fix(prioritize): CSMA/CD rate-limit resilience for post-prioritize

[ifireball]

Summary

• Add shared scripts/lib/github-api-csma.sh with carrier-sense quota checks, inter-call jitter, and exponential backoff on GitHub 429/secondary rate limits.
• Wire the helper into post-prioritize.sh for project field updates and sticky comment posting.
• Add post-prioritize-test.sh and register it in make script-test.

Test plan

• bash internal/scaffold/fullsend-repo/scripts/post-prioritize-test.sh
• make script-test
• go test ./internal/scaffold/... -run TestFullsendRepoFiles

Made with Cursor

[waynesun09]

Review Squad Report — 6-agent review

Agents: 2x claude-coder, 2x claude-researcher, gemini-code-review, cursor-code-review
Verified findings: 1 CRITICAL, 3 HIGH, 6 MEDIUM (inline), plus 4 LOW / 3 INFO (not inline)
False positives removed: 7

Key finding

The cat "${combined}" bug (lines 201, 242, 279) silently swallows all non-retryable error output — confirmed by 4/6 agents. This should be fixed before merge.

LOW / INFO (not posted inline)

• LOW: $RANDOM has 15-bit entropy — parallel CI runners with sequential PIDs may produce identical jitter sequences
• LOW: Shebang on sourced library is misleading (file is mode 100644, designed to be sourced)
• LOW: >/dev/null on fullsend post-comment suppresses debug output
• LOW: Tests don't verify RICE score computation or that CSMA was actually invoked
• INFO: Other post-scripts (triage, code, retro) are unprotected — follow-up work
• INFO: CSMA/CD analogy is closer to CSMA/CA (WiFi 802.11) — implementation is sound regardless
• INFO: Test BACKOFF_CAP_SEC=1 prevents exercising real backoff math

[github-actions]

Site preview

Preview: https://ec3d15e8-site.fullsend-ai.workers.dev

Commit: a6984f637b547c5211fc2af284f8352785fb03a6

[fullsend-ai-review]

Review

Findings

No findings.

The CSMA/CD library is well-implemented with proper carrier-sense quota checks, inter-call jitter, and exponential backoff with rate-limit reset awareness. The three wrapper functions (github_csma_run, github_csma_run_pipe, github_csma_run_cmd) correctly handle their respective use cases (direct gh calls, piped stdin to gh, and arbitrary commands). Temp file cleanup via trap ... RETURN is correct for all exit paths.

The integration into post-prioritize.sh correctly wraps all five gh call sites and the fullsend post-comment call. The >/dev/null on the final fullsend call appropriately suppresses success output while preserving stderr for error reporting.

Test coverage is solid: unit tests for github_csma_is_rate_limit (including the {"totalCount":429} false-positive guard) and github_csma_backoff, plus integration tests for happy path, rate-limit retry, non-retryable auth errors, and exhausted retries. The mock gh script correctly simulates rate-limit responses and distinguishes auth errors from retryable failures.

Scaffold bookkeeping is correct: post-prioritize-test.sh added to executableFiles (mode 100755), github-api-csma.sh correctly omitted (mode 100644, sourced not executed), both added to TestFullsendRepoFilesExist, and the test registered in make script-test.

[waynesun09]

All 8 review findings addressed in the fix commit. LGTM.