open-code-review-toolkit 0.12.1__tar.gz → 0.13.0__tar.gz

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: open-code-review-toolkit
-Version: 0.12.1
+Version: 0.13.0
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -228,6 +228,7 @@ Requires-Dist: certifi<2027,>=2026.10.19
 Requires-Dist: httpx2<3,>=2.13.0
 Requires-Dist: jsonschema<5,>=4.26.0
 Requires-Dist: mcp<3,>=2.2.0
+Requires-Dist: opentelemetry-api<2,>=1.45.1
 Requires-Dist: pyjwt<3,>=2.15.0
 Description-Content-Type: text/markdown
 
@@ -297,7 +298,9 @@ commit without forge credentials:
 
 ```console
 ocr-ci preflight --local
-ocr-ci review --local --result review.json --stderr review.stderr --report review.md -- --commit HEAD
+review_dir=$(mktemp -d)
+review_dir=$(cd "$review_dir" && pwd -P)
+ocr-ci review --local --result "$review_dir/review.json" --stderr "$review_dir/review.stderr" --report "$review_dir/review.md" -- --commit HEAD
 ```
 
 Local execution uses the same OCR, mandatory evidence MCP, validation and DLP
@@ -321,13 +324,17 @@ On a successful rerun, the toolkit replaces untouched OCR-only notes instead of
 
 Suppression uses both the GitLab diff position and a stable finding fingerprint, so ordinary line shifts do not normally bring the same bug back. A materially changed finding can still receive a new discussion. See [GitLab review operations](docs/operations.md) for the complete lifecycle, posting modes, permissions, failure behavior, and Mermaid state diagram.
 
-After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v10's exact reviewed source SHA, target SHA/protection state, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v11's exact reviewed diff, actual target, policy authority, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, older receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
 
-Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable target-ref decisions and never lets a source change self-authorize its review. Root and nested target `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
+An intentionally absent toolkit receipt retains compatible direct posting outside
+GitLab CI without automatic approval. A present v9/v10 receipt can be read for historical
+diagnostics, but cannot publish a new current MR review.
+
+Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable decisions from the selected policy commit and never lets a source change self-authorize its review. Root and nested policy `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
 
 ## Project architecture
 
-The shipped Repository Evidence Engine reads immutable base/head Git objects, stores bounded typed facts and deltas, creates the compact bootstrap used by OCR, and exposes detailed facts, literal search, scoped absence checks, and base/head changes through the mandatory built-in read-only MCP server. That internal server is always present and cannot be removed or replaced by operator configuration. Protected-policy enriched reviews can also acquire stable GitLab discussions, verified remediation history, and protected same-revision CI outcomes before OCR. Optional external tools use the governed registry-v2 federation gateway: the toolkit freezes explicit allowlists, validates schemas, origins, DLP and budgets, and reconciles content-free usage receipts while OCR remains the only model loop. Local review permits explicit HTTPS or stdio upstreams; GitLab permits HTTPS only.
+The shipped Repository Evidence Engine reads immutable base/head Git objects, stores bounded typed facts and deltas, creates the compact bootstrap used by OCR, and exposes detailed facts, literal search, scoped absence checks, and base/head changes through the mandatory built-in read-only MCP server. GitLab reviews can also expose a bounded, separately labelled actual-target snapshot for relevant code context; it does not become policy or another reviewed delta. The internal server is always present and cannot be removed or replaced by operator configuration. Protected-policy enriched reviews can also acquire stable GitLab discussions, verified remediation history, and protected same-revision CI outcomes before OCR. Optional external tools use the governed registry-v2 federation gateway: the toolkit freezes explicit allowlists, validates schemas, origins, DLP and budgets, and reconciles content-free usage receipts while OCR remains the only model loop. Local review permits explicit HTTPS or stdio upstreams; GitLab permits HTTPS only.
 
 - [Toolkit strategy](docs/engineering/toolkit_strategy.md) - durable product boundaries, architecture, invariants, and non-goals.
 - [Bounded review context](docs/review-context.md) - protected policy, GitLab discussions and same-revision CI outcomes, legacy reference migration, opaque handles, DLP, receipt, and cleanup contracts.
@@ -338,21 +345,23 @@ The shipped Repository Evidence Engine reads immutable base/head Git objects, st
 
 1. Configure protected/masked `GITLAB_API_TOKEN` and LLM variables in GitLab.
 2. Pin and checksum the OCR binary.
-3. Keep `OCR_GITLAB_TARGET_PROTECTION_MODE=required` unless the project deliberately permits an unprotected target in limited, comment-only mode.
-4. Merge repository review configuration, including the Rules path, into the target branch.
+3. With toolkit 0.13.0, leave `OCR_GITLAB_TARGET_PROTECTION_MODE` unset to use its `auto` default for a single MR targeting an unprotected branch under the same project's protected default-branch policy. Select explicit `required` to reject unprotected targets, or `unprotected` for the earlier limited profile.
+4. Merge repository review configuration, including the Rules path, into the protected policy branch before relying on it.
 5. Enable the CI review job in a later merge request and install this package.
 6. Run the four public helper stages around `ocr review`:
 
 ```console
 ocr-ci preflight
 ocr-ci configure
-ocr-ci review --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log -- ... --format json
-ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
+review_result="/tmp/ocr-result-${CI_JOB_ID}.json"
+review_stderr="/tmp/ocr-stderr-${CI_JOB_ID}.log"
+ocr-ci review --result "$review_result" --stderr "$review_stderr" -- ... --format json || export OCR_EXIT_CODE=$?
+ocr-ci post --result "$review_result" --stderr "$review_stderr"
 ```
 
 See the [GitLab mode matrix](examples/gitlab/README.md), the complete [`ocr-review.gitlab-ci.yml`](examples/gitlab/ocr-review.gitlab-ci.yml) pipeline, the [GitLab setup guide](docs/gitlab.md), and [GitLab review operations](docs/operations.md).
 
-The two-merge-request setup is recommended because repository Rules are loaded only from the captured target commit. On the default protected-target path, a supported one-merge-request alternative may add the Rules and CI job together when that integration merge request does not need review: its first run stops before OCR with a setup-pending note, retrying the same merge request cannot change the captured target Rules, and later merge requests work after it merges. An actually unprotected target with missing target Rules fails closed without promoting the source copy or promising setup-pending status. If the status identity is missing or mismatched, the toolkit likewise uses the generic fail-closed failure note. A green advisory job or pipeline does not prove that OCR or its model executed.
+The two-merge-request setup is recommended because repository Rules must already exist on the captured policy commit. For a protected target that is its own authority; for an unprotected target in `auto`, it is the protected default branch. The integration MR can add Rules and CI together when it need not be reviewed: its first run may stop with setup-pending, and later MRs work after the policy change merges. Retrying the same MR cannot promote its source Rules. An unprotected target in explicit `unprotected` mode with missing target Rules fails closed. A green advisory job or pipeline does not prove that OCR or its model executed. See the [GitLab setup guide](docs/gitlab.md#first-integration-sequence) for the exact boundary.
 
 ## Configuration and safety
 

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/README.md

@@ -64,7 +64,9 @@ commit without forge credentials:
 
 ```console
 ocr-ci preflight --local
-ocr-ci review --local --result review.json --stderr review.stderr --report review.md -- --commit HEAD
+review_dir=$(mktemp -d)
+review_dir=$(cd "$review_dir" && pwd -P)
+ocr-ci review --local --result "$review_dir/review.json" --stderr "$review_dir/review.stderr" --report "$review_dir/review.md" -- --commit HEAD
 ```
 
 Local execution uses the same OCR, mandatory evidence MCP, validation and DLP
@@ -88,13 +90,17 @@ On a successful rerun, the toolkit replaces untouched OCR-only notes instead of
 
 Suppression uses both the GitLab diff position and a stable finding fingerprint, so ordinary line shifts do not normally bring the same bug back. A materially changed finding can still receive a new discussion. See [GitLab review operations](docs/operations.md) for the complete lifecycle, posting modes, permissions, failure behavior, and Mermaid state diagram.
 
-After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v10's exact reviewed source SHA, target SHA/protection state, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v11's exact reviewed diff, actual target, policy authority, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, older receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
 
-Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable target-ref decisions and never lets a source change self-authorize its review. Root and nested target `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
+An intentionally absent toolkit receipt retains compatible direct posting outside
+GitLab CI without automatic approval. A present v9/v10 receipt can be read for historical
+diagnostics, but cannot publish a new current MR review.
+
+Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable decisions from the selected policy commit and never lets a source change self-authorize its review. Root and nested policy `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
 
 ## Project architecture
 
-The shipped Repository Evidence Engine reads immutable base/head Git objects, stores bounded typed facts and deltas, creates the compact bootstrap used by OCR, and exposes detailed facts, literal search, scoped absence checks, and base/head changes through the mandatory built-in read-only MCP server. That internal server is always present and cannot be removed or replaced by operator configuration. Protected-policy enriched reviews can also acquire stable GitLab discussions, verified remediation history, and protected same-revision CI outcomes before OCR. Optional external tools use the governed registry-v2 federation gateway: the toolkit freezes explicit allowlists, validates schemas, origins, DLP and budgets, and reconciles content-free usage receipts while OCR remains the only model loop. Local review permits explicit HTTPS or stdio upstreams; GitLab permits HTTPS only.
+The shipped Repository Evidence Engine reads immutable base/head Git objects, stores bounded typed facts and deltas, creates the compact bootstrap used by OCR, and exposes detailed facts, literal search, scoped absence checks, and base/head changes through the mandatory built-in read-only MCP server. GitLab reviews can also expose a bounded, separately labelled actual-target snapshot for relevant code context; it does not become policy or another reviewed delta. The internal server is always present and cannot be removed or replaced by operator configuration. Protected-policy enriched reviews can also acquire stable GitLab discussions, verified remediation history, and protected same-revision CI outcomes before OCR. Optional external tools use the governed registry-v2 federation gateway: the toolkit freezes explicit allowlists, validates schemas, origins, DLP and budgets, and reconciles content-free usage receipts while OCR remains the only model loop. Local review permits explicit HTTPS or stdio upstreams; GitLab permits HTTPS only.
 
 - [Toolkit strategy](docs/engineering/toolkit_strategy.md) - durable product boundaries, architecture, invariants, and non-goals.
 - [Bounded review context](docs/review-context.md) - protected policy, GitLab discussions and same-revision CI outcomes, legacy reference migration, opaque handles, DLP, receipt, and cleanup contracts.
@@ -105,21 +111,23 @@ The shipped Repository Evidence Engine reads immutable base/head Git objects, st
 
 1. Configure protected/masked `GITLAB_API_TOKEN` and LLM variables in GitLab.
 2. Pin and checksum the OCR binary.
-3. Keep `OCR_GITLAB_TARGET_PROTECTION_MODE=required` unless the project deliberately permits an unprotected target in limited, comment-only mode.
-4. Merge repository review configuration, including the Rules path, into the target branch.
+3. With toolkit 0.13.0, leave `OCR_GITLAB_TARGET_PROTECTION_MODE` unset to use its `auto` default for a single MR targeting an unprotected branch under the same project's protected default-branch policy. Select explicit `required` to reject unprotected targets, or `unprotected` for the earlier limited profile.
+4. Merge repository review configuration, including the Rules path, into the protected policy branch before relying on it.
 5. Enable the CI review job in a later merge request and install this package.
 6. Run the four public helper stages around `ocr review`:
 
 ```console
 ocr-ci preflight
 ocr-ci configure
-ocr-ci review --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log -- ... --format json
-ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
+review_result="/tmp/ocr-result-${CI_JOB_ID}.json"
+review_stderr="/tmp/ocr-stderr-${CI_JOB_ID}.log"
+ocr-ci review --result "$review_result" --stderr "$review_stderr" -- ... --format json || export OCR_EXIT_CODE=$?
+ocr-ci post --result "$review_result" --stderr "$review_stderr"
 ```
 
 See the [GitLab mode matrix](examples/gitlab/README.md), the complete [`ocr-review.gitlab-ci.yml`](examples/gitlab/ocr-review.gitlab-ci.yml) pipeline, the [GitLab setup guide](docs/gitlab.md), and [GitLab review operations](docs/operations.md).
 
-The two-merge-request setup is recommended because repository Rules are loaded only from the captured target commit. On the default protected-target path, a supported one-merge-request alternative may add the Rules and CI job together when that integration merge request does not need review: its first run stops before OCR with a setup-pending note, retrying the same merge request cannot change the captured target Rules, and later merge requests work after it merges. An actually unprotected target with missing target Rules fails closed without promoting the source copy or promising setup-pending status. If the status identity is missing or mismatched, the toolkit likewise uses the generic fail-closed failure note. A green advisory job or pipeline does not prove that OCR or its model executed.
+The two-merge-request setup is recommended because repository Rules must already exist on the captured policy commit. For a protected target that is its own authority; for an unprotected target in `auto`, it is the protected default branch. The integration MR can add Rules and CI together when it need not be reviewed: its first run may stop with setup-pending, and later MRs work after the policy change merges. Retrying the same MR cannot promote its source Rules. An unprotected target in explicit `unprotected` mode with missing target Rules fails closed. A green advisory job or pipeline does not prove that OCR or its model executed. See the [GitLab setup guide](docs/gitlab.md#first-integration-sequence) for the exact boundary.
 
 ## Configuration and safety
 

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/pyproject.toml

@@ -27,6 +27,8 @@ dependencies = [
   "mcp>=2.2.0,<3",
   # MCP crypto accepts older PyJWT; enforce its security floor for resolver installs.
   "PyJWT>=2.15.0,<3",
+  # MCP accepts an OpenTelemetry API version with vulnerable tracestate parsing.
+  "opentelemetry-api>=1.45.1,<2",
   "jsonschema>=4.26.0,<5",
   "httpx2>=2.13.0,<3",
   "anyio>=4.10.0,<5",

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.12.1'
-__version_tuple__ = version_tuple = (0, 12, 1)
+__version__ = version = '0.13.0'
+__version_tuple__ = version_tuple = (0, 13, 0)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/cli.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+import os
 import sys
 from collections.abc import Sequence
 from pathlib import Path
@@ -93,6 +94,9 @@ def main(argv: Sequence[str] | None = None) -> int:
                 **({"report_path": Path(args.report)} if args.report is not None else {}),
                 **({"debug_dir": Path(args.debug_dir)} if args.debug_dir is not None else {}),
             )
+        except review_runner.ReviewRunnerNoHandoff as exc:
+            print(f"Cannot run Open Code Review: {exc}", file=sys.stderr)
+            return os.EX_TEMPFAIL
         except review_runner.ReviewRunnerError as exc:
             if not isinstance(exc, review_runner.ReviewRejected):
                 print(f"Cannot run Open Code Review: {exc}", file=sys.stderr)

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/common/redaction.py

@@ -147,9 +147,9 @@ def redact_env_secret_values(text: str) -> str:
 def redact_sensitive(text: str) -> str:
     """Replace known secret values from the process environment with `***`.
 
-    Used before publishing OCR-controlled text to the merge request, including
-    stderr excerpts from `OCR_POST_ERROR_DETAILS=1` and structured OCR JSON
-    fields. Performs two passes:
+    Used before publishing OCR-controlled text to the merge request and when
+    rendering bounded local diagnostics from structured OCR JSON fields.
+    Performs two passes:
 
     1. Replace each known env value (length >= 4). This is exact-match
        replacement over a small allowlist of secret-bearing environment

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/evidence/artifacts.py

@@ -4,7 +4,10 @@ from __future__ import annotations
 
 import os
 import stat
+from collections.abc import Iterator
+from contextlib import contextmanager
 from dataclasses import dataclass
+from fcntl import LOCK_EX, LOCK_NB, flock
 from pathlib import Path
 
 
@@ -18,6 +21,7 @@ class EvidenceArtifacts:
     policy_rules: Path
     context_store: Path
     pre_execution_status: Path
+    review_run_lock: Path
     action_receipt: Path
     action_receipt_lock: Path
     dlp_decisions: Path
@@ -35,6 +39,7 @@ def repository_artifacts(root: Path | None = None) -> EvidenceArtifacts:
         policy_rules=directory / "policy-rules.json",
         context_store=directory / "context.json",
         pre_execution_status=directory / "pre-execution-status.json",
+        review_run_lock=directory / ".review-run.lock",
         action_receipt=directory / "evidence-actions.json",
         action_receipt_lock=directory / ".evidence-actions.json.lock",
         dlp_decisions=directory / "private-dlp-decisions.json",
@@ -48,10 +53,92 @@ def prepare_artifact_directory(artifacts: EvidenceArtifacts) -> None:
     if directory.is_symlink():
         raise OSError(f"refusing private artifact directory symlink: {directory}")
     directory.mkdir(mode=0o700, parents=False, exist_ok=True)
-    metadata = directory.stat(follow_symlinks=False)
-    if not stat.S_ISDIR(metadata.st_mode):
-        raise OSError(f"private artifact path is not a directory: {directory}")
-    directory.chmod(0o700)
+    descriptor = os.open(
+        directory,
+        os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0),
+    )
+    try:
+        metadata = os.fstat(descriptor)
+        named = directory.stat(follow_symlinks=False)
+        if (
+            not stat.S_ISDIR(metadata.st_mode)
+            or metadata.st_uid != os.getuid()
+            or (metadata.st_dev, metadata.st_ino) != (named.st_dev, named.st_ino)
+        ):
+            raise OSError(f"private artifact path is not a safe directory: {directory}")
+        os.fchmod(descriptor, 0o700)
+        named = directory.stat(follow_symlinks=False)
+        if (metadata.st_dev, metadata.st_ino) != (named.st_dev, named.st_ino):
+            raise OSError(f"private artifact directory changed during setup: {directory}")
+    finally:
+        os.close(descriptor)
+
+
+class ReviewRunBusy(OSError):
+    """Another review owns the fixed private artifacts for this repository."""
+
+
+@contextmanager
+def locked_review_run(artifacts: EvidenceArtifacts) -> Iterator[None]:
+    """Hold one stable private lock across a review's entire artifact lifetime."""
+
+    prepare_artifact_directory(artifacts)
+    directory = -1
+    descriptor = -1
+    try:
+        directory = os.open(
+            artifacts.directory,
+            os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0),
+        )
+        directory_stat = os.fstat(directory)
+        named_directory = artifacts.directory.stat(follow_symlinks=False)
+        if (
+            not stat.S_ISDIR(directory_stat.st_mode)
+            or directory_stat.st_uid != os.getuid()
+            or (directory_stat.st_dev, directory_stat.st_ino)
+            != (named_directory.st_dev, named_directory.st_ino)
+            or stat.S_IMODE(directory_stat.st_mode) & 0o077
+        ):
+            raise OSError("private review lock directory is unsafe")
+        descriptor = os.open(
+            artifacts.review_run_lock.name,
+            os.O_CREAT | os.O_RDWR | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0),
+            0o600,
+            dir_fd=directory,
+        )
+        opened = os.fstat(descriptor)
+        named = os.stat(
+            artifacts.review_run_lock.name,
+            dir_fd=directory,
+            follow_symlinks=False,
+        )
+        if (
+            not stat.S_ISREG(opened.st_mode)
+            or opened.st_uid != os.getuid()
+            or opened.st_nlink != 1
+            or stat.S_IMODE(opened.st_mode) & 0o077
+            or (opened.st_dev, opened.st_ino) != (named.st_dev, named.st_ino)
+        ):
+            raise OSError("private review lock file is unsafe")
+        try:
+            flock(descriptor, LOCK_EX | LOCK_NB)
+        except BlockingIOError as exc:
+            raise ReviewRunBusy("another review is already running in this repository") from exc
+        named = os.stat(
+            artifacts.review_run_lock.name,
+            dir_fd=directory,
+            follow_symlinks=False,
+        )
+        if (opened.st_dev, opened.st_ino) != (named.st_dev, named.st_ino):
+            raise OSError("private review lock file changed during acquisition")
+        # Keep the named inode across runs; unlinking it would let a second
+        # review lock a replacement while this review still holds the old one.
+        yield
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+        if directory >= 0:
+            os.close(directory)
 
 
 def write_private_bytes(path: Path, content: bytes) -> None:

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/evidence/collect.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import os
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 
 from ocr_toolkit.evidence.categorize import categorize_paths
 from ocr_toolkit.evidence.collectors import collect_ref_facts, fact_deltas
@@ -16,7 +16,11 @@ from ocr_toolkit.evidence.repository import (
     file_deltas,
 )
 from ocr_toolkit.evidence.store import EvidenceStore, EvidenceStoreError
-from ocr_toolkit.evidence.store.contracts import POLICY_KINDS
+from ocr_toolkit.evidence.store.contracts import POLICY_KINDS, TARGET_CONTEXT_KINDS
+
+MAX_TARGET_FILE_RECORDS = 64
+MAX_TARGET_DEPENDENCY_RECORDS = 64
+MAX_TARGET_DIAGNOSTICS = 32
 
 
 def _commit_refs(
@@ -44,15 +48,62 @@ def _component_for_path(path: str) -> str:
     return path.split("/", 1)[0] if "/" in path else "repository"
 
 
+def _relevant_target_dependency(path: str, changed_paths: tuple[str, ...]) -> bool:
+    """Select manifests in a changed path's own directory or an ancestor."""
+
+    parent = PurePosixPath(path).parent.as_posix()
+    return any(
+        changed == path or parent == "." or changed.startswith(parent + "/")
+        for changed in changed_paths
+    )
+
+
+def _add_target_diagnostic(store: EvidenceStore, message: str) -> bool:
+    """Keep an optional target notice only when the base evidence still serializes."""
+
+    prior_diagnostics = list(store.diagnostics)
+    try:
+        store.add_diagnostic(message)
+        store.to_json()
+    except EvidenceStoreError as exc:
+        store.diagnostics = prior_diagnostics
+        if str(exc) not in {
+            "serialized evidence store exceeds its byte budget",
+            "evidence diagnostic must contain between 1 and 1024 characters",
+        }:
+            raise
+        return False
+    return True
+
+
+def _as_target_record(record: EvidenceRecord, target_sha: str) -> EvidenceRecord:
+    """Reuse a collected code fact without inheriting its old ref or trust label."""
+
+    return EvidenceRecord(
+        kind=record.kind,
+        value=record.value,
+        source_path=record.source_path,
+        ref=RefRole.TARGET,
+        commit_sha=target_sha,
+        component=record.component,
+        provenance=record.provenance,
+        confidence=record.confidence,
+        trust=TrustClass.TARGET_REPOSITORY,
+        sensitivity=record.sensitivity,
+        staleness=record.staleness,
+    )
+
+
 def collect_repository_evidence(
     root: Path | None = None,
     *,
     base_ref: str | None = None,
     head_ref: str | None = None,
     policy_ref: str | None = None,
+    target_ref: str | None = None,
     include_policy_records: bool = True,
 ) -> EvidenceStore:
-    """Build evidence, optionally omitting target-derived policy authority records."""
+    """Build B/H diff evidence, separate P policy, and optional untrusted T context."""
 
     reader = GitRepositoryReader(root or Path.cwd())
     base_sha, head_sha = _commit_refs(reader, base_ref, head_ref)
@@ -219,4 +270,81 @@ def collect_repository_evidence(
         *policy_diagnostics,
     ):
         store.add_diagnostic(diagnostic)
+    if target_ref is not None:
+        # The actual target may differ from both the historical diff base and
+        # the protected policy branch. Its facts are optional code context and
+        # must never consume the budget reserved for B/H/P or alter their deltas.
+        store.to_json()  # A pre-existing B/H/P budget failure remains a normal error.
+        target_sha = reader.resolve_commit(target_ref)
+        store.target = EvidenceSnapshot(RefRole.TARGET, target_sha, ())
+        try:
+            header_size = len(store.to_json().encode("utf-8"))
+        except EvidenceStoreError as exc:
+            if str(exc) != "serialized evidence store exceeds its byte budget":
+                raise
+            header_size = store.limits.max_bytes
+        if header_size > store.limits.max_bytes - 256:
+            store.target = None
+            _add_target_diagnostic(store, "actual target context omitted by evidence byte limit")
+            return store
+        if target_sha in {base_sha, head_sha}:
+            # The common unchanged-target case needs no third repository scan.
+            prior = base if target_sha == base_sha else head
+            prior_facts = base_facts if target_sha == base_sha else head_facts
+            target_files = EvidenceSnapshot(
+                RefRole.TARGET,
+                target_sha,
+                tuple(_as_target_record(record, target_sha) for record in prior.records),
+                diagnostics=prior.diagnostics,
+            )
+            target_facts = [_as_target_record(record, target_sha) for record in prior_facts]
+            target_fact_diagnostics: list[str] = []
+        else:
+            try:
+                target_files = build_file_snapshot(
+                    reader, target_sha, RefRole.TARGET, paths=changed
+                )
+                target_facts, target_fact_diagnostics = collect_ref_facts(
+                    reader, target_sha, RefRole.TARGET, changed_paths=changed
+                )
+            except RepositoryEvidenceError as exc:
+                if str(exc) != "repository tree exceeds the bounded entry limit":
+                    raise
+                # T's commit identity was resolved before this optional scan.
+                # A target-only tree limit cannot change B/H/P or their deltas.
+                _add_target_diagnostic(
+                    store, "actual target code context omitted by repository tree entry limit"
+                )
+                return store
+        diagnostics = (*target_files.diagnostics, *target_fact_diagnostics)
+        target_diagnostics = diagnostics[:MAX_TARGET_DIAGNOSTICS]
+        files = target_files.records[:MAX_TARGET_FILE_RECORDS]
+        dependencies = tuple(
+            record
+            for record in target_facts
+            if record.kind in TARGET_CONTEXT_KINDS - {"repository.file"}
+            and _relevant_target_dependency(record.source_path, changed)
+        )
+        dependencies = tuple(
+            sorted(dependencies, key=lambda item: (item.kind, item.source_path, item.id))
+        )
+        selected_dependencies = dependencies[:MAX_TARGET_DEPENDENCY_RECORDS]
+        omitted = (
+            len(target_files.records) > MAX_TARGET_FILE_RECORDS
+            or len(dependencies) > MAX_TARGET_DEPENDENCY_RECORDS
+        )
+        for record in (*files, *selected_dependencies):
+            if not store.add_target_context(record):
+                omitted = True
+        if omitted:
+            _add_target_diagnostic(
+                store, "target code context is incomplete due to bounded evidence limits"
+            )
+        if diagnostics:
+            _add_target_diagnostic(store, "target code context has unavailable source details")
+        for diagnostic in target_diagnostics:
+            if not _add_target_diagnostic(store, f"target:{diagnostic}"):
+                break
+        if len(diagnostics) > MAX_TARGET_DIAGNOSTICS:
+            _add_target_diagnostic(store, "target collection diagnostics were truncated")
     return store

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/evidence/collectors/orchestration.py

@@ -78,7 +78,7 @@ def collect_ref_facts(
     diagnostics = []
     trust = (
         TrustClass.TARGET_REPOSITORY
-        if ref in {RefRole.BASE, RefRole.POLICY}
+        if ref in {RefRole.BASE, RefRole.POLICY, RefRole.TARGET}
         else TrustClass.SOURCE_REPOSITORY
     )
     changed_exact = tuple(sorted(set(changed_paths)))

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/evidence/mcp.py

@@ -23,7 +23,7 @@ from ocr_toolkit.context.mcp import (
 )
 from ocr_toolkit.context.store import ContextStore
 from ocr_toolkit.evidence.actions import UNATTRIBUTED_ACTION, record_action
-from ocr_toolkit.evidence.model import CoverageRecord, EvidenceDelta, EvidenceRecord
+from ocr_toolkit.evidence.model import CoverageRecord, EvidenceDelta, EvidenceRecord, RefRole
 from ocr_toolkit.evidence.policy.schema import is_legacy_policy_value
 from ocr_toolkit.evidence.store import EvidenceStore, EvidenceStoreError
 
@@ -161,6 +161,14 @@ def evidence_summary(store: EvidenceStore) -> dict[str, object]:
         "policy": policy,
         "merge_request_context": merge_request_context,
         "policy_ref": store.policy.commit_sha if store.policy else None,
+        "target": store.target.commit_sha if store.target else None,
+        "target_context": {
+            "records": sum(record.ref is RefRole.TARGET for record in store.records),
+            "trust": "target_repository" if store.target else None,
+            "content_role": "untrusted_code_evidence" if store.target else None,
+            "authoritative_for_policy": False,
+            "absence_authoritative": False,
+        },
         "coverage_contract": ("repository.evidence-coverage/v1" if store.coverage else "absent"),
         "base": store.base.commit_sha if store.base else None,
         "head": store.head.commit_sha if store.head else None,
@@ -233,8 +241,8 @@ def _list_records(store: EvidenceStore, arguments: dict[str, object]) -> dict[st
         raise EvidenceMCPError("delta_kind requires kind=repository.evidence_delta")
     if query.kind == "repository.evidence_delta" and query.ref is not None:
         raise EvidenceMCPError("evidence deltas span base and head and do not accept ref")
-    if query.ref not in {None, "base", "head", "policy", "shared"}:
-        raise EvidenceMCPError("ref must be base, head, policy, or shared")
+    if query.ref not in {None, "base", "head", "policy", "target", "shared"}:
+        raise EvidenceMCPError("ref must be base, head, policy, target, or shared")
     page_size = arguments.get("page_size", DEFAULT_PAGE_SIZE)
     if isinstance(page_size, bool) or not isinstance(page_size, int):
         raise EvidenceMCPError("page_size must be an integer")
@@ -375,8 +383,8 @@ def _search_records(store: EvidenceStore, arguments: dict[str, object]) -> dict[
         raise EvidenceMCPError("delta_kind requires kind=repository.evidence_delta")
     if kind == "repository.evidence_delta" and ref is not None:
         raise EvidenceMCPError("evidence deltas span base and head and do not accept ref")
-    if ref not in {None, "base", "head", "policy", "shared"}:
-        raise EvidenceMCPError("ref must be base, head, policy, or shared")
+    if ref not in {None, "base", "head", "policy", "target", "shared"}:
+        raise EvidenceMCPError("ref must be base, head, policy, target, or shared")
     max_results = arguments.get("max_results", DEFAULT_SEARCH_RESULTS)
     if isinstance(max_results, bool) or not isinstance(max_results, int):
         raise EvidenceMCPError("max_results must be an integer")
@@ -560,7 +568,8 @@ def _tool_definition() -> dict[str, object]:
     return {
         "name": TOOL_NAME,
         "description": (
-            "Read bounded, redacted repository evidence for immutable base/head refs. "
+            "Read bounded, redacted repository evidence for immutable base/head refs and "
+            "optional actual-target code context (ref=target). "
             "Use summary first, list to narrow, and get for one stable record. Query "
             "kind=repository.evidence_delta with optional delta_kind for base/head changes. "
             "Current structured decisions and guidance are target-derived non-authoritative "
@@ -601,7 +610,7 @@ def _tool_definition() -> dict[str, object]:
                 },
                 "ref": {
                     "type": "string",
-                    "enum": ["base", "head", "policy", "shared"],
+                    "enum": ["base", "head", "policy", "target", "shared"],
                     "description": "Optional immutable-ref filter for action=list only.",
                 },
                 "page_size": {
@@ -659,7 +668,7 @@ def _search_tool_definition() -> dict[str, object]:
                     ),
                 },
                 "component": {"type": "string", "maxLength": 256},
-                "ref": {"type": "string", "enum": ["base", "head", "policy", "shared"]},
+                "ref": {"type": "string", "enum": ["base", "head", "policy", "target", "shared"]},
                 "max_results": {
                     "type": "integer",
                     "minimum": 1,

{open_code_review_toolkit-0.12.1 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/evidence/model.py

@@ -43,6 +43,7 @@ class RefRole(str, Enum):
     BASE = "base"
     HEAD = "head"
     POLICY = "policy"
+    TARGET = "target"
     SHARED = "shared"
 
 
@@ -408,9 +409,9 @@ class EvidenceSnapshot:
         """Ensure snapshot records match the declared ref and are ordered."""
 
         if self.ref is RefRole.SHARED:
-            raise ValueError("snapshot ref must be base, head, or policy")
-        if self.ref is RefRole.POLICY and self.coverage:
-            raise ValueError("policy snapshot cannot contain coverage")
+            raise ValueError("snapshot ref must be base, head, policy, or target")
+        if self.ref in {RefRole.POLICY, RefRole.TARGET} and self.coverage:
+            raise ValueError("policy and target snapshots cannot contain coverage")
         if len(self.commit_sha) != 40 or not all(c in "0123456789abcdef" for c in self.commit_sha):
             raise ValueError("snapshot commit_sha must be a lowercase 40-character SHA-1")
         for record in self.records: