Code Tribunal 1.0.1

Code Tribunal 1.0.1

release/release-inputs.json is status: active and the scoped live-evidence
campaign is complete. These notes are final when v1.0.1 is tagged.

Release identity

• Release: 1.0.1
• Tag: v1.0.1
• Runtime source R: 5817e99f8d831a816056feb2dfd44fac85b5196c
• Release commit P: see the annotated tag v1.0.1
• Publication run: 30536734285; quality run for R: 30536734260
• Base image: ghcr.io/seanleecoder/code-tribunal/ai-review-base:1.0-5817e99f8d831a816056feb2dfd44fac85b5196c@sha256:657d5e700768f29e98a980bf6264891d870b8e90af22ab9bd6c82beb30e27e03
• Reviewer image: ghcr.io/seanleecoder/code-tribunal/ai-review-reviewer:1.0-5817e99f8d831a816056feb2dfd44fac85b5196c@sha256:a4b35e46ac23881e1a4dca52d2cf6a04ee77378d519706f43e70271f0d54cb0d
• External manifest: build with
  python scripts/build_release_manifest.py --tag v1.0.1 --runtime-source "$R" --release-commit "$P" --out /tmp/release-manifest.json
  then validate with python scripts/check_release_manifest.py /tmp/release-manifest.json

For the accepted release-version grammar and derived notes path, see the
release version contract.

Scope

This patch release carries the post-1.0.0 fixes and release-readiness work.

• Added/deleted-file anchor fix. The shipped 1.0.0 runtime dropped every
  finding on an added or deleted file (and on any file ordered after one in the
  diff) on GitHub, because the prepared diff's --- /dev/null sentinel failed
  anchor-scan path validation; consensus then exited 3 and post/gate never ran.
  Anchor finalization now maps the added/deleted sides, so such findings are
  accepted. This closes the defect knowingly shipped in 1.0.0.
• render-body.v3 posted output. Free-text and path-shaped model values render
  as literal data, malformed suggestions stay visible as data, and fragment-aware
  truncation keeps spans atomic, blocks closed, and trusted footers/markers intact.
  Prose now wraps instead of scrolling: bodies, evidence, and critique rationale
  render as one code span per line rather than a text fenced block, while
  suggestions keep the fenced block because they are code. Every model-authored
  value still renders inside a code or pre element, which is also the boundary
  keeping model text away from both platforms' post-render autolink, mention, and
  issue-reference filters. Consensus artifacts remain consensus.v1.
• Reviewer model and effort defaults. Model IDs in review.yaml must fully
  match the supported grammar; a malformed value, including a trailing newline, is
  rejected with model_error before the reviewer CLI is invoked. The Cursor
  permission smoke now requires an explicit exact model and rejects the discovery
  placeholder auto before invoking Docker.
• Release-state tooling. Prose claims about release state are now bound to
  release-inputs.status and enforced in make quality; live evidence moved to
  docs/evidence/; scripts/scan_evidence_leaks.py replaces ad-hoc credential
  greps.

Migration

The posted-body format is render-body.v3. Existing bot-authored inline threads
receive a one-time body update on the next review run; issue IDs, state records,
and marker grammar are unchanged. Deployments tracking main before this change see
one further refresh, because the prose format changed within v3.

Cursor

The Cursor CLI remains an opt-in substitute reviewer with a separate credential and
egress path. Completing SPEC-21 Cursor acceptance
is required before enabling Cursor, not before shipping 1.0.1. The historical
1.0.0 Cursor runs do not certify Cursor enablement.

Live campaign

Scoped with the
change-impact triage table
against git diff v1.0.0..R. That diff touches anchors.py, render.py, post.py,
schema.py, types.py, mock_reviewer.py, adapter_runner.py, config/review.yaml,
consensus.schema.json, and base.Dockerfile. It leaves input_bundle.py,
github_platform.py, gitlab_platform.py, gate.py, consensus.py, and
scripts/verify_pipeline_trust.py unchanged — which is what makes the waivers
below honest rather than convenient.

Rows re-run live:

Row	Why it must re-run	Record
Image publication verification	digests always change	record
GitHub lifecycle Chain B, adding fixture	anchors.py/post.py/render.py changed, and the added-file path has never had a live green run. Step 1 asserts accepted_finding_count == raw_finding_count	record
GitLab lifecycle Chain B, condensed	independent render surface for render-body.v3; create, changed-body in-place update, blocking gate	record
One real 3-model panel, GitHub only	default model IDs and the tightened model-ID grammar changed; only a real provider call proves they resolve	record
render-body.v3 refresh of a pre-v3 thread	the only live proof of the migration claim above; re-review a change request whose bot thread predates v3	folded into the lifecycle records as a labelled step

The GitLab real panel is not run: the adapter path is platform-independent, and the
single GitHub panel proves the changed defaults resolve.

Rows shipping under a registered waiver. Each carries a Release-evidence-waived
line whose text is registered verbatim under verification.evidence_waivers; both
halves were stamped at activation, because the artifact must carry an empty
verification block while it is a draft:

Row	Basis
GitLab hostile-MR credential/enforcement boundary	credential withholding, prepare fail-closed, and trusted-composition auditing are unchanged between R(1.0.0) = 88bc941 and R(1.0.1); regression-covered by test_verify_pipeline_trust.py and the fork-secret withholding cases in test_input_bundle.py; passed live at 1.0.0 against the prior pair
Codex max / OpenCode xhigh effort routes	unvalidated at the real providers. Effort levels pass through without coercion, and a malformed model or effort value fails closed with model_error before the CLI is invoked, so a provider-side rejection surfaces as an adapter failure rather than silent degradation
GitHub revision failures (SPEC-34)	1.0.0 waiver carried forward unchanged; github_platform.py and input_bundle.py are untouched and the row is already classified live-optional

1.0.1 release gates

• Run the scoped campaign above against one frozen runtime source and the final
  base/reviewer image pair.
• Record only sanitized evidence and keep private consumer coordinates out of
  the public repository. Audit with scripts/scan_evidence_leaks.py and record its
  exact scope, including the operator-only --exact-value-file pass that 1.0.0
  left unmet.
• Activate the release inputs only after every non-waived release-gating record
  binds to the same source and image digests.

Correction to the 1.0.0 record

release/1.0.0.md is pinned byte-identical to its tag and must not be rewritten, so
this correction is recorded here instead. Its "Tagging" section names
0f86df6a6f698f44dd58f3007943786c0b90e528 as the commit to tag. That commit was
rewritten before the release PR merged and is not reachable from main. The released
release commit P is 3ad443e0b3d91f2736c3dd3b4f1fb5d7f8d21997, which is what
v1.0.0 actually tags; PR #85 landed as a true merge commit
(a9ec8c55fc2f716ac728f67644388ac546c6c89e) so P stayed in history. The tagging
constraint itself was followed correctly — only the SHA in the prose is stale.

Carried known limitations

Unchanged from 1.0.0 and not softened by this release: there is no in-pipeline
trusted-image or trusted-composition enforcement — a hostile consumer
.gitlab-ci.yml can substitute the pinned images, and containment comes from
credential withholding plus the out-of-band trust auditor. Network egress is
unenforced at the container/runner boundary. "Credential isolated" is claimable only
in the recorded sense — protected credentials withheld from an unprotected-ref MR in
the hardened child topology — and not as a product-wide property. GitLab forks are
untested. Cursor remains disabled pending the SPEC-21 enablement queue.

Cursor remains disabled for this release. Before enabling it, complete the
SPEC-21 checklist's explicit ask-mode decision and, if the chosen contract
requires Cursor-backed blocking findings, its blocking fixture and required-check
verification.

Finalization

The scoped campaign passed, the release inputs are active, and every cited record
binds to R = 5817e99 with the base and reviewer digests above. Remaining: tag
v1.0.1 on release commit P, then attach the external manifest and its checksum to
the GitHub release. See "Tagging" below — the tag target is constrained.

Tagging

The external manifest binds release_commit and re-derives the R..P diff, so the
tag must point at a commit that satisfies it.

• Do not squash-merge the release pull request. A squash rewrites P into a new
  commit and drops it from main's history, which invalidates the manifest.
• Either tag v1.0.1 on P exactly, or rebuild and re-validate the manifest against
  the merge commit and tag that — the latter only validates while main has not
  advanced past the merge, because changed_paths is recomputed from R..P.
• Re-run python scripts/check_release_manifest.py after any change of tag target and
  attach the regenerated manifest, not an earlier copy.
• Write the annotated tag message as a release certificate, matching the shape of
  git show --no-patch v1.0.0: R, P, publication run, both digests, the evidence
  summary, the registered waivers, the carried limitations, and the external manifest
  sha256.

Known failing tests in this release commit

make quality on this release commit fails exactly two tests, and both are expected:

test_release_tools.py::test_draft_has_no_historical_verification_binding
test_release_tools.py::test_populated_synthetic_draft_verification_remains_valid

Both read the checked-in release/release-inputs.json through a _draft() helper
that assumes it is a draft. They fail because this commit activates the release —
the state a release commit must be in.

This is a pre-existing tooling defect, not a 1.0.1 regression, and it is verifiable in
one command:

git show v1.0.0:release/release-inputs.json   # status: active, 6 records, 1 waiver

The 1.0.0 release commit carries the identical state. The tests were added in #95,
after v1.0.0, so no release had reached activation with them present until now.

Why this does not affect the release:

• The images are unaffected. unit.test_release_tools is module-skipped inside the
  runtime image (repository-only release tooling is absent from the runtime image).
  The in-image suite that runs at build time and in preflight passes: 662 tests, OK.
• The evidence is unaffected. No product code is implicated; all five passed
  records bind to R = 5817e99 and the digests that ship.
• The recorded quality run is correctly scoped. verification.ci_run_id
30536734260 is the make quality run for R, which is green.
• Nothing in build_release_manifest.py or check_release_manifest.py asserts a
  quality result for P.

The fix cannot land in this commit: ai-review/tests/ is not in
ALLOWED_RELEASE_PATHS, and folding it into R would change the images, because
ai-review/tests is copied into the base image and the image runs its own suite. It is
queued for 1.0.2, where it is an ordinary bug fix in R: pin the synthetic test's
status to draft, and make the repo-state guard status-aware (draft implies an empty
verification binding; active requires the full active validation to pass, with waivers
permitted as a return value). Keep that guard — it catches the class of error where
main claims evidence it does not have.

main returns to green with the follow-up commit that snapshots this artifact and
resets release/release-inputs.json to the 1.0.2 draft.

Operator sign-off items

• Non-disclosing exact-value credential scan. scripts/scan_evidence_leaks.py
  covered all retained 1.0.1 artifacts and evidence records — 312 files, 0.6 MB, 10
  detectors, zero matches — but that is pattern and entropy detection, not a comparison
  against the configured secret values. Repeat with --exact-value-file before
  sign-off, or accept the pattern-based scan as the bar and say so explicitly. This was
  also left unmet at 1.0.0.
• OpenRouter-billed token and cost for the single real panel (run 30540576843).
  No artifact carries a token or cost field; read it from the OpenRouter dashboard if
  the figure is wanted in the record.
• Demo hygiene — done. The mock variables were deleted from both consumers after
  the campaign and confirmed absent, restoring the fail-closed resting state.