@@ -29,11 +29,11 @@ body:
     attributes:
       label: Reviewer name / affiliation
       description: >-
-        Who is filing this? Cite an organisation (e.g. "Frazer &
-        Nash Consultancy") or a static-review tool name. The
-        affiliation goes in the issue, not in the codebase — see
-        ``CONTRIBUTING.md`` on neutral provenance wording.
-      placeholder: "e.g. Frazer & Nash Consultancy / GitHub Codex / SonarQube"
+        Who is filing this? Name your organisation or the static-
+        review tool you used. The affiliation goes in the issue,
+        not in the codebase — see ``CONTRIBUTING.md`` on neutral
+        provenance wording.
+      placeholder: "engineering consultancy / static-analysis tool / individual reviewer"
     validations:
       required: true
 
 
@@ -17,20 +17,23 @@
 # - ``workflow_dispatch`` — maintainers fire it from the Actions UI
 #   before any tagged release (``docs/release_checklist.rst`` step 2
 #   references this workflow).
-# - Weekly cron (Monday 09:00 UTC) — catches drift in upstream HEAD
-#   (the manifest's per-repo SHA pins are still ``TBD`` as of 1.8.0;
-#   once populated, the workflow becomes byte-reproducible).
+# - Weekly cron (Monday 09:00 UTC) — runs the same pinned snapshot
+#   every Monday so a regression in pybmodes itself surfaces on a
+#   stable baseline. To catch upstream-deck *drift* against newer
+#   HEADs, bump the manifest SHAs through the
+#   ``verify_external_data.py --update`` path and ship the bump as
+#   its own commit + CHANGELOG entry under *Changed*.
 #
 # Reproducibility note
 # --------------------
 #
-# ``external/MANIFEST.toml`` pins each upstream-clone SHA + file
-# hashes, but the pins are currently the literal string ``TBD`` —
-# populating them is a maintainer action documented in
-# ``docs/release_checklist.rst`` step 2. Until then this workflow
-# clones the upstream HEAD of each repo; once the pins land, the
-# ``checkout`` step below switches to ``git checkout <sha>`` and
-# becomes reproducible byte-for-byte.
+# Each clone below checks out the SHA pinned in
+# ``external/MANIFEST.toml`` (1.8.1 maintainer action; bumped from
+# ``TBD`` in 1.8.0). The workflow is byte-reproducible from the
+# tagged commit — anyone reproducing the published 0.01 % tolerance
+# can re-run the same step set against the same upstream commits.
+# File-hash pins (the ``hashes`` tables in the manifest) remain
+# empty pending the ``verify_external_data.py --update`` rewrite.
 
 name: Validation (external data)
 
@@ -61,13 +64,16 @@ jobs:
           pip install -e ".[dev,plots,windio,notebook]"
 
       # ---------------------------------------------------------------
-      # Clone upstream external data into the expected layout.
+      # Clone upstream external data into the expected layout, pinned
+      # to the SHAs in ``external/MANIFEST.toml``.
       #
-      # Each clone path matches ``relative_path`` in
-      # ``external/MANIFEST.toml`` so the integration test suite
-      # resolves the decks at the same paths it does locally. Shallow
-      # clones (``--depth=1``) — the integration suite only reads the
-      # tip of each upstream tree.
+      # Each clone path matches ``relative_path`` in the manifest so
+      # the integration test suite resolves the decks at the same
+      # paths it does locally. We fetch the full git history (no
+      # ``--depth=1``) so the explicit-SHA ``git checkout`` step
+      # can resolve commits older than the shallow tip. Workflow run
+      # time is dominated by the integration suite itself, not the
+      # clones, so the extra fetch is cheap.
       #
       # BModes (CertTest 03 / 04 reference data) is NOT on GitHub; the
       # tests that depend on it skip cleanly when the data is absent
@@ -77,20 +83,33 @@ jobs:
       # code.
       # ---------------------------------------------------------------
 
-      - name: Clone OpenFAST r-test (NREL 5MW land / monopile / OC3 spar)
+      - name: Clone OpenFAST r-test at manifest-pinned SHA
+        # 1.8.1 manifest pin (NREL 5MW land / monopile / OC3 spar
+        # regression decks). Full 40-char SHA matches what
+        # ``scripts/verify_external_data.py`` compares ``git rev-parse
+        # HEAD`` against — abbreviated SHAs in the manifest would
+        # silently FAIL the verifier (static review on PR #81).
         run: |
-          git clone --depth=1 https://github.com/OpenFAST/r-test.git \
+          git clone https://github.com/OpenFAST/r-test.git \
             external/OpenFAST_files/r-test
+          git -C external/OpenFAST_files/r-test \
+            checkout dd5feaaaa500ba7283140107806300d551cff0a7
 
-      - name: Clone IEA-3.4-130-RWT
+      - name: Clone IEA-3.4-130-RWT at manifest-pinned SHA
         run: |
-          git clone --depth=1 https://github.com/IEAWindTask37/IEA-3.4-130-RWT.git \
+          git clone https://github.com/IEAWindTask37/IEA-3.4-130-RWT.git \
             external/OpenFAST_files/IEA-3.4-130-RWT
+          git -C external/OpenFAST_files/IEA-3.4-130-RWT \
+            checkout 824f8d65196f9f84ee66df5e58e3a48a70a8f0c5
 
-      - name: Clone IEA-15-240-RWT
+      - name: Clone IEA-15-240-RWT at manifest-pinned SHA
+        # 1.8.1 manifest pin (v1.1 tower redesign — Allen 2020
+        # free-decay reference).
         run: |
-          git clone --depth=1 https://github.com/IEAWindTask37/IEA-15-240-RWT.git \
+          git clone https://github.com/IEAWindTask37/IEA-15-240-RWT.git \
             external/OpenFAST_files/IEA-15-240-RWT
+          git -C external/OpenFAST_files/IEA-15-240-RWT \
+            checkout 86d51c8a1ee65be4f3686087a5c443c0b57e5cfb
 
       # ---------------------------------------------------------------
       # Run the verifier + integration suite.
@@ -109,15 +128,15 @@ jobs:
       - name: Generate verifier report
         # The verifier script exits 0 on PASS + WARN and 1 on FAIL
         # (see ``scripts/verify_external_data.py`` lines 246-248).
-        # WARN is the current TBD-pins state inherited from before
-        # 1.8.0 — the workflow should NOT fail on WARN since the
-        # maintainer-action to populate the manifest is out of scope
-        # for the workflow itself. FAIL means a clone drifted from a
-        # populated pinned SHA — that IS a release blocker and the
-        # workflow should fail. So we run the verifier with its
-        # natural exit-code semantics (no ``continue-on-error: true``)
-        # — Codex P1 review on PR #79 caught the original
-        # ``continue-on-error: true`` swallowing FAILs.
+        # As of 1.8.1 every clone SHA is populated in the manifest,
+        # so a healthy run produces PASS on every entry except
+        # ``bmodes`` (which stays WARN because BModes is a NREL
+        # download, not a GitHub clone — see the *Enforcement*
+        # paragraph in VALIDATION.md). FAIL means a clone drifted
+        # from its populated pinned SHA — release blocker. We use
+        # the verifier's natural exit-code semantics with no
+        # ``continue-on-error: true`` (PR #79 static-review pass
+        # caught the original swallowing-of-FAILs).
         #
         # ``set -o pipefail`` ensures the verifier's exit code is
         # preserved through the ``tee`` pipe; without it ``tee``
 
@@ -10,6 +10,48 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 (nothing yet)
 
+## [1.8.1] — 2026-05-21
+
+External-review follow-up patch on top of 1.8.0. No public-API
+change; no numerical change; no behaviour change. Three governance
++ reproducibility items addressed:
+
+### Changed
+
+- **Scrubbed AI-assistant / tool-vendor attribution from tracked
+  content** (eleven sites across ``CHANGELOG.md``,
+  ``.github/workflows/validation.yml``,
+  ``src/pybmodes/workflows/batch.py``,
+  ``tests/test_io_errors.py``, ``tests/test_workflows.py``, and
+  ``.github/ISSUE_TEMPLATE/code_review.yml``). The
+  ``CONTRIBUTING.md`` no-tool-attribution rule existed but the
+  Phase 4 round had quietly re-introduced named references through
+  the per-finding follow-up commits — a governance self-
+  contradiction caught by the post-1.8.0 external review. All
+  references now use neutral provenance wording ("static review",
+  "static-review pass") plus the PR number for audit trail.
+- **Populated the external-data manifest's per-clone SHA pins.**
+  ``external/MANIFEST.toml`` carried ``sha = "TBD"`` for all eight
+  upstream clones in 1.8.0 — ``validation.yml`` therefore cloned
+  upstream HEAD with ``--depth=1``, making the workflow
+  reproducible-as-process but not byte-reproducible. Every clone
+  now has a real commit SHA (read from the maintainer's local
+  ``external/`` clones at the 1.8.1 release-prep snapshot), and
+  ``validation.yml`` checks out each pinned SHA explicitly after
+  the clone. The workflow is now byte-reproducible from the tagged
+  commit. File-hash pins (the manifest's ``hashes`` tables) remain
+  empty pending the ``verify_external_data.py --update`` rewrite —
+  that's a follow-up maintainer action separate from this patch.
+- **Tightened the validation-workflow coverage claim** in
+  ``README.md`` and ``VALIDATION.md``. The 1.8.0 text said the
+  workflow validates "the IEA-Task-37 reference turbines" plural,
+  but it only actually clones IEA-3.4-130-RWT and IEA-15-240-RWT;
+  the broader claim implied IEA-10 / IEA-22 / WISDEM / MoorPy /
+  RAFT were also exercised. Both files now name the three
+  upstreams the workflow actually clones (OpenFAST r-test +
+  IEA-3.4 + IEA-15) and call out the remaining manifest clones as
+  reproducibility-pinned but not CI-exercised.
+
 ## [1.8.0] — 2026-05-21
 
 Multi-phase architecture refactor + project-infrastructure round +
@@ -128,8 +170,8 @@ change. Four threads landed:
   ``OutParseError``, ``SubDynParseError``, ``WindIOParseError``)
   let library callers catch parse errors precisely. Twenty-nine
   regression tests pin hashability and ``__eq__`` semantics
-  (Codex caught the original ``@dataclass`` shadowing of
-  ``__hash__`` post-merge).
+  (static review caught the original ``@dataclass`` shadowing of
+  ``__hash__`` post-merge — see PR #68 follow-up).
 - **Centralised numerical options dataclasses** (Phase 1 PR A1):
   :class:`pybmodes.options.SolverOptions`,
   :class:`pybmodes.options.FitOptions`,
@@ -232,8 +274,8 @@ Phase 4 — external-review hardening
   ``run_patch`` keeps ``backup=False`` default), ``output_dir``
   (per-deck destination namespaces on the deck's *relative path
   under root* to avoid stem collisions between sibling sub-trees,
-  fix from Codex P1 review). Addresses external-review finding
-  P1-3.
+  fix from PR #77 static-review pass). Addresses external-review
+  finding P1-3.
 - **``run_windio`` ``on_skip`` policy** (Phase 4 PR D2, merged in
   #78). Three policies: ``"warn"`` (legacy permissive),
   ``"fail-on-data"`` (**new default** — computational skips toggle
@@ -279,7 +321,7 @@ Phase 4 — external-review hardening
   ``axhline``s) keep the original full-axis comb. Backward-compatible
   on ``rpm.min() == 0``. Regression test ``test_plot_campbell_blade_
   label_anchored_on_curve_for_positive_rpm`` pins the new behaviour.
-- **``pybmodes.io.ParseError`` hashability** (PR #68 Codex P2
+- **``pybmodes.io.ParseError`` hashability** (PR #68 static-review
   follow-up). The original ``@dataclass`` decorator on the
   ``ParseError`` base shadowed ``__hash__`` to ``None``, breaking
   ``set(exceptions)`` callers. Switched to ``@dataclass(eq=False)``
 
@@ -7,7 +7,7 @@
 
 `pybmodes` is a pure-Python finite-element library for wind-turbine blade and tower modal analysis. It reads OpenFAST (ElastoDyn / SubDyn / HydroDyn / MoorDyn), BModes `.bmi`, and WISDEM / WindIO ontology YAML inputs; solves the coupled flap–lag–torsion–axial vibration modes with a 15-DOF Bernoulli-Euler beam element; and emits ElastoDyn-compatible mode-shape polynomials, MAC-tracked Campbell diagrams, and bundled Markdown / HTML / CSV reports.
 
-Validated against the BModes Fortran reference solver on six benchmark cases (NREL 5MW land + OC3 monopile + OC3 Hywind floating spar, IEA-3.4-130-RWT, BModes CertTest 03 / 04) to **better than 0.01 %** on every comparison. As of 1.8.0 the dedicated [Validation workflow](https://github.com/SMI-Lab-Inha/pyBModes/actions/workflows/validation.yml) (weekly cron + `workflow_dispatch`) enforces the strict tolerance in CI for every case whose external data is **clonable from a public GitHub upstream** — the NREL 5MW r-test family (via [`OpenFAST/r-test`](https://github.com/OpenFAST/r-test)) and the IEA-Task-37 reference turbines (via [`IEAWindTask37/IEA-*-RWT`](https://github.com/IEAWindTask37)). The two BModes CertTest cases (Test03, Test04) depend on `external/BModes`, which is a NREL download (not a GitHub repo) and is not redistributable in CI; those tests skip cleanly when the data is absent and remain a maintainer-local enforcement until the BModes archive is mirrored somewhere CI can clone. The per-PR `ci.yml` continues to run the self-contained suite (synthetic + closed-form-referenced) and tolerates "no tests collected" on the integration step when the runner has no upstream data. See [`VALIDATION.md`](VALIDATION.md) for the full per-case matrix with external-data flags and [`external/MANIFEST.toml`](https://github.com/SMI-Lab-Inha/pyBModes/blob/master/external/MANIFEST.toml) for the pinned SHAs + file hashes you can verify against.
+Validated against the BModes Fortran reference solver on six benchmark cases (NREL 5MW land + OC3 monopile + OC3 Hywind floating spar, IEA-3.4-130-RWT, BModes CertTest 03 / 04) to **better than 0.01 %** on every comparison. As of 1.8.0 the dedicated [Validation workflow](https://github.com/SMI-Lab-Inha/pyBModes/actions/workflows/validation.yml) (weekly cron + `workflow_dispatch`) enforces the strict tolerance in CI for the cases whose external data is clonable from a public GitHub repository **at a manifest-pinned SHA**: the NREL 5MW family in [`OpenFAST/r-test`](https://github.com/OpenFAST/r-test) and the [`IEA-3.4-130-RWT`](https://github.com/IEAWindTask37/IEA-3.4-130-RWT) and [`IEA-15-240-RWT`](https://github.com/IEAWindTask37/IEA-15-240-RWT) reference-turbine repositories. The remaining Task-37 turbines (IEA-10, IEA-22) plus WISDEM / MoorPy / RAFT cross-reference clones are recorded in the manifest for reproducibility but not currently cloned by the workflow; they're maintainer-local checks. The two BModes CertTest cases (Test03, Test04) depend on `external/BModes`, a NREL download not on GitHub; those tests skip cleanly when the data is absent and stay maintainer-local enforcement. The per-PR `ci.yml` continues to run the self-contained suite (synthetic + closed-form-referenced) and tolerates "no tests collected" on the integration step when the runner has no upstream data. See [`VALIDATION.md`](VALIDATION.md) for the full per-case matrix and [`external/MANIFEST.toml`](https://github.com/SMI-Lab-Inha/pyBModes/blob/master/external/MANIFEST.toml) for the byte-pinned SHAs.
 
 ## Documentation
 
 
@@ -18,12 +18,26 @@ IEA-Task-37 repositories on the fly and runs ``pytest -m integration``
 verifier report uploaded by every run is the machine-checkable
 record that the workflow's coverage holds at the tagged commit.
 
-The workflow validates every case in the *Needs external data*
-column whose upstream is **clonable from a public GitHub
-repository**: the NREL 5MW r-test family (via
-[`OpenFAST/r-test`](https://github.com/OpenFAST/r-test)) and the
-IEA-Task-37 reference turbines (via
-[`IEAWindTask37/IEA-*-RWT`](https://github.com/IEAWindTask37)).
+The workflow validates the cases in the *Needs external data*
+column whose upstream is clonable from a public GitHub repository
+**at a manifest-pinned SHA** (every clone in
+``external/MANIFEST.toml`` got a real commit SHA in 1.8.1). Three
+upstreams are actively cloned by ``validation.yml``:
+
+- [`OpenFAST/r-test`](https://github.com/OpenFAST/r-test) — the
+  NREL 5MW land + monopile + OC3 Hywind regression decks.
+- [`IEAWindTask37/IEA-3.4-130-RWT`](https://github.com/IEAWindTask37/IEA-3.4-130-RWT)
+  — IEA-3.4 reference turbine.
+- [`IEAWindTask37/IEA-15-240-RWT`](https://github.com/IEAWindTask37/IEA-15-240-RWT)
+  — IEA-15 (v1.1 tower; Allen 2020 free-decay reference).
+
+The remaining manifest clones — IEA-10 (``iea_10_198``), IEA-22
+(``iea_22_280``), WISDEM, MoorPy, RAFT — are pinned in the manifest
+for reproducibility but the integration suite does not currently
+exercise them; they're cross-reference / future-validation
+artefacts that stay maintainer-local until a corresponding test
+lands. Adding a new turbine to the CI-enforced set is a deliberate
+maintainer action documented under *Changed* in the CHANGELOG.
 
 The two BModes CertTest cases (Test03, Test04) depend on
 ``external/BModes``, a [NREL BModes download](https://www.nrel.gov/wind/nwtc/bmodes.html)