open-code-review-toolkit 0.8.3__tar.gz → 0.8.4__tar.gz

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: open-code-review-toolkit
-Version: 0.8.3
+Version: 0.8.4
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -249,7 +249,7 @@ ocr-ci --help
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.10.0 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The current OCR 1.10.1 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/README.md

@@ -22,7 +22,7 @@ ocr-ci --help
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.10.0 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The current OCR 1.10.1 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.8.3'
-__version_tuple__ = version_tuple = (0, 8, 3)
+__version__ = version = '0.8.4'
+__version_tuple__ = version_tuple = (0, 8, 4)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/context/dlp.py

@@ -109,7 +109,7 @@ class ForbiddenMatcher:
         exact: list[str] = []
         seen: set[str] = set()
         for value in values:
-            candidate = normalize_text(value)
+            candidate = normalize_text(value, allow_horizontal_tabs=True)
             if not candidate:
                 continue
             for representation in (_display_normalize(candidate), _source_normalize(candidate)):
@@ -157,14 +157,16 @@ class ForbiddenMatcher:
         return self.match_reason(value) is not None
 
 
-def normalize_text(value: object) -> str | None:
+def normalize_text(value: object, *, allow_horizontal_tabs: bool = False) -> str | None:
     """Normalize NFC/newlines and reject unsupported controls."""
 
     if not isinstance(value, str):
         return None
     normalized = unicodedata.normalize("NFC", value.replace("\r\n", "\n").replace("\r", "\n"))
+    allowed_controls = "\n\t" if allow_horizontal_tabs else "\n"
     if any(
-        unicodedata.category(character) in {"Cc", "Cf", "Cs", "Zl", "Zp"} and character != "\n"
+        unicodedata.category(character) in {"Cc", "Cf", "Cs", "Zl", "Zp"}
+        and character not in allowed_controls
         for character in normalized
     ):
         return None
@@ -178,10 +180,11 @@ def check_text(
     publication: bool = False,
     forbidden: tuple[str, ...] = (),
     forbidden_matcher: ForbiddenMatcher | None = None,
+    allow_horizontal_tabs: bool = False,
 ) -> DLPResult:
     """Apply independent units, redaction, PII, and optional publication checks."""
 
-    normalized = normalize_text(value)
+    normalized = normalize_text(value, allow_horizontal_tabs=allow_horizontal_tabs)
     if normalized is None:
         return DLPResult(False, None, "invalid_text", "type_or_control")
     normalized_bytes = normalized.encode("utf-8")

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/ocr_result.py

@@ -9,6 +9,7 @@ import secrets
 import stat
 import sys
 from collections.abc import Callable, Mapping
+from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
@@ -20,6 +21,11 @@ MAX_RESULT_BYTES_HARD_LIMIT = 20_000_000
 TOOLKIT_RESULT_KEY = "_ocr_toolkit"
 TOOLKIT_RESULT_SCHEMA_VERSION = 5
 SUPPORTED_TOOLKIT_RESULT_SCHEMA_VERSIONS = frozenset({TOOLKIT_RESULT_SCHEMA_VERSION})
+TOOLKIT_ADVISORY_KEY = "_ocr_toolkit_advisory"
+TOOLKIT_ADVISORY_SCHEMA_VERSION = "ocr.toolkit-advisory/v1"
+TOOLKIT_ADVISORY_KIND = "background_recommended_limit"
+TOOLKIT_ADVISORY_UNIT = "characters"
+MAX_TOOLKIT_ADVISORY_VALUE = 999_999_999_999
 # The receipt can name the 16 configured external servers plus the mandatory built-in.
 MAX_TOOLKIT_MCP_USAGE_SERVERS = 17
 MAX_TOOLKIT_MCP_TOOLS_PER_SERVER = 128
@@ -57,6 +63,69 @@ class OcrResultTooLarge(Exception):
     """The OCR result artifact exceeds the configured safety limit."""
 
 
+@dataclass(frozen=True, slots=True)
+class OcrToolkitAdvisory:
+    """Carry one validated toolkit-authored numeric OCR advisory."""
+
+    actual: int
+    recommended: int
+
+
+def parse_toolkit_advisory(value: Any) -> OcrToolkitAdvisory:
+    """Parse the exact private toolkit advisory without accepting extensions."""
+
+    if not isinstance(value, dict) or set(value) != {
+        "schema_version",
+        "kind",
+        "actual",
+        "recommended",
+        "unit",
+    }:
+        raise OcrResultMalformed("OCR toolkit advisory has an unsupported schema")
+    actual = value.get("actual")
+    recommended = value.get("recommended")
+    if (
+        value.get("schema_version") != TOOLKIT_ADVISORY_SCHEMA_VERSION
+        or value.get("kind") != TOOLKIT_ADVISORY_KIND
+        or value.get("unit") != TOOLKIT_ADVISORY_UNIT
+        or not isinstance(actual, int)
+        or isinstance(actual, bool)
+        or not isinstance(recommended, int)
+        or isinstance(recommended, bool)
+        or not 0 < recommended < actual <= MAX_TOOLKIT_ADVISORY_VALUE
+    ):
+        raise OcrResultMalformed("OCR toolkit advisory has invalid closed values")
+    return OcrToolkitAdvisory(actual=actual, recommended=recommended)
+
+
+def background_recommended_advisory(*, actual: int, recommended: int) -> OcrToolkitAdvisory:
+    """Construct one validated background recommendation advisory."""
+
+    return parse_toolkit_advisory(
+        {
+            "schema_version": TOOLKIT_ADVISORY_SCHEMA_VERSION,
+            "kind": TOOLKIT_ADVISORY_KIND,
+            "actual": actual,
+            "recommended": recommended,
+            "unit": TOOLKIT_ADVISORY_UNIT,
+        }
+    )
+
+
+def toolkit_advisory_payload(advisory: OcrToolkitAdvisory) -> dict[str, object]:
+    """Serialize a validated advisory into its exact private result shape."""
+
+    payload: dict[str, object] = {
+        "schema_version": TOOLKIT_ADVISORY_SCHEMA_VERSION,
+        "kind": TOOLKIT_ADVISORY_KIND,
+        "actual": advisory.actual,
+        "recommended": advisory.recommended,
+        "unit": TOOLKIT_ADVISORY_UNIT,
+    }
+    parse_toolkit_advisory(payload)
+    return payload
+
+
 def max_result_bytes() -> int:
     """Return the maximum OCR JSON artifact size to read into memory."""
 
@@ -234,7 +303,16 @@ def _decode_result(data: bytes) -> Any:
     except UnicodeDecodeError as exc:
         raise OcrResultMalformed(str(exc)) from exc
     try:
-        return json.loads(text)
+
+        def reject_duplicate_advisory(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+            result: dict[str, Any] = {}
+            for key, value in pairs:
+                if key == TOOLKIT_ADVISORY_KEY and key in result:
+                    raise OcrResultMalformed("OCR result repeats the reserved toolkit advisory")
+                result[key] = value
+            return result
+
+        return json.loads(text, object_pairs_hook=reject_duplicate_advisory)
     except (json.JSONDecodeError, RecursionError) as exc:
         raise OcrResultMalformed(str(exc)) from exc
 

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/posting/approval.py

@@ -14,10 +14,11 @@ from ocr_toolkit.ocr_result import (
     TOOLKIT_MCP_SERVER_NAME_RE,
 )
 from ocr_toolkit.posting.settings import BooleanSetting
-from ocr_toolkit.result_contract import ReviewOutcome
+from ocr_toolkit.result_contract import OcrResultContractError, ReviewOutcome
 
 ALLOWED_CATEGORIES = frozenset({"style", "documentation", "maintainability"})
 MAX_APPROVABLE_FINDINGS = 3
+INVALID_APPROVAL_RECEIPT_REASON = "the review-time approval receipt is missing or invalid"
 
 
 class ApprovalStatus(str, Enum):
@@ -218,6 +219,23 @@ def publication_dlp_state(value: Any) -> str | None:
         )
     ):
         return None
+    selected = original["selected"]
+    completed = original["completed"]
+    reused = original["reused"]
+    failed = original["failed"]
+    waived = original["waived"]
+    outcome = original["outcome"]
+    derived_outcomes = {"failed"} | (
+        {"skipped"}
+        if selected == 0
+        else {"clean", "warning"}
+        if failed == 0
+        else {"failed"}
+        if failed == selected
+        else {"partial"}
+    )
+    if selected != completed + reused + failed + waived or outcome not in derived_outcomes:
+        return None
     return "publication-filtered"
 
 
@@ -237,7 +255,7 @@ def _valid_dlp_reason_counts(value: Any) -> bool:
 def automatic_approval_metadata_reason(toolkit_metadata: Any) -> str:
     """Return the closed review-time receipt blocker for automatic approval."""
 
-    invalid = "the review-time approval receipt is missing or invalid"
+    invalid = INVALID_APPROVAL_RECEIPT_REASON
     if not isinstance(toolkit_metadata, dict):
         return invalid
     if toolkit_metadata.get("schema_version") != 5 or set(toolkit_metadata) != {
@@ -433,6 +451,51 @@ def automatic_approval_metadata_reason(toolkit_metadata: Any) -> str:
     return ""
 
 
+def toolkit_receipt_is_valid(toolkit_metadata: Any) -> bool:
+    """Return whether metadata is an exact receipt v5, including valid blockers."""
+
+    return automatic_approval_metadata_reason(toolkit_metadata) != INVALID_APPROVAL_RECEIPT_REASON
+
+
+def publication_outcome_for_summary(outcome: ReviewOutcome, publication: Any) -> ReviewOutcome:
+    """Recover only validated original coverage facts from a filtered receipt."""
+
+    if publication_dlp_state(publication) != "publication-filtered":
+        return outcome
+    if outcome.kind != "partial" or outcome.manifest_present:
+        raise OcrResultContractError(
+            "publication-filtered receipt is not bound to a safe result projection"
+        )
+    original = publication["original"]
+    kind = original["outcome"]
+    if outcome.budget_exceeded and kind != "partial":
+        raise OcrResultContractError(
+            "publication-filtered receipt contradicts the result budget state"
+        )
+    counts = {
+        field: original[field] for field in ("selected", "completed", "reused", "failed", "waived")
+    }
+    manifest_present = any(counts.values())
+    status = {
+        "clean": "complete" if manifest_present else "success",
+        "warning": "completed_with_warnings",
+        "partial": "budget_exceeded" if outcome.budget_exceeded else "completed_with_errors",
+        "failed": "failed",
+        "skipped": "skipped",
+    }[kind]
+    return ReviewOutcome(
+        status=status,
+        kind=kind,
+        budget_exceeded=outcome.budget_exceeded and kind == "partial",
+        manifest_present=manifest_present,
+        selected_count=counts["selected"],
+        completed_count=counts["completed"],
+        reused_count=counts["reused"],
+        failed_count=counts["failed"],
+        waived_count=counts["waived"],
+    )
+
+
 def _valid_evidence_actions(value: Any, evidence_calls: Any) -> bool:
     """Validate verified counts or an explicit unavailable attribution state."""
 

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/posting/formatting.py

@@ -23,6 +23,7 @@ from ocr_toolkit.ocr_result import (
     PUBLIC_REVIEW_TOOL_CALL_NAMES,
     SUPPORTED_TOOLKIT_RESULT_SCHEMA_VERSIONS,
     TOOLKIT_MCP_SERVER_NAME_RE,
+    OcrToolkitAdvisory,
 )
 from ocr_toolkit.posting.approval import (
     ApprovalResult,
@@ -599,10 +600,10 @@ def format_publication_dlp_details(signal: dict[str, Any] | None) -> str:
     omitted = signal["omitted"]
     carried = signal["carried_forward_comments"]
     completeness = (
-        "One or more publication units were omitted, so this review is partial and cannot "
-        "authorize automatic approval."
+        "One or more public projection units were omitted. OCR coverage is reported "
+        "separately, and automatic approval remains unavailable."
         if omitted["comments"] or omitted["warnings"]
-        else "The canonical publication or approval projection changed, so automatic approval remains unavailable."
+        else "The public projection changed, so automatic approval remains unavailable."
     )
     return "\n".join(
         [
@@ -830,7 +831,11 @@ def format_reviewer_guide(
         enumerate(comments),
         key=lambda item: _guide_comment_rank(item[1], item[0]),
     )
-    guide_comments = [comment for _, comment in ranked_comments[:MAX_REVIEWER_GUIDE_COMMENTS]]
+    guide_comments = (
+        [comment for _, comment in ranked_comments[:MAX_REVIEWER_GUIDE_COMMENTS]]
+        if len(comments) >= 2
+        else []
+    )
     if guide_comments:
         lines.append("")
         lines.append("### Recommended focus areas")
@@ -879,6 +884,8 @@ def _review_outcome_line(
             marker, status_text = "⚠️", "Review stopped at token budget"
         elif partial_result:
             marker, status_text = "⚠️", "Review incomplete"
+        elif outcome_status == "publication-filtered":
+            marker, status_text = "⚠️", "Review complete with publication filtering"
         elif outcome_status in {"warning", "completed_with_warnings"} or warning_count:
             marker, status_text = "⚠️", "Review complete with warnings"
         elif has_finding_state:
@@ -922,6 +929,17 @@ def _review_outcome_line(
     return f"{prefix}**{status_text} — {result_text}**"
 
 
+def format_ocr_core_advisory(advisory: OcrToolkitAdvisory | None) -> str:
+    """Render one validated numeric OCR advisory for Technical details only."""
+
+    if advisory is None:
+        return ""
+    return (
+        f"- OCR core advisory: background {advisory.actual} characters; recommended "
+        f"{advisory.recommended} characters; accepted by OCR core"
+    )
+
+
 def summarize_result(
     total: int,
     inline_count: int,
@@ -933,6 +951,7 @@ def summarize_result(
     tool_calls_summary: str = "",
     mcp_usage_summary: str = "",
     token_usage_summary: str = "",
+    ocr_core_advisory_summary: str = "",
     publication_dlp_details: str = "",
     reviewer_guide: str = "",
     fallback_reasons: Mapping[str, int] | None = None,
@@ -1044,7 +1063,12 @@ def summarize_result(
         )
         if reasons:
             technical.append(f"- Fallback reasons: {reasons}")
-    for summary in (mcp_usage_summary, tool_calls_summary, token_usage_summary):
+    for summary in (
+        mcp_usage_summary,
+        tool_calls_summary,
+        token_usage_summary,
+        ocr_core_advisory_summary,
+    ):
         if summary:
             technical.append(summary)
     technical.append(f"- Review mode: `{post_mode()}`")

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/posting/result.py

@@ -122,7 +122,10 @@ def _safe_detail(value: object, reason: str) -> str:
 
 
 def normalize_coverage_diagnostics(
-    outcome: ReviewOutcome, warnings: Sequence[Any]
+    outcome: ReviewOutcome,
+    warnings: Sequence[Any],
+    *,
+    legacy_warning_fallback: bool = True,
 ) -> CoverageDiagnostics:
     """Normalize manifest failures or legacy warnings once at the posting boundary."""
 
@@ -136,7 +139,7 @@ def normalize_coverage_diagnostics(
             )
             for item in outcome.failed_items
         )
-    elif outcome.kind == "partial":
+    elif outcome.kind == "partial" and legacy_warning_fallback:
         for warning in warnings:
             path = warning.get("file") or warning.get("path") if isinstance(warning, dict) else None
             candidates.append((path, _legacy_reason(warning), ocr_warning_text(warning)))

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/posting/workflow.py

@@ -17,11 +17,13 @@ from ocr_toolkit.common.git import isolated_git_environment, read_only_git_prefi
 from ocr_toolkit.common.markdown import markdown_code_block, neutralize_quick_actions
 from ocr_toolkit.evidence.artifacts import repository_artifacts
 from ocr_toolkit.ocr_result import (
+    TOOLKIT_ADVISORY_KEY,
     TOOLKIT_RESULT_KEY,
     OcrResultMalformed,
     OcrResultMissing,
     OcrResultTooLarge,
     load_ocr_result,
+    parse_toolkit_advisory,
 )
 from ocr_toolkit.posting import gitlab as gitlab_api
 from ocr_toolkit.posting.approval import (
@@ -31,6 +33,8 @@ from ocr_toolkit.posting.approval import (
     evaluate_approval_policy,
     provisional_approval_result,
     publication_dlp_state,
+    publication_outcome_for_summary,
+    toolkit_receipt_is_valid,
 )
 from ocr_toolkit.posting.comments import (
     clean_text,
@@ -41,6 +45,7 @@ from ocr_toolkit.posting.formatting import (
     format_fallback_comment_chunks,
     format_inline_comment,
     format_mcp_usage_summary,
+    format_ocr_core_advisory,
     format_omitted_comments_summary,
     format_publication_dlp_details,
     format_reviewer_guide,
@@ -625,6 +630,19 @@ def post_results(config: GitLabConfig, result: dict[str, Any]) -> int:
             title="**Open Code Review publication policy error**",
         )
 
+    advisory = None
+    if TOOLKIT_ADVISORY_KEY in result:
+        try:
+            advisory = parse_toolkit_advisory(result[TOOLKIT_ADVISORY_KEY])
+        except OcrResultMalformed as exc:
+            return invalid_ocr_schema_exit(config, str(exc))
+        if not toolkit_receipt_is_valid(toolkit_metadata):
+            return invalid_ocr_schema_exit(
+                config,
+                "OCR toolkit advisory is not bound to a valid receipt v5",
+            )
+    ocr_core_advisory_summary = format_ocr_core_advisory(advisory)
+
     comments_value = result.get("comments", [])
     warnings_value = result.get("warnings", [])
     tool_calls_summary = format_tool_calls_summary(result.get("tool_calls"))
@@ -651,16 +669,25 @@ def post_results(config: GitLabConfig, result: dict[str, Any]) -> int:
     approval_comments = list(comments)
 
     warnings = warnings_value
-    coverage_diagnostics = normalize_coverage_diagnostics(outcome, warnings)
-    if outcome.kind == "failed":
+    try:
+        summary_outcome = publication_outcome_for_summary(outcome, publication)
+    except OcrResultContractError as exc:
+        return invalid_ocr_schema_exit(config, str(exc))
+    coverage_diagnostics = normalize_coverage_diagnostics(
+        summary_outcome,
+        warnings,
+        legacy_warning_fallback=publication_state != "publication-filtered",
+    )
+    if summary_outcome.kind == "failed":
         return post_manifest_failure(
             config,
-            outcome,
+            summary_outcome,
             outcome_message,
             warnings,
             tool_calls_summary=tool_calls_summary,
             mcp_usage_summary=mcp_usage_summary,
             token_usage_summary=token_usage_summary,
+            ocr_core_advisory_summary=ocr_core_advisory_summary,
         )
 
     billing_reason = llm_billing_failure_reason(warnings)
@@ -733,11 +760,19 @@ def post_results(config: GitLabConfig, result: dict[str, Any]) -> int:
     summary_run_id = secrets.token_hex(16)
     receipt_sha, reviewed_author_id = approval_receipt_identity(result.get(TOOLKIT_RESULT_KEY))
     reviewed_commit = receipt_sha or reviewed_sha()
+    summary_status = (
+        "publication-filtered"
+        if publication_state == "publication-filtered"
+        and summary_outcome.kind in {"clean", "warning"}
+        else "budget_exceeded"
+        if summary_outcome.budget_exceeded
+        else summary_outcome.kind
+    )
     reviewer_guide = format_reviewer_guide(
         comments,
         omitted_count,
-        outcome_status="budget_exceeded" if outcome.budget_exceeded else outcome.kind,
-        coverage_summary=outcome.coverage_summary,
+        outcome_status=summary_status,
+        coverage_summary=summary_outcome.coverage_summary,
     )
 
     if publishable_comment_count == 0:
@@ -754,13 +789,14 @@ def post_results(config: GitLabConfig, result: dict[str, Any]) -> int:
                 tool_calls_summary=tool_calls_summary,
                 mcp_usage_summary=mcp_usage_summary,
                 token_usage_summary=token_usage_summary,
+                ocr_core_advisory_summary=ocr_core_advisory_summary,
                 publication_dlp_details=dlp_details,
                 reviewer_guide=reviewer_guide,
                 reviewed_sha=reviewed_commit,
                 mr_head_sha=mr_head_sha(),
-                outcome_status=("budget_exceeded" if outcome.budget_exceeded else outcome.kind),
+                outcome_status=summary_status,
                 outcome_message=outcome_message,
-                coverage_summary=outcome.coverage_summary,
+                coverage_summary=summary_outcome.coverage_summary,
                 coverage_diagnostics=coverage_diagnostics,
                 warnings=warnings,
                 suppressed_count=suppressed_count,
@@ -940,14 +976,15 @@ def post_results(config: GitLabConfig, result: dict[str, Any]) -> int:
             tool_calls_summary=tool_calls_summary,
             mcp_usage_summary=mcp_usage_summary,
             token_usage_summary=token_usage_summary,
+            ocr_core_advisory_summary=ocr_core_advisory_summary,
             publication_dlp_details=dlp_details,
             reviewer_guide=reviewer_guide,
             fallback_reasons=fallback_reasons,
             reviewed_sha=reviewed_commit,
             mr_head_sha=mr_head_sha(),
-            outcome_status="budget_exceeded" if outcome.budget_exceeded else outcome.kind,
+            outcome_status=summary_status,
             outcome_message=outcome_message,
-            coverage_summary=outcome.coverage_summary,
+            coverage_summary=summary_outcome.coverage_summary,
             coverage_diagnostics=coverage_diagnostics,
             warnings=warnings,
             suppressed_count=suppressed_count,
@@ -1060,6 +1097,7 @@ def post_manifest_failure(
     tool_calls_summary: str = "",
     mcp_usage_summary: str = "",
     token_usage_summary: str = "",
+    ocr_core_advisory_summary: str = "",
 ) -> int:
     """Post a manifest-declared run failure while preserving prior review notes."""
 
@@ -1072,6 +1110,7 @@ def post_manifest_failure(
         tool_calls_summary=tool_calls_summary,
         mcp_usage_summary=mcp_usage_summary,
         token_usage_summary=token_usage_summary,
+        ocr_core_advisory_summary=ocr_core_advisory_summary,
         outcome_status="failed",
         outcome_message=message,
         coverage_summary=outcome.coverage_summary,

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/preflight.py

@@ -28,7 +28,7 @@ DEFAULT_REQUEST_HEADERS = {
     "Accept": "application/json",
     "User-Agent": "open-code-review-ci-preflight/1.0",
 }
-EXPECTED_OCR_VERSION = "1.10.0"
+EXPECTED_OCR_VERSION = "1.10.1"
 
 
 class PreflightError(Exception):

{open_code_review_toolkit-0.8.3 → open_code_review_toolkit-0.8.4}/src/ocr_toolkit/review_runner.py

@@ -76,13 +76,17 @@ from ocr_toolkit.evidence.store import EvidenceStore, EvidenceStoreError
 from ocr_toolkit.ocr_result import (
     MAX_TOOLKIT_MCP_USAGE_COUNT,
     PUBLIC_REVIEW_TOOL_CALL_NAMES,
+    TOOLKIT_ADVISORY_KEY,
     TOOLKIT_RESULT_KEY,
     TOOLKIT_RESULT_SCHEMA_VERSION,
     OcrResultMalformed,
     OcrResultMissing,
     OcrResultTooLarge,
+    OcrToolkitAdvisory,
+    background_recommended_advisory,
     inspect_ocr_result,
     load_ocr_result,
+    toolkit_advisory_payload,
     transform_ocr_result,
 )
 from ocr_toolkit.posting.result import ocr_warning_text
@@ -156,7 +160,7 @@ class ReviewRunnerError(Exception):
 class BackgroundQualification:
     """Carry closed toolkit-authored projections of installed OCR diagnostics."""
 
-    warning: str | None = None
+    advisory: OcrToolkitAdvisory | None = None
     operator_notices: tuple[str, ...] = ()
 
 
@@ -441,7 +445,13 @@ def _review_receipt(
     }
 
 
-def _dlp_reasons(value: object, *, budgets: TextBudgets, matcher: ForbiddenMatcher) -> Counter[str]:
+def _dlp_reasons(
+    value: object,
+    *,
+    budgets: TextBudgets,
+    matcher: ForbiddenMatcher,
+    allow_horizontal_tabs: bool = False,
+) -> Counter[str]:
     """Count closed DLP failures without retaining hostile strings or locations."""
 
     reasons: Counter[str] = Counter()
@@ -459,12 +469,24 @@ def _dlp_reasons(value: object, *, budgets: TextBudgets, matcher: ForbiddenMatch
                 budgets=budgets,
                 publication=True,
                 forbidden_matcher=matcher,
+                allow_horizontal_tabs=allow_horizontal_tabs,
             )
             if not checked.admitted:
                 reasons[checked.reason] += 1
     return reasons
 
 
+def _code_field_allows_horizontal_tabs(path: tuple[object, ...]) -> bool:
+    """Allow HTAB only in the two closed code-bearing finding fields."""
+
+    return bool(
+        len(path) == 3
+        and path[0] == "comments"
+        and isinstance(path[1], int)
+        and path[2] in {"existing_code", "suggestion_code"}
+    )
+
+
 def _private_dlp_decisions(
     payload: dict[str, object], *, forbidden: tuple[str, ...]
 ) -> dict[str, object]:
@@ -527,6 +549,7 @@ def _private_dlp_decisions(
             budgets=budgets,
             publication=True,
             forbidden_matcher=matcher,
+            allow_horizontal_tabs=_code_field_allows_horizontal_tabs(path),
         )
         if checked.admitted:
             continue
@@ -582,32 +605,36 @@ def _write_private_dlp_decisions(
         raise ReviewRunnerError("OCR private DLP diagnostics could not be written") from exc
 
 
-def _publication_sinks(payload: dict[str, object]) -> list[object]:
+def _publication_sinks(payload: dict[str, object]) -> list[tuple[object, bool]]:
     """Select only OCR-controlled values that the posting owner can render."""
 
-    sinks: list[object] = []
+    sinks: list[tuple[object, bool]] = []
     message = payload.get("message")
     if message is not None:
-        sinks.append(message)
+        sinks.append((message, False))
     comments = payload.get("comments")
     if isinstance(comments, list):
-        sinks.extend(
-            {key: value for key, value in item.items() if key in QUARANTINE_COMMENT_FIELDS}
-            for item in comments
-            if isinstance(item, dict)
-        )
+        for item in comments:
+            if not isinstance(item, dict):
+                continue
+            sinks.extend(
+                (
+                    value,
+                    isinstance(value, str) and key in {"existing_code", "suggestion_code"},
+                )
+                for key, value in item.items()
+                if key in QUARANTINE_COMMENT_FIELDS
+            )
     warnings = payload.get("warnings")
     if warnings is not None:
-        sinks.append(warnings)
+        sinks.append((warnings, False))
     manifest = payload.get("manifest")
     coverage = manifest.get("coverage") if isinstance(manifest, dict) else None
     failed = coverage.get("failed") if isinstance(coverage, dict) else None
     if isinstance(failed, list):
-        sinks.extend(
-            {key: item.get(key) for key in ("path", "reason") if key in item}
-            for item in failed
-            if isinstance(item, dict)
-        )
+        for item in failed:
+            if isinstance(item, dict):
+                sinks.extend((item[key], False) for key in ("path", "reason") if key in item)
     return sinks
 
 
@@ -729,7 +756,14 @@ def _safe_publication_comments(
         for key, field_value in item.items():
             if not isinstance(key, str) or key not in QUARANTINE_COMMENT_FIELDS:
                 continue
-            if _dlp_reasons(field_value, budgets=budgets, matcher=matcher):
+            if _dlp_reasons(
+                field_value,
+                budgets=budgets,
+                matcher=matcher,
+                allow_horizontal_tabs=(
+                    isinstance(field_value, str) and key in {"existing_code", "suggestion_code"}
+                ),
+            ):
                 omitted_fields += 1
                 content_unsafe = content_unsafe or key == "content"
                 continue
@@ -844,8 +878,15 @@ def _publication_projection(
     budgets = TextBudgets(max_chars=2_000_000, max_bytes=8_000_000, max_lines=100_000)
     matcher = ForbiddenMatcher.compile(forbidden)
     sink_reasons: Counter[str] = Counter()
-    for sink in _publication_sinks(payload):
-        sink_reasons.update(_dlp_reasons(sink, budgets=budgets, matcher=matcher))
+    for sink, allow_horizontal_tabs in _publication_sinks(payload):
+        sink_reasons.update(
+            _dlp_reasons(
+                sink,
+                budgets=budgets,
+                matcher=matcher,
+                allow_horizontal_tabs=allow_horizontal_tabs,
+            )
+        )
     sanitized, private_reasons, redacted_fields = _sanitize_nonpublication_fields(
         payload, budgets=budgets, matcher=matcher
     )
@@ -871,7 +912,7 @@ def _publication_projection(
             payload.get("warnings"), budgets=budgets, matcher=matcher
         )
         projected: dict[str, object] = {
-            "status": "completed_with_errors",
+            "status": "budget_exceeded" if outcome.budget_exceeded else "completed_with_errors",
             "message": (
                 "Publication policy produced a safe partial OCR result. Independently safe "
                 "findings may be published, but the result must not be treated as a complete "
@@ -883,6 +924,8 @@ def _publication_projection(
                 payload.get("tool_calls"), allowed_tools=allowed_tools
             ),
         }
+        if outcome.budget_exceeded:
+            projected["summary"] = {"budget_exceeded": True}
     else:
         reasons = sink_reasons + private_reasons
         return (
@@ -924,7 +967,7 @@ def _finalize_ocr_result(
     evidence_action_counts: dict[str, int] | None = None,
     *,
     forbidden: tuple[str, ...],
-    toolkit_warnings: tuple[str, ...] = (),
+    toolkit_advisory: OcrToolkitAdvisory | None = None,
 ) -> tuple[dict[str, int], bool, dict[str, object]]:
     """Validate, DLP-project, and receipt-bind one result in one atomic read/replace."""
 
@@ -935,25 +978,12 @@ def _finalize_ocr_result(
 
     def finalize(payload: dict[str, object]) -> dict[str, object]:
         nonlocal filtered, publication, usage
-        if TOOLKIT_RESULT_KEY in payload:
-            raise OcrResultMalformed(f"OCR result contains reserved field {TOOLKIT_RESULT_KEY!r}")
+        for reserved in (TOOLKIT_RESULT_KEY, TOOLKIT_ADVISORY_KEY):
+            if reserved in payload:
+                raise OcrResultMalformed(f"OCR result contains reserved field {reserved!r}")
         warnings = payload.get("warnings", [])
         if not isinstance(warnings, list):
             raise OcrResultMalformed("OCR result warnings must be a list")
-        warning_texts = {ocr_warning_text(warning) for warning in warnings}
-        appended_warnings: list[str] = []
-        for warning in toolkit_warnings:
-            if warning in warning_texts:
-                continue
-            warning_texts.add(warning)
-            appended_warnings.append(warning)
-        payload = {
-            **payload,
-            "warnings": [
-                *warnings,
-                *appended_warnings,
-            ],
-        }
         metadata = _review_receipt(
             payload,
             composition,
@@ -969,7 +999,10 @@ def _finalize_ocr_result(
         mcp = metadata.get("mcp")
         raw_usage = mcp.get("usage") if isinstance(mcp, dict) else None
         usage = dict(raw_usage) if isinstance(raw_usage, dict) else {}
-        return {**projected, TOOLKIT_RESULT_KEY: metadata}
+        finalized = {**projected, TOOLKIT_RESULT_KEY: metadata}
+        if toolkit_advisory is not None:
+            finalized[TOOLKIT_ADVISORY_KEY] = toolkit_advisory_payload(toolkit_advisory)
+        return finalized
 
     try:
         transform_ocr_result(result_path, finalize)
@@ -1158,14 +1191,14 @@ def _parse_background_preview(*, returncode: int, stderr: bytes) -> BackgroundQu
             or len(max_tools_matches) > 1
         ):
             raise ReviewRunnerError("OCR background preview returned ambiguous diagnostics")
-        warning: str | None = None
+        advisory: OcrToolkitAdvisory | None = None
         if soft_matches:
             actual, limit = (int(value) for value in soft_matches[0].groups())
             if not 0 < limit < actual:
                 raise ReviewRunnerError("OCR background preview returned invalid thresholds")
-            warning = (
-                f"Installed OCR reported a {actual}-character review background above its "
-                f"recommended {limit}-character threshold; review continued."
+            advisory = background_recommended_advisory(
+                actual=actual,
+                recommended=limit,
             )
         operator_notices: tuple[str, ...] = ()
         if max_tools_matches:
@@ -1179,7 +1212,7 @@ def _parse_background_preview(*, returncode: int, stderr: bytes) -> BackgroundQu
                 "effective tool-call limit.",
             )
         return BackgroundQualification(
-            warning=warning,
+            advisory=advisory,
             operator_notices=operator_notices,
         )
     if hard_character is not None:
@@ -1295,9 +1328,11 @@ def _run_background_qualified_review(
             file=sys.stderr,
         )
         return 2, BackgroundQualification()
-    if qualification.warning is not None:
+    if qualification.advisory is not None:
         print(
-            f"OCR background qualification warning: {qualification.warning}",
+            "OCR core advisory: "
+            f"background {qualification.advisory.actual} characters; recommended "
+            f"{qualification.advisory.recommended} characters; accepted by OCR core",
             file=sys.stderr,
         )
     for notice in qualification.operator_notices:
@@ -1933,11 +1968,7 @@ def run_evidence_review(
                         enrichment,
                         evidence_action_counts,
                         forbidden=forbidden,
-                        toolkit_warnings=(
-                            (background_qualification.warning,)
-                            if background_qualification.warning is not None
-                            else ()
-                        ),
+                        toolkit_advisory=background_qualification.advisory,
                     )
                 except ReviewRunnerError:
                     try: