Code Tribunal 1.0.2

Code Tribunal 1.0.2

Release identity

• Release: 1.0.2
• Tag: v1.0.2
• Release inputs: release/release-inputs.json, status: active
• Runtime source R: 54dffa130be5c921602f264a2123fda4b1895f13
• Base image: ghcr.io/seanleecoder/code-tribunal/ai-review-base:1.0-54dffa130be5c921602f264a2123fda4b1895f13@sha256:960600d339a9c7ed95539fe5de6f2414ed82fb06b96a02ed267d9332cd3d7fb4
• Reviewer image: ghcr.io/seanleecoder/code-tribunal/ai-review-reviewer:1.0-54dffa130be5c921602f264a2123fda4b1895f13@sha256:6bf8fdfbe11a3b85519ae954411b436e5bed5f895e900074404a7b27359e6fab
• Quality run: 31369496045 (passed)
• Publication run: 31369496025 (passed)

For the accepted release-version grammar and derived notes path, see the
release version contract.

Scope

Carried in from the 1.0.1 release, which surfaced them:

• Release-tooling test fixes. test_release_tools.py asserted that the
  checked-in release artifact is always an unbound draft, and hardcoded the release
  version in its manifest tests. The first made make quality fail on any release
  commit; the second made it fail on every post-release draft reset. Both are fixed:
  the repo-state guard is now scoped by declared status, and the version is derived
  from the artifact. This is why the 1.0.1 release commit shipped with two known
  failing tests.
• Stop shipping test code in the runtime image — done. base.Dockerfile now copies
  only ai-review/tests/fixtures, which is all preflight resolves paths from, and the
  build-time in-image suite is removed. Both preflights instead bind-mount the
  checkout's tests into the built image, which still proves "this exact image passes the
  suite" and proves it against the current tests rather than whatever was frozen into
  the layers. A production image that processes untrusted diffs and model output no
  longer carries test code, and a change to test code no longer alters image
  identity. Fixtures are the exception and still ship, because the reviewer preflight
  runs --read-only with no mount and resolves its diff and repo from them; a fixture
  change therefore does alter the image digest and stays part of the release binding.
  The GitLab image-build template is removed entirely (see below), so the only image
  build that remains is the GitHub publish workflow.
• Removed the GitLab image-build template. ai-review/ci/build-images.gitlab-ci.yml
  built the product images from a GitLab mirror of this repository. No such project
  exists, no current user-facing documentation referenced it, it was not part of the
  hashed release artifact, and it was never executed against a real GitLab instance.
  The historical Phase-2 acceptance record still references it and is retained as
  written, with a superseded-procedure note added rather than its findings edited. Its
  supply-chain guards in check_supply_chain_pins.py are removed with it. GitLab remains
  a fully supported consumer platform — review.gitlab-ci.yml and
  review-child.gitlab-ci.yml are unchanged, still hashed in canonical_templates, and
  still covered by the live evidence campaign. What is gone is only the ability to build
  the images from GitLab; a consumer needing that would write their own pipeline around
  base.Dockerfile and reviewer.Dockerfile.
• Tag signing — established. SSH signing is configured and verified end to end
  (Good "git" signature), with signers in .github/allowed_signers and the procedure
  documented in
  release-process.md. Applies from
  v1.0.2; v1.0.0 and v1.0.1 remain unsigned and are not being retagged.

Also included in this release:

• Reliable OpenCode structured output. The adapter now uses OpenCode's
  schema-backed StructuredOutput transport through a loopback client, treats only
  answer parts as answer text, rejects ambiguous JSON streams across every adapter,
  and retains redacted raw stdout when parsing fails. If OpenCode returns an exact
  JSON-stringified finding or critique inside the schema-backed array, the client
  decodes that one unambiguous object; other malformed shapes remain fail-closed. A
  provider-free image preflight exercises the complete transport, including its
  permission negative control.
• Bounded OpenCode tool reach. The reviewer explicitly denies external-directory
  access, resolves the packaged CLI and interpreter ahead of ambient PATH, and ships
  a checksum-verified ripgrep so search never downloads an unverified executable at
  review time. Image preflights verify the effective permissions and both pinned
  binaries against decoys.
• Four peer reviewer seats. AI_REVIEW_REVIEWERS selects any roster of Claude,
  Codex, OpenCode, and Cursor while preserving the shipped Claude/Codex/OpenCode
  default. Thresholds are validated against the configured panel and clamped to the
  selected seats without dropping corroboration below two. GitHub scopes
  CURSOR_API_KEY to the Cursor matrix job only; Cursor remains disabled by default.
• Independent review and critique budgets. Review stages default to 1,800 seconds
  and critiques to 900 seconds, with separate CI ceilings and a capped compatibility
  fallback for older configurations. OpenCode forwards max effort unchanged rather
  than rejecting or silently remapping it.
• Refreshed reviewer toolchain. The published image pins OpenCode 1.18.12, Claude
  Code 2.1.221, Codex 0.146.0, Cursor Agent 2026.07.23-e383d2b, and ripgrep 15.1.0.

Deferred, deliberately not in 1.0.2:

• SPEC-42 — whether a human /ai-review wontfix may clear the merge gate. Deferred
  by decision. The current behaviour is unchanged and documented: wontfix durably
  dismisses a finding and suppresses re-posting, but consensus keeps counting it as
  blocking and the required check stays red. Reproduced live again at 1.0.1. The only
  escapes remain disabling merge_gate.enabled or removing the required check.

Version decision. This ships as 1.0.2. The new reviewer roster is opt-in, the
shipped three-seat default and existing per-seat controls are unchanged, and the
remaining product changes are compatible fixes and operational hardening. Removing
test code changes image identity but not the supported runtime interface. The release
therefore keeps the already-reviewed patch target rather than reopening the train as a
minor release.

Live campaign

Scoped with the
change-impact triage table
against git diff v<previous>..R. Rows re-run live:

Row	Why it must re-run	Record
Image publication verification	digests always change	docs/evidence/record-image-publication-verification.md — passed
GitHub real default-model panel	config/review.yaml, adapter transport, and reviewer selection changed	docs/evidence/record-github-default-model-smoke.md — passed; PR #14, run 31370873644, full three-seat panel, real findings posted, required gate blocked

Rows shipping under a registered waiver:

Row	Waiver reason (must match verification.evidence_waivers verbatim)
OpenCode max effort route	OpenCode max effort was already accepted in real runs on an operator-controlled project; those runs are operator attestation rather than source-bound public evidence, and the final runtime change only normalizes a returned structured item after provider execution, so the operator accepted skipping a duplicate 1.0.2 rerun.
GitLab hostile-MR credential/enforcement boundary	Trust topology is unchanged: input_bundle.py, gitlab_platform.py, and scripts/verify_pipeline_trust.py carry no diff; roster documentation and stage timeouts do not alter credential withholding. Covered by test_verify_pipeline_trust.py and fork-secret withholding cases in test_input_bundle.py.
GitHub revision failures	github_platform.py and input_bundle.py carry no revision-race behavior change; covered by SPEC-34 cases in test_input_bundle.py and test_github_platform.py.

The first candidate campaign (f21418f…, demo PR #12, run 31367545101,
attempts 1 and 2) reproducibly degraded because OpenCode returned a string item
that finalization dropped. That campaign is retained as failed validation. PR #116
closed the gap, runtime 54dffa1… and both images were rebuilt, and the final
campaign above reached panel_status: full with no failed reviewers.

Release evidence outcome

• The source-bound image-publication and GitHub default-model rows passed.
• OpenCode max, the unchanged GitLab hostile-MR boundary, and unchanged GitHub
  revision-failure wiring ship under the registered waivers above.
• Downloaded final-campaign artifacts were clean under the repository's ten
  pattern/entropy credential detectors. An exact-value audit was not performed and
  is not claimed.
• The external release manifest binds the signed tag's release commit to R, the
  canonical-template hashes, the immutable digests, run IDs, evidence records, and
  waivers.

Carried known limitations

• GitLab does not enforce the trusted image or trusted composition inside the
  consumer pipeline; the historical hostile-MR containment came from protected
  credential withholding plus an out-of-band trust auditor.
• Network egress is not enforced at the container or runner boundary.
• "Credential isolated" is claimable only in the recorded hardened-child,
  unprotected-ref topology. GitLab forks remain untested.
• Cursor is disabled by default and is not accepted for enablement until the
  SPEC-21 closure checklist has a pinned Composer model and fresh denial evidence.
• OpenCode max has operator-attested real-project validation but no public
  source-bound 1.0.2 artifact.

Operator sign-off items

• OpenCode max rerun skipped by operator decision based on prior real-project
  validation; residual evidence limitation recorded above.
• Exact-value credential scan not performed; pattern/entropy artifact scan passed.
• Cursor remains disabled; the publication annotation for the discovery-only
  auto model is not treated as a permission-smoke pass.
• v1.0.2 is SSH-signed and verified before publication.

Release artifacts

The GitHub release publishes the external release manifest and its SHA-256 checksum.
The activated inputs are snapshotted at
release/history/1.0.2-release-inputs.json for historical validation.