fix: pin validated structured workflow runtime

docker-compose.yml

@@ -105,7 +105,7 @@ services:
     build:
       context: ./docker/contextual-orchestrator
       dockerfile: Dockerfile
-    image: ${COMPOSE_PROJECT_NAME:-lineageweave}-orchestrator:b030799be812ef11a7c978c9b5a03ae99f4a7573
+    image: ${COMPOSE_PROJECT_NAME:-lineageweave}-orchestrator:88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2
     env_file:
       - ${HOME}/.env
     environment:

docker/contextual-orchestrator/Dockerfile

@@ -4,7 +4,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends curl build-esse
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
        sh -s -- -y --profile minimal --default-toolchain 1.97.1
 ENV PATH=/root/.cargo/bin:$PATH
-ADD https://github.com/ContextualWisdomLab/contextual-orchestrator/archive/b030799be812ef11a7c978c9b5a03ae99f4a7573.tar.gz /tmp/contextual-orchestrator.tar.gz
+ADD https://github.com/ContextualWisdomLab/contextual-orchestrator/archive/88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2.tar.gz /tmp/contextual-orchestrator.tar.gz
 RUN mkdir /tmp/contextual-orchestrator \
     && tar -xzf /tmp/contextual-orchestrator.tar.gz --strip-components=1 -C /tmp/contextual-orchestrator \
     && python -m pip install --no-cache-dir 'maturin>=1.8,<2' \
@@ -13,25 +13,24 @@ RUN mkdir /tmp/contextual-orchestrator \
 FROM python:3.12-slim@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf
 
 LABEL org.opencontainers.image.source="https://github.com/ContextualWisdomLab/contextual-orchestrator" \
-      org.opencontainers.image.revision="b030799be812ef11a7c978c9b5a03ae99f4a7573"
+      org.opencontainers.image.revision="88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2"
 
 WORKDIR /app
 
 # Reuse the upstream implementation without copying it into LineageWeave.
 # Pin the runtime to a reviewed immutable upstream commit; model selection,
 # structured synthesis, and reasoning policy stay in contextual-orchestrator.
-ADD https://github.com/ContextualWisdomLab/contextual-orchestrator/archive/b030799be812ef11a7c978c9b5a03ae99f4a7573.tar.gz /tmp/contextual-orchestrator.tar.gz
+ADD https://github.com/ContextualWisdomLab/contextual-orchestrator/archive/88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2.tar.gz /tmp/contextual-orchestrator.tar.gz
 RUN mkdir /tmp/contextual-orchestrator \
     && tar -xzf /tmp/contextual-orchestrator.tar.gz --strip-components=1 -C /tmp/contextual-orchestrator \
     && cp -R /tmp/contextual-orchestrator/contextual_orchestrator /app/contextual_orchestrator \
     && cp -R /tmp/contextual-orchestrator/examples /app/examples \
-    && rm -rf /tmp/contextual-orchestrator /tmp/contextual-orchestrator.tar.gz \
-    && python -m pip install --no-cache-dir \
-        'cryptography>=43.0' \
-        'opentelemetry-api>=1.30.0' \
-        'opentelemetry-sdk>=1.30.0' \
-        'opentelemetry-exporter-otlp-proto-http>=1.30.0' \
-        'redis>=5.0' \
+    && python -m pip install --no-cache-dir 'uv==0.12.6' \
+    && cd /tmp/contextual-orchestrator \
+    && uv export --locked --no-dev --no-emit-project --extra queue --no-hashes --output-file /tmp/runtime-requirements.txt \
+    && python -m pip install --no-cache-dir --requirement /tmp/runtime-requirements.txt \
+    && python -c 'import cryptography, jsonschema, redis; from opentelemetry.exporter.otlp.proto.http import trace_exporter' \
+    && rm -rf /tmp/contextual-orchestrator /tmp/contextual-orchestrator.tar.gz /tmp/runtime-requirements.txt \
     && useradd --uid 10001 --no-create-home orchestrator
 
 COPY --from=token-builder /tmp/token-wheels /tmp/token-wheels

docs/adr/0083-orchestrator-runtime-commit-pin.md

@@ -15,7 +15,7 @@ multi-agent.
 ## Decision
 
 `docker/contextual-orchestrator/Dockerfile` pins the downloaded archive to
-commit `b030799be812ef11a7c978c9b5a03ae99f4a7573`. The pin remains explicit
+commit `88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2`. The pin remains explicit
 and immutable until the reviewed upstream change is superseded; it is not a
 moving `main` reference and it is not a LineageWeave monkey patch.
 

tests/test_documentation_hygiene.py

@@ -118,7 +118,7 @@ def test_role_catalog_identity_migration_is_wired() -> None:
 
 def test_orchestrator_runtime_pin_matches_adr() -> None:
     """The image pin and ADR must describe the same immutable upstream commit."""
-    expected_embedding_contract_commit = "b030799be812ef11a7c978c9b5a03ae99f4a7573"
+    expected_embedding_contract_commit = "88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2"
     dockerfile = (
         _ROOT / "docker" / "contextual-orchestrator" / "Dockerfile"
     ).read_text(encoding="utf-8")
@@ -140,6 +140,11 @@ def test_orchestrator_runtime_pin_matches_adr() -> None:
         f'org.opencontainers.image.revision="{expected_embedding_contract_commit}"'
         in dockerfile
     )
+    assert "uv export --locked --no-dev --no-emit-project --extra queue" in dockerfile
+    assert "--requirement /tmp/runtime-requirements.txt" in dockerfile
+    assert "import cryptography, jsonschema, redis" in dockerfile
+    assert "opentelemetry.exporter.otlp.proto.http import trace_exporter" in dockerfile
+    assert "'jsonschema>=4.23,<5'" not in dockerfile
 
 
 def test_embedding_bootstrap_contract_keeps_request_model_free() -> None: