RELEASE / V1.0 / GA

Enterprise control
for agent-generated code.

codecr V1.0 establishes a production control layer between business intent, AI coding agents, source control, and merge authority. The release makes policy resolution, isolated analysis, and source-free security events independently auditable across cloud, VPC, and self-hosted boundaries.

RELEASE DATE2026-09-05

API GENERATIONv1

POLICY SCHEMA.codecr.yaml

SUPPORT STATEGA

01 / RELEASE POSITION

Governance is now a deployment primitive.

V1.0 treats every pull request as a bounded decision: authorize the context, resolve the policy, calculate the blast radius, execute analysis in isolation, and emit a decision without transferring merge authority to an AI agent.

GA / VPC SANDBOX

14-Day VPC Sandbox

Approved enterprise tenants can evaluate codecr through a topology-scoped pilot covering VPC peering, SSO, repository allowlists, customer KMS authority, policy assignment, and hardware-isolated microVM analysis.

Dedicated Cloud, VPC Peering, and Air-Gapped / On-Prem topology contracts.
Okta and SAML 2.0 identity boundary.
Non-production repository scoping with pinned policy digests.
Source-free evidence and teardown on completion, failure, cancellation, or timeout.

PROVISIONING REMAINS APPROVAL-GATED

GA / POLICY ENGINE

`.codecr.yaml` governance

Security teams can define enforceable controls beside the code and resolve them deterministically across organization, portfolio, repository, and path scopes.

The most restrictive enforceable rule wins.
Relaxation requires a signed, scoped, unexpired exception.
Missing or unpinned parents fail closed.
Every decision records the effective policy digest and owner.

REPOSITORY-NATIVE CONTROL

GA / EVENT DELIVERY

Enterprise webhooks

P0 policy violations and customer-authorized remediation triggers can be delivered as signed, source-free events to a customer-owned verification gateway.

HMAC-SHA256 over the timestamp and exact raw request body.
Five-minute replay window, stable delivery ID, and controlled key rotation.
Idempotent retry contract for 408, 425, 429, and 5xx.
Reference adapters for PagerDuty, Datadog, Slack, and Microsoft Teams.

DESTINATION SECRETS STAY CUSTOMER-SIDE

02 / STABLE CONTRACTS

Interfaces promoted in V1.0.

Contract	V1.0 guarantee	Operator responsibility
Policy resolution	Deterministic inheritance and decision digest.	Pin parent policies and name authorized exception owners.
Analysis workspace	Ephemeral execution with hard teardown conditions.	Approve runtime class, network egress, and key policy.
Webhook delivery	Versioned JSON envelope, signature headers, stable delivery ID.	Verify raw bytes, enforce replay tolerance, and deduplicate.
Agentic remediation	Bounded handoff to a customer-approved coding agent.	Retain human approval and merge authority.
Onboarding email	Optional, separate, double-opt-in state machine.	Complete controller address, provider DNS, suppression, and activation evidence.

03 / ACTIVATION BOUNDARY

GA does not bypass the gate.

The V1.0 product and pilot control contract are generally available. Transactional onboarding email is a separately controlled subsystem: it remains fail-closed until the responsible operator supplies production secrets, replaces the headquarters-address placeholder, verifies provider-generated DNS, proves signed provider events, and demonstrates durable write-before-send suppression.

04 / OPERATOR ACTION

Before the first governed repository.

01
Approve the boundary. Record deployment topology, source-control scope, model route, network egress, and KMS owner.
02
Resolve policy. Pin every inherited .codecr.yaml parent and preserve the effective digest.
03
Exercise failure paths. Prove P0 blocking, missing-parent failure, sandbox teardown, webhook replay rejection, and destination deduplication.
04
Attach evidence. Store signed release hashes, test results, approvals, exceptions, and rollback ownership in the Trust Center record.

Enterprise webhook guide .codecr.yaml reference VPC deployment guide Security architecture