fix(opencode): extend model pool retry budget

.github/workflows/opencode-review.yml

@@ -1438,10 +1438,10 @@ jobs:
       # continue-on-error, so it survives the job failing.
       model_pool_outcome: ${{ steps.opencode_review_model_pool.outputs.review_status }}
     # Coverage and current-head evidence are prepared before the model pool.
-    # The model pool has a 25-minute retry budget and its publish gate has an
-    # 8-minute cap, so 45 minutes releases genuinely hung runners without
+    # The model pool has a 60-minute retry budget and its publish gate has an
+    # 8-minute cap, so 90 minutes releases genuinely hung runners without
     # truncating the bounded multi-provider review path.
-    timeout-minutes: 45
+    timeout-minutes: 90
     permissions:
       actions: read
       checks: read
@@ -3178,7 +3178,7 @@ jobs:
       - name: Run OpenCode PR Review model pool
         id: opencode_review_model_pool
         if: needs.coverage-evidence.result == 'success'
-        timeout-minutes: 12
+        timeout-minutes: 65
         continue-on-error: true
         env:
           STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
@@ -3210,25 +3210,25 @@ jobs:
           # Keep stale providers from pinning required review jobs for hours.
           # Adversarial validation needs enough room to read the evidence, but
           # dynamic cadence and the outer watchdog still bound each current-head run.
-          OPENCODE_RUN_TIMEOUT_SECONDS: "180"
+          OPENCODE_RUN_TIMEOUT_SECONDS: "600"
           OPENCODE_EXPORT_TIMEOUT_SECONDS: "120"
-          OPENCODE_TOTAL_RETRY_BUDGET_SECONDS: "540"
-          OPENCODE_POOL_STEP_TIMEOUT_SECONDS: "540"
+          OPENCODE_TOTAL_RETRY_BUDGET_SECONDS: "3600"
+          OPENCODE_POOL_STEP_TIMEOUT_SECONDS: "3600"
           # Visit the high-sensitivity candidate catalog once. Per-provider
           # failures and timeouts are logged before the publish gate evaluates
           # the current-head result and fails closed when no verdict exists.
           OPENCODE_POOL_MAX_CYCLES: "1"
           OPENCODE_DYNAMIC_REVIEW_CADENCE: "true"
           OPENCODE_SMALL_CHANGE_FILE_THRESHOLD: "3"
           OPENCODE_MEDIUM_CHANGE_FILE_THRESHOLD: "20"
-          OPENCODE_SMALL_CHANGE_RUN_TIMEOUT_SECONDS: "90"
-          OPENCODE_SMALL_CHANGE_TOTAL_BUDGET_SECONDS: "180"
-          OPENCODE_MEDIUM_CHANGE_RUN_TIMEOUT_SECONDS: "120"
-          OPENCODE_MEDIUM_CHANGE_TOTAL_BUDGET_SECONDS: "360"
-          OPENCODE_LARGE_CHANGE_RUN_TIMEOUT_SECONDS: "180"
-          OPENCODE_LARGE_CHANGE_TOTAL_BUDGET_SECONDS: "540"
-          OPENCODE_UNKNOWN_CHANGE_RUN_TIMEOUT_SECONDS: "120"
-          OPENCODE_UNKNOWN_CHANGE_TOTAL_BUDGET_SECONDS: "360"
+          OPENCODE_SMALL_CHANGE_RUN_TIMEOUT_SECONDS: "600"
+          OPENCODE_SMALL_CHANGE_TOTAL_BUDGET_SECONDS: "3600"
+          OPENCODE_MEDIUM_CHANGE_RUN_TIMEOUT_SECONDS: "600"
+          OPENCODE_MEDIUM_CHANGE_TOTAL_BUDGET_SECONDS: "3600"
+          OPENCODE_LARGE_CHANGE_RUN_TIMEOUT_SECONDS: "600"
+          OPENCODE_LARGE_CHANGE_TOTAL_BUDGET_SECONDS: "3600"
+          OPENCODE_UNKNOWN_CHANGE_RUN_TIMEOUT_SECONDS: "600"
+          OPENCODE_UNKNOWN_CHANGE_TOTAL_BUDGET_SECONDS: "3600"
           # This installation currently reports a 4k request-body limit for
           # GitHub Models GPT-5 endpoints even though the public catalog is
           # larger. Keep the exact runtime failure visible without spending a
@@ -3237,8 +3237,8 @@ jobs:
           OPENCODE_DYNAMIC_MAX_CYCLES: "1"
           CENTRAL_REVIEW_PROCESS_FALLBACK_ELIGIBLE: ${{ steps.central_review_process_fallback_scope.outputs.eligible || 'false' }}
           CENTRAL_REVIEW_PROCESS_FALLBACK_SCOPE_LABEL: ${{ steps.central_review_process_fallback_scope.outputs.scope_label || 'unsupported' }}
-          OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS: "120"
-          OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS: "180"
+          OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS: "600"
+          OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS: "3600"
           OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_MAX_CYCLES: "1"
           OPENCODE_BACKOFF_INITIAL_SECONDS: "30"
           OPENCODE_BACKOFF_MAX_SECONDS: "30"
@@ -3259,13 +3259,13 @@ jobs:
         run: |
           set -euo pipefail
           set +e
-          timeout --kill-after=30s "${OPENCODE_POOL_STEP_TIMEOUT_SECONDS:-540}s" \
+          timeout --kill-after=30s "${OPENCODE_POOL_STEP_TIMEOUT_SECONDS:-3600}s" \
             bash "$GITHUB_WORKSPACE/scripts/ci/run_opencode_review_model_pool.sh"
           pool_status=$?
           set -e
           if [ "$pool_status" -eq 124 ] || [ "$pool_status" -eq 137 ] || [ "$pool_status" -eq 143 ]; then
             printf 'OpenCode model pool exceeded the outer %ss step budget; marking the pool exhausted so current-head evidence fallback can publish a bounded reason instead of blocking the org queue.\n' \
-              "${OPENCODE_POOL_STEP_TIMEOUT_SECONDS:-540}"
+              "${OPENCODE_POOL_STEP_TIMEOUT_SECONDS:-3600}"
             {
               printf 'review_model=\n'
               printf 'review_status=exhausted\n'
@@ -6481,42 +6481,8 @@ jobs:
               return 0
             fi
 
-            clean_evidence_fallback_body="$(printf '%s\n' \
-              "## Pull request overview" \
-              "" \
-              "OpenCode model providers were unavailable for this same-head run, but deterministic current-head evidence is clean: coverage evidence passed, peer GitHub Checks are complete, medium-or-higher code-scanning alerts are clear, mergeability is clean, and reviewer threads are resolved or outdated." \
-              "" \
-              "## Findings" \
-              "" \
-              "No blocking findings in deterministic current-head evidence." \
-              "" \
-              "## Evidence" \
-              "" \
-              "- Result: APPROVE" \
-              "- Reason: MODEL_UNAVAILABLE_CLEAN_EVIDENCE" \
-              "- Model-pool outcome: \`${OPENCODE_MODEL_POOL_OUTCOME:-unknown}\`" \
-              "- Head SHA: \`${HEAD_SHA}\`" \
-              "- Workflow run: ${RUN_ID}" \
-              "- Workflow attempt: ${RUN_ATTEMPT}" \
-              "- Review provenance: deterministic fallback after model-output unavailability; no adversarial_validation block was fabricated." \
-              "" \
-              "This fallback does not suppress failed checks, medium-or-higher code-scanning alerts, merge conflicts, unresolved reviewer threads, or failed coverage evidence; any of those conditions still publish REQUEST_CHANGES or leave the approval state unchanged."
-            )"
-            printf '::notice::MODEL_OUTPUT_UNAVAILABLE: current-head deterministic evidence is clean for head %s; publishing MODEL_UNAVAILABLE_CLEAN_EVIDENCE approval so provider outage is not treated as a source blocker.\n' "$HEAD_SHA"
-            create_pull_review "APPROVE" "$clean_evidence_fallback_body"
-            if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
-              {
-                printf '## OpenCode required check satisfied by clean deterministic evidence\n\n'
-                printf -- '- Result: `MODEL_UNAVAILABLE_CLEAN_EVIDENCE`\n'
-                printf -- '- Head SHA: `%s`\n' "$HEAD_SHA"
-                printf -- '- Workflow run: %s\n' "$RUN_ID"
-                printf -- '- Workflow attempt: %s\n' "$RUN_ATTEMPT"
-                printf -- '- Model-pool outcome: `%s`\n' "${OPENCODE_MODEL_POOL_OUTCOME:-unknown}"
-                printf -- '- Reason: model providers were unavailable, while coverage, peer checks, code-scanning alerts, mergeability, and review threads were clean for this exact head.\n'
-                printf -- '- Review state: APPROVE posted from deterministic current-head evidence; no adversarial_validation block was fabricated.\n\n'
-              } >>"$GITHUB_STEP_SUMMARY"
-            fi
-            return 0
+            printf '::notice::MODEL_OUTPUT_UNAVAILABLE: deterministic evidence fallback will not approve %s#%s because model-unavailable approvals are limited to existing same-head real-model approvals or allowlisted central review-process self-repair.\n' "${GH_REPOSITORY:-unknown}" "${PR_NUMBER:-unknown}"
+            return 1
           }
 
           same_head_opencode_approval_exists() {

.github/workflows/strix.yml

@@ -651,8 +651,8 @@ jobs:
           # Capture the gate exit code plus its console output. The gate returns
           # exit 1 both for genuine blocking vulnerabilities AND for
           # LLM-backend-unavailable outcomes (GitHub Models "Too many requests"
-          # rate limits, 413 tokens_limit_reached token-cap, connection/warm-up
-          # failures) that could not complete a scan. A backend outage is CI
+          # rate limits, OpenAI quota starvation, 413 tokens_limit_reached
+          # token-cap, connection/warm-up failures) that could not complete a scan. A backend outage is CI
           # infrastructure noise, not a security finding, so it must not fail
           # the required check and block merges.
           strix_run_log="$RUNNER_TEMP/strix_gate_console.log"
@@ -674,7 +674,7 @@ jobs:
           fi
 
           # Recognized signals that the LLM backend was unavailable / starved.
-          backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure'
+          backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure'
           # Any evidence that a vulnerability was actually reported. Its presence
           # forces a hard failure so real findings are NEVER downgraded. Keep the
           # severity branch anchored away from identifiers so environment lines

scripts/ci/run_opencode_review_model_pool.sh

@@ -626,8 +626,8 @@ main() {
 	budget_seconds="${OPENCODE_TOTAL_RETRY_BUDGET_SECONDS:-1500}"
 	max_cycles="${OPENCODE_POOL_MAX_CYCLES:-0}"
 	if [ "${CENTRAL_REVIEW_PROCESS_FALLBACK_ELIGIBLE:-false}" = "true" ]; then
-		original_run_timeout="${OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS:-300}"
-		budget_seconds="${OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS:-420}"
+		original_run_timeout="${OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS:-600}"
+		budget_seconds="${OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS:-3600}"
 		max_cycles="${OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_MAX_CYCLES:-1}"
 		printf 'Central review-process evidence fallback eligible for scope "%s"; limiting OpenCode model pool to %ss per attempt, %ss total budget, and %s cycle(s) so provider delay is logged before the publish fallback evaluates current-head peer evidence.\n' \
 			"${CENTRAL_REVIEW_PROCESS_FALLBACK_SCOPE_LABEL:-unsupported}" "$original_run_timeout" "$budget_seconds" "$max_cycles"

scripts/ci/strix_quick_gate.sh

@@ -2735,6 +2735,11 @@ is_rate_limit_error() {
 		return 0
 	fi
 
+	if grep -Eiq '(exceeded your current quota|insufficient_quota|billing details)' "$STRIX_LOG" &&
+		grep -Eiq "$LLM_PROVIDER_ONLY_REGEX" "$STRIX_LOG"; then
+		return 0
+	fi
+
 	# Bare HTTP 429 — require a provider marker so we don't misclassify
 	# target-application rate-limit responses as LLM provider errors.
 	if grep -Eq '(^|[^0-9])429([^0-9]|$)' "$STRIX_LOG" &&