open-code-review-toolkit 0.12.0__tar.gz → 0.12.1__tar.gz

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/.gitignore

@@ -16,3 +16,4 @@ dist/
 .idea/
 *.log
 .codex
+.playwright-cli/

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: open-code-review-toolkit
-Version: 0.12.0
+Version: 0.12.1
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -242,6 +242,8 @@ Description-Content-Type: text/markdown
 
 Open Code Review Toolkit is an unofficial review control and integration layer for [Alibaba Open Code Review](https://github.com/alibaba/open-code-review), with GitLab CI and standalone local providers. It provides bounded repository evidence, a compact review bootstrap, a built-in read-only MCP server, environment-driven OCR configuration, preflight validation, local Markdown reports, and safe GitLab merge-request posting. It does **not** bundle or download the `ocr` binary.
 
+[Explore the toolkit site](https://open-code-review-toolkit.pages.dev/) for a quick overview, demo video, and latest release notes.
+
 > [!NOTE]
 > The project is under active development; the public API, CLI, environment contract, and generated schemas may evolve before 1.0.
 
@@ -319,7 +321,7 @@ On a successful rerun, the toolkit replaces untouched OCR-only notes instead of
 
 Suppression uses both the GitLab diff position and a stable finding fingerprint, so ordinary line shifts do not normally bring the same bug back. A materially changed finding can still receive a new discussion. See [GitLab review operations](docs/operations.md) for the complete lifecycle, posting modes, permissions, failure behavior, and Mermaid state diagram.
 
-After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v9's exact reviewed source SHA, target SHA/protection state, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v10's exact reviewed source SHA, target SHA/protection state, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
 
 Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable target-ref decisions and never lets a source change self-authorize its review. Root and nested target `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
 

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/README.md

@@ -9,6 +9,8 @@
 
 Open Code Review Toolkit is an unofficial review control and integration layer for [Alibaba Open Code Review](https://github.com/alibaba/open-code-review), with GitLab CI and standalone local providers. It provides bounded repository evidence, a compact review bootstrap, a built-in read-only MCP server, environment-driven OCR configuration, preflight validation, local Markdown reports, and safe GitLab merge-request posting. It does **not** bundle or download the `ocr` binary.
 
+[Explore the toolkit site](https://open-code-review-toolkit.pages.dev/) for a quick overview, demo video, and latest release notes.
+
 > [!NOTE]
 > The project is under active development; the public API, CLI, environment contract, and generated schemas may evolve before 1.0.
 
@@ -86,7 +88,7 @@ On a successful rerun, the toolkit replaces untouched OCR-only notes instead of
 
 Suppression uses both the GitLab diff position and a stable finding fingerprint, so ordinary line shifts do not normally bring the same bug back. A materially changed finding can still receive a new discussion. See [GitLab review operations](docs/operations.md) for the complete lifecycle, posting modes, permissions, failure behavior, and Mermaid state diagram.
 
-After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v9's exact reviewed source SHA, target SHA/protection state, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v10's exact reviewed source SHA, target SHA/protection state, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
 
 Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable target-ref decisions and never lets a source change self-authorize its review. Root and nested target `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
 

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.12.0'
-__version_tuple__ = version_tuple = (0, 12, 0)
+__version__ = version = '0.12.1'
+__version_tuple__ = version_tuple = (0, 12, 1)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/src/ocr_toolkit/context/dlp.py

@@ -3,14 +3,20 @@
 from __future__ import annotations
 
 import html
+import ipaddress
 import re
 import unicodedata
 from collections.abc import Iterator, Mapping
 from contextlib import contextmanager
 from contextvars import ContextVar
 from dataclasses import dataclass
+from datetime import date
 
-from ocr_toolkit.common.redaction import redact_env_secret_values, redact_sensitive
+from ocr_toolkit.common.redaction import (
+    SENSITIVE_NAMED_KEY_PATTERN,
+    redact_env_secret_values,
+    redact_sensitive,
+)
 from ocr_toolkit.context.contracts import TextBudgets
 
 EMAIL_RE = re.compile(
@@ -18,6 +24,20 @@ EMAIL_RE = re.compile(
     r"@(?:[a-z0-9-]{1,63}\.)+[a-z]{2,63}(?![a-z0-9_-])"
 )
 PHONE_RE = re.compile(r"(?<!\w)(?:\+?[1-9][\d .()/-]{7,24}\d)(?!\w)")
+PURE_CREDENTIAL_ASSIGNMENT_RE = re.compile(
+    rf"(?im)^[ \t]*{SENSITIVE_NAMED_KEY_PATTERN}[ \t]*:[ \t]*"
+    r"(?:(?P<quote>['\"])\{\{[ \t]*[A-Za-z_][A-Za-z0-9_]*[ \t]*\}\}(?P=quote)|"
+    r"(?P<empty>\"\"|''))[ \t]*$"
+)
+ISO_DATE_RE = re.compile(r"(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})")
+VERSION_CONTEXT_RE = re.compile(r"(?i)\b(?:version|release|build|pin)[ \t]+(?:v)?$")
+DATE_CONTEXT_RE = re.compile(
+    r"(?i)\b(?:date|dated|on|since|until|before|after|expires)(?:[ \t]+on)?[ \t]+$"
+)
+IP_CONTEXT_RE = re.compile(
+    r"(?i)(?:\b|_)(?:ipv4|ip|cidr|subnet|address|host|loginhost|listen|allow|network)\b"
+)
+PHONE_CONTEXT_RE = re.compile(r"(?i)\b(?:call|phone|tel|contact)[ \t]*$")
 MARKDOWN_DEST_RE = re.compile(
     r"(?:\]\(\s*<?(?:https?://|mailto:)|^\s*\[[^\]\n]+\]:\s*<?(?:https?://|mailto:)|"
     r"<(?:https?://|mailto:))",
@@ -95,11 +115,59 @@ def _contains_phone(value: str) -> bool:
     """Recognize formatted phone-like values without classifying bare identifiers."""
 
     return any(
-        match.group(0).startswith("+") or any(separator in match.group(0) for separator in " .()/-")
+        (
+            match.group(0).startswith("+")
+            or any(separator in match.group(0) for separator in " .()/-")
+        )
+        and not _technical_number(value, match)
         for match in PHONE_RE.finditer(value)
     )
 
 
+def _technical_number(value: str, match: re.Match[str]) -> bool:
+    """Exclude only bounded, parsed technical syntax from phone candidates."""
+
+    candidate = match.group(0)
+    if candidate.startswith("+") or candidate != candidate.strip():
+        return False
+    before, after = value[: match.start()], value[match.end() :]
+    if before.endswith((".", "/", "-")) or re.match(r"(?:[./-]\d)", after):
+        return False
+    if PHONE_CONTEXT_RE.search(before[-24:]):
+        return False
+    try:
+        if "/" in candidate:
+            ipaddress.IPv4Network(candidate, strict=False)
+            return True
+        elif isinstance(ipaddress.ip_address(candidate), ipaddress.IPv4Address):
+            if after.startswith(":"):
+                port = re.match(r":(\d{1,5})\b", after)
+                return bool(port and 1 <= int(port[1]) <= 65535)
+            return bool(IP_CONTEXT_RE.search(before[-96:]))
+    except ValueError:
+        pass
+    if ISO_DATE_RE.fullmatch(candidate) and DATE_CONTEXT_RE.search(before[-32:]):
+        try:
+            date(int(candidate[:4]), int(candidate[5:7]), int(candidate[8:10]))
+        except ValueError:
+            return False
+        return True
+    if re.fullmatch(r"\d{4}\.\d{1,2}\.\d{1,3}", candidate):
+        return bool(VERSION_CONTEXT_RE.search(before[-32:]))
+    if re.fullmatch(r"\d+\.\d+", candidate):
+        return bool(
+            re.search(r"(?i)\bdecimal\([ \t]*['\"]$", before[-32:])
+            and re.match(r"['\"][ \t]*\)", after)
+        )
+    return False
+
+
+def _semantic_secret_text(value: str) -> str:
+    """Remove proven no-value assignments only from generic secret classification."""
+
+    return PURE_CREDENTIAL_ASSIGNMENT_RE.sub("safe_reference_assignment", value)
+
+
 def _display_normalize(value: str) -> str:
     """Approximate closed text rendered by common Markdown/HTML constructs."""
 
@@ -235,6 +303,7 @@ def check_text(
     forbidden: tuple[str | ForbiddenValue, ...] = (),
     forbidden_matcher: ForbiddenMatcher | None = None,
     allow_horizontal_tabs: bool = False,
+    allow_opaque_code: bool = False,
     enabled: bool | None = None,
 ) -> DLPResult:
     """Apply independent units, redaction, PII, and optional publication checks."""
@@ -258,15 +327,26 @@ def check_text(
         return DLPResult(False, None, "limit", detector)
     if not (_DLP_ENABLED.get() if enabled is None else enabled):
         return DLPResult(True, normalized, "disabled")
-    redacted = redact_env_secret_values(redact_sensitive(normalized))
-    if redacted != normalized:
+    # Exact environment values retain priority even when they resemble a reference.
+    if redact_env_secret_values(normalized) != normalized:
+        return DLPResult(False, None, "secret", "normalized")
+    semantic = _semantic_secret_text(normalized)
+    if redact_sensitive(semantic) != semantic:
         return DLPResult(False, None, "secret", "normalized")
     decoded = _html_decode(normalized) if publication else normalized
     displayed = _display_normalize(normalized) if publication else normalized
     source = _source_normalize(normalized) if publication else normalized
-    if publication and redact_env_secret_values(redact_sensitive(displayed)) != displayed:
+    semantic_displayed = _display_normalize(semantic) if publication else semantic
+    semantic_source = _source_normalize(semantic) if publication else semantic
+    if publication and (
+        redact_env_secret_values(displayed) != displayed
+        or redact_sensitive(semantic_displayed) != semantic_displayed
+    ):
         return DLPResult(False, None, "secret", "displayed")
-    if publication and redact_env_secret_values(redact_sensitive(source)) != source:
+    if publication and (
+        redact_env_secret_values(source) != source
+        or redact_sensitive(semantic_source) != semantic_source
+    ):
         return DLPResult(False, None, "secret", "source")
     pii_candidates = (("normalized", normalized),)
     if publication:
@@ -289,7 +369,7 @@ def check_text(
             else "html_comment"
             if HTML_COMMENT_RE.search(decoded)
             else "html_tag"
-            if HTML_TAG_RE.search(decoded)
+            if HTML_TAG_RE.search(decoded) and not (allow_opaque_code and decoded == normalized)
             else "display_control"
             if any(_is_display_control(character) for character in decoded)
             else None

open_code_review_toolkit-0.12.1/src/ocr_toolkit/evidence/gitlinks.py

@@ -0,0 +1,66 @@
+"""Identify changed Git submodule pointers from immutable tree objects."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Literal
+
+from ocr_toolkit.evidence.repository import (
+    GitRepositoryReader,
+    RepositoryEvidenceError,
+    RepositoryObject,
+)
+
+GitlinkChangeKind = Literal["added", "updated", "deleted"]
+_SHA_RE = re.compile(r"[0-9a-f]{40}\Z")
+
+
+@dataclass(frozen=True, slots=True)
+class GitlinkChange:
+    """Private tree evidence; paths and object IDs must not enter public receipts."""
+
+    path: str
+    kind: GitlinkChangeKind
+    before_oid: str | None
+    after_oid: str | None
+
+
+def _entries_by_path(entries: tuple[RepositoryObject, ...]) -> dict[str, RepositoryObject]:
+    by_path: dict[str, RepositoryObject] = {}
+    for entry in entries:
+        if entry.path in by_path:
+            raise RepositoryEvidenceError("Git tree contains a duplicate path")
+        if (entry.mode == "160000") != (entry.object_type == "commit"):
+            raise RepositoryEvidenceError("Git tree contains an invalid gitlink entry")
+        by_path[entry.path] = entry
+    return by_path
+
+
+def changed_gitlinks(
+    reader: GitRepositoryReader, base_sha: str, head_sha: str
+) -> tuple[GitlinkChange, ...]:
+    """Return changed mode-160000 entries without reading or following their targets.
+
+    Both inputs must be full immutable commit IDs. The reader's bounded, isolated
+    ``ls-tree -z`` path is the only source of evidence. A gitlink target object
+    need not exist in the parent repository, so it is never looked up here.
+    """
+
+    if _SHA_RE.fullmatch(base_sha) is None or _SHA_RE.fullmatch(head_sha) is None:
+        raise RepositoryEvidenceError("gitlink inspection requires immutable commit IDs")
+    before = _entries_by_path(reader.list_objects(base_sha))
+    after = _entries_by_path(reader.list_objects(head_sha))
+    changes: list[GitlinkChange] = []
+    for path in sorted(before.keys() | after.keys()):
+        prior = before.get(path)
+        current = after.get(path)
+        prior_oid = prior.object_sha if prior is not None and prior.is_submodule else None
+        current_oid = current.object_sha if current is not None and current.is_submodule else None
+        if prior_oid == current_oid:
+            continue
+        kind: GitlinkChangeKind = (
+            "added" if prior_oid is None else "deleted" if current_oid is None else "updated"
+        )
+        changes.append(GitlinkChange(path, kind, prior_oid, current_oid))
+    return tuple(changes)

open_code_review_toolkit-0.12.1/src/ocr_toolkit/evidence/opaque_code.py

@@ -0,0 +1,108 @@
+"""Bounded immutable-source proof for optional OCR code fields.
+
+This module establishes source identity only. Publication still needs to check
+the complete original text for sensitive content and prove its renderer safe.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+
+from ocr_toolkit.posting.comments import line_number
+from ocr_toolkit.posting.settings import (
+    MAX_SUGGESTION_CODE_CHARS,
+    MAX_SUGGESTION_SPAN_LINES,
+)
+from ocr_toolkit.posting.suggestions import (
+    SuggestionState,
+    evaluate_suggestion,
+    normalize_replacement,
+    safe_repository_path,
+)
+
+MAX_PROOF_SOURCE_CHARS = 256_000
+MAX_PROOF_PATH_CHARS = 1_024
+
+
+@dataclass(frozen=True, slots=True)
+class OpaqueCodeProof:
+    """Only closed proof facts; no source text, hash, or rejected value."""
+
+    existing_verified: bool = False
+    suggestion_verified: bool = False
+
+
+def _bounded_line(value: Any) -> int:
+    """Parse an OCR line without admitting unbounded decimal conversion."""
+
+    if isinstance(value, str) and len(value) > 12:
+        return 0
+    try:
+        return line_number(value)
+    except ValueError:
+        return 0
+
+
+def prove_opaque_code(
+    comment: dict[str, Any],
+    path: str,
+    read_head_blob: Callable[[str], str | None],
+) -> OpaqueCodeProof:
+    """Prove code against one exact, bounded range of the reviewed head.
+
+    The caller owns the immutable commit binding of ``read_head_blob`` and the
+    sink-specific rendering guarantee. A failed read or malformed model value
+    returns only false proof facts, so it cannot open a publication exception.
+    """
+
+    existing = comment.get("existing_code")
+    suggestion = comment.get("suggestion_code")
+    if not isinstance(existing, str) or not existing:
+        return OpaqueCodeProof()
+    if len(existing) > MAX_SUGGESTION_CODE_CHARS:
+        return OpaqueCodeProof()
+    suggestion_well_formed = suggestion is None or (
+        isinstance(suggestion, str) and len(suggestion) <= MAX_SUGGESTION_CODE_CHARS
+    )
+    if not isinstance(path, str) or len(path) > MAX_PROOF_PATH_CHARS:
+        return OpaqueCodeProof()
+    if not safe_repository_path(path):
+        return OpaqueCodeProof()
+
+    raw_start = comment.get("start_line")
+    raw_end = comment.get("end_line")
+    start = _bounded_line(comment.get("line") if raw_start is None else raw_start)
+    end = _bounded_line(comment.get("line") if raw_end is None else raw_end)
+    if start <= 0 or end < start or end - start > MAX_SUGGESTION_SPAN_LINES:
+        return OpaqueCodeProof()
+
+    try:
+        source = read_head_blob(path)
+    except Exception:  # External repository-reader failures must close the proof.
+        return OpaqueCodeProof()
+    if not isinstance(source, str) or len(source) > MAX_PROOF_SOURCE_CHARS:
+        return OpaqueCodeProof()
+    lines = source.replace("\r\n", "\n").replace("\r", "\n").splitlines()
+    if end > len(lines):
+        return OpaqueCodeProof()
+    selected = "\n".join(lines[start - 1 : end])
+    if normalize_replacement(existing) != normalize_replacement(selected):
+        return OpaqueCodeProof()
+
+    if not suggestion or not suggestion_well_formed:
+        return OpaqueCodeProof(existing_verified=True)
+    # A no-op is source-proven too, but cannot smuggle an authored fence into
+    # a fallback rendering path. Actionable replacements use the evaluator's
+    # stricter shape checks.
+    if "```" in suggestion:
+        return OpaqueCodeProof(existing_verified=True)
+    try:
+        decision = evaluate_suggestion(comment, path, lambda _path: source)
+    except (ValueError, TypeError):
+        return OpaqueCodeProof(existing_verified=True)
+    return OpaqueCodeProof(
+        existing_verified=True,
+        suggestion_verified=decision.state in {SuggestionState.ACTIONABLE, SuggestionState.NO_OP},
+    )

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/src/ocr_toolkit/federation/admission.py

@@ -100,7 +100,13 @@ def strings(value: object, *, depth: int = 16, nodes: int = 1024) -> Iterator[st
             raise FederationError("protocol_invalid")
 
 
-def check_dlp(value: object, matcher: ForbiddenMatcher, *, dlp_enabled: bool = True) -> None:
+def check_dlp(
+    value: object,
+    matcher: ForbiddenMatcher,
+    *,
+    boundary: str,
+    dlp_enabled: bool = True,
+) -> None:
     """Reject a complete JSON value if any string discloses protected content."""
     chars = 0
     for text in strings(value):
@@ -113,7 +119,11 @@ def check_dlp(value: object, matcher: ForbiddenMatcher, *, dlp_enabled: bool = T
             text, budgets=_TEXT_BUDGETS, forbidden_matcher=matcher, allow_horizontal_tabs=True
         )
         if not checked.admitted:
-            raise FederationError("oversized" if checked.reason == "limit" else "dlp_rejected")
+            raise FederationError(
+                "oversized" if checked.reason == "limit" else "dlp_rejected",
+                boundary=boundary,
+                detector=checked.reason,
+            )
 
 
 def compile_schema(
@@ -156,7 +166,7 @@ def compile_schema(
                 if multiplied > 64:
                     raise FederationError("schema_invalid")
                 pending.extend((child, multiplied) for child in branches)
-        check_dlp(schema, matcher, dlp_enabled=dlp_enabled)
+        check_dlp(schema, matcher, boundary="schema", dlp_enabled=dlp_enabled)
         Draft202012Validator.check_schema(schema)
         return Draft202012Validator(schema, registry=SchemaRegistry())
     except FederationError:
@@ -190,7 +200,7 @@ def arguments(
                 raise FederationError("origin_denied") from None
             if candidate not in policy.resource_origins:
                 raise FederationError("origin_denied")
-    check_dlp(value, matcher, dlp_enabled=dlp_enabled)
+    check_dlp(value, matcher, boundary="arguments", dlp_enabled=dlp_enabled)
     return value, canonical
 
 
@@ -211,7 +221,7 @@ def result(
     content = [types.TextContent(type="text", text=block.text) for block in value.content]
     structured = value.structured_content
     candidate = {"content": [block.text for block in content], "structured": structured}
-    check_dlp(candidate, matcher, dlp_enabled=dlp_enabled)
+    check_dlp(candidate, matcher, boundary="result", dlp_enabled=dlp_enabled)
     if len(encode(candidate)) > RESPONSE_BYTES:
         raise FederationError("oversized")
     if validator is not None and (

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/src/ocr_toolkit/federation/contracts.py

@@ -31,12 +31,21 @@ COUNTERS = (
     "cache_hits",
     "single_flight",
 )
+DLP_GATE_REASONS = ("forbidden", "invalid_text", "limit", "pii", "secret")
+DLP_CALL_GATES = ("arguments", "result")
+DLP_BOUNDARIES = frozenset(("schema", *DLP_CALL_GATES))
 
 
 class FederationError(ValueError):
     """Expose only one closed, content-free failure code."""
 
-    def __init__(self, code: str = "federation_failed") -> None:
+    def __init__(
+        self,
+        code: str = "federation_failed",
+        *,
+        boundary: str | None = None,
+        detector: str | None = None,
+    ) -> None:
         allowed = {
             "registry_invalid",
             "secret_missing",
@@ -56,6 +65,10 @@ class FederationError(ValueError):
             "tool_failed",
         }
         self.code = code if code in allowed else "federation_failed"
+        self.boundary = boundary if boundary in DLP_BOUNDARIES else None
+        self.detector = detector if detector in DLP_GATE_REASONS else None
+        if self.detector is None:
+            self.boundary = None
         super().__init__(self.code)
 
 

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/src/ocr_toolkit/federation/gateway.py

@@ -25,6 +25,8 @@ from .contracts import (
     CONCURRENCY,
     COUNTERS,
     DELIVERY_BYTES,
+    DLP_CALL_GATES,
+    DLP_GATE_REASONS,
     MAX_CALLS,
     METADATA_BYTES,
     FederationError,
@@ -79,6 +81,7 @@ class Gateway:
                 "server": spec.name,
                 "assurance": tool.assurance,
                 **dict.fromkeys(COUNTERS, 0),
+                "dlp_gates": {gate: dict.fromkeys(DLP_GATE_REASONS, 0) for gate in DLP_CALL_GATES},
             }
             for spec in registry.servers
             for tool in spec.tools
@@ -153,7 +156,9 @@ class Gateway:
                     else None
                 )
                 description = tool.description or ""
-                admission.check_dlp(description, self.matcher, dlp_enabled=self.dlp_enabled)
+                admission.check_dlp(
+                    description, self.matcher, boundary="schema", dlp_enabled=self.dlp_enabled
+                )
                 definition = types.Tool(
                     name=policy.alias, description=description, input_schema=tool.input_schema
                 )
@@ -212,9 +217,10 @@ class Gateway:
         finally:
             self.dispatches.pop(key, None)
 
-    def _terminal(self, alias: str, reason: str) -> None:
+    def _terminal(self, alias: str, error: FederationError) -> None:
         """Record one outcome and optional diagnostic subset without retaining content."""
         counts = self.counts[alias]
+        reason = error.code
         if reason in {
             "arguments_invalid",
             "origin_denied",
@@ -230,6 +236,8 @@ class Gateway:
         counts[outcome] += 1
         if reason in {"dlp_rejected", "oversized"}:
             counts[reason] += 1
+        if error.boundary in DLP_CALL_GATES and error.detector in DLP_GATE_REASONS:
+            counts["dlp_gates"][error.boundary][error.detector] += 1
 
     async def call_tool(
         self, _context: Any, params: types.CallToolRequestParams
@@ -292,12 +300,12 @@ class Gateway:
             counts["completed"] += 1
             return result
         except asyncio.CancelledError:
-            self._terminal(params.name, "tool_failed")
+            self._terminal(params.name, FederationError("tool_failed"))
             raise
         except FederationError as error:
-            self._terminal(params.name, error.code)
+            self._terminal(params.name, error)
         except Exception:
-            self._terminal(params.name, "tool_failed")
+            self._terminal(params.name, FederationError("tool_failed"))
         return types.CallToolResult(
             content=[types.TextContent(type="text", text="federation_unavailable")], is_error=True
         )
@@ -344,8 +352,13 @@ class Gateway:
                 counts[key] for key in ("completed", "denied", "failed", "timed_out")
             ):
                 raise FederationError("cleanup_failed")
+            dlp_gates = counts["dlp_gates"]
+            if sum(sum(gate.values()) for gate in dlp_gates.values()) > (
+                counts["dlp_rejected"] + counts["oversized"]
+            ):
+                raise FederationError("cleanup_failed")
         return {
-            "schema": "ocr.federation/v1",
+            "schema": "ocr.federation/v2",
             "run_id": self.run_id,
             "state": "finalized",
             "cleanup": "clean",

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/src/ocr_toolkit/federation/runtime.py

@@ -69,7 +69,7 @@ class RunningGateway:
         self._loop: asyncio.AbstractEventLoop | None = None
         self._main_task: asyncio.Task[Any] | None = None
         self._stop: asyncio.Event | None = None
-        self._error: str | None = None
+        self._error: FederationError | None = None
         self._receipt: dict[str, Any] | None = None
         self._gateway: Gateway | None = None
         self._closed = False
@@ -97,7 +97,7 @@ class RunningGateway:
             self._thread.join(20)
             if not self._thread.is_alive():
                 shutil.rmtree(self._directory)
-            raise FederationError(self._error)
+            raise self._error
 
     @property
     def secret_values(self) -> tuple[str, ...]:
@@ -121,7 +121,7 @@ class RunningGateway:
             asyncio.run(self._serve(registry, selected, forbidden, run_id))
         except BaseException:
             if self._error is None:
-                self._error = "cleanup_failed"
+                self._error = FederationError("cleanup_failed")
         finally:
             self._ready.set()
 
@@ -157,11 +157,11 @@ class RunningGateway:
             try:
                 await asyncio.wait_for(self._stop.wait(), RUN_SECONDS)
             except TimeoutError:
-                self._error = "timed_out"
+                self._error = FederationError("timed_out")
         except FederationError as error:
-            self._error = error.code
+            self._error = error
         except BaseException:
-            self._error = "gateway_unavailable"
+            self._error = FederationError("gateway_unavailable")
         finally:
             if listener is not None:
                 listener.close()
@@ -170,12 +170,12 @@ class RunningGateway:
             try:
                 await stack.aclose()
             except BaseException:
-                self._error = "cleanup_failed"
+                self._error = FederationError("cleanup_failed")
             if self._error is None:
                 try:
                     self._receipt = gateway.receipt()
                 except FederationError:
-                    self._error = "cleanup_failed"
+                    self._error = FederationError("cleanup_failed")
             self._ready.set()
 
     def _request_stop(self, *, cancel: bool = False) -> None:

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.12.1}/src/ocr_toolkit/local_chatgpt.py

@@ -10,7 +10,10 @@ from typing import Any
 
 from ocr_toolkit.provider_config import ProviderConfigError, request_controls_from_environment
 
-CHATGPT_OCR_VERSIONS = frozenset({"1.13.2"})
+# Exact binary versions are qualified by preflight.validate_ocr_binary first.
+# Native auth is an independently reviewed capability within that qualified line.
+CHATGPT_CONTRACT_LINE = (1, 13)
+CHATGPT_MIN_PATCH = 2
 _CONFLICTING_SETTINGS = (
     "OCR_LLM_URL",
     "OCR_LLM_TOKEN",
@@ -77,10 +80,19 @@ def provider_entry(environment: Mapping[str, str]) -> dict[str, Any]:
 
 
 def require_supported_version(version: str) -> None:
-    """Keep native auth limited to the separately qualified OCR release."""
+    """Require the reviewed native-auth contract after exact binary qualification."""
 
-    if version not in CHATGPT_OCR_VERSIONS:
-        raise LocalChatGPTError("ChatGPT authentication requires qualified OCR 1.13.2")
+    parts = version.split(".")
+    if (
+        len(version) > 32
+        or len(parts) != 3
+        or any(not part.isascii() or not part.isdecimal() for part in parts)
+        or tuple(map(int, parts[:2])) != CHATGPT_CONTRACT_LINE
+        or int(parts[2]) < CHATGPT_MIN_PATCH
+    ):
+        raise LocalChatGPTError(
+            "ChatGPT authentication requires qualified OCR 1.13.2 or later in the 1.13 line"
+        )
 
 
 def _directory(path: Path, *, private: bool = False, owned: bool = False) -> None: