Release v0.9.0

.next-version

@@ -1 +1 @@
-0.8.8
+0.9.1

.release-metadata.json

@@ -1,13 +1,11 @@
 {
   "issues": [
-    157,
-    158,
-    159,
-    160,
-    161,
-    162,
-    163
+    167,
+    168,
+    169,
+    170,
+    172
   ],
   "schema_version": "ocr-toolkit.release-authorization/v1",
-  "version": "0.8.7"
+  "version": "0.9.0"
 }

.release-source-date-epoch

@@ -1 +1 @@
-1788255290
+1788423271

.release-version

@@ -1 +1 @@
-0.8.7
+0.9.0

CHANGELOG.md

@@ -1,3 +1,34 @@
+## 0.9.0 - 2026-09-03
+
+### 🚀 Features
+
+- Add `OCR_GITLAB_TARGET_PROTECTION_MODE=unprotected` as an explicit limited review path for an actually unprotected GitLab target. The secure `required` default is unchanged; limited runs retain normal result and finding publication but are always comment-only, reject privileged context and external MCP before OCR, omit protected-policy inputs, and bind immutable source, target, and actual protection state in receipt v8. ([#168](https://github.com/xeonvs/open-code-review-toolkit/issues/168))
+
+### 🐛 Bug Fixes
+
+- Use one strict effective reviewed-source SHA across review execution, pre-execution status diagnostics, posting, and later actions. Detached merge-request pipelines now use a valid `CI_COMMIT_SHA` only when the merge-request source SHA is absent or all zero, while malformed, conflicting, stale, and mismatched identities still fail closed. ([#167](https://github.com/xeonvs/open-code-review-toolkit/issues/167))
+- Reconcile OCR 1.11.2's attempted built-in evidence tool counts with private action receipt v3 while retaining completed actions as the only source of successful evidence use and approval authority; failed or malformed calls cannot satisfy the mandatory summary. Local reviews remain receipt-less instead of emitting receipt v8 with a non-GitLab protection state, while every present invalid receipt still fails closed. ([#169](https://github.com/xeonvs/open-code-review-toolkit/issues/169))
+
+### 🛠 Maintenance
+
+- Qualify checksum-verified Open Code Review 1.11.2 as the adjacent compatibility baseline for toolkit 0.9.0.
+
+  Changed: built-in language routing admits `.mjs` and `.cjs` under JavaScript Rules and `.cxx` and `.hxx` under C++ Rules; `.svh` remains excluded. Hosted Linux and independent Darwin qualification use checksum-verified release artifacts.
+
+  Unchanged: result and manifest schemas, inherited completion cap `16384`, explicit positive completion-cap transport, default `medium` effort, effective max-tools, private reasoning/session data, receipt v8, DLP, telemetry ownership, and approval authority.
+
+  Deployment: OCR 1.11.2 is qualification evidence, not a runtime fallback; install the final recommended OCR 1.11.3 directly. ([#170](https://github.com/xeonvs/open-code-review-toolkit/issues/170))
+- Promote checksum-verified Open Code Review 1.11.3 as the sole accepted runtime for toolkit 0.9.0, prevent inherited raw-provider capture, and preserve valid findings and summaries when additive failed-tool diagnostics are absent, malformed, non-zero, or contradictory. Install OCR 1.11.3 directly and verify the platform checksum from the compatibility manifest. ([#172](https://github.com/xeonvs/open-code-review-toolkit/issues/172))
+
+### 📖 Documentation
+
+- Document protected and limited unprotected-target setup, capability and failure boundaries, two-merge-request and supported one-merge-request rollout, and the complete review/publication decision process. The new canonical Mermaid maps distinguish error, warning, success, decision, and auxiliary states and are linked from the root agent instructions, documentation index, and toolkit strategy. ([#168](https://github.com/xeonvs/open-code-review-toolkit/issues/168))
+
+### 🧩 Rules
+
+- Route `.mjs` and `.cjs` through OCR 1.11.2's built-in JavaScript Rules and `.cxx` and `.hxx` through its C++ Rules; `.svh` remains excluded. ([#170](https://github.com/xeonvs/open-code-review-toolkit/issues/170))
+
+
 ## 0.8.7 - 2026-09-01
 
 ### 🚀 Features

docs/configuration.md

@@ -97,7 +97,7 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell
 | --- | --- | --- | --- | --- |
 | **`OCR_VERSION`** | Example pipeline | Yes | `v1.11.3` | Checksum-pinned recommended OCR binary release for toolkit 0.9.0. |
 | **`OCR_SHA256`** | Example pipeline | Yes | `9726204ac81baee153fd65b1ff357c380f73e9d8091c4a73c3c9fb541b5164cb` | Expected Linux AMD64 OCR binary digest. |
-| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.7` | Exact toolkit wheel release installed by the current published example. |
+| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.9.0` | Exact toolkit wheel release installed by the current published example. |
 | **`OCR_TOOLKIT_CHECKSUMS_URL`** | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. |
 | `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. |
 | `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. |

docs/engineering/execution_history/README.md

@@ -6,6 +6,7 @@
 
 | Stable tag | Primary archived plan | Related context in the same archive |
 | --- | --- | --- |
+| `v0.9.0` | [Unprotected-target integrity and OCR 1.11.2/1.11.3](releases.md#plan-toolkit-0-9-0) | Canonical reviewed-source identity, constrained unprotected-target reviews, action receipt v3 and receipt v8, additive diagnostic containment, OCR 1.11.2/1.11.3 qualification, complete Mermaid decision maps, retained semantic OCR remediation, Codex Security review, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.7` | [OCR 1.11.1, evidence integrity, and efficient built-in MCP](releases.md#plan-toolkit-0-8-7) | Evidence comparison integrity, bounded search and exact coverage tools, protected same-revision CI outcomes, OCR 1.11.1 qualification, three complete local reviews, controlled five-action MCP qualification, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.6` | [OCR 1.11.0 and precise security signals](releases.md#plan-toolkit-0-8-6) | Contextual injection classification, provider-private OCR-state containment, OCR 1.11.0 qualification and Rules, one complete local semantic review with remediation, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.5` | [Provider diagnostics and OCR 1.10.2](releases.md#plan-toolkit-0-8-5) | Closed numeric provider diagnostics, unchanged GitLab/DLP/receipt/approval projections, OCR 1.10.2 qualification and Rules, compatibility scheduling, explicit local OCR provider-failure waiver, feature merge, development artifact verification, and stable-delivery handoff. |

docs/engineering/execution_history/releases.md

@@ -2,6 +2,90 @@
 
 This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active or blocked repository work; historical receipts here remain part of the audit trail.
 
+<a id="plan-toolkit-0-9-0"></a>
+
+## Toolkit 0.9.0 — unprotected-target integrity and OCR 1.11.2/1.11.3
+
+Status: repository complete; external stable delivery pending
+Release classification: `release-required`
+Target stable version: `0.9.0`
+Repository completion date: 2026-09-03
+
+### Goal and delivered scope
+
+Toolkit 0.9.0 delivers the complete authorized scope of issues #167, #168, #169,
+#170, and #172. One strict effective reviewed-source SHA now binds review,
+pre-execution diagnostics, posting, and later actions, including the detached
+GitLab pipeline fallback. Explicitly permitted unprotected targets gain a
+separately constrained review path: normal findings and summaries remain
+publishable, but the run is always comment-only and cannot acquire protected
+policy, enriched context, adapters, accepted decisions, structured target
+guidance, or external MCP authority.
+
+Private action receipt v3 authenticates attempted and completed fixed evidence
+actions separately. Receipt v8 binds immutable source, target, and actual
+target-protection state and retains only a closed aggregate failed-tool state.
+Valid findings, summaries, manifests, and posting transactions survive absent,
+malformed, hostile, non-zero, or contradictory additive OCR diagnostics.
+Bounded credential-redacted failure details are console-only, and toolkit-owned
+OCR children remove inherited `OCR_RAW_LOGGING`.
+
+The release qualifies OCR 1.11.2 as adjacent compatibility evidence and promotes
+checksum-verified OCR 1.11.3 as the sole accepted and recommended runtime. The
+effective Rules contract adds `.mjs`/`.cjs` JavaScript and `.cxx`/`.hxx` C++
+routing while `.svh` remains excluded. The canonical
+`docs/review-decision-flow.md` supplies three contract-tested Mermaid maps and
+is linked from the root `AGENTS.md`, documentation index, and toolkit strategy.
+
+### Review, OCR, security, and test evidence
+
+- The completed local quality matrix passed 1,486 tests plus 408 subtests at
+  86.38% branch coverage; every scoped coverage floor passed. Compatibility,
+  Towncrier draft, frozen Ruff formatting, Gitleaks, dependency audit, signature
+  checks, deterministic double build, Twine, archive privacy, and separate clean
+  wheel/sdist CLI smokes also passed.
+- Codex Security diff scan `cecd81ce-bc01-42eb-bedf-a4a2a44a096c` covered the
+  complete changed range and reported zero reportable findings. It was not rerun.
+- The owner-authorized retained-artifact semantic OCR repeat completed all 20
+  selected items with zero failed, reused, or waived items and exactly reconciled
+  six attempted/completed evidence summaries. Its two supported findings were
+  corrected; offline finalization then proved valid receipt-less local output and
+  byte-identical retained diagnostics. No additional semantic OCR ran.
+- OCR 1.11.3 qualification used hosted run 33725971286, checksum-pinned evidence
+  SHA-256 `6ad0e1f607b2ddcbb9e7b25e4432d6102ec22d7ef6847c2858c8fb22d38cc0f2`,
+  independent Darwin arm64 readback, adjacent-source review, and deterministic
+  hostile boundary tests. It did not run another configured-provider review.
+
+### Repository and development-publication evidence
+
+- Feature PR #171 passed the complete hosted check set at reviewed head
+  `3441e8a77d71b026db89a896d6374f6cb0a09b99` and was exact-tree squash-merged
+  as `3c7e38c08a48c9af1d0b0c5e10ecf0ac8b5eacc3`.
+- Development workflow run 33732297187 published and independently verified
+  `0.8.8.dev83`. The TestPyPI wheel SHA-256 is
+  `706dfce3991a00b9e93aa65f19bb30baa6b323eab57d8c449d170310a63bbfaf`;
+  the sdist SHA-256 is
+  `b22e1fa5eacade47a130e21474442034aee28c93b5f6880a652981efb353de99`.
+  Workflow and registry bytes, PEP 740 provenance, hosted verifier installs, and
+  CLI smokes agree.
+
+### Stable delivery handoff
+
+The release PR is the final repository mutation. It sets
+`.release-version=0.9.0`, `.next-version=0.9.1`, deterministic source epoch
+`1788423271`, exact sorted issues `[167,168,169,170,172]`, generated Towncrier
+notes, the stable example pin, and this archive while returning `PLANS.md` to its
+inactive template.
+
+External closure remains pending until the exact reviewed release head is
+squash-merged and the protected workflow is independently reconciled across
+TestPyPI, PyPI, workflow artifacts, and the immutable GitHub Release. Closure
+requires byte equality, PEP 740 provenance and GitHub attestations, annotated
+`v0.9.0` tag and peeled target, immutable five-asset Release, validated
+`release-receipt.json`, clean wheel and sdist installs on Python 3.12–3.14,
+Actions-owned receipts, closed #167/#168/#169/#170/#172 and milestone `v0.9.0`,
+deleted release branch, and clean `main == origin/main == v0.9.0^{}`.
+
 <a id="plan-toolkit-0-8-7"></a>
 
 ## Toolkit 0.8.7 — OCR 1.11.1, evidence integrity, and efficient built-in MCP

examples/gitlab/ocr-review.gitlab-ci.yml

@@ -7,7 +7,7 @@ default:
 
 variables:
   OCR_VERSION: "v1.11.3"
-  OCR_TOOLKIT_VERSION: "0.8.7"
+  OCR_TOOLKIT_VERSION: "0.9.0"
   OCR_TOOLKIT_CHECKSUMS_URL: "https://github.com/xeonvs/open-code-review-toolkit/releases/download/v${OCR_TOOLKIT_VERSION}/SHA256SUMS"
   OCR_SHA256: "9726204ac81baee153fd65b1ff357c380f73e9d8091c4a73c3c9fb541b5164cb"
   OCR_POST_MODE: "draft"

tests/test_release_notes.py

@@ -274,6 +274,33 @@ def test_087_release_notes_cover_evidence_integrity_and_mcp_routing() -> None:
         assert phrase in notes
 
 
+def test_090_release_notes_cover_limited_targets_and_ocr_diagnostic_boundaries() -> None:
+    """Keep the trust, publication, and direct OCR migration boundaries explicit."""
+
+    changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+    notes = release.release_notes(changelog, "0.9.0")
+
+    for phrase in (
+        "OCR_GITLAB_TARGET_PROTECTION_MODE=unprotected",
+        "always comment-only",
+        "reject privileged context and external MCP before OCR",
+        "effective reviewed-source SHA",
+        "action receipt v3",
+        "receipt v8",
+        "Local reviews remain receipt-less",
+        "adjacent compatibility baseline",
+        "not a runtime fallback",
+        "sole accepted runtime for toolkit 0.9.0",
+        "Install OCR 1.11.3 directly",
+        "additive failed-tool diagnostics",
+        "canonical Mermaid maps",
+        ".mjs",
+        ".cxx",
+        ".svh",
+    ):
+        assert phrase in notes
+
+
 def test_extracts_only_the_exact_release_section() -> None:
     changelog = "# Changelog\n\n## 0.2.0 - later\n\nnew\n\n## 0.1.0 - now\n\nfirst\n"