fix(ci): pin catalog-compatible contextual-orchestrator revision

[seonghobae]

Summary

• pin the central review sidecar to contextual-orchestrator d1bd3626ddb04a7b14e43aebf60827ac50ef8d17
• update the immutable pin contract and ADR
• resolves the list-shaped agent catalog KeyError: agents observed in required Noema reviews

Validation

• python3 -m pytest -q tests/test_contextual_orchestrator_review_sidecar_contract.py (14 passed)

The pinned revision is an exact upstream PR head and remains subject to normal protected review.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a1a84456-17a0-4c9c-85de-a9cd9f10b475

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Cross-repository evidence: accounting-information-platform PR #29 exact head ebe04200792ee9760c332396128975d10f4212ba reproduces the pinned c60ec889bdd1b8dd0b2be53e60d7b758a4ece6b7 sidecar failure in both Required Noema Review and Strix. The sidecar reaches load_agents with a list-shaped catalog and c60ec load_agents expects data["agents"]. contextual-orchestrator PR #901 head d1bd3626 contains the compatible loader fix and its focused model-group suite passes 27/27 locally. PR #1371 pins that compatible revision; PR #1370 provides the alternative workflow envelope normalization. Until one trusted path is integrated, the accounting PR cannot obtain authoritative Noema/Strix evidence.

[seonghobae]

@opencode-agent

[seonghobae]

@opencode-agent

Please review exact current head 8a3717430048a53ef4aa62dc69de83e0e03de7f5 against main@8f84b661e468de451ba5c076dc938f342bf52d70. Review only; do not update, merge, bypass, or dismiss protection. Confirm the catalog-compatible contextual-orchestrator pin and workflow boundary.

[seonghobae]

Owner-path evidence update for the current Noema/central review failure class:

• Protected central main is f6c2a2702b7b7578b2d1fc5f2f9a5125a0390d33; its sidecar still defaults to ORCHESTRATOR_PIN_SHA=c60ec889bdd1b8dd0b2be53e60d7b758a4ece6b7.
• Central fix(security): fail closed on unavailable dependency review #897 Strix run 33146562912, job 98769125825, used that exact protected-sidecar pin and failed closed after three provider attempts with HTTP 400 invalid_tools: each tool.function.description must be at most 1024 characters (request IDs f0ad92aaf51842878f2ffbe48d17d17e, 3b717390da54412fbcd660a042ecada5, 0eef0fbe60f744f1b8ee88eb63b2e067). This is an integration/pin incompatibility, not a Noema product finding.
• ContextualWisdomLab/contextual-orchestrator#887 merged as 2591b66a272a36df255500093e4ff33fac94097e and removes that unsupported 1024-character tool-description cap while preserving the bounded request-body contract. This PR's proposed pin d1bd3626ddb04a7b14e43aebf60827ac50ef8d17 is a descendant of 2591b66a... (14 commits ahead), so it contains the owning orchestrator repair.
• The current fix(ci): pin catalog-compatible contextual-orchestrator revision #1371 head is bc996ddcc26958aae0be3bde76f2fd60201a12dc on central base f6c2a270.... Its previously cancelled Security Scan 33146545771, CodeQL 33146545753, and Python Security 33146545737 have been re-run through the existing check path; no foreign source/ref was changed.

Acceptance/revalidation: converge #1371 through normal central governance without weakening gates, then re-run Strix on an exact submitted head and require the sidecar log to show a pin containing #887, no invalid_tools 1024-description rejection, and a terminal authoritative scanner result. After protected integration, regenerate downstream Noema exact-head/live-base review/scanner evidence; predecessor green is not reusable.

[seonghobae]

@opencode-agent please review the exact current PR HEAD 1206abe.

Scope: verify that the sidecar dependency pin is an immutable exact contextual-orchestrator revision for the requested orchestrator/free + ZDR path, while model/candidate selection remains caller-supplied and dynamic in the pinned upstream implementation. Verify the three synchronized references, current-head Checks, and that no real_datasets content is uploaded. Please post a structured current-head APPROVED or CHANGES_REQUESTED review with status=passed and at least two falsified probes.