xeonvs · xeonvs · Aug 14, 2026 · Aug 14, 2026
@@ -1 +1 @@
-0.6.0
+0.6.1
@@ -1,8 +1,7 @@
 {
   "issues": [
-    76,
-    78
+    81
   ],
   "schema_version": "ocr-toolkit.release-authorization/v1",
-  "version": "0.5.0"
+  "version": "0.6.0"
 }
@@ -1 +1 @@
-1786541273
+1786704375
@@ -1 +1 @@
-0.5.0
+0.6.0
@@ -1,3 +1,27 @@
+## 0.6.0 - 2026-08-14
+
+### 🚀 Features
+
+- Improve repository-aware reviews and their GitLab result presentation:
+
+  - Add target-branch structured accepted decisions and nested project guidance through the existing read-only evidence MCP, with deterministic scopes, applicability, staleness, precedence, and self-authorization safeguards.
+  - Isolate malformed or oversized policy entries, preserve global root guidance when changed-path identity is empty, and keep complete multibyte or redaction-expanded policy values within persistence and MCP budgets.
+  - Separate collection and persistence responsibilities into explicit internal packages while retaining the supported evidence API and one collector/store/MCP lifecycle.
+  - Preserve source provenance when semantic facts collide, reject ambiguous post-redaction mappings, validate snapshot indexes before serialization, and make atomic store replacement durable where the platform supports directory synchronization.
+  - Combine review health and finding publication into one clear outcome line while preserving warning, incomplete-coverage, posting-limit, suppression, and failure states, and add opt-in closed-enum Shields badges for individual GitLab findings with a private-safe text fallback.
+
+  ([#81](https://github.com/xeonvs/open-code-review-toolkit/issues/81))
+- Target checksum-verified Open Code Review 1.9.3 after adjacent compatibility qualification. ([#82](https://github.com/xeonvs/open-code-review-toolkit/issues/82))
+
+### 📖 Documentation
+
+- Document the repository threat model and security-review calibration so contributors, researchers, and automated security scans share the same assets, attacker capabilities, trust boundaries, and reportability context. ([#81](https://github.com/xeonvs/open-code-review-toolkit/issues/81))
+
+### Security
+
+- Scope the destructive GitHub Actions storage permission to the cleanup job, and harden repository policy evidence against Markdown delimiter injection, irrelevant-guidance saturation, forged schema-v3 provenance/applicability, and legacy trust-label confusion. ([#81](https://github.com/xeonvs/open-code-review-toolkit/issues/81))
+
+
 ## 0.5.0 - 2026-08-12
 
 ### 🚀 Features

@@ -40,7 +40,7 @@ flowchart LR
 - OCR compatibility and the established common evidence model now converge at compact-bootstrap/evidence-MCP integration.
 - M3 threat modeling can proceed from the established generic composition boundary; provider examples wait for BL-011, while managed OAuth does not block static-header or stdio operation.
 - M2 is established through independently verified stable delivery of its framework plugins, template rules, scoped evidence, deltas, and built-in MCP projection. Conditional future ecosystem packs remain in M6 and do not reopen M2; M4 can proceed independently from the stable evidence contracts it consumes.
-- M4 implementation and local review are active in the 0.6.0 lifecycle; it remains in progress until stable artifacts and tracking closure are independently read back.
+- M4 implementation, protected feature merge, development publication, security review, and local OCR remediation are complete in the 0.6.0 lifecycle; it remains in progress until stable artifacts and tracking closure are independently read back.
 - The M5 measurement-gap audit can begin from current lifecycle and result receipts; BL-016 is required only for later named-profile comparisons.
 - Versioned documentation remains a separate MCP integration: the toolkit supplies package/version evidence but does not store documentation.
 - Additional code-hosting adapters are not ecosystem collectors. They remain conditional because the near-term product is GitLab-first.

@@ -14,6 +14,8 @@ Statuses are `ready`, `planned`, `parked`, `conditional`, or `owner action`. Rel
 | M2 evidence gaps (BL-008) | Completed and removed | Demonstrated framework resolution, component ownership, scoped completeness, and first-class MCP delta projection ship through the shared evidence contracts; unproven formats are not retained as mandatory work. |
 | M2 framework selection (BL-009) | Completed and removed | The anonymized selection produced bounded static Jinja2, Go web, Symfony/Twig, and React/Next providers with synthetic cross-provider validation and no second MCP. |
 | M2 milestone closure | Completed | Stable 0.5.0 delivery and independent external readback establish M2; BL-010 remains a conditional M6 extension and is not unfinished M2 scope. |
+| M4 accepted decisions (BL-014) | Completed and removed | Structured target-only decisions now preserve deterministic identity, optional metadata, safe scope, applicability, staleness, and bounded bootstrap/MCP projections without granting suppression authority. |
+| M4 project guidance (BL-015) | Completed and removed | Immutable target guidance now has bounded discovery, deterministic nested applicability and precedence, changed-guidance exclusion, compact bootstrap hints, and full text through the existing read-only evidence MCP. |
 
 ## M3 External MCP hardening
 
@@ -60,37 +62,6 @@ Statuses are `ready`, `planned`, `parked`, `conditional`, or `owner action`. Rel
 - **Validation:** Provider configuration, capability-rendering, redaction, and end-to-end synthetic example tests; do not duplicate the established core composition matrix.
 - **Release classification expectation:** `no-release` for threat-model and documentation examples; any new public runtime behavior is classified separately.
 
-## M4 Policy and project guidance
-
-### BL-014: Evolve accepted decisions into tolerant structured Markdown
-
-- **Status:** planned
-- **Priority:** medium
-- **Roadmap theme:** M4 Policy and project guidance
-- **Dependencies:** Established M1 evidence/MCP contracts and current target-branch self-whitelisting guard.
-- **Activation trigger:** Evidence model can preserve decision scope and provenance.
-- **Goal:** Add optional Scope, Category, Review after, and Owner metadata without breaking existing decision documents.
-- **Scoped deliverables:** Parse heading/rationale entries and optional bullet metadata; normalize unique decision IDs; define repository-relative glob semantics, Category as descriptive metadata, Owner as contact metadata, and `Review after` as an expiry signal rather than automatic deletion; tolerate unknown fields; filter by target branch and component scope; place summaries in bootstrap and full rationale in evidence MCP.
-- **Acceptance criteria:** Existing files remain valid; duplicate IDs and unsafe scope patterns are reported deterministically; malformed optional metadata cannot invalidate unrelated decisions; expired decisions are surfaced as stale and do not silently suppress findings; Owner/Category cannot grant authority; source-branch edits never affect the current review.
-- **Exclusions:** YAML, unconditional finding suppression, policy authorization, or mandatory metadata.
-- **Validation:** Backward-compatibility, unknown/malformed field, scope, date, target/source, and size-bound fixtures.
-- **Release classification expectation:** `release-required`.
-
-### BL-015: Simplify project guidance after an upstream OCR contract exists
-
-- **Status:** conditional
-- **Priority:** medium
-- **Roadmap theme:** M4 Policy and project guidance
-- **Dependencies:** Established M1 evidence/MCP contracts and documented/tested upstream OCR automatic guidance behavior.
-- **Activation trigger:** A supported OCR release proves in compatibility tests that its guidance mechanism can resolve the intended target-ref version rather than the source worktree path.
-- **Goal:** Replace large excerpts with target-branch paths and short non-authoritative hints while preserving fail-closed handling.
-- **Scoped deliverables:** Define root-to-file applicability and precedence for nested `AGENTS.md`/`CLAUDE.md`; discover applicable target-branch files without checkout or execution; exclude guidance changed, added, renamed, or deleted by the merge request; supply target-ref-aware paths/hints; permit OCR native tools to read only the intended target versions on demand.
-- **Acceptance criteria:** Source changes and symlink/submodule indirection cannot self-instruct; conflicting nested guidance resolves deterministically; missing upstream capability retains current bounded behavior; guidance remains untrusted and never overrides system policy.
-- **Exclusions:** Removing safeguards before the trigger, copying full guidance into bootstrap, or toolkit-specific instruction execution.
-- **Validation:** Multi-scope target/source fixtures, changed-guidance attacks, capability fallback tests, and bootstrap budget tests.
-- **Release classification expectation:** `release-required`.
-- **Upstream overlap:** OCR 1.9.1 adds repository-maintainer `AGENTS.md` guidance for upstream contributors, not a runtime target-ref-aware guidance discovery contract. The activation trigger remains unmet.
-
 ## M5 Review profiles and quality measurement
 
 Telemetry is intentionally outside M1. OCR owns token, cost, budget, provider-level review duration, LLM request, and per-tool call duration/count telemetry; the toolkit reuses those upstream signals instead of adding a second implementation. M5 audits only the remaining GitLab lifecycle, bounded evidence/MCP, posting, and review-value gaps before deciding whether any provider-neutral toolkit telemetry is needed.

@@ -6,6 +6,7 @@
 
 | Stable tag | Primary archived plan | Related context in the same archive |
 | --- | --- | --- |
+| `v0.6.0` | [M4 policy and project guidance](releases.md#plan-toolkit-0-6-0) | Structured target decisions, nested guidance, schema-v3 evidence, responsibility-based collectors/store extraction, OCR 1.9.3 qualification, security/OCR reviews, and stable-delivery handoff. |
 | `v0.5.0` | [M2 ecosystem and framework coverage](releases.md#plan-toolkit-0-5-0) | Framework/template evidence, OCR 1.9.2 qualification, both local review cycles, and immutable stable-delivery receipts. |
 | `v0.4.7` | [GitLab review delivery and OCR 1.9.0-1.9.1 qualification](releases.md#plan-toolkit-0-4-7) | Exact-range suggestions, add-only SHA-bound approval, and the release lifecycle used by later stable delivery. |
 | `v0.4.6` | [OCR 1.8.9-1.8.10 qualification and toolkit 0.4.6](releases.md#plan-toolkit-0-4-6) | The subsequent [0.4.6 lifecycle and backlog reconciliation](releases.md#plan-toolkit-0-4-6-reconciliation) records the process correction carried into later releases. |