fix(sidecar): bump vendored contextual-orchestrator pin to fix orchestrator/free retry-stacking

[seonghobae]

Root cause

ContextualWisdomLab/contextual-orchestrator PR #1081 (merged 414f22973658c4ddc3d4320fcf7acd9b4e8ba991) fixes a real, confirmed bug: TaskOrchestrator._invoke's own retry-then-failover decision for a retryable 5xx (budgeted 1 + tool_retry_attempts real tries per candidate) was getting multiplied by ModelClient._send_with_retry's independent transient-retry-with-backoff loop underneath it (max_retries + 1 further tries per call) — up to (tool_retry_attempts + 1) × (max_retries + 1) real network attempts (6 at production defaults) against one already-flagged-flaky orchestrator/free agent before _invoke ever tried the next ranked candidate.

This is the confirmed root cause of independently observed incidents in ContextualWisdomLab/.github PRs #1912, #1231, #1503, and #1198, each spending 9–57+ minutes stuck on one escalated route and surfacing that same route's model in its final error — never reaching a cleanly-ready sibling preflight had already found.

Critical follow-up finding: merging that fix upstream has had zero effect in production so far, because scripts/ci/contextual_orchestrator_review_sidecar.sh's ORCHESTRATOR_PIN_SHA is a hardcoded default that does not auto-track contextual-orchestrator's main — every review sidecar (Noema, OpenCode, Strix) was still vendoring 2e414d15ba58f28597751b625a8a2f00fc9fadcf, a commit from 2026-09-04, two days stale relative to the fix.

Verification (done independently before opening this PR)

• Cloned contextual-orchestrator at the fix branch head (73a5c20), confirmed the new regression test passes.
• Swapped orchestrator.py back to unmodified main and reran the same test: reproduced the exact pre-fix bug (6 <= 2 assertion failure — 6 real network attempts before failover).
• Restored the fix and ran the full suite: 3393 passed, with the only 2 failures confirmed pre-existing and unrelated (reproduced identically against clean, unmodified main).
• Confirmed no ModelClient.timeout/max_retries/backoff value changed anywhere in the diff — only which agent gets tried changes, consistent with this org's standing "no fixed model-path timeout" policy (.github fix(strix): bound scanner runtime to 900 seconds #1889/fix(noema): bound model runtime to 900 seconds #1890/fix(opencode): bound model runtime to 900 seconds #1892 reverted via fix(noema): restore unbounded model runtime contract #1891/fix(review): restore user-directed model timeout policy #1895).

Changes

• scripts/ci/contextual_orchestrator_review_sidecar.sh: ORCHESTRATOR_PIN_SHA default advances 2e414d15ba58f28597751b625a8a2f00fc9fadcf → 414f22973658c4ddc3d4320fcf7acd9b4e8ba991.
• tests/test_contextual_orchestrator_review_sidecar_contract.py: companion ORCH_PIN_SHA constant bump (contract-tested — this repo's tests pin exact SHA strings in both the script and the ADR).
• docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md: updated the inline "today" SHA reference and appended a 2026-09-06 amendment documenting this bump, matching the ADR's established per-bump amendment convention.
• CHANGELOG.md: new entry documenting the pin advance and the fix it carries.

Why this PR's own review may look unusual

This PR's required Noema/OpenCode/Strix review checks run the base branch's trusted copy of the sidecar script per this repo's pull_request_target trust-boundary design — i.e. they will still hit the exact bug this PR fixes, since the base branch doesn't have the bump yet. Expect this PR's own reviews to be slow or flaky for that reason; that is not a defect in the diff, it's the exact chicken-and-egg case this bump exists to resolve for every other PR.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01KPmJErfkcHer4UVEgrQxUX

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: c4a703b9-d7f1-496d-9997-a8bf56f93b36

📥 Commits

Reviewing files that changed from the base of the PR and between fe827e1 and eedda4d.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md
• scripts/ci/contextual_orchestrator_review_sidecar.sh
• tests/test_contextual_orchestrator_review_sidecar_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}