From 52e98b6f8fefb9f36c93d607d4fbf1691e3ba0ac Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 31 Aug 2026 01:41:04 +0000 Subject: [PATCH] chore(ci): bump ORCHESTRATOR_PIN_SHA past #922's failover fix Vendors contextual-orchestrator's request-time provider-transport-failure classification fix (#922) plus everything else that landed on that repo's main since the last pin (#912, #868, #920, #921, #928, #925, #929 -- 148 commits total). requirements.lock is unchanged and every __main__.py CLI change is additive, so the sidecar's dependency surface is unaffected. No provider credentials are available in this sandbox, so an actually- executed end-to-end sidecar run isn't possible here; live verification is left as a follow-up for the next hosted noema-review/opencode-review/strix run against this pin, per the gap-baseline entry. --- CHANGELOG.md | 8 ++++ ...ntextual-orchestrator-vendored-free-zdr.md | 2 +- docs/product-technical-gap-baseline.md | 42 +++++++++++++++++++ .../contextual_orchestrator_review_sidecar.sh | 2 +- ...al_orchestrator_review_sidecar_contract.py | 2 +- 5 files changed, 53 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4d402ee428..e629cdedb3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ this file. The format follows Keep a Changelog, and versioned releases follow Semantic Versioning where the repository publishes a release. ## [Unreleased] +- Bump the vendored `ORCHESTRATOR_PIN_SHA` from `30c6d71680e659f25a0a433d4726ad0d437f9757` + to `79c6841b9b3645d1f14b943985825d2302071f5b` in the sidecar script, its + contract test, and ADR-0003 -- vendoring `contextual-orchestrator`'s + request-time failover classification fix (#922) and everything else that + landed on that repo's `main` since the last pin. `requirements.lock` is + unchanged and every CLI change is additive, so the sidecar's dependency + surface is unaffected; see `docs/product-technical-gap-baseline.md` for + the full review and the still-open live-verification follow-up. - Fix two live-on-`main` regressions Devin Review found immediately after PRs #1456 and #1459 merged (both bypass-merged past the org-wide `opencode-review` outage; these hotfixes correct real defects the local diff --git a/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md b/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md index 7e0ee41395..9e998b9ef6 100644 --- a/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md +++ b/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md @@ -24,7 +24,7 @@ all five, and auto-optimize routing by cost. 1. **Vendoring, pinned**: `scripts/ci/contextual_orchestrator_review_sidecar.sh` clones `ContextualWisdomLab/contextual-orchestrator` at an exact SHA - (`30c6d71680e659f25a0a433d4726ad0d437f9757` today) into `RUNNER_TEMP`. The + (`79c6841b9b3645d1f14b943985825d2302071f5b` today) into `RUNNER_TEMP`. The source's `requirements.lock` is installed with `--require-hashes` and `--no-deps`, so dependency resolution cannot silently move the reviewed runtime. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c2ce78cf03..2e4b455a4d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1653,6 +1653,48 @@ string, a bare number) confirmed to fail against the pre-fix script (`KeyError: signature as the original round-4 bug) before passing after the fix. 1930 tests pass; 100% coverage and 100% docstring coverage on `scripts/ci/`. +## 2026-08-31 sidecar pin bumped past #922's request-time failover fix + +- Bumps `ORCHESTRATOR_PIN_SHA` from `30c6d71680e659f25a0a433d4726ad0d437f9757` + (the #1430 pin) to `79c6841b9b3645d1f14b943985825d2302071f5b` in the same + three places #1430 established as the contract: the sidecar script default + (`scripts/ci/contextual_orchestrator_review_sidecar.sh`), the contract + test's `ORCH_PIN_SHA` (`tests/test_contextual_orchestrator_review_sidecar_contract.py`), + and `docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md`'s "today" + reference. +- This vendors `contextual-orchestrator` PR #922 (`fix(routing): classify + primary provider transport failures explicitly` — the classification fix + behind this Draft's own request-time failover acceptance contract, see + PR #1437) plus everything else that landed on that repo's `main` since the + last pin: #912 (video job resource normalization), #868 (gateway default + chat model + configured-gateway discovery + OpenRouter ZDR/privacy + metadata), #920/#921 (cleanup/docs), #928 (provider-catalog-sync outage + tolerance), #925 (`stream_options.include_usage` for tools passthrough), + and #929 (Bytez raw-token `Authorization` header fix) — 148 commits total + between the two pins. +- Reviewed for anything that would break the sidecar's actual dependency + surface before bumping, since ADR-0003 requires this: `requirements.lock` + is byte-for-byte unchanged (no `--require-hashes` drift), and every change + to `contextual_orchestrator/__main__.py` (the CLI the launcher invokes) is + strictly additive -- new optional flags and discovery-source plumbing, zero + removed arguments or subcommands. The `register-credential` and `--serve + --agents ... --port ... --auth-token ...` invocations the sidecar/launcher + depend on are untouched. +- Not independently verified live: this sandbox has no provider credentials + (`BYTEZ_API_KEY`/`NVIDIA_NIM_API_KEY`/`NVIDIA_NIM_API_KEY_SUB`/ + `OPENROUTER_API_KEY`/`OPENAI_API_KEY`), so an actually-executed end-to-end + sidecar run against real providers isn't possible here the way ADR-0003's + own PoC bar asks for. Local verification is `.github`'s own full suite + (2023 passed, 1 skipped, 100% coverage/docstrings) plus the static + sidecar/pin contract tests; the real live proof is the next hosted + `noema-review`/`opencode-review`/`strix` run against this new pin, once + the ongoing org-wide `opencode-review` outage (tracked on PR #1437 and + elsewhere in this baseline) clears enough to observe one. Left as this + entry's own concrete follow-up rather than a bypass-merge, since (unlike + the scheduler-script hotfixes bypass-merged earlier this session) this + change's actual correctness depends on live provider behavior this + sandbox cannot exercise. + ## 5. 실행 루프와 고객의 다음 행동 각 hourly pass는 아래 순서를 유지한다. diff --git a/scripts/ci/contextual_orchestrator_review_sidecar.sh b/scripts/ci/contextual_orchestrator_review_sidecar.sh index c82a230c1a..d5a342e77a 100755 --- a/scripts/ci/contextual_orchestrator_review_sidecar.sh +++ b/scripts/ci/contextual_orchestrator_review_sidecar.sh @@ -14,7 +14,7 @@ # (fail-closed zero-cost) pool. set -euo pipefail -ORCHESTRATOR_PIN_SHA="${ORCHESTRATOR_PIN_SHA:-30c6d71680e659f25a0a433d4726ad0d437f9757}" +ORCHESTRATOR_PIN_SHA="${ORCHESTRATOR_PIN_SHA:-79c6841b9b3645d1f14b943985825d2302071f5b}" ORCHESTRATOR_GIT_URL="${ORCHESTRATOR_GIT_URL:-https://github.com/ContextualWisdomLab/contextual-orchestrator.git}" # The Strix gate and Noema SSRF guard accept this one process-local origin. # Keep it fixed so an environment override cannot create an unvalidated sidecar. diff --git a/tests/test_contextual_orchestrator_review_sidecar_contract.py b/tests/test_contextual_orchestrator_review_sidecar_contract.py index af7472057c..4dc20fedfc 100644 --- a/tests/test_contextual_orchestrator_review_sidecar_contract.py +++ b/tests/test_contextual_orchestrator_review_sidecar_contract.py @@ -40,7 +40,7 @@ ) GATEWAY_MODEL = "contextual-orchestrator/orchestrator/free" -ORCH_PIN_SHA = "30c6d71680e659f25a0a433d4726ad0d437f9757" +ORCH_PIN_SHA = "79c6841b9b3645d1f14b943985825d2302071f5b" def _read(path: Path) -> str: