fix(scheduler): fail after summarized action errors

[seonghobae]

Root cause

The scheduler isolated per-PR mutation and dispatch failures into action_error decisions, emitted its complete human and JSON summaries, and then unconditionally returned success. The organization sweep also classified any 403-shaped output as an unreadable repository, even when the versioned scheduler payload proved that repository inspection succeeded and the 403 came from an attempted action.

Change

• return nonzero only after the complete scan and summary when any action_error exists
• keep ordinary wait, block, skip, and deferred-capacity outcomes successful
• treat a 403 as repository-unavailable only when no versioned scheduler payload exists
• preserve targeted and organization-sweep propagation contracts
• document the terminal policy and authoritative GitHub Actions references

Verification

• TDD red: exact regression set failed on the unconditional zero return, missing versioned-payload classifier, and missing doctoring contract
• uv run --with pip pytest: 1,395 passed, 1 skipped
• uv run --with pip coverage run -m pytest -q && uv run --with pip coverage report --show-missing --fail-under=100: 8,348 statements and 3,214 branches at 100%
• uv run --with pip interrogate --fail-under=100 scripts/ci: 100%
• uv run --with pip python -m compileall -q scripts/ci tests
• actionlint .github/workflows/pr-review-merge-scheduler.yml with ShellCheck 0.11.0
• git diff --check
• CodeGraph synchronized and healthy

The explicit --with pip isolates the current-main fresh-uv bootstrap gap tracked separately by #1265; this change does not duplicate that boundary.

Supersedes #899.
Closes #894.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc613038-b25a-4013-8adc-11301843a0e9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 0 potential issues.

[devin-ai-integration]

Devin Review found 0 new potential issues.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 4cd10ce7e967bc1d2b1297716ee61e94584141c3.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32659790911/job/97244088159)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32659790911/job/97244088159)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: pr-review-merge-scheduler.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: pr-review-merge-scheduler.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_merge_scheduler.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script: pr_review_merge_scheduler.py"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (2 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (2 files)"]
  R5 --> V5["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 4cd10ce7e967bc1d2b1297716ee61e94584141c3
• Workflow run: 32662255656
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 4cd10ce7e967bc1d2b1297716ee61e94584141c3.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32659790911/job/97244088159)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32659790911/job/97244088159)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: pr-review-merge-scheduler.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: pr-review-merge-scheduler.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_merge_scheduler.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script: pr_review_merge_scheduler.py"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (2 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (2 files)"]
  R5 --> V5["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 4cd10ce7e967bc1d2b1297716ee61e94584141c3.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32659790911/job/97244088159)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32659790911/job/97244088159)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: pr-review-merge-scheduler.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: pr-review-merge-scheduler.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_merge_scheduler.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script: pr_review_merge_scheduler.py"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (2 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (2 files)"]
  R5 --> V5["targeted test run"]

Loading

[seonghobae]

Exact-head check RCA: Strix run 32659790911 failed after repeated NVIDIA NIM HTTP 429 rate-limit responses, then the direct fallback returned LLM Provider NOT provided; no vulnerability report artifact was produced. This is provider/backend infrastructure, not a source finding in the scheduler change. Keep the fail-closed result and revalidate after provider remediation.