fix(strix): retry transient visibility API failures

.github/workflows/strix.yml

@@ -462,6 +462,7 @@ jobs:
           test -f "$trusted_strix_source/scripts/ci/strix_quick_gate.sh"
           test -f "$trusted_strix_source/scripts/ci/test_strix_quick_gate.sh"
           test -f "$trusted_strix_source/scripts/ci/strix_required_workflow_smoke.sh"
+          test -f "$trusted_strix_source/scripts/ci/strix_resolve_target_visibility.py"
           {
             echo "TRUSTED_STRIX_SOURCE=$trusted_strix_source"
             echo "TRUSTED_STRIX_GATE=$trusted_strix_source/scripts/ci/strix_quick_gate.sh"
@@ -548,45 +549,16 @@ jobs:
             exit 1
           fi
           case "$EVENT_REPOSITORY_VISIBILITY" in
-            PUBLIC | public) is_private=false ;;
-            PRIVATE | private | INTERNAL | internal) is_private=true ;;
+            PUBLIC | public) echo "is_private=false" >>"$GITHUB_OUTPUT" ;;
+            PRIVATE | private | INTERNAL | internal) echo "is_private=true" >>"$GITHUB_OUTPUT" ;;
             "")
-              is_private=""
-              for target_visibility_attempt in 1 2 3 4 5 6; do
-                # The single-quoted jq program intentionally expands jq's
-                # `$visibility`, not a shell variable (ShellCheck SC2016).
-                # shellcheck disable=SC2016
-                if is_private="$(
-                  gh api "repos/${TARGET_REPOSITORY}" --jq '
-                    (.visibility // "" | ascii_downcase) as $visibility
-                    | if $visibility == "public" then "false"
-                      elif $visibility == "private" or $visibility == "internal" then "true"
-                      else empty
-                      end
-                  '
-                )"; then
-                  break
-                fi
-                is_private=""
-                if [ "$target_visibility_attempt" -lt 6 ]; then
-                  echo "Repository visibility lookup failed (attempt ${target_visibility_attempt}/6), possibly a transient GitHub API rate limit; retrying after backoff." >&2
-                  sleep "$(( target_visibility_attempt * 5 ))"
-                fi
-              done
+              python3 "$TRUSTED_STRIX_SOURCE/scripts/ci/strix_resolve_target_visibility.py"
               ;;
             *)
               echo "::error::Target repository event visibility was not public, private, or internal."
               exit 1
               ;;
           esac
-          case "$is_private" in
-            true | false) ;;
-            *)
-              echo "::error::Target repository visibility did not resolve to true or false after retries."
-              exit 1
-              ;;
-          esac
-          echo "is_private=$is_private" >>"$GITHUB_OUTPUT"
 
       - name: Materialize target workspace
         if: github.event_name != 'repository_dispatch'

CHANGELOG.md

@@ -1395,7 +1395,14 @@ Semantic Versioning where the repository publishes a release.
   again.
 - Resolve Strix visibility from the trusted GitHub event for ordinary push,
   schedule, and pull-request runs, reserving API retries for cross-repository
-  dispatches whose workflow token may not see the target repository.
+  dispatches whose workflow token may not see the target repository. The
+  reserved cross-repository fallback now delegates to
+  `scripts/ci/strix_resolve_target_visibility.py` (see the transient/rate-limit
+  retry entry below) instead of the prior inline six-attempt linear-backoff
+  loop, so the two independently landed fixes for the same root cause compose:
+  the trusted-event fast path skips the GitHub API call entirely, and only the
+  `repository_dispatch` path retries, now with separate transient/rate-limit
+  budgets and `Retry-After`/`X-RateLimit-Reset` support.
 - Reconciled the Strix required-workflow smoke contract and the privileged
   OpenCode model pool with the current `gpt-5.4` direct-OpenAI fallback after
   `gpt-5.6-luna` was retired. This prevents every consumer repository's
@@ -1453,6 +1460,7 @@ Semantic Versioning where the repository publishes a release.
 - Restored 100% docstring coverage for the commercial-readiness GitHub transport constructor.
 - Refused PR Review Merge Scheduler head mutations, `update-branch` and the last-push approval head restamp, whenever the resolved mutation credential is the workflow `GITHUB_TOKEN`. GitHub starts no workflow run for events created with that credential, so the moved head collected no current-head required checks and the PR stayed permanently `BLOCKED` with a `github-actions[bot]` merge commit that no later scheduler run could repair, because the branch was no longer behind. The scheduler now waits with `head_mutation_credential_upgrade` guidance naming `PR_REVIEW_MERGE_TOKEN`, `OPENCODE_APPROVE_TOKEN`, and the OpenCode app token exchange.
 - Parsed `opencode.jsonc` as JSONC (stripping `//` and `/* */` comments outside string literals) in the reasoning-effort guard and its contract tests, instead of raw `json.loads`, which rejected the file the moment it carried its first explanatory comment (added for the `contextual-orchestrator` provider block) with `Expecting property name enclosed in double quotes`. Comment markers inside string values, such as the `$schema` URL, are left untouched.
+- Retried transient GitHub visibility lookups in the required Strix job so a timeout, 408, 5xx, 429, empty/non-boolean response, leftover CONNECT `200`, or authenticated HTTP 403 rate-limit (installation budget / secondary rate limit) no longer aborts the scan before it starts. Rate-limit 403 uses a distinct 3-attempt budget and a 30–60s bounded wait (Retry-After / X-RateLimit-Reset when present, otherwise 30/60s). Multi-block `gh --include` output uses the terminal HTTP status, so a leading proxy `200 Connection established` cannot suppress a later 429/503 retry, a later timeout/reset marker, or a CONNECT-only drop. A real 401/403/404 on a missing or unauthorized repository stays fail-closed and is never treated as a source finding.
 - Download the pinned `uv` 0.12.1 exporter from the official GitHub Releases URL instead of `releases.astral.sh`, which now returns HTTP 403 and blocks org-wide OpenCode `coverage-evidence`. The SHA-256 pin is unchanged. The opener may follow one hop onto `release-assets.githubusercontent.com` or `objects.githubusercontent.com` and still rejects every other host, userinfo, non-HTTPS scheme, and nondefault port (ContextualWisdomLab/.github#1109).
 - Compared the trusted `uv` executable's post-install `--version` output against the real GitHub Releases build's full string, `uv 0.12.1 (x86_64-unknown-linux-gnu)`, instead of the bare `uv 0.12.1` the prior check required; the genuine release binary always prints the target triple, so every installation was failing the pin check immediately after the archive download itself was fixed (ContextualWisdomLab/.github#1109).
 - Excluded relative `-r` and `--requirement` referrers from generated flat base-lock publication while retaining bounded include syntax diagnostics and discovering independently complete direct `.txt` children of `requirements` directories.