Orca-Code-Review v1.1.0

Orca-Code-Review v1.1.0

Backward-compatible release. All new inputs default to their prior behavior —
existing workflows keep working with no changes.

Review quality

• Default review now runs a single gpt-5.5 tier; the cheap→strong cascade
  remains available and configurable via the recipe (#3)
• Calibrated P1/P2 severity and tightened precision rules to cut false
  positives on large PRs (#2)
• P3 severity tier added; review summary now pinned to the top of the PR
  description (#4)
• Feeds the repo's own conventions (AGENTS.md / CLAUDE.md / CONTRIBUTING.md)
  to the engine so project-specific choices aren't flagged as defects (#5)

Configurability (new inputs, all optional)

• auto-review-authors, max-diff-kb (512), max-diff-files (300),
  on-oversized-diff (fail), settings (true), report (true)
• Dashboard-driven settings, quiet mode, server-side rubric override, and an
  exhaustive review loop
• Retry/backoff proxy, oversized-diff guard, per-run report-back, and an
  edit-in-place summary comment

Security & hardening

• API key is passed via environment, never on argv (avoids process-list /
  CI-log leakage) (round-1 review)
• Fork-PR auto-review spend gate; author gate still applies when settings are
  disabled; policy-block stays fatal in exhaustive mode
• Project-conventions doc is read from the base revision only and gated to
  the default branch, framed as untrusted read-only data — a malicious
  AGENTS.md on a PR head cannot weaken the review or alter severity tags (#5)
• Proxy hardening: client-disconnect safety, upstream timeout, idempotency,
  crash/hang fixes; merge-gate integrity; settings authority
• Control-plane URLs preserve gateway sub-paths (self-hosted deployments)
• Added SECURITY.md: threat model, pull_request_target boundary, data flow,
  and key-hygiene guidance