Toolkit 0.8.5: provider diagnostics and OCR 1.10.2

.github/workflows/ocr-compatibility.yml

@@ -2,7 +2,7 @@ name: OCR compatibility
 
 on:
   schedule:
-    - cron: "41 5 * * *"
+    - cron: "15 7 * * *"
   workflow_dispatch:
     inputs:
       tag:

README.md

@@ -22,7 +22,7 @@ ocr-ci --help
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.10.1 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The current OCR 1.10.2 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 

changelog.d/149.feature.md

@@ -0,0 +1,5 @@
+Classified LLM-provider failures now emit at most one toolkit-authored CI diagnostic line with closed HTTP detail and non-zero aggregate retry counts from a fully validated `ocr.llm-retry-report/v1`.
+
+- **Added:** HTTP `402` is shown as `http-payment-required`, HTTP `429` as `http-rate-limited`, a uniform status is shown only when all terminal failures share it, and mixed details are deterministically count-aggregated.
+- **Changed:** The `rate-or-spending-limit` GitLab remediation now recommends lowering `OCR_REVIEW_CONCURRENCY` and/or `OCR_LLM_MAX_COMPLETION_TOKENS`, starting a new merge request pipeline, and checking provider request/account limits without claiming either setting caused the failure.
+- **Unchanged:** The GitLab summary/reason, previous-review preservation, DLP, receipt v5, toolkit telemetry, and automatic-approval contracts are unchanged; raw provider-controlled fields and stderr remain private.

changelog.d/151.bugfix.md

@@ -0,0 +1 @@
+OCR compatibility classification now sends feature-bearing patch releases to human review instead of allowing adjacent maintenance keywords to misclassify them as `automatic-safe`.

changelog.d/151.maintenance.md

@@ -0,0 +1,5 @@
+Open Code Review 1.10.2 is the checksum-pinned runtime dependency for toolkit 0.8.5.
+
+- **Changed:** The current GitLab example, runtime preflight, compatibility manifest, and qualification evidence move from OCR 1.10.1 to 1.10.2. The inherited OpenAI completion cap remains `16384`, but OCR grouping requests now use that template-owned cap instead of a separate `4096`; an explicit `OCR_LLM_MAX_COMPLETION_TOKENS` continues to override every request.
+- **Changed:** Daily OCR compatibility discovery moves from `05:41 UTC` to `07:15 UTC`; exact-tag manual dispatch remains the recovery path when GitHub delays or omits a scheduled run.
+- **Unchanged:** OCR result and manifest schemas, default `medium` effort, effective max-tools behavior, DLP, receipt v5, toolkit telemetry ownership, and approval contracts are unchanged.

changelog.d/151.rules.md

@@ -0,0 +1 @@
+The recommended OCR 1.10.2 built-in Rules and reviewable-file allowlist now cover Solidity (`.sol`) and Vyper (`.vy`).

compatibility/evidence/ocr-1.10.2.json

@@ -0,0 +1,205 @@
+{
+  "assets": [
+    {
+      "name": "opencodereview-darwin-amd64",
+      "sha256": "91d30daa43ea698775df16cb4999e69624f009c93bb7a832310d13070981303d",
+      "size": 57674784
+    },
+    {
+      "name": "opencodereview-darwin-arm64",
+      "sha256": "74fc7bcc0e6d0790c5ca033fd82a5474b6f05d443ed51a26a6f61c0cac6589fd",
+      "size": 54711010
+    },
+    {
+      "name": "opencodereview-linux-amd64",
+      "sha256": "e9205614f80e009ee7b1f444c9da08486fb9ff6db022954fe9203d923ab720b2",
+      "size": 55931042
+    },
+    {
+      "name": "opencodereview-linux-arm64",
+      "sha256": "8ca3f4931200fbf48ff4b2045a6fb69da18246d11f74e630558a6ba5bab53ef4",
+      "size": 52691106
+    },
+    {
+      "name": "opencodereview-windows-amd64.exe",
+      "sha256": "3ec56cc810500fac54d2c4c0ebe580b7841b1cd1966f2e2e86ce51d0292aa56e",
+      "size": 57393152
+    },
+    {
+      "name": "opencodereview-windows-arm64.exe",
+      "sha256": "27ee3472871a32cd5d843579361db198ed10a83855fd43d26a763a0e9cd3cddd",
+      "size": 53370880
+    },
+    {
+      "name": "sha256sum.txt",
+      "sha256": "b5176aaa04a7f00bd84dd61556ca29e6cbdfcfe64cc50af6653163d9be4e7654",
+      "size": 572
+    }
+  ],
+  "classification": "human-review-required",
+  "classification_reasons": [
+    "release notes contain a material or ambiguous compatibility signal"
+  ],
+  "comparison_version": "1.10.1",
+  "contracts": {
+    "comment_thinking_probe": {
+      "additive_field_preserved": true,
+      "posting_exposes_thinking": false,
+      "result": "passed"
+    },
+    "completion_cap_probe": {
+      "explicit": 4096,
+      "inherited": 16384,
+      "result": "passed",
+      "wire_field": "max_completion_tokens"
+    },
+    "numeric_cli_probe": {
+      "max_tokens_budget": {
+        "cases": {
+          "invalid_below": {
+            "effective": null,
+            "input": -1,
+            "outcome": "rejected"
+          },
+          "minimum": {
+            "effective": 1,
+            "input": 1,
+            "outcome": "accepted"
+          },
+          "omitted": {
+            "effective": "unlimited",
+            "input": null,
+            "outcome": "accepted"
+          },
+          "representative": {
+            "effective": 30000,
+            "input": 30000,
+            "outcome": "accepted"
+          },
+          "sentinel": {
+            "effective": "unlimited",
+            "input": 0,
+            "outcome": "accepted"
+          }
+        },
+        "maximum": null,
+        "owner": "ocr-cli"
+      },
+      "max_tools": {
+        "cases": {
+          "invalid_below": {
+            "effective": null,
+            "input": -1,
+            "outcome": "rejected"
+          },
+          "minimum": {
+            "effective": 100,
+            "input": 50,
+            "outcome": "accepted"
+          },
+          "minimum_minus_one": {
+            "effective": 100,
+            "input": 49,
+            "outcome": "normalized",
+            "reported_normalization": 50
+          },
+          "omitted": {
+            "effective": 100,
+            "input": null,
+            "outcome": "accepted"
+          },
+          "representative": {
+            "effective": 101,
+            "input": 101,
+            "outcome": "accepted"
+          },
+          "sentinel": {
+            "effective": 100,
+            "input": 0,
+            "outcome": "accepted"
+          }
+        },
+        "maximum": null,
+        "owner": "ocr-template-or-higher-cli",
+        "reported_minimum": 50
+      },
+      "result": "passed"
+    },
+    "optional_capabilities": [
+      "llm_result_identity",
+      "per_run_model_override",
+      "per_run_provider_override",
+      "review_effort",
+      "semantic_grouping"
+    ],
+    "preview_probe": {
+      "format": "json",
+      "path": "example.py",
+      "result": "passed",
+      "session_store_created": false
+    },
+    "required_review_flags": [
+      "--audience",
+      "--background-file",
+      "--effort",
+      "--format",
+      "--from",
+      "--max-tokens-budget",
+      "--max-tools",
+      "--preview",
+      "--rule",
+      "--to"
+    ],
+    "result_contract_probe": {
+      "additive_fields_allowed": true,
+      "comment_fields": [
+        "category",
+        "content",
+        "end_line",
+        "existing_code",
+        "path",
+        "severity",
+        "start_line",
+        "thinking"
+      ],
+      "manifest_schema": "ocr.run-manifest/v1",
+      "normalized_outcome": "clean",
+      "result": "passed"
+    },
+    "review_budget_probe": {
+      "budget": 30000,
+      "completed": 2,
+      "failed_budget": 1,
+      "partial_findings_preserved": true,
+      "result": "passed",
+      "selected": 3
+    },
+    "semantic_grouping_probe": {
+      "default_effort": "medium",
+      "filter_requests": 1,
+      "grouping_completion_cap": 16384,
+      "grouping_requests": 1,
+      "main_requests": 3,
+      "result": "passed",
+      "review_rounds": 2
+    },
+    "target_rule_selection_probe": {
+      "format": "json",
+      "from_to_unchanged": true,
+      "path": "synthetic-template.ocrfixture",
+      "result": "passed",
+      "source_exclusion": "unsupported_ext",
+      "target_selected": true
+    },
+    "version_probe": "passed"
+  },
+  "published_at": "2026-08-27T05:49:24Z",
+  "release_changes": "## 🚀 Features\n\n- feat(session): register GroupingTask as a tracked TaskType (#1067)\n- feat(rules): add Solidity and Vyper review rules (#961)\n- feat(action): opt-in completeness-gated checkpoint ranges (#476) (#945)\n- feat(session): compare findings across two review sessions (#922) (#946)\n\n## 🐛 Bug Fixes\n\n- fix: record grace round requests (#1066)\n\n## 📖 Documentation\n\n- docs(ko): add Korean translation for integration guides (#1072)\n\n**Full Changelog**: https://github.com/alibaba/open-code-review/compare/v1.10.1...v1.10.2",
+  "release_notes_sha256": "cad919d43d01e6f8c5ed1a2cb83120d76d082996e5c246c356a97155443d2e83",
+  "result": "compatible",
+  "schema_version": 2,
+  "tag": "v1.10.2",
+  "tested_baseline_version": "1.10.1",
+  "upstream_repository": "alibaba/open-code-review",
+  "version": "1.10.2"
+}

compatibility/ocr-support.json

@@ -1,6 +1,6 @@
 {
-  "monitoring_floor": "1.10.1",
-  "recommended_version": "1.10.1",
+  "monitoring_floor": "1.10.2",
+  "recommended_version": "1.10.2",
   "releases": [
     {
       "assets": [
@@ -1240,6 +1240,59 @@
       "release_url": "https://github.com/alibaba/open-code-review/releases/tag/v1.10.1",
       "status": "tested",
       "version": "1.10.1"
+    },
+    {
+      "assets": [
+        {
+          "name": "opencodereview-darwin-amd64",
+          "sha256": "91d30daa43ea698775df16cb4999e69624f009c93bb7a832310d13070981303d",
+          "size": 57674784
+        },
+        {
+          "name": "opencodereview-darwin-arm64",
+          "sha256": "74fc7bcc0e6d0790c5ca033fd82a5474b6f05d443ed51a26a6f61c0cac6589fd",
+          "size": 54711010
+        },
+        {
+          "name": "opencodereview-linux-amd64",
+          "sha256": "e9205614f80e009ee7b1f444c9da08486fb9ff6db022954fe9203d923ab720b2",
+          "size": 55931042
+        },
+        {
+          "name": "opencodereview-linux-arm64",
+          "sha256": "8ca3f4931200fbf48ff4b2045a6fb69da18246d11f74e630558a6ba5bab53ef4",
+          "size": 52691106
+        },
+        {
+          "name": "opencodereview-windows-amd64.exe",
+          "sha256": "3ec56cc810500fac54d2c4c0ebe580b7841b1cd1966f2e2e86ce51d0292aa56e",
+          "size": 57393152
+        },
+        {
+          "name": "opencodereview-windows-arm64.exe",
+          "sha256": "27ee3472871a32cd5d843579361db198ed10a83855fd43d26a763a0e9cd3cddd",
+          "size": 53370880
+        },
+        {
+          "name": "sha256sum.txt",
+          "sha256": "b5176aaa04a7f00bd84dd61556ca29e6cbdfcfe64cc50af6653163d9be4e7654",
+          "size": 572
+        }
+      ],
+      "capabilities": [
+        "llm_result_identity",
+        "per_run_model_override",
+        "per_run_provider_override",
+        "review_effort",
+        "semantic_grouping"
+      ],
+      "evidence": "compatibility/evidence/ocr-1.10.2.json",
+      "evidence_sha256": "5f37a74a412734c3ebb6846a1082c4a553c087d7d0b5221597a381ec28c16ce3",
+      "human_conclusion": "Compatible after human review in issue #151 and hosted workflow run 33055459209. OCR 1.10.2 adds tracked grouping and grace-round requests, aligns grouping with the inherited 16384 completion cap, and adds Solidity/Vyper review rules without changing toolkit result, manifest, medium-effort, max-tools, DLP, receipt, telemetry, or approval contracts. Session comparison and reusable GitHub Action checkpoint ranges are not consumed; the latter only partially overlaps BL-021. The original machine automatic-safe classification was overridden because feature-bearing release notes require human review.",
+      "published_at": "2026-08-27T05:49:24Z",
+      "release_url": "https://github.com/alibaba/open-code-review/releases/tag/v1.10.2",
+      "status": "tested",
+      "version": "1.10.2"
     }
   ],
   "schema_version": 1,

docs/codex/TASKS_BACKLOG.md

@@ -44,7 +44,7 @@ M3 is established. BL-011 is complete and recorded above rather than retained as
 
 ## M6 Profiles and quality measurement
 
-Provider/network telemetry remains outside M1 and M5. OCR owns token, cost, budget, provider-level review duration, request, and tool-call telemetry. Toolkit v0.7.1 exposes only validated provider-neutral token buckets, distinguishes OCR-wide tool totals from verified MCP-server and count-only evidence-action use, and carries deterministic publication-DLP state in receipt v5, a parseable GitLab summary marker, and a structured local log event; it adds no exporter or endpoint. M6 audits whether those result-derived lifecycle signals need provider-neutral export/alert routing instead of duplicating OCR telemetry.
+Provider/network telemetry remains outside M1 and M5. OCR owns token, cost, budget, provider-level review duration, request, and tool-call telemetry. The toolkit exposes only validated provider-neutral token buckets, distinguishes OCR-wide tool totals from verified MCP-server and count-only evidence-action use, and carries deterministic publication-DLP state in receipt v5, a parseable GitLab summary marker, and a structured local log event; it adds no exporter or endpoint. The 0.8.5 development line adds at most one bounded toolkit-authored CI failure diagnostic from closed retry-report enums and counts, not provider telemetry or an export path. M6 audits whether result-derived lifecycle signals need provider-neutral export/alert routing instead of duplicating OCR telemetry.
 
 ### BL-016: Evaluate explicit run-level model profiles
 
@@ -127,6 +127,7 @@ Provider/network telemetry remains outside M1 and M5. OCR owns token, cost, budg
 - **Roadmap theme:** M7 Later and conditional work
 - **Dependencies:** Stable provider-neutral core contracts and a funded non-GitLab use case. GitLab-first M5 does not depend on it.
 - **Activation trigger:** A named forge has an owner, synthetic fixtures, and explicit parity requirements for CI orchestration, positioning, deduplication, discussion ownership, and safe publication.
+- **Upstream overlap:** OCR 1.10.2 reusable GitHub Action checkpoint ranges cover only upstream Action range selection. They do not provide toolkit forge acquisition, discussion, publication, or lifecycle parity, so the trigger and acceptance criteria remain unmet.
 - **Goal:** Add one coherent host adapter without leaking forge semantics into evidence or core result handling.
 - **Scoped deliverables:** The capability matrix covers authentication, diff positions, drafts, discussion acquisition, provider-declared account classification, thread/reply structure, edit/version identity, anchors, resolved/stale state, pagination/snapshot mutation, ambiguous writes, permissions, and idempotency.
 - **Acceptance criteria:** Core remains provider-neutral, GitLab behavior does not regress, unsupported host capabilities fail or degrade explicitly rather than emulate unsafe parity, and the new host meets the approved lifecycle and security matrix.