xeonvs · Oct 23, 2026 · Oct 23, 2026
@@ -1 +1 @@
-0.13.0
+0.14.0
@@ -1,13 +1,7 @@
 {
   "schema_version": "ocr-toolkit.release-authorization/v1",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "issues": [
-    248,
-    249,
-    250,
-    251,
-    252,
-    253,
-    258
+    264
   ]
 }
@@ -1 +1 @@
-1792673087
+1792761040
@@ -1 +1 @@
-0.12.1
+0.13.0
@@ -1,3 +1,19 @@
+## 0.13.0 - 2026-10-23
+
+### 🚀 Features
+
+- GitLab MR reviews now default `OCR_GITLAB_TARGET_PROTECTION_MODE` from `required` to `auto`: when the actual target is unprotected, the toolkit can use the same project's protected default branch for review rules and governed context while keeping the result comment-only.
+
+  - Changed: current MR reviews require a detached pipeline and bind the checked-out source, GitLab diff version, actual target, and policy commit in receipt v11; stale or unverifiable results stop before publication and approval.
+  - Migration: use `required` to retain protected-target-only admission, or `unprotected` for the previous limited comment-only path. Existing `--local` reviews remain standalone and do not require GitLab MR variables.
+
+  ([#264](https://github.com/xeonvs/open-code-review-toolkit/issues/264))
+
+### Security
+
+- Require OpenTelemetry API 1.45.1 or newer to exclude vulnerable tracestate parsing in MCP’s dependency graph. ([#266](https://github.com/xeonvs/open-code-review-toolkit/issues/266))
+
+
 ## 0.12.1 - 2026-10-22
 
 ### 🐛 Bug Fixes

@@ -32,7 +32,7 @@ plan_archive_indexes:
   - docs/engineering/execution_history/README.md
   - docs/engineering/README.md
   - docs/README.md
-active_plan: PLANS.md
+active_plan: null
 runtime_agent_config_managed: true
 instruction_contract_version: 3
 planning_contract_version: 2

@@ -158,7 +158,7 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell
 | --- | --- | --- | --- | --- |
 | **`OCR_VERSION`** | Example pipeline | Yes | Qualified OCR pin for the example's toolkit release | Exact binary release pinned with its asset checksum in the [pipeline](../examples/gitlab/ocr-review.gitlab-ci.yml); not resolved dynamically. |
 | **`OCR_SHA256`** | Example pipeline | Yes | Manifest SHA-256 for `opencodereview-linux-amd64` | Exact digest pinned alongside `OCR_VERSION` in the pipeline; must belong to the same release entry. |
-| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.12.1` | Exact toolkit wheel release installed by the current published example; update this pin with the published release. |
+| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.13.0` | Exact toolkit wheel version selected by the example; advance this table and the example together in the release PR. |
 | **`OCR_TOOLKIT_CHECKSUMS_URL`** | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. |
 | `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. |
 | `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. |

@@ -1,6 +1,6 @@
 # Execution History Index
 
-`PLANS.md` owns active or blocked repository work. This archive preserves completed plans so an agent can recover the decisions, validation evidence, merge receipts, hashes, and resume context behind a published toolkit version. It also retains the historical [review-context design checkpoint](review_context_design_checkpoint.md) (formerly `m5_context_contracts.md`) and [evidence migration matrix](evidence_migration_matrix.md); neither owns current runtime contracts.
+`PLANS.md` owns active or blocked repository work. This archive preserves completed repository plans, their decisions, validation evidence and pre-publication handoffs. Historical entries may also include later merge receipts and hashes; current external delivery is verified through the immutable release receipt and Actions-owned issue comments. It also retains the historical [review-context design checkpoint](review_context_design_checkpoint.md) (formerly `m5_context_contracts.md`) and [evidence migration matrix](evidence_migration_matrix.md); neither owns current runtime contracts.
 
 <!-- engineering-workflow:index:start -->
 - [2026-10-22-toolkit-site-launch-and-release-notification.md](2026-10-22-toolkit-site-launch-and-release-notification.md)
@@ -14,6 +14,7 @@
 
 | Stable tag | Primary archived plan | Related context in the same archive |
 | --- | --- | --- |
+| `v0.13.0` | [Protected policy fallback for single-MR reviews](plans/2026-10-23-toolkit-0-13-0-protected-default-policy-fallback-for-single-mr-review.md) | #264 protected-policy authority with distinct code target, #265 conditional BL-025 planning, security dependency audit, protected feature merge and verified development artifacts; stable-delivery handoff pending. |
 | `v0.12.1` | [Review diagnostics, DLP and OCR 1.13.3](releases.md#plan-toolkit-0-12-1) | Protected feature/release merges, local OCR and security review, verified development and stable artifacts, immutable release, issue/milestone closure, live site refresh, and external reconciliation. |
 | `v0.12.0` | [OCR 1.13.2, external-tool context and optional local ChatGPT auth](releases.md#plan-toolkit-0-12-0) | Adjacent local OCR qualification, protected MR-context navigation, optional local native authentication and compatible dependency/security updates; protected stable delivery and external reconciliation verified. |
 | `v0.11.3` | [OCR 1.12.13 and reviewed qualification signals](releases.md#plan-toolkit-0-11-3) | Adjacent 1.12.12–1.12.13 qualification, conservative provider/model/deadline review routing, and preserved timeout outcomes; verified stable delivery and external reconciliation. |