Integrate OCR 1.11.5 with private tool diagnostics - #178
Conversation
Draft handoff receiptImplementation and local/hosted verification are complete in Draft PR #178.
The final workflow is a regression run against the already-promoted Draft manifest. Original adjacent 1.11.3→1.11.4 and 1.11.4→1.11.5 audit identities remain in the two separate committed evidence files and manifest conclusions. This completes WQ-06's local and hosted delivery portion. Real LLM/model validation remains pending in another configured environment. Follow the Draft body checklist using this PR's built toolkit wheel and exact OCR 1.11.5, not the published 0.9.0 wheel. PR remains Draft and mergeable, with no unresolved threads; issues #176/#177 and milestone v0.9.1 remain open. No merge or package publication was performed. |
|
Version-neutral documentation follow-up completed at signed commit Self-review completed before commit. Local quality: 1525 tests + 408 subtests, 86.39% coverage and all risk-group floors; Ruff, MyPy, Bandit, lock, manifest, Towncrier, diff and pinned Gitleaks checks passed. GitHub independently verifies the commit signature. All 13 checks on this exact head are SUCCESS, including all five OS/Python jobs, package build, dependencies, Security and CodeQL. CI run: https://github.com/xeonvs/open-code-review-toolkit/actions/runs/34025051012 . Local and remote heads agree; worktree is clean. WQ-07 and the WQ-06 local/push/hosted portion are complete. The PR remains Draft and mergeable; no merge, release or issue closure was performed. External model qualification remains pending. Use the Build artifacts wheel for this head. The runtime subtree remains |
Final feature gate
The feature branch is ready for protected squash merge. Stable publication and external reconciliation remain separate release lifecycle states. |
## Scope Prepare and authorize stable toolkit **v0.9.1** for the completed OCR 1.11.4/1.11.5 qualification and diagnostic-safety work tracked by: - #176 - #177 This release PR contains repository-side release preparation only. Stable publication and external reconciliation remain pending until this exact PR is merged and the protected Release workflow completes. ## Reviewed implementation - Feature PR: #178 - Reviewed feature head: `b47fa551b5de42dcfe9cd5b316a32f4184525be6` - Protected squash merge: `de9055e699ff8a7bc0806c6eae5bdf6666e95160` - Release base: `de9055e699ff8a7bc0806c6eae5bdf6666e95160` - Release head: `4a3847af59b7597975e0daeb1f2867cee3077d01` ## Development publication - Workflow: https://github.com/xeonvs/open-code-review-toolkit/actions/runs/34098626798 - Version: `0.9.1.dev87` - Wheel SHA-256: `2cb519f4e54b25bf1e64416fdacd17ccbba7eba99a758ec0437bbd3021ba2829` - Sdist SHA-256: `9872ea9fcb8c81fd42264af325705e717f311265becffeab192e6ec28c07fd0e` - TestPyPI PEP 740 verification and wheel/sdist install smoke passed. ## Review receipts - Local OCR 1.11.5 reviewed `ae0a9ac..029cdf0`: 9 selected, 9 completed, 0 failed/reused/waived, 77 tool calls, no GitLab posting; result SHA-256 `3a5374a846c3033734da0c66d7a9032e54043e96b8a8322fd9724f37691c2873`. - Codex Security scans `5db2da0c-3f84-46a4-b4dd-cf3521fd1402` and `90628f3c-10aa-4ce9-a3fa-b8c497e504d4`: 8/8 combined surfaces closed, 0 reportable findings. ## Release validation - 1,538 tests plus 408 subtests passed. - Combined coverage: 86.40%; locked risk groups: 85% / 82% / 86% / 88%. - Ruff, MyPy, Bandit, compatibility validation, release-note extraction, `uv lock --check`, diff checks, and pinned Gitleaks passed. - Two source-epoch-controlled builds were byte-identical. - Wheel SHA-256: `c1343b2eba77378d2c4a143bad445e47a762e0e67e3a916cb8f69e2f748f45fb` - Sdist SHA-256: `32ef050255aa9dc0056935bb4280fde9ace0490df0a0affb82a98655f14ce994` - Twine and clean package metadata/content checks passed. ## Release preparation - Stable marker: `0.9.1` - Next development marker: `0.9.2` - Deterministic source epoch: `1788768251` - Authorized issue set: `[176, 177]` - Towncrier fragments rendered into `CHANGELOG.md`. - Public GitLab example pinned to toolkit `0.9.1`. - Complete execution plan archived at `docs/engineering/execution_history/releases.md#plan-toolkit-0-9-1` with stable external delivery pending. - `.release-reconciled-version` intentionally remains `0.9.0` until independent external readback is complete. ## Post-merge gates The protected Release workflow must independently prove registry bytes, PEP 740 provenance, GitHub attestations, annotated tag target, immutable GitHub Release and exact assets, release receipt, supported-Python registry installs, Actions-owned issue receipts, issue/milestone closure, release-branch cleanup, and synchronized `main`. A separate protected `no-release` reconciliation PR will then record those facts and advance `.release-reconciled-version` without creating or mutating another stable release.
1 participant
Result
Integrate OCR 1.11.4 and 1.11.5 for toolkit 0.9.1, with exact OCR 1.11.5 as the supported runtime. Bounded private failed-tool arguments are discarded before normalized diagnostics and publication DLP, while valid review signal and GitLab summaries remain publishable. Tracks #176 and #177 in milestone
v0.9.1.Changes
failure_details.argumentswithout exposing it in finalized results, receipts, notes, telemetry, or public DLP decisions.CompatibilityError/contracts/contract-probe-failedstatus.Exact head
b47fa551b5de42dcfe9cd5b316a32f4184525be6f934ed54598f1ff4696ef5f93c0e7ceb9f279f70754b35fd0de50ed684e78ccfce9012dec6f0b88853a4ab7c8ce6dc07d5362c7c4984bf8d98b55e4e8d4c01b9399d488a2a983d95c041b03cc840957b52df28514e8dbb51f798e6cb1259d97555a41a2e3e3ccaf90519c13b03d69dd6c4aa5470a8eb52727f5e3fd2ce43e5887d8a67cdf107aa1aValidation
ae0a9ac..029cdf0: selected/completed 9/9, failed/reused/waived 0/0/0, 77 tool calls, no GitLab posting. The two malformed-output findings were fixed and regression-tested; retained private evidence SHA-256 is3a5374a846c3033734da0c66d7a9032e54043e96b8a8322fd9724f37691c2873.5db2da0c-3f84-46a4-b4dd-cf3521fd1402closed 7/7 security-relevant surfaces through57f5236; incremental scan90628f3c-10aa-4ce9-a3fa-b8c497e504d4covered57f5236..ecd7ecb. Both completed with no reportable findings and emitted sealed reports/SARIF.Release path
This PR is the completed feature gate. After exact-head hosted checks and thread review, make it Ready and squash-merge. Then verify the protected-main TestPyPI development publication, prepare the separate protected
Release v0.9.1PR, complete stable TestPyPI/PyPI/tag/provenance/attestation/immutable-Release readback, close #176/#177 and the milestone, clean branches, synchronizemain, and finish the no-release external reconciliation without producing another stable release.