open-code-review-toolkit 0.8.7__tar.gz → 0.9.0__tar.gz

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: open-code-review-toolkit
-Version: 0.8.7
+Version: 0.9.0
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -258,11 +258,11 @@ python -m pip install open-code-review-toolkit
 ```
 
 The toolkit does not bundle OCR. Download the platform asset for exact
-[Open Code Review 1.11.1](https://github.com/alibaba/open-code-review/releases/tag/v1.11.1),
+[Open Code Review 1.11.3](https://github.com/alibaba/open-code-review/releases/tag/v1.11.3),
 verify it before installation against the [compatibility manifest](compatibility/ocr-support.json),
 and place the verified binary on `PATH`. The current Linux amd64 digest is
-`1cdc7d1f776f1cdb69850130b930e40f64accc86ecaf09600573b3600456322f`; Darwin arm64 is
-`5fdf72e51aae021ac7bf43d7b9dcb160f04880f623c66e8ada5e6ae5a92e172c`. The manifest owns
+`9726204ac81baee153fd65b1ff357c380f73e9d8091c4a73c3c9fb541b5164cb`; Darwin arm64 is
+`515cd92ce300b62dea2bcaf53e910cdf57b681e1d58bbd0a9e8e49617bca52fa`. The manifest owns
 the other platform hashes.
 
 Verify the installation without contacting an LLM provider:
@@ -272,14 +272,14 @@ ocr --version
 ocr-ci --help
 ```
 
-`ocr --version` must report `open-code-review v1.11.1`; `ocr-ci --help` must exit
+`ocr --version` must report `open-code-review v1.11.3`; `ocr-ci --help` must exit
 successfully. `ocr-ci preflight` is an operational configuration check, not the installation
 smoke test.
 
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.11.1 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The current OCR 1.11.3 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 
@@ -289,7 +289,7 @@ On a successful rerun, the toolkit replaces untouched OCR-only notes instead of
 
 Suppression uses both the GitLab diff position and a stable finding fingerprint, so ordinary line shifts do not normally bring the same bug back. A materially changed finding can still receive a new discussion. See [GitLab review operations](docs/operations.md) for the complete lifecycle, posting modes, permissions, failure behavior, and Mermaid state diagram.
 
-After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v6's exact reviewed source SHA and merge-request author. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, and adapter records do not independently block approval, while degraded metadata, DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, any direct external MCP, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules and protected-branch policy remain authoritative. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v8's exact reviewed source SHA, target SHA/protection state, and merge-request author. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, and adapter records do not independently block approval, while an unprotected target, degraded metadata, DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, any direct external MCP, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
 
 Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable target-ref decisions and never lets a source change self-authorize its review. Root and nested target `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
 
@@ -306,8 +306,10 @@ The shipped Repository Evidence Engine reads immutable base/head Git objects, st
 
 1. Configure protected/masked `GITLAB_API_TOKEN` and LLM variables in GitLab.
 2. Pin and checksum the OCR binary.
-3. Install this package.
-4. Run the four public helper stages around `ocr review`:
+3. Keep `OCR_GITLAB_TARGET_PROTECTION_MODE=required` unless the project deliberately permits an unprotected target in limited, comment-only mode.
+4. Merge repository review configuration, including the Rules path, into the target branch.
+5. Enable the CI review job in a later merge request and install this package.
+6. Run the four public helper stages around `ocr review`:
 
 ```console
 ocr-ci preflight
@@ -318,6 +320,8 @@ ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
 
 See the [GitLab mode matrix](examples/gitlab/README.md), the complete [`ocr-review.gitlab-ci.yml`](examples/gitlab/ocr-review.gitlab-ci.yml) pipeline, the [GitLab setup guide](docs/gitlab.md), and [GitLab review operations](docs/operations.md).
 
+The two-merge-request setup is recommended because repository Rules are loaded only from the captured target commit. On the default protected-target path, a supported one-merge-request alternative may add the Rules and CI job together when that integration merge request does not need review: its first run stops before OCR with a setup-pending note, retrying the same merge request cannot change the captured target Rules, and later merge requests work after it merges. An actually unprotected target with missing target Rules fails closed without promoting the source copy or promising setup-pending status. If the status identity is missing or mismatched, the toolkit likewise uses the generic fail-closed failure note. A green advisory job or pipeline does not prove that OCR or its model executed.
+
 ## Configuration and safety
 
 Configuration is environment-driven. The [configuration reference](docs/configuration.md) documents supported `OCR_*`, `CI_*`, `GITLAB_*`, and MCP inputs. Posting requires `GITLAB_API_TOKEN`; job tokens and legacy aliases are deliberately unsupported.

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/README.md

@@ -31,11 +31,11 @@ python -m pip install open-code-review-toolkit
 ```
 
 The toolkit does not bundle OCR. Download the platform asset for exact
-[Open Code Review 1.11.1](https://github.com/alibaba/open-code-review/releases/tag/v1.11.1),
+[Open Code Review 1.11.3](https://github.com/alibaba/open-code-review/releases/tag/v1.11.3),
 verify it before installation against the [compatibility manifest](compatibility/ocr-support.json),
 and place the verified binary on `PATH`. The current Linux amd64 digest is
-`1cdc7d1f776f1cdb69850130b930e40f64accc86ecaf09600573b3600456322f`; Darwin arm64 is
-`5fdf72e51aae021ac7bf43d7b9dcb160f04880f623c66e8ada5e6ae5a92e172c`. The manifest owns
+`9726204ac81baee153fd65b1ff357c380f73e9d8091c4a73c3c9fb541b5164cb`; Darwin arm64 is
+`515cd92ce300b62dea2bcaf53e910cdf57b681e1d58bbd0a9e8e49617bca52fa`. The manifest owns
 the other platform hashes.
 
 Verify the installation without contacting an LLM provider:
@@ -45,14 +45,14 @@ ocr --version
 ocr-ci --help
 ```
 
-`ocr --version` must report `open-code-review v1.11.1`; `ocr-ci --help` must exit
+`ocr --version` must report `open-code-review v1.11.3`; `ocr-ci --help` must exit
 successfully. `ocr-ci preflight` is an operational configuration check, not the installation
 smoke test.
 
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.11.1 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The current OCR 1.11.3 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 
@@ -62,7 +62,7 @@ On a successful rerun, the toolkit replaces untouched OCR-only notes instead of
 
 Suppression uses both the GitLab diff position and a stable finding fingerprint, so ordinary line shifts do not normally bring the same bug back. A materially changed finding can still receive a new discussion. See [GitLab review operations](docs/operations.md) for the complete lifecycle, posting modes, permissions, failure behavior, and Mermaid state diagram.
 
-After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v6's exact reviewed source SHA and merge-request author. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, and adapter records do not independently block approval, while degraded metadata, DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, any direct external MCP, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules and protected-branch policy remain authoritative. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v8's exact reviewed source SHA, target SHA/protection state, and merge-request author. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, and adapter records do not independently block approval, while an unprotected target, degraded metadata, DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, any direct external MCP, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
 
 Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable target-ref decisions and never lets a source change self-authorize its review. Root and nested target `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
 
@@ -79,8 +79,10 @@ The shipped Repository Evidence Engine reads immutable base/head Git objects, st
 
 1. Configure protected/masked `GITLAB_API_TOKEN` and LLM variables in GitLab.
 2. Pin and checksum the OCR binary.
-3. Install this package.
-4. Run the four public helper stages around `ocr review`:
+3. Keep `OCR_GITLAB_TARGET_PROTECTION_MODE=required` unless the project deliberately permits an unprotected target in limited, comment-only mode.
+4. Merge repository review configuration, including the Rules path, into the target branch.
+5. Enable the CI review job in a later merge request and install this package.
+6. Run the four public helper stages around `ocr review`:
 
 ```console
 ocr-ci preflight
@@ -91,6 +93,8 @@ ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
 
 See the [GitLab mode matrix](examples/gitlab/README.md), the complete [`ocr-review.gitlab-ci.yml`](examples/gitlab/ocr-review.gitlab-ci.yml) pipeline, the [GitLab setup guide](docs/gitlab.md), and [GitLab review operations](docs/operations.md).
 
+The two-merge-request setup is recommended because repository Rules are loaded only from the captured target commit. On the default protected-target path, a supported one-merge-request alternative may add the Rules and CI job together when that integration merge request does not need review: its first run stops before OCR with a setup-pending note, retrying the same merge request cannot change the captured target Rules, and later merge requests work after it merges. An actually unprotected target with missing target Rules fails closed without promoting the source copy or promising setup-pending status. If the status identity is missing or mismatched, the toolkit likewise uses the generic fail-closed failure note. A green advisory job or pipeline does not prove that OCR or its model executed.
+
 ## Configuration and safety
 
 Configuration is environment-driven. The [configuration reference](docs/configuration.md) documents supported `OCR_*`, `CI_*`, `GITLAB_*`, and MCP inputs. Posting requires `GITLAB_API_TOKEN`; job tokens and legacy aliases are deliberately unsupported.

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.8.7'
-__version_tuple__ = version_tuple = (0, 8, 7)
+__version__ = version = '0.9.0'
+__version_tuple__ = version_tuple = (0, 9, 0)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/src/ocr_toolkit/evidence/actions.py

@@ -13,8 +13,11 @@ from typing import Any
 
 from ocr_toolkit.evidence.store.atomic import atomic_write
 
-ACTION_RECEIPT_SCHEMA = "ocr.evidence-action-receipt/v2"
+ACTION_RECEIPT_SCHEMA = "ocr.evidence-action-receipt/v3"
 EVIDENCE_ACTIONS = ("summary", "list", "get", "search", "coverage")
+UNATTRIBUTED_ACTION = "unattributed"
+ACTION_RECEIPT_BUCKETS = (*EVIDENCE_ACTIONS, UNATTRIBUTED_ACTION)
+ACTION_RECEIPT_STATES = ("attempted", "completed")
 MAX_ACTION_CALLS = 1_000_000_000
 MAX_ACTION_RECEIPT_BYTES = 4_096
 
@@ -45,23 +48,35 @@ def _serialized_receipt_update(path: Path) -> Iterator[None]:
         os.close(descriptor)
 
 
-def _validated_counts(value: Any) -> dict[str, int] | None:
+def _validated_counts(value: Any) -> dict[str, dict[str, int]] | None:
     if not isinstance(value, dict) or set(value) != {"schema_version", "actions"}:
         return None
     actions = value.get("actions")
     if value.get("schema_version") != ACTION_RECEIPT_SCHEMA or not isinstance(actions, dict):
         return None
-    if set(actions) != set(EVIDENCE_ACTIONS):
+    if set(actions) != set(ACTION_RECEIPT_STATES):
         return None
+    if any(not isinstance(actions[state], dict) for state in ACTION_RECEIPT_STATES):
+        return None
+    attempted = actions["attempted"]
+    completed = actions["completed"]
+    if set(attempted) != set(ACTION_RECEIPT_BUCKETS) or set(completed) != set(EVIDENCE_ACTIONS):
+        return None
+    counts = (*attempted.values(), *completed.values())
     if any(
         not isinstance(count, int) or isinstance(count, bool) or not 0 <= count <= MAX_ACTION_CALLS
-        for count in actions.values()
+        for count in counts
     ):
         return None
-    return {action: actions[action] for action in EVIDENCE_ACTIONS}
+    if any(completed[action] > attempted[action] for action in EVIDENCE_ACTIONS):
+        return None
+    return {
+        "attempted": {action: attempted[action] for action in ACTION_RECEIPT_BUCKETS},
+        "completed": {action: completed[action] for action in EVIDENCE_ACTIONS},
+    }
 
 
-def read_action_receipt(path: Path) -> dict[str, int] | None:
+def read_action_receipt(path: Path) -> dict[str, dict[str, int]] | None:
     """Read one bounded receipt or return unavailable for any unsafe shape."""
 
     flags = os.O_RDONLY
@@ -94,10 +109,10 @@ def read_action_receipt(path: Path) -> dict[str, int] | None:
     return _validated_counts(value)
 
 
-def record_action(path: Path, action: object) -> None:
-    """Atomically increment one completed action without retaining arguments."""
+def record_action(path: Path, action: object, *, completed: bool = False) -> None:
+    """Atomically increment one attempted or completed action without retaining arguments."""
 
-    if action not in EVIDENCE_ACTIONS:
+    if action not in ACTION_RECEIPT_BUCKETS or (completed and action not in EVIDENCE_ACTIONS):
         raise ValueError("evidence action is outside the closed receipt enum")
     with _serialized_receipt_update(path):
         counts = read_action_receipt(path)
@@ -110,13 +125,22 @@ def record_action(path: Path, action: object) -> None:
         if exists and counts is None:
             raise ValueError("evidence action receipt is malformed")
         if counts is None:
-            counts = dict.fromkeys(EVIDENCE_ACTIONS, 0)
-        if counts[action] >= MAX_ACTION_CALLS:
+            counts = {
+                "attempted": dict.fromkeys(ACTION_RECEIPT_BUCKETS, 0),
+                "completed": dict.fromkeys(EVIDENCE_ACTIONS, 0),
+            }
+        state = "completed" if completed else "attempted"
+        if counts[state][action] >= MAX_ACTION_CALLS:
             raise ValueError("evidence action receipt exceeds the count bound")
-        counts[action] += 1
+        if completed and counts["completed"][action] >= counts["attempted"][action]:
+            raise ValueError("completed evidence action has no authenticated attempt")
+        counts[state][action] += 1
         payload = {
             "schema_version": ACTION_RECEIPT_SCHEMA,
-            "actions": {name: counts[name] for name in EVIDENCE_ACTIONS},
+            "actions": {
+                "attempted": {name: counts["attempted"][name] for name in ACTION_RECEIPT_BUCKETS},
+                "completed": {name: counts["completed"][name] for name in EVIDENCE_ACTIONS},
+            },
         }
         atomic_write(
             path,

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/src/ocr_toolkit/evidence/collect.py

@@ -50,8 +50,9 @@ def collect_repository_evidence(
     base_ref: str | None = None,
     head_ref: str | None = None,
     policy_ref: str | None = None,
+    include_policy_records: bool = True,
 ) -> EvidenceStore:
-    """Build one evidence store from immutable refs and existing bounded collectors."""
+    """Build evidence, optionally omitting target-derived policy authority records."""
 
     reader = GitRepositoryReader(root or Path.cwd())
     base_sha, head_sha = _commit_refs(reader, base_ref, head_ref)
@@ -70,13 +71,16 @@ def collect_repository_evidence(
         changed_paths=changed,
         coverage_sink=base_coverage,
     )
-    policy_facts, policy_diagnostics = collect_ref_facts(
-        reader,
-        policy_sha,
-        RefRole.POLICY,
-        changed_paths=changed,
-    )
-    policy_facts = [record for record in policy_facts if record.kind in POLICY_KINDS]
+    if include_policy_records:
+        policy_facts, policy_diagnostics = collect_ref_facts(
+            reader,
+            policy_sha,
+            RefRole.POLICY,
+            changed_paths=changed,
+        )
+        policy_facts = [record for record in policy_facts if record.kind in POLICY_KINDS]
+    else:
+        policy_facts, policy_diagnostics = [], []
     policy = EvidenceSnapshot(
         RefRole.POLICY,
         policy_sha,

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/src/ocr_toolkit/evidence/mcp.py

@@ -22,7 +22,7 @@ from ocr_toolkit.context.mcp import (
     tool_definitions,
 )
 from ocr_toolkit.context.store import ContextStore
-from ocr_toolkit.evidence.actions import record_action
+from ocr_toolkit.evidence.actions import UNATTRIBUTED_ACTION, record_action
 from ocr_toolkit.evidence.model import CoverageRecord, EvidenceDelta, EvidenceRecord
 from ocr_toolkit.evidence.policy.schema import is_legacy_policy_value
 from ocr_toolkit.evidence.store import EvidenceStore, EvidenceStoreError
@@ -785,21 +785,35 @@ def handle_request(
             return _error(request_id, -32602, "Invalid tool call")
         name = params.get("name")
         if isinstance(name, str) and name in {TOOL_NAME, SEARCH_TOOL_NAME, COVERAGE_TOOL_NAME}:
+            arguments = params.get("arguments", {})
+            if name == TOOL_NAME:
+                action = arguments.get("action") if isinstance(arguments, dict) else None
+                attempt_action = (
+                    action
+                    if isinstance(action, str) and action in {"summary", "list", "get"}
+                    else UNATTRIBUTED_ACTION
+                )
+            else:
+                action = "search" if name == SEARCH_TOOL_NAME else "coverage"
+                attempt_action = action
+            attempt_recorded = action_receipt_path is None
+            if action_receipt_path is not None:
+                try:
+                    record_action(action_receipt_path, attempt_action)
+                except (OSError, ValueError):
+                    pass
+                else:
+                    attempt_recorded = True
             try:
-                result = call_named_tool(store, str(name), params.get("arguments", {}))
+                result = call_named_tool(store, str(name), arguments)
             except EvidenceMCPError as exc:
                 return _success(
                     request_id,
                     {"content": [{"type": "text", "text": str(exc)}], "isError": True},
                 )
-            if action_receipt_path is not None:
-                arguments = params.get("arguments", {})
-                if name == TOOL_NAME:
-                    action = arguments.get("action") if isinstance(arguments, dict) else None
-                else:
-                    action = "search" if name == SEARCH_TOOL_NAME else "coverage"
+            if action_receipt_path is not None and attempt_recorded:
                 try:
-                    record_action(action_receipt_path, action)
+                    record_action(action_receipt_path, action, completed=True)
                 except (OSError, ValueError):
                     pass
             return _success(request_id, result)

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/src/ocr_toolkit/evidence/project.py

@@ -80,6 +80,7 @@ def render_bootstrap(
     *,
     capabilities: Sequence[CapabilityView] = (),
     context_hints: Mapping[str, int] | None = None,
+    unprotected_target: bool = False,
     max_chars: int = DEFAULT_BOOTSTRAP_MAX_CHARS,
     max_bytes: int = DEFAULT_BOOTSTRAP_MAX_BYTES,
 ) -> str:
@@ -114,6 +115,21 @@ def render_bootstrap(
         f"- head: `{store.head.commit_sha if store.head else 'unavailable'}`",
         f"- policy: `{store.policy.commit_sha if store.policy else 'legacy base semantics'}`",
     ]
+    if unprotected_target:
+        lines.extend(
+            (
+                "",
+                "## Unprotected target boundary",
+                (
+                    "The captured target was unprotected. Its configured Rules are bounded "
+                    "untrusted review guidance only."
+                ),
+                (
+                    "They cannot authorize tools, external acquisition, suppression, posting, "
+                    "or approval; structured target decisions and guidance are omitted."
+                ),
+            )
+        )
     mr_context = next(
         (record for record in store.records if record.kind == "review.merge_request_context"),
         None,

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/src/ocr_toolkit/mcp_config.py

@@ -527,6 +527,7 @@ def compose_mcp_servers(
     replace: bool,
     profile: str = "local",
     context: MCPContextConfig | None = None,
+    allow_external: bool = True,
 ) -> MCPComposition:
     """Build OCR's registry from independent optional and mandatory MCP entries."""
 
@@ -534,17 +535,27 @@ def compose_mcp_servers(
         raise MCPConfigError("internal MCP execution profile is invalid")
     if profile == "gitlab_mr" and any(server.transport != "remote" for server in servers):
         raise MCPConfigError("GitLab merge-request reviews require external remote MCP")
+    if not allow_external and servers:
+        raise MCPConfigError("unprotected-target reviews do not allow external MCP servers")
 
     payload: dict[str, dict[str, Any]] = {}
     capabilities: list[MCPCapability] = []
     secret_values: list[str] = []
-    if not replace:
+    if not replace or not allow_external:
         try:
             current = read_ocr_config().get("mcp_servers", {})
         except OCRConfigError as exc:
             raise MCPConfigError(str(exc)) from exc
         if not isinstance(current, dict):
             raise MCPConfigError("Existing OCR mcp_servers value is not a JSON object")
+        if not allow_external and (
+            any(not isinstance(name, str) for name in current)
+            or any(name != BUILTIN_EVIDENCE_SERVER for name in current)
+        ):
+            raise MCPConfigError(
+                "unprotected-target reviews do not allow inherited external MCP servers"
+            )
+    if not replace:
         declared_names = {server.name for server in servers}
         for name, value in current.items():
             # Explicit operator input replaces the same named inherited entry;
@@ -632,7 +643,10 @@ def compose_mcp_servers(
 
 
 def build_mcp_composition(
-    *, profile: str = "local", context: MCPContextConfig | None = None
+    *,
+    profile: str = "local",
+    context: MCPContextConfig | None = None,
+    allow_external: bool = True,
 ) -> MCPComposition:
     """Parse environment settings into the complete profiled MCP composition."""
 
@@ -641,6 +655,7 @@ def build_mcp_composition(
         replace=_replace_configured_servers(),
         profile=profile,
         context=context,
+        allow_external=allow_external,
     )
 
 

{open_code_review_toolkit-0.8.7 → open_code_review_toolkit-0.9.0}/src/ocr_toolkit/ocr_result.py

@@ -19,7 +19,7 @@ from ocr_toolkit.common.redaction import sanitize_ocr_value
 DEFAULT_MAX_RESULT_BYTES = 2_000_000
 MAX_RESULT_BYTES_HARD_LIMIT = 20_000_000
 TOOLKIT_RESULT_KEY = "_ocr_toolkit"
-TOOLKIT_RESULT_SCHEMA_VERSION = 6
+TOOLKIT_RESULT_SCHEMA_VERSION = 8
 SUPPORTED_TOOLKIT_RESULT_SCHEMA_VERSIONS = frozenset({TOOLKIT_RESULT_SCHEMA_VERSION})
 TOOLKIT_ADVISORY_KEY = "_ocr_toolkit_advisory"
 TOOLKIT_ADVISORY_SCHEMA_VERSION = "ocr.toolkit-advisory/v1"

open_code_review_toolkit-0.9.0/src/ocr_toolkit/posting/approval.py

@@ -0,0 +1,152 @@
+"""Conservative policy and typed outcomes for GitLab automatic approval."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import Enum
+from typing import Any
+
+from ocr_toolkit.posting.settings import BooleanSetting
+from ocr_toolkit.result_contract import ReviewOutcome
+from ocr_toolkit.review_receipt import (
+    INVALID_APPROVAL_RECEIPT_REASON,
+    automatic_approval_metadata_reason,
+    publication_dlp_state,
+    publication_outcome_for_summary,
+    toolkit_receipt_is_valid,
+)
+
+__all__ = [
+    "INVALID_APPROVAL_RECEIPT_REASON",
+    "ApprovalEligibility",
+    "ApprovalResult",
+    "ApprovalStatus",
+    "approval_summary_line",
+    "automatic_approval_metadata_reason",
+    "evaluate_approval_policy",
+    "provisional_approval_result",
+    "publication_dlp_state",
+    "publication_outcome_for_summary",
+    "toolkit_receipt_is_valid",
+]
+
+ALLOWED_CATEGORIES = frozenset({"style", "documentation", "maintainability"})
+MAX_APPROVABLE_FINDINGS = 3
+
+
+class ApprovalStatus(str, Enum):
+    """Closed public states for one automatic-approval transaction."""
+
+    APPROVED = "approved"
+    NOT_ELIGIBLE = "not eligible"
+    DISABLED = "disabled"
+    SKIPPED = "skipped"
+    FAILED = "failed"
+
+
+@dataclass(frozen=True, slots=True)
+class ApprovalResult:
+    """Bounded status rendered in the review summary and runner log."""
+
+    status: ApprovalStatus
+    reason: str
+
+
+@dataclass(frozen=True, slots=True)
+class ApprovalEligibility:
+    """Policy conclusion before provider state is consulted."""
+
+    eligible: bool
+    result: ApprovalResult
+
+
+def evaluate_approval_policy(
+    setting: BooleanSetting,
+    outcome: ReviewOutcome,
+    comments: list[dict[str, Any]],
+    warnings: list[Any],
+    omitted_count: int,
+    toolkit_metadata: Any = None,
+) -> ApprovalEligibility:
+    """Evaluate the fixed automatic-approval policy from authoritative OCR data."""
+
+    if not setting.enabled:
+        reason = (
+            "configuration was invalid and failed closed"
+            if not setting.valid
+            else "disabled by OCR_AUTO_APPROVE"
+        )
+        return ApprovalEligibility(
+            False,
+            ApprovalResult(ApprovalStatus.DISABLED, reason),
+        )
+    metadata_reason = automatic_approval_metadata_reason(toolkit_metadata)
+    if metadata_reason:
+        reason = metadata_reason
+    elif toolkit_metadata["evidence"]["mandatory"] is not outcome.requires_evidence_mcp:
+        reason = "the review-time approval receipt is missing or invalid"
+    elif not outcome.manifest_present:
+        reason = "the OCR result has no authoritative coverage manifest"
+    elif outcome.kind != "clean" or outcome.budget_exceeded:
+        reason = "the OCR review did not complete cleanly"
+    elif outcome.failed_count or outcome.waived_count:
+        reason = "coverage contained failed or waived items"
+    elif warnings:
+        reason = "the OCR review reported warnings"
+    elif omitted_count:
+        reason = "one or more findings were omitted from publication"
+    elif len(comments) > MAX_APPROVABLE_FINDINGS:
+        reason = f"the review reported more than {MAX_APPROVABLE_FINDINGS} findings"
+    else:
+        reason = ""
+
+    if reason:
+        return ApprovalEligibility(
+            False,
+            ApprovalResult(ApprovalStatus.NOT_ELIGIBLE, reason),
+        )
+
+    for comment in comments:
+        severity = comment.get("severity")
+        category = comment.get("category")
+        if severity != "low":
+            return ApprovalEligibility(
+                False,
+                ApprovalResult(
+                    ApprovalStatus.NOT_ELIGIBLE,
+                    "a finding had a blocking or malformed severity",
+                ),
+            )
+        if not isinstance(category, str) or category not in ALLOWED_CATEGORIES:
+            return ApprovalEligibility(
+                False,
+                ApprovalResult(
+                    ApprovalStatus.NOT_ELIGIBLE,
+                    "a finding had a blocking or malformed category",
+                ),
+            )
+
+    return ApprovalEligibility(
+        True,
+        ApprovalResult(
+            ApprovalStatus.SKIPPED,
+            "awaiting post-publication SHA verification",
+        ),
+    )
+
+
+def approval_summary_line(result: ApprovalResult) -> str:
+    """Render exactly one bounded automatic-approval state line."""
+
+    return f"- Automatic approval: `{result.status.value}` — {result.reason}."
+
+
+def provisional_approval_result(eligibility: ApprovalEligibility) -> ApprovalResult:
+    """Return a fail-closed state safe to publish before provider readback."""
+
+    if not eligibility.eligible:
+        return eligibility.result
+    return ApprovalResult(
+        ApprovalStatus.FAILED,
+        "automatic approval has not yet been confirmed",
+    )