xeonvs · xeonvs · Aug 25, 2026 · Aug 25, 2026
@@ -1 +1 @@
-0.8.2
+0.8.3
@@ -1,9 +1,9 @@
 {
   "issues": [
-    129,
-    130,
-    132
+    135,
+    136,
+    137
   ],
   "schema_version": "ocr-toolkit.release-authorization/v1",
-  "version": "0.8.1"
+  "version": "0.8.2"
 }
@@ -1 +1 @@
-1787598637
+1787648187
@@ -1 +1 @@
-0.8.1
+0.8.2
@@ -1,3 +1,32 @@
+## 0.8.2 - 2026-08-25
+
+### 🚀 Features
+
+- Expose OCR 1.10.0 review depth and grouping with explicit operator ownership.
+
+  - **Added:** `OCR_REVIEW_EFFORT` is a closed `low|medium|high` setting written to OCR's root `effort` key. Its exact default is `medium`, selecting up to two review rounds; `low` selects one and `high` selects three. A caller-supplied OCR `--effort` remains the per-run override, and merge-request text cannot select it.
+  - **Changed:** OCR may semantically group related changed files and filter findings per group before additional rounds. Group labels, path-derived keys, membership, and round diagnostics remain untrusted private result data and cannot change findings, severity, fingerprints, lifecycle commands, receipt v5, toolkit telemetry, posting, or automatic approval.
+
+  ([#135](https://github.com/xeonvs/open-code-review-toolkit/issues/135))
+
+### 🐛 Bug Fixes
+
+- **Fixed:** Reject caller-owned OCR `--output`, `--output=...`, `-o`, and attached short forms before preview so the new upstream output flag cannot bypass the toolkit-owned result descriptor, atomic validation, DLP, cleanup, or posting handoff. Also make successful compatibility promotion report a caller-supplied relative manifest path without crashing after the update was written. ([#135](https://github.com/xeonvs/open-code-review-toolkit/issues/135))
+- **Fixed:** A failed OCR compatibility qualification now still updates the canonical version issue and uploads a bounded `ocr-toolkit.compatibility-status/v1` artifact before the job returns red. Public coordination receives only closed phase, reason, version, and run identity; raw exceptions remain in the private job log, and aggregate promotion stays blocked. ([#136](https://github.com/xeonvs/open-code-review-toolkit/issues/136))
+
+### 🛠 Maintenance
+
+- Qualify and promote the next OCR runtime without losing predecessor or deployment context.
+
+  - **OCR 1.9.10 — inherited predecessor:** Toolkit 0.8.0 and 0.8.1 used exact OCR 1.9.10, whose unset OpenAI completion cap was observed as `max_completion_tokens=58888`. Its checksum-pinned evidence remains unchanged; toolkit 0.8.2 does not require installing or requalifying it.
+  - **OCR 1.10.0 — changed target:** Toolkit 0.8.2 preflight and the GitLab example now require checksum-verified OCR 1.10.0. Qualification covers semantic file grouping, path-aware comments, group filtering, one/two/three review rounds, partial-budget reporting, tool/token accounting, the new `--output` flag, private git diagnostics, and the new inherited OpenAI completion cap `max_completion_tokens=16384`. Linux amd64 SHA-256 is `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b`.
+  - **Telemetry:** OCR remains authoritative for provider, request, latency, cost, grouping, round, and tool telemetry. OCR 1.10.0 group spans can contain sorted changed paths and model-produced labels; the toolkit defaults OCR telemetry off, does not ingest those values, and adds no exporter or approval/routing signal.
+  - **Deployment/Migration:** Deploy toolkit 0.8.2 directly with OCR 1.10.0; do not install OCR 1.9.10 as an intermediate step. Unset `OCR_LLM_MAX_COMPLETION_TOKENS` inherits `16384`; set an explicit value such as `4096` when a gateway-specific invariant is required. Caller `--output`/`-o` remains unsupported because `ocr-ci review --result` owns the private result lifecycle.
+
+  ([#135](https://github.com/xeonvs/open-code-review-toolkit/issues/135))
+- **Changed:** Complete the BL-017 review-signal ownership audit with a `no-new-layer` result. OCR retains provider/review telemetry ownership; toolkit receipt, context, DLP, posting, and approval projections retain deterministic lifecycle ownership. No exporter, automatic routing, developer scoring, or duplicate group/round metric schema is added. ([#137](https://github.com/xeonvs/open-code-review-toolkit/issues/137))
+
+
 ## 0.8.1 - 2026-08-24
 
 ### 🚀 Features

@@ -94,7 +94,7 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell
 | --- | --- | --- | --- | --- |
 | **`OCR_VERSION`** | Example pipeline | Yes | `v1.10.0` | Checksum-pinned recommended OCR binary release for toolkit 0.8.2. |
 | **`OCR_SHA256`** | Example pipeline | Yes | `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b` | Expected Linux AMD64 OCR binary digest. |
-| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.1` | Exact toolkit wheel release installed by the current published example. |
+| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.2` | Exact toolkit wheel release installed by the current published example. |
 | **`OCR_TOOLKIT_CHECKSUMS_URL`** | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. |
 | `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. |
 | `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. |

@@ -6,6 +6,7 @@
 
 | Stable tag | Primary archived plan | Related context in the same archive |
 | --- | --- | --- |
+| `v0.8.2` | [OCR 1.10.0, review effort, and compatibility failure recovery](releases.md#plan-toolkit-0-8-2) | Exact OCR 1.10.0 promotion, medium review effort, private grouping/round data, toolkit-owned output/DLP/approval boundaries, failed-qualification retention, BL-017 ownership audit, feature merge, development artifact verification, explicit local-LLM non-claim, and stable-delivery handoff. |
 | `v0.8.1` | [Completion cap, safe provider failures, and validation ownership](releases.md#plan-toolkit-0-8-1) | Protocol-aware completion cap, canonical provider configuration, bounded provider-failure projection, privacy and approval invariants, protected validation deduplication, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.0` | [Remediation threads, GitLab commands, and documentation](releases.md#plan-toolkit-0-8-0) | Policy-v2 verified remediation history, context-store v2, provider-neutral forge views, exact live-username commands, environment cleanup, mode-oriented examples, OCR 1.9.10, 85% coverage and risk-group gates, protected feature merge, explicit enriched-qualification waiver, and stable-delivery handoff. |
 | `v0.7.1` | [Bounded result semantics and OCR 1.9.9](releases.md#plan-toolkit-0-7-1) | Receipt v5, canonical publication/approval projection, reconciled count-only evidence use, privacy-safe token buckets, deterministic Recommended focus ranking, OCR 1.9.9 qualification, concurrency and hostile-read remediation, protected feature merge, and stable-delivery handoff. |

@@ -2,6 +2,50 @@
 
 This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active or blocked repository work; historical receipts here remain part of the audit trail.
 
+<a id="plan-toolkit-0-8-2"></a>
+
+## Repository-Complete Plan: v0.8.2 OCR 1.10.0 and review effort
+
+Status: repository work complete; protected stable release and external reconciliation pending
+Owner: Codex
+Release classification: `release-required`
+Target stable version: `0.8.2`
+Last Updated: 2026-08-25
+
+### Goal
+
+Qualify and promote checksum-pinned OCR 1.10.0; expose explicit bounded review effort with toolkit default `medium`; retain toolkit ownership of result files, DLP, receipt v5, and approval; recover bounded compatibility evidence after a failed qualification; and complete the BL-017 review-signal ownership audit without creating a duplicate telemetry layer.
+
+### Delivered contract
+
+- Toolkit 0.8.2 preflight and the GitLab example require exact OCR 1.10.0. OCR 1.9.10 remains the tested 0.8.0/0.8.1 predecessor and is not an intermediate deployment step. Linux amd64 SHA-256 is `f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b`; Darwin arm64 SHA-256 is `c8f51b17c2be193ca178ecce6b5bcc1e38a5614629fbe81c6e1c95af5ede12e4`.
+- `OCR_REVIEW_EFFORT` is the closed operator-owned `low|medium|high` control and defaults to `medium`, selecting up to two rounds. A caller `--effort` remains a per-run override; merge-request content never selects review depth.
+- OCR semantic group labels, path-derived keys, file membership, and round diagnostics remain untrusted private result data. Safe values do not block approval; DLP-sanitized private-only values do not become publication failures; none enters findings, severity, fingerprints, lifecycle commands, GitLab text, receipt v5, toolkit telemetry, posting, or automatic approval.
+- Caller-owned OCR `--output`, `--output=...`, `-o`, and attached short forms fail before preview. `ocr-ci review --result` remains the sole owner of the private descriptor, atomic validation, DLP, cleanup, receipt, and posting handoff.
+- Failed OCR compatibility qualification emits only closed `ocr-toolkit.compatibility-status/v1` phase/reason/version/run identity for issue/artifact handling, then restores the red job outcome so aggregate promotion remains blocked. Impossible phase/reason pairs fail closed; raw exceptions remain in the private job log.
+- BL-017 completed with `no-new-layer`: OCR owns provider/request/latency/cost/token/group/round/tool telemetry; toolkit owns deterministic context, DLP, receipt, posting, approval, and compatibility lifecycle signals. Explicitly enabled OCR grouping spans may contain repository-derived high-cardinality paths or model-produced labels.
+- Required configuration-table inputs are bold only according to their scoped `Required` cells. Optional, computed, conditional-alternative, and dynamic owner inputs remain distinguishable and contract-tested.
+
+### Validation and delivery evidence
+
+- Feature PR [#134](https://github.com/xeonvs/open-code-review-toolkit/pull/134) passed all 13 hosted checks at reviewed head `11b58547d9cba9523cc646c51f934c0b904dfe23` and tree `56b9286585862a071f90c5df889c0240dbb91a46`, then squash-merged as `cdc46735ba4338906d2049ff29789c1c92295d7c` with the same tree.
+- The single final local gate passed 1,256 tests plus 310 subtests at 86.14% combined branch coverage and risk groups 84/82/85/87, with Ruff, strict MyPy, Bandit, lock, OCR manifest/evidence, rendered Towncrier, pinned Gitleaks 8.24.3, diff, and plan lifecycle checks green.
+- Hosted OCR compatibility run [32825123658](https://github.com/xeonvs/open-code-review-toolkit/actions/runs/32825123658) qualified the exact Linux artifact. The PATH-effective local Darwin arm64 OCR was atomically updated to exact 1.10.0 and passed isolated no-LLM gateway/version/help checks without modifying user config, credentials, or HOME.
+- The owner explicitly waived local LLM execution because this environment has no configured provider access. No production model/provider result, finding quality, or live gateway behavior is claimed; deterministic real-OCR wire and result-consumer qualification remains the exact evidence boundary.
+- TestPyPI development run [32829250700](https://github.com/xeonvs/open-code-review-toolkit/actions/runs/32829250700) published and read back `0.8.2.dev70` with Trusted Publishing provenance and exact wheel/sdist installs. Wheel SHA-256 is `8ac4fe8a1b04e2472e1f31b818b97d06f35425597a6d59f51e9f0c1d6e06a9d6`; sdist SHA-256 is `fe04831bc1bb6db566ebb1131f787562150be0e7cdb5b96932fcb519aaf2e3a7`.
+- Release authorization tracks exactly open milestone issues #135, #136, and #137. The release candidate sets `.release-version=0.8.2`, `.next-version=0.8.3`, and deterministic epoch `1787648187`, one second after the feature squash merge.
+
+### Trust boundaries and non-claims
+
+- GitLab acquisition and mutation remain provider-specific. Policy, normalized context, DLP, stores, result contracts, receipts, approval, and compatibility classification remain provider-neutral and can admit a future code-host adapter without importing GitLab upward.
+- OCR 1.10.0's inherited OpenAI completion cap is observed as `16384`; OCR 1.9.10's predecessor value remains `58888`. The toolkit default stays unset, explicit `4096` remains an operator workaround, and neither `/models` nor an MR-controlled value selects a cap.
+- Receipt schema remains v5. Private group/round sanitization cannot enable approval, while partial, required-degraded, mutated, rejected, impossible, or publication-filtered state remains approval-ineligible.
+- Stable TestPyPI/PyPI bytes, GitHub attestations, registry provenance, annotated `v0.8.2` tag, immutable GitHub Release and assets, `release-receipt.json`, supported-Python registry installs, Actions-owned issue receipts, issue/milestone closure, and final clean-main synchronization are not claimed by this repository checkpoint and remain post-merge external gates.
+
+### Resume point
+
+Open the exact `Release v0.8.2` PR from `release/v0.8.2`, require its unchanged exact-head hosted checks and resolved review threads, then use the protected squash merge to start stable publication. Independently verify registry/workflow/Release bytes, provenance, attestations, installs, annotated tag, immutable receipt, issue receipts, issue and milestone closure, synchronized `main`, and final scratch cleanup. Preserve the explicit local-LLM non-claim during reconciliation.
+
 <a id="plan-toolkit-0-8-1"></a>
 
 ## Repository-Complete Plan: v0.8.1 completion cap and safe provider failures

@@ -7,7 +7,7 @@ default:
 
 variables:
   OCR_VERSION: "v1.10.0"
-  OCR_TOOLKIT_VERSION: "0.8.1"
+  OCR_TOOLKIT_VERSION: "0.8.2"
   OCR_TOOLKIT_CHECKSUMS_URL: "https://github.com/xeonvs/open-code-review-toolkit/releases/download/v${OCR_TOOLKIT_VERSION}/SHA256SUMS"
   OCR_SHA256: "f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b"
   OCR_POST_MODE: "draft"

@@ -140,19 +140,11 @@ def test_081_release_notes_separate_added_fixed_removed_and_unchanged_contracts(
         assert contract in notes
 
 
-def test_082_fragments_are_actionable_for_people_and_deployment_agents() -> None:
+def test_082_release_notes_are_actionable_for_people_and_deployment_agents() -> None:
     """Keep added, changed, inherited, fixed, and migration outcomes distinct."""
 
-    fragments = "\n".join(
-        (ROOT / "changelog.d" / name).read_text(encoding="utf-8")
-        for name in (
-            "135.maintenance.md",
-            "135.feature.md",
-            "135.bugfix.md",
-            "136.bugfix.md",
-            "137.maintenance.md",
-        )
-    )
+    changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+    notes = release.release_notes(changelog, "0.8.2")
 
     for phrase in (
         "OCR 1.9.10 — inherited predecessor",
@@ -169,7 +161,7 @@ def test_082_fragments_are_actionable_for_people_and_deployment_agents() -> None
         "no-new-layer",
         "No exporter",
     ):
-        assert phrase in fragments
+        assert phrase in notes
 
 
 def test_extracts_only_the_exact_release_section() -> None: