fix(strix): include contextual-orchestrator import context

[seonghobae]

Summary

• Extend the trusted PR-scope resolver to enumerate every contextual_orchestrator/*.py file from the exact PR head when a package module changes.
• Preserve changed-file attribution: unchanged sibling modules are scan context only, never changed findings.
• Add a production-gate regression for __main__.py importing an unchanged cost_ledger.py, plus doctoring and changelog evidence.

Root cause

ContextualWisdomLab/contextual-orchestrator#801 failed closed after Strix scanned only one changed Python file and reported unchanged local imports as missing. The package is not under the existing backend/app context rule. This stacked change extends the same trusted exact-head boundary without weakening provider or vulnerability gates.

Evidence

• Exact parent PR head: d9479cf486f731e8efe582e7b029234e05b36cae (fix(strix): include backend app dependency context #1191).
• New commit: e6f3b3f76e67582a7408e29aab5fcd537f1ebbc1.
• bash -n scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh.
• git diff --check.
• bash scripts/ci/test_strix_quick_gate.sh -> PASS.

Review and merge

This PR must receive independent review and pass the protected checks at its exact head. No self-approval, bypass, or gate weakening is requested.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 819d3490-56a3-4cb4-b3ea-ba55a05ea8a9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Current-head review completed at e6f3b3f76e67582a7408e29aab5fcd537f1ebbc1; Devin found no issues, the stacked base is the exact #1191 head, and no source change is required. Continuing with hosted Checks and protected independent approval.

[seonghobae]

Closing as absorbed into the canonical Strix owner PR #1153 at exact head ab0f179ddf0623a92fc597b7be0f080991fd5a5c.

The canonical repair preserves this PR's valid contextual_orchestrator/*.py sibling-import context, while strengthening the trust boundary with an exact trimmed/validated PR-head SHA, NUL-delimited git ls-tree parsing, bounded path normalization, trusted-base context reads, unchanged changed-file attribution, and fail-closed behavior for missing/invalid exact-head evidence.

Verified on the canonical tree: focused Strix contracts 29 passed, 16 subtests; full central suite 1,288 passed, 16 subtests; complete test_strix_quick_gate: PASS; shell syntax, Python compile, and diff checks pass. This PR's stacked base is the already-closed competing #1191 branch, so retaining it would leave a second writer for the same source boundary.

[seonghobae]

The stacked parent #1191 is now closed/unmerged, so its child cannot be the protected merge path while targeting the closed parent branch. The exact child head is three commits ahead of current main and includes the parent plus child changes. Retargeting this PR to main preserves the stack as one auditable protected change set and will cause required Checks to run on the exact child head; no code or review authority is bypassed.

[seonghobae]

Superseded by the canonical owner PR #1153, whose current exact head ab0f179ddf0623a92fc597b7be0f080991fd5a5c already contains this contextual_orchestrator sibling-context repair and passes the full local gate suite. Parent #1191 was closed as a duplicate. No source change is lost.