diff --git a/bitbucket-pipelines.yml b/bitbucket-pipelines.yml
index a8392dc..730cd2a 100644
--- a/bitbucket-pipelines.yml
+++ b/bitbucket-pipelines.yml
@@ -138,11 +138,13 @@ definitions:
           - git clone -q "https://x-token-auth:${BITBUCKET_CLONE_TOKEN}@bitbucket.org/${BITBUCKET_WORKSPACE}/code-review-agent.git"
 
           # Build the PR URL and run the agent.
-          # The || echo below only covers the python main.py call:
-          # agent crashes, AWS STS errors, and runtime exceptions become
-          # warnings instead of hard failures. A failure in git clone or
-          # apt-get above is still a hard failure (rare in practice).
-          # AI review is advisory, not a gate.
+          # AI review is advisory for *runtime* failures: agent crashes,
+          # AWS STS errors, and Python exceptions become warnings via the
+          # || echo below (which only wraps the python main.py call).
+          # *Infrastructure/configuration* failures (missing BITBUCKET_CLONE_TOKEN,
+          # git clone failures, apt-get failures) remain HARD failures by
+          # design — they indicate the pipeline setup itself is broken and
+          # need to be loud, not silently degraded into a stale warning.
           - export PR_URL="https://bitbucket.org/${BITBUCKET_WORKSPACE}/${BITBUCKET_REPO_SLUG}/pull-requests/${BITBUCKET_PR_ID}"
           - cd code-review-agent && python main.py "$PR_URL" || echo "WARNING - AI review step failed (non-blocking)"
 
@@ -372,9 +374,17 @@ pipelines:
               if [ -z "$latest_tag" ]; then latest_tag="v0.0.0"; fi
               echo "Latest tag: ${latest_tag}"
 
-            # Parse the tag into its three version components
+            # Parse the tag into its three version components.
+            # Validate strict semver first — bash arithmetic silently mangles
+            # non-semver tags (v1, v1.2, v1.2.3-rc1 etc.) into wrong results.
+            # Fail loudly with a clear error so nobody ships a bad release.
             - |
               version=$(echo "$latest_tag" | sed 's/^v//')
+              if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                echo "BLOCKED: latest tag '$latest_tag' is not strict semver (expected v#.#.#)."
+                echo "Fix by creating a properly-formatted tag: git tag -a vX.Y.Z -m 'Release vX.Y.Z'"
+                exit 1
+              fi
               major=$(echo "$version" | cut -d. -f1)
               minor=$(echo "$version" | cut -d. -f2)
               patch=$(echo "$version" | cut -d. -f3)