From 883d12bbaaad97b9b53f8227f49d61be690729cf Mon Sep 17 00:00:00 2001
From: xeonvs <11463419+xeonvs@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:51:25 +0200
Subject: [PATCH] Release v0.8.6

---
 .next-version                                 |   2 +-
 .release-metadata.json                        |   6 +-
 .release-source-date-epoch                    |   2 +-
 .release-version                              |   2 +-
 CHANGELOG.md                                  |  44 ++++++
 PLANS.md                                      | 147 +-----------------
 changelog.d/153.bugfix.md                     |   5 -
 changelog.d/155.bugfix.md                     |   5 -
 changelog.d/155.doc.md                        |   4 -
 changelog.d/155.maintenance.md                |   6 -
 changelog.d/155.rules.md                      |   1 -
 docs/configuration.md                         |   4 +-
 docs/engineering/execution_history/README.md  |   1 +
 .../engineering/execution_history/releases.md |  94 +++++++++++
 examples/gitlab/ocr-review.gitlab-ci.yml      |   2 +-
 tests/test_release_notes.py                   |  24 +++
 16 files changed, 173 insertions(+), 176 deletions(-)
 delete mode 100644 changelog.d/153.bugfix.md
 delete mode 100644 changelog.d/155.bugfix.md
 delete mode 100644 changelog.d/155.doc.md
 delete mode 100644 changelog.d/155.maintenance.md
 delete mode 100644 changelog.d/155.rules.md

diff --git a/.next-version b/.next-version
index 7fc2521..1e9b46b 100644
--- a/.next-version
+++ b/.next-version
@@ -1 +1 @@
-0.8.6
+0.8.7
diff --git a/.release-metadata.json b/.release-metadata.json
index fde2b4c..760dc93 100644
--- a/.release-metadata.json
+++ b/.release-metadata.json
@@ -1,8 +1,8 @@
 {
   "issues": [
-    149,
-    151
+    153,
+    155
   ],
   "schema_version": "ocr-toolkit.release-authorization/v1",
-  "version": "0.8.5"
+  "version": "0.8.6"
 }
diff --git a/.release-source-date-epoch b/.release-source-date-epoch
index fa9a82a..dea0a93 100644
--- a/.release-source-date-epoch
+++ b/.release-source-date-epoch
@@ -1 +1 @@
-1787824489
+1787913471
diff --git a/.release-version b/.release-version
index 7ada0d3..7fc2521 100644
--- a/.release-version
+++ b/.release-version
@@ -1 +1 @@
-0.8.5
+0.8.6
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9ace170..dae3760 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,47 @@
+## 0.8.6 - 2026-08-28
+
+### 🐛 Bug Fixes
+
+- Correct reviewer-guide security classification:
+
+  - **Fixed:** command/shell, SQL/NoSQL, code, template, prompt, LDAP, XPath, CRLF/header, log, HTML/script, and expression injection require explicit vulnerability context; the standalone word `injection` is no longer promoted.
+  - **Changed:** neutral phrases such as knowledge or dependency injection no longer inflate the published security count or estimated review effort.
+  - **Unchanged:** finding severity, lifecycle, suppression, and approval behavior.
+
+  ([#153](https://github.com/xeonvs/open-code-review-toolkit/issues/153))
+- Contain provider-private OCR state at the publication boundary:
+
+  - **Fixed:** reasoning, encrypted/native replay payloads, and request `tool_choice` fields are removed before the canonical OCR result is persisted or receipt v5 is bound.
+  - **Changed:** private-only removal preserves a byte-equivalent review projection and approval eligibility; the same fields laundered through findings or warnings become `publication-filtered`.
+  - **Unchanged:** receipt v5, public tool-call and reasoning-token counters, DLP reason counts for private-only state, and approval rules.
+
+  ([#155](https://github.com/xeonvs/open-code-review-toolkit/issues/155))
+
+### 🛠 Maintenance
+
+- Qualify the toolkit 0.8.6 OCR dependency:
+
+  - **Changed:** Open Code Review 1.11.0 is the sole accepted runtime; grouping inventory is status-first with churn and the GitLab job timeout is 45 minutes for the default-medium/highest supported round envelope.
+  - **Added:** checksum-verified Linux and Darwin evidence plus strict historical-1.10.x-old/1.11.0-new qualification fixtures.
+  - **Migration:** deploy toolkit 0.8.6 directly with OCR 1.11.0. OCR 1.10.2 is comparison evidence only, not a supported fallback.
+  - **Unchanged:** result/manifest, inherited completion cap `16384`, support for an operator-selected positive completion-cap override, default effort `medium`, receipt v5, DLP, telemetry, summary, and approval contracts. The toolkit leaves that override unset by default and does not recommend a provider-specific value. OCR 1.11.0 corrects max-tools help text only: effective omitted/`0`/`49`/`50` remains `100`, while `101` raises the cap to `101`.
+
+  ([#155](https://github.com/xeonvs/open-code-review-toolkit/issues/155))
+
+### 📖 Documentation
+
+- Refresh installation and operating guidance:
+
+  - **Changed:** Python 3.12–3.14 uses `uv tool install` by default or `pip` only in an activated virtual environment; OCR is installed separately as checksum-verified 1.11.0 and verified with `ocr --version` plus `ocr-ci --help`.
+  - **Clarified:** max-tools runtime is unchanged despite corrected help text; reasoning and `tool_choice` stay private; reviewer-guide injection matching is contextual; Ruff formatting is applied and checked before each Python commit.
+
+  ([#155](https://github.com/xeonvs/open-code-review-toolkit/issues/155))
+
+### 🧩 Rules
+
+- **Added:** review Handlebars (`.hbs`) and Mustache (`.mustache`) files through OCR 1.11.0's built-in allowlist and language-specific Rules. Toolkit evidence and publication authority are unchanged. ([#155](https://github.com/xeonvs/open-code-review-toolkit/issues/155))
+
+
 ## 0.8.5 - 2026-08-27
 
 ### 🚀 Features
diff --git a/PLANS.md b/PLANS.md
index ff22863..6d4abc7 100644
--- a/PLANS.md
+++ b/PLANS.md
@@ -6,149 +6,4 @@ before handoff or commit. Completed stable plans are indexed in
 
 ## Active Work
 
-### Toolkit 0.8.6 — OCR 1.11.0 and precise security signals
-
-Status: active — Draft implementation exists; independent review and full stable delivery
-are in progress.
-
-Release classification: `release-required`
-
-Target stable version: `0.8.6`
-
-#### Goal
-
-Deliver toolkit 0.8.6 as an immutable stable release. The release must qualify and require
-OCR 1.11.0, fix false security promotion for neutral domain phrases, keep provider-private
-reasoning and request state outside every public/receipt/approval sink, pass local and hosted
-validation, and finish with independently verified registry and GitHub artifacts, closed
-release issues and milestone, and synchronized clean `main`.
-
-#### Scope And Decisions
-
-- Continue from Draft PR #154 and issues #153/#155; inspect the complete Draft rather than
-  assuming its existing green checks prove readiness.
-- OCR 1.11.0 is the sole supported runtime. OCR 1.10.2 remains comparison evidence only.
-- Preserve one provider-neutral flow:
-  `private OCR state -> canonical projection -> DLP -> publication -> receipt/approval`.
-- Keep grouping inventory, timeout scaling, Handlebars/Mustache Rules, `file_find`, result,
-  manifest, receipt v5, DLP, telemetry, summary, and approval contracts internally
-  consistent and covered by synthetic tests.
-- Fix #153 only in reviewer-guide analytics: neutral phrases such as knowledge or dependency
-  injection must not increase the security count or effort, while explicit metadata and a
-  closed set of vulnerability phrases remain promoted.
-- Required configuration variables remain bold in public documentation.
-- Do not set or recommend a provider-specific `4096` completion cap. The active default is
-  unset and inherits the qualified OCR/provider contract. Historical wire evidence may retain
-  its exact tested value when explicitly labelled as historical evidence.
-- Update the PATH-effective local Darwin arm64 OCR atomically to checksum-verified 1.11.0.
-- Run one semantic local OCR review against the exact final feature head with concurrency 1.
-  If it fails exclusively because every provider request is HTTP 429, record the gate as
-  owner-authorized `waived`, not passed, do not retry again, and continue release delivery.
-- Keep full test and OCR output in ignored owner-only temporary logs. Public plans, issues,
-  PRs, changelog, release notes, and summaries contain only synthetic or bounded structural
-  evidence and never private paths, credentials, provider/model identity, prompts, reasoning,
-  tool payloads, request IDs, or raw OCR output.
-- macOS hosted checks remain advisory; Linux supported-Python checks and protected release
-  authorization are the release priority.
-- No B2B, `core/common`, shared-template, or consumer-repository integration is in scope.
-
-#### Requirements And Evidence
-
-| ID | Requirement | Authoritative evidence |
-| --- | --- | --- |
-| `R1` | Exact OCR 1.11.0 qualification and sole-runtime pin | Upstream release/source review, compatibility evidence/hash validation, preflight/example tests, local binary digest/version/help |
-| `R2` | Correct grouping/rules/timeout/file lookup behavior | Qualification-only parser tests, installed-artifact no-LLM probes, runtime contract tests |
-| `R3` | Provider-private fields cannot affect public state | Hostile projection, DLP, receipt, cleanup, telemetry, summary, and approval tests |
-| `R4` | #153 false-positive classification fixed without broad regression | Exact reproducer plus positive, neutral, Unicode, boundary, determinism, and immutability tests |
-| `R5` | Documentation/examples/changelog are current and consistent | Documentation contracts, version searches, Towncrier draft, complete diff review |
-| `R6` | Feature tree is release-ready | Targeted tests, full quality/coverage, security, package determinism, local OCR, self-review, exact PR head/check/thread readback |
-| `R7` | Stable release is authorized and published | Release plan/receipt, release PR exact-head checks, protected stable workflow success |
-| `R8` | Publication is independently closed | Byte equality across workflow/TestPyPI/PyPI/Release, provenance and attestations, tag target, Python 3.12–3.14 installs, release-note/asset readback |
-| `R9` | Repository and tracking state are closed | Actions-owned issue receipts, #153/#155 closed, milestone closed, archived plan, clean `main == origin/main == v0.8.6^{}` |
-
-#### Work Queue
-
-| Queue | Status | Deliverable |
-| --- | --- | --- |
-| `WQ-01` | `done` | Live `main`, Draft PR, issues, milestone, upstream release, roadmap/backlog, and release owners inspected. |
-| `WQ-02` | `done` | Draft #154 implementation and documentation audited; release plan and completion-cap wording corrected. |
-| `WQ-03` | `done` | Exact local OCR 1.11.0 installed and qualified; the single concurrency-1 semantic review completed 7/7 selected files. |
-| `WQ-04` | `done` | The one confirmed OCR finding is fixed; full gates and holistic self-review pass, and the signed final feature-head commit is ready to bind. |
-| `WQ-05` | `in progress` | Push the final feature head, update and mark PR ready, verify protected checks/threads/policy, merge, and verify development publication. |
-| `WQ-06` | `pending` | Prepare signed `release/v0.8.6` state, generated changelog, archived plan, receipt inputs, and release PR. |
-| `WQ-07` | `pending` | Verify release PR, merge exact reviewed tree, and complete the protected stable workflow. |
-| `WQ-08` | `pending` | Independently verify registries, bytes, provenance, attestations, tag, immutable Release, receipt, and supported-Python installs. |
-| `WQ-09` | `pending` | Verify issue receipts, close issues/milestone, synchronize clean `main`, remove task-owned temporary material, and perform final audit. |
-
-#### Validation Contract
-
-- During iteration: focused tests for every changed parser, subprocess, persistence, DLP,
-  posting, receipt, configuration, compatibility, and documentation boundary.
-- Final feature gate: `scripts/quality.sh check`, all coverage floors, compatibility manifest,
-  lockfile, Towncrier draft, Ruff format/lint, strict MyPy, Bandit, checksum-verified
-  Gitleaks, package build/determinism, and `git diff --check`.
-- OCR gate: exact installed 1.11.0 identity and one semantic review at concurrency 1; inspect
-  the result/manifest and coverage rather than process exit alone. A pure repeated HTTP 429 is
-  a documented waiver, never a pass.
-- PR gates: exact head/base/tree, all required checks complete, no unresolved review threads,
-  current merge policy, and re-read immediately before merge.
-- Stable closure: independent artifact bytes, TestPyPI/PyPI metadata and PEP 740 provenance,
-  GitHub attestations and immutable Release, annotated tag peeled target, receipt schema and
-  hashes, clean wheel/sdist installs on Python 3.12–3.14, issue/milestone receipts, and clean
-  synchronized `main`.
-
-#### Risks And Recovery
-
-- A Draft-green check can miss semantic or privacy defects. Fix only evidence-backed findings,
-  repeat the affected gate, and then rerun the single complete final gate.
-- Local OCR replacement can fail. Verify the candidate before atomic replacement and retain a
-  verified rollback copy until 1.11.0 passes local identity and no-LLM probes.
-- Provider rate limiting can make semantic OCR unavailable. After the single concurrency-1 run,
-  accept only an all-429 outcome for the authorized waiver; mixed or product failures require
-  diagnosis and remediation.
-- Registry propagation can lag. Verify JSON/simple-index state and retry once without cache;
-  do not misclassify cache lag as an artifact defect.
-- Stable release publication is irreversible. Re-read exact release head, authorization,
-  checks, and receipt inputs immediately before merge; stop on any mismatch.
-
-#### Current Evidence
-
-- Draft PR #154 starts from released v0.8.5 and had 13/13 hosted checks green at head
-  `79d5587`; issues #153/#155 and milestone v0.8.6 are open.
-- Hosted OCR compatibility run 33158664020 verified the official 1.11.0 assets and generated
-  the accepted human-review-required evidence. Adjacent source review maps each consumed
-  contract or records it as no-impact.
-- PATH-effective OCR is official Darwin arm64 1.11.0 with SHA-256
-  `ac8bf5a0fcd176bb9dcc15b169e90f4b52bf32787adef17a850489dbed97fb78`.
-  The installed `probe-local` contract passed version/help, preview, grouping, Rules, result,
-  budget, numeric CLI, and completion-cap checks.
-- The only configured-provider OCR review ran at concurrency 1 on exact head `d2249ab` and
-  finished in 396 seconds with manifest `complete`: 7 selected, 7 completed, 0 failed,
-  0 reused, and 0 waived. It returned one medium bug finding; this is a passing semantic
-  gate, so no provider waiver applies.
-- The finding correctly identified that the qualification-only grouping parser accepted the
-  historical wire shape only for 1.10.2 even though repeatable semantic probes cover the full
-  qualified 1.10.0–1.10.2 line. The parser now binds that exact old shape to all 1.10.x
-  releases while production preflight remains exact 1.11.0. All 86 compatibility tests pass.
-- Targeted privacy/posting/configuration/release suites pass 480 tests plus 243 subtests;
-  manifest validation, Towncrier draft, Ruff format check, and diff checks pass.
-- The final canonical gate passes 1,321 tests plus 363 subtests at 86.52% branch
-  coverage. The four locked risk groups pass at 85%, 82%, 86%, and 87%; Ruff format/lint,
-  strict MyPy, and Bandit pass in the same run.
-- Independent lock and OCR-manifest validation, rendered 0.8.6 Towncrier draft,
-  dependency audit, pinned Gitleaks, and `git diff --check` pass. Two deterministic
-  wheel/sdist builds are byte-identical; Twine and archive content/privacy checks pass,
-  and clean wheel plus sdist installs and CLI smoke pass on Python 3.12, 3.13, and 3.14.
-- Holistic feature-diff self-review found and fixed one documentation drift: the current
-  compatibility guide now describes only an operator-selected positive completion-cap
-  override and the full qualification-only historical 1.10.x inventory parser range.
-  Machine qualification evidence retains its exact checksum-bound tested probe. No other
-  correctness, privacy, release, documentation, or example inconsistency remains.
-
-#### Closure Gate
-
-- [ ] Every requirement has direct current-state evidence.
-- [ ] Feature and release PRs are merged from exact reviewed heads with required checks green.
-- [ ] Stable 0.8.6 artifacts, provenance, attestations, tag, Release, receipt, and installs are independently verified.
-- [ ] Issues #153/#155 and milestone v0.8.6 are closed through truthful release evidence.
-- [ ] The active plan is archived, local and remote release branches are removed, task-owned temporary material is cleaned, and `main` is clean and synchronized.
+No active or blocked repository work.
diff --git a/changelog.d/153.bugfix.md b/changelog.d/153.bugfix.md
deleted file mode 100644
index ed74a41..0000000
--- a/changelog.d/153.bugfix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Correct reviewer-guide security classification:
-
-- **Fixed:** command/shell, SQL/NoSQL, code, template, prompt, LDAP, XPath, CRLF/header, log, HTML/script, and expression injection require explicit vulnerability context; the standalone word `injection` is no longer promoted.
-- **Changed:** neutral phrases such as knowledge or dependency injection no longer inflate the published security count or estimated review effort.
-- **Unchanged:** finding severity, lifecycle, suppression, and approval behavior.
diff --git a/changelog.d/155.bugfix.md b/changelog.d/155.bugfix.md
deleted file mode 100644
index 0996ec7..0000000
--- a/changelog.d/155.bugfix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Contain provider-private OCR state at the publication boundary:
-
-- **Fixed:** reasoning, encrypted/native replay payloads, and request `tool_choice` fields are removed before the canonical OCR result is persisted or receipt v5 is bound.
-- **Changed:** private-only removal preserves a byte-equivalent review projection and approval eligibility; the same fields laundered through findings or warnings become `publication-filtered`.
-- **Unchanged:** receipt v5, public tool-call and reasoning-token counters, DLP reason counts for private-only state, and approval rules.
diff --git a/changelog.d/155.doc.md b/changelog.d/155.doc.md
deleted file mode 100644
index 4977f54..0000000
--- a/changelog.d/155.doc.md
+++ /dev/null
@@ -1,4 +0,0 @@
-Refresh installation and operating guidance:
-
-- **Changed:** Python 3.12–3.14 uses `uv tool install` by default or `pip` only in an activated virtual environment; OCR is installed separately as checksum-verified 1.11.0 and verified with `ocr --version` plus `ocr-ci --help`.
-- **Clarified:** max-tools runtime is unchanged despite corrected help text; reasoning and `tool_choice` stay private; reviewer-guide injection matching is contextual; Ruff formatting is applied and checked before each Python commit.
diff --git a/changelog.d/155.maintenance.md b/changelog.d/155.maintenance.md
deleted file mode 100644
index 62976cf..0000000
--- a/changelog.d/155.maintenance.md
+++ /dev/null
@@ -1,6 +0,0 @@
-Qualify the toolkit 0.8.6 OCR dependency:
-
-- **Changed:** Open Code Review 1.11.0 is the sole accepted runtime; grouping inventory is status-first with churn and the GitLab job timeout is 45 minutes for the default-medium/highest supported round envelope.
-- **Added:** checksum-verified Linux and Darwin evidence plus strict historical-1.10.x-old/1.11.0-new qualification fixtures.
-- **Migration:** deploy toolkit 0.8.6 directly with OCR 1.11.0. OCR 1.10.2 is comparison evidence only, not a supported fallback.
-- **Unchanged:** result/manifest, inherited completion cap `16384`, support for an operator-selected positive completion-cap override, default effort `medium`, receipt v5, DLP, telemetry, summary, and approval contracts. The toolkit leaves that override unset by default and does not recommend a provider-specific value. OCR 1.11.0 corrects max-tools help text only: effective omitted/`0`/`49`/`50` remains `100`, while `101` raises the cap to `101`.
diff --git a/changelog.d/155.rules.md b/changelog.d/155.rules.md
deleted file mode 100644
index e7a9bd6..0000000
--- a/changelog.d/155.rules.md
+++ /dev/null
@@ -1 +0,0 @@
-**Added:** review Handlebars (`.hbs`) and Mustache (`.mustache`) files through OCR 1.11.0's built-in allowlist and language-specific Rules. Toolkit evidence and publication authority are unchanged.
diff --git a/docs/configuration.md b/docs/configuration.md
index 241519d..a46082e 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -92,9 +92,9 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell
 
 | Variable | Source / owner | Required | Exact default | Behavior |
 | --- | --- | --- | --- | --- |
-| **`OCR_VERSION`** | Example pipeline | Yes | `v1.11.0` | Checksum-pinned recommended OCR binary release for the toolkit 0.8.6 development line. |
+| **`OCR_VERSION`** | Example pipeline | Yes | `v1.11.0` | Checksum-pinned recommended OCR binary release for toolkit 0.8.6. |
 | **`OCR_SHA256`** | Example pipeline | Yes | `13f68cc2eca1a36d42140e9d37797b68fea5cbbf4b6345ec01ec1b06910fab60` | Expected Linux AMD64 OCR binary digest. |
-| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.5` | Exact toolkit wheel release installed by the current published example. |
+| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.6` | Exact toolkit wheel release installed by the current published example. |
 | **`OCR_TOOLKIT_CHECKSUMS_URL`** | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. |
 | `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. |
 | `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. |
diff --git a/docs/engineering/execution_history/README.md b/docs/engineering/execution_history/README.md
index dee5a10..f98b59f 100644
--- a/docs/engineering/execution_history/README.md
+++ b/docs/engineering/execution_history/README.md
@@ -6,6 +6,7 @@
 
 | Stable tag | Primary archived plan | Related context in the same archive |
 | --- | --- | --- |
+| `v0.8.6` | [OCR 1.11.0 and precise security signals](releases.md#plan-toolkit-0-8-6) | Contextual injection classification, provider-private OCR-state containment, OCR 1.11.0 qualification and Rules, one complete local semantic review with remediation, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.5` | [Provider diagnostics and OCR 1.10.2](releases.md#plan-toolkit-0-8-5) | Closed numeric provider diagnostics, unchanged GitLab/DLP/receipt/approval projections, OCR 1.10.2 qualification and Rules, compatibility scheduling, explicit local OCR provider-failure waiver, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.4` | [GitLab summary correctness and OCR 1.10.1](releases.md#plan-toolkit-0-8-4) | Receipt-bound OCR core advisory, publication-filtered coverage, field-bounded HTAB with unchanged-value DLP checks, non-duplicating one-finding guide, OCR 1.10.1 qualification, final local OCR remediation, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.3` | [OCR boundaries and review tool-usage visibility](releases.md#plan-toolkit-0-8-3) | Authoritative compatibility failure publication, installed-OCR numeric boundary ownership, complete bounded review tool-activity counters, advisory macOS endpoint checks, feature merge, development artifact verification, explicit local-LLM non-claim, and stable-delivery handoff. |
diff --git a/docs/engineering/execution_history/releases.md b/docs/engineering/execution_history/releases.md
index 47201ec..dc74b30 100644
--- a/docs/engineering/execution_history/releases.md
+++ b/docs/engineering/execution_history/releases.md
@@ -2,6 +2,100 @@
 
 This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active or blocked repository work; historical receipts here remain part of the audit trail.
 
+<a id="plan-toolkit-0-8-6"></a>
+
+## Toolkit 0.8.6 — OCR 1.11.0 and precise security signals
+
+Status: repository complete; external stable delivery pending
+Release classification: `release-required`
+Target stable version: `0.8.6`
+Repository completion date: 2026-08-28
+
+### Goal and delivered scope
+
+Toolkit 0.8.6 qualifies OCR 1.11.0 as its sole accepted runtime, corrects
+reviewer-guide security classification for neutral uses of the word
+`injection`, and keeps provider-private reasoning and request state outside
+every persisted public, receipt, summary, telemetry, and approval projection.
+
+Security promotion now requires explicit command/shell, SQL/NoSQL, code,
+template, prompt, LDAP, XPath, CRLF/header, log, HTML/script, or expression
+injection context. Neutral phrases such as knowledge or dependency injection
+do not increase the published security count or estimated review effort;
+finding severity, lifecycle, suppression, and approval behavior are unchanged.
+
+OCR reasoning, signed or encrypted replay payloads, and request `tool_choice`
+state are removed before canonical result persistence and receipt-v5 binding.
+Private-only removal preserves a byte-equivalent review projection and approval
+eligibility. The same values laundered through public findings or warnings are
+publication-filtered through the existing DLP and remain approval-ineligible.
+
+### OCR qualification and compatibility decisions
+
+- OCR 1.11.0 is the only production runtime accepted by toolkit 0.8.6.
+  OCR 1.10.2 is adjacent historical comparison evidence, not a fallback.
+- Grouping inventory changes to status-first entries with added/deleted churn.
+  Qualification accepts the old wire form only for OCR 1.10.0 through 1.10.2
+  and the new form from 1.11.0 onward; production code consumes neither form.
+- `file_find` supports repository-relative subpaths and both slash styles.
+  Handlebars and Mustache join the built-in allowlist and Rules contract.
+- OCR's 15-minute base subtask timeout scales to 15/30/45 minutes for
+  low/medium/high effort, so the GitLab example allows the 45-minute envelope.
+- Max-tools runtime behavior is unchanged: omitted, `0`, `49`, and `50` remain
+  effectively `100`; `101` raises the cap to `101`. Corrected help text does
+  not alter findings, completeness, DLP, receipt, telemetry, or approval.
+- The inherited completion cap remains OCR-owned. The toolkit supports an
+  operator-selected positive override, leaves it unset by default, and does
+  not recommend a provider-specific value.
+- Receipt v5, result and manifest schemas, public token/tool counters, DLP,
+  toolkit telemetry, summary, and approval contracts remain unchanged.
+
+### Repository, OCR, and hosted evidence
+
+- Hosted qualification run 33158664020 verified the checksum-pinned OCR 1.11.0
+  artifacts and required human review for the minor release. The PATH-effective
+  Darwin arm64 binary matched SHA-256
+  `ac8bf5a0fcd176bb9dcc15b169e90f4b52bf32787adef17a850489dbed97fb78`.
+- Exactly one configured-provider semantic review ran with concurrency 1 at
+  exact feature head `d2249abaa1760a1ac15e7b0ab75414e7af5a37ea`. Its manifest
+  completed all 7 selected files with failed/reused/waived `0/0/0` and found
+  one valid grouping-qualification defect.
+- Signed corrective commit `2a96f02b58eb54fc3e71ff1e9cec7343f4a20076`
+  extends the qualification-only old-format parser across OCR 1.10.0-1.10.2
+  while production preflight remains exact 1.11.0. No second OCR run was made.
+- The final feature gate passed 1,321 tests plus 363 subtests at 86.52% branch
+  coverage. Risk groups passed at 85%, 82%, 86%, and 87%; Ruff, strict MyPy,
+  Bandit, lock/manifest validation, Towncrier draft, dependency audit, pinned
+  Gitleaks, deterministic builds, Twine, archive privacy, and clean Python
+  3.12-3.14 wheel and sdist installs passed.
+- Feature PR #154 passed all 13 hosted checks at reviewed head
+  `2a96f02b58eb54fc3e71ff1e9cec7343f4a20076` and tree
+  `0d37e445782671e9cbe95e2d6a0ba2ce1599eb17`, with zero unresolved review
+  threads. It was squash-merged as verified commit
+  `58170e9765480e25ca0a963cd790af5938df83bc` with the same tree.
+- Development workflow run 33164086626 published and independently verified
+  `0.8.6.dev78`. TestPyPI wheel SHA-256 is
+  `2608b60b8efd891be1796c729ba6ac2151045febe4d0d724f355ec6a884327c6`;
+  sdist SHA-256 is
+  `e99a6e50b4a82d913660a66a46ba8c256104c5d1ab7971274716671208d1968a`.
+  Workflow and registry bytes, PEP 740 provenance, and clean installs agree.
+
+### Stable delivery handoff
+
+The release PR is the final repository mutation. It sets
+`.release-version=0.8.6`, `.next-version=0.8.7`, deterministic source epoch
+`1787913471` one second after the feature squash merge, exact sorted issues
+`[153, 155]`, generated Towncrier notes, the stable example pin, and this
+archived plan while returning `PLANS.md` to its inactive template.
+
+External closure remains pending until the exact reviewed release head is
+squash-merged and the protected workflow is independently reconciled across
+TestPyPI, PyPI, workflow artifacts, and the immutable GitHub Release. Closure
+requires byte equality, PEP 740 provenance and GitHub attestations, annotated
+`v0.8.6` tag and peeled target, immutable `release-receipt.json`, clean PyPI
+wheel and sdist installs on Python 3.12-3.14, Actions-owned receipts, closed
+#153/#155 and milestone `v0.8.6`, synchronized clean `main`, and scratch cleanup.
+
 <a id="plan-toolkit-0-8-5"></a>
 
 ## Toolkit 0.8.5 — provider diagnostics and OCR 1.10.2
diff --git a/examples/gitlab/ocr-review.gitlab-ci.yml b/examples/gitlab/ocr-review.gitlab-ci.yml
index ac8645f..6bf1179 100644
--- a/examples/gitlab/ocr-review.gitlab-ci.yml
+++ b/examples/gitlab/ocr-review.gitlab-ci.yml
@@ -7,7 +7,7 @@ default:
 
 variables:
   OCR_VERSION: "v1.11.0"
-  OCR_TOOLKIT_VERSION: "0.8.5"
+  OCR_TOOLKIT_VERSION: "0.8.6"
   OCR_TOOLKIT_CHECKSUMS_URL: "https://github.com/xeonvs/open-code-review-toolkit/releases/download/v${OCR_TOOLKIT_VERSION}/SHA256SUMS"
   OCR_SHA256: "13f68cc2eca1a36d42140e9d37797b68fea5cbbf4b6345ec01ec1b06910fab60"
   OCR_POST_MODE: "draft"
diff --git a/tests/test_release_notes.py b/tests/test_release_notes.py
index 73cc2f5..dd5e4f3 100644
--- a/tests/test_release_notes.py
+++ b/tests/test_release_notes.py
@@ -225,6 +225,30 @@ def test_085_release_notes_keep_provider_diagnostics_bounded_and_actionable() ->
         assert phrase in notes
 
 
+def test_086_release_notes_preserve_privacy_and_exact_ocr_migration() -> None:
+    """Keep the security-signal fix and OCR 1.11.0 boundary actionable."""
+
+    changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+    notes = release.release_notes(changelog, "0.8.6")
+
+    for phrase in (
+        "standalone word `injection`",
+        "knowledge or dependency injection",
+        "encrypted/native replay payloads",
+        "tool_choice",
+        "publication-filtered",
+        "Open Code Review 1.11.0",
+        "sole accepted runtime",
+        "status-first with churn",
+        "45 minutes",
+        "operator-selected positive completion-cap override",
+        "does not recommend a provider-specific value",
+        "Handlebars",
+        "Mustache",
+    ):
+        assert phrase in notes
+
+
 def test_extracts_only_the_exact_release_section() -> None:
     changelog = "# Changelog\n\n## 0.2.0 - later\n\nnew\n\n## 0.1.0 - now\n\nfirst\n"