Release v0.8.2

[xeonvs]

Stable release candidate

• stable version: 0.8.2
• next development line: 0.8.3
• exact reviewed head: 8198879399953fb3eca6ee9aebb5f172b6b360eb
• exact tree: ba935a1f0a7f0e6e6c899120ecdc08e3822097c4
• protected base / feature squash merge: cdc46735ba4338906d2049ff29789c1c92295d7c
• deterministic source epoch: 1787648187
• tracked release issues: [OCR compatibility] Qualify v1.10.0 #135, Retain bounded diagnostics when OCR compatibility qualification fails #136, Complete BL-017 review signal ownership audit for OCR grouping and rounds #137

Included delta

• Promotes exact checksum-qualified OCR 1.10.0; OCR 1.9.10 remains the 0.8.0/0.8.1 predecessor and is not an intermediate deployment.
• Adds OCR_REVIEW_EFFORT=low|medium|high with exact default medium, while explicit OCR --effort retains per-run precedence.
• Keeps semantic group/path/round diagnostics private and outside findings, severity, fingerprints, lifecycle commands, GitLab text, receipt v5, toolkit telemetry, and automatic approval.
• Rejects caller OCR --output/-o forms so ocr-ci review --result retains descriptor, DLP, cleanup, receipt, and posting ownership.
• Retains bounded compatibility status/issue/artifact evidence after failed qualification while preserving the red job and blocked promotion.
• Completes BL-017 with no-new-layer; OCR owns provider/review telemetry and toolkit owns deterministic lifecycle signals.
• Keeps required configuration inputs visually bold according to their scoped Required contract.

Development artifact evidence

Feature PR #134 was squash-merged as cdc46735ba4338906d2049ff29789c1c92295d7c. TestPyPI run 32829250700 published and read back 0.8.2.dev70 with verified provenance and exact wheel/sdist installs:

• wheel SHA-256: 8ac4fe8a1b04e2472e1f31b818b97d06f35425597a6d59f51e9f0c1d6e06a9d6
• sdist SHA-256: fe04831bc1bb6db566ebb1131f787562150be0e7cdb5b96932fcb519aaf2e3a7

Release-candidate validation

• Feature head passed 1,256 tests + 310 subtests at 86.14% combined branch coverage and risk groups 84/82/85/87, plus Ruff, MyPy, Bandit, lock/manifest, Towncrier, pinned Gitleaks, diff, and plan gates.
• Exact feature/reconciliation head passed all 13 protected PR checks across Linux/macOS Python 3.12-3.14, Build artifacts, Security, CodeQL, and Dependency Review.
• Release-only changes passed 69 focused release/config/example/authorization tests, Ruff, JSON metadata, plan lifecycle, lock/OCR manifest, pinned Gitleaks, and diff/invariant checks.
• The owner waived local LLM execution because this environment has no configured provider access. The release does not claim a production model/provider result; checksum-verified real-OCR deterministic wire and result-consumer evidence remains the qualification boundary.
• The stable workflow is the sole owner of reproducible release builds, Twine, registry publication/readback, provenance/attestations, and clean Python 3.12-3.14 installs; those boundaries are not duplicated locally.

This is the final repository mutation for 0.8.2. After exact-head checks pass, protected squash merge starts the unchanged stable publication, provenance, registry readback, supported-Python install, immutable Release, receipt, issue, and milestone reconciliation workflow.