chore(sidecar): advance contextual-orchestrator pin to 767e67fb (no implicit model timeout)

[seonghobae]

Why

Today's Noema failures in fast-mlsirm (#1860 run 34748511702, #1825 run 34752130895) and in contextual-orchestrator itself (#1053 attempts 1–2) trace to the vendored CO pin 414f2297: ModelClient.__init__ defaults timeout=90 and the review gateway constructs its client without a timeout, so every NVIDIA NIM google/gemma-4-31b-it attempt hits TimeoutError at exactly 90 s (sidecar artifact 10315556637: 15 of 27 failed attempts at 90.0 s), the orchestrator cycles circuit open/reset on the same route for ~20 min, and the caller receives 502 provider_connection_error. contextual-orchestrator#1053 (merged as 767e67fb) removes the implicit deadline: model timeout is null by default and administrator-configured per model (model_timeout_seconds), which is the policy ADR-0003 already states.

What

• scripts/ci/contextual_orchestrator_review_sidecar.sh: ORCHESTRATOR_PIN_SHA 414f2297 → 767e67fbc6b881a452761f32abb69b9971b9b03b.
• tests/test_contextual_orchestrator_review_sidecar_contract.py: ORCH_PIN_SHA updated.
• docs/adr/0003-...: current pin and a 2026-09-13 amendment recording the root cause.
• CHANGELOG.md: entry with the evidence above.

Verification

• tests/test_contextual_orchestrator_review_sidecar_contract.py + tests/test_contextual_orchestrator_* / sidecar tests: 225 passed locally.
• bash -n on the sidecar script.
• Hosted acceptance is the first Noema/OpenCode/Strix run on this pin against a consumer PR (this PR's own required workflows still run the pre-fix main pin); it is not claimed here.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 79a9cce9-cc9e-47f2-9e3a-8d74588a4fdd

📥 Commits

Reviewing files that changed from the base of the PR and between d6cf572 and 509fa2a.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md
• scripts/ci/contextual_orchestrator_review_sidecar.sh
• tests/test_contextual_orchestrator_review_sidecar_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Infrastructure-exception merge record (2026-09-13)

Code/security/contract gates on the exact head all pass: agent-review-runtime-quality, coverage-evidence, coverage-source-tree, Bandit, gitleaks, pip-audit, Semgrep, trivy-fs, scorecard, CodeRabbit, Devin Review; locally 225 sidecar/orchestrator contract tests pass.

Failing/pending checks are the pre-fix gateway gating its own fix: noema-review job 103727409257 ran the sidecar at vendoring contextual-orchestrator @ 414f2297 (the pin this PR replaces) and failed; opencode-review has no exact-head verdict (same sidecar); CodeQL compatibility = central dispatch defect #2051; strix pending on the same sidecar. Merged under the infrastructure exception with minimal bypass of bot-verdict contexts only. Post-merge verification: the next consumer Noema run must log vendoring contextual-orchestrator @ 767e67fb and must not end in 90 s TimeoutErrors; revert this pin if it does.