diff --git a/bitbucket-pipelines.yml b/bitbucket-pipelines.yml
index 81f4378..8bc4097 100644
--- a/bitbucket-pipelines.yml
+++ b/bitbucket-pipelines.yml
@@ -125,8 +125,10 @@ definitions:
           # BEFORE any data is written, closing the race window that exists when
           # writing first and chmodding second (default umask would expose the
           # token briefly as 644). printf (not echo) avoids a trailing newline.
+          - set +x
           - install -m 600 /dev/null "$(pwd)/web-identity-token"
           - printf '%s' "$BITBUCKET_STEP_OIDC_TOKEN" > "$(pwd)/web-identity-token"
+          - set -x
 
           # Clone the review agent repo (private — needs BITBUCKET_CLONE_TOKEN)
           # SETUP REQUIRED: set BITBUCKET_CLONE_TOKEN (marked "Secured") in
@@ -196,6 +198,9 @@ pipelines:
     # -------------------------------------------------------------------------
     # Feature branches represent new functionality. They must go through
     # dev first for integration testing before promotion to stg/main.
+    # Note: Code quality checks (lint, typecheck, unit-tests) run in the
+    # default pipeline on every push. This PR pipeline validates branch
+    # routing and performs AI code review only.
     "feature/*":
       # Gate steps below use atlassian/default-image:4 (not python:3.12.7)
       # because gates only run bash/shell — no Python needed. The default
@@ -214,16 +219,15 @@ pipelines:
                 [ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
               done
               echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
-      - parallel:
-          - step: *lint
-          - step: *typecheck
-          - step: *unit-tests
       - step: *ai-code-review
 
     # -------------------------------------------------------------------------
     # bugfix/* → dev only
     # -------------------------------------------------------------------------
     # Bug fixes follow the same path as features — must land in dev first.
+    # Note: Code quality checks (lint, typecheck, unit-tests) run in the
+    # default pipeline on every push. This PR pipeline validates branch
+    # routing and performs AI code review only.
     "bugfix/*":
       - step:
           name: "Gate: bugfix → dev"
@@ -239,10 +243,6 @@ pipelines:
                 [ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
               done
               echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
-      - parallel:
-          - step: *lint
-          - step: *typecheck
-          - step: *unit-tests
       - step: *ai-code-review
 
     # -------------------------------------------------------------------------
@@ -250,6 +250,9 @@ pipelines:
     # -------------------------------------------------------------------------
     # Hotfixes are urgent production fixes. They can go directly to main
     # (fast-track) or to dev (to keep the dev branch in sync).
+    # Note: Code quality checks (lint, typecheck, unit-tests) run in the
+    # default pipeline on every push. This PR pipeline validates branch
+    # routing and performs AI code review only.
     "hotfix/*":
       - step:
           name: "Gate: hotfix → main or dev"
@@ -265,10 +268,6 @@ pipelines:
                 [ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
               done
               echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
-      - parallel:
-          - step: *lint
-          - step: *typecheck
-          - step: *unit-tests
       - step: *ai-code-review
 
     # -------------------------------------------------------------------------
@@ -276,6 +275,9 @@ pipelines:
     # -------------------------------------------------------------------------
     # Once features/fixes are integrated in dev, a PR from dev to stg
     # promotes the code to staging for final validation.
+    # Note: Code quality checks (lint, typecheck, unit-tests) run in the
+    # default pipeline on every push. This PR pipeline validates branch
+    # routing and performs AI code review only.
     dev:
       - step:
           name: "Gate: dev → stg"
@@ -291,10 +293,6 @@ pipelines:
                 [ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
               done
               echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
-      - parallel:
-          - step: *lint
-          - step: *typecheck
-          - step: *unit-tests
       - step: *ai-code-review
 
     # -------------------------------------------------------------------------
@@ -302,6 +300,9 @@ pipelines:
     # -------------------------------------------------------------------------
     # Final promotion: staging to main. After this merges, the code is
     # ready for a production release via the custom release-prod pipeline.
+    # Note: Code quality checks (lint, typecheck, unit-tests) run in the
+    # default pipeline on every push. This PR pipeline validates branch
+    # routing and performs AI code review only.
     stg:
       - step:
           name: "Gate: stg → main"
@@ -317,10 +318,6 @@ pipelines:
                 [ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
               done
               echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
-      - parallel:
-          - step: *lint
-          - step: *typecheck
-          - step: *unit-tests
       - step: *ai-code-review
 
 
@@ -441,6 +438,15 @@ pipelines:
                 exit 1
               fi
             - export RELEASE_TAG="$(cat release_tag.txt)"
+            # Validate tag format before deployment — reject corrupted/empty tags.
+            # Regex: v followed by three version numbers (no leading zeros).
+            # Escaped dots: \. matches literal dots, not any character.
+            - |
+              if ! [[ "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+                echo "BLOCKED: invalid release tag format: $RELEASE_TAG"
+                echo "Expected format: v#.#.# (e.g., v1.2.3, no leading zeros)"
+                exit 1
+              fi
             - echo "Deploying ${RELEASE_TAG}"
 
             # DEPLOY_COMMAND is a repository variable configured in