Release v0.9.1

[xeonvs]

Scope

Prepare and authorize stable toolkit v0.9.1 for the completed OCR 1.11.4/1.11.5 qualification and diagnostic-safety work tracked by:

• [OCR compatibility] Qualify v1.11.4 #176
• [OCR compatibility] Qualify v1.11.5 #177

This release PR contains repository-side release preparation only. Stable publication and external reconciliation remain pending until this exact PR is merged and the protected Release workflow completes.

Reviewed implementation

• Feature PR: Integrate OCR 1.11.5 with private tool diagnostics #178
• Reviewed feature head: b47fa551b5de42dcfe9cd5b316a32f4184525be6
• Protected squash merge: de9055e699ff8a7bc0806c6eae5bdf6666e95160
• Release base: de9055e699ff8a7bc0806c6eae5bdf6666e95160
• Release head: 4a3847af59b7597975e0daeb1f2867cee3077d01

Development publication

• Workflow: https://github.com/xeonvs/open-code-review-toolkit/actions/runs/34098626798
• Version: 0.9.1.dev87
• Wheel SHA-256: 2cb519f4e54b25bf1e64416fdacd17ccbba7eba99a758ec0437bbd3021ba2829
• Sdist SHA-256: 9872ea9fcb8c81fd42264af325705e717f311265becffeab192e6ec28c07fd0e
• TestPyPI PEP 740 verification and wheel/sdist install smoke passed.

Review receipts

• Local OCR 1.11.5 reviewed ae0a9ac..029cdf0: 9 selected, 9 completed, 0 failed/reused/waived, 77 tool calls, no GitLab posting; result SHA-256 3a5374a846c3033734da0c66d7a9032e54043e96b8a8322fd9724f37691c2873.
• Codex Security scans 5db2da0c-3f84-46a4-b4dd-cf3521fd1402 and 90628f3c-10aa-4ce9-a3fa-b8c497e504d4: 8/8 combined surfaces closed, 0 reportable findings.

Release validation

• 1,538 tests plus 408 subtests passed.
• Combined coverage: 86.40%; locked risk groups: 85% / 82% / 86% / 88%.
• Ruff, MyPy, Bandit, compatibility validation, release-note extraction, uv lock --check, diff checks, and pinned Gitleaks passed.
• Two source-epoch-controlled builds were byte-identical.
  • Wheel SHA-256: c1343b2eba77378d2c4a143bad445e47a762e0e67e3a916cb8f69e2f748f45fb
  • Sdist SHA-256: 32ef050255aa9dc0056935bb4280fde9ace0490df0a0affb82a98655f14ce994
• Twine and clean package metadata/content checks passed.

Release preparation

• Stable marker: 0.9.1
• Next development marker: 0.9.2
• Deterministic source epoch: 1788768251
• Authorized issue set: [176, 177]
• Towncrier fragments rendered into CHANGELOG.md.
• Public GitLab example pinned to toolkit 0.9.1.
• Complete execution plan archived at docs/engineering/execution_history/releases.md#plan-toolkit-0-9-1 with stable external delivery pending.
• .release-reconciled-version intentionally remains 0.9.0 until independent external readback is complete.

Post-merge gates

The protected Release workflow must independently prove registry bytes, PEP 740 provenance, GitHub attestations, annotated tag target, immutable GitHub Release and exact assets, release receipt, supported-Python registry installs, Actions-owned issue receipts, issue/milestone closure, release-branch cleanup, and synchronized main. A separate protected no-release reconciliation PR will then record those facts and advance .release-reconciled-version without creating or mutating another stable release.