continue-strix-transport / continue-noema-transport re-dispatch 403s in consumer repos (repo GITHUB_TOKEN used for cross-repo repository_dispatch) #2509

Symptom

After a provider outage, the strix (and by construction noema) transport continuation can never re-dispatch, so the consumer PR keeps a red required check.

Evidence: fast-mlsirm PR #2031, run 36504286670, job 109249614018 (continue-strix-transport, head 257be76d, attempt 1):

Strix provider capacity unavailable (http_status=unknown, provider_attempt_count=unknown); waiting 159s before same-head continuation re-dispatch 1.
gh: Resource not accessible by integration (HTTP 403)
{"message":"Resource not accessible by integration", ... "create-a-repository-dispatch-event","status":"403"}

Root cause

Both continuation jobs post POST repos/ContextualWisdomLab/.github/dispatches with

GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || github.token }}

• .github/workflows/strix.yml job continue-strix-transport (~L1511, env.GH_TOKEN)
• .github/workflows/noema-review.yml job continue-noema-transport (same pattern)

When the required workflow runs in a consumer repo (fast-mlsirm), secrets.PR_REVIEW_MERGE_TOKEN resolves empty (or lacks access to .github), so the step falls back to the consumer's repo-scoped GITHUB_TOKEN. A repo-scoped GITHUB_TOKEN cannot create a repository_dispatch event in a different repository, which yields exactly the 403 above.

codeql-pr.yml (~L486-515) and opencode-review.yml (~L509) perform the same cross-repo dispatch successfully by minting a token through GitHub OIDC → ${OPENCODE_API_BASE_URL}/exchange_github_app_token (id-token: write).

Proposed fix

1. In both continuation jobs, add id-token: write and mint the app token with the same OIDC exchange step used by codeql-pr.yml, then use it only for the dispatch call; keep PR_REVIEW_MERGE_TOKEN as a first preference if it is ever exposed.
2. Before relying on it, confirm the exchange endpoint accepts strix.yml / noema-review.yml job_workflow_refs (it is currently exercised by codeql-pr / opencode-review only).
3. Add a contract test that no job posting to repos/ContextualWisdomLab/.github/dispatches can fall back to github.token in a consumer-repo run.

Workaround in the meantime

rerun-failed-jobs on the strix run, or a manual strix-scan repository_dispatch with a user token (reported working for fast-mlsirm #2070).

🤖 Generated with Claude Code