open-code-review-toolkit 0.11.0__tar.gz → 0.11.2__tar.gz

{open_code_review_toolkit-0.11.0 → open_code_review_toolkit-0.11.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: open-code-review-toolkit
-Version: 0.11.0
+Version: 0.11.2
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -228,6 +228,7 @@ Requires-Dist: certifi<2027,>=2026.7.22
 Requires-Dist: httpx2<3,>=2.13.0
 Requires-Dist: jsonschema<5,>=4.26.0
 Requires-Dist: mcp<3,>=2.2.0
+Requires-Dist: pyjwt<3,>=2.15.0
 Description-Content-Type: text/markdown
 
 # Open Code Review Toolkit

{open_code_review_toolkit-0.11.0 → open_code_review_toolkit-0.11.2}/pyproject.toml

@@ -25,6 +25,8 @@ classifiers = [
 ]
 dependencies = [
   "mcp>=2.2.0,<3",
+  # MCP crypto accepts older PyJWT; enforce its security floor for resolver installs.
+  "PyJWT>=2.15.0,<3",
   "jsonschema>=4.26.0,<5",
   "httpx2>=2.13.0,<3",
   "anyio>=4.10.0,<5",
@@ -52,7 +54,7 @@ dev = [
   "pytest>=9.1.1",
   "pytest-cov>=7.1.0",
   "ruff>=0.16.7",
-  "setuptools-scm==10.2.3",
+  "setuptools-scm==10.3.4",
   "towncrier>=26.9.0",
   "twine>=7.0.0",
   "types-jsonschema>=4.26.0.20260518",

{open_code_review_toolkit-0.11.0 → open_code_review_toolkit-0.11.2}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.11.0'
-__version_tuple__ = version_tuple = (0, 11, 0)
+__version__ = version = '0.11.2'
+__version_tuple__ = version_tuple = (0, 11, 2)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.11.0 → open_code_review_toolkit-0.11.2}/src/ocr_toolkit/cli.py

@@ -94,7 +94,8 @@ def main(argv: Sequence[str] | None = None) -> int:
                 **({"debug_dir": Path(args.debug_dir)} if args.debug_dir is not None else {}),
             )
         except review_runner.ReviewRunnerError as exc:
-            print(f"Cannot run Open Code Review: {exc}", file=sys.stderr)
+            if not isinstance(exc, review_runner.ReviewRejected):
+                print(f"Cannot run Open Code Review: {exc}", file=sys.stderr)
             return 2
     if args.command == "post":
         return posting_main([args.result, args.stderr])

{open_code_review_toolkit-0.11.0 → open_code_review_toolkit-0.11.2}/src/ocr_toolkit/ocr_result.py

@@ -19,6 +19,7 @@ from ocr_toolkit.common.redaction import sanitize_ocr_value
 DEFAULT_MAX_RESULT_BYTES = 2_000_000
 MAX_RESULT_BYTES_HARD_LIMIT = 20_000_000
 TOOLKIT_RESULT_KEY = "_ocr_toolkit"
+TOOLKIT_PRIVATE_DIAGNOSTIC_KEY = "_ocr_toolkit_private_diagnostic"
 TOOLKIT_RESULT_SCHEMA_VERSION = 9
 SUPPORTED_TOOLKIT_RESULT_SCHEMA_VERSIONS = frozenset({TOOLKIT_RESULT_SCHEMA_VERSION})
 TOOLKIT_ADVISORY_KEY = "_ocr_toolkit_advisory"

{open_code_review_toolkit-0.11.0 → open_code_review_toolkit-0.11.2}/src/ocr_toolkit/posting/workflow.py

@@ -18,6 +18,7 @@ from ocr_toolkit.common.markdown import markdown_code_block, neutralize_quick_ac
 from ocr_toolkit.evidence.artifacts import repository_artifacts
 from ocr_toolkit.ocr_result import (
     TOOLKIT_ADVISORY_KEY,
+    TOOLKIT_PRIVATE_DIAGNOSTIC_KEY,
     TOOLKIT_RESULT_KEY,
     OcrResultMalformed,
     OcrResultMissing,
@@ -666,6 +667,11 @@ def post_results(config: GitLabConfig, result: dict[str, Any]) -> int:
         print_posting_failure_banner()
         return 1
 
+    if TOOLKIT_PRIVATE_DIAGNOSTIC_KEY in result:
+        return invalid_ocr_schema_exit(
+            config, "private diagnostic result is not publication-eligible"
+        )
+
     toolkit_metadata = result.get(TOOLKIT_RESULT_KEY)
     if toolkit_metadata is not None and not toolkit_receipt_is_valid(toolkit_metadata):
         return invalid_ocr_schema_exit(

{open_code_review_toolkit-0.11.0 → open_code_review_toolkit-0.11.2}/src/ocr_toolkit/preflight.py

@@ -29,7 +29,7 @@ DEFAULT_REQUEST_HEADERS = {
     "Accept": "application/json",
     "User-Agent": "open-code-review-ci-preflight/1.0",
 }
-RECOMMENDED_OCR_VERSION = "1.12.7"
+RECOMMENDED_OCR_VERSION = "1.12.11"
 SUPPORTED_OCR_VERSIONS = (
     "1.11.0",
     "1.11.1",
@@ -49,8 +49,16 @@ SUPPORTED_OCR_VERSIONS = (
     "1.12.5",
     "1.12.6",
     "1.12.7",
+    "1.12.8",
+    "1.12.9",
+    "1.12.10",
+    "1.12.11",
+)
+DEPRECATED_OCR_VERSIONS = (
+    "1.10.0",
+    "1.10.1",
+    "1.10.2",
 )
-DEPRECATED_OCR_VERSIONS = ("1.10.0", "1.10.1", "1.10.2")
 # Retain the public constant as the recommended pin, not as the runtime acceptance policy.
 EXPECTED_OCR_VERSION = RECOMMENDED_OCR_VERSION
 

{open_code_review_toolkit-0.11.0 → open_code_review_toolkit-0.11.2}/src/ocr_toolkit/review_runner.py

@@ -89,6 +89,7 @@ from ocr_toolkit.ocr_result import (
     MAX_TOOLKIT_MCP_USAGE_COUNT,
     PUBLIC_REVIEW_TOOL_CALL_NAMES,
     TOOLKIT_ADVISORY_KEY,
+    TOOLKIT_PRIVATE_DIAGNOSTIC_KEY,
     TOOLKIT_RESULT_KEY,
     TOOLKIT_RESULT_SCHEMA_VERSION,
     OcrResultMalformed,
@@ -143,7 +144,7 @@ from ocr_toolkit.reporting.model import (
     failed_report,
     report_from_result,
 )
-from ocr_toolkit.result_contract import OcrResultContractError, parse_result_outcome
+from ocr_toolkit.result_contract import OcrResultContractError, ReviewOutcome, parse_result_outcome
 from ocr_toolkit.result_usage import normalize_token_usage, token_usage_mapping
 from ocr_toolkit.review_debug import DebugBundle, DebugStatus
 from ocr_toolkit.review_progress import ReviewProgress, progress_enabled
@@ -210,7 +211,35 @@ MAX_TOOL_FAILURE_LOG_FIELD_CHARS = 500
 
 
 class ReviewRunnerError(Exception):
-    """The local OCR review process could not be started safely."""
+    """OCR execution or result admission failed safely."""
+
+
+class ReviewRejected(ReviewRunnerError):
+    """Carry closed admission facts without guessing the execution cause."""
+
+    def __init__(self, reason: str, outcome: ReviewOutcome, calls: int | None) -> None:
+        self.reason = reason
+        self.calls = calls
+        self.outcome = outcome
+        reported = "unavailable" if calls is None else str(calls)
+        detail = (
+            "required evidence use was not confirmed by OCR result telemetry"
+            if reason == "evidence-use-unconfirmed"
+            else "mandatory evidence summary action attribution was not confirmed"
+            if outcome.requires_evidence_mcp
+            else "evidence action attribution was not confirmed"
+        )
+        super().__init__(
+            f"{detail} (reported calls: {reported}; reason={reason}). "
+            "Result not accepted for publication or automatic approval."
+        )
+
+    def diagnostic(self) -> str:
+        """Render only parser-validated outcome and coverage counters."""
+        coverage = self.outcome.coverage_summary
+        return f"Review rejected: {self} outcome={self.outcome.kind}" + (
+            f"; {coverage}" if coverage else ""
+        )
 
 
 @dataclass(frozen=True, slots=True)
@@ -480,6 +509,10 @@ def _review_receipt(
         raise ReviewRunnerError(f"OCR result has an unsupported outcome contract: {exc}") from exc
 
     tool_calls = payload.get("tool_calls")
+    if tool_calls is None and "tool_calls" in payload:
+        raise ReviewRunnerError("OCR result has malformed MCP usage telemetry")
+    if tool_calls is None and outcome.requires_evidence_mcp:
+        raise ReviewRejected("evidence-use-unconfirmed", outcome, None)
     by_tool = tool_calls.get("by_tool") if isinstance(tool_calls, dict) else None
     total_calls = tool_calls.get("total") if isinstance(tool_calls, dict) else None
     if tool_calls is None and outcome.kind == "failed":
@@ -516,7 +549,11 @@ def _review_receipt(
             if (
                 not isinstance(count, int)
                 or isinstance(count, bool)
-                or not 0 < count <= MAX_TOOLKIT_MCP_USAGE_COUNT
+                or not (
+                    0 <= count <= MAX_TOOLKIT_MCP_USAGE_COUNT
+                    if tool == TOOL_NAME
+                    else 0 < count <= MAX_TOOLKIT_MCP_USAGE_COUNT
+                )
             ):
                 raise ReviewRunnerError("OCR result has an invalid known MCP usage count")
             owner = owners[tool]
@@ -538,7 +575,8 @@ def _review_receipt(
     }
     evidence_calls = sum(evidence_by_tool.values())
     if outcome.requires_evidence_mcp and not evidence_by_tool[TOOL_NAME]:
-        raise ReviewRunnerError(f"OCR review did not call the mandatory {TOOL_NAME} tool")
+        reported = 0 if total_calls == 0 else by_tool.get(TOOL_NAME)
+        raise ReviewRejected("evidence-use-unconfirmed", outcome, reported)
     try:
         action_attribution = verified_evidence_actions(
             evidence_by_tool,
@@ -546,7 +584,9 @@ def _review_receipt(
             mandatory=outcome.requires_evidence_mcp,
         )
     except ValueError as exc:
-        raise ReviewRunnerError(str(exc)) from exc
+        raise ReviewRejected(
+            "evidence-action-attribution-invalid", outcome, evidence_by_tool[TOOL_NAME]
+        ) from exc
     completed = action_attribution.get("completed")
     failure_state = (
         "absent"
@@ -1485,6 +1525,34 @@ def _publication_projection(
     return projected, publication, True
 
 
+def _retain_private_diagnostic_result(result_path: Path, *, reason: str) -> bool:
+    """Mark bounded rejected execution data without granting publication authority."""
+
+    try:
+        transform_ocr_result(
+            result_path,
+            lambda payload: {
+                TOOLKIT_PRIVATE_DIAGNOSTIC_KEY: {"reason": reason},
+                "result": payload,
+            },
+        )
+    except (OcrResultMalformed, OcrResultMissing, OcrResultTooLarge, OSError):
+        print(
+            "OCR private diagnostic retention failed; original failure preserved.",
+            file=sys.stderr,
+        )
+        try:
+            result_path.unlink(missing_ok=True)
+        except OSError:
+            pass
+        return False
+    print(
+        "OCR rejected result retained as private diagnostics; not posting-eligible.",
+        file=sys.stderr,
+    )
+    return True
+
+
 def _finalize_ocr_result(
     result_path: Path,
     composition: mcp_config.MCPComposition,
@@ -1497,6 +1565,7 @@ def _finalize_ocr_result(
     toolkit_advisory: OcrToolkitAdvisory | None = None,
     report_consumer: Callable[[ReviewReport], None] | None = None,
     state: ReviewRunState | None = None,
+    private_diagnostics: bool = False,
 ) -> tuple[dict[str, int], bool, dict[str, object]]:
     """Validate, DLP-project, and receipt-bind one result in one atomic read/replace."""
 
@@ -1509,7 +1578,7 @@ def _finalize_ocr_result(
 
     def finalize(payload: dict[str, object]) -> dict[str, object]:
         nonlocal failure_telemetry, filtered, publication, usage, report
-        for reserved in (TOOLKIT_RESULT_KEY, TOOLKIT_ADVISORY_KEY):
+        for reserved in (TOOLKIT_RESULT_KEY, TOOLKIT_ADVISORY_KEY, TOOLKIT_PRIVATE_DIAGNOSTIC_KEY):
             if reserved in payload:
                 raise OcrResultMalformed(f"OCR result contains reserved field {reserved!r}")
         warnings = payload.get("warnings", [])
@@ -1566,7 +1635,7 @@ def _finalize_ocr_result(
         finalized = {**projected, TOOLKIT_RESULT_KEY: metadata} if provider_receipt else projected
         if toolkit_advisory is not None and provider_receipt:
             finalized[TOOLKIT_ADVISORY_KEY] = toolkit_advisory_payload(toolkit_advisory)
-        if report_consumer is not None:
+        if report_consumer is not None and not private_diagnostics:
             evidence = metadata.get("evidence")
             if not isinstance(evidence, dict):
                 raise ReviewRunnerError("verified evidence facts are unavailable")
@@ -1585,17 +1654,31 @@ def _finalize_ocr_result(
                 )
             except OcrResultContractError as exc:
                 raise ReviewRunnerError("admitted review report is inconsistent") from exc
+        if private_diagnostics:
+            return {**payload, TOOLKIT_PRIVATE_DIAGNOSTIC_KEY: {"reason": "private-retention"}}
         return finalized
 
     try:
         transform_ocr_result(result_path, finalize)
     except (OcrResultMalformed, OcrResultMissing, OcrResultTooLarge) as exc:
+        if private_diagnostics:
+            try:
+                result_path.unlink(missing_ok=True)
+            except OSError:
+                pass
         raise ReviewRunnerError("OCR result is not valid bounded JSON") from exc
-    except ReviewRunnerError:
-        try:
-            result_path.unlink(missing_ok=True)
-        except OSError:
-            pass
+    except ReviewRunnerError as exc:
+        if isinstance(exc, ReviewRejected):
+            print(exc.diagnostic(), file=sys.stderr)
+        retained = False
+        if private_diagnostics:
+            reason = exc.reason if isinstance(exc, ReviewRejected) else "result-validation-failed"
+            retained = _retain_private_diagnostic_result(result_path, reason=reason)
+        if not retained:
+            try:
+                result_path.unlink(missing_ok=True)
+            except OSError:
+                pass
         raise
     _print_tool_failure_diagnostics(failure_telemetry)
     if state is not None:
@@ -2916,7 +2999,7 @@ def _run_evidence_review(
                     cleanup_error = OSError("federation cleanup could not be verified")
             if state.progress is not None:
                 state.progress.phase("cleanup")
-            if exit_code == 0 and not preserve_authorized:
+            if exit_code == 0:
                 evidence_action_counts = read_action_receipt(artifacts.action_receipt)
             if not preserve_authorized:
                 try:
@@ -2932,7 +3015,7 @@ def _run_evidence_review(
                 os.environ.pop("HOME", None)
             else:
                 os.environ["HOME"] = previous_home
-            if cleanup_error is None and exit_code == 0 and not preserve_authorized:
+            if cleanup_error is None and exit_code == 0:
                 state.enter("result-validation")
                 forbidden: tuple[str | ForbiddenValue, ...] = tuple(
                     ForbiddenValue(v, "operator_secret") for v in composition.secret_values
@@ -2954,15 +3037,20 @@ def _run_evidence_review(
                         forbidden=forbidden,
                         dlp_enabled=dlp_enabled,
                         toolkit_advisory=background_qualification.advisory,
+                        **({"private_diagnostics": True} if preserve_authorized else {}),
                         **({"report_consumer": state.admit_report} if state.local else {}),
                         **({"state": state} if state.local or state.progress is not None else {}),
                     )
                 except ReviewRunnerError:
-                    try:
-                        result_path.unlink(missing_ok=True)
-                    except OSError:
-                        pass
+                    # Authorized diagnostic retention is owned by finalization.
+                    if not preserve_authorized:
+                        try:
+                            result_path.unlink(missing_ok=True)
+                        except OSError:
+                            pass
                     raise
+            if cleanup_error is None and exit_code != 0 and preserve_authorized:
+                _retain_private_diagnostic_result(result_path, reason="execution-failed")
             if cleanup_error is None and exit_code == 0 and preserve_authorized:
                 forbidden = tuple(
                     ForbiddenValue(v, "operator_secret") for v in composition.secret_values
@@ -2991,7 +3079,7 @@ def _run_evidence_review(
         raise ReviewRunnerError("OCR private session cleanup failed") from cleanup_error
     if preserve_authorized:
         print(
-            "OCR private diagnostics retained; result is not posting-eligible "
+            "OCR private session artifacts retained; no posting-eligible result handoff "
             f"session_home={session_home} artifact_directory={artifacts.directory}",
             file=sys.stderr,
         )