fix(automation): stop mention sweep after shared rate-limit exhaustion

[seonghobae]

Incident

Scheduled Review Agent Mention Router run 31868885733 exhausted the OpenCode GitHub App installation REST budget and then continued traversing organization repositories. The run produced zero dispatches and 116 isolated failures, including .github#1008 and bandscope, after the first installation-wide API rate limit exceeded response.

Test-first repair

• RED commit e5e255272f0cef3ed9c4b0b365d5df793cf46807 adds focused regressions proving primary installation-budget exhaustion must stop before a second PR is touched and that secondary-rate-limit messages are also sweep-global.
• GREEN commit 602d4f91f5b58657f1d8e00c18ae0b2a20900280 adds SweepRateLimitExhausted plus exact message classification and raises after recording the first exhausted scope.
• Doctoring commit 2502f665a1b74cb7814c01535c3dbaf3a20ce259 records the incident, trust boundary, rollback, and APA 7 references to GitHub's primary/secondary REST and GitHub App rate-limit guidance.

Boundary

The repair does not retry, sleep, widen permissions, rotate credentials, alter reviewer identity, change the canonical invocation key, weaken the exact-name artifact ledger, or represent failed work as dispatched. Ordinary candidate-local failures remain isolated. Explicit GitHub primary/secondary exhaustion stops only the current scheduled sweep so it cannot amplify an already exhausted shared installation budget.

This is complementary to concurrency-isolation PR #835 and dispatch-envelope PR #840; it does not duplicate their queue or payload changes.

Exact identity

• Protected base: main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba
• Exact head at PR creation: 2502f665a1b74cb7814c01535c3dbaf3a20ce259
• Changed paths: scripts/ci/agent_mention_sweep.py, tests/test_agent_mention_rate_limit.py, docs/doctoring/agent-mention-rate-limit-fail-fast.md

Merge gate

Keep Draft until exact-current-head Agent Mention Router Quality CI, 100% owned statement/branch/docstring coverage, security/SAST/supply-chain checks, current semantic review, zero valid unresolved threads, two qualifying non-author formal approvals including last-push approval, and protected-main branch rules are all satisfied. No queued, failed, predecessor-head, self/author, or bypass evidence is acceptance.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 17e11adb-a383-40db-86ca-d401ddc1cf91

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb06cd and 2502f66.

📒 Files selected for processing (3)

• docs/doctoring/agent-mention-rate-limit-fail-fast.md
• scripts/ci/agent_mention_sweep.py
• tests/test_agent_mention_rate_limit.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-current-head read-only review request for 2502f665a1b74cb7814c01535c3dbaf3a20ce259 over protected base 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.

This focused TDD repair stops an organization-wide mention sweep immediately after the first explicit GitHub primary or secondary installation-rate-limit exhaustion, while preserving isolation for ordinary candidate-local failures. Exact-head Agent Mention Router Quality CI and the hosted security, SAST, supply-chain, and dependency checks are terminal-success; unresolved inline threads are zero. The PR is now Ready and auto-merge is armed subject to independent approvals and protected-main rules.

Review this exact head only. Preserve reviewer identities and credentials; do not mutate the branch, synthesize author approval, weaken protection, or merge.

@opencode-agent review
@cwl-noema-review review
@strix review

[seonghobae]

@opencode-agent @cwl-noema-review @coderabbitai review

Review exact head 2502f665a1b74cb7814c01535c3dbaf3a20ce259. Verify that only explicit GitHub primary/secondary rate-limit exhaustion becomes sweep-global, the first exhausted scope is recorded exactly once, traversal stops before any later PR/repository request, ordinary candidate-local failures remain isolated, no retry/sleep/credential rotation/permission widening is introduced, and the change preserves canonical dispatch, ledger, reviewer, and merge-authority contracts. Submit a formal exact-head verdict.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 39 minutes and 3 seconds before sending another message.