Toolkit 0.10.0: local review provider, diagnostics and OCR controls

.next-version

@@ -1 +1 @@
-0.9.2
+0.10.0

README.md

@@ -7,7 +7,7 @@
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/xeonvs/open-code-review-toolkit/badge)](https://securityscorecards.dev/viewer/?uri=github.com/xeonvs/open-code-review-toolkit)
 [![CodeQL](https://github.com/xeonvs/open-code-review-toolkit/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/xeonvs/open-code-review-toolkit/actions/workflows/codeql.yml)
 
-Open Code Review Toolkit is an unofficial GitLab CI integration layer for [Alibaba Open Code Review](https://github.com/alibaba/open-code-review). It provides bounded repository evidence, a compact review bootstrap, a built-in read-only MCP server, environment-driven OCR configuration, preflight validation, and safe GitLab merge-request posting. It does **not** bundle or download the `ocr` binary.
+Open Code Review Toolkit is an unofficial review control and integration layer for [Alibaba Open Code Review](https://github.com/alibaba/open-code-review), with GitLab CI and standalone local providers. It provides bounded repository evidence, a compact review bootstrap, a built-in read-only MCP server, environment-driven OCR configuration, preflight validation, local Markdown reports, and safe GitLab merge-request posting. It does **not** bundle or download the `ocr` binary.
 
 > [!NOTE]
 > The project is under active development; the public API, CLI, environment contract, and generated schemas may evolve before 1.0.
@@ -55,7 +55,28 @@ The toolkit defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 
-## How reviews evolve
+## Standalone local quick start
+
+With the qualified OCR binary and LLM environment configured, review an immutable
+commit without forge credentials:
+
+```console
+ocr-ci preflight --local
+ocr-ci review --local --result review.json --stderr review.stderr --report review.md -- --commit HEAD
+```
+
+Local execution uses the same OCR, mandatory evidence MCP, validation and DLP
+pipeline as CI. It publishes every admitted finding to a fresh private Markdown
+file and the console, without GitLab acquisition, suppression, approval or a
+fabricated publication receipt. See [local review](docs/local.md) for ranges,
+failure behavior and optional private `--debug-dir` bundles.
+
+Optional [reasoning and progress controls](docs/configuration.md#provider-endpoint-and-completion-cap-contract)
+do not change review rounds or budgets. Reasoning is unset by default; explicit
+`none` is a wire value whose support depends on the provider/model. Progress is
+off by default and emits only bounded toolkit phases on stderr.
+
+## How GitLab reviews evolve
 
 On a successful rerun, the toolkit replaces untouched OCR-only notes instead of accumulating stale reviews. A human reply transfers that discussion to the team: the conversation is preserved and a matching finding is suppressed. Reply with `/ocr suppress` or `@<live-bot-username> suppress` to keep a discussion open without future repeats; use the corresponding `resolve` command to resolve it after the next successful posting transaction. For example, a bot named `mr.bot` accepts the exact reply `@mr.bot resolve`.
 

ROADMAP.md

@@ -40,6 +40,13 @@ flowchart LR
 
 ## Ordering notes
 
+- The active 0.10.0 Draft adds standalone local delivery, provider-neutral reporting,
+  private debug observations and explicit reasoning/progress controls to the same
+  execution engine. It does not reopen established milestones or activate the
+  conditional second-forge, model-profile, routing or evidence-pack backlog.
+  Draft readiness, configured external qualification and stable delivery remain
+  separate states in `PLANS.md`.
+
 - OCR compatibility and the established common evidence model converge at compact-bootstrap/evidence-MCP integration.
 - M3 is established from BL-011's real-OCR characterization of the current generic composition boundary. Direct composition is an operator-configured privileged facility, not safe author-triggered reference resolution. BL-012 remains conditional and does not block M3 or M5 when reviewed static credentials or a stdio proxy suffice.
 - M2 is established through independently verified stable delivery of its framework plugins, template rules, scoped evidence, deltas, and built-in MCP projection. Conditional future ecosystem packs remain in M7 and do not reopen M2.

changelog.d/181.maintenance.md

@@ -0,0 +1 @@
+Target checksum-verified Open Code Review 1.11.6 after qualifying 1.11.6.

changelog.d/181.rules.md

@@ -0,0 +1 @@
+Review OCaml and ReasonML files with the recommended OCR release's built-in rules, and route Kotlin script files to Kotlin rules while preserving its default test-file exclusions.

changelog.d/182.feature.md

@@ -0,0 +1,8 @@
+Add explicit standalone local preflight and immutable-diff review with shared
+private Markdown artifacts and console summaries, every DLP-admitted finding, and verified evidence usage,
+independently of inherited CI identity or forge publication.
+Add a private local debug bundle with bounded original and finalized artifacts,
+actual check outcomes and value-free DLP decisions, without bypassing the shared
+review pipeline or retaining its temporary runtime session.
+Expose explicit protocol-specific reasoning effort and bounded, opt-in review
+progress that remains independent of OCR output and result admission.

changelog.d/182.refactor.md

@@ -0,0 +1 @@
+Separate common review outcome, coverage, finding metadata, usage and DLP reporting from GitLab publication, preserving existing GitLab summaries and approval behavior.

compatibility/evidence/ocr-1.11.6.json

@@ -0,0 +1,275 @@
+{
+  "assets": [
+    {
+      "name": "opencodereview-darwin-amd64",
+      "sha256": "311cc54cefcd51263ba07851aa6a32f259edfcc9ec9861039eab9da274657dce",
+      "size": 57828336
+    },
+    {
+      "name": "opencodereview-darwin-arm64",
+      "sha256": "a60f101490ba9bb88e90becf23b78c1e2fd2d98219ea36384010d488ed32d7b0",
+      "size": 54861634
+    },
+    {
+      "name": "opencodereview-linux-amd64",
+      "sha256": "09f30595834f8297a592b51bf4707fb24728b2826a65915f1964c5563e4fb3bd",
+      "size": 56082594
+    },
+    {
+      "name": "opencodereview-linux-arm64",
+      "sha256": "1e4dc70445037fd06c3bbb0a0b09944a696703937c3287083321540d880729a2",
+      "size": 52822178
+    },
+    {
+      "name": "opencodereview-windows-amd64.exe",
+      "sha256": "c2652bb4f70c8c3af38bf69656ab05f10c13cd9457da77bc374f41ab9c25de25",
+      "size": 57546240
+    },
+    {
+      "name": "opencodereview-windows-arm64.exe",
+      "sha256": "a5402e6bf927c5bd042ca67a4fad41e4a92c1d3d06f1dbeee147bf66fdb5486c",
+      "size": 53508608
+    },
+    {
+      "name": "sha256sum.txt",
+      "sha256": "5fe2640d8b521f7ac6ff4880a5227e452226998171c49e728fb23c02d858cd52",
+      "size": 572
+    }
+  ],
+  "classification": "human-review-required",
+  "classification_reasons": [
+    "release notes contain a material or ambiguous compatibility signal"
+  ],
+  "comparison_version": "1.11.5",
+  "contracts": {
+    "comment_arguments_probe": {
+      "comments_per_batch": 2,
+      "failure_arguments_preserved": true,
+      "intact_cases": [
+        "array",
+        "serialized",
+        "repaired"
+      ],
+      "repair_warning": true,
+      "result": "passed",
+      "suspect_batch_rejected": true
+    },
+    "comment_thinking_probe": {
+      "additive_field_preserved": true,
+      "posting_exposes_thinking": false,
+      "result": "passed"
+    },
+    "completion_cap_probe": {
+      "explicit": 4096,
+      "inherited": 16384,
+      "result": "passed",
+      "wire_field": "max_completion_tokens"
+    },
+    "language_rule_probe": {
+      "default_excluded_paths": [
+        "src/test/kotlin/scripts/Example.kts",
+        "test/parser.ml"
+      ],
+      "excluded_extensions": [
+        ".svh"
+      ],
+      "extensions": [
+        ".cjs",
+        ".cxx",
+        ".hxx",
+        ".kts",
+        ".mjs",
+        ".ml",
+        ".mli",
+        ".mm",
+        ".pug",
+        ".re",
+        ".rei",
+        ".sv",
+        ".v",
+        ".vh",
+        ".vhd",
+        ".vhdl"
+      ],
+      "m_routing": "matlab_and_objective_c",
+      "result": "passed",
+      "rule_source": "system_builtin",
+      "selected": 16
+    },
+    "numeric_cli_probe": {
+      "max_tokens_budget": {
+        "cases": {
+          "invalid_below": {
+            "effective": null,
+            "input": -1,
+            "outcome": "rejected"
+          },
+          "minimum": {
+            "effective": 1,
+            "input": 1,
+            "outcome": "accepted"
+          },
+          "omitted": {
+            "effective": "unlimited",
+            "input": null,
+            "outcome": "accepted"
+          },
+          "representative": {
+            "effective": 30000,
+            "input": 30000,
+            "outcome": "accepted"
+          },
+          "sentinel": {
+            "effective": "unlimited",
+            "input": 0,
+            "outcome": "accepted"
+          }
+        },
+        "maximum": null,
+        "owner": "ocr-cli"
+      },
+      "max_tools": {
+        "cases": {
+          "invalid_below": {
+            "effective": null,
+            "input": -1,
+            "outcome": "rejected"
+          },
+          "minimum": {
+            "effective": 100,
+            "input": 50,
+            "outcome": "accepted"
+          },
+          "minimum_minus_one": {
+            "effective": 100,
+            "input": 49,
+            "outcome": "normalized",
+            "reported_normalization": 50
+          },
+          "omitted": {
+            "effective": 100,
+            "input": null,
+            "outcome": "accepted"
+          },
+          "representative": {
+            "effective": 101,
+            "input": 101,
+            "outcome": "accepted"
+          },
+          "sentinel": {
+            "effective": 100,
+            "input": 0,
+            "outcome": "accepted"
+          }
+        },
+        "maximum": null,
+        "owner": "ocr-template-or-higher-cli",
+        "reported_minimum": 50
+      },
+      "result": "passed"
+    },
+    "optional_capabilities": [
+      "llm_result_identity",
+      "per_run_model_override",
+      "per_run_provider_override",
+      "review_effort",
+      "semantic_grouping"
+    ],
+    "preview_probe": {
+      "format": "json",
+      "path": "example.py",
+      "result": "passed",
+      "session_store_created": false
+    },
+    "reasoning_effort_probe": {
+      "efforts": [
+        "unset",
+        "none",
+        "high"
+      ],
+      "protocols": [
+        "openai",
+        "openai-responses"
+      ],
+      "provider_acceptance": "not-tested",
+      "responses_siblings_preserved": true,
+      "result": "passed"
+    },
+    "required_review_flags": [
+      "--audience",
+      "--background-file",
+      "--effort",
+      "--format",
+      "--from",
+      "--max-tokens-budget",
+      "--max-tools",
+      "--preview",
+      "--rule",
+      "--to"
+    ],
+    "result_contract_probe": {
+      "additive_fields_allowed": true,
+      "comment_fields": [
+        "category",
+        "content",
+        "end_line",
+        "existing_code",
+        "path",
+        "severity",
+        "start_line",
+        "thinking"
+      ],
+      "manifest_schema": "ocr.run-manifest/v1",
+      "normalized_outcome": "clean",
+      "result": "passed"
+    },
+    "review_budget_probe": {
+      "budget": 30000,
+      "completed": 2,
+      "failed_budget": 1,
+      "grouping_requests": 0,
+      "grouping_strategy": "per_file",
+      "partial_findings_preserved": true,
+      "result": "passed",
+      "selected": 3
+    },
+    "semantic_grouping_probe": {
+      "default_effort": "medium",
+      "files": 4,
+      "filter_requests": 1,
+      "grouping_completion_cap": 16384,
+      "grouping_requests": 1,
+      "main_requests": 3,
+      "prior_finding_semantics": "filter_survivors_as_confirmed",
+      "recheck_instruction_requests": 3,
+      "result": "passed",
+      "review_rounds": 2
+    },
+    "small_change_grouping_probe": {
+      "grouping_requests": 0,
+      "high_churn": "per_file",
+      "low_churn": "bundle_all",
+      "result": "passed",
+      "single_file": "per_file",
+      "threshold_files": 4
+    },
+    "target_rule_selection_probe": {
+      "format": "json",
+      "from_to_unchanged": true,
+      "path": "synthetic-template.ocrfixture",
+      "result": "passed",
+      "source_exclusion": "unsupported_ext",
+      "target_selected": true
+    },
+    "version_probe": "passed"
+  },
+  "published_at": "2026-09-07T07:22:48Z",
+  "release_changes": "## 🚀 Features\n\n- feat(allowlist): add OCaml/ReasonML language support (#942) (#951)\n- feat(action): first-class review controls (effort, max_tokens_budget, llm_reasoning_effort) and live progress (#1154)\n- feat(viewer): number the lines inside the Existing Code block (#1172) (#1180)\n\n## 🐛 Bug Fixes\n\n- fix(launcher): forward SIGINT/SIGTERM signals to child process (#1145)\n- fix(rules): route Kotlin script files to Kotlin review rules (#1091)\n\n## 📖 Documentation\n\n- docs(pages): correct FAQ JSON output shape and plan-threshold cost lever (#1190)\n- docs(pages): correct the developer guide to match the actual project (#1182)\n\n## Other Changes\n\n- Honor timeout_sec for openai-go's ResponseHeaderTimeout (#1161) (#1162)\n\n**Full Changelog**: https://github.com/alibaba/open-code-review/compare/v1.11.5...v1.11.6",
+  "release_notes_sha256": "ff62a35907aba038dedc23b6746e42f46066046a950001a50591f79194d27ecb",
+  "result": "compatible",
+  "schema_version": 3,
+  "tag": "v1.11.6",
+  "tested_baseline_version": "1.11.5",
+  "upstream_repository": "alibaba/open-code-review",
+  "version": "1.11.6"
+}