From 509fa2a44dba6c8c8718ff35bf2161c127125cca Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 13 Sep 2026 22:00:48 +0900 Subject: [PATCH] chore(sidecar): advance contextual-orchestrator pin to 767e67fb (no implicit model timeout) Advance ORCHESTRATOR_PIN_SHA from 414f2297 to protected main@767e67fbc6b881a452761f32abb69b9971b9b03b, the merge of contextual-orchestrator#1053. Under the old pin ModelClient defaulted to timeout=90 and the review gateway inherited it, so NVIDIA NIM google/gemma-4-31b-it attempts in the Noema sidecar timed out at exactly 90 s (15 of 27 attempts in fast-mlsirm#1860 run 34748511702) and the gateway answered 502 provider_connection_error after ~20 min of circuit retries. #1053 makes the model timeout null by default and administrator configured per model. Update the sidecar contract test constant, ADR-0003 (current pin and a 2026-09-13 amendment), and CHANGELOG. tests/test_contextual_orchestrator_* and sidecar contract tests: 225 passed. Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 4 ++++ ...03-contextual-orchestrator-vendored-free-zdr.md | 14 +++++++++++++- .../ci/contextual_orchestrator_review_sidecar.sh | 2 +- ...textual_orchestrator_review_sidecar_contract.py | 2 +- 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 50e3fb6443..d118a4a47a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,7 @@ +### Contextual-orchestrator pin advance removes the implicit 90 s model request timeout + +- Advanced the central sidecar's pinned immutable CO revision from `414f2297` to protected `main@767e67fbc6b881a452761f32abb69b9971b9b03b`, carrying contextual-orchestrator#1053 into Strix, OpenCode, and Noema. Root cause: `ModelClient.__init__` defaulted `timeout=90`, and the review gateway constructed its client without a timeout, so long structured-output completions on NVIDIA NIM (`google/gemma-4-31b-it`) hit `TimeoutError` at exactly 90 s on every attempt; the orchestrator then cycled circuit open/reset on the same route for ~20 min and answered `502 provider_connection_error` (fast-mlsirm#1860 run 34748511702, sidecar artifact 10315556637: 15 of 27 failed attempts at 90.0 s; fast-mlsirm#1825 run 34752130895 same signature). #1053 removes the implicit deadline (null by default, administrator `model_timeout_seconds` per model) and was merged under the infrastructure exception because the pre-fix sidecar was failing its own Noema/OpenCode gates. Hosted acceptance is the first Noema/OpenCode/Strix run on this pin against a consumer PR; not claimed here. Refs ContextualWisdomLab/contextual-orchestrator#1053, ContextualWisdomLab/fast-mlsirm#1860. + ### Pingora edge policy admits HWPX evidence documents without UTF-8 decoding - `scripts/ci/pingora_edge_policy.py`'s `BINARY_DOCUMENT_MAGIC` only knew `.pdf` and `.png`, and `_is_binary_documentation_asset` only admitted a `doc`/`docs`/`documentation` directory, so a ZIP-based `.hwpx` evidence attachment under `evidence/` matched neither rule and fell through to the strict UTF-8 decode every other candidate gets. Observed on ContextualWisdomLab/late-life-anxiety-reanalysis#10, head `a1cd5bc6783c6510dfcf937f523c733366e82213`, run `34700409497`, job `103571044859`: "Pingora edge policy could not establish complete evidence: Runtime policy candidate evidence/reviewer_response_draft.hwpx is not valid UTF-8". The fix adds `.hwpx` (`PK\x03\x04`) to `BINARY_DOCUMENT_MAGIC` and extends `_is_binary_documentation_asset` to admit an `.hwpx` under an `evidence` path segment, gated on a bounded container check in the new `_is_complete_hwpx` -- unprefixed ZIP, exact EOCD record, unique members with `mimetype` first, a stored (not deflated) `mimetype` entry exactly `application/hwp+zip`, and a non-empty, unencrypted `Contents/content.hpf` manifest -- so no document body is ever parsed or rendered and no malware inspection is implied. The runtime-path guard and the Nginx-runtime-text fallback scan for disguised or malformed archives are unchanged. `tests/test_pingora_hwpx_evidence.py` runs the production policy boundary offline: RED (test-only apply) showed 3 failing / 19 passing; GREEN (full patch) showed 90 passing across that file plus `tests/test_pingora_edge_policy.py` and `tests/test_pingora_edge_workflow_contract.py`. Branch coverage of the touched module is 100% (388 statements, 174 branches, 0 missed) and `interrogate scripts/ci -q` reports 100.0% docstrings. Hosted acceptance still requires a newly loaded central source SHA to re-run the consumer's exact head bootstrap. Refs ContextualWisdomLab/.github#2116. diff --git a/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md b/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md index 9b0749f258..6629675f14 100644 --- a/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md +++ b/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md @@ -24,7 +24,7 @@ all five, and auto-optimize routing by cost. 1. **Vendoring, pinned**: `scripts/ci/contextual_orchestrator_review_sidecar.sh` clones `ContextualWisdomLab/contextual-orchestrator` at an exact SHA - (`414f22973658c4ddc3d4320fcf7acd9b4e8ba991` today) into `RUNNER_TEMP`. The + (`767e67fbc6b881a452761f32abb69b9971b9b03b` today) into `RUNNER_TEMP`. The source's `requirements.lock` is installed with `--require-hashes` and `--no-deps`, so dependency resolution cannot silently move the reviewed runtime. @@ -259,6 +259,18 @@ all five, and auto-optimize routing by cost. fault. Accepted-size and tool-schema probes call the pinned client's deterministic mock response explicitly and therefore perform no provider call. +- **2026-09-13 amendment: advance the governed runtime pin to remove the + implicit 90 s model request timeout.** The vendored pin advances from + `414f22973658c4ddc3d4320fcf7acd9b4e8ba991` to + `767e67fbc6b881a452761f32abb69b9971b9b03b`, the commit that merges + `contextual-orchestrator#1053`. Under the previous pin `ModelClient` + defaulted to `timeout=90`, so every NVIDIA NIM `google/gemma-4-31b-it` + attempt in the Noema sidecar ended in `TimeoutError` at exactly 90 s (15 of + 27 attempts in fast-mlsirm#1860 run 34748511702) and the gateway surfaced + `502 provider_connection_error` after ~20 min of circuit retries. #1053 makes + the model timeout null by default and administrator-configured per model + (`model_timeout_seconds`), matching this ADR's rule that model inference + carries no wall-clock deadline. - **2026-09-06 amendment: advance the governed runtime pin to fix `orchestrator/free` retry-stacking.** The vendored pin advances from `2e414d15ba58f28597751b625a8a2f00fc9fadcf` to diff --git a/scripts/ci/contextual_orchestrator_review_sidecar.sh b/scripts/ci/contextual_orchestrator_review_sidecar.sh index 38d9551a32..3c2a1b51b9 100755 --- a/scripts/ci/contextual_orchestrator_review_sidecar.sh +++ b/scripts/ci/contextual_orchestrator_review_sidecar.sh @@ -14,7 +14,7 @@ # (fail-closed zero-cost) pool. set -euo pipefail -ORCHESTRATOR_PIN_SHA="${ORCHESTRATOR_PIN_SHA:-414f22973658c4ddc3d4320fcf7acd9b4e8ba991}" +ORCHESTRATOR_PIN_SHA="${ORCHESTRATOR_PIN_SHA:-767e67fbc6b881a452761f32abb69b9971b9b03b}" ORCHESTRATOR_GIT_URL="${ORCHESTRATOR_GIT_URL:-https://github.com/ContextualWisdomLab/contextual-orchestrator.git}" # The Strix gate and Noema SSRF guard accept this one process-local origin. # Keep it fixed so an environment override cannot create an unvalidated sidecar. diff --git a/tests/test_contextual_orchestrator_review_sidecar_contract.py b/tests/test_contextual_orchestrator_review_sidecar_contract.py index 31af868d45..b279d33a98 100644 --- a/tests/test_contextual_orchestrator_review_sidecar_contract.py +++ b/tests/test_contextual_orchestrator_review_sidecar_contract.py @@ -40,7 +40,7 @@ ) GATEWAY_MODEL = "contextual-orchestrator/orchestrator/free" -ORCH_PIN_SHA = "414f22973658c4ddc3d4320fcf7acd9b4e8ba991" +ORCH_PIN_SHA = "767e67fbc6b881a452761f32abb69b9971b9b03b" def _read(path: Path) -> str: