xeonvs · xeonvs · Aug 26, 2026 · Aug 26, 2026
@@ -1 +1 @@
-0.8.4
+0.8.5
@@ -1,10 +1,8 @@
 {
   "issues": [
-    139,
-    140,
-    142,
-    143
+    145,
+    146
   ],
   "schema_version": "ocr-toolkit.release-authorization/v1",
-  "version": "0.8.3"
+  "version": "0.8.4"
 }
@@ -1 +1 @@
-1787732180
+1787744412
@@ -1 +1 @@
-0.8.3
+0.8.4
@@ -1,3 +1,34 @@
+## 0.8.4 - 2026-08-26
+
+### 🐛 Bug Fixes
+
+- Correct GitLab review summaries by keeping OCR coverage, publication integrity, findings, and OCR core advisories as independent signals.
+
+  - **Added:** accepted OCR background recommendations are projected as a receipt-bound numeric `ocr.toolkit-advisory/v1` line under Technical details, including failed-result summaries; they no longer become OCR warnings or approval blockers.
+  - **Fixed:** complete OCR coverage followed by publication filtering now renders `Review complete with publication filtering`, preserves only exhaustively validated original outcome/count combinations, and does not invent partial-coverage or pathless failed-item diagnostics.
+  - **Changed:** horizontal tabs are retained only in `existing_code` and `suggestion_code` after the unchanged value passes all secret, PII, forbidden-value, laundering, and budget checks, and Recommended focus areas are shown only for two or more published findings.
+  - **Unchanged:** publication filtering remains warning-bearing and automatic-approval-ineligible; receipt v5, publication-DLP signal v2, manifest/result schemas, secret/PII/laundering/budget checks, ordinary OCR warnings, real partial/budget outcomes, and the existing non-zero tool-call/token summary format remain authoritative.
+
+  ([#145](https://github.com/xeonvs/open-code-review-toolkit/issues/145))
+
+### 🛠 Maintenance
+
+- Qualify and promote checksum-pinned Open Code Review 1.10.1 for toolkit 0.8.4.
+
+  - **Added:** canonical qualification evidence records the hosted OCR 1.10.1 result, completion-cap, medium-effort, and max-tools probes.
+  - **Changed:** preflight, the compatibility manifest, and the GitLab example now require OCR 1.10.1. SHA-256 pins are Linux AMD64 `8b806c221d409727a21611b4a7952d8e15edadbbc25f5affccaeb8f677e4055c`, Darwin ARM64 `8fc24bd825c9d918b894be05c0cf27fac8d30bc549257c812d87337167c7563c`, and upstream `sha256sum.txt` `ec72bda51f1227f412ee00602d952868efc57d847cce0ae1586fb97069d4139d`.
+  - **Consumed:** bounded private session-cache keys reduce upstream cache-key risk without adding a toolkit receipt or telemetry field.
+  - **Unchanged:** result and manifest schemas, inherited OpenAI completion cap `16384`, explicit `4096` override, default `medium` effort, and behaviorally qualified max-tools semantics remain unchanged.
+  - **Not consumed:** the upstream GitHub Action, delegate skill, npm launcher, provider preset, and repository-local `providers.go` rule do not alter the toolkit's native-binary, explicit-protocol integration.
+  - **Deployment:** update directly from OCR 1.10.0 to 1.10.1; no intermediate OCR version is required.
+
+  ([#146](https://github.com/xeonvs/open-code-review-toolkit/issues/146))
+
+### 🧩 Rules
+
+- OCR 1.10.1 adds `.m` files to its review allowlist and selects MATLAB or Objective-C built-in rules from file content. The upstream repository-local `providers.go` rule is not a toolkit-wide rule. ([#146](https://github.com/xeonvs/open-code-review-toolkit/issues/146))
+
+
 ## 0.8.3 - 2026-08-26
 
 ### 🚀 Features

@@ -94,7 +94,7 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell
 | --- | --- | --- | --- | --- |
 | **`OCR_VERSION`** | Example pipeline | Yes | `v1.10.1` | Checksum-pinned recommended OCR binary release for toolkit 0.8.4. |
 | **`OCR_SHA256`** | Example pipeline | Yes | `8b806c221d409727a21611b4a7952d8e15edadbbc25f5affccaeb8f677e4055c` | Expected Linux AMD64 OCR binary digest. |
-| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.3` | Exact toolkit wheel release installed by the current published example. |
+| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.4` | Exact toolkit wheel release installed by the current published example. |
 | **`OCR_TOOLKIT_CHECKSUMS_URL`** | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. |
 | `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. |
 | `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. |

@@ -6,6 +6,7 @@
 
 | Stable tag | Primary archived plan | Related context in the same archive |
 | --- | --- | --- |
+| `v0.8.4` | [GitLab summary correctness and OCR 1.10.1](releases.md#plan-toolkit-0-8-4) | Receipt-bound OCR core advisory, publication-filtered coverage, field-bounded HTAB with unchanged-value DLP checks, non-duplicating one-finding guide, OCR 1.10.1 qualification, final local OCR remediation, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.3` | [OCR boundaries and review tool-usage visibility](releases.md#plan-toolkit-0-8-3) | Authoritative compatibility failure publication, installed-OCR numeric boundary ownership, complete bounded review tool-activity counters, advisory macOS endpoint checks, feature merge, development artifact verification, explicit local-LLM non-claim, and stable-delivery handoff. |
 | `v0.8.2` | [OCR 1.10.0, review effort, and compatibility failure recovery](releases.md#plan-toolkit-0-8-2) | Exact OCR 1.10.0 promotion, medium review effort, private grouping/round data, toolkit-owned output/DLP/approval boundaries, failed-qualification retention, BL-017 ownership audit, feature merge, development artifact verification, explicit local-LLM non-claim, and stable-delivery handoff. |
 | `v0.8.1` | [Completion cap, safe provider failures, and validation ownership](releases.md#plan-toolkit-0-8-1) | Protocol-aware completion cap, canonical provider configuration, bounded provider-failure projection, privacy and approval invariants, protected validation deduplication, feature merge, development artifact verification, and stable-delivery handoff. |

@@ -2,6 +2,94 @@
 
 This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active or blocked repository work; historical receipts here remain part of the audit trail.
 
+<a id="plan-toolkit-0-8-4"></a>
+
+## Toolkit 0.8.4 — GitLab summary correctness and OCR 1.10.1
+
+Status: repository complete; external stable delivery pending
+Release classification: `release-required`
+Target stable version: `0.8.4`
+Repository completion date: 2026-08-26
+
+### Goal and delivered scope
+
+Separate OCR coverage, publication integrity, ordinary findings or warnings,
+and the low-level OCR core background recommendation in GitLab summaries. A
+strict receipt-bound `ocr.toolkit-advisory/v1` projection now renders only in
+Technical details and does not become an OCR warning, DLP input, coverage
+signal, receipt field, telemetry field, or approval signal. Complete OCR
+coverage followed by publication filtering retains its validated original
+counts and renders the publication-filtered state; real partial, budget, and
+failed outcomes remain authoritative.
+
+Publication DLP admits HTAB only in `existing_code` and `suggestion_code` while
+checking the unchanged value for secrets, PII, forbidden values, laundering,
+and budget. A single published finding no longer repeats itself in Recommended
+focus areas; deterministic ranking remains for two or more findings. Toolkit
+0.8.4 promotes checksum-pinned OCR 1.10.1, including its `.m` MATLAB versus
+Objective-C rule selection, while preserving receipt v5, publication-DLP signal
+v2, result and manifest schemas, ordinary OCR warnings, and the existing
+non-zero tool-call and token summary format.
+
+### Decisions and non-claims
+
+- Issues #145 and #146 are the complete tracked release set.
+- The OCR core advisory is accepted only from the exact preview diagnostic,
+  projected to bounded positive character counts, bound to a valid receipt,
+  and rendered under Technical details. Raw or malformed advisory input fails
+  closed and cannot affect approval.
+- HTAB admission is field-specific rather than a whitespace-normalized checking
+  copy: every private and public DLP check sees the original code value.
+- OCR 1.10.1 compatibility is Maintenance; its effective `.m` review behavior
+  is a separate Rules entry. Historical OCR 1.10.0 evidence is unchanged.
+- The final OCR run used context mode `off`; no enriched-context qualification
+  is claimed and no second local OCR run is part of release preparation.
+- B2B, `core/common`, shared templates, and other consumer repositories remain
+  outside this release.
+
+### Repository, OCR, and hosted evidence
+
+- Final local OCR 1.10.1 reviewed exact range
+  `origin/main..02c2f9d8f76d736ba83deed7700bed9374c4e38d` with concurrency
+  `2`, context mode `off`, and no explicit completion cap. It completed all
+  10 selected items with failed/reused/waived `0/0/0`, 102 tool calls, and
+  empty stderr.
+- Three confirmed OCR findings were corrected: exhaustive receipt-v5 original
+  outcome/count validation; unchanged HTAB-bearing values across all remaining
+  DLP checks; and valid advisory rendering for failed-result Technical details.
+- The final local gate passed 1,290 tests plus 337 subtests at 86.46% combined
+  branch coverage against the 85% floor. Risk groups passed at 85%, 82%, 86%,
+  and 87%; Ruff, strict MyPy, Bandit, Gitleaks 8.24.3, lock and OCR manifest
+  validation, Towncrier draft, deterministic builds, Twine, archive privacy,
+  and clean Python 3.12-3.14 wheel and sdist installs passed.
+- Feature PR #147 passed all 13 hosted checks at reviewed head
+  `54521ceb370a91cd5b5d5cf95eb7565cd8da78b0` and tree
+  `619869ca79d687fab3feb5c374096b5b35d39230`, with zero unresolved review
+  threads. It was squash-merged as verified commit
+  `5393e7526c9358873ad668fdd1d8f35443d14940` with the same tree.
+- Development workflow run 32964488326 published and independently verified
+  `0.8.4.dev74`. TestPyPI wheel SHA-256 is
+  `dbb97bee0fe74d75721ab978d6db49c7e6c265f6d059186276a60430fb32e095`;
+  sdist SHA-256 is
+  `904b829ffde000e2825bf979147fed9e1191317aca7957d8570eedff360d26f0`.
+  Trusted Publishing provenance, exact readback, and clean installs passed.
+
+### Stable delivery handoff
+
+The release PR is the final repository mutation. It sets
+`.release-version=0.8.4`, `.next-version=0.8.5`, deterministic source epoch
+`1787744412` one second after the feature squash merge, exact sorted issues
+`[145, 146]`, generated Towncrier notes, stable example pins, and this archived
+plan while returning `PLANS.md` to its inactive template.
+
+External closure remains pending until the exact reviewed release head is
+squash-merged and stable workflow output is independently reconciled across
+TestPyPI, PyPI, workflow artifacts, and the immutable GitHub Release. Closure
+requires byte equality, PEP 740 provenance and GitHub attestations, annotated
+`v0.8.4` tag and peeled target, immutable `release-receipt.json`, clean PyPI
+wheel and sdist installs on Python 3.12-3.14, Actions-owned receipts, closed
+#145/#146 and milestone `v0.8.4`, synchronized clean `main`, and scratch cleanup.
+
 <a id="plan-toolkit-0-8-3"></a>
 
 ## Toolkit 0.8.3 — OCR boundaries and review tool-usage visibility

@@ -7,7 +7,7 @@ default:
 
 variables:
   OCR_VERSION: "v1.10.1"
-  OCR_TOOLKIT_VERSION: "0.8.3"
+  OCR_TOOLKIT_VERSION: "0.8.4"
   OCR_TOOLKIT_CHECKSUMS_URL: "https://github.com/xeonvs/open-code-review-toolkit/releases/download/v${OCR_TOOLKIT_VERSION}/SHA256SUMS"
   OCR_SHA256: "8b806c221d409727a21611b4a7952d8e15edadbbc25f5affccaeb8f677e4055c"
   OCR_POST_MODE: "draft"

@@ -182,6 +182,28 @@ def test_083_release_notes_cover_hotfix_activity_and_release_gates() -> None:
         assert phrase in notes
 
 
+def test_084_release_notes_separate_advisory_publication_and_dlp_contracts() -> None:
+    """Keep the summary hotfix and OCR deployment boundary explicit."""
+
+    changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+    notes = release.release_notes(changelog, "0.8.4")
+
+    for phrase in (
+        "ocr.toolkit-advisory/v1",
+        "Technical details",
+        "Review complete with publication filtering",
+        "original outcome/count combinations",
+        "horizontal tabs",
+        "unchanged value",
+        "secret, PII, forbidden-value, laundering, and budget checks",
+        "two or more published findings",
+        "Open Code Review 1.10.1",
+        "MATLAB or Objective-C",
+        "update directly from OCR 1.10.0 to 1.10.1",
+    ):
+        assert phrase in notes
+
+
 def test_extracts_only_the_exact_release_section() -> None:
     changelog = "# Changelog\n\n## 0.2.0 - later\n\nnew\n\n## 0.1.0 - now\n\nfirst\n"