[OCR compatibility] Qualify v1.8.10

[github-actions]

OCR v1.8.10 compatibility evidence

• machine result: compatible
• classification: human-review-required
• all upstream asset digests and sha256sum.txt: verified
• Linux amd64 version/help/preview/result-consumer probes: passed

Upstream release changes

• release: https://github.com/alibaba/open-code-review/releases/tag/v1.8.10
• compare: alibaba/open-code-review@v1.8.9...v1.8.10
• current tested baseline: v1.8.8
• published: 2026-08-07T03:10:32Z

## 🚀 Features

- feat(viewer): collapse secondary session sections (#738)

## 🐛 Bug Fixes

- fix: remove timeout fields and more (#756)
- fix(cli): reject unexpected positional arguments (#749)
- fix(viewer): restore session response formatting (#754)
- fix(agent): render tool parameters deterministically (#721)

## 📖 Documentation

- docs(readme): update OpenSSF badge from Silver to Gold (#748)

## Other Changes

- ci(pages): add smoke test step to verify build output is servable (#741)
- test: raise statement coverage to 90% and enforce it in CI (#747)
- chore(deps): bump preact (#743)

**Full Changelog**: https://github.com/alibaba/open-code-review/compare/v1.8.9...v1.8.10

Classification reasons

• release notes contain a material or ambiguous compatibility signal

Human checklist

• Review upstream release notes and relevant commits.
• Confirm compatible or incompatible.
• Confirm tested support and recommended-version promotion.
• Route any compatibility change through protected PR and stable release gates.

Workflow evidence

• run: https://github.com/xeonvs/open-code-review-toolkit/actions/runs/31243828961
• classification: human-review-required

[xeonvs]

Human review conclusion: OCR 1.8.10 is compatible with the toolkit. Rejection of unexpected positional arguments affects invalid invocations only; removed timeout fields are internal; deterministic tool-parameter rendering is additive and improves reproducibility without completing BL-016 profiles or BL-017 telemetry. Viewer, documentation, test, CI, and dependency changes are outside consumed toolkit contracts.

Release receipt:

• compatibility evidence: compatibility/evidence/ocr-1.8.10.json
• promotion feature PR: Qualify OCR 1.8.9 through 1.8.10 #67, verified merge 2b0f8393ba86a6150a694180b10bae7d0907db09
• combined release/closure PR: Release v0.4.6 #68, verified merge c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6
• stable release workflow: https://github.com/xeonvs/open-code-review-toolkit/actions/runs/31250755741
• stable release: https://github.com/xeonvs/open-code-review-toolkit/releases/tag/v0.4.6 (immutable)
• PyPI/TestPyPI 0.4.6 wheel SHA-256: 7a944f5f1332728d857574d81cb484507eb3c5a6f5105d71a35dfbec0329307d
• PyPI/TestPyPI 0.4.6 sdist SHA-256: dcde562699c759764eb3cba4654cce511871c2e3c26a1ab2c1d9726fe94c5cba

Both registry provenance records identify release.yml, the exact release merge and workflow run, and their expected trusted-publishing environments. The annotated v0.4.6 tag resolves to the release merge; GitHub attestations and Python 3.12-3.14 published-artifact smokes pass. Closing as completed.