fix(ci): pin review sidecar to merged 429 recovery head

[seonghobae]

Change

Pin the central review sidecar to contextual-orchestrator main 8e1f1a8bf3e96e56dc8fcc90ec777883a1d56ce6. That ancestry includes image request cooldown recovery (#1223), structured 429 recovery (#1251), and structured stage evidence (#1253). The previous pin was 01bf92a3ec67a0e1f9b68978eb16b60301e985fd; its requirements.lock is byte-identical to the new pin's lock.

This is an intermediate source-consumption step. The sidecar still clones source at runtime and still bootstraps provider keys. It does not satisfy the immutable released gateway and secrets-free consumer contract in #1759. Historical admin bypasses on the source PRs are not independent approval for this PR.

Verification

• git diff --check and bash -n scripts/ci/contextual_orchestrator_review_sidecar.sh passed.
• Central focused contract tests: 52 passed (test_contextual_orchestrator_review_sidecar_contract.py, test_noema_orchestrator_workflow_contract.py, test_strix_contextual_orchestrator_contract.py).
• With CO main on PYTHONPATH, the Python 3.12 launcher and gateway imports used by the sidecar succeeded (launcher-import-ok). The sidecar's embedded offline HTTP body-limit/forwarding probe also exited 0 against that exact CO source without provider egress. This does not prove live provider availability or hosted Noema behavior.

Delivery gate

Require current-head security/quality checks and qualifying independent review. After protected merge, verify the central main pin and obtain hosted Noema or OpenCode exact-pin request evidence before calling this consumed. The release and remote gateway migration remain separate.

[coderabbitai]

Warning

Review limit reached

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 2ccef14b-cb2b-41fd-9706-ab18f9ef6a4e

📥 Commits

Reviewing files that changed from the base of the PR and between 1d908b7 and 4208323.

📒 Files selected for processing (3)

• docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md
• scripts/ci/contextual_orchestrator_review_sidecar.sh
• tests/test_contextual_orchestrator_review_sidecar_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head admission correction — 42083239ec82906c92360ea68410b28f5e50d076

Ready is review admission only. Fresh audit against base 1d908b76a984518393dc46d7e0181b19b97c50bc found:

• latest terminal workflow blockers: SAST Semgrep 36383668634=failure, Python Security 36383668631=failure, CodeQL PR 36383668711=failure

This PR is moved to Draft/Proposed until the causal owner repair is present on a successor exact head and re-audited. Queued/pending work is neither an additional blocker nor passing evidence. No Close, force push, destructive rebase, manual rerun, synthetic status/approval, merge, auto-merge, or bypass was performed.