env-reach

Classify the failure by its message: the exact classifier denial phrase means the request never left, an HTTP code like 403 means GitHub or a proxy rejected it, and no code at all means a transport failure. Each cause requires a different response.

Stop and report instead of retrying, since classifier denials vary by tool and session and cannot be bypassed with permissions.allow. Do not build workarounds or route the blocked action through another tool or a local session.

Not blindly. A 502 or 504 can mean the proxy forwarded your POST but lost the response, so GitHub may have already processed it. Read the remote state first or make the call idempotent before retrying to avoid duplicate issues or comments.

No. Check the response body: 'Resource not accessible by integration' indicates a permission problem, while secondary rate limit messages with Retry-After headers mean you should wait. Other wording may come from org policies or the proxy itself.

Git push uses the git protocol with separately injected credentials, not the REST API permission set. A blocked git/refs API endpoint does not imply push is blocked, so branches can still be uploaded even when API writes fail.

GraphQL is blocked by the proxy with a 403 before authentication, so changing tokens does not help. Use the documented REST CCR endpoints for review threads instead, and note that local sessions are unaffected.