fix: pin validated structured workflow runtime

docker-compose.yml

@@ -105,7 +105,7 @@ services:
     build:
       context: ./docker/contextual-orchestrator
       dockerfile: Dockerfile
-    image: ${COMPOSE_PROJECT_NAME:-lineageweave}-orchestrator:b030799be812ef11a7c978c9b5a03ae99f4a7573
+    image: ${COMPOSE_PROJECT_NAME:-lineageweave}-orchestrator:88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2
     env_file:
       - ${HOME}/.env
     environment:

docker/contextual-orchestrator/Dockerfile

@@ -4,7 +4,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends curl build-esse
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
        sh -s -- -y --profile minimal --default-toolchain 1.97.1
 ENV PATH=/root/.cargo/bin:$PATH
-ADD https://github.com/ContextualWisdomLab/contextual-orchestrator/archive/b030799be812ef11a7c978c9b5a03ae99f4a7573.tar.gz /tmp/contextual-orchestrator.tar.gz
+ADD https://github.com/ContextualWisdomLab/contextual-orchestrator/archive/88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2.tar.gz /tmp/contextual-orchestrator.tar.gz
 RUN mkdir /tmp/contextual-orchestrator \
     && tar -xzf /tmp/contextual-orchestrator.tar.gz --strip-components=1 -C /tmp/contextual-orchestrator \
     && python -m pip install --no-cache-dir 'maturin>=1.8,<2' \
@@ -13,14 +13,14 @@ RUN mkdir /tmp/contextual-orchestrator \
 FROM python:3.12-slim@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf
 
 LABEL org.opencontainers.image.source="https://github.com/ContextualWisdomLab/contextual-orchestrator" \
-      org.opencontainers.image.revision="b030799be812ef11a7c978c9b5a03ae99f4a7573"
+      org.opencontainers.image.revision="88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2"
 
 WORKDIR /app
 
 # Reuse the upstream implementation without copying it into LineageWeave.
 # Pin the runtime to a reviewed immutable upstream commit; model selection,
 # structured synthesis, and reasoning policy stay in contextual-orchestrator.
-ADD https://github.com/ContextualWisdomLab/contextual-orchestrator/archive/b030799be812ef11a7c978c9b5a03ae99f4a7573.tar.gz /tmp/contextual-orchestrator.tar.gz
+ADD https://github.com/ContextualWisdomLab/contextual-orchestrator/archive/88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2.tar.gz /tmp/contextual-orchestrator.tar.gz
 RUN mkdir /tmp/contextual-orchestrator \
     && tar -xzf /tmp/contextual-orchestrator.tar.gz --strip-components=1 -C /tmp/contextual-orchestrator \
     && cp -R /tmp/contextual-orchestrator/contextual_orchestrator /app/contextual_orchestrator \

docs/adr/0083-orchestrator-runtime-commit-pin.md

@@ -15,7 +15,7 @@ multi-agent.
 ## Decision
 
 `docker/contextual-orchestrator/Dockerfile` pins the downloaded archive to
-commit `b030799be812ef11a7c978c9b5a03ae99f4a7573`. The pin remains explicit
+commit `88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2`. The pin remains explicit
 and immutable until the reviewed upstream change is superseded; it is not a
 moving `main` reference and it is not a LineageWeave monkey patch.
 

tests/test_documentation_hygiene.py

@@ -118,7 +118,7 @@ def test_role_catalog_identity_migration_is_wired() -> None:
 
 def test_orchestrator_runtime_pin_matches_adr() -> None:
     """The image pin and ADR must describe the same immutable upstream commit."""
-    expected_embedding_contract_commit = "b030799be812ef11a7c978c9b5a03ae99f4a7573"
+    expected_embedding_contract_commit = "88873d8c6f3b8a5a57915e9f4c167ece92fe9ca2"
     dockerfile = (
         _ROOT / "docker" / "contextual-orchestrator" / "Dockerfile"
     ).read_text(encoding="utf-8")