open-code-review-toolkit 0.8.4__tar.gz → 0.8.6__tar.gz

{open_code_review_toolkit-0.8.4 → open_code_review_toolkit-0.8.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: open-code-review-toolkit
-Version: 0.8.4
+Version: 0.8.6
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -238,18 +238,45 @@ Open Code Review Toolkit is an unofficial GitLab CI integration layer for [Aliba
 
 ## Install
 
-Install the Python package from PyPI and install a supported OCR binary separately:
+Python 3.12 through 3.14 is supported. Install the toolkit CLI in an isolated tool
+environment:
 
 ```console
+uv tool install open-code-review-toolkit
+```
+
+If `uv` is unavailable, use `pip` only inside an activated virtual environment; do not
+install the toolkit into a global Python environment:
+
+```console
+python -m venv .venv
+. .venv/bin/activate
 python -m pip install open-code-review-toolkit
+```
+
+The toolkit does not bundle OCR. Download the platform asset for exact
+[Open Code Review 1.11.0](https://github.com/alibaba/open-code-review/releases/tag/v1.11.0),
+verify it before installation against the [compatibility manifest](compatibility/ocr-support.json),
+and place the verified binary on `PATH`. The current Linux amd64 digest is
+`13f68cc2eca1a36d42140e9d37797b68fea5cbbf4b6345ec01ec1b06910fab60`; Darwin arm64 is
+`ac8bf5a0fcd176bb9dcc15b169e90f4b52bf32787adef17a850489dbed97fb78`. The manifest owns
+the other platform hashes.
+
+Verify the installation without contacting an LLM provider:
+
+```console
 ocr --version
 ocr-ci --help
 ```
 
+`ocr --version` must report `open-code-review v1.11.0`; `ocr-ci --help` must exit
+successfully. `ocr-ci preflight` is an operational configuration check, not the installation
+smoke test.
+
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.10.1 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The current OCR 1.11.0 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 

{open_code_review_toolkit-0.8.4 → open_code_review_toolkit-0.8.6}/README.md

@@ -11,18 +11,45 @@ Open Code Review Toolkit is an unofficial GitLab CI integration layer for [Aliba
 
 ## Install
 
-Install the Python package from PyPI and install a supported OCR binary separately:
+Python 3.12 through 3.14 is supported. Install the toolkit CLI in an isolated tool
+environment:
 
 ```console
+uv tool install open-code-review-toolkit
+```
+
+If `uv` is unavailable, use `pip` only inside an activated virtual environment; do not
+install the toolkit into a global Python environment:
+
+```console
+python -m venv .venv
+. .venv/bin/activate
 python -m pip install open-code-review-toolkit
+```
+
+The toolkit does not bundle OCR. Download the platform asset for exact
+[Open Code Review 1.11.0](https://github.com/alibaba/open-code-review/releases/tag/v1.11.0),
+verify it before installation against the [compatibility manifest](compatibility/ocr-support.json),
+and place the verified binary on `PATH`. The current Linux amd64 digest is
+`13f68cc2eca1a36d42140e9d37797b68fea5cbbf4b6345ec01ec1b06910fab60`; Darwin arm64 is
+`ac8bf5a0fcd176bb9dcc15b169e90f4b52bf32787adef17a850489dbed97fb78`. The manifest owns
+the other platform hashes.
+
+Verify the installation without contacting an LLM provider:
+
+```console
 ocr --version
 ocr-ci --help
 ```
 
+`ocr --version` must report `open-code-review v1.11.0`; `ocr-ci --help` must exit
+successfully. `ocr-ci preflight` is an operational configuration check, not the installation
+smoke test.
+
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.10.1 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The current OCR 1.11.0 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 

{open_code_review_toolkit-0.8.4 → open_code_review_toolkit-0.8.6}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.8.4'
-__version_tuple__ = version_tuple = (0, 8, 4)
+__version__ = version = '0.8.6'
+__version_tuple__ = version_tuple = (0, 8, 6)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.8.4 → open_code_review_toolkit-0.8.6}/src/ocr_toolkit/posting/formatting.py

@@ -650,10 +650,17 @@ SECURITY_SIGNAL_RE = re.compile(
     r"(?i)\b("
     r"security|credential|secret|token|password|private[_ -]?token|"
     r"client[_ -]?secret|api[_ -]?key|authorization|auth|"
-    r"injection|xss|csrf|ssrf|rce|path traversal|host header|"
+    r"xss|csrf|ssrf|rce|path traversal|host header|"
     r"privilege|permission|access control|vault|leak"
     r")\b"
 )
+SECURITY_INJECTION_RE = re.compile(
+    r"(?i)(?<!\w)(?:"
+    r"(?:os[\s_-]+)?command|shell(?:[\s_-]+command)?|sql|nosql|code|"
+    r"(?:server[\s_-]+side[\s_-]+)?template|prompt|ldap|xpath|crlf|"
+    r"(?:http[\s_-]+)?header|log|html|script|expression"
+    r")[\s_\-\u2010-\u2015]+injection(?!\w)"
+)
 
 
 HIGH_SIGNAL_RE = re.compile(r"(?i)\b(high|critical|blocker|security)\b")
@@ -674,7 +681,8 @@ def comment_signal_text(comment: dict[str, Any]) -> str:
 def comment_has_security_signal(comment: dict[str, Any]) -> bool:
     """Return true only when OCR text explicitly carries security wording."""
 
-    return bool(SECURITY_SIGNAL_RE.search(comment_signal_text(comment)))
+    text = comment_signal_text(comment)
+    return bool(SECURITY_SIGNAL_RE.search(text) or SECURITY_INJECTION_RE.search(text))
 
 
 def comment_is_high_signal(comment: dict[str, Any]) -> bool:

{open_code_review_toolkit-0.8.4 → open_code_review_toolkit-0.8.6}/src/ocr_toolkit/posting/workflow.py

@@ -1151,7 +1151,7 @@ def post_llm_provider_failure(
         ),
         ProviderFailureReason.RATE_OR_SPENDING_LIMIT: (
             "The LLM provider rejected the request under a rate or spending limit.",
-            "The cause may be ordinary throttling, an account or API-key spending limit, or cost reservation from the requested output cap. Retry later and check account limits. If short probes pass but a full review fails before generation, try an explicit `OCR_LLM_MAX_COMPLETION_TOKENS`, for example `4096`.",
+            "Try lowering `OCR_REVIEW_CONCURRENCY` and/or `OCR_LLM_MAX_COMPLETION_TOKENS`, then start a new merge request pipeline. If it still fails, check the provider's request and account limits.",
         ),
         ProviderFailureReason.OVERLOADED: (
             "The LLM provider reported that it was overloaded.",

{open_code_review_toolkit-0.8.4 → open_code_review_toolkit-0.8.6}/src/ocr_toolkit/preflight.py

@@ -28,7 +28,7 @@ DEFAULT_REQUEST_HEADERS = {
     "Accept": "application/json",
     "User-Agent": "open-code-review-ci-preflight/1.0",
 }
-EXPECTED_OCR_VERSION = "1.10.1"
+EXPECTED_OCR_VERSION = "1.11.0"
 
 
 class PreflightError(Exception):

{open_code_review_toolkit-0.8.4 → open_code_review_toolkit-0.8.6}/src/ocr_toolkit/provider_failure.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 from collections import Counter
 from collections.abc import Mapping
+from dataclasses import dataclass
 from enum import StrEnum
 from typing import Any
 
@@ -47,6 +48,55 @@ class ProviderFailureReason(StrEnum):
     UNKNOWN = "unknown"
 
 
+class ProviderFailureDetail(StrEnum):
+    """Closed protocol detail safe for one toolkit-authored CI diagnostic."""
+
+    HTTP_BAD_REQUEST = "http-bad-request"
+    HTTP_UNAUTHORIZED = "http-unauthorized"
+    HTTP_PAYMENT_REQUIRED = "http-payment-required"
+    HTTP_FORBIDDEN = "http-forbidden"
+    HTTP_NOT_FOUND = "http-not-found"
+    HTTP_REQUEST_TIMEOUT = "http-request-timeout"
+    HTTP_CONFLICT = "http-conflict"
+    HTTP_CONTENT_TOO_LARGE = "http-content-too-large"
+    HTTP_UNPROCESSABLE_CONTENT = "http-unprocessable-content"
+    HTTP_RATE_LIMITED = "http-rate-limited"
+    HTTP_GATEWAY_TIMEOUT = "http-gateway-timeout"
+    HTTP_OVERLOADED = "http-overloaded"
+    HTTP_SERVER_ERROR = "http-server-error"
+    HTTP_NON_SUCCESS = "http-non-success"
+    RESPONSE_DECODE = "response-decode"
+    RESPONSE_STATUS = "response-status"
+    STREAM = "stream"
+    CANCELLED = "cancelled"
+    TIMEOUT = "timeout"
+    NETWORK = "network"
+    UNKNOWN = "unknown"
+
+
+@dataclass(frozen=True)
+class ProviderFailureProjection:
+    """Validated provider-neutral failure state retained only for operator output."""
+
+    reason: ProviderFailureReason
+    details: tuple[tuple[ProviderFailureDetail, int], ...]
+    status_code: int | None
+    failed_requests: int
+    cancelled_requests: int
+    retried_requests: int
+    total_retries: int
+    recovered_requests: int
+
+
+@dataclass(frozen=True)
+class _AttemptFailure:
+    """Internal terminal-attempt projection after retry-report validation."""
+
+    reason: ProviderFailureReason
+    detail: ProviderFailureDetail
+    status_code: int | None
+
+
 class RetryReportError(Exception):
     """The private retry report is malformed or internally inconsistent."""
 
@@ -79,6 +129,32 @@ def _http_reason(status_code: int) -> ProviderFailureReason:
     return ProviderFailureReason.REQUEST_REJECTED
 
 
+def _http_detail(status_code: int) -> ProviderFailureDetail:
+    """Map one bounded HTTP status to provider-neutral protocol detail."""
+
+    return {
+        400: ProviderFailureDetail.HTTP_BAD_REQUEST,
+        401: ProviderFailureDetail.HTTP_UNAUTHORIZED,
+        402: ProviderFailureDetail.HTTP_PAYMENT_REQUIRED,
+        403: ProviderFailureDetail.HTTP_FORBIDDEN,
+        404: ProviderFailureDetail.HTTP_NOT_FOUND,
+        408: ProviderFailureDetail.HTTP_REQUEST_TIMEOUT,
+        409: ProviderFailureDetail.HTTP_CONFLICT,
+        413: ProviderFailureDetail.HTTP_CONTENT_TOO_LARGE,
+        422: ProviderFailureDetail.HTTP_UNPROCESSABLE_CONTENT,
+        429: ProviderFailureDetail.HTTP_RATE_LIMITED,
+        504: ProviderFailureDetail.HTTP_GATEWAY_TIMEOUT,
+        529: ProviderFailureDetail.HTTP_OVERLOADED,
+    }.get(
+        status_code,
+        (
+            ProviderFailureDetail.HTTP_SERVER_ERROR
+            if 500 <= status_code <= 599
+            else ProviderFailureDetail.HTTP_NON_SUCCESS
+        ),
+    )
+
+
 def _validate_http_class(status_code: int, error_class: str, failure_phase: str) -> None:
     """Reject attempt fields that contradict OCR's status-derived v1 classifier."""
 
@@ -97,8 +173,8 @@ def _validate_http_class(status_code: int, error_class: str, failure_phase: str)
         raise RetryReportError("retry report HTTP status contradicts its error class")
 
 
-def _attempt_reason(attempt: Mapping[str, Any]) -> ProviderFailureReason | None:
-    """Validate one attempt and return its closed error reason, if any."""
+def _attempt_failure(attempt: Mapping[str, Any]) -> _AttemptFailure | None:
+    """Validate one attempt and return its closed error projection, if any."""
 
     outcome = attempt.get("outcome")
     if outcome not in ATTEMPT_OUTCOMES:
@@ -117,13 +193,18 @@ def _attempt_reason(attempt: Mapping[str, Any]) -> ProviderFailureReason | None:
 
     if status_value and not 200 <= status_value <= 299:
         _validate_http_class(status_value, error_class, failure_phase)
-        return _http_reason(status_value)
+        return _AttemptFailure(_http_reason(status_value), _http_detail(status_value), status_value)
     if status_value:
         if failure_phase not in {"response_decode", "response_status", "stream"}:
             raise RetryReportError("retry report successful HTTP status has invalid failure phase")
         if error_class not in {"network", "provider", "unknown"}:
             raise RetryReportError("retry report successful HTTP status has invalid error class")
-        return ProviderFailureReason.INVALID_RESPONSE
+        detail = {
+            "response_decode": ProviderFailureDetail.RESPONSE_DECODE,
+            "response_status": ProviderFailureDetail.RESPONSE_STATUS,
+            "stream": ProviderFailureDetail.STREAM,
+        }[failure_phase]
+        return _AttemptFailure(ProviderFailureReason.INVALID_RESPONSE, detail, status_value)
     if failure_phase == "http" or error_class in {
         "authentication",
         "overloaded",
@@ -132,18 +213,25 @@ def _attempt_reason(attempt: Mapping[str, Any]) -> ProviderFailureReason | None:
     }:
         raise RetryReportError("retry report transport failure has HTTP-only classification")
     if error_class == "cancelled":
-        return ProviderFailureReason.CANCELLED
+        return _AttemptFailure(
+            ProviderFailureReason.CANCELLED, ProviderFailureDetail.CANCELLED, None
+        )
     if error_class == "timeout":
-        return ProviderFailureReason.TIMEOUT
+        return _AttemptFailure(ProviderFailureReason.TIMEOUT, ProviderFailureDetail.TIMEOUT, None)
     if error_class == "network":
         if failure_phase in {"response_decode", "response_status", "stream"}:
-            return ProviderFailureReason.INVALID_RESPONSE
-        return ProviderFailureReason.NETWORK
-    return ProviderFailureReason.UNKNOWN
+            detail = {
+                "response_decode": ProviderFailureDetail.RESPONSE_DECODE,
+                "response_status": ProviderFailureDetail.RESPONSE_STATUS,
+                "stream": ProviderFailureDetail.STREAM,
+            }[failure_phase]
+            return _AttemptFailure(ProviderFailureReason.INVALID_RESPONSE, detail, None)
+        return _AttemptFailure(ProviderFailureReason.NETWORK, ProviderFailureDetail.NETWORK, None)
+    return _AttemptFailure(ProviderFailureReason.UNKNOWN, ProviderFailureDetail.UNKNOWN, None)
 
 
-def _request_reason(request: Mapping[str, Any]) -> ProviderFailureReason | None:
-    """Validate one logical request and classify only its terminal failure."""
+def _request_failure(request: Mapping[str, Any]) -> _AttemptFailure | None:
+    """Validate one logical request and project only its terminal failure."""
 
     outcome = request.get("outcome")
     if outcome not in REQUEST_OUTCOMES:
@@ -151,7 +239,7 @@ def _request_reason(request: Mapping[str, Any]) -> ProviderFailureReason | None:
     attempts = request.get("attempts")
     if not isinstance(attempts, list) or not 0 < len(attempts) <= MAX_ATTEMPTS_PER_REQUEST:
         raise RetryReportError("retry report request attempts are invalid")
-    reasons: list[ProviderFailureReason | None] = []
+    failures: list[_AttemptFailure | None] = []
     for index, attempt in enumerate(attempts, start=1):
         if (
             not isinstance(attempt, dict)
@@ -159,24 +247,26 @@ def _request_reason(request: Mapping[str, Any]) -> ProviderFailureReason | None:
             or attempt.get("attempt") != index
         ):
             raise RetryReportError("retry report attempt order is invalid")
-        reasons.append(_attempt_reason(attempt))
+        failures.append(_attempt_failure(attempt))
     if outcome == "succeeded":
-        if len(attempts) < 2 or any(reason is not None for reason in reasons):
+        if len(attempts) < 2 or any(failure is not None for failure in failures):
             raise RetryReportError("retry report succeeded request is inconsistent")
         return None
     if outcome == "recovered":
-        if reasons[-1] is not None or not any(reason is not None for reason in reasons[:-1]):
+        if failures[-1] is not None or not any(failure is not None for failure in failures[:-1]):
             raise RetryReportError("retry report recovered request is inconsistent")
         return None
     if outcome == "cancelled":
-        return ProviderFailureReason.CANCELLED
-    if reasons[-1] is None:
+        return _AttemptFailure(
+            ProviderFailureReason.CANCELLED, ProviderFailureDetail.CANCELLED, None
+        )
+    if failures[-1] is None:
         raise RetryReportError("retry report failed request ends in success")
-    return reasons[-1]
+    return failures[-1]
 
 
-def parse_retry_report_failure(result: object) -> ProviderFailureReason | None:
-    """Validate retry-report v1 and return one closed terminal failure reason."""
+def parse_retry_report_projection(result: object) -> ProviderFailureProjection | None:
+    """Validate retry-report v1 and return one closed numeric failure projection."""
 
     if not isinstance(result, dict):
         raise RetryReportError("OCR result must be an object")
@@ -222,26 +312,82 @@ def parse_retry_report_failure(result: object) -> ProviderFailureReason | None:
     if total_requests < len(requests):
         raise RetryReportError("OCR retry report total_requests is inconsistent")
     for field, expected in expected_counts.items():
-        if _bounded_count(report.get(field), field, maximum=MAX_RETRY_REQUESTS * 100) != expected:
+        maximum = (
+            MAX_RETRY_REQUESTS * (MAX_ATTEMPTS_PER_REQUEST - 1)
+            if field == "total_retries"
+            else MAX_RETRY_REQUESTS
+        )
+        if _bounded_count(report.get(field), field, maximum=maximum) != expected:
             raise RetryReportError(f"OCR retry report {field} is inconsistent")
 
-    reasons: list[ProviderFailureReason] = []
+    failures: list[_AttemptFailure] = []
     for request in requests:
         if not isinstance(request, dict):
             raise RetryReportError("OCR retry report request is invalid")
-        reason = _request_reason(request)
-        if reason is not None:
-            reasons.append(reason)
-    if not reasons:
+        failure = _request_failure(request)
+        if failure is not None:
+            failures.append(failure)
+    if not failures:
         return None
-    counts = Counter(reasons)
-    return next(iter(counts)) if len(counts) == 1 else ProviderFailureReason.MIXED
+    reason_counts = Counter(failure.reason for failure in failures)
+    reason = next(iter(reason_counts)) if len(reason_counts) == 1 else ProviderFailureReason.MIXED
+    detail_counts = Counter(failure.detail for failure in failures)
+    statuses = {failure.status_code for failure in failures}
+    shared_status = next(iter(statuses)) if len(statuses) == 1 else None
+    return ProviderFailureProjection(
+        reason=reason,
+        details=tuple(sorted(detail_counts.items(), key=lambda item: item[0].value)),
+        status_code=shared_status,
+        failed_requests=expected_counts["failed_requests"],
+        cancelled_requests=expected_counts["cancelled_requests"],
+        retried_requests=expected_counts["retried_requests"],
+        total_retries=expected_counts["total_retries"],
+        recovered_requests=expected_counts["recovered_requests"],
+    )
 
 
-def provider_failure_reason(result: object) -> ProviderFailureReason | None:
-    """Return a closed reason, degrading malformed private diagnostics to unavailable."""
+def parse_retry_report_failure(result: object) -> ProviderFailureReason | None:
+    """Validate retry-report v1 and return one closed terminal failure reason."""
+
+    projection = parse_retry_report_projection(result)
+    return projection.reason if projection is not None else None
+
+
+def render_provider_diagnostics(projection: ProviderFailureProjection) -> str:
+    """Render one bounded deterministic CI line from a validated projection."""
+
+    fields = [f"summary={projection.reason.value}"]
+    if len(projection.details) == 1:
+        fields.append(f"detail={projection.details[0][0].value}")
+    else:
+        details = ",".join(f"{detail.value}:{count}" for detail, count in projection.details)
+        fields.append(f"details={details}")
+    if projection.status_code is not None:
+        fields.append(f"status={projection.status_code}")
+    for name in (
+        "failed_requests",
+        "cancelled_requests",
+        "retried_requests",
+        "total_retries",
+        "recovered_requests",
+    ):
+        value = getattr(projection, name)
+        if value:
+            fields.append(f"{name}={value}")
+    return "OCR provider diagnostics: " + " ".join(fields)
+
+
+def provider_failure_projection(result: object) -> ProviderFailureProjection | None:
+    """Return closed diagnostics, degrading malformed private data to unavailable."""
 
     try:
-        return parse_retry_report_failure(result)
+        return parse_retry_report_projection(result)
     except RetryReportError:
         return None
+
+
+def provider_failure_reason(result: object) -> ProviderFailureReason | None:
+    """Return a closed reason, degrading malformed private diagnostics to unavailable."""
+
+    projection = provider_failure_projection(result)
+    return projection.reason if projection is not None else None

{open_code_review_toolkit-0.8.4 → open_code_review_toolkit-0.8.6}/src/ocr_toolkit/review_runner.py

@@ -99,7 +99,11 @@ from ocr_toolkit.pre_execution import (
     PreExecutionStatusError,
     write_pre_execution_status,
 )
-from ocr_toolkit.provider_failure import ProviderFailureReason, provider_failure_reason
+from ocr_toolkit.provider_failure import (
+    ProviderFailureProjection,
+    provider_failure_projection,
+    render_provider_diagnostics,
+)
 from ocr_toolkit.providers.gitlab import (
     GitLabProviderError,
     acquire_review_snapshot,
@@ -150,6 +154,16 @@ QUARANTINE_COMMENT_FIELDS = frozenset(
         "suggestion_code",
     }
 )
+PROVIDER_PRIVATE_RESULT_KEYS = frozenset(
+    {
+        "encrypted_content",
+        "native_payload",
+        "reasoning_content",
+        "redacted_thinking",
+        "thinking",
+        "tool_choice",
+    }
+)
 
 
 class ReviewRunnerError(Exception):
@@ -459,8 +473,10 @@ def _dlp_reasons(
     while stack:
         nested = stack.pop()
         if isinstance(nested, dict):
-            stack.extend(nested.keys())
-            stack.extend(nested.values())
+            for key, value in nested.items():
+                if isinstance(key, str) and key in PROVIDER_PRIVATE_RESULT_KEYS:
+                    reasons["invalid_text"] += 1
+                stack.extend((key, value))
         elif isinstance(nested, list):
             stack.extend(nested)
         elif isinstance(nested, str):
@@ -689,6 +705,11 @@ def _sanitize_nonpublication_fields(
             child_path = (*path, key)
             if isinstance(source, dict):
                 assert isinstance(key, str)
+                if key in PROVIDER_PRIVATE_RESULT_KEYS and not _is_publication_sink_path(
+                    child_path
+                ):
+                    redacted_fields += 1
+                    continue
                 if not _is_publication_sink_path(
                     child_path
                 ) and not _is_static_public_tool_key_path(child_path):
@@ -890,7 +911,7 @@ def _publication_projection(
     sanitized, private_reasons, redacted_fields = _sanitize_nonpublication_fields(
         payload, budgets=budgets, matcher=matcher
     )
-    if not sink_reasons and not private_reasons:
+    if not sink_reasons and not private_reasons and redacted_fields == 0:
         return payload, {"state": "passed"}, False
 
     try:
@@ -928,6 +949,8 @@ def _publication_projection(
             projected["summary"] = {"budget_exceeded": True}
     else:
         reasons = sink_reasons + private_reasons
+        if not reasons:
+            return sanitized, {"state": "passed"}, False
         return (
             sanitized,
             {
@@ -2081,14 +2104,16 @@ def read_stderr_excerpt(stderr_path: Path, max_chars: int = DEFAULT_DIAGNOSTIC_C
     return redact_sensitive(text)[:max_chars]
 
 
-def _closed_provider_failure_reason(result_path: Path) -> ProviderFailureReason | None:
-    """Return only a validated retry-report reason from one private result artifact."""
+def _closed_provider_failure_projection(
+    result_path: Path,
+) -> ProviderFailureProjection | None:
+    """Return only validated retry-report diagnostics from one private result."""
 
     try:
         result = load_ocr_result(result_path)
     except (OcrResultMalformed, OcrResultMissing, OcrResultTooLarge):
         return None
-    return provider_failure_reason(result)
+    return provider_failure_projection(result)
 
 
 def _resolve_ocr_binary() -> str:
@@ -2155,13 +2180,9 @@ def run_review(
 
     if completed.returncode != 0:
         print(f"Open Code Review exited with code {completed.returncode}.", file=sys.stderr)
-        provider_reason = _closed_provider_failure_reason(result_path)
-        if provider_reason is not None:
-            print(
-                f"OCR provider failure classified as {provider_reason.value}; "
-                "private diagnostics remain in the owner-only artifacts.",
-                file=sys.stderr,
-            )
+        provider_projection = _closed_provider_failure_projection(result_path)
+        if provider_projection is not None:
+            print(render_provider_diagnostics(provider_projection), file=sys.stderr)
         else:
             excerpt = read_stderr_excerpt(stderr_path)
             if excerpt: