From a72ac3f075a61b847eeb40eb953c62dbb61fe45d Mon Sep 17 00:00:00 2001 From: xeonvs <11463419+xeonvs@users.noreply.github.com> Date: Tue, 11 Aug 2026 11:46:47 +0200 Subject: [PATCH] Release v0.4.7 --- .next-version | 2 +- .release-metadata.json | 10 + .release-source-date-epoch | 2 +- .release-version | 2 +- CHANGELOG.md | 23 ++ PLANS.md | 227 +++++------------- changelog.d/69.doc.md | 2 - changelog.d/70.bugfix.md | 2 - changelog.d/71.feature.md | 2 - changelog.d/72.feature.md | 1 - changelog.d/73.rules.md | 1 - docs/engineering/execution_history/README.md | 2 +- .../engineering/execution_history/releases.md | 171 +++++++++++++ 13 files changed, 271 insertions(+), 176 deletions(-) create mode 100644 .release-metadata.json delete mode 100644 changelog.d/69.doc.md delete mode 100644 changelog.d/70.bugfix.md delete mode 100644 changelog.d/71.feature.md delete mode 100644 changelog.d/72.feature.md delete mode 100644 changelog.d/73.rules.md diff --git a/.next-version b/.next-version index f905682..cb498ab 100644 --- a/.next-version +++ b/.next-version @@ -1 +1 @@ -0.4.7 +0.4.8 diff --git a/.release-metadata.json b/.release-metadata.json new file mode 100644 index 0000000..8c67dad --- /dev/null +++ b/.release-metadata.json @@ -0,0 +1,10 @@ +{ + "issues": [ + 70, + 71, + 72, + 73 + ], + "schema_version": "ocr-toolkit.release-authorization/v1", + "version": "0.4.7" +} diff --git a/.release-source-date-epoch b/.release-source-date-epoch index ff3a79d..5582fbc 100644 --- a/.release-source-date-epoch +++ b/.release-source-date-epoch @@ -1 +1 @@ -1786181004 +1786440757 diff --git a/.release-version b/.release-version index ef52a64..f905682 100644 --- a/.release-version +++ b/.release-version @@ -1 +1 @@ -0.4.6 +0.4.7 diff --git a/CHANGELOG.md b/CHANGELOG.md index 2154472..5b002d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,26 @@ +## 0.4.7 - 2026-08-11 + +### 🚀 Features + +- Add default-on `OCR_AUTO_APPROVE` for conservative, exact-SHA GitLab approval after every current review note publishes, with an explicit fail-closed opt-out and bounded status readback. + Limit eligibility to complete manifest-backed reviews with at most three low-severity style, documentation, or maintainability findings, while preserving every existing approval when a later review is ineligible or disabled. ([#71](https://github.com/xeonvs/open-code-review-toolkit/issues/71)) +- Target checksum-verified Open Code Review 1.9.1 after qualifying 1.9.0 through 1.9.1. ([#72](https://github.com/xeonvs/open-code-review-toolkit/issues/72)) + +### 🐛 Bug Fixes + +- Publish an actionable GitLab suggestion only when `existing_code` proves that the replacement applies to one contiguous range in the immutable reviewed head. + Retain the explanatory finding, with a bounded non-sensitive omission reason, when a replacement is stale, malformed, multi-region, diff-prefixed, or otherwise unverifiable. ([#70](https://github.com/xeonvs/open-code-review-toolkit/issues/70)) + +### 📖 Documentation + +- Document the established evidence and MCP architecture, reconcile the completed 0.4.6 lifecycle and remaining backlog with current code, and index archived execution history by stable release tag. + Make the release pull request the final repository mutation while exact-tree authorization, registry and provenance verification, an immutable machine-readable receipt, and idempotent issue closure prove external delivery after merge. ([#69](https://github.com/xeonvs/open-code-review-toolkit/issues/69)) + +### 🧩 Rules + +- The recommended OCR built-in rules and reviewable-file allowlist now include Nim source, script, and package files. ([#73](https://github.com/xeonvs/open-code-review-toolkit/issues/73)) + + ## 0.4.6 - 2026-08-08 ### 🚀 Features diff --git a/PLANS.md b/PLANS.md index ea4c6ac..a85a9f6 100644 --- a/PLANS.md +++ b/PLANS.md @@ -4,7 +4,7 @@ Use this file for active, blocked, or recently completed execution work. Update ## Active Plan: Harden GitLab suggestions and add SHA-bound approval for 0.4.7 -Status: active; final OCR completed once, findings corrected, deterministic post-review validation complete; protected PR and release delivery pending +Status: active; final release inputs locally validated; release PR and stable delivery pending Owner: Codex Last Updated: 2026-08-11 Release Classification: release-required @@ -85,10 +85,10 @@ independently read back. with private result/stderr artifacts, no GitLab posting, and verified nonzero built-in MCP use. Correct its findings, complete deterministic validation and final self-review, and do not run a second OCR or Codex Security review. -7. [ ] Run deterministic post-review validation and pinned local Gitleaks over +7. [x] Run deterministic post-review validation and pinned local Gitleaks over the unpublished history, push the exact reviewed branch, open one feature PR, resolve every conversation, pass protected checks, and squash-merge. -8. [ ] Independently verify the exact TestPyPI development artifacts, hashes, +8. [x] Independently verify the exact TestPyPI development artifacts, hashes, provenance, and supported-Python installs before preparing `release/v0.4.7`. 9. [ ] Prepare and validate the final release PR, consuming fragments 69, 70, 71, 72, and 73 and reconciling repository-side planning truth without @@ -356,169 +356,68 @@ independently read back. all five fragments 69-73; every tracked issue remains open until stable 0.4.7 delivery is proven by the immutable receipt and independent readback. -## Completed Plan: Reconcile 0.4.6 lifecycle, architecture, and backlog truth - -Status: completed; validated documentation/process PR handoff -Owner: Codex -Last Updated: 2026-08-08 -Release Classification: no-release -Target Stable Version: not applicable - -### Goal - -Close the externally completed toolkit 0.4.6 lifecycle in repository truth, document the established M1 architecture, re-audit every remaining backlog item against current code and published behavior, correct planning and release-process drift, and archive older execution plans without changing runtime or initiating package publication. - -### Decisions - -- Inspect current implementation before retaining backlog scope or dependencies; distinguish implemented, partial, planned, conditional, obsolete, and historical work. -- Adopt the durable lifecycle `feature PR -> TestPyPI development verification -> release PR -> stable publication -> external reconciliation -> no-release closure PR` for future release-required work. -- Keep `.release-version`, `.next-version`, `.release-source-date-epoch`, the recommended OCR baseline, dependencies, runtime behavior, and public contracts unchanged. -- Open one documentation/process pull request and leave it unmerged in this task because a merge to `main` would initiate the automatic TestPyPI development publication that this no-release task explicitly excludes. -- Preserve the complete audit trail by moving older completed plan detail to `docs/engineering/execution_history/releases.md`; keep the 0.4.6 cycle and this reconciliation in the compact active registry. - -### Work Queue - -1. [x] Read the canonical instructions, all current plans and durable documentation, the M1 implementation and tests, v0.4.0-v0.4.6 history, and live 0.4.6 release and issue receipts. -2. [x] Run bounded OCR discovery and confirm that no unseen stable upstream release exists. -3. [x] Reconcile the 0.4.6 plan and future release-lifecycle instructions from independently verified external evidence. -4. [x] Archive older completed plans without losing decisions, validation, links, hashes, or receipts. -5. [x] Rewrite durable strategy and README current-state prose and classify historical migration material explicitly. -6. [x] Audit every backlog item, narrow BL-008 and BL-013 to remaining work, park BL-012 conditionally, and correct other status/dependency errors. -7. [x] Correct the evidence MCP cursor terminology without changing behavior and add the documentation Towncrier fragment. -8. [x] Review each substantial workstream, render changed Mermaid diagrams, validate Markdown, public-content privacy, quality, Gitleaks, Towncrier, marker immutability, and the final diff. -9. [x] Update this plan to handoff truth, push the exact branch, and open one protected documentation/process pull request without merging or publishing packages. - -### Initial Evidence - -- The clean synchronized `main` branch is at annotated tag `v0.4.6`; the tag targets release merge `c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6`. -- Feature PR #67 merged as `2b0f8393ba86a6150a694180b10bae7d0907db09`; release PR #68 merged as `c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6`; release workflow `31250755741` completed successfully. -- TestPyPI, PyPI, and the immutable GitHub Release expose wheel SHA-256 `7a944f5f1332728d857574d81cb484507eb3c5a6f5105d71a35dfbec0329307d` and sdist SHA-256 `dcde562699c759764eb3cba4654cce511871c2e3c26a1ab2c1d9726fe94c5cba`. -- Registry provenance identifies `release.yml`, the release merge/run, and the `testpypi-public-disclosure` and `pypi-production` trusted-publishing environments. Published wheel installs passed on Python 3.12/3.13 and the sdist on Python 3.14. -- Issues #65 and #66 have completed four-item human checklists, owner conclusions, release receipts, and `completed` closure reasons. -- `scripts/ocr_compat.py discover` reports zero unseen stable OCR releases; no compatibility promotion belongs in this task. - -### Code-First Backlog Audit - -| Item | Current capability conclusion | Result | -| --- | --- | --- | -| BL-008 | Partially implemented | M1 already supplies the listed Python, JavaScript, Go, Composer, Ansible, image, immutable-delta, MCP, and scoped-completeness baseline. The item now contains only demonstrated format, installed-metadata, workspace/platform, precedence, tag/digest, component-scope, and completeness gaps. | -| BL-009 | Not implemented; selection trigger unmet | Remains planned, but no longer waits for all BL-008 gaps; only a selected plugin's actual evidence dependency applies. | -| BL-010 | Conditional trigger unmet | Remains conditional and no longer waits for broad BL-008/BL-009 completion. | -| BL-011 | Not implemented; ready safety work | Remains the prerequisite for automatic reference detection and provider-specific external-content examples. | -| BL-012 | Conditional trigger unmet | Moved from ready/high to conditional/low; no named provider currently requires managed browser OAuth beyond static headers or a reviewed stdio proxy. | -| BL-013 | Core implemented; provider examples not implemented | Mandatory built-in/external composition, transports, replacement, namespaces, collisions, capability rendering, secrets, receipts, and integration tests are complete. Only BL-011-gated synthetic provider examples remain; OAuth is not a blocker. | -| BL-014 | Not implemented; technical trigger met | Remains planned on established evidence and target-branch decision contracts. | -| BL-015 | Conditional trigger unmet | Remains conditional because no supported OCR contract proves target-ref-aware automatic guidance. | -| BL-016 | Partially unblocked | OCR per-run model/provider and result-identity capabilities exist; the owner-approved closed profile and precedence matrix remains the blocker. | -| BL-017 | Partially implemented inputs; audit ready | Existing OCR telemetry plus review-health, failed-file, finding, posting, suppression, and MCP-use receipts support an audit now. The item is narrowed to no-release gap analysis; any runtime telemetry becomes separate work. | -| BL-018 | Conditional trigger unmet | Remains conditional on profiles, the measurement conclusion, representative evidence, and an owner-approved routing policy. | -| BL-019 | Technical prerequisite met; operational trigger unmet | Stable M1 parser interfaces exist, but target selection, bounded resources, corpus ownership, and backend criteria remain unresolved, so the item stays parked. | -| BL-020 | Partially unblocked; demand trigger unmet | MCP composition and evidence schemas are stable; file configuration remains parked until operational need and a coherent non-secret schema are demonstrated. | -| BL-021 | Conditional trigger unmet | Remains conditional because no funded named forge, owner, fixture set, or parity matrix exists. | - -### Architecture And Process Review Checkpoint - -- Critical/Pareto review selected one compact active registry, one stable-tag index, and one full release archive. This preserves all nonblank historical plan content byte-for-byte while avoiding year-based hierarchy and duplicate summaries. -- The release contract now separates repository preparation from external publication and post-release reconciliation. The latest reconciled tag remains indexed from `PLANS.md`; older cycles retain stable explicit anchors in the archive. -- Source/test readback confirms the BL-008 implemented baseline and BL-013 composition baseline. Strategy claims match the current collector registry, mandatory MCP lifecycle, native HTTPS/stdio transports, scoped completeness, and distinct GitLab result/reporting concepts. -- No exact OCR version remains in durable strategy prose. Historical release numbers remain only in the archive/index, operational compatibility docs, changelog, and version-specific backlog evidence where they are intentional. - -### Final Validation And Handoff - -- `scripts/quality.sh check` passes Ruff formatting/lint, mypy, Bandit, 547 tests plus 35 subtests, and 79.01% coverage. The focused release-process, review-runner, result, posting, and runtime-helper suite passes 218 tests plus 27 subtests. -- Every changed Mermaid block renders successfully with Mermaid CLI 11.16.0 and passes visual review. All repository-local Markdown links and anchors validate, including every tag-index entry and explicit archive anchor. -- `uv run towncrier build --draft --version 0.4.7`, `uv run python scripts/ocr_compat.py validate`, the changed-public-content privacy scan, checksum-verified Gitleaks 8.24.3, and `git diff --check` pass. Final bounded OCR discovery still reports zero unseen stable releases. -- `.release-version`, `.next-version`, and `.release-source-date-epoch` are byte-identical to `origin/main`. The diff changes no CLI, environment, schema, MCP behavior, GitLab publication behavior, workflow, dependency, lock, or recommended OCR baseline; the only runtime-file edit corrects a cursor docstring. -- Protected documentation/process PR #69 carries this no-release closure on `agent/reconcile-0.4.6-lifecycle`. It remains unmerged because merging to `main` would initiate the repository's automatic TestPyPI development workflow; no package, tag, Release, attestation, or registry artifact was created by this task. - -## Completed Plan: Qualify OCR 1.8.9-1.8.10 and release toolkit 0.4.6 - -Status: completed; stable publication and external reconciliation independently verified -Owner: Codex -Last Updated: 2026-08-08 -Release Classification: release-required -Target Stable Version: 0.4.6 -Tracking Issues: #65, #66 - -### Goal - -Qualify Open Code Review 1.8.9 and 1.8.10 as one ordered upstream release chain, promote checksum-verified 1.8.10 as the tested and recommended toolkit baseline, update the local OCR installation and every affected test, example, documentation, and backlog contract, and publish stable toolkit 0.4.6. Reclaim GitHub Actions storage through the repository's bounded retention policy without deleting workflow run/check metadata, releases, tags, attestations, or registry artifacts. - -### Decisions - -- Treat OCR 1.8.9 and 1.8.10 as compatible human-reviewed candidates. Viewer, benchmark, Pages, OpenCode plugin, documentation, CI, and dependency changes are release-note-only context because the toolkit does not consume those surfaces. -- OCR 1.8.9 native `code_search` option-like reference hardening improves the upstream security boundary without changing the toolkit CLI, result, MCP, or configuration contract. -- OCR 1.8.10 rejects invalid extra positional CLI arguments, removes dead internal timeout fields, and renders tool parameters deterministically. Valid toolkit invocations remain compatible; deterministic rendering improves reproducibility but does not complete BL-016 or BL-017. -- Preserve all future backlog statuses. Verify that BL-019 retains one activation sentence and update only version-specific context proven stale by the promoted baseline; no roadmap milestone is completed. -- Install only the official checksum-verified Darwin arm64 OCR 1.8.10 binary locally and run deterministic compatibility probes. Do not perform an unbounded or paid LLM review. -- Use the existing bounded Actions maintenance policy: delete eligible caches, expired/aged artifacts, and aged downloadable log archives while retaining workflow run/check metadata and longer release/TestPyPI audit windows. Re-read repository storage APIs and repeat the dry-run after execution. -- The original combined release/closure decision is historical evidence of the process gap corrected after publication. Stable publication completed successfully, but repository-side closure required this later no-release reconciliation. -- Future release-required plans remain active through feature merge, TestPyPI development verification, release PR, stable publication, external reconciliation, and a separate no-release closure PR. - -### Work Queue - -1. [x] Repeat the Actions cleanup dry-run, execute the exact bounded policy through the maintenance workflow, and verify the resulting cache/artifact/log candidate state. -2. [x] Independently verify hosted evidence and official binaries for OCR 1.8.9 and 1.8.10; run deterministic local probes and atomically update local OCR to 1.8.10. -3. [x] Promote the cumulative reviewed baseline to 1.8.10 and update runtime, checksum, example, compatibility, configuration, security, and test contracts. -4. [x] Reconcile upstream changes against the backlog and roadmap, preserve unfinished scope, verify the single BL-019 activation line, and add one Towncrier feature fragment for the full chain. -5. [x] Review the cleanup, qualification/promotion, and documentation/backlog boundaries separately; correct every actionable finding before continuing. -6. [x] Run focused and complete Python validation, manifest/workflow/Towncrier checks, pinned Gitleaks, reproducible build/Twine, restricted-path wheel/sdist installs, and a final full-diff review. -7. [x] Merge the protected feature PR and independently reconcile its exact TestPyPI development artifacts, hashes, provenance, and supported install smokes. -8. [x] Prepare and merge release PR #68 as verified merge `c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6`. -9. [x] Verify stable TestPyPI/PyPI artifacts, annotated tag, immutable GitHub Release, hashes, attestations, and Python 3.12-3.14 installs through successful release workflow `31250755741` and independent registry/GitHub readback. -10. [x] Record the completed human conclusions and stable-release receipts on #65/#66 and close both issues as completed. - -### Initial Evidence - -- `main` is clean and synchronized at `b066140`; stable toolkit v0.4.5 is published and `.next-version` targets 0.4.6. The recommended and locally installed OCR baseline is 1.8.8. -- Open issues #65 and #66 contain hosted schema-v2 qualification evidence for OCR 1.8.9 and 1.8.10. Both machine contracts are compatible and require the human conclusions recorded above; the observed chain is contiguous from tested baseline 1.8.8. -- Official Darwin arm64 SHA-256 is `abb70af93c0dae6785e6129e9bb9ab50432f9d6b3164fa1d8ffdcd972a3fdf1d` for OCR 1.8.9 and `ee850ccd9ea69feb38b87dd4f789da7da5e96648c2747c52a01014eac2b87a23` for OCR 1.8.10. Official Linux amd64 SHA-256 is `43ea736e9e14501336db46a83e12f06f79eec690a019e2c186df98477c8b179c` and `7161500791b8d27906ee8a29bf4429953b27048e90e33dd9a4ff6118932c9001`, respectively. -- Repository storage reads found 195,180,119 bytes across six caches and 17,889,889 bytes across 167 artifacts before cleanup. The dry-run selected 267 bounded objects: three caches, 95 artifacts, and 169 log archives; known cache/artifact bytes total 125,000,205, excluding log archives whose API does not expose size. - -### Actions Cleanup Review Checkpoint - -- The execution-time dry-run reproduced the original scope exactly: 267 objects and 125,000,205 known bytes. Maintenance run `31250057127` completed successfully and deleted all three caches, 95 artifacts, and 169 log archives with zero already-absent responses; workflow run and check metadata remained available. -- Repository API readback reports 80,065,771 bytes across three active caches and 8,004,032 bytes across 72 active artifacts, about 84 MiB of known Actions storage. This is a 125,000,205-byte reduction in the API surfaces that expose sizes; GitHub's account billing meter can update later and is not available to the repository-scoped token. -- A manual audit still lists the 169 old run identities because `--include-all-old` deliberately plans against immutable run metadata. Direct reads of representative log archives return HTTP 404, proving their downloadable bytes are gone. Scheduled cleanup already limits retry planning to two weekly opportunities and does not need a policy or test change. - -### Qualification, Promotion, And Backlog Review Checkpoint - -- Hosted schema-v2 evidence from run `31243828961` forms a contiguous 1.8.8 to 1.8.9 to 1.8.10 chain. Official `sha256sum.txt` files and independently downloaded Darwin arm64 binaries agree with the evidence digests; deterministic version, help, preview, JSON-result, and optional-capability probes pass for both candidates. -- `/opt/homebrew/bin/ocr` was atomically replaced with the official Darwin arm64 1.8.10 binary. It reports `open-code-review v1.8.10`; SHA-256 is `ee850ccd9ea69feb38b87dd4f789da7da5e96648c2747c52a01014eac2b87a23`, and the installed-path compatibility probe passes. -- Source and release-note review confirms that 1.8.9's `code_search` hardening is upstream defense in depth without a consumed interface change. OCR 1.8.10's invalid positional-argument rejection does not affect valid toolkit calls, its timeout-field removal is internal, and deterministic tool-parameter rendering is additive. Both tags retain Go MCP SDK v1.6.1 and the existing protocol revision set. -- Runtime preflight, public GitLab example version and Linux checksum, README, compatibility/configuration/GitLab/security documentation, manifest, evidence, and current-baseline tests now agree on 1.8.10. One #66 Towncrier feature fragment covers the full reviewed chain; no rules fragment is justified because the consumed allowlist/rule surface did not change. -- Backlog review adds deterministic-rendering context to BL-016 and BL-017 without changing their planned status. BL-008/009/010 retain historically accurate 1.8.8 overlap notes, BL-019 already contains exactly one activation sentence, and no roadmap status changes. -- Review found four test cases whose semantics were "next patch after the current baseline" but whose fixtures remained pinned to 1.8.8/1.8.9. They now exercise 1.8.10 to 1.8.11. Focused validation passes 124 tests plus 15 MCP subtests, manifest validation, Ruff, and `git diff --check`. - -### Pre-Commit Validation Checkpoint - -- `scripts/quality.sh check` passes 547 tests plus 35 subtests at 79% coverage together with Ruff formatting/lint, mypy, and Bandit. Manifest validation, frozen-lock validation, workflow YAML parsing, Towncrier 0.4.6 draft rendering, dependency audit, and `git diff --check` pass. -- Two source-date-epoch-controlled development builds are byte-identical and pass Twine: wheel SHA-256 `ab92dd17be8c4bfaebc2d140e322edc4d3b152f8c2f77bb66b0d5ee06cccad2e`; sdist SHA-256 `2ee0b2e72e839feb1cf379327d50ea52a32b862dd1d8e4cc8d71238285e730d0`. -- Restricted-path installs pass from a private hostile shadow-package directory: the wheel on Python 3.12 and 3.13, and the sdist on Python 3.14. All three expose the installed CLI/import and exact development version without importing repository content. -- Final scope review confirms that evidence hashes match the manifest, current pins agree on OCR 1.8.10, remaining 1.8.8 references are historical fixtures or capability provenance, and no roadmap, runtime dependency, CLI, environment, schema, or provider contract changed beyond the expected OCR version baseline. -- Checksum-verified Gitleaks 8.24.3 passes the complete first-parent feature history. The locally installed 8.30.1 was not accepted as a substitute for the repository's exact security pin. - ### Feature Merge And Development Publication -- Feature PR #67 passed all 13 protected checks with no conversation comments, reviews, or review threads and merged as GitHub-verified squash commit `2b0f8393ba86a6150a694180b10bae7d0907db09`. All six post-main workflow suites completed successfully. -- TestPyPI run `31250465780` published and installed immutable `0.4.6.dev42`. Cache-bypassed PEP 691 reads, freshly downloaded registry bytes, and the workflow artifact are byte-identical: wheel SHA-256 `c82121bd500afd808da784b9c2cdf2883ee979bec4e73578238e246bb3d526bb`; sdist SHA-256 `2372e29519a5a9bf6ec373de466451348eb4055e15479d8a4843c357dbf22b06`. -- TestPyPI provenance subjects match both exact digests and identify `testpypi.yml`, merge `2b0f8393ba86a6150a694180b10bae7d0907db09`, run `31250465780`, and the `testpypi-public-disclosure` environment. Restricted-path installs of registry bytes pass for the wheel on Python 3.12/3.13 and the sdist on Python 3.14 from a private hostile shadow-package directory. -- The release PR is also the repository-side closure PR as requested. It will consume the #66 fragment, reconcile the plan and unchanged roadmap/backlog statuses, and advance the next development line; stable publication evidence will be added only to #65/#66 after it exists, without a second repository PR. +- Feature PR #74 was read back as exact head + `2f63d250cb47ab3c7bcc174514949f7bb2d6e044` over base + `bb8827148f13b17b209495788ac4f7b15573a168`, with zero comments, reviews, or + review threads. All 13 exact-head required checks passed from their required + App integration IDs before squash merge. The GitHub-verified merge + `0534c54c7f00b5e391fd6a85d9fee41aaa6c1d70` has the reviewed head tree + `9ff900ab33d3485cb4d6aadd0c88fe180e4a708b` and exact protected base as its + only parent. The feature branch was deleted locally and remotely. +- TestPyPI run `31478171014` completed successfully for that exact merge and + published immutable `0.4.7.dev45`. Cache-bypassed PEP 691 reads, freshly + downloaded registry bytes, and Actions artifact `9096110238` are + byte-identical: wheel SHA-256 + `e7aa351d30ae6da865e249ec353ebef2c4a2ba6eb2365370df86aa247d0116c9`; + sdist SHA-256 + `ed05585e4d8c3104641a2309e830fad1738043c2fa1343febe0ceff9e559e251`. + The Actions archive digest is + `91018933dff03e8ad97fe5e814ab06776a9d246198bab3c68ae32bc8fa7e5fb2`. +- Independent PyPI Integrity reads bind both exact subjects to repository + `xeonvs/open-code-review-toolkit`, workflow `testpypi.yml`, and environment + `testpypi-public-disclosure`. Registry wheel installs pass on Python 3.12 and + 3.13; the registry sdist installs on Python 3.14. All three pass `pip check`, + exact runtime-version import, and restricted-`PATH` CLI smoke from a hostile + shadow-package working directory. +- The final release PR is the last repository mutation. It archives the complete + externally reconciled 0.4.6 cycles under stable-tag anchors, consumes exactly + fragments 69-73, records authorization metadata for issues 70-73, and lists + stable registry, provenance, tag, immutable Release, receipt, install, and + issue-closure checks as pending. Roadmap, strategy, and backlog statuses remain + unchanged after another code-first reconciliation. ### Release Preparation Review Checkpoint -- The combined release-and-closure diff contains only the stable/next version markers, deterministic source epoch, generated 0.4.6 changelog, consumed #66 fragment, and current plan receipts. The release notes render the exact `v0.4.5...v0.4.6` comparison; no roadmap milestone or future-backlog item is closed. -- The complete quality gate passes 547 tests plus 35 subtests at 79% coverage, Ruff formatting/lint, mypy, and Bandit. Manifest, frozen lock, release-note extraction, dependency audit, and both staged/unstaged `git diff --check` validation pass. -- Two clean stable builds with version `0.4.6` and source epoch `1786181004` are byte-identical and pass Twine: wheel SHA-256 `7a944f5f1332728d857574d81cb484507eb3c5a6f5105d71a35dfbec0329307d`; sdist SHA-256 `dcde562699c759764eb3cba4654cce511871c2e3c26a1ab2c1d9726fe94c5cba`. -- Restricted-path installs of the stable wheel pass on Python 3.12 and 3.13, and the stable sdist passes on Python 3.14. All three run the installed CLI/import from a private hostile shadow-package directory and report exactly 0.4.6. -- Checksum-verified Gitleaks 8.24.3 passes the release history from protected `main`; the final release commit remains signed and the combined diff is free of whitespace errors. - - -### External Release Reconciliation - -- Feature PR #67 merged as `2b0f8393ba86a6150a694180b10bae7d0907db09`; release PR #68 merged as `c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6`. -- Stable release workflow `31250755741` completed successfully. The reviewed wheel SHA-256 is `7a944f5f1332728d857574d81cb484507eb3c5a6f5105d71a35dfbec0329307d`; the reviewed sdist SHA-256 is `dcde562699c759764eb3cba4654cce511871c2e3c26a1ab2c1d9726fe94c5cba`. -- Cache-bypassed TestPyPI and PyPI JSON reads, the workflow artifact, and immutable GitHub Release assets expose the same two filenames and hashes. Registry provenance subjects bind both distributions to `release.yml`, the exact release merge/run, and the `testpypi-public-disclosure` and `pypi-production` environments. -- Annotated tag object `b3fc3f1e0789142d27829ebf5cad5cd81ca79b8a` targets the release merge. GitHub reports the v0.4.6 Release immutable; GitHub artifact attestations verify both distributions. -- Published-artifact installs passed for the wheel on Python 3.12 and 3.13 and the sdist on Python 3.14 from the restricted hostile-shadow-package harness. -- Issues #65 and #66 each retain a completed four-item human checklist, an owner compatibility conclusion, the full release receipt, and a `completed` closure reason. +- The release branch starts from exact feature merge + `0534c54c7f00b5e391fd6a85d9fee41aaa6c1d70`. Its tracked authorization + metadata names stable 0.4.7 and the sorted issue set 70-73; stable and next + version markers are 0.4.7 and 0.4.8, and deterministic epoch `1786440757` is + exactly one second after the feature merge. Towncrier consumed only fragments + 69-73, and the generated release notes end with the exact + `v0.4.6...v0.4.7` comparison. +- The previously retained 0.4.6 plans moved into the stable-tag archive without + rewriting their plan text. Explicit anchors resolve from the execution-history + index, and roadmap, strategy, README, and backlog review found no status or + narrative change justified by this repository-only release preparation. +- The release-focused suite passes 137 tests plus 15 subtests. The complete + isolated Python 3.12 gate passes formatting, Ruff, strict mypy, Bandit with + zero medium/high findings, 623 tests plus 85 subtests, and 79.09% coverage. + OCR manifest validation, workflow YAML parsing, changed-shell ShellCheck, + release-note extraction, metadata/archive checks, and `git diff --check` + pass. `pip-audit --skip-editable` reports no known dependency vulnerabilities. +- Two clean source-date-epoch-controlled stable builds are byte-identical and + pass Twine, canonical archive composition, centralized SCM-version, zero + runtime dependency, and Python `>=3.12,<3.15` metadata checks. Wheel SHA-256 + is `15c86588987fd441aebf7a43235571e2d14f789aa7a8e1f59cbd24ce113978b2`; + sdist SHA-256 is + `5ad2563c9cfc4e6fc9da95d425df44c5e53e62de05ddad462eeda0b41626ac6a`. + Restricted-`PATH` hostile-shadow installs pass for the wheel on Python 3.12 + and 3.13 and the sdist on Python 3.14, including exact runtime version, CLI, + and `pip check` readback. +- Stable TestPyPI/PyPI bytes, Integrity provenance, GitHub attestations, the + annotated tag, immutable Release and exact asset set, release receipt, + published-artifact installs, and issue receipt/closure remain external + post-merge gates. None is represented as complete in this release PR, and no + later repository closure PR is planned. diff --git a/changelog.d/69.doc.md b/changelog.d/69.doc.md deleted file mode 100644 index bf62835..0000000 --- a/changelog.d/69.doc.md +++ /dev/null @@ -1,2 +0,0 @@ -Document the established evidence and MCP architecture, reconcile the completed 0.4.6 lifecycle and remaining backlog with current code, and index archived execution history by stable release tag. -Make the release pull request the final repository mutation while exact-tree authorization, registry and provenance verification, an immutable machine-readable receipt, and idempotent issue closure prove external delivery after merge. diff --git a/changelog.d/70.bugfix.md b/changelog.d/70.bugfix.md deleted file mode 100644 index 2ee93ec..0000000 --- a/changelog.d/70.bugfix.md +++ /dev/null @@ -1,2 +0,0 @@ -Publish an actionable GitLab suggestion only when `existing_code` proves that the replacement applies to one contiguous range in the immutable reviewed head. -Retain the explanatory finding, with a bounded non-sensitive omission reason, when a replacement is stale, malformed, multi-region, diff-prefixed, or otherwise unverifiable. diff --git a/changelog.d/71.feature.md b/changelog.d/71.feature.md deleted file mode 100644 index 8185c38..0000000 --- a/changelog.d/71.feature.md +++ /dev/null @@ -1,2 +0,0 @@ -Add default-on `OCR_AUTO_APPROVE` for conservative, exact-SHA GitLab approval after every current review note publishes, with an explicit fail-closed opt-out and bounded status readback. -Limit eligibility to complete manifest-backed reviews with at most three low-severity style, documentation, or maintainability findings, while preserving every existing approval when a later review is ineligible or disabled. diff --git a/changelog.d/72.feature.md b/changelog.d/72.feature.md deleted file mode 100644 index 267d650..0000000 --- a/changelog.d/72.feature.md +++ /dev/null @@ -1 +0,0 @@ -Target checksum-verified Open Code Review 1.9.1 after qualifying 1.9.0 through 1.9.1. diff --git a/changelog.d/73.rules.md b/changelog.d/73.rules.md deleted file mode 100644 index 97d7218..0000000 --- a/changelog.d/73.rules.md +++ /dev/null @@ -1 +0,0 @@ -The recommended OCR built-in rules and reviewable-file allowlist now include Nim source, script, and package files. diff --git a/docs/engineering/execution_history/README.md b/docs/engineering/execution_history/README.md index d2442de..ff6bb09 100644 --- a/docs/engineering/execution_history/README.md +++ b/docs/engineering/execution_history/README.md @@ -6,7 +6,7 @@ | Stable tag | Primary archived plan | Related context in the same archive | | --- | --- | --- | -| `v0.4.6` | [OCR 1.8.9-1.8.10 qualification and toolkit 0.4.6](../../../PLANS.md#completed-plan-qualify-ocr-189-1810-and-release-toolkit-046) | The latest externally reconciled cycle remains in the active registry until the next stable closure. | +| `v0.4.6` | [OCR 1.8.9-1.8.10 qualification and toolkit 0.4.6](releases.md#plan-toolkit-0-4-6) | The subsequent [0.4.6 lifecycle and backlog reconciliation](releases.md#plan-toolkit-0-4-6-reconciliation) records the process correction carried into later releases. | | `v0.4.5` | [OCR 1.8.7-1.8.8 qualification and toolkit 0.4.5](releases.md#plan-toolkit-0-4-5) | Compatibility-chain automation and the toolchain update included in that release. | | `v0.4.4` | [Evidence coverage and GitLab review health](releases.md#plan-toolkit-0-4-4) | Scoped completeness, failed-file coverage, and summary separation. | | `v0.4.3` | [OCR compatibility automation hardening](releases.md#plan-toolkit-0-4-3) | Retention and compatibility issue lifecycle. | diff --git a/docs/engineering/execution_history/releases.md b/docs/engineering/execution_history/releases.md index 4bd9250..a4f0ce4 100644 --- a/docs/engineering/execution_history/releases.md +++ b/docs/engineering/execution_history/releases.md @@ -2,6 +2,177 @@ This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active, blocked, and recently completed work; historical receipts here remain part of the audit trail. + + +## Completed Plan: Reconcile 0.4.6 lifecycle, architecture, and backlog truth + +Status: completed; validated documentation/process PR handoff +Owner: Codex +Last Updated: 2026-08-08 +Release Classification: no-release +Target Stable Version: not applicable + +### Goal + +Close the externally completed toolkit 0.4.6 lifecycle in repository truth, document the established M1 architecture, re-audit every remaining backlog item against current code and published behavior, correct planning and release-process drift, and archive older execution plans without changing runtime or initiating package publication. + +### Decisions + +- Inspect current implementation before retaining backlog scope or dependencies; distinguish implemented, partial, planned, conditional, obsolete, and historical work. +- Adopt the durable lifecycle `feature PR -> TestPyPI development verification -> release PR -> stable publication -> external reconciliation -> no-release closure PR` for future release-required work. +- Keep `.release-version`, `.next-version`, `.release-source-date-epoch`, the recommended OCR baseline, dependencies, runtime behavior, and public contracts unchanged. +- Open one documentation/process pull request and leave it unmerged in this task because a merge to `main` would initiate the automatic TestPyPI development publication that this no-release task explicitly excludes. +- Preserve the complete audit trail by moving older completed plan detail to `docs/engineering/execution_history/releases.md`; keep the 0.4.6 cycle and this reconciliation in the compact active registry. + +### Work Queue + +1. [x] Read the canonical instructions, all current plans and durable documentation, the M1 implementation and tests, v0.4.0-v0.4.6 history, and live 0.4.6 release and issue receipts. +2. [x] Run bounded OCR discovery and confirm that no unseen stable upstream release exists. +3. [x] Reconcile the 0.4.6 plan and future release-lifecycle instructions from independently verified external evidence. +4. [x] Archive older completed plans without losing decisions, validation, links, hashes, or receipts. +5. [x] Rewrite durable strategy and README current-state prose and classify historical migration material explicitly. +6. [x] Audit every backlog item, narrow BL-008 and BL-013 to remaining work, park BL-012 conditionally, and correct other status/dependency errors. +7. [x] Correct the evidence MCP cursor terminology without changing behavior and add the documentation Towncrier fragment. +8. [x] Review each substantial workstream, render changed Mermaid diagrams, validate Markdown, public-content privacy, quality, Gitleaks, Towncrier, marker immutability, and the final diff. +9. [x] Update this plan to handoff truth, push the exact branch, and open one protected documentation/process pull request without merging or publishing packages. + +### Initial Evidence + +- The clean synchronized `main` branch is at annotated tag `v0.4.6`; the tag targets release merge `c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6`. +- Feature PR #67 merged as `2b0f8393ba86a6150a694180b10bae7d0907db09`; release PR #68 merged as `c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6`; release workflow `31250755741` completed successfully. +- TestPyPI, PyPI, and the immutable GitHub Release expose wheel SHA-256 `7a944f5f1332728d857574d81cb484507eb3c5a6f5105d71a35dfbec0329307d` and sdist SHA-256 `dcde562699c759764eb3cba4654cce511871c2e3c26a1ab2c1d9726fe94c5cba`. +- Registry provenance identifies `release.yml`, the release merge/run, and the `testpypi-public-disclosure` and `pypi-production` trusted-publishing environments. Published wheel installs passed on Python 3.12/3.13 and the sdist on Python 3.14. +- Issues #65 and #66 have completed four-item human checklists, owner conclusions, release receipts, and `completed` closure reasons. +- `scripts/ocr_compat.py discover` reports zero unseen stable OCR releases; no compatibility promotion belongs in this task. + +### Code-First Backlog Audit + +| Item | Current capability conclusion | Result | +| --- | --- | --- | +| BL-008 | Partially implemented | M1 already supplies the listed Python, JavaScript, Go, Composer, Ansible, image, immutable-delta, MCP, and scoped-completeness baseline. The item now contains only demonstrated format, installed-metadata, workspace/platform, precedence, tag/digest, component-scope, and completeness gaps. | +| BL-009 | Not implemented; selection trigger unmet | Remains planned, but no longer waits for all BL-008 gaps; only a selected plugin's actual evidence dependency applies. | +| BL-010 | Conditional trigger unmet | Remains conditional and no longer waits for broad BL-008/BL-009 completion. | +| BL-011 | Not implemented; ready safety work | Remains the prerequisite for automatic reference detection and provider-specific external-content examples. | +| BL-012 | Conditional trigger unmet | Moved from ready/high to conditional/low; no named provider currently requires managed browser OAuth beyond static headers or a reviewed stdio proxy. | +| BL-013 | Core implemented; provider examples not implemented | Mandatory built-in/external composition, transports, replacement, namespaces, collisions, capability rendering, secrets, receipts, and integration tests are complete. Only BL-011-gated synthetic provider examples remain; OAuth is not a blocker. | +| BL-014 | Not implemented; technical trigger met | Remains planned on established evidence and target-branch decision contracts. | +| BL-015 | Conditional trigger unmet | Remains conditional because no supported OCR contract proves target-ref-aware automatic guidance. | +| BL-016 | Partially unblocked | OCR per-run model/provider and result-identity capabilities exist; the owner-approved closed profile and precedence matrix remains the blocker. | +| BL-017 | Partially implemented inputs; audit ready | Existing OCR telemetry plus review-health, failed-file, finding, posting, suppression, and MCP-use receipts support an audit now. The item is narrowed to no-release gap analysis; any runtime telemetry becomes separate work. | +| BL-018 | Conditional trigger unmet | Remains conditional on profiles, the measurement conclusion, representative evidence, and an owner-approved routing policy. | +| BL-019 | Technical prerequisite met; operational trigger unmet | Stable M1 parser interfaces exist, but target selection, bounded resources, corpus ownership, and backend criteria remain unresolved, so the item stays parked. | +| BL-020 | Partially unblocked; demand trigger unmet | MCP composition and evidence schemas are stable; file configuration remains parked until operational need and a coherent non-secret schema are demonstrated. | +| BL-021 | Conditional trigger unmet | Remains conditional because no funded named forge, owner, fixture set, or parity matrix exists. | + +### Architecture And Process Review Checkpoint + +- Critical/Pareto review selected one compact active registry, one stable-tag index, and one full release archive. This preserves all nonblank historical plan content byte-for-byte while avoiding year-based hierarchy and duplicate summaries. +- The release contract now separates repository preparation from external publication and post-release reconciliation. The latest reconciled tag remains indexed from `PLANS.md`; older cycles retain stable explicit anchors in the archive. +- Source/test readback confirms the BL-008 implemented baseline and BL-013 composition baseline. Strategy claims match the current collector registry, mandatory MCP lifecycle, native HTTPS/stdio transports, scoped completeness, and distinct GitLab result/reporting concepts. +- No exact OCR version remains in durable strategy prose. Historical release numbers remain only in the archive/index, operational compatibility docs, changelog, and version-specific backlog evidence where they are intentional. + +### Final Validation And Handoff + +- `scripts/quality.sh check` passes Ruff formatting/lint, mypy, Bandit, 547 tests plus 35 subtests, and 79.01% coverage. The focused release-process, review-runner, result, posting, and runtime-helper suite passes 218 tests plus 27 subtests. +- Every changed Mermaid block renders successfully with Mermaid CLI 11.16.0 and passes visual review. All repository-local Markdown links and anchors validate, including every tag-index entry and explicit archive anchor. +- `uv run towncrier build --draft --version 0.4.7`, `uv run python scripts/ocr_compat.py validate`, the changed-public-content privacy scan, checksum-verified Gitleaks 8.24.3, and `git diff --check` pass. Final bounded OCR discovery still reports zero unseen stable releases. +- `.release-version`, `.next-version`, and `.release-source-date-epoch` are byte-identical to `origin/main`. The diff changes no CLI, environment, schema, MCP behavior, GitLab publication behavior, workflow, dependency, lock, or recommended OCR baseline; the only runtime-file edit corrects a cursor docstring. +- Protected documentation/process PR #69 carries this no-release closure on `agent/reconcile-0.4.6-lifecycle`. It remains unmerged because merging to `main` would initiate the repository's automatic TestPyPI development workflow; no package, tag, Release, attestation, or registry artifact was created by this task. + + + +## Completed Plan: Qualify OCR 1.8.9-1.8.10 and release toolkit 0.4.6 + +Status: completed; stable publication and external reconciliation independently verified +Owner: Codex +Last Updated: 2026-08-08 +Release Classification: release-required +Target Stable Version: 0.4.6 +Tracking Issues: #65, #66 + +### Goal + +Qualify Open Code Review 1.8.9 and 1.8.10 as one ordered upstream release chain, promote checksum-verified 1.8.10 as the tested and recommended toolkit baseline, update the local OCR installation and every affected test, example, documentation, and backlog contract, and publish stable toolkit 0.4.6. Reclaim GitHub Actions storage through the repository's bounded retention policy without deleting workflow run/check metadata, releases, tags, attestations, or registry artifacts. + +### Decisions + +- Treat OCR 1.8.9 and 1.8.10 as compatible human-reviewed candidates. Viewer, benchmark, Pages, OpenCode plugin, documentation, CI, and dependency changes are release-note-only context because the toolkit does not consume those surfaces. +- OCR 1.8.9 native `code_search` option-like reference hardening improves the upstream security boundary without changing the toolkit CLI, result, MCP, or configuration contract. +- OCR 1.8.10 rejects invalid extra positional CLI arguments, removes dead internal timeout fields, and renders tool parameters deterministically. Valid toolkit invocations remain compatible; deterministic rendering improves reproducibility but does not complete BL-016 or BL-017. +- Preserve all future backlog statuses. Verify that BL-019 retains one activation sentence and update only version-specific context proven stale by the promoted baseline; no roadmap milestone is completed. +- Install only the official checksum-verified Darwin arm64 OCR 1.8.10 binary locally and run deterministic compatibility probes. Do not perform an unbounded or paid LLM review. +- Use the existing bounded Actions maintenance policy: delete eligible caches, expired/aged artifacts, and aged downloadable log archives while retaining workflow run/check metadata and longer release/TestPyPI audit windows. Re-read repository storage APIs and repeat the dry-run after execution. +- The original combined release/closure decision is historical evidence of the process gap corrected after publication. Stable publication completed successfully, but repository-side closure required this later no-release reconciliation. +- Future release-required plans remain active through feature merge, TestPyPI development verification, release PR, stable publication, external reconciliation, and a separate no-release closure PR. + +### Work Queue + +1. [x] Repeat the Actions cleanup dry-run, execute the exact bounded policy through the maintenance workflow, and verify the resulting cache/artifact/log candidate state. +2. [x] Independently verify hosted evidence and official binaries for OCR 1.8.9 and 1.8.10; run deterministic local probes and atomically update local OCR to 1.8.10. +3. [x] Promote the cumulative reviewed baseline to 1.8.10 and update runtime, checksum, example, compatibility, configuration, security, and test contracts. +4. [x] Reconcile upstream changes against the backlog and roadmap, preserve unfinished scope, verify the single BL-019 activation line, and add one Towncrier feature fragment for the full chain. +5. [x] Review the cleanup, qualification/promotion, and documentation/backlog boundaries separately; correct every actionable finding before continuing. +6. [x] Run focused and complete Python validation, manifest/workflow/Towncrier checks, pinned Gitleaks, reproducible build/Twine, restricted-path wheel/sdist installs, and a final full-diff review. +7. [x] Merge the protected feature PR and independently reconcile its exact TestPyPI development artifacts, hashes, provenance, and supported install smokes. +8. [x] Prepare and merge release PR #68 as verified merge `c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6`. +9. [x] Verify stable TestPyPI/PyPI artifacts, annotated tag, immutable GitHub Release, hashes, attestations, and Python 3.12-3.14 installs through successful release workflow `31250755741` and independent registry/GitHub readback. +10. [x] Record the completed human conclusions and stable-release receipts on #65/#66 and close both issues as completed. + +### Initial Evidence + +- `main` is clean and synchronized at `b066140`; stable toolkit v0.4.5 is published and `.next-version` targets 0.4.6. The recommended and locally installed OCR baseline is 1.8.8. +- Open issues #65 and #66 contain hosted schema-v2 qualification evidence for OCR 1.8.9 and 1.8.10. Both machine contracts are compatible and require the human conclusions recorded above; the observed chain is contiguous from tested baseline 1.8.8. +- Official Darwin arm64 SHA-256 is `abb70af93c0dae6785e6129e9bb9ab50432f9d6b3164fa1d8ffdcd972a3fdf1d` for OCR 1.8.9 and `ee850ccd9ea69feb38b87dd4f789da7da5e96648c2747c52a01014eac2b87a23` for OCR 1.8.10. Official Linux amd64 SHA-256 is `43ea736e9e14501336db46a83e12f06f79eec690a019e2c186df98477c8b179c` and `7161500791b8d27906ee8a29bf4429953b27048e90e33dd9a4ff6118932c9001`, respectively. +- Repository storage reads found 195,180,119 bytes across six caches and 17,889,889 bytes across 167 artifacts before cleanup. The dry-run selected 267 bounded objects: three caches, 95 artifacts, and 169 log archives; known cache/artifact bytes total 125,000,205, excluding log archives whose API does not expose size. + +### Actions Cleanup Review Checkpoint + +- The execution-time dry-run reproduced the original scope exactly: 267 objects and 125,000,205 known bytes. Maintenance run `31250057127` completed successfully and deleted all three caches, 95 artifacts, and 169 log archives with zero already-absent responses; workflow run and check metadata remained available. +- Repository API readback reports 80,065,771 bytes across three active caches and 8,004,032 bytes across 72 active artifacts, about 84 MiB of known Actions storage. This is a 125,000,205-byte reduction in the API surfaces that expose sizes; GitHub's account billing meter can update later and is not available to the repository-scoped token. +- A manual audit still lists the 169 old run identities because `--include-all-old` deliberately plans against immutable run metadata. Direct reads of representative log archives return HTTP 404, proving their downloadable bytes are gone. Scheduled cleanup already limits retry planning to two weekly opportunities and does not need a policy or test change. + +### Qualification, Promotion, And Backlog Review Checkpoint + +- Hosted schema-v2 evidence from run `31243828961` forms a contiguous 1.8.8 to 1.8.9 to 1.8.10 chain. Official `sha256sum.txt` files and independently downloaded Darwin arm64 binaries agree with the evidence digests; deterministic version, help, preview, JSON-result, and optional-capability probes pass for both candidates. +- `/opt/homebrew/bin/ocr` was atomically replaced with the official Darwin arm64 1.8.10 binary. It reports `open-code-review v1.8.10`; SHA-256 is `ee850ccd9ea69feb38b87dd4f789da7da5e96648c2747c52a01014eac2b87a23`, and the installed-path compatibility probe passes. +- Source and release-note review confirms that 1.8.9's `code_search` hardening is upstream defense in depth without a consumed interface change. OCR 1.8.10's invalid positional-argument rejection does not affect valid toolkit calls, its timeout-field removal is internal, and deterministic tool-parameter rendering is additive. Both tags retain Go MCP SDK v1.6.1 and the existing protocol revision set. +- Runtime preflight, public GitLab example version and Linux checksum, README, compatibility/configuration/GitLab/security documentation, manifest, evidence, and current-baseline tests now agree on 1.8.10. One #66 Towncrier feature fragment covers the full reviewed chain; no rules fragment is justified because the consumed allowlist/rule surface did not change. +- Backlog review adds deterministic-rendering context to BL-016 and BL-017 without changing their planned status. BL-008/009/010 retain historically accurate 1.8.8 overlap notes, BL-019 already contains exactly one activation sentence, and no roadmap status changes. +- Review found four test cases whose semantics were "next patch after the current baseline" but whose fixtures remained pinned to 1.8.8/1.8.9. They now exercise 1.8.10 to 1.8.11. Focused validation passes 124 tests plus 15 MCP subtests, manifest validation, Ruff, and `git diff --check`. + +### Pre-Commit Validation Checkpoint + +- `scripts/quality.sh check` passes 547 tests plus 35 subtests at 79% coverage together with Ruff formatting/lint, mypy, and Bandit. Manifest validation, frozen-lock validation, workflow YAML parsing, Towncrier 0.4.6 draft rendering, dependency audit, and `git diff --check` pass. +- Two source-date-epoch-controlled development builds are byte-identical and pass Twine: wheel SHA-256 `ab92dd17be8c4bfaebc2d140e322edc4d3b152f8c2f77bb66b0d5ee06cccad2e`; sdist SHA-256 `2ee0b2e72e839feb1cf379327d50ea52a32b862dd1d8e4cc8d71238285e730d0`. +- Restricted-path installs pass from a private hostile shadow-package directory: the wheel on Python 3.12 and 3.13, and the sdist on Python 3.14. All three expose the installed CLI/import and exact development version without importing repository content. +- Final scope review confirms that evidence hashes match the manifest, current pins agree on OCR 1.8.10, remaining 1.8.8 references are historical fixtures or capability provenance, and no roadmap, runtime dependency, CLI, environment, schema, or provider contract changed beyond the expected OCR version baseline. +- Checksum-verified Gitleaks 8.24.3 passes the complete first-parent feature history. The locally installed 8.30.1 was not accepted as a substitute for the repository's exact security pin. + +### Feature Merge And Development Publication + +- Feature PR #67 passed all 13 protected checks with no conversation comments, reviews, or review threads and merged as GitHub-verified squash commit `2b0f8393ba86a6150a694180b10bae7d0907db09`. All six post-main workflow suites completed successfully. +- TestPyPI run `31250465780` published and installed immutable `0.4.6.dev42`. Cache-bypassed PEP 691 reads, freshly downloaded registry bytes, and the workflow artifact are byte-identical: wheel SHA-256 `c82121bd500afd808da784b9c2cdf2883ee979bec4e73578238e246bb3d526bb`; sdist SHA-256 `2372e29519a5a9bf6ec373de466451348eb4055e15479d8a4843c357dbf22b06`. +- TestPyPI provenance subjects match both exact digests and identify `testpypi.yml`, merge `2b0f8393ba86a6150a694180b10bae7d0907db09`, run `31250465780`, and the `testpypi-public-disclosure` environment. Restricted-path installs of registry bytes pass for the wheel on Python 3.12/3.13 and the sdist on Python 3.14 from a private hostile shadow-package directory. +- The release PR is also the repository-side closure PR as requested. It will consume the #66 fragment, reconcile the plan and unchanged roadmap/backlog statuses, and advance the next development line; stable publication evidence will be added only to #65/#66 after it exists, without a second repository PR. + +### Release Preparation Review Checkpoint + +- The combined release-and-closure diff contains only the stable/next version markers, deterministic source epoch, generated 0.4.6 changelog, consumed #66 fragment, and current plan receipts. The release notes render the exact `v0.4.5...v0.4.6` comparison; no roadmap milestone or future-backlog item is closed. +- The complete quality gate passes 547 tests plus 35 subtests at 79% coverage, Ruff formatting/lint, mypy, and Bandit. Manifest, frozen lock, release-note extraction, dependency audit, and both staged/unstaged `git diff --check` validation pass. +- Two clean stable builds with version `0.4.6` and source epoch `1786181004` are byte-identical and pass Twine: wheel SHA-256 `7a944f5f1332728d857574d81cb484507eb3c5a6f5105d71a35dfbec0329307d`; sdist SHA-256 `dcde562699c759764eb3cba4654cce511871c2e3c26a1ab2c1d9726fe94c5cba`. +- Restricted-path installs of the stable wheel pass on Python 3.12 and 3.13, and the stable sdist passes on Python 3.14. All three run the installed CLI/import from a private hostile shadow-package directory and report exactly 0.4.6. +- Checksum-verified Gitleaks 8.24.3 passes the release history from protected `main`; the final release commit remains signed and the combined diff is free of whitespace errors. + + +### External Release Reconciliation + +- Feature PR #67 merged as `2b0f8393ba86a6150a694180b10bae7d0907db09`; release PR #68 merged as `c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6`. +- Stable release workflow `31250755741` completed successfully. The reviewed wheel SHA-256 is `7a944f5f1332728d857574d81cb484507eb3c5a6f5105d71a35dfbec0329307d`; the reviewed sdist SHA-256 is `dcde562699c759764eb3cba4654cce511871c2e3c26a1ab2c1d9726fe94c5cba`. +- Cache-bypassed TestPyPI and PyPI JSON reads, the workflow artifact, and immutable GitHub Release assets expose the same two filenames and hashes. Registry provenance subjects bind both distributions to `release.yml`, the exact release merge/run, and the `testpypi-public-disclosure` and `pypi-production` environments. +- Annotated tag object `b3fc3f1e0789142d27829ebf5cad5cd81ca79b8a` targets the release merge. GitHub reports the v0.4.6 Release immutable; GitHub artifact attestations verify both distributions. +- Published-artifact installs passed for the wheel on Python 3.12 and 3.13 and the sdist on Python 3.14 from the restricted hostile-shadow-package harness. +- Issues #65 and #66 each retain a completed four-item human checklist, an owner compatibility conclusion, the full release receipt, and a `completed` closure reason. + ## Completed Plan: Qualify OCR 1.8.7-1.8.8 and release toolkit 0.4.5