open-code-review-toolkit 0.1.0__py3-none-any.whl

ocr_toolkit/preflight.py

@@ -0,0 +1,395 @@
+"""Fail-fast checks for OCR CI before LLM review spend."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+from ocr_toolkit.common.redaction import redact_sensitive
+
+HTTP_TIMEOUT_SECONDS = 30
+MAX_RESPONSE_BODY_BYTES = 2_000_000
+RESPONSE_READ_CHUNK_BYTES = 64 * 1024
+HEADER_NAME_RE = re.compile(r"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$")
+DEFAULT_REQUEST_HEADERS = {
+    "Accept": "application/json",
+    "User-Agent": "open-code-review-ci-preflight/1.0",
+}
+EXPECTED_OCR_VERSION = "1.7.13"
+
+
+class PreflightError(Exception):
+    """A required OCR CI preflight check failed."""
+
+
+class _NoRedirectHandler(urllib.request.HTTPRedirectHandler):
+    """Prevent urllib from forwarding secret headers across redirects."""
+
+    def redirect_request(self, *_args: Any, **_kwargs: Any) -> None:
+        return None
+
+
+URL_OPENER = urllib.request.build_opener(_NoRedirectHandler)
+
+
+def _set_response_timeout(response: Any, timeout: float) -> None:
+    """Best-effort update of the underlying socket timeout before each read."""
+
+    try:
+        sock = response.fp.raw._sock
+    except AttributeError:
+        return
+    sock.settimeout(timeout)
+
+
+def _safe_url(url: str) -> str:
+    """Return a URL safe for CI diagnostics."""
+
+    return redact_sensitive(url)
+
+
+def _env(name: str, default: str = "") -> str:
+    return os.environ.get(name, default).strip()
+
+
+def _gitlab_api_root() -> str:
+    api_root = _env("CI_API_V4_URL")
+    if api_root:
+        return api_root.rstrip("/")
+
+    server_url = _env("CI_SERVER_URL")
+    if not server_url:
+        raise PreflightError("CI_SERVER_URL or CI_API_V4_URL is required")
+    return f"{server_url.rstrip('/')}/api/v4"
+
+
+def _request_json(url: str, headers: dict[str, str]) -> Any:
+    parsed_url = urllib.parse.urlsplit(url)
+    if headers and (parsed_url.scheme != "https" or not parsed_url.netloc):
+        raise PreflightError(f"Refusing to send credentials to non-HTTPS URL: {_safe_url(url)}")
+
+    request_headers: dict[str, str] = dict(DEFAULT_REQUEST_HEADERS)
+    for key, value in headers.items():
+        if not HEADER_NAME_RE.fullmatch(key) or "\r" in value or "\n" in value:
+            raise PreflightError(f"GET {_safe_url(url)} contains an invalid HTTP header")
+        request_headers[key] = value
+
+    raw_body = b""
+    last_error: Exception | None = None
+    deadline = time.monotonic() + HTTP_TIMEOUT_SECONDS
+    retryable_statuses = {408, 429, 500, 502, 503, 504}
+    for attempt in range(3):
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise PreflightError(f"GET {_safe_url(url)} timed out after {HTTP_TIMEOUT_SECONDS}s")
+        request = urllib.request.Request(url, headers=request_headers, method="GET")
+        try:
+            with URL_OPENER.open(request, timeout=remaining) as response:
+                chunks: list[bytes] = []
+                total_bytes = 0
+                while total_bytes < MAX_RESPONSE_BODY_BYTES:
+                    remaining = deadline - time.monotonic()
+                    if remaining <= 0:
+                        raise TimeoutError
+                    _set_response_timeout(response, remaining)
+                    chunk = response.read(
+                        min(RESPONSE_READ_CHUNK_BYTES, MAX_RESPONSE_BODY_BYTES - total_bytes)
+                    )
+                    if not chunk:
+                        break
+                    chunks.append(chunk)
+                    total_bytes += len(chunk)
+                if total_bytes >= MAX_RESPONSE_BODY_BYTES:
+                    remaining = deadline - time.monotonic()
+                    if remaining <= 0:
+                        raise TimeoutError
+                    _set_response_timeout(response, remaining)
+                    if response.read(1):
+                        raise PreflightError(
+                            f"GET {_safe_url(url)} response exceeds {MAX_RESPONSE_BODY_BYTES} bytes"
+                        )
+                raw_body = b"".join(chunks)
+            break
+        except urllib.error.HTTPError as exc:
+            raw_error = exc.read(16_384).decode("utf-8", errors="replace").strip()
+            if exc.code not in retryable_statuses or attempt == 2:
+                detail = f": {redact_sensitive(raw_error)}" if raw_error else ""
+                raise PreflightError(
+                    f"GET {_safe_url(url)} failed with HTTP {exc.code}{detail}"
+                ) from exc
+            last_error = exc
+        except TimeoutError as exc:
+            last_error = exc
+            if attempt == 2:
+                raise PreflightError(
+                    f"GET {_safe_url(url)} timed out after {HTTP_TIMEOUT_SECONDS}s"
+                ) from exc
+        except OSError as exc:
+            last_error = exc
+            if attempt == 2:
+                raise PreflightError(
+                    f"GET {_safe_url(url)} failed: {redact_sensitive(str(exc))}"
+                ) from exc
+        sleep_seconds = min(1.0, max(0.0, deadline - time.monotonic()))
+        if sleep_seconds:
+            time.sleep(sleep_seconds)
+    else:
+        raise PreflightError(f"GET {_safe_url(url)} failed: {redact_sensitive(str(last_error))}")
+
+    if not raw_body:
+        return None
+
+    try:
+        return json.loads(raw_body.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise PreflightError(f"GET {_safe_url(url)} returned non-JSON metadata") from exc
+
+
+def validate_gitlab_access() -> None:
+    """Verify the configured bot token can read this project and MR."""
+
+    token = _env("GITLAB_API_TOKEN")
+    project_id = _env("CI_PROJECT_ID")
+    mr_iid = _env("CI_MERGE_REQUEST_IID")
+    if not token:
+        raise PreflightError("GITLAB_API_TOKEN is required")
+    if not project_id or not mr_iid:
+        raise PreflightError("CI_PROJECT_ID and CI_MERGE_REQUEST_IID are required")
+
+    api_root = _gitlab_api_root()
+    project_id_encoded = urllib.parse.quote_plus(project_id)
+    headers = {"PRIVATE-TOKEN": token}
+
+    print("Validating GitLab token access to project and merge request")
+    _request_json(f"{api_root}/user", headers)
+    _request_json(f"{api_root}/projects/{project_id_encoded}", headers)
+    _request_json(f"{api_root}/projects/{project_id_encoded}/merge_requests/{mr_iid}", headers)
+
+
+def validate_ocr_binary() -> None:
+    """Verify that the external OCR binary has the supported release."""
+
+    executable = shutil.which("ocr")
+    if executable is None:
+        raise PreflightError(
+            "Open Code Review binary 'ocr' was not found on PATH; install it separately"
+        )
+    try:
+        completed = subprocess.run(
+            [executable, "--version"],
+            check=False,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=10,
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise PreflightError(f"Cannot run ocr --version: {redact_sensitive(str(exc))}") from exc
+    output = f"{completed.stdout}\n{completed.stderr}".strip()
+    if completed.returncode != 0:
+        raise PreflightError(
+            f"ocr --version exited {completed.returncode}: {redact_sensitive(output)}"
+        )
+    if not re.search(rf"(?<![0-9.])v?{re.escape(EXPECTED_OCR_VERSION)}(?![0-9.])", output):
+        raise PreflightError(
+            f"Unsupported Open Code Review version; expected {EXPECTED_OCR_VERSION}, "
+            f"got {redact_sensitive(output)!r}"
+        )
+    print(f"Open Code Review binary validated: {EXPECTED_OCR_VERSION}")
+
+
+def _models_url() -> str:
+    explicit_url = _env("OCR_LLM_MODELS_URL")
+    if explicit_url:
+        return explicit_url
+
+    base = ""
+    llm_url = _env("OCR_LLM_URL")
+    if not base:
+        normalized_llm_url = llm_url.rstrip("/")
+        for endpoint in ("/chat/completions", "/responses"):
+            if normalized_llm_url.endswith(endpoint):
+                base = normalized_llm_url[: -len(endpoint)]
+                break
+        else:
+            if normalized_llm_url.endswith("/v1"):
+                base = normalized_llm_url
+
+    if not base:
+        raise PreflightError(
+            "Cannot derive LLM /models URL; set OCR_LLM_MODELS_URL or "
+            "set OCR_LLM_VALIDATE_MODEL=false"
+        )
+    return f"{base.rstrip('/')}/models"
+
+
+def _parse_extra_headers(value: str) -> dict[str, str]:
+    """Parse optional OCR LLM extra headers JSON for preflight metadata calls."""
+
+    if not value.strip():
+        return {}
+    try:
+        payload = json.loads(value)
+    except json.JSONDecodeError as exc:
+        raise PreflightError("OCR_LLM_EXTRA_HEADERS must be a JSON object") from exc
+    if not isinstance(payload, dict):
+        raise PreflightError("OCR_LLM_EXTRA_HEADERS must be a JSON object")
+
+    headers: dict[str, str] = {}
+    for key, header_value in payload.items():
+        if not isinstance(key, str) or not HEADER_NAME_RE.fullmatch(key.strip()):
+            raise PreflightError("OCR_LLM_EXTRA_HEADERS contains an invalid header name")
+        if not isinstance(header_value, str):
+            raise PreflightError("OCR_LLM_EXTRA_HEADERS contains a non-string header value")
+        if "\r" in header_value or "\n" in header_value:
+            raise PreflightError("OCR_LLM_EXTRA_HEADERS contains an invalid header value")
+        headers[key.strip()] = header_value
+    return headers
+
+
+def _llm_headers(token: str) -> dict[str, str]:
+    """Build the same auth/header set used by OCR's llm.* configuration."""
+
+    auth_header = _env("OCR_LLM_AUTH_HEADER", "Authorization") or "Authorization"
+    if not HEADER_NAME_RE.fullmatch(auth_header):
+        raise PreflightError("OCR_LLM_AUTH_HEADER is not a valid HTTP header name")
+    headers = _parse_extra_headers(_env("OCR_LLM_EXTRA_HEADERS"))
+    headers[auth_header] = f"Bearer {token}"
+    return headers
+
+
+def _context_length(model: dict[str, Any]) -> int:
+    for key in (
+        "context_length",
+        "contextLength",
+        "max_context_length",
+        "maxContextLength",
+    ):
+        value = model.get(key)
+        if value is None:
+            continue
+        try:
+            parsed = int(value)
+        except (TypeError, ValueError):
+            continue
+        if parsed > 0:
+            return parsed
+    return 0
+
+
+def _allowed_models() -> list[str]:
+    """Return exact model ids allowed without querying gateway metadata."""
+
+    value = _env("OCR_LLM_ALLOWED_MODELS")
+    if not value:
+        return []
+    return [item.strip() for item in value.split(",") if item.strip()]
+
+
+def _is_allowed_model(model_id: str) -> bool:
+    """Return whether model id is in the optional offline allowlist."""
+
+    allowed = _allowed_models()
+    if not allowed:
+        return False
+    return model_id in allowed
+
+
+def _validate_allowed_model(model_id: str) -> bool:
+    """Validate model id against the optional offline allowlist."""
+
+    allowed = _allowed_models()
+    if not allowed:
+        return False
+    if not _is_allowed_model(model_id):
+        raise PreflightError(f"OCR_LLM_MODEL {model_id!r} is not listed in OCR_LLM_ALLOWED_MODELS")
+    print(f"OCR model allowed by OCR_LLM_ALLOWED_MODELS: {model_id}")
+    return True
+
+
+def validate_llm_model() -> None:
+    """Verify the selected model exists in OpenAI-compatible metadata."""
+
+    model_id = _env("OCR_LLM_MODEL")
+    if not model_id:
+        raise PreflightError("OCR_LLM_MODEL is required")
+    allowlist_matched = _validate_allowed_model(model_id)
+
+    validate_mode = _env("OCR_LLM_VALIDATE_MODEL", "false").lower()
+    if validate_mode in {"false", "0", "no", "off"}:
+        print("OCR LLM /models validation disabled by OCR_LLM_VALIDATE_MODEL=false")
+        return
+    if validate_mode not in {"true", "1", "yes", "on", "auto"}:
+        raise PreflightError("OCR_LLM_VALIDATE_MODEL must be true, false, or auto")
+
+    token = _env("OCR_LLM_TOKEN")
+    if not token:
+        raise PreflightError("OCR_LLM_TOKEN is required")
+    headers = _llm_headers(token)
+
+    print("Validating OCR model against LLM gateway metadata")
+    try:
+        models_url = _models_url()
+    except PreflightError as exc:
+        if validate_mode == "auto" and allowlist_matched:
+            print(
+                "OCR LLM /models URL unavailable; continuing because "
+                f"OCR_LLM_MODEL is allowlisted: {redact_sensitive(str(exc))}",
+                file=sys.stderr,
+            )
+            return
+        raise
+    try:
+        payload = _request_json(models_url, headers)
+    except PreflightError as exc:
+        if validate_mode == "auto" and allowlist_matched:
+            print(
+                "OCR LLM /models validation unavailable; continuing because "
+                f"OCR_LLM_MODEL is allowlisted: {redact_sensitive(str(exc))}",
+                file=sys.stderr,
+            )
+            return
+        raise
+    items = payload.get("data") if isinstance(payload, dict) else payload
+    if not isinstance(items, list):
+        raise PreflightError("LLM /models response is not a model list")
+
+    matched_model = next(
+        (item for item in items if isinstance(item, dict) and item.get("id") == model_id),
+        None,
+    )
+    if matched_model is None:
+        raise PreflightError(f"Gateway model {model_id!r} was not found in /models")
+
+    context_length = _context_length(matched_model)
+    if context_length <= 0:
+        print(f"LLM model validated: {model_id} context_length=unknown")
+        return
+    print(f"LLM model validated: {model_id} context_length={context_length}")
+
+
+def main() -> int:
+    """Run all fail-fast checks."""
+
+    try:
+        validate_ocr_binary()
+        validate_gitlab_access()
+        validate_llm_model()
+    except PreflightError as exc:
+        print(f"OCR preflight failed: {redact_sensitive(str(exc))}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ocr_toolkit/py.typed

@@ -0,0 +1 @@
+

open_code_review_toolkit-0.1.0.dist-info/METADATA

@@ -0,0 +1,283 @@
+Metadata-Version: 2.4
+Name: open-code-review-toolkit
+Version: 0.1.0
+Summary: Unofficial GitLab CI integration layer for Open Code Review
+Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
+Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
+Project-URL: Issues, https://github.com/xeonvs/open-code-review-toolkit/issues
+Project-URL: Changelog, https://github.com/xeonvs/open-code-review-toolkit/blob/main/CHANGELOG.md
+Author: Open Code Review Toolkit contributors
+License: 
+                                         Apache License
+                                   Version 2.0, January 2004
+                                http://www.apache.org/licenses/
+        
+           TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+        
+           1. Definitions.
+        
+              "License" shall mean the terms and conditions for use, reproduction,
+              and distribution as defined by Sections 1 through 9 of this document.
+        
+              "Licensor" shall mean the copyright owner or entity authorized by
+              the copyright owner that is granting the License.
+        
+              "Legal Entity" shall mean the union of the acting entity and all
+              other entities that control, are controlled by, or are under common
+              control with that entity. For the purposes of this definition,
+              "control" means (i) the power, direct or indirect, to cause the
+              direction or management of such entity, whether by contract or
+              otherwise, or (ii) ownership of fifty percent (50%) or more of the
+              outstanding shares, or (iii) beneficial ownership of such entity.
+        
+              "You" (or "Your") shall mean an individual or Legal Entity
+              exercising permissions granted by this License.
+        
+              "Source" form shall mean the preferred form for making modifications,
+              including but not limited to software source code, documentation
+              source, and configuration files.
+        
+              "Object" form shall mean any form resulting from mechanical
+              transformation or translation of a Source form, including but
+              not limited to compiled object code, generated documentation,
+              and conversions to other media types.
+        
+              "Work" shall mean the work of authorship, whether in Source or
+              Object form, made available under the License, as indicated by a
+              copyright notice that is included in or attached to the work
+              (an example is provided in the Appendix below).
+        
+              "Derivative Works" shall mean any work, whether in Source or Object
+              form, that is based on (or derived from) the Work and for which the
+              editorial revisions, annotations, elaborations, or other modifications
+              represent, as a whole, an original work of authorship. For the purposes
+              of this License, Derivative Works shall not include works that remain
+              separable from, or merely link (or bind by name) to the interfaces of,
+              the Work and Derivative Works thereof.
+        
+              "Contribution" shall mean any work of authorship, including
+              the original version of the Work and any modifications or additions
+              to that Work or Derivative Works thereof, that is intentionally
+              submitted to Licensor for inclusion in the Work by the copyright owner
+              or by an individual or Legal Entity authorized to submit on behalf of
+              the copyright owner. For the purposes of this definition, "submitted"
+              means any form of electronic, verbal, or written communication sent
+              to the Licensor or its representatives, including but not limited to
+              communication on electronic mailing lists, source code control systems,
+              and issue tracking systems that are managed by, or on behalf of, the
+              Licensor for the purpose of discussing and improving the Work, but
+              excluding communication that is conspicuously marked or otherwise
+              designated in writing by the copyright owner as "Not a Contribution."
+        
+              "Contributor" shall mean Licensor and any individual or Legal Entity
+              on behalf of whom a Contribution has been received by Licensor and
+              subsequently incorporated within the Work.
+        
+           2. Grant of Copyright License. Subject to the terms and conditions of
+              this License, each Contributor hereby grants to You a perpetual,
+              worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+              copyright license to reproduce, prepare Derivative Works of,
+              publicly display, publicly perform, sublicense, and distribute the
+              Work and such Derivative Works in Source or Object form.
+        
+           3. Grant of Patent License. Subject to the terms and conditions of
+              this License, each Contributor hereby grants to You a perpetual,
+              worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+              (except as stated in this section) patent license to make, have made,
+              use, offer to sell, sell, import, and otherwise transfer the Work,
+              where such license applies only to those patent claims licensable
+              by such Contributor that are necessarily infringed by their
+              Contribution(s) alone or by combination of their Contribution(s)
+              with the Work to which such Contribution(s) was submitted. If You
+              institute patent litigation against any entity (including a
+              cross-claim or counterclaim in a lawsuit) alleging that the Work
+              or a Contribution incorporated within the Work constitutes direct
+              or contributory patent infringement, then any patent licenses
+              granted to You under this License for that Work shall terminate
+              as of the date such litigation is filed.
+        
+           4. Redistribution. You may reproduce and distribute copies of the
+              Work or Derivative Works thereof in any medium, with or without
+              modifications, and in Source or Object form, provided that You
+              meet the following conditions:
+        
+              (a) You must give any other recipients of the Work or
+                  Derivative Works a copy of this License; and
+        
+              (b) You must cause any modified files to carry prominent notices
+                  stating that You changed the files; and
+        
+              (c) You must retain, in the Source form of any Derivative Works
+                  that You distribute, all copyright, patent, trademark, and
+                  attribution notices from the Source form of the Work,
+                  excluding those notices that do not pertain to any part of
+                  the Derivative Works; and
+        
+              (d) If the Work includes a "NOTICE" text file as part of its
+                  distribution, then any Derivative Works that You distribute must
+                  include a readable copy of the attribution notices contained
+                  within such NOTICE file, excluding those notices that do not
+                  pertain to any part of the Derivative Works, in at least one
+                  of the following places: within a NOTICE text file distributed
+                  as part of the Derivative Works; within the Source form or
+                  documentation, if provided along with the Derivative Works; or,
+                  within a display generated by the Derivative Works, if and
+                  wherever such third-party notices normally appear. The contents
+                  of the NOTICE file are for informational purposes only and
+                  do not modify the License. You may add Your own attribution
+                  notices within Derivative Works that You distribute, alongside
+                  or as an addendum to the NOTICE text from the Work, provided
+                  that such additional attribution notices cannot be construed
+                  as modifying the License.
+        
+              You may add Your own copyright statement to Your modifications and
+              may provide additional or different license terms and conditions
+              for use, reproduction, or distribution of Your modifications, or
+              for any such Derivative Works as a whole, provided Your use,
+              reproduction, and distribution of the Work otherwise complies with
+              the conditions stated in this License.
+        
+           5. Submission of Contributions. Unless You explicitly state otherwise,
+              any Contribution intentionally submitted for inclusion in the Work
+              by You to the Licensor shall be under the terms and conditions of
+              this License, without any additional terms or conditions.
+              Notwithstanding the above, nothing herein shall supersede or modify
+              the terms of any separate license agreement you may have executed
+              with Licensor regarding such Contributions.
+        
+           6. Trademarks. This License does not grant permission to use the trade
+              names, trademarks, service marks, or product names of the Licensor,
+              except as required for reasonable and customary use in describing the
+              origin of the Work and reproducing the content of the NOTICE file.
+        
+           7. Disclaimer of Warranty. Unless required by applicable law or
+              agreed to in writing, Licensor provides the Work (and each
+              Contributor provides its Contributions) on an "AS IS" BASIS,
+              WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+              implied, including, without limitation, any warranties or conditions
+              of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+              PARTICULAR PURPOSE. You are solely responsible for determining the
+              appropriateness of using or redistributing the Work and assume any
+              risks associated with Your exercise of permissions under this License.
+        
+           8. Limitation of Liability. In no event and under no legal theory,
+              whether in tort (including negligence), contract, or otherwise,
+              unless required by applicable law (such as deliberate and grossly
+              negligent acts) or agreed to in writing, shall any Contributor be
+              liable to You for damages, including any direct, indirect, special,
+              incidental, or consequential damages of any character arising as a
+              result of this License or out of the use or inability to use the
+              Work (including but not limited to damages for loss of goodwill,
+              work stoppage, computer failure or malfunction, or any and all
+              other commercial damages or losses), even if such Contributor
+              has been advised of the possibility of such damages.
+        
+           9. Accepting Warranty or Additional Liability. While redistributing
+              the Work or Derivative Works thereof, You may choose to offer,
+              and charge a fee for, acceptance of support, warranty, indemnity,
+              or other liability obligations and/or rights consistent with this
+              License. However, in accepting such obligations, You may act only
+              on Your own behalf and on Your sole responsibility, not on behalf
+              of any other Contributor, and only if You agree to indemnify,
+              defend, and hold each Contributor harmless for any liability
+              incurred by, or claims asserted against, such Contributor by reason
+              of your accepting any such warranty or additional liability.
+        
+           END OF TERMS AND CONDITIONS
+        
+           APPENDIX: How to apply the Apache License to your work.
+        
+              To apply the Apache License to your work, attach the following
+              boilerplate notice, with the fields enclosed by brackets "[]"
+              replaced with your own identifying information. (Don't include
+              the brackets!)  The text should be enclosed in the appropriate
+              comment syntax for the file format. We also recommend that a
+              file or class name and description of purpose be included on the
+              same "printed page" as the copyright notice for easier
+              identification within third-party archives.
+        
+           Copyright [yyyy] [name of copyright owner]
+        
+           Licensed under the Apache License, Version 2.0 (the "License");
+           you may not use this file except in compliance with the License.
+           You may obtain a copy of the License at
+        
+               http://www.apache.org/licenses/LICENSE-2.0
+        
+           Unless required by applicable law or agreed to in writing, software
+           distributed under the License is distributed on an "AS IS" BASIS,
+           WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+           See the License for the specific language governing permissions and
+           limitations under the License.
+License-File: LICENSE
+Keywords: ci,code-review,gitlab,open-code-review
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Typing :: Typed
+Requires-Python: <3.15,>=3.10
+Description-Content-Type: text/markdown
+
+# Open Code Review Toolkit
+
+Open Code Review Toolkit is an unofficial GitLab CI integration layer for [Alibaba Open Code Review](https://github.com/alibaba/open-code-review). It provides bounded repository context generation, environment-driven OCR configuration, preflight validation, and safe GitLab merge-request posting. It does **not** bundle or download the `ocr` binary.
+
+> [!NOTE]
+> The project is under active development. It currently targets Python 3.10-3.14 on Linux and macOS; the public API, CLI, environment contract, and generated schemas may evolve before 1.0.
+
+## Install
+
+Install the Python package from PyPI and install a supported OCR binary separately:
+
+```console
+python -m pip install open-code-review-toolkit
+ocr --version
+ocr-ci --help
+```
+
+The current compatibility target is OCR `1.7.13`. CI should pin the release and verify its published checksum before execution.
+Review output defaults to English. Set `OCR_REVIEW_LANGUAGE=Russian` to use Russian consistently in both OCR configuration and generated review context.
+
+Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
+
+## GitLab CI quick start
+
+1. Configure protected/masked `GITLAB_API_TOKEN` and LLM variables in GitLab.
+2. Pin and checksum the OCR binary.
+3. Install this package.
+4. Run the five helper stages around `ocr review`:
+
+```console
+ocr-ci preflight
+ocr-ci configure
+ocr-ci mcp-config
+ocr-ci context --output .review-context/dependencies.md
+# run: ocr review ... --format json
+ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
+```
+
+See the fully synthetic [`examples/gitlab/ocr-review.gitlab-ci.yml`](examples/gitlab/ocr-review.gitlab-ci.yml) and the [GitLab guide](docs/gitlab.md).
+
+## Configuration and safety
+
+Configuration is environment-only in v0.1. The [configuration reference](docs/configuration.md) documents supported `OCR_*`, `CI_*`, `GITLAB_*`, and MCP inputs. Posting requires `GITLAB_API_TOKEN`; job tokens and legacy aliases are deliberately unsupported.
+
+Repository content, OCR output, and provider responses are untrusted inputs. The toolkit applies bounded reads and writes, secret redaction, Unicode normalization, Markdown/quick-action neutralization, fingerprinted comments, ownership boundaries for human replies, and rollback controls. Review the [security and trust model](docs/security.md) before enabling write access.
+
+## Development and release
+
+- [Contributing](CONTRIBUTING.md)
+- [Development guide](docs/development.md)
+- [Security policy](SECURITY.md)
+- [Release process](docs/release.md)
+- [Changelog](CHANGELOG.md)
+
+Licensed under Apache-2.0.