ARCHIVE / V1.0 / ENTERPRISE REFERENCE
Its GA, VPC, microVM, policy-inheritance and integration descriptions do not establish active deployments, issued artifacts or capabilities included in a hosted workspace. Isolated execution is unavailable in the current hosted release. Use the hosted product guide and current product updates for supported workflows.
CodLab V1.0 establishes a production control layer between business intent, AI coding agents, source control, and merge authority. The release makes policy resolution, isolated analysis, and source-free security events independently auditable across cloud, VPC, and self-hosted boundaries.
.codecr.yamlV1.0 treats every pull request as a bounded decision: authorize the context, resolve the policy, calculate the blast radius, execute analysis in isolation, and emit a decision without transferring merge authority to an AI agent.
Approved enterprise tenants can evaluate CodLab through a topology-scoped pilot covering VPC peering, SSO, repository allowlists, customer KMS authority, policy assignment, and hardware-isolated microVM analysis.
.codecr.yaml governanceSecurity teams can define enforceable controls beside the code and resolve them deterministically across organization, portfolio, repository, and path scopes.
P0 policy violations and customer-authorized remediation triggers can be delivered as signed, source-free events to a customer-owned verification gateway.
408, 425, 429, and 5xx.| Contract | V1.0 guarantee | Operator responsibility |
|---|---|---|
| Policy resolution | Deterministic inheritance and decision digest. | Pin parent policies and name authorized exception owners. |
| Analysis workspace | Ephemeral execution with hard teardown conditions. | Approve runtime class, network egress, and key policy. |
| Webhook delivery | Versioned JSON envelope, signature headers, stable delivery ID. | Verify raw bytes, enforce replay tolerance, and deduplicate. |
| Agentic remediation | Bounded handoff to a customer-approved coding agent. | Retain human approval and merge authority. |
| Onboarding email | Optional, separate, double-opt-in state machine. | Complete controller address, provider DNS, suppression, and activation evidence. |
The V1.0 product and pilot control contract are generally available. Transactional onboarding email is a separately controlled subsystem: it remains fail-closed until the responsible operator supplies production secrets, replaces the headquarters-address placeholder, verifies provider-generated DNS, proves signed provider events, and demonstrates durable write-before-send suppression.
Approve the boundary. Record deployment topology, source-control scope, model route, network egress, and KMS owner.
Resolve policy. Pin every inherited .codecr.yaml parent and preserve the effective digest.
Exercise failure paths. Prove P0 blocking, missing-parent failure, sandbox teardown, webhook replay rejection, and destination deduplication.
Attach evidence. Store signed release hashes, test results, approvals, exceptions, and rollback ownership in the Trust Center record.