Prepare v0.6.1 provider evidence

[xeonvs]

Summary

Prepare Open Code Review Toolkit v0.6.1 by separating protected-target policy from the forge diff base, retaining changed template evidence within bounded collection, and exposing bounded untrusted merge-request intent through the existing evidence MCP boundary.

Implementation, the one permitted local OCR review, post-OCR remediation, and local validation are complete. The branch is published only at this finalized checkpoint to avoid repeated GitHub Actions consumption.

Tracks #87, #88, #89, #90.

Implementation

• Prioritize changed templates within the existing per-ref and per-kind evidence limits.
• Add top-level ocr-ci --version from centralized package metadata.
• Add an immutable protected-target policy identity without changing diff-base-to-head review semantics.
• Materialize the exact repository-owned OCR rules blob from the captured policy SHA without modifying the checkout.
• Collect protected-target decisions and guidance against unchanged review paths.
• Normalize and persist bounded merge-request intent as invocation-trust evidence.
• Keep raw provider text out of bootstrap, argv, environment, logs, and receipts.
• Block automatic approval when mutable author-controlled MR intent is admitted while retaining comment publication.
• Qualify OCR 1.9.4 and reconcile telemetry/backlog impact.
• Add verified OpenSSF Scorecard and CodeQL README badges.
• Update public contracts, backlog analysis, Towncrier fragments, and the requirement-to-evidence matrix.

OCR 1.9.4 qualification

• Hosted run 31868292800 verified all asset digests plus sha256sum.txt, Linux amd64 CLI/preview/JSON consumer contracts, and classified the release for human review.
• Adjacent source review confirmed the terminal session line is omitted from JSON output; TraceSummary is an internal no-output-change refactor; Go MCP SDK remains v1.6.1.
• The session ID is useful OCR-owned correlation evidence for BL-017, but remains high-cardinality run identity rather than a new toolkit telemetry layer.
• Local Darwin arm64 asset digest 66a591c291947fd7036628f69698c3d240b497e8aa13c5837caae271f014414f was verified, installed, and passed the real local contract probe.
• A post-remediation bounded discovery found no stable OCR release newer than 1.9.4.

Trust-boundary review

• Provider snapshot acquisition is bounded, read-only, same-origin, open-MR-only, and derived from normalized numeric invocation identity.
• Protected target branch/protection/head selects policy; author-controlled MR fields cannot select policy or authority.
• The captured policy SHA is immutable throughout preparation and bounded fetch verifies the exact object.
• Repository-owned --rule transport preserves exact bytes and explicit external operator-owned paths remain untouched.
• Evidence v1-v3 stores retain explicit legacy semantics; new schemas use hostile-readback validation.
• MR context is complete-field admitted, bounded, redacted, source-head bound, and represented only as untrusted data.
• External MCP context remains explicitly untrusted and cannot authorize tools, writes, suppression, posting, or approval.
• Fixtures and diagnostics remain synthetic and private-safe.

Validation

• Focused tests pass before each logical signed commit.
• Complete diffs pass self-review, architecture review, and requirement-to-evidence review.
• Python 3.12, 3.13, and 3.14 quality matrices pass: 810 tests plus 105 subtests at 81.21% coverage on each interpreter.
• Ruff, mypy, Bandit, pip-audit, Gitleaks, compatibility manifest, Towncrier, and package metadata checks pass.
• Deterministic pre-OCR double builds and Twine checks pass.
• Installed wheel and sdist-derived-wheel Git/private-artifact/stdio-MCP tests pass.
• Acceptance criteria and touched boundaries are mapped to production owners and real entry points; doubles replace only collaborators beyond the claimed boundary.
• The complete 38-module test suite was audited for false integration claims.
• Exactly one final local OCR 1.9.4 review completed over the exact feature range.
• All four OCR findings are remediated and covered through their production owners.
• The 2,372-character bootstrap warning was traced to duplicated inventory/trust/tool guidance, not provider text; the final-review store now renders 1,643 characters and the dense installed fixture 1,974, both untruncated under the 2,000-character default.
• The saved OCR transcript was audited: all 70 evidence calls failed before reading context because OCR materialized inactive union-schema fields and selected summary; the dispatcher now accepts declared inactive fields, rejects unknown fields, and real installed wheel/sdist stdio tests prove summary/list/get plus raw synthetic MR-context retrieval.
• Model-dependent matching/contradictory/unknown intent calibration is not claimed: the one OCR run did not read MR context, and no fake LLM test is substituted as integration evidence.
• All required hosted checks pass on exact corrected head aafe57f.

Release closure

• Feature PR is made ready and merged only after local readiness.
• TestPyPI development artifacts are independently verified after feature merge.
• Exact Release v0.6.1 PR is reviewed and merged.
• TestPyPI and PyPI bytes/hashes agree with the release artifacts.
• Provenance, attestations, supported-Python installs, annotated tag, and immutable GitHub Release are independently verified.
• Actions-owned release receipt is read back.
• Issues Use the current protected target ref for review policy and guidance #87, Prioritize changed templates within bounded evidence collection #88, Expose bounded untrusted merge-request intent through provider evidence #89, and [OCR compatibility] Qualify v1.9.4 #90 are closed only through the release receipt lifecycle.
• Release planning is archived and local main is synchronized cleanly.