chore(release): v1.1.0 with a validated single-source release version

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -29,7 +29,7 @@ body:
     attributes:
       label: Workflow and CLI version
       description: Record the workflowVersion from run-state.json and the installed skill version when known.
-      placeholder: workflow 1.1, skill 1.0.0
+      placeholder: workflow 1.1, skill 1.1.0
     validations:
       required: false
   - type: dropdown

AGENTS.md

@@ -28,8 +28,12 @@ When documentation and runtime behavior disagree, verify the CLI and tests, then
 - `validate` distinguishes valid-incomplete, valid-complete, and invalid state. Structural validation is not semantic assurance.
 - Stage-gate approval requires at least 8/10, no zero dimension, and zero blockers.
 - A requested revision must retain its ID and be resolved by an upstream artifact change or an explicit no-change disposition.
+- `package.json` is the single source of truth for the release version. `SKILL.md` metadata, `CITATION.cff`, the README version badge, and a dated `CHANGELOG.md` release section must match it; `npm run validate` fails on any partial bump.
+- Do not hardcode the release version anywhere else. Scripts that need it must read it from `package.json` or the shipped `SKILL.md` frontmatter.
 - The CLI is single-writer. Do not introduce concurrent state mutation without a designed locking/generation protocol and cross-platform tests.
 - Preserve atomic state replacement, managed-path containment, symlink rejection, non-overwrite behavior, and explicit exit classes.
+- Preflight the complete initialization layout before the first scaffold write; a late path conflict must leave earlier missing files untouched.
+- Keep `currentPhase` equal to the latest non-pending phase and keep stage-gate score, dimensions, blockers, and decision metadata consistent with the gate status.
 - Never convert skipped or zero-execution host checks into a pass.
 
 ## Implementation Style
@@ -39,6 +43,7 @@ When documentation and runtime behavior disagree, verify the CLI and tests, then
 - Validate arguments and current state before filesystem mutation.
 - Use workspace-relative managed paths; reject traversal, symlinks, type conflicts, and unsafe slugs.
 - Preserve the previous valid `run-state.json` if a write fails.
+- Repository validators and test fixtures must not follow symlinked directories or copy ignored local workflow/secrets into disposable repository clones.
 - Keep exit codes stable: `0` success, `2` usage, `3` workflow/inconclusive state, `4` filesystem or safety failure.
 - Add focused regression tests for every reproduced defect and verify rejected mutations leave state/artifacts unchanged.
 - Do not weaken tests, hide expected failures, or rewrite unrelated user changes to make a gate pass.
@@ -51,6 +56,7 @@ Update all affected surfaces when behavior changes:
 - Required artifact heading or field: asset template, CLI contract table, benchmark fixture, tests, example run, and traceability guidance.
 - Host claim: README matrix, `references/compatibility.md`, and a dated eval with the exact host/version/check executed.
 - Package/release process: `RELEASING.md`, repository validator, changelog, and public wording.
+- Release version: `package.json` first, then `skills/agentic-rd-skill/SKILL.md` metadata, `CITATION.cff`, the README badge, and a dated `CHANGELOG.md` section. Confirm with `npm run validate` rather than by inspection.
 - Security boundary: `SECURITY.md`, `quality-and-safety.md`, tests, and threat notes in the change description.
 
 Do not copy current package bytes or benchmark point values into undated README prose. Keep point-in-time measurements in dated eval files and make `npm run benchmark` the current source.

CHANGELOG.md

@@ -2,12 +2,18 @@
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-08-01
+
+Workflow contract 1.1 is now released. Existing workflow 1.0 state remains readable and there is no breaking change to the v1 artifact layout or CLI surface.
+
 ### Added
 
 - Added workflow contract 1.1 with minimum phase headings, stable finding-coverage tables, safe multi-artifact scaffolding, configurable human-review metadata, and explicit valid-incomplete versus valid-complete output.
 - Added durable revision IDs, upstream-artifact fingerprints, and explicit no-change dispositions for stage-gate reapproval.
 - Added deterministic coverage for zero-host smoke behavior and the newly reproduced setup, revision-bypass, and invalid-state mutation paths.
 - Added repository-wide `AGENTS.md` instructions and a maintainer release-integrity checklist.
+- Added a repository-validated release-version invariant: `package.json` is the single source of truth and `npm run validate` now fails when `SKILL.md` metadata, `CITATION.cff`, the README version badge, or a dated `CHANGELOG.md` release section disagrees with it.
+- Added a regression test that mutates a copied repository tree to prove the release-version invariant reports drift on every checked surface.
 
 ### Changed
 
@@ -22,6 +28,17 @@
 - Prevented stage-gate reapproval from silently bypassing a requested revision.
 - Prevented `advance` and `finalize` from mutating state that fails full workflow validation.
 - Clarified protected tag/version selection versus GitHub immutable-release guarantees.
+- Fixed the model-backed host smoke asserting a hardcoded `1.0.0` activation marker; it now reads the shipped `SKILL.md` metadata version, so a release bump can no longer make the activation check assert a version the package does not declare.
+- Fixed the repository validator's Markdown walk descending into the local `.venv` and treating the ignored local `project-brief.md` dogfood artifact as tracked source, which made link validation depend on the contributor's local environment. A directory whose name ends in `.md` is also no longer misread as a file.
+- Preflighted every managed initialization destination before the first write so a late file/directory conflict cannot leave partial scaffolding behind.
+- Rejected contradictory `currentPhase` and stage-gate decision metadata before a state-changing command can persist a newly invalid workflow.
+- Stopped repository Markdown validation from following symlinked directories and restricted disposable test copies to project-owned roots instead of ignored local files.
+- Reported malformed `package.json` content as a validation failure instead of crashing the repository validator.
+
+### Known Issues
+
+- Symlink-rejection tests are skipped with `EPERM` on Windows hosts that cannot create symlinks; the Linux and macOS CI jobs remain the authoritative coverage for those paths.
+- `npm run smoke:hosts` remains environment-dependent and exits 3 with `inconclusive` when no eligible host CLI is installed. The host activation matrix is still the dated 2026-07-18 snapshot and was not rerun for this release.
 
 ## [1.0.0] - 2026-07-31
 

CITATION.cff

@@ -5,6 +5,6 @@ authors:
   - family-names: Gasperini
     given-names: Michael
 url: "https://github.com/TheStreamCode/agentic-rd-skill"
-version: "1.0.0"
-date-released: 2026-07-31
+version: "1.1.0"
+date-released: 2026-08-01
 license: MIT

README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/TheStreamCode/agentic-rd-skill/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/TheStreamCode/agentic-rd-skill/actions/workflows/ci.yml)
 [![Agent Skills](https://img.shields.io/badge/Agent%20Skills-open%20standard-0969da)](https://agentskills.io/specification)
-[![Version](https://img.shields.io/badge/version-1.0.0-2ea44f)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-1.1.0-2ea44f)](CHANGELOG.md)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 Agentic R&D Skill is an open-source, portable multi-agent research and development workflow for Codex, Claude Code, GitHub Copilot, Gemini CLI, and OpenCode. It turns complex technical, product, business, feasibility, strategy, and investigation briefs into traceable evidence, executable plans, reviewed results, and gated final reports—without requiring a provider-specific LLM SDK.
@@ -153,7 +153,7 @@ work/
 
 The final output can be created only after a stage-gate score of at least 8/10, no zero-scored dimension, and no blocker. The CLI deliberately refuses v0.3 workspaces rather than guessing at a migration.
 
-New runs use workflow contract 1.1: setup stays in progress until the filled brief and run log pass their minimum artifact contracts. Material findings receive stable IDs and coverage tables. Existing workflow 1.0 state remains readable.
+New runs use workflow contract 1.1, released in skill version 1.1.0: setup stays in progress until the filled brief and run log pass their minimum artifact contracts. Material findings receive stable IDs and coverage tables. Existing workflow 1.0 state remains readable.
 
 Common commands:
 
@@ -198,13 +198,17 @@ gh skill publish --dry-run
 
 [`evals/manifest.json`](evals/manifest.json) defines repeatable activation, safety, failure, gating, and efficiency scenarios. Metrics are recorded only when the host exposes them. This project does not claim cost, speed, or quality improvements without a measured comparison.
 
+The dated [`v1.1.0 security review`](evals/security-review-v1.1.0.md) records the filesystem, state-integrity, secret-handling, and release-surface checks performed for this release, including residual single-writer and host-verification limitations.
+
 The local benchmark uses a completed standard-profile workspace with four evidence artifacts, four execution artifacts, two result artifacts, and about 126 KiB of artifact data. It measures fresh-process `init`, `status`, and `validate` latency and enforces deliberately broad regression budgets; it is a CLI guardrail, not a claim about model response time or research quality. See the [v1.0.0 dogfood](evals/dogfood-v1.0.0.md) for the current real-case workflow evaluation and [`evals/usability-review.md`](evals/usability-review.md) for the earlier UX snapshot.
 
 Run `npm run benchmark` for the current package size and local timing snapshot. CI enforces broad limits of 256 KiB for the installable package and p95 limits of 750 ms for `init`, 500 ms for `status`, and 750 ms for `validate`. These guardrails cover local workflow bookkeeping, not model latency, token cost, or research quality; avoiding copied point-in-time numbers prevents README drift.
 
 ## Versioning
 
-Version 1.0 introduced the breaking artifact layout and state contract. Unreleased workflow contract 1.1 adds truthful setup state, minimum artifact headings, revision history, and pre-mutation validation while retaining read compatibility with v1.0 state. The CLI intentionally does not migrate v0.3 runs.
+The project follows semantic versioning. Version 1.0 introduced the breaking artifact layout and state contract. Version 1.1 released workflow contract 1.1, which adds truthful setup state, minimum artifact headings, revision history, and pre-mutation validation while retaining read compatibility with v1.0 state. The CLI intentionally does not migrate v0.3 runs.
+
+`package.json` is the single source of truth for the release version. `npm run validate` fails when the skill metadata, citation file, README badge, or dated changelog section disagrees with it, so a partial version bump cannot reach a tag.
 
 ## Frequently Asked Questions
 
@@ -234,7 +238,7 @@ The stage gate scores alignment, evidence quality, execution correctness, risk a
 
 ## Maintainer, Citation, and Support
 
-Agentic R&D Skill is maintained by [Michael Gasperini (Mikesoft)](https://mikesoft.it) through [TheStreamCode](https://github.com/TheStreamCode). Deterministic workflow/package checks were last rerun on July 31, 2026; the host activation matrix is a separate dated snapshot documented in the compatibility reference. Maintainers should follow [RELEASING.md](RELEASING.md) so release integrity and evidence dates are verified independently.
+Agentic R&D Skill is maintained by [Michael Gasperini (Mikesoft)](https://mikesoft.it) through [TheStreamCode](https://github.com/TheStreamCode). Deterministic workflow/package checks were last rerun on August 1, 2026; the host activation matrix is a separate dated snapshot documented in the compatibility reference. Maintainers should follow [RELEASING.md](RELEASING.md) so release integrity and evidence dates are verified independently.
 
 For academic or published use, cite the project using [`CITATION.cff`](CITATION.cff). Contributions are welcome through the [contribution guide](CONTRIBUTING.md), and security issues should follow the [security policy](SECURITY.md).
 

RELEASING.md

@@ -5,7 +5,7 @@ Use this checklist for every stable release. A passing local suite does not auth
 ## Prepare
 
 1. Start from a clean `main` checkout synchronized with `origin/main`.
-2. Align the intended version in `package.json`, `CITATION.cff`, `skills/agentic-rd-skill/SKILL.md`, README badge, and `CHANGELOG.md`.
+2. Set the intended version in `package.json`, then align `skills/agentic-rd-skill/SKILL.md` metadata, `CITATION.cff`, the README version badge, and a dated `CHANGELOG.md` release section. `npm run validate` enforces this alignment and fails on a partial bump, so run it before continuing rather than checking each file by hand.
 3. Review public host/version evidence separately from deterministic CLI evidence. Date every activation snapshot and keep untested hosts labeled as documentation-only.
 4. Run:
 

SECURITY.md

@@ -16,6 +16,8 @@ Use GitHub private vulnerability reporting or a security advisory for sensitive
 - Web pages, repositories, documents, logs, issues, and tool output are untrusted data and may contain prompt injection.
 - The portable skill does not pre-approve tools. Host permission, sandbox, workspace trust, and organizational policy remain authoritative.
 - The CLI refuses symlinked managed paths, unknown flags, incompatible state, out-of-order phases, mutation from globally invalid state, and finalization before approval.
+- Initialization validates every managed destination before its first scaffold write, so a late path conflict does not leave partial workflow files behind.
+- Repository validation does not follow symlinked documentation directories, and disposable validation fixtures copy only project-owned roots rather than ignored local workflow or secret files.
 - Workflow 1.1 verifies minimum artifact headings and revision fingerprints. These are integrity and traceability controls, not proof that Markdown claims are true or independently reviewed.
 - Revision fingerprints show whether upstream artifact bytes changed after a request; they are not signatures, provenance attestations, or protection against a malicious workspace owner.
 - The state CLI assumes one writer. Concurrent commands in the same workspace are outside the supported threat model until locking or generation checks are designed and tested.

evals/security-review-v1.1.0.md

@@ -0,0 +1,50 @@
+# v1.1.0 Security Review
+
+Snapshot: 2026-08-01 on Windows 11 with Node.js 24.18.0, npm 11.16.0, Python 3.12.10, and GitHub CLI 2.96.0. This is a repository-grounded maintainer review, not a third-party audit or a guarantee of semantic correctness.
+
+## Executive Summary
+
+No critical or high-severity vulnerability was identified in the dependency-free skill package or local workflow CLI. Four defense-in-depth findings were corrected before release: atomic initialization preflight, stricter workflow-state coherence, non-following repository document traversal, and narrower disposable test copies. No tracked credential pattern was found, and the installable skill remained free of runtime dependencies.
+
+## Scope And Method
+
+- Reviewed the installable package, CLI state transitions, managed-path operations, repository validators, benchmarks, host-smoke runner, tests, GitHub Actions, release metadata, and public documentation.
+- Examined process execution, filesystem writes, symlink handling, path containment, temporary-directory cleanup, environment inheritance, release version synchronization, and package contents.
+- Ran syntax checks, repository validation, deterministic tests, realistic benchmarks, the hash-pinned Agent Skills reference validator, GitHub skill publish dry-run, tracked-secret pattern checks, and Git integrity checks.
+- Used GitHub API evidence for repository visibility, secret scanning, push protection, pull-request checks, CodeQL, releases, and branch rules.
+
+## Medium Findings
+
+### SEC-01: Late initialization conflicts could leave partial scaffolding
+
+Impact: a repair-style `init` could recreate an earlier missing artifact before discovering that a later managed destination had the wrong file type.
+
+Resolution: `skills/agentic-rd-skill/scripts/rd.mjs:386-400` now dry-runs every managed destination before the first write. A regression test proves a conflicting run-log path leaves the missing brief and existing state unchanged.
+
+### SEC-02: Repository Markdown traversal followed directory symlinks
+
+Impact: a local or malicious checkout could make validation leave the repository root, inspect unintended Markdown, or recurse through a symlink cycle.
+
+Resolution: `scripts/validate-repo.mjs:70-106` now uses non-following file checks and `Dirent` traversal. Symlinked directories are not visited; required symlinked files do not satisfy the regular-file contract.
+
+## Low Findings
+
+### SEC-03: Disposable repository fixtures copied broad local content
+
+The release-version regression fixture copied nearly the whole working directory except a short denylist. `tests/package.test.mjs:11-41` now allowlists project-owned roots, excluding ignored root-level workflow artifacts, environment files, logs, and unrelated local material.
+
+### SEC-04: Malformed package metadata could abort validation
+
+`scripts/validate-repo.mjs:181-205` now converts JSON parse failure into an explicit repository-validation finding. The validator continues reporting the fault without an uncaught exception.
+
+## Residual Risks And Limitations
+
+- The workflow state machine remains intentionally single-writer. Concurrent state-changing CLI processes are unsupported until a locking or generation protocol is designed and tested.
+- Structural heading, coverage, fingerprint, and gate checks do not establish that artifact claims are true, unbiased, or independently reviewed.
+- Windows could not create symlinks in the local test environment (`EPERM`); Linux and macOS CI remain the authoritative regression coverage for symlink paths.
+- Host discovery was inconclusive because GitHub Copilot CLI and OpenCode were not installed. No model-backed host smoke was run, and the 2026-07-18 activation matrix remains historical evidence.
+- Child host processes inherit the invoking environment so authenticated CLIs can operate. Model-backed smokes remain opt-in and require explicit credential and budget authorization.
+
+## Verification Status
+
+The complete local gate, official Agent Skills validator, and GitHub publish dry-run passed after these changes. Remote CI and CodeQL evidence must be rechecked on the final commit; release, tag, and installation verification remain separate publication gates.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-rd-skill",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "A portable Agent Skill for evidence-aware, stateful multi-agent research and development workflows.",
   "private": true,
   "repository": {