diff --git a/.next-version b/.next-version index 6f4eebd..100435b 100644 --- a/.next-version +++ b/.next-version @@ -1 +1 @@ -0.8.1 +0.8.2 diff --git a/.release-metadata.json b/.release-metadata.json index 1996653..ef3ee57 100644 --- a/.release-metadata.json +++ b/.release-metadata.json @@ -1,12 +1,9 @@ { "issues": [ - 120, - 123, - 124, - 125, - 126, - 127 + 129, + 130, + 132 ], "schema_version": "ocr-toolkit.release-authorization/v1", - "version": "0.8.0" + "version": "0.8.1" } diff --git a/.release-source-date-epoch b/.release-source-date-epoch index c241962..550eaa0 100644 --- a/.release-source-date-epoch +++ b/.release-source-date-epoch @@ -1 +1 @@ -1787572363 +1787598637 diff --git a/.release-version b/.release-version index a3df0a6..6f4eebd 100644 --- a/.release-version +++ b/.release-version @@ -1 +1 @@ -0.8.0 +0.8.1 diff --git a/CHANGELOG.md b/CHANGELOG.md index 0d61d1b..2dcc297 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,39 @@ +## 0.8.1 - 2026-08-24 + +### 🚀 Features + +- Operators can now control the LLM request's completion/output cap independently of OCR context and aggregate review budgets: + + - **Added:** optional `OCR_LLM_MAX_COMPLETION_TOKENS`, accepting decimal integers from `1` through `1000000`. Its exact default is unset, so toolkit 0.8.1 inherits the qualified OCR behavior. + - **Protocol mapping:** `openai` writes `llm.extra_body.max_completion_tokens`, `openai-responses` writes `max_output_tokens`, and `anthropic` writes `max_tokens`. + - **Migration:** an equal JSON integer already owned by `OCR_LLM_EXTRA_BODY` is deduplicated; a different or non-integer value fails configuration. Remove the duplicate field or keep the same integer in both inputs. + - **Deployment:** toolkit 0.8.1 remains on OCR 1.9.10. For a gateway that accepts short probes but rejects a full review before generation, try an explicit value such as `4096`; the toolkit does not derive it from `/models.max_completion_tokens`. + - **Unchanged:** `OCR_MAX_TOKENS_BUDGET`, OCR prompt/context `max_tokens`, receipt v5, DLP, telemetry, review outcomes, severity, findings, and approval policy are unaffected. + + ([#130](https://github.com/xeonvs/open-code-review-toolkit/issues/130)) + +### 🐛 Bug Fixes + +- Provider configuration and failed-review diagnostics now share one safe boundary: + + - **Fixed:** `ocr-ci configure` and `ocr-ci preflight` now use the same explicit `OCR_LLM_PROTOCOL`, normalized credential-free HTTPS API root, headers, request controls, and auxiliary models URL. Protocol-mismatched terminal endpoints, embedded credentials, fragments, and ambiguous queried `/models` derivation fail closed. + - **Changed:** a non-zero OCR result with a valid bounded `ocr.llm-retry-report/v1` now produces a toolkit-authored provider-neutral GitLab reason and remediation hint. Runtime `404` remains `endpoint-or-model-not-found`; `429` lists throttling, spending limits, and requested-output cost reservation as possibilities without claiming which occurred. + - **Privacy:** classified failures ignore normal findings and raw provider/model identities, response bodies, codes/messages, request IDs, paths, warnings, and stderr. `OCR_POST_ERROR_DETAILS=1` does not override this boundary. + - **Unchanged:** the previous successful review is preserved, automatic approval is not attempted, and receipt v5, DLP, telemetry, severity, finding, and posting-transaction contracts do not change. + + ([#129](https://github.com/xeonvs/open-code-review-toolkit/issues/129)) + +### 🛠 Maintenance + +- Protected validation now assigns each repeated check to one explicit owner: + + - **Changed:** all five supported OS/Python pull-request jobs still run the complete functional suite, while Ubuntu on the newest supported Python is the single owner of combined and risk-group coverage floors. + - **Removed:** generic `main`-push reruns of CI, package build, Security, and CodeQL; duplicate wheel/sdist construction inside the CI quality job; and duplicate source quality and dependency-audit runs inside the TestPyPI development workflow. + - **Unchanged:** pull-request Security, CodeQL, Dependency Review, and `Build artifacts` gates; scheduled security analysis; TestPyPI artifact publication, provenance, bounded registry readback, and clean installs; release-pull-request checks; and the complete post-merge stable-release validation. + + ([#132](https://github.com/xeonvs/open-code-review-toolkit/issues/132)) + + ## 0.8.0 - 2026-08-24 ### 🚀 Features diff --git a/PLANS.md b/PLANS.md index 0f84541..ca171a2 100644 --- a/PLANS.md +++ b/PLANS.md @@ -4,52 +4,4 @@ Use this file for active or blocked repository work. Update it before implementa ## Active Work -### Release 0.8.1: completion cap and safe LLM provider failures - -Status: implementation complete, final exact-head validation pending; `release-required`. Target stable version: `0.8.1`. - -#### Outcome and scope - -- Add optional `OCR_LLM_MAX_COMPLETION_TOKENS`; its exact default is unset and therefore inherits the qualified OCR behavior. It controls only the per-request completion/output cap through the protocol-specific `llm.extra_body` key and does not change OCR prompt/context `max_tokens`, `OCR_MAX_TOKENS_BUDGET`, receipt v5, DLP, telemetry, severity, findings, or approval contracts. -- Canonicalize provider URL, protocol, headers, auxiliary `/models` URL, and request-body controls in one provider-neutral runtime owner shared by `configure` and `preflight`. -- Project private OCR retry diagnostics into a closed provider-neutral failure reason and toolkit-authored GitLab guidance. Raw provider bodies, messages, codes, URLs, models, request IDs, paths, warnings, credentials, and stderr remain private. -- Keep OCR `1.9.10` as the exact qualified dependency. Do not promote unreleased upstream defaults or derive a completion cap from `/models` metadata. -- Remove repeated validation that crosses no new owner or artifact boundary: one PR job owns coverage, one owns packages, protected-main TestPyPI owns development artifact publication/readback, and stable release keeps its exact trusted-boundary gates. - -#### Trust and data flow - -1. Operator environment enters a single provider-config parser. It accepts an explicit closed protocol, bounded positive decimal completion cap, valid header objects, and absolute HTTPS URLs without credentials or fragments. The parser normalizes API root and terminal inference endpoint, preserves an unambiguous query for inference, and requires explicit `OCR_LLM_MODELS_URL` when an auxiliary URL cannot be derived safely. -2. `configure` projects only the validated inference settings into the private OCR configuration. A completion cap maps to `max_completion_tokens` for `openai`, `max_output_tokens` for `openai-responses`, and `max_tokens` for `anthropic`. An equal value already present in `OCR_LLM_EXTRA_BODY` is deduplicated; a different value fails closed. -3. `preflight` consumes the same canonical configuration and derives `/models` only from its normalized API root. Explicit protocol remains authoritative; a terminal endpoint for another protocol is rejected rather than changing protocol implicitly. -4. On a non-zero OCR exit, posting hostile-reads the bounded result artifact only for `ocr.llm-retry-report/v1`. A strict parser admits only allowlisted error class, failure phase, terminal outcome, and HTTP status into a closed reason. Normal findings and every raw/provider-controlled field are ignored. -5. The GitLab note is generated entirely from toolkit-owned static text. Classified failures suppress `OCR_POST_ERROR_DETAILS`; malformed, oversized, missing, or ambiguous diagnostics retain the existing generic note. Previous successful review notes remain, no normal findings are posted, and auto-approval is unreachable. - -#### Logical slices and commit gates - -1. **Plan and coordination.** Create `codex/v0.8.1-provider-failures`, this planning commit, milestone `v0.8.1`, a completion-cap issue linked with #129, updated #129 acceptance criteria, and a Draft PR. Before commit: plan/self-review, requirement and boundary mapping, `git diff --check`. -2. **Completion-cap contract.** Implement parsing, protocol mapping, conflict behavior, environment/generated-config/installed-artifact tests, and an exact checksum-verified OCR 1.9.10 no-LLM wire probe proving inherited `58888` and explicit `4096`. If the probe does not prove the override, omit the public setting and continue only the diagnostics work. Before commit: focused tests, full diff and trust review, `git diff --check`. -3. **Canonical provider configuration.** Share one provider-neutral owner between configure and preflight; cover API roots, terminal endpoints, trailing slash, query, credentials, fragments, protocol mismatch, and explicit models URL. Before commit: focused tests, URL/header/data-flow review, `git diff --check`. -4. **Failure projection and GitLab.** Add the bounded retry-report parser, closed reason mapping, static hints, and one renderer for non-zero retry reports and existing successful-result billing/quota warnings. Cover HTTP 400/401/402/403/404/408/409/413/422/429/5xx/529, timeout, network, decode, mixed, malformed, oversized, raw-data absence, previous-review preservation, no findings/approval, and strict/advisory behavior. Before commit: focused tests, privacy/approval/rollback review, `git diff --check`. -5. **Documentation and release handoff.** Document exact defaults, mappings, conflicts, the `4096` workaround, the three distinct token ceilings, possible provider cost reservation, and the limits of `/models`; add separate feature and bug-fix Towncrier fragments. Reconcile strategy/roadmap only where the implemented outcome changes them. Before commit: documentation/version consistency, Towncrier draft, full diff review, `git diff --check`. -6. **Validation ownership deduplication.** Keep all five OS/Python full-test jobs but instrument coverage only on Ubuntu 3.14; keep packaging only in `Build artifacts`; stop generic workflow reruns on protected-main push; and keep TestPyPI development focused on its distinct versioned artifact/publication/readback boundary. Release-PR and post-merge stable gates remain unchanged. Update workflow contract tests, development/release guidance, issue #132, and a maintenance fragment. Before commit: focused workflow tests, trigger/check-name and trusted-boundary review, actionlint-equivalent YAML/static validation through existing tests, rendered Towncrier, and `git diff --check`. - -#### Validation and delivery - -- Focused contract, configuration, preflight, result, posting, approval, environment, installed-artifact, and compatibility tests. -- Full `scripts/quality.sh check` including combined and risk-group coverage floors; `PYTHONPATH=src python scripts/ocr_compat.py validate`; lock/manifest tests; `scripts/gitleaks.sh`; Towncrier draft; reproducible wheel/sdist, Twine, and clean installs on Python 3.12-3.14. -- Overall requirements, provider-boundary, privacy, DLP/approval, telemetry, rollback, and documentation self-review before push. -- Push the complete feature history to the Draft PR, wait for hosted checks, address evidence-driven failures through the same commit gate, then mark ready and merge through protected review. -- Verify the deterministic TestPyPI development build, then prepare and merge the protected `Release v0.8.1` PR. Monitor stable TestPyPI/PyPI publication, tag, immutable GitHub Release, provenance, attestations, supported-Python installs, and immutable receipt; close tracked issues only after independent external reconciliation. - -Resume point: run one final exact-head local gate, commit and push the reviewed validation-ownership slice, update Draft PR #131 and issue #132, then require the hosted owners to pass. - -#### Current implementation evidence - -- Coordination: milestone `v0.8.1`, completion-cap issue #130, provider-diagnostics issue #129, and Draft PR #131 are open. -- Exact OCR 1.9.10 Darwin arm64 asset SHA-256 `c626347bafcdbf25cf058af403d16568a3a9ffa1814046ff7c9d1e6becaf60d2` was verified before execution. The isolated production-config-path probe observed `max_completion_tokens=58888` when unset and `max_completion_tokens=4096` when explicitly configured; all temporary binary, config, repository, HOME, and receipt paths were removed. -- Completion-cap parsing, protocol mapping, collision rules, environment defaults, generated config, wheel/sdist installed paths, and the reusable exact wire probe are implemented and focused-green. -- Canonical provider configuration now gives `configure` and `preflight` one environment snapshot and one owner for explicit protocol, API-root normalization, terminal-endpoint compatibility, secret-bearing headers, request-body controls, and auxiliary metadata URLs. Queried inference URLs require an explicit models URL; metadata-disabled preflight remains compatible. -- Provider failure projection now hostile-reads the bounded private result, validates retry-report v1 counters and terminal attempt facts, and emits only a closed provider-neutral reason. Non-zero classified runs use one static GitLab renderer, keep stderr/provider fields private, preserve the previous review, publish no findings, and never reach approval; legacy billing warnings use the same renderer. The focused gate passed Ruff, full package mypy, 302 tests, and 119 subtests. -- Public configuration, GitLab operations, security boundaries, and the test-evidence matrix now distinguish the per-request completion cap, OCR-owned prompt/context ceiling, and aggregate review budget; document the `/models` non-claim and the safe 404/429 projection; and preserve the generic fallback boundary. Separate #130 feature and #129 bug-fix fragments enumerate added, changed, migration, privacy, deployment, and unchanged contracts. The documentation gate passed 49 tests, Ruff, `git diff --check`, and the rendered 0.8.1 Towncrier section. -- Overall parser-boundary review found and closed three narrow fail-closed gaps before publication: completion-cap length is bounded before integer conversion, embedded URL whitespace is rejected before `urllib` normalization, and JSON booleans cannot satisfy retry attempt numbering. Ruff, full package mypy, 135 focused tests, 100 subtests, and `git diff --check` pass for the correction. -- Issue #132 owns the user-requested validation deduplication. The retained boundaries are five full functional matrix jobs, one PR coverage owner, PR security, one PR package owner, protected-main development artifact publication/readback, release-PR review, and the unchanged post-merge stable release pipeline. Its focused workflow contract passed 46 tests and YAML parsing for all five edited workflows; the complete handoff gate passed 1,231 tests plus 306 subtests, 86.13% combined branch coverage, all four risk floors (84/82/85/87), Ruff, mypy, Bandit, lock and OCR-manifest validation, rendered Towncrier, and `git diff --check`. Live ruleset readback confirmed the required check contexts and strict protected-head policy remain aligned with the unchanged job names. +No active or blocked repository work. diff --git a/changelog.d/129.bugfix.md b/changelog.d/129.bugfix.md deleted file mode 100644 index 56557a0..0000000 --- a/changelog.d/129.bugfix.md +++ /dev/null @@ -1,6 +0,0 @@ -Provider configuration and failed-review diagnostics now share one safe boundary: - -- **Fixed:** `ocr-ci configure` and `ocr-ci preflight` now use the same explicit `OCR_LLM_PROTOCOL`, normalized credential-free HTTPS API root, headers, request controls, and auxiliary models URL. Protocol-mismatched terminal endpoints, embedded credentials, fragments, and ambiguous queried `/models` derivation fail closed. -- **Changed:** a non-zero OCR result with a valid bounded `ocr.llm-retry-report/v1` now produces a toolkit-authored provider-neutral GitLab reason and remediation hint. Runtime `404` remains `endpoint-or-model-not-found`; `429` lists throttling, spending limits, and requested-output cost reservation as possibilities without claiming which occurred. -- **Privacy:** classified failures ignore normal findings and raw provider/model identities, response bodies, codes/messages, request IDs, paths, warnings, and stderr. `OCR_POST_ERROR_DETAILS=1` does not override this boundary. -- **Unchanged:** the previous successful review is preserved, automatic approval is not attempted, and receipt v5, DLP, telemetry, severity, finding, and posting-transaction contracts do not change. diff --git a/changelog.d/130.feature.md b/changelog.d/130.feature.md deleted file mode 100644 index 6ef2014..0000000 --- a/changelog.d/130.feature.md +++ /dev/null @@ -1,7 +0,0 @@ -Operators can now control the LLM request's completion/output cap independently of OCR context and aggregate review budgets: - -- **Added:** optional `OCR_LLM_MAX_COMPLETION_TOKENS`, accepting decimal integers from `1` through `1000000`. Its exact default is unset, so toolkit 0.8.1 inherits the qualified OCR behavior. -- **Protocol mapping:** `openai` writes `llm.extra_body.max_completion_tokens`, `openai-responses` writes `max_output_tokens`, and `anthropic` writes `max_tokens`. -- **Migration:** an equal JSON integer already owned by `OCR_LLM_EXTRA_BODY` is deduplicated; a different or non-integer value fails configuration. Remove the duplicate field or keep the same integer in both inputs. -- **Deployment:** toolkit 0.8.1 remains on OCR 1.9.10. For a gateway that accepts short probes but rejects a full review before generation, try an explicit value such as `4096`; the toolkit does not derive it from `/models.max_completion_tokens`. -- **Unchanged:** `OCR_MAX_TOKENS_BUDGET`, OCR prompt/context `max_tokens`, receipt v5, DLP, telemetry, review outcomes, severity, findings, and approval policy are unaffected. diff --git a/changelog.d/132.maintenance.md b/changelog.d/132.maintenance.md deleted file mode 100644 index 4d6ba0c..0000000 --- a/changelog.d/132.maintenance.md +++ /dev/null @@ -1,5 +0,0 @@ -Protected validation now assigns each repeated check to one explicit owner: - -- **Changed:** all five supported OS/Python pull-request jobs still run the complete functional suite, while Ubuntu on the newest supported Python is the single owner of combined and risk-group coverage floors. -- **Removed:** generic `main`-push reruns of CI, package build, Security, and CodeQL; duplicate wheel/sdist construction inside the CI quality job; and duplicate source quality and dependency-audit runs inside the TestPyPI development workflow. -- **Unchanged:** pull-request Security, CodeQL, Dependency Review, and `Build artifacts` gates; scheduled security analysis; TestPyPI artifact publication, provenance, bounded registry readback, and clean installs; release-pull-request checks; and the complete post-merge stable-release validation. diff --git a/docs/configuration.md b/docs/configuration.md index e2f4120..02bd7c9 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -83,9 +83,9 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell | Variable | Source / owner | Required | Exact default | Behavior | | --- | --- | --- | --- | --- | -| `OCR_VERSION` | Example pipeline | Yes | `v1.9.10` | Checksum-pinned recommended OCR binary release for toolkit 0.8.0. | +| `OCR_VERSION` | Example pipeline | Yes | `v1.9.10` | Checksum-pinned recommended OCR binary release for toolkit 0.8.1. | | `OCR_SHA256` | Example pipeline | Yes | `359e5bafda1438a47ef389399f4994350e1016371eac1dc17a2c428acb228e6c` | Expected Linux AMD64 OCR binary digest. | -| `OCR_TOOLKIT_VERSION` | Example pipeline | Yes | `0.8.0` | Exact toolkit wheel release installed by the current published example. | +| `OCR_TOOLKIT_VERSION` | Example pipeline | Yes | `0.8.1` | Exact toolkit wheel release installed by the current published example. | | `OCR_TOOLKIT_CHECKSUMS_URL` | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. | | `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. | | `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. | diff --git a/docs/engineering/execution_history/README.md b/docs/engineering/execution_history/README.md index 1697cca..5a44468 100644 --- a/docs/engineering/execution_history/README.md +++ b/docs/engineering/execution_history/README.md @@ -6,6 +6,7 @@ | Stable tag | Primary archived plan | Related context in the same archive | | --- | --- | --- | +| `v0.8.1` | [Completion cap, safe provider failures, and validation ownership](releases.md#plan-toolkit-0-8-1) | Protocol-aware completion cap, canonical provider configuration, bounded provider-failure projection, privacy and approval invariants, protected validation deduplication, feature merge, development artifact verification, and stable-delivery handoff. | | `v0.8.0` | [Remediation threads, GitLab commands, and documentation](releases.md#plan-toolkit-0-8-0) | Policy-v2 verified remediation history, context-store v2, provider-neutral forge views, exact live-username commands, environment cleanup, mode-oriented examples, OCR 1.9.10, 85% coverage and risk-group gates, protected feature merge, explicit enriched-qualification waiver, and stable-delivery handoff. | | `v0.7.1` | [Bounded result semantics and OCR 1.9.9](releases.md#plan-toolkit-0-7-1) | Receipt v5, canonical publication/approval projection, reconciled count-only evidence use, privacy-safe token buckets, deterministic Recommended focus ranking, OCR 1.9.9 qualification, concurrency and hostile-read remediation, protected feature merge, and stable-delivery handoff. | | `v0.7.0` | [M5 bounded review-context enrichment](releases.md#plan-toolkit-0-7-0) | Protected policy, GitLab discussions, provider-neutral adapters, context store and handles, fixed context tools, OCR-session containment, safe-partial publication DLP, receipt v4, setup diagnostics, GitLab CI uncertainty, OCR 1.9.8 qualification, adversarial boundary remediation, and stable-delivery handoff. | diff --git a/docs/engineering/execution_history/releases.md b/docs/engineering/execution_history/releases.md index 4632983..84615b2 100644 --- a/docs/engineering/execution_history/releases.md +++ b/docs/engineering/execution_history/releases.md @@ -2,6 +2,49 @@ This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active or blocked repository work; historical receipts here remain part of the audit trail. + + +## Repository-Complete Plan: v0.8.1 completion cap and safe provider failures + +Status: repository work complete; protected stable release and external reconciliation pending +Owner: Codex +Release classification: `release-required` +Target stable version: `0.8.1` +Last Updated: 2026-08-24 + +### Goal + +Expose a bounded protocol-aware LLM completion cap without changing OCR's prompt/context ceiling or the toolkit aggregate budget; unify provider configuration ownership; turn private OCR retry facts into safe provider-neutral GitLab guidance; and remove repeated validation that crossed no new platform, security, artifact, publication, or registry boundary. + +### Delivered contract + +- `OCR_LLM_MAX_COMPLETION_TOKENS` is optional and unset by default. It accepts positive decimal integers from `1` through `1000000` and maps to `max_completion_tokens` for `openai`, `max_output_tokens` for `openai-responses`, and `max_tokens` for `anthropic` through `llm.extra_body`. +- An equal integer already present in `OCR_LLM_EXTRA_BODY` is deduplicated; a conflicting or non-integer owner fails closed. `/models.max_completion_tokens` is never treated as a spending policy or automatic default. +- `configure` and `preflight` share one provider-neutral owner for explicit protocol, credential-free absolute HTTPS endpoints, headers, request-body controls, API-root normalization, terminal endpoint compatibility, and auxiliary models URL derivation. +- On non-zero OCR exit, only a strict bounded `ocr.llm-retry-report/v1` projection may select a toolkit-authored provider-neutral GitLab note. Raw bodies, messages, codes, URLs, model and provider identities, request IDs, paths, warnings, credentials, stderr, and failed-result findings remain private. +- Classified failures preserve the previous successful review, publish no normal findings, ignore `OCR_POST_ERROR_DETAILS`, and cannot reach automatic approval. Receipt v5, DLP, telemetry, severity, outcome, finding, and posting-transaction contracts remain unchanged. +- All five pull-request OS/Python jobs still run the full suite. Ubuntu Python 3.14 alone owns coverage; `Build artifacts` alone owns package smoke; Security, CodeQL, and Dependency Review retain their pull-request and scheduled boundaries. Protected-main TestPyPI owns development artifact publication/provenance/readback, while release-PR and stable-release gates remain complete. +- OCR 1.9.10 remains the exact qualified dependency. An isolated checksum-verified no-LLM wire probe observed inherited `max_completion_tokens=58888` when the toolkit setting was unset and `4096` when explicitly configured. + +### Validation and delivery evidence + +- Feature PR [#131](https://github.com/xeonvs/open-code-review-toolkit/pull/131) passed all hosted checks at reviewed head `4bfd9fc760143cb707c43aeca4f56db2a3096c13` and was squash-merged as `3f5c756ca5b6ccf62043765908fdc2cf2b29e14a`; the merge tree equals reviewed tree `4e1e8578b328666ac8c24201e0bd3635c42d5b4f`. +- Exact feature-head local validation passed 1,231 tests plus 306 subtests at 86.13% combined branch coverage and risk groups 84/82/85/87, with Ruff, mypy, Bandit, lock, OCR manifest, Towncrier, pinned Gitleaks, and diff checks green. +- TestPyPI development run [32766642880](https://github.com/xeonvs/open-code-review-toolkit/actions/runs/32766642880) published and read back `0.8.1.dev68`; provenance and clean wheel/sdist installs passed. Wheel SHA-256 is `764d00835c725fa67274b48d95420bb5e3b3d0be28043dc73203cc166bad1ad0`; sdist SHA-256 is `a9faf493df1d03d0f078ad6807fc04f9dc7cdc82aafc24ac9fec30cbd9843a12`. +- Release authorization tracks exactly open milestone issues #129, #130, and #132. The release candidate sets `.release-version=0.8.1`, `.next-version=0.8.2`, and deterministic epoch `1787598637`, one second after the feature squash merge. + +### Trust boundaries and non-claims + +- The `4096` example is an operator workaround for gateways that may reserve spending against requested output. It is not an automatic toolkit default and does not claim that a completion cap caused any particular `429`. +- Runtime `404` remains `endpoint-or-model-not-found`; untrusted raw provider text is not used to distinguish those cases. +- The retry report remains private OCR result data, not toolkit telemetry, a DLP input, receipt evidence, or an approval signal. +- Removing repeated checks relies on the active strict protected-`main` ruleset and unchanged required check names. It does not remove a supported Python/OS run, security analysis, package smoke, public artifact verification, release authorization, registry readback, or stable install gate. +- Stable TestPyPI/PyPI bytes, GitHub attestations, registry provenance, annotated `v0.8.1` tag, immutable GitHub Release and assets, `release-receipt.json`, supported-Python registry installs, Actions-owned issue receipts, issue/milestone closure, and final clean-main synchronization are not claimed by this repository checkpoint and remain post-merge external gates. + +### Resume point + +Open the exact `Release v0.8.1` PR from `release/v0.8.1`, require its unchanged exact-head hosted checks and resolved review threads, then use the protected squash merge to start stable publication. Independently verify registry/workflow/Release bytes, provenance, attestations, installs, annotated tag, immutable receipt, issue receipts, issue and milestone closure, synchronized `main`, and final scratch cleanup. + ## Repository-Complete Plan: v0.8.0 remediation threads, GitLab commands, and documentation diff --git a/examples/gitlab/ocr-review.gitlab-ci.yml b/examples/gitlab/ocr-review.gitlab-ci.yml index 78cb347..e604437 100644 --- a/examples/gitlab/ocr-review.gitlab-ci.yml +++ b/examples/gitlab/ocr-review.gitlab-ci.yml @@ -7,7 +7,7 @@ default: variables: OCR_VERSION: "v1.9.10" - OCR_TOOLKIT_VERSION: "0.8.0" + OCR_TOOLKIT_VERSION: "0.8.1" OCR_TOOLKIT_CHECKSUMS_URL: "https://github.com/xeonvs/open-code-review-toolkit/releases/download/v${OCR_TOOLKIT_VERSION}/SHA256SUMS" OCR_SHA256: "359e5bafda1438a47ef389399f4994350e1016371eac1dc17a2c428acb228e6c" OCR_POST_MODE: "draft" diff --git a/tests/test_release_notes.py b/tests/test_release_notes.py index f9785ac..6111c17 100644 --- a/tests/test_release_notes.py +++ b/tests/test_release_notes.py @@ -113,6 +113,33 @@ def test_080_release_notes_are_actionable_for_operators_and_automation() -> None assert contract in notes +def test_081_release_notes_separate_added_fixed_removed_and_unchanged_contracts() -> None: + """Give deployment agents an exact delta without requiring source inspection.""" + + changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8") + notes = release.release_notes(changelog, "0.8.1") + + for label in ("**Added:**", "**Fixed:**", "**Changed:**", "**Removed:**", "**Unchanged:**"): + assert label in notes + for contract in ( + "OCR_LLM_MAX_COMPLETION_TOKENS", + "unset", + "llm.extra_body.max_completion_tokens", + "max_output_tokens", + "max_tokens", + "OCR_LLM_EXTRA_BODY", + "/models.max_completion_tokens", + "endpoint-or-model-not-found", + "requested-output cost reservation", + "raw provider/model identities", + "automatic approval is not attempted", + "all five supported OS/Python", + "generic `main`-push reruns", + "complete post-merge stable-release validation", + ): + assert contract in notes + + def test_extracts_only_the_exact_release_section() -> None: changelog = "# Changelog\n\n## 0.2.0 - later\n\nnew\n\n## 0.1.0 - now\n\nfirst\n"