From 8198879399953fb3eca6ee9aebb5f172b6b360eb Mon Sep 17 00:00:00 2001
From: xeonvs <11463419+xeonvs@users.noreply.github.com>
Date: Tue, 25 Aug 2026 11:02:33 +0200
Subject: [PATCH] Prepare release v0.8.2
---
.next-version | 2 +-
.release-metadata.json | 8 +-
.release-source-date-epoch | 2 +-
.release-version | 2 +-
CHANGELOG.md | 29 +
PLANS.md | 507 +-----------------
changelog.d/135.bugfix.md | 1 -
changelog.d/135.feature.md | 4 -
changelog.d/135.maintenance.md | 6 -
changelog.d/136.bugfix.md | 1 -
changelog.d/137.maintenance.md | 1 -
docs/configuration.md | 2 +-
docs/engineering/execution_history/README.md | 1 +
.../engineering/execution_history/releases.md | 44 ++
examples/gitlab/ocr-review.gitlab-ci.yml | 2 +-
tests/test_release_notes.py | 16 +-
16 files changed, 88 insertions(+), 540 deletions(-)
delete mode 100644 changelog.d/135.bugfix.md
delete mode 100644 changelog.d/135.feature.md
delete mode 100644 changelog.d/135.maintenance.md
delete mode 100644 changelog.d/136.bugfix.md
delete mode 100644 changelog.d/137.maintenance.md
diff --git a/.next-version b/.next-version
index 100435b..ee94dd8 100644
--- a/.next-version
+++ b/.next-version
@@ -1 +1 @@
-0.8.2
+0.8.3
diff --git a/.release-metadata.json b/.release-metadata.json
index ef3ee57..ff21d73 100644
--- a/.release-metadata.json
+++ b/.release-metadata.json
@@ -1,9 +1,9 @@
{
"issues": [
- 129,
- 130,
- 132
+ 135,
+ 136,
+ 137
],
"schema_version": "ocr-toolkit.release-authorization/v1",
- "version": "0.8.1"
+ "version": "0.8.2"
}
diff --git a/.release-source-date-epoch b/.release-source-date-epoch
index 550eaa0..241e042 100644
--- a/.release-source-date-epoch
+++ b/.release-source-date-epoch
@@ -1 +1 @@
-1787598637
+1787648187
diff --git a/.release-version b/.release-version
index 6f4eebd..100435b 100644
--- a/.release-version
+++ b/.release-version
@@ -1 +1 @@
-0.8.1
+0.8.2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2dcc297..f6517bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,32 @@
+## 0.8.2 - 2026-08-25
+
+### 🚀 Features
+
+- Expose OCR 1.10.0 review depth and grouping with explicit operator ownership.
+
+ - **Added:** `OCR_REVIEW_EFFORT` is a closed `low|medium|high` setting written to OCR's root `effort` key. Its exact default is `medium`, selecting up to two review rounds; `low` selects one and `high` selects three. A caller-supplied OCR `--effort` remains the per-run override, and merge-request text cannot select it.
+ - **Changed:** OCR may semantically group related changed files and filter findings per group before additional rounds. Group labels, path-derived keys, membership, and round diagnostics remain untrusted private result data and cannot change findings, severity, fingerprints, lifecycle commands, receipt v5, toolkit telemetry, posting, or automatic approval.
+
+ ([#135](https://github.com/xeonvs/open-code-review-toolkit/issues/135))
+
+### 🐛 Bug Fixes
+
+- **Fixed:** Reject caller-owned OCR `--output`, `--output=...`, `-o`, and attached short forms before preview so the new upstream output flag cannot bypass the toolkit-owned result descriptor, atomic validation, DLP, cleanup, or posting handoff. Also make successful compatibility promotion report a caller-supplied relative manifest path without crashing after the update was written. ([#135](https://github.com/xeonvs/open-code-review-toolkit/issues/135))
+- **Fixed:** A failed OCR compatibility qualification now still updates the canonical version issue and uploads a bounded `ocr-toolkit.compatibility-status/v1` artifact before the job returns red. Public coordination receives only closed phase, reason, version, and run identity; raw exceptions remain in the private job log, and aggregate promotion stays blocked. ([#136](https://github.com/xeonvs/open-code-review-toolkit/issues/136))
+
+### 🛠 Maintenance
+
+- Qualify and promote the next OCR runtime without losing predecessor or deployment context.
+
+ - **OCR 1.9.10 — inherited predecessor:** Toolkit 0.8.0 and 0.8.1 used exact OCR 1.9.10, whose unset OpenAI completion cap was observed as `max_completion_tokens=58888`. Its checksum-pinned evidence remains unchanged; toolkit 0.8.2 does not require installing or requalifying it.
+ - **OCR 1.10.0 — changed target:** Toolkit 0.8.2 preflight and the GitLab example now require checksum-verified OCR 1.10.0. Qualification covers semantic file grouping, path-aware comments, group filtering, one/two/three review rounds, partial-budget reporting, tool/token accounting, the new `--output` flag, private git diagnostics, and the new inherited OpenAI completion cap `max_completion_tokens=16384`. Linux amd64 SHA-256 is `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b`.
+ - **Telemetry:** OCR remains authoritative for provider, request, latency, cost, grouping, round, and tool telemetry. OCR 1.10.0 group spans can contain sorted changed paths and model-produced labels; the toolkit defaults OCR telemetry off, does not ingest those values, and adds no exporter or approval/routing signal.
+ - **Deployment/Migration:** Deploy toolkit 0.8.2 directly with OCR 1.10.0; do not install OCR 1.9.10 as an intermediate step. Unset `OCR_LLM_MAX_COMPLETION_TOKENS` inherits `16384`; set an explicit value such as `4096` when a gateway-specific invariant is required. Caller `--output`/`-o` remains unsupported because `ocr-ci review --result` owns the private result lifecycle.
+
+ ([#135](https://github.com/xeonvs/open-code-review-toolkit/issues/135))
+- **Changed:** Complete the BL-017 review-signal ownership audit with a `no-new-layer` result. OCR retains provider/review telemetry ownership; toolkit receipt, context, DLP, posting, and approval projections retain deterministic lifecycle ownership. No exporter, automatic routing, developer scoring, or duplicate group/round metric schema is added. ([#137](https://github.com/xeonvs/open-code-review-toolkit/issues/137))
+
+
## 0.8.1 - 2026-08-24
### 🚀 Features
diff --git a/PLANS.md b/PLANS.md
index 84529dd..ca171a2 100644
--- a/PLANS.md
+++ b/PLANS.md
@@ -4,509 +4,4 @@ Use this file for active or blocked repository work. Update it before implementa
## Active Work
-### OCR 1.10.0 integration, review effort, and compatibility failure recovery
-
-Status: `active`
-Owner: Codex
-Release classification: `release-required`
-Target stable version: `0.8.2`
-Plan Origin: `plan_mode_approved`
-Last Updated: 2026-08-25
-
-#### Goal
-
-Qualify and integrate checksum-pinned Open Code Review 1.10.0, expose its bounded
-review-effort control with a toolkit default of `medium`, preserve toolkit-owned
-result, DLP, receipt, and approval boundaries around new group/round data, repair
-the compatibility workflow so failed qualifications retain a canonical issue and
-bounded artifact, complete the activated BL-017 signal-ownership audit without a
-second telemetry layer, update the PATH-effective local OCR binary safely, and
-deliver the result through the protected toolkit 0.8.2 release lifecycle.
-
-#### Requested Scope
-
-- Create `codex/v0.8.2-ocr-1.10.0` from synchronized `main`, make this plan the
- first repository write, commit it with an SSH signature, push it, and open a
- Draft PR before product implementation.
-- Create milestone `v0.8.2`, one canonical OCR 1.10.0 qualification issue with
- the stable workflow marker, and bounded linked work for compatibility failure
- recovery and the BL-017 measurement audit.
-- Repair the deterministic OCR compatibility gateway for OCR 1.10.0's required
- comment `path`, semantic grouping, group-level filtering, and multi-round
- lifecycle; qualify the exact hosted Linux amd64 artifact before promotion.
-- Preserve a failed qualification as a closed schema-versioned status, update
- the canonical issue, upload the artifact, and still fail the qualification
- job so aggregation and promotion cannot proceed from incomplete evidence.
-- Promote manifest, preflight, public GitLab example, documentation, and machine
- evidence from OCR 1.9.10 to exact OCR 1.10.0 with hosted asset/checksum parity.
-- Add `OCR_REVIEW_EFFORT` with exact values `low`, `medium`, or `high`; default
- it to `medium`, write OCR's root `effort` config, and preserve an explicit OCR
- `--effort` CLI flag as the per-run override.
-- Keep `OCR_LLM_MAX_COMPLETION_TOKENS` unset by default. Qualify and document
- inherited OpenAI completion caps separately: 58,888 for OCR 1.9.10 and 16,384
- for OCR 1.10.0, while retaining explicit `4096` as the operator workaround for
- gateways that reserve spending against the requested output cap.
-- Reject caller-owned OCR `--output`, `--output=...`, `-o`, and attached short
- forms before OCR execution. Continue capturing stdout through the toolkit's
- pre-opened owner-only result descriptor and keep `--result` toolkit-owned.
-- Treat additive OCR `groups` labels and paths as untrusted private result data.
- They may be privately sanitized but never enter findings, GitLab text, receipt
- v5, severity, fingerprints, lifecycle commands, toolkit telemetry, or approval.
-- Document semantic grouping, review rounds, budget/cost effects, output-path
- ownership, completion-cap migration, git-error privacy, and OCR telemetry
- cardinality without adopting a second exporter or trusting MR content as a
- configuration authority.
-- Activate and complete the bounded BL-017 audit. Keep BL-016 parked, BL-018
- conditional, and BL-019/BL-020 inactive; reconcile backlog, strategy, roadmap,
- engineering navigation, and execution history only to the achieved truth.
-- Update the PATH-effective local `/opt/homebrew/bin/ocr` atomically from its
- current 1.8.10 Darwin arm64 binary to exact 1.10.0 after checksum and contract
- acceptance, without changing the user's OCR config, credentials, or HOME.
-- Produce separate agent- and human-readable Towncrier fragments for maintenance,
- feature, and bug-fix outcomes, then run the protected 0.8.2 lifecycle through
- exact-head hosted validation, merge, registry publication, and external readback.
-
-#### Requirement Traceability
-
-- `REQ-001` (`done`): materialize the approved full plan first, create the
- feature branch, signed planning commit, initial push, Draft PR, milestone, and
- linked issue structure. Covered by `WQ-01` and `WQ-02`.
-- `REQ-002` (`done`): make failed compatibility qualification produce a
- bounded status, canonical issue update, and artifact while the job remains red
- and aggregate remains blocked. Covered by `WQ-03`.
-- `REQ-003` (`done`): adapt deterministic qualification to OCR 1.10.0 comment
- paths, grouping, filters, effort rounds, usage, budget, and version-specific
- completion caps. Covered by `WQ-03` and `WQ-04`.
-- `REQ-004` (`done`): independently source-audit, checksum-verify, and qualify
- OCR 1.10.0 Linux amd64, then promote every manifest, preflight, example, and
- evidence owner without changing historical OCR 1.9.10 evidence. Covered by
- `WQ-04` and `WQ-05`.
-- `REQ-005` (`done`): add the exact documented environment contract
- `OCR_REVIEW_EFFORT=medium`, closed validation, root-config projection, and
- explicit CLI override precedence without MR-controlled routing. Covered by
- `WQ-05`.
-- `REQ-006` (`done`): reject caller OCR output-path controls and preserve the
- existing safe result descriptor, cleanup, and failure behavior. Covered by
- `WQ-05`.
-- `REQ-007` (`done`): prove new group/round fields remain provider-neutral,
- private, DLP-bounded, receipt-independent, and unable to alter severity,
- findings, approval, posting, or lifecycle commands. Covered by `WQ-06`.
-- `REQ-008` (`done`): complete the BL-017 source-to-signal audit with a
- no-new-layer conclusion unless evidence demonstrates a separately scoped gap;
- preserve BL-016/018/019/020 activation boundaries. Covered by `WQ-07`.
-- `REQ-009` (`done`): publish version-separated, deployment-actionable docs
- and changelog text covering added, changed, rejected, inherited, telemetry,
- privacy, and migration behavior. Covered by `WQ-07` and `WQ-08`.
-- `REQ-010` (`done`): atomically update local OCR to checksum-verified Darwin
- arm64 1.10.0 and pass isolated no-LLM checks without modifying user config.
- Covered by `WQ-09`.
-- `REQ-011` (`pending`): complete focused and one final full local validation,
- exact-head hosted PR checks, record the owner-waived local LLM non-claim, and
- complete the protected 0.8.2 release/readback lifecycle without restoring
- validation duplication removed by #132. Covered by `WQ-10` through `WQ-12`.
-
-#### Explicit Non-Goals
-
-- Do not fork or patch upstream OCR, run `ocr scan`, adopt OCR's `--output` file
- ownership, or add a second review engine, grouping implementation, or result
- writer.
-- Do not derive effort, model, provider, completion cap, approval, suppression,
- severity, or lifecycle state from merge-request title, description, paths,
- diff, discussions, group labels, model prose, or raw provider errors.
-- Do not implement automatic effort/profile routing or activate BL-016/BL-018;
- explicit `medium` is an operator-owned default, not an inferred policy.
-- Do not publish raw group labels, file paths, provider identities, response
- bodies, request IDs, stderr, failed compatibility exception text, or rejected
- DLP values in issues, notes, receipts, or toolkit telemetry.
-- Do not create a general configuration file framework, fuzzing campaign, new
- coverage framework, new telemetry exporter, or broad test-directory rewrite.
-- Do not weaken or disable Bandit, Gitleaks, CodeQL, dependency review, coverage,
- protected-branch, artifact, provenance, or registry gates. Do not run a
- separate Codex Security scan unless a later validated finding requires it.
-- Do not edit the user's OCR config or credentials, invoke a real model during
- the local binary replacement, or preserve downloaded binaries in the repo.
-- Do not close issues, milestone, active plan, or stable-release state before
- independent external reconciliation confirms the exact published artifacts.
-
-#### Constraints
-
-- `main` is clean and equals `origin/main` at stable toolkit v0.8.1 commit
- `b0ffdd3c324afe9095ee966b339748d5944b029b`; `.next-version` is `0.8.2`.
-- The approved effort decision supersedes the earlier recommended `low`: toolkit
- default is exactly `medium`; `low` and `high` remain explicit alternatives.
-- Each logical commit requires focused tests, full slice diff self-review,
- requirements and trust/data-flow reconciliation, `git diff --check`, and an
- SSH-signed commit. New non-trivial tests receive concise behavioral docstrings;
- docstrings name a concrete OCR version only when the assertion is versioned.
-- Preserve the #132 ownership split: focused checks per slice, one complete local
- quality gate before final publication, one hosted coverage owner, one PR build
- owner, and complete stable-release gates only at the release boundary.
-- The hosted Linux amd64 compatibility probe is primary version evidence. The
- Darwin arm64 probe is an independent local wire/CLI check with an isolated
- temporary HOME and deterministic HTTP peer, never a real LLM call.
-- Qualification failures retain only closed status codes in public artifacts;
- raw exception detail may remain only in the bounded workflow log for synthetic
- compatibility fixtures and may not include credentials or private repository
- content.
-- Receipt schema stays v5. Existing DLP distinction between private sanitization
- and publication filtering, partial-review approval blocking, posting rollback,
- fingerprinting, and human ownership must remain intact.
-- A real-model exact-head qualification may use only an owner-configured provider
- with `OCR_LLM_MAX_COMPLETION_TOKENS=4096`; the user explicitly waived this
- local gate because the current environment has no provider access. Preserve
- the non-claim instead of substituting Codex credentials or model output.
-
-#### Inputs And Sources
-
-- User-approved v0.8.2 plan and the later explicit choice of default
- `OCR_REVIEW_EFFORT=medium`.
-- Root `AGENTS.md`, engineering-workflow 0.8.1, `docs/development.md`,
- `docs/release.md`, project principles, compatibility policy, public
- configuration/operations/GitLab contracts, and the #132 validation split.
-- Stable main v0.8.1, issues #129/#130/#132, current OCR support manifest and
- evidence, existing compatibility harness, result/DLP/receipt/approval code,
- environment-contract tests, and GitLab example.
-- Official upstream OCR v1.10.0 release, compare from v1.9.10, commit
- `a66240084b382ed97a47590bdec13a6a34df0743`, GitHub asset digests, and
- `sha256sum.txt`.
-- Failed scheduled workflow run 32815275725: discovery passed; qualification
- failed because the existing deterministic response emitted no accepted
- comment; issue upsert and artifact upload were then skipped.
-- Read-only exact Darwin arm64 probe during planning: reported OCR v1.10.0 and
- reproduced `candidate full review did not emit the synthetic comment` without
- a real LLM or user-config change.
-- BL-016 through BL-020, toolkit strategy/roadmap, and engineering signal owners
- for backlog reconciliation.
-
-#### User Decisions And Answers
-
-- Ship OCR 1.10.0 in the next toolkit release and update the local OCR binary.
-- Investigate every upstream change and prioritize what materially benefits the
- toolkit; track demonstrated backlog relationships without overengineering.
-- Fix the compatibility Action failure and the missing canonical issue/artifact,
- rather than rerunning the unchanged failing workflow repeatedly.
-- Default `OCR_REVIEW_EFFORT` to `medium`, accepting up to two review rounds and
- the associated cost/latency change; document `low` as the explicit economy
- choice and `high` as deliberate deeper review.
-- Preserve provider-neutral architecture, DLP/approval independence, safe handling
- of every MR-controlled text source, accurate release-note categorization, and
- agent-readable deployment/migration language.
-- Keep tests in their existing thematic owners, add meaningful boundary evidence,
- and avoid mechanical file/subdirectory reorganization or percentage-only tests.
-- Preserve efficient validation ownership from #132 instead of repeating the
- full suite locally, on every push, after main merge, and again without a new
- trust boundary.
-- Skip the local LLM-backed review in this environment. This owner waiver removes
- the release blocker but does not convert deterministic OCR compatibility or
- hosted CI evidence into a claim about a production model/provider response.
-
-#### Completed Baseline State
-
-- Toolkit v0.8.1 is stably released and `main` is synchronized and clean.
-- OCR 1.9.10 is the exact current recommended/preflight/example version with
- immutable compatibility evidence; OCR 1.9.9 remains historical predecessor.
-- `OCR_LLM_MAX_COMPLETION_TOKENS` already provides closed protocol-aware override
- mapping and is unset by default; provider failures already publish safe static
- GitLab guidance without raw provider fields or stderr.
-- Receipt v5, canonical publication/DLP projection, partial-review approval
- blocking, context-store/MCP boundaries, provider-neutral codehost contracts,
- and GitLab posting transactions are implemented and covered.
-- Combined branch coverage floor is 85% with four risk-group floors; PR and
- release validation ownership was deduplicated in #132.
-- The PATH-effective local OCR is user-owned Darwin arm64 v1.8.10 at
- `/opt/homebrew/bin/ocr`; it is not managed by a Homebrew formula or cask.
-- Latest upstream stable OCR is v1.10.0. Official SHA-256 values relevant here
- are Linux amd64 `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b`
- and Darwin arm64 `c8f51b17c2be193ca178ecce6b5bcc1e38a5614629fbe81c6e1c95af5ede12e4`.
-
-#### Current Work Queue
-
-1. `WQ-01` (`done`): pass plan fidelity, create the feature branch, perform
- planning self-review/checks, and make the signed planning commit.
-2. `WQ-02` (`done`): push planning head, open Draft PR, create/read back
- milestone and canonical/sub-issue coordination.
-3. `WQ-03` (`done`): implement bounded failure status plus always-run issue and
- artifact handling; add workflow/CLI tests and preserve final failure outcome.
-4. `WQ-04` (`done`): adapt the gateway and real OCR contracts for path,
- grouping, filtering, effort rounds, budget, usage, and completion caps; push
- the signed qualification checkpoint and run hosted Linux qualification.
-5. `WQ-05` (`done`): validate hosted evidence, promote OCR 1.10.0, add
- `OCR_REVIEW_EFFORT=medium`, reject OCR output-path ownership, and update exact
- environment/config/installed-artifact contracts.
-6. `WQ-06` (`done`): add focused groups/DLP/receipt/approval/result regressions
- and repair only real contract violations exposed by them.
-7. `WQ-07` (`done`): complete BL-017 audit and reconcile backlog, strategy,
- roadmap, telemetry privacy/cardinality, and no-new-layer conclusion.
-8. `WQ-08` (`done`): update public docs, examples, compatibility text, test
- evidence matrix, and separate Towncrier feature/bugfix/maintenance fragments.
-9. `WQ-09` (`done`): checksum-verify and atomically install local Darwin arm64
- OCR 1.10.0; run version/help/no-LLM isolated contract checks and clean temporary
- artifacts with rollback on failure.
-10. `WQ-10` (`done`): perform holistic requirements/privacy/architecture/data-
- flow/telemetry/docs self-review and one final local quality/security/manifest/
- changelog gate; update plan to exact implementation truth and final commit.
-11. `WQ-11` (`done`): push final signed history, wait for exact-head hosted PR
- checks, fix only evidence-backed failures through the same commit gate, and
- record the user-waived local LLM qualification as an explicit non-claim.
-12. `WQ-12` (`in_progress`): ready and merge the protected feature PR, verify the
- TestPyPI development artifact, execute protected release/v0.8.2, independently
- reconcile PyPI/TestPyPI/provenance/tag/GitHub Release/receipt/install state,
- close issues and milestone through release automation, archive this plan with
- `scripts/plan_lifecycle.py`, and synchronize clean local `main`.
-
-#### Locked Decisions
-
-- Toolkit target is 0.8.2; exact OCR target is 1.10.0.
-- `OCR_REVIEW_EFFORT` is a closed lower-case enum with exact default `medium`.
-- Explicit OCR `--effort` remains the per-run override; no second CLI wrapper flag
- and no MR-derived automatic routing are introduced.
-- OCR `groups` is optional untrusted private data, not a toolkit public contract
- or approval/receipt/telemetry input.
-- OCR `--output/-o` is not adopted because it transfers path creation/truncation
- ownership across the toolkit's existing safe result boundary.
-- OCR 1.10.0 inherited completion cap is documented and qualified as 16,384, but
- toolkit completion-cap default remains unset and explicit 4,096 remains the
- recommended gateway-specific workaround.
-- Compatibility failure status uses closed phase/reason values and the same stable
- version marker; success and failure never own separate issues.
-- BL-017 completes as a bounded ownership audit with no new exporter unless the
- audit proves a separate gap; current evidence expects `no-new-layer`.
-- Local OCR replacement occurs only after exact checksum and contract acceptance,
- uses an atomic rollback transaction, and never edits user configuration.
-
-#### Verification
-
-- Planning: plan-fidelity check, full `PLANS.md` diff review, `git diff --check`,
- signed commit verification, remote branch/Draft PR/issue/milestone readback.
-- Workflow failure: unit tests for success/failure status schemas, bounded public
- rendering, duplicate issue prevention, failed-job preservation, always-run
- issue/artifact steps, cancelled behavior, and aggregate blocking; YAML parse.
-- OCR contracts: exact Linux hosted and Darwin local binaries, asset digest plus
- checksum-file agreement, version/help/preview, two-file grouping, path-aware
- finding, low/medium rounds, early stop, group filter, budget partial, token/tool
- accounting, inherited/explicit completion caps, and target-rule selection.
-- Runtime config: exact environment set/default tests, closed effort enum,
- generated root config, CLI precedence documentation, installed-artifact
- configure/preflight/review checks, and caller output-option rejection forms.
-- Privacy/approval: safe and hostile group metadata, PII/secret/laundering/private
- sanitization, no publication/receipt/log/toolkit-telemetry projection, unchanged
- finding fingerprint/severity, safe auto-approval parity, and fail-closed partial,
- malformed, budget, or publication-filtered cases.
-- Documentation/backlog: current-version/default/checksum consistency, BL-017
- source-to-signal matrix, BL-016/018/019/020 status checks, rendered Towncrier
- categories, links/index checks, and deployment-agent language review.
-- Final local: focused suites while iterating; once at final head run
- `scripts/quality.sh check`, `scripts/gitleaks.sh`, `uv lock --check`,
- `scripts/ocr_compat.py validate`, Towncrier draft, `git diff --check`, and the
- repository privacy scan. Do not repeat clean multi-Python installs locally
- because hosted Build artifacts and release gates own that boundary.
-- Hosted/delivery: all required feature-PR checks, explicit local-model non-claim,
- protected merge, TestPyPI development build/provenance/install readback,
- protected stable release, immutable registry/GitHub/tag/receipt readback, and
- supported-Python install verification.
-
-#### Latest Validation Results
-
-- `2026-08-25`: `main` and `origin/main` both resolve to
- `b0ffdd3c324afe9095ee966b339748d5944b029b`; worktree is clean and next version
- is 0.8.2.
-- `2026-08-25`: engineering-workflow 0.8.1 audit found all canonical files and
- required documentation indexes; no index errors. Audit noise is confined to
- ignored disposable `.quality-logs` environments, which remain untouched.
-- `2026-08-25`: GitHub CLI is authenticated with repository/workflow scope.
- Scheduled compatibility run 32815275725 discovered v1.10.0, then failed its
- full-review contract; issue upsert and artifact upload were skipped and the
- aggregate job did not run.
-- `2026-08-25`: official release metadata and upstream source comparison identify
- semantic grouping/rounds, path-aware comments, output-file support, and git
- diagnostic changes; exact public asset hashes are recorded above.
-- `2026-08-25`: an isolated checksum-verified Darwin arm64 1.10.0 planning probe
- reproduced the compatibility comment failure without using a real LLM or
- changing the installed OCR/config; all temporary probe/source directories were
- removed afterward.
-- `2026-08-25`: the complete schema-v2 active plan passed engineering-workflow
- `plan_lifecycle.py check`; full plan diff self-review and `git diff --check`
- passed with no product or external mutation before the planning checkpoint.
-- `2026-08-25`: signed planning commit
- `4cc7d6427cfebd26db6ff26739f8710d4b8ae134` was pushed and opened Draft PR
- #134. Milestone `v0.8.2` contains canonical OCR issue #135 and linked sub-issues
- #136 (failed-qualification retention) and #137 (BL-017 audit); GitHub API
- readback confirms all three open issues and both parent-child relationships.
-- `2026-08-25`: failed qualification now emits only the closed
- `ocr-toolkit.compatibility-status/v1` projection to issue automation, retains
- raw diagnostics in the private job log, always attempts canonical issue and
- artifact handling, and explicitly restores the red job outcome. Ruff, mypy,
- 83 focused compatibility/workflow tests, YAML parsing, plan validation, and
- `git diff --check` pass; self-review also added the pre-manifest failure path.
-- `2026-08-25`: an isolated checksum-verified Darwin arm64 OCR 1.10.0 contract
- run passed the adapted real-binary gateway: path-aware comments, one semantic
- grouping call, two default-medium review rounds, one filter call, inherited
- `max_completion_tokens=16384`, explicit override `4096`, the existing partial
- budget contract, result consumers, and telemetry-off environment. The binary,
- HOME, repositories, and receipt were temporary and removed; installed OCR and
- user configuration remain unchanged.
-- `2026-08-25`: hosted Linux run 32825123658 passed on exact head `3c49968`,
- updated canonical issue #135, retained its seven-day artifact, and produced
- human-review-required evidence with Linux amd64 SHA-256
- `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b`. The reviewed source and
- wire contract were accepted and promoted to manifest/preflight/example owners.
- `OCR_REVIEW_EFFORT` now defaults to root-config `medium`, explicit CLI effort
- remains authoritative, caller output paths fail before preview, and 272 focused
- tests plus 104 subtests, installed wheel/sdist checks, Ruff, mypy, manifest
- validation, and `git diff --check` pass. Promotion also exposed and fixed the
- relative-manifest success-reporting bug in the compatibility CLI.
-- `2026-08-25`: additive OCR group labels, file lists, and round diagnostics have
- explicit boundary regressions: safe values leave the canonical result and
- auto-approval decision unchanged; PII and recognized secrets are sanitized in
- the private result without becoming a publication failure; neither safe nor
- sanitized values enter receipt v5; and receipt extensions fail closed. The 129
- focused review/approval tests plus 71 subtests, Ruff, and `git diff --check`
- pass. Direct mypy invocation over test files remains non-owner validation and
- reports pre-existing test-module export errors; the repository quality owner
- remains the final typed gate.
-- `2026-08-25`: the BL-017 source-to-signal matrix maps provider, request,
- latency, cost, tokens, grouping, rounds, tools, coverage, context, DLP,
- posting, approval, and compatibility to their existing owners. OCR 1.10.0
- group span names/attributes contain sorted changed paths or model-produced
- labels, so explicitly enabled OCR telemetry is classified as repository-
- derived and high-cardinality. The audit concludes `no-new-layer`; BL-016 stays
- parked, BL-018 conditional, and BL-019/BL-020 retain their activation gates.
- Documentation contracts pass 23 focused tests, Ruff, plan validation, and
- `git diff --check`.
-- `2026-08-25`: public configuration, compatibility, GitLab, operations,
- security, example, README, and test-evidence owners now separate OCR 1.9.10's
- inherited `58888` completion cap from the OCR 1.10.0 target's `16384`, explain
- explicit `4096`, `medium`/two-round effort, grouping cost and telemetry,
- private group/result authority, and rejected caller output ownership. Five
- category-correct fragments distinguish feature, compatibility maintenance,
- workflow/runtime fixes, audit maintenance, and direct deployment without an
- intermediate OCR version. The rendered Towncrier 0.8.2 section and 53 focused
- documentation/configuration/integration tests pass with Ruff and
- `git diff --check`.
-- `2026-08-25`: the PATH-effective local OCR was atomically replaced from
- user-owned Darwin arm64 1.8.10 with official OCR 1.10.0 commit `a66240084`.
- Installed size `54644290` and SHA-256
- `c8f51b17c2be193ca178ecce6b5bcc1e38a5614629fbe81c6e1c95af5ede12e4`
- match GitHub Release metadata and the compatibility manifest. Version/help
- confirms root effort with default `medium` and upstream output-file support;
- the installed-binary isolated no-LLM gateway contract passes. User
- `.opencodereview` directory metadata is byte-for-byte unchanged, rollback and
- probe artifacts were removed, and no config, credential, or HOME was edited.
-- `2026-08-25`: required inputs in the public configuration tables are now
- bold only where the row's scoped `Required` contract applies; optional and
- conditionally alternative inputs remain distinguishable. The exact display
- set is protected by the environment-contract test rather than presentation-
- blind string checks.
-- `2026-08-25`: holistic review rechecked the upstream-artifact-to-gateway-to-
- private-result-to-DLP-to-receipt/approval flow, provider-neutral ownership,
- compatibility failure projection, workflow permissions, documentation, and
- release notes. It found and closed one impossible qualification-status gap by
- binding each failed phase to its exact closed reason set; no further product,
- privacy, approval, or telemetry defect remains.
-- `2026-08-25`: the single final local gate passes 1,256 tests plus 310
- subtests at 86.14% combined branch coverage. Risk groups pass at 84%, 82%,
- 85%, and 87%; Ruff format/lint, strict MyPy, Bandit, checksum-pinned Gitleaks
- 8.24.3, lock resolution, OCR manifest/evidence validation, the rendered 0.8.2
- Towncrier section, `git diff --check`, and plan lifecycle validation pass.
- The temporary scanner archive matched SHA-256
- `b90f13bb8c90ab72083d9b0c842e39dafb82c0e5c3f872f407366b7a58909013`
- and was removed without changing the global 8.30.1 installation. Clean
- package rebuild/install matrices are deliberately left to the single hosted
- Build artifacts owner and stable release gates under the #132 validation split.
-- `2026-08-25`: exact pushed head
- `c9df0cb087a84efd978a88477d49930799f1af04` and tree
- `6c4fb8c2acd4ecbe72aee0682fb25a31956350f2` pass all 13 hosted PR checks,
- including Linux/macOS Python 3.12-3.14, the single package owner, CodeQL,
- dependency review/audit, Bandit, secrets, and coverage quality. The task and
- macOS launch environments expose no OCR/OpenAI/Anthropic provider variables
- and the owner OCR home contains no config file. The user therefore explicitly
- waived local LLM execution; no production-model behavior is claimed.
-
-#### Risks And Recovery
-
-- Risk: the gateway fixture accidentally models OCR internals instead of the
- consumed public wire contract. Recovery: keep stage detection structural,
- assert real binary output/counters, and separately source-audit upstream logic.
-- Risk: failure handling masks the qualification exit. Recovery: preserve the
- failed step outcome, run only issue/artifact cleanup afterward, then use an
- explicit terminal step to fail the job; aggregate continues to require success.
-- Risk: medium effort silently changes cost or turns budgeted runs partial.
- Recovery: document exact default/round count, retain explicit low override,
- count grouping/round usage, and keep partial outcomes approval-ineligible.
-- Risk: group labels/paths leak through additive fields, private diagnostics, or
- upstream telemetry. Recovery: exclude them from the canonical projection,
- re-sanitize private readback, test every sink, default OCR telemetry off, and
- document upstream path/cardinality exposure when operators enable it.
-- Risk: OCR `--output` bypasses safe file ownership. Recovery: reject every long,
- equals, short, and attached form before preview or model execution.
-- Risk: local replacement fails or changes config. Recovery: verify the new file
- before rename, retain the old executable inside the atomic transaction, restore
- it on any failed check, use isolated HOME for probes, and compare user config
- metadata before/after without reading or rewriting credential values.
-- Risk: the waived live-provider run leaves a model-behavior evidence gap.
- Recovery: retain the explicit non-claim in plan/PR/release notes and rely only
- on deterministic real-OCR wire checks plus protected hosted/release gates;
- never describe these as a production provider review.
-- Risk: validation duplication returns. Recovery: follow #132 ownership, use
- focused local checks per slice and one final full gate, and retain repetition
- only where PR, platform, artifact, release, or registry boundaries differ.
-
-#### Resume Point
-
-Continue `WQ-12`: commit and push the owner-waiver reconciliation, wait for the
-new exact plan-only head checks, ready and merge protected feature PR #134,
-verify its TestPyPI development publication, and prepare the protected
-`release/v0.8.2` PR according to `docs/release.md`.
-
-#### Plan Fidelity Check
-
-- [x] Every user-requested outcome and the later `medium` decision has a stable
- requirement and queue owner.
-- [x] Product, workflow, local-install, external-issue, qualification, release,
- and post-release outcomes are distinguished.
-- [x] Inputs, authoritative documents, upstream evidence, current baseline, and
- rejected alternatives are recorded.
-- [x] Data flow, trust boundaries, DLP/approval independence, telemetry privacy,
- result-file ownership, and provider-neutral reuse are explicit.
-- [x] Focused, final local, hosted, waived-model non-claim, artifact, and release
- validation responsibilities are mapped without undoing #132.
-- [x] Risks have bounded recovery paths and the first safe unfinished action is
- exact.
-
-#### Reconciliation Check
-
-- [x] `PLANS.md` was empty before this activation; no prior active work was
- overwritten.
-- [x] Stable v0.8.1 baseline, closed #129/#130/#132, next version 0.8.2, current
- OCR 1.9.10 support, failed v1.10.0 workflow, and local OCR 1.8.10 agree.
-- [x] BL-017 is ready and its trigger is met; BL-016/018/019/020 remain outside
- implementation scope unless later evidence and user approval change them.
-- [x] Documentation indexes are complete; no unrelated instruction migration or
- test reorganization is pending.
-
-#### Closure Gate
-
-- [ ] All requirements and queue items are `done` or explicitly `out_of_scope`.
-- [ ] Final exact-head validation, self-review, hosted checks, waived-model
- non-claim, stable publication, external reconciliation, issue/milestone closure,
- and local OCR verification are recorded.
-- [ ] Backlog, roadmap, strategy, public docs, changelog, manifest/evidence, and
- execution history describe the same delivered state.
-- [ ] `scripts/plan_lifecycle.py check` passes before the checked close/archive
- transition; `PLANS.md` is not manually marked done.
-
-#### Post-Close Delivery
-
-- Protected feature PR merge, TestPyPI development verification, stable release
- PR, PyPI/TestPyPI publication, provenance/attestation, annotated tag, immutable
- GitHub Release and release receipt, supported-Python registry installs, issue
- receipts, milestone closure, and clean synchronized `main` are in scope for the
- complete requested release and remain pending until independently verified.
-
-#### Handoff Notes
-
-- Resume from the first non-terminal WQ item and update this plan before every
- signed commit, push, external qualification, release transition, or handoff.
-- Do not infer success from repository prose, a green aggregate summary, or an
- installed version string alone; retain exact commit/tree, asset hashes, job
- conclusions, artifacts, and registry/GitHub readback for each boundary.
+No active or blocked repository work.
diff --git a/changelog.d/135.bugfix.md b/changelog.d/135.bugfix.md
deleted file mode 100644
index 2e12472..0000000
--- a/changelog.d/135.bugfix.md
+++ /dev/null
@@ -1 +0,0 @@
-**Fixed:** Reject caller-owned OCR `--output`, `--output=...`, `-o`, and attached short forms before preview so the new upstream output flag cannot bypass the toolkit-owned result descriptor, atomic validation, DLP, cleanup, or posting handoff. Also make successful compatibility promotion report a caller-supplied relative manifest path without crashing after the update was written.
diff --git a/changelog.d/135.feature.md b/changelog.d/135.feature.md
deleted file mode 100644
index 4199d4b..0000000
--- a/changelog.d/135.feature.md
+++ /dev/null
@@ -1,4 +0,0 @@
-Expose OCR 1.10.0 review depth and grouping with explicit operator ownership.
-
-- **Added:** `OCR_REVIEW_EFFORT` is a closed `low|medium|high` setting written to OCR's root `effort` key. Its exact default is `medium`, selecting up to two review rounds; `low` selects one and `high` selects three. A caller-supplied OCR `--effort` remains the per-run override, and merge-request text cannot select it.
-- **Changed:** OCR may semantically group related changed files and filter findings per group before additional rounds. Group labels, path-derived keys, membership, and round diagnostics remain untrusted private result data and cannot change findings, severity, fingerprints, lifecycle commands, receipt v5, toolkit telemetry, posting, or automatic approval.
diff --git a/changelog.d/135.maintenance.md b/changelog.d/135.maintenance.md
deleted file mode 100644
index a76ebf8..0000000
--- a/changelog.d/135.maintenance.md
+++ /dev/null
@@ -1,6 +0,0 @@
-Qualify and promote the next OCR runtime without losing predecessor or deployment context.
-
-- **OCR 1.9.10 — inherited predecessor:** Toolkit 0.8.0 and 0.8.1 used exact OCR 1.9.10, whose unset OpenAI completion cap was observed as `max_completion_tokens=58888`. Its checksum-pinned evidence remains unchanged; toolkit 0.8.2 does not require installing or requalifying it.
-- **OCR 1.10.0 — changed target:** Toolkit 0.8.2 preflight and the GitLab example now require checksum-verified OCR 1.10.0. Qualification covers semantic file grouping, path-aware comments, group filtering, one/two/three review rounds, partial-budget reporting, tool/token accounting, the new `--output` flag, private git diagnostics, and the new inherited OpenAI completion cap `max_completion_tokens=16384`. Linux amd64 SHA-256 is `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b`.
-- **Telemetry:** OCR remains authoritative for provider, request, latency, cost, grouping, round, and tool telemetry. OCR 1.10.0 group spans can contain sorted changed paths and model-produced labels; the toolkit defaults OCR telemetry off, does not ingest those values, and adds no exporter or approval/routing signal.
-- **Deployment/Migration:** Deploy toolkit 0.8.2 directly with OCR 1.10.0; do not install OCR 1.9.10 as an intermediate step. Unset `OCR_LLM_MAX_COMPLETION_TOKENS` inherits `16384`; set an explicit value such as `4096` when a gateway-specific invariant is required. Caller `--output`/`-o` remains unsupported because `ocr-ci review --result` owns the private result lifecycle.
diff --git a/changelog.d/136.bugfix.md b/changelog.d/136.bugfix.md
deleted file mode 100644
index 3b3e67b..0000000
--- a/changelog.d/136.bugfix.md
+++ /dev/null
@@ -1 +0,0 @@
-**Fixed:** A failed OCR compatibility qualification now still updates the canonical version issue and uploads a bounded `ocr-toolkit.compatibility-status/v1` artifact before the job returns red. Public coordination receives only closed phase, reason, version, and run identity; raw exceptions remain in the private job log, and aggregate promotion stays blocked.
diff --git a/changelog.d/137.maintenance.md b/changelog.d/137.maintenance.md
deleted file mode 100644
index aef2c69..0000000
--- a/changelog.d/137.maintenance.md
+++ /dev/null
@@ -1 +0,0 @@
-**Changed:** Complete the BL-017 review-signal ownership audit with a `no-new-layer` result. OCR retains provider/review telemetry ownership; toolkit receipt, context, DLP, posting, and approval projections retain deterministic lifecycle ownership. No exporter, automatic routing, developer scoring, or duplicate group/round metric schema is added.
diff --git a/docs/configuration.md b/docs/configuration.md
index 646e628..2765b42 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -94,7 +94,7 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell
| --- | --- | --- | --- | --- |
| **`OCR_VERSION`** | Example pipeline | Yes | `v1.10.0` | Checksum-pinned recommended OCR binary release for toolkit 0.8.2. |
| **`OCR_SHA256`** | Example pipeline | Yes | `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b` | Expected Linux AMD64 OCR binary digest. |
-| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.1` | Exact toolkit wheel release installed by the current published example. |
+| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.2` | Exact toolkit wheel release installed by the current published example. |
| **`OCR_TOOLKIT_CHECKSUMS_URL`** | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. |
| `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. |
| `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. |
diff --git a/docs/engineering/execution_history/README.md b/docs/engineering/execution_history/README.md
index 5a44468..b4ee2c7 100644
--- a/docs/engineering/execution_history/README.md
+++ b/docs/engineering/execution_history/README.md
@@ -6,6 +6,7 @@
| Stable tag | Primary archived plan | Related context in the same archive |
| --- | --- | --- |
+| `v0.8.2` | [OCR 1.10.0, review effort, and compatibility failure recovery](releases.md#plan-toolkit-0-8-2) | Exact OCR 1.10.0 promotion, medium review effort, private grouping/round data, toolkit-owned output/DLP/approval boundaries, failed-qualification retention, BL-017 ownership audit, feature merge, development artifact verification, explicit local-LLM non-claim, and stable-delivery handoff. |
| `v0.8.1` | [Completion cap, safe provider failures, and validation ownership](releases.md#plan-toolkit-0-8-1) | Protocol-aware completion cap, canonical provider configuration, bounded provider-failure projection, privacy and approval invariants, protected validation deduplication, feature merge, development artifact verification, and stable-delivery handoff. |
| `v0.8.0` | [Remediation threads, GitLab commands, and documentation](releases.md#plan-toolkit-0-8-0) | Policy-v2 verified remediation history, context-store v2, provider-neutral forge views, exact live-username commands, environment cleanup, mode-oriented examples, OCR 1.9.10, 85% coverage and risk-group gates, protected feature merge, explicit enriched-qualification waiver, and stable-delivery handoff. |
| `v0.7.1` | [Bounded result semantics and OCR 1.9.9](releases.md#plan-toolkit-0-7-1) | Receipt v5, canonical publication/approval projection, reconciled count-only evidence use, privacy-safe token buckets, deterministic Recommended focus ranking, OCR 1.9.9 qualification, concurrency and hostile-read remediation, protected feature merge, and stable-delivery handoff. |
diff --git a/docs/engineering/execution_history/releases.md b/docs/engineering/execution_history/releases.md
index 84615b2..14962cf 100644
--- a/docs/engineering/execution_history/releases.md
+++ b/docs/engineering/execution_history/releases.md
@@ -2,6 +2,50 @@
This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active or blocked repository work; historical receipts here remain part of the audit trail.
+
+
+## Repository-Complete Plan: v0.8.2 OCR 1.10.0 and review effort
+
+Status: repository work complete; protected stable release and external reconciliation pending
+Owner: Codex
+Release classification: `release-required`
+Target stable version: `0.8.2`
+Last Updated: 2026-08-25
+
+### Goal
+
+Qualify and promote checksum-pinned OCR 1.10.0; expose explicit bounded review effort with toolkit default `medium`; retain toolkit ownership of result files, DLP, receipt v5, and approval; recover bounded compatibility evidence after a failed qualification; and complete the BL-017 review-signal ownership audit without creating a duplicate telemetry layer.
+
+### Delivered contract
+
+- Toolkit 0.8.2 preflight and the GitLab example require exact OCR 1.10.0. OCR 1.9.10 remains the tested 0.8.0/0.8.1 predecessor and is not an intermediate deployment step. Linux amd64 SHA-256 is `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b`; Darwin arm64 SHA-256 is `c8f51b17c2be193ca178ecce6b5bcc1e38a5614629fbe81c6e1c95af5ede12e4`.
+- `OCR_REVIEW_EFFORT` is the closed operator-owned `low|medium|high` control and defaults to `medium`, selecting up to two rounds. A caller `--effort` remains a per-run override; merge-request content never selects review depth.
+- OCR semantic group labels, path-derived keys, file membership, and round diagnostics remain untrusted private result data. Safe values do not block approval; DLP-sanitized private-only values do not become publication failures; none enters findings, severity, fingerprints, lifecycle commands, GitLab text, receipt v5, toolkit telemetry, posting, or automatic approval.
+- Caller-owned OCR `--output`, `--output=...`, `-o`, and attached short forms fail before preview. `ocr-ci review --result` remains the sole owner of the private descriptor, atomic validation, DLP, cleanup, receipt, and posting handoff.
+- Failed OCR compatibility qualification emits only closed `ocr-toolkit.compatibility-status/v1` phase/reason/version/run identity for issue/artifact handling, then restores the red job outcome so aggregate promotion remains blocked. Impossible phase/reason pairs fail closed; raw exceptions remain in the private job log.
+- BL-017 completed with `no-new-layer`: OCR owns provider/request/latency/cost/token/group/round/tool telemetry; toolkit owns deterministic context, DLP, receipt, posting, approval, and compatibility lifecycle signals. Explicitly enabled OCR grouping spans may contain repository-derived high-cardinality paths or model-produced labels.
+- Required configuration-table inputs are bold only according to their scoped `Required` cells. Optional, computed, conditional-alternative, and dynamic owner inputs remain distinguishable and contract-tested.
+
+### Validation and delivery evidence
+
+- Feature PR [#134](https://github.com/xeonvs/open-code-review-toolkit/pull/134) passed all 13 hosted checks at reviewed head `11b58547d9cba9523cc646c51f934c0b904dfe23` and tree `56b9286585862a071f90c5df889c0240dbb91a46`, then squash-merged as `cdc46735ba4338906d2049ff29789c1c92295d7c` with the same tree.
+- The single final local gate passed 1,256 tests plus 310 subtests at 86.14% combined branch coverage and risk groups 84/82/85/87, with Ruff, strict MyPy, Bandit, lock, OCR manifest/evidence, rendered Towncrier, pinned Gitleaks 8.24.3, diff, and plan lifecycle checks green.
+- Hosted OCR compatibility run [32825123658](https://github.com/xeonvs/open-code-review-toolkit/actions/runs/32825123658) qualified the exact Linux artifact. The PATH-effective local Darwin arm64 OCR was atomically updated to exact 1.10.0 and passed isolated no-LLM gateway/version/help checks without modifying user config, credentials, or HOME.
+- The owner explicitly waived local LLM execution because this environment has no configured provider access. No production model/provider result, finding quality, or live gateway behavior is claimed; deterministic real-OCR wire and result-consumer qualification remains the exact evidence boundary.
+- TestPyPI development run [32829250700](https://github.com/xeonvs/open-code-review-toolkit/actions/runs/32829250700) published and read back `0.8.2.dev70` with Trusted Publishing provenance and exact wheel/sdist installs. Wheel SHA-256 is `8ac4fe8a1b04e2472e1f31b818b97d06f35425597a6d59f51e9f0c1d6e06a9d6`; sdist SHA-256 is `fe04831bc1bb6db566ebb1131f787562150be0e7cdb5b96932fcb519aaf2e3a7`.
+- Release authorization tracks exactly open milestone issues #135, #136, and #137. The release candidate sets `.release-version=0.8.2`, `.next-version=0.8.3`, and deterministic epoch `1787648187`, one second after the feature squash merge.
+
+### Trust boundaries and non-claims
+
+- GitLab acquisition and mutation remain provider-specific. Policy, normalized context, DLP, stores, result contracts, receipts, approval, and compatibility classification remain provider-neutral and can admit a future code-host adapter without importing GitLab upward.
+- OCR 1.10.0's inherited OpenAI completion cap is observed as `16384`; OCR 1.9.10's predecessor value remains `58888`. The toolkit default stays unset, explicit `4096` remains an operator workaround, and neither `/models` nor an MR-controlled value selects a cap.
+- Receipt schema remains v5. Private group/round sanitization cannot enable approval, while partial, required-degraded, mutated, rejected, impossible, or publication-filtered state remains approval-ineligible.
+- Stable TestPyPI/PyPI bytes, GitHub attestations, registry provenance, annotated `v0.8.2` tag, immutable GitHub Release and assets, `release-receipt.json`, supported-Python registry installs, Actions-owned issue receipts, issue/milestone closure, and final clean-main synchronization are not claimed by this repository checkpoint and remain post-merge external gates.
+
+### Resume point
+
+Open the exact `Release v0.8.2` PR from `release/v0.8.2`, require its unchanged exact-head hosted checks and resolved review threads, then use the protected squash merge to start stable publication. Independently verify registry/workflow/Release bytes, provenance, attestations, installs, annotated tag, immutable receipt, issue receipts, issue and milestone closure, synchronized `main`, and final scratch cleanup. Preserve the explicit local-LLM non-claim during reconciliation.
+
## Repository-Complete Plan: v0.8.1 completion cap and safe provider failures
diff --git a/examples/gitlab/ocr-review.gitlab-ci.yml b/examples/gitlab/ocr-review.gitlab-ci.yml
index 0b437e2..e5a8bc6 100644
--- a/examples/gitlab/ocr-review.gitlab-ci.yml
+++ b/examples/gitlab/ocr-review.gitlab-ci.yml
@@ -7,7 +7,7 @@ default:
variables:
OCR_VERSION: "v1.10.0"
- OCR_TOOLKIT_VERSION: "0.8.1"
+ OCR_TOOLKIT_VERSION: "0.8.2"
OCR_TOOLKIT_CHECKSUMS_URL: "https://github.com/xeonvs/open-code-review-toolkit/releases/download/v${OCR_TOOLKIT_VERSION}/SHA256SUMS"
OCR_SHA256: "f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b"
OCR_POST_MODE: "draft"
diff --git a/tests/test_release_notes.py b/tests/test_release_notes.py
index bd117f0..92e9b71 100644
--- a/tests/test_release_notes.py
+++ b/tests/test_release_notes.py
@@ -140,19 +140,11 @@ def test_081_release_notes_separate_added_fixed_removed_and_unchanged_contracts(
assert contract in notes
-def test_082_fragments_are_actionable_for_people_and_deployment_agents() -> None:
+def test_082_release_notes_are_actionable_for_people_and_deployment_agents() -> None:
"""Keep added, changed, inherited, fixed, and migration outcomes distinct."""
- fragments = "\n".join(
- (ROOT / "changelog.d" / name).read_text(encoding="utf-8")
- for name in (
- "135.maintenance.md",
- "135.feature.md",
- "135.bugfix.md",
- "136.bugfix.md",
- "137.maintenance.md",
- )
- )
+ changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+ notes = release.release_notes(changelog, "0.8.2")
for phrase in (
"OCR 1.9.10 — inherited predecessor",
@@ -169,7 +161,7 @@ def test_082_fragments_are_actionable_for_people_and_deployment_agents() -> None
"no-new-layer",
"No exporter",
):
- assert phrase in fragments
+ assert phrase in notes
def test_extracts_only_the_exact_release_section() -> None: