||
-  github.event.workflow_run.pull_requests[0].number || 'event' }}@${{
+  'event' }}@${{
   github.event.client_payload.pr_head_sha || github.event.pull_request.head.sha ||
-  github.event.workflow_run.pull_requests[0].head.sha || github.sha }}
+  github.sha }}
 
 on:
   pull_request_target:
     types: [opened, synchronize, reopened, ready_for_review, closed]
-  workflow_run:
-    workflows: ["Required OpenCode Review", "Strix Security Scan"]
-    types: [completed]
   # Default-branch-only retry entrypoint; no caller-selected workflow ref.
   repository_dispatch:
     types: [noema-review]
@@ -22,18 +19,12 @@ concurrency:
     noema-review-${{
     github.event.pull_request.base.repo.full_name ||
     github.event.client_payload.target_repository || github.repository }}-${{
-    github.event.pull_request.number || github.event.workflow_run.pull_requests[0].number ||
+    github.event.pull_request.number ||
     github.event.client_payload.pr_number ||
-    github.run_id }}-${{
-    github.event.client_payload.pr_head_sha || github.event.pull_request.head.sha ||
-    github.event.workflow_run.pull_requests[0].head.sha || github.sha }}-${{
-    github.event_name == 'workflow_run' &&
-    github.event.workflow_run.conclusion == 'cancelled' &&
-    format('cancelled-{0}', github.run_id) ||
-    'actionable' }}
-  # A cancelled upstream review emits a workflow_run event whose Noema job is
-  # skipped. It must not cancel a live same-head Noema review before skipping.
-  cancel-in-progress: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion != 'cancelled' }}
+    github.run_id }}
+  cancel-in-progress: >-
+    ${{ github.event_name == 'pull_request_target' &&
+    (github.event.action == 'synchronize' || github.event.action == 'closed') }}
 
 permissions:
   contents: read
@@ -191,10 +182,6 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event_name == 'repository_dispatch'
-      || (
-        github.event_name == 'workflow_run'
-        && github.event.workflow_run.conclusion != 'cancelled'
-      )
       || (
         github.event_name == 'pull_request_target'
         && github.event.action != 'closed'
@@ -209,8 +196,8 @@ jobs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
       TARGET_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.client_payload.target_repository || github.repository }}
-      PR_NUMBER: ${{ github.event.pull_request.number || github.event.workflow_run.pull_requests[0].number || github.event.client_payload.pr_number || '' }}
-      EXPECTED_HEAD: ${{ github.event.client_payload.pr_head_sha || github.event.pull_request.head.sha || github.event.workflow_run.pull_requests[0].head.sha || '' }}
+      PR_NUMBER: ${{ github.event.pull_request.number || github.event.client_payload.pr_number || '' }}
+      EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.client_payload.pr_head_sha || '' }}
     steps:
       - name: Skip events without pull request context
         if: env.PR_NUMBER == ''
@@ -292,13 +279,13 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          if [[ ! "$EXPECTED_HEAD" =~ ^[0-9a-f]{40}$ ]]; then
+          if [[ ! "$EXPECTED_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
             echo "::error::Noema trigger did not provide a canonical lowercase exact head SHA."
             exit 1
           fi
           live_head="$(gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}" --jq '.head.sha')"
-          if [ "${live_head,,}" != "${EXPECTED_HEAD,,}" ]; then
-            echo "::error::Noema trigger is stale; expected ${EXPECTED_HEAD}, observed ${live_head}."
+          if [ "${live_head,,}" != "${EXPECTED_HEAD_SHA,,}" ]; then
+            echo "::error::Noema trigger is stale; expected ${EXPECTED_HEAD_SHA}, observed ${live_head}."
             exit 1
           fi
 
@@ -332,7 +319,7 @@ jobs:
               # current run even when its display_title never rendered a
               # matching "@$head" suffix to exclude by.
               if ! run_ids="$(jq -r --arg pr "$PR_NUMBER" --argjson current "$CURRENT_RUN_ID" \
-                --arg target "$TARGET_REPOSITORY" --arg head "$EXPECTED_HEAD" '
+                --arg target "$TARGET_REPOSITORY" --arg head "$EXPECTED_HEAD_SHA" '
                   .workflow_runs[]
                   | select(.id < $current)
                   | select(.path == ".github/workflows/noema-review.yml")
@@ -364,7 +351,7 @@ jobs:
                   sed 's/^/  /' /tmp/noema-supersede-live-head-error >&2 || true
                   exit 0
                 fi
-                if [ "${live_head,,}" != "${EXPECTED_HEAD,,}" ]; then
+                if [ "${live_head,,}" != "${EXPECTED_HEAD_SHA,,}" ]; then
                   echo "::notice::Noema cleanup stopped because the PR head advanced."
                   exit 0
                 fi
@@ -495,6 +482,25 @@ jobs:
           echo "::add-mask::$app_token"
           echo "token=$app_token" >>"$GITHUB_OUTPUT"
 
+      - name: Validate current pull request head
+        if: env.PR_NUMBER != ''
+        env:
+          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}
+        run: |
+          set -euo pipefail
+          if ! [[ "$EXPECTED_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "::error::Noema expected head must be a full commit SHA."
+            exit 1
+          fi
+          pull_request_json="$(gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}")"
+          live_state="$(jq -r '.state // empty' <<<"$pull_request_json")"
+          live_head_sha="$(jq -r '.head.sha // empty' <<<"$pull_request_json")"
+          if [ "$live_state" != "open" ] || [ "${live_head_sha,,}" != "${EXPECTED_HEAD_SHA,,}" ]; then
+            printf '::error::Noema review target is closed or stale. expected head=%s; live state=%s head=%s.\n' \
+              "$EXPECTED_HEAD_SHA" "${live_state:-missing}" "${live_head_sha:-missing}"
+            exit 1
+          fi
+
       - name: Resolve Noema target repository visibility
         if: env.PR_NUMBER != ''
         id: target_visibility
@@ -575,4 +581,4 @@ jobs:
           python3 -m scripts.ci.noema_review_gate \
             --repo "$TARGET_REPOSITORY" \
             --pr-number "$PR_NUMBER" \
-            --expected-head "$EXPECTED_HEAD"
+            --expected-head "$EXPECTED_HEAD_SHA"

.github/workflows/opencode-review-dispatch.yml

@@ -2312,7 +2312,6 @@ jobs:
     # 36-minute publication gate, the 18-minute Noema handoff, and setup/cleanup
     # overhead without truncating a late current-head verdict, handoff, merge
     # scheduler follow-up, or bounded failure reason.
-    timeout-minutes: 305
     permissions:
       actions: write
       checks: read
@@ -3993,7 +3992,6 @@ jobs:
       - name: Run OpenCode PR Review model pool
         id: opencode_review_model_pool
         if: needs.coverage-evidence.result == 'success'
-        timeout-minutes: 205
         continue-on-error: true
         env:
           SHARE: "false"
@@ -4004,14 +4002,7 @@ jobs:
           # the SAME model 5x let a rate-limited/hung leader consume the whole
           # step, so the pool never reached a healthy fallback model.
           OPENCODE_MODEL_ATTEMPTS: "1"
-          # Preserve reviews that legitimately need tens of minutes to inspect a
-          # large repository. Changed-file count is not a repository-complexity
-          # proxy. Let Contextual Orchestrator use the existing total review
-          # budget; the bounded provider-pool watchdog remains the outer guard.
-          OPENCODE_RUN_TIMEOUT_SECONDS: "11700"
           OPENCODE_EXPORT_TIMEOUT_SECONDS: "180"
-          OPENCODE_TOTAL_RETRY_BUDGET_SECONDS: "11700"
-          OPENCODE_POOL_STEP_TIMEOUT_SECONDS: "12000"
           # A second pass through the same provider catalog repeats the same
           # quota/format failures and can occupy the required check for hours.
           # Exhaust each distinct candidate once, then publish the bounded
@@ -4020,23 +4011,10 @@ jobs:
           OPENCODE_DYNAMIC_REVIEW_CADENCE: "true"
           OPENCODE_SMALL_CHANGE_FILE_THRESHOLD: "3"
           OPENCODE_MEDIUM_CHANGE_FILE_THRESHOLD: "20"
-          OPENCODE_SMALL_CHANGE_RUN_TIMEOUT_SECONDS: "11700"
-          OPENCODE_SMALL_CHANGE_TOTAL_BUDGET_SECONDS: "11700"
-          OPENCODE_MEDIUM_CHANGE_RUN_TIMEOUT_SECONDS: "11700"
-          OPENCODE_MEDIUM_CHANGE_TOTAL_BUDGET_SECONDS: "11700"
-          OPENCODE_LARGE_CHANGE_RUN_TIMEOUT_SECONDS: "11700"
-          OPENCODE_LARGE_CHANGE_TOTAL_BUDGET_SECONDS: "11700"
-          OPENCODE_UNKNOWN_CHANGE_RUN_TIMEOUT_SECONDS: "11700"
-          OPENCODE_UNKNOWN_CHANGE_TOTAL_BUDGET_SECONDS: "11700"
-          OPENCODE_DYNAMIC_RUN_TIMEOUT_CAP_SECONDS: "11700"
-          OPENCODE_DYNAMIC_TOTAL_BUDGET_CAP_SECONDS: "11700"
           OPENCODE_DYNAMIC_MAX_CYCLES_CAP: "1"
-          OPENCODE_FREE_RUN_TIMEOUT_SECONDS: "3600"
           OPENCODE_DYNAMIC_MAX_CYCLES: "1"
           CENTRAL_REVIEW_PROCESS_FALLBACK_ELIGIBLE: ${{ steps.central_review_process_fallback_scope.outputs.eligible || 'false' }}
           CENTRAL_REVIEW_PROCESS_FALLBACK_SCOPE_LABEL: ${{ steps.central_review_process_fallback_scope.outputs.scope_label || 'unsupported' }}
-          OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS: "11700"
-          OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS: "11700"
           OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_MAX_CYCLES: "1"
           OPENCODE_BACKOFF_INITIAL_SECONDS: "30"
           OPENCODE_BACKOFF_MAX_SECONDS: "30"
@@ -4059,18 +4037,9 @@ jobs:
           set -euo pipefail
           source "$GITHUB_WORKSPACE/scripts/ci/load_contextual_orchestrator_token.sh"
           set +e
-          timeout --kill-after=30s "${OPENCODE_POOL_STEP_TIMEOUT_SECONDS:-3600}s" \
-            bash "$GITHUB_WORKSPACE/scripts/ci/run_opencode_review_model_pool.sh"
+          bash "$GITHUB_WORKSPACE/scripts/ci/run_opencode_review_model_pool.sh"
           pool_status=$?
           set -e
-          if [ "$pool_status" -eq 124 ] || [ "$pool_status" -eq 137 ] || [ "$pool_status" -eq 143 ]; then
-            printf 'OpenCode model pool exceeded the outer %ss step budget; marking the pool exhausted so current-head evidence fallback can publish a bounded reason instead of blocking the org queue.\n' \
-              "${OPENCODE_POOL_STEP_TIMEOUT_SECONDS:-3600}"
-            {
-              printf 'review_model=\n'
-              printf 'review_status=exhausted\n'
-            } >>"$GITHUB_OUTPUT"
-          fi
           exit "$pool_status"
 
       - name: Exchange OpenCode app token for review writes
@@ -4623,7 +4592,6 @@ jobs:
         # The approval gate normally waits about six minutes, with bounded
         # extensions for image validation or package/GPU builds plus API and
         # publication overhead.
-        timeout-minutes: 36
         env:
           GH_TOKEN: ${{ steps.opencode_app_token.outputs.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
           CHECK_LOOKUP_GH_TOKEN: ${{ github.token }}
@@ -4678,7 +4646,6 @@ jobs:
           # failed-check diagnosis in this publish step is a short best-effort
           # augmentation; current-head logs/SARIF remain the authoritative
           # reason source when the augmentation is unavailable.
-          OPENCODE_RUN_TIMEOUT_SECONDS: "120"
           OPENCODE_EXPORT_TIMEOUT_SECONDS: "60"
         run: |
           set -euo pipefail
@@ -6032,8 +5999,7 @@ jobs:
             } >"$prompt_file"
 
             cd "$OPENCODE_REVIEW_WORKDIR"
-            if ! timeout --kill-after=30s "${OPENCODE_RUN_TIMEOUT_SECONDS:-120}s" \
-              env -u GH_TOKEN -u GITHUB_TOKEN -u OPENCODE_APP_TOKEN \
+            if ! env -u GH_TOKEN -u GITHUB_TOKEN -u OPENCODE_APP_TOKEN \
               -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL \
               opencode run "$(cat "$prompt_file")" \
               --pure \