Release v0.8.5

.next-version

@@ -1 +1 @@
-0.8.5
+0.8.6

.release-metadata.json

@@ -1,8 +1,8 @@
 {
   "issues": [
-    145,
-    146
+    149,
+    151
   ],
   "schema_version": "ocr-toolkit.release-authorization/v1",
-  "version": "0.8.4"
+  "version": "0.8.5"
 }

.release-source-date-epoch

@@ -1 +1 @@
-1787744412
+1787824489

.release-version

@@ -1 +1 @@
-0.8.4
+0.8.5

CHANGELOG.md

@@ -1,3 +1,34 @@
+## 0.8.5 - 2026-08-27
+
+### 🚀 Features
+
+- Classified LLM-provider failures now emit at most one toolkit-authored CI diagnostic line with closed HTTP detail and non-zero aggregate retry counts from a fully validated `ocr.llm-retry-report/v1`.
+
+  - **Added:** HTTP `402` is shown as `http-payment-required`, HTTP `429` as `http-rate-limited`, a uniform status is shown only when all terminal failures share it, and mixed details are deterministically count-aggregated.
+  - **Changed:** The `rate-or-spending-limit` GitLab remediation now recommends lowering `OCR_REVIEW_CONCURRENCY` and/or `OCR_LLM_MAX_COMPLETION_TOKENS`, starting a new merge request pipeline, and checking provider request/account limits without claiming either setting caused the failure.
+  - **Unchanged:** The GitLab summary/reason, previous-review preservation, DLP, receipt v5, toolkit telemetry, and automatic-approval contracts are unchanged; raw provider-controlled fields and stderr remain private.
+
+  ([#149](https://github.com/xeonvs/open-code-review-toolkit/issues/149))
+
+### 🐛 Bug Fixes
+
+- OCR compatibility classification now sends feature-bearing patch releases to human review instead of allowing adjacent maintenance keywords to misclassify them as `automatic-safe`. ([#151](https://github.com/xeonvs/open-code-review-toolkit/issues/151))
+
+### 🛠 Maintenance
+
+- Open Code Review 1.10.2 is the checksum-pinned runtime dependency for toolkit 0.8.5.
+
+  - **Changed:** The current GitLab example, runtime preflight, compatibility manifest, and qualification evidence move from OCR 1.10.1 to 1.10.2. The inherited OpenAI completion cap remains `16384`, but OCR grouping requests now use that template-owned cap instead of a separate `4096`; an explicit `OCR_LLM_MAX_COMPLETION_TOKENS` continues to override every request.
+  - **Changed:** Daily OCR compatibility discovery moves from `05:41 UTC` to `07:15 UTC`; exact-tag manual dispatch remains the recovery path when GitHub delays or omits a scheduled run.
+  - **Unchanged:** OCR result and manifest schemas, default `medium` effort, effective max-tools behavior, DLP, receipt v5, toolkit telemetry ownership, and approval contracts are unchanged.
+
+  ([#151](https://github.com/xeonvs/open-code-review-toolkit/issues/151))
+
+### 🧩 Rules
+
+- The recommended OCR 1.10.2 built-in Rules and reviewable-file allowlist now cover Solidity (`.sol`) and Vyper (`.vy`). ([#151](https://github.com/xeonvs/open-code-review-toolkit/issues/151))
+
+
 ## 0.8.4 - 2026-08-26
 
 ### 🐛 Bug Fixes

docs/compatibility.md

@@ -71,7 +71,7 @@ Solidity (`.sol`) and Vyper (`.vy`) join the effective built-in Rules and review
 
 The hosted qualification initially labelled the patch `automatic-safe` because maintenance keywords masked the `Features` section. Human review overrode that result, and the classifier now treats feature-bearing patch notes as material so they require the human lane.
 
-Deploy toolkit 0.8.5 directly with OCR 1.10.2 after the Draft release work is approved. The public Linux amd64 example verifies SHA-256 `e9205614f80e009ee7b1f444c9da08486fb9ff6db022954fe9203d923ab720b2`; the independently checked Darwin arm64 artifact verifies `74fc7bcc0e6d0790c5ca033fd82a5474b6f05d443ed51a26a6f61c0cac6589fd`, and the upstream `sha256sum.txt` verifies `b5176aaa04a7f00bd84dd61556ca29e6cbdfcfe64cc50af6653163d9be4e7654`.
+Deploy toolkit 0.8.5 directly with OCR 1.10.2. The public Linux amd64 example verifies SHA-256 `e9205614f80e009ee7b1f444c9da08486fb9ff6db022954fe9203d923ab720b2`; the independently checked Darwin arm64 artifact verifies `74fc7bcc0e6d0790c5ca033fd82a5474b6f05d443ed51a26a6f61c0cac6589fd`, and the upstream `sha256sum.txt` verifies `b5176aaa04a7f00bd84dd61556ca29e6cbdfcfe64cc50af6653163d9be4e7654`.
 
 The contiguous 1.9.7 through 1.9.8 promotion combines the repository-owned hosted Linux qualification with adjacent upstream source review. It also repeats the required 1.9.8 contract probes through the checksum-verified Darwin arm64 artifact. Multi-tool MCP initialization, fixed tool discovery and dispatch, and owner-only session persistence remain compatible with the M5 design: the toolkit may expose several fixed tools from its one built-in process, while an isolated `HOME` contains OCR's `.opencodereview/sessions` state for deterministic cleanup. Gemini and Bedrock are optional upstream provider capabilities that the toolkit neither selects nor configures; mirror-aware installation is outside the toolkit-owned download path; native severity retains the structured result fields already consumed; and human-audience progress routing does not affect the toolkit's agent-audience invocation. Therefore this promotion requires no toolkit CI behavior adaptation beyond version and checksum pins. These source observations establish capability only; the M5 production-path tests remain responsible for proving the toolkit's composition and containment.
 

docs/configuration.md

@@ -94,7 +94,7 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell
 | --- | --- | --- | --- | --- |
 | **`OCR_VERSION`** | Example pipeline | Yes | `v1.10.2` | Checksum-pinned recommended OCR binary release for toolkit 0.8.5. |
 | **`OCR_SHA256`** | Example pipeline | Yes | `e9205614f80e009ee7b1f444c9da08486fb9ff6db022954fe9203d923ab720b2` | Expected Linux AMD64 OCR binary digest. |
-| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.4` | Exact toolkit wheel release installed by the current published example. |
+| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.5` | Exact toolkit wheel release installed by the current published example. |
 | **`OCR_TOOLKIT_CHECKSUMS_URL`** | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. |
 | `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. |
 | `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. |

docs/engineering/execution_history/README.md

@@ -6,6 +6,7 @@
 
 | Stable tag | Primary archived plan | Related context in the same archive |
 | --- | --- | --- |
+| `v0.8.5` | [Provider diagnostics and OCR 1.10.2](releases.md#plan-toolkit-0-8-5) | Closed numeric provider diagnostics, unchanged GitLab/DLP/receipt/approval projections, OCR 1.10.2 qualification and Rules, compatibility scheduling, explicit local OCR provider-failure waiver, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.4` | [GitLab summary correctness and OCR 1.10.1](releases.md#plan-toolkit-0-8-4) | Receipt-bound OCR core advisory, publication-filtered coverage, field-bounded HTAB with unchanged-value DLP checks, non-duplicating one-finding guide, OCR 1.10.1 qualification, final local OCR remediation, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.3` | [OCR boundaries and review tool-usage visibility](releases.md#plan-toolkit-0-8-3) | Authoritative compatibility failure publication, installed-OCR numeric boundary ownership, complete bounded review tool-activity counters, advisory macOS endpoint checks, feature merge, development artifact verification, explicit local-LLM non-claim, and stable-delivery handoff. |
 | `v0.8.2` | [OCR 1.10.0, review effort, and compatibility failure recovery](releases.md#plan-toolkit-0-8-2) | Exact OCR 1.10.0 promotion, medium review effort, private grouping/round data, toolkit-owned output/DLP/approval boundaries, failed-qualification retention, BL-017 ownership audit, feature merge, development artifact verification, explicit local-LLM non-claim, and stable-delivery handoff. |

docs/engineering/execution_history/releases.md

@@ -2,6 +2,102 @@
 
 This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active or blocked repository work; historical receipts here remain part of the audit trail.
 
+<a id="plan-toolkit-0-8-5"></a>
+
+## Toolkit 0.8.5 — provider diagnostics and OCR 1.10.2
+
+Status: repository complete; external stable delivery pending
+Release classification: `release-required`
+Target stable version: `0.8.5`
+Repository completion date: 2026-08-27
+
+### Goal and delivered scope
+
+Toolkit 0.8.5 adds one bounded provider-neutral CI diagnostic line derived
+only from a fully validated private `ocr.llm-retry-report/v1`. HTTP 402 and
+429 retain the same public `rate-or-spending-limit` reason while the local log
+can distinguish `http-payment-required` from `http-rate-limited`, include one
+uniform HTTP status, and aggregate only non-zero closed retry counters. Mixed
+terminal details are deterministically counted. Provider-controlled text,
+identities, paths, URLs, headers, request IDs, and stderr cannot enter that
+projection.
+
+The GitLab summary shape, previous-review preservation, publication DLP, receipt
+v5, toolkit telemetry, findings, severity, suppression, and automatic approval
+remain unchanged. Rate/spending remediation suggests lowering concurrency and/or
+an operator-selected completion cap, starting a new pipeline, and checking the
+provider's request/account limits without claiming a proven cause or recommending
+a provider-specific numeric cap.
+
+The release qualifies and pins OCR 1.10.2, records its grouping-cap and
+grace-round behavior, adds Solidity and Vyper to the effective Rules contract,
+and makes feature-bearing OCR patch releases require human compatibility review.
+Daily discovery moves to 07:15 UTC while exact-tag manual dispatch remains the
+recovery path.
+
+### Decisions and non-claims
+
+- Issues #149 and #151 are the complete tracked release set.
+- Provider diagnostics remain one toolkit-authored local line from a strict
+  closed numeric projection; they are not telemetry, receipt, DLP, finding,
+  severity, outcome, publication, or approval inputs.
+- OCR 1.10.2 qualification is Maintenance, the classifier correction is a Bug
+  Fix, the diagnostic is a Feature, and Solidity/Vyper support is Rules.
+- Session comparison and upstream GitHub Action checkpoint ranges are not
+  consumed. The latter does not activate or complete a second forge adapter.
+- B2B, `core/common`, shared templates, and consumer repositories remain outside
+  this release.
+- Local semantic OCR review is explicitly waived for this release, not passed:
+  both owner-authorized invocations failed before generation only at the external
+  provider boundary.
+
+### Repository, OCR, and hosted evidence
+
+- Official Darwin arm64 OCR 1.10.2 was installed as the PATH-effective binary
+  and verified at SHA-256
+  `74fc7bcc0e6d0790c5ca033fd82a5474b6f05d443ed51a26a6f61c0cac6589fd`.
+  Hosted qualification run 33055459209 and local isolated probes verified the
+  consumed OCR contracts without changing user configuration.
+- The exact-range local OCR attempts used concurrency 2 and then the
+  owner-requested concurrency 1. Each selected all nine supported files, but all
+  13 logical requests received HTTP 429 through 65 retries, with zero input/output
+  tokens and zero findings. The owner authorized release continuation if the
+  concurrency-1 retry repeated that class. No OCR finding or semantic-pass claim
+  was derived from these failures.
+- The final deterministic gate passed 1,296 tests plus 337 subtests at 86.51%
+  branch-aware coverage. Risk groups passed at 85%, 82%, 86%, and 87% against
+  floors of 80%, 80%, 85%, and 85%. The current release-contract tests, Ruff,
+  strict MyPy, Bandit, manifest and lock validation, Towncrier draft, pinned
+  Gitleaks, public-diff privacy scan, and `git diff --check` passed.
+- Feature PR #150 passed all 13 hosted checks at reviewed head
+  `701bedd2e39b67a7433a63c0b2019354fc751089` and tree
+  `0ecda6c3836201378220e7935eaadc72a8ff9a58`, with zero unresolved review
+  threads. It was squash-merged as verified commit
+  `6a9d6d37833dabe75d09937694c958e75fe77faa` with the same tree.
+- Development workflow run 33060708492 published and independently verified
+  `0.8.5.dev76`. TestPyPI wheel SHA-256 is
+  `d340472778120454fc7b0a74f37d743d592e536c3dcc41c83f0c9afc02da7af6`;
+  sdist SHA-256 is
+  `efa9c865f8e959d774710976453422625f566fd1835d868c066a6b6a87644aa3`.
+  Workflow/TestPyPI bytes, PEP 740 provenance, and clean wheel/sdist installs
+  agree.
+
+### Stable delivery handoff
+
+The release PR is the final repository mutation. It sets
+`.release-version=0.8.5`, `.next-version=0.8.6`, deterministic source epoch
+`1787824489` one second after the feature squash merge, exact sorted issues
+`[149, 151]`, generated Towncrier notes, stable example pins, and this archived
+plan while returning `PLANS.md` to its inactive template.
+
+External closure remains pending until the exact reviewed release head is
+squash-merged and stable workflow output is independently reconciled across
+TestPyPI, PyPI, workflow artifacts, and the immutable GitHub Release. Closure
+requires byte equality, PEP 740 provenance and GitHub attestations, annotated
+`v0.8.5` tag and peeled target, immutable `release-receipt.json`, clean PyPI
+wheel and sdist installs on Python 3.12-3.14, Actions-owned receipts, closed
+#149/#151 and milestone `v0.8.5`, synchronized clean `main`, and scratch cleanup.
+
 <a id="plan-toolkit-0-8-4"></a>
 
 ## Toolkit 0.8.4 — GitLab summary correctness and OCR 1.10.1

examples/gitlab/ocr-review.gitlab-ci.yml

@@ -7,7 +7,7 @@ default:
 
 variables:
   OCR_VERSION: "v1.10.2"
-  OCR_TOOLKIT_VERSION: "0.8.4"
+  OCR_TOOLKIT_VERSION: "0.8.5"
   OCR_TOOLKIT_CHECKSUMS_URL: "https://github.com/xeonvs/open-code-review-toolkit/releases/download/v${OCR_TOOLKIT_VERSION}/SHA256SUMS"
   OCR_SHA256: "e9205614f80e009ee7b1f444c9da08486fb9ff6db022954fe9203d923ab720b2"
   OCR_POST_MODE: "draft"

tests/test_release_notes.py

@@ -204,6 +204,27 @@ def test_084_release_notes_separate_advisory_publication_and_dlp_contracts() ->
         assert phrase in notes
 
 
+def test_085_release_notes_keep_provider_diagnostics_bounded_and_actionable() -> None:
+    """Keep the provider and OCR upgrade boundaries explicit for deployment."""
+
+    changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+    notes = release.release_notes(changelog, "0.8.5")
+
+    for phrase in (
+        "ocr.llm-retry-report/v1",
+        "http-payment-required",
+        "http-rate-limited",
+        "OCR_REVIEW_CONCURRENCY",
+        "OCR_LLM_MAX_COMPLETION_TOKENS",
+        "GitLab summary/reason",
+        "Open Code Review 1.10.2",
+        "07:15 UTC",
+        "Solidity",
+        "Vyper",
+    ):
+        assert phrase in notes
+
+
 def test_extracts_only_the_exact_release_section() -> None:
     changelog = "# Changelog\n\n## 0.2.0 - later\n\nnew\n\n## 0.1.0 - now\n\nfirst\n"