GitHub Rate Limit Fallback -> Primary

apps/ade-cli/README.md

@@ -506,6 +506,7 @@ ade cursor cloud agents create --repo https://github.com/owner/repo --prompt "fi
 ade --role cto github app-auth login              # device-flow authorize the machine ADE GitHub App (headless/brain)
 ade github app-auth status --text                 # show whether a GitHub App user token is stored (login, expiry)
 ade --role cto github app-auth clear              # remove the stored GitHub App authorization
+ade actions run github.getStatus --input-json '{"forceRefresh":true}' --text # show active read/write sources and cooldowns
 ade open ade://lane/<lane-uuid>
 ade open --linear-issue ADE-123 --branch arul/ade-123-fix
 ade link lane <lane-uuid>
@@ -521,6 +522,11 @@ ade skill list --text
 ade skill show ade-browser --text
 ```
 
+GitHub reads try credentials in environment → ADE GitHub App → GitHub CLI →
+stored PAT order. Writes skip the read-only GitHub App. `github.getStatus`
+reports the active read/write sources, per-credential failure/cooldown state,
+fallback details, and any background-refresh pause without exposing tokens.
+
 Use typed commands first. They validate common arguments and provide stable JSON fields or readable text summaries. Use `ade help <command> <subcommand>` for exact flags, `ade actions list --text` to discover the full service-backed action catalog, and `ade actions run <domain.action>` only when there is no typed command for the workflow yet. For stored project credentials, prefer `ade secrets`; `list` is metadata-only and `get --text` prints the secret value, so agents should read only the named secret the user asked for and avoid logging it.
 
 Output modes are explicit: `--text` for human-readable summaries, `--json` (default for piped output) for stable JSON, and `--pretty` for pretty-printed JSON.

apps/ade-cli/src/bootstrap.ts

@@ -1221,7 +1221,7 @@ export async function createAdeRuntime(args: {
       logger,
       appVersion: "ade-cli",
       getAdeCliAgentEnv: createHeadlessAdeCliAgentEnv,
-      getLocalGitHubToken: () => headlessLinearServices.githubService.getTokenOrThrowAsync(),
+      getLocalGitHubToken: () => headlessLinearServices.githubService.getGitTransportTokenOrThrowAsync(),
       onLinearIssueChatLinked: publishLinearChatLink,
       onEvent: (event) => {
         pushEvent("runtime", event as unknown as Record<string, unknown>);
@@ -1446,6 +1446,9 @@ export async function createAdeRuntime(args: {
     prService: headlessLinearServices.prService,
     projectConfigService,
     db,
+    isGithubRelayHealthy: () => automationIngressService.isGithubRelayHealthy(),
+    getGithubBackgroundPauseUntilMs: () =>
+      headlessLinearServices.githubService.getBackgroundRequestPauseUntilMs(),
     onEvent: emitPrEvent,
     onPullRequestsSnapshot: (snapshot) =>
       prMergeAutoSettlementService?.processSnapshot(snapshot),
@@ -1978,7 +1981,7 @@ export async function createAdeRuntime(args: {
       swallow(() => iosSimulatorService?.dispose());
       swallow(() => appControlService?.dispose());
       swallow(() => builtInBrowserBridge?.dispose());
-      swallow(() => linearOAuthService.dispose());
+      void linearOAuthService.dispose().catch(() => {});
       swallow(() => headlessLinearServices.dispose());
       swallow(() => agentChatService?.forceDisposeAll?.());
       swallow(() => testService.disposeAll());

apps/ade-cli/src/cli.ts

@@ -1212,15 +1212,18 @@ const HELP_BY_COMMAND: Record<string, string> = {
     $ ade github app-auth status --text        Show whether a token is stored (login, expiry)
     $ ade --role cto github app-auth clear      Remove the stored authorization
     $ ade github actions --text                 List raw github service actions
+    $ ade actions run github.getStatus --input-json '{"forceRefresh":true}' --text
+                                                Show active read/write credentials and cooldowns
 
   Notes:
     - login, clear (and the raw start/poll actions) require --role cto.
     - login keeps one connection open for the whole device flow because the
       device-auth session lives in runtime memory; do not split start and poll
       across separate invocations in headless mode.
-    - GitHub operations prefer an explicit environment token, then GitHub CLI,
-      and finally a stored PAT. The GitHub App remains read-only and is used
-      only for webhook-backed PR updates.
+    - GitHub reads try an explicit environment token, the ADE GitHub App,
+      GitHub CLI, then a stored PAT. Writes skip the read-only GitHub App.
+      Authentication failures and rate limits can fall through to the next
+      healthy credential while the failed source is in cooldown.
 
   Flags (login):
     --max-wait <seconds>    Give up waiting after N seconds (default: GitHub's