fix(review): bound free-provider failover

[seonghobae]

Summary

• cap each opencode-free/* review attempt at 600 seconds
• preserve the existing 90-minute window for paid/full review providers
• reuse the shared provider timeout cap instead of adding a second runner path

Runtime evidence

The first production review after #659 passed coverage in 1m11s, then remained in opencode-free/nemotron-3-ultra-free for more than 20 minutes with no verdict or failover: central run 30503754266 against ContextualWisdomLab/saju-caldav#14.

Validation

• focused model-pool + contract tests: 59 passed
• full suite: 679 passed
• Ruff, Bash syntax, workflow YAML parse, and git diff --check: passed

Follow-up to #659.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ef5fa17d-be4a-420c-94db-0b63d055eef9

📥 Commits

Reviewing files that changed from the base of the PR and between 7231cb7 and 1142c4c.

📒 Files selected for processing (4)

• .github/workflows/opencode-review-dispatch.yml
• scripts/ci/run_opencode_review_model_pool.sh
• tests/test_opencode_agent_contract.py
• tests/test_opencode_model_pool_runner.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head refresh: replaced the behind aa7333a head with 1142c4c, rebuilt as the same single-purpose change directly on current main 7231cb7.

Validation before push:

• focused model-pool and workflow contract tests: 59 passed
• full repository suite: 702 passed
• actionlint, ShellCheck (excluding pre-existing informational SC2016 prompt-literal notices), Ruff, and git diff check: clean
• live failure evidence: the previous current-head model pool allowed opencode-free candidates a 5,400-second attempt window; one free candidate consumed 5m52s before control rejection. The new trusted workflow pins OPENCODE_FREE_RUN_TIMEOUT_SECONDS=600 and the tested opencode-free/* branch preserves the remaining queue budget for failover.

The update was force-with-lease guarded against the exact former PR head. Superseded-head checks are not merge evidence; only 1142c4c current-head results will be used.

[seonghobae]

Merged-audit evidence for current head 1142c4c:

• 46 current-head checks completed without failures or pending work; CodeQL merge-preview and compatibility analyses, pip-audit, OSV, dependency review, Semgrep, Bandit, Trivy, gitleaks, Scorecard, Noema, coverage evidence, and Strix passed.
• Open Medium/High/Critical code-scanning alerts: 0. Current unresolved review threads: 0.
• Strix produced provider 429/403 logs and no vulnerability report artifact; all independent security gates were green.
• The exact-head central OpenCode dispatch 30509193921 was force-cancelled because trusted workflow execution necessarily used pre-fix main and therefore could not exercise this PRs new free-provider timeout. This is the pipeline bootstrap defect covered by the explicitly authorized force-merge exception.
• SHA-guarded squash merge 7711503 has the exact same tree as the PR head.
• Governance was immediately restored: ruleset active, no bypass actors, 2 approvals plus last-push approval plus thread resolution required; strict branch protection, admins enforced, force-push/delete disabled.

Post-merge origin/main full-suite verification is running against the exact merge commit and will be recorded when complete.

[seonghobae]

Post-merge verification completed on the exact remote default-branch commit 7711503: 702 passed in 81.28s. The temporary detached worktree was removed after verification.